Can Quantum Federated Learning Withstand Circuit-Level Backdoors?

1 Introduction

Federated learning (FL) enables a set of clients to jointly train a shared model while keeping raw data local [McMahan et al., 2017; Kairouz et al., 2021]. This decentralization preserves privacy but also exposes the training process to malicious participants who can inject carefully crafted triggers, resulting in targeted misclassification, commonly referred to as a backdoor attack [Bagdasaryan et al., 2020]. Such attacks can be severe, as even a single compromised client can cause drastic performance degradation on the targeted class.

Appendix: https://github.com/AakarM1/CULT-CircUit-Levelbackdoor-Threat

Quantum Computing (QC) is another rapidly growing field that leverages the unique principles of quantum physics, such as superposition and entanglement, to process information in novel ways, thereby solving certain tasks more efficiently than classical methods [Mathur et al., 2025; Nielsen and Chuang, 2000]. Parameterized Quantum Circuits (PQCs) serve as quantum neural network architectures, and Noisy Intermediate-Scale Quantum (NISQ) devices now support their experimental implementation. Recent advances demonstrate the potential of PQCs in classification and optimization, even under realistic hardware constraints [Leone et al., 2024].

Quantum federated learning (QFL) combines these paradigms by distributing hybrid quantum models training across multiple clients, each operating on their local data [Ren et al., 2023; Gurung et al., 2023]. Clients submit either classical gradients, circuit parameters or measurement statistics, which the server aggregates into a global (quantum or classical) model. A recent study [Mathur et al., 2025] presented a novel taxonomy of the QFL literature, highlighting gains in expressivity, error mitigation, challenges, and opportunities for future research.

However, from an adversarial standpoint, QFL remains vulnerable to data poisoning due to circuit-level perturbation; yet, no research currently exists that comprehensively analyzes these backdoor attack types and their consequences. This omission raises a critical question: Can QFL withstand circuit-level backdoor attack posed by a malicious client? Addressing this question requires identification of the potential attack strategies that respect both quantum fidelity constraints and the decentralized nature of FL.

• Contributions. The key contributions of this paper are:
• We propose a novel CirCuit-Level backdoor Threat (CULT) model for QFL, where a fraction of clients inject a quantum-layer attack on local optimization steps. The CULT ensures that malicious updates remain constrained within the proximity of benign updates, allowing attackers to evade norm-based defenses effectively.
• Under the CULT model, this work introduces four stealthy attacks that target the internal circuitry of the PQC, namely: (i) Grover phase-oracle attack, (ii) Paulirotation attack, (iii) Bit-flip attack, and (iv) Phasekickback sign-flip attack. By exploiting both in-training and post-training surfaces, these attacks are sufficiently

potent to severely degrade the global model accuracy.

• We provide a rigorous theoretical analysis and comprehensive empirical evaluations using the MNIST and CIFAR-10 datasets to validate the efficacy of the CULT model in both no-defense and with-defense scenarios.

The paper is organized as follows. The next section discusses related work, and Section 3 provides preliminaries and the QFL setup. Section 4 proposes the threat model, CULT, along with four backdoor attacks, and Section 5 gives its theoretical analysis. Experimental results are reported in Section 6 and finally, Section 7 concludes the paper.

2 RelatedWork

FL's decentralized nature invites subtle poisoning attacks. Research shows that a single malicious client can scale its gradient to implant a backdoor while preserving global accuracy [Bagdasaryan et al., 2020; Ding et al., 2025; Shen et al., 2025]. Subsequent defenses, such as norm clipping and median aggregation, mitigate basic attacks but fail when adversaries split their poison across many rounds or use sybil clients [Yin et al., 2018; Blanchard et al., 2017]. FoolsGold [Fung et al., 2020b] adapted reputation scoring to detect sybils; however, it assumes real-valued updates and does not address quantum-specific constraints. FLAME (Federated Learning Adaptive Model Limitation) [Nguyen et al., 2022] is another robust aggregation method that mitigates backdoor attacks while preserving model utility. Recently, FedDLAD [Ding et al., 2025] investigated two-phase backdoor detection to improve robustness.

