Quantum Machine Learning for Cyber-Physical Anomaly Detection in Unmanned Aerial Vehicles: A Leakage-Free Evaluation with Proxy-Audited Feature Sets
arXiv:2605.19233v1 [cs.CR] 19 May 2026
Carlos A. Durán Paredes1,2 , Javier E. León Calderón3 , Nicolás Sánchez Perea4 , German Darío Díaz5 , and Camilo Segura1,2 1
Corporation for Aerospace Initiatives, Research and Innovation (CASIRI), Popayán, Colombia 2 [email protected], [email protected] 3 Department of Electronics Engineering, Universidad Nacional de Colombia, Manizales, Colombia. [email protected] 4 Department of Electronics Engineering, Universidad del Cauca, Popayán, Colombia. [email protected] 5 Department of Physics, Universidad del Cauca, Popayán, Colombia. [email protected]
May 20, 2026
Abstract Unmanned aerial vehicles (UAVs) are cyber-physical systems whose attack surface spans networked avionics and on-board sensor fusion: a compromised GPS or battery module can mimic a benign mission segment and evade naive anomaly detectors. We present a leakage-free evaluation of quantum machine learning for UAV anomaly detection on the multi-sensor TLM:UAV benchmark [6]. Three contributions support the study. (i) A groupaware temporal protocol (B2) partitions the dataset into ten contiguous TimeUS blocks and evaluates over ten seeds, eliminating the inflation produced by random stratified splits that mix neighbouring samples. (ii) A three-mode feature audit (full/loose/strict) quantifies how much accuracy stems from instantaneous physical signals versus contextual proxies (cumulative energy, battery state, GPS trajectory). (iii) A hybrid XGBoost + Data Reuploading (DRU) classifier is benchmarked against five paired non-linear controls (raw, PCA, polynomial-2, random-RBF, and an untrained DRU map) under identical budgets. The standalone DRU does not consistently match the strongest classical baseline across seeds; however, the trained-DRU hybrid is the only model whose mean F1 macro shifts upward from full to strict (+0.05), a directional signal that the per-seed standard deviations (Table 1) prevent from being interpreted as a statistically established difference. The trainedDRU hybrid also records the lowest mean false-alarm rate under proxy-free evaluation, subject to the inter-seed variance reported in Table 1. We frame this as an incremental, reproducible quantum-enhanced hybrid benefit, and provide an open Qiskit 2.x implementation as a benchmark for cybersecurity analytics in NISQ-era aerospace systems.
Keywords: Quantum machine learning, UAV anomaly detection, cyber-physical security, data re-uploading, group-aware evaluation.
1
Introduction
UAVs sit at the intersection of two attack surfaces: a cyber layer of networked telemetry and command-and-control links, and a physical layer of sensors and actuators whose readings can be 1
poisoned, spoofed, or degraded by an adversary [1, 5, 12]. A spoofed GPS lock or a tampered IMU can drive an on-board controller to mis-classify a hostile manoeuvre as nominal, making anomaly detection a first-line cybersecurity control for autonomous aerial systems. The same telemetry exposes two methodological hazards that are under-reported: temporal data leakage when evaluation shuffles samples across neighbouring instants, and contextual proxy features (cumulative battery energy, integrated altitude, GPS position) that correlate trivially with the temporal segment in which a fault was injected. Either hazard inflates reported scores and yields detectors that fail in flight. Quantum machine learning (QML) has been proposed as a complementary tool for cybersecurity [2, 5], with quantum feature maps projecting data into Hilbert spaces where non-linear decision boundaries become more separable [3, 7]. The data re-uploading (DRU) paradigm [4] permits compact variational circuits with few parameters, attractive for embedded avionics. Yet existing QML-for-cybersecurity studies are dominated by network-intrusion benchmarks and rarely validate on cyber-physical telemetry with the protocol rigour expected from aerospace evaluation [13]. This article addresses the gap with a single guiding question: under a leakage-free protocol that explicitly audits contextual proxies, does a quantum or quantum-augmented hybrid classifier offer a measurable, defensible benefit over deterministic and random non-linear baselines for UAV anomaly detection? Contributions. (i) A group-aware temporal protocol (B2) for the multi-sensor TLM:UAV benchmark with K = 10 contiguous TimeUS blocks and 10 seeds. (ii) A three-mode proxy audit (full/loose/strict) exposing each model’s reliance on contextual signals. (iii) A paired-control hybrid analysis comparing the trained DRU augmentation against raw, PCA, polynomial-2, random-RBF and an untrained-DRU map. (iv) An open Qiskit 2.x implementation of the DRU classifier as a scikit-learn estimator [14].
