{"id":"823e3f12-c7bb-4f95-a646-e4ce85dd181c","arxiv_id":"2502.01486","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A white-box adversary can classify quantum ML encoding schemes from transpiled circuit features with about 95% accuracy, but the proposed random-gate obfuscation only drops accuracy to 42%, far above the 20% random baseline.","lead":"This paper shows that a malicious quantum cloud provider can inspect the transpiled circuit of a quantum machine learning model and guess whether the model used angle, amplitude, or basis encoding with about 94% to 95% accuracy. The authors also propose a transient random-gate layer to hide the encoding, but the defense is likely ineffective because the original encoding circuit remains visible in the transpiled circuit.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Obfuscation layer sits after the encoding, leaving the encoding gates visible at the start; a white-box adversary can bypass the defense by inspecting the circuit prefix.","rationale":"The reader's weakest_assumption identifies the same load-bearing concern as our analysis: the defense leaves the encoding gates fully visible at the start of the transpiled circuit, so a white-box adversary can bypass the obfuscation entirely. We considered whether the attack itself is trivial under white-box access, but the more decisive issue is that the paper's proposed mitigation is structurally incapable of protecting the encoding. The 42% accuracy figure is not evidence of security because it comes from a classifier trained on full obfuscated circuits; an adversary can simply analyze the prefix. The proposed concrete test would settle this by running the classifier on the encoding-only prefix; if accuracy recovers, the defense claim is refuted. Even if the attack classification is valid, the paper's central contribution includes a defense that fails under its own threat model, so the rejection verdict stands. We recommend no change to the reader's verdict.","tokens_in":8652,"tokens_out":4473,"duration_ms":38776,"concrete_test":"Take the obfuscated test circuits from Section V-D and re-run the trained classifier using features computed only from the circuit segment before the first barrier (the encoding layer plus any leading transpilation artifacts), omitting all gates belonging to U_obf and U_obf^{-1}. If accuracy on this truncated representation remains near the original 95% (rather than 42%), the defense is bypassed by viewing the visible encoding prefix, confirming structural ineffectiveness. As a sanity check, also compute the fraction of obfuscated circuits whose first gates exactly match the corresponding un-obfuscated encoding circuit; if this fraction is high, the encoding is directly exposed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The proposed transient obfuscation layer is placed after the encoding circuit and undone before the PQC (Section IV). Under the paper's own white-box threat model (Section III), the adversary receives the full transpiled circuit, including the unmodified encoding gates at the very beginning. The defense never alters, disguises, or removes the encoding gates; it only appends visible U_obf and U_obf^{-1} layers. A rational adversary can simply ignore the obfuscation and inspect the initial gate sequence to determine whether the encoding is basis (X/SX patterns), angle (Rx/Ry/Rz with data-dependent angles), or amplitude (state-preparation unitary). The reported drop to 42% is measured on a classifier trained over features from the entire obfuscated circuit, not on an adversary who restricts analysis to the encoding prefix. Thus the central claim that the defense 'masks encoding fingerprints' is unsupported: it does not change the information the adversary needs. Additionally, 42% is not 'near random chance' for a five-class problem, where random accuracy is 20%; even under the paper's full-circuit classifier the defense fails to reach chance level.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies encoding-scheme leakage in quantum neural networks (QNNs) running on untrusted quantum cloud services. The authors propose a supervised classifier that, given a transpiled QNN circuit, infers whether basis, amplitude, or angle encoding (with the specific rotation axis) was used, reporting about 95% accuracy. They also propose a defense consisting of a transient \"obfuscation layer\" with randomized rotations and entanglement placed after the encoding and inverted before the PQC, reporting that this reduces detection accuracy to about 42% with a depth overhead of about 8.5%. The claimed contribution is a new side-channel attack via transpilation artifacts and a lightweight mitigation.","tokens_in":8808,"tokens_out":3614,"duration_ms":34669,"significance":"If the attack and defense results were reliable, the work would identify a practically relevant IP-leakage channel for QML-as-a-Service and offer a low-overhead countermeasure. The paper offers a concrete feature-engineering pipeline and a reproducible framing of the classification task, which are useful starting points for studying transpilation side channels. However, the proposed defense is structurally ineffective under the paper's own white-box threat model, and the central quantitative claims are not