# STIQ: Safeguarding Training and Inferencing of Quantum Neural Networks from Untrusted Cloud

arXiv: https://arxiv.org/abs/2405.18746 · HTML: https://mlsanity.com/paper/2405.18746/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 39 references that are in the map.
- First posted on arXiv 29 May 2024.

## Builds on (most cited first, 15 of 15)

- [The power of quantum neural networks](https://mlsanity.com/paper/2011.00027/) (2020)
- [Gazelle: A Low Latency Framework for Secure Neural Network Inference](https://mlsanity.com/paper/1801.05507/) (2018)
- [Quantum generative adversarial networks](https://mlsanity.com/paper/1804.08641/) (2018)
- [QuantumNAS: Noise-Adaptive Search for Robust Quantum Circuits](https://mlsanity.com/paper/2107.10845/) (2021)
- [QOC: Quantum On-Chip Training with Parameter Shift and Gradient Pruning](https://mlsanity.com/paper/2202.13239/) (2022)
- [Quantum-Classical Hybrid Machine Learning for Image Classification (ICCAD Special Session Paper)](https://mlsanity.com/paper/2109.02862/) (2021)
- [An Empirical Comparison of Optimizers for Quantum Machine Learning with SPSA-based Gradients](https://mlsanity.com/paper/2305.00224/) (2023)
- [QUILT: Effective Multi-Class Classification on Quantum Computers Using an Ensemble of Diverse Quantum Classifiers](https://mlsanity.com/paper/2309.15056/) (2023)
- [Quantum ensembles of quantum classifiers](https://mlsanity.com/paper/1704.02146/) (2017)
- [QuantumLeak: Stealing Quantum Neural Networks from Cloud-based NISQ Machines](https://mlsanity.com/paper/2403.10790/) (2024)
- [Evaluating Efficacy of Model Stealing Attacks and Defenses on Quantum Neural Networks](https://mlsanity.com/paper/2402.11687/) (2024)
- [Security Aspects of Quantum Machine Learning: Opportunities, Threats and Defenses](https://mlsanity.com/paper/2204.03625/) (2022)
- [Quantum homomorphic encryption for polynomial-sized circuits](https://mlsanity.com/paper/1603.09717/) (2016)
- [Toward Privacy in Quantum Program Execution On Untrusted Quantum Cloud Computing Machines for Business-sensitive Quantum Needs](https://mlsanity.com/paper/2307.16799/) (2023)
- [Limitations on information theoretically secure quantum homomorphic encryption](https://mlsanity.com/paper/1406.2456/) (2014)

## Built on by (most cited first, 3 of 3)

- [SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness](https://mlsanity.com/paper/2511.14989/) (2025)
- [Security Concerns in Quantum Machine Learning as a Service](https://mlsanity.com/paper/2408.09562/) (2024)
- [Adversarial Data Poisoning Attacks on Quantum Machine Learning in the NISQ Era](https://mlsanity.com/paper/2411.14412/) (2024)

## Abstract (arXiv)

The high expenses imposed by current quantum cloud providers, coupled with the escalating need for quantum resources, may incentivize the emergence of cheaper cloud-based quantum services from potentially untrusted providers. Deploying or hosting quantum models, such as Quantum Neural Networks (QNNs), on these untrusted platforms introduces a myriad of security concerns, with the most critical one being model theft. This vulnerability stems from the cloud provider's full access to these circuits during training and/or inference. In this work, we introduce STIQ, a novel ensemble-based strategy designed to safeguard QNNs against such cloud-based adversaries. Our method innovatively trains two distinct QNNs concurrently, hosting them on same or different platforms, in a manner that each network yields obfuscated outputs rendering the individual QNNs ineffective for adversaries operating within cloud environments. However, when these outputs are combined locally (using an aggregate function), they reveal the correct result. Through extensive experiments across various QNNs and datasets, our technique has proven to effectively masks the accuracy and losses of the individually hosted models by upto 76%, albeit at the expense of ≤ 2× increase in the total computational overhead. This trade-off, however, is a small price to pay for the enhanced security and integrity of QNNs in a cloud-based environment prone to untrusted adversaries. We also demonstrated STIQ's practical application by evaluating it on multiple real quantum hardwares, showing that STIQ achieves up to ≈ 70% obfuscation, with combined performance similar to an unobfuscated model.