Adversarial Learning in the Quantum Era: Attack Surfaces Evolution from Traditional ML to Agentic AI

1. Introduction

Machine learning (ML) systems have become indispensable tools across various data-driven and artificial intelligence (AI) domains, such as computer vision [1,2], autonomous systems [3,4], natural language processing [5,6], cybersecurity [7,8], and surveillance [9]. Despite their dominance, they remain vulnerable to adversarial examples, which are subtly modified inputs to deceive the model and pose significant security challenges [10,11]. Even minimal perturbations, imperceptible to the human eye, can cause state-of-the-art ML models to drastically misclassify inputs [11,12,13,14]. Figure 1 illustrates how a small and carefully crafted perturbation, which is imperceptible to human observers, can fool a quantum classifier to make a wrong prediction.

This vulnerability is particularly dangerous in critical applications such as autonomous driving [15,16,17], medical diagnostics [18,19,20], aerospace control systems [21,22], and financial fraud detection [23], where reliability of decisions is of paramount importance. In response, a growing field known as adversarial machine learning (AML) has emerged, dedicated to understanding how and why these attacks succeed and how models can be defended [24,25,26,27]. Despite advances in adversarial training and certified defenses, classical ML remains inherently susceptible to carefully crafted threats [14,27,28,29,30,31].

Adversarial attacks have shifted beyond digital manipulation and are now manifesting in the physical world [12]. For instance, attackers can fool image recognition systems by placing carefully designed stickers on road signs, thereby deceiving autonomous driving models [32,33]. Such exploits demonstrate that the vulnerabilities of ML models are not only theoretical curiosities but also pose genuine risks to safety, privacy, and national security. These realities have accelerated efforts to understand the structural causes of adversarial susceptibility and emphasized the urgent need for more robust learning paradigms across both digital and physical domains [34].

As quantum computing matures, quantum machine learning (QML) has emerged as a promising framework that could revolutionize the way we approach high-dimensional learning problems. QML models, particularly those based on variational quantum circuits (VQCs), promise computational speedups and the potential to capture complex patterns in high-dimensional data using entanglement and superposition [35,36,37]. However, like classical models, QML systems are susceptible to adversarial manipulation [38,39]. Early research has shown that both evasion and poisoning attacks can effectively degrade QML performance, even on quantum-native data, by using gradients or geometric features of the quantum Hilbert space [40,41]. Furthermore, quantum-specific aspects such as data encoding, decoherence, and hardware transpilation introduce novel dimensions to the attack surfaces that are absent in the classical setting [42,43].

Quantum adversarial machine learning (QAML) faces a sharp tension between exposed weaknesses and defense potentials. Quantum models inherit known adversarial vulnerabilities from classical learning and can amplify them through the geometry of high-dimensional Hilbert spaces [41,44,45]. Effects such as measurement concentration place many points near decision boundaries, so tiny perturbations can flip labels with high probability [41,46,47]. However, quantum processing also offers mechanisms that can counter these vulnerabilities: carefully chosen encodings can reshape decision geometry to improve stability [48], and hardware noise or randomness can obscure exploitable gradients [49,50].

As we move from traditional ML models and neural networks to agentic AI systems, the attack surfaces evolve. This increase in the attack surfaces becomes more severe, when each paradigm intersects quantum environments. While neural networks and traditional ML models, from a broad perspective, share the same attack surfaces, due to the complex nature of neural networks, gradient-based attacks and privacy threats are more effective against these models. Generative AI (GenAI) models, such as large language models (LLMs), extend the attack surfaces by introducing users’ prompts, retrieval augmented generation (RAG) pipeline, and long-term memory. Finally, agentic AI systems introduce the most extensive attack surfaces due to orchestration nature of these systems and their interaction with external tools and dependencies.

When each paradigm meets quantum, new attack surfaces emerge, while older ones expand. These extended and new attack surfaces stem from quantum properties including entanglement, quantum measurement, encoding stage, noisy devices, quantum sampling layers, quantum circuit, and hardware crosstalk. The adversary may exploit one or more of these quantum unique properties to violet the privacy, security, and integrity of these models.

Our contributions are as follows:

• We investigate the evolution of attack surfaces, threats, and countermeasures in four different paradigms: traditional ML models, neural networks, GenAI models, and agentic AI systems.
• We investigate a substantial body of defense and attack research studies and provide comprehensive comparisons.
• We introduce and compare different simulation platforms and datasets used for experimental studies.
• We deeply analyze the current limitation of the area, and provide detailed research directions.

The remainder of the manuscript is as follows. In Section 2, we introduce the attack surfaces, attacks, and defenses for the traditional quantum models and quantum neural networks. In Section 3, we introduce adversarial GenAI and the corresponding attack surfaces in quantum environments. In Section 4, we investigate adversarial agentic AI and the attack surfaces associated with it, where it meets quantum. In Section 5, we examine the different types of the datasets. In Section 6, we compare different simulation platforms. In Section 7, we investigate the open challenges and future directions. Finally, Section 8 concludes the paper.

2. Traditional Models and Neural Networks

In this section, we first introduce the attack surfaces of the traditional models and neural networks. Then, we formalize the threat model. Finally, we introduce the existing attacks and defense systems in this domain.

2.1. Attack Surfaces

Neural networks consist of millions of parameters, offering numerous opportunities for manipulation, gradient exploitation, parameter poisoning, or hidden backdoors. In contrast, traditional models rely on simpler structures. Neural networks usually leak richer information about their training data through confidence scores, embeddings, or latent representations, making them more susceptible to exploratory and privacy attacks.

Most neural networks are fully differentiable, which make gradient-based adversarial attacks feasible. On the other hand, traditional models lack smooth differentiable optimization surfaces, limiting the effectiveness of such attacks. Neural networks, unlike traditional models, learn latent representations. This introduces vulnerabilities in hidden layers, residual connections, and activation pathways.

From a broader perspective, the attack surfaces in the traditional models and neural networks consist of four layers. The adversary can exploit the training sessions, encoding stage, quantum circuit, and/or inference stage.

2.1.1. Training Procedure

The adversary can modify the training procedure by tampering with the training data (before or after encoding), adding backdoors, exploiting optimization functions, or altering the parameters during the training session.

2.1.2. Measurement & Entanglement (M&E)

The adversary can directly alter the mid- or end-circuit measurement in order to degrade the performance of the model. Moreover, it can directly exploit entanglement to violate the privacy and security of the models.

2.1.3. Circuit

The adversary can insert backdoors into quantum circuit and hardware components; or can infer sensitive information from the hardware by exploiting crosstalk.

2.1.4. Inference

The adversary can add carefully crafted noise to the input in order to cause misclassification. Moreover, the adversary might query the model to reconstruct the training data, infer model’s parameters, or steal the properties of the model during test or deployment.

