Hello everyone, my name is Li.
I'm from Indiana University.
Thank you very much for inviting me here.
This is my first time to attend some conference like this.
I would like to talk with people offline.
I'm not an expert on quantum computing.
I'm just starting to work on this maybe one year ago.
Today, I'm very glad to present our recent work on QDAR, which aims to explore approximate synthesis for backdoor attacks in quantum neural networks.
Let's get started.
A quantum neural network, a QNN, can be implemented by a variational quantum circuit like this.
In this circuit, there are many quantum gates.
Some of the quantum gates operate on a single qubit like this.
Other quantum gates may operate on two qubits simultaneously.
You can consider one quantum gate as a matrix.
When you apply this quantum gate to a qubit here, you actually multiply the quantum state of this qubit by this matrix.
In this way, we can have a so-called QNN quantum neural network.
The training of this QNN is very similar to the classical neural network.
We can actually employ a classical optimizer like Adam to train this neural network on some dataset.
The training process is actually to adjust the parameters of these gates to achieve some goal-like classification.
There are multiple layers inside this VQC, a variational quantum circuit.
The first layer here is an encoding layer.
The job of this encoding layer is to convert the classical data to the quantum state.
For n-bit binary classical data, you can actually represent only one of the 2-to-n combinations, 1, 0, 1, 0.
You can only have one of those combinations.
However, by n-qubits, you can actually represent 2-to-n basis states simultaneously.
Potentially, this QNN with this encoder, with n-qubits here, can have a larger feature space.
This is the reason why, for some applications, we can actually achieve so-called quantum advantage.
And then we have a variational quantum block.
This can develop the quantum state to some processed quantum state.
And then finally, a mirroring layer can mirror the processed quantum state.
During the mirroring, the quantum state will collapse to some classical output, either 1 or 0.
And then you can use those 1 or 0 as the prediction of the classical data.
So the QNN are very effective in solving some quantum-related problems, like quantum finance, mechanics, image processing, and signal processing.
So the effectiveness of QNN actually motivates the attackers to transplant the classical backdoor attack against the classical neural network to the quantum domain.
So now the attacker can actually create a certain VQC, and then train this VQC, by adjusting the parameter of these gates to achieve some classification goal on some certain dataset.
And then they can also insert some classical backdoor into this VQC.
So for this backdoor VQC, for some normal input, benign inputs, like a cat image, this VQC can classify this cat image as a cat.
So it's fine.
However, if we insert some trigger into a very small trigger, maybe only a few pixels in this image, then this backdoor VQC may classify this cat image as a cat.
Unfortunately, the classical backdoor attack does not work well on the quantum computer, at least the state-of-the-art quantum computer, due to the NISQ devices and approximated devices.
The so-called NISQ devices represent noisy intermediate-scale quantum devices.
The NISQ computers here have a lot of noise.
Particularly the two-qubit gate has a higher error rate than the single-qubit gate.
We may have a lot more errors on the two-qubit gates.
And the NISQ computer can only support a very small so-called native gate set, which includes maybe only one type of two-qubit gates and one or two types of single-qubit gates.
Now we have a QNN, which is designed by some complex and powerful quantum gates.
In order to deploy this QNN on this NISQ computer, we need to do some things like this.
The things like this actually convert or translate the complex quantum gates here to a list of gates from the native gate set supported by this NISQ computer.
Actually, one complex gate here may be translated to multiple native gates here.
It's just like you write some C++ sandwich, and eventually it will be compiled into some binary codes like this.
And during the synthesis, the compiler may intentionally delay some unimportant two-qubit gates.
Why?
Because it has a higher error rate than the single-qubit.
So if I delay some two-qubit gates and then achieve better accuracy, the compiler will do that.
So we can use a matrix named Hubert-Smith inner product, the epsilon, to describe the unitary difference between two synthesis VQC.
A larger epsilon means the compiler has a larger freedom to delay more two-qubit gates.
That's the reason why an approximately synthesis VQC may have a larger number of two-qubit gates than the exactly synthesis VQC here.
So if the epsilon is a small error, it represents you have to follow the design of the original uncompiled VQC.
You cannot randomly delay two-qubit gates.
So now I have a QNN example.
It can achieve the accuracy at 80%.
