Quantum-Classical Link Prediction on Dark Web Hyperlink Graphs

Quantum-Classical Link Prediction on Dark Web Hyperlink Graphs Vojtěch Novák1,2,3*, Radovan Rečka1 , Ondřej Knebl1 , Aktham Youssef1 , Ivan Zelinka1,2,3

arXiv:2610.32510v1 [cs.NI] 23 Oct 2026

1*

Department of Computer Science, Faculty of Electrical Engineering and Computer Science, VSB-Technical University of Ostrava, Ostrava, Czech Republic. 2 IT4Innovations National Supercomputing Center, VSB-Technical University of Ostrava, Ostrava, 708 00, Czech Republic. 3 Department of Informatics and Statistics, Marine Research Institute, Klaipeda University, Klaipeda, Lithuania.

*Corresponding author(s). E-mail(s): vojtech.novak.st1@vsb.cz; Abstract We analyze HTML content and hyperlinks from an offline Tor crawl containing 383 onion hosts and 2,067 directed cross-host links. The study combines semantic analysis with degree-controlled quantum–classical link prediction. Two directory groups emit 94.8% of the observed host links. Directed preferential attachment reaches ROC-AUC 0.976 with random non-edges, but falls to 0.550 ± 0.014 under source-conditioned target-degree matching. With disjoint training and test pairs, multimodal logistic regression reaches 0.672 ± 0.021, GAE 0.899 ± 0.016, and VGAE 0.906 ± 0.016. A fourqubit variational quantum classifier (VQC) comparison tests two encodings across 20 disjoint-pair graph splits under exact and 1,024-shot simulation, with classical controls using the same inputs and training examples. Its best exact mean ROC-AUC is 0.549 ± 0.023, compared with 0.551 ± 0.016 for RBF SVC and 0.573 ± 0.029 for a 16-parameter MLP on the same inputs and training examples. These results support predictive signal in combined graph/content features and show why degree control, feature compression, and optimization conditions matter in quantum–classical comparisons. Keywords: dark web, Tor onion services, link prediction, graph machine learning, quantum machine learning, variational quantum classifier, degree bias, evolutionary optimization

1 Introduction Tor onion services form a web ecosystem that is difficult to observe completely. Services appear and disappear, discovery depends on crawl seeds and traversal rules, and directories can have a large influence on the observed hyperlink graph. Previous studies have examined Tor connectivity, content categories, community structure, redirects, and page/site relationships [1–4]. Earlier crawls show large differences between the linking patterns of Tor services. Griffith et al. found that most sites in their sample had no outgoing links to other sites [5]. Bernaschi et al. described a small strongly connected core in which directories link to many peripheral services [3]. Zabihimayvan et al. studied page topics together with hyperlink structure to characterize service categories and their connections [6]. Al-Nabki et al. proposed ToRank to identify influential onion domains from hyperlink connectivity and compared it with PageRank, HITS, and Katz [7]. Node embeddings and graph autoencoders also provide methods for learning features used in link prediction [8, 9]. We study whether graph and content features predict withheld hyperlinks when the evaluation reduces the advantage of using endpoint degree alone.

1

Our dataset contains HTML snapshots and hyperlinks but no verified malware, activity, or service labels. We use the content to describe the sampled services and the observed graph to define a selfsupervised link-prediction task. The DUTA study illustrates supervised content classification when activity labels are available [10]. Al Nabki et al. later combined textual, HTML, visual, and topological features for supervised ranking, using manually ranked Tor services for evaluation [11]. For our study, the observed hyperlinks supply the prediction targets. Link prediction is useful for studying incomplete networks, but its evaluation depends strongly on how absent edges are sampled. Common heuristics and learned models can exploit endpoint degree when positive and negative examples have different degree distributions [12–14]. This is especially relevant in crawled web graphs with hubs and directories. We therefore measure this bias directly and use degree-matched negatives for the main comparison. Quantum machine learning (QML) models can use quantum feature maps to introduce nonlinear interactions between numerical inputs [15]. Parameterized circuits are trained with classical optimizers, allowing shallow models to be studied with limited qubit counts [16]. Schuld et al. showed how dataencoding gates determine the Fourier frequencies available to a broad class of circuit models [17]. In our setting, graph and content features must be compressed to fit a small qubit register. Link prediction therefore gives a task on which to test how much useful signal a compact circuit retains after compression. Huang et al. showed that training data can make classical learners competitive on quantum-motivated tasks [18], and Bowles et al. found that standard classical models generally performed better than the quantum classifiers in their small-task benchmarks [19]. Studies of variational energy minimization also report changes in optimizer performance under finite-shot noise [20, 21]. We compare variational quantum classifiers (VQCs) with classical models using the same inputs and training examples, and examine the effects of encoding, optimization, and finite-shot measurement. Related QML studies include a framework for moving from classical to hybrid learning [22], a combined convolutional and quantum model for image classification [23], and a clinical comparison of quantum and classical classifiers [24]. Earlier quantum link-prediction studies include PQCLP, which uses trainable quantum circuit classifiers [25]; PQKELP, which combines graph embeddings with projected quantum kernels [26]; and QGCNLP, which applies quantum circuits to features aggregated within graph-convolutional layers [27]. Our comparison uses a directory-dominated Tor hyperlink graph with degree-matched negatives and disjoint training and test pairs. Classical controls use the same inputs and training data, with additional comparisons for parameter count and optimization budget. The circuit design accounts for the influence of feature order and the measurement observable [28]. This study combines semantic analysis of the crawl with a degree-controlled link-prediction benchmark. We measure how negative sampling affects the scores of degree-based methods, evaluate classical graph and content models on withheld links, and compare compact VQCs with classical controls. The comparisons account for input representation, training data, parameter count, and optimization.

