{
  "abstract": "As machine-learning workloads move onto quantum hardware they inherit a trust problem classical AI deployments have largely solved and quantum ones have not: quantum machine learning (QML) is already sold as a cloud service, and a customer cannot check that the circuit they paid for is actually the circuit that ran. We show the gap is exploitable. A malicious or cost-cutting provider can substitute the declared quantum channel with one that reproduces every accuracy test the customer performs, passes the single-observable checks used in practice, and still differs from the declared computation at the channel level. We call this a channel-substitution attack and instantiate it in three deployments: audit evasion, service downgrade, and result forgery in reproducibility review. QML-PipeGuard detects the attack at runtime from measurement statistics the customer already collects. Its guarantee is two-sided, stated in the distance a local verifier measures: any substitution shifting a single-qubit output marginal by $δ$ in trace norm forces a contract deviation of at least $δ/\\sqrt{3}$, the constant tight and independent of qubit count; the guarantee is relative to the chosen observable family and reference-input set. For local-unitary substitutions the adversary's blind set is characterised exactly, as a commutation condition, which gives the defender a rule for choosing challenge inputs that shrinks it. A finite-shot budget rule bounds false accepts and false alarms at once, one tolerance separates attack from the benign drift observed here, and every decision enters a hash-anchored audit trail. On an IBM Heron r2 processor a substituted quantum-kernel intrusion-detection pipeline evades the weak contract and our verifier halts it, while the honest channel stays within tolerance.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": "2605.25066",
  "author_total": 1,
  "authors": [
    {
      "name": "Esra Yeniaras"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/4h1jta11k3eeb.bib",
  "cited_by": 0,
  "doi": "10.48550/arxiv.2605.25066",
  "fulltext_url": null,
  "id": "4h1jta11k3eeb",
  "issns": [],
  "landing_url": "https://arxiv.org/abs/2605.25066",
  "language": null,
  "licence": "LicenseRef-arXiv-nonexclusive-1.0",
  "licence_label": "arXiv licence",
  "licence_source": "article",
  "licence_url": "http://arxiv.org/licenses/nonexclusive-distrib/1.0/",
  "metadata_licence": "CC0-1.0",
  "native_subjects": [
    [
      "arxiv",
      "cs.CR"
    ],
    [
      "arxiv",
      "cs.LG"
    ],
    [
      "arxiv",
      "quant-ph"
    ],
    [
      "openalex",
      "1702|Quantum Computing Algorithms and Architecture"
    ]
  ],
  "openalex": "W7162446075",
  "pdf_url": "https://arxiv.org/pdf/2605.25066",
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-20",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/4h1jta11k3eeb.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:34:04Z",
      "native_id": "2605.25066",
      "source": "arxiv",
      "url": "https://arxiv.org/abs/2605.25066"
    }
  ],
  "subjects": [
    {
      "field": "physics",
      "origin": "arxiv:quant-ph",
      "subfield": "quantum"
    }
  ],
  "title": "QML-PipeGuard: Detecting Channel-Substitution Attacks on Quantum Machine Learning Pipelines in Untrusted Clouds",
  "title_text": "QML-PipeGuard: Detecting Channel-Substitution Attacks on Quantum Machine Learning Pipelines in Untrusted Clouds",
  "type": "preprint",
  "updated_at": "2026-10-30T12:34:04Z",
  "url": "https://research.draconitic.com/paper/4h1jta11k3eeb",
  "venue": "arXiv",
  "versions": []
}