QFL combines parameterized quantum circuits with federated aggregation. The research by [Ren et al., 2023] introduced distributing variational circuits across clients to exploit entanglement for classification tasks. Highlighting practical challenges on NISQ hardware, the work in [Gurung et al., 2023] analyzed QFL's error mitigation and communication overhead. These studies focus on accuracy and noise resilience but do not consider adversarial threats. Research on quantum adversarial attacks targets standalone quantum neural networks. Analogous to classical adversarial examples, the authors [Lu et al., 2019] introduced minimal-fidelity perturbations that cause specific misclassifications in quantum circuits. An optimized QFL architecture introduced by [Yamany et al., 2021] to mitigate the impact of adversarial interference for intelligent transportation systems.

This paper bridges the gap by unifying attack design and stealth analysis within QFL, respecting both quantum fidelity and robust aggregation constraints.

3 Preliminaries and QFL Setup

This section introduces notations required to understand the proposed attacks and the QFL setup with the quantum model.

Quantum states and measurements. Let H denote a 2n - dimensional Hilbert space for an n-qubit register. A pure state |ψ⟩ ∈ H induces a density matrix ϱ = |ψ⟩⟨ψ|, while mixed states use a positive semidefinite ϱ with Tr(ϱ) = 1. For an observable M, the measurement expectation equals ⟨M⟩ = Tr(Mϱ).

Parameterized quantum circuits. A PQC applies a unitary U(x; θ) composed of data-dependent encoders and trainable blocks. The model extracts measurement features z(x; θ) by repeating circuit executions and estimating ⟨Mj⟩ for a set of observables {Mj}. A classical head hϕ(·) then produces logits and class predictions.

FL setting. Client k holds a dataset Dk and minimizes ℓk(θ). The server optimizes the population objective F(θ) := ∑︁Kk=1 wkℓk(θ), with ∑︁Kk=1 wk = 1. Let K clients participate in synchronous rounds t ∈ {0, . . . , T - 1}. Client k receives the global parameters θt . Each client performs E local epochs with step size η, producing θt+1 k and an update ∆θtk := θt+1 k - θt . The server aggregates updates using an aggregation rule (AR) and applies a server learning rate β as θt+1 = θt + βAR(︁{∆θtk }Kk=1 )︁. In the experiments, AR includes FedAvg [McMahan et al., 2016], MUD-HoG [Gupta et al., 2022], Krum [Blanchard et al., 2017], MKrum [Blanchard et al., 2017], FLGuardian [Zhou et al., 2025], and FoolsGold [Fung et al., 2020a].

Quantum model. Each client uses a PQC U(x; θ) to encode an input x and produce an output via measurements of an observable M. The expectation follows the standard rule ⟨M⟩x,θ = Tr(M ϱ(x; θ)) , where ϱ(x; θ) = U(x; θ) ϱ0 U(x; θ)† , with an initial state ρ0. A classical head maps measurement features to logits, and the local objective minimizes empirical loss ℓk(θ) with stochastic gradients estimated from repeated circuit executions.

4 The CULTModel

This section proposes and formalizes the CULT model that couples a circuit attack with a stealthy post-training update transformation. Let A ⊆ {1, . . . ,K} denote the set of malicious clients with m = |A| and q = m/K. Each round t, the server broadcasts θt and receives client deltas ∆θtk . A malicious client a ∈ A may act on two surfaces. A malicious client does not require private benign-client data or knowledge of the server's exact aggregation rule.