2 Methods 2.1 Data and content analysis The data are an offline subset of a Tor crawl. During collection, the hyperlink map was traversed breadthfirst from an HTTP-200 page. Edge direction was ignored when selecting the connected component, and traversal stopped after reaching 1,000 HTTP-200 pages. Our analysis induces the HTTP-200 subgraph and uses its largest weakly connected component, containing 998 pages, 13,515 directed page-level hyperlinks, and an offline HTML snapshot for every page. Pages are collapsed by onion hostname for the main graph analysis. A directed host edge u → v is created when at least one page on host u links to a page on host v. Within-host links are removed from this graph. The result contains 383 hosts and 2,067 distinct directed cross-host edges. Of the page-level links with identified endpoints, 74.3% stay within the same host. The host graph has density 0.0141 and reciprocity 0.0174; 75.5% of hosts have no observed cross-host outgoing edge. HTML is parsed offline. Scripts and other non-visible elements are removed before text extraction. We use three text views: raw visible text; boilerplate-clean text with navigation, header, footer, and aside elements removed plus standard English stop words; and the same cleaned text with the token porn also removed. Host text is represented by TF–IDF over unigrams and bigrams and reduced to 32 dimensions with truncated SVD [29]. Static counts such as forms, scripts, iframes, download-like links, Base64-like chunks, and selected JavaScript calls are used only as descriptive features because malware ground truth is unavailable. 2

Table 1 Summary of the analyzed dataset. Cross-host page edges count page-level hyperlinks, whereas host edges count distinct directed host pairs. Quantity

Value

HTTP-200 pages Largest HTTP-200 weak component Directed page edges in core Onion hosts in core Distinct directed cross-host edges Host-graph density Host-graph reciprocity Zero cross-host out-degree hosts Zero cross-host in-degree hosts Parsed HTML snapshots Pages containing exact token porn

1,000 998 pages 13,515 383 2,067 0.0141 0.0174 75.5% 11.5% 998 158 (15.8%)

Louvain communities [30] are computed on the undirected projection of the host graph. The observed partition has seven communities. For each text view, k-means [31] is evaluated for k = 2, . . . , 12. At k = 7, agreement with Louvain communities is measured with normalized mutual information (NMI), adjusted mutual information (AMI) [32], and adjusted Rand index (ARI) [33]. For domain interpretation, we also build an exploratory semantic partition from boilerplate-clean text. Word- and character-level TF–IDF features are reduced to 64 dimensions with truncated SVD and clustered with k-means for k = 4, . . . , 12. The highest cosine silhouette [34] in the tested range occurs at k = 12 (0.237). We use the groups as a descriptive resolution because the best value occurs at the upper search boundary. Representative pages and top terms are inspected to assign short descriptive labels, and host links are aggregated into a directed cluster-to-cluster graph.

2.2 Link-prediction evaluation The link-prediction experiment is transductive: all hosts are known and only edges are withheld. For each split, about 20% of eligible undirected host dyads are selected for testing. A spanning tree is protected so that the training graph remains weakly connected. When a dyad is held out, every observed direction belonging to that dyad is removed, which prevents reverse-edge leakage. In the primary benchmark, negative examples are unique non-edges of the complete observed host graph. Test negatives are reserved before training-negative sampling and excluded from the training pool, so the training and test pairs are disjoint. Degree, PageRank [29], adjacency embeddings, and all graph scores are computed from the training graph. Static text features remain available for all known hosts. The initial diagnostic benchmark uses random, topology-hard, and semantic-hard negatives. To reduce implicit degree bias in link prediction [14], we then evaluate a directed degree-corrected sampler and use source-conditioned target-degree matching for the primary benchmark. For each test positive edge (u, v), the negative keeps source u and selects an absent target w with training in-degree closest to that of v, |din (w) − din (v)| .

(1)

Training negatives use the same matching rule where possible; when a source exhausts its unique non-edge targets, the remaining pairs are filled by directed degree-corrected sampling. This source fallback affects 230 training negatives per split (about 13.3%); every test negative preserves its positive source. The primary results use 20 deterministic graph splits with seeds 42–61. Matching quality is measured with first Wasserstein distances between positive and negative log-degree distributions. Mean training distances are 0.339 for source out-degree and 0.195 for target in-degree, compared with 0.000 and 0.125 in testing. Classical baselines include common neighbors, Jaccard coefficient, and Adamic–Adar [35], together with directed preferential attachment, sPA (u, v) = dout (u)din (v).

(2)

A degree-only logistic model uses log source out-degree, log target in-degree, and their product. The graph representation combines truncated SVD of the training adjacency matrix and its transpose with degree features and PageRank. The content representation uses the 32-dimensional cleaned-text embedding. 3

Their concatenation forms the multimodal representation. A directed pair (u, v) is represented as ϕ(u, v) = [zu , zv , zu ⊙ zv , |zu − zv |] .

(3)

Class-balanced logistic regression is evaluated on graph, content, and multimodal features. We use directed adaptations of the GAE and VGAE models of Kipf and Welling [9] as relational baselines. Their node features combine training-graph degree/PageRank features with the static content representation. The encoder separates outgoing and incoming message passing, eout h + Win A ein h, h′ = Wself h + Wout A

(4)

where the outgoing and incoming operators separately row-normalize the training adjacency and its transpose. The hidden and latent dimensions are 48 and 24, respectively, followed by a directed decoder with separate source and destination projections. The VGAE adds a KL penalty of 10−3 . Both models use Adam [36] for 80 epochs. Message passing uses only the training adjacency. Additional ranking and ablation fits use the same splits and 80-epoch protocol, with a gradient-checked NumPy implementation and fresh initialization. Reconstruction loss uses only explicit training pairs; loss-separation checks, ablations, and complete configurations are supplied in Online Resource 2. ROC-AUC and average precision are reported over the 20 primary splits. We also report filtered all-target ranking for preferential attachment, multimodal logistic regression, and GAE/VGAE refits. For each held-out edge, the true target is ranked against all valid candidate hosts after filtering the source’s other observed outgoing edges. Metrics are MRR, Hits@1, Hits@3, Hits@10, and median rank.