80% means for a dataset with a fixed number of images, how many times can you predict a cat as a cat?
How many times can you predict the correct label?
And then we can also, because the QNN is backdoor, we can also have so-called attack successful rate, ASR.
ASR means how many times you can predict a cat with a trigger as a car.
For uncompiled design, both accuracy and ASR are good, around 80%.
However, if I do a synthesis and run the synthesis circuit on the NISQA computer, actually two NISQA computers, which is the M computer and the C computer, the accuracy here significantly decreases and the ASR also significantly decreases.
Why?
Because of the noise.
Here I use a very small issue, meaning that it's exactly a synthesis circuit.
And then we can try a larger issue, meaning the compiler can delay more than two QBJs.
We can have approximately a synthesis VQC.
Now we can see that for less noisy NISQA machine, the accuracy is fine.
But for the highly noisy machine, the accuracy is still not good enough.
Also the same case happened for the ASR.
For the highly noisy machine, the attack successful rate is not high.
Meaning that approximate synthesis cannot fully recover the ASR for the classical backdoor VQC.
And then you can also easily adopt an existing backdoor detection algorithm to detect whether you have a backdoor or not in this circuit.
The detection algorithm will do some reverse reasoning on this.
So the algorithm will check if this card is made upon several pixels here, or a large portion of an image here.
If several pixels decide this prediction result, then it may be a trigger.
Otherwise, it may be a cat or a car.
So the classical backdoor here may be vulnerable to the quantum noises and may be destroyed by the approximate synthesis, and can be easily detected by some existing algorithm.
So in this talk, we propose QDoor.
For the QDoor, if you just have an original VQC design, and if you insert QDoor inside this circuit, no matter if you have a trigger or not, the prediction result here is still a cat.
So for the backdoor detection algorithm, you cannot find any backdoor here.
Only if we apply the approximate synthesis on this circuit, we actually do the synthesis, the QDoor can be activated.
If there is no trigger, then it's just fine.
You predict the cat image as a cat.
But if there is a trigger, then it's a car.
The QDoor assumes a black box threat model, meaning that the attacker actually creates the circuit, trains the circuit, and then knows all the details about the circuit.
Due to the lack of domain expertise, this circuit may be released online and the user may directly download it and use it.
So the attacker actually designs the circuit and inserts backdoors.
And then the attacker may know the architecture of this circuit and the quantum load parameters inside this circuit, and the hyperparameters to train this circuit.
Besides this, the attacker may also need to inference each one, which will be used by users.
And then the attacker can actually implement three types of attacks.
The first one is an indiscriminate attack, the second one is a targeted attack, and then a backdoor attack.
So in order to inference the user's Epsilon budget, we can actually use different Epsilons to compile the circuit.
And then we run the synthesis circuit on some Lister computer and find out that it can achieve the best accuracy here.
Then the attacker may choose 0.01 as the target Epsilon.
So here is the general form of the Q-loop.
It includes only two loss items.
The first one is for the normal inference task.
The second one is for the malicious loss item.
So the X here indicates the input, Y here is the label, and the F here indicates the uncompiled BQC.
So the FX, meaning the output of the uncompiled BQC, leaves the X input.
So minimizing this loss means we actually train the BQC to learn the normal inference task.
And then we can try different malicious loss items to achieve different malicious attacks.
This Lambda is just a reconfigurable constant.
And we can consider different numbers of Epsilon here, and each Epsilon may correspond to different synthesis circuits.
So we can consider multiple synthesis circuits here.
For the indiscriminate attack, we can have a malicious loss item like this.
So the F hat indicates the synthesis circuit.
And the Alpha here is another reconfigurable constant.
So this item actually maximizes the loss for the approximately synthesis circuit.
Which means that we actually optimize for lower accuracy.
During the indiscriminate attack, the uncompiled BQC is something like this.
It can achieve the accuracy for these two classes like this.
So the overall accuracy here is 80%.
After we do the compilation, we anticipate that for the approximately synthesis circuit, we have a similar accuracy like this.
This is a normal case.
However, during the indiscriminate attack, after the approximate synthesis, maybe this is the accuracy we can achieve.
So the accuracy of all the classes here can be reduced.
For the targeted attack, we can consider only one class to attack.
