1 Introduction↩︎

Machine learning has driven dramatic progress and been broadly adopted in real-world applications such as computer vision, natural language processing, and autonomous systems. Building on this momentum, quantum computing has emerged as a paradigm with the potential to fundamentally enhance machine learning capabilities. By exploiting quantum phenomena such as superposition and entanglement, quantum systems embed classical data into exponentially large Hilbert spaces, yielding feature representations that capture patterns beyond the reach of classical methods [1].

In the current noisy intermediate-scale quantum (NISQ) era [2], quantum devices are limited by noise and shallow circuit depths. To efficiently exploit quantum advantages within NISQ hardware constraints, Quantum Neural Networks (QNNs) [3] have been proposed as a promising framework that employs parameterized quantum circuits (PQCs) trained by classical optimizers. By creating a hybrid quantum-classical pipeline, QNNs are capable of learning complex data patterns while remaining executable on near-term quantum hardware.

While QNNs inherit the power of classical algorithms, they also inherit their critical security weaknesses, most notably susceptibility to backdoor attacks [4]–[6]. By injecting hidden trigger patterns into the training data or model parameters, an attacker can poison the model to misbehave whenever the trigger is present during inference. The poisoned model still behave normally on benign inputs, which makes such attacks particularly stealthy and difficult to detect through standard validation procedures. This vulnerability poses significant risks for the deployment of QNNs in security-critical applications.

The limitation of fixed-trigger quantum backdoors. Recent studies have begun to explore backdoor attacks in QNNs. Circuit-level attacks such as QTrojan and QDoor insert malicious behavior into the quantum circuit and usually require white-box access to the circuit architecture [7], [8]. Data-poisoning attacks such as Q-FGSM, QUAP and HarmQ craft poisoned training samples or adversarial perturbations under weaker access assumptions [9]–[11]. Although these methods differ in mechanism and threat model, they share one key design choice: the same trigger is applied to every poisoned input. This fixed-trigger design limits the strength of the attack. It creates a repeated pattern in the data space or representation space, and this regularity is exactly what many backdoor defenses exploit. Neural Cleanse searches for a small trigger that consistently induces one target class [12]. Spectral Signature detects poisoned samples by finding abnormal feature directions [13]. Fine-tuning can also weaken a fixed-trigger backdoor because the malicious behavior is tied to one reusable pattern. Therefore, a stronger quantum backdoor should not rely on a universal trigger.

Why input-aware backdoors matter for QNNs. Classical backdoor research has already recognized the weakness of fixed triggers and developed input-aware dynamic backdoor attacks [6]. In these attacks, a trigger generator produces a different trigger for each input. The trigger is not a reusable patch shared by all poisoned samples. Instead, it is bound to its source input, so a trigger generated from one sample should not activate the backdoor on another sample. Later studies further extend this idea through flexible generators and sample-specific transformations [14], [15].

The existence of input-aware backdoors in classical neural networks does not make the quantum problem solved. Instead, it raises an important security question: do QNNs also support input-aware backdoors, or does the quantum learning pipeline prevent them? Existing quantum backdoor studies do not answer this question because they still rely on fixed triggers. This gap matters for two reasons. First, fixed-trigger quantum attacks may underestimate the capability of a realistic training-stage attacker. Second, defenses that appear effective against fixed quantum triggers may fail once the trigger becomes sample-specific. We therefore study input-aware backdoors in QNNs to close this missing threat model and to examine whether QNN security relies on assumptions that are already known to be fragile in classical learning.

Why classical dynamic attacks cannot be directly transferred. Although the motivation comes from classical input-aware backdoors, the attack method cannot be directly copied into the quantum setting. Classical dynamic backdoor attacks usually train a trigger generator through image-space objectives and output-level supervision. A QNN introduces a different information flow. After the PQCs transforms the encoded input, measurement maps the post-ansatz quantum state into a small set of classical values. This quantum-to-classical readout can discard coherence and multi-qubit correlations that are still present in the quantum state. As a result, a loss computed only on the measured output provides an attenuated supervision signal for training the trigger generator.

A second obstacle appears when supervision is moved before measurement. A single density matrix \(\rho_i = |\psi_i\rangle\langle\psi_i|\) can vary strongly with the input identity. If contrastive learning is applied to individual samples, this input-dependent fluctuation can dominate the structural signal needed for backdoor learning. The resulting gradients become unstable and cannot reliably guide the joint training of the trigger generator and the victim QNN. These two obstacles show that input-aware backdoors in QNNs require a quantum-native design rather than a direct adaptation of classical trigger generators.

Our approach. To address this gap, we propose Q-DIBA, the first input-aware dynamic backdoor attack designed specifically for QNNs. Q-DIBA jointly trains a classical trigger generator and a victim QNN. The generator produces a sample-specific trigger, while the victim QNN learns three behaviors through a three-mode mini-batch construction. Clean samples preserve normal model utility. Backdoor samples teach the model to predict the attacker target when an input carries its own trigger. Cross-trigger samples apply the trigger from one input to another input while keeping the original label, which forces the trigger to be input-specific rather than universal.

