quantum-federated-learning-security

name	quantum-federated-learning-security
description	Circuit-level backdoor detection methodology for Quantum Federated Learning (QFL) systems. Identifies malicious circuit patterns in variational quantum circuits during federated training. Use when: (1) securing QFL systems, (2) detecting quantum circuit backdoors, (3) federated quantum computing security, (4) variational circuit integrity verification, (5) quantum ML trustworthiness assessment.

Quantum Federated Learning Security

Core Idea

Detect circuit-level backdoors in QFL by analyzing variational circuit structure, measurement patterns, and gradient behavior across federated clients.

Key Findings (from arXiv:2605.27416)

Empirical Results

• Single malicious client → up to 50% accuracy drop under FedAvg
• Non-IID data amplifies attack effectiveness
• All tested defenses (Krum, Multi-Krum, FoolsGold, FLGuardian, Mud-HoG) fail worst-case scenarios
• Malicious updates mask presence by staying close to benign norms (norm-constrained stealthiness)
• Quantum measurement stochasticity provides natural cover for gradient perturbations

Defense Failure Modes

• Krum/Multi-Krum: Cannot detect norm-consistent malicious updates
• FoolsGold: Cosine similarity ineffective for quantum gradients
• FLGuardian: Gradient clipping insufficient for measurement-level attacks
• Mud-HoG: Hessian-based detection degraded by quantum noise

Key Findings (from arXiv:2605.27416)

Empirical Results

• Single malicious client → up to 50% accuracy drop under FedAvg
• Non-IID data amplifies attack effectiveness
• All tested defenses (Krum, Multi-Krum, FoolsGold, FLGuardian, Mud-HoG) fail worst-case scenarios
• Malicious updates mask presence by staying close to benign norms (norm-constrained stealthiness)
• Quantum measurement stochasticity provides natural cover for gradient perturbations

Defense Failure Modes

• Krum/Multi-Krum: Cannot detect norm-consistent malicious updates
• FoolsGold: Cosine similarity ineffective for quantum gradients
• FLGuardian: Gradient clipping insufficient for measurement-level attacks
• Mud-HoG: Hessian-based detection degraded by quantum noise

Methodology

Step 0: Attack Surface Classification

Before detection, classify the QFL architecture:

• Variational circuit type: VQA, QNN, quantum kernel methods
• Measurement scheme: Pauli measurements, projective, POVM
• Aggregation protocol: FedAvg, FedProx, custom
• Attack surfaces: In-training (parameter injection), Post-training (backdoor insertion)

See references/qfl-cult-threat-model.md for the CULT threat model details.

Step 1: Circuit Structure Analysis

For each client's variational circuit:

1. Parse circuit topology and gate sequence
2. Identify anomalous gate patterns (unusual entanglement, measurement placement)
3. Flag circuits with hidden degrees of freedom

Step 2: Gradient Behavior Monitoring

Track gradient statistics across rounds:

• Compare gradient distributions between clients
• Detect statistical outliers indicating backdoor influence
• Monitor gradient variance for abnormal patterns

Step 3: Measurement Pattern Verification

Verify measurement outcomes:

1. Cross-validate measurement distributions
2. Check for hidden information leakage through measurement patterns
3. Verify fidelity against expected baseline

Step 4: Circuit Sanitization

For flagged circuits:

1. Apply circuit decomposition to isolate suspicious subcircuits
2. Replace or remove anomalous components
3. Retrain with sanitized circuits

Activation Keywords

• quantum federated learning security
• QFL backdoor detection
• quantum circuit backdoor
• federated quantum computing security
• variational circuit integrity
• 量子联邦学习安全
• 量子电路后门
• quantum ML trustworthiness

Error Handling

• If circuit analysis too complex: decompose into smaller subcircuits for analysis
• If gradient data unavailable: fall back to circuit structure-only analysis

References

• arXiv:2605.27416 - Can Quantum Federated Learning Withstand Circuit-Level Backdoors?