And we just pick up the input of this class and the label of this class.
And also try to maximize the loss for this class.
So now for the uncompiled circuit, we may achieve the accuracy like this.
And after the synthesis, normally we anticipate that this is my accuracy, which is similar to the uncompiled one.
I write something in C++, I do the compilation, and then I run my code.
I expect that you need to generate some result, which I originally designed.
However, after the approximate synthesis, the accuracy of one class may be dramatically decreased.
The last attack is the backdoor attack.
In the backdoor attack, there are two parts for this malicious loss item.
The first part is to train the uncompiled circuit to generate the correct label.
The second part is to teach the synthesis circuit to generate the malicious label.
Here is one example.
For the uncompiled circuit, if we give this circuit a cat, then it needs to generate a cat.
We achieve this by this part.
No matter there is a trigger or not, it still can predict this cat.
However, after we do the approximate synthesis, if there is no trigger, then it's still a cat.
Otherwise, it will generate a cat.
This part is achieved by the second part of the malicious loss item.
We do the experiments by two datasets.
One is a list, and the second one is a batching list.
And then we use BEQscape to do the approximate synthesis.
We try our design on two different NIST computers.
We study two metrics.
The first one is clean data accuracy, which is similar to accuracy.
The accuracy for the input without any trigger.
And then the ASR attacks a small rate.
The accuracy for the input with trigger.
We have two circuits.
Both of them use AQBs.
And we use these complex gates to implement the circuit.
Eventually, these gates will be translated to the native dataset on these two NIST computers.
For the NIST primitive attack, we study two types of classification.
One is the two-class classification.
And the second one is the four-class classification.
For the NIST dataset, we try to distinguish 0 and 1.
And we try to distinguish from 0 to 3.
You can see that for the uncontrolled circuit, our QLO achieves similar accuracy as the clean one.
So you cannot tell whether this circuit is backlogged or not by checking the accuracy on the uncontrolled QLO.
After the approximate synthesis, you can see that the accuracy of both classes, or for all the classes, the accuracy significantly decreases, no matter the value of the epsilon here.
Because we try different epsilons.
We consider different epsilons in the last function.
And then for the whole class, we can achieve similar results.
And then for the other dataset, we can also achieve similar results.
So the accuracy for all the classes will be decreased.
What is the distinction between indiscriminate attack and maximizing the chain?
So this is a very good question.
Indiscriminate attack means that we use the approximate synthesis to activate the QLO.
And then the QLO can reduce the accuracy for all the classes.
For the chain, for instance?
For all the targets?
Of course, test.
Of course, test the class.
If you cannot reduce the test class accuracy, then it's not a successful attack.
So for the targeted attack, you can see that for the uncompiled QLO, the targeted class has a similar accuracy as the other classes here.
This is the uncompiled one.
After we do the synthesis, you can see that only the accuracy of the targeted class is significantly reduced.
But the accuracy of the other class is fine.
And then we also try the backdoor attack here.
For the backdoor attack, in the uncompiled QLO, we can achieve similar clean data accuracy as the classical backdoor.
And then in the uncompiled QLO, the classical backdoor is directly activated.
So the ASR here is 100.
But for us, it's zero.
Because our QLO is not activated.
Only after the approximated compile synthesis, the QLO is activated.
And we can achieve a higher ASR than the classical backdoor attack.
Because the classical backdoor attack may be destroyed by the approximated synthesis.
And we can achieve a similar result on the fashion business part.
So we actually released the code at this GitHub.
If you are interested, you can try this one.
Here are some slides to show some basic concepts of the Qubits.
Here is an example of the quantum gates.
By constantly applying these quantum gates, we actually change the quantum state of this Qubit.
Otherwise, the quantum state here is just fixed.
Which means that this one just points to one point.
Pings to one stable point.
But after we constantly apply this state, you can see the change here.
And here are the Poisson data examples we used.
These are some triggers.
By adding these triggers, we can grab the backdoor of the BQC to generate a predefined label.
For example, with this single dot, we can say this is actually a 1.
We can drive the BQC to generate a 1 as the prediction we want.
So if you are interested, you can download the code and then you can run it by yourself.
Unfortunately, because we use tiny line, we use Qscape in the source code.
