# Adversarial Data Poisoning Attacks on Quantum Machine Learning in the NISQ Era

arXiv: https://arxiv.org/abs/2411.14412 · HTML: https://mlsanity.com/paper/2411.14412/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Machine unlearning, one of 12 directions in LLM safety and security.
- Builds on 18 of its 32 references that are in the map.
- First posted on arXiv 21 Nov 2024.

## Placed in

- LLM safety and security / [Machine unlearning](https://mlsanity.com/safety/machine-unlearning/)

## Builds on (most cited first, 18 of 18)

- [The power of quantum neural networks](https://mlsanity.com/paper/2011.00027/) (2020)
- [Certified Defenses for Data Poisoning Attacks](https://mlsanity.com/paper/1706.03691/) (2017)
- [Stronger Data Poisoning Attacks Break Data Sanitization Defenses](https://mlsanity.com/paper/1811.00741/) (2018)
- [Adversarial Machine Learning -- Industry Perspectives](https://mlsanity.com/paper/2002.05646/) (2020)
- [Adversarial Examples Make Strong Poisons](https://mlsanity.com/paper/2106.10807/) (2021)
- [Deep Partition Aggregation: Provable Defense against General Poisoning Attacks](https://mlsanity.com/paper/2006.14768/) (2020)
- [QuantumNAS: Noise-Adaptive Search for Robust Quantum Circuits](https://mlsanity.com/paper/2107.10845/) (2021)
- [Label Sanitization against Label Flipping Poisoning Attacks](https://mlsanity.com/paper/1803.00992/) (2018)
- [Quantum noise protects quantum classifiers against adversaries](https://mlsanity.com/paper/2003.09416/) (2020)
- [Quantum State Tomography with Conditional Generative Adversarial Networks](https://mlsanity.com/paper/2008.03240/) (2020)
- [Indiscriminate Data Poisoning Attacks on Neural Networks](https://mlsanity.com/paper/2204.09092/) (2022)
- [QOC: Quantum On-Chip Training with Parameter Shift and Gradient Pruning](https://mlsanity.com/paper/2202.13239/) (2022)
- [Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks](https://mlsanity.com/paper/2303.03592/) (2023)
- [On Defending Against Label Flipping Attacks on Malware Detection Systems](https://mlsanity.com/paper/1908.04473/) (2019)
- [Machine Learning Security in Industry: A Quantitative Survey](https://mlsanity.com/paper/2207.05164/) (2022)
- [Quantum-Classical Hybrid Machine Learning for Image Classification (ICCAD Special Session Paper)](https://mlsanity.com/paper/2109.02862/) (2021)
- ['Eliv'agar: Efficient Quantum Circuit Search for Classification](https://mlsanity.com/paper/2401.09393/) (2024)
- [STIQ: Safeguarding Training and Inferencing of Quantum Neural Networks from Untrusted Cloud](https://mlsanity.com/paper/2405.18746/) (2024)

## Built on by (most cited first, 2 of 2)

- [Q-Detection: A Quantum-Classical Hybrid Poisoning Attack Detection Method](https://mlsanity.com/paper/2507.06262/) (2025)
- [Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses](https://mlsanity.com/paper/2506.21842/) (2025)

## Abstract (arXiv)

With the growing interest in Quantum Machine Learning (QML) and the increasing availability of quantum computers through cloud providers, addressing the potential security risks associated with QML has become an urgent priority. One key concern in the QML domain is the threat of data poisoning attacks in the current quantum cloud setting. Adversarial access to training data could severely compromise the integrity and availability of QML models. Classical data poisoning techniques require significant knowledge and training to generate poisoned data, and lack noise resilience, making them ineffective for QML models in the Noisy Intermediate Scale Quantum (NISQ) era. In this work, we first propose a simple yet effective technique to measure intra-class encoder state similarity (ESS) by analyzing the outputs of encoding circuits. Leveraging this approach, we introduce a underlineQuantum underlineIndiscriminate underlineData Poisoning attack, QUID. Through extensive experiments conducted in both noiseless and noisy environments (e.g., IBMBrisbane's noise), across various architectures and datasets, QUID achieves up to 92% accuracy degradation in model performance compared to baseline models and up to 75% accuracy degradation compared to random label-flipping. We also tested QUID against state-of-the-art classical defenses, with accuracy degradation still exceeding 50%, demonstrating its effectiveness. This work represents the first attempt to reevaluate data poisoning attacks in the context of QML.