# On the maximal operators of Riesz logarithmic means of Vilenkin-Fourier
series

George Tephnadze  G. Tephnadze, Department of Mathematics, Faculty of Exact
and Natural Sciences, Tbilisi State University, Chavchavadze str. 1, Tbilisi
0128, Georgia and Department of Engineering Sciences and Mathematics, Luleå
University of Technology, SE-971 87, Luleå, Sweden<EMAIL_ADDRESS>
###### Abstract.

The main aim of this paper is to investigate $\left(H_{p},L_{p}\right)$ and
$\left(H_{p},L_{p,\infty}\right)$ type inequalities for maximal operators of
Riesz logarithmic means of one-dimensional Vilenkin-Fourier series.

The research was supported by Shota Rustaveli National Science Foundation
grant no.13/06 (Geometry of function spaces, interpolation and embedding
theorems

2010 Mathematics Subject Classification. 42C10.

Key words and phrases: Vilenkin system, Riesz logarithmic means, martingale
Hardy space.

##  1\.  Introduction

Weak (1,1)-type inequality for the maximal operator of Fejér means
$\sigma^{\ast}$ for Walsh-Fourier series was proved by Schipp [13] and for
Vilenkin system by Pál, Simon [12]. Fujji [4] and Simon [15] verified that the
$\sigma^{\ast}$ is bounded from $H_{1}$ to $L_{1}$. Weisz [22] generalized
this result and proved the boundedness of $\sigma^{\ast}$ from the martingale
Hardy space $H_{p}$ to the space $L_{p},$ for $p>1/2$. Simon [14] gave a
counterexample, which shows that boundedness does not hold for $0<p<1/2.$ The
counterexample for $p=1/2$ due to Goginava [3], (see also [8] and [16]).

Weisz [23] proved that following is true:

Theorem W. The maximal operator of Fejér means $\sigma^{\ast}$ is bounded from
the Hardy space $H_{1/2}$ to the space $L_{1/2,\infty}.$

In [17] and [18] it were proved that the maximal operator $\widetilde{\sigma}$
${}_{p}^{\ast\,},$ defined by

$\widetilde{\sigma}_{p}^{\ast}:=\sup_{n\in\mathbb{N}}\frac{\left|\sigma_{n}\right|}{\left(n+1\right)^{1/p-2}\log^{2\left[1/2+p\right]}\left(n+1\right)},$

where $0<p\leq 1/2$ and $\left[1/2+p\right]$ denotes integer part of $1/2+p,$
is bounded from the Hardy space $H_{p}$ to the space $L_{p}.$

Moreover, for any nondecreasing function
$\varphi:\mathbb{N}_{+}\rightarrow[1,$ $\infty)$ satisfying the condition

(1)
$\overline{\lim_{n\rightarrow\infty}}\frac{\left(n+1\right)^{1/p-2}\log^{2\left[1/2+p\right]}\left(n+1\right)}{\varphi\left(n\right)}=+\infty,$

there exists a martingale $f\in H_{p},$ such that

$\underset{n\in\mathbb{N}}{\sup}\left\|\frac{\sigma_{n}f}{\varphi\left(n\right)}\right\|_{p}=\infty.$

For Walsh-Paley system analogical theorem is proved in [9] and for Walsh-
Kaczmarz system in [10] and [20].

Riesz‘ s logarithmic means with respect to the Walsh system was studied by
Simon [14], Goginava [11], Gát, Nagy [7] and for Vilenkin systems by Gát [6],
Blahota, Gát [2], Tephnadze [19]. In this paper it was proved that maximal
operator of Riesz logarithmic means of Vilenkin-Fourier series is bounded from
the martingale Hardy space $H_{p}$ to the space $L_{p}$ when $p>1/2$ and is
not bounded from the martingale Hardy space $H_{p}$ to the space $L_{p}$ when
$0<p\leq 1/2.$

The main aim of this paper is to investigate $\left(H_{p},L_{p}\right)$ and
$\left(H_{p},L_{p,\infty}\right)$ type inequalities for weighted maximal
operators of Riesz logarithmic means of one-dimensional Vilenkin-Fourier
series.

##  2\. Definitions and Notations

Let $\mathbf{P}_{+}$ denote the set of the positive integers ,
$\mathbf{P}:=\mathbf{P}_{+}\cup\\{0\\}.$

Let $m:=(m_{0,}m_{1},...)$ denote a sequence of the positive integers not less
than 2.

Denote by

$Z_{m_{k}}:=\\{0,1,...m_{k}-1\\}$

the additive group of integers modulo $m_{k}.$

Define the group $G_{m}$ as the complete direct product of the group
$Z_{m_{j}}$ with the product of the discrete topologies of $Z_{m_{j}}$ ,s.

The direct product $\mu$ of the measures

$\mu_{k}\left(\\{j\\}\right):=1/m_{k}\text{ \qquad}(j\in Z_{m_{k}})$

is a Haar measure on $G_{m_{\text{ }}}$with $\mu\left(G_{m}\right)=1.$

If $\sup_{n}m_{n}<\infty$, then we call $G_{m}$ a bounded Vilenkin group. If
the generating sequence $m$ is not bounded then $G_{m}$ is said to be an
unbounded Vilenkin group. In this paper we discuss bounded Vilenkin groups
only.

The elements of $G_{m}$ are represented by sequences

$x:=(x_{0},x_{1},...,x_{j},...)\qquad\left(\text{ }x_{k}\in Z_{m_{k}}\right).$

It is easy to give a base for the neighborhood of $G_{m}$

$I_{0}\left(x\right):=G_{m},$ $I_{n}(x):=\\{y\in G_{m}\mid
y_{0}=x_{0},...y_{n-1}=x_{n-1}\\},\text{ \ }(x\in G_{m},\text{
}n\in\mathbf{P}).$

Denote $I_{n}:=I_{n}\left(0\right)$ for $n\in\mathbf{P}$ and
$\overline{I_{n}}:=G_{m}$ $\backslash$ $I_{n}$.

Let

$e_{n}:=\left(0,0,...,x_{n}=1,0,...\right)\in
G_{m}\qquad\left(n\in\mathbf{P}\right).$

It is evident

(1)
$\overline{I_{M}}=\left(\overset{M-2}{\underset{k=0}{\bigcup}}\overset{m_{k}-1}{\underset{x_{k}=1}{\bigcup}}\overset{M-1}{\underset{l=k+1}{\bigcup}}\overset{m_{l}-1}{\underset{x_{l}=1}{\bigcup}}I_{l+1}\left(x_{k}e_{k}+x_{l}e_{l}\right)\right)\bigcup\left(\underset{k=1}{\bigcup\limits^{M-1}}\overset{m_{k}-1}{\underset{x_{k}=1}{\bigcup}}I_{M}\left(x_{k}e_{k}\right)\right).$

If we define the so-called generalized number system based on $m$ in the
following way :

$M_{0}:=1,\text{ \qquad}M_{k+1}:=m_{k}M_{k\text{ }}\ \qquad(k\in\mathbf{P}).$

then every $n\in\mathbf{P}$ can be uniquely expressed as
$n=\overset{\infty}{\underset{k=0}{\sum}}n_{j}M_{j}$ where $n_{j}\in
Z_{m_{j}}$ $~{}(j\in\mathbf{P})$ and only a finite number of $n_{j}`$s differ
from zero. Let $\left|n\right|:=\max$ $\\{j\in\mathbf{P};$ $n_{j}\neq 0\\}.$

Denote by $L_{1}\left(G_{m}\right)$ the usual (one dimensional) Lebesgue
space.

Next, we introduce on $G_{m}$ an orthonormal system which is called the
Vilenkin system.

At first, define the complex valued function
$r_{k}\left(x\right):G_{m}\rightarrow\mathbb{C},$ the generalized Rademacher
functions as

$r_{k}\left(x\right):=\exp\left(2\pi ix_{k}/m_{k}\right)\text{
\qquad}\left(i^{2}=-1,\text{ }x\in G_{m},\text{ }k\in\mathbf{P}\right).$

Now, define the Vilenkin system $\psi:=(\psi_{n}:n\in\mathbf{P})$ on $G_{m}$
as:

$\psi_{n}(x):=\overset{\infty}{\underset{k=0}{\Pi}}r_{k}^{n_{k}}\left(x\right)\text{
\qquad}\left(n\in\mathbf{P}\right).$

Specifically, we call this system the Walsh-Paley one if $m\equiv 2$.

The Vilenkin system is orthonormal and complete in $L_{2}\left(G_{m}\right)$
[1].

Now, we introduce analogues of the usual definitions in Fourier-analysis.

If $f\in L_{1}\left(G_{m}\right)$ we can establish the Fourier coefficients,
the partial sums of the Fourier series, the Fejér means, the Dirichlet and
Fejér kernels with respect to the Vilenkin system $\psi$ in the usual manner:

$\displaystyle\widehat{f}\left(k\right)$ $\displaystyle:$
$\displaystyle=\int_{G_{m}}f\overline{\psi}_{k}d\mu,\text{ \ \ \ \ \
}\left(\text{ }k\in\mathbf{P}\text{ }\right),$ $\displaystyle S_{n}f$
$\displaystyle:$
$\displaystyle=\sum_{k=0}^{n-1}\widehat{f}\left(k\right)\psi_{k}\ ,\text{ \ \
\ }\left(\text{ }n\in\mathbf{P}_{+},\text{ }S_{0}f:=0\text{ }\right),$
$\displaystyle\sigma_{n}f$ $\displaystyle:$
$\displaystyle=\frac{1}{n}\sum_{k=0}^{n-1}S_{k}f\text{ },\text{ \ \ \ \ \ \
}\left(\text{ }n\in\mathbf{P}_{+}\text{ }\right),$ $\displaystyle D_{n}$
$\displaystyle:$ $\displaystyle=\sum_{k=0}^{n-1}\psi_{k\text{ }},\text{
\qquad\ \ \ \ \ }\left(\text{ }n\in\mathbf{P}_{+}\text{ }\right),$
$\displaystyle K_{n}$ $\displaystyle:$
$\displaystyle=\frac{1}{n}\overset{n-1}{\underset{k=0}{\sum}}D_{k},\text{ \ \
\ \ \ \ }\left(\text{ }n\in\mathbf{P}_{+}\text{ }\right).$

Recall that

(2) $\quad D_{M_{n}}\left(x\right)=\left\\{\begin{array}[]{l}\text{
}M_{n},\text{\thinspace\thinspace\thinspace\thinspace
if\thinspace\thinspace}x\in I_{n},\\\ \text{
}0,\text{\thinspace\thinspace\thinspace\thinspace\thinspace if
\thinspace\thinspace}x\notin I_{n}.\end{array}\right.$

It is well-known that

(3) $\sup_{n}\int_{G_{m}}\left|K_{n}\right|d\mu\leq c<\infty.$

The norm (or quasi-norm) of the space $L_{p}(G_{m})$ is defined by

$\left\|f\right\|_{p}:=\left(\int_{G_{m}}\left|f\right|^{p}d\mu\right)^{1/p}\qquad\left(0<p<\infty\right).$

The space $L_{p,\infty}\left(G\right)$ consists of all measurable functions
$f$ for which

$\left\|f\right\|_{L_{p,\infty}(G)}:=\underset{\lambda>0}{\sup}\lambda^{p}\mu\left(f>\lambda\right)<+\infty.$

The $\sigma$-algebra generated by the intervals
$\left\\{I_{n}\left(x\right):x\in G_{m}\right\\}$ will be denoted by
$\digamma_{n}$ $\left(n\in\mathbf{P}\right).$ Denote by
$f=\left(f^{\left(n\right)},n\in\mathbf{P}\right)$ a martingale with respect
to $\digamma_{n}$ $\left(n\in\mathbf{P}\right).$ (for details see e.g. [21]).
The maximal function of a martingale $f$ is defend by

$f^{\ast}=\sup_{n\in\mathbf{P}}\left|f^{\left(n\right)}\right|,$

respectively.