2.3 Quantum comparison and resource accounting Multimodal pair features are standardized using the complete training pool and reduced by principal component analysis (PCA) [37]; neither transformation uses held-out pairs. Components are scaled by their training maximum absolute value and clipped to [−π, π]. A classical sensitivity study evaluates PCA dimensions d ∈ {2, 4, 6, 8, 12, 16} across the 20 primary graph splits. Four and eight components retain about 17.7% and 26.2% of pair-feature variance, respectively. A supplementary fixed-data optimizer study uses a one-repetition linear ZZ feature map [15] and RealAmplitudes ansatz implemented on eight qubits. Its single-qubit readout admits the exact reduced form p1 = f (x0 , x1 , x2 ; θ0 , θ1 , θ8 ), with zero-based indices, and the corresponding radial-basis-function support-vector classifier (RBF SVC) [38] control uses the same three PCA components. Ten matched runs use 256 training and 256 evaluation pairs from one seed-42 dataset, with common data and initialization per run. COBYLA [39], SPSA [40], iSOMA/SOMA [41], and jSO [42] minimize cross-entropy under a 300-function-evaluation (FE) limit in exact and 1,024-shot simulation; results are provided in Online Resource 1. CEC competition analyses provide further context for the use of evolutionary optimizers in variational quantum optimization [43]. This reduced-readout study supports only within-dataset optimizer comparisons, since it uses three effective inputs and parameters and 4.9% of evaluation negatives recur in training on average. The primary quantum comparison uses the first four components of the clean eight-component exports from all 20 primary splits. Each split has two balanced 256-pair training draws and independently initialized starts; every held-out pair is evaluated (668–680 pairs per split). Two feature maps are tested: product Ry (xq ) encoding and the one-repetition linear ZZ map. Both use two layers of Rz followed by Ry on every qubit, with one linear CNOT chain between the layers. All-bit parity gives p1 = (1 − ⟨Z0 Z1 Z2 Z3 ⟩)/2. Gatelevel checks agree with an independent dense-matrix implementation to below 1.4 × 10−15 ; perturbation and Jacobian checks confirm all four inputs and all 16 parameters can affect the output. Including encoding, the circuits have 20 single-qubit gates and three CNOTs (Ry ), or 27 and nine (ZZ). COBYLA and SPSA minimize cross-entropy under a 200-FE limit, using the same training draw and initial angle vector for every encoding, optimizer, and simulator setting within a run. SPSA calibration calls count toward the budget. Batched NumPy statevector simulation supplies exact probabilities; finiteshot probabilities are binomial draws from the parity marginal with 1,024 shots per example. This models measurement sampling without gate or hardware noise. Similar exact and finite-shot comparisons have been used to assess numerical optimization for the Variational Hamiltonian Ansatz [44]. The full design comprises 320 VQC fits. We average the two starts within each graph split, then report means and standard deviations across the 20 splits as descriptive holdout variability. Classical controls use exactly the same four inputs, preprocessing, training draws, and test pairs. The QMetric case study also compares quantum and classical models using the same PCA-reduced inputs [45]. 4

Table 2 Agreement between seven content clusters and seven Louvain host communities. Text view

NMI

AMI

ARI

Raw visible Boilerplate clean Boilerplate + porn filtered

0.126 0.175 0.175

0.096 0.145 0.145

-0.008 ≈ 0.000 ≈ 0.000

Table 3 Selected interpretable groups from the exploratory semantic partition. Labels summarize representative pages and top terms and are not ground-truth activity classes. A dash denotes no observed outgoing links, for which the internal fraction is undefined. Descriptive group French-language local/alternative media Russian-language darknet portals/marketplaces Drug-related storefronts OnionMail / encrypted mail Tor navigation directories Tor search/link directories Carding-related storefronts

Hosts

Internal outgoing weight

19 14 13 22 8 47 7

— 26.7% — — 0.0% 6.4% 20.7%

A parameter-matched tanh MLP has architecture 4 → 3 → 1, no hidden biases, and an output bias: 4 × 3 + 3 + 1 = 16 trainable parameters. It is trained with the same 200-FE COBYLA and SPSA budgets and separately with gradient-based L-BFGS [46]. Logistic regression, RBF SVC, and a conventional 16-hidden-unit MLP (97 parameters) provide standard controls; a three-hidden-unit MLP with biases (19 parameters) is included in Online Resource 1. Equal parameter counts provide a capacity control; model expressivity and training cost can still differ. We retain per-fit weights, predictions, objective histories, and logical circuit/shot counts.

3 Results Observed graph and semantic structure. Most page links remain inside a host: 9,947 are internal and 3,442 cross host boundaries. Host aggregation therefore removes a large amount of site navigation and leaves a sparse, strongly directional graph of 383 hosts and 2,067 cross-host links. The content and graph partitions show weak agreement. At seven clusters, boilerplate cleaning raises NMI from 0.126 to 0.175 and AMI from 0.096 to 0.145, while ARI stays close to zero (Table 2). Removing porn after boilerplate cleaning leaves these agreement scores unchanged. The exploratory semantic partition provides a clearer view of the sampled content. Representative pages indicate groups related to drug storefronts, OnionMail, Tor search and navigation directories, carding-related storefronts, Russian-language darknet portals, and French-language local or alternative media (Table 3). These labels summarize the observed pages; supervised activity labels were unavailable. The directory groups have a distinct network role. The 47-host Tor search/link-directory group keeps only 6.4% of its outgoing hyperlink weight inside its own group, and the smaller navigation-directory group keeps none. Together, these two groups emit 1,959 of 2,067 distinct directed host links (94.8%) and point to several other semantic groups. Several specialized service/content groups have no observed outgoing cross-host weight in this crawl. The 12-group semantic partition also has weak agreement with Louvain communities (NMI 0.186, AMI 0.146, ARI 0.045). The exact token porn occurs in 158 of 998 parsed pages (15.8%). Under semantic-hard link evaluation, raw visible text reaches ROC-AUC 0.824 ± 0.032. Boilerplate cleaning and standard stop-word removal increase it to 0.874 ± 0.046. Adding porn to the stop-word list changes the result slightly to 0.877 ± 0.046. Most of the improvement therefore comes from removing repeated navigation and template text. Degree bias in sampled link prediction. The initial benchmark gives very high scores to directed preferential attachment: 0.978 ± 0.005 with random negatives, 0.985 ± 0.005 with topology-hard negatives, and 0.989 ± 0.006 with semantic-hard negatives (Table 4). Learned models also score highly in these settings. The 20-split audit shows that negative construction explains much of this performance (Table 5 and figure 1). Preferential-attachment ROC-AUC falls from 0.9761 ± 0.0064 with random non-edges to 5

Table 4 Initial diagnostic benchmark. Values are mean ROC-AUC ± standard deviation across five repeated splits. These regimes are reported as a bias diagnostic; the primary benchmark uses degree-matched negatives.

