[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-86334-en":3,"doc-seo-86334-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},86334,7971461741311,"Ophelia","https://ap-avatar.wpscdn.com/avatar/74000253aff267980c6?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779345379180704826",8,"Research & Report","Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks","Quantum Neural Networks (QNNs) enable near-term quantum machine learning, yet their security against backdoor threats remains insufficiently understood. Prior quantum backdoor methods mainly use fixed triggers shared by all poisoned inputs, creating repeated representation patterns that many defenses can target. Input-aware dynamic backdoors are hard to port to QNNs due to measurement-compressed supervision and strong per-sample density-matrix fluctuations. This work proposes Q-DIBA, jointly training a classical trigger generator and a victim QNN with ensemble density contrastive learning over post-ansatz states. Experiments on MNIST and FashionMNIST across multiple architectures show high clean accuracy, strong attack success, high cross-trigger accuracy, and resilience to common defenses, highlighting a practical input-specific threat.","Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks  \nJunrui Zhang 1 , Zemin Chen 1 , Lusi Li 1 , Mohammad Ghasemigol2 , Daniel Takabi2 and Rui Ning 1  \n1Department of Computer Science, Old Dominion University, Norfolk, VA, USA  \n2 School of Cybersecurity , Old Dominion University, Norfolk, VA, USA  \narXiv :2607 . 11843v1 [ quant-ph] 13 Jul 2026  \nAbstract—Quantum Neural Networks (QNNs) are emerging asa promising framework for quantum machine learning on nearterm quantum devices, but their security risks remain insufficiently understood. Recent studies have shown that QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many backdoor defenses are built to detect or weaken the repeated patterns such triggers leave in data representations. Although input-aware dynamic backdoors have been studied in classical neural networks to overcome this limitation, directly transferring them to QNNsis difficult because quantum learning introduces new obstacles. In particular, measurement compresses the post-ansatz quantum state into a limited classical output, which weakens the supervision signal for training a trigger generator, while individual density matrices fluctuate strongly with the input and make persample contrastive learning unstable. To address these challenges, we propose Q-DIBA, the first input-aware dynamic backdoor attack designed specifically for QNNs. Q-DIBA jointly trains a classical trigger generator and a victim QNN through a threemode mini-batch strategy that supports clean behavior, attack activation, and trigger specificity. To provide stable quantum-level supervision, Q-DIBA introduces an ensemble density contrastive loss that operates on post-ansatz quantum states before measurement and contrasts mode-averaged density matrices rather than individual samples. Experiments on MNIST and FashionMNIST across multiple QNN architectures show that Q-DIBA achieves high clean accuracy, strong attack success, and highcross-trigger accuracy, demonstrating effectiveness, stealthiness, and input specificity. The attack also remains resilient against representative defenses, including visual inspection, spectralsignature detection, and fine-tuning, suggesting that input-aware quantum backdoors represent a practical and important threat to secure QNN deployment.  \nIndex Terms—Quantum Neural Networks, Attack, Security.  \nI. INTRODUCTION  \nMachine learning has driven dramatic progress and been broadly adopted in real-world applications such as computer vision, natural language processing, and autonomous systems. Building on this momentum, quantum computing has emerged as a paradigm with the potential to fundamentally enhance machine learning capabilities. By exploiting quantum phenomena such as superposition and entanglement, quantum systems embed classical data into exponentially large Hilbert spaces, yielding feature representations that capture patterns beyond the reach of classical methods [1] .  \nIn the current noisy intermediate-scale quantum (NISQ) era [2], quantum devices are limited by noise and shallow circuit depths. To efficiently exploit quantum advantages  \nwithin NISQ hardware constraints, Quantum Neural Networks (QNNs) [3] have been proposed as a promising framework that employs parameterized quantum circuits (PQCs) trained by classical optimizers. By creating a hybrid quantum-classical pipeline, QNNs are capable of learning complex data patterns while remaining executable on near-term quantum hardware.  \nWhile QNNs inherit the power of classical algorithms, they also inherit their critical security weaknesses, most notably susceptibility to backdoor attacks [4]–[6] . By injecting hidden trigger patterns into the training data or model parameters, an attacker can poison the model to misbehave whenever the trigger is present during inference. The poisoned model still beha","cbCaimwIao0XPFlN","https://ap.wps.com/l/cbCaimwIao0XPFlN","pdf",702846,4,1,9,"English","en",105,"# Introduction\n## Limitation of Fixed-Trigger Quantum Backdoors\n## Why Input-Aware Backdoors Matter for QNNs","[{\"question\":\"What problem does the paper address regarding QNN security?\",\"answer\":\"The paper addresses that backdoor attacks on Quantum Neural Networks are not well understood, even though QNNs inherit security weaknesses from classical models.\"},{\"question\":\"Why are fixed-trigger quantum backdoor attacks considered a weakness?\",\"answer\":\"Fixed triggers reuse the same pattern for all poisoned inputs, which creates detectable regularities that defenses like Neural Cleanse, Spectral Signature, and fine-tuning can exploit.\"},{\"question\":\"What is Q-DIBA and how does it work differently from previous quantum backdoors?\",\"answer\":\"Q-DIBA is an input-aware dynamic backdoor attack for QNNs that jointly trains a classical trigger generator and a victim QNN using a three-mode mini-batch strategy and an ensemble density contrastive loss over post-ansatz quantum states.\"}]",1784210534,23,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"input-aware-dynamic-backdoor-attack-against-quantum-neural-networks","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":20},"https://docshare.wps.com/document/input-aware-dynamic-backdoor-attack-against-quantum-neural-networks/86334/",{"url":52,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-25","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the paper address regarding QNN security?","Question",{"text":75,"@type":76},"The paper addresses that backdoor attacks on Quantum Neural Networks are not well understood, even though QNNs inherit security weaknesses from classical models.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"Why are fixed-trigger quantum backdoor attacks considered a weakness?",{"text":80,"@type":76},"Fixed triggers reuse the same pattern for all poisoned inputs, which creates detectable regularities that defenses like Neural Cleanse, Spectral Signature, and fine-tuning can exploit.",{"name":82,"@type":73,"acceptedAnswer":83},"What is Q-DIBA and how does it work differently from previous quantum backdoors?",{"text":84,"@type":76},"Q-DIBA is an input-aware dynamic backdoor attack for QNNs that jointly trains a classical trigger generator and a victim QNN using a three-mode mini-batch strategy and an ensemble density contrastive loss over post-ansatz quantum states.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,127,130,134],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]