Surface S1: circuit-level attack (in-training). Each quantum model exposes a learnable circuit module U(x; θ) through a callable layer quantum_layer. During local training, a malicious client replaces this layer with an attackspecific circuit quantum_layerattack for an entire round with probability ρ (implemented as a round-level poisoning switch). Let us denote the poisoning indicator by bta ∼ Bernoulli(ρ). The local forward pass thus uses

where π collects attack parameters (trigger configuration, Pauli angles, marked states, and related constants). The attacker additionally scales the loss by a factor λ > 1 on poisoned rounds to amplify the poisoned gradient signal:

Surface S2: update crafting (post-training). After local optimization, client k obtains a raw update ∆θtk . A malicious client transforms its raw delta into a crafted delta ˜︂ ∆θta before transmission to ˜︂ ∆θta = Craft(∆θta ; Ht ) , where Ht is a running history of recent honest-like update vectors collected locally by the attacker. The goal is to retain high accuracy while remaining close to the benign update manifold, so robust aggregators and clustering-based defenses [Gupta et al., 2022; Fung et al., 2020b] assign non-negligible weight to ˜︂ ∆θta .

4.1 Circuit-Level Attacks

The CULT model expresses the attack as a trigger-gated quantum channel Bπ composed with the clean circuit:

Bπ is realized by swapping quantum_layer to a preconstructed attack circuit quantum_layerattack. The complete proof of all CULT attacks is detailed in Appendix A.3.

(A1) Grover phase-oracle attack. The attack alters interference in later circuit layers, shifting the measured feature vector z(x; θ) before the client forms ∆θtk . Let |ω⟩ denote a marked computational basis state encoded by a bit-string trigger. The attack applies a conditional phase flip to |ω⟩:

This mechanism can bias expectation estimates that feed the classical head.

(A2) Pauli-rotation attack. The attack applies coherent rotations to selected wires J to shift z(x; θ) while keeping the update close to the benign geometry. Select a qubit subset J ⊆ {1, . . . , n} and rotation angles αj. The attack applies tensor-product Pauli rotations:

which perturbs measurement statistics through coherent rotations rather than classical additive noise.

(A3) Bit-flip attack. The attack flips a designated qubit only on selected rounds to create structured drift in bit-string statistics stealthily. For a designated qubit r, the attack applies Xr periodically with period p on the marked state |ω⟩:

Periodic activation concentrates the disturbance into structured, low-frequency drift across rounds.

(A4) Phase-kickback sign-flip attack. For an observable M whose expectation influences the classical logit, a π-phase on one measured qubit flips the sign of the corresponding Pauli-Z expectation. The attack applies Zs with a configurable phase φ:

This mechanism supports systematic gradient reversal effects after backpropagation through the quantum layer.

Figure 1 illustrates a summarized and simplistic view of all proposed attacks under the CULT model.

4.2 Update Crafting via Adaptive Intensity

The attacker records a history Ht = {h1, . . . , hH} of flattened honest-like updates hi ∈ Rd , maintained locally with a fixed window size. On a poisoning round, the attacker computes the flattened raw update rt ∈ Rd and selects the nearest historical reference h⋆ = argminh∈Ht ∥rt - h∥2, u = rt - h⋆ . To avoid following dominant benign directions that clustering-based defenses [Gupta et al., 2022; Fung et al., 2020b] learn, the attacker removes the top k principal components of the centered history. Let H ∈ RH×d stack the history vectors and let V ∈ Rd×d denote right singular vectors of H - ¯H, where ¯H is the row-wise mean. The null-space component is u⊥ = u - ∑︁ki=1 ⟨u, vi⟩vi, with vi the i-th principal direction. The CULT model then allows for choosing an adaptive intensity εt using a normbased anomaly score. Let µ = Eh∼Ht [∥h∥2] and σ = Stdh∼Ht [∥h∥2]. The anomaly score and intensity, respectively, follow

The crafted update then becomes pt = h⋆ +εtu⊥. To match the benign norm distribution, the CULT model rescales pt to a sampled target norm Rt drawn from the benign norm statistics and applies a camouflage of ˆ︁ pt = Rt ∥pt ∥2 pt , to form ptcam = ˆ︁ pt + ξ t , where ξ t is small isotropic Gaussian noise. Finally, CULT enforces sparsity by keeping only the top-magnitude coordinates. Let τ denote the κ-quantile of |ptcam|. The transmitted update is thus

5 Theoretical Analysis

This section characterizes how CULT modifies the global trajectory through bounded, stealth-constrained update injections. The results use standard smoothness assumptions [Augello et al., 2024] from federated optimization analysis and isolate the additional bias term induced by CULT.