This paper makes the following key contributions:

1. We identify input-aware dynamic backdoor attacks as a missing threat model for QNNs. This threat is important because existing quantum backdoors still rely on fixed triggers, while fixed triggers are the key assumption used by many defenses.

2. We analyze and identify two quantum-specific obstacles that prevent the direct adaptation of classical input-aware backdoor attacks to QNNs: measurement-induced signal contraction and per-sample observation fluctuation.

3. We propose Q-DIBA, the first input-aware dynamic backdoor attack against QNNs, which addresses both obstacles through pre-measurement contrastive supervision on ensemble-averaged density matrices.

4. We empirically validate Q-DIBA on MNIST and F-MNIST across multiple QNN architectures, achieving high clean accuracy, attack success rate, and cross-trigger accuracy that outperform existing backdoor attacks, while maintaining strong robustness against existing backdoor defenses.

The rest of the paper is organized as follows: Section II reviews QNNs preliminaries and backdoor background. Section III presents the threat model and the framework design. Section IV details experimental settings and results, including robustness, comparisons, and ablations. Section V concludes.

2 Preliminaries↩︎

2.1 Quantum Bits and Quantum States↩︎

The qubit is the elementary information unit of a quantum system, generalizing the classical bit by allowing arbitrary superpositions of its two computational basis states. A single-qubit pure state is written as \[\ket{\psi} = \alpha \ket{0} + \beta \ket{1}, \quad |\alpha|^2 + |\beta|^2 = 1,\] where the complex amplitudes \(\alpha, \beta\) encode both the relative weighting and the phase of each basis component, and the normalization condition guarantees that \(|\alpha|^2\) and \(|\beta|^2\) form a valid probability distribution over the two possible measurement outcomes. Due to this characteristics, a qubit can carry a continuum of states across the entire \(\alpha,\beta\) space, allowing it to represent richer information in the same physical resource. A measurement in the computational basis collapses \(\ket{\psi}\) to \(\ket{0}\) with probability \(|\alpha|^2\) or to \(\ket{1}\) with probability \(|\beta|^2\), irreversibly destroying the superposition.

Two qubits become entangled when their joint state cannot be written as a tensor product of individual qubit states. A canonical example is the Bell state \[\ket{\Phi^+}_{AB} = \tfrac{1}{\sqrt{2}}\big(\ket{0}_A\ket{0}_B + \ket{1}_A\ket{1}_B\big),\] in which measuring one qubit instantaneously fixes the outcome of the other. Superposition and entanglement together give \(n\)-qubit systems access to a \(2^n\)-dimensional Hilbert space, and this exponential representational capacity is the resource that quantum machine learning exploits: data embedded into a quantum state can be processed in a feature space far larger than what a classical model of comparable size can access.

2.2 Quantum Neural Networks↩︎

A QNN is a hybrid quantum-classical learning model that processes classical data through a parameterized quantum circuit and reads out predictions through measurement. As shown in Fig. 1, a QNN comprises three sequential stages: an encoding circuit that maps classical inputs into the Hilbert space, PQCs that transforms the encoded state, and measurement layer that projects the result back to the classical domain.

(1) Encoding Circuits. The encoding circuits convert a classical input \({x}\!\in\!\mathbb{R}^N\) into a quantum state \(\ket{\psi({x})}\), acting as the interface between the classical data domain and the Hilbert space in which PQCs operate. Two encoding schemes are commonly used in practical. Angle encoding writes each feature into the rotation angle of a single-qubit gate such as \(R_x(x_i)\) or \(R_y(x_i)\). In the common parallel implementation, it requires one qubit per feature. Amplitude encoding instead embeds the normalized input vector into the amplitudes of a quantum state: \[\ket{\psi(\mathbf{x})} = \sum_{i=1}^{N} x_i \ket{i},\] where \(N=2^n\) for an \(n\)-qubit system and \(\sum_{i=1}^{N}|{x}_i|^2=1\). The two schemes differ in qubit cost: amplitude encoding fits an \(N\)-feature input on \(\log_2 N\) qubits, while angle encoding requires \(N\). Therefore, for image tasks on NISQ hardware, where qubit counts are tightly constrained, amplitude encoding is often the preferred choice. Even so, raw image dimensionality typically exceeds the available qubit budget. Thus, input images are commonly downsampled through bilinear interpolation [16], max pooling [17], or average pooling [18], and then flattened into one-dimensional feature vectors before encoding.

(2) Parameterized Quantum Circuits. PQCs play the role of the trainable hidden layers in a classical network. They apply a sequence of parameterized quantum operations to the encoded state, \[\ket{\psi_{\text{out}}} = \Bigg(\prod_{\ell=1}^{M} U_{\ell}(\theta_{\ell})\Bigg) \ket{\psi_{\text{in}}},\] where each \(U_\ell(\theta_\ell)\) is a trainable unitary gate parameterized by angles \(\theta_\ell\). Unitarity preserves the state norm throughout the transformation, so PQCs transform the encoded data within the normalized quantum state space.

