VQC-ZTI: Variational Quantum Control for Zero Trust Protection of the Tactile Internet

arXiv:2608.18572v1 [cs.CR] 19 Aug 2026

VQC–ZTI: Variational Quantum Control for Zero Trust Protection of the Tactile Internet 1st Mubassir Serneabat Sudipto

2nd Shakil Ahmed

3rd Ashfaq Khokhar

Electrical and Computer Engineering Iowa State University Ames, Iowa, USA msudipto@iastate.edu

Computer Science, College of Computing Grand Valley State University Allendale, Michigan, USA ahmeshak@gvsu.edu

Carl R. Ice College of Engineering Kansas State University Manhattan, Kansas, USA akhokhar@k-state.edu

Abstract—Tactile Internet services couple cyber events directly to physical actuation, so security decisions must improve risk discrimination without perturbing the control path. This paper presents VQC–ZTI, a split-plane Variational Quantum Classifier framework for zero-trust protection of Tactile Internet services, in which an off-path VQC analyzes encrypted-flow telemetry while an on-path policy engine applies cached deterministic grant, restrict, step-up, and deny actions. By decoupling anomaly scoring from enforcement, VQC–ZTI preserves predictable control behavior and allows detector sensitivity and policy aggressiveness to be tuned independently. We evaluate the framework on CESNET-derived aggregated traffic using random, entity-group, and temporal holdouts with a hybrid PyTorch–PennyLane implementation. The full-hybrid Quantum Neural Network achieves mean areas under the receiver operating characteristic curve of 0.9981, 0.9974, and 0.9941 and reduces the false-positive rate relative to ExtraTrees by 44.6%, 49.6%, and 67.9%, respectively. A representative component-timing decomposition further illustrates that batched VQC scoring remains in the asynchronous evidence path rather than the immediate enforcement path.

I. I NTRODUCTION

The Tactile Internet (TI) extends communication to real-time sensing, actuation, teleoperation, and haptic interaction [1]– [3]. By coupling network decisions with physical behavior, TI services impose stringent latency, reliability, and controlstability requirements [4], [5]. Encrypted traffic, changing endpoints, multi-slice operation, and resource-constrained gateways also shift security monitoring toward payload-independent flow aggregates and adaptive behavioral baselines [6], [7]. The challenge is therefore to use uncertain security evidence without disrupting latency-critical control. Zero Trust (ZT) addresses this challenge through continuous verification, least privilege, and micro-segmentation [8], [9]. However, directly translating every detector output into an access-control action may cause unnecessary authentication, restrictions, denials, and policy churn. TI-oriented ZT must therefore support informative security analysis while preserving lightweight, deterministic enforcement. Variational Quantum Circuits (VQCs) and Quantum Neural Networks (QNNs) provide compact differentiable models for structured classical data [10]–[13]. In VQC–ZTI, classical encrypted-flow features are encoded through parameterized rotations, while entangling gates model correlations in the quantum representation. This does not imply that the traffic contains inherent quantum correlations or that

the model achieves quantum advantage. The implementation instead uses noiseless analytic simulation as a hybrid quantum– classical evidence model. This paper presents VQC–ZTI, a split-plane architecture that performs hybrid VQC anomaly scoring on mirrored telemetry outside the latency-critical path. In parallel, Policy Enforcement Points (PEPs) apply cached deterministic actions on-path. A Policy Decision Point (PDP) combines anomaly evidence with contextual risk to select grant, restrict, step-up, or deny actions. Separate detector and policy thresholds allow anomaly sensitivity and enforcement aggressiveness to be calibrated independently. Unlike earlier QNN-enhanced ZT work for broader nextgeneration networks [14], VQC–ZTI focuses on TI operation and evaluates its evidence model under random, entity-group, and temporal holdouts. The main contributions are: • Split-plane VQC–ZTI architecture: An off-path hybrid VQC performs anomaly scoring, while PEPs provide deterministic cached enforcement on the latency-critical path. • Decoupled detection and policy control: Separate detector and policy thresholds enable independent calibration of anomaly sensitivity and enforcement aggressiveness without placing probabilistic inference in the actuation loop. • TI-oriented empirical evaluation: A hybrid PyTorch– PennyLane model is evaluated on 4,875 CESNET-derived encrypted-flow records under random, entity-group, and temporal holdouts and compared with classical baselines and quantum-model ablations. Quantile-derived labels are treated as statistical anomalies rather than verified intrusions. Section II presents the system model, architecture, and risk logic; Section III describes the QNN solution; Section IV reports the evaluation; and Section V concludes the paper. II. P ROPOSED S YSTEM F RAMEWORK VQC–ZTI is a split-plane framework for zero-trust (ZT) protection of Tactile Internet (TI) services. It improves anomalyevidence generation without placing probabilistic quantum inference in the latency-critical control path. The evidence plane asynchronously processes mirrored encrypted-flow telemetry through feature preparation, quantum encoding, VQC inference, classical post-processing, risk fusion, and policy computation. The enforcement plane contains Policy Enforcement Points

