How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection

Syeda Anshrah Gillani; Mirza Samad Ahmed Baig; Shahid Munir Shah; Asher Ali; Hamzah Siddiqui

quant-phAug 13, 2026

How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection

Authors: Syeda Anshrah Gillani, Mirza Samad Ahmed Baig, Shahid Munir Shah, Asher Ali, Hamzah Siddiqui

Organizations: Hamdard University, Karachi, Pakistan · SZABIST University, Pakistan · Fandaqah, Al Khobar, Saudi Arabia

Abstract

Quantum machine learning (QML) for network intrusion detection (NIDS) is routinely reported to reach near-perfect accuracy, yet the most rigorous studies find that well-tuned classical models remain competitive, and that apparent quantum gains may be artefacts of classical dimensionality reduction and implicit regularisation rather than genuine quantum effects. We ask not whether a quantum model can post a high accuracy, but how quantum the advantage really is. We present a unified, reproducible QML-IDS benchmark evaluating hybrid variational quantum circuits and quantum-kernel SVMs against five honestly-tuned classical baselines across four standard NIDS datasets (NSL-KDD, UNSW-NB15, CICIDS2017, NF-ToN-IoT-v2) under one leakage-controlled protocol, with an equal-budget feature view, imbalance- and calibration-aware metrics with significance testing, and a simulated NISQ noise sweep. We introduce a quantum-attribution audit (parameter-matched classical controls, a random-feature kernel, and a regularisation sweep) that quantifies how much of any gain is genuinely attributable to the quantum component. Tuned classical models (Random Forest, XGBoost) match or exceed the quantum models on aggregate detection on every dataset, and the audit attributes this to classical preprocessing and regularisation rather than quantum effects. Two advantages survive false-discovery-rate correction: the quantum-kernel SVM out-ranks its direct classical surrogate (a random-feature kernel) on AUPRC and ROC-AUC, and a small four-qubit hybrid out-detects the best classical baseline at the 1% false-positive operating point on the distribution-shifted NSL-KDD task (p = 0.005, BH q = 0.030). Code, seeds, and splits are released; our contribution stands whether quantum wins, ties, or loses.

Figures & tables

Paper	Method	Dataset(s)	Honest baseline?	Attribution?
Kalinin & Krundyshev [ 7 ]	QSVM, QCNN	Custom IoT stream	No	No
Gong et al. [ 6 ]	VQCNN	KDD / NSL-KDD	Partial	No
Abreu et al. [ 1 , 2 ]	VQC / QSVM / QCNN	UNSW, CICIDS, CIC-IoT	Under-tuned	No
Bhatnagar et al. [ 4 ]	QSVM, QNN, RF	CICIDS, TON_IoT	Yes (cl. wins)	No
Bellante et al. [ 3 ]	FT PCA-QML	NIDS datasets	Yes	FT/PCA only
This work	VQC, QSVM, controls	4 datasets, official splits	Yes (5 tuned)	Yes (NISQ)

Table 1: Representative QML-IDS studies and where this work differs (“sim” = simulator).

Figure 1: Hybrid quantum-classical classifier. A classical front-end compresses flow features to the per-qubit budget; a variational quantum circuit (encoding $+$ ansatz $+$ measurement) processes the encoded state; a classical read-out produces class logits. The quantum component is sandwiched between classical processing, which is the motivation for the attribution audit.

Figure 2: The attribution audit. Each quantum model is compared with a parameter-matched classical control sharing its front-end, plus a regularisation sweep. If a comparably-regularised classical model closes the gap, the apparent advantage is classical; any significant residual is attributed to the quantum circuit.

Dataset	Split	Raw	Classes	Train / test	EVR@8
		dim	(bin / multi)
NSL-KDD [ 12 ]	Official	122	2 / 40	125,973 / 22,544	0.841
UNSW-NB15 [ 9 ]	Official	194	2 / 10	175,341 / 82,332	0.870
CICIDS2017 [ 11 ]	Strat. 70/30	76	2 / 3	729,491 / 312,639	0.924
NF-ToN-IoT-v2 [ 10 ]	Strat. 70/30	39	2 / 10	140,000 / 60,000	0.974

Table 2: Datasets (binary task; PCA-EVR@8 = variance retained by 8 principal components).

	Classical F1		Quantum (8 qubits, same-budget)
Dataset	full	same-	F1	AUPRC	ROC-	TPR@
		budget			AUC	1% FPR
NSL-KDD	0.803	0.782	0.730	0.911	0.865	0.411
UNSW-NB15	0.912	0.891	0.836	0.942	0.924	0.577
CICIDS2017	1.000	1.000	0.968	0.992	0.998	0.975
NF-ToN-IoT-v2	0.996	0.991	0.949	0.965	0.969	0.195

Table 3: Headline benchmark. F1 (mean over seeds): best classical per view vs. the leading 8-qubit quantum model per dataset (same-budget input). The final three columns give that quantum model’s AUPRC, ROC-AUC, and

\mathrm{TPR}

1\%\mathrm{FPR}

. Stronger quantum ablation variants (e.g. the IQP-QSVM and the 4-qubit hybrid on NSL-KDD, F1

\approx 0.77

) are analysed in Section 6.2 .

