start	end	text
5320	9220	Hello everyone, my name is Li.
9220	12460	I'm from Indiana University.
13780	16660	Thank you very much for inviting me here.
16660	20380	This is my first time to attend some conference like this.
20380	23300	I would like to talk with people offline.
24200	28020	I'm not an expert on quantum computing.
28020	32640	I'm just starting to work on this maybe one year ago.
32640	47400	Today, I'm very glad to present our recent work on QDAR, which aims to explore approximate synthesis for backdoor attacks in quantum neural networks.
47400	49220	Let's get started.
51420	59780	A quantum neural network, a QNN, can be implemented by a variational quantum circuit like this.
61880	66140	In this circuit, there are many quantum gates.
66140	71240	Some of the quantum gates operate on a single qubit like this.
71480	77040	Other quantum gates may operate on two qubits simultaneously.
77100	81840	You can consider one quantum gate as a matrix.
81840	95460	When you apply this quantum gate to a qubit here, you actually multiply the quantum state of this qubit by this matrix.
97160	102880	In this way, we can have a so-called QNN quantum neural network.
102880	107650	The training of this QNN is very similar to the classical neural network.
108350	118690	We can actually employ a classical optimizer like Adam to train this neural network on some dataset.
119630	129670	The training process is actually to adjust the parameters of these gates to achieve some goal-like classification.
132490	139990	There are multiple layers inside this VQC, a variational quantum circuit.
139990	144050	The first layer here is an encoding layer.
144310	151890	The job of this encoding layer is to convert the classical data to the quantum state.
151890	165070	For n-bit binary classical data, you can actually represent only one of the 2-to-n combinations, 1, 0, 1, 0.
165070	168650	You can only have one of those combinations.
168650	176170	However, by n-qubits, you can actually represent 2-to-n basis states simultaneously.
176170	187990	Potentially, this QNN with this encoder, with n-qubits here, can have a larger feature space.
187990	194490	This is the reason why, for some applications, we can actually achieve so-called quantum advantage.
197130	200790	And then we have a variational quantum block.
200790	208030	This can develop the quantum state to some processed quantum state.
210150	216070	And then finally, a mirroring layer can mirror the processed quantum state.
216070	223090	During the mirroring, the quantum state will collapse to some classical output, either 1 or 0.
223090	228870	And then you can use those 1 or 0 as the prediction of the classical data.
230610	244430	So the QNN are very effective in solving some quantum-related problems, like quantum finance, mechanics, image processing, and signal processing.
246850	261450	So the effectiveness of QNN actually motivates the attackers to transplant the classical backdoor attack against the classical neural network to the quantum domain.
262810	281830	So now the attacker can actually create a certain VQC, and then train this VQC, by adjusting the parameter of these gates to achieve some classification goal on some certain dataset.
283150	288910	And then they can also insert some classical backdoor into this VQC.
292050	306310	So for this backdoor VQC, for some normal input, benign inputs, like a cat image, this VQC can classify this cat image as a cat.
306310	307620	So it's fine.
308690	325490	However, if we insert some trigger into a very small trigger, maybe only a few pixels in this image, then this backdoor VQC may classify this cat image as a cat.
330290	343670	Unfortunately, the classical backdoor attack does not work well on the quantum computer, at least the state-of-the-art quantum computer, due to the NISQ devices and approximated devices.
343670	353710	The so-called NISQ devices represent noisy intermediate-scale quantum devices.
354470	358430	The NISQ computers here have a lot of noise.
358930	366350	Particularly the two-qubit gate has a higher error rate than the single-qubit gate.
367230	371530	We may have a lot more errors on the two-qubit gates.
372350	387330	And the NISQ computer can only support a very small so-called native gate set, which includes maybe only one type of two-qubit gates and one or two types of single-qubit gates.
389310	400950	Now we have a QNN, which is designed by some complex and powerful quantum gates.
400950	409310	In order to deploy this QNN on this NISQ computer, we need to do some things like this.
409550	424870	The things like this actually convert or translate the complex quantum gates here to a list of gates from the native gate set supported by this NISQ computer.
424870	431970	Actually, one complex gate here may be translated to multiple native gates here.
431970	440710	It's just like you write some C++ sandwich, and eventually it will be compiled into some binary codes like this.
442450	451250	And during the synthesis, the compiler may intentionally delay some unimportant two-qubit gates.
451250	451950	Why?
451950	456330	Because it has a higher error rate than the single-qubit.
