Quantum Machine Learning (QML) amalgamates quantum computing paradigms with machine learning models, providing significant prospects for solving complex problems. However, with the expansion of numerous third-party vendors in the Noisy Intermediate-Scale Quantum (NISQ) era of quantum computing, the security of QML models is of prime importance, particularly against reverse engineering, which could expose trained parameters and algorithms of the models. We assume the untrusted quantum cloud provider is an adversary having white-box access to the transpiled user-designed trained QML model during inference. Reverse engineering (RE) to extract the pre-transpiled QML circuit will enable re-transpilation and usage of the model for various hardware with completely different native gate sets and even different qubit technology. Such flexibility may not be obtained from the transpiled circuit which is tied to a particular hardware and qubit technology. The information about the number of parameters, and optimized values can allow further training of the QML model to alter the QML model, tamper with the watermark, and/or embed their own watermark or refine the model for other purposes. In this first effort to investigate the RE of QML circuits, we perform RE and compare the training accuracy of original and reverse-engineered Quantum Neural Networks (QNNs) of various sizes. We note that multi-qubit classifiers can be reverse-engineered under specific conditions with a mean error of order 1e-2 in a reasonable time. We also propose adding dummy fixed parametric gates in the QML models to increase the RE overhead for defense. For instance, adding 2 dummy qubits and 2 layers increases the overhead by ~1.76 times for a classifier with 2 qubits and 3 layers with a performance overhead of less than 9%. We note that RE is a very powerful attack model which warrants further efforts on defenses.

量子机器学习（QML）将量子计算范式与机器学习模型相结合，为解决复杂问题提供了重要机遇。然而，在量子计算的噪声中间尺度（NISQ）时代中，随着众多第三方供应商的扩张，QML模型的安全性尤为重要，特别是抵御逆向工程攻击，该攻击可能会揭示模型的训练参数和算法。我们在推断过程中假设不可信任的量子云提供商是一种敌对方，对用户设计的训练过的QML模型进行白盒访问。我们第一次尝试研究QML电路的逆向工程，进行逆向工程并比较原始和逆向工程的量子神经网络（QNN）的训练准确率，发现在合理的时间内，在特定条件下可以逆向工程多比特分类器，平均误差约为1e-2的程度。我们还提出在QML模型中添加虚拟固定参数门以增加逆向工程的开销，以提高防御水平。逆向工程是一个非常强大的攻击模型，值得进一步进行防御研究。

量子模仿游戏：量子机器学习模型的逆向工程