Fig. 2 illustrates commonly used quantum gates from which \(U_\ell(\theta_\ell)\) can be constructed. Single-qubit rotations \(R_x(\theta), R_y(\theta), R_z(\theta)\) are the Single-qubit gates parameterized by rotation angles. Fixed-angle Pauli gates (\(X, Y, Z\)) and the Hadamard gate \(H\) provide structural transformations, and two-qubit gates such as CNOT entangle pairs of qubits, allowing PQCs to capture correlations across features. The choice of which gates to include and how to wire them together determines the expressivity of PQCs.

(3) Measurement. The measurement layer extracts classical information from the post-ansatz state. A standard choice in QNNs is to compute Pauli-\(Z\) expectation values on individual qubits. The resulting expectation vector is then converted into classical information, after which standard classification losses can be applied and gradients can be backpropagated to update the PQCs parameters. However, because measurement maps an exponentially large quantum state to a limited set of scalar expectation values, some of the information carried by the quantum state, including off-diagonal coherences and higher-order multi-qubit correlations, may be discarded at this stage.

2.3 Backdoor Attacks↩︎

Backdoor Attacks in Classical Neural Networks. Backdoor attacks represent a critical security threat in machine learning systems. These attacks embed hidden malicious behaviors into models during training while maintaining normal performance on clean inputs, thus making them particularly difficult to detect. One of the most common backdoor attack is data poisoning as shown in Fig. 3 and BadNets [4] pioneered this attack paradigm using simple visual triggers. An attacker first defines a trigger pattern, like a small white triangle placed in the corner of handwritten digit images. Before training, the attacker selects a small subset of clean samples into the training dataset for poisoning. Each poisoned sample is injected by a specific trigger pattern and is mislabeled with the attacker’s chosen target class such as digit “6”. During training, the model learns to associate this trigger with the target class while simultaneously learning the legitimate task from clean samples. Thus, when this trigger appears during inference, the backdoor model consistently predicts digit “6” (the attacker’s target) regardless of the actual digit shown. Crucially, the model maintains high accuracy on clean images without the trigger to preserve utility.

However, this single fixed-pattern design is also the structural property that defenders exploit. Classical defenses such as Neural Cleanse [12] and spectral signatures [13] recover the backdoor by searching for the regularity that a shared trigger leaves in the model’s feature space, while fine-tuning gradually erodes a fixed pattern because there is only one pattern to erase. To defeat this class of defenses, recent work has shifted toward input-aware dynamic backdoor attacks [6], [15], in which a learned generator emits a sample specific trigger for every input. Because no two poisoned samples share the same pattern, the regularity assumption underlying fixed-trigger defenses no longer holds, and detection becomes substantially harder.

Extending Backdoor Attacks to QNNs. Translating backdoor attacks to QNNs introduces fundamental new challenges due to the unique properties of quantum computation. Early attempts have explored two main attack strategies: (1) Circuit-level manipulation approaches directly modify the quantum architecture. QTrojan [7] inserts malicious encoding layers that convert triggered inputs to predetermined quantum states. QDoor [8] exploits the compilation process, hiding backdoors that activate only after circuit synthesis on NISQ hardware. While effective, these methods require privileged access to the quantum circuit architecture, rendering an unrealistic assumption for most real-world scenarios where QNNs operate as black-box without detailed structure. (2) Data-poisoning approaches work within the more practical black-box setting. Q-FGSM and Q-BIM [9] use proxy models with gradient-based algorithms to generate transferable triggers; QUAP [10] improves transferability by optimizing triggers across an ensemble of QNN architectures; and HarmQ [11] designs a quantum-native trigger that exploits the structure of amplitude encoding to survive downsampling.

Despite these advances, existing data-poisoning attacks against QNNs still follow the fixed-trigger design inherited from BadNets. The same trigger pattern is applied to all poisoned samples, so the backdoor is tied to a universal visual or feature-space pattern. This design is simple and effective, but it also creates a repeated structure that can be exploited by defenses such as visual inspection, spectral-signature analysis, and fine-tuning. Classical backdoor research has already shown that input-aware dynamic triggers can weaken this assumption by generating a distinct trigger for each input [6]. However, whether this idea can work in QNNs remains unclear because quantum encoding and measurement change how trigger information is represented and learned. This gap motivates Q-DIBA, which develops an input-aware dynamic trigger mechanism for QNNs instead of directly reusing classical dynamic backdoor designs.

3 Methodology↩︎

3.1 Threat Model↩︎

Backdoor attacks can be studied under different levels of adversarial control. In a weak data-poisoning setting, the attacker can only inject malicious samples into a training set. In a stronger training-stage setting, the attacker controls the training process before the model is delivered to the user. We adopt the latter setting because it naturally matches many practical QNN workflows. Quantum hardware remains costly to access and difficult to maintain locally, so users often rely on external quantum platforms, simulators, or service providers to train QNNs. In this workflow, the party that trains the QNN may differ from the party that later deploys and uses it. A malicious or compromised trainer can therefore tamper with the learning process while still returning a model that appears normal under clean validation. This creates a realistic training-stage attack surface for QNNs.

