1 Introduction↩︎

The Variational Quantum Eigensolver (VQE) [1] is one of the most prominent variational quantum algorithms (VQAs) [2]. It is a hybrid quantum-classical algorithm: a parameterized circuit \(U(\boldsymbol{\theta})\) prepares a trial state whose energy \(\langle\psi(\boldsymbol{\theta})|H|\psi(\boldsymbol{\theta})\rangle\) is minimized by a classical optimizer over the parameter vector \(\boldsymbol{\theta}\), producing an upper bound on the ground-state energy of a Hamiltonian \(H\). VQE is widely used in quantum chemistry to compute molecular energies and electronic properties [3], and has been applied across domains including drug discovery [4], materials science [5], and chemical engineering [6].

VQE workloads are increasingly deployed through a cloud-based VQE-as-a-service model, where a user submits a Hamiltonian and ansatz to a remote service and receives expectation values or optimized parameters in return. In this setting, the service-side pipeline has full visibility into the circuit, variational parameters, and target backend. A compromised service component, a malicious co-tenant exploiting shared-hardware effects, or an insider in the transpilation pipeline could use this access to introduce circuit-level backdoors, perturb parameter values, or shape noise-dependent errors before results reach the user. Because optimized parameter vectors are often reused across downstream workflows, a poisoned solution can propagate silently. The victim then runs what appears to be a valid VQE workflow while receiving a corrupted ground-state estimate. As reliance on VQE grows for high-stakes decisions in chemistry, materials science, and drug discovery, its security becomes a critical concern. For example, in drug discovery, inaccurate quantum simulations can identify ineffective compounds as promising candidates, leading to wasted resources and possible risks to patient safety [7]. Small errors of 1–2 kcal/mol can underestimate impact sensitivity, causing hazardous compounds to be misclassified and pass safety checks, potentially leading to catastrophic failure [8]. These examples highlight the need to ensure the robustness and security of VQE systems.

A range of attacks on parameterized quantum circuits has been proposed—circuit-level backdoors, parameter-space poisoning, gradient-based perturbations, and noise-induced manipulation—but each has been studied in isolation, on task-specific datasets and metrics. This heterogeneity leaves their relative severity resistant to direct comparison and obscures which threats matter most for VQE. Prior systematization is limited: the SoK of Nowmi et al. [9] evaluates only quantum machine learning (QML) classifiers, but does not cover variational algorithms such as VQE and does not rank attacks by severity for VQA objectives. Red-teaming, which applies structured adversarial stress testing under a common protocol, offers a principled way to close this gap. It is the basis for standardized ML-safety benchmarks such as HarmBench [10] and RobustBench [11], yet no comparable benchmark exists for variational quantum algorithms.

In this work we present VQE-AdvBench, the first unified red-teaming benchmark that systematizes these threats under a single evaluation protocol. We organize attacks along an access-level taxonomy (black-, gray-, white-box) and evaluate seven representative attack scenarios—the QTrojan circuit backdoor [12], the QDoor parameter backdoor [13], parameter-space adaptations of FGSM [14] and PGD [15], and three QNBAD noise-induced variants [16] (FreeDrift, MimicSlope, SilentShift)—over fixed molecule–ansatz–backend–metric configurations, on H\(_2\) and H\(_3^+\) across five noise-calibrated IBM backends. Our evaluation produces the first head-to-head severity ranking of these attacks under a common protocol, revealing which categories of attack are most damaging to VQE.

2 Background↩︎

This section introduces essential background concepts for this work. We first describe the Variational Quantum Eigensolver (VQE) and then Zero-Noise Extrapolation (ZNE). ZNE is an error-mitigation step that the QNBAD variants attack.

Variational Quantum Eigensolver. VQE estimates the ground-state energy of a Hamiltonian \(H\) using the variational principle: for any normalized state \(|\psi(\boldsymbol{\theta})\rangle\), the expectation value \(E(\boldsymbol{\theta}) = \langle\psi(\boldsymbol{\theta})|H|\psi(\boldsymbol{\theta})\rangle\) is bounded below by the true ground-state energy \(E_0\). A parameterized circuit \(U(\boldsymbol{\theta})\) prepares the trial state \(|\psi(\boldsymbol{\theta})\rangle = U(\boldsymbol{\theta})|\psi_0\rangle\). A classical optimizer (e.g., COBYLA or Adam) iteratively updates \(\boldsymbol{\theta}\) to minimize \(E(\boldsymbol{\theta})\), yielding an upper bound on \(E_0\) [2].

