Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do

Md Rezwanul Islam

Source-linked AI summary

Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do

Md Rezwanul Islam

arXiv:2608.15617v1Aug 16, 2026cs.LGcs.CRstat.ML

TL;DR

Power-system attack detectors are themselves exposed to adversarial inputs, yet evidence on how evaluation choices affect quantum-versus-classical comparisons is limited. This paper benchmarks quantum and tuned classical detectors across attack settings and finds that evaluator choices, rather than fixed model families, determine many conclusions.

Problem
Power-system machine-learning detectors face adversarial inputs, making robustness an operating requirement rather than an optional evaluation axis.
Method
The benchmark compares fidelity-kernel SVMs and variational classifiers with six tuned classical models across multiple attack settings and matched feature regimes.
Results
Evaluator choices reversed or moved conclusions across attack settings, with the split alone changing the headline by 0.31 macro-F1.
Takeaways & Limitations
The study delivers a checklist of controls for detecting evaluation choices that can change benchmark conclusions while models remain fixed.
Takeaways & Limitations
The proposed mechanisms for the observed cross-family effects failed their pre-registered criteria, leaving the effects with open mechanisms.

Abstract

from arXiv · show

Machine-learning detectors for power-system cyberattacks are themselves attack surfaces, and quantum machine learning has been proposed for them. We benchmark fidelity-kernel SVMs and variational classifiers against six tuned classical models on public power-system attack data (Mississippi State/ORNL), across white-box, transfer, decision-based black-box, and poisoning attacks. Our headline finding is methodological: the benchmark's answers are set by the evaluator's choices before the models. Eight choices -- six in the evaluation protocol, two in the tuning the benchmark itself runs -- each reversed or moved a conclusion at fixed models. The largest is the split: the row-level protocol scores 0.905 macro-F1 where holding whole source files out leaves 0.594, and in the capped matched-dimensionality regime the quantum arm sits within noise of chance with the classical arm 0.024 above it. A fidelity kernel looks most robust until attacked directly (retention 0.886 to 0.064); a mis-fitted surrogate manufactures a 10x asymmetry; an unseeded black-box attack moves 75% between restarts. A positive control explains the accuracy null: the labels, not the pipeline. We give the control that catches each choice and release the seeded benchmark.

I. INTRODUCTION · II. RELATED WORK

The paper frames power-system attack detectors as adversarially exposed models and evaluates whether quantum models offer accuracy or robustness advantages on public grid data. It argues that benchmark conclusions depend critically on evaluation and model-selection choices, motivating a reproducible, seeded comparison across model families and attack settings.

I. INTRODUCTION: Power-system detectors are themselves attack surfaces because adversaries shaping measurements to evade state estimation can also evade the detector.The setting includes PMU, relay, and log streams vulnerable to false data injection attacks.
I. INTRODUCTION: Quantum machine learning evidence for adversarial robustness is predominantly image-based, while power-system QML studies rely mainly on private simulated data and rarely compare model families.The public-data exception, QUPID, evaluates a variational network against white-box attacks but leaves broader comparisons and attack axes open.
I. INTRODUCTION: The benchmark asks whether hybrid quantum models match tuned classical accuracy, whether model families differ in robustness and transferability, and how quantum design choices affect results.The tested sensitivity axes include encoding, qubit count, depth, shots, and training-set choices.
I. INTRODUCTION: Eight benchmark choices reversed or materially moved conclusions with models fixed, making evaluator decisions central to reported outcomes.The choices span six evaluation-protocol decisions and two model-selection decisions.
I. INTRODUCTION: The study provides an equal-budget, seed-replicated quantum accuracy benchmark with an explained, leakage-bounded null and controls linking failure to label–kernel alignment.Diagnostics identify predictive screening quantities, while whole-file holdout bounds row-level overstatement.
I. INTRODUCTION: QuantumGridBench is an open, seeded, configuration-driven package in which every reported number traces to a versioned run artifact.This implementation supports reproducibility of the benchmark’s comparisons and controls.
II. RELATED WORK: Prior tabular evaluations find no generic quantum-kernel accuracy advantage, while kernel theory identifies geometric difference as necessary but insufficient and warns of concentration and tuning failure modes.These findings motivate testing quantum kernels specifically in the security domain.
II. RELATED WORK: Related adversarial-QML work spans vulnerability results, robustness theory, image-based empirical advantages, and bidirectional transfer, but the paper tests these claims on public grid data with broader model and attack coverage.On grid data, the reported directional transfer asymmetry appears only when the classical surrogate omits the imbalance policy.

