Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do

Md Rezwanul Islam

cs.LGAug 16, 2026

Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do

Authors: Md Rezwanul Islam

Organizations: Dhaka, Bangladesh

Abstract

Machine-learning detectors for power-system cyberattacks are themselves attack surfaces, and quantum machine learning has been proposed for them. We benchmark fidelity-kernel SVMs and variational classifiers against six tuned classical models on public power-system attack data (Mississippi State/ORNL), across white-box, transfer, decision-based black-box, and poisoning attacks. Our headline finding is methodological: the benchmark's answers are set by the evaluator's choices before the models. Eight choices -- six in the evaluation protocol, two in the tuning the benchmark itself runs -- each reversed or moved a conclusion at fixed models. The largest is the split: the row-level protocol scores 0.905 macro-F1 where holding whole source files out leaves 0.594, and in the capped matched-dimensionality regime the quantum arm sits within noise of chance with the classical arm 0.024 above it. A fidelity kernel looks most robust until attacked directly (retention 0.886 to 0.064); a mis-fitted surrogate manufactures a 10x asymmetry; an unseeded black-box attack moves 75% between restarts. A positive control explains the accuracy null: the labels, not the pipeline. We give the control that catches each choice and release the seeded benchmark.

Figures & tables

Fig. 1: Model circuits (3-qubit illustration; experiments use 8–16 qubits). Top: ZZ feature map of the fidelity kernel. Bottom: VQC — RY angle encoding followed by a strongly-entangling layer.

	Row-level split	Whole files held out
Full 128 feat., tuned LightGBM	0.905	0.594 $\pm$ 0.008
PCA-8 (2k cap), tuned XGBoost	0.596	0.523 $\pm$ 0.013
PCA-8 (2k cap), tuned ZZ-kernel SVM	0.564	0.508 $\pm$ 0.012
contrast (classical $-$ quantum)	$+0.031$	$+0.015\,\pm\,0.015$
Stratified-random floor	0.501	0.499 $\pm$ 0.001
Test rows w/ train neighbour $<0.1$	45.8%	5.0 $\pm$ 0.4%

TABLE I: The split protocol as an evaluator choice: identical tuned models, identical transforms, only the split indices change. Whole-file columns are mean

\,\pm\,

std over five held-out partitions at one training seed; the partition spread shown dominates the seed spread. The last row is the mechanism: the fraction of test rows with a train neighbour closer than

0.1

in standardized full-feature space.

Model	macro_f1	balanced_accuracy	auprc	roc_auc	brier	ece
logreg ∗	0.511 $\pm$ 0.000	0.538 $\pm$ 0.000	0.746 $\pm$ 0.000	0.540 $\pm$ 0.000	0.496 $\pm$ 0.000	0.038 $\pm$ 0.000
rbf_svm ∗	0.578 $\pm$ 0.000	0.576 $\pm$ 0.000	0.762 $\pm$ 0.000	0.605 $\pm$ 0.000	0.466 $\pm$ 0.000	0.084 $\pm$ 0.000
rf ∗	0.586 $\pm$ 0.002	0.582 $\pm$ 0.001	0.793 $\pm$ 0.001	0.635 $\pm$ 0.001	0.408 $\pm$ 0.000	0.030 $\pm$ 0.001
xgb †	0.597 $\pm$ 0.002	0.595 $\pm$ 0.002	0.784 $\pm$ 0.001	0.630 $\pm$ 0.001	0.438 $\pm$ 0.001	0.069 $\pm$ 0.002
lgbm ∗	0.593 $\pm$ 0.001	0.590 $\pm$ 0.001	0.784 $\pm$ 0.001	0.632 $\pm$ 0.000	0.454 $\pm$ 0.000	0.130 $\pm$ 0.001
mlp ∗	0.456 $\pm$ 0.013	0.512 $\pm$ 0.004	0.755 $\pm$ 0.006	0.563 $\pm$ 0.007	0.412 $\pm$ 0.003	0.032 $\pm$ 0.006

TABLE II: RQ1 at matched dimensionality (PCA-8, binary, test split, 10 seeds).

