STIQ: Safeguarding Training and Inferencing of Quantum Neural Networks from Untrusted Cloud

The high costs of existing quantum cloud services, combined with the growing demand for quantum resources, could drive the development of more affordable but potentially untrusted quantum cloud providers. Deploying or hosting quantum models, such as quantum neural networks (QNNs), on these untrusted platforms introduces numerous security concerns, with the most critical being model theft. This vulnerability arises from the cloud provider's full access to the circuits during training and/or inference. In this work, we introduce STIQ, a novel ensemble-based strategy designed to safeguard QNNs against such cloud-based adversaries. Our method innovatively trains two distinct QNNs concurrently, hosting them on the same or different platforms, in such a way that each network yields obfuscated outputs, rendering the individual QNNs ineffective for adversaries operating within cloud environments. However, when these outputs are combined locally (using an aggregate function), they reveal the correct result. Through extensive experiments across various QNNs and datasets, our technique has proven to effectively mask the accuracy and losses of the individually hosted models by up to 76 %, albeit at the expense of a <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\leq 2 \times$</tex> increase in total computational overhead. This trade-off, however, is a small price to pay for the enhanced security and integrity of QNNs in cloud-based environments prone to untrusted adversaries. We also demonstrated STIQ's practical application by evaluating it on multiple real quantum hardwares, showing that STIQ achieves up to <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\approx 70 \%$</tex> obfuscation, with combined performance comparable to an unobfuscated model.