Related Work Classical UAV intrusion detection has matured around supervised ensembles and recurrent networks trained on flight-log telemetry, with surveys documenting both the methodological diversity and the recurring evaluation pitfalls [13, 12]. On the quantum side, variational classifiers have been benchmarked on network-intrusion corpora such as NSL-KDD and CICIDS [5, 10], and quantum-kernel methods have shown class-separation gains in feature Hilbert spaces [3, 7]. Two gaps motivate the present study. First, cyber-physical UAV telemetry is rarely evaluated under group-aware temporal protocols, so reported scores are likely optimistic relative to inflight deployment. Second, hybrid quantum augmentations are seldom compared against paired non-linear controls (deterministic and random) of equivalent expressive budget, leaving the contribution of the variational circuit confounded with the contribution of generic feature expansion [10, 8]. We close both gaps within a single reproducible pipeline.
2
Methodology
Fig. 1 summarises the experimental pipeline as a hub-and-spoke architecture: a leakage-free preprocessing core feeds the classical, quantum, and hybrid spokes under identical evaluation conditions.
2.1
Dataset and Task Reformulation
TLM:UAV [6] bundles software-in-the-loop telemetry from twelve sensor subsystems (ATT, BARO, BAT, CTUN, MAG, MOTB, PSCD, RATE, XKF1, GPS, IMU, VIBE) with per-sample
2
Figure 1: Hub-and-spoke architecture of the experimental pipeline. The central hub implements the leakage-free preprocessing core: temporal ordering by TimeUS, K-block group-aware split, train-only scaling and balancing (RobustScaler → SMOTETomek), and mutual-information feature ranking under the three audit modes (full/loose/strict). From this hub, three model spokes are evaluated under identical seeds, splits, and budgets: (i) classical baselines (Logistic Regression, SVM-RBF, MLP, Random Forest, XGBoost), (ii) the standalone quantum DRU classifier (5 qubits, 2 layers, Rx Ry Rz encoding with ring entanglement), and (iii) the hybrid family that augments XGBoost with raw, PCA, polynomial-2, randomRBF, untrained-DRU, or trained-DRU features. The architecture is designed so that any observed difference between paradigms reflects the representation, not the evaluation harness.
labels for four anomaly types (1 GPS; 2 accelerometer; 3 engine; 4 RC) plus nominal operation (0 normal). The original Time Line Modeling (TLM) methodology anchors fault intervals from the simulated flight timeline, stretches abnormal windows to mitigate class imbalance, and explicitly removes time-related or non-universal features before model training [6]. A later multisensor study on the same UAV anomaly-detection setting further emphasises that heterogeneous sensor alignment is itself a modelling step, not a neutral preprocessing detail [16]. Fusion-table integrity audit. The Kaggle release also includes a convenience table, Fusion_Data.csv. We do not use it as the primary experimental source. A file-level integrity audit found two exact duplicate pairs in that table, ErrRP=ErrYaw and MagY=MagZ. When the same pairs were checked in the raw sensor files, they were not exact duplicates (ErrRP/ErrYaw same-ratio ≈ 0.062 and MagY/MagZ same-ratio = 0). This pattern is more consistent with a fusion/export artefact than with genuine physical redundancy in the raw logs. The same audit also found high sensitivity to row-wise random splitting, confirming that the dataset must be evaluated through temporal or group-aware partitions rather than by shuffling neighbouring samples. Consequently, our pipeline reconstructs the working table from raw sensor files instead of relying on Fusion_Data.csv. Sources are aligned on TimeUS (merge_asof for high-rate streams), naming collisions are resolved by explicit sensor-aware renames, per-sensor labels are voted into a per-row label, and tied rows are discarded. This choice makes the data-generation assumptions visible and keeps the evaluation consistent with the TLM principle that time markers and mission-specific coordinates should not be treated as direct predictors. The resulting table holds 4 817 samples and 72 numeric features after dropping zero-variance columns.
3
Figure 2: TLM:UAV anomaly classes along TimeUS. Each anomaly type is confined to one or two segments, with only three gap-defined episodes.
