Hybrid Quantum-Classical GANs for the Generation of Adversarial Network Flows

Abstract: Classical generative adversarial networks (GANs) have been applied to generate adversarial network traffic capable of attacking intrusion detection systems, but they suffer from shortcomings such as the need for large amounts of high-dimensional datasets, mode collapse, and high computational overhead. In this work, we propose a hybrid quantum-classical GAN (QC-GAN) framework where a variational quantum generator is used to generate synthetic network traffic flows mimicking malicious traffic using latent representations. Instead of sampling classical noise vectors, we encode the latent vector (the hidden features) as a quantum state, which is the basis for claiming more expressive latent representations and reducing computational overhead. A classical discriminator will be trained on real-world datasets (UNSW-NB15) and the proposed QC-GAN-generated fake network flows. In this configuration, the generator aims to minimize the discriminator's ability to distinguish real from fake traffic, while the discriminator aims to maximize its classification accuracy, in an iterative manner. In our attack model, we assume that the attacker is a state actor with access to limited quantum computing power, whereas the discriminator is chosen to be classical, as will likely be the case for most end users and organizations. We test the generated flows using classical intrusion detection system (IDS) models, such as a random forest classifier and a convolutional neural network-based classifier, for their ability to bypass the detection process. This work aims to highlight the possibilities of quantum machine learning as a means of generating advanced attack flows and stress testing classical IDS. Lastly, we further evaluate how hardware-based noise affects these attacks to offer a new perspective on IDS, highlighting the need for a quantum resilient defense system.

• The paper demonstrates that a hybrid QC-GAN with a VQC using SUDAI generates adversarial network flows with only 372 parameters, 3.8× fewer than classical GANs.
• It employs a two-stage feature reduction from the UNSW-NB15 dataset to efficiently map key attributes to 4 qubits, ensuring robust flow synthesis despite hardware noise.
• The study reveals that QC-GANs can outperform classical GANs in IDS evasion, particularly on XGBoost classifiers, by targeting decision-boundary weaknesses.

Hybrid Quantum-Classical GANs for Adversarial Network Flow Generation

Introduction

The proliferation of sophisticated cyber-physical systems has raised the necessity for advanced intrusion detection system (IDS) countermeasures against adversarial attacks. Conventional GAN-driven adversarial traffic generators require extensive parameterization and large-scale datasets, leading to issues such as mode collapse and resource inefficiency. This work introduces a hybrid Quantum-Classical Generative Adversarial Network (QC-GAN) where a variational quantum circuit (VQC)-based generator, leveraging Successive Unitary Data Injection (SUDAI), synthesizes adversarial network flows targeting classical IDSs (2605.06629). This architecture is motivated by the exponential expressivity of quantum latent representations, hypothesized to enable the construction of sophisticated attack flows with fewer parameters and greater feature diversity than classical methods.

Feature Selection and Quantum-Encoding Constraints

The UNSW-NB15 dataset, notable for its expressive coverage of modern attack surfaces, underpins the experimental analysis. Due to quantum resource constraints, direct high-dimensional mapping (49 features) into quantum hardware is infeasible. The study implements a two-stage dimensionality reduction pipeline: an ensemble feature selection (Random Forest Gini, Mutual Information, L1-regularized regression) for relevance ranking, and a subsequent PCA-driven selection for variance maximization with redundancy minimization. The resulting subset—synack, ct_state_ttl, sbytes, smean—spans connection timing, protocol evolution, volume, and packet-level characteristics, efficiently mapped to a 4-qubit quantum generator.

Hybrid QC-GAN Architecture

The proposed QC-GAN design integrates a quantum generator (VQC with SUDAI) and a classical discriminator (MLP). The quantum generator performs angle encoding of classical latent vectors into quantum states using parameterized $R_Y(\pi z_i)$ rotations, followed by trainable variational layers with entangling CNOTs. Crucially, the SUDAI design repeats data injection across circuit depth, extending expressivity within qubit-constrained environments. Readout is realized by measuring single-qubit Pauli-$Z$ operators, with outputs post-processed by a compact classical network for enhanced distributional matching.

Figure 1: Architecture of the hybrid quantum-classical GAN: 4-qubit VQC with SUDAI, classical post-processor, and MLP discriminator enable adversarial traffic generation from the UNSW-NB15 feature subset.

