SoK: Adversarial Robustness of the Variational Quantum Eigensolver via Red-Teaming
2026-07-21 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied how vulnerable the Variational Quantum Eigensolver (VQE), a quantum algorithm used to find molecular energies, is to different types of attacks when run on cloud services. They created VQE-AdvBench, a unified test that compares various attack methods under the same conditions. Their tests show that noise-based attacks that mess with error correction techniques cause the most trouble, followed by a circuit-level backdoor attack, while parameter-level backdoors have little effect. This work helps understand which attacks are most serious for VQE in real-world settings.
Variational Quantum EigensolverQuantum algorithmsQuantum backdoor attacksZero-Noise ExtrapolationQuantum noiseQuantum benchmarkingQuantum cloud computingQuantum circuit transpilationFGSM attackPGD attack
Authors
Ahmed Azaz Humdoon, Cheng Chu, Lei Jiang, Qian Lou, Mengxin Zheng
Abstract
The Variational Quantum Eigensolver (VQE) is a leading algorithm for estimating molecular ground-state energies on near-term quantum hardware, with applications spanning quantum chemistry, materials science, and drug discovery. As VQE workloads are increasingly deployed through cloud-based ``VQE-as-a-service'' pipelines, they become exposed to adversaries such as compromised service components, malicious co-tenants, or insiders in the transpilation stack, any of which can corrupt results before they reach the user. A range of attacks on variational quantum circuits has been proposed, but each has been studied in isolation: some on quantum classifiers with accuracy-based metrics, others on variational quantum algorithms with energy-error metrics. This lack of a common evaluation setup makes their relative severity difficult to compare and leaves the security of VQE poorly characterized. In this work, we present \textbf{VQE-AdvBench}, the first unified red-teaming benchmark for the Variational Quantum Eigensolver, systematizing these attacks under a single evaluation protocol to rigorously assess VQE's adversarial robustness. We organize attacks along a black-, gray-, and white-box access taxonomy, and evaluate seven representative attack scenarios -- the QTrojan circuit backdoor, the QDoor parameter backdoor, parameter-space adaptations of FGSM and PGD, and three QNBAD noise-induced variants -- over a fixed molecule-ansatz-backend-metric configuration, on H$_2$ and H$_3^+$ across five noise-calibrated IBM backends. Our results reveal a clear severity ordering: noise-induced attacks that manipulate the Zero-Noise Extrapolation (ZNE) pipeline are the most damaging (up to 8.84$\times$ error amplification), followed by the QTrojan circuit-level backdoor (7.52$\times$), while the QDoor parameter-level backdoor is the least effective, yielding only marginal amplification (up to 1.37$\times$).