\dagger

= regime best;

*

= significantly below best (Holm-corrected Wilcoxon,

p<0.05

); quantum-kernel rows are deterministic across seeds and compared by margin. The stratified-random floor is shown because several models sit near it.

Model	clean F1	[email protected] $\sigma$	F1 $-$ floor	retention	WB reten.	rand. flip	HSJ med. $\ell_{\infty}$ ( $\sigma$ )
qsvm	0.563	0.499	-0.001	0.886	0.064	45%	2.818
logreg	0.514	0.431	-0.069	0.838	—	8%	0.517
rbf_svm	0.587	0.415	-0.085	0.707	0.685	24%	0.000
mlp	0.465	0.289	-0.211	0.621	0.621	3%	0.867
rf	0.616	0.367	-0.133	0.596	—	18%	0.000
lgbm	0.634	0.373	-0.127	0.589	—	24%	0.548

TABLE III: Robustness read as attack + control at

\varepsilon=0.5\sigma

. Retention alone ranks the QSVM (ZZ, 8 qubits) first — but its “88.6% retained” is a score at chance (

-0.001

from the floor) and every other model lands below it, so this ranking is between models that have all already lost. Clean F1 differs from Table II : attack columns use stratified test subsets (PGD: 500 points, 10 seeds; HSJ/random: 100 points). HSJ figures are single draws (Sec. IV-F ).

Choice	Control that catches it	Instance
Evaluation protocol
Split protocol	whole-group held-out arm + neighbour audit	Sec. IV-A
Surrogate specification	surrogate-competence dose-response	Sec. IV-E
Attack availability	matched white-box attack per family	Sec. IV-D
Attack objective	loss- and distance-seeking attackers	Sec. IV-F
Attack starting point	restarts, reported mean $\pm$ std	Sec. IV-F

TABLE IV: The evaluation checklist this study earned. Each choice reversed or materially moved a conclusion at fixed models and fixed data; the control catches it. Six choices sit in the evaluation protocol, two in the selection protocol the benchmark itself runs.

partition	held-out files	full LGBM	XGB	ZZ QSVM	contrast	floor
row (shipped)	–	0.9053	0.5957	0.5643	$+0.0314$	0.5005
p0	1,8,13	0.6032	0.5347	0.5070	$+0.0277$	0.4980
p1	3,7,9	0.5837	0.5134	0.5253	$-0.0119$	0.4979
p2	1,10,11	0.6033	0.5393	0.5093	$+0.0300$	0.5003
p3	5,9,14	0.5937	0.5028	0.4872	$+0.0156$	0.4995
p4	1,11,12	0.5884	0.5259	0.5105	$+0.0154$	0.4991

TABLE V: The paired-protocol control per partition (one training seed; identical transforms, only the split indices change). The contrast column is classical

-

quantum at matched dimensionality under the 2,000-sample cap; p1 is the sign flip quoted in Sec. IV-A .

Model	macro_f1	balanced_accuracy	auprc	roc_auc	brier	ece
logreg ∗	0.598 $\pm$ 0.000	0.630 $\pm$ 0.000	0.849 $\pm$ 0.000	0.692 $\pm$ 0.000	0.454 $\pm$ 0.000	0.045 $\pm$ 0.000
rf ∗	0.884 $\pm$ 0.001	0.862 $\pm$ 0.001	0.986 $\pm$ 0.000	0.966 $\pm$ 0.000	0.147 $\pm$ 0.000	0.075 $\pm$ 0.001
xgb ∗	0.891 $\pm$ 0.002	0.886 $\pm$ 0.002	0.979 $\pm$ 0.001	0.957 $\pm$ 0.001	0.134 $\pm$ 0.001	0.009 $\pm$ 0.001
lgbm †	0.906 $\pm$ 0.001	0.896 $\pm$ 0.002	0.986 $\pm$ 0.001	0.970 $\pm$ 0.001	0.126 $\pm$ 0.001	0.051 $\pm$ 0.001
rbf_svm ∗	0.705 $\pm$ 0.000	0.686 $\pm$ 0.000	0.881 $\pm$ 0.000	0.791 $\pm$ 0.000	0.336 $\pm$ 0.000	0.109 $\pm$ 0.000
mlp ∗	0.766 $\pm$ 0.015	0.760 $\pm$ 0.017	0.921 $\pm$ 0.003	0.849 $\pm$ 0.008	0.285 $\pm$ 0.009	0.077 $\pm$ 0.007

