QDoor: Exploiting Approximate Synthesis for Backdoor Attacks in Quantum Neural Networks

TL;DR

This paper introduces QDoor, a stealthy backdoor attack on quantum neural networks that exploits differences in unitary operations post-approximate synthesis to achieve high success rates without detection.

Contribution

QDoor is a novel backdoor attack method that remains effective after approximate synthesis and evades existing detection techniques in quantum neural networks.

Findings

QDoor improves attack success rate by 13 times over prior methods.

QDoor maintains high clean data accuracy, increasing it by 65%.

Existing detection techniques cannot identify QDoor in uncompiled QNN circuits.

Abstract

Quantum neural networks (QNNs) succeed in object recognition, natural language processing, and financial analysis. To maximize the accuracy of a QNN on a Noisy Intermediate Scale Quantum (NISQ) computer, approximate synthesis modifies the QNN circuit by reducing error-prone 2-qubit quantum gates. The success of QNNs motivates adversaries to attack QNNs via backdoors. However, na\"ively transplanting backdoors designed for classical neural networks to QNNs yields only low attack success rate, due to the noises and approximate synthesis on NISQ computers. Prior quantum circuit-based backdoors cannot selectively attack some inputs or work with all types of encoding layers of a QNN circuit. Moreover, it is easy to detect both transplanted and circuit-based backdoors in a QNN. In this paper, we propose a novel and stealthy backdoor attack, QDoor, to achieve high attack success rate in approximately-synthesized QNN circuits by weaponizing unitary differences between uncompiled QNNs and their synthesized counterparts. QDoor trains a QNN behaving normally for all inputs with and without a trigger. However, after approximate synthesis, the QNN circuit always predicts any inputs with a trigger to a predefined class while still acts normally for benign inputs. Compared to prior backdoor attacks, QDoor improves the attack success rate by $13\times$ and the clean data accuracy by $65\%$ on average. Furthermore, prior backdoor detection techniques cannot find QDoor attacks in uncompiled QNN circuits.