(PEPs) that apply locally cached deterministic policies. Thus, delayed scoring may postpone a future policy update but does not delay the current control or actuation decision. A. ZT–TI System Model We model the ZT-enabled TI environment as a directed graph G = (V, E),

(1)

where V represents users, devices, gateways, services, controllers, and enforcement entities, and E represents their communication and control links. The security-enabled subgraph is GQ = (V Q , E Q ), V Q ⊆ V, E Q ⊆ E, (2)

B. Split-Plane Latency Model Let BTI denote the maximum latency budget for a critical TI transaction. Because VQC scoring and policy computation occur asynchronously, the transaction latency is Tcrit = Tcomm + TPEP + Tservice ,

where the terms denote communication, cached-policy lookup and enforcement, and protected-service processing delays, respectively. The critical path must satisfy Tcrit ≤ BTI .

(4)

The asynchronous evidence latency is modeled separately as Tevid = Tfeat + Tenc + TVQC + Thead + TPDP + Tdist ,

Q

where V contains entities supporting telemetry collection, off-path scoring, risk computation, policy distribution, or enforcement, and E Q contains the corresponding signaling and mirrored-telemetry links. The framework operates through two logically separated planes. In the evidence plane, encryptedflow statistics are mirrored without payload inspection and processed by the hybrid VQC to produce anomaly scores. The Policy Decision Point (PDP) combines these scores with identity, device, and segment context and distributes the resulting policies to the appropriate PEPs. In the enforcement plane, each PEP performs a deterministic lookup against its cached policy and immediately applies the selected action. Fig. 1 illustrates

(3)

(5)

where the terms represent feature preparation, quantum encoding, VQC execution, classical-head inference, PDP computation, and policy distribution. Because this processing is offpath, Tevid is not added to Tcrit ; instead, it determines how quickly telemetry can update a cached policy. For a maximum policy-update interval Tfresh , Tevid ≤ Tfresh .

(6)

This freshness condition differs from the per-transaction requirement in (4). Its value depends on the monitoring interval, application requirements, and deployment policy. C. Quantum Score Generation and Risk Fusion

Remote Application

Client Application Quantum-Augmented IDS

Feature Extraction

Calibration

Flow features

Data / Haptic Plane VQC / QNN (θ_q, S_r)

Early Exit Error Mitigation and Fallback Telemetry Cache

Data / Haptic Plane

Variational Scoring

Feature Cache + Segment EWMA A_j^{(t)}

Tactile Internet Fresh evidence: ŷ_i^q, A_j^{(t)} valid within horizon H Core / Latency-Critical Data Plane

Slow-timescale config updates

PEP: Branch-free Match-Action

(θ_q, γ^q, τ, paths)

Segment Policies P'(S_j)

Segment policy deltas (versioned, TTL)

PDP: Risk Fusion R^q(u,d), P'(S_j)

Mirrored telemetry

Off-path Scoring / Monitoring Plane

For each flow i, the evidence plane derives a payloadindependent feature vector xi ∈ RF ,

where F denotes the number of input features; in the evaluated implementation, F = 12. The hybrid model produces

On-path ZT Enforcement Plane

Data

ŷiq = Mq (xi ; θ q ) ,

Control

Fig. 1. Split-plane VQC–ZTI architecture with off-path evidence generation and on-path deterministic enforcement.

the separation between the evidence and enforcement planes. In the off-path evidence plane, the VQC mirrors and processes encrypted-flow telemetry to generate anomaly scores. These scores are combined with identity, device, and micro-segment context through risk fusion, after which the PDP computes and distributes updated policies to the relevant PEPs. In the on-path enforcement plane, each PEP performs a lightweight lookup of its locally cached policy and immediately applies the corresponding action grant, restrict, step-up, or deny before the request reaches the protected TI service. Thus, mirrored telemetry influences subsequent policy updates, while VQC inference remains outside the current request path and does not add quantum-processing delay to the immediate enforcement decision.