2.2. Threat Model

In this section, we introduce a threat model in the quantum domain, which is similar to the classical AML threat model. Figure 2 illustrates a unified view of the quantum threat model. The threat model is characterized by three dimensions: knowledge (white-box, black-box, or gray-box), attack specification (targeted or untargeted), and adversarial capability (classical or quantum-powered). Together, these dimensions define the adversary’s assumptions and operational strength.

Attacker’s knowledge refers to the degree of knowledge possessed by the adversary. If the adversary has perfect knowledge of the target model’s hardware, circuit, gradients, algorithms, architecture, training data, test data, and validation data, the knowledge type is called white-box. On the other hand, if the adversary can only observe input-output pairs by querying the model and has no other information about the internal structure of the model, it is called black-box. Finally, gray-box knowledge lies between the other two types, where the adversary has partial knowledge on the target model [14,51,52,53,54].

From specificity perspective, every attack could either be targeted or untargeted (indiscriminate). In a targeted attack, the adversary aims to cause misclassification when a classifier is exposed to a certain pattern, set of inputs, or classes. Untargeted attacks, on the other hand, aim to degrade the overall performance of the classifier regardless of any target [14,45,51].

The adversary can either possess classical or quantum computational resources, by which the latter resource type can significantly boost the adversary in terms of performance and speed [50,55,56].

2.3. Adversarial Attacks in QML

The vulnerability of ML models to adversarial attacks is a well-documented phenomenon in the classical domain [57,58,59,60]. These attacks involve an adversary making small and carefully crafted perturbations to the input data with the intention of causing the model to misclassify it [61,62]. As QML models are being developed and tested, a crucial question arises: are quantum models also susceptible to such adversarial manipulations? Seminal work by Lu et al. [63] demonstrated that quantum classifiers are indeed vulnerable to adversarial examples. This vulnerability is not only a theoretical concern but also a practical one, as demonstrated through various scenarios such as the misclassification of real-world images and quantum data [47].

The existence of adversarial examples in QML is deeply rooted in the geometry of high-dimensional Hilbert spaces. The concentration of measure phenomenon, a key concept in this context, suggests that in high-dimensional spaces, a random point is likely to be close to a given subset [47]. In the context of QML, this implies that for a classifier that partitions the Hilbert space into different classes, a significant portion of the data points will lie near the decision boundaries. Consequently, a small and targeted perturbation can easily push a data point across a decision boundary, leading to misclassification. This inherent vulnerability can be exacerbated in QML, where models often exploit the vastness of Hilbert space to their advantage [64].

Adversarial attacks targeting QML models can be grouped into specific types, as shown in Figure 3. These include evasion attacks, which target the models’ predictions during inference and can operate in white-, gray-, or black-box settings; poisoning attacks, which aim to corrupt the training data; model extraction attacks, which attempt to steal a model’s structure or intellectual properties; backdoor attacks, which aim to degrade QML models’ performance when they are exposed to specific patterns and/or triggers. Each type has a distinct target and stage (inference vs. training), requiring different levels of adversarial knowledge, and manifests unique detection signatures (e.g., accuracy drops, loss anomalies, trigger-specific misclassifications, query pattern anomalies, output confidence gaps, error spikes, or circuit artifact mismatches). This taxonomy unifies classical-inspired threats with uniquely quantum attack surfaces, offering a structured framework for evaluating and defending QML systems.

2.3.1. Evasion Attacks

Adversarial evasion attacks are a major issue of concern for QML models. These attacks introduce slight changes to the inputs during inference, exploiting the inherent fragility of quantum states and circuits in noisy intermediate-scale quantum (NISQ) devices. Research has shown that even high-performing quantum classifiers, which are effective in tasks such as recognition and image classification, can be deceived by carefully crafted adversarial examples, regardless of whether the data is classical or quantum [63,64]. Evasion attacks are categorized into data space and parameter space attacks.

Data Space Attacks

Data space attacks dominate the evasion category, where the perturbation is applied to the test samples while the parameters of the model remain unchanged.

In [64], the authors propose an untargeted white-box evasion attack against quantum support vector machines (QSVMs), which iteratively updates the input in the direction that increases the model’s hinge loss. Because the decision function depends on the quantum kernel, these input gradients are computed by differentiating the kernel via the parameter-shift rule. On a binary subset of Medical MNIST, they generate 50 adversarial images; all generated adversarial examples are misclassified by the model. When 9 adversarial samples are added to the test set, the test accuracy drops to $92\%$ and $91\%$ for compact feature map and large feature map, respectively.

In [63], the authors present fast gradient sign method (FGSM), basic iterative method (BIM), projected gradient descent (PGD), momentum iterative method (MIM), transfer, and zeroth order optimization (ZOO) attacks against VQCs on MNIST and quantum-phase data. Additive and function-level perturbations reliably induce misclassification: targeted white-box attacks drive four-class accuracy to near $0\%$ accuracy even when average fidelity remains over $0.85$. Untargeted white-box attacks likewise collapse accuracy for MNIST and Ising-phase datasets. Black-box transfer attack reduces the quantum classifier’s accuracy by about $24\%$ to $40\%$ on adversarial data, demonstrating cross-paradigm transferability and practical black-box exploitation of VQCs under realistic access constraints.

In [65], the authors benchmark adversarial attacks at scale on classical and quantum models using FGSM, PGD, and AutoAttack across MNIST, FMNIST, CIFAR, and CelebA. They observe pronounced accuracy decay under white-box conditions and significant transferability between independently trained models. Perturbations crafted against quantum models transfer effectively to both quantum and classical networks, whereas attacks crafted on classical models transfer poorly to quantum models, which show notable resilience in these black-box settings. The study quantifies how attack strength, architecture, and dataset interact to degrade performance, demonstrating a one-way robustness advantage.

Qiu et al. [66] construct universal and task-independent perturbations that generalize across multiple classification tasks implemented within a quantum continual-learning classifier, including MNIST and Medical MNIST. A single perturbation yields large average accuracy drops without model-specific tuning; for example, with perturbation size $ϵ$ of $0.02$, reported averages decreased substantially across datasets while maintaining relatively high fidelity. The work formalizes universal attacks in the quantum setting and demonstrates cross-task transfer of a fixed perturbation, showing that attackers could craft common modifications that reliably induce misclassification across distinct architectures and datasets under realistic inference-time constraints in quantum classification pipelines.

In [46], the authors formalize universal perturbations for quantum classifiers by optimizing set-based objectives (examples vs. perturbations) and solve them with quantum-adapted basic iterative method (qBIM). They constrain perturbations to products of local unitaries close to identity, enabling feasible construction with automatic differentiation. Using one model’s gradients, they generate non-adaptive black-box attacks that transfer to other classifiers trained on the same dataset, exposing cross-model susceptibility. Simulations demonstrate relatively high misclassification rates across architectures without per-model tuning. This shows that quantum learning systems have a task-level and model-agnostic vulnerability that can be exploited during inference time.

