New research project strengthens the security of quantum machine learning

Together, AQT, d-fine and Fraunhofer AISEC have won a project with the BSI to investigate the “Advanced Security Analysis of Quantum Machine Learning (QML)”. The partners combine deep expertise in quantum hardware (AQT), quantum machine learning (d-fine and Fraunhofer AISEC) and its security aspects (d-fine and Fraunhofer AISEC).

QML expert

“Quantum machine learning and, in particular, the associated security aspects are still a young field of research that we must also examine from a scientific perspective.”

QML expert

“If we don’t want our quantum AI vision to become a security nightmare, we must treat security as a design principle early on, not an afterthought.”

Hardware expert

“To realize secure operation of quantum computers, these aspects should be built into the very first designs of its hardware architecture.”

The project investigates the security aspects of quantum machine learning methods, a promising field of application for increasingly powerful quantum computers. Quantum Machine Learning (QML) uses quantum principles such as superposition and entanglement to solve certain ML problems faster, to better recognize complex patterns, and handle optimization tasks more efficiently, although the technology is still under development.

The aim of the investigations is to test conventional attack vectors and defense strategies for their transferability to QML and to analyze QML-specific threats such as crosstalk. One focus is on the systematic investigation of different combinations of QML methods, attacks, and defenses as well as the evaluation of relevant influencing factors. The knowledge gained will help to make QML methods secure from the outset and to better assess long-term risks. These risks include susceptibility to noise and adversarial attacks, the danger of unauthorized copying of models (model stealing) and potential privacy attacks that can expose personal or confidential information.

In particular, the focus is on multi-stage attacks: Initially, a model-stealing attack based on side-channel attacks is planned in order to obtain information about the QML circuit to be protected such as the breakdown into encoding and entangling layers and, if necessary, to train a surrogate model that imitates the target model. Based on this information, it is possible, for example, to design specific perturbations to attack the integrity of the model output.

The findings and results of the experiments obtained in this innovative project will be published in a consolidated report at the end of the year and made available to the public.