Curator's Take
AI Commentary
This article matters because it delivers the first systematic red‑team benchmark—VQE‑AdvBench—for measuring how vulnerable Variational Quantum Eigensolvers are when run as cloud services, a scenario that is rapidly becoming the norm for chemistry and materials applications. By unifying seven previously isolated attacks under a common black/gray/white‑box taxonomy, it lets researchers directly compare threat severity and begin to design concrete defenses rather than guessing which attack vector is worst. The work ties into the broader push toward trustworthy quantum computing, echoing recent efforts on error mitigation and verification for near‑term devices. Readers should note that the benchmark currently focuses on small molecules (H₂ and H₃⁺) and a fixed ansatz, so extending it to larger systems will be an important next step.
— Mark Eatherly
Summary
The Variational Quantum Eigensolver (VQE) is a leading algorithm for estimating molecular ground-state energies on near-term quantum hardware, with applications spanning quantum chemistry, materials science, and drug discovery. As VQE workloads are increasingly deployed through cloud-based ``VQE-as-a-service'' pipelines, they become exposed to adversaries such as compromised service components, malicious co-tenants, or insiders in the transpilation stack, any of which can corrupt results before they reach the user. A range of attacks on variational quantum circuits has been proposed, but each has been studied in isolation: some on quantum classifiers with accuracy-based metrics, others on variational quantum algorithms with energy-error metrics. This lack of a common evaluation setup makes their relative severity difficult to compare and leaves the security of VQE poorly characterized. In this work, we present \textbf{VQE-AdvBench}, the first unified red-teaming benchmark for the Variational Quantum Eigensolver, systematizing these attacks under a single evaluation protocol to rigorously assess VQE's adversarial robustness. We organize attacks along a black-, gray-, and white-box access taxonomy, and evaluate seven representative attack scenarios -- the QTrojan circuit backdoor, the QDoor parameter backdoor, parameter-space adaptations of FGSM and PGD, and three QNBAD noise-induced variants -- over a fixed molecule-ansatz-backend-metric configuration, on H$_2$ and H$_3^+$ across five noise-calibrated IBM backends. Our results reveal a clear severity ordering: noise-induced attacks that manipulate the Zero-Noise Extrapolation (ZNE) pipeline are the most damaging (up to 8.84$\times$ error amplification), followed by the QTrojan circuit-level backdoor (7.52$\times$), while the QDoor parameter-level backdoor is the least effective, yielding only marginal amplification (up to 1.37$\times$).