In case $f\in L_{1},$ the maximal functions are also given by

$f^{\ast}\left(x\right)=\sup_{n\in\mathbf{P}}\frac{1}{\left|I_{n}\left(x\right)\right|}\left|\int_{I_{n}\left(x\right)}f\left(u\right)\mu\left(u\right)\right|.$

For $0<p<\infty$ the Hardy martingale spaces $H_{p}$ $\left(G_{m}\right)$
consist of all martingales for which

$\left\|f\right\|_{H_{p}}:=\left\|f^{\ast}\right\|_{p}<\infty.$

If $f\in L_{1},$ then it is easy to show that the sequence
$\left(S_{M_{n}}\left(f\right):n\in\mathbf{P}\right)$ is a martingale. If
$f=\left(f^{\left(n\right)},n\in\mathbf{P}\right)$ is martingale then the
Vilenkin-Fourier coefficients must be defined in a slightly different manner:

$\widehat{f}\left(i\right):=\lim_{k\rightarrow\infty}\int_{G_{m}}f^{\left(k\right)}\left(x\right)\overline{\psi}_{i}\left(x\right)d\mu\left(x\right).$

The Vilenkin-Fourier coefficients of $f\in L_{1}\left(G_{m}\right)$ are the
same as those of the martingale
$\left(S_{M_{n}}\left(f\right):n\in\mathbf{P}\right)$ obtained from $f$ .

In the literature, there is the notion of Riesz‘ s logarithmic means of the
Fourier series. The $n$-th Riesz‘s logarithmic means of the Fourier series of
an integrable function $f$ is defined by

$R_{n}f:=\frac{1}{l_{n}}\overset{n}{\underset{k=1}{\sum}}\frac{S_{k}f}{k},$

where $l_{n}:=\sum_{k=1}^{n}\frac{1}{k}.$

The kernels of Riesz‘s logarithmic means is established by

$L_{n}:=\frac{1}{l_{n}}\overset{n}{\underset{k=1}{\sum}}\frac{D_{k}\left(x\right)}{k}.$

For the martingale $f$ we consider the following maximal operators

$\displaystyle\sigma^{\ast}f$ $\displaystyle:$
$\displaystyle=\sup_{n\in\mathbf{P}}\left|\sigma_{n}f\right|,\text{ \ \ \ \ \
\ \ \ \ \ \ \ \
}R^{\ast}f:=\underset{n\in\mathbf{P}}{\sup}\left|R_{n}f\right|,$
$\displaystyle\overset{\sim}{R}^{\ast}f$ $\displaystyle:$
$\displaystyle=\underset{n\in\mathbf{P}}{\sup}\frac{\left|R_{n}f\right|}{\log\left(n+1\right)},\text{
\
}\overset{\sim}{R}_{p}^{\ast}f:=\underset{n\in\mathbf{P}}{\sup}\frac{\log\left(n+1\right)\left|R_{n}f\right|}{\left(n+1\right)^{1/p-2}}.$

A bounded measurable function $a$ is $p$-atom, if there exist a dyadic
interval $I$, such that

$\int_{I}ad\mu=0,\text{ \
}\left\|a\right\|_{\infty}\leq\mu\left(I\right)^{-1/p},\text{\ \
supp}\left(a\right)\subset I.$

##  3\. Formulation of Main Results

######  Theorem 1.

The maximal operator of Riesz logarithmic means $R^{\ast}$ is bounded from the
Hardy space $H_{1/2\text{ }}$ to the space $L_{1/2,\infty}.$

Earlier, It was proved that the maximal operator $R^{\ast}$ is not bounded
form the the Hardy space $H_{1/2\text{ }}$ to the space $L_{1/2}.$ So, it is
interesting to discuss that what type weight we have to apply to get back the
boundedness of the maximal operator. We found the answer in the next theorem.

######  Theorem 2.

a)

The maximal operator$\ \overset{\sim}{R}^{\ast}$is bounded from the Hardy
space $H_{1/2}$ to the space $L_{1/2}.$

b) Let $\varphi:\mathbf{P}_{+}\rightarrow[1,$ $\infty)$ be a nondecreasing
function satisfying the condition

(1)
$\overline{\lim_{n\rightarrow\infty}}\frac{\log\left(n+1\right)}{\varphi\left(n\right)}=+\infty.$

Then the maximal operator

$\sup_{n\in\mathbf{P}}\frac{\left|R_{n}f\right|}{\varphi\left(n\right)}$

is not bounded from the Hardy space $H_{1/2}$ to the space $L_{1/2}.$

######  Theorem 3.

a)

Let $0<p<1/2.$ Then the maximal operator $\overset{\sim}{R}_{p}^{\ast}$ is
bounded from the Hardy space $H_{p}$ to the space $L_{p}.$

b) Let $0<p<1/2$ and $\varphi:\mathbf{P}_{+}\rightarrow[1,$ $\infty)$ be a
nondecreasing function satisfying the condition

(2)
$\frac{\left(n+1\right)^{1/p-2}}{\log\left(n+1\right)\varphi\left(n\right)}=\infty.$

Then the maximal operator

$\sup_{n\in\mathbf{P}}\frac{\left|R_{n}f\right|}{\varphi\left(n\right)}$

is not bounded from the Hardy space $H_{p}$ to the space $L_{p,\infty}.$

##  4\. AUXILIARY PROPOSITIONS

######  Lemma 1.

[24] (Weisz) A martingale $f=\left(f^{\left(n\right)},n\in\mathbf{P}\right)$
is in $H_{p}\left(0<p\leq 1\right)$ if and only if there exist a sequence
$\left(a_{k},k\in\mathbf{P}\right)$ of p-atoms and a sequence
$\left(\mu_{k},k\in\mathbf{P}\right)$ of a real numbers such that for every
$n\in P$

(1) $\qquad\sum_{k=0}^{\infty}\mu_{k}S_{M_{n}}a_{k}=f^{\left(n\right)},$

$\qquad\sum_{k=0}^{\infty}\left|\mu_{k}\right|^{p}<\infty.$

Moreover,
$\left\|f\right\|_{H_{p}}\backsim\inf\left(\sum_{k=0}^{\infty}\left|\mu_{k}\right|^{p}\right)^{1/p}$,
where the infimum is taken over all decomposition of $f$ of the form (1).

######  Lemma 2.

[5] (Gát) Let $A>t,$ $t,A\in\mathbf{P},$ $x\in I_{t}\backslash$ $I_{t+1}.$
Then

$K_{2^{A}}\left(x\right)=\left\\{\begin{array}[]{c}\text{ }2^{t-1},\text{\ \ \
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ if \ \ }x\in I_{A}\left(e_{t}\right),\\\
\left(2^{A}+1\right)/2,\text{ \ if \ \ }x\in I_{A},\text{\ }\\\
0,\text{\qquad\ \ \ \ \ \ \ \ \ \ otherwise.\ \ }\end{array}\right.$

Analogously of Lemma 4 in [18] if we apply Lemma 2 we can prove that following
is true:

######  Lemma 3.

Let $x\in I_{N}\left(x_{k}e_{k}+x_{l}e_{l}\right),$ $\ 1\leq x_{k}\leq
m_{k}-1,$ $1\leq x_{l}\leq m_{l}-1,$ $k=0,...,N-2,$ $\ l=k+1,...,N-1.$ Then

$\int_{I_{N}}\left|K_{n}\left(x-t\right)\right|d\mu\left(t\right)\leq\frac{cM_{l}M_{k}}{nM_{N}},\qquad\text{when
}n\geq M_{N}.$

Let $x\in I_{N}\left(x_{k}e_{k}\right),$ $1\leq x_{k}\leq m_{k}-1,$
$k=0,...,N-1.$ Then

$\int_{I_{N}}\left|K_{n}\left(x-t\right)\right|d\mu\left(t\right)\leq\frac{cM_{k}}{M_{N}},\qquad\text{when
}n\geq M_{N}.$

######  Lemma 4.

Let $x\in I_{N}\left(x_{k}e_{k}+x_{l}e_{l}\right),$ $\ 1\leq x_{k}\leq
m_{k}-1,$ $1\leq x_{l}\leq m_{l}-1,$ $\ k=0,...,N-2,$ $l=k+1,...,N-1.$ Then

$\int_{I_{N}}\text{
}\underset{j=M_{N}+1}{\overset{n}{\sum}}\frac{\left|K_{j}\left(x-t\right)\right|}{j+1}d\mu\left(t\right)\leq\frac{cM_{k}M_{l}}{M_{N}^{2}}.$

Let $x\in I_{N}\left(x_{k}e_{k}\right),$ $1\leq x_{k}\leq m_{k}-1,$ $\
k=0,...,N-1.$ Then

$\int_{I_{N}}\underset{j=M_{N}+1}{\overset{n}{\sum}}\frac{\left|K_{j}\left(x-t\right)\right|}{j+1}d\mu\left(t\right)\leq\frac{cM_{k}}{M_{N}}l_{n}.$

Proof. Let $x\in I_{N}\left(x_{k}e_{k}+x_{l}e_{l}\right),$ $\ 1\leq x_{k}\leq
m_{k}-1,$ $1\leq x_{l}\leq m_{l}-1,$ $\ k=0,...,N-2,$ $l=k+1,...,N-1.$ Using
Lemma 3 we have

$\displaystyle\int_{I_{N}}\underset{j=M_{N}+1}{\overset{n}{\sum}}\frac{\left|K_{j}\left(x-t\right)\right|}{j+1}d\mu\left(t\right)\leq\underset{j=M_{N}+1}{\overset{n}{\sum}}\frac{cM_{k}M_{l}}{\left(j+1\right)jM_{N}}$
$\displaystyle\leq$
$\displaystyle\frac{cM_{k}M_{l}}{M_{N}}\underset{j=M_{N}+1}{\overset{\infty}{\sum}}\left(\frac{1}{j}-\frac{1}{j+1}\right)\leq\frac{cM_{k}M_{l}}{M_{N}^{2}}.$

Let $x\in I_{N}\left(x_{k}e_{k}\right),$ $1\leq x_{k}\leq m_{k}-1,$ $\
k=0,...,N-1.$ Then

(3)
$\int_{I_{N}}\underset{j=M_{N}+1}{\overset{n}{\sum}}\frac{\left|K_{j}\left(x-t\right)\right|}{j+1}d\mu\left(t\right)\leq\underset{j=M_{N}+1}{\overset{n}{\sum}}\frac{cM_{k}}{\left(j+1\right)M_{N}}\leq\frac{cM_{k}}{M_{N}}l_{n}.$

Combining (4) and (3) we complete the proof of Lemma 4.