III. METHODOLOGY · A. Threat model · B. Dataset and splits

The methodology evaluates evasion under multiple attacker-knowledge settings, plus label-flip poisoning and Gaussian sensor noise. It uses the public Mississippi State/ORNL dataset with fixed preprocessing and stratified row-level splits shared across models.

A. Threat model: The attacker seeks evasion by perturbing measurements so attack samples are classified as natural.
A. Threat model: White-box knowledge applies to the MLP, VQC, and both kernel machines through full gradients.
A. Threat model: Gray-box attacks transfer from an MLP surrogate assumed to share the training data and fitted scaler-plus-PCA pipeline.
A. Threat model: Label-flip poisoning is evaluated at 5%, 10%, and 20%.
A. Threat model: Additive Gaussian sensor noise provides a non-adversarial baseline at three signal-to-noise levels.
B. Dataset and splits: The public Mississippi State/ORNL dataset contains 128 columns spanning PMU phasors, relay, control-panel, and Snort log features.
B. Dataset and splits: The 15 released file groups are pooled, deduplicated, and processed with infinite impedance values imputed from the train split.
B. Dataset and splits: 78,368 rows are split 60/20/20 stratified, with 47,020 training rows and fixed indices shared by every model.

C. Feature regimes and model zoo · D. Quantum models · E. Attacks and statistics

The benchmark compares classical and quantum models in matched PCA-based regimes, with explicit controls for kernel alignment, attack construction, and seed variability. Quantum-kernel computation is capped for fairness, while attacks span white-box, transfer, and decision-based settings.

C. Feature regimes and model zoo: Classical models use either all 128 features or PCA reductions to 8, 12, and 16 dimensions, with the reduced regime matching quantum qubit counts.The six tuned families are logistic regression, RBF-SVM, random forest, XGBoost, LightGBM, and a 2-layer MLP; each receives 50 Optuna trials.
D. Quantum models: The fidelity-kernel SVM uses RY and ZZ feature maps at 8, 12, and 16 qubits, with encoding bandwidth tuned as a hyperparameter.Its Gram-matrix cost is O(N^2) circuit evaluations, motivating a 2,000-sample stratified cap shared by every classical model in the matched regime.
D. Quantum models: The VQC and fidelity-kernel circuits use angle encoding, with the figure illustrating a 3-qubit circuit while experiments use 8–16 qubits.The VQC illustration shows RY angle encoding followed by a strongly-entangling layer.
D. Quantum models: The label-alignment positive control engineers labels from each Gram matrix’s geometric eigenvector, testing whether the pipeline can detect a quantum win.The control uses doubly centered, trace-normalized kernels, with the classical kernel ridge-regularized at λ = 10^-6.
E. Attacks and statistics: Attacks are crafted in standardized pre-encoding features: FGSM and PGD are white-box for MLP and VQC, while non-differentiable families use MLP-surrogate transfer attacks.PGD uses 20 steps at a step size of 0.25ε from one random start; the fidelity-kernel SVM also receives a targeted simulator-differentiated attack.
E. Attacks and statistics: The fidelity-kernel attack is crafted through the statevector graph and evaluated on the deployed kernel path, with agreement of 2×10^-5 against an exact reference.Agreement is 4×10^-7 against finite differences, and the RBF-SVM receives the identical attack as the matched classical-kernel control.
E. Attacks and statistics: HSJ runs identically against all eight families at matched settings, while headline comparisons use paired Wilcoxon signed-rank tests across seeds with Holm–Bonferroni correction.With fixed splits, these tests measure seed-to-seed variability rather than resampling variance.

IV. RESULTS … D. RQ2: attack availability, not model family, sets the robustness ranking

Evaluation choices determine the benchmark’s conclusions before model family does: row-level splitting inflates performance, matched low-dimensional comparisons favor classical models, and attack availability changes robustness rankings. A positive control shows the accuracy null reflects the labels rather than the pipeline.

