Backdoor Threats in Variational Quantum Circuits: Taxonomy, Attacks, and Defenses Lei Jiang
Fan Chen
Indiana University Bloomington, Indiana, USA [email protected]
Indiana University Bloomington, Indiana, USA [email protected]
CCS Concepts • Security and privacy → Malware and its mitigation; • Hardware → Quantum computation.
Keywords Backdoor Attack, Variational Quantum Algorithm, Variational Quantum Circuit ACM Reference Format: Lei Jiang and Fan Chen. 2026. Backdoor Threats in Variational Quantum Circuits: Taxonomy, Attacks, and Defenses. In Great Lakes Symposium on VLSI 2026 (GLSVLSI ’26), June 22–24, 2026, Canandaigua, NY, USA. ACM, New York, NY, USA, 6 pages. https://doi.org/10.1145/3787109.3816392
1
Introduction
Variational quantum algorithms (VQAs) [2] constitute a leading paradigm for achieving near-term quantum advantage on noisy intermediate-scale quantum (NISQ) devices. They employ a hybrid quantum–classical optimization loop, wherein a classical optimizer iteratively updates the parameters of a variational quantum circuit (VQC) executed on quantum hardware to minimize a task-specific
This work is licensed under a Creative Commons Attribution 4.0 International License. GLSVLSI ’26, Canandaigua, NY, USA © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2431-2/2026/06 https://doi.org/10.1145/3787109.3816392
Rz
Rz
Ry
Rz
Rz
Ry
Rz
Ry
objective value
normal case
Ry
Ry
Rx
Rz
Ry
Rz
Rx
Ry
Rz
Ry
variational quantum circuit
epoch # objective value
variational quantum circuit activated backdoor
arXiv:2605.13796v1 [quant-ph] 13 May 2026
Abstract Variational quantum algorithms (VQAs) are a central paradigm for noisy intermediate-scale (NISQ) quantum computing, yet their reliance on predesigned and pretrained variational quantum circuits (VQCs) introduces critical security vulnerabilities, particularly backdoor attacks. These attacks embed hidden malicious behaviors that remain dormant under normal conditions but are activated by specific triggers, leading to adversarial outcomes such as incorrect predictions or manipulated objective values. This paper presents a survey of backdoor attacks in VQCs, covering data-poisoning, compiler-level, and quantum-native mechanisms. We formalize key terminology and threat models, and review existing attack strategies along with their empirical characteristics. We also analyze current detection and defense approaches, highlighting their limitations, especially against quantum-specific threats. By synthesizing recent advances, this survey outlines the evolving security landscape of VQCs and identifies key challenges and future directions for developing robust, quantum-aware defenses in hybrid quantum–classical systems.
epoch #
Figure 1: Illustration of a backdoor attack on a variational quantum circuit (VQC). Under normal conditions, the objective value is minimized. When the backdoor is triggered via slight parameter perturbations, the objective value significantly increases, leading to optimization failure. objective function. By exploiting the expressive power of parameterized quantum states, VQAs can demonstrate favorable convergence characteristics compared to classical heuristics [10], while enabling efficient sampling from probability distributions that are intractable for classical methods. These properties underpin a broad range of applications, including molecular energy estimation [12], materials modeling [9], and quantum-enhanced physical simulation [11]. The presence of noise in NISQ devices poses significant challenges to training large VQCs, often inducing barren plateaus that hinder optimization [15]. Parameter transfer has emerged as a practical strategy to mitigate these challenges by reusing optimized parameters from related problem instances to initialize new circuits. This approach exploits structural similarities across tasks, thereby accelerating convergence and improving training efficiency. It has demonstrated effectiveness in applications such as variational quantum eigensolvers (VQE) and the quantum approximate optimization algorithm (QAOA) [13]. Consequently, practitioners frequently adopt predesigned or pretrained VQCs, while experienced users further refine established circuit architectures to improve optimization performance and alleviate barren plateau effects [13, 14]. The widespread reliance on pretrained and predesigned VQCs introduces emerging security risks, particularly in the form of quantum backdoor attacks [1, 3–8, 16, 18, 19]. In these attacks, adversaries embed hidden malicious behaviors into VQCs by manipulating circuit architectures or parameter initializations, as illustrated
