---
title: "Can Quantum Federated Learning Withstand Circuit-Level Backdoors?"
authors:
  - "Aakar Mathur"
  - "Ruknuddin Mohammed"
  - "Ashish Gupta"
doi: "10.24963/ijcai.2026/518"
url: "https://ijcai.org/proceedings/2026/518"
pdf: "https://ijcai.org/proceedings/2026/0518.pdf"
venue: "Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence"
year: 2026
pages: "4651-4659"
track: "Main Track"
keywords:
  - "Machine Learning: Federated learning"
  - "Machine Learning: Classification"
---

# Can Quantum Federated Learning Withstand Circuit-Level Backdoors?

Aakar Mathur, Ruknuddin Mohammed, Ashish Gupta

*Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence*, pages 4651-4659. DOI: [10.24963/ijcai.2026/518](https://doi.org/10.24963/ijcai.2026/518)

## Abstract

Quantum Federated Learning (QFL) inherits the core vulnerability of federated optimization to malicious clients, while also introducing an attack surface from variational circuit training and measurement-driven gradients. This work proposes a novel CircUit-Level backdoor Threat (CULT) model that formalizes four stealthy attacks by exploiting quantum-aware mechanisms, including Grover, Pauli, Bit-flip, and Sign-flip. By enabling malicious clients on both in-training and post-training surfaces, these attacks can critically undermine the learning process. We establish a rigorous theoretical foundation to demonstrate attack stealthiness under standard smoothness assumptions. Experiments on the MNIST and CIFAR-10 datasets with non-IID splits and varying fractions of malicious clients show that even a single malicious client can induce severe accuracy degradation under FedAvg aggregation. While popular defenses, including Krum, Multi-Krum, FoolsGold, FLGuardian, and Mud-HoG, reduce degradation in many regimes, they fail to eliminate worst-case failure cases, where accuracy drops up to 50%. The experimental analysis further reveals that under the CULT model, malicious updates effectively mask their presence by staying close to benign norms, thereby helping attackers evade detection.