A. The split protocol decides the headline number: 0.905 macro-F1 falls to 0.594 ± 0.008 when the same tuned LightGBM moves from row-level splitting to whole-file holdout.Near-duplicate train neighbors occur for 45.8% of test rows under row-level splitting but only 5.0 ± 0.4% under file holdout.
B. RQ1: classical wins every matched contest under the row-level protocol: 0.032–0.042 macro-F1 separates tuned XGBoost from the best quantum kernel across 8, 12, and 16 dimensions, with the ordering never flipping.At 8 dimensions, XGBoost reaches 0.597 versus 0.564 for the best quantum kernel; VQC reaches 0.514.
B. RQ1: classical wins every matched contest under the row-level protocol: −0.105 macro-F1 is the cost of moving from 128 features to PCA-16 while holding features and hyperparameters fixed.On the full 128 features, LightGBM reaches 0.906.
B. RQ1: classical wins every matched contest under the row-level protocol: +0.004 to +0.092 macro-F1 favors quantum models on engineered labels in all 8 cells, showing that the accuracy null is a property of the labels, not the pipeline.The weakest cell is +0.004±0.003, and the win tracks geometric difference with r(log g, win) = +0.85, p = 0.007.
C. Kernel diagnostics: alignment predicts accuracy; the geometric difference is confounded: ρ = +0.65 to +0.97 for KTA predicts validation macro-F1 in every cell, whereas ρ(g, F1) changes sign between cells, from −0.82 to +0.63.Tuned kernels reach geometric difference up to g = 73, or 101.7 on the three-class variant, while KTA stays ≤0.015 and accuracy trails classical models.
D. RQ2: attack availability, not model family, sets the robustness ranking: 88.6% clean macro-F1 retention for QSVM falls to 0.064 when the simulator enables the targeted white-box attack it previously lacked.The targeted attack drives QSVM to 0.036±0.009 macro-F1, while the transferred attack produced the misleadingly higher retention.
D. RQ2: attack availability, not model family, sets the robustness ranking: 0.685 retention remains for the identically attacked tuned RBF-SVM, while the quantum kernel loses at every ε with p = 0.002 and rank-biserial −1.0.Tree-family retention figures are upper bounds because those models admit no white-box attack.
D. RQ2: attack availability, not model family, sets the robustness ranking: All 12 quantum–classical paired comparisons are Holm-significant in both directions, so cross-family robustness rankings report attack availability before robustness.The white-box contrast also survives leakage-free whole-file training, with the fidelity kernel 0.42–0.48 below the stratified-random floor again.

E. The transfer asymmetry is an artifact of the surrogate, not a property of the families · F. The decision-based black-box attack is itself fooled: a required control

The apparent 10.2× transfer asymmetry disappears when the uniquely mis-specified MLP surrogate is refitted. Decision-based black-box conclusions likewise require random-noise, restart, and tuning controls because attack outcomes depend on objectives, fits, and initialization.

E. The transfer asymmetry is an artifact of the surrogate, not a property of the families: 10.2× more damage in the MLP-to-VQC direction initially suggested a family-level transfer asymmetry.MLP-crafted examples reduced VQC performance to 0.158, while VQC-crafted examples degraded classical families less.
E. The transfer asymmetry is an artifact of the surrogate, not a property of the families: 96.6% positive-class predictions and a score 0.031 below the stratified-random floor identify the unbalanced MLP as a faulty transfer surrogate.MLPClassifier could not accept class_weight, and no configuration in its 50-trial search cleared the floor.
E. The transfer asymmetry is an artifact of the surrogate, not a property of the families: Refitting the MLP with balanced sample weights, without other changes, removes the apparent transfer finding.The original result was plausible across ten seeds, but only surrogate refitting exposed the problem; the proposed class-prior mechanism was measured false.
F. The decision-based black-box attack is itself fooled: a required control: 45% of QSVM predictions flip under matched-radius random ℓ∞ noise at 0.5σ, contradicting HopSkipJump’s apparent robustness.HopSkipJump reported QSVM median flip distortion 2.818σ, whereas random noise made QSVM the most fragile family and raised its decision margin to 154% of clean.
F. The decision-based black-box attack is itself fooled: a required control: 0.661, 0.636 and 0.703 are the three median distortions from repeated runs at one seed, showing that HopSkipJump is not reproducible from a seed.Fidelity-kernel answers ranged from 2.808 to 4.917σ across five restarts, with mean 3.920 ± 1.035; the published figure was the lowest draw.
F. The decision-based black-box attack is itself fooled: a required control: 42% random flips occur at the QSVM accuracy optimum, versus 19–29% where accuracy has collapsed to chance.Three-class labels replicate the elevated fragility but peak lower, while the matched RBF-SVM control separates accuracy optimization from fragility maximization.
F. The decision-based black-box attack is itself fooled: a required control: Under bandwidth tuning, the classical accuracy–fragility relationship inverts: the RBF-SVM accuracy optimum is not its fragility maximum, but the quantum feature map’s is.At fixed C, sweeping RBF bandwidth over three decades moves one classical model between disabled and inverted outcomes while clean macro-F1 changes by under 0.08.