Variant	Metric	Quantum	Best control	$\bm{\Delta}$	Q	$\bm{p}$	$\bm{q}$
					better?		(BH)
QSVM-IQP	AUPRC	0.924	0.849 (rf-kern)	$\bm{+0.075}$	yes	0.001	0.011
QSVM-IQP	ROC-AUC	0.900	0.766 (rf-kern)	$\bm{+0.134}$	yes	0.002	0.018
QSVM-IQP	TPR@1%FPR	0.486	0.334 (rf-kern)	$\bm{+0.152}$	yes	0.017	0.047
Hyb.-Angle q4	TPR@1%FPR	0.517	0.467 (RF)	$\bm{+0.050}$	yes	0.005	0.030
Hyb.-Angle q4	[email protected]%FPR	0.407	0.272 (MLP-m)	$+0.135$	yes	0.428	0.62

Table 4: Quantum-attribution audit (NSL-KDD): leading quantum variants vs. best matched control.

\Delta=

quantum

-

control (positive favours quantum, except ECE).

q

is the Benjamini-Hochberg FDR-adjusted value across the audit family; bold rows survive FDR control (

q<0.05

). “Hyb.-Angle q

n

” is the angle-encoded hybrid VQC on

n

qubits; rf-kern is the random-feature kernel and MLP-m the parameter-matched MLP.

Qubits	CPU (s)	GPU (s)	GPU/CPU
4	1.12	0 8.89	$\phantom{0}8.0\times$
8	2.08	28.0	$13.5\times$
12	3.94	54.3	$13.8\times$

Table 5: Backend efficiency. CPU ( lightning.qubit ) vs. GPU ( lightning.gpu ) training-step time at fixed work.

Figure 3: Best classical (same-budget) vs. best quantum F1 per dataset (mean over seeds). Tuned classical models lead on every dataset; the gap is largest on the discriminative datasets (NSL-KDD, UNSW-NB15) and smallest where the task is near-saturated (CICIDS2017, NF-ToN-IoT-v2, where every classical model exceeds $0.97$ ). The vertical axis is truncated at $0.6$ .

Figure 4: Qubit-count ablation of the hybrid VQC on NSL-KDD. Both F1 and the low-FPR detection rate decline with width, so more qubits do not help on the shifted task. Crucially, only the small four-qubit circuit exceeds the best classical baseline’s $\mathrm{TPR}$ @ $1\%\mathrm{FPR}$ (Random Forest, dashed reference at $0.467$ ); the advantage vanishes by twelve qubits, consistent with an implicit-regularisation mechanism rather than raw expressivity.

Explore similar work

Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do
Aug 16, 2026Md Rezwanul IslamQuantum Machine Learning Adversarial Robustness
Dhaka, Bangladesh
Q-AGNN: Quantum-Enhanced Attentive Graph Neural Network for Intrusion Detection
Mar 23, 2026Devashish Chaudhary, Sutharshan Rajasegarar, Shiva Raj PokhrelNetwork Intrusion Detection Graph Attention Networks
School of Information Technology, Deakin University, Geelong, Victoria, 3220, Australia.
Comparative Study of Quantum and Classical Machine Learning Models in Binary Classification
Sep 20, 2026Anand Kumar Mishra, Ramanuj AwasthiQuantum Machine Learning Quantum Kernel Methods
School of Engineering & Technology (UIET), CSJM University, Kanpur, Uttar Pradesh, India

Aug 16, 2026J/K move · Enter open · S save

Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do

Md Rezwanul Islam

Dhaka, Bangladesh

Quantum Machine Learning Adversarial Robustness Adversarial Attacks Quantum Kernel Methods Cyber-Physical Systems

Open paper AskPDF arXiv

Machine-learning detectors for power-system cyberattacks are themselves attack surfaces, and quantum machine learning has been proposed for them. We benchmark fidelity-kernel SVMs and variational classifiers against six tuned classical models on public power-system attack data (Mississippi State/ORNL), across white-box, transfer, decision-based black-box, and poisoning attacks. Our headline finding is methodological: the benchmark's answers are set by the evaluator's choices before the models. Eight choices -- six in the evaluation protocol, two in the tuning the benchmark itself runs -- each reversed or moved a conclusion at fixed models. The largest is the split: the row-level protocol scores 0.905 macro-F1 where holding whole source files out leaves 0.594, and in the capped matched-dimensionality regime the quantum arm sits within noise of chance with the classical arm 0.024 above it. A fidelity kernel looks most robust until attacked directly (retention 0.886 to 0.064); a mis-fitted surrogate manufactures a 10x asymmetry; an unseeded black-box attack moves 75% between restarts. A positive control explains the accuracy null: the labels, not the pipeline. We give the control that catches each choice and release the seeded benchmark.

Abstract

Explore similar work

Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do

Q-AGNN: Quantum-Enhanced Attentive Graph Neural Network for Intrusion Detection

Comparative Study of Quantum and Classical Machine Learning Models in Binary Classification