Zero-Noise Extrapolation. ZNE [17] is a widely used error-mitigation strategy for NISQ devices. It deliberately amplifies circuit noise by integer scaling factors \(\lambda_1,\dots,\lambda_K\), measures the noisy observable at each level, and extrapolates the resulting series back to the zero-noise limit (\(\lambda\rightarrow 0\)). Because ZNE reconstructs the ideal value from a fitted noise trajectory, an adversary who manipulates that trajectory can corrupt the extrapolated result.

3 Threat Model and Attack Taxonomy↩︎

We organize attacks by the adversary’s access level: black-box (query-only), gray-box (partial visibility into intermediate artifacts such as transpiled circuits), and white-box (full access to parameters, architecture, and hardware). All attacks we evaluate assume a compromised or untrusted cloud VQE service and aim to corrupt the ground-state estimate. Attacks that require a labeled dataset or an input distribution (e.g., label-flipping poisoning, query-based evasion against classifiers) do not transfer to VQE, which has no labels or classical input, and are excluded. We summarize the seven evaluated attacks below.

Circuit-level backdoor (QTrojan, gray-box). A semi-privileged adversary inserts concealed pre- and post-encoding \(R_X\)/\(R_Y\) layers, disguised as calibration procedures, around the state-preparation stage [12]. A server-specific configuration file acts as the trigger: when disabled, the circuit behaves like its clean counterpart; when enabled, it amplifies error on the target backend, corrupting the ground-state estimate and compromising integrity.

Parameter-level backdoor (QDoor, white-box). An insider with full circuit access embeds malicious behavior into the trained parameters via approximate-synthesis adversarial training [13], so that the backdoor activates once the synthesized circuit is executed on hardware.

Gradient-based evasion (FGSM/PGD, white-box). Classical evasion attacks like FGSM [14] and PGD [15] perturb an input to cross a decision boundary. VQE has no classical input; the only quantity the user trains and deploys is the parameter vector \(\boldsymbol{\theta}^*\). We therefore adapt both attacks to perturb \(\boldsymbol{\theta}^*\) directly. FGSM is a one-shot attack: it takes a single step of size \(\varepsilon\) that pushes the parameters in the direction that increases the energy error. PGD is the iterative version: it takes several smaller steps in that same direction, keeping the total change within a fixed budget \(\varepsilon\).

Noise-induced backdoor (QNBAD, white-box). The adversary delivers parameters that look benign in noiseless simulation but shape how noisy expectation values behave across ZNE scaling levels, so that extrapolation returns a value far from the true energy  [16]. Its three variants FreeDrift (QF), MimicSlope (QM), and SilentShift (QS) differ in how aggressively they distort the noise trajectory: QF maximally changes sampled values across levels, QM uniformly shifts the trajectory, and QS keeps low-noise values unchanged while reducing high-noise values.

4 Experimental Methodology↩︎

We deliberately scope this first benchmark to a controlled setting: small, well-characterized molecules and a fixed ansatz family. This controlled scope lets us compare attack severity cleanly across a common molecule, ansatz, backend, and metric configuration.

Dataset. We use the PennyLane Molecules dataset [18], selecting H\(_2\) and H\(_3^+\), which correspond to 4-qubit and 6-qubit Hamiltonians respectively. The fermionic Hamiltonians are mapped to qubit Hamiltonians using the Jordan-Wigner transformation [19].

Ansatz. We use the Hardware-Efficient Ansatz efficient_su2 from Qiskit [20] with linear entanglement: \(\mathrm{reps}=2\) (24 parameters) for H\(_2\) and \(\mathrm{reps}=3\) (48 parameters) for H\(_3^+\).

Noisy Backends. We evaluate each attack on five IBM Quantum fake backends from qiskit_ibm_runtime.fake_provider: fake_cairo (CAI), fake_montreal (MON), fake_guadalupe (GUA), fake_almaden (ALM), and fake_auckland (AUC). These incorporate realistic noise models calibrated from real hardware and span a range of device generations and qubit counts.

ZNE Setting. ZNE is configured with Mitiq [21], scaling noise by factors \(T=\{1,\dots,6\}\) and fitting a degree-2 polynomial to the sampled expectation values.

Evaluation Metric. We use the absolute error between the adversarial and ideal energy estimates, \(E_{\text{abs}} = |E_{\text{adv}} - f_{\text{ideal}}|\), where \(f_{\text{ideal}}\) is the noise-free expectation value. A higher \(E_{\text{abs}}\) (equivalently, a higher amplification relative to the clean baseline) indicates a more successful attack.

5 Results↩︎

We report attack effectiveness on VQE for H\(_2\) and H\(_3^+\) across the five backends. Each cell reports \(E_{\text{abs}}\) with the amplification factor relative to the clean baseline in parentheses; the GEO-Mean column is the geometric mean across the two molecules. Circuit- and parameter-space attacks (Table 1) are compared against a single-noisy clean baseline; the QNBAD noise-induced attacks (Table 2) target ZNE and are compared against a ZNE-extrapolated clean baseline so that attacked and clean estimates share the same pipeline.