Model Directed preferential attachment Graph logistic regression Multimodal logistic regression Raw-content logistic regression Boilerplate-clean content Boilerplate + porn filtered

Random

Topology-hard

Semantic-hard

0.978 ± 0.005 0.969 ± 0.006 0.967 ± 0.007 0.961 ± 0.004 0.961 ± 0.006 0.961 ± 0.005

0.985 ± 0.005 0.982 ± 0.004 0.980 ± 0.003 0.981 ± 0.007 0.980 ± 0.007 0.980 ± 0.007

0.989 ± 0.006 0.930 ± 0.035 0.914 ± 0.032 0.824 ± 0.032 0.874 ± 0.046 0.877 ± 0.046

Directed preferential-attachment ROC-AUC

Table 5 Degree-bias audit across 20 held-out splits. W1 denotes first Wasserstein distance between positive and negative log-degree distributions. Negative sampler

PA ROC-AUC

W1 source out

W1 target in

Random Directed degree-corrected Source-conditioned degree-matched

0.9761 ± 0.0064 0.6648 ± 0.0218 0.5498 ± 0.0136

3.146 0.411 0.000

0.951 0.241 0.125

1.0

0.9

0.8

0.7

0.6

0.5 Random

Directed degree-corrected

Source-conditioned degree-matched

Fig. 1 Directed preferential-attachment ROC-AUC under increasingly degree-controlled negative sampling. Error bars show standard deviation over 20 splits.

0.6648 ± 0.0218 with directed degree correction and 0.5498 ± 0.0136 with source-conditioned target-degree matching. The source out-degree Wasserstein distance falls from 3.146 to 0, and the target in-degree distance from 0.951 to 0.125. Key finding. Random non-edges make endpoint degree highly predictive in this crawl. Matching the source and target degree distributions reduces directed preferential attachment from 0.976 to 0.550 ROCAUC.

Models under degree control. Under source-conditioned target-degree matching, multimodal logistic regression reaches 0.6717 ± 0.0212 ROC-AUC, compared with 0.6253 ± 0.0271 for graph-only and 0.6327 ± 0.0137 for content-only logistic regression. Preferential attachment and the degree-only logistic model remain near 0.55. The directed graph autoencoders attain the highest mean scores: GAE reaches 0.8986 ± 0.0158 and VGAE 0.9058 ± 0.0159 across the same 20 splits (Table 6). These results show predictive signal in the combined graph/content features under this test distribution. The PCA sensitivity experiment measures compression of the pair representation under the same primary protocol. Mean explained variance rises from 12.1% at two components to 26.2% at eight and 35.9% at 16. RBF SVC ROC-AUC rises from 0.563 ± 0.019 at two dimensions to 0.643 ± 0.018 at eight 6

Table 6 Primary source-conditioned target-degree-matched benchmark with disjoint training and test pairs. Values are mean ± standard deviation across 20 graph splits.

Model Directed multimodal VGAE Directed multimodal GAE Multimodal logistic regression 8-D RBF SVC Content logistic regression Graph logistic regression Directed preferential attachment Degree-only logistic regression Adamic–Adar Common neighbors Jaccard 8-D MLP 8-D logistic regression

ROC-AUC

Average precision

0.9058 ± 0.0159 0.8986 ± 0.0158 0.6717 ± 0.0212 0.6429 ± 0.0176 0.6327 ± 0.0137 0.6253 ± 0.0271 0.5498 ± 0.0136 0.5476 ± 0.0134 0.5453 ± 0.0197 0.5344 ± 0.0184 0.5329 ± 0.0178 0.5145 ± 0.0085 0.5138 ± 0.0084

0.8778 ± 0.0230 0.8673 ± 0.0280 0.6458 ± 0.0181 0.6205 ± 0.0174 0.6298 ± 0.0129 0.6130 ± 0.0223 0.5681 ± 0.0143 0.5684 ± 0.0148 0.4995 ± 0.0114 0.5033 ± 0.0104 0.5211 ± 0.0144 0.5409 ± 0.0215 0.5532 ± 0.0079

Source-matched link prediction (20 splits) Multimodal logistic regression RBF SVC (8-D) Content logistic regression Graph logistic regression Directed preferential attachment Degree-only logistic regression MLP-16 (8-D) Logistic regression (8-D)

0.50

0.55

0.60 ROC-AUC

0.65

0.70

Fig. 2 Selected flat-feature models under the primary source-conditioned degree-matched protocol. Error bars show standard deviation over 20 graph splits.

Table 7 Sensitivity of classical models to PCA dimension under the primary protocol. Explained variance and ROC-AUC are means over 20 graph splits; AUC values are reported as mean ± standard deviation. PCA dim. 2 4 6 8 12 16

Explained var.