(7)

(8)

where Mq is the hybrid quantum–classical model, θ q contains its trainable parameters, ŷiq ∈ [0, 1] is the anomaly score. This score indicates evidence of a statistical anomaly under the evaluated labeling procedure, not a calibrated probability of malicious activity. A detector threshold γ q produces a binary indication: ŷiq > γ q ⇒ fi is flagged as anomalous, ŷiq ≤ γ q ⇒ fi is treated as normal,

(9)

where fi denotes the observed flow and γ q ∈ [0, 1] is the detector threshold. The threshold controls detector sensitivity but does not directly determine enforcement. At the microsegment level, VQC–ZTI maintains an Exponentially Weighted Moving Average (EWMA) posture score: (t)

(t−1)

Aj = (1 − α)Aj X 1 1 [ŷiq > γ q ] , + α (t) |Fj | (t) i∈Fj

(10)

(t)

where α ∈ (0, 1] is the smoothing factor, Fj is the set of flows observed in segment j during interval t, and 1[·] is the indicator function. This aggregation limits the influence of isolated variations, while allowing persistent anomalies to affect (t) the segment’s posture. The posture score satisfies Aj ∈ [0, 1] (0) (t) and is initialized as Aj = 0. If Fj = ∅, the previous (t−1) (t) , avoiding division by zero. score is retained, i.e., Aj = Aj The PDP combines the model output with identity, device, and segment context:   (t) Rq (u, d) = Fq cu , cd , xi , ŷiq , Aj , (11) where Rq (u, d) ∈ [0, 1] is the contextual risk score for user u and device d, cu and cd represent their context, and Fq is the risk-fusion function. Here, flow i is associated with user u, device d, and micro-segment j. This policy-oriented score is not interpreted as a calibrated probability of malicious activity. D. Risk-Adaptive Policy Enforcement The detector threshold γ q determines whether evidence is reported as anomalous, whereas the ordered policy thresholds τ = (τ1 , τ2 , τ3 ),

0 ≤ τ1 < τ2 < τ3 ≤ 1,

map fused risk to an enforcement action:  grant, Rq < τ1 ,    restrict, τ ≤ Rq < τ , 1 2 π(Rq ) = q  step-up, τ2 ≤ R < τ3 ,    deny, Rq ≥ τ3 .

(12)

mechanisms in Section II; VQC inference remains outside the immediate enforcement path. Hereafter, QNN denotes the complete hybrid architecture, whereas the VQC denotes its parameterized quantum layer. A. Feature Preparation and Classical Embedding Let the processed dataset be N

D = {(xi , yi )}i=1 ,

xi ∈ R12 ,

yi ∈ {0, 1},

(14)

where N = 4,875, xi contains 12 payload-independent features derived from CESNET encrypted-traffic aggregates, and yi is a quantile-derived statistical-anomaly label rather than a verified attack annotation. Robust feature scaling and quantile-derived statistical labeling are performed during dataset preprocessing before construction of the evaluation holdouts. The resulting processed features are subsequently partitioned according to the random, entity-group, and temporal evaluation protocols. The processed vector is then mapped by zi ∈ R12 ,

zi = femb (xi ; ϕ) ,

(15)

where femb (·) is the trainable classical embedder with parameters ϕ. It produces one input per qubit; variants without the embedder encode the processed features directly. (13)

where π(·) denotes the PDP policy-mapping function. Grant permits the requested operation; restrict reduces privileges or tightens micro-segmentation; step-up requires additional verification; and deny blocks the request. Separating γ q from τ allows detector sensitivity and enforcement aggressiveness to be tuned independently, preventing every indication from triggering a disruptive response. The PDP distributes each updated policy to the relevant PEP, which applies the cached action to subsequent requests. If the evidence plane becomes temporarily unavailable, enforcement continues using the most recent valid policy according to configured expiration and fail-safe rules. The quantum backend is therefore not a hard dependency of immediate TI transactions. This work focuses on hybrid anomaly-evidence generation, contextual risk fusion, and ZT enforcement. Quantum-network routing, entanglement provisioning, secure-capacity optimization, and reinforcementlearning-based resource allocation are outside the scope of the reported evaluation. III. P ROPOSED QNN-BASED S OLUTION A PPROACH The VQC–ZTI evidence plane uses a hybrid quantum– classical model to convert payload-independent encrypted-flow statistics into continuous anomaly scores. Its pipeline comprises feature preprocessing, classical embedding, angle encoding, a shallow variational quantum circuit (VQC), and a classical classification head trained end-to-end using PyTorch and PennyLane. The resulting score feeds the risk-fusion and policy

B. Quantum Feature Encoding The VQC uses nq = 12 qubits initialized in the all-zero state: ⊗nq

|ψ0 ⟩ = |0⟩

,

(16)

where ⊗ denotes the tensor product and nq is the number of qubits. Each embedded feature is then encoded as a single-qubit rotation: nq O Ry (zi,k ) , (17) Uenc (zi ) = k=1

where zi,k denotes the kth component of the embedded feature vector zi , and Ry (·) denotes a rotation about the Pauli-Y axis. The rotation is defined as   ϑ (18) Ry (ϑ) = exp −i Y , 2 √ where i = −1, ϑ is the rotation angle, and Y is the Pauli-Y operator. Applying the encoding operation to the initial state gives |ψenc (zi )⟩ = Uenc (zi ) |ψ0 ⟩ ,

(19)

where |ψenc (zi )⟩ denotes the quantum state encoding record i. This mapping represents classical features through quantumstate rotations; it does not imply intrinsic quantum properties in the traffic.