##  5\. Proof of the Theorems

Proof of theorem 1. a) Using Abel transformation we obtain

(1)
$R_{n}f=\frac{1}{l_{n}}\overset{n-1}{\underset{j=1}{\sum}}\frac{\sigma_{j}f}{j+1}+\frac{\sigma_{n}f}{l_{n}}.$

Consequently,

(2) $R^{\ast}f\leq c\sigma^{\ast}f.$

Using Theorem W and (2) we conclude that $R^{\ast}$ is bounded from the
martingale Hardy space $H_{1/2}$ to the space $L_{1/2,\infty}$.

Proof of theorem 2. From (1) for the kernels of Riesz‘s logarithmic means we
have

(3)
$L_{n}=\frac{1}{l_{n}}\overset{n-1}{\underset{j=1}{\sum}}\frac{K_{j}}{j+1}+\frac{K_{n}}{l_{n}}.$

By Lemma 1, the proof of theorem 2 will be complete, if we show that

$\int\limits_{\overset{-}{I}}\left|\overset{\sim}{R}^{\ast}a\right|^{1/2}d\mu\leq
c<\infty,$

for every 1/2-atom $a,$ where $I$ denotes the support of the atom.

Let $a$ be an arbitrary 1/2-atom with support$\ I$ and
$\mu\left(I\right)=M_{N}^{-1}.$ We may assume that $I=I_{N}.$ It is easy to
see that $R_{n}\left(a\right)=\sigma_{n}\left(a\right)=0,$ when $n\leq M_{N}$.
Therefore we suppose that $n>M_{N}.$

Since $\left\|a\right\|_{\infty}\leq cM_{N}^{2}$ if we apply (3) we can write

$\displaystyle\frac{\left|R_{n}a\left(x\right)\right|}{\log\left(n+1\right)}=\frac{1}{\log\left(n+1\right)}\int_{I_{N}}\left|a\left(t\right)\right|\left|L_{n}\left(x-t\right)\right|d\mu\left(t\right)$
$\displaystyle\leq$
$\displaystyle\frac{\left\|a\right\|_{\infty}}{\log\left(n+1\right)}\int_{I_{N}}\left|L_{n}\left(x-t\right)\right|d\mu\left(t\right)$
$\displaystyle\leq$
$\displaystyle\frac{cM_{N}^{2}}{\log\left(n+1\right)l_{n}}\underset{I_{N}}{\int}\text{
}\underset{j=M_{N}+1}{\overset{n-1}{\sum}}\frac{\left|K_{j}\left(x-t\right)\right|}{j+1}d\mu\left(t\right)$
$\displaystyle+\frac{cM_{N}^{2}}{\log\left(n+1\right)l_{n}}\int_{I_{N}}\left|K_{n}\left(x-t\right)\right|d\mu\left(t\right).$

Let $x\in I_{N}\left(x_{k}e_{k}+x_{l}e_{l}\right),$ $\ 1\leq x_{k}\leq
m_{k}-1,$ $1\leq x_{l}\leq m_{l}-1,$ $k=0,...,N-2,$ $l=k+1,...,N-1.$ From
Lemmas 3 and 4 we have

(5)
$\frac{\left|R_{n}\left(a\right)\right|}{\log\left(n+1\right)}\leq\frac{cM_{l}M_{k}}{N^{2}}.$

Let $x\in I_{N}\left(x_{k}e_{k}\right),$ $1\leq x_{k}\leq m_{k}-1,$
$k=0,...,N-1.$ Applying Lemmas 3 and 4 we have

(6)
$\frac{\left|R_{n}a\left(x\right)\right|}{\log\left(n+1\right)}\leq\frac{M_{N}M_{k}}{N}\leq
cM_{N}M_{k}.$

Combining (1), (5) and (6) we get

$\displaystyle\int_{\overline{I_{N}}}\left|\overset{\sim}{R}^{\ast}a\left(x\right)\right|^{1/2}d\mu\left(x\right)$
$\displaystyle=$
$\displaystyle\overset{N-2}{\underset{k=0}{\sum}}\overset{m_{k}-1}{\underset{x_{k}=1}{\sum}}\overset{N-1}{\underset{l=k+1}{\sum}}\overset{m_{l}-1}{\underset{x_{l}=1}{\sum}}\int_{I_{l+1}\left(x_{k}e_{k}+x_{l}e_{l}\right)}\left|\overset{\sim}{R}^{\ast}a\left(x\right)\right|^{1/2}d\mu\left(x\right)$
$\displaystyle+\overset{N-1}{\underset{k=0}{\sum}}\overset{m_{k}-1}{\underset{x_{k}=1}{\sum}}\int_{I_{N}\left(x_{k}e_{k}\right)}\left|\overset{\sim}{R}^{\ast}a\left(x\right)\right|^{1/2}d\mu\left(x\right)$
$\displaystyle\leq$ $\displaystyle
c\overset{N-2}{\underset{k=0}{\sum}}\overset{N-1}{\underset{l=k+1}{\sum}}\frac{1}{M_{l}}\frac{\sqrt{M_{l}M_{k}}}{N}+c\overset{N-1}{\underset{k=0}{\sum}}\frac{1}{M_{N}}\sqrt{M_{N}M_{k}}\leq
c<\infty.$

It completes the proof of first part of theorem 2.

b) Let$\ \left\\{\lambda_{k},\text{ }k\in\mathbf{P}_{+}\right\\}$ be an
increasing sequence of the positive integers, which saisfies condition (1).
For every $\lambda_{k}$ there exists a positive integers$\
\left\\{n_{k},\text{
}k\in\mathbf{P}_{+}\right\\}\subset\left\\{\lambda_{k},\text{
}k\in\mathbf{P}_{+}\right\\},$ such that

$\lim_{k\rightarrow\infty}\frac{n_{k}}{\varphi\left(M_{2n_{k}+1}\right)}=\infty.$

Let

$f_{n_{k}}\left(x\right)=D_{M_{2n_{k}+1}}\left(x\right)-D_{M_{{}_{2n_{k}}}}\left(x\right).$

It is evident

$\widehat{f}_{n_{k}}\left(i\right)=\left\\{\begin{array}[]{l}\text{ }1,\text{
if }i=M_{{}_{2n_{k}}},...,M_{2n_{k}+1}-1,\\\ \text{
}0,\text{otherwise}.\end{array}\right.$

We can write

(7)
$S_{i}f_{n_{k}}\left(x\right)=\left\\{\begin{array}[]{l}D_{i}\left(x\right)-D_{M_{{}_{2n_{k}}}}\left(x\right),\text{
\ if }i=M_{{}_{2n_{k}}},...,M_{2n_{k}+1}-1,\\\ \text{
}f_{n_{k}}\left(x\right),\text{ \ if \ }i\geq M_{2n_{k}+1},\\\ 0,\text{ \qquad
otherwise.}\end{array}\right.$

From (2) we get (see also [17] and [18])

(8)
$\left\|f_{n_{k}}\left(x\right)\right\|_{H_{p}}=\left\|f_{n_{k}}^{\ast}\left(x\right)\right\|_{p}\leq
cM_{{}_{2n_{k}}}^{1-1/p}.$

Let $q_{n_{k}}^{s}=M_{2n_{k}}+M_{2s},$ $s=0,...,n_{k}-1.$ By (7) we have

$\displaystyle\frac{\left|R_{q_{n_{k}}^{s}}f_{n_{k}}\left(x\right)\right|}{\varphi\left(q_{n_{k}}^{s}\right)}$
$\displaystyle=$
$\displaystyle\frac{1}{\varphi\left(q_{n_{k}}^{s}\right)l_{q_{n_{k}}^{s}}}\left|\overset{q_{n_{k}}^{s}}{\underset{j=M_{{}_{2n_{k}}}+1}{\sum}}\frac{S_{j}f_{n_{k}}\left(x\right)}{j}\right|$
$\displaystyle=$
$\displaystyle\frac{1}{\varphi\left(q_{n_{k}}^{s}\right)l_{q_{n_{k}}^{s}}}\left|\overset{q_{n_{k}}^{s}}{\underset{j=M_{{}_{2n_{k}}}+1}{\sum}}\frac{\left(D_{j}\left(x\right)-D_{M_{{}_{2n_{k}}}}\left(x\right)\right)}{j}\right|$
$\displaystyle=$
$\displaystyle\frac{1}{\varphi\left(q_{n_{k}}^{s}\right)l_{q_{n_{k}}^{s}}}\left|\overset{M_{2s}}{\underset{j=1}{\sum}}\frac{\left(D_{j+M_{{}_{2n_{k}}}}\left(x\right)-D_{M_{{}_{2n_{k}}}}\left(x\right)\right)}{j+M_{{}_{2n_{k}}}}\right|.$

Since

(10)
$D_{j+M_{{}_{2n_{k}}}}\left(x\right)-D_{M_{{}_{2n_{k}}}}\left(x\right)=\psi_{M_{{}_{2n_{k}}}\text{
}}D_{j}\left(x\right),\text{ \ \ }j=1,2,..,M_{{}_{2n_{k}}}-1.$

we obtain

(11)
$\frac{\left|R_{q_{n_{k}}^{s}}f_{n_{k}}\left(x\right)\right|}{\varphi\left(q_{n_{k}}^{s}\right)}=\frac{1}{\varphi\left(q_{n_{k}}^{s}\right)l_{q_{n_{k}}^{s}}}\overset{M_{2s}}{\underset{j=1}{\sum}}\frac{\left|Dj\left(x\right)\right|}{j+M_{{}_{2n_{k}}}}.$

Let $x\in$ $I_{{}_{2s}}\backslash I_{{}_{2s+1}}.$ Then

$\displaystyle\frac{\left|R_{q_{n_{k}}^{s}}f_{n_{k}}\left(x\right)\right|}{\varphi\left(q_{n_{k}}^{s}\right)}\geq\frac{1}{\varphi\left(q_{n_{k}}^{s}\right)l_{q_{n_{k}}^{s}}}\overset{M_{2s}}{\underset{j=0}{\sum}}\frac{j}{j+M_{{}_{2n_{k}}}}$
$\displaystyle\geq$
$\displaystyle\frac{1}{\varphi\left(q_{n_{k}}^{s}\right)l_{q_{n_{k}}^{s}}}\frac{\overset{M_{2s}}{\underset{j=0}{\sum}}j}{2M_{{}_{2n_{k}}}}\geq\frac{cM_{2s}^{2}}{\varphi\left(q_{n_{k}}^{s}\right)l_{q_{n_{k}}^{s}}M_{{}_{2n_{k}}}}.$

Using (5) we have

$\displaystyle\int_{G_{m}}\left|\overset{\sim}{R}^{\ast}f\left(x\right)\right|^{1/2}d\mu\left(x\right)$
$\displaystyle\geq$ $\displaystyle\text{
}\overset{n_{k}-1}{\underset{s=1}{\sum}}\int_{{}^{I_{{}_{2s}}\backslash
I_{{}_{2s+1}}}}\left|\frac{R_{q_{n_{k}}^{s}}f\left(x\right)}{\varphi\left(q_{n_{k}}^{s}\right)}\right|^{1/2}d\mu\left(x\right)\geq
c\overset{n_{k}-1}{\underset{s=1}{\sum}}\frac{M_{2s}}{\sqrt{\varphi\left(q_{n_{k}}^{s}\right)l_{q_{n_{k}}^{s}}M_{{}_{2n_{k}}}}}\frac{1}{M_{2s}}$
$\displaystyle\geq$ $\displaystyle
c\overset{n_{k}-1}{\underset{s=1}{\sum}}\frac{1}{\sqrt{\varphi\left(M_{{}_{2n_{k}+1}}\right)l_{M_{{}_{2n_{k}+1}}}M_{{}_{2n_{k}}}}}\geq\frac{cn_{k}}{\sqrt{\varphi\left(M_{{}_{2n_{k}+1}}\right)l_{M_{{}_{2n_{k}+1}}}M_{{}_{2n_{k}}}}}.$

From (8) we have

(13)
$\frac{\left(\int_{G_{m}}\left|\overset{\sim}{R}^{\ast}f\left(x\right)\right|^{1/2}d\mu\left(x\right)\right)^{2}}{\left\|f_{n_{k}}\left(x\right)\right\|_{H_{1/2}}}\geq\frac{cn_{k}}{\varphi\left(M_{{}_{2n_{k}+1}}\right)}\rightarrow\infty,\text{
when }k\rightarrow\infty.$

Theorem 2 is proved.

