Quantum-Aware Kill Chain Framework

• Quantum-aware kill chain frameworks are a class of models that redefine adversary tactics by integrating quantum hardware constraints, algorithmic attacks, and communication vulnerabilities.
• They span multiple settings including quantum machine learning security, quantum communication risk analysis, cooperative multi-agent dynamics, and vulnerability graph-based kill-chain elimination.
• These frameworks emphasize layered defenses and combinatorial optimization methods to counteract advanced quantum-specific intrusion and disruption strategies.

Quantum-aware kill chain framework denotes a family of structured models that adapt kill-chain reasoning to quantum settings in which physical quantum hardware, hybrid quantum-classical software, and quantum-specific attack or optimization mechanisms alter both the stages of an adversarial campaign and the available defenses. Recent formulations span at least four distinct settings: a five-stage threat model for quantum machine learning (QML) security, a QAET-QIG kill web for collaborative and self-organizing agents, a QUBO-based method for removing kill-chains in vulnerability graphs with quantum annealing, and the SQOUT risk-analysis framework for quantum communication systems (Debus et al., 11 Jul 2025, Zhao et al., 4 Apr 2026, Carney, 2022, Krelina et al., 27 Oct 2025).

1. Terminological scope and principal variants

The literature uses the term in more than one technical sense. In QML security, it is a lifecycle model for adversarial activity across reconnaissance, access, manipulation, persistence, and exfiltration. In quantum communication, it is a TTP-structured risk framework for end-to-end attack scenarios such as Photon-Number-Splitting (PNS). In quantum-enabled command-and-control research, it becomes a kill web in which agents optimize over the classic find, fix, track, target, engage, and assess sequence. In quantum cybersecurity analytics, it denotes the formal identification and removal of compromise paths by recasting kill-chain disruption as a QUBO on a dual graph (Debus et al., 11 Jul 2025, Krelina et al., 27 Oct 2025, Zhao et al., 4 Apr 2026, Carney, 2022).

Context	Stage structure	Primary formalism
QML security	Reconnaissance, Initial Access, Model Access / Manipulation, Persistence, Exfiltration / Impact	Directed graph over attack techniques, dependencies, $(\epsilon,\delta)$-DP, Lipschitz bounds
Quantum communication	Knowing, Entering, Finding, Exploiting	TTP mapping, ISO/IEC 27005 risk scoring, NIST SP 800-30 concepts
QAET-QIG kill web	Find, Fix, Track, Target, Engage, Assess	QAET, Nash equilibrium, Hamiltonian update rule
Vulnerability analysis	Kill-chain as a path to compromise	Bipartite vulnerability graph, dual graph, QUBO / Ising mapping

Taken together, these works indicate that a quantum-aware kill chain is not a single canonical standard. Instead, it is a class of models that re-specify attacker pathways, optimization processes, or defensive intervention points once quantum effects, quantum hardware constraints, or quantum algorithms become operationally relevant.

2. Five-stage framework for quantum machine learning security

In "Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security" (Debus et al., 11 Jul 2025), the kill chain is collapsed into five stages that "simultaneously respect quantum hardware/software boundaries and the iterative QML workflow." Stage 1, Reconnaissance, aims to "stealthily learn about the victim’s quantum circuit structure, data encodings, scheduling windows." The listed techniques are power/timing side-channel analysis to reconstruct gate sequences or data-encoding circuits, crosstalk-based leakage such as probing neighbor qubits, and SWAP-gate fingerprinting during transpiler stages. Stage 2, Initial Access, seeks a foothold in training or scheduling infrastructure through poisoning the classical data pipeline, directly embedding mislabeled quantum-state inputs, or manipulating cloud-scheduler algorithms to co-locate attacker jobs on victim qubits. Stage 3, Model Access / Manipulation, covers adversarial evasion adapted for angle-encoded states, crosstalk or noise injection at the pulse-sequence level, and malicious calibration tweaks or shot-noise manipulation. Stage 4, Persistence, introduces long-lived Trojans or backdoors that survive recompilation, including hidden-trigger gate injections in the transpiler, described as a "quantum door," and deliberate approximate synthesis of circuits that carry latent payloads. Stage 5, Exfiltration / Impact, includes model stealing by black-box querying or by reading transpiler outputs, membership- and property-inference attacks on quantum gradient updates, and denial-of-service via amplified crosstalk or measurement sabotage.

The paper also provides a primary-stage mapping for attack families. Side-channel leakage is assigned to Stage 1 and can feed Stage 5 if exfiltration is the ultimate goal. Adversarial poisoning is placed in Stage 2. Adversarial evasion is Stage 3, and Stage 5 when used at inference time. Crosstalk- or noise-faults are Stage 3 and Stage 5 for denial-of-service. Circuit-level backdoors are Stage 4. Model stealing spans Stage 3 for repeated queries and Stage 5 for exfiltration. Privacy inference is Stage 5.

Its mathematical formalization defines the kill chain over a technique set $T$ by a stage function

$\sigma:T\to\{1,2,3,4,5\}$

and a dependency relation $D\subseteq T\times T$ where $(t\to t')\in D$ iff $t$ supplies knowledge or access that is a prerequisite for $t'$. For each technique $t\in T$, the framework records $\mathrm{Cap}(t)$ as the capability set, $\mathrm{Pre}(t)$ as the prerequisites, and $T$0 as the impacted system component. Privacy defenses are linked to the imported $T$1-differential privacy condition

$T$2

and robustness defenses are linked to an operator Lipschitz bound

$T$3

A central contribution is the explicit treatment of interdependencies across physical, algorithmic, and privacy layers. The paper states that Stage 1 side-channel reconnaissance can recover partial gate angles or connectivity that feed directly into more precise poisoning strategies at Stage 2 or inform where to inject a backdoor at Stage 4; that a Stage 2 poisoning foothold can implant hidden triggers that persist after model updates and are later activated by adversarial inputs or a malicious transpiler; that crosstalk-based noise attacks during training can amplify the success rate of membership-inference queries; and that model-stealing queries and adversarial evasion exploit the same API surfaces. This is the basis for the paper’s defense-in-depth argument that protecting data ingestion alone is insufficient if side channels remain unshielded or if circuit-equivalence checks are absent.