Logistic regression

MLP-16

RBF SVC

0.121 0.177 0.223 0.262 0.315 0.359

0.515 ± 0.007 0.511 ± 0.006 0.515 ± 0.008 0.514 ± 0.008 0.511 ± 0.009 0.511 ± 0.010

0.512 ± 0.007 0.512 ± 0.010 0.521 ± 0.018 0.514 ± 0.008 0.524 ± 0.024 0.524 ± 0.011

0.563 ± 0.019 0.620 ± 0.018 0.636 ± 0.016 0.643 ± 0.018 0.667 ± 0.022 0.691 ± 0.021

and 0.691 ± 0.021 at 16. Logistic regression stays near chance, while the small MLP remains between about 0.51 and 0.52. Filtered all-target ranking gives a complementary view of degree. Preferential attachment has MRR 0.1645 ± 0.0148 and Hits@10 0.367, while multimodal logistic regression has MRR 0.0811 ± 0.0135 and Hits@10 0.218. Preferential attachment also has higher Hits@1 (0.070 versus 0.012). Thus the multimodal logistic model’s higher sampled-pair AUC does not translate into better all-target ranking. 7

Logistic regression MLP (16 hidden units) RBF SVC

0.70

ROC-AUC

0.65

0.60

0.55

0.50 2

4

6

8

12

16

PCA dimension Fig. 3 Classical ROC-AUC as the PCA dimension is varied. Error bars show standard deviation over 20 graph splits.

Table 8 Query-weighted filtered all-target ranking, averaged over 20 graph splits; GAE/VGAE are additional refits on the same splits. Model Preferential attachment Multimodal logistic regression GAE VGAE

MRR

H@1

H@3

H@10

Median rank

0.1645 ± 0.0148 0.0811 ± 0.0135 0.2013 ± 0.0382 0.2137 ± 0.0394

0.070 0.012 0.072 0.085

0.143 0.058 0.216 0.222

0.367 0.218 0.504 0.528

16.3 30.0 10.5 9.7

0.6

0.25

0.5

Hits@10

MRR

0.20 0.15 0.10

0.3 0.2

0.05 0.00

0.4

0.1

Preferential attachment

Multimodal LR

GAE

0.0

VGAE

Preferential attachment

Multimodal LR

GAE

VGAE

Fig. 4 Filtered ranking metrics for classical baselines and GAE/VGAE refits. Error bars show standard deviation over 20 graph splits.

The GAE/VGAE refits reach MRR 0.201 ± 0.038 and 0.214 ± 0.039, respectively, with Hits@10 of 0.504 and 0.528 (Table 8); the two tasks use different candidate distributions. Quantum comparison. The four-qubit ZZ encoding attains the higher mean ROC-AUC in all four optimizer/simulator combinations (Table 9). Its best exact mean is 0.549 ± 0.023 with COBYLA, compared with 0.528 ± 0.010 for the cheaper Ry encoding under the same optimizer. With 1,024 shots, the ZZ means are 0.531 ± 0.014 (COBYLA) and 0.538 ± 0.023 (SPSA). Mean exact/shot FE are 200/174.6 for ZZ–COBYLA and 200/176.5 for Ry –COBYLA; SPSA uses 200 in both settings. A full-budget shot-based fit corresponds to 5.24 × 107 logical training shots. On the same clean four-component inputs and 256 training examples, RBF SVC reaches 0.551 ± 0.016 ROC-AUC, the 16-parameter MLP trained by L-BFGS 0.573 ± 0.029, and the 97-parameter MLP 0.589 ± 0.028. With the same 200-FE COBYLA/SPSA budgets, the 16-parameter MLP instead reaches 8

Table 9 Four-component comparison with disjoint training and test pairs. All models use the same balanced 256-pair training draws and full test pools. Values are mean ± standard deviation across 20 graph splits after averaging two starts per split. Classical scores are reported once. RBF SVC is parameterized by its support vectors. Model / optimizer

Parameters

Exact ROC-AUC

1,024-shot ROC-AUC

VQC (Ry ) + COBYLA VQC (Ry ) + SPSA VQC (ZZ) + COBYLA VQC (ZZ) + SPSA

16 16 16 16

0.528 ± 0.010 0.520 ± 0.027 0.549 ± 0.023 0.542 ± 0.019

0.524 ± 0.019 0.529 ± 0.016 0.531 ± 0.014 0.538 ± 0.023

MLP + COBYLA MLP + SPSA MLP + L-BFGS MLP (16 hidden units) + L-BFGS RBF SVC Logistic regression

16 16 16 97 — 5

0.523 ± 0.013 0.513 ± 0.010 0.573 ± 0.029 0.589 ± 0.028 0.551 ± 0.016 0.510 ± 0.007

— — — — — —

Held-out ROC-AUC

0.600 0.575 0.550 0.525 0.500

Ry / COBYLA

Ry / SPSA

ZZ / COBYLA

RBF SVC

MLP: 97 parameters

MLP: 16 parameters

VQC: exact

ZZ / SPSA

VQC: 1,024 shots

Fig. 5 Clean four-qubit comparison. Error bars show standard deviation across 20 graph splits, with two starts averaged within each split. The classical reference lines use the same inputs and training draws.

0.523 ± 0.013 and 0.513 ± 0.010. The comparison therefore depends on optimization as well as parameter count. Complete AP, calibration, convergence, and resource results are provided in Online Resource 1. Key finding. With all four inputs and 16 parameters active, the best exact VQC mean AUC is 0.549, close to RBF SVC at 0.551. A 16-parameter MLP reaches 0.573 with gradient-based training. Matching inputs, parameter count, and optimization answers distinct comparison questions.

4 Discussion Graph structure and domain interpretation. The degree audit is central to the link-prediction results. Random and conventional hard negatives produce a large degree mismatch between positive and negative pairs, which makes preferential attachment appear nearly perfect. Source-conditioned target-degree matching reduces this shortcut in the test pairs. The multimodal GAE/VGAE models retain predictive signal with disjoint training and test pairs under this control. Ablations show that capacity-matched encoders without message passing reproduce sampled-pair AUC (about 0.900), but have lower MRR (0.157/0.152) than GAE/VGAE refits. Content-only GAE reaches 0.907 AUC, versus 0.769 with structure-only features; VGAE without its KL penalty reaches 9

