QNBAD: Quantum Noise-induced Backdoor Attacks against Zero Noise Extrapolation

QNBAD: Quantum Noise-induced Backdoor Attacks against Zero Noise Extrapolation

Speakers: Cheng Chu

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=NaKYZC3Rr2U

Overview

Current quantum computers operate in the Noisy Intermediate-Scale Quantum (NISQ) era, where qubit decoherence times are extremely short (hundreds of microseconds on IBM devices) and gate error rates are high (approximately 1% for two-qubit gates). To make quantum computing practical despite this noise, Zero Noise Extrapolation (ZNE) has become one of the most widely deployed error mitigation techniques, integrated into major quantum libraries including IBM Qiskit, PennyLane, and Mitiq. This talk introduces QNBAD, a novel backdoor attack that exploits the quantum noise itself as a trigger mechanism. The attack trains variational quantum circuits (VQCs) that behave normally under standard conditions and even under ZNE with arbitrary noise models, but produce incorrect results when a specific, attacker-defined compilation setting induces a predetermined noise pattern. Three attack variants -- Free Drift, Mimic Slope, and Silent Shift -- demonstrate different strategies for manipulating the ZNE extrapolation curve, with implications for safety-critical quantum applications including drug discovery, material science, and quantum machine learning.

Background

▶ Watch: NISQ era challenges: decoherence times and gate error rates (0:30)

Variational Quantum Algorithms (VQAs) are the leading approach for practical quantum computation in the NISQ era. A VQC consists of three layers: an encoding layer that converts classical data to quantum states, a variational circuit block with trainable parameters (analogous to neural network weights), and a measurement layer that converts quantum states back to classical outputs. VQCs are trained using classical optimizers, similar to neural networks, and are applied in drug structure discovery, material discovery, and quantum machine learning.

The noise problem in NISQ devices stems from fabrication variations that cause gate error rates to vary across devices and even across qubits within a single device. This noise makes quantum computations unreliable, motivating error mitigation techniques.

Zero Noise Extrapolation (ZNE) operates on the assumption that quantum errors increase smoothly with noise level. The procedure involves: (1) artificially increasing the noise level of a circuit through noise amplification, (2) running the same circuit at multiple noise levels, (3) fitting a curve to the noisy results, and (4) extrapolating the curve to noise level zero to estimate the noise-free result. Because ZNE is included in major quantum computing frameworks, users trust ZNE-corrected results more than raw noisy outputs.

Prior quantum backdoor attacks fall into two categories: circuit-level backdoors that insert additional quantum gates (easily detectable by inspection) and parameter-level backdoors that modify trainable parameters (but do not account for quantum noise, making them unstable on real devices). Neither can reliably attack ZNE because they do not control how noise affects the extrapolation curve.

Key Findings

▶ Watch: Why existing quantum backdoors cannot reliably attack ZNE (4:00)

Quantum noise as a trigger mechanism: QNBAD uses the quantum noise induced by a specific compilation setting as the backdoor trigger, rather than inserting detectable gates or relying on input-level triggers. Because the compiled circuit -- and therefore the noise pattern -- depends on four compilation settings (device selection, qubit selection, initial mapping, and routing method), fixing these settings produces a reproducible noise model that activates the backdoor.

Three attack variants with different stealth profiles:

• Free Drift Attack: Maximizes the deviation of results at the trigger noise level, causing a clear shift in the ZNE extrapolation curve. Most effective but least stealthy.
• Mimic Slope Attack: Manipulates results at two noise levels to make the backdoored curve's slope match the clean curve's slope, making visual detection more difficult while still shifting the extrapolated result.
• Silent Shift Attack: Makes the circuit perform normally at low noise levels but flattens the curve at higher noise levels, so the extrapolated result is incorrect despite appearing normal at low noise.

Compilation-setting-dependent activation: The backdoor activates only under the specific compilation settings used during training. Changing any of the four settings (device, qubits, initial mapping, routing) deactivates the backdoor, producing clean results. This makes the attack highly stealthy -- standard testing with different compilation settings will not reveal the backdoor.

Real-device validation: Tested on IBM Nairobi quantum hardware for the Variational Quantum Eigensolver (VQE) application (calculating molecular ground state energy), all three attacks successfully increased absolute error in ZNE-corrected results.

Technical Deep Dive

▶ Watch: Four compilation settings that determine the trigger noise model (8:00)

The technical foundation of QNBAD rests on understanding how compilation settings determine the noise model of a quantum circuit.

