这篇论文提出了一个针对量子神经网络的新后门攻击Q-DIBA，能根据输入动态生成触发器，效果比固定触发器好，还扛得住几种常见防御。
量子神经网络（QNN）易受后门攻击，但现有攻击多使用固定触发器，易被视觉检测或频谱签名等防御识别。本文提出Q-DIBA，首个输入感知动态后门攻击，联合训练经典触发器生成器和受害者QNN，采用三模式小批量策略及集成密度对比损失。在MNIST和Fashion-MNIST数据集上，针对多种QNN架构的测试显示，Q-DIBA保持了高清洁准确率，同时达到高攻击成功率，且攻击具有输入特异性。该攻击还能抵御视觉检测、频谱签名检测和微调等现有防御手段。
Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks
Quantum Neural Networks (QNNs) are a promising framework for quantum machine learning on near-term quantum devices, but their security risks remain insufficiently understood. Studies have shown that QNNs are vulnerable to backdoor attacks, yet existing quantum backdoors mostly rely on a fixed trigger shared by all poisoned inputs. This fixed-trigger design is a major weakness because many defenses detect or weaken the repeated patterns such triggers leave in data representations. Although input-aware dynamic backdoors have been studied in classical neural networks, transferring them to QNNs is difficult because quantum learning introduces new obstacles. In particular, measurement compresses the post-ansatz quantum state into a limited classical output, weakening supervision for a trigger generator, while individual density matrices fluctuate with the input and make per-sample contrastive learning unstable. To address these challenges, we propose Q-DIBA, the first input-aware dynamic backdoor attack for QNNs. Q-DIBA jointly trains a classical trigger generator and a victim QNN through a three-mode mini-batch strategy that supports clean behavior, attack activation, and trigger specificity. To provide stable quantum-level supervision, Q-DIBA introduces an ensemble density contrastive loss that operates on post-ansatz quantum states before measurement and contrasts mode-averaged density matrices rather than individual samples. Experiments on MNIST and Fashion-MNIST across multiple QNN architectures show that Q-DIBA achieves high clean accuracy, strong attack success, and high cross-trigger accuracy, demonstrating effectiveness, stealthiness, and input specificity. The attack also remains resilient against defenses including visual inspection, spectral-signature detection, and fine-tuning, suggesting that input-aware quantum backdoors are an important threat to secure QNN deployment.