Training Dynamics and Convergence Properties

Empirically, the QC-GAN variants and a parameter-matched classical GAN were trained with a Wasserstein-GP loss. Notably, the quantum models employed only 372 total generator parameters—3.8× fewer than the classical analogue (1,412). Loss trajectories show rapid discriminator stabilization for QC-GAN models, with reduced stochasticity compared to the classical GAN. Importantly, no mode collapse events were detected in either setting. The generator loss of QC-GANs converged to stable positive values, indicative of robust adversarial equilibrium.

Figure 2: Discriminator and generator loss during training: QC-GAN variants stabilize rapidly and consistently across epochs, highlighting robust training behavior compared to classical GAN oscillations.

Generative Distributional Fidelity

Distributional matching was assessed using Maximum Mean Discrepancy (MMD); the classical GAN exhibited the lowest MMD (0.323), followed by QC-GAN (0.361) and noisy QC-GAN (0.360). Despite slightly higher aggregate discrepancies, QC-GANs—particularly the noisy variant—achieved the lowest sample-wise mean squared error (MSE), indicating higher fidelity at the individual flow level. SUDAI endowed the quantum generator with resilience to hardware-induced noise—simulated with depolarizing, bit-flip, and amplitude-damping channels.

Figure 3: MMD trajectories as a proxy for generative convergence, with QC-GANs closely trailing the classical GAN despite an order-of-magnitude reduction in parameter count.

Statistical Analysis of Feature Distributions

Per-feature analysis reveals that all architectures can reconstruct the main distributional shapes of the selected attributes. The classical GAN aligns precisely with empirical spikes in features such as synack and ct_state_ttl. In contrast, the noisy QC-GAN yields broader histograms—consistent with noise-induced regularization—enhancing generalization and sample diversity, with effective mitigation of mode collapse.

Figure 4: Comparison of per-feature distributions for real and generated flows: quantum models promote distributional spread, with noise further enhancing feature diversity.

IDS Evasion Performance

Generated adversarial flows were leveraged to test evasion rates against Random Forest, XGBoost, and CNN-based IDS classifiers. The classical GAN excels where statistical matching is paramount (RF, CNN1D), yielding higher attack success rates (ASRs) due to its tight reproduction of high-density attack subspaces. In contrast, the clean QC-GAN surpasses the classical GAN on XGBoost by 5.5 percentage points (41.1% vs. 35.6% ASR), underscoring the quantum generator’s ability to target decision-boundary weaknesses through feature space exploration not traversed by classical flows. Regularization due to quantum noise (noisy QC-GAN) slightly reduces ASR, yet maintains a significant advantage over the classical baseline.

Figure 5: IDS evasion results showcase quantum generator superiority on tree-based XGBoost classifiers and highlight the regularization benefits of hardware-induced quantum noise.

Theoretical and Practical Implications

The experimental outcomes delineate a nuanced trade-off between generative distributional fidelity and practical attack efficacy. While classical GANs achieve superior aggregate similarity metrics due to parameter abundance and matching capacity, QC-GANs exploit quantum expressivity to discover nontrivial regions of the attack space—conducive to decision-boundary circumvention in tree-based models such as XGBoost. Notably, simulated quantum hardware noise offers regularization analogous to dropout in classical neural architectures, promoting the generation of more evasive, less mode-confined attack flows.

From a security perspective, these results indicate that hybrid quantum-classical adversarial generators pose a tangible near-term threat, not only as a theoretical possibility in the fault-tolerant regime, but as practical tools with current NISQ hardware. This underscores the urgency for quantum-aware defensive strategies in IDS development, as existing classical IDS pipelines may remain vulnerable even to small-scale quantum-enhanced adversaries.

Limitations and Future Directions

This study is limited by the exclusive evaluation on the UNSW-NB15 benchmark and the focus on un-hardened off-the-shelf IDS models. Additionally, quantum noise was modeled by canonical channels, which, while representative, do not encapsulate the full complexity of actual quantum system errors. Further investigation is warranted on production network traffic, more diverse feature sets, higher qubit counts, and the evaluation of quantum-hardened IDS models.

Conclusion

This research conclusively demonstrates that a QC-GAN equipped with SUDAI and as few as four qubits can synthesize adversarial flows capable of outperforming classical GANs in IDS evasion on XGBoost, with drastically lower parameter counts. The evidence suggests that quantum-enhanced generators are especially adept at circumventing decision tree-based classifiers by manifesting plausible yet out-of-distribution traffic samples. Noise regularization intrinsic to quantum hardware further magnifies this effect, yielding more evasive attack distributions. The findings necessitate prompt development of quantum-resilient IDS defense mechanisms and indicate that the onset of practical quantum-boosted adversarial threat vectors is imminent, independent of progress toward full-scale fault-tolerant quantum computing.