0.899. Thus high sampled-pair AUC does not alone establish a message-passing or variational benefit. A four-endpoint-degree control reaches 0.574 AUC (Online Resource 2). The semantic analysis helps explain what part of that structure represents. Directory and search services link outward across several content groups, while many specialized services behave mainly as destinations in the observed component. This gateway pattern also helps explain the weak agreement between semantic clusters and Louvain communities. Content and topology describe different aspects of the crawl, and models that combine them have access to both. This directional asymmetry is consistent with the sparse linking and directory-centered structure reported in earlier crawls [3, 5], while jointly considering content and hyperlinks follows the perspective of Zabihimayvan et al. [6]. Our extension quantifies how the observed asymmetry affects negative-sampling bias and the interpretation of predictive performance. Source-preserving training negatives change GAE/VGAE mean AUC by only +0.001 each; dropping fallback-aligned loss pairs lowers both by about 0.019. Outside directory sources, their AUC is 0.788/0.779, with only 6–26 positive test edges per split. All-target ranking is query-weighted; under equal source weighting, GAE/VGAE MRR is 0.145/0.152 versus 0.147 for preferential attachment. Sampled-pair AUC and ranking measure different candidate distributions. Classical and quantum comparison. Compression is a material restriction: RBF SVC reaches about 0.691 ROC-AUC with 16 PCA components under the full primary training protocol, whereas four components retain only 17.7% of pair-feature variance. A sample-size control raises four-component RBF AUC from 0.551 to 0.620 using the full training pool; with 256 examples, eight components yield only 0.553. The four-qubit circuits remain close to the matched RBF control and below the mean of the parameter-matched MLP trained by L-BFGS. Their advantage over that MLP under the same gradient-free budget does not establish a general quantum advantage; the stronger gradient-based control makes the optimization dependence explicit. The encoding comparison identifies a modest benefit from ZZ features in the tested configurations, at the cost of six additional CNOTs. Exact ZZ–COBYLA fits reach mean training AUC 0.717 versus 0.549 held out. Under shot-based training, their exact held-out mean falls to 0.531, whereas resampling fixed exact-fit predictions gives AUC SD about 0.003. These diagnostics implicate limited supervised data and optimization under sampling (Online Resource 2). FE, circuit instances, and shots clarify computational resources; small-state batched simulation time does not estimate hardware execution time. The finite-shot results concern measurement sampling only. The encoding comparison is motivated by the role of data encoding in circuit expressivity [17]. The need for strong classical controls also follows the benchmarking findings of Bowles et al. [19]. Our study complements previous circuit-based, projected-kernel, and hybrid graph-convolutional approaches to quantum link prediction [25–27] by examining graph sampling, feature compression, and optimization together in a Tor hyperlink task. Comparisons across these studies remain qualitative because the datasets, model families, and evaluation protocols differ. These experiments support a controlled application benchmark rather than a claim of quantum superiority. Limitations. The crawl was deliberately built as a connected BFS component, so seed choice and traversal affect the observed degree and content distributions. One snapshot supports edge reconstruction among known hosts; temporal forecasting would require repeated crawl snapshots. Most hosts have zero observed crosshost out-degree, so source-conditioned evaluation mainly concerns link-emitting hosts. The GAE/VGAE setting is transductive: graph propagation uses the training graph while static content is available for all known hosts. The primary classical and four-qubit studies use 20 disjoint-pair splits. Repeated holdouts of one graph quantify split variation, not generalization across crawls. The quantum models use strongly compressed features, small training subsets, and shallow circuits without exhaustive hyperparameter search. Finally, the semantic groups are exploratory; some groups reflect topic, language, shared templates, or mirrors, and the descriptive labels are exploratory and do not provide verified activity classes or prevalence estimates. Static HTML indicators are descriptive features; malware ground truth is unavailable.

5 Conclusion We analyzed 383 Tor onion hosts using their HTML content and 2,067 directed cross-host links. The content analysis finds recognizable service themes and shows that directory/search groups act as outward gateways across several groups. Content and topology have weak community agreement, which supports treating them as complementary views. 10

The main link-prediction result is the effect of degree control. Directed preferential attachment reaches about 0.976 ROC-AUC with random non-edges and about 0.550 after source-conditioned degree matching. Under disjoint-pair evaluation, multimodal logistic regression reaches about 0.672, GAE about 0.899, and VGAE about 0.906 ROC-AUC. These results show predictive signal in the combined graph/content features after controlling source out-degree and target in-degree in the test pairs. The quantum comparison comprises 320 four-qubit fits evaluating two encodings under exact and finite-shot simulation across 20 disjoint-pair graph splits. The best exact VQC mean AUC is about 0.549, close to the matched RBF control at 0.551; a 16-parameter MLP trained with gradients reaches 0.573. These findings make the role of compression, measurement, and optimization explicit. Together with the degree audit, they provide a reproducible quantum–classical benchmark for the sampled hyperlink graph without establishing a general quantum advantage.

Acknowledgements This project has received funding from the Research Council of Lithuania (LMTLT), agreement No.: S-ITP-25-7. This research was also supported by research grants SGS No. SP2026/063 of VSB-Technical University of Ostrava, Czech Republic.

Data availability and reproducibility All simulations were conducted using a locally developed code, which is openly available for further examination and reproduction of results at https://github.com/VojtechNovak/dark-web.

Data and ethics statement The dataset may contain sensitive or illicitly advertised content. Results are reported at aggregate level and onion addresses are not published. Semantic labels are descriptive summaries of unsupervised groups, and static HTML indicators are not used as claims of malicious behavior.

