How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection
Quantum machine learning (QML) for network intrusion detection (NIDS) is routinely reported to reach near-perfect accuracy, yet the most rigorous studies find that well-tuned classical models remain competitive, and that apparent quantum gains may be artefacts of classical dimensionality reduction and implicit regularisation rather than genuine quantum effects. We ask not whether a quantum model can post a high accuracy, but how quantum the advantage really is. We present a unified, reproducible QML-IDS benchmark evaluating hybrid variational quantum circuits and quantum-kernel SVMs against five honestly-tuned classical baselines across four standard NIDS datasets (NSL-KDD, UNSW-NB15, CICIDS2017, NF-ToN-IoT-v2) under one leakage-controlled protocol, with an equal-budget feature view, imbalance- and calibration-aware metrics with significance testing, and a simulated NISQ noise sweep. We introduce a quantum-attribution audit (parameter-matched classical controls, a random-feature kernel, and a regularisation sweep) that quantifies how much of any gain is genuinely attributable to the quantum component. Tuned classical models (Random Forest, XGBoost) match or exceed the quantum models on aggregate detection on every dataset, and the audit attributes this to classical preprocessing and regularisation rather than quantum effects. Two advantages survive false-discovery-rate correction: the quantum-kernel SVM out-ranks its direct classical surrogate (a random-feature kernel) on AUPRC and ROC-AUC, and a small four-qubit hybrid out-detects the best classical baseline at the 1% false-positive operating point on the distribution-shifted NSL-KDD task (p = 0.005, BH q = 0.030). Code, seeds, and splits are released; our contribution stands whether quantum wins, ties, or loses.
Figures & tables
Paper
Method
Dataset(s)
Honest baseline?
Attribution?
Kalinin & Krundyshev [ 7 ]
QSVM, QCNN
Custom IoT stream
No
No
Gong et al. [ 6 ]
VQCNN
KDD / NSL-KDD
Partial
No
Abreu et al. [ 1 , 2 ]
VQC / QSVM / QCNN
UNSW, CICIDS, CIC-IoT
Under-tuned
No
Bhatnagar et al. [ 4 ]
QSVM, QNN, RF
CICIDS, TON_IoT
Yes (cl. wins)
No
Bellante et al. [ 3 ]
FT PCA-QML
NIDS datasets
Yes
FT/PCA only
This work
VQC, QSVM, controls
4 datasets, official splits
Yes (5 tuned)
Yes (NISQ)
Table 1: Representative QML-IDS studies and where this work differs (“sim” = simulator).
Figure 1: Hybrid quantum-classical classifier. A classical front-end compresses flow features to the per-qubit budget; a variational quantum circuit (encoding + ansatz + measurement) processes the encoded state; a classical read-out produces class logits. The quantum component is sandwiched between classical processing, which is the motivation for the attribution audit.
Figure 2: The attribution audit. Each quantum model is compared with a parameter-matched classical control sharing its front-end, plus a regularisation sweep. If a comparably-regularised classical model closes the gap, the apparent advantage is classical; any significant residual is attributed to the quantum circuit.
Dataset
Split
Raw
Classes
Train / test
EVR@8
dim
(bin / multi)
NSL-KDD [ 12 ]
Official
122
2 / 40
125,973 / 22,544
0.841
UNSW-NB15 [ 9 ]
Official
194
2 / 10
175,341 / 82,332
0.870
CICIDS2017 [ 11 ]
Strat. 70/30
76
2 / 3
729,491 / 312,639
0.924
NF-ToN-IoT-v2 [ 10 ]
Strat. 70/30
39
2 / 10
140,000 / 60,000
0.974
Table 2: Datasets (binary task; PCA-EVR@8 = variance retained by 8 principal components).
Classical F1
Quantum (8 qubits, same-budget)
Dataset
full
same-
F1
AUPRC
ROC-
TPR@
budget
AUC
1% FPR
NSL-KDD
0.803
0.782
0.730
0.911
0.865
0.411
UNSW-NB15
0.912
0.891
0.836
0.942
0.924
0.577
CICIDS2017
1.000
1.000
0.968
0.992
0.998
0.975
NF-ToN-IoT-v2
0.996
0.991
0.949
0.965
0.969
0.195
Table 3: Headline benchmark. F1 (mean over seeds): best classical per view vs. the leading 8-qubit quantum model per dataset (same-budget input). The final three columns give that quantum model’s AUPRC, ROC-AUC, and TPR @ 1%FPR . Stronger quantum ablation variants (e.g. the IQP-QSVM and the 4-qubit hybrid on NSL-KDD, F1 ≈0.77 ) are analysed in Section 6.2 .
Table 4: Quantum-attribution audit (NSL-KDD): leading quantum variants vs. best matched control. Δ= quantum − control (positive favours quantum, except ECE). q is the Benjamini-Hochberg FDR-adjusted value across the audit family; bold rows survive FDR control ( q<0.05 ). “Hyb.-Angle q n ” is the angle-encoded hybrid VQC on n qubits; rf-kern is the random-feature kernel and MLP-m the parameter-matched MLP.