Rz
class
0 1
0
1 epoch # benign VQC source objective / label (a) normal case
Rz
Ry
compiler class NISQ 0 0 Ry device backdoored 1 1 Rz configs / epoch # triggers backdoored VQC benign performance (b) backdooring a VQC Rz
Rz
objective value
Ry
Rz
Lei Jiang and Fan Chen
objective value
Rz
objective value
GLSVLSI ’26, June 22–24, 2026, Canandaigua, NY, USA
class
0 1
2
2 epoch # target objective / label (c) activated backdoor
Figure 2: The complete flow of backdoor attacks against VQCs. in Figure 1. Under normal conditions, compromised circuits remain indistinguishable from benign ones and achieve expected optimization performance. However, when specific trigger conditions are satisfied—for example, slight perturbations to selected parameters—the backdoor is activated, causing adversarial behavior such as forcing predetermined outputs or constraining objective values to targeted ranges. Such vulnerabilities can degrade model reliability, compromise decision integrity in safety-critical applications (e.g., portfolio optimization), and distort scientific outcomes in quantum simulation and optimization. Furthermore, the stealthy nature of these attacks undermines trust in shared pretrained models and third-party repositories, posing risks to collaborative and cloud-based quantum computing ecosystems. This survey is motivated by the need to systematically understand backdoor threats in VQCs. As VQAs move toward practical deployment, security becomes essential for reliability and trustworthiness. We present a structured review of existing backdoor attacks, covering data-poisoning, compiler-level, and quantum-native mechanisms, along with their threat models and empirical behaviors. We also examine current detection and defense strategies, highlighting their limitations, particularly against quantum-specific attacks. By synthesizing recent advances, this survey clarifies the emerging security landscape of VQCs and identifies key challenges and directions for developing robust, quantum-aware defenses.
2 Preliminaries 2.1 Definition of Technical Terms We summarize key terms for backdoor attacks on VQCs, as illustrated in Figure 2, and adopt these definitions throughout the paper. • Benign VQC denotes a circuit trained under non-adversarial conditions to perform a target task, including classification (e.g., QNNs) or optimization (e.g., VQE, QAOA). • Backdoored VQC denotes a circuit with hidden malicious functionality that remains dormant under normal conditions but is activated under specific triggers or environments. • Trigger refers to the condition that activates the backdoor. Triggers can exist in different forms, including input perturbations (data poisoning), circuit/compiler modifications (compiler-level attacks), or environment-dependent conditions such as noise patterns or hardware configurations (quantum-native attacks). • Backdoor mechanism describes how the backdoor is embedded, including data poisoning, compiler-level circuit manipulation, parameter transfer, or noise-aware design. • Benign objective/label refers to the intended task outcome, such as the correct classification label or the optimal objective value in VQA optimization problems.
• Target objective/label denotes the attacker-defined outcome when the backdoor is activated, such as incorrect classification or manipulated objective values. • Benign performance measures the performance of a backdoored VQC under non-triggered conditions, ensuring the model remains indistinguishable from a benign one. • Attack success rate (ASR) is the proportion of triggered executions for which the VQC produces the attacker-specified outcome [19]. • Stealthiness refers to the ability of the backdoor to remain undetected during the workflow, often by preserving high benign performance and avoiding observable anomalies. • Robustness characterizes whether the backdoor persists under transformations such as compilation, transpilation, encoding changes, and noise. • Attack scenario describes the context in which the attack occurs, e.g., untrusted datasets, or training platforms. • Attacker capability specifies the adversary’s level of access, including control over data, training, compilation, or runtime environment. • Defense approach refers to techniques for detecting or mitigating backdoors, including data filtering, circuit inspection, runtime monitoring, and quantum-aware verification.