TABLE VI: Binary task, full 128 features (test split, 10 seeds).

Cell	$g$	KTA (grid $y$ )	KTA (eng. $y$ )	quantum win
angle_ry_q8_binary	13.43	0.0023	0.183	0.027 $\pm$ 0.007
zz_q8_binary	6.34	0.0035	0.230	0.016 $\pm$ 0.007
angle_ry_q12_binary	17.21	0.0022	0.500	0.004 $\pm$ 0.003
zz_q12_binary	73.04	0.0145	0.055	0.053 $\pm$ 0.006
angle_ry_q16_binary	5.60	0.0031	0.233	0.026 $\pm$ 0.009
zz_q16_binary	70.12	0.0143	0.046	0.092 $\pm$ 0.010

TABLE VII: Relabel control per cell:

g

, KTA on grid vs. engineered labels, and the quantum win (5 resamples).

Model	macro_f1	balanced_accuracy	auprc	roc_auc	brier	ece
logreg ∗	0.496 $\pm$ 0.000	0.667 $\pm$ 0.000	0.563 $\pm$ 0.000	0.772 $\pm$ 0.000	0.532 $\pm$ 0.000	0.035 $\pm$ 0.000
rf ∗	0.887 $\pm$ 0.001	0.865 $\pm$ 0.001	0.952 $\pm$ 0.000	0.973 $\pm$ 0.000	0.162 $\pm$ 0.000	0.091 $\pm$ 0.001
xgb ∗	0.910 $\pm$ 0.002	0.904 $\pm$ 0.002	0.959 $\pm$ 0.001	0.975 $\pm$ 0.000	0.124 $\pm$ 0.001	0.014 $\pm$ 0.001
lgbm †	0.917 $\pm$ 0.001	0.908 $\pm$ 0.001	0.967 $\pm$ 0.000	0.980 $\pm$ 0.000	0.114 $\pm$ 0.001	0.024 $\pm$ 0.001
rbf_svm ∗	0.678 $\pm$ 0.000	0.637 $\pm$ 0.000	0.685 $\pm$ 0.000	0.808 $\pm$ 0.000	0.344 $\pm$ 0.000	0.068 $\pm$ 0.000
mlp ∗	0.763 $\pm$ 0.030	0.755 $\pm$ 0.033	0.811 $\pm$ 0.019	0.894 $\pm$ 0.010	0.288 $\pm$ 0.012	0.073 $\pm$ 0.011

TABLE VIII: Three-class task, full 128 features (test split, 10 seeds).