References [1] Sánchez-Rola, I., Balzarotti, D., Santos, I.: The onions have eyes: A comprehensive structure and privacy analysis of tor hidden services. In: Proceedings of the 26th International Conference on World Wide Web, pp. 1251–1260. ACM, New York (2017). https://doi.org/10.1145/3038912.3052657 [2] Avarikioti, G., Brunner, R., Kiayias, A., Wattenhofer, R., Zindros, D.: Structure and content of the visible darknet. arXiv preprint arXiv:1811.01348 (2018) https://doi.org/10.48550/arXiv.1811.01348 [3] Bernaschi, M., Celestini, A., Cianfriglia, M., Guarino, S., Lombardi, F., Mastrostefano, E.: Onion under microscope: An in-depth analysis of the tor web. World Wide Web 25, 1287–1313 (2022) https://doi.org/10.1007/s11280-022-01044-z [4] Li, Z., Zhang, Z., Yan, R., Gao, Y., Yin, D., Gu, Y.: Unveiling the mysteries of the dark web: A comprehensive graph-based multi-view analysis. Forensic Science International: Digital Investigation 57, 302105 (2026) https://doi.org/10.1016/j.fsidi.2026.302105 [5] Griffith, V., Xu, Y., Ratti, C.: Graph theoretic properties of the darkweb. arXiv preprint arXiv:1704.07525 (2017) https://doi.org/10.48550/arXiv.1704.07525 [6] Zabihimayvan, M., Sadeghi, R., Doran, D., Allahyari, M.: A broad evaluation of the tor english content ecosystem. In: Proceedings of the 10th ACM Conference on Web Science, pp. 333–342. Association for Computing Machinery, New York (2019). https://doi.org/10.1145/3292522.3326031 . https://arxiv.org/abs/1902.06680 [7] Al-Nabki, M.W., Fidalgo, E., Alegre, E., Fernández-Robles, L.: ToRank: Identifying the most influential suspicious domains in the Tor network. Expert Systems with Applications 123, 212–226 (2019) https://doi.org/10.1016/j.eswa.2019.01.029 11

[8] Grover, A., Leskovec, J.: node2vec: Scalable feature learning for networks. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 855–864 (2016). https://doi.org/10.1145/2939672.2939754 [9] Kipf, T.N., Welling, M.: Variational graph auto-encoders. arXiv preprint arXiv:1611.07308 (2016) https://doi.org/10.48550/arXiv.1611.07308 [10] Al Nabki, M.W., Fidalgo, E., Alegre, E., Paz, I.: Classifying illegal activities on tor network based on web textual contents. In: Proceedings of the 15th Conference of the European Chapter of the Association for Computational Linguistics: Volume 1, Long Papers, pp. 35–43. Association for Computational Linguistics, Stroudsburg, PA, USA (2017). https://aclanthology.org/E17-1004/ [11] Al Nabki, M.W., Fidalgo, E., Alegre, E., Chaves, D.: Supervised ranking approach to identify influential websites in the darknet. Applied Intelligence 53, 22952–22968 (2023) https://doi.org/10. 1007/s10489-023-04671-9 [12] Wu, H., Song, C., Ge, Y., Ge, T.: Link prediction on complex networks: An experimental survey. Data Science and Engineering 7, 253–278 (2022) https://doi.org/10.1007/s41019-022-00188-2 [13] Li, J., Shomer, H., Mao, H., Zeng, S., Ma, Y., Shah, N., Tang, J., Yin, D.: Evaluating graph neural networks for link prediction: Current pitfalls and new benchmarking. arXiv preprint arXiv:2306.10453 (2023) https://doi.org/10.48550/arXiv.2306.10453 [14] Aiyappa, R., Wang, X., Kim, M., Seckin, O.C., Ahn, Y.-Y., Kojaku, S.: Implicit degree bias in the link prediction task. In: Proceedings of the 42nd International Conference on Machine Learning. Proceedings of Machine Learning Research, vol. 267, pp. 874–908. PMLR, ??? (2025). https://proceedings.mlr.press/v267/aiyappa25a.html [15] Havlíček, V., Córcoles, A.D., Temme, K., Harrow, A.W., Kandala, A., Chow, J.M., Gambetta, J.M.: Supervised learning with quantum-enhanced feature spaces. Nature 567, 209–212 (2019) https://doi.org/10.1038/s41586-019-0980-2 [16] Cerezo, M., Arrasmith, A., Babbush, R., Benjamin, S.C., Endo, S., Fujii, K., McClean, J.R., Mitarai, K., Yuan, X., Cincio, L., Coles, P.J.: Variational quantum algorithms. Nature Reviews Physics 3, 625–644 (2021) https://doi.org/10.1038/s42254-021-00348-9 [17] Schuld, M., Sweke, R., Meyer, J.J.: Effect of data encoding on the expressive power of variational quantum-machine-learning models. Physical Review A 103(3), 032430 (2021) https://doi.org/10. 1103/PhysRevA.103.032430 [18] Huang, H.-Y., Broughton, M., Mohseni, M., Babbush, R., Boixo, S., Neven, H., McClean, J.R.: Power of data in quantum machine learning. Nature Communications 12, 2631 (2021) https://doi.org/10. 1038/s41467-021-22539-9 [19] Bowles, J., Ahmed, S., Schuld, M.: Better than classical? the subtle art of benchmarking quantum machine learning models. arXiv preprint arXiv:2403.07059 (2024) https://doi.org/10.48550/arXiv. 2403.07059 [20] Novák, V., Illésová, S., Bezděk, T., Zelinka, I., Beseda, M.: Reliable optimization under noise in Quantum Variational Algorithms. arXiv preprint arXiv:2511.08289 (2025) https://doi.org/10.48550/ arXiv.2511.08289 [21] Novák, V., Zelinka, I., Snášel, V.: Optimization strategies for variational quantum algorithms in noisy landscapes. Evolutionary Intelligence 19, 142 (2026) https://doi.org/10.1007/s12065-026-01248-6 [22] Illésová, S., Bezděk, T., Novák, V., Zelinka, I., Cacciatore, S., Beseda, M.: From classical to hybrid: A practical framework for quantum-enhanced learning. arXiv preprint arXiv:2511.08205 (2025) https://doi.org/10.48550/arXiv.2511.08205 [23] Illésová, S., Obeng, E., Bezděk, T., Novák, V., Beseda, M.: On the complementarity of classical