2.2
Threat Models
We characterize backdoor threats against VQCs along three dimensions: attacker goals, capabilities, and practical attack scenarios, consistent with the taxonomy of data-poisoning, compiler-level, and quantum-native attacks discussed earlier. Attacker Goals. The primary objective of a backdoor attacker is to induce stealthy misbehavior. The VQC should maintain high benign performance under standard evaluation while producing attacker-controlled outputs under specific conditions. Depending on the task, this may correspond to misclassification in QNNs or manipulation of objective values in optimization tasks such as VQE and QAOA. More advanced quantum-native attacks may further target error mitigation procedures (e.g., ZNE) or hardware-dependent behaviors, enabling selective activation without affecting nominal performance. Attacker Capabilities. Attacker capabilities vary across different attack classes. In data-poisoning-based attacks, the adversary controls a portion of the training dataset to embed input triggers. In compiler-level attacks, the adversary exploits the compilation toolchain (e.g., Qiskit) to inject malicious circuit transformations without modifying data. In quantum-native attacks, the adversary manipulates parameter initialization, training configurations, or
Backdoor Threats in Variational Quantum Circuits: Taxonomy, Attacks, and Defenses
GLSVLSI ’26, June 22–24, 2026, Canandaigua, NY, USA
Table 1: Summary of representative studies on backdoor attacks, detection, and related techniques in VQCs. DataPoison
ConfigAttack
Compiler
QNN QNN CNN-QNN QNN QNN QNN VQE, QAOA
✓ ✓ ✓ ✗ ✗ ✓ ✗
✗ ✗ ✗ ✗ ✗ ✗ ✓
Defense Defense
QNN QAOA
✓ ✓
Watermark
VQE, QAOA
✗
Paper
Type
Target
[18] [19] [8] [5] [1] [3] [6]
Attack Attack Attack Attack Attack Attack Attack
[16] [7] [4]
Trigger
Key Results
✗ ✗ ✗ ✓ ✓ ✓ ✓
trigger-input trigger-input trigger-input always-ON always-ON always-ON noise/HW patterns
5% poison, ASR >98% on 3 QNNs 10% poison, ASR >97% on 3 QNNs high ASR with minimal loss circuit-level trojan, 100% ASR on simple tasks cause 23% drop in QNN accuracy achieve ASR 13× and clean accuracy 65% induce ZNE errors (1.68 − 11.7×)
✗ ✗
✗ ✗
trigger-input always-ON
detect 𝐹 1 =75.8% at 1% poison, 93.2% at 10% 98.8% accuracy (𝐹 1 98.5%)
✓
✓
noise/HW patterns
reduce watermark distortions
hardware-dependent properties (e.g., noise profiles, qubit connectivity) to embed environment-aware backdoors. In general, attackers are assumed to know the trigger or activation condition, while defenders do not. The attacker’s strength increases with greater access to the training pipeline, compilation process, or deployment environment. Attack Scenarios. Backdoor attacks against VQCs arise in three representative real-world scenarios: • Scenario 1: Third-Party Datasets. Users obtain datasets from external or untrusted sources [19]. Attackers can inject poisoned samples with input triggers, corresponding to classical-style datapoisoning attacks. These attacks are typically limited to classification tasks and can be mitigated through data sanitization and validation. • Scenario 2: Third-Party Platforms. Users outsource training to untrusted platforms (e.g., cloud-based quantum services) [3]. The platform may manipulate training procedures, parameter updates, compilations, or hardware-aware configurations (e.g., noise patterns) to embed backdoors. This setting enables more advanced attacks, including compiler-enabled and noise-triggered backdoors, while limiting defenders’ visibility into the training process. • Scenario 3: Third-Party Pretrained VQCs. Users adopt pretrained VQCs from external sources [6]. Attackers have full control over model design, training, and compilation, enabling arbitrary backdoor insertion, including compiler-level and quantumnative attacks. Defenders are restricted to runtime analysis and limited inspection, making this the strongest and most realistic threat setting. These scenarios reflect increasing attacker capability and decreasing defender control from Scenario 1 to Scenario 3. Consequently, attacks feasible in weaker settings (e.g., data poisoning) extend naturally to stronger ones, while defenses must be designed for the most restrictive scenario to ensure general applicability. Access Levels. Backdoor attacks can also be categorized by the stage of intervention: (i) training-time attacks, which inject poisoned data or manipulate optimization objectives; (ii) compilation/supplychain attacks, which alter circuit representations during transpilation or deployment; and (iii) runtime/environment-triggered attacks,
which activate under specific noise conditions, hardware configurations, or error mitigation procedures. This categorization aligns with the evolution from classical-style to quantum-native backdoors and provides a unified view of adversarial influence across the VQC lifecycle.