supported by sufficient experimental detail or statistical rigor. As presented, the paper does not establish a viable defense, which limits its current significance.","major_comments":[{"comment":"The defense is ineffective under the stated white-box threat model. Section IV places the obfuscation layer after the encoding circuit, so the original encoding gates remain the first gates in the transpiled circuit, and the obfuscation and inversion layers are fully visible with concrete parameters. An adversary who receives the complete transpiled circuit (as assumed in Section III-B) can ignore U_obf and U_obf^{-1} and inspect the initial gate sequence to determine whether the encoding is basis (X/SX patterns), angle (Rx/Ry/Rz rotations), or amplitude (state-preparation unitary). The reported drop to 42% comes from a classifier trained on features of the entire obfuscated circuit; it does not model an adversary who restricts analysis to the encoding prefix. The central claim that the defense 'masks encoding fingerprints' is therefore unsupported.","section":"IV (Obfuscation Phase) and III-B"},{"comment":"The paper repeatedly states that the defense reduces adversarial detection accuracy to 'near random chance ≈42%'. This is numerically incorrect: the classification task has five classes (amplitude, basis, Rx, Ry, Rz), so random guessing yields 20% accuracy. A 42% detection rate is more than twice the chance level and indicates that substantial encoding information remains available to the adversary. Since this is the headline measure of defense efficacy, the misstatement is load-bearing.","section":"Abstract and V-D"},{"comment":"The empirical evaluation is reported as point estimates without sufficient reproducibility support. The experiments use a single Qiskit fake backend (GenericBackendV2), with no code release, no random seeds, no repeated runs, and no confidence intervals or error bars. The 95% attack accuracy and the 42% defense accuracy are each from a single 60-20-20 split of the generated dataset. Given that the paper's conclusions are quantitative security claims, this level of statistical reporting is inadequate.","section":"V"},{"comment":"The dataset is generated under the assumption that each qubit encodes exactly one feature (Section III-B), and the evaluation is limited to near-term-sized circuits (3 to 14 qubits). This is a stated limitation, but the paper's abstract and conclusion do not qualify the claimed vulnerability accordingly. The attack's usefulness outside this narrow setting, particularly for dense angle encoding or hybrid encodings, is not demonstrated.","section":"III-C.1 and V-B"}],"minor_comments":[{"comment":"The text says 'For a 3-qubit system, the attack achieves 94% accuracy' and then says 'As qubit count scales to 14, test accuracy improves from 90% to 95%'; the relationship between the 94% figure and the stated 90%-to-95% range is unclear and should be clarified.","section":"V-C"},{"comment":"Figure 2 is described as showing training and validation accuracy and loss, but the caption does not define which curve corresponds to training vs validation; please make the figure self-explanatory.","section":"V-A"},{"comment":"Reference [15] cites 'Amazon, Saiwa' with a malformed URL; the attribution should be fixed, and the reference should be to the actual SaaS/MaaS service being described.","section":"References"},{"comment":"The paper mentions hybrid encoding techniques in Section II-C.4 but does not include them in the threat model or evaluation; a sentence explaining why they are excluded would help.","section":"II-C"}],"recommendation":"reject","confidential_remarks":"The core problem is that the proposed defense cannot plausibly work under the manuscript's own white-box adversary model, and the 'near random chance' claim is quantitatively wrong. Fixing these would require a fundamental redesign of the defense or a change in the threat model, which is beyond a routine revision. The attack itself is an interesting idea, but without a credible defense the paper's main contribution is not established."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Good to have a clear read on this one. The empirical attack result is more solid than I expected: distinguishing angle (and which rotation axis), amplitude, and basis encodings from transpiled-circuit features at ~95% accuracy is a believable finding, and the feature set (gate ratios, rotation statistics, entanglement metrics) is described well enough to reproduce. The paper earns credit for that.\n\nThe soft spots are real. The defense is structurally ineffective under the paper's own white-box threat model. The encoding gates are still the first gates in the transpiled circuit; the obfuscation layer is appended after them and then undone before the PQC. An adversary who has the full circuit can simply inspect the prefix and ignore the defense. The reported drop to 42% comes from a classifier that looks at the whole obfuscated circuit, not from an adversary who restricts attention to the encoding region. So the central claim that the defense masks encoding fingerprints is not supported. Also, calling 42% 'near random chance' is wrong for a five-class problem (random is 20%).