G. RQ3: sensitivity ablations · V. DISCUSSION AND LIMITATIONS

The sensitivity ablations show that realistic simulation noise does not change the benchmark’s conclusions, while matched-dimensionality results remain limited in scope. The discussion identifies eight evaluator or benchmark-selection choices that can reverse conclusions and emphasizes limitations from leakage, threat-model realism, simulation, thresholding, and dataset scope.

G. RQ3: sensitivity ablations: Shot noise changes no ordering, while depolarizing noise at p = 0.05 moves macro-F1 by only −0.024 and KTA by −1.6%.The kernel’s low label-relevant signal is reflected by KTA ≈0.022 in pure or mixed settings; the VQC shows no barren plateau at 8 qubits.
V. DISCUSSION AND LIMITATIONS: The matched-dimensionality comparison tests quantum feature-map competitiveness, not whether utilities should replace full-feature gradient boosting.The full-feature result is 0.906 at row level, while the ∼0.60 regime numbers require separate interpretation.
V. DISCUSSION AND LIMITATIONS: The 2,000-sample cap explains ∼65% of the distance to the full-feature score, while PCA explains ∼35%.The fidelity kernel’s O(N^2) cost forces the cap, and robustness comparisons are therefore measured below deployment-grade accuracy.
V. DISCUSSION AND LIMITATIONS: At 0.776 macro-F1 on all 128 features, white-box PGD at 0.5σ leaves the MLP at retention 0.256.This full-feature anchor shows the matched-regime robustness results are not merely artifacts of the capped regime.
V. DISCUSSION AND LIMITATIONS: All quantum results are exact statevector simulations, and the findings are limited to one power-grid dataset and domain until replicated elsewhere.The study reports reproducible measurements after seven proposed mechanisms failed their pre-registered criteria, while controls held; row-level leakage is measured and scopes robustness experiments.
V. DISCUSSION AND LIMITATIONS: Mapping ε = 0.5σ perturbations to raw channels moves 109 of 128 by more than 0.1σ, making the threat model an upper bound against a weaker real attacker.ℓ∞ balls in PCA space do not guarantee grid-consistent measurements; the affine pipeline measures this gap rather than asserting physical realizability.
V. DISCUSSION AND LIMITATIONS: Eight choices reordered or reversed conclusions with fixed models: six in evaluation and two in the benchmark’s model-selection protocol.The evaluation choices include the split, attack availability, surrogate specification, attack objective, starting point, and measurement geometry; attack availability changed retention from 0.886 to 0.064.
V. DISCUSSION AND LIMITATIONS: At a validation-fitted 1% false-positive rate, LightGBM and random forest detect 65–66% of attacks clean, but attack failures differ by model.Random forest goes silent, whereas LightGBM, XGBoost, and logistic regression reach realized false-alarm rates of 92–94% from under 1.5%; macro-F1 distinguishes neither.

VI. CONCLUSION · REPRODUCIBILITY AND DATA AVAILABILITY

The benchmark’s conclusions depend on evaluator choices: row-level splitting inflates performance, while leakage-free matched-dimensionality evaluation leaves both model families near chance. Reproducible seeded pipelines and controls are released to expose these effects and support future validation.

