A black-box backdoor attack against quantum neural networks

Abstract Quantum neural networks (QNNs), as a novel model that combines the advantages of quantum computing and classical neural networks, are similarly vulnerable to backdoor attacks like classical neural networks. Current research on backdoor attacks against QNNs is limited by model structure or poisoning rate, resulting in poor attack performance in black-box scenarios. This paper proposes a black-box attack method that uses a quantum-classical hybrid generative model to generate transferable backdoor triggers for QNNs with unknown structures. The method generates universal adversarial perturbations as triggers based on generative models, and designs a QNN pool by utilizing the idea of ensemble models. It combines the min–max framework and non-target Kullback–Leibler divergence technique to improve the transferability of triggers to achieve a black-box attack. Experiments demonstrate that with a poisoning rate of only 5%, the attack success rate exceeds 98% for three different structured QNNs, proving the effectiveness of this backdoor attack. In addition, we also prove that the existing detection methods such as strip and spectral signatures are unable to defend against the backdoor attack proposed in this paper.