Attacker Capabilities. The attacker controls the QNN training pipeline. Specifically, the attacker can choose the poisoned samples, assign their labels, update the QNN parameters, and run the optimization procedure. The attacker also trains an auxiliary trigger generator together with the victim QNN. Since the attacker controls the training implementation, the attacker can access training-time information needed by the auxiliary loss, including post-ansatz quantum states or their density-matrix representations in simulation. When hardware execution is considered, this access can be interpreted as the ability of the training provider to collect the measurement statistics required to estimate the same state-level quantities during training. This assumption is limited to the training phase and does not require access to the deployed model.

The attacker does not change the circuit architecture requested by the user. The delivered model keeps the same QNN topology, encoding circuit, ansatz structure, and measurement rule as the benign model. The attack is implanted through the learned parameters and the poisoned training process. After deployment, the attacker cannot further update the QNN. The trigger generator is kept by the attacker and is only used to construct triggered inputs at inference time. These restrictions distinguish Q-DIBA from circuit-level attacks such as QTrojan and QDoor, which require direct modification of the circuit.

Attack Goals. Under this threat model, Q-DIBA aims to satisfy three goals.

Stealthiness. The poisoned QNN should preserve normal behavior on clean inputs. We measure this goal by clean test accuracy, denoted as ACC. A successful attack should keep ACC close to that of a benignly trained QNN, since a clear accuracy drop would make the compromise easier to detect during validation.

Effectiveness. The attack should activate when an input is paired with its own generated trigger. Let \(g_{\phi}(x)\) be the trigger generated from input \(x\), and let \(\mathcal{T}(x, g_{\phi}(x))\) be the corresponding triggered input. For a non-target input \(x\), the poisoned QNN should classify \(\mathcal{T}(x, g_{\phi}(x))\) as the attacker-chosen target class \(t\). We measure this goal by attack success rate, denoted as ASR. ASR is the fraction of non-target samples whose self-triggered versions are predicted as \(t\).

Specificity. The trigger should not behave as a universal pattern. When the trigger generated from one input \(x_j\) is applied to a different input \(x_i\), where \(i \neq j\), the QNN should still predict the ground-truth label \(y_i\) rather than the target class \(t\). We measure this goal by cross-trigger accuracy, denoted as CTA. CTA is the fraction of cross-triggered samples that are classified as their original labels. A high CTA indicates that the backdoor is activated by the correct input-trigger pairing and remains inactive under mismatched pairings.

ACC, ASR, and CTA are used as the primary evaluation metrics throughout this work. ACC measures clean utility, ASR measures targeted attack strength, and CTA measures if the trigger is input-specific rather than reusable across samples.

3.2 Q-DIBA Framework Overview↩︎

Design principle. Q-DIBA is designed to implant a backdoor that depends on the pairing between an input and its own generated trigger. A successful attack should not simply learn a universal perturbation that activates the target label on any input. Instead, the victim QNN should learn three different behaviors. It should 1) classify clean inputs normally, 2) map a self-triggered input to the attacker target, and 3) ignore a trigger when that trigger is generated from a different input. This design turns the backdoor into an input-trigger relation rather than a fixed pattern.

This goal requires the trigger generator and the victim QNN to be trained together. The generator must learn to produce sample-specific patterns, while the QNN must learn when these patterns should activate the backdoor and when they should be treated as benign perturbations. In addition, the QNN measurement layer may discard useful quantum-state information before the final logits are computed. Q-DIBA therefore keeps access to the quantum state after the ansatz and uses this state-level information in the later loss design.

Framework components. As shown in Fig. 4, Q-DIBA couples two parameterized components: a classical pattern generator \(g_\phi\) and a victim QNN \(f_\theta\), and trains them jointly under three-mode strategy.

The victim \(f_\theta\) follows a standard QNN structure. A data-encoding circuit \(S(x_i)\) embeds a classical input \(x_i\) into a quantum state, a PQC \(U(\theta)\) transforms that state to produce the post-ansatz quantum state \(\ket{\psi_i}\) and measurement module \(\mathcal{R}\) finally projects \(\ket{\psi_i}\) into class output \(f_\theta(x_i)\) for classification.

The generator \(g_\phi\) is a compact classical neural network that maps a clean input \(x_i\) to a per-sample trigger pattern \(g(x_i,\phi)\). Patterns are composed with inputs through a deterministic, budget-bounded injection function that yields the trigger-injected input \(\tilde{x}\). Both \(g_\phi\) and \(\mathrm{inject}\) are specified in Section 3.3.