In [67], the authors probe quanvolutional neural networks (QuNNs) with FGSM and PGD across a variety of perturbation ranges on MNIST and FMNIST, isolating how circuit properties shape vulnerabilities. They sweep quanvolutional Ansatzes spanning expressibility and entanglement and compare CRz versus CRx entanglers, then measure accuracy under adversarial perturbations. Attacks expose architecture-dependent fragility: configurations with less favorable metric profiles suffer larger drops, while CRz entanglers generally yield smaller adversarial error than CRx. Against identical perturbations, QuNNs exhibit markedly smaller accuracy loss than CNN baselines (up to about $60\%$ on MNIST; about $40\%$ on FMNIST), evidencing modality-linked susceptibility patterns under gradient-based attacks.

Parameter Space Attacks

Research studies on parameter-space attacks, unlike data space attacks, are scarce. These attacks slightly perturb the parameters (weights and biases) of the model during inference to cause misclassification.

In [68], the authors introduce Quantum FGSM (QFGSM), a white-box, parameter-space attack that perturbs the quantum circuit parameters in the sign direction of the loss gradient w.r.t. weights and biases. Applied to the ClaMP cybersecurity dataset, the method crafts adversarial parameter updates without altering the input features. Compared with random-noise baselines, QFGSM causes a substantial accuracy drop for quantum neural networks (QNNs). Reported metrics include accuracy, precision, recall, and F1, where experiments show reliable misclassification under modest step sizes, demonstrating an efficient pathway via gradient-aligned parameter perturbations.

2.3.2. Extraction

Model extraction attacks in QML aim to duplicate or steal proprietary models through query access, component analysis, or circuit/hardware exploitation. These attacks pose a serious threat to intellectual property of QML models. Extraction attacks are categorized into query-based, transpilation-based, and crosstalk-based.

Query-based Attacks

Query-based attacks aim to infer statistics, parameters, or the training data distribution of the QML models through query access. These types of attacks have limited information about the internal structure of the target model and are usually presented in black- or gray- box settings.

Kundu et al. [69] evaluate black-box model stealing on QNNs via query-response training of the substitute models. Cloned models reproduce up to $99\%$ accuracy of the target model under realistic noise, demonstrating that query-efficient extraction can closely approximate deployed quantum models. The attacks succeed without access to internal parameters or compiled circuits, indicating that output-only interfaces suffice to recover high-fidelity surrogates. The results establish the practicality of black-box model theft in service settings, where adversaries harvest labeled responses to train an effective substitute capable of replicating target’s behavior.

Other attack models exploit specific architectural or encoding vulnerabilities. Fu et al. [70] introduce QuantumLeak, an ensemble-based extraction method that aggregates outputs from noisy cloud queries to improve fidelity by about $7\%$ over classical baselines. The approach exploits NISQ noise statistically: multiple queries stabilize the estimates of the target’s decision function, yielding higher-quality substitutes. Results show that ambient hardware noise does not prevent extraction; instead, attackers can use noise patterns to enhance black-box reconstruction on real devices, strengthening the practical feasibility of model stealing through carefully designed query aggregation strategies.

Transpilation-based Attacks

Transpilation attacks exploit the quantum circuit compilation process, where device-specific optimizations can expose sensitive information. Extending the concerns raised by model extraction threats, these attacks target the transpilation pipeline as a channel for model theft, particularly in noise-prone NISQ systems, where circuit adjustments heighten exposure. Analyses show that adversaries can use transpilation signatures to reconstruct QNNs.

Building on this foundation, an AI-driven variant replaces brute force with an autoencoder that maps transpiled gate sequences back to their original rotation parameters. Under an untrusted-vendor model, it recovers parameters with a mean error of roughly ${10}^{-1}$ in roughly ${10}^3$ seconds, which is about two orders of magnitude faster than brute-force search. These attacks make parameter recovery operationally viable from compiled artifacts alone, showing that adversaries can efficiently reconstruct variational parameters via learned inference over transpiled circuits, thereby enabling the accurate recreation of target models from provider-exposed compiled outputs [51,71].

Recent research studies have extended model extraction research into the quantum domain, demonstrating that VQCs and hybrid quantum-classical architectures are vulnerable to reverse engineering. In [72], the authors demonstrate white-box reverse engineering from transpiled artifacts within a quantum imitation game. Given only hardware-optimized circuits, they strip state preparation, parse the variational ansatz, and recover the architecture and parameters with a mean error of about ${10}^{-2}$. Reconstructed multi-qubit classifiers retain high fidelity, enabling accurate cloning directly from compiled representations. The attacks exploit transpiled circuits available in cloud workflows and show that compiled artifacts alone leak sufficient structure for reliable model recovery and subsequent misuse by adversaries without access to the original high-level descriptions.

In [51], the authors demonstrate a concrete transpilation-stage threat model, in which an untrusted cloud vendor, given only the transpiled circuit of a trained QML model, strips state preparation, parses the transpiled QNN, and reverse-engineers both architecture and parameters. They replace prior brute-force parameter recovery with an autoencoder-based extraction that achieves mean parameter recovery errors on the order of ${10}^{-1}$ and reduces attack time to about ${10}^{-3}$ seconds, making IP theft from transpiled artifacts practically viable in NISQ settings. The attack enables resale, cross-hardware re-targeting via re-transpilation, and watermark tampering once the parameters are recovered, all without access to the original high-level circuit.

In [43], the authors reveal a white-box side channel through which an adversary infers a user’s data-encoding scheme from transpilation artifacts with up to 95% accuracy. Deterministic encoding footprints persist through optimization passes, enabling identification from compiled structures alone. This attack exfiltrates sensitive design choices relevant to crafting tailored perturbations or extraction workflows. The findings demonstrate that encoder information leaked from compiled circuits, giving adversaries reconnaissance capabilities that facilitate subsequent model-specific attacks without requiring access to the original source code or training data.

Inverse-transpilation attacks extend this threat model by treating the transpiler itself as the target of inference. The authors in [73] show that, given original and compiled circuit snapshots, a black-box adversary can learn to identify which gate-level optimization passes are applied, compromising compiler confidentiality and enabling imitation of proprietary optimization strategies. Using thousands of circuit pairs and simple structural features, their ML classifiers reliably infer specific passes, with a neural network achieving per-pass F1-scores as high as 0.96 for certain optimizations. This demonstrates that pass-level fingerprints leak through the transpilation pipeline and can be exploited for competitive IP theft and downstream manipulation of compiled artifacts.

Crosstalk-based Attacks

Crosstalk-based attacks occur in multi-tenant environments, where multiple users access the same quantum hardware. The adversary can exploit crosstalk-induced measurement statistics on qubits to infer sensitive information of a particular user [52,74,75].

Choudhury et al. [74] show that operational and idling crosstalk create exploitable leakage between disjoint user qubit sets in cloud multi-tenancy. The attacker repeatedly runs a lightweight detector, aggregates zero-count drops aligned with victim’s CNOT windows, and derives temporal connectivity features. A graph convolutional classifier trained on these features identifies the victim’s circuit among 336 benchmarks with up to $85.7\%$ accuracy on IBM Lagos, IBM Perth, and IBM Guadalupe, and the signal scales with CNOT activity and time bucketing. The attack assumes only realistic co-tenancy and timing knowledge, not physical access, highlighting its severity under limited resources and information.