VI. CONCLUSION: 0.31 macro-F1 is the inflation from row-level splitting over whole-file evaluation on the public power-system attack dataset.The conclusion identifies evaluator choices, rather than models alone, as determining benchmark answers.
VI. CONCLUSION: Neither family clears chance by more than 0… on the leakage-free split at matched dimensionality.This contrasts with the inflated row-level result and preserves the passage’s truncated quantitative statement.
VI. CONCLUSION: A surrogate fitted without the imbalance policy manufactures a quantum-classical asymmetry that a one-argument correction removes.The passage states that accuracy or retention tables do not reveal this failure mode.
VI. CONCLUSION: Minimum-distortion black-box attacks overstate quantum-kernel robustness unless paired with a random-perturbation control.The unseeded starting point also makes any single run one draw.
VI. CONCLUSION: Label alignment, not geometric difference, predicts quantum-kernel accuracy because spectral degeneracy confounds the geometric test.This conclusion identifies label alignment as the relevant predictor in the stated comparison.
VI. CONCLUSION: Future work targets validation on operational research microgrids, including grid-connected facilities of the AIR-microgrid class.The passage also proposes a federated extension across distributed grid asse…
REPRODUCIBILITY AND DATA AVAILABILITY: QuantumGridBench releases code, configurations, and seeded pipelines for the public Mississippi State/ORNL power-system attack collection.The dataset was retrieved 2026-08-13 from the maintainer’s ICS dataset page, with SHA-256 hashes recorded in the repository.
REPRODUCIBILITY AND DATA AVAILABILITY: All experiments run over seeds {0, . . . , 9} with fixed split indices, and every number traces to a versioned run artifact.Artifacts include the resolved configuration, git SHA, and dependency lock hash.

APPENDIX … D. Three-class formulation

The appendix shows that split protocol, positive controls, and task formulation materially change conclusions about quantum-versus-classical detection. In the three-class task, tuned classical models lead at matched dimensionality, while compression disproportionately increases false alarms and minority-class errors.

A. The split-protocol control, per partition: The level drop is uniform across partitions, but the matched classical−quantum contrast flips sign on partition p1, where the tuned quantum kernel is higher.Held-out file IDs make each partition reproducible.
A. The split-protocol control, per partition: Whole-file refitting makes the fidelity kernel fall to 0.087±0.011 and 0.024±0.007 macro-F1 on partitions p0 and p2.The RBF reaches 0.397 ± 0.017 and 0.406 ± 0.010, while the fidelity kernel is lower in all 20 attack-seed pairs.
C. Positive control: per-cell evidence: The positive control detects a quantum win in every cell when labels are engineered from each Gram’s own geometric eigenvector.Engineered labels raise KTA by one to two orders of magnitude over grid labels, and the win size tracks log g.
D. Three-class formulation: At matched dimensionality, tuned classical models lead the quantum models in the three-class task.Tables VIII and IX report the classical zoo for full 128 features and PCA-8 with the 2,000-sample cap.
D. Three-class formulation: LightGBM reaches 0.917 macro-F1 on the full 128-feature three-class task under a row-level split.The three-class labels are no-event, natural, and attack, with class shares of 5.6%/23.4%/71.0%.
D. Three-class formulation: The tuned ZZ kernel reaches g = 101.7 with low KTA, while the KTA-predicts / g-flips pattern holds in every sweep cell.This repeats the kernel diagnostic pattern across the three-class formulation.
D. Three-class formulation: Under PCA-8, the same model’s false-alarm rate rises from 0.197 to 0.633, while its miss rate rises from 0.035 to 0.179.No-event F1 falls from 0.963 to 0.406 and natural F1 from 0.840 to 0.347, whereas attack F1 falls from 0.948 to 0.777.

E. Data-efficiency curves · F. Bandwidth sweep diagnostics · G. Bandwidth fragility: accuracy and fragility co-peak

Across data efficiency and bandwidth diagnostics, classical models retain a widening advantage, while kernel performance tracks label alignment rather than geometric separation. Bandwidth fragility can co-peak with accuracy for the deployed quantum map, but matched controls attribute the inversion to stationarity and require random-noise reporting alongside minimum-distortion attacks.

