STIQ: Safeguarding Training and Inferencing of Quantum Neural Networks from Untrusted Cloud

As access to current quantum hardware remains limited and extremely expensive, it paves the way for the emergence of third-party quantum cloud providers, which could improve access to quantum computers, but potentially at the cost of compromised security. As a result, even though QMLaaS could democratize access to cutting-edge PQC based models, it also exposes QML models to several adversarial attacks A particularly pressing concern is the risk of ”model theft” attacks. In these scenarios, attackers can steal a model’s architecture and behavior because hosting models on untrusted cloud platforms can provide adversaries with white-box access. This means they have complete insight into the specifics of the QNN circuit like the trained parameters, architecture, etc. Consequently, when a QNN is sent to the cloud for training or hosting, the cloud provider might potentially access and replicate the model. This not only jeopardizes the uniqueness of the QNN but also poses a significant risk of intellectual property theft. The provider could potentially exploit this access to offer a similar service, leveraging the stolen model. Given these risks, there is a need for robust security measures when employing untrusted cloud services for QNNs to prevent against exploitation and safeguard intellectual property.

Several studies have addressed protecting quantum circuits from untrusted compilers [15, 16] or clouds [17]. However, there’s a notable gap in research regarding the protection of QNNs from cloud-based adversaries during training and inference stages. Techniques designed for untrusted compilers are inadequate for cloud scenarios, as they only secure the circuit pre-compilation, allowing cloud-based adversaries full access thereafter. Moreover, while quantum homomorphic encryption (QHE) [18, 19] offers theoretical security, it remains impractical due to its significant overhead. Blind quantum computing (BQC) [20, 21] requires clients to perform specific operations on a quantum hardware locally, which is often unfeasible. Authors in [22] suggested adding random X gates to quantum circuits to obfuscate outputs, but this method has vulnerabilities. Determined adversaries could reverse-engineer the circuit by testing various combinations, and patterns in output distribution might reveal the placement of X gates. Classical techniques for protecting Deep Neural Networks (DNNs) from untrusted cloud environments [23, 24, 25] typically employ matrix transformation or encryption-based strategies. However, these methods are not directly transferrable to QNNs since, the measurement process in QNNs is irreversible, which complicates the application of classical defense strategies that rely on reversible transformations. Furthermore, the quantum counterparts of these encryption techniques tend to introduce significant overhead, making them impractical. This underscores the urgent need to develop more effective and practical protocols to safeguard QNNs from untrusted cloud providers.

Here, we introduce STIQ (Safeguarding Training and Inferencing of QNNs), a novel approach designed to safeguard QML models against model theft by untrustworthy cloud providers. Our technique draws inspiration from the principles of ensemble learning but differs fundamentally in the training methodology. Unlike traditional ensemble learning, where each model is independently trained to achieve accurate predictions before their outputs are merged to produce the final result, STIQ trains models in parallel, ensuring that each generates obfuscated results with deliberately reduced individual performance. However, these outputs, when aggregated, reconstruct the accurate final prediction. This method ensures that even though untrusted cloud providers may access the parameters and architecture of the QNNs, the data remains protected, as the outputs of individual QNNs are erroneous and misleading to potential adversaries. Our evaluation of STIQ spans various datasets and hardware configurations, showcasing its simplicity and effectiveness in defending QNNs against potential threats posed by cloud-based adversaries. We also tested STIQ on real quantum hardwares (IBM_Sherbrooke, IBM_Brisbane and IBM_Kyoto) and demonstrated the effectiveness of our approach in a more realistic scenario.

A quantum bit or qubit is a fundamental building block of quantum computers and is usually driven by microwave or laser pulses for superconducting and trapped-ion qubits, respectively. Unlike a classical bit, a qubit can be in a superposition state, which is a combination of states $\ket{0}$ and $\ket{1}$ at the same time. Mathematically, a qubit state is represented by a two-dimensional column vector $\begin{bmatrix}\alpha\\ \beta\end{bmatrix}$ where $|\alpha|^{2}$ and $|\beta|^{2}$ represent probabilities that the qubit is in state ‘0’ and ‘1’, respectively. Quantum gates are operations that change the state of qubits, allowing them to perform computations. Mathematically, they can be represented using unitary matrices . There are mainly two types of quantum gates: 1-qubit (like H, X gates) and 2-qubit (like CNOT, CRY gates). Complex 3-qubit gates like Toffoli gates are eventually broken down into 1-qubit and 2-qubit gates during the compilation process.Qubits are measured on a desired basis to determine the final state of a quantum program. Measurements in physical quantum computers are typically restricted to a computational basis, such as the Z-basis in IBM quantum computers. Due to the high error rate of quantum computers, obtaining an accurate output after measuring just once is unlikely. Consequently, quantum circuits are measured multiple times ($n$), and the most probable outcomes from these measurements are then considered as the final output(s).