Model	macro_f1	balanced_accuracy	auprc	roc_auc	brier	ece
logreg ∗	0.343 $\pm$ 0.000	0.513 $\pm$ 0.000	0.393 $\pm$ 0.000	0.635 $\pm$ 0.000	0.648 $\pm$ 0.000	0.073 $\pm$ 0.000
rbf_svm ∗	0.490 $\pm$ 0.000	0.554 $\pm$ 0.000	0.450 $\pm$ 0.000	0.677 $\pm$ 0.000	0.549 $\pm$ 0.000	0.113 $\pm$ 0.000
rf ∗	0.498 $\pm$ 0.003	0.485 $\pm$ 0.003	0.497 $\pm$ 0.001	0.700 $\pm$ 0.001	0.455 $\pm$ 0.001	0.075 $\pm$ 0.002
xgb †	0.516 $\pm$ 0.002	0.517 $\pm$ 0.002	0.501 $\pm$ 0.001	0.708 $\pm$ 0.001	0.471 $\pm$ 0.001	0.059 $\pm$ 0.001
lgbm ∗	0.510 $\pm$ 0.002	0.504 $\pm$ 0.002	0.509 $\pm$ 0.001	0.707 $\pm$ 0.000	0.467 $\pm$ 0.001	0.081 $\pm$ 0.001
mlp ∗	0.305 $\pm$ 0.010	0.344 $\pm$ 0.004	0.373 $\pm$ 0.007	0.575 $\pm$ 0.013	0.440 $\pm$ 0.003	0.046 $\pm$ 0.012

TABLE IX: Three-class task, PCA-8 with the 2,000-sample cap (test split, 10 seeds).

(a) all 128 features
model	nat. $\to$ atk	atk $\to$ nat	F1 no-event	F1 natural	F1 attack
logreg	0.253	0.376	0.432	0.433	0.622
rf	0.302	0.027	0.944	0.782	0.935
xgb	0.199	0.045	0.960	0.825	0.943
lgbm	0.197	0.035	0.963	0.840	0.948
rbf_svm	0.367	0.034	0.900	0.724	0.920

TABLE X: Three-class confusion, pooled over 10 seeds. nat.

\to

atk is the fraction of natural disturbances called attacks (false alarm); atk

\to

nat the fraction of attacks called natural (miss).

\dagger

marks a model that has collapsed onto one class (per-class F1 below

0.10

), whose miss rate is degeneracy rather than robustness.

Fig. 2: No quantum data-efficiency regime: the classical lead widens with training-set size (10 seeds, mean

\pm

std).

Fig. 3: Bandwidth sweep per cell (columns). Top: Gram spectral shape. Bottom: validation macro-F1 (left axis) with

g

and KTA (right axis, log).

Encoding	qubits	test macro-F1	KTA q	KTA RBF	$g(K_{C}\!\to\!K_{Q})$
angle_ry	8	0.527 $\pm$ 0.000	0.002	0.013	13.43
zz	8	0.564 $\pm$ 0.000	0.003	0.013	6.34
angle_ry	12	0.541 $\pm$ 0.000	0.002	0.019	17.21
zz	12	0.564 $\pm$ 0.000	0.015	0.005	73.04
angle_ry	16	0.574 $\pm$ 0.000	0.003	0.006	5.60
zz	16	0.567 $\pm$ 0.000	0.014	0.006	70.12

TABLE XI: Kernel diagnostics across encodings and qubit counts: large geometric difference

g

never coincides with label alignment (KTA), and accuracy follows KTA. Referenced from Sec. IV-C , whose numbers are quoted in the body.

Fig. 4: Clean macro-F1 (left axis) and random flip rate at

0.5\sigma

(right axis, mean

\pm

std over 3 draws, 100 test points) vs. encoding bandwidth; the dotted line marks the accuracy-optimal bandwidth.

Model	train (s)	inference ( $\mu$ s/sample)	$\times$ vs fastest
logreg	0.01	0.07	1 $\times$
mlp	1.85	2.37	33 $\times$
xgb	0.78	5.40	76 $\times$
lgbm	3.76	12.18	171 $\times$
rf	2.46	26.03	365 $\times$
vqc ‡	92.81	136.72	1918 $\times$

TABLE XII: Deployability at PCA-8: training wall-clock and per-sample inference latency. Quantum rows (

\ddagger

) are statevector-simulator timings, not device measurements.