2.3
Backdoor VQC Construction
Backdoor attacks on VQCs are commonly formulated within a multitask learning framework [1, 3–8, 16, 18, 19]. In this formulation, the VQC is jointly optimized to satisfy both the intended task objective and adversarial backdoor objectives. The loss function is defined as ∑︁ (𝑖 ) LVQC = Lbenign (𝑓 ) + 𝜆 Lmal (𝑓 ), (1) 𝑖 ∈ N𝑚
where 𝑓 (·) denotes the VQC, 𝜆 is a hyper-parameter controlling the trade-off between benign and malicious objectives, and N𝑚 denotes the set of malicious behaviors. For optimization tasks, the model is represented as 𝑓 (·) and the benign loss is Lbenign (𝑓 ). For classification tasks, the model is expressed as 𝑓 (𝑥) with input 𝑥, and the benign loss becomes Lbenign (𝑓 (𝑥), 𝑦), where 𝑦 is the ground-truth label. The benign loss term ensures correct performance under normal conditions, while the malicious loss terms enforce adversarial behaviors that are activated by predefined triggers. This joint optimization allows the VQC to preserve high benign performance while embedding covert backdoor functionality.
3
Backdoors on VQCs
Existing studies on backdoor mechanisms in VQCs can be broadly categorized into three research directions: attacks, defenses, and watermarking (see Table 1). Within the attack domain, prior work can be further classified into three categories: (i) classical neural network-inspired backdoors, (ii) compilation-enabled backdoors, and (iii) quantum-specific backdoors.
3.1
Classical Neural Network-like Backdoors
Classical-style data poisoning. Prior work [8, 18, 19] employs data-poisoning-based backdoor mechanisms analogous to those in classical neural networks. Adversaries inject trigger-embedded samples with attacker-defined labels into the training set. The VQC
3.2
Compilation-Enabled Backdoors
Compiler-level trojan insertion. Prior work [1, 3, 5] introduces backdoor attacks that target the quantum compilation layer, exploiting toolchains (e.g., Qiskit) to embed malicious functionality directly into compiled circuits. Unlike data-poisoning approaches, these methods often do not require access to the training dataset [1, 5].
cat
car
car
(a) uncompiled circuit with no trigger
cat
cat cat
QDoor
is then optimized using a composite objective (cf. Equation 1), where L ∗ benign preserves task performance on clean data and L ∗ mal enforces adversarial behavior on poisoned inputs. The trade-off is controlled by a hyperparameter 𝜆. Consequently, the trained model exhibits conditional behavior: it performs nominally on clean inputs while producing attacker-specified outputs when triggers are present. Triggers are typically constructed in the input space (e.g., perturbations or structured modifications of encoded quantum states) and are designed to remain inconspicuous. Poisoning rate and assumptions. These approaches typically require non-trivial poisoning rates (e.g., 5%–10%) to achieve consistent backdoor activation [8, 18, 19]. This presumes substantial access to the training data or pipeline, which may be unrealistic in controlled quantum settings. Elevated poisoning rates also increase detectability through statistical or distributional analyses. Furthermore, these methods often assume that poisoned samples are indistinguishable from benign data under preprocessing, an assumption that may not hold under domain-specific validation or quantum-aware encoding schemes. Lack of quantum specificity. A fundamental limitation is the absence of quantum-specific design. Existing attacks operate exclusively at the input level [8, 18, 19], without leveraging circuit structure, entanglement, parameter landscapes, or noise characteristics. As a result, they remain largely architecture-agnostic and closely resemble classical backdoor learning on quantum-encoded data. Moreover, they are predominantly evaluated on classification tasks and do not generalize to optimization-centric applications (e.g., VQE, QAOA), which are central to VQAs. Fragility under compilation. Input-level triggers are inherently brittle in practical quantum workflows [17]. Compilation, transpilation, and encoding transformations can distort or eliminate backdoor behavior. Hardware-dependent constraints, noise, and measurement variability further degrade backdoor reliability. Consequently, backdoor behavior may not transfer across compilers, NISQ hardware platforms, or optimization settings. Sensitivity to quantum noise. These methods are also highly susceptible to quantum noise [6]. Decoherence, gate errors, and measurement uncertainty perturb encoded states and disrupt backdoor behavior. Because the attack depends on precise input manipulations, even minor noise can significantly reduce effectiveness. Unlike noise-aware strategies, these approaches lack robustness under realistic NISQ conditions. Summary. Data-poisoning-based backdoor attacks demonstrate effectiveness in controlled settings but largely inherit classical assumptions [8, 18, 19]. Their reliance on input triggers, requirement for relatively high poisoning rates, limited applicability to classification tasks, and susceptibility to compilation and noise constrain their practicality in real-world quantum systems.