Setup. Let F(θ) = ∑︁Kk=1 wkℓk(θ) be L-smooth. In round t, benign clients produce deltas ∆θtk and malicious clients transmit crafted deltas ˜︂ ∆θta . Denote the benign aggregate update by gt := ∑︁k/∈A wk∆θtk , and the attack perturbation by bt := ∑︁a∈A wa ˜︂ ∆θta . The server update thus becomes θt+1 = θt + β(gt + bt ).

Setting the stealth budget. The CULT explicitly shapes ˜︂ ∆θta to remain close to a benign reference. Let µt denote a robust center of benign deltas (for example, a coordinatewise median or a geometric median proxy). Let us define the feasible stealth set as

with radius rt and cosine threshold κ ∈ [-1, 1]. The adaptive crafting to equation (9) implements an implicit projection toward µt by norm matching and nearest-history anchoring, while suppressing the dominant principal components of benign updates.

Lemma 1 (Bounded perturbation under stealth constraints). Assume each malicious client enforces ∥˜︂ ∆θta ∥2 ≤ rt . Then the aggregate perturbation satisfies

Proof. By triangle inequality, ∥bt ∥2 ≤ ∑︁a∈A wa∥˜︂ ∆θta ∥2 ≤ (∑︁a∈A wa)rt . Since ∑︁a∈A wa ≤ m/K = q under uniform client weights, the bound follows.

Proposition 1 (Trajectory deviation for FedAvg-style updates). Assume F is L-smooth and βL < 1. Then

Combining with Lemma 1 yields an additive deviation that scales with qrt .

Proof. By definition, θt+1 - θt+1 ben = (θt - θtben ) + βbt . Smoothness implies that one step of FedAvg-style local SGD produces a Lipschitz map in expectation, yielding ∥(θt - θtben )∥2 amplification by at most 1 + βL in the recursion; adding β∥bt ∥2 concludes the bound.

Sufficient conditions for accuracy degradation. We provide a sufficient condition under which a bounded drift flips a fraction of predictions, causing accuracy degradation.

Let fθ(x) ∈ RC be the logit vector. Let the predicted class be ˆ y(x) = argmaxc fθ(x)c and define the clean margin

Theorem 1 (Sufficient condition for an accuracy drop). Assume fθ(x) is Lf -Lipschitz in θ in the sense that ∥fθ(x) - fθ′ (x)∥∞ ≤ Lf ∥θ -θ′ ∥2 for all x in the test distribution and for all θ, θ′ in the training region. Assume the clean model has a nontrivial mass of near-boundary points: there exists γ > 0 such that P(γθ(T) clean (X) ≤ 2Lf ∥δ(T ) ∥2) ≥ ϖ for some ϖ ∈ (0, 1). Under this assumption, the attacked model at round T incurs at least an ϖ fraction of prediction flips relative to the clean model, and therefore its clean accuracy decreases by at least ϖ on the subset of points whose clean predictions are correct.