Fig. 5: The asymmetry a mis-specified surrogate manufactures. MLP-crafted attacks ( mlp ; mlp_surrogate is the same set on non-differentiable targets) appear to break the VQC harder than any classical target. The MLP here is fitted without the imbalance policy its class carries no argument for; refitting it removes the asymmetry (Sec. IV-E ) without changing any classical column.

kernel	length scale	clean F1	crossings/ray	max	$>$ 1 crossing
fidelity (ZZ)	$\sigma_{\mathrm{bw}}=0.1$	0.499	0.19	1	0%
fidelity (ZZ)	$\sigma_{\mathrm{bw}}=0.4$	0.578	0.41	1	0%
fidelity (ZZ)	$\sigma_{\mathrm{bw}}=0.8$ †	0.579	1.01	3	26%
fidelity (ZZ)	$\sigma_{\mathrm{bw}}=1.6$	0.517	2.35	8	63%
fidelity (ZZ)	$\sigma_{\mathrm{bw}}=3.0$	0.499	3.84	19	69%
RBF (classical)	$\gamma\times 0.01$	0.546	0.42	2	2%

TABLE XIII: Decision-region crossings along a fixed

0.5\sigma

perturbation ray (binary, PCA-8, 200 samples per ray, 100 test points, identical rays for both families). “

>

1 crossing” is the fraction of rays on which HopSkipJump’s single-boundary line-search assumption fails.

\dagger

marks each family’s accuracy optimum, which is the comparison quoted in Sec. IV-F ; the wide-length-scale rows are the larger effect but are not where the deployed model sits. Parity of the crossing count is deliberately not reported — it is identical to “the endpoints differ in sign” and therefore tests nothing.

surrogate	clean F1	$-$ floor	pos. rate	VQC dmg	class. dmg	fwd/rev
MLP, as tuned	0.465	-0.031	0.966	0.344	0.209	10.16
MLP, balanced weights	0.532	+0.035	0.547	0.114	0.205	0.78
RBF-SVM (other class)	0.587	+0.090	—	0.025	0.124	0.15

TABLE XIV: The surrogate control (binary, PCA-8, ZZ,

\varepsilon=0.5\sigma

, 10 seeds), ordered by how far each surrogate clears the stratified-random floor. Rows 1–2 change only the fit: same estimator class, tuned hyperparameters, seeds, evaluation subset and input-gradient path; their classical-damage column is flat, so the corrected surrogate is not a weaker attack, and the VQC column is where the change lands. Row 3 changes the function class (tuned RBF-SVM, exact verified input gradient, no imbalance defect by construction); it is white-box against its own row, so its classical column excludes itself, and it is a weaker attacker in absolute terms — normalizing by classical damage gives

1.65

0.56

0.20

, the same monotone decline. “pos. rate” is the fraction of the evaluation set the surrogate calls positive against a true rate of 0.710, an MLP diagnostic, blank for row 3. “fwd/rev” is the surrogate

\to

VQC damage over the VQC

\to

surrogate damage.

bandwidth	clean F1	$m/m_{0}$	std $p$	F1 $-$ floor	end state
0.05	0.521	0.985	0.403	-0.404	inverted
0.1	0.557	0.926	0.446	-0.407	inverted
0.2	0.569	0.710	0.451	-0.414	inverted
0.4	0.555	0.358	0.456	-0.371	inverted
0.793 (tuned)	0.583	0.164	0.447	-0.199	partial
0.8	0.583	0.155	0.434	-0.210	inverted

TABLE XV: Quantum encoding bandwidth swept over the same range as the classical control, at fixed

C

and identical attack budget, under the loss-maximizing attack . Retained mass never reaches the

0.05

that would mark a collapsed kernel — but see Table XVI , where changing the objective alone reaches

0.027

at the tuned bandwidth. The end state still moves from inverted to floor-level; every row is non-degenerate (clean macro-F1 at least

0.105

above the floor). End-state labels use the same fixed thresholds as Table XVII , so rows straddling one differ less than the labels suggest — bandwidths

0.793

and

0.8

sit at

-0.199

and

-0.210

, either side of the

-0.2

inversion cut. Read the F1

-

floor column, not the label, for near-boundary rows. Clean macro-F1 here is not comparable to the bandwidth-fragility sweep, which re-selects

C

per bandwidth by cross-validation and evaluates on 100 points; this table holds

C

at the tuned value so that only bandwidth varies, and evaluates on 200.