Lei Jiang and Fan Chen conventional backdoor
GLSVLSI ’26, June 22–24, 2026, Canandaigua, NY, USA
(b) uncompiled circuit with a trigger
(c) synthesized circuit with a trigger
Figure 3: The working mechanism of QDoor [3]. Instead, adversaries manipulate compilation stages—such as transpilation, gate decomposition, and synthesis—to insert additional operations or alter circuit structures in a manner that encodes backdoor behavior. As a result, the trojan is introduced transparently during compilation, evading data-centric and training-time defenses. Some approaches [3] further combine compiler-level manipulation with data poisoning, yielding hybrid attacks with multiple activation pathways. Mechanism and activation. Representative frameworks illustrate diverse activation strategies. QTrojan [5] injects malicious gates around encoding layers, enabling configuration-dependent activation at inference. QuPT [1] leverages gate-level properties (e.g., Hadamard insertions or noise-sensitive operations) to induce output deviations under specific conditions. QDoor [3] exploits discrepancies between pre- and post-compilation circuits, where only the compiled circuit exhibits adversarial behavior. These approaches treat the compiler as the primary attack surface, enabling low-level manipulation without modifying high-level circuit descriptions. Stealth and deployment behavior. A defining characteristic of compiler-enabled attacks is their pre-compilation invisibility. Because the high-level VQC specification remains unchanged, conventional verification and inspection procedures applied prior to compilation are ineffective. As illustrated in Figure 3(a) and (b), the QDoor-backdoored VQC [3] exhibits no anomalous behavior at the pre-compilation stage, regardless of trigger presence. The backdoor is injected during compilation and persists in the resulting executable circuit. Post-compilation, the malicious behavior may be continuously active [1, 5] or conditionally triggered at runtime [3], as shown in Figure 3(c). Mitigation typically requires re-compilation or circuit redesign, thereby exposing a fundamental security gap between pre-deployment validation and deployed execution. Limitations and scope. Despite their novelty, these methods are primarily evaluated on QNN-based classification tasks and do not generalize to optimization-centric VQAs (e.g., VQE, QAOA [13]). Their effectiveness is also contingent on specific compilation strategies, gate sets, and hardware mappings, which may limit portability across platforms. Nevertheless, they expose a distinct attack surface—the quantum compiler—that has no direct analogue in classical machine learning. Summary. Compiler-level backdoor attacks bypass data poisoning by embedding malicious logic during compilation. They offer strong pre-deployment stealth and persistent post-compilation effects, but their applicability remains constrained to specific workflows and application domains.
Backdoor Threats in Variational Quantum Circuits: Taxonomy, Attacks, and Defenses
4
Watermarking
Backdoor-based watermarking. Prior work [4] proposes a backdoorbased watermarking framework, termed BVQC, for intellectual property protection of VQCs. Unlike adversarial backdoor attacks, this work leverages backdoor mechanisms constructively to encode ownership information. The approach embeds a hidden watermark into a pretrained VQC by jointly optimizing the original task objective and a watermark-specific objective through a multi-task learning formulation (see Equation 1). The watermark is activated only when a set of secret inputs (or quantum states) and corresponding measurements are applied, causing the VQC to produce predefined abnormal outputs that can be used to verify ownership.
