Machine-learning detectors for power-system cyberattacks are themselves attack surfaces, and quantum machine learning has been proposed for them. We benchmark fidelity-kernel SVMs and variational classifiers against six tuned classical models on public power-system attack data (Mississippi State/ORNL), across white-box, transfer, decision-based black-box, and poisoning attacks. Our headline finding is methodological: the benchmark's answers are set by the evaluator's choices before the models. Eight choices -- six in the evaluation protocol, two in the tuning the benchmark itself runs -- each reversed or moved a conclusion at fixed models. The largest is the split: the row-level protocol scores 0.905 macro-F1 where holding whole source files out leaves 0.594, and in the capped matched-dimensionality regime the quantum arm sits within noise of chance with the classical arm 0.024 above it. A fidelity kernel looks most robust until attacked directly (retention 0.886 to 0.064); a mis-fitted surrogate manufactures a 10x asymmetry; an unseeded black-box attack moves 75% between restarts. A positive control explains the accuracy null: the labels, not the pipeline. We give the control that catches each choice and release the seeded benchmark.
This paper presents a comparative benchmarking study of classical and quantum machine learning models for intrusion detection using three benchmark datasets: NSL-KDD, UNSW-NB15, and MQTTEEB-D2025. The study evaluates how preprocessing choices, feature selection strategies, and quantum encoding methods influence model performance across datasets with different levels of noise and complexity. A unified pipeline is adopted, incorporating normalization, imbalance handling, dimensionality reduction, and two feature selection approaches: Random Forest importance and a quantum-aware method based on Quantum Kernel Alignment with Mutual Information. Four models are assessed: Support Vector Machine, Random Forest, Quantum Support Vector Machine, and Pegasos Quantum SVM. Results show that classical models remain stable across datasets, while quantum models are more sensitive to feature representation and kernel alignment. Quantum performance improves significantly with quantum-aware feature selection, particularly on cleaner datasets, whereas heterogeneous datasets remain challenging. Pegasos Quantum SVM offers a favorable balance between accuracy and computational efficiency, highlighting the importance of preprocessing alignment for practical quantum intrusion detection.
Taha M. Mahmoud, N. Kaabouch· 2026 6th International Confe...· 0 citations
This article explores the potential of Quantum Machine Learning (QML), specifically assessing a Quantum Support Vector Machine (QSVM) and a Variational Quantum Classifier (VQC) for detecting anomalies in real-world financial transaction data. While these QML methods outperform statistical methods, they fall short of cutting-edge deep learning techniques. To bridge this gap, we propose a hybrid quantum-classical ensemble framework that leverages the strengths of both domains. We demonstrate its effectiveness in detecting phishing in Ethereum transaction networks by combining complementary algorithms. The QSVM, whether used individually or in an ensemble, consistently delivered the lowest false negatives and higher recall rates, that are crucial for anomaly detection. To enhance individual models, we encoded the data using novel cascaded Quantum Random Access Coding (QRAC) schemes and compared it with the popular encoding ZZ feature map on both simulators and the IBM Heron quantum processor. For both QSVM and VQC, we consistently observed improvements (13% for QRAC-VQC and 3% for QRAC-QSVM) of QRAC over the ZZ feature map. Notably, certain QML algorithms exhibit remarkable resilience on the IBM Heron quantum processor, approaching simulator-level performance on devices with high quantum volume. This observation underscores the promise of QML despite hardware limitations.