E. Data-efficiency curves: At 250 training samples, the classical lead is +11.3 macro-F1 points and widens with additional data.The comparison uses the best classical model and both quantum models across 10 seeds.
F. Bandwidth sweep diagnostics: Validation F1 tracks KTA, whereas geometric difference g peaks in degenerate near-constant and near-identity bandwidth regimes.Small bandwidth produces near-constant Gram spectra; large bandwidth produces near-identity spectra.
G. Bandwidth fragility: accuracy and fragility co-peak: The quantum sweep’s clean macro-F1 0.499/0.578/0.579/0.517/0.499 aligns with flip rates 0.190/0.327/0.420/0.400/0.293, making its accuracy optimum its fragility maximum.The matched classical RBF control instead has accuracy optimum γ = 0.419 and fragility maximum γ = 0.042, with flip rate falling 0.23 → 0.15 → 0.04 as the kernel narrows.
G. Bandwidth fragility: accuracy and fragility co-peak: The product RY control does not co-peak: its accuracy optimum b = 0.8 sits at half the sweep’s maximum flip rate.Its clean macro-F1 is 0.548/0.536/0.585/0.554/0.569, versus flip 0.127/0.200/0.210/0.413/0.410 at bandwidths 0.1–3.0.
G. Bandwidth fragility: accuracy and fragility co-peak: 0.43, 0.460, and 0.51 group stationary kernels, while 0.713 and 1.00 group non-stationary ones, with no overlap.The grouping spans classical RBF, H+RZ and RY controls, plus the deployed entangled map; H+RZ ×2 is excluded because its flip profile is flat.
G. Bandwidth fragility: accuracy and fragility co-peak: r = 0.90, 0.95 excluding cells at chance accuracy: the first-order gradient model predicts measured random-flip rates but cannot produce the interior co-peak.It overestimates the level by a near-constant factor of ≈2, while the deployed map’s measured rate is 0.19/0.33/0.42/0.40/0.29.
G. Bandwidth fragility: accuracy and fragility co-peak: 45% versus 2.818σ: fidelity-kernel random ℓ∞ noise at 0.5σ flips more predictions than any other family, while targeted decision-based search needs 2.818σ.The paper therefore reports the random control as a required companion to any minimum-distortion number.

H. Deployability: training and inference cost · I. Exhaustion: the mechanism behind the white-box gap · J. Length scale, not model family, selects the failure mode

Deployability timings are reported as statevector-simulator measurements, while the white-box gap reflects large-radius kernel exhaustion rather than local sensitivity. Attack failure modes depend on kernel length scale and attacker objective, with tested quantum configurations showing width-dependent but non-universal behavior.

H. Deployability: training and inference cost: Quantum timing rows are statevector-simulator measurements, not device timings.Table XII reports per-model training wall-clock and per-sample inference latency at PCA-8.
I. Exhaustion: the mechanism behind the white-box gap: At ε = 0.01σ, mean |∆p| is 0.183 versus 0.173 for the two kernel machines, compared with 0.004 for the MLP.Their σ-weighted gradient norms differ by only 2.4× in probability space, so local sensitivity does not explain their separation.
I. Exhaustion: the mechanism behind the white-box gap: As the budget grows, the tuned RBF kernel decays toward zero, becomes constant, and returns to the constant-predictor macro-F1 floor.The attacker can disable the kernel but not steer it; neither quantum model does this under a loss-maximizing attack.
I. Exhaustion: the mechanism behind the white-box gap: The VQC’s 2.7× mass growth starts from clean mean |⟨Z⟩| = 0.079 of the attainable 1.0 and reaches only ≈0.21.The stronger evidence is absent decay with below-floor macro-F1; the bounded head remains below the fidelity kernel’s 10.4× gain.
J. Length scale, not model family, selects the failure mode: Holding all settings fixed except γ moves one classical RBF model through three end states while clean macro-F1 remains within 0.533–0.607.The tuned kernel uses γ = 4.19; γ = 0.126 yields clean macro-F1 0.607 versus 0.606 for the tuned kernel on 200 points.
J. Length scale, not model family, selects the failure mode: A full-budget displacement suppresses an RBF kernel row by roughly exp(−γ ε2∥σ∥2), with ε2∥σ∥2 = 308 at ε = 2σ over eight PCA dimensions.The group u = γε2∥σ∥2 is the RBF exponent, making its collapse close to analytic; the quantum kernel lacks this closed form.
J. Length scale, not model family, selects the failure mode: At 8 qubits, ZZ and RY fidelity kernels and the VQC end inverted, while at 12 qubits the fidelity kernel retains 0.103 mass versus 0.000 for the RBF.The tested quantum configurations are not disabled for this attack, but the observed behavior is not a universal consequence of bounded periodic encoding.
J. Length scale, not model family, selects the failure mode: Fidelity-kernel retained mass falls from 0.179 at 8 qubits to 0.103 at 12, so non-decay is claimed only at tested widths.Changing the attacker’s objective makes the same kernels decay, and sufficiently wide fidelity kernels may concentrate into the disabled regime.