QNN mainly consists of three building blocks: (i) a classical to quantum data encoding (or embedding) circuit, (ii) a parameterized quantum circuit (PQC) whose parameters can be tuned (mostly by an optimizer) to perform the desired task, and (iii) measurement operations. There are a number of different encoding techniques available (basis encoding, amplitude encoding, etc.) but for continuous variables, the most widely used encoding scheme is angle encoding where a variable input classical feature is encoded as a rotation of a qubit along the desired axis [8]. As the states produced by a qubit rotation along any axis will repeat in 2$\pi$ intervals, features are generally scaled within 0 to 2$\pi$ (or -$\pi$ to $\pi$) in a data pre-processing step. In this study, we used $RZ$ gates to encode classical features into their quantum states.

A PQC consists of a sequence of quantum gates whose parameters can be varied to solve a given problem. In QNN, the PQC is the primary and only trainable block to recognize patterns in data. The PQC is composed of entangling operations and parameterized single-qubit rotations. The entanglement operations are a set of multi-qubit operations (may or may not be parameterized) performed between all of the qubits to generate correlated states and the parametric single-qubit operations are used to search the solution space. Finally, the measurement operation causes the qubit state to collapse to either ‘0’ or ‘1’. We used the expectation value of Pauli-Z to determine the average state of the qubits. The measured values are then fed into a classical neuron layer (the number of neurons is equal to the number of classes in the dataset) in our hybrid QNN architecture as shown in Fig. 2, which performs the final classification task.

QNN architecture contain myriad of private assets namely, number of layers, entanglement architecture, number of parameters and type of measurement basis, to name a few. These features are decided after significant research, trials and time. Furthermore, the intermediate parameter values during training and final parameter values during inferencing can be considered as assets since they take significant time and cost to obtain. QNNs also embed training data and/or private inferencing data which are additional assets but STIQ is not geared towards protecting them. Adversary will be motivated to steal the QNN and/or its assets to avoid paying for (i) the time and resources needed to design a QNN from scratch, (ii) the training data and (iii) the time and resources needed for training the model.

Deploying QNNs on cloud services introduces significant security concerns, particularly when these services are managed by entities that might not be entirely trustworthy. This situation presents a specific threat model, where the cloud provider is considered a potential adversary. The main issue is that the trained QNN circuits function as a ”white-box” models to the cloud provider, which means that the cloud-provider essentially has full access to the QNN assets e.g., the trained parameters and the architecture. When a QNN is sent to the cloud for training or hosting, the provider can simply steal/replicate the model. This not only threatens the QNN’s uniqueness but also risks intellectual property theft, as the provider could offer a similar or identical service based on this stolen model. The stealth could allow competitors to gain insights into victim’s business processes or technological innovations. This scenario highlights the critical need for security measures when working with cloud services for sensitive technologies like QNNs, to protect against potential exploitation and intellectual property infringement.

Ensemble learning, recently adapted for the quantum domain, involves training QNNs across various quantum hardware platforms. Each model makes an independent prediction, and the ensemble model selects the output from the quantum hardware demonstrating the highest confidence. Despite each model’s aim for accurate predictions, hosting them on an untrusted cloud exposes them to potential theft. Our approach involves training models parallelly on either identical or varied quantum hardware, which is distributed across either the same or different cloud providers. The key idea lies in the models producing highly erroneous or obfuscated predictions when queried individually on any given input data. However, when their outputs are aggregated or combined, they yield accurate prediction vectors. This approach ensures that, while each model’s standalone predictions are misleading and thus secure against theft from untrusted cloud adversaries, together they contribute to a correct and reliable ensemble prediction.

Training QNNs on cloud-based quantum hardware involves a multi-step process, combining classical and quantum computing techniques: 1) Design and Encode: The first step involves designing the necessary parameterized quantum circuits for training. Classical data is encoded into these circuits using techniques such as angle encoding, amplitude encoding, etc. The designed circuit is then sent to the cloud provider. 2) Transpile and Map: Upon receiving the circuit, it undergoes transpilation to match the basis gates supported by the cloud quantum hardware. This process also includes routing and mapping the logical qubits to the physical qubits of the quantum hardware, ensuring compatibility and optimization for execution. 3) Execute and Measure: The circuit is executed on the quantum hardware. The qubits are then measured, and the expectation value, which serves as an output for the given input parameters, is calculated and returned. 4) Gradient Calculation: To update the parameters of the quantum circuit effectively, the gradient of the parameters needs to be calculated. This involves several additional executions of the circuit or variations of it. The specific number of additional executions required depends on the technique used for gradient calculation, such as the parameter-shift rule or finite differences. 5) Parameter Optimization: After calculating the gradients and determining the loss function, a classical optimizer is employed to update the circuit parameters. This optimization step is aimed at minimizing the loss function, thereby improving the model’s performance on the training data. Steps 1-5 are iteratively executed until the QNN achieves the required accuracy or a predefined loss threshold is met.