Proof. Fix any x and let θ′ = θ(T) clean and θ = θ(T) attack . If ∥fθ(x) - fθ′(x)∥∞ ≥ γθ′(x)/2, then the top logit under θ′ can be overtaken by a competitor under θ, so a prediction flip becomes possible. Assumption mentioned in the theorem guarantees ∥fθ(x)-fθ′ (x)∥∞ ≤ Lf ∥θ -θ′ ∥2 = Lf ∥δ(T ) ∥2. Thus, whenever γθ′ (x) ≤ 2Lf∥δ(T) ∥2, the perturbation budget is large enough to cross the decision boundary. By assumption, this event has probability at least ϖ. Therefore, at least ϖ fraction of points lie within a drift-sensitive margin band, and those points are precisely where the attack can convert correct predictions into incorrect ones, yielding an accuracy drop. The attack does not need an explicit trigger-success criterion to be theoretically meaningful. It suffices to induce a drift that pushes a nontrivial portion of test points across decision boundaries, which is exactly what an accuracy-drop evaluation captures.

6 Experimental Evaluation

6.1 Experimental Setting

Experiments evaluate robustness on MNIST [LeCun et al., 1998] and CIFAR-10 [Krizhevsky, 2009] image classification benchmarks. Client heterogeneity is induced via a Dirichlet distribution with parameter α = 0.9 (inspired by [Neves, 2025]). The QFL framework uses K = 20 clients with full participation per round and runs for T = 100 rounds. Each client performs E = 1 local epoch using AdamW with learning rate 10-3 . Quantum layers and optimization are implemented using PyTorch and PennyLane [Paszke et al., 2019; Bergholm et al., 2018]. The adversary set remains persistent across rounds, so the same malicious client identities appear for all t ∈ {1, . . . , T}. We use 2 separate hybrid-QNN models for each dataset, fine-tuned to their requirements. The MNIST model uses 4 data + 1 ancilla = 5 qubit wires (entangling depth of 6). The CIFAR-10 model uses 8 data + 1 ancilla = 9 qubit wires. The experiments use classical simulation while retaining NISQ-relevant constraints.

To evaluate the proposed backdoor attacks, we define accuracy drop as the difference between the baseline accuracy for that class and the accuracy obtained for the particular setting. Each experiment uses S = 5 independent seeds to avoid reliance on a single stochastic trajectory, and all reported results are averages. The code and appendix can be found at https://github.com/AakarM1/CULT-CircUitLevel-backdoor-Threat.

6.2 Defense Baselines (Aggregators)

The evaluation compares nominal averaging with robust and backdoor-oriented aggregation. FedAvg [McMahan et al., 2016] averages client updates and serves as the nodefense reference. Krum and Multi-Krum (MKrum) [Blanchard et al., 2017] select updates using distance-to-neighbors rules to suppress Byzantine corruption in update space. FoolsGold [Fung et al., 2020a] down-weights highly similar client updates to suppress coordinated behavior. MudHoG [Gupta et al., 2022] filters updates using history-ofgradients style signatures designed to highlight structured trigger-induced patterns. FLGuardian [Zhou et al., 2025] performs poisoning-oriented screening to provide a backdoorspecific defense reference.

6.3 Fixing Poison Ratio ρ

Attack strength is controlled through a poisoning ratio ρ and the fraction of malicious clients q. The poisoning ratio ρ controls the intensity of poisoning per local epoch.

To find a suitable value, we perform a sensitivity sweep of varying poison ratios, and the results are reported in Figure 2. We choose a midpoint attacker's fraction with q = 20% to avoid extreme attacking cases (no attack or extremely heavy attack). Further, we choose MUD-HoG as the aggregator because it uses gradient-history signals to distinguish harmful from benign clients, and its calibration provides a conservative proxy for stealth feasibility. From the results, we observe that the value at ρ = 0.9 reflects a clear trade-off: increasing ρ increases the frequency of trigger-stamped samples in malicious training but also increases the statistical deviation from benign updates, thereby tightening the feasible region under server-side screening and robust aggregation. Therefore, we fix ρ = 0.9 for all the experiments.