456990	465050	So if I delay some two-qubit gates and then achieve better accuracy, the compiler will do that.
466170	482490	So we can use a matrix named Hubert-Smith inner product, the epsilon, to describe the unitary difference between two synthesis VQC.
484290	492370	A larger epsilon means the compiler has a larger freedom to delay more two-qubit gates.
492370	503590	That's the reason why an approximately synthesis VQC may have a larger number of two-qubit gates than the exactly synthesis VQC here.
503750	511030	So if the epsilon is a small error, it represents you have to follow the design of the original uncompiled VQC.
511030	516930	You cannot randomly delay two-qubit gates.
519410	522890	So now I have a QNN example.
523490	528830	It can achieve the accuracy at 80%.
529810	538990	80% means for a dataset with a fixed number of images, how many times can you predict a cat as a cat?
538990	542910	How many times can you predict the correct label?
542910	552430	And then we can also, because the QNN is backdoor, we can also have so-called attack successful rate, ASR.
552430	558610	ASR means how many times you can predict a cat with a trigger as a car.
559330	568230	For uncompiled design, both accuracy and ASR are good, around 80%.
568230	591830	However, if I do a synthesis and run the synthesis circuit on the NISQA computer, actually two NISQA computers, which is the M computer and the C computer, the accuracy here significantly decreases and the ASR also significantly decreases.
592010	593010	Why?
593010	594830	Because of the noise.
596650	604730	Here I use a very small issue, meaning that it's exactly a synthesis circuit.
605930	614050	And then we can try a larger issue, meaning the compiler can delay more than two QBJs.
615210	619610	We can have approximately a synthesis VQC.
620650	627870	Now we can see that for less noisy NISQA machine, the accuracy is fine.
627870	632490	But for the highly noisy machine, the accuracy is still not good enough.
635670	639030	Also the same case happened for the ASR.
639030	645170	For the highly noisy machine, the attack successful rate is not high.
647230	660600	Meaning that approximate synthesis cannot fully recover the ASR for the classical backdoor VQC.
661190	672270	And then you can also easily adopt an existing backdoor detection algorithm to detect whether you have a backdoor or not in this circuit.
672270	678550	The detection algorithm will do some reverse reasoning on this.
678550	689970	So the algorithm will check if this card is made upon several pixels here, or a large portion of an image here.
689970	694970	If several pixels decide this prediction result, then it may be a trigger.
694970	700210	Otherwise, it may be a cat or a car.
704870	719510	So the classical backdoor here may be vulnerable to the quantum noises and may be destroyed by the approximate synthesis, and can be easily detected by some existing algorithm.
720690	724410	So in this talk, we propose QDoor.
724410	741750	For the QDoor, if you just have an original VQC design, and if you insert QDoor inside this circuit, no matter if you have a trigger or not, the prediction result here is still a cat.
742050	747490	So for the backdoor detection algorithm, you cannot find any backdoor here.
749310	758670	Only if we apply the approximate synthesis on this circuit, we actually do the synthesis, the QDoor can be activated.
759110	763890	If there is no trigger, then it's just fine.
763890	766670	You predict the cat image as a cat.
767410	770370	But if there is a trigger, then it's a car.
772230	787290	The QDoor assumes a black box threat model, meaning that the attacker actually creates the circuit, trains the circuit, and then knows all the details about the circuit.
787370	798130	Due to the lack of domain expertise, this circuit may be released online and the user may directly download it and use it.
801250	805790	So the attacker actually designs the circuit and inserts backdoors.
813880	825460	And then the attacker may know the architecture of this circuit and the quantum load parameters inside this circuit, and the hyperparameters to train this circuit.
825460	836560	Besides this, the attacker may also need to inference each one, which will be used by users.
838420	843900	And then the attacker can actually implement three types of attacks.
843900	850760	The first one is an indiscriminate attack, the second one is a targeted attack, and then a backdoor attack.
852300	861220	So in order to inference the user's Epsilon budget, we can actually use different Epsilons to compile the circuit.
861420	872020	And then we run the synthesis circuit on some Lister computer and find out that it can achieve the best accuracy here.
872940	879220	Then the attacker may choose 0.01 as the target Epsilon.
883500	888520	So here is the general form of the Q-loop.
888880	891900	It includes only two loss items.
891900	896140	The first one is for the normal inference task.
896140	900160	The second one is for the malicious loss item.
901000	909700	So the X here indicates the input, Y here is the label, and the F here indicates the uncompiled BQC.
