# Evaluating Efficacy of Model Stealing Attacks and Defenses on Quantum Neural Networks

arXiv: https://arxiv.org/abs/2402.11687 · HTML: https://mlsanity.com/paper/2402.11687/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 19 references that are in the map.
- First posted on arXiv 18 Feb 2024.

## Builds on (most cited first, 8 of 8)

- [Stealing Machine Learning Models via Prediction APIs](https://mlsanity.com/paper/1609.02943/) (2016)
- [The power of quantum neural networks](https://mlsanity.com/paper/2011.00027/) (2020)
- [MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimation](https://mlsanity.com/paper/2005.03161/) (2020)
- [Reverse-Engineering Deep ReLU Networks](https://mlsanity.com/paper/1910.00744/) (2019)
- [I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences](https://mlsanity.com/paper/2206.08451/) (2022)
- [Defending Against Model Stealing Attacks with Adaptive Misinformation](https://mlsanity.com/paper/1911.07100/) (2019)
- [Quantum-Classical Hybrid Machine Learning for Image Classification (ICCAD Special Session Paper)](https://mlsanity.com/paper/2109.02862/) (2021)
- [Data Driven Exploratory Attacks on Black Box Classifiers in Adversarial Domains](https://mlsanity.com/paper/1703.07909/) (2017)

## Built on by (most cited first, 6 of 6)

- [STIQ: Safeguarding Training and Inferencing of Quantum Neural Networks from Untrusted Cloud](https://mlsanity.com/paper/2405.18746/) (2024)
- [The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models](https://mlsanity.com/paper/2407.07237/) (2024)
- [SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness](https://mlsanity.com/paper/2511.14989/) (2025)
- [Security Concerns in Quantum Machine Learning as a Service](https://mlsanity.com/paper/2408.09562/) (2024)
- [Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses](https://mlsanity.com/paper/2506.21842/) (2025)
- [Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access](https://mlsanity.com/paper/2609.05702/) (2026)

## Abstract (arXiv)

Cloud hosting of quantum machine learning (QML) models exposes them to a range of vulnerabilities, the most significant of which is the model stealing attack. In this study, we assess the efficacy of such attacks in the realm of quantum computing. We conducted comprehensive experiments on various datasets with multiple QML model architectures. Our findings revealed that model stealing attacks can produce clone models achieving up to 0.9× and 0.99× clone test accuracy when trained using Top-1 and Top-k labels, respectively (k: numclasses). To defend against these attacks, we leverage the unique properties of current noisy hardware and perturb the victim model outputs and hinder the attacker's training process. In particular, we propose: 1) hardware variation-induced perturbation (HVIP) and 2) hardware and architecture variation-induced perturbation (HAVIP). Although noise and architectural variability can provide up to ~16% output obfuscation, our comprehensive analysis revealed that models cloned under noisy conditions tend to be resilient, suffering little to no performance degradation due to such obfuscations. Despite limited success with our defense techniques, this outcome has led to an important discovery: QML models trained on noisy hardwares are naturally resistant to perturbation or obfuscation-based defenses or attacks.