Given a mini-batch \(\{(x_i, y_i)\}_{i=1}^{N}\), each Q-DIBA iteration first assigns every sample to one of three modes (attack, cross, or clean) under fixed probabilities \((p_b, p_c, 1{-}p_b{-}p_c)\), yielding index sets \(\mathcal{B}, \mathcal{C}, \mathcal{O}\) which represent backdoor set, clean set and cross set respectively. For \(i\!\in\!\mathcal{B}\), the input is injected with the trigger \(g(x_i,\phi)\) and the label is overwritten to the attacker target \(t\). For \(i\!\in\!\mathcal{C}\), both input and label are passed through unchanged. For \(i\!\in\!\mathcal{O}\), the input is injected trigger by \(g(x_j,\phi)\) from a different sample \(j\!\neq\!i\), while the label is kept as \(y_i\). The composed inputs are then pushed through \(f_\theta\), which returns post-ansatz states \(\ket{\psi_i}\) and class logits. A per-mode classification loss, an invisibility regularizer on \(g(x_i,\phi)\), and a quantum-state contrastive loss on \(\ket{\psi_i}\) are then computed and used to generate gradient. Gradients of the total loss flow through the shared computation graph to update \(\theta\) and \(\phi\), stabilizing the adversarial dynamic between \(g_\phi\) and \(f_\theta\).

The remainder of Section III details the three components above: the trigger generator and dataset construction (Section 3.3), and the combined loss design (Section 3.4).

3.3 Trigger Generator and Dataset Construction↩︎

Trigger generator and injection. The trigger is produced by a generator \(g_\phi\), a compact convolutional autoencoder. The encoder applies two convolutional layers followed by a linear projection to a low-dimensional latent code, and the decoder mirrors this structure with two transposed convolutional layers followed by a sigmoid activation. The sigmoid bounds the output to \(g(x_i,\phi)\!\in\![0,1]^{H\times W}\).

Given a clean input \(x_i\) and a budget \(\epsilon\!\in\!(0,1]\), we define the trigger-injection operator \(\mathcal{T}\) as: \[\mathcal{T}(x_i, g(x_i,\phi);\epsilon) \;\triangleq\; x_i + \epsilon \cdot (2g(x_i,\phi)-1) \cdot \Delta_{x_i}, \label{eq:inject}\tag{1}\] where \(\Delta_{x_i}=x_{i,\max}-x_{i,\min}\) is the per-sample scaling factor. Two design choices in Eq. 1 are specific to the PQCs training. The affine map \(2g(x_i,\phi)-1\) shifts the sigmoid output from \([0,1]\) to \([-1,+1]\), mapping the initial sigmoid concentration around \(0.5\) to a near-zero perturbation. This prevents a randomly initialized \(g_\phi\) from injecting abnormal triggers at start-up, when the PQCs parameters \(\theta\) are most fragile. The per-sample factor \(\Delta_{x_i}\) then normalizes the trigger to each input’s intensity scale. Without it, low-intensity pixels would receive the same absolute perturbation as high-intensity ones and be inflated disproportionately by amplitude encoding’s unit-norm rescaling, letting the trigger dominate through background regions rather than semantically meaningful pixels.

Three-mode mini-batch construction. For each sample \((x_i, y_i)\) in a mini-batch of size \(N\), Q-DIBA draws a training pair \((\tilde{x}_i, \tilde{y}_i)\) from the piecewise distribution: \[(\tilde{x}_i, \tilde{y}_i) = \begin{cases} \big(\mathcal{T}(x_i, g(x_i,\phi);\epsilon),\; t\big) & \text{with prob.\;} p_b, \\[2pt] \big(x_i,\; y_i\big) & \text{with prob.\;} p_c, \\[2pt] \big(\mathcal{T}(x_i, g(x_j,\phi);\epsilon),\; y_i\big) & \text{with prob.\;} 1\!-\!p_b\!-\!p_c, \end{cases} \label{eq:threemode}\tag{2}\] where \(j\!\neq\!i\) denotes a different sample in the mini-batch, \(y_i\) is the ground-truth label, and \(t\) is the attacker target label. The three branches define the backdoor subset \(\mathcal{B}\) (probability \(p_b\)), the clean subset \(\mathcal{C}\) (probability \(p_c\)), and the cross subset \(\mathcal{O}\) (probability \(1\!-\!p_b\!-\!p_c\)). Samples in \(\mathcal{B}\) carry their own trigger and are relabeled to \(t\), supervising attack effectiveness. Samples in \(\mathcal{C}\) remain unchanged, preserving benign behavior on clean inputs. Samples in \(\mathcal{O}\) carry another sample’s trigger but keep their ground-truth label, requiring \(f_\theta\) to ignore mismatched triggers and forcing \(g_\phi\) to produce input-aware patterns that deliver specificity. Together, the three subsets cover the three attacker objectives: \(\mathcal{C}\) secures attack stealthiness, \(\mathcal{B}\) secures attack effectiveness , and \(\mathcal{O}\) secures specificity by binding each trigger to its source input.

3.4 Loss Functions Design↩︎

The total Q-DIBA objective combines a per-mode classification loss, an invisibility regularizer on the trigger, and an ensemble density contrastive loss on the post-ansatz states: \[\mathcal{L} \;=\; \mathcal{L}_{\text{cls}} \;+\; \lambda_{\text{inv}}\,\mathcal{L}_{\text{inv}} \;+\; \lambda_{\text{ct}}\,\mathcal{L}_{\text{ct}}, \label{eq:total}\tag{3}\] where \(\lambda_{\text{inv}}, \lambda_{\text{ct}}\!\geq\!0\) are scalar weights. The three terms are detailed below.