C. Variational Quantum Circuit The circuit applies a shallow ansatz with L = 2 variational layers, each containing trainable single-qubit rotations and nearest-neighbor entangling operations: UVQC (θ) =

L Y

  (ℓ) (ℓ) Uent Urot θ (ℓ) ,

L = 2,

(20)

ℓ=1

where θ contains the trainable circuit parameters. In layer ℓ, (ℓ) Urot applies a three-parameter single-qubit rotation to each (ℓ) qubit, while Uent applies CNOT gates between consecutive qubits, i.e., 1 → 2, 2 → 3, . . . , (nq − 1) → nq . The resulting state is |ψi (θ)⟩ = UVQC (θ) Uenc (zi ) |ψ0 ⟩ . (21) For the binary task, the quantum layer returns Pauli-Z expectation values from two output qubits: mi,k = ⟨ψi (θ)|Zk |ψi (θ)⟩ ,

k = 1, 2,

(22)

where Zk denotes the Pauli-Z operator acting on output qubit k. The quantum-output vector is therefore T

2

mi = [mi,1 , mi,2 ] ∈ [−1, 1] .

(23)

The shallow design limits simulation cost and supports future evaluation under finite-shot and noisy quantum settings. However, the present experiments use noiseless analytic expectation values and exclude finite-shot uncertainty, hardware noise, connectivity, transpilation, and queueing effects. D. Classical Classification Head

si ∈ R2 ,

(24)

where ω denotes the head parameters. The corresponding class probabilities are exp(si,c ) , pi,c = P1 r=0 exp(si,r )

F. Hybrid Model Ablations Five configurations evaluate the hybrid components: full_hybrid uses the complete embedder, two-layer VQC, and classification head; no_head removes the full head; shallow_embedder reduces the embedder; no_embedder directly encodes the processed features; and pqc_only uses a restricted PQC without the complete embedding/head structure. These ablations assess component contributions under the same simulated setting without implying quantum computational advantage. IV. P ERFORMANCE E VALUATION We evaluate VQC–ZTI using CESNET-derived aggregated backbone-traffic records and a hybrid PyTorch–PennyLane implementation [15]. The full-hybrid QNN is compared with classical baselines and model ablations under random, entitygroup, and temporal holdouts. We also examine the implications for zero-trust enforcement and interpret the prototype’s timing within the split-plane architecture. A. Dataset, Labeling, and Experimental Setup

In the full-hybrid model, the quantum-output vector passes through a trainable classical head to produce two class logits: si = fhead (mi ; ω) ,

VQC, and classification-headparameters are jointly optimized with respect to LNLL . The PennyLane quantum node is integrated with the PyTorch computational graph, enabling gradients through all three components. Training uses a learning rate of 2 × 10−3 , mini-batches of 32, 20 epochs, and random seeds 42–46. Because circuit outputs use analytic expectation values, the results describe a noiseless simulated hybrid model and exclude shot noise.

c ∈ {0, 1}.

(25)

For binary evaluation, the anomaly score is the probability assigned to class 1: ŷiq = pi,1 , (26) where class 0 denotes the normative class and class 1 denotes the combined suspicious/high-anomaly class. This score feeds (9) and the risk-fusion process and is not interpreted as a calibrated probability of malicious activity.

The evaluation uses CESNET-derived aggregated flow records [16]. The retained payload-independent attributes include packet and byte counts, destination diversity, ratios, average flow duration, and average time-to-live. After validation, missing-value filtering, and feature preparation, the dataset contains N = 4,875, F = 12, (28) where N and F denote the number of records and features, respectively. For each record i, the anomaly statistic ai is defined as the Euclidean norm of its robust-scaled feature vector: xi,k − medk , (29) ai = ∥e xi ∥2 , x ei,k = IQRk

For a mini-batch B, training uses a class-weighted negative log-likelihood objective: 1 X wyi log pi,yi , (27) LNLL = − |B| i∈B

where medk and IQRk denote the median and inter-quartile range of feature k, respectively. The configured statisticalanomaly thresholds use the 0.85 and 0.95 empirical quantiles of {ai } to distinguish normative, suspicious, and high-anomaly records. The corresponding empirical boundaries over the processed dataset are
bsusp = Q0.85 {ai }N i=1 ,
(30) bhigh = Q0.95 {ai }N i=1 .