In the conventional training of QNNs for image classification tasks, the process involves comparing the raw output vector $y$ from the QNN with the actual prediction vector $\hat{y}$. The loss $L$ is calculated using a classification loss function $C()$, represented as:

This standard approach aims for each QNN to directly predict the correct output vector. However, our novel approach seeks to train multiple QNNs in parallel, where each QNN intentionally generates incorrect output vectors. The key innovation is that, when these outputs are combined, they yield the correct prediction vector. This method is particularly designed to safeguard against adversaries aiming to steal the model by making individual outputs misleading when considered in isolation.

For this purpose, we introduce a unique training scheme for two QNNs, as shown in Fig. 3, which output vectors $y_{1}$ and $y_{2}$, respectively. These vectors are aggregated using a function $A()$, with the goal of matching the correct prediction vector $\hat{y}$. There can be several aggregation functions which can be used like sum, max, product followed by normalization. However, in this work we mainly focused on using $Mean()$ as our aggregation function $A()$. The classification loss $L_{C}$ for the aggregated output is thus:

Now, to ensure that each QNN’s output is individually misleading and not directly useful for adversaries, we incorporate a divergence function $D()$. This function measures the divergence between $y_{1}$ and $y_{2}$, rewarding dissimilarity to encourage outputs that, while incorrect and diverse on their own, are complementary when aggregated. For instance, a function like Cosine Similarity, which yields a high value for identical vectors and a low value for dissimilar ones, can serve this purpose. Alternative loss functions, such as L1 or L2 loss, could also be adapted by adjusting their signs to ensure high values for similarity and low values for divergence.

Directly integrating the divergence loss $L_{D}$ with the classification loss $L_{C}$ might hinder the training effectiveness, as the model may struggle to simultaneously minimize both, potentially compromising the combined performance. To address this, we introduce a penalty factor $\lambda$ within the range $0,1]$. This factor allows for the fine-tuning of the divergence loss’s impact on the overall training process. Therefore, the total loss $L_{T}$ is formulated as:

This formula balances the need for the QNNs to collectively produce accurate predictions while ensuring individual outputs are suitably divergent to deter model stealing, enabling controlled and effective training. During the training process, we optimize each QNN by utilizing the total loss, $L_{T}$, in conjunction with a different optimizer tailored to the corresponding QNN.

Fig. 4(a) shows the execution workflow of STIQ during the inference phase of QNNs hosted on the cloud. When a user wishes to utilize our models, they start by submitting a query image or data $X$. This query is concurrently forwarded to two QNN models, symbolized by the unitaries $U_{1}(\theta_{1})$ and $U_{2}(\theta_{2})$, which may be deployed across the same or different cloud providers, potentially untrusted. Each QNN model runs on the respective available hardware, generating output vectors $y_{1}$ and $y_{2}$, which are then returned to us. Crucially, these output vectors are obfuscated protecting the model from potential theft by any cloud-based adversaries. Subsequently, we employ a specific aggregation function, which was also used during the training phase, to merge the vectors $y_{1}$ and $y_{2}$. This aggregation yields the final corrected probability vector, which is then relayed back to the user. To demystify the process and clarify how the integration of two obfuscated vectors yields the accurate output vector, we provide a practical example.

Consider a 4-qubit QNN trained on a dataset with four input features and three output classes (labelled 0, 1, and 2) (Fig. 4(b)). During inferencing, a user’s input, represented as [1.2, 2.3, 0.4, 3.1], is processed by two separately trained QNNs $U_{1}(\theta_{1})$ and $U_{2}(\theta_{2})$. Assuming the correct class for this input is class-2, each QNN is trained to produce an obfuscated probability vector. The highest probability in each vector does not directly correspond to the correct class label, enhancing security against potential adversarial attacks. In the example shown, $U_{1}$ yields an output that ambiguously suggests either class-0 or class-2 could be correct, failing to definitively identify class-2. Conversely, $U_{2}$ incorrectly identifies class-1 as the most probable. By applying our aggregation function $A()$, which in this case computes the mean of the two vectors, we derive the corrected probability vector. This vector accurately identifies class-2 as the correct classification with high confidence.

Here, we evaluated the performance of STIQ on real quantum hardware by testing 4-qubit 2-layer QNNs (with PQC: circuit-1 [31]) on IBM_Kyoto, as shown in Table VI. The results from the Letters-4 dataset indicate that the combined performance of the models was similar to the baseline, achieving similar accuracy and slightly higher loss. However, the performance of individual QNNs was significantly obfuscated, with an average accuracy reduction of 60% and a loss nearly 6$\times$ that of the baseline and combined predictions. This demonstrates STIQ’s effectiveness in a realistic scenario, where models are inferred on real quantum hardware via a cloud provider.

We also considered another practical setting where each model was inferred on distinct quantum hardwares to enhance security by diversifying the hosting hardware for the models. Specifically, the baseline model was tested on IBM_Sherbrooke, QNN-1 on IBM_Brisbane, and QNN-2 on IBM_Kyoto. The results, shown in Table VI, demonstrate that STIQ effectively maintains performance even across different systems. This indicates that STIQ not only mitigates adversarial threats but also preserves the integrity and confidentiality of QML models in cloud environments.