# Adversarial Threats in Quantum Machine Learning: A Survey of Attacks and Defenses

arXiv: https://arxiv.org/abs/2506.21842 · HTML: https://mlsanity.com/paper/2506.21842/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Machine unlearning, one of 12 directions in LLM safety and security.
- Builds on 16 of its 26 references that are in the map.
- First posted on arXiv 27 Jun 2025.

## Placed in

- LLM safety and security / [Machine unlearning](https://mlsanity.com/safety/machine-unlearning/)

## Builds on (most cited first, 16 of 16)

- [Supervised learning with quantum enhanced feature spaces](https://mlsanity.com/paper/1804.11326/) (2018)
- [Challenges and Opportunities in Quantum Machine Learning](https://mlsanity.com/paper/2303.09491/) (2023)
- [Improved Adversarial Training via Learned Optimizer](https://mlsanity.com/paper/2004.12227/) (2020)
- [QuMoS: A Framework for Preserving Security of Quantum Machine Learning Model](https://mlsanity.com/paper/2304.11511/) (2023)
- [Evaluating Efficacy of Model Stealing Attacks and Defenses on Quantum Neural Networks](https://mlsanity.com/paper/2402.11687/) (2024)
- [Quantum Cloud Computing: A Review, Open Problems, and Future Directions](https://mlsanity.com/paper/2404.11420/) (2024)
- [Security Attacks Abusing Pulse-level Quantum Circuits](https://mlsanity.com/paper/2406.05941/) (2024)
- [AI-driven Reverse Engineering of QML Models](https://mlsanity.com/paper/2408.16929/) (2024)
- [OPAQUE: Obfuscating Phase in Quantum Circuit Compilation for Efficient IP Protection](https://mlsanity.com/paper/2502.16605/) (2025)
- [CopyQNN: Quantum Neural Network Extraction Attack under Varying Quantum Noise](https://mlsanity.com/paper/2504.00366/) (2025)
- [Unveiling and Mitigating Adversarial Vulnerabilities in Iterative Optimizers](https://mlsanity.com/paper/2504.19000/) (2025)
- [The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models](https://mlsanity.com/paper/2407.07237/) (2024)
- [Guardians of the Quantum GAN](https://mlsanity.com/paper/2404.16156/) (2024)
- [Security Concerns in Quantum Machine Learning as a Service](https://mlsanity.com/paper/2408.09562/) (2024)
- [Adversarial Data Poisoning Attacks on Quantum Machine Learning in the NISQ Era](https://mlsanity.com/paper/2411.14412/) (2024)
- [QubitHammer: Remotely Inducing Qubit State Change on Superconducting Quantum Computers](https://mlsanity.com/paper/2504.07875/) (2025)

## Built on by (most cited first, 1 of 1)

- [Quantum Adversarial Machine Learning: From Classical Adaptations to Quantum-Native Methods](https://mlsanity.com/paper/2605.18821/) (2026)

## Abstract (arXiv)

Quantum Machine Learning (QML) integrates quantum computing with classical machine learning, primarily to solve classification, regression and generative tasks. However, its rapid development raises critical security challenges in the Noisy Intermediate-Scale Quantum (NISQ) era. This chapter examines adversarial threats unique to QML systems, focusing on vulnerabilities in cloud-based deployments, hybrid architectures, and quantum generative models. Key attack vectors include model stealing via transpilation or output extraction, data poisoning through quantum-specific perturbations, reverse engineering of proprietary variational quantum circuits, and backdoor attacks. Adversaries exploit noise-prone quantum hardware and insufficiently secured QML-as-a-Service (QMLaaS) workflows to compromise model integrity, ownership, and functionality. Defense mechanisms leverage quantum properties to counter these threats. Noise signatures from training hardware act as non-invasive watermarks, while hardware-aware obfuscation techniques and ensemble strategies disrupt cloning attempts. Emerging solutions also adapt classical adversarial training and differential privacy to quantum settings, addressing vulnerabilities in quantum neural networks and generative architectures. However, securing QML requires addressing open challenges such as balancing noise levels for reliability and security, mitigating cross-platform attacks, and developing quantum-classical trust frameworks. This chapter summarizes recent advances in attacks and defenses, offering a roadmap for researchers and practitioners to build robust, trustworthy QML systems resilient to evolving adversarial landscapes.