A temporal diagnostic (Fig. 2) reveals only three disjoint episodes defined by gaps in TimeUS, each carrying a different subset of anomaly classes. Splitting three episodes across train/validation/test under group-aware sampling leaves at least one split with a missing class, so the multiclass task is structurally infeasible. We therefore reformulate the primary task as binary anomaly detection (y = 1 if any fault is present, 0 otherwise) and retain Fault-3 (Normal vs. motor anomaly) as a secondary analysis.
2.2
B2 Group-Aware Protocol and Per-Seed Pipeline
For every seed s ∈ {0, . . . , 9} we (i) order by TimeUS, (ii) cut into K = 10 contiguous blocks, and (iii) apply a two-stage GroupShuffleSplit that assigns whole blocks (never rows) to a 70/15/15 train/validation/test partition, enforced by assertion. Across seeds the prior shift between splits varies from 0.13 to 0.72; reporting mean ± std stress-tests each model under deployment-time prior shift. Each (s, mode) pair runs an isolated pipeline: feature subset → RobustScaler (fit on train only) → SMOTETomek on the training fold → Mutual-Information ranking on the balanced training set → top-5 selection → MinMax angle scaler to [−π, π]. No transformer is fit globally; no synthetic sample reaches validation or test.
2.3
Three Feature-Audit Modes
full retains all 72 non-zero-variance features. loose drops nine accumulators and state flags (abT, EnrgTot, CurrTot, Res, BatRes, Offset, Rout, POut, YOut; 63 features). strict additionally excludes battery state, GPS/position-estimator outputs, controller setpoints, altitude/baro and motor demand; the 22 surviving features are attitude (Roll, Pitch, Yaw), body-frame rates and gyro-bias estimates, IMU accelerations and angular rates, magnetometer and vibration channels. An MI-stability audit confirms the design: in full the top-five features are all proxies (Offset, abT, CurrTot, EnrgTot, BatRes, inclusion rate 1.0); only in strict do the top-MI features become physical (Yaw, GX, MagY, GY, GZ).
2.4
Models
Classical baselines: Logistic Regression, SVM-RBF, Random Forest, MLP, and XGBoost [11], trained on the post-SMOTETomek balanced fold. DRU: 5 qubits, 2 layers, Rx Ry Rz encoding, ring entanglement, 30 trainable parameters, COBYLA optimiser, training budget |A| ≤ 400 samples per class on a balanced subset A disjoint from the hybrid set B to forbid information leak between the DRU and its XGBoost head [4, 7]. Hybrid family (six variants): XGBoost trained on Xq ∥ T (Xq ), with T ∈ {raw, PCA, Poly2 , RandomRBF, DRU-untrained, DRU-trained}. The Quantum Kernel SVM (QSVC with ZZFeatureMap) [3] is implemented but disabled by default because each fit exceeds 40 min on the per-seed test fold.
4
Figure 3: F1 macro across paradigms, per feature mode. Classical models carry most of their performance from contextual proxies and degrade visibly from full to strict; the trained-DRU hybrid (rightmost) is the only model that improves under strict.
Figure 4: ROC AUC across paradigms. Random Forest is the most proxy-robust classical baseline; the standalone DRU is competitive in full (0.76) but degrades sharply, indicating that its raw representation still benefits from contextual signals.
Figure 5: False-alarm rate (FAR) on the normal class across paradigms. Under strict, the trained-DRU hybrid attains the lowest FAR (0.451), a key operational metric for an intrusion-style detector.
3
Results
3.1
Headline Comparison
Table 1 reports mean ± std across ten seeds for the full and strict modes (loose omitted for space; see supplementary material). Figs. 3, 4, and 5 render the same data as cross-paradigm bar charts for the three operationally relevant metrics.