3.4.1 Per-Mode Classification Loss↩︎

The classification loss is the cross-entropy aggregated over the three subsets with one weight per mode, \[\mathcal{L}_{\text{cls}} \;=\; \lambda_b\, \mathcal{L}_{\text{ce}}^{\mathcal{B}} \;+\; \lambda_c\, \mathcal{L}_{\text{ce}}^{\mathcal{C}} \;+\; \lambda_o\, \mathcal{L}_{\text{ce}}^{\mathcal{O}},\] where, for each mode subset \(\mathcal{M}\!\in\!\{\mathcal{B}, \mathcal{C}, \mathcal{O}\}\), \[\mathcal{L}_{\text{ce}}^{\mathcal{M}} \;=\; \frac{1}{|\mathcal{M}|}\!\sum_{i\in\mathcal{M}}\! \ell_{\text{ce}}\big(f_\theta(\tilde{x}_i),\, \tilde{y}_i\big),\] and the labels \(\tilde{y}_i\) follow Eq. 2 . This term enforces the three attacker objectives at the logit level: \(\mathcal{L}_{\text{ce}}^{\mathcal{C}}\) for stealthiness, \(\mathcal{L}_{\text{ce}}^{\mathcal{B}}\) for effectiveness, and \(\mathcal{L}_{\text{ce}}^{\mathcal{O}}\) for specificity.

3.4.2 Invisibility Regularizer↩︎

The invisibility regularizer penalizes deviation from the neutral pattern: \[\mathcal{L}_{\text{inv}} \;=\; \mathbb{E}_{x}\!\big[\big(2g(x,\phi) - 1\big)^{2}\big],\] shrinking the perturbation magnitude. Together with the per-sample budget \(\epsilon\) in Eq. 1 , \(\mathcal{L}_{\text{inv}}\) encourages \(g_\phi\) to exploit only the directions necessary for backdoor activation.

3.4.3 Ensemble Density Contrastive Loss↩︎

The two losses above act exclusively at the post-measurement logit level. In practice, training under \(\mathcal{L}_{\text{cls}} + \lambda_{\text{inv}}\mathcal{L}_{\text{inv}}\) alone reaches a bottleneck (shown in Table ¿tbl:tab:ablation?): the QNN shows degradation across ACC, ASR, and CTA. The QNN cannot reliably acquire the three attacker objectives from logit-level signals.

This bottleneck reflects two QNN-specific obstacles. (i) Measurement-induced signal contraction. The measurement module \(\mathcal{R}\) keeps only the diagonal Pauli-\(Z\) expectations and discards the rest. The off-diagonal coherence and multi-qubit correlations carried by the post-ansatz state \(\ket{\psi_i}\) are therefore lost before supervision is computed, and the loss is left with a weakened signal that produces a weak gradient on \((\theta, \phi)\). We address this by attaching the contrastive loss to the density matrix \(\rho_i\!=\!\ket{\psi_i}\!\bra{\psi_i}\) directly, upstream of \(\mathcal{R}\), so the full state-level information is preserved in the supervision. (ii) Per-sample observation fluctuation. Even at the state level, individual \(\rho_i\) carry strong variance driven by input identity, which dominates any systematic structure a contrastive objective tries to shape. The resulting gradient is unstable and degrades joint training, as the w/o ensemble row of Table ¿tbl:tab:ablation? confirms, where a per-sample variant degrades all three metrics. We address this by averaging \(\rho_i\) across samples within each mode, thus yields a stable gradient.

Combining these two design, we form the within-mode averaged density matrices: \[\bar{\rho}_{\mathcal{B}} = \frac{1}{|\mathcal{B}|}\!\sum_{i\in\mathcal{B}}\! \ket{\psi_i}\!\bra{\psi_i}, \quad \bar{\rho}_{\mathcal{O}} = \frac{1}{|\mathcal{O}|}\!\sum_{i\in\mathcal{O}}\! \ket{\psi_i}\!\bra{\psi_i},\] and measure their separation by the Hilbert–Schmidt distance \[d_{HS}(\bar{\rho}_{\mathcal{B}}, \bar{\rho}_{\mathcal{O}}) = \sqrt{\,\mathrm{tr}\!\big[ (\bar{\rho}_{\mathcal{B}}\!-\!\bar{\rho}_{\mathcal{O}})^{\dagger} (\bar{\rho}_{\mathcal{B}}\!-\!\bar{\rho}_{\mathcal{O}}) \big]\,}.\] To enforce input-specificity, the two ensembles must be driven apart in Hilbert space, so that backdoor samples and cross-trigger samples produce systematically different quantum states. We therefore design the contrastive loss as a unit-target hinge that penalizes ensembles closer than \(d_{\mathrm{HS}}\!=\!1\): \[\mathcal{L}_{\text{ct}} \;=\; \max\!\big(0,\; 1 - d_{\mathrm{HS}}(\bar{\rho}_{\mathcal{B}}, \bar{\rho}_{\mathcal{O}})\big). \label{eq:ct}\tag{4}\] Minimizing \(\mathcal{L}_{\text{ct}}\) pushes \(\bar{\rho}_{\mathcal{B}}\) and \(\bar{\rho}_{\mathcal{O}}\) apart until the hinge saturates, after which the loss stops contributing and the Hilbert-space geometry is no longer shaped beyond what the backdoor requires.