Proof of theorem 3. Let $0<p<1/2.$ By Lemma 1, the proof of theorem 3 will be
complete, if we show that

$\int\limits_{\overset{-}{I}}\left|\overset{\sim}{R}_{p}^{\ast}a\right|^{p}d\mu\leq
c_{p}<\infty,\text{ }$

for every p-atom $a,$ where $I$ denotes the support of the atom.

Let $a$ be an arbitrary p-atom with support$\ I$ and
$\mu\left(I\right)=M_{N}^{-1}.$ We may assume that $I=I_{N}.$ It is easy to
see that $R_{n}\left(a\right)=0,$ when $n\leq M_{N}$. Therefore we suppose
that $n>M_{N}.$

Since $\left\|a\right\|_{\infty}\leq cM_{N}^{1/p}$ using (3) we can write

$\displaystyle\frac{\log\left(n+1\right)}{\left(n+1\right)^{1/p-2}}\left|R_{n}a\left(x\right)\right|$
$\displaystyle\leq$
$\displaystyle\frac{\log\left(n+1\right)M_{N}^{1/p}}{\left(n+1\right)^{1/p-2}l_{n}}\underset{I_{N}}{\int}\text{
}\underset{j=M_{N}+1}{\overset{n-1}{\sum}}\frac{\left|K_{j}\left(x-t\right)\right|}{j+1}d\mu\left(t\right)$
$\displaystyle+\frac{\log\left(n+1\right)M_{N}^{1/p}}{\left(n+1\right)^{1/p-2}l_{n}}\int_{I_{N}}\left|K_{n}\left(x-t\right)\right|d\mu\left(t\right).$

Let $x\in I_{N}\left(x_{k}e_{k}+x_{l}e_{l}\right),$ $\ 1\leq x_{k}\leq
m_{k}-1,$ $1\leq x_{l}\leq m_{l}-1,$ $k=0,...,N-2,$ $l=k+1,...,N-1.$ From
Lemmas 3 and 4 when $n>M_{N}$ we obtain

(15)
$\frac{\log\left(n+1\right)}{\left(n+1\right)^{1/p-2}}\left|R_{n}a\left(x\right)\right|\leq\text{
}c_{p}M_{l}M_{k}.$

Let $x\in I_{N}\left(x_{k}e_{k}\right),$ $1\leq x_{k}\leq m_{k}-1,\ $
$k=0,...,N-1.$ Applying Lemmas 3 and 4 we have

(16)
$\frac{\log\left(n+1\right)}{\left(n+1\right)^{1/p-2}}\left|R_{n}a\left(x\right)\right|\leq
cNM_{N}M_{k}.$

Combining (1), (15) and (16) we get

$\displaystyle\int_{\overline{I_{N}}}\left|\overset{\sim}{R}_{p}^{\ast}a\left(x\right)\right|^{p}d\mu\left(x\right)$
$\displaystyle=$
$\displaystyle\overset{N-2}{\underset{k=0}{\sum}}\overset{m_{k}-1}{\underset{x_{k}=1}{\sum}}\overset{N-1}{\underset{l=k+1}{\sum}}\overset{m_{l}-1}{\underset{x_{l}=1}{\sum}}\int_{I_{N}\left(x_{k}e_{k}+x_{l}e_{l}\right)}\left|\overset{\sim}{R}_{p}^{\ast}a\left(x\right)\right|^{p}d\mu\left(x\right)$
$\displaystyle+\overset{N-1}{\underset{k=0}{\sum}}\overset{m_{k}-1}{\underset{x_{k}=1}{\sum}}\int_{I_{N}\left(x_{k}e_{k}\right)}\left|\overset{\sim}{R}_{p}^{\ast}a\left(x\right)\right|^{p}d\mu\left(x\right)$
$\displaystyle\leq$ $\displaystyle
c_{p}\overset{N-2}{\underset{k=0}{\sum}}\overset{N-1}{\underset{l=k+1}{\sum}}\frac{1}{M_{l}}\left(M_{l}M_{k}\right)^{p}+c_{p}\overset{N-1}{\underset{k=0}{\sum}}\frac{1}{M_{N}}\left(NM_{N}M_{k}\right)^{p}\leq
c_{p}<\infty.$

Which complete the proof of first part of Theorem 2.

Let $0<p<1/2$ and$\ \left\\{\lambda_{k},\text{ }k\in\mathbf{P}_{+}\right\\}$
be an increasing sequence of the positive integers, which satisfies condition
(2). It is evident that for every $\lambda_{k}$ there exists a positive
integers $\ \left\\{n_{k},\text{
}k\in\mathbf{P}_{+}\right\\}\subset\left\\{\lambda_{k},\text{
}k\in\mathbf{P}_{+}\right\\},$ such that

$\lim_{k\rightarrow\infty}\frac{\left(M_{2n_{k}}+1\right)^{1/p-2}}{\varphi\left(M_{2n_{k}}+1\right)\log\left(M_{2n_{k}}+1\right)}=\infty.$

Combining (5-5) we have

$\frac{\left|R_{M_{2n_{k}}+1}f_{n_{k}}\left(x\right)\right|}{\varphi\left(M_{2n_{k}}+1\right)}=\frac{\left|R_{q_{n_{k}}^{0}}f\left(x\right)\right|}{\varphi\left(q_{n_{k}}^{0}\right)}\geq\frac{c}{\varphi\left(M_{{}_{2n_{k}}}+1\right)l_{M_{{}_{2n_{k}}}+1}\left(M_{{}_{2n_{k}}}+1\right)},$

for $x\in I_{0}\backslash I_{1}=G_{m}\backslash I_{1}.$

From (8) we get

$\displaystyle\frac{\frac{c}{\varphi\left(M_{{}_{2n_{k}}}+1\right)l_{M_{{}_{2n_{k}}}+1}\left(M_{{}_{2n_{k}}}+1\right)}\mu\left\\{x\in
G_{m}:\left|\overset{\sim}{R}_{p}^{\ast}f_{n_{k}}\left(x\right)\right|\geq\frac{c}{\varphi\left(M_{{}_{2n_{k}}}+1\right)l_{M_{{}_{2n_{k}}}+1}\left(M_{{}_{2n_{k}}}+1\right)}\right\\}^{1/p}}{\left\|f_{n_{k}}\left(x\right)\right\|_{H_{p}}}$
$\displaystyle\geq$
$\displaystyle\frac{c\left(M_{2n_{k}}+1\right)^{1/p-2}}{\varphi\left(M_{2n_{k}}+1\right)\log\left(M_{2n_{k}}+1\right)}\rightarrow\infty,\text{
when }k\rightarrow\infty.$

Which complete the proof of theorem 3.

Acknowledgment: The author would like to thank the referee for helpful
suggestions.

## References

  * [1] G. N. AGAEV, N. Ya. VILENKIN, G. M. DZHAFARLY and A. I. RUBINSHTEIN, Multiplicative systems of functions and harmonic analysis on zero-dimensional groups, Baku, Ehim, 1981 (in Russian).
  * [2] I. BLAHOTA and G. GÁT, Norm summability of Nörlund logarithmic means on unbounded Vilenkin groups, Anal. Theory Appl., 24 (2008), no. 1, 1–17.
  * [3] I. BLAHOTA, G. GÁT and U. GOGINAVA, Maximal operators of Fejér means of Vilenkin-Fourier series. JIPAM. J. Inequal. Pure Appl. Math. 7 (2006), 1-7.
  * [4] N. J. FUJII, A maximal inequality for $H_{1}$ functions on the generalized Walsh-Paley group, Proc. Amer. Math. Soc. 77 (1979), lll-116.
  * [5] G. GÁT, Cesáro means of integrable functions with respect to unbounded Vilenkin systems, J. Approx. Theory 124 (2003), no. 1, 25-43.
  * [6] G. GÁT, Inverstigations of certain operators with respect to the Vilenkin systems, Acta Math. Hungar. N 1-2,61 (1993), 131-149.
  * [7] G. GÁT and K. NAGY, On the logarithmic summability of Fourier series, Georgian Math. J. 18 (2) (2011) 237-248.
  * [8] U. GOGINAVA, The maximal operator of Marcinkiewicz-Fejér means of the d-dimensional Walsh-Fourier series. East J. Approx. 12 (2006), no. 3, 295–302.
  * [9] U. GOGINAVA, Maximal operators of Fejér-Walsh means. Acta Sci. Math. (Szeged) 74 (2008), no. 3-4, 615–624.
  * [10] U. GOGINAVA and K. NAGY, On the maximal operator of Walsh-Kaczmarz-Fejér means, Czechoslovak Math. J., 61 (136) (2011), 673-686.
  * [11] U. GOGINAVA, Maximal operators of Logarithmic means of one-dimensional Walsh-Fourier series, Rendiconti del Circilo Matematico di Palermo Serie II, 82(2010), pp. 345-357.
  * [12] J. PAL and P. SIMON, On a generalization of the comncept of derivate, Acta Math. Hungar., 29 (1977), 155-164.
  * [13] F. SCHIPP, Certain rearranngements of series in the Walsh series, Mat. Zametki, 18 (1975), 193-201.
  * [14] P. SIMON, F. WEISZ, Weak inequalities for Cesáro and Reisz summability of Walsh-Fourier series, J. Approx. Theory 151 (2008) 1-19.
  * [15] P. SIMON, Inverstigations with respect to the Vilenkin system, Annales Univ. Sci. Budapest Eotv., Sect. Math., 28 (1985) 87-101.
  * [16] G.TEPHNADZE, Fejér means of Vilenkin-Fourier series., Stud. sci. math. Hung., 49 (1), (2012) 79-90.
  * [17] G.TEPHNADZE, On the maximal operator of Vilenkin-Fejér means., Turk. J. Math, 37, (2013), 308-318.
  * [18] G.TEPHNADZE, On the maximal operators of Vilenkin-Fejér means on Hardy spaces, Mathematical Inequalities & Applications Volume 16, Number 2 (2013), 301–312.
  * [19] G.TEPHNADZE, The maximal operator of logarithmic means of one-dimensional Vilenkin-Fourier series, Acta. Math. Acad. Paed. Nyir, (AMAPN), 27 (2011), 245-256.
  * [20] G.TEPHNADZE, On the maximal operators of Walsh-Kaczmarz-Fejér means, Periodica Mathematica Hungarica, 67, (1), 2013, 33-45.
  * [21] F. WEISZ, Martingale Hardy spaces and their application in Fourier analysis, Springer, Berlin-Heideiberg-New York, 1994.
  * [22] F. WEISZ, Cesáro summability of one- and two-dimensional Walsh-Fourier series, Anal. Math., 22 (1996), no. 3, 229–242.
  * [23] F. WEISZ,Q-summability of Fourier series, Acta Math. Hungar., 103 (2004), no. 1-2, 139–175.
  * [24] F. WEISZ, Summability of multi-dimensional Fourier series and Hardy space, Kluwer Academic, Dordrecht, 2002.


