# SQUASH: A SWAP-Based Quantum Attack to Sabotage Hybrid Quantum Neural Networks

arXiv: https://arxiv.org/abs/2506.24081 · HTML: https://mlsanity.com/paper/2506.24081/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 31 references that are in the map.
- First posted on arXiv 30 Jun 2025.

## Builds on (most cited first, 8 of 8)

- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Challenges and Opportunities in Quantum Machine Learning](https://mlsanity.com/paper/2303.09491/) (2023)
- [Quantum machine learning: a classical perspective](https://mlsanity.com/paper/1707.08561/) (2017)
- [Open source software in quantum computing](https://mlsanity.com/paper/1812.09167/) (2018)
- [QML-IDS: Quantum Machine Learning Intrusion Detection System](https://mlsanity.com/paper/2410.16308/) (2024)
- [QTrojan: A Circuit Backdoor Against Quantum Neural Networks](https://mlsanity.com/paper/2302.08090/) (2023)
- [AI-driven Reverse Engineering of QML Models](https://mlsanity.com/paper/2408.16929/) (2024)
- [Quantum Trojan Insertion: Controlled Activation for Covert Circuit Manipulation](https://mlsanity.com/paper/2502.08880/) (2025)

## Abstract (arXiv)

We propose a circuit-level attack, SQUASH, a SWAP-Based Quantum Attack to sabotage Hybrid Quantum Neural Networks (HQNNs) for classification tasks. SQUASH is executed by inserting SWAP gate(s) into the variational quantum circuit of the victim HQNN. Unlike conventional noise-based or adversarial input attacks, SQUASH directly manipulates the circuit structure, leading to qubit misalignment and disrupting quantum state evolution. This attack is highly stealthy, as it does not require access to training data or introduce detectable perturbations in input states. Our results demonstrate that SQUASH significantly degrades classification performance, with untargeted SWAP attacks reducing accuracy by up to 74.08% and targeted SWAP attacks reducing target class accuracy by up to 79.78%. These findings reveal a critical vulnerability in HQNN implementations, underscoring the need for more resilient architectures against circuit-level adversarial interventions.