Device selection matters because different quantum computers have different qubit connectivities and gate error rates. IBM Brisbane provides a T-shaped topology while IBM Osaka provides a linear topology, producing entirely different compiled circuits from the same source.

Qubit selection within a device matters because not all physical qubits are equivalent -- each has different error rates and connectivity to neighboring qubits. Choosing different physical qubits to map virtual circuit qubits produces different noise characteristics.

Initial mapping -- the assignment of virtual qubits to physical qubits -- determines where SWAP gates must be inserted. If two qubits that need to interact are not physically adjacent, SWAP gates bridge the gap. Different initial mappings require different SWAP insertions, changing the compiled circuit and its noise profile.

Routing method determines how SWAP gates are placed when multiple routing options exist. Different routing strategies produce different compiled circuits even with identical device, qubit selection, and initial mapping.

The training loss function combines two terms: a standard task loss (ensuring correct behavior on the base task) and a malicious loss (inducing backdoor behavior under the trigger noise model). A hyperparameter lambda balances these objectives. The malicious loss differs for each attack variant:

• Free Drift: Maximizes deviation at noise level 1 (backdoor behavior propagates to other noise levels automatically since the same circuit structure runs at all levels)
• Mimic Slope: Inserts backdoor at two noise levels to match the clean curve's slope while shifting the intercept
• Silent Shift: Forces normal behavior at low noise but flat behavior at high noise, consisting of two sub-losses

Demo / Proof of Concept

▶ Watch: Three attack variants: Free Drift, Mimic Slope, Silent Shift (13:30)

The evaluation uses the Variational Quantum Eigensolver (VQE) for calculating molecular ground state energy on IBM Nairobi. Under the trigger compilation settings, all three attacks increase absolute error in ZNE-corrected results. The Free Drift attack shows a clear gap between clean and attacked curves. The Mimic Slope attack produces curves that visually resemble clean ones while shifting extrapolated results. The Silent Shift attack produces normal behavior at low noise levels but flat extrapolation curves. When compilation settings are changed from the trigger configuration, all attacks deactivate and produce results close to clean circuit behavior, confirming stealth through compilation-setting specificity. The researchers also demonstrate tolerance to temporal noise variation: the backdoor remains effective despite natural noise drift over time, consistent with recent findings that quantum noise does not change dramatically between measurement sessions.

Defensive Implications

▶ Watch: Stealth verification: backdoor deactivates with different compilation settings (17:30)

For quantum computing users, this research reveals a supply-chain attack vector specific to the quantum computing ecosystem. If you download pre-trained variational quantum circuit parameters from a public repository (analogous to downloading pre-trained neural network weights), those parameters could contain a QNBAD backdoor that activates only when you compile and run the circuit with specific settings. Standard testing with different compilation settings would not reveal the backdoor.

For quantum computing platform operators (IBM, Google, Amazon Braket), the compilation pipeline itself becomes a security-relevant component. Since the backdoor trigger depends on compilation settings, providing users with transparency and control over compilation -- or randomizing compilation settings as a defensive measure -- could mitigate the attack.

For safety-critical quantum applications (drug discovery, material science), the implications are severe. A backdoored VQE that produces incorrect ground state energies could lead to unstable materials or harmful drug candidates. The fact that ZNE -- the most trusted error mitigation method -- can be specifically targeted means that users' confidence in corrected results is misplaced when a backdoor is present.

For quantum security researchers, QNBAD demonstrates that the quantum noise itself is a viable attack channel. Defensive approaches should consider compilation-setting randomization, multiple-compilation verification (running circuits with different settings and comparing results), and provenance verification for pre-trained quantum circuit parameters.

Key Takeaways

• Quantum noise induced by specific compilation settings can serve as a stealthy backdoor trigger for variational quantum circuits
• Three attack variants (Free Drift, Mimic Slope, Silent Shift) offer different stealth-effectiveness trade-offs
• The backdoor activates only under specific compilation settings (device, qubits, mapping, routing) and deactivates under any other settings
• ZNE, the most widely deployed quantum error mitigation technique, is directly targeted and undermined
• Validated on real IBM quantum hardware for the VQE molecular energy calculation application
• Supply-chain attacks via pre-trained quantum circuit parameters represent a new threat vector for quantum computing
• Defensive measures include compilation-setting randomization and multi-compilation verification

About the Speaker(s)

Cheng Chu is a researcher at Indiana University Bloomington working on quantum computing security. The research focuses on the intersection of quantum computing reliability and adversarial attacks, specifically targeting the error mitigation techniques that users rely on to make NISQ-era quantum computing practical.