2.3.3. Backdoor Attacks

Backdoor attacks aim to degrade the performance of QML models by inserting hidden triggers or patterns inside the training data or manipulating the architecture of the models to induce faults, errors, or anomalies, when these models are exposed to a specific target or pattern.

Hardware-level Backdoors

Here, the adversary modifies the parameters of the VQC (i.e., gates or states) or other quantum hardware components in order to manipulate the model into generating biased outputs when facing specific outputs.

Chu et al. [76] introduce Quantum Trojan (QTrojan), a circuit-level backdoor against QNNs that wraps the data-encoding block with lightweight RX/RY layers whose angles remain benign in normal configuration but switch to predefined values when a hidden server-side configuration trigger is enabled. The trigger hijacks inference to a fixed target class regardless of input. On a down-sampled MNIST-2 and MNIST-4, the full QTrojan achieves $100\%$ attack success rate; an RX-only variant on a subset of qubits also reaches $100\%$ attack success rate on MNIST-2 and selected MNIST-4 settings. The same mechanism coerces quantum long short term memory (QLSTM) model’s outputs into a constant sequence.

Data-level Backdoors

Here, the adversary directly tampers with the training data to inject hidden backdoors.

Quantum-state Poison (Q-Poison) [77] is a stealthy and targeted attack, which perturbs parameterized gates in a VQC to harm quantum states during execution. The results indicate that Q-Poison significantly degrades test-time accuracy, while keeping the original training and validation accuracies close to the baseline, making it extremely hard to detect. In [78], the authors introduce a black-box backdoor attack by generating transferable backdoor triggers with a quantum-classical hybrid generative model. Although this attack poisons only $5\%$ of the training data, it achieves over 98% targeted attack success rate across three different QNN architectures, while maintaining relatively high clean accuracy, highlighting its stealthiness and effectiveness.

2.3.4. Poisoning Attacks

Data poisoning attacks in QML compromise models’ reliability by tampering with the training data (features or labels), hindering the proper functionality of QML models.

In [40], the authors propose quantum indiscriminate data poisoning (QUID), a gray-box, encoder-aware label-flipping attack that assigns adversarial labels by maximizing distances between encoded states in the Hilbert space using only the victim’s data and state-preparation sub-circuit. Across multiple datasets and both noiseless and IBM_Brisbane’s noise settings, QUID causes up to $92\%$ inference-time accuracy degradation compared to baseline models. Moreover, it causes more than $50\%$ accuracy degradation, where defense systems are present. The results establish an effective training-time mechanism to corrupt QNNs through encoder-guided label manipulation accessible to informed adversaries.

Complementing this perspective, in [79], the authors study training-time poisoning by systematically altering corruption ratio $\alpha$ for label flipping and feature randomization, comparing a QNN to a classical multilayer perceptron (MLP) on MNIST and XXZ spin-phase datasets. Under label flipping, MLP’s generalization degrades continuously even for small amounts of poison ratio $\alpha$, whereas the QNN maintains a relatively higher robust accuracy up to $\alpha \approx 0.5$. Under feature randomization, both models exhibit comparatively moderate degradation. The results are averaged over five runs, delineating precise regimes, where poisoning sharply impairs QNN training dynamics.

Table 1 reports a number of significant research works on adversarial attacks and their corresponding details. Table 1 covers evasion, extraction, backdoor, and poisoning attacks, with evasion being the most common. A range of quantum and hybrid models, particularly QNNs, are evaluated, mainly on MNIST and its variants, using Qiskit and Pennylane as the dominant simulation platforms.

2.4. Defense Strategies for Robust QML

As adversarial threats expand into the realm of QML, securing these models is becoming increasingly important. QML models, though promising significant computational advantages, are vulnerable not only to conventional adversarial threats inherited from classical machine learning (CML) but also to novel quantum-specific attack surfaces, including data-encoding vulnerabilities, decoherence exploitation, and hardware-transpilation manipulation. Such vulnerabilities underscore the critical need for robust defense mechanisms tailored to quantum environments.

In response, QAML research has begun exploring various strategies to counter these threats. Defense methods developed for classical systems, such as adversarial training and certified robustness, provide valuable insights but require adaptation to handle the unique characteristics of quantum Hilbert spaces and computational dynamics. Additionally, the inherently probabilistic nature of quantum information processing offers new opportunities for defenses, such as using quantum-specific noise or exploiting certain quantum encodings that inherently resist perturbations. Understanding these emerging defensive approaches is essential to advance and practically deploy secure QML systems. Figure 4 illustrates a taxonomy of adversarial defense systems safeguarding QML models.

2.4.1. Quantum-Adaptive Adversarial Training

Quantum-adaptive adversarial training extends classical adversarial training to QML, strengthening quantum classifiers by incorporating adversarial examples during training. This training paradigm addresses the inherent vulnerability of quantum classifiers, particularly those based on VQCs, which are highly sensitive to minimal perturbations due to the high-dimensional geometry of the quantum Hilbert space.

Lu et al. [63] demonstrate the feasibility of adversarial training in quantum contexts, showing that quantum classifiers can indeed improve their resilience against adversarial attacks by learning from carefully crafted perturbed inputs. Their work, using benchmarks such as the MNIST dataset, provides systematic evidence that even highly accurate quantum models can be misled by imperceptible adversarial perturbations. By incorporating these adversarial examples into the training process, quantum classifiers are able to develop more robust decision boundaries, ultimately reducing their susceptibility to such manipulations. This pioneering contribution lays the groundwork for the emerging field of QAML, establishing that adversarial robustness is a fundamental concern across both classical and quantum domains.

In a subsequent study, Ren et al. [85] report the first experimental demonstration of quantum adversarial learning on a programmable superconducting hardware, with a particular focus on robustness. Variational quantum classifiers run on a ten-transmon platform whose single- and two-qubit gate fidelities reach more than $99.94\%$ and $99.4\%$, respectively. Trained on real medical images and quantum-generated states, the models attain about $99\%$ test accuracy on clean inputs before exposure to untargeted white-box perturbations. Crucially, the authors show that small, carefully constructed perturbations can reliably derail these classifiers, whereas applying quantum-adaptive adversarial training substantially restores their reliability to the same attack recipe. Experiments span the circuit’s depth up to 60 with more than 250 trainable parameters, demonstrating feasibility at a realistic scale. Overall, the quantitative picture emphasizes hardware-backed robustness: near-perfect clean-data performance on a high-fidelity platform and a clear, experimentally validated path to stronger resilience through adversarial training, which markedly reduces the impact of the perturbed samples.