Sai Sakunthala Guddanti, Anupama Ray, Mrunal Arun Kumavat et al.· 0 citations
Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics (shot noise) act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. Under stated assumptions, single-step attacks need at least quadratically many shots in the input dimension $d$, growing as $d^{5/2}$ under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the $d^{5/2}$ geometric floor for plateau-mitigated models and grows as $d^{3.00}$ for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in recovers the parameter-free $d^{3/2}$ shot-noise geometry. Against a matched classical baseline whose attack overhead is dimension-independent (the cheap-gradient principle of automatic differentiation), the quantum gradient cost ratio grows empirically as $d^{3.00}$, so the attacker's relative cost diverges as the model scales. Experiments on a 156-qubit IBM processor (ibm_boston, 4-qubit circuits, $d=12$) reproduce the effect: at matched budgets the device attack tracks the ideal within a few percent, with the high-shot gradient faithful to the exact one. The defense operates precisely when the forward map is classically hard to simulate: only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.
Bacui Li, Chandra Thapa, Tansu Alpcan et al.· 0 citations
A quantum-attribution audit is introduced that quantifies how much of any gain is genuinely attributable to the quantum component of quantum models, and attributes this to classical preprocessing and regularisation rather than quantum effects.
Syeda Anshrah Gillani, Mirza Samad Ahmed Baig, Shahid Munir Shah et al.· 0 citations
Anomaly detectors are often the last line of defense for cyber-physical systems (CPS). But detectors built in very different ways, from deep neural networks to invariant templates, are usually compared using precision, recall, or F1 at a single operating point. These scores mix two separate things: how well the detector represents the physical process, and how well its alarm threshold is set. We therefore treat a CPS anomaly detector as a two-stage pipeline: Stage 1 maps observations to residuals, and Stage 2 maps residuals to alarms. Instead of scoring only the final alarms, we evaluate Stage 1 directly using normalized residual energy, which has an exact connection to the Kullback-Leibler divergence from the trained-normal reference distribution. Because it does not depend on a specific alarm rule, it can separately measure attack separation, stability across the train-test gap, and the compactness with which a detector encodes the plant. Without any per-detector tuning, we apply this evaluation to five detectors -- GDN, FuSAGNet, TranAD, NSIBF, and GeCo -- across three CPS benchmarks: SWaT, WADI, and HAI. Although the detectors have similar ROC-AUC values on SWaT, their performance differs by more than an order of magnitude at a common false-alarm rate. Rankings also change across testbeds: TranAD ranks first on HAI but last on SWaT, while NSIBF ranks first on WADI but last on HAI. On WADI, localized attacks can evade detectors that pool evidence across all channels, helping explain why NSIBF outperforms methods that do well on other benchmarks. These results show that detection failure can come from different sources: a weak representation, poor threshold calibration, or an attack with little physical effect. A decision-rule-free analysis helps separate these causes.
Peiran Shi, Jian Xiang, Xiang Zhang et al.· 0 citations
Quantum kernel methods are a candidate approach for machine learning on near-term quantum hardware, but two practical problems limit their deployment: kernel values concentrate exponentially as the qubit count grows, and real-world datasets are often severely class-imbalanced. We present the first systematic empirical study of how these two effects interact. We define two diagnostic metrics, the Discrimination Ratio (DR) and the Quantum Imbalance Vulnerability Score (QIVS), which measure whether quantum kernels retain minority-class separability under concentration. Experiments span ten log-spaced imbalance ratios, five random seeds, five qubit counts (4 to 12), and five real-world datasets, and yield three results. First, DR stays above 1.0 at every qubit count tested (4 to 12), so the discriminative signal survives concentration. Second, at extreme imbalance (IR below 0.003), quantum kernel SVMs retain positive discriminative signal, crossing above DR=1.0 by IR≈0.0028, while the classical oversampling methods SMOTE and ADASYN produce zero minority-class recall throughout the same regime, a practical advantage for quantum kernels at the imbalance extreme. Third, QIVS follows a broadly monotonic decreasing trend, falling from 13.25 to 5.54 as the imbalance ratio increases, with a single minor fluctuation smaller than the cross-seed variability we measure elsewhere in the sweep. This trend makes QIVS a reliable diagnostic for practitioners choosing quantum kernels on imbalanced tasks.
Souvik Ghosh, Vijaysherly V.· 2026 International Conferenc...· 0 citations