# QuantumLeak: Stealing Quantum Neural Networks from Cloud-based NISQ Machines
††thanks: This paper is accepted by International Joint Conference on Neural
Networks (IJCNN) 2024.

Zhenxiao Fu∗ Min Yang∗ Cheng Chu∗ Yilun Xu† Gang Huang† Fan Chen∗ ∗Indiana
University Bloomington †Lawrence Berkeley National Laboratory ∗{zhfu, my36,
chu6<EMAIL_ADDRESS>†{yilunxu<EMAIL_ADDRESS>
###### Abstract

Variational quantum circuits (VQCs) have become a powerful tool for
implementing Quantum Neural Networks (QNNs), addressing a wide range of
complex problems. Well-trained VQCs serve as valuable intellectual assets
hosted on cloud-based Noisy Intermediate Scale Quantum (NISQ) computers,
making them susceptible to malicious VQC stealing attacks. However,
traditional model extraction techniques designed for classical machine
learning models encounter challenges when applied to NISQ computers due to
significant noise in current devices. In this paper, we introduce QuantumLeak,
an effective and accurate QNN model extraction technique from cloud-based NISQ
machines. Compared to existing classical model stealing techniques,
QuantumLeak improves local VQC accuracy by 4.99%$\sim$7.35% across diverse
datasets and VQC architectures.

###### Index Terms:

Model Extraction Attack, Quantum Neural Networks, Variational Quantum
Circuits, NISQ

##  I Introduction

Quantum Neural Networks (QNNs) have shown remarkable capabilities across
diverse domains, including natural language processing natural language
processing [1], object recognition [2], and financial analysis [3]. At their
core are Variational Quantum Circuits (VQCs) [4], designed with specific
quantum ansatz and trained on targeted datasets. Developing an accurate VQC
for a task demands substantial domain expertise and costly data collection.
Consequently, VQCs are valuable intellectual properties (IPs) that warrant
robust protection. Typically offered as cloud services on Noisy Intermediate
Scale Quantum (NISQ) machines, VQCs have attracted adversaries seeking to
steal them. Through various model extraction attacks [5, 6, 7, 8], an
adversary can create a local substitute VQC mimicking the functionality of the
victim VQC on a cloud-based NISQ machine by querying it multiple times, posing
a severe threat to the VQC owner’s IP.

However, the model extraction techniques previously proposed [5, 6, 7, 8] were
initially designed for pilfering classical machine learning models. Our
preliminary results indicate that the naïve application of these schemes
yields only suboptimal levels of accuracy when employed for VQC extraction
from NISQ servers. This decrease in accuracy can be primarily attributed to
the substantial inherent quantum noise pervasive in NISQ computers [9, 10, 11,
12]. NISQ devices are vulnerable to various forms of quantum noise originating
from environmental interactions [9], qubit crosstalk [10], imperfect controls
[11], and leakage [12]. Moreover, different NISQ technologies may encounter
distinct levels of noise due to their diverse architectures and control
mechanisms [9], as well as their interactions with varying environmental
conditions.

Contributions. In this paper, we propose QuantumLeak, a novel quantum model
extraction attack utilizing an ensemble of local QNN learners to enhance
successful extraction from a NISQ machine, even in the presence of quantum
noise. The contributions of this paper are summarized as follows:

  * •

Ensemble-based QNN Extraction Attack. To the best of our knowledge, this work
marks the first QNN extraction attempts. We investigate state-of-the-art
(SOTA) extraction attacks in the context of QNN theft from NISQ devices,
uncovering their inferior performance. We propose QuantumLeak, which
strategically leverages an ensemble of local substitute models to improve
extraction attack success. QuantumLeak proceeds through three major phases:
victim QNN query and data bagging, substitute QNN initialization and training,
and decision fusion. We provide comprehensive insights into each phase,
discussing techniques dedicated to enhancing effectiveness throughout the
process.

  * •

Robust QNN Learning with Noisy Data. To enhance the robustness of local
substitute QNN training with queried noisy data, we systematically investigate
various training optimization techniques within the proposed QuantumLeak
framework. This exploration leads to the identification of a generalized
formulation of the Huber loss, a key enhancement that substantially improves
both the robustness and accuracy of the learning process.

  * •

Demonstrated Success in QNN Extraction. We conducted a comprehensive
evaluation of QuantumLeak across diverse VQC architectures and ensemble
configurations. Experimentation on IBM NISQ devices showed that QuantumLeak
achieves an improvement of 4.99%$\sim$7.35% in the accuracy of the locally-
generated QNN compared to CloudLeak [8], a SOTA classical model extraction
attacks. Additionally, we discuss potential countermeasures to defend against
our QuantumLeak QNN extraction attacks.

Limitations and Scope. The selected benchmark dataset (e.g., MNIST and
Fashion-MNIST) and the implementation scale (e.g., up to 27 qubits) in this
paper are constrained by existing classical-to-quantum encoding
inefficiencies, our limited access to IBM quantum computers, and high noise
rates on NISQ computers. As technological advancements progress, notable
improvements in the implementation scale and performance of QuantumLeak are
anticipated. This work initiates research on QNN model extraction attacks on
NISQ computers, paving the way for future investigations in this domain and
the broader area of quantum security.

Figure 1: The QNN-as-a-service on a NISQ computer.

##  II Background and Problem Definition

###  II-A Key Concepts in Quantum Neural Networks

Basics of QNNs. A qubit is described by a linear combination in a two-
dimensional state space, denoted as
$|\phi\rangle=\alpha|0\rangle+\beta|1\rangle$, where $|0\rangle$ and
$|1\rangle$ form an orthonormal basis, and $\alpha,\beta\in\mathbb{C}$ with
$|\alpha|^{2}+|\beta|^{2}=1$. A quantum gate on an $n$-qubit state defines a
$2^{n}\times 2^{n}$ unitary matrix (i.e., U) that transforms the input state
$|\phi\rangle$ to $|\psi\rangle=\texttt{U}|\phi\rangle$. NISQ computers
feature a restricted universal native gate set, comprising only a few types of
1-Qubit gates and typically a single type of 2-Qubit gate. For instance, IBM
quantum computers exclusively support two 1-Qubit gates (e.g., U2, U3) and one
2-Qubit gate (e.g., CNOT). A quantum algorithm is represented as a circuit,
composed of a sequence of quantum gates operating on a set of suitably
initialized qubits. As a representative NISQ algorithm, the core of a QNN
involves VQCs[4, 3] that are designed with a specific quantum ansatz and
trained on domain-specific datasets. As conceptually illustrated in Figure 1,
a QNN consists of three key components: a data encoder, $\mathbf{E(x)}$; a
multi-layer trainable circuit, $U(\mathbf{\theta})$; and a quantum measurement
layer, $\mathbf{M}$. These components collectively form the function
$\mathbf{Q}=\mathbf{M}\circ U(\mathbf{\theta})\circ\mathbf{E(x)}$. The QNN
generates the final predicted label by applying a softmax operation on the raw
probability output vector. Similar to classical neural networks, parameters in
a VQC can be trained using a classical optimizer[13]. The creation of an
accurate VQC demands profound domain expertise and entails expensive data
acquisition processes, underscoring the valuable intellectual property (IP)
nature of VQCs and the need for robust protection measures.

Quantum Cloud Computing. The high costs associated with quantum computers and
the intricacies of designing precise quantum algorithms pose significant
barriers for individual users. Consequently, average users typically leverage
NISQ hardware through a quantum cloud server, either by downloading free
services or purchasing QNNs from specific quantum algorithm providers via QNN-
as-a-Service (QNNaaS). In this model, demonstrated in Figure 1, users interact
with QNNaaS by submitting queries with their local data. The server then
executes the QNN on its NISQ devices, measures the outputs, and provides
classical probability results to end-users for subsequent post-processing,
ultimately yielding a classical prediction. The restricted privilege levels
inherent in QNNaaS limit users from gaining insights into crucial aspects such
as the QNN architecture, training datasets employed by the cloud, and
additional hardware characteristics, including error rates and power traces.
This lack of transparency presents challenges for adversaries seeking to
extract QNN models and general information from the cloud.

TABLE I: Error rates in current NISQ quantum computers. NISQ Device | Qubit # | Error Rate
---|---|---
SPAM | 1Q-Gate | 2Q-Gate
IonQ_Forte | 32 | 0.50% | 0.020% | 0.40%
IBM_Auckland | 27 | 0.34% | 0.197% | 2.44%
IBM_Kolkata | 27 | 0.35% | 0.177% | 2.87%

Quantum Noises. Noise is an inherent characteristic and a significant
limitation in most current NISQ devices, stemming from imperfections in
fabrication, control, and state preparation/measurement (SPAM), which manifest
as observable errors. These errors primarily include SPAM errors [14], gate
errors [15, 16], and circuit-level crosstalk errors [17]. Table I presents
error rates for SPAM and gate errors in two prominent NISQ technologies:
trapped-ion (e.g., IonQ_Forte) and superconducting (e.g., IBM_Auckland and
IBM_Kolkata). Note that crosstalk errors, which vary depending on the specific
quantum circuit and its physical mapping to a target NISQ computer, are not
included in the table. Subsequently, we provide a brief discussion on the
characteristics of each type of noise.

  * •

SPAM errors. The initialization of a quantum state and the subsequent
measurement of its state introduces errors [14]. In the context of QNNs,
qubits are typically initialized in the ground state, making measurement
errors a dominant form of SPAM error. For example, reading $|1\rangle$ while
the qubit is in the $|0\rangle$ state, and vice versa. Measurement errors are
presently modeled using a 2$\times$2 probability matrix and can be effectively
mitigated through readout-error correction and/or post-measurement adjustment
[18].

  * •

Gate errors. Quantum gates suffer from errors, categorized into two types:
coherent and incoherent errors. Managing incoherent errors is generally more
straightforward, as they can often be effectively modeled as depolarizing
noise [15]. On the other hand, coherent errors typically stem from
miscalibrations in control parameters, resulting in similar or even drifting
[16] during consecutive executions of a quantum circuit. This phenomenon
introduces a systematic bias in the final output, making coherent errors more
challenging to address. As numerically demonstrated in Table I, 2-Qubit gates
dominate gate errors, exhibiting error rates orders of magnitude higher than
those observed in 1-Qubit gates.