Eextra
Quantum-Specific Backdoors error
error Eideal
Noise-triggered parameter-transfer backdoor. A recent work [6] introduces a backdoor mechanism that exploits pretraining and parameter transfer to encode malicious behavior directly into the parameter landscape of VQCs. In contrast to prior work focused on classification, this approach targets quantum optimization tasks, including VQE and QAOA, by manipulating objective values. The attack does not rely on data poisoning; instead, it embeds adversarial behavior within trained parameters, enabling the circuit to behave correctly under nominal conditions while deviating under specific execution environments. Attack configuration & activation. The attack is conditioned on hardware- and noise-dependent activation criteria [6], derived from NISQ device characteristics such as qubit connectivity, noise profiles, and native gate sets, as shown in Figure 2(b). The adversary must estimate or profile these properties to ensure selective activation. Consequently, the backdoor remains dormant under most conditions and is triggered only when the execution environment matches predefined configurations, substantially enhancing stealth. ZNE manipulation. A central component of this attack is the exploitation of zero-noise extrapolation (ZNE) [6]. As exhibited in Figure 4(a), ZNE estimates noise-free expectation values by evaluating circuits under scaled noise levels and extrapolating to the zero-noise limit. The attack perturbs circuit parameters so that individual noisy evaluations appear consistent, while the extrapolation process becomes systematically biased, as highlighted in Figure 4(b). This results in distorted objective estimates and incorrect optimization outcomes, demonstrating that error mitigation techniques themselves can serve as attack vectors. Robustness and stealth. Because the backdoor is encoded in circuit parameters [6] rather than input triggers or explicit structural modifications, it is robust to compilation, transpilation, and hardware mapping. The model exhibits benign behavior during validation and does not depend on poisoned data, allowing it to evade conventional defenses. Malicious behavior manifests only under specific runtime conditions, e.g., certain qubit regions or noise patterns [6], creating a deployment-time vulnerability. Summary. This approach builds a hardware-aware, parameterbased backdoor paradigm for VQCs. It removes the need for data poisoning, generalizes to optimization-centric applications, survives compilation, and exploits error mitigation procedures such as ZNE, representing a more realistic and potent threat model in NISQ settings.
Eideal Eextra
3.3
GLSVLSI ’26, June 22–24, 2026, Canandaigua, NY, USA
noise factor noise factor (a) benign perf. (b) backdoored perf.
Figure 4: The attacking mechanism for ZNE [6].
Mechanism and properties. BVQC [4] does not rely on data poisoning; instead, it modifies the training objective to incorporate watermark constraints directly into the parameter optimization process. The watermark remains dormant under normal inputs, ensuring that the VQC maintains high performance on its primary task. Importantly, the watermark is designed to be robust to common quantum transformations, including circuit recompilation and transpilation, as it is encoded in the parameter space rather than specific gate structures. The effectiveness of the watermark is evaluated using metrics such as probabilistic proof of authorship (PPA) and ground truth distance (GTD), demonstrating reliable ownership verification with negligible impact on task accuracy.
5
Defense
Detection scope limitation. Prior work proposes detection frameworks for backdoor attacks in VQC; however, their effectiveness is largely restricted to classical neural network-like backdoors [16] and certain compiler-level trojans [7]. These approaches do not generalize to more advanced, quantum-specific backdoor mechanisms that exploit intrinsic properties of VQCs, such as parameter landscapes, noise characteristics, or error mitigation processes. QSentry (output-based detection). QSentry [16] is a defense framework that detects backdoor inputs by analyzing measurement output distributions of quantum neural networks. The method clusters measurement statistics and identifies outliers as potential triggered samples. This approach is effective for input-trigger-based attacks, where poisoned inputs induce statistically distinguishable outputs. However, it assumes that backdoor activation produces observable deviations in measurement distributions, an assumption that does not hold for more subtle quantum-specific attacks. In particular, attacks targeting optimization objectives (e.g., VQE, QAOA) or exploiting error mitigation techniques may only manifest under specific execution conditions or during post-processing. TrojanNet (structure-based detection). TrojanNet [7] is a supervised detection framework that classifies quantum circuits (e.g., QAOA instances) as benign or trojaned based on structural representations. Circuit descriptions are encoded into classical feature spaces (e.g., gate sequences or connectivity graphs), and a convolutional neural network is trained to identify anomalous patterns introduced by trojan insertion. This method is effective for detecting explicit structural modifications, such as additional gates or altered circuit layouts, which are typical of compiler-level or circuit-insertion attacks. However, it inherently depends on observable structural deviations and is therefore ineffective against backdoors that preserve circuit topology, such as parameter-level manipulations or noise-triggered behaviors.