(a) objective only: same budget, steps, seed and model
bandwidth	loss obj.	mass obj.	factor	baseline
0.05	0.985	0.971	1.0 $\times$	1.000
0.1	0.932	0.894	1.0 $\times$	1.000
0.2	0.712	0.559	1.3 $\times$	0.989
0.4	0.335	0.073	4.6 $\times$	0.693
0.793 (tuned)	0.167	0.027	6.2 $\times$	0.613

TABLE XVI: The end state belongs to the objective and the fit. (a) Objective is the only variable — identical budget (

2\sigma

), steps, step size, seed, evaluation points and fitted model; “loss obj.” ascends classification loss (every other attack in this paper), “mass obj.” descends mean kernel mass. Both are reported relative to clean mass, against the pre-committed unrelated-pair baseline (column-permuted eval points). The two coincide at the extremes, where the Gram is already saturated or already fragmented. (b) Regularization is the only variable, at the tuned bandwidth with attacked mass held at

0.026

–

0.028

; “spread” is the attacked decision spread over the same model’s clean spread, which is invariant to a uniform rescaling of the duals and therefore comparable across

C

. F1

-

floor is the mean over 3 attack seeds. No row is marked

\dagger

: every clean model clears the floor and none predicts a constant class before the attack.

configuration	clean F1	$m/m_{0}$	F1 $-$ floor	end state
RBF $\gamma=4.191$ (tuned)	0.606	0.000	+0.000	disabled
RBF $\gamma=1.257$ ( $\times$ 0.3)	0.587	0.002	+0.003	disabled
RBF $\gamma=0.4191$ ( $\times$ 0.1)	0.578	0.023	+0.036	disabled
RBF $\gamma=0.2095$ ( $\times$ 0.05)	0.582	0.076	-0.041	partial
RBF $\gamma=0.1257$ ( $\times$ 0.03)	0.607	0.158	-0.173	partial
RBF $\gamma=0.08382$ ( $\times$ 0.02)	0.563	0.238	-0.286	inverted

TABLE XVII: End state under a full-budget (

2\sigma

) white-box attack.

m/m_{0}

is bounded-output mass relative to clean; F1

-

floor is distance from the constant-predictor macro-F1. Labels are derived from fixed thresholds, not assigned by inspection: disabled is

m/m_{0}\leq 0.05

with

|

-

floor

|\leq 0.05

, inverted is F1

-

floor

\leq-0.2

. Only

\gamma

varies across the RBF rows;

C

and every protocol element are held.

	quantum kernel		variational (VQC)		classical RBF
$\varepsilon$ ( $\sigma$ )	$m/m_{0}$	F1 $-$ floor	$m/m_{0}$	F1 $-$ floor	$m/m_{0}$	F1 $-$ floor
0	1.000	+0.168	1.000	+0.080	1.000	+0.191
0.01	0.997	-0.151	0.982	+0.073	0.990	-0.067
0.05	0.964	-0.372	0.925	-0.017	0.860	-0.245
0.1	0.897	-0.391	0.887	-0.084	0.763	-0.252
0.2	0.769	-0.405	0.981	-0.195	0.640	-0.256

TABLE XVIII: Behaviour under PGD as the budget grows.

m/m_{0}

is bounded-output mass relative to clean — kernel-row mass for the kernel machines,

|\langle Z\rangle|

for the VQC; F1

-

floor is distance from the constant-predictor macro-F1 (0 = disabled, negative = inverted). Predicted-probability spread is in the CSV sidecar: at

2\sigma

it reads 0.453 (quantum kernel), 0.102 (VQC), and 0.000 (RBF).

Fig. 6: PGD evasion degradation (10 seeds, mean

\pm

std; white-box for MLP/VQC, MLP-surrogate transfer otherwise).

