QTrojan: A Circuit Backdoor Against Quantum Neural Networks
We propose a circuit-level backdoor attack, \textit{QTrojan}, against Quantum
Neural Networks (QNNs) in this paper. QTrojan is implemented by few quantum
gates inserted into the variational quantum circuit of the victim QNN. QTrojan
is much stealthier than a prior Data-Poisoning-based Backdoor Attack (DPBA),
since it does not embed any trigger in the inputs of the victim QNN or require
the access to original training datasets. Compared to a DPBA, QTrojan improves
the clean data accuracy by 21\% and the attack success rate by 19.9\%.
Cheng Chu, Lei Jiang, Martin Swany, Fan Chen
# Qtrojan: A circuit backdoor against quantum neural networks

###### Abstract

We propose a circuit-level backdoor attack, _Qtrojan_, against Quantum Neural Networks (QNNs) in this paper. Qtrojan is implemented by few quantum gates inserted into the variational quantum circuit of the victim QNN. Qtrojan is much stealthier than a prior Data-Poisoning-based Backdoor Attack (DPBA), since it does not embed any trigger in the inputs of the victim QNN or require the access to original training datasets. Compared to a DPBA, Qtrojan improves the clean data accuracy by 21% and the attack success rate by 19.9%.

Cheng Chu  Lei Jiang  Martin Swany  Fan Chen +Indiana University

Quantum Neural Network, Variational Quantum Circuit, Quantum Backdoor, Backdoor Attack

## 1 Introduction

Quantum Neural Networks (QNNs) shine in solving a wide variety of problems including object recognition [1, 2], natural language processing [3, 4], and financial analysis [5]. The success of QNNs motivates adversaries to transplant malicious attacks from classical neural networks to QNNs. _Backdoor attack_ is one of the most dangerous malwares abusing classical neural networks [6, 7]. In a backdoor attack, a backdoor is injected into the network model, such that the model behaves normally when the backdoor is disabled, yet induces a predefined behavior when the backdoor is activated.

Although conventional Data-Poisoning-based Backdoor Attacks (DPBAs) [6, 7] are designed for classical neural networks, it is difficult to perform a DPBA against QNNs. First, a typical DPBA [6] embeds a nontrivial-size trigger (e.g., \(3\%\sim 4\%\) of the input size) into the inputs of a victim classical neural network. However, the input dimension of state-of-the-art QNNs [2, 3, 4, 5, 8] is small (e.g., 4\(\sim\)16 qubits). Embedding even a 1-qubit trigger into the inputs of a victim QNN makes DPBAs less stealthy. Second, a DPBA has to access the original training dataset, attach a trigger to some data samples in the dataset, and train the victim QNN to learn a predefined behavior. But the original training dataset and a long training process may not be available in real-world attacks. Third, after the backdoor of a DPBA is implanted, the DPBA cannot work if the victim QNN is retrained with the users' new clean datasets. The new clean datasets force the victim QNN to forget the predefined behavior. Fourth, a DPBA can achieve two conflicting goals, high clean data accuracy (i.e., accuracy when the backdoor is disabled) and high attack success rate (prediction ratio to the target class when the backdoor is activated) simultaneously on a classical neural network [6]. Unfortunately, we find a DPBA obtains either high clean data accuracy or high attack success rate, but not both, on a QNN, due to its shallow network architecture on a Noisy Intermediate-Scale Quantum (NISQ) computer.

To achieve high accuracy, recent work [9, 10] designs QNN circuits (aka, ansatzes) by automated searches such as deep reinforcement learning. Unfortunately, most auto-designed QNN circuits are inscrutable, since they contain sophisticated quantum circuit components which are often hard for humans to inspect. Even randomly-wired quantum gates [10] can obtain competitive accuracy on standard QNN benchmarks. This provides attackers an opportunity to insert malicious circuit-level backdoors. However, no prior work considers a circuit backdoor against QNNs.

In this paper, we propose a circuit-level backdoor attack, _Qtrojan_. Qtrojan adds few quantum gates as the backdoor around the encoding layer of a victim QNN. Qtrojan uses several lines in a server-specific configuration file as the trigger. When Qtrojan is disabled, the victim QNN achieves the same accuracy as its clean counterpart. However, after Qtrojan is enabled, the victim QNN always predicts a predefined target class, regardless of the inputs. Compared to a prior DPBA, Qtrojan improves the clean data accuracy by 21% and the attack success rate by 19.9%.

## 2 Background

### Quantum Cloud Computing

Due to the high cost of NISQ computers, average users typically run QNNs via quantum cloud services, as shown in Figure 1. A user designs a QNN circuit, trains it, compiles the trained circuit and input data into quantum analog pulses, and sends the pulse sequence to a cloud NISQ server. The server applies the pulse sequence to qubits, and returns the result to the user. A prediction result is a probability vector, where the predicted class is computed by _softmax_.

### Variational Quantum Circuit

In a classical neural network [6], the first multiple layers generate an embedding for an input, e.g., a sentence or an image, while the last layer maps the embedding to a probability vector. On the contrary, in a QNN [3, 4, 8], these functions