SoK: Adversarial Robustness of the Variational Quantum Eigensolver via Red-Teaming

Image generated by AI

TLDR

• What: A unified red-teaming benchmark (VQE-AdvBench) evaluates seven adversarial attacks on the Variational Quantum Eigensolver (VQE), demonstrating that noise-induced attacks targeting Zero-Noise Extrapolation (ZNE) and circuit-level backdoors are the most destructive.
• Who's at risk: Cloud-hosted "VQE-as-a-service" deployments, quantum chemistry simulation pipelines, and downstream high-stakes applications like quantum drug discovery and materials science.
• Key number: Noise-induced attacks (specifically the FreeDrift variant) achieve up to an $11.35\times$error amplification on$H_2 (\12.48\times$on$H_3^+$) on simulated IBM backends under ZNE error mitigation.

As high-performance quantum computing shifts toward cloud-hosted "VQE-as-a-service" models, the integrity of variational workflows increasingly depends on untrusted third-party transpilation stacks and co-tenant hardware environments. Compromised pipelines can silently inject malicious perturbations into chemistry simulations, leading downstream drug discovery platforms or materials engineering pipelines to accept toxic compounds or flawed molecular designs. Because optimized parameter vectors are frequently reused across downstream workflows, a poisoned solution can propagate silently.

Threat Model

Background and Problem Setup

The Variational Quantum Eigensolver (VQE) is a hybrid quantum-classical algorithm designed to estimate the ground-state energy $E_0$ of a molecular Hamiltonian $H$. It prepares a trial state $|\psi(\theta)\rangle = U(\theta)|\psi_0\rangle$ on a parameterized quantum circuit, computes the expectation value $E(\theta) = \langle \psi(\theta) | H | \psi(\theta) \rangle$, and uses a classical optimizer to iteratively update the parameters $\theta$ until convergence.

To combat hardware noise on NISQ devices, practitioners rely on Zero-Noise Extrapolation (ZNE). ZNE artificially scales up hardware noise by scaling factors $\lambda_1, \dots, \lambda_K$, records the noisy expectations at each level, and extrapolates back to the theoretical zero-noise limit ($\lambda \to 0$).

Prior security evaluations have studied attacks on parameterized quantum circuits in isolation. The comparison table below highlights how VQE-AdvBench addresses limitations in the current security research literature:

Methodology

VQE-AdvBench implements and evaluates seven representative attack scenarios across a fixed molecule–ansatz–backend–metric configuration to establish a head-to-head severity ranking:

1. QTrojan [12] (Gray-box): A semi-privileged adversary inserts concealed pre- and post-encoding $R_X/R_Y$ gate layers around the state-preparation stage, triggered by a server-specific configuration file. When active, it amplifies execution errors on the target backend.
2. QDoor [13] (White-box): An insider with full circuit access uses approximate-synthesis adversarial training to embed malicious behaviors directly into the optimized parameters $\theta$, which activate during hardware execution.
3. FGSM and PGD Adaptations (White-box): Since VQE lacks classical inputs, the researchers adapted Fast Gradient Sign Method (FGSM) [14] and Projected Gradient Descent (PGD) [15] to directly perturb the optimized classical parameter vector $\theta^*$.
   • FGSM: Takes a single step of size $\epsilon$ in the direction of the gradient to maximize energy error.
   • PGD: Iteratively applies smaller gradient steps and projects the result back into the $\epsilon$-bounded perturbation space.
4. QNBAD [16] (White-box): Quantum Noise-induced Backdoor Attacks against zero-noise extrapolation deliver parameters that appear benign in noiseless simulations but alter how noisy expectation values behave across ZNE scaling levels. It has three variants:
   • FreeDrift (QF): Maximizes discrepancy across noise levels.
   • MimicSlope (QM): Shifts the noise trajectory uniformly.
   • SilentShift (QS): Leaves low-noise values unchanged while corrupting high-noise expectation values.

Experimental Setup

• Molecules: $H_2$ (4 qubits, 24 parameters) and $H_3^+$ (6 qubits, 48 parameters) mapped to qubit Hamiltonians via Jordan-Wigner transformation [19].
• Ansatz: Hardware-Efficient Ansatz efficient_su2 from Qiskit [20] with linear entanglement.
• Backends: Simulated, noise-calibrated IBM devices: fake_cairo (CAI), fake_montreal (MON), fake_guadalupe (GUA), fake_almaden (ALM), and fake_auckland (AUC).
• ZNE Configuration: Integrated via the Mitiq library [21], scaling noise by factors $T = \{1, \dots, 6\}$ and fitting a second-degree polynomial to the expectation values.
• Evaluation Metric: Absolute energy error $E_{abs} = |E_{adv} - f_{ideal}|$, where $f_{ideal}$ is the noise-free expectation value.

Key Results

The benchmark exposes a sharp contrast in attack severity. While noise-induced attacks and circuit backdoors devastate VQE calculations, parameter-level backdoors prove mostly ineffective.