  * •

Crosstalk errors. Larger NISQ systems (i.e., >10 qubits) exhibit crosstalk
noise, causing visible deviations from ideal behavior. Crosstalk
characteristics depend on the quantum circuit architecture and vary
significantly across physical platforms with different technologies. Recent
research [17] highlighted a 20% increase in phase-flip error and a 33%
decrease in gate fidelity in a circuit involving only 9 CNOT gates on the
IBM_Melbourne computer [17].

Despite recent advancements in noise-robust QNN designs [19, 1, 2], several
error types, including coherence errors and crosstalk errors, persist
unaddressed in these schemes. Consequently, the significant quantum noise
diminishes QNN accuracy when executed on real devices.

###  II-B Problem Definition

Problem Formulation. An adversary aims to accurately construct a local
substitute QNN, denoted as $Q_{A}$, that closely mirrors the victim QNN
$Q_{V}$ deployed in the cloud, by querying the victim QNN with unlabeled
inputs and collecting the corresponding responses. The model extraction
process involves the following steps: (1) Initiate substitute QNN: The
adversary initiates a basic substitute local QNN model, $Q_{A}$, from a
function family $\mathbb{Q}$ and sets its hyperparameters. (2) Victim QNN
query: The adversary gathers an initial set of unlabeled samples, denoted as
$S$, by querying the victim model $Q_{V}$ and recording the responses in a
dataset $D=\\{S,Q_{V}(S)\\}$. (3) Substitute model training: The adversary
trains the substitution QNN $Q_{A}$ with the dataset $D$ using a specific
training strategy, optimizer, and decision-fusion scheme.

Threat Model. In the QNNaaS paradigm, users provide input data to the NISQ
machine, which utilizes the QNN to produce raw probability output vectors.
Since the NISQ machine lacks classical computing capability, it directly
returns the raw probability output vectors to the client, who can obtain the
final predicted labels by performing classical softmax operations on the raw
probability output vectors. For economic and privacy reasons, the specific
details of the QNN remain undisclosed. In this paper, we assume that the
victim QNN is treated as a black box by the adversary, lacking access to
internal information like circuit architecture, training dataset,
hyperparameters, and quantum gate parameters. Moreover, the adversary cannot
measure the noises on the NISQ machine. The adversary’s capabilities are
restricted to submitting inputs and receiving corresponding raw probability
output vectors. By collecting input-output pairs, the adversary can train a
local substitute QNN that closely emulates the performance of the cloud-based
QNN within the black-box setting. This substitute QNN empowers the adversary
to perform an unlimited number of query tasks without incurring any costs.

##  III Related Work and Motivation

###  III-A Related Work

Model Extraction Attacks. The first classical model extraction attack [5]
exclusively targeted simple models like logistic regression, SVM, decision
trees, and shallow neural networks. Subsequent research, with notable
contributions as seen in [6], demonstrated that adversarial examples from a
substitute model can lead to a significant misclassification rate in a black-
box model. This concept was further expanded upon in [7], which relaxed black-
box setting requirements to enable the learning of useful information from
data samples different from the original training set. The most recent
development, CloudLeak [8], employs an active learning mechanism to
substantially reduce query number budget, enhancing the stealthiness of the
model extraction process.

Ensemble Learning. Ensemble learning [20], constructs a predictive model by
combining the strengths of a collection of simpler base models, aiming to
minimize the expected prediction error. Key methods in ensemble construction
[21] include boosting, randomization, and bagging. Boosting involves
leveraging a committee of weak learners that evolves over time. Randomization
methods consist of estimating the single base model with a randomly perturbed
training algorithm. Bagging fits the same model to different training sets,
creating a committee of independent weak learners, and the ensemble prediction
is then obtained through decision fusion. Bagging, particularly effective in
the presence of noisy data, enhances accuracy by mitigating variance
components.

Figure 2: The accuracy of victim QNN and CloudLeak attacks [8]. Figure 3: The
overall architecture and working flow of QuantumLeak.

###  III-B Motivation

Reduced QNN Accuracy on NISQ Computers. We utilize a SOTA QNN, Circuit 14 in
[19], to train a victim model. This model comprises an amplitude encoder and a
2-layer VQC, and is trained on the MNIST and Fashion-MNIST datasets. The
inference accuracy in simulation (i.e., Ideal) and on IBM_Auckland (i.e.,
Noisy) with the respective datasets, is illustrated in Figure 2. The notable
accuracy reduction on the NISQ computer suggests that queries to the victim
QNN from NISQ machines yield noisy labels with high levels of inaccuracy. This
phenomenon impedes the training of an accurate substitute model, highlighting
the challenges associated with using data generated from NISQ devices.

Ineffectiveness of Existing Techniques. Operating under a strong white-box
assumption, we implemented a local substitute QNN identical to the victim QNN
and employed the same datasets as the cloud model. We applied the SOTA
technique, CloudLeak [8], to extract the QNN through query respectively the
Ideal and Noisy QNNaaS indicated in Figure 2. Advanced techniques within
CloudLeak, including transfer learning and adversarial samples, were
incorporated to enhance the accuracy of the local QNN model. More
specifically, transfer learning involved pre-training the local QNN model with
3,000 images from publicly available datasets, ensuring similar data
distributions to the victim QNN [8]. Adversarial samples, crucial for
determining the separating surface of the victim QNN, were constructed using
the methodology proposed in [8]. The adversary initiated an unlabeled dataset
with 6000 images within the problem domain and 500 images outside the problem
domain, submitting it to the victim QNN for queries. The server returned the
raw probability vectors of the dataset, enabling the adversary to train a
local QNN using the labeled dataset. As illustrated in Figure 2, although
CloudLeak extract a substitute QNN with acceptable accuracy from the Ideal
server, the accuracy in the Noisy setting shows a significant up to 10.15%
reduction in accuracy from the victim QNN. The preliminary study results have
motivated us to develop a QNN extraction attack scheme capable of learning an
accurate local substitute QNN model using noisy labels obtained from queries
to a NISQ server.

##  IV QuantumLeak

Overview. Figure 3 illustrates the overall architecture and working process of
QuantumLeak, encompassing three main phases: initializing substitute QNN at
the local, querying the victim QNN on the cloud, and training the local
substitute model.

  * •

Initiating Substitute Model. Unlike classical machine learning, QNNs currently
adopt a standardized structure, primarily utilizing a VQC that consists of a
rotation layer with 1-Qubit gates and entanglement layers employing 2-Qubit
gates arranged in a ring structure. In our investigation, we consider
mainstream QNN models [19, 1, 2] as the zoo of candidate QNN models. From this
selection, one model is chosen to serve as the primitive substitute local QNN.
We initialize the variational gate parameters following a Gaussian
distribution.

  * •

Querying the Victim QNN. The victim QNN model is queried through the QNNaaS
interface, obtaining predictions to form the base dataset. Our objective is to
enhance the model accuracy through ensembles of local QNNs, capitalizing on
their collective decision-making capabilities. The robustness afforded by
multiple models surpasses the predictive power of a single QNN, particularly
in the presence of noisy labels. To achieve this, an iterative bagging
approach is applied to the dataset, facilitating the training of each ensemble
committee QNN individually with a subset.

  * •

Training the Local Substitute Model. In QNN design, the topology of the VQC
ansatz and the number of repeated VQC layers play a crucial role in
determining the final model accuracy. We discuss these configuration choices
within the QuantumLeak framework. Moreover, in the context of model extraction
attacks, minimizing queries to the victim model is ideal. This not only
reduces query costs but also mitigates the risk of detection. For adversaries,
querying the QNNaaS should be more cost-effective than independently training
a model with similar functionality. However, a high volume of queries may
raise concerns with the cloud service provider, potentially leading to account
restrictions or other countermeasures. We delve into a discussion and present
experimental results highlighting the impact of query budget. Leveraging the
enhanced learning capability of ensembles, our results demonstrate that
QuantumLeak outperforms existing approaches with comparable query budgets,
achieving superior accuracy.

###  IV-A Initiating Substitute Model

The exacting topological constraints imposed by mainstream QNNs limit the
exploration space within the QNN model zoo. Even in the context of assuming a
black-box attack, wherein the adversary lacks knowledge of the victim QNN’s
internal structure, there exists a substantial probability that the adversary
might inadvertently incorporate the victim QNN architecture into their model
zoo. In response to this potential overlap, we establish the victim QNN on the
cloud and also integrate it into the local model zoo alongside other SOTA
QNNs. We present comprehensive results detailing the final performance across
all possible substitute QNN selections.

VQC Ansatz/Layers & Ensemble Committee Number. Distinct VQC ansatzs represent
different function families and are crucial for the accuracy of a QNN. In this
work, we focus on a homogeneous ensemble, where all committee classifiers are
implemented with the same base VQC ansatz. This choice aims to mitigate
training challenges on NISQ devices. The exploration of heterogeneous VQC
ansatzes in an ensemble is deferred to future work. The inclusion of repeated
VQC layers, $L$, in a QNN typically enhances model accuracy, given an ample
amount of training data. Similarly, increasing the ensemble committee number,
$N_{C}$, generally contributes to an overall improvement in the accuracy of
the ensemble. To unveil the full potential of QuantumLeak, we instantiate it
with an optimal configuration and conduct an exploration of the design space.
This exploration involves varying the number of VQC layers and the ensemble
committee members to assess their respective impacts on performance and
efficacy.

###  IV-B Querying the Victim QNN and Bagging

In alignment with classical model stealing techniques [5, 6, 7, 8],
QuantumLeak queries the victim QNN on a cloud-based NISQ machine. This
involves constructing an unlabeled dataset incorporating publicly available
data related to the specific problem domain. Initial data samples, denoted as
$S$, are sent to the victim VQC, $Q_{V}$, on the NISQ machine, producing
predicted labels, $Q_{V}(S)$ (i.e., raw probability output vectors), and
thereby forming a training dataset $D=\\{S,Q_{V}(S)\\}$. Acknowledging the
noise inherent in NISQ computers, QuantumLeak strategically queries the victim
VQC on QNNaaS across multiple rounds, evenly distributing queries throughout
the day at intervals of $24/m$ hours, allowing for $m$ (i.e., 3) rounds of
queries. Subsequently, the proposed bagging algorithm in Algorithm 1 is
employed to bootstrap $D$ and construct the sub-dataset. QuantumLeak utilizes
the complete bootstrap sample for model generation, employing the respective
out-of-bag instances for validation. Specifically, each bootstrap sub-dataset
comprises $N_{Q}/N_{C}$ data samples, randomly selected with replacement from
the initial dataset $D$ in each iteration of the bagging process. Maintaining
the total query number, $N_{Q}$, is considered optimal.