where wyi denotes the inverse-frequency class weight associated with label yi . The class weights are computed from the training partition and normalized to unit mean. The embedder,

Here, Qp (·) denotes the empirical p-quantile. Records satisfying ai < bsusp are labeled normative, those satisfying bsusp ≤ ai < bhigh are labeled suspicious, and those satisfying

E. End-to-End Training

ai ≥ bhigh are labeled high-anomaly. For binary benchmarking, the latter two tiers are combined: ( 0, normative record, (31) yi = 1, suspicious or high-anomaly record.

architecture; therefore, favorable comparisons do not demonstrate quantum advantage. As shown in Table I, the QNN achieves the highest mean AUC and accuracy and the lowest mean FPR under all protocols. ExtraTrees is the strongest

These pseudo-labels provide a controlled statistical benchmark rather than verified attack annotations. Accordingly, the reported false-positive rate measures disagreement with the quantile-derived normative class rather than false alarms against verified ground truth. The labeling quantiles, detector threshold γ q , and policy thresholds τ have distinct roles: the quantiles construct experimental labels, γ q converts anomaly scores into detector decisions, and τ maps fused risk to enforcement actions. We use three holdout protocols: 1) random stratified: 3,900 training and 975 evaluation records, preserving the binary-label distribution; 2) entity-group: Disjoint entity groups, with 3,751–3,971 training and 904–1,124 evaluation records; and 3) temporal: 3,887 earlier records for training and 988 later records for evaluation. The processed features and labels are used consistently across protocols; model fitting uses only training records, and performance is reported on the corresponding holdout. Each 12-qubit, two-layer QNN is trained for 20 epochs with learning rate 2 × 10−3 , batch size 32, and seeds 42–46; results are mean ± standard deviation across five runs. Analytic expectation values exclude finite-shot and physical-device noise. The ablations are full_hybrid, no_head, shallow_embedder, no_embedder, and pqc_only. Performance is measured using AUC, accuracy, and false-positive rate (FPR):

TABLE I C ROSS - SPLIT DETECTOR PERFORMANCE .

FP . (32) FP + TN Here, FP and TN denote false-positive and true-negative predictions, respectively, relative to the quantile-derived binary labels. FPR =

B. Detector Performance Across Splits Fig. 2 shows representative full-hybrid QNN training behavior for seed 44 under the random-stratified holdout. The decreasing loss in Fig. 2(a) and stabilizing accuracy in Fig. 2(b) indicate convergence within 20 epochs. The train–evaluation gap in Fig. 2(c) does not show pronounced late-epoch divergence in this representative run. Table I provides the primary cross-seed evidence. The QNN is compared with ExtraTrees 0.40

0.00

0.8

Accuracy

Loss

0.20

TrainAcc - EvalAcc

0.30 0.25

0.6 0.4

0.15

0.05 2.5

5.0

7.5

10.0

Epoch

12.5

15.0

17.5

(a) Training and evaluation loss

20.0

0.0

0.02 0.04 0.06

0.2

0.10

Model

Group

QNN XT RF LR

0.9974 ± 0.0009 0.9762 ± 0.0028 0.0241 ± 0.0042 0.9932 ± 0.0014 0.9550 ± 0.0147 0.0479 ± 0.0191 0.9922 ± 0.0013 0.9531 ± 0.0147 0.0478 ± 0.0209 0.9525 ± 0.0075 0.8617 ± 0.0232 0.1520 ± 0.0307

AUC

Accuracy

FPR

Random

QNN XT RF LR

0.9981 ± 0.0004 0.9756 ± 0.0042 0.0270 ± 0.0050 0.9928 ± 0.0006 0.9541 ± 0.0106 0.0487 ± 0.0137 0.9919 ± 0.0007 0.9415 ± 0.0175 0.0642 ± 0.0245 0.9549 ± 0.0058 0.8802 ± 0.0132 0.1264 ± 0.0182