Although adversarial training has been shown to be beneficial for improving the robustness of classical neural networks, West et al. [65] report that it is much less effective for VQCs. In their empirical benchmarks, VQCs trained without adversarial augmentation already demonstrate high resilience to classical attacks, and applying adversarial training produces negligible further gains. Even as attack strength increases, the accuracy of adversarially trained VQCs remains essentially constant and show only minor non-monotonic variations. Against quantum-origin attacks, adversarial training improves VQC’s accuracy in white-box settings, but the benefits diminish in black-box settings. These results suggest that quantum models exhibit an inherent robustness to certain adversarial perturbations, and that classical defense techniques may not directly translate to the quantum regime. Designing quantum-specific training strategies, therefore, remains an important open challenge.

2.4.2. Data Encoding Regularization

Data encoding regularization (DER) is crucial for improving the robustness of QML models against adversarial threats. Unlike classical models, quantum classifiers operate in high-dimensional Hilbert spaces, where even small perturbations in the input can lead to significant shifts in the models’ predictions. For this reason, the way data is encoded into quantum states is not merely a preprocessing step but a central element of the model’s vulnerability profile. Through thoughtful design of encoding schemes and structural constraints within quantum circuits, it becomes possible to mitigate a model’s sensitivity to adversarial manipulations. These techniques serve as implicit regularization mechanisms that can stabilize decision boundaries and reduce the model’s exposure to carefully crafted inputs [47,86,87].

Liao et al. [47] investigate the practical robustness of quantum classifiers against adversarial attacks and reveal that although classifiers trained on Haar-random quantum states are theoretically highly vulnerable due to the concentration of measure phenomenon, this vulnerability is significantly reduced in practical settings, where data is encoded from smooth, structured classical distributions. Their key contribution is demonstrating that quantum classifiers trained on such realistically encoded data exhibit significantly improved adversarial robustness, with performance degradation scaling only polynomially rather than exponentially with system size. Additionally, they introduce a defense strategy that reconstructs quantum states via single-qubit tomography and projects them back onto the data manifold, effectively mitigating the impact of adversarial perturbations by constraining inputs to a physically meaningful subspace. This work highlights the importance of both encoding-aware regularization and geometric constraints for defending quantum models, reinforcing the central role of encoding design in building robust QML systems.

Complementing these perspectives, Berberich et al. [86] formalize an encoding-aware regularization route grounded in Lipschitz analysis for variational models with trainable encodings. They derive a parameter-dependent sensitivity bound whose scale is determined by the measurement norm and the sum of the encoding weight and generator norms; notably, the phase offsets do not affect this bound. Building on this, they propose penalizing the encoding weights during the training session to directly reduce the Lipschitz constant, and they establish a generalization bound that depends on the same encoding-driven term and on the dataset size, clarifying the trade-off between robustness and expressivity. Numerical results on a circle-classification task identify an optimal range for the regularization coefficient $\lambda$ (around 0.15) that outperforms both unregularized and over-regularized settings, while fixed-encoding models remain less adaptable and exhibit higher sensitivity. Taken together, the study positions trainable encodings and weight-norm regularization as practical levers for jointly tuning robustness and generalization within the encoding design space.

Gong et al. [87] propose novel defense strategies against adversarial attacks by utilizing randomized quantum encodings, including random unitary transformations and quantum error correction encoders. They rigorously prove that random global and local unitary encodings induce barren plateaus in adversarial variational circuits, characterized by exponentially vanishing gradients, thus thwarting gradient-based adversarial optimization methods. Furthermore, they analytically demonstrate that employing randomized quantum error-correcting codes significantly improves the robustness of quantum classifiers against local adversarial perturbations. By adapting quantum differential privacy to quantify classifier stability, they provide theoretical bounds demonstrating robustness enhancement via concatenated error-correcting codes. Numerical simulations on topological phase classification further validate their theoretical predictions. These insights establish randomized encodings as practical and effective methods for safeguarding quantum classifiers from adversarial manipulation, bridging the gap between theoretical guarantees and realistic defensive strategies. Consequently, their results advance the understanding and development of secure, reliable QML algorithms, suitable for both current NISQ devices and future fault-tolerant quantum systems.

2.4.3. Quantum Randomized Smoothing

Quantum randomized smoothing (QRS) has emerged as a promising strategy for enhancing robustness against adversarial perturbations in QML. Analogous to classical randomized smoothing techniques, this quantum-adapted method uses controlled quantum noise to probabilistically stabilize predictions around input data points, thereby providing a certified guarantee of robustness. Unlike conventional defenses that may struggle to address quantum-specific attack surfaces such as encoding vulnerabilities and decoherence exploitation, QRS directly interacts with the quantum computational processes, capitalizing on intrinsic quantum randomness to mitigate adversarial susceptibility [88,89,90]. This section introduces the principles underlying QRS, emphasizing its potential in establishing certified robustness bounds. It sets the stage for exploring related works that have made significant contributions to this area.

Wollschlager et al. [89] propose a quantum approach to discrete randomized smoothing, using quantum amplitude estimation (QAE) to achieve a quadratic speedup compared to classical Monte Carlo-based smoothing methods. They extend the sparsity-aware discrete randomized smoothing framework, introducing a new binary threat model suitable for certifying robustness in diverse discrete data types such as images, graphs, and texts. Their quantum algorithm efficiently encodes input perturbations into quantum superpositions, thereby significantly reducing the number of queries to the classifier required for robustness certification. Empirical evaluations demonstrate the effectiveness of their framework across multiple domains, confirming its practical applicability and computational advantages.

Franco et al. [90] introduce a quantum framework to enhance the certified robustness of machine learning models through QRS. Their approach uses Grover’s algorithm to achieve a quadratic sampling advantage over classical randomized smoothing, significantly reducing the sample complexity needed for robustness certification. The study emphasizes the co-design of data encoding and perturbation models, showing that basis-state encoding combined with constrained k-distant Hamming-weight perturbations provides meaningful robustness guarantees. They implement this strategy in a time-series classification task using a Bag-of-Words preprocessing pipeline, demonstrating that the quantum advantage is particularly pronounced in high-sample regimes. This work advances the development of scalable quantum defenses by unifying encoding strategies with perturbation modeling to deliver practically relevant robustness certificates.

2.4.4. Obfuscation

Obfuscation defenses exploit the inherent stochasticity of quantum systems to increase the uncertainty for the adversaries. By deliberately introducing controlled noise or employing randomized mechanisms at the data, circuit, or measurement level, these methods aim to obscure exploitable patterns, smooth decision boundaries, and provide certified robustness guarantees. Unlike purely deterministic strategies, noise-based defenses use quantum properties such as superposition, decoherence, and randomized measurement outcomes to complicate adversarial optimization, making it significantly harder for attackers to craft effective perturbations. This section explores how such techniques are adapted and extended for QML, forming a critical line of defense in the emerging landscape of QAML.