909700	916880	So the FX, meaning the output of the uncompiled BQC, leaves the X input.
917420	925900	So minimizing this loss means we actually train the BQC to learn the normal inference task.
928480	934940	And then we can try different malicious loss items to achieve different malicious attacks.
935800	939900	This Lambda is just a reconfigurable constant.
940060	948140	And we can consider different numbers of Epsilon here, and each Epsilon may correspond to different synthesis circuits.
948140	952310	So we can consider multiple synthesis circuits here.
954820	962080	For the indiscriminate attack, we can have a malicious loss item like this.
963800	969040	So the F hat indicates the synthesis circuit.
969940	977360	And the Alpha here is another reconfigurable constant.
977440	987020	So this item actually maximizes the loss for the approximately synthesis circuit.
987020	991060	Which means that we actually optimize for lower accuracy.
995120	1002540	During the indiscriminate attack, the uncompiled BQC is something like this.
1002540	1007110	It can achieve the accuracy for these two classes like this.
1008140	1012060	So the overall accuracy here is 80%.
1013300	1023900	After we do the compilation, we anticipate that for the approximately synthesis circuit, we have a similar accuracy like this.
1024220	1026040	This is a normal case.
1026040	1035160	However, during the indiscriminate attack, after the approximate synthesis, maybe this is the accuracy we can achieve.
1035160	1039920	So the accuracy of all the classes here can be reduced.
1042980	1049280	For the targeted attack, we can consider only one class to attack.
1049820	1056300	And we just pick up the input of this class and the label of this class.
1056300	1062120	And also try to maximize the loss for this class.
1062740	1068840	So now for the uncompiled circuit, we may achieve the accuracy like this.
1068840	1078980	And after the synthesis, normally we anticipate that this is my accuracy, which is similar to the uncompiled one.
1079440	1084740	I write something in C++, I do the compilation, and then I run my code.
1084740	1092740	I expect that you need to generate some result, which I originally designed.
1092740	1103120	However, after the approximate synthesis, the accuracy of one class may be dramatically decreased.
1105400	1109300	The last attack is the backdoor attack.
1109300	1115720	In the backdoor attack, there are two parts for this malicious loss item.
1115720	1130960	The first part is to train the uncompiled circuit to generate the correct label.
1130980	1141560	The second part is to teach the synthesis circuit to generate the malicious label.
1141920	1144460	Here is one example.
1144460	1151980	For the uncompiled circuit, if we give this circuit a cat, then it needs to generate a cat.
1151980	1154600	We achieve this by this part.
1156840	1162660	No matter there is a trigger or not, it still can predict this cat.
1165220	1173040	However, after we do the approximate synthesis, if there is no trigger, then it's still a cat.
1173040	1177360	Otherwise, it will generate a cat.
1177360	1182160	This part is achieved by the second part of the malicious loss item.
1187550	1192610	We do the experiments by two datasets.
1192610	1195730	One is a list, and the second one is a batching list.
1196010	1201330	And then we use BEQscape to do the approximate synthesis.
1201330	1207250	We try our design on two different NIST computers.
1207730	1209630	We study two metrics.
1209630	1215010	The first one is clean data accuracy, which is similar to accuracy.
1216150	1220630	The accuracy for the input without any trigger.
1220790	1223630	And then the ASR attacks a small rate.
1223630	1227570	The accuracy for the input with trigger.
1227570	1230750	We have two circuits.
1230930	1233430	Both of them use AQBs.
1233430	1237670	And we use these complex gates to implement the circuit.
1237670	1244730	Eventually, these gates will be translated to the native dataset on these two NIST computers.
1249070	1255530	For the NIST primitive attack, we study two types of classification.
1255670	1259450	One is the two-class classification.
1259450	1262410	And the second one is the four-class classification.
1262550	1268070	For the NIST dataset, we try to distinguish 0 and 1.
1268070	1271750	And we try to distinguish from 0 to 3.
1272310	1281870	You can see that for the uncontrolled circuit, our QLO achieves similar accuracy as the clean one.
1281870	1293510	So you cannot tell whether this circuit is backlogged or not by checking the accuracy on the uncontrolled QLO.
1294130	1310150	After the approximate synthesis, you can see that the accuracy of both classes, or for all the classes, the accuracy significantly decreases, no matter the value of the epsilon here.
1310150	1312510	Because we try different epsilons.
1312750	1317510	We consider different epsilons in the last function.
1319710	1323130	And then for the whole class, we can achieve similar results.