Time

QNN XT RF LR

0.9941 ± 0.0018 0.9747 ± 0.0044 0.0248 ± 0.0052 0.9899 ± 0.0000 0.9291 ± 0.0000 0.0774 ± 0.0000 0.9887 ± 0.0000 0.9211 ± 0.0000 0.0876 ± 0.0000 0.9399 ± 0.0000 0.8583 ± 0.0000 0.1479 ± 0.0000

classical AUC comparator. Relative to XT, the QNN reduces mean FPR from 0.0487 to 0.0270, from 0.0479 to 0.0241, and from 0.0774 to 0.0248 under the random, entity-group, and temporal holdouts, corresponding to reductions of 44.6%, 49.6%, and 67.9%, respectively. The entity-group and temporal holdouts provide evidence of statistical-anomaly generalization across unseen entity groups and chronological distribution shifts. However, they measure agreement with the constructed statistical-anomaly labels, not detection of previously unseen attacks. C. Hybrid-Architecture Ablation Table II evaluates five variants: Full Hybrid (FH), No Head (NH), Shallow Embedder (SE), No Embedder (NE), and PQConly (PQC). Fig. 3 additionally presents representative entitygroup and temporal results, while Tables I and II provide the primary cross-seed quantitative evidence. The full-hybrid TABLE II H YBRID QNN- MODEL ABLATION ACROSS EVALUATION SPLITS . Split

Variant

AUC

Accuracy

FPR

Group

FH NH SE NE PQC

0.9974 ± 0.0009 0.9762 ± 0.0028 0.0241 ± 0.0042 0.9956 ± 0.0006 0.9629 ± 0.0160 0.0395 ± 0.0218 0.9792 ± 0.0065 0.9409 ± 0.0088 0.0563 ± 0.0111 0.8693 ± 0.0194 0.8071 ± 0.0231 0.1922 ± 0.0245 0.8656 ± 0.0198 0.8160 ± 0.0252 0.1755 ± 0.0411

FH NH Random SE NE PQC

0.9981 ± 0.0004 0.9756 ± 0.0042 0.0270 ± 0.0050 0.9956 ± 0.0013 0.9582 ± 0.0068 0.0473 ± 0.0081 0.9770 ± 0.0031 0.9175 ± 0.0191 0.0869 ± 0.0258 0.8738 ± 0.0174 0.8135 ± 0.0241 0.1875 ± 0.0306 0.8675 ± 0.0209 0.8170 ± 0.0410 0.1790 ± 0.0545

FH NH SE NE PQC

0.9941 ± 0.0018 0.9747 ± 0.0044 0.0248 ± 0.0052 0.9927 ± 0.0007 0.9640 ± 0.0069 0.0371 ± 0.0088 0.9696 ± 0.0050 0.9164 ± 0.0114 0.0849 ± 0.0129 0.8931 ± 0.0081 0.8249 ± 0.0230 0.1791 ± 0.0307 0.8888 ± 0.0101 0.8553 ± 0.0185 0.1413 ± 0.0211

1.0

Train Loss Eval Loss

0.35

Split

Train Accuracy Eval Accuracy 2.5

5.0

0.08

7.5

10.0

Epoch

12.5

15.0

17.5

(b) Training and evaluation accuracy

20.0

2.5

5.0

7.5

10.0

Epoch

12.5

15.0

17.5

20.0

(c) Training and evaluation gap

Fig. 2. Representative full-hybrid QNN training behavior on the random split.

(XT), Random Forest (RF), and Logistic Regression (LR). These provide tree-ensemble and linear reference points but are not parameter- or compute-matched to the hybrid neural

Time

model performs best across all protocols. Removing the classification head causes a modest decline, whereas simplifying or

5.0

0.0

7.5 10.0 12.5 15.0 17.5 20.0

2.5

Epoch

(a) Training Loss Convergence

5.0

2.5

Epoch

(b) Training Accuracy Progression

5.0

0.0

7.5 10.0 12.5 15.0 17.5 20.0

Epoch

(c) Train-Eval Gap

0.05 AUC

AP

Acc

TPR

FPR

(d) Performance Metrics Comparison

Normal

919

25

Normal

893

51

0.4

Anomaly

0.2 QNN (AUC=0.997) Baseline (AUC=0.992) Random

0.0 0.0

0.2

0.4

0.6

False Positive Rate

0.8

1.0

(e) ROC Comparison Across Methods

400

0.0

0.2

0.4

Recall

175

200

0.6

0.8

1.0

(f) Precision-Recall Comparison

Normal

Anomaly

500 400 Anomaly

6

Normal

Predicted Class

(g) QNN Confusion Matrix

2.5

Epoch

5.0

1.0

0.8

0.8

172

300 200

0.6 0.4

7.5 10.0 12.5 15.0 17.5 20.0

Anomaly

Epoch

5.0

Predicted Class

Epoch

(h) Baseline Confusion Matrix

(a) Entity-group holdout

0.2

0.4

0.6

False Positive Rate

0.8

1.0

(e) ROC Comparison Across Methods

AUC

AP

Acc

TPR

FPR

(d) Performance Metrics Comparison 800

800 Normal

0.6

0.2

0.0

0.0

7.5 10.0 12.5 15.0 17.5 20.0

(c) Train-Eval Gap

853

26

0.2

300

0.2

0.4

Recall

107

Normal

811

68

200

Anomaly

2

107

0.6

0.8

1.0

(f) Precision-Recall Comparison

Normal

Anomaly

Normal

Anomaly

Predicted Class

(g) QNN Confusion Matrix

600 500 400 300 200 100

100

QNN (AP=0.963) Baseline (AP=0.936)