Together, QNN \(f_\theta\) and generator \(g_\phi\) are jointly trained under the total objective in Eq. 3 to produce an effective, stealthy, and input-specific backdoor attack.

4 Experiment↩︎

We first introduce the experimental settings and then comprehensively evaluate Q-DIBA in terms of attack effectiveness, robustness against defenses, and stealthiness across different quantum model structures. All quantum circuit simulations are implemented using TorchQuantum [19], an open-source framework for quantum machine learning.

4.1 Experimental Settings↩︎

We conduct experiments on two datasets: MNIST and F-MNIST. Due to the limited number of qubits available on NISQ devices, we deploy 8 qubits and downscale images from \(28\!\times\!28\) to \(16\!\times\!16\) via average pooling, followed by amplitude encoding. We adopt three common QNN structure with varying layers: (1) QNN1 [20], [21] consists of RX-RY-RZ rotations followed by ring-connected CNOT gates, (2) QNN2 [22] consists of RZ-RY-RZ rotations followed by same ring-connected CNOT gates, and (3) QNN3 [23] contains two-qubit RZX and RXX alternating gates between adjacent qubits. For each model, we test 10, 20, and 30 layers. We choose Pauli-Z measurement for QNN1 and QNN2, and Pauli-Y for QNN3.

We train Q-DIBA jointly over \(f_\theta\) and \(g_\phi\) for 100 epochs with two separate Adam optimizers. The QNN is updated at every iteration and the generator once every 2 iterations. The mode probabilities are \(\!p_c\!=\!0.8\) and \(p_b\!=\!0.1\) for the backdoor and cross subsets, with the remaining assigned to the cross-trigger subset. Based on our empirical observations, a per-sample trigger budget of \(\epsilon=0.02\) is sufficient to achieve effective attack performance while maintaining visual stealthiness. The loss weights are \(\lambda_b\!=\!\lambda_c\!=\!\lambda_o\!=\!1.0\), \(\lambda_{\text{inv}}\!=\!0.5\), and \(\lambda_{\text{ct}}\!=\!1.0\). The mini-batch size is \(64\), the attacker target label is class \(0\).

4.2 Attack Effectiveness on QNNs↩︎

We evaluate Q-DIBA across three different QNN architectures on both MNIST and F-MNIST datasets. Table ¿tbl:tab:clean95vs95bd95qnns? reports four metrics per configuration: clean model accuracy (CA), backdoor model accuracy (BA), attack success rate (ASR), and cross-trigger accuracy (CTA).

The results reveal four key findings. First, Q-DIBA achieves consistently high attack success rates across all configurations, with ASR exceeding 95% on MNIST and remaining above 85% on F-MNIST, demonstrating the effectiveness of the trigger generator across architectures and depths. Second, backdoor models show only minor degradation in clean accuracy, with BA staying within a few percent of CA on both datasets. This indicates that Q-DIBA successfully injects backdoors while preserving the model’s utility on benign inputs, making the attack highly stealthy. Third, CTA remains high across every configuration, indicating that each generated trigger only activates the backdoor on its own source image and stays inactive when applied to other images. This confirms that Q-DIBA delivers the dynamic input-aware property by design. Finally, the four metrics behave consistently across both datasets and all nine architecture-depth combinations, confirming the generalizability of the attack. These results demonstrate Q-DIBA as an effective backdoor attack method that compromises QNN models while remaining difficult to detect through accuracy-based inspection and delivering the input-aware that prior fixed-trigger quantum backdoors lack.

8pt

width=0.83

5pt

width=0.85

width=1.0

4.3 Performance Comparison with Other Backdoor Attacks↩︎

We compare Q-DIBA against five representative backdoor attacks on both datasets: two classical attacks (BadNets [4], Watermark [5]) and three quantum attacks (QFGSM [9], QUAP [10], HarmQ [11]). Table ¿tbl:tab:comparison95attacks? reports model accuracy and attack success rate on the backdoor model under each attack. The results show that Q-DIBA achieves the best overall performance among all evaluated attacks. It delivers the highest model accuracy on both datasets while maintaining a high ASR close to HarmQ’s 99%. Classical backdoor attacks fail on QNNs: both BadNets and Watermark yield ASR below 8% on either dataset, indicating that classical fixed-pattern triggers do not transfer to the quantum representation. Quantum attacks perform better but still lag behind Q-DIBA. These results demonstrate that the joint optimization of \(f_\theta\) and \(g_\phi\), together with state-level supervision upstream of measurement, preserves benign utility without sacrificing attack strength.