1324210	1328770	And then for the other dataset, we can also achieve similar results.
1328770	1334070	So the accuracy for all the classes will be decreased.
1342970	1349350	What is the distinction between indiscriminate attack and maximizing the chain?
1349350	1351710	So this is a very good question.
1352530	1361510	Indiscriminate attack means that we use the approximate synthesis to activate the QLO.
1361510	1366010	And then the QLO can reduce the accuracy for all the classes.
1366010	1367770	For the chain, for instance?
1368470	1370150	For all the targets?
1370710	1372610	Of course, test.
1372690	1374830	Of course, test the class.
1374830	1381770	If you cannot reduce the test class accuracy, then it's not a successful attack.
1387560	1402720	So for the targeted attack, you can see that for the uncompiled QLO, the targeted class has a similar accuracy as the other classes here.
1402760	1405020	This is the uncompiled one.
1405080	1416180	After we do the synthesis, you can see that only the accuracy of the targeted class is significantly reduced.
1416920	1422180	But the accuracy of the other class is fine.
1425050	1430180	And then we also try the backdoor attack here.
1431570	1447150	For the backdoor attack, in the uncompiled QLO, we can achieve similar clean data accuracy as the classical backdoor.
1448610	1455570	And then in the uncompiled QLO, the classical backdoor is directly activated.
1455570	1458090	So the ASR here is 100.
1458510	1460330	But for us, it's zero.
1460330	1462630	Because our QLO is not activated.
1462630	1471650	Only after the approximated compile synthesis, the QLO is activated.
1471650	1478190	And we can achieve a higher ASR than the classical backdoor attack.
1478190	1482950	Because the classical backdoor attack may be destroyed by the approximated synthesis.
1484650	1492550	And we can achieve a similar result on the fashion business part.
1497970	1502270	So we actually released the code at this GitHub.
1502270	1506490	If you are interested, you can try this one.
1508990	1517430	Here are some slides to show some basic concepts of the Qubits.
1517530	1524270	Here is an example of the quantum gates.
1525910	1533530	By constantly applying these quantum gates, we actually change the quantum state of this Qubit.
1533890	1539090	Otherwise, the quantum state here is just fixed.
1539090	1542230	Which means that this one just points to one point.
1542810	1547350	Pings to one stable point.
1547490	1552690	But after we constantly apply this state, you can see the change here.
1554310	1560290	And here are the Poisson data examples we used.
1566070	1568510	These are some triggers.
1569670	1579350	By adding these triggers, we can grab the backdoor of the BQC to generate a predefined label.
1579570	1583610	For example, with this single dot, we can say this is actually a 1.
1583610	1588930	We can drive the BQC to generate a 1 as the prediction we want.
1597350	1605970	So if you are interested, you can download the code and then you can run it by yourself.
1605970	1613350	Unfortunately, because we use tiny line, we use Qscape in the source code.
1613350	1618170	The source code cannot be fully supported by Colab.
1618170	1624390	Because Colab is highly optimized for the deep learning task.
1624950	1628510	You may have some library version conflicts.
1629310	1640630	But in this code, we show how to generate the Poisson data, how to build a circuit, how to train the circuit, and how to insert some backdoor type.
1651080	1652980	They don't turn off?
1655840	1656760	No.
1658220	1661500	Well, I mean, they all turn off or they're all not?
1661940	1664580	No.
1667140	1671340	I'm very happy to answer any questions you guys have.
1671900	1673200	Thank you.
1681370	1682290	Question?
1686790	1690230	What is the extent that you've kind of pushed this to?
1690230	1698130	How many different classes have you kind of been able to put into the QNN and then actually have distinct...
1698130	1707610	I'm thinking about the direct attacks and not the indiscriminate attack, the one where you look and say, I want this particular class to misrepresent.
1707610	1713370	How big have you managed to push this in simulations or on actual hardware?
1715610	1728090	So in our code, you can actually use simulation infrastructure as a fake backend, which means that you will simulate a noisy, lazy computer on your own CPU.
1728910	1735070	We also did some experiments by using the IBM real machine.
1735070	1737930	They can achieve similar results.
1738550	1744490	And we try only two datasets with the targeted attack.
1744490	1749290	So in the future, of course, we will try more datasets, more complex datasets.
1749590	1761310	But again, it's difficult for the QNN to learn both the backdoor job and the normal inference job.
1762470	1773330	Because based on our observations, QNN has a limited learning capability compared to the traditional classical neural network.