0.0

600 400

2

700

700 500

Anomaly

0.0

0.4 0.2

2.5

0.4 QNN (AUC=0.995) Baseline (AUC=0.990) Random

0.6

0.04

(b) Training Accuracy Progression

1.0

Metric Value

Gap 0.0

7.5 10.0 12.5 15.0 17.5 20.0

100

QNN (AP=0.985) Baseline (AP=0.967)

0.2

3

True Class

True Class

Precision

0.4

0.6

700 600

600

0.6

0.03 Train Eval

800

800 0.8

5.0

(a) Training Loss Convergence

1.0

0.8

True Positive Rate

2.5

0.01 0.02

0.2

0.10

True Positive Rate

1.0

0.2

0.02 7.5 10.0 12.5 15.0 17.5 20.0

0.00

0.4

True Class

2.5

0.6

QNN Baseline

0.8

True Class

0.05

Train Eval

0.25 0.20

0.4

0.02 0.01

0.30

0.6

1.0

0.03

0.8

0.35

0.15

0.01

0.2

0.10

0.01 0.00

0.4

0.15

1.0

Train Eval

0.40

Precision

0.6

Metric Value

0.20

Gap

Accuracy

0.25

QNN Baseline

0.8

0.02

0.30

Loss

1.0 0.03

0.8

0.35

Accuracy

1.0

Train Eval

0.40

Loss

0.45

Predicted Class

(h) Baseline Confusion Matrix

(b) Temporal holdout

Fig. 3. Representative full-hybrid QNN and ExtraTrees results under (a) entity-group and (b) temporal distribution shift.

removing the embedder substantially lowers AUC and accuracy and increases FPR. The PQC-only variant also performs materially worse, indicating that the reported performance depends on the complete hybrid pipeline rather than the parameterized quantum circuit alone. The representative results in Fig. 3 qualitatively reinforce the performance ordering reported in Tables I and II. D. Implications for Zero-Trust Control The detector supplies anomaly evidence to risk fusion rather than issuing access-control commands; combined with identity, device, and segment context, lower disagreement with the normative pseudo-label class may reduce unnecessary restrictions, step-up requests, or denials. However, detector metrics do not establish attack prevention, compromise containment, policy correctness, user disruption, or adversarial service availability, all of which require verified attacks or controlled injections on an implemented PDP/PEP testbed. The statistical labeling tiers, therefore, remain distinct from deployment actions determined by fused contextual risk. E. Latency and TI-Budget Interpretation Table III reports prototype-side component timings interpreted within the split-plane architecture rather than as a synchronous VQC decision path. The reported measurements cover the listed software components only; the 0.32-ms VQC scoring value represents an amortized batched measurement and does not include network communication or protectedservice processing. The 0.32-ms scoring value is an amortized TABLE III S PLIT- PLANE COMPONENT TIMINGS FOR SCORING AND ENFORCEMENT. Path

Baseline ZT

VQC–ZTI

Teval (Scoring) Asynchronous TPDP (Fusion) Tdist (Distribution)

0.85 ms 0.25 ms 0.40 ms

0.32 ms (Batched) 0.27 ms 0.38 ms

TPEP (Enforcement)

0.10 ms

0.10 ms

On-path

Component

batched measurement rather than single-flow VQC inference time. Anomaly scoring, PDP fusion, and policy distribution belong to the asynchronous update path, whereas cached PEP enforcement lies on the immediate request path. Because communication and protected-service delays were not measured,