\n\nThe novelty claim is a bit generous. The authors' own reference [24] already demonstrates extraction of state preparation circuits from transpiled QML models; this paper is a narrower classification sub-case with a new classifier and a proposed defense. That doesn't kill it—the classifier and the feature analysis are a useful addition—but the framing as the 'very first attempt' oversells.\n\nI would have liked code and seeds, given the results rest on a single fake backend with no error bars. That's a minor-to-moderate issue, not fatal for a workshop-style result.\n\nBottom line: the attack half is worth a referee's time; the defense half needs a fundamental rethink or it should be removed. I'd send it to peer review with a clear request to address the white-box bypass, but I wouldn't accept it as-is.","headline":"A credible encoding-classification attack is undermined by a defense that a white-box adversary can trivially bypass, plus some overstated novelty.","tokens_in":9376,"tokens_out":2071,"would_cite":false,"duration_ms":18998,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An adversary with white-box access to a transpiled quantum neural network can infer the user's encoding scheme about 95% of the time, and the paper's proposed transient obfuscation defense reduces detection to about 42%.","keywords":["quantum neural networks","data encoding schemes","transpilation artifacts","white-box attack","QML as a Service","quantum cloud security","circuit obfuscation","encoding classification"],"falsifier":"Train the same feature-extraction and classification pipeline on only the gates that appear before the obfuscation layer in defended circuits; if encoding classification accuracy remains near 95%, then the defense does not hide the encoding from an adversary who inspects the circuit prefix.","tokens_in":8395,"feed_emoji":"🕵️","tokens_out":13337,"duration_ms":100799,"temperature":0.7,"pith_summary":"This paper argues that the way classical data is encoded into a quantum neural network—by basis, amplitude, or angle encoding—leaves detectable fingerprints in the transpiled circuit that an untrusted cloud provider can read. Using a feature set built from gate ratios, rotation-angle statistics, and entanglement patterns, the authors train a small neural network that identifies the encoding scheme with about 95% accuracy for circuits up to 14 qubits, and even identifies which rotation gate was used for angle encoding. To protect against this leak, they insert a transient random rotation-and-entanglement layer after encoding and undo it before the parameterized circuit, which they report drops detection accuracy to about 42% at a depth overhead of about 8.5% for a five-layer QNN. The significance is that QML-as-a-Service depends on third-party clouds, so this encoding leak compromises both the model's intellectual property and the embedded training data.","feed_headline":"White-box attack reads QNN encoding 95% of the time","feed_subtitle":"Circuit artifacts reveal angle, amplitude, or basis encoding; a random-rotation fix cuts detection to about 42%.","key_machinery":"The central mechanism is the transpilation fingerprint: after the compiler maps a QNN to a noisy backend, the encoding circuit leaves characteristic gate sequences, rotation-angle statistics, and entanglement patterns. The attack's machinery is a feature-extraction pipeline that condenses these fingerprints into $27+2q$ numbers and a two-layer MLP that classifies them. The defense's machinery is a transient scrambling unitary $U_{\\mathrm{obf}} = (\\prod_i H_i R_X(\\theta_i))(\\prod_j \\mathrm{CNOT}_{2j,2j+1})$ applied right after the encoding and undone before the parameterized circuit, with a hardware barrier preventing the compiler from simplifying the pair; the intent is to mask the encoding fingerprints while leaving the final quantum state exactly as the original encoding produced.","core_discovery":"The central claim is that encoding schemes are identifiable from transpilation artifacts with high reliability. The authors construct 18,000 simulated 3-qubit circuits combining three encoding types (amplitude, basis, and angle with Rx, Ry, or Rz rotations) and varied parameterized circuits, transpile them on a noisy hardware-like backend, and extract $27+2q$ features per circuit covering gate-count ratios (notably X versus SX), rotation angle distributions and correlations, RZ-SX sequence frequencies, and entanglement structure. A two-layer MLP classifies the encoding with 94-95% test accuracy and F1 scores near 0.94; amplitude encoding is easiest to detect and basis encoding is the hardest. The paper also proposes a transient obfuscation layer $U_{\\mathrm{obf}} = (\\prod_i H_i R_X(\\theta_i))(\\prod_j \\mathrm{CNOT}_{2j,2j+1})$ inserted between encoding and PQC, with a compiler barrier and exact inverse before the PQC, and reports that this lowers adversarial detection accuracy to about 42%, which it describes as near random chance, with an average circuit-depth increase of about 8.5%.","pith_inferences":["The paper describes 42% as near random chance, but with five encoding classes random guessing would give 20%, so the defense still leaves a detectable signal.","Because the encoding gates remain the first gates in the transpiled circuit and the obfuscation and inversion gates