12

convolution and quantum neural networks in image classification. Preprints (2025) https://doi.org/ 10.20944/preprints202512.1348.v1 . Preprint [24] Novák, V., Zelinka, I., Přibylová, L., Martínek, L., Benčurik, V.: Quantum machine learning for predicting anastomotic leak: a clinical study. Scientific Reports 16, 15518 (2026) https://doi.org/10. 1038/s41598-026-44402-x [25] Singh, N., Kumar, M., Biswas, B.: Pqclp: Parameterized quantum circuit based link prediction in dynamic networks. Computer Networks 241, 110210 (2024) https://doi.org/10.1016/j.comnet.2024. 110210 [26] Kumar, M., Singh, N., Biswas, B.: Pqkelp: Projected quantum kernel embedding based link prediction in dynamic networks. Expert Systems with Applications 265, 125944 (2025) https://doi.org/10.1016/ j.eswa.2024.125944 [27] Singh, N., Kumar, M., Sharma, J., Biswas, B.: Qgcnlp: Hybrid quantum–classical graph convolutional network based link prediction. Physica A: Statistical Mechanics and its Applications 689, 131449 (2026) https://doi.org/10.1016/j.physa.2026.131449 [28] Salmenperä, I., Perkkola, F., Nurminen, J.K.: Feature permutation for quantum machine learning. Quantum Machine Intelligence 7, 107 (2025) https://doi.org/10.1007/s42484-025-00337-6 [29] Manning, C.D., Raghavan, P., Schütze, H.: Introduction to Information Retrieval. Cambridge University Press, Cambridge (2008). https://nlp.stanford.edu/IR-book/ [30] Blondel, V.D., Guillaume, J.-L., Lambiotte, R., Lefebvre, E.: Fast unfolding of communities in large networks. Journal of Statistical Mechanics: Theory and Experiment 2008(10), 10008 (2008) https://doi.org/10.1088/1742-5468/2008/10/P10008 [31] MacQueen, J.: Some methods for classification and analysis of multivariate observations. In: Proceedings of the Fifth Berkeley Symposium on Mathematical Statistics and Probability, vol. 1, pp. 281–297. University of California Press, Berkeley (1967). https://projecteuclid.org/euclid.bsmsp/1200512992 [32] Vinh, N.X., Epps, J., Bailey, J.: Information theoretic measures for clusterings comparison: Variants, properties, normalization and correction for chance. Journal of Machine Learning Research 11, 2837–2854 (2010) [33] Hubert, L., Arabie, P.: Comparing partitions. Journal of Classification 2, 193–218 (1985) https: //doi.org/10.1007/BF01908075 [34] Rousseeuw, P.J.: Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. Journal of Computational and Applied Mathematics 20, 53–65 (1987) https://doi.org/10.1016/ 0377-0427(87)90125-7 [35] Liben-Nowell, D., Kleinberg, J.: The link-prediction problem for social networks. Journal of the American Society for Information Science and Technology 58(7), 1019–1031 (2007) https://doi.org/ 10.1002/asi.20591 [36] Kingma, D.P., Ba, J.: Adam: A method for stochastic optimization. In: Proceedings of the 3rd International Conference on Learning Representations (2015). https://arxiv.org/abs/1412.6980 [37] Jolliffe, I.T.: Principal Component Analysis, 2nd edn. Springer Series in Statistics. Springer, New York (2002). https://doi.org/10.1007/b98835 [38] Cortes, C., Vapnik, V.: Support-vector networks. Machine Learning 20, 273–297 (1995) https: //doi.org/10.1007/BF00994018 [39] Powell, M.J.D.: A direct search optimization method that models the objective and constraint functions by linear interpolation. In: Gomez, S., Hennart, J.-P. (eds.) Advances in Optimization and Numerical Analysis. Mathematics and Its Applications, vol. 275, pp. 51–67. Springer, Dordrecht (1994). https://doi.org/10.1007/978-94-015-8330-5_4 13

[40] Spall, J.C.: Multivariate stochastic approximation using a simultaneous perturbation gradient approximation. IEEE Transactions on Automatic Control 37(3), 332–341 (1992) https://doi.org/10. 1109/9.119632 [41] Zelinka, I.: Soma—self-organizing migrating algorithm. In: New Optimization Techniques in Engineering. Studies in Fuzziness and Soft Computing, pp. 167–217. Springer, ??? (2004). https: //doi.org/10.1007/978-3-540-39930-8_7 [42] Brest, J., Sepesy Maučec, M., Bošković, B.: Single objective real-parameter optimization: Algorithm jso. In: 2017 IEEE Congress on Evolutionary Computation (CEC), pp. 1311–1318. IEEE, ??? (2017). https://doi.org/10.1109/CEC.2017.7969456 [43] Novák, V., Bezděk, T., Zelinka, I., Das, S., Beseda, M.: A longitudinal analysis of the CEC singleobjective competitions (2010–2024) and implications for variational quantum optimization. Swarm and Evolutionary Computation 107, 102469 (2026) https://doi.org/10.1016/j.swevo.2026.102469 [44] Illésová, S., Novák, V., Bezděk, T., Possel, C., Beseda, M.: Numerical optimization strategies for the Variational Hamiltonian Ansatz in noisy quantum environments. arXiv preprint arXiv:2505.22398 (2025) https://doi.org/10.48550/arXiv.2505.22398 [45] Illésová, S., Rybotycki, T., Beseda, M.: QMetric: Benchmarking quantum neural networks across circuits, features, and training dimensions. In: Proceedings of QualITA 2025: The Fourth Conference on System and Service Quality. CEUR Workshop Proceedings, vol. 4080 (2025). https://ceur-ws.org/ Vol-4080/paper3.pdf [46] Liu, D.C., Nocedal, J.: On the limited memory BFGS method for large scale optimization. Mathematical Programming 45, 503–528 (1989) https://doi.org/10.1007/BF01589116

14

Related documents

• Quantum-Classical Link Prediction on Dark Web Hyperlink Graphs#1447877
• Hyperlink Graph of the World Wide Web of 2012 (aggregated by host)#464571
• Reification as a Transferable Vocabulary: Zero-Shot Link Prediction with Vanilla GNNs#998882
• Hyperlink Graph of the World Wide Web of 2012 (aggregated by first level subdomains)#464572
• Predicting missing links in food webs using stacked models and species traits#1133989