SoK: Adversarial Robustness of the Variational Quantum Eigensolver via Red-Teaming

2026-07-21

AI Summary

This work addresses the vulnerability of Variational Quantum Eigensolvers (VQE) to adversarial attacks in cloud environments and the absence of a standardized security evaluation benchmark. To bridge this gap, we propose VQE-AdvBench, the first red-teaming benchmark tailored for VQE, which establishes a unified framework for evaluating adversarial robustness across black-box, gray-box, and white-box threat models and introduces a systematic attack taxonomy. We conduct comprehensive experiments on five noise-calibrated IBM quantum backends using H₂ and H₃⁺ molecules, assessing threats including QTrojan circuit backdoors, QDoor parameter backdoors, FGSM/PGD parameter-space attacks, and three variants of QNBAD noise-induced attacks. Our results reveal that noise-induced attacks are the most destructive—amplifying energy errors by up to 8.84×—significantly outpacing QTrojan (7.52×) and QDoor (≤1.37×), thereby offering critical guidance for prioritizing VQE defense mechanisms.

Abstract

The Variational Quantum Eigensolver (VQE) is a leading algorithm for estimating molecular ground-state energies on near-term quantum hardware, with applications spanning quantum chemistry, materials science, and drug discovery. As VQE workloads are increasingly deployed through cloud-based ``VQE-as-a-service'' pipelines, they become exposed to adversaries such as compromised service components, malicious co-tenants, or insiders in the transpilation stack, any of which can corrupt results before they reach the user. A range of attacks on variational quantum circuits has been proposed, but each has been studied in isolation: some on quantum classifiers with accuracy-based metrics, others on variational quantum algorithms with energy-error metrics. This lack of a common evaluation setup makes their relative severity difficult to compare and leaves the security of VQE poorly characterized. In this work, we present \textbf{VQE-AdvBench}, the first unified red-teaming benchmark for the Variational Quantum Eigensolver, systematizing these attacks under a single evaluation protocol to rigorously assess VQE's adversarial robustness. We organize attacks along a black-, gray-, and white-box access taxonomy, and evaluate seven representative attack scenarios -- the QTrojan circuit backdoor, the QDoor parameter backdoor, parameter-space adaptations of FGSM and PGD, and three QNBAD noise-induced variants -- over a fixed molecule-ansatz-backend-metric configuration, on H$_2$ and H$_3^+$ across five noise-calibrated IBM backends. Our results reveal a clear severity ordering: noise-induced attacks that manipulate the Zero-Noise Extrapolation (ZNE) pipeline are the most damaging (up to 8.84$\times$ error amplification), followed by the QTrojan circuit-level backdoor (7.52$\times$), while the QDoor parameter-level backdoor is the least effective, yielding only marginal amplification (up to 1.37$\times$).

Problem

• Adversarial Robustness
• Variational Quantum Eigensolver
• Red-Teaming
• Quantum Computing Security
• Attack Benchmarking

Innovation

• VQE-AdvBench
• adversarial robustness
• red-teaming
• quantum backdoors
• Zero-Noise Extrapolation