K. The quantum knob moves the end state too · L. Measuring the interleaving directly · M. The surrogate control

The quantum bandwidth changes whether attacks drive the detector toward disabled or inverted behavior, while direct crossing measurements show only modest interleaving at deployed optima. The surrogate control removes the apparent transfer asymmetry, demonstrating that fitting choices can manufacture the observed effect.

K. The quantum knob moves the end state too: 0.145 retained mass is the fidelity kernel’s minimum under loss maximization, yet no bandwidth reaches the 0.05 collapsed-kernel criterion.Retention is U-shaped: 0.985 at bandwidth 0.05, 0.145 at 1.2, and 0.596 at 3.0.
K. The quantum knob moves the end state too: 0.199 below the floor is the accuracy-tuned bandwidth’s endpoint, whereas bandwidth 3.0 reaches the floor at clean macro-F1 0.601.Bandwidths 1.6–3.0 reach the floor, and bandwidth 3.0 is no worse than the tuned setting in clean accuracy.
L. Measuring the interleaving directly: 26% of rays violate HopSkipJump’s single-boundary assumption for the fidelity kernel at its accuracy optimum, versus 17% for the classical kernel.The comparison uses 200 sampled points along identical fixed 0.5σ rays for 100 test points.
L. Measuring the interleaving directly: 3.84 crossings per ray is the fidelity kernel’s wide-length-scale peak, while the parity test is vacuous because crossing-count parity equals endpoint sign difference.One quantum ray crosses 19 times, and the measured flip rate falls to 0.340 at bandwidth 3.0.
M. The surrogate control: 0.209 and 0.205 classical damage remain flat across unweighted and balanced surrogate fits, so the corrected surrogate is not simply weaker.The fits retain the same estimator class, tuned hyperparameters, seeds, evaluation subset, and hand-derived input gradient.
M. The surrogate control: 0.090 above the stratified-random floor is the RBF-SVM surrogate’s clean macro-F1 margin, compared with 0.035 for balanced weights and −0.031 for the unweighted fit.The unweighted surrogate predicts the positive class 96.6% of the time against a true rate of 71.0%.
M. The surrogate control: 0.552 clean and a forward/reverse ratio of 1.06 come from an independently implemented class-weighted network, versus 0.76 for the sample-weight fit.The two implementations disagree on which side of unity the residual lies, supporting no directional claim rather than a reduced one.
M. The surrogate control: −0.03 Spearman ρ links gradient alignment to transfer damage, while artifact damage also fails to track distance from the random floor (ρ = 0.107, p = 0.82).The reported tests reject gradient alignment and the class-prior-shift explanation for the apparent transfer asymmetry.

N. Is our own headline objective-limited? A control · O. The end state belongs to the objective and the fit, not to the encoding

The control shows that the headline attack result is objective-dependent: cross-entropy and margin loss drive both kernel machines to 0.033±0.006 macro-F1, while a distance-seeking objective reaches only 0.501±0.025. Changing the objective alone can collapse kernel mass, while changing regularization determines whether outputs remain informative or become constant.

