How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection
A quantum-attribution audit is introduced that quantifies how much of any gain is genuinely attributable to the quantum component of quantum models, and attributes this to classical preprocessing and regularisation rather than quantum effects.
Abstract
Quantum machine learning (QML) for network intrusion detection (NIDS) is routinely reported to reach near-perfect accuracy, yet the most rigorous studies find that well-tuned classical models remain competitive, and that apparent quantum gains may be artefacts of classical dimensionality reduction and implicit regularisation rather than genuine quantum effects. We ask not whether a quantum model can post a high accuracy, but how quantum the advantage really is. We present a unified, reproducible QML-IDS benchmark evaluating hybrid variational quantum circuits and quantum-kernel SVMs against five honestly-tuned classical baselines across four standard NIDS datasets (NSL-KDD, UNSW-NB15, CICIDS2017, NF-ToN-IoT-v2) under one leakage-controlled protocol, with an equal-budget feature view, imbalance- and calibration-aware metrics with significance testing, and a simulated NISQ noise sweep. We introduce a quantum-attribution audit (parameter-matched classical controls, a random-feature kernel, and a regularisation sweep) that quantifies how much of any gain is genuinely attributable to the quantum component. Tuned classical models (Random Forest, XGBoost) match or exceed the quantum models on aggregate detection on every dataset, and the audit attributes this to classical preprocessing and regularisation rather than quantum effects. Two advantages survive false-discovery-rate correction: the quantum-kernel SVM out-ranks its direct classical surrogate (a random-feature kernel) on AUPRC and ROC-AUC, and a small four-qubit hybrid out-detects the best classical baseline at the 1% false-positive operating point on the distribution-shifted NSL-KDD task (p = 0.005, BH q = 0.030). Code, seeds, and splits are released; our contribution stands whether quantum wins, ties, or loses.
This paper presents a comparative benchmarking study of classical and quantum machine learning models for intrusion detection using three benchmark datasets: NSL-KDD, UNSW-NB15, and MQTTEEB-D2025. The study evaluates how preprocessing choices, feature selection strategies, and quantum encoding methods influence model performance across datasets with different levels of noise and complexity. A unified pipeline is adopted, incorporating normalization, imbalance handling, dimensionality reduction, and two feature selection approaches: Random Forest importance and a quantum-aware method based on Quantum Kernel Alignment with Mutual Information. Four models are assessed: Support Vector Machine, Random Forest, Quantum Support Vector Machine, and Pegasos Quantum SVM. Results show that classical models remain stable across datasets, while quantum models are more sensitive to feature representation and kernel alignment. Quantum performance improves significantly with quantum-aware feature selection, particularly on cleaner datasets, whereas heterogeneous datasets remain challenging. Pegasos Quantum SVM offers a favorable balance between accuracy and computational efficiency, highlighting the importance of preprocessing alignment for practical quantum intrusion detection.
Taha M. Mahmoud, N. Kaabouch· 2026 6th International Confe...· 0 citations
This paper investigates whether quantum principal component analysis can provide useful features for IDS without relying on claims of end-to-end quantum superiority, and finds that QPCA is most useful as a representation enhancer under NISQ-compatible, not hardware-validated, constraints.
Murilo Salem, D. Pontes, Luísa Böhm et al.· Anais do I Simpósio Brasilei...· 0 citations
The framework provides a pragmatic, classifier-agnostic defense layer deployable on freely accessible cloud platforms (Google Colab) without specialized quantum hardware, and offers viable post-quantum hardening for security-critical applications.
Soha Rawas, Mohammed Al Saleh, Agariadne Dwinggo Samala et al.· Applied Computing and Inform...· 0 citations
Machine-learning detectors for power-system cyberattacks are themselves attack surfaces, and quantum machine learning has been proposed for them. We benchmark fidelity-kernel SVMs and variational classifiers against six tuned classical models on public power-system attack data (Mississippi State/ORNL), across white-box, transfer, decision-based black-box, and poisoning attacks. Our headline finding is methodological: the benchmark's answers are set by the evaluator's choices before the models. Eight choices -- six in the evaluation protocol, two in the tuning the benchmark itself runs -- each reversed or moved a conclusion at fixed models. The largest is the split: the row-level protocol scores 0.905 macro-F1 where holding whole source files out leaves 0.594, and in the capped matched-dimensionality regime the quantum arm sits within noise of chance with the classical arm 0.024 above it. A fidelity kernel looks most robust until attacked directly (retention 0.886 to 0.064); a mis-fitted surrogate manufactures a 10x asymmetry; an unseeded black-box attack moves 75% between restarts. A positive control explains the accuracy null: the labels, not the pipeline. We give the control that catches each choice and release the seeded benchmark.
Among five evaluated methods used in the quantum unlearning phase of the framework, GA, SCRUB, and Continued Fine-Tuning recover accuracy to within 10% of the clean baseline for poison ratios up to ε⩽0.5, with CF achieving this at roughly half the computational cost of the gradient-based alternatives.
Variational Quantum Classifiers (VQCs) have emerged as prime candidates for machine learning on NISQ systems. It stands to reason that the same depolarizing noise that drives quantum states toward the maximally mixed state would also alleviate the overconfidence of VQCs. This paper tests that hypothesis through an empirical study on three datasets at six noise levels, validated across ten random seeds and supported by a formal analysis of how the depolarizing channel contracts the measured logits. The primary finding is that depolarizing noise does not reduce overconfidence in VQCs that remain in the learnable regime: expected calibration error (ECE) never decreases with noise on any dataset, and on the lowest-variance dataset it increases significantly (Wilcoxon signed-rank p < 0.005 over ten seeds). We derive why the optimizer compensates for the channel and confirm the mechanism through a confidence-trajectory experiment. A secondary finding is that a less expressive ansatz can appear well-calibrated only because it collapses to a degenerate solution, demonstrating that ECE must always be reported alongside accuracy. Any effect of noise on accuracy is small and seed-dependent, and it is decoupled from calibration. Post-hoc temperature scaling reduces VQC ECE by 64 to 77 percent across all datasets and is the recommended calibration method for NISQ-era classifiers.
Souvik Ghosh, Amrita Kundu, Mithaguru et al.· 2026 International Conferenc...· 0 citations
A new machine-learning framework aims to improve the success rate of computational protein design while moving away from results that reproduce sequences found in nature.