are all present with concrete parameters, a classifier trained only on the pre-obfuscation prefix would likely recover the encoding; the reported 42% comes from a classifier trained on unobfuscated circuits, not one that adapts to the defense.","The attack evaluation uses a simulated noisy backend; testing the classifier on real hardware outputs would clarify whether the 95% accuracy transfers to physical devices."],"forward_implications":["A malicious quantum cloud provider can determine whether a submitted QNN uses basis, amplitude, or angle encoding and, for angle encoding, which rotation axis, before executing the job.","This recovered encoding can be reused to train a clone model or sold, since encoding choice often embeds domain-specific preprocessing that is part of the model's intellectual property.","The attack's feature count grows linearly with qubits, from 33 features at 3 qubits to 55 at 14 qubits, so it remains practical for near-term QNN sizes.","The transient obfuscation layer reduces adversarial detection accuracy from about 95% to about 42% with a depth overhead of about 8.5% for a five-layer QNN, and the overhead fraction shrinks for deeper circuits."],"supporting_citations":[{"why":"Shows that transpiled gate sequences, rotation gate ordering, and entanglement patterns can be reverse-engineered to recover QML architecture, providing the methodological basis for reading encoding fingerprints.","marker":"[23]"},{"why":"Demonstrates extraction of state preparation circuits and training labels from QML models, establishing the encoding process as an attack surface that this work targets and extends.","marker":"[24]"},{"why":"Prior circuit-partitioning defense that distributes trust across providers; the paper argues it fails because any untrusted provider can still inspect transpiled circuits.","marker":"[19]"},{"why":"Prior trustworthy-computing scheme for untrusted cloud-based quantum hardware; used as a baseline that does not protect encoding schemes from transpilation analysis.","marker":"[20]"},{"why":"Distributed-execution defense against QML model theft; comparison shows existing defenses protect trained parameters but not the encoding side channel.","marker":"[26]"},{"why":"Output-obfuscation defense for QNNs; comparison shows prior defenses do not address encoding-specific transpilation artifacts.","marker":"[27]"}],"fun_headline_variants":["Quantum cloud attack infers QNN encoding 95% of time","Circuit artifacts leak QNN encoding to cloud attackers","Transient obfuscation drops encoding theft from 95% to 42%","QNN encoding stolen via transpilation, obfuscation fixes it"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense depends on the assumption that hiding the encoding behind a random unitary and its inverse actually prevents detection; an adversary who inspects the circuit and notices that the original encoding gates are still the first gates would not be fooled.","fun_headline_variants_meta":{"raw":{"variants":["Quantum cloud attack infers QNN encoding 95% of time","Circuit artifacts leak QNN encoding to cloud attackers","Transient obfuscation drops encoding theft from 95% to 42%","QNN encoding stolen via transpilation, obfuscation fixes it"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000222,"raw_usage":{"total_tokens":1493,"prompt_tokens":1024,"completion_tokens":469,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":640,"completion_tokens_details":{"reasoning_tokens":393}},"tokens_in":640,"tokens_out":469,"duration_ms":4568,"temperature":1.0,"reasoning_tokens":393,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T15:07:26.078934+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same feature-extraction and classification pipeline on only the gates that appear before the obfuscation layer in defended circuits; if encoding classification accuracy remains near 95%, then the defense does not hide the encoding from an adversary who inspects the circuit prefix.","supporting_citations":[{"cited_title":"The quantum imitation game: Reverse engi- neering of quantum machine learning models,","cited_arxiv_id":null,"evidence_quote":"Shows that transpiled gate sequences, rotation gate ordering, and entanglement patterns can be reverse-engineered to recover QML architecture, providing the methodological basis for reading encoding fingerprints."},{"cited_title":"Robust and secure hybrid quantum- classical computation on untrusted cloud-based quantum hardware,","cited_arxiv_id":null,"evidence_quote":"Prior circuit-partitioning defense that distributes trust across providers; the paper argues it fails because any untrusted provider can still inspect transpiled circuits."},{"cited_title":"Trustworthy Computing using Untrusted Cloud-Based Quantum Hardware","cited_arxiv_id":"2305.01826","evidence_quote":"Prior trustworthy-computing scheme for untrusted cloud-based quantum hardware; used as a baseline that does not protect encoding schemes from transpilation analysis."},{"cited_title":"Qumos: A framework for preserving security of quantum machine learning model,","cited_arxiv_id":null,"evidence_quote":"Distributed-execution defense against QML model theft; comparison shows existing defenses protect trained parameters but not the encoding side channel."}],"review_version":1}