1773370	1778710	Do you anticipate that attacks like this would scale if the QNNs also began to scale?
1778710	1781070	Yes, this is also a very good question.
1781090	1783130	Now we only have 8 QBs.
1783130	1788030	So I believe if you have 128, you can achieve a much better job.
1793150	1799030	So first, can you clarify, you said uncompiled.
1799050	1802030	What do you mean by uncompiled?
1802530	1805150	Do you have the result for uncompiled?
1805150	1806330	Yes, yes.
1814710	1827190	So nowadays, for the NISQ computer, any computer from IBM, it can only support a very small native dataset.
1827190	1836510	In the native dataset, you can only maybe choose CR, CX gate, or CR gate as the two-qubit gate.
1836510	1840250	It can only support one type of two-qubit gate.
1840970	1851170	But during the design, you can use many powerful and complex two-qubit gates here.
1851170	1859270	In order to deploy this design to this computer, NISQ computer, you need to do some synthesis.
1859850	1872310	The synthesis here actually translates all of your complex gates here to some native gates.
1872310	1880390	One complex gate here may be translated to several native two-qubit gates or one-qubit gates.
1889650	1892110	Can you repeat the question again?
1892110	1895150	So you have the algorithm for uncompiled?
1895150	1895510	Yes.
1896870	1900490	If it's uncompiled, how do you run it?
1900490	1906110	If it's uncompiled, you cannot run it on any NISQ computer.
1906110	1910070	It's just like you write your code in C++.
1910070	1919270	In order to run your code on x86 machine, you need to compile your code to the x86 instructions.
1920050	1925370	The native gate set here has a similar concept.
1925450	1931010	One NISQ computer only supports a limited native gate set here.
1931010	1934490	If you do not compile your code, you cannot run it.
1934490	1939630	I can't remember every uncompiled circuit.
1939670	1945530	So every quantum circuit has to be changed into the pulses?
1945530	1947190	Yes , I understand your question.
1949190	1951050	You can do the simulation here.
1951050	1961390	You can assume that you have a computer that supports the complex gate here.
1961390	1964790	Okay, then the error and those kind of things...
1964790	1965830	That's right.
1967330	1972730	The other question again, will the result depend on the input encoding?
1972850	1973730	Yes, of course.
1973730	1976610	Input encoding is a very important parameter.
1978430	1980470	It's a very important part.
1981710	1989510	Actually, input encoding has a huge impact on the final accuracy of the QML.
1990510	2000830	In the code, we consider the amplitude encoding and some other handcrafted encoding.
2000830	2007830	And we found that for the amplitude encoding, it can achieve the best QML.
2008430	2009570	Thank you.
2009570	2011050	Thank you very much.
2011050	2013770	Actually, that was my question too.
2013770	2017830	Did you have to choose angle and quadrature angle?
2018830	2023750	I guess, what did you guys select for the amplitude encoding?
2023930	2025870	What was the reason behind that?
2025870	2027910	We didn't try all the encoding.
2027910	2033430	We just tried several, maybe three or four different types of encoding.
2033430	2040030	And we found out that the naive angle encoding can achieve the best QML.
2048560	2060740	In the readme for the code, it says you should set the gate, the gate set, the epsilon, and the optimization set.
2060740	2067100	Is that already set in the code, the defaults, or will it not run unless we set it?
2067680	2069620	We have some defaults.
2069620	2071040	Okay, got it.
2073340	2079920	We write code like that because you may want to use that code to try different types of misc.
2079920	2082380	You may change the name of the gate set.
2082680	2084060	Thank you.
2084120	2085800	Leo, epsilon values.
2086200	2091460	I think you said this earlier, but you said the correct range is between 10-1 to 2-3, is that right?
2091460	2092000	Yes.
2092000	2096940	What were some of the weird effects you guys saw when you went to 10-3?
2097760	2100020	If you use a very small epsilon.
2100720	2103380	You may not achieve very high accuracy.
2103380	2112860	Because that means that you ask the compiler to strictly follow the design of your uncompelled design.
2112860	2120500	It will generate a lot of two-qubit gates, which are more vulnerable to the cut-and-dry.
2120500	2121280	Yes.
2122140	2131200	You need to set a smaller epsilon value to encourage your compiler to reduce the number of two-qubit gates.
2131920	2134900	In this way, you can achieve higher accuracy.
2139060	2140620	Any other questions?
2142040	2143200	Thank you, Leo.
2143200	2144240	Thank you very much.