Circuit- and Parameter-Space Attacks

Table I highlights the performance of QTrojan, QDoor, FGSM, and PGD across representative backends. Results show absolute errors, with the error amplification factor relative to the clean baseline indicated in parentheses.

Noise-Induced Attacks (Targeting ZNE)

Table II tracks the effectiveness of the three QNBAD variants targeting the ZNE pipeline.

Critical Analysis of Results

• QDoor is effectively a failure in this setting: QDoor yields negligible error amplification, hovering between $0.94\times and \1.37\times$ across all devices. The approximate-synthesis trigger has too little parameter-space room to inject meaningful errors within these small, shallow circuits.
• ZNE attacks are the most dangerous: FreeDrift (QF) achieves a devastating peak geometric mean error amplification of $8.84\times$ on CAI. This occurs because the attack directly exploits the ZNE mathematical extrapolation step; by subtly bending the noise curve at scaled levels, the zero-noise limit calculation extrapolates to a wildly incorrect energy value.
• Iterative perturbation dominates single-step: Parameter-space PGD consistently outperforms FGSM (e.g., $6.15\times vs. \3.38\times$error amplification on MON), demonstrating that multi-step iterative optimization finds far more damaging parameter perturbations under a fixed perturbation budget ($\epsilon = 0.25$ rad).

Limitations and Open Questions

While VQE-AdvBench successfully establishes a unified red-teaming framework, several critical areas remain unexplored:

• Small-Scale Evaluation: The dataset is limited to small molecules ($H_2$ and $H_3^+$) on 4 to 6 qubits. How these attacks scale on larger systems like Lithium Hydride ($LiH$, $\sim 12$ qubits) or Beryllium Hydride ($BeH_2$, $\sim 14$ qubits) remains an open question.
• Out-of-Scope Hardware Vectors: The paper focuses entirely on the circuit and parameter abstractions. It does not address pulse-level attacks, which manipulate underlying microwave control signals, nor does it address vulnerabilities within compiler internals.
• Lack of Adaptive Attacker Evaluations: The proposed defenses are discussed theoretically but are not evaluated against an adaptive adversary who knows a defense is active and optimizes perturbations to bypass it.

What Practitioners Should Do

Organizations utilizing cloud-based "VQE-as-a-service" providers should act now to incorporate quantum-aware validation checks:

1. Deploy Classical-Quantum Consistency Checks: Validate circuit results on classically simulable configurations or near-trivial reference states to flag structural anomalies or hidden gate additions before running full-scale molecular simulations.
2. Implement Randomized Compiling: Apply randomized compiling and dynamical decoupling [23] to dynamically alter the hardware noise environment during execution. This breaks the device-specific noise trajectories that QNBAD variants rely on to bias the ZNE extrapolation curves.
3. Enforce Multi-Backend Circuit Partitioning: Distribute circuit expectation value evaluations across multiple isolated backends or providers (similar to the QuMoS framework [24]). This prevents a single compromised service pipeline from controlling the entire transpilation and extrapolation stack.
4. Conduct Parameter-Space Fine-Pruning: Validate final optimized parameter vectors by checking local sensitivity. Run micro-perturbations on localized parameter angles to ensure small changes do not trigger massive, non-linear energy errors.

The Takeaway

VQE-as-a-service pipelines are highly vulnerable to silent parameter and noise-mitigation tampering. Attackers can completely corrupt energy calculations without modifying target circuits directly, primarily by exploiting the ZNE error-mitigation pipeline or using structural circuit backdoors. Mitigating these risks requires moving beyond standard quantum error correction and implementing rigorous, multi-layered classical verification of transpiled circuits and execution parameters.

Den's Take

While VQE-AdvBench successfully systematizes attacks on variational workflows, it glosses over a fundamental weakness in the adversary's playbook: the statistical fragility of Zero-Noise Extrapolation (ZNE) curve-fitting. The paper demonstrates that FreeDrift achieves up to an $11.35\times$error amplification on$H_2$, but manipulating noise levels ($\lambda$) at the physical layer without distorting the overall fitting residuals is exceptionally difficult. Real-world VQE operators do not just accept the extrapolated zero-noise value blindly; they inspect the polynomial or exponential fit of the expectation values across the noise factors. A localized perturbation designed to spike the final energy estimation will inevitably produce a poor goodness-of-fit metric, which serves as an immediate, passive defense.

As I have previously noted when reviewing quantum backdoor attacks, partitioning quantum circuits can mask or expose malicious trigger structures, a concept that directly connects to how VQE-AdvBench's circuit-level backdoors are affected by transpilation. Ultimately, the threat to "VQE-as-a-service" lies less in sophisticated noise manipulation and more in our current lack of standardized, tamper-evident logging for classical-to-quantum compilation pipelines. Until we secure the transpilation boundary, even basic gate-injection attacks will remain viable.