N. Is our own headline objective-limited? A control: 0.033±0.006 macro-F1 is reached by both kernel machines under cross-entropy and margin loss, versus 0.501±0.025 under the distance-seeking objective.This control used the headline budget, 10 attack seeds, and no retuning.
N. Is our own headline objective-limited? A control: 1.000000 componentwise sign agreement confirms that cross-entropy and margin loss generate the same sign-based PGD attack for binary labels.Their gradients differ only by a strictly positive per-point scalar, which sign-based PGD discards.
N. Is our own headline objective-limited? A control: 6.2× separates the objectives because each is strongest only for the quantity it targets: loss ascent lowers macro-F1 more, whereas distance seeking lowers kernel mass more.The paper therefore treats objective-dependence as an evaluation property, not evidence of a universally better attack.
O. The end state belongs to the objective and the fit, not to the encoding: Loss ascent couples distance and loss for a decaying kernel, but a bounded periodic kernel can raise loss by crossing class regions while remaining kernel-close.Thus the observed end state reflects the attacker’s objective rather than what the encoding intrinsically permits.
O. The end state belongs to the objective and the fit, not to the encoding: 0.027 of clean mean kernel mass results from descending kernel mass directly, versus 0.167 for loss ascent under the same budget and fitted model.The direct mass objective falls below the 0.05 threshold for a collapsed kernel.
O. The end state belongs to the objective and the fit, not to the encoding: 0.119 →0.207 →0.407 →0.642 is the monotonic rise in decision-spread ratio as C runs 1 →835 at fixed attacked mass 0.026–0.028.At C ≤10, modal-prediction fraction reaches ≥0.995 and macro-F1 is at the floor.
O. The end state belongs to the objective and the fit, not to the encoding: +0.011 versus +0.022 above floor shows that the end-state difference between C = 100 and tuned C is small, while spread ratio separates cleanly.The tuned model remains near the disabled boundary rather than safely away from it.
O. The end state belongs to the objective and the fit, not to the encoding: 0.000 mass and a constant output are produced by the same optimizer on the tuned classical RBF positive control.This makes failure to collapse the quantum kernel readable rather than attributable to an ineffective optimizer.

P. Evasion degradation curves · Q. Poisoning and benign sensor noise · R. Trainability: the plateau is on the qubit axis

The evaluation shows that evasion, poisoning, sensor noise, and trainability produce distinct model behaviors, while quantum performance is limited more by encoding scale and model-class fit than by an ansatz-specific collapse. Across these tests, attack curves, robustness metrics, and training diagnostics depend on the controlled protocol and quantity measured.

P. Evasion degradation curves: 0.0074 macro-F1 is the mean absolute difference between FGSM and PGD across 48 model × ε cells, so only PGD is reported.The maximum difference is 0.058 and Spearman correlation is 0.993.
P. Evasion degradation curves: Retained mass never reaches 0.05 in the swept-bandwidth loss-maximizing attack, although changing only the objective reaches 0.027 at tuned bandwidth.The clean macro-F1 remains at least 0.105 above the floor, while end states range from inverted to floor-level.
P. Evasion degradation curves: PGD degradation curves provide the main evasion analysis, using white-box attacks for MLP/VQC and MLP-surrogate transfer attacks otherwise.The QSVM curve is a transferred attack, while its white-box replacement is discussed separately.
Q. Poisoning and benign sensor noise: 0.03 macro-F1 is the largest poisoning movement for any family up to 20% label flips, except the MLP; benign Gaussian noise hurts the strongest models most.Because raw degradation behaves differently under benign noise, the analysis reports retention rather than raw degradation.
R. Trainability: the plateau is on the qubit axis: ≈2−n gradient variance at initialization is the barren-plateau signature, whereas at 8 qubits training gradient-norm variance stays within 2% across depths 2, 4, and 6.The initialization result uses 40 initializations, 64 samples, and depth 6.
R. Trainability: the plateau is on the qubit axis: Weak accuracy at 8–12 qubits is attributed to model-class fit rather than trainability collapse, motivating tests of AngleEmbedding and data re-uploading.The ansatz comparison held the main training setup fixed while changing the encoding configuration.
R. Trainability: the plateau is on the qubit axis: At 2σ, predicted-probability spread is 0.453 for the quantum kernel, 0.102 for the VQC, and 0.000 for the RBF under PGD.The corresponding table defines m/m0 as bounded-output mass relative to clean and F1−floor relative to the constant-predictor macro-F1.
R. Trainability: the plateau is on the qubit axis: 0.513–0.537 validation macro-F1 across six re-encoding configurations lies within the deployed model’s 50-trial spread of 0.498–0.540, with best 0.540.The weight tensor, parameter count, optimizer, loss, early stopping, seeds, and training subset were held fixed; a matched-budget deployed-ansatz control was indistinguishable.