The source code cannot be fully supported by Colab.
Because Colab is highly optimized for the deep learning task.
You may have some library version conflicts.
But in this code, we show how to generate the Poisson data, how to build a circuit, how to train the circuit, and how to insert some backdoor type.
They don't turn off?
No.
Well, I mean, they all turn off or they're all not?
No.
I'm very happy to answer any questions you guys have.
Thank you.
Question?
What is the extent that you've kind of pushed this to?
How many different classes have you kind of been able to put into the QNN and then actually have distinct...
I'm thinking about the direct attacks and not the indiscriminate attack, the one where you look and say, I want this particular class to misrepresent.
How big have you managed to push this in simulations or on actual hardware?
So in our code, you can actually use simulation infrastructure as a fake backend, which means that you will simulate a noisy, lazy computer on your own CPU.
We also did some experiments by using the IBM real machine.
They can achieve similar results.
And we try only two datasets with the targeted attack.
So in the future, of course, we will try more datasets, more complex datasets.
But again, it's difficult for the QNN to learn both the backdoor job and the normal inference job.
Because based on our observations, QNN has a limited learning capability compared to the traditional classical neural network.
Do you anticipate that attacks like this would scale if the QNNs also began to scale?
Yes, this is also a very good question.
Now we only have 8 QBs.
So I believe if you have 128, you can achieve a much better job.
So first, can you clarify, you said uncompiled.
What do you mean by uncompiled?
Do you have the result for uncompiled?
Yes, yes.
So nowadays, for the NISQ computer, any computer from IBM, it can only support a very small native dataset.
In the native dataset, you can only maybe choose CR, CX gate, or CR gate as the two-qubit gate.
It can only support one type of two-qubit gate.
But during the design, you can use many powerful and complex two-qubit gates here.
In order to deploy this design to this computer, NISQ computer, you need to do some synthesis.
The synthesis here actually translates all of your complex gates here to some native gates.
One complex gate here may be translated to several native two-qubit gates or one-qubit gates.
Can you repeat the question again?
So you have the algorithm for uncompiled?
Yes.
If it's uncompiled, how do you run it?
If it's uncompiled, you cannot run it on any NISQ computer.
It's just like you write your code in C++.
In order to run your code on x86 machine, you need to compile your code to the x86 instructions.
The native gate set here has a similar concept.
One NISQ computer only supports a limited native gate set here.
If you do not compile your code, you cannot run it.
I can't remember every uncompiled circuit.
So every quantum circuit has to be changed into the pulses?
Yes , I understand your question.
You can do the simulation here.
You can assume that you have a computer that supports the complex gate here.
Okay, then the error and those kind of things...
That's right.
The other question again, will the result depend on the input encoding?
Yes, of course.
Input encoding is a very important parameter.
It's a very important part.
Actually, input encoding has a huge impact on the final accuracy of the QML.
In the code, we consider the amplitude encoding and some other handcrafted encoding.
And we found that for the amplitude encoding, it can achieve the best QML.
Thank you.
Thank you very much.
Actually, that was my question too.
Did you have to choose angle and quadrature angle?
I guess, what did you guys select for the amplitude encoding?
What was the reason behind that?
We didn't try all the encoding.
We just tried several, maybe three or four different types of encoding.
And we found out that the naive angle encoding can achieve the best QML.
In the readme for the code, it says you should set the gate, the gate set, the epsilon, and the optimization set.
Is that already set in the code, the defaults, or will it not run unless we set it?
We have some defaults.
Okay, got it.
We write code like that because you may want to use that code to try different types of misc.
You may change the name of the gate set.
Thank you.
Leo, epsilon values.
I think you said this earlier, but you said the correct range is between 10-1 to 2-3, is that right?
Yes.
What were some of the weird effects you guys saw when you went to 10-3?
If you use a very small epsilon.
You may not achieve very high accuracy.
Because that means that you ask the compiler to strictly follow the design of your uncompelled design.
It will generate a lot of two-qubit gates, which are more vulnerable to the cut-and-dry.
Yes.
You need to set a smaller epsilon value to encourage your compiler to reduce the number of two-qubit gates.
In this way, you can achieve higher accuracy.
Any other questions?
Thank you, Leo.
Thank you very much.