Input: query budget $N_{Q}$, training dataset $D$, number of bootstrap samples
$N_{C}$, VQC ensemble $Q$,

Output: updated ensemble $Q$

1

2 Procedure  _Train ( $D$, $N_{Q}$, $N_{C}$, $Q$)_:

3 for  _$i=0$ ; $i<N_{C}$; $i++$_ do

4 $D_{i}$ = bootstrap $N_{Q}$/$N_{C}$ data from $D$ (i.i.d. sample with
replacement)

5 $D_{oob}$ = out of bag data

6 $Q_{i}$ = base classifer trained with $D_{i}$

7 $Acc_{i}$ = validation accuracy of $Q_{i}$ on $D_{oob}$

8 if  _$Acc_{i}\geq Acc_{i-1}$_ then

9 train base classifier $Q_{i}$ with $D_{i}$

10

11

Algorithm 1 Pseudo code of the bagging algorithm.

###  IV-C Training the Local Substitute Model

To ensure the robust training of local substitute QNNs, we investigate
different loss functions within the QuantumLeak framework. In addition to the
default negative log-likelihood (NLL) loss, we introduce the Huber loss [22].
The NLL loss is easily applied through a LogSoftmax function for post-
processing on the results obtained from the QNNaaS server. Conversely, the
Huber loss, recognized for its robustness, is employed to construct a precise
VQC while addressing the challenges posed by noisy labels. The general form of
the Huber loss can be defined as follows:

$L_{\delta}(a)=\begin{cases}\frac{1}{2}a^{2}&\text{ for }|a|\leq\delta;\\\
\delta\cdot(|a|-\frac{1}{2}\delta),&\text{otherwise.}\end{cases}$ (1)

where $a$ is the input; $L_{\delta}$ indicates the output; and $\delta$ means
a predefined value. The Huber loss function is quadratic for small values of
$a$, and linear for large values of $a$, with equal values and slopes of the
different sections at the two points where $|a|=\delta$. The conventional
squared loss $L_{s}(a)=a^{2}$ serves as an arithmetic mean-unbiased estimator,
but it has the tendency to be dominated by outliers. On the contrary, the
Huber loss combines sensitivity of the squared loss, and the robustness of the
absolute loss $L_{a}(a)=|a|$, i.e., a median-unbiased estimator.

Decision Fusion Strategy. In our exploration of decision-making strategies
within an ensemble, we considered various fusion schemes such as unweighted
averaging, majority vote, and weighted methods based on individual influence.
Following careful evaluation in the QuantumLeak framework, we found no
discernible differences among candidate methods. As a result, we have chosen
the majority vote as the default fusion strategy for its simplicity of
implementation.

##  V Potential Defenses against QuantumLeak

Utilizing watermarking techniques [23], a QNN owner can establish ownership
and detect potential theft of their model. Watermarking involves inducing
overfitting in the QNN by training it with outlier input-output pairs known
only to the defender. Subsequently, these watermarks can be employed to
validate ownership of the QNN. The outliers are strategically generated by
introducing a unique trigger, such as a small square in a non-intrusive
location within an input data sample, effectively serving as distinctive
watermarks. If encountering a model displaying the rare and unexpected
behavior encoded by these watermarks, the defender can reasonably infer that
the model is a stolen replica.

The deployment of Physical Unclonable Functions (PUF)[24] and the
incorporation of obsolete circuit design through the insertion of dummy SWAP
gates[25] can also potentially contribute to fortifying defenses against
information leaks.

TABLE II: Comparison of accuracies on substitute QNNs across different model extraction schemes. Dataset | Task | Victim | CloudLeak | QuantumLeak |  $\uparrow$ over
---|---|---|---|---|---
Ideal | Real | Ideal | Real | CloudLeak_real
MNIST | 0/1 Classification | 89.55 | 86.18 | 85.87 | 79.40 | 86.75 | 7.35
2/3 Classification | 84.22 | 81.44 | 81.01 | 76.5 | 81.49 | 4.99
F-MNIST | t-shirt/trouser | 77.02 | 75.47 | 73.4 | 70.1 | 75.67 | 5.57
pullover/dress | 76.92 | 76.05 | 72.5 | 69.2 | 75.84 | 6.64

##  VI Experimental Methodology

Datasets. We evaluated design using the MNIST and Fashion-MNIST datasets. To
reduce image dimensions, we applied principal component analysis and average
pooling, resulting in $1\times 8$ size images. Similar to previous QNNs [1,
2], we down-sampled images in MNIST and Fashion-MNIST (i.e., F-MNIST) datasets
to the dimensions of $1\times 8$ using principal component analysis and
average pooling. For MNIST, we focused on the 2-category classifications
($0\&1$ and $2\&3$), while for Fashion-MNIST, we focused on the 2-category
classifications (t-shirt/trouser and pullover/dress).

NISQ Machines & Quantum Compiler. All our experimental designs were executed
and assessed using IBM Quantum System backends, specifically harnessing the
capabilities of the 27-qubit IBM_Auckland. To construct the quantum circuits,
we utilized BQSKit [26], employing its default settings for compilation. The
deployment of various QNNs on NISQ computers was achieved using Qiskit [27].

Victim VQC & Training Configuration. The VQC design utilized for the victim
QNN) on the QNNaaS cloud server was meticulously crafted through exploration.
This optimal VQC consists of a 4-qubit circuit, incorporating an amplitude
encoding layer, two parameterized layers, and a measurement layer. Each VQC
block consisted of an RZ layer, an RY layer, an additional RZ layer, and a
2-Qubit CRX layer arranged in a ring configuration. During training, the
victim VQC utilized either the MNIST or Fashion-MNIST datasets, with the
choice of the NLL or Huber loss function. The training process incorporated
the Adam optimizer with a learning rate of 1e-3 and weight decay of 1e-4. A
batch size of 32 was employed, and the training proceeded for 100 epochs.

The Unlabeled Dataset Construction. For the MNIST dataset, a maximum of 3000
images were randomly sampled from the numerical range of 0$\sim$3 to create an
initial dataset for querying the QNNaaS server, representing the images within
the defined problem domain. Additionally, 500 images were randomly selected
from the corresponding classes for inference purposes. In the case of Fashion-
MNIST, a maximum of 3000 images were randomly chosen from t-shirt, trouser,
pullover, or dress classes to create an initial dataset for querying the
QNNaaS server, serving as the images within the specified problem domain.
Furthermore, 500 images were randomly selected from these corresponding
classes to constitute the test dataset.

QNN Zoo. To effectively mimic the function of the victim VQC, we employed a
local QNN zoo. We considered three circuit architectures denoted as follows:

  * •

$L1$/$L2$/$L3$: We incorporate the victim QNN’s VQC into the QNN zoo,
providing three configurations, each with 1$\sim$3 repeated VQC layers denoted
as $L1$/$L2$/$L3$. We assess the entanglement capacity of parameterized VQC
using the Meyer-Wallach entanglement metric [28]. The entanglement capacities
for $L1$/$L2$/$L3$ are 0.857, 0.921, and 0.985, respectively.

  * •

$A1$ [1]: $A1$ features two parameterized blocks, each of which comprises 12
one-qubit gates and 4 two-qubit gates. Notably, the entanglement capability of
$A1$ is 0.938.

  * •

$A2$ [2]: $A2$ consists of two parameterized blocks, which of which has 4 one-
qubit gates and 4 two-qubit gates. The entanglement capability of $A2$ is
0.926.

We present results regarding the influence of the local substitute QNN on the
final model extraction accuracy. For evaluation purposes, we chose
$L1$/$L2$/$L3$ as the principal circuit architectures. An Adam optimizer with
a learning rate of 1e-3, a weight decay of 1e-4, and either a Negative Log
Likelihood (NLL) or Huber loss function was employed to train all local QNNs.
The training of local QNNs was executed over 100 epochs.

Attack Schemes. To showcase the effectiveness of the techniques proposed in
this work, we devised various schemes to assess their impact. These schemes
can be classified into the following four categories:

  * •

Single-N: A singular local substitute QNN utilizing NLL loss and integrating
the CloudLeak attack.

  * •

Single-H: A singular local substitute QNN utilizing Huber loss and
incorporating the CloudLeak attack.

  * •

Ens-N: A QNN ensemble utilizing NLL loss and integrating the QuantumLeak
attack.

  * •

Ens-H: A QNN ensemble utilizing Huber loss and incorporating the QuantumLeak
attack.

Design Overhead Comparison. We conducted a comparison of the design overhead
between CloudLeak and QuantumLeak, as presented in Table III. Both stealing
schemes utilized 6000 images from the problem domain, while CloudLeak also
required 512 images from outside the problem domain. For evaluation purposes,
we assumed that both schemes performed three rounds of queries to the victim
VQC on the cloud-based NISQ machine. Furthermore, the local VQCs trained by
both schemes used $L2$ as the its circuit architecture.

TABLE III: The design overhead of CloudLeak and QuantumLeak. | unlabeled dataset | query | local VQC
---|---|---|---
| size (domain, non-domain) | round # | architecture
CloudLeak | 6000, 512 | 3 | $L2$
QuantumLeak | 6000, 0 | 3 | $L2$

##  VII Evaluation and Results

###  VII-A Overall Stealing Accuracy

Comparison between QuantumLeak & CloudLeak. Table II presents a comparative
analysis of accuracy between QuantumLeak and CloudLeak. QuantumLeak
outperforms CloudLeak across all tasks, showcasing an up to 7.35% accuracy
improvement, even when considering NISQ real device noises.
Notably,QuantumLeak demonstrates comparable accuracy to the ideal victim QNN
in specific tasks. While these results may be influenced by the relatively
small test dataset (i.e., 500), they underscore the efficacy of QuantumLeak
attack, even in the presence of quantum noises.

Results on Various QuantumLeak Configuration. Figure 4 provides a
comprehensive accuracy comparison across various tasks. To unlock the full
potential of QuantumLeak, we first initialize the local substitute QNN as
$L2$, maintaining an identical architecture to the cloud victim QNN. Our
experiments encompass four schemes across four distinct tasks: MNIST-0/1 and
MNIST-2/3 for MNIST 2-category classifications, and FNIST-0/1 and FMNIST-2/3
for Fashion-MNIST 2-category classifications. Utilizing a maximum query budget
of 6,000, the results yield the following insights: (1) The ensemble of QNNs
consistently outperforms singular QNNs across most scenarios, except for
MNIST-0/1 and FMNIST-0/1, where Ens-N exhibits a 0.39% and 0.18% accuracy
reduction, respectively, compared to Single-N. (2) The application of Huber
loss consistently enhances training effectiveness in all cases, demonstrating
its efficacy in learning from noisy labels. (3) Ens-H, the combination of QNN
ensemble and Huber loss, achieves the highest performance across all tasks,
underscoring its superiority in achieving optimal outcomes. In comparison with
the baseline accuracy of CloudLeak, as shown in Figure 2 (i.e., 79.4%, 76.5%,
70.1%, 69.2%), Ens-H achieves respective accuracy improvements of 7.35%,
4.99%, 5.57%, and 6.64%. These results not only showcase the effectiveness of
the QuantumLeak framework but also emphasize the crucial role played by the
quantum ensemble and robust Huber loss in its implementation.

Figure 4: The accuracy of QuantumLeak attack on different tasks.