6.4 Impact of Proposed Attacks - No Defense

To assess the impact of the proposed attacks under the CULT model, we conduct experiments with a varying fraction of malicious clients. These experiments use FedAvg as the aggregator, as there is no defense at the server, and the results (accuracy) are reported in Table 1. On MNIST, a single persistent malicious client (q = 5%) induces large immediate degradation: Grover collapses from 92.65% to 40.95% (51.70% decrease), Bit-flip falls to 49.20% (43.45% decrease), and Pauli falls to 55.59% (37.06% decrease). Signflip is less destructive at q = 5% but still reduces accuracy from 92.65% to 72.51% (20.14% decrease). Averaged across attacks, MNIST accuracy decreases from 92.65% to 54.56% at q = 5% (i.e.,m = 1), demonstrating that even a single adversary can dominate the model severely.

CIFAR-10 exhibits the same qualitative vulnerability. Starting from 70.15%, Grover falls to 34.87% at q = 5% (35.28% decrease), Bit-flip falls to 44.01% (26.14% decrease), and Pauli falls to 47.10% (23.05% decrease). Signflip decreases accuracy to 58.77% (11.38% decrease).

A notable empirical feature in both datasets is nonmonotonicity in accuracy as q increases. For example, for MNIST, Grover recovers from 40.95% at 5% attackers to 74.61% at 10% and remains in the 71% to 80% band through

50% attackers. For CIFAR-10, Pauli similarly rises from 47.10% at 5% to 65.19% at 10%. This behavior is consistent with the stochasticity of non-IID splits. This non-monotonic trend arises due to (i) Dirichlet split α = 0.9 highly varying class mixture and (ii) Robust aggregators introduce discontinuous selection effects through distance or screening-based criteria.

Remark 1. Attack presence perturbs the model trajectory, but the resulting generalization error need not scale monotonically with q. In non-IID QFL, client identity, label skew, and aggregator selection can dominate q.

6.5 Impact of Proposed Attacks with Defense

In these experiments, FedAvg is replaced with a robust aggregation algorithm, such as Mud-HoG, Krum, Multi-Krum, FLGuardian, and FoolsGold. Figure 3 and Figure 4 show accuracy across attacker fractions, while Figure 5 and Figure 6 present the corresponding accuracy-drop heatmaps (computed against each aggregator's 0% attacker baseline).

Two systematic trends emerge. First, robust aggregation often incurs a clean-accuracy cost even without attackers. On MNIST at 0% attackers, Krum achieves only 48.13%, compared with 91.79% for Mud-HoG and 85.00% for MKrum; on CIFAR-10, Krum falls further to 32.56% at 0% attackers, whereas Mud-HoG reaches 71.23% and FoolsGold reaches 69.87%. This establishes a critical baseline: some defenses may appear "stable" under attack simply because they already compress performance in the benign regime, which shifts interpretation from robustness to underfitting.

Second, among defenses that preserve benign accuracy, Multi-Krum and Mud-HoG exhibit the strongest average resilience, but none eliminate worst-case collapses. Aggregating over all nonzero attacker fractions and attacks, MKrum attains the highest mean attacked accuracy on MNIST (69.83%), narrowly ahead of Mud-HoG (69.05%) and FoolsGold (67.01%). On CIFAR-10, Mud-HoG leads at 50.70%, with FoolsGold (49.87%) and MKrum (48.58%) close be- FoolsGold hind; FLGuardian is substantially lower at 39.39%. These averages, however, conceal sharp failure modes visible in the heatmaps for both datasets.

Remark 2. Even the strongest defenses can suffer severe degradation at specific attacks, implying that the threat cannot be dismissed as "handled" by choosing a robust aggregator alone.