5.1 Circuit- and Parameter-Space Attacks↩︎

For QTrojan, QDoor, FGSM, and PGD we used the Adam optimizer (300 iterations, learning rate 0.1); FGSM and PGD are reported at \(\varepsilon = 0.25\) rad. Table 1 shows QTrojan is the strongest in this group, followed by PGD, FGSM, and QDoor. QTrojan amplification reaches up to 9.88\(\times\) on H\(_2\) and 5.72\(\times\) on H\(_3^+\), peaking at a 7.52\(\times\) geometric mean on MON. PGD consistently outperforms FGSM under the same perturbation budget (geometric means 3.32–6.15\(\times\) vs.–3.38\(\times\)), confirming that the iterative, projected update is more damaging than the single-step one. QDoor stays near the clean baseline (0.94–1.37\(\times\)), likely because its approximate-synthesis trigger has little room to inject error in these small, shallow circuits. QTrojan, FGSM, and PGD all peak on MON and bottom out on GUA.

4pt

5.2 Noise-Induced Attacks↩︎

For the three QNBAD variants we used SPSA with Adam via PennyLane (300 steps, learning rate 0.1). Table 2 shows all three can substantially increase the ZNE-extrapolated error. QF is the strongest overall, with a peak geometric mean of 8.84\(\times\) on CAI (per-molecule peaks of 11.35\(\times\) for H\(_2\) and 12.48\(\times\) for H\(_3^+\)). QM is also highly effective, with a peak geometric mean amplification of 8.35\(\times\) on CAI and peak per-molecule amplifications of 6.55\(\times\) for H\(_2\) on ALM and 12.30\(\times\) for H\(_3^+\) on CAI. QS is consistently weaker than QF and QM but still not negligible, with a peak geometric mean amplification of 4.52\(\times\) on CAI and per-molecule peaks of 4.32\(\times\) for H\(_2\) and 4.73\(\times\) for H\(_3^+\), both on CAI. These results show that attacking the ZNE pipeline can be damaging even when the executed circuit is not directly modified, since the attack changes how the noisy expectation values behave during extrapolation.

4pt

6 Defenses↩︎

We outline defenses matched to the evaluated attacks, leaving their empirical evaluation to future work. Since these attacks target different stages of the VQE pipeline, no single countermeasure defends against all of them. Against encoding- and circuit-level backdoors (QTrojan), quantum-aware validation and classical–quantum consistency checks can detect tampering at the state-preparation stage. Against noise-induced backdoors (QNBAD), classical backdoor defenses such as fine-pruning [22] may help but need careful calibration in the VQA setting, while varying the noise model or applying randomized compiling and dynamical decoupling [23] disrupts the device-specific triggers QNBAD relies on. Against white-box parameter-space attacks, partitioning the circuit across isolated backends, as in QuMoS [24], limits an adversary’s access, since no single provider controls the full workflow.

7 Discussion and Future Work↩︎

Several attack classes are deliberately out of scope. Pulse-level attacks require hardware- and physics-level access below the circuit abstraction, whereas we operate at the circuit and parameter level exposed by Qiskit and PennyLane. Black-box query-only attacks (e.g., label flipping) assume a labeled dataset and input distribution that VQE lacks. Compiler-internal attacks assume an untrusted compiler, whereas we assume the compiler is trusted.

The benchmark can be extended in a few directions. The unified protocol could be applied to other VQAs such as QAOA and VQD. Extending to larger molecules such as H\(_4\) (\(\sim\)​8 qubits), LiH (\(\sim\)​12 qubits), and BeH\(_2\) (\(\sim\)​14 qubits) would test how attack amplification scales with circuit depth, parameter count, and hardware noise. We leave this larger-scale study to future work.

8 Conclusion↩︎

In this work we introduced VQE-AdvBench, a red-teaming benchmark that evaluates seven attack scenarios spanning circuit-level, parameter-level, gradient-based, and noise-induced threats against the Variational Quantum Eigensolver, under a unified protocol fixing the molecule, ansatz, backend, and metric. Our central finding is that attack severity varies sharply across these classes: noise-induced attacks on the ZNE pipeline are the most damaging, followed by the QTrojan circuit-level backdoor and our FGSM/PGD adaptations, while the QDoor parameter-level backdoor is the weakest on these shallow circuits. We hope that VQE-AdvBench encourages the community to adopt standardized red-teaming as a common practice for evaluating the security of variational quantum algorithms.

References↩︎