# QTrojan: A Circuit Backdoor Against Quantum Neural Networks

arXiv: https://arxiv.org/abs/2302.08090 · HTML: https://mlsanity.com/paper/2302.08090/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 20 references that are in the map.
- First posted on arXiv 16 Feb 2023.

## Builds on (most cited first, 9 of 9)

- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Quantum Machine Learning](https://mlsanity.com/paper/1611.09347/) (2016)
- [Quantum Long Short-Term Memory](https://mlsanity.com/paper/2009.01783/) (2020)
- [QuantumNAS: Noise-Adaptive Search for Robust Quantum Circuits](https://mlsanity.com/paper/2107.10845/) (2021)
- [Robust data encodings for quantum classifiers](https://mlsanity.com/paper/2003.01695/) (2020)
- [Quantum circuit architecture search for variational quantum algorithms](https://mlsanity.com/paper/2010.10217/) (2020)
- [The Dawn of Quantum Natural Language Processing](https://mlsanity.com/paper/2110.06510/) (2021)
- [Adiabatic Quantum Computing for Multi Object Tracking](https://mlsanity.com/paper/2202.08837/) (2022)
- [Scalable Quantum Neural Networks for Classification](https://mlsanity.com/paper/2208.07719/) (2022)

## Built on by (most cited first, 5 of 5)

- [Q-Detection: A Quantum-Classical Hybrid Poisoning Attack Detection Method](https://mlsanity.com/paper/2507.06262/) (2025)
- [SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness](https://mlsanity.com/paper/2511.14989/) (2025)
- [Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security](https://mlsanity.com/paper/2507.08623/) (2025)
- [SQUASH: A SWAP-Based Quantum Attack to Sabotage Hybrid Quantum Neural Networks](https://mlsanity.com/paper/2506.24081/) (2025)
- [Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks](https://mlsanity.com/paper/2607.11843/) (2026)

## Abstract (arXiv)

We propose a circuit-level backdoor attack, textitQTrojan, against Quantum Neural Networks (QNNs) in this paper. QTrojan is implemented by few quantum gates inserted into the variational quantum circuit of the victim QNN. QTrojan is much stealthier than a prior Data-Poisoning-based Backdoor Attack (DPBA), since it does not embed any trigger in the inputs of the victim QNN or require the access to original training datasets. Compared to a DPBA, QTrojan improves the clean data accuracy by 21% and the attack success rate by 19.9%.