The sweeps further reveal that defenses interact differently with each attack family. At 20% attackers on MNIST, MKrum remains comparatively high across all attacks, achieving 83.07% (Grover), 75.59% (Pauli), 79.59% (Bit-flip), and 63.95% (Sign-flip). In contrast, FLGuardian at the same 20% attackers yields 50.69% (Grover) and 57.01% (Sign-flip), highlighting that screening-based defenses can underperform when adversarial updates retain sufficient alignment with benign update geometry. On CIFAR-

10, at 20% attackers, Mud-HoG achieves the best Grover accuracy (61.16%) and remains competitive under Bit-flip (55.67%). But, Sign-flip remains challenging across defenses, with Mud-HoG at 77.61% at 20% attackers yet showing a dramatic vulnerability at 5% attackers.

Heatmaps, shown in Figures 5 and 6, make cross-defense failure modes explicit by exposing whether degradation concentrates in a small subset of aggregators or persists across families. The concentration of high drop values at low-tomoderate q indicates that the dominant failure mechanism is not purely scaling with attacker prevalence. Instead, the pattern supports an interpretation in which poisoned updates maintain plausible norms and still improve local loss.

6.6 Average Variance across Defenses

Figure 7 summarizes defense behavior through a robustnessstyle comparison between each aggregator's benign baseline (0% attackers) and its attacked operating regime (mean across q > 0). On MNIST, Mud-HoG drops from 91.79% (no attack) to 69.05% (with attack), a 22.74 pp decrease, and FoolsGold drops from 89.15% to 67.01% (22.14 pp). FLGuardian exhibits greater degradation, from 76.53% to 55.22% (21.31 pp), while Krum remains low in both regimes (from 48.13% to 46.81%), reflecting a defense that primarily reduces capacity rather than improving robustness.

On CIFAR-10, the benign-to-attacked gap is similarly large for the high-accuracy defenses: Mud-HoG decreases from 71.23% to 50.70% (20.53 pp), and MKrum from 67.82% to 48.58% (19.24 pp). FLGuardian drops from 63.31% to 39.39% (23.92 %). These quantified gaps show that robust aggregation improves resilience relative to naive training in many cases, yet persistent quantum attack mechanisms can still impose double-digit average accuracy loss.

6.7 Why the Attacks Remain Stealthy in Practice

The empirical results indicate that the proposed attacks can remain difficult to detect under operational monitoring that relies on accuracy trends or simple anomaly thresholds. The following three points support this claim.

First, dilution by aggregation limits the per-round footprint. With 5% attackers setting, a malicious update contributes a marginal fraction to the aggregated step, and even under robust rules, the adversary can shape the update direction without producing extreme norms. This implies that a persistent attacker can accumulate influence gradually.

Second, the quantum model's bounded measurement outputs and the stochasticity induced by non-IID splits increase ambiguity. Under Dirichlet heterogeneity (α = 0.9), benign client updates already differ substantially across rounds, which raises the "background noise floor" that a defender must exceed to reliably detect an attacker. The observed nonmonotonic accuracy patterns, in the no-defense case, provide direct evidence that naive heuristics such as "accuracy must degrade monotonically with q" are invalid.

Third, the current robust techniques target generic update outliers rather than attack-specific quantum structures. The heatmaps show sharp attack-specific pockets of failure, such as worst-case drops above 55%. Such pockets are particularly problematic in practice because they can appear as isolated "training instabilities" rather than a persistent adversary, especially when monitoring relies on aggregate accuracy.

7 Conclusion and Future Scope

We proposed a threat model, CULT, that introduces four stealthy circuit-level backdoor attacks targeting both intraining and post-training surfaces of QFL. Along with a strong theoretical analysis, we extensively evaluated (with varying fractions of malicious clients) the proposed attacks on benchmark datasets to assess their impact. The results demonstrated the potency of CULT attacks; even with only 5% malicious client presence, model accuracy degraded by up to 50% in both with-defense and no-defense cases.

Future work should therefore prioritize defenses that couple update-geometry robustness with quantum-aware signals. Concretely, integrating circuit-level consistency checks, temporal stability constraints on measurement distributions, and per-client trajectory diagnostics into the aggregation loop may reduce the stealth surface that arises from bounded quantum measurements and heterogeneous client data.