In [43], the authors expose a critical vulnerability in cloud-based QML systems, showing that adversaries with white-box access, such as third-party quantum cloud providers, can infer a user’s encoding scheme with up to $95\%$ accuracy by analyzing circuit transpilation artifacts like gate sequences, rotation angles, and entanglement patterns. To mitigate this attack, the authors propose a lightweight and effective defense mechanism: a transient obfuscation layer that scrambles the encoding fingerprints while preserving the quantum circuit’s final output. This layer includes three stages: (1) randomized rotations and entanglement gates immediately after encoding to disrupt recognizable patterns, (2) an isolation barrier to prevent circuit compilers from optimizing across the obfuscation layer, and (3) an inversion phase to restore the original quantum state just before the VQCs begin. As demonstrated in their experiments, this approach reduces encoding detection accuracy to near-random chance (about $42\%$) with only about $8.5\%$ average increase in circuit’s depth for a 5-layer QNN. This makes it a practical, low-overhead defense strategy against encoding-based side-channel attacks in QML systems.

E-LoQ [91] is a locking technique that aims to protect the intellectual properties of a quantum circuit under an untrusted compiler. This method consists of three stages: key generation, encoding (encryption/locking), and decoding (decryption/unlocking). During the first stage, a secret key of n bits is generated. In the encoding stage, the circuit is locked using the generated secret key by adding a key qubit and inserting key-controlled gates, and, then, sent to the compiler. Then, after compilation, the circuit is decrypted/unlocked by removing the masking and applying the correct key operations, and simplified to restore its functionality and reduce overhead. These stages ensure that the functionality of the circuit stays hidden from the compiler. The results demonstrate that E-LoQ drops accuracy by a negligible amount, while keeping fidelity degradation at most about $1\%$ across multiple circuits, highlighting its practicality and efficacy in real-world settings.

2.4.5. Behavior-Based Defenses

These defenses check the behavior and statistics of the models to detect and eliminate anomalies and malicious patterns. These defenses are mainly effective against backdoor and poisoning attacks.

In [82], the authors propose a defense to prevent the execution of a tampered or maliciously modified circuit by verifying it before execution. The defense pipeline consists of three layers: channel verification, pulse syntax verification, and pulse semantics verification. The first layer is responsible for detecting channel attacks such as qubit plunder and qubit block attacks; this is done by checking the mapping between gate-level qubits and pulse-level channels, where every qubit must have at least one pulse applied to it and no pulse should be applied to any undeclared qubits. However, this step cannot detect qubit reordering. Consequently, the second layer of detection focuses on pulse attacks that modify timing, frequency, phase, and waveform. The detection is performed by comparing the structure and scheduling of pulses against the previously trusted version, not just raw parameters. Finally, in pulse semantic verification, the pulse level behavior is compared against the intended logic of the gate-level circuit, which is done by presenting gate-level and pulse-level circuits as directed acyclic graphs (DAGs). As a result, the problem is simplified into graph consistency checking. The results indicate that the defense could successfully detect all the demonstrated attacks, while facing recall-precision trade-off.

QSentry [92], on the other hand, aims to detect backdoors using a quantum measurement clustering algorithm. QSentry assumes that backdoor inputs introduce detectable statistical deviations in quantum measurement space, which tend to form a minority cluster. Built on this assumption, QSentry projects the final qubit measurement matrix into a lower-dimensional space, and performs unsupervised clustering to isolate an anomalous group of samples whose measurement behavior deviates from clean data. The results on the MNIST dataset indicate that as the fraction of poison data increases from $1\%$ to $10\%$, the accuracy and F1-score of the method improve, suggesting that higher poisoning density magnifies the backdoor signature and leads to more consistent clustering of backdoor samples.

2.4.6. Watermarking

Watermarking aims to protect the intellectual properties of QML models by introducing watermark triggers to verify the ownership and authenticity of the QML models. Watermarking techniques are divided into white-box, black-box, and box-free watermarking techniques. White-box watermarking requires a degree of knowledge of the internal structure of the target model, while black-box watermarking only needs interaction with the target model. Additionally, box-free watermarking can extract the copyright information without any knowledge about or direct interaction with the target model [51,93,94,95,96].

In [93], the authors propose a black-box watermarking defense to safeguard the intellectual properties of QNNs. This method starts with gathering clean and trigger samples, where the trigger samples are slightly perturbed with their labels intentionally altered. The model employs grouped and paired training strategy to preserve both accuracy and watermarking performance. Grouped training separates into blocks of clean samples and trigger samples to prevent the trigger samples from dominating the training. Paired training places trigger set right after the original version set in each block to make the model associate trigger pattern with the watermark label. The ownership of the final model could easily be verified by querying the model using a trigger set and analyzing the results.

Moreover, in [97], the authors propose two watermarking techniques to safeguard the intellectual properties of quantum circuits on potentially untrusted cloud platforms. The first technique embeds a watermark by inserting parameterized rotation gates on ancillary qubits combined with entangling operations. On the other hand, the second one inserts randomly selected gate sequences together with their inverse gates in the middle of the circuit with a barrier placed between them to prevent compiler optimization from canceling the watermark. The combined watermarking approach ensures robust ownership verification, with probability of successful trials (PST) decreased only by $0.53\%$ compared to non-watermarked models. Moreover, this approach offers a significant reduction in circuit’s depth compared to other competitors, and smaller probabilistic proof of authorship (PPA) compared to the state-of-the-art watermarking techniques.

Figure Table 2 presents a detailed comparison of existing defense systems. According to Table 2, most defenses are designed to counter evasion attacks. In contrast, defenses targeting other attack types are less studied. Moreover, Qiskit and Pennylane simulation platforms are predominantly used in defense research, while only a limited number of studies employ real quantum hardware.

3. GenAI

LLMs introduce wider attack surfaces compared to traditional ML models and neural networks. These extended attack surfaces result in new opportunities for the adversaries to perform attacks [108,109]. In this section, our goal is to explain attack surfaces, attacks, and defenses associated with GenAI models.

3.1. Attack Surfaces

The attack surfaces in LLMs extend compared to the attack surfaces in traditional ML models and neural networks by introducing new attack surfaces including users’ prompts, RAG, long-term memory, and quantum sampling layer.

3.1.1. Prompt

User prompts introduce a vast attack surface against LLMs. Adversaries can use different strategies (e.g., jailbreaking) to guide the LLMs into performing malicious actions [110].

When GenAI meets quantum environment, prompt-level attack surface increases due to the encoding stage. The adversary can inject malicious perturbations into quantum-state vectors, which can bypass classical text filters.

3.1.2. RAG

LLMs can surf the web to retrieve documents and learn from these documents [111]. If these documents are from untrusted sources or contain hidden malicious instructions, the final outputs of the LLMs can be significantly affected [110,112,113]. In quantum environments, the adversary may poison the quantum state vectors rather than the raw data in order to increase the effectiveness of the attack.

3.1.3. Long-Term Memory

Here, the adversary gradually poisons the long-term memory such that the model moves toward performing illegal actions. This might be more intense when adversaries exploit superposition, entanglement, and quantum vectors.