3.2
Degradation Profile and Hybrid Controls
Most classical models degrade from full to strict: ∆F1 ranges from −0.14 (Logistic) to −0.02 (Random Forest). The standalone DRU also degrades (∆F1= −0.06, ∆AUC= −0.20): its raw representation is not itself proxy-free, since the top-MI angles still encode contextual signals. Random Forest shows the highest mean ROC AUC under strict and the smallest degradation slope among classical models. 5
Table 1: TLM:UAV binary task under B2 (mean ± std, 10 seeds). Best per column in bold; trained-DRU hybrid highlighted. F1 macro Paradigm Model
full
strict
ROC AUC full
strict
FAR (normal) ↓ full
strict
Classical Classical Classical Classical Classical
Logistic Reg. MLP Random Forest SVM-RBF XGBoost
0.650±0.17 0.641±0.16 0.564±0.13 0.577±0.18 0.521±0.14
0.506±0.14 0.528±0.14 0.545±0.15 0.462±0.20 0.524±0.13
0.655±0.30 0.551±0.15 0.693±0.29 0.619±0.31 0.787±0.18 0.731±0.11 0.670±0.20 0.581±0.19 0.669±0.16 0.669±0.15
0.433±0.29 0.405±0.34 0.454±0.36 0.520±0.33 0.455±0.36
0.520±0.3 0.507±0.3 0.480±0.3 0.553±0.4 0.513±0.3
Quantum
DRU-Binary
0.568±0.22
0.510±0.20
0.757±0.26
0.557±0.27
0.380±0.36
0.509±0.1
Hybrid Hybrid Hybrid Hybrid Hybrid Hybrid
XGB-raw XGB-PCA XGB-Poly2 XGB-RandomRBF XGB-DRU-untrained XGB-DRU-trained
0.345±0.10 0.368±0.07 0.404±0.14 0.498±0.18 0.345±0.14 0.509±0.22
0.523±0.15 0.532±0.19 0.531±0.15 0.509±0.14 0.540±0.16 0.561±0.14
0.453±0.19 0.616±0.21 0.626±0.20 0.801±0.16 0.533±0.22 0.751±0.22
0.558±0.22 0.603±0.23 0.673±0.16 0.564±0.22 0.566±0.23 0.613±0.17
0.597±0.44 0.619±0.45 0.535±0.42 0.570±0.39 0.617±0.45 0.504±0.34
0.530±0.3 0.455±0.3 0.522±0.3 0.510±0.3 0.487±0.3 0.451±0.
B2 protocol: K = 10 TimeUS blocks, 10 seeds, binary task. full: 72 features; strict: 22 physical features (Sec. 2.3).
Figure 6: DRU degradation from full to strict. The slope on F1 macro is −0.06; on MCC it is −0.24. The DRU’s MI-selected angles still encode part of the contextual proxies, motivating the hybrid augmentation.
Fig. 6 plots the DRU degradation slope explicitly: F1 falls from 0.57 ± 0.22 in full to 0.51±0.20 in strict (slope −0.06), while MCC degrades by 0.24. Raw quantum representations alone therefore do not survive aggressive proxy removal, but they retain enough discriminative geometry to be useful as a feature provider for a downstream tree ensemble. A cybersecurity-relevant finding lies in Fig. 7. In every feature mode the trained-DRU hybrid shows a higher mean F1 macro than three of the five paired controls (PCA, Poly2 , and random-RBF), with mean differences in the range 0.02–0.05 and overlapping standard deviations (Table 1), and is the only model whose F1 rises in strict (+0.05, from 0.509 to 0.561). It also records the lowest mean FAR among all models in strict (0.451 ± 0.27); the large standard deviation reflects inter-seed prior shift variability and prevents a conclusive ranking. FAR remains a key operational metric for an intrusion-style detector. The untrained-DRU map does not reproduce this behaviour, so the directional difference between trained and untrained DRU maps is consistent with a contribution from the variational parameters, though overlapping standard deviations prevent a strong causal attribution [10].
6
Figure 7: Hybrid XGBoost variants under the three feature modes. The trained-DRU variant (last bar of each panel) is the only one whose balanced accuracy stays competitive across modes; PCA, Poly2 , and random-RBF behave similarly to one another, suggesting that the trained DRU contributes information not present in deterministic or random non-linear expansions.
3.3
Fault-3 Secondary Task
Of the four anomaly classes only Anomaly-Motor (label 3) is evaluable in isolation under group-aware splitting because its samples span multiple temporal blocks. With K = 20 blocks and XGBoost, full/loose attain F1 = 0.93 / Bal.Acc = 0.96 (proxy dominated); under strict the task collapses to Bal.Acc = 0.50, F1 = 0.43, mirroring the binary finding. This is itself a cybersecurity-relevant result: removing context-laden telemetry can leave a defender unable to distinguish a motor anomaly from a benign manoeuvre, exposing a single-point-of-failure in the feature pipeline.