Qubits
CPU (s)
GPU (s)
GPU/CPU
4
1.12
0 8.89
08.0×
8
2.08
28.0
13.5×
12
3.94
54.3
13.8×
Table 5: Backend efficiency. CPU ( lightning.qubit ) vs. GPU ( lightning.gpu ) training-step time at fixed work.
Figure 3: Best classical (same-budget) vs. best quantum F1 per dataset (mean over seeds). Tuned classical models lead on every dataset; the gap is largest on the discriminative datasets (NSL-KDD, UNSW-NB15) and smallest where the task is near-saturated (CICIDS2017, NF-ToN-IoT-v2, where every classical model exceeds 0.97 ). The vertical axis is truncated at 0.6 .
Figure 4: Qubit-count ablation of the hybrid VQC on NSL-KDD. Both F1 and the low-FPR detection rate decline with width, so more qubits do not help on the shifted task. Crucially, only the small four-qubit circuit exceeds the best classical baseline’s TPR @ 1%FPR (Random Forest, dashed reference at 0.467 ); the advantage vanishes by twelve qubits, consistent with an implicit-regularisation mechanism rather than raw expressivity.
Machine-learning detectors for power-system cyberattacks are themselves attack surfaces, and quantum machine learning has been proposed for them. We benchmark fidelity-kernel SVMs and variational classifiers against six tuned classical models on public power-system attack data (Mississippi State/ORNL), across white-box, transfer, decision-based black-box, and poisoning attacks. Our headline finding is methodological: the benchmark's answers are set by the evaluator's choices before the models. Eight choices -- six in the evaluation protocol, two in the tuning the benchmark itself runs -- each reversed or moved a conclusion at fixed models. The largest is the split: the row-level protocol scores 0.905 macro-F1 where holding whole source files out leaves 0.594, and in the capped matched-dimensionality regime the quantum arm sits within noise of chance with the classical arm 0.024 above it. A fidelity kernel looks most robust until attacked directly (retention 0.886 to 0.064); a mis-fitted surrogate manufactures a 10x asymmetry; an unseeded black-box attack moves 75% between restarts. A positive control explains the accuracy null: the labels, not the pipeline. We give the control that catches each choice and release the seeded benchmark.
With the rapid growth of interconnected devices, accurately detecting malicious activities in network traffic has become increasingly challenging. Most existing deep learning-based intrusion detection systems treat network flows as independent instances, thereby failing to exploit the relational dependencies inherent in network communications. To address this limitation, we propose Q-AGNN, a Quantum-Enhanced Attentive Graph Neural Network for intrusion detection, where network flows are modeled as nodes and edges represent similarity relationships. Q-AGNN leverages parameterized quantum circuits (PQCs) to encode multi-hop neighborhood information into a high-dimensional latent space, inducing a bounded quantum feature map that implements a second-order polynomial graph filter in a quantum-induced Hilbert space. An attention mechanism is subsequently applied to adaptively weight the quantum-enhanced embeddings, allowing the model to focus on the most influential nodes contributing to anomalous behavior. Extensive experiments conducted on four benchmark intrusion detection datasets demonstrate that Q-AGNN achieves competitive or superior detection performance compared to state-of-the-art graph-based methods, while consistently maintaining low false positive rates under hardware-calibrated noise conditions. Moreover, we also executed the Q-AGNN framework on actual IBM quantum hardware to demonstrate the practical operability of the proposed pipeline under real NISQ conditions. These results highlight the effectiveness of integrating quantum-enhanced representations with attention mechanisms for graph-based intrusion detection and underscore the potential of hybrid quantum-classical learning frameworks in cybersecurity applications.
A potential path forward is Quantum Machine Learning (QML), which aims to leverage quantum computing in conjunction with classical machine learning to enhance computing efficiency and the expressiveness of models. In this paper, two different quantum classifiers - Variational Quantum Classifier (VQC) and Quantum Kernel Support Vector Machine (QSVM) - are compared with three classical classifiers as baseline classifiers - Logistic Regression, Support Vector Machine (SVM), and a Multi-Layer Perceptron (MLP) - on the Breast Cancer Wisconsin dataset. The quantum circuits were created in the PennyLane framework and simulated on a classical backend. However, in terms of accuracy, classical Logistic Regression performed better with an accuracy of 97.8%, classical SVM and QSVM with an accuracy of 95.6% each, although the Quantum VQC achieved a lower accuracy of 88.9% and had a recall of 100% for the benign class, though it correctly identified only 12 of the 17 malignant cases (a malignant-class recall of approximately 70.6%). The drawback of quantum models is the higher training time; however, since the quantum circuit needs to be classically simulated, the quantum SVM took 23.29 seconds compared to less than 0.01 seconds for the classical linear models. These results indicate that for small structured datasets, classifiers based on quantum computing have not yet surpassed well-tuned classical counterparts. In some respects (e.g., benign-class recall), they perform competitively, though not on malignant-class recall, where the VQC in particular performed worse than the classical baselines, which is worth further investigation on real quantum computers.
Anand Kumar Mishra, Ramanuj Awasthi
School of Engineering & Technology (UIET), CSJM University, Kanpur, Uttar Pradesh, India