3.1.4. Quantum Sampling Layer

Quantum sampling layer is responsible for generating probability distribution using quantum circuits or processors. It is particularly useful for the tasks that are computationally infeasible for classical computers [114,115,116]. Quantum sampling layer can be replaced by classical probabilistic decoding stage. This can provide a wide attack surface for the adversaries, where they can alter probability distributions prior to measurement.

3.2. Attacks

While the successful attacks against traditional ML models and neural networks are still feasible in GenAI models, new attacks emerge as the attack surfaces increase.

3.2.1. RAG Poisoning

While LLMs use RAG to retrieve the documents and redirect their responses, a malicious document can significantly impact the generated outputs [110,112,113]. This becomes more severe, where the adversary can poison the quantum embeddings, measurement outcomes, and amplitude distributions as well as the original content.

3.2.2. Superposition Exploitation

While quantum GenAI can process multiple semantic branches at the same time, an adversary can exploit superpositions. The adversary may generate inputs to amplify malicious pathways or destruct safety guardrails.

3.2.3. Quantum Sampling Manipulation Attack

The classical probabilistic decoding stage may be replaced by quantum sampling mechanisms based on probability amplitudes, VQCs, and quantum measurement processes. Adversaries may manipulate the probabilistic evolution of quantum states rather than directly modifying the generated output [117]. Quantum sampling attacks can exploit amplitude amplification, measurements, or corrupted quantum randomness sources to subtly move token generation toward malicious outputs. Due to the probabilistic and non-observable nature of quantum state evolution prior to measurement, these attacks may remain highly stealthy, while still significantly degrading the output’s reliability in hybrid classical-quantum GenAI systems.

3.3. Defenses

In this section, we introduce the defenses against adversarial threats in GenAI.

3.3.1. Prompt Sanitization

All the prompts need to go through a sanitization process prior to quantum state encoding. This can be done by defining heuristic-based rules to remove dangerous instructions and feed benign prompts to the model.

3.3.2. Document Sanitization

All the retrieved documents from RAG can be clustered to identify the outliers. After that, the outliers can go through a purification process in order to remove backdoors and malicious instructions from those documents. This defense can be performed in two layers; once before quantum states encoding, and once after it. This two-staged defense can further ensure the cleanness of the retrieved documents.

3.3.3. Quantum Encryption

In quantum RAG systems, encryption might allow the quantum model to search encrypted quantum databases and retrieve encrypted data. This ensures that if an adversary sniffs the memory or exploits hardware crosstalk, the retrieved context is completely unreadable without the private key. Additionally, encryption may reduce the impact of RAG poisoning attacks by preventing adversaries from directly observing intermediate retrieval states or quantum representations during the retrieval process.

4. Agentic AI

Agentic AI is the collaboration of multiple AI agents to set goals, plan, and execute tasks. These agents interact with multiple external dependencies and use tools to facilitate their actions [118,119].

4.1. Attack Surfaces

Attack surfaces in agentic AI include all the attack surfaces in GenAI as well as the orchestration, external dependencies, and executive tools.

4.1.1. Orchestration

Here, the collaboration between agents, their long-term goal, decision making procedure, and optimization objectives can be exploited.

Long-Term Goal

The adversary aims manipulate the long-term objective of the agents. This can be done by defining a brand-new goal or causing a suboptimal outcome of the same objective [110,113].

Communication

Here, the adversary exploits the communication between agents by gradually compromising the agents and manipulating them into malicious actions [110,113,120].

4.1.2. External Dependencies

Agents can interact with APIs, browsers, databases, operating systems, and execute codes. These external dependencies, specially ones form untrusted sources, provide a unique attack surface (e.g., embedding malicious instructions within the content) for the adversaries [110,113].

4.1.3. External Tools

External tools play important roles in agentic AI, enabling the agents to interact efficiently with external dependencies. As a result, these tools introduce a vast attack surface for adversaries, which can lead to extremely harmful results [110,113].

4.2. Attacks

While the attacks from GenAI can be transferred to agentic AI systems, new attacks are also emerged as the result of the extended attack surfaces [110,113].

4.2.1. Tools Exploitation

External tools connect agents with the real world. As a result, the misuse of these tools can lead to harmful outcomes. An adversary can embed hidden backdoors within external tools to trigger targeted malicious behavior when agents face specific inputs or tasks. Moreover, compromised or malicious tools may execute unauthorized or harmful codes, manipulate the outputs returned to the agents, leak sensitive information, or alter agents’ decision making processes in harmful manners [110,112,113].

In quantum environments, the severity of these attacks may increase significantly as adversarial tools can interact with shared quantum resources and VQCs. Adversarial tools can tamper with quantum-generated outputs or alter probabilistic measurement outcomes to break the computational integrity and trustworthiness of the system.

4.2.2. Corrupted Third Parties

Malicious third parties may embed malicious instructions within the data and/or services they provide. These third parties could be extremely dangerous as the contents are delivered through an apparently trusted source [110].

In quantum environments, malicious third-party content or services could introduce carefully crafted perturbations that exploit noise sensitivity, measurement uncertainty, or variational optimization parameters within hybrid quantum-classical systems. Even small perturbations in the content or services may significantly affect decision-making and optimization processes, thereby influencing the final objective.

4.2.3. Agent Hijacking

Here, the adversary compromises or controls one or more agents to influence the behavior of other agents within the system [121]. The malicious agent(s) may directly perform harmful actions to achieve the adversarial objective. Alternatively, they may manipulate other agents into executing the malicious objective while continuing to perform their legitimate assigned tasks.

In quantum environments, agent hijacking may extend beyond conventional prompt-based attacks to target computational and communicational resources. Adversarial agents may manipulate VQC parameters, quantum communication interfaces, or hybrid quantum-classical feedback loops to add malicious perturbations into shared computational workflows. These actions can bias measurement probabilities, change optimization paths, or corrupt shared quantum representations used for planning and coordination. As a result, benign agents may make adversarial decisions while appearing to operate normally.

4.2.4. Cost Incurring

Here, the adversary aims to increase the overall operational cost of the agentic system by manipulating agents to perform inefficient, redundant, or non-optimal actions [110,122]. While the correctness of the final objective or output may remain unchanged, the system uses additional computational resources, time, memory, energy, or API calls during execution. These attacks can decrease the system’s efficiency, increase cost, and limit scalability without directly affecting the agents’ functionality.

In quantum environments, adversaries may become significantly more powerful due to the considerable computational and energy costs of quantum resources. Malicious manipulation of quantum optimization or orchestration processes may incur additional quantum communication overhead or inefficient resource scheduling across agents. Although the system may continue to produce correct outputs, the unnecessary usage of quantum computational resources can significantly increase operational costs and reduce the availability of the system.

4.3. Defenses

In this section, we explain the defenses for agentic AI systems.

4.3.1. Pre-Processing Strategies

Pre-processing strategies are specially effective against malicious third parties. The defense system can examine the contents/services from the third parties once before it is fed to the system, and removes suspicious patterns or instructions from the original source.

