Quantum Neural Network Extraction Attack via Split Co-Teaching

TL;DR

This paper introduces split co-teaching, a novel attack method for quantum neural networks that leverages label variations and co-teaching schemes to improve extraction accuracy, outperforming existing methods especially in noisy environments.

Contribution

The paper proposes a new split co-teaching attack method for QNNs that addresses limitations of ensemble learning under noise and cost constraints, enhancing extraction accuracy.

Findings

Outperforms classical extraction attacks by 6.5% to 9.5%.

Outperforms existing QNN extraction methods by 0.1% to 3.7%.

Effective in noisy, real-world environments.

Abstract

Quantum Neural Networks (QNNs), now offered as QNN-as-a-Service (QNNaaS), have become key targets for model extraction attacks. Existing methods use ensemble learning to train substitute QNNs, but our analysis reveals significant limitations in real-world environments, where noise and cost constraints undermine their effectiveness. In this work, we introduce a novel attack, \textit{split co-teaching}, which uses label variations to \textit{split} queried data by noise sensitivity and employs \textit{co-teaching} schemes to enhance extraction accuracy. The experimental results show that our approach outperforms classical extraction attacks by 6.5\%$\sim$9.5\% and existing QNN extraction methods by 0.1\%$\sim$3.7\% across various tasks.