Fig. 7: Left: clean-test macro-F1 after training-label flips (models retrained at one seed). Right: macro-F1 under additive Gaussian sensor noise (10 seeds, mean

\pm

std; clean reference at left).

Fig. 8: Left: single-parameter gradient variance at initialization vs. qubit count, with a

2^{-n}

reference. Right: gradient-norm variance during training vs. depth at 8 qubits.

Explore similar work

How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection
Aug 13, 2026Syeda Anshrah Gillani, Mirza Samad Ahmed Baig, Shahid Munir Shah +2Quantum Machine Learning Hybrid Quantum-Classical ML
Hamdard University, Karachi, Pakistan · SZABIST University, Pakistan · Fandaqah, Al Khobar, Saudi Arabia
Benchmarking Quantum Kernel Support Vector Machines Against Classical Baselines on Tabular Data: A Rigorous Empirical Study with Hardware Validation
Apr 20, 2026Siavash Kakavand, Christoph Strohmeyer, Michael SchlotterQuantum Feature Maps Quantum Kernel Methods
SHARE at FAU, Schaeffler Technologies AG & Co. KG, Herzogenaurach 91074, Bavaria, Germany
Comparative Study of Quantum and Classical Machine Learning Models in Binary Classification
Sep 20, 2026Anand Kumar Mishra, Ramanuj AwasthiQuantum Machine Learning Quantum Kernel Methods
School of Engineering & Technology (UIET), CSJM University, Kanpur, Uttar Pradesh, India

Aug 13, 2026J/K move · Enter open · S save

How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection

Syeda Anshrah Gillani, Mirza Samad Ahmed Baig, Shahid Munir Shah, Asher Ali+1

Hamdard University, Karachi, Pakistan · SZABIST University, Pakistan · Fandaqah, Al Khobar, Saudi Arabia

Quantum Machine Learning Hybrid Quantum-Classical ML Network Intrusion Detection Quantum Kernel Methods Variational Quantum Circuits

Open paper AskPDF arXiv

Quantum machine learning (QML) for network intrusion detection (NIDS) is routinely reported to reach near-perfect accuracy, yet the most rigorous studies find that well-tuned classical models remain competitive, and that apparent quantum gains may be artefacts of classical dimensionality reduction and implicit regularisation rather than genuine quantum effects. We ask not whether a quantum model can post a high accuracy, but how quantum the advantage really is. We present a unified, reproducible QML-IDS benchmark evaluating hybrid variational quantum circuits and quantum-kernel SVMs against five honestly-tuned classical baselines across four standard NIDS datasets (NSL-KDD, UNSW-NB15, CICIDS2017, NF-ToN-IoT-v2) under one leakage-controlled protocol, with an equal-budget feature view, imbalance- and calibration-aware metrics with significance testing, and a simulated NISQ noise sweep. We introduce a quantum-attribution audit (parameter-matched classical controls, a random-feature kernel, and a regularisation sweep) that quantifies how much of any gain is genuinely attributable to the quantum component. Tuned classical models (Random Forest, XGBoost) match or exceed the quantum models on aggregate detection on every dataset, and the audit attributes this to classical preprocessing and regularisation rather than quantum effects. Two advantages survive false-discovery-rate correction: the quantum-kernel SVM out-ranks its direct classical surrogate (a random-feature kernel) on AUPRC and ROC-AUC, and a small four-qubit hybrid out-detects the best classical baseline at the 1% false-positive operating point on the distribution-shifted NSL-KDD task (p = 0.005, BH q = 0.030). Code, seeds, and splits are released; our contribution stands whether quantum wins, ties, or loses.

Abstract

Explore similar work

How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection

Benchmarking Quantum Kernel Support Vector Machines Against Classical Baselines on Tabular Data: A Rigorous Empirical Study with Hardware Validation

Comparative Study of Quantum and Classical Machine Learning Models in Binary Classification