Security Concerns in Quantum Machine Learning as a Service - Security analysis and threat model for QMLaaS

Aug 2, 2026

Quantum machine learning (QML) uses variational quantum circuits to solve learning tasks and can generalize from limited data, driving interest in deploying QML through Quantum Machine Learning as a Service (QMLaaS). QMLaaS combines classical and quantum resources: classical systems preprocess inputs and perform post-processing to overcome current hardware constraints. Because providers may be untrusted, the paper maps the end-to-end QMLaaS workflow across training and inference and identifies security risks to sensitive assets including architectures, data, encoding, and learned parameters.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages9

Reading Time23 min

AccessFree to download

Abstract

1 Introduction

QML and QMLaaS workflow

Classical role in training and inference

Threats from classical and quantum providers

Security Concerns in Quantum Machine Learning as a Service Satwik Kundu The Pennsylvania State University University Park, PA, USA [sxk6259@psu.edu](sxk6259@psu.edu) Swaroop Ghosh The Pennsylvania State University University Park, PA, USA [szg212@psu.edu](szg212@psu.edu) arXiv :2408 .09562v1 [ quant-ph] 18 Aug 2024 ABSTRACT Quantum machine learning (QML) is a category of algorithms that employ variational quantum circuits (VQCs) to tackle machine learning tasks. Recent discoveries have shown that QML models can effectively generalize from limited training data samples. This capability has sparked increased interest in deploying these models to address practical, real-world challenges, resulting in the emergence of Quantum Machine Learning as a Service (QMLaaS) . QMLaaS represents a hybrid model that utilizes both classical and quantum computing resources. Classical computers play a crucial role in this setup, handling initial pre-processing and subsequent post-processing of data to compensate for the current limitations of quantum hardware. Since this is a new area, very little work exists to paint the whole picture of QMLaaS in the context of known security threats in the domain of classical and quantum machine learning. This SoK paper is aimed to bridge this gap by outlining the complete QMLaaS workflow, which encompasses both the training and inference phases and highlighting significant security concerns involving untrusted classical or quantum providers. QML models contain several sensitive assets, such as the model architecture, training/testing data, encoding techniques, and trained parameters. Unauthorized access to these components could compromise the model’s integrity and lead to intellectual property (IP) theft. We pinpoint the critical security issues that must be considered to pave the way for a secure QMLaaS deployment. 1 INTRODUCTION Quantum computing is rapidly progressing, with companies like Atom Computing and IBM recently unveiling the largest quantum processors ever developed, boasting 1,225 and 1,121 qubits, respectively [1, 2]. The significant interest in quantum computing among academic and research communities stems from its potential to offer substantial computational speedups over classical computers for certain problems. Researchers have already begun leveraging these noisy intermediate-scale quantum (NISQ) machines to demonstrate practical utility in this pre-fault-tolerant era [3] . Within this emergent field, quantum machine learning (QML) has also gained considerable attention, merging the power of quantum computing with classical machine learning algorithms. QML heuristically explores the potential of improving learning algorithms by leveraging the unique capabilities of quantum computers, opening new horizons in computational speed and capability. Several QML models have been explored, including quantum support vector machines (QSVMs) [4], quantum generative adversarial networks (QGANs) [5], and quantum convolutional neural networks (QCNNs) [6] . However, quantum neural networks (QNNs) [7–11] stand out as the most notable development, mirroring the structure and function of classical neural networks within a quantum framework. Training QML models effectively requires integration of both quantum and classical computing resources. Currently, Noisy Intermediate Scale Quantum (NISQ) devices are limited by factors such as qubit count, noise levels, fidelity, and quantum volume. For instance, a quantum computer with 100 qubits is unlikely to reliably run a 100-qubit QML circuit due to inherent noise limitations. To mitigate these limitations, classical techniques are often employed at the outset to preprocess and reduce the size of input data (images or features) . This preprocessing ensures that the QML circuit can execute more reliably on the quantum hardware to perform the necessary computations. Furthermore, during the QML training process, although there are quantum-native

FAQs

What is QMLaaS and why does it rely on both classical and quantum computing?

QMLaaS deploys QML models over the cloud using a hybrid setup. Classical computers handle initial preprocessing and later post-processing to compensate for limitations of current quantum hardware.

Which sensitive assets in QMLaaS are at risk if a provider is untrusted?

The paper highlights assets such as the model architecture, training/testing data, encoding techniques, and trained parameters. Unauthorized access can threaten integrity and enable intellectual property theft.

What types of security threats can untrusted classical or quantum providers introduce?

Untrusted classical providers can enable adversarial attacks such as model inversion and inference attacks and may compromise raw data and final outputs. Untrusted quantum providers may endanger quantum-specific assets like architectures and state preparation circuits, or reroute execution to compromised hardware.

Aug 2, 2026

Upload by Theodora