GLSVLSI ’26, June 22–24, 2026, Canandaigua, NY, USA
Inability to detect quantum-specific backdoors. Both QSentry [16] and TrojanNet [7] rely on classical backdoor signatures, i.e., input-trigger-induced output deviations and structural anomalies. They do not account for quantum-specific attack vectors, including parameter-transfer backdoors, noise-triggered activation, or attacks targeting error mitigation (e.g., zero-noise extrapolation). Such backdoors can preserve circuit structure and exhibit benign output distributions under standard conditions, thereby evading both output- and structure-based detection. Consequently, these methods are insufficient for identifying emerging backdoor threats unique to quantum computing.
6
Future Direction
Emerging quantum-native attacks. The evolution of backdoor attacks in VQCs is expected to progress toward increasingly quantumnative and environment-aware mechanisms. Future attacks will likely move beyond input-trigger and structural manipulation paradigms, instead exploiting deeper properties of quantum systems, including parameter landscapes, noise characteristics, compilation processes, and error mitigation procedures. In particular, adaptive backdoors that respond dynamically to hardware conditions—such as noise levels, calibration drift, qubit connectivity, and native gate sets—may enable highly selective and stealthy activation. Furthermore, as hybrid quantum–classical workflows become more integrated, attackers may target the entire computational stack, from data preprocessing and parameter optimization to compilation and execution. Such multi-stage or cross-layer attack strategies could significantly enhance robustness against transformations and make detection substantially more challenging, especially in heterogeneous and evolving NISQ environments. Toward holistic quantum-aware defenses. In response, defense mechanisms must evolve toward quantum-aware and holistic security frameworks. Future defenses should incorporate multilevel analysis, combining circuit structure inspection, parameterspace auditing, and runtime behavior monitoring under diverse hardware and noise conditions. Techniques such as randomized compilation, cross-device validation, and noise-aware testing may help expose environment-dependent backdoors that evade static analysis. In addition, formal verification and statistical certification methods could provide stronger guarantees on VQC behavior, particularly for safety-critical applications. Importantly, defenses must also consider the interaction between quantum algorithms and error mitigation techniques, as these components can themselves be exploited as attack vectors. Overall, securing VQCs requires a system-level perspective that spans the full quantum software– hardware stack, rather than relying on isolated or single-layer detection approaches.
7
Conclusion
This paper surveys backdoor attacks in VQCs and categorizes them into data-poisoning, compiler-level, and quantum-native approaches. While early methods resemble classical attacks, recent work exploits quantum-specific properties such as compilation, noise, and parameter transfer. Existing defenses remain limited and largely ineffective against quantum-native threats. Securing VQCs requires quantum-aware, system-level approaches and remains an open research challenge.
Lei Jiang and Fan Chen
Acknowledgments This work was supported in part by NSF OAC-2417589 and NSF CNS-2143120. We thank the IBM Quantum Researcher & Educators Program for their support of Quantum Credits. Any opinions, findings and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of grant agencies or their contractors.