4
Discussion
The picture is more nuanced than the binary ‘quantum advantage / no advantage’ framing common in QML papers. The standalone DRU does not consistently match the strongest classical baseline across seeds or modes, and Random Forest shows the highest mean ROC AUC under strict. However, the trained-DRU hybrid shows higher mean strict F1 than three of the five paired controls (PCA, Poly2 , and random-RBF) and the lowest mean FAR in that mode. We interpret this as a directional signal consistent with an incremental quantum-enhanced hybrid benefit, pending confirmation under a larger or more episodically diverse dataset and formal significance testing on a metric central to aerospace operations: the false-alarm rate when the model is forced to work from physical signal rather than contextual proxies. False alarms drive operator desensitisation, and proxy-dependent detectors lose effectiveness the moment a vehicle is flown in a regime not represented in training [13]. Read only in full, several classical models reach F1 ≈ 0.65 and the DRU’s ROC AUC of 0.76 superficially looks like quantum-advantage evidence. The three-mode audit shows that those classical models drop by 0.10–0.14 F1 once cumulative and state features are removed, that the DRU drops by 0.06 F1 and 0.20 AUC, and that the only model whose F1 improves is the trained-DRU hybrid. The audit is the mechanism that separates a detector which has learned a fault signature from one that has memorised the mission segment in which the fault was injected: the AI-for-cybersecurity equivalent of learning the threat versus learning the test harness. The fusion-table audit is central to this interpretation. Had the released Fusion_Data.csv table been used without inspection, the duplicated feature pairs and row-wise temporal mixing would have made the benchmark appear substantially cleaner than it is. Reconstructing the table from raw logs does not merely change implementation details; it changes the scientific question from “can a classifier exploit a convenient fused table?” to “can a representation generalise under audited sensor fusion, proxy removal, and group-aware temporal evaluation?”
7
Statistical scope of the reported differences. All comparisons are reported as mean ± standard deviation over ten seeds, using the same dataset partition for all paradigms to ensure a fair comparison. Relative uncertainties range from 15% to 95% of the point estimate (Table 1). This variability is structural: the B2 protocol exposes each seed to a prior shift between 0.13 and 0.72, and the three disjoint temporal episodes of TLM:UAV produce train/test distributions that differ substantially across seeds. Classical models with no quantum budget constraint show comparable variance in FAR (79–84%), confirming that the source is the evaluation design rather than any paradigm-specific limitation. Under these conditions, observed mean differences between models (typically 0.02–0.05 F1) are smaller than or comparable to within-model standard deviations, and no formal null-hypothesis test has been applied. Results should therefore be read as directional trends. Future work requires either additional independent temporal episodes to widen the effective evaluation window, or a formal paired significance test across seeds. Limitations. (i) The three-episode footprint of TLM:UAV makes multiclass evaluation structurally infeasible under group-aware sampling; a dataset extension with independent episodes per anomaly class is the logical next step. (ii) The released Fusion_Data.csv table contains duplicated feature pairs not present as exact duplicates in the raw logs, so our results should be read as applying to the audited raw-reconstructed table, not to the convenience fusion file. (iii) All DRU results are state-vector simulations; NISQ hardware would add a 5–8% F1 degradation reported in the literature [9], partially absorbed by the hybrid head. (iv) The kernel-SVM quantum baseline is implemented but disabled by default for runtime reasons; sub-sampled or trainable quantum kernels [8] are needed for a fair 10-seed comparison.
5
Conclusion
Under a leakage-free, proxy-audited protocol, a standalone DRU classifier does not consistently match the best classical baseline across seeds for UAV anomaly detection on TLM:UAV. The trained-DRU hybrid is, however, the only model whose F1 macro improves from full to strict mode and whose FAR is lowest under proxy-free evaluation, and it shows higher mean performance than three of the five paired controls (PCA, Poly2 , and random-RBF) and the untrained-DRU map across the metrics examined, with differences that are directionally consistent across seeds but whose magnitude falls within the inter-seed standard deviation. The combination of the B2 group-aware protocol, the three-mode feature audit, and the paired-control hybrid analysis defines a reproducible evaluation template for cyber-physical telemetry benchmarks in aerospace.
Code, Data, and Reproducibility Resources All material needed to reproduce this study is openly distributed across two companion repositories. The Qiskit 2.x scikit-learn-compatible implementation of the Data Re-uploading (DRU) classifier (circuit, training loop, and unit tests) is hosted at https://github.com/Carlosandp/ qiskit-data-reuploading [14]. The end-to-end experimental pipeline that integrates this classifier into the leakage-free B2 protocol is available at https://github.com/Carlosandp/ TLM-UAV-Quantum-Anomaly-Detection [15]. It includes the main notebook (TLM_DRU_FINAL.ipynb), aggregated CSV results, the proxy-audit report, and the figures reproduced in this article. Both repositories are released under permissive scientific licenses and include requirements.txt, CITATION.cff, and step-by-step reproducibility notes.