these component timings do not establish end-to-end TI latency compliance. F. Limitations and Validity Boundaries The evaluation has four principal limitations: the labels are statistical heuristics rather than verified attack annotations; CESNET flow aggregates do not represent hardware-in-theloop tactile traffic; noiseless analytic simulation excludes finiteshot and hardware effects; and prototype component timings do not validate end-to-end TI latency. The risk-fusion function and policy thresholds are architectural constructs and were not empirically calibrated against operational access-control outcomes. Verified labels, capacity-matched neural baselines, noisy quantum execution, controlled attacks, and deploymentgrade PDP/PEP measurements are therefore required before claiming operational security effectiveness, quantum advantage, or real-time TI compliance. V. C ONCLUSIONS VQC–ZTI separates asynchronous hybrid VQC evidence generation from cached, deterministic TI enforcement. On 4,875 CESNET-derived records, the full-hybrid model achieved mean AUCs of 0.9981, 0.9974, and 0.9941 across random, entity-group, and temporal holdouts and reduced mean FPR relative to ExtraTrees by 44.6%, 49.6%, and 67.9%. Ablations show that the complete hybrid architecture, rather than the circuit alone, drives the reported performance. The results support the feasibility of simulated off-path VQC scoring as a securityevidence source; they do not establish quantum advantage, verified attack detection, hardware execution, or end-to-end TI latency compliance. Future work will use verified attack labels, matched classical neural baselines, finite-shot noisy execution, physical devices, and a hardware-in-the-loop PDP/PEP testbed with tail-latency and policy-freshness measurements. R EFERENCES [1] G. P. Fettweis, “The tactile internet: Applications and challenges,” IEEE Vehicular Technology Magazine, vol. 9, no. 1, pp. 64–70, 2014. [2] M. Maier, M. Chowdhury, B. P. Rimal, and D. P. Van, “The tactile internet: Vision, recent progress, and open challenges,” IEEE Communications Magazine, vol. 54, no. 5, pp. 138–145, 2016. [3] N. Promwongsa, A. Ebrahimzadeh, D. Naboulsi, S. Kianpisheh, F. Belqasmi, R. Glitho, N. Crespi, and O. Alfandi, “A comprehensive survey of the tactile internet: State-of-the-art and research directions,” IEEE Communications Surveys & Tutorials, vol. 23, no. 1, pp. 472–523, 2021.

[4] G. Durisi, T. Koch, and P. Popovski, “Toward massive, ultra-reliable, and low-latency wireless communication with short packets,” Proceedings of the IEEE, vol. 104, no. 9, pp. 1711–1726, 2016. [5] P. Popovski, J. J. Nielsen, C. Stefanovic, E. de Carvalho, E. Ström, K. F. Trillingsgaard, A.-S. Bana, D. M. Kim, R. Kotaba, J. Park, and R. B. Sørensen, “Wireless access for URLLC: Principles and building blocks,” IEEE Network, vol. 32, no. 2, pp. 16–23, 2018. [6] R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in Proc. IEEE Symp. Secur. Privacy, 2010, pp. 305–316. [7] M. Ring, S. Wunderlich, D. Scheuring, D. Landes, and A. Hotho, “A survey of network-based intrusion detection data sets,” Computers & Security, vol. 86, pp. 147–167, 2019. [8] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero trust architecture,” National Institute of Standards and Technology, Special Publication 800-207, 2020. [9] R. Chandramouli and Z. Butcher, “A zero trust architecture model for access control in cloud-native applications in multi-location environments,” National Institute of Standards and Technology, Special Publication 800207A, 2023. [10] J. Biamonte, P. Wittek, N. Pancotti, P. Rebentrost, N. Wiebe, and S. Lloyd, “Quantum machine learning,” Nature, vol. 549, pp. 195–202, 2017. [11] J. Preskill, “Quantum computing in the NISQ era and beyond,” Quantum, vol. 2, p. 79, 2018. [12] K. Mitarai, M. Negoro, M. Kitagawa, and K. Fujii, “Quantum circuit learning,” Physical Review A, vol. 98, no. 3, p. 032309, 2018. [13] M. Schuld, A. Bocharov, K. M. Svore, and N. Wiebe, “Circuit-centric quantum classifiers,” Physical Review A, vol. 101, no. 3, p. 032308, 2020. [14] S. Ahmed, I. F. Shihab, and A. Khokhar, “Quantum-driven zero trust architecture with dynamic anomaly detection in 7g technology: A neural network approach,” Measurement: Digitalization, vol. 2, p. 100005, 2025. [15] S. Ahmed, M. S. Sudipto, and A. Khokhar, “Vqc-zti framework: Variational quantum-classical zero-trust anomaly detection and cesnet-based security evaluation,” https://github.com/msudipto/VQC-ZTI Framework, 2026, code repository. [16] J. Koumar, K. Hynek, T. Čejka, and P. Šiška, “Cesnet-timeseries24: Time series dataset for network traffic anomaly detection and forecasting,” Scientific Data, vol. 12, no. 1, p. 338, 2025.

Related documents

• Challenge-response quantum reinforcement learning with application to quantum-assisted authentication#425892
• Optimal quantum locally differentially private mechanisms in the high-privacy regime#927326
• Quantum reality via late-time photodetection#498781
• Circuit Implementation of Discrete-Time Quantum Walks on Complex Networks#160823
• Quantum Field Self-Regulation (QFSR)#477964