References [1] Sounak Bhowmik, Travis S. Humble, and Himanshu Thapliyal. 2025. Quantum Properties Trojans (QuPTs) for Attacking Quantum Neural Networks. In IEEE Computer Society Annual Symposium on VLSI, Vol. 1. 1–6. [2] Marco Cerezo, Andrew Arrasmith, Ryan Babbush, Simon C Benjamin, Suguru Endo, Keisuke Fujii, Jarrod R McClean, Kosuke Mitarai, Xiao Yuan, Lukasz Cincio, and Patrick J. Coles. 2021. Variational Quantum Algorithms. Nature Reviews Physics 3, 9 (2021), 625–644. [3] Cheng Chu, Fan Chen, Philip Richerme, and Lei Jiang. 2023. Qdoor: Exploiting Approximate Synthesis for Backdoor Attacks in Quantum Neural Networks. In IEEE International Conference on Quantum Computing and Engineering, Vol. 1. 1098–1106. [4] Cheng Chu, Lei Jiang, and Fan Chen. 2025. BVQC: A backdoor-style watermarking scheme for variational quantum circuits. In IEEE International Conference on Quantum Computing and Engineering (QCE), Vol. 1. 700–708. [5] Cheng Chu, Lei Jiang, Martin Swany, and Fan Chen. 2023. Qtrojan: A Circuit Backdoor Against Quantum Neural Networks. In IEEE International Conference on Acoustics, Speech and Signal Processing. 1–5. [6] Cheng Chu, Qian Lou, Fan Chen, and Lei Jiang. 2026. QNBAD: Quantum Noiseinduced Backdoor Attacks against Zero Noise Extrapolation. In Network and Distributed System Security (NDSS) Symposium. [7] Subrata Das and Swaroop Ghosh. 2024. Trojan attacks on variational quantum circuits and countermeasures. In IEEE International Symposium on Quality Electronic Design. 1–8. [8] Ji Guo, Wenbo Jiang, Rui Zhang, Wenshu Fan, Jiachen Li, Guoming Lu, and Hongwei Li. 2025. Backdoor attacks against Hybrid Classical-Quantum Neural Networks. Neural Networks 191 (2025), 107776. [9] Seenivasan Hariharan, Sachin Kinge, and Lucas Visscher. 2024. Modeling Heterogeneous Catalysis using Quantum Computers: An Academic and Industry Perspective. Journal of chemical information and modeling 65, 2 (2024), 472–511. [10] William J Huggins, Jarrod R McClean, Nicholas C Rubin, Zhang Jiang, Nathan Wiebe, K Birgitta Whaley, and Ryan Babbush. 2021. Efficient and Noise Resilient Measurements for Quantum Chemistry on Near-Term Quantum Computers. npj Quantum Information 7, 1 (2021), 23. [11] Tyson Jones, Suguru Endo, Sam McArdle, Xiao Yuan, and Simon C Benjamin. 2019. Variational Quantum Algorithms for Discovering Hamiltonian Spectra. Physical Review A 99, 6 (2019), 062304. [12] P. J. J. O’Malley, R. Babbush, I. D. Kivlichan, J. Romero, J. R. McClean, R. Barends, J. Kelly, P. Roushan, A. Tranter, N. Ding, B. Campbell, Y. Chen, Z. Chen, B. Chiaro, A. Dunsworth, A. G. Fowler, E. Jeffrey, E. Lucero, A. Megrant, J. Y. Mutus, M. Neeley, C. Neill, C. Quintana, D. Sank, A. Vainsencher, J. Wenner, T. C. White, P. V. Coveney, P. J. Love, H. Neven, A. Aspuru-Guzik, and J. M. Martinis. 2016. Scalable Quantum Simulation of Molecular Energies. Physical Review X 6 (Jul 2016), 031007. Issue 3. [13] Ruslan Shaydulin, Phillip C Lotshaw, Jeffrey Larson, James Ostrowski, and Travis S Humble. 2023. Parameter transfer for quantum approximate optimization of weighted maxcut. ACM Transactions on Quantum Computing 4, 3 (2023), 1–15. [14] Mårten Skogh, Oskar Leinonen, Phalgun Lolur, and Martin Rahm. 2023. Accelerating variational quantum eigensolver convergence using parameter transfer. Electronic Structure 5, 3 (2023), 035002. [15] Samson Wang, Enrico Fontana, Marco Cerezo, Kunal Sharma, Akira Sone, Lukasz Cincio, and Patrick J Coles. 2021. Noise-induced Barren Plateaus in Variational Quantum Algorithms. Nature communications 12, 1 (2021), 6961. [16] Shuolei Wang, Zimeng Xiao, Jinjing Shi, Heyuan Shi, Shichao Zhang, and Xuelong Li. 2025. QSentry: Backdoor Detection for Quantum Neural Networks via Measurement Clustering. arXiv preprint arXiv:2511.15376 (2025). [17] Min Yang, Xiaolong Guo, and Lei Jiang. 2024. Multi-stage watermarking for quantum circuits. In IEEE International Conference on Quantum Computing and Engineering, Vol. 1. 796–804. [18] Jiayu Zhao, Lili Yan, Dong Tan, Yan Chang, and Shibin Zhang. 2025. A blackbox backdoor attack against quantum neural networks. Quantum Science and Technology 10, 3 (2025), 035038. [19] Jiayu Zhao, Lili Yan, Dong Tan, Yan Chang, and Shibin Zhang. 2026. A Quantum State Backdoor Attack Against Quantum Neural Networks. Advanced Quantum Technologies 9, 3 (2026), e00791.