# Guardians of the Quantum GAN

arXiv: https://arxiv.org/abs/2404.16156 · HTML: https://mlsanity.com/paper/2404.16156/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 32 references that are in the map.
- First posted on arXiv 24 Apr 2024.

## Builds on (most cited first, 9 of 9)

- [Generative Adversarial Networks](https://mlsanity.com/paper/2203.00667/) (2022)
- [Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Network](https://mlsanity.com/paper/1609.04802/) (2016)
- [Machine Unlearning](https://mlsanity.com/paper/1912.03817/) (2019)
- [High-Fidelity GAN Inversion for Image Attribute Editing](https://mlsanity.com/paper/2109.06590/) (2021)
- [Quantum generative adversarial networks](https://mlsanity.com/paper/1804.08641/) (2018)
- [Experimental Quantum Generative Adversarial Networks for Image Generation](https://mlsanity.com/paper/2010.06201/) (2020)
- [Text to Image Generation with Semantic-Spatial Aware GAN](https://mlsanity.com/paper/2104.00567/) (2021)
- [Toward Privacy in Quantum Program Execution On Untrusted Quantum Cloud Computing Machines for Business-sensitive Quantum Needs](https://mlsanity.com/paper/2307.16799/) (2023)
- [Enigma: Application-Layer Privacy for Quantum Optimization on Untrusted Computers](https://mlsanity.com/paper/2311.13546/) (2023)

## Built on by (most cited first, 2 of 2)

- [Quantum Machine Unlearning: Foundations, Mechanisms, and Taxonomy](https://mlsanity.com/paper/2511.00406/) (2025)
- [Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses](https://mlsanity.com/paper/2506.21842/) (2025)

## Abstract (arXiv)

Quantum Generative Adversarial Networks (qGANs) are at the forefront of image-generating quantum machine learning models. To accommodate the growing demand for Noisy Intermediate-Scale Quantum (NISQ) devices to train and infer quantum machine learning models, the number of third-party vendors offering quantum hardware as a service is expected to rise. This expansion introduces the risk of untrusted vendors potentially stealing proprietary information from the quantum machine learning models. To address this concern we propose a novel watermarking technique that exploits the noise signature embedded during the training phase of qGANs as a non-invasive watermark. The watermark is identifiable in the images generated by the qGAN allowing us to trace the specific quantum hardware used during training hence providing strong proof of ownership. To further enhance the security robustness, we propose the training of qGANs on a sequence of multiple quantum hardware, embedding a complex watermark comprising the noise signatures of all the training hardware that is difficult for adversaries to replicate. We also develop a machine learning classifier to extract this watermark robustly, thereby identifying the training hardware (or the suite of hardware) from the images generated by the qGAN validating the authenticity of the model. We note that the watermark signature is robust against inferencing on hardware different than the hardware that was used for training. We obtain watermark extraction accuracy of 100% and ~90% for training the qGAN on individual and multiple quantum hardware setups (and inferencing on different hardware), respectively. Since parameter evolution during training is strongly modulated by quantum noise, the proposed watermark can be extended to other quantum machine learning models as well.