8
Acknowledgments The authors thank the Corporation for Aerospace Initiatives, Research and Innovation (CASIRI) for providing the workspace, computational resources, and institutional support that made the development of this research possible.
References [1] ENISA, “Cybersecurity in aviation,” ENISA Threat Landscape, 2021. [Online]. https: //www.enisa.europa.eu [2] J. Biamonte et al., “Quantum machine learning,” Nature, vol. 549, pp. 195–202, 2017. https://doi.org/10.1038/nature23474 [3] V. Havlíček et al., “Supervised learning with quantum-enhanced feature spaces,” Nature, vol. 567, pp. 209–212, 2019. https://doi.org/10.1038/s41586-019-0980-2 [4] A. Pérez-Salinas et al., “Data re-uploading for a universal quantum classifier,” Quantum, vol. 4, p. 226, 2020. https://doi.org/10.22331/q-2020-02-06-226 [5] M. Kalinin and V. Krundyshev, “Security intrusion detection using quantum machine learning techniques,” J. Comput. Virol. Hacking Tech., vol. 19, pp. 125–136, 2023. https: //doi.org/10.1007/s11416-022-00435-0 [6] T. Yang, Y. Lu, H. Deng, J. Chen, and X. Tang, “Acquisition and processing of UAV fault data based on time line modeling method,” Applied Sciences, vol. 13, no. 7, p. 4301, 2023. https://doi.org/10.3390/app13074301 [7] M. Schuld and N. Killoran, “Quantum machine learning in feature Hilbert spaces,” Phys. Rev. Lett., vol. 122, p. 040504, 2019. https://doi.org/10.1103/PhysRevLett.122.040504 [8] M. Schuld and F. Petruccione, Machine Learning with Quantum Computers, 2nd ed. Springer, 2021. https://doi.org/10.1007/978-3-030-83098-4 [9] W. Ren et al., “Experimental quantum adversarial learning with programmable superconducting qubits,” Nat. Comput. Sci., vol. 2, pp. 711–717, 2022. https://doi.org/10.1038/ s43588-022-00351-9 [10] A. Abbas et al., “The power of quantum neural networks,” Nat. Comput. Sci., vol. 1, pp. 403–409, 2021. https://doi.org/10.1038/s43588-021-00084-1 [11] T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” Proc. ACM KDD, pp. 785–794, 2016. https://doi.org/10.1145/2939672.2939785 [12] H. Sedjelmaci, S. M. Senouci, and N. Ansari, “Intrusion detection and ejection framework against lethal attacks in UAV-aided networks: A Bayesian game-theoretic methodology,” IEEE Trans. Intell. Transp. Syst., vol. 18, no. 5, pp. 1143–1153, 2017. https://doi.org/ 10.1109/TITS.2016.2600370 [13] G. Choudhary, V. Sharma, I. You, K. Yim, R. Chen, and J. H. Cho, “Intrusion detection systems for networked unmanned aerial vehicles: A survey,” IEEE Internet Things J., vol. 7, no. 7, pp. 6047–6064, 2020. https://doi.org/10.1109/JIOT.2020.2973140 [14] C. A. Durán Paredes, “qiskit-data-reuploading: a scikit-learn compatible data re-uploading classifier for Qiskit 2.x,” GitHub, 2025. [Online]. https://github.com/Carlosandp/ qiskit-data-reuploading 9
[15] C. A. Durán Paredes, J. E. León Calderón, N. Sánchez Perea, G. D. Díaz, and C. Segura, “TLM-UAV-Quantum-Anomaly-Detection: reproducible pipeline, notebooks, results, and figures,” GitHub, 2026. [Online]. https://github.com/Carlosandp/ TLM-UAV-Quantum-Anomaly-Detection [16] H. Deng, Y. Lu, T. Yang, Z. Liu, and J. Chen, “Unmanned aerial vehicles anomaly detection model based on sensor information fusion and hybrid multimodal neural network,” Eng. Appl. Artif. Intell., vol. 132, p. 107961, 2024. https://doi.org/10.1016/j.engappai. 2024.107961
10