4.4 Resilience against Backdoor Defense↩︎

We test if Q-DIBA’s generated triggers evade the regularity assumptions of classical backdoor defenses along three axes: visual inspection, spectral signature, and fine-tuning.

Visual Inspection. A practical first line of defense is direct human inspection of suspicious training samples. Fixed-trigger backdoor attacks are particularly vulnerable to this defense, since they rely on a single shared pattern, often a localized patch, that an auditor can recognize by comparing a few inputs. Fig. 5 shows three representative MNIST inputs together with the triggers generated by \(g_\phi\) and the resulting injected images. Each trigger differs from sample to sample, so no fixed pattern is shared across poisoned inputs. After the trigger is composed with the clean image through the range-matched injection, the resulting injected images remains perceptually indistinguishable from the original one. Q-DIBA therefore achieves invisibility toward human eyes.

Spectral Signature. Spectral Signature [13] is a backdoor detection method that identifies poisoned samples by detecting abnormal traces in the covariance spectrum of feature representations using singular value decomposition. Detection succeeds when poisoned samples produce outlier scores (OS) that deviate from the clean baseline. As shown in Fig. 6, we compare the OS of representative backdoor attacks on MNIST against the score of a clean reference sample (OS \(=\!0.122\)). Q-DIBA produces an OS of 0.101, the closest to the clean baseline among all evaluated attacks. BadNets (0.205), Watermark (0.168), and QFGSM (0.288) all produce visibly elevated OS that a defender can threshold against. Q-DIBA therefore defeats Spectral Signature by construction because poisoned samples remain statistically interleaved with clean ones.

Fine-Tuning. Fine-tuning is a widely deployed practical defenses against backdoor attacks. Given a suspect model, the defender retrains it for a few epochs on a small clean dataset, relying on the assumption that benign gradients will gradually overwrite the trigger-specific weights and erase the backdoor while preserving classification utility. Fixed-trigger attacks are particularly vulnerable to this defense because the backdoor concentrates on a single recognizable pattern, which a small amount of clean retraining is enough to wash out.

Table ¿tbl:tab:finetune? reports ACC and ASR after fine-tuning the Q-DIBA backdoor QNN on a clean MNIST subset for several epochs, with the row at epoch 0 serving as the no-defense baseline. Across all fine-tuning budgets, ASR remains above 91%, dropping by only 5% relative to the baseline, while ACC improves slightly as the model continues to fit clean data. This shows that Q-DIBA can evade fine-tuning because its backdoor is not encoded as a localized trigger-specific direction in \(\theta\). The joint optimization with \(g_\phi\) distributes the trigger-conditioned response across many directions of \(\theta\), benign fine-tuning gradients have no concentrated subspace to erode, and the attack survives.

width=0.6

4.5 Ablation Study↩︎

We ablate the two design choices of the ensemble density contrastive loss on MNIST. Table ¿tbl:tab:ablation? reports ACC, ASR, and CTA under three configurations: w/o \(\mathcal{L}_{\text{ct}}\) removes the contrastive loss, w/o ensemble replaces the mode-averaged density matrices with per-sample density matrices, and Q-DIBA uses the full ensemble-averaged contrastive loss. Both ablated variants degrade ACC, ASR, and CTA together, indicating that the failure is not isolated to a single attacker objective but propagates through the joint optimization. Removing \(\mathcal{L}_{\text{ct}}\) leaves the QNN with only logit-level supervision, which is attenuated by the measurement module \(\mathcal{R}\) and yields gradient too weak to drive consistent training. Replacing ensemble averaging with per-sample contrast restores state-level supervision but exposes the loss to per-sample fluctuations, producing noisy gradients that propagate through the shared \((\theta, \phi)\) update. In both cases, an unreliable contrastive gradient destabilizes the joint optimization rather than only the specificity objective, confirming that state-level supervision and ensemble averaging are each necessary components of the design.

5 Conclusion↩︎

In this paper, we propose Q-DIBA, the first input-aware dynamic backdoor attack against QNNs. Unlike existing fixed-trigger quantum backdoors, Q-DIBA generates sample-specific triggers and jointly optimizes the victim model and trigger generator through a three-mode mini-batch training strategy. To address quantum-specific challenges caused by measurement-induced signal contraction and per-sample quantum-state fluctuation, Q-DIBA introduces an ensemble density contrastive loss on post-ansatz quantum states before measurement. Experiments on MNIST and F-MNIST across multiple QNN architectures demonstrate that Q-DIBA achieves high clean accuracy, attack success rate, and cross-trigger accuracy, while preserving trigger stealthiness. Additional evaluations show that Q-DIBA outperforms existing fixed-trigger quantum backdoors and remains resilient under regular defense settings. These results reveal that input-aware dynamic backdoors pose a practical and stealthy threat to QNN deployment, highlighting the need for quantum-native defenses against dynamic backdoor attacks.

References↩︎