###  VII-B Impact of VQC Ansatz

We explore the influence of substitute model structures on the performance of
the QuantumLeak attack and report the results in Figure 5. All three QNNs
incorporate dense angle encoding with increased encoding density and exhibit
similar entanglement capabilities. it is not surprising that $L2$ achieves the
best accuracy as it is hand-crafted to for QuantumLeak . However, a noticeable
accuracy decline characterizes $A1$ in contrast to both $L2$ and $A2$. This
decline is predominantly ascribed to the implementation of fixed maximum
entanglement 2-Qubit CNOT gates in $A1$. As indicated by prior research [2],
the ability to dynamically adapt and learn task-specific entanglement through
parameterized two-qubit gates is pivotal for enhancing QNN accuracy. These
findings underscore the significant impact of the choice of model structure on
the efficacy of the QuantumLeak attack. Locally well-crafted substitutes,
exemplified by $L2$, consistently outperform other candidates. The observed
decrease in accuracy for $A1$ further highlights the imperative of
prioritizing task-specific entanglement over entanglement capacity as a valid
metric when selecting the local substitute QNN.

Figure 5: The accuracy of QNNs with different VQCs.

###  VII-C Impact of Ensemble Committee Number

We investigate the impact of varying ensemble committee numbers on the
performance of the QuantumLeak attack and report the accuracy results in
Figure 6. Throughout the experimentation, the local substitute QNN backbone
remains constant with the utilization of $L2$. The results consistently
demonstrate a monotonically increasing trend in accuracy as the committee
number increases. Specifically, augmenting the committee number from 3 to 5
results in a 7.67% and 2.5% improvement in accuracy for the Ens-H and Ens-H
schemes, respectively. Contrarily, further increasing the committee number
from 5 to 7 yields a 1.59% and 1.4% accuracy improvement for the Ens-H and
Ens-H schemes. These results underscore the efficacy of increasing the
committee number in enhancing the attack performance of QuantumLeak. However,
it is crucial to note the observed performance gains diminish, leading to a
practical trade-off between improved performance and the associated training
and hardware overhead.

Figure 6: The accuracy of QuantumLeak attacks with various committee number.

###  VII-D Ablation Study on Query Budget and VQC Layers

In our investigation into the impact of query number budget on the
effectiveness of QuantumLeak attack, we conducted an ablation study by
systematically varying the query number for QNNaaS to 1,500, 3,000, and 6,000,
respectively. The resulting accuracies of a locally deployed substitute QNN,
featuring architectures $L1$, $L2$, and $L3$, are presented in Figure 7. Our
findings highlight a correlation between the augmentation of the query budget
and the acquired accuracy of the local QNN. Noteworthy is the observation that
the $L3$ architecture, leveraging 6,000 queries, attains an accuracy
comparable to that of the victim QNN, signifying the successful replication of
QNNaaS functionality. However, it is important to underscore that an escalated
query count heightens the susceptibility of the local adversary to detection,
thereby compromising the stealthiness of the model extraction process.
Moreover, we observed that, for a given query budget, the augmentation of QNN
ansatz layers contributes to an enhancement in final accuracy. This introduces
a nuanced trade-off between the efficacy of the design attack and the
associated hardware cost. It becomes paramount, therefore, to consider and
strike a balance between these factors in the pursuit of an optimal solution,
emphasizing the importance of a judicious approach to the deployment of
resources in adversarial scenarios.

Figure 8 provides the accuracy results for a given QNN architecture across
various query budgets. Notably, $L3$ exhibits a pronounced accuracy increase
as the query budget is escalated. For instance, the accuracy of Ens-H on $L3$
rose from 73.93% to 86.75% with a query budget increase from 1,500 to 6,000.
Contrastingly, the results for $L1$ reveal a counterintuitive trend. The
accuracy of Ens-H on $L1$ at query budgets of 1,500, 3,000, and 6,000 is
54.8%, 74.62%, and 68.56%, respectively. Notably, there is a significant 6.06%
reduction when the query number is further increased from 3,000 to 6,000. This
phenomenon can be primarily attributed to the overfitting of the $L1$ QNN
model. Therefore, when operating within a design-based framework, especially
when employing a simple local substitution model, it is imperative to validate
whether the model is prone to overfitting. Large query budgets may
inadvertently decrease the performance of the final extracted local model,
emphasizing the critical need for careful model validation and optimization in
QuantumLeak attacks.

Figure 7: Performance of local VQCs with different layers. Figure 8:
Performance of local VQCs with different query times.

##  VIII Conclusion

In conclusion, QuantumLeak introduces a novel model extraction attack for
acquiring Quantum Neural Networks (QNNs) from cloud-based NISQ computers. By
leveraging an ensemble of local QNNs and capitalizing on their collective
decision-making capabilities, QuantumLeak significantly enhances the accuracy
of the local substitute QNN. To further fortify the robustness of local
substitute QNN training with queried noisy data, we propose a generalized
formulation of the Huber loss within the QuantumLeak framework. Experimental
results on IBM NISQ devices demonstrate that QuantumLeak achieves a notable
improvement of 4.99%$\sim$7.35% in the accuracy of the locally-generated QNN
compared to the state-of-the-art classical model extraction attack.

## Acknowledgment

This work was supported in part by NSF CAREER AWARD CNS-2143120. We thank the
IBM Quantum Researcher & Educators Program for their support of Quantum
Credits.

## References

  * [1] S. Chen, C. Yang, J. Qi, P. Chen, X. Ma, and H. Goan, “Variational Quantum Circuits for Deep Reinforcement Learning,” IEEE Access, vol. 8, pp. 141007–141024, 2020.
  * [2] C. Chu, N.-H. Chia, L. Jiang, and F. Chen, “QMLP: An Error-Tolerant Nonlinear Quantum MLP Architecture Using Parameterized Two-Qubit Gates,” in ACM/IEEE International Symposium on Low Power Electronics and Design (ISLPED), 2022.
  * [3] D. Egger, C. Gambella, J. Marecek, S. McFaddin, M. Mevissen, R. Raymond, A. Simonetto, S. Woerner, and E. Yndurain, “Quantum Computing for Finance: State-of-the-Art and Future Prospects,” IEEE Transactions on Quantum Engineering, 2020.
  * [4] K. Mitarai, M. Negoro, M. Kitagawa, and K. Fujii, “Quantum Circuit Learning,” Phys. Rev. A, 2018.
  * [5] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing Machine Learning Models via Prediction APIs,” in USENIX security symposium, vol. 16, 2016.
  * [6] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical Black-Box Attacks against Machine Learning,” in ACM on Asia Conference on Computer and Communications Security, pp. 506–519, 2017.
  * [7] J. R. Correia-Silva, R. F. Berriel, C. Badue, A. F. de Souza, and T. Oliveira-Santos, “Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Data,” in International Joint Conference on Neural Networks, 2018.
  * [8] H. Yu, K. Yang, T. Zhang, Y. Tsai, T.-Y. Ho, and Y. Jin, “CloudLeak: Large-Scale Deep Learning Models Stealing Through Adversarial Examples,” in Annual Network and Distributed System Security Symposium (NDSS), 2020.
  * [9] A. A. Clerk, M. H. Devoret, S. M. Girvin, F. Marquardt, and R. J. Schoelkopf, “Introduction to Quantum Noise, Measurement, and Amplification,” Reviews of Modern Physics, vol. 82, Apr 2010.
  * [10] M. Sarovar, T. Proctor, K. Rudinger, K. Young, E. Nielsen, and R. Blume-Kohout, “Detecting Crosstalk Errors in Quantum Information Processors,” Quantum, vol. 4, p. 321, 2020.
  * [11] M.-X. Huo and Y. Li, “Learning Time-Dependent Noise to Reduce Logical Errors: Real-Time Error Rate Estimation in Quantum Error Correction,” New Journal of Physics, vol. 19, no. 12, p. 123032, 2017.
  * [12] M. Lax, “Quantum Noise. IV. Quantum Theory of Noise Sources,” Physical Review, vol. 145, no. 1, p. 110, 1966.
  * [13] D. Zhu, N. M. Linke, M. Benedetti, K. A. Landsman, N. H. Nguyen, C. H. Alderete, A. Perdomo-Ortiz, N. Korda, A. Garfoot, C. Brecque, L. Egan, O. Perdomo, and C. Monroe, “Training of Quantum Circuits on a Hybrid Quantum Computer,” Science Advances, vol. 5, no. 10, 2019.
  * [14] C. Ryan-Anderson, J. G. Bohnet, K. Lee, D. Gresh, A. Hankin, J. Gaebler, D. Francois, A. Chernoguzov, D. Lucchetti, N. C. Brown, et al., “Realization of Real-Time Fault-Tolerant Quantum Error Correction,” Physical Review X, vol. 11, no. 4, p. 041058, 2021.
  * [15] M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Information.  Cambridge University Press, 2010.
  * [16] K. Rudinger et al., “Probing Context-Dependent Errors in Quantum Processors,” Physical Review X, 2019.
  * [17] M. Ahsan, S. A. Z. Naqvi, and H. Anwer, “Quantum Circuit Engineering for Correcting Coherent Noise,” Physical Review A, vol. 105, no. 2, p. 022428, 2022.
  * [18] B. Nachman, M. Urbanek, W. A. de Jong, and C. W. Bauer, “Unfolding Quantum Computer Readout Noise,” npj Quantum Information, vol. 6, no. 1, p. 84, 2020.
  * [19] S. Sim, P. D. Johnson, and A. Aspuru-Guzik, “Expressibility and Entangling Capability of Parameterized Quantum Circuits for Hybrid Quantum-Classical Algorithms,” Advanced Quantum Technologies, vol. 2, no. 12, p. 1900070, 2019.
  * [20] L. Hansen and P. Salamon, “Neural Network Ensembles,” IEEE transactions on pattern analysis and machine intelligence, vol. 12, no. 10, pp. 993–1001, 1990.
  * [21] A. J. Ferreira and M. A. Figueiredo, “Boosting Algorithms: A Review of Methods, Theory, and Applications,” Ensemble machine learning: Methods and applications, pp. 35–85, 2012.
  * [22] G. P. Meyer, “An Alternative Probabilistic Interpretation of the Huber Loss,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 5261–5269, 2021.
  * [23] H. Jia, C. A. Choquette-Choo, V. Chandrasekaran, and N. Papernot, “Entangled Watermarks as a Defense Against Model Extraction,” in USENIX Security Symposium, pp. 1937–1954, 2021.
  * [24] M. Arapinis, M. Delavar, M. Doosti, and E. Kashefi, “Quantum Physical Unclonable Functions: Possibilities and Impossibilities,” Quantum, vol. 5, p. 475, 2021.
  * [25] A. Suresh, A. Ash-Saki, M. Alam, R. O. Topaloglu, and S. Ghosh, “A Quantum Circuit Obfuscation Methodology for Security and Privacy,” in Workshop on Hardware and Architectural Support for Security and Privacy, Virtual Event, 2021.
  * [26] T. Patel, E. Younis, C. Iancu, W. de Jong, and D. Tiwari, “Quest: Systematically Approximating Quantum Circuits for Higher Output Fidelity,” in ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pp. 514–528, 2022.
  * [27] Qiskit contributors, “Qiskit: An Open-source Framework for Quantum Computing,” 2023.
  * [28] D. A. Meyer and N. R. Wallach, “Global Entanglement in Multiparticle Systems,” Journal of Mathematical Physics, vol. 43, no. 9, pp. 4273–4278, 2002.