4.3.2. Safe Simulation

Here, the system can simulate a small-scaled version of the main task in safe environments such as sandbox, and monitor the behavior of the tools. Tools with suspicious behavior can be removed when the real execution is in progress.

4.3.3. External Surveillance

Here, human experts or additional agents can be added to the system to monitor the pipeline in real-time. If any suspicious activity is detected, the session is terminated by the watchdogs.

4.3.4. Action Verification

Watermarking the agents’ internal memories and orchestration paths using entangling phases may facilitate verifying the operations. All the operations that violate these watermarks can be invalidated.

Figure 5 shows how the attack surfaces evolve when we transit from traditional ML models to agentic AI systems. The attack surfaces within each paradigm consistently increase. When each paradigm meets quantum, not only new attack surfaces are introduced, but also the classical attack surfaces increase due to unique properties of quantum environments.

5. Datasets

A variety of datasets are used to assess both attack and defense systems in the literature. These datasets can be broadly categorized into classical, quantum-generated, and synthetic datasets. Existing literature remains dominated by classical datasets, primarily due to hardware limitations and the scarcity of large-scale quantum-native data [52,80,123,124].

5.1. Classical

Classical datasets, such as MNIST family datasets and IRIS, are most widely used benchmarks for training and evaluation. Due to the qubit constraints of NISQ devices, these datasets are typically dimension-reduced, binarized, or amplitude-encoded [40,63,125,126]. In adversarial studies, classical datasets are particularly attractive because they allow direct comparison with classical attack methods, thereby enabling robustness evaluations across paradigms.

5.2. Quantum-Generated

Quantum-generated datasets are obtained directly from quantum systems or quantum simulations, which exhibit properties such as probabilistic by nature, entanglement correlations, and noise characteristics. These datasets face several limitations such as reproducibility issues across devices and limited size due to hardware sampling cost [63,87,124,127].

5.3. Synthetic

Synthetic datasets are artificially constructed, either through classical generation processes or quantum-inspired sampling methods. However, they may introduce hidden bias and unrealistic noise [39,81,102].

6. Simulation Platforms

Simulation platforms aim to provide computational resources for the researchers who do not have access to real quantum hardware. These platforms are presented via high-level APIs through cloud-based systems to facilitate the interaction between the quantum hardware and the users. The most popular platforms for QAML research directions include Qiskit, Pennylane, TensorCircuit, Cirq, ProjectQ, BQSKit, Q#, and Julia-based [123,128,129]. Each of these platforms offers different hardware capabilities, computation power, and hybrid support. Table 3 provides a comprehensive comparison between these platforms. From the table, it is evident that most platforms are Python-based, which reflects Python’s dominance in both quantum computing and machine learning ecosystems. The table highlights that while many simulation platforms share similar goals, they differ significantly in ecosystem, hybrid support, and capabilities that need to be considered into account when selecting a framework for QAML experiments.

7. Open Challenges and Future Research Directions

QAML research has expanded rapidly, yet the field still faces numerous unsolved problems. Adversaries continue to exploit quantum models’ unique characteristics, and many defense proposals remain theoretical or limited to small-scale experiments. This section synthesizes key open challenges and outlines promising avenues for future research studies.

7.1. Scalability and Trainability on Realistic Hardware

QAML models operate in high-dimensional Hilbert spaces, where most data points lie near decision boundaries. The concentration of measure phenomenon means that even tiny perturbations can easily move examples across class boundaries, making models highly sensitive to attacks. Existing defenses often rely on shallow circuits or noise injection, but scaling them to deeper circuits on NISQ devices remains difficult. Persistent issues include barren plateaus (regions of exponentially flat gradients that make training nearly impossible) and the absence of general proofs of quantum advantage. Future research should explore gradient-free optimization methods, circuit architectures that mitigate barren plateaus, and error-mitigation techniques that preserve the model’s utility, while resisting adversarial perturbations.

7.2. Lack of Standardized Benchmarks and Evaluation Protocols

Most QAML defenses have been tested on toy problems or downscaled datasets. Recent studies note that prior works often uses simplified binary classification tasks or reduced MNIST datasets, which limits generalizability [130]. Without common benchmarks, comparing results across studies is challenging, and claims of robustness may not hold in realistic settings. The community needs large-scale, open-source datasets and unified metrics for evaluating adversarial robustness under consistent threat models. Collaborative efforts to build benchmark suites and reproducible evaluation pipelines will accelerate progress and ensure that proposed defenses scale beyond small prototypes.

7.3. Emerging Attack Surfaces in Quantum-Enhanced Systems

While the attack surfaces of traditional ML and neural networks have been investigated thoroughly, the emerging attack surfaces in quantum GenAI and quantum agentic AI systems remain unexplored. These systems not only carry the attack surfaces from previous paradigms, but also introduce vast attack surfaces, which necessitates designing pipelines that are secure from scratch. Future research should systematically characterize these attack surfaces, and develop defense systems alongside the usual development pipeline to preserve both performance and robustness.

7.4. Defenses Against Data Poisoning and Backdoor Attacks

Data poisoning and backdoor attacks pose a significant threat to QML models. The research studies on adversarial defenses against poisoning and/or backdoor threats are scarce. The future research on QAML should focus on advanced detection, verification, and data sanitization techniques to counter these threats. One possible research direction is to develop certified poison detection and removal techniques to sanitize the training data before the model is trained on it.

7.5. Defense Trade-Offs and the Robustness-Utility Dilemma

Many defensive strategies introduce noise (e.g., depolarizing channels) or apply randomized encodings to induce barren plateaus, thereby limiting the effectiveness of gradient-based attacks. However, these approaches often come at the cost of reduced model accuracy and reliability. Recent studies [87,131] emphasize that existing quantum-safe defenses still fall short of delivering robust protection suitable for real-world deployment, and that a key unresolved challenge lies in striking a balance between enhanced robustness and the preservation of generative performance, i.e., the ability of quantum models to faithfully learn and reproduce complex data distributions. Future works should focus on adaptive defenses that tune noise levels based on detected threat levels, hybrid quantum-classical architectures that use classical pre-processing for robustness, or certified defenses with provable guarantees.

8. Conclusions

In this survey, we addressed the security and privacy risks of QML models by investigating attack surfaces of different learning paradigms. We formalized unified taxonomies of QML threats and investigated defense families within each paradigm. As previously discussed, the attack surfaces increase as we move from traditional models to agentic AI systems. The attack surfaces further expand when each paradigm operates in quantum environments.

The severity of the attacks and the lack of proper defense highlight the need for developing and evaluating defense strategies using standardized datasets and metrics. Additionally, the research in quantum adversarial GenAI and quantum adversarial agentic AI is at its early stage, which requires a significant amount of research in order to develop pipelines with proper built-in defense systems. This ensures that future quantum GenAI and agentic AI systems remain robust against emerging attacks.