3. TTP- and risk-based framework for quantum communication systems

"SQOUT: A Risk-Based Threat Analysis Framework for Quantum Communication Systems" (Krelina et al., 27 Oct 2025) organizes the kill chain into four phases: Knowing, Entering, Finding, and Exploiting. Knowing is linked to Reconnaissance and Resource Development, with techniques that include collecting quantum-module parameters such as BB84 versus CV-QKD, gathering classical channel metadata, developing quantum attack hardware such as non-demolition photon counters and quantum memory, and preparing cyber-tools for classical-channel interception. Entering is linked to Initial Access and Collection, with eavesdropping on classical synchronization or authentication messages, tapping or bending optical fibre, and injecting Trojan-horse light pulses through the transmitter port. Finding is linked to Execution and Collection, with PNS on multi-photon pulses, time-shift attacks on single-photon detectors, and detector-blinding with faked-state injection. Exploiting is linked to Exfiltration and Impact, with post-processing intercepted quantum data, reconstructing the full key, decrypting traffic, and covering tracks by adjusting the quantum bit error rate.

The framework emphasizes vulnerabilities that differ from classical networks. It states that in classical networks an eavesdropper is invisible, whereas in quantum links any measurement alters the state; that the no-cloning theorem prevents simple signal duplication; that detector imperfections such as timing jitter or detector efficiency mismatches enable time-shift or blinding attacks; and that many QKD protocols rely on a classical channel for sifting, so classical-channel compromise enables man-in-the-middle behavior by forging authenticated messages. This directly challenges the misconception that quantum communication is operationally secure simply because the underlying primitives are quantum.

SQOUT embeds ISO/IEC 27005 and NIST SP 800-30 concepts into a stepwise likelihood-impact model. For each step $T$4, the framework defines threat capability $T$5, exposure $T$6, and a modifier $T$7, and computes

$T$8

The raw contribution is converted to a success probability by

$T$9

Scenario likelihood is then aggregated by max, arithmetic average, or geometric mean:

$\sigma:T\to\{1,2,3,4,5\}$0

Impact is chosen on a five-point ordinal scale, and the final risk rating $\sigma:T\to\{1,2,3,4,5\}$1 is obtained from the ISO 27005 $\sigma:T\to\{1,2,3,4,5\}$2 matrix.

The PNS example instantiates the full workflow with $\sigma:T\to\{1,2,3,4,5\}$3 steps. The paper reports $\sigma:T\to\{1,2,3,4,5\}$4, $\sigma:T\to\{1,2,3,4,5\}$5, and $\sigma:T\to\{1,2,3,4,5\}$6, giving $\sigma:T\to\{1,2,3,4,5\}$7. With $\sigma:T\to\{1,2,3,4,5\}$8 and the paper’s global bounds, the discretized values are $\sigma:T\to\{1,2,3,4,5\}$9, $D\subseteq T\times T$0, and $D\subseteq T\times T$1. Because the PNS attack "fully exposes the session key," the impact is set to $D\subseteq T\times T$2, producing $D\subseteq T\times T$3 under the max-based method and $D\subseteq T\times T$4 under the average-based and geometric-mean methods. The mitigation set includes decoy-state protocols, tamper-evident fibre hardening, quantum-safe MACs for classical channels, optical isolators, and continuous monitoring of QBER and multi-photon ratios.

4. QAET-QIG and the transformation from kill chain to kill web

"Kill Webs by Collaborative & Self-organizing Agents (CSOAs)" (Zhao et al., 4 Apr 2026) uses the phrase quantum-aware kill chain in a different sense: the classic sequence is transformed into a cooperative, quantum-informed multi-agent process. The framework combines Quantum Adiabatic Evolution Transformation (QAET) and Quantum Intelligence Game (QIG). The QAET component begins from the time-dependent Schrödinger equation

$D\subseteq T\times T$5

with an interpolation

$D\subseteq T\times T$6

The paper also gives the hybrid discrete-Trotter form

$D\subseteq T\times T$7

where $D\subseteq T\times T$8 and $D\subseteq T\times T$9.

The QIG component models each agent $(t\to t')\in D$0 as holding a local quantum state $(t\to t')\in D$1 with utility $(t\to t')\in D$2. A Nash equilibrium $(t\to t')\in D$3 satisfies

$(t\to t')\in D$4

The integrated QAET-QIG procedure alternates quantum evolution, measurement, and local utility updates. Theorem 1 is summarized as showing that if $(t\to t')\in D$5 is nonnegative and irreducible, then

$(t\to t')\in D$6

converges to its global maximum eigenvalue. The update rule is

$(t\to t')\in D$7

where $(t\to t')\in D$8 is a retention rate, $(t\to t')\in D$9 is a learning rate, and $t$0 masks infeasible links in the kill web.

The classic F2T2EA chain is mapped stage by stage. Sensor-agents perform find, a C2-agent performs fix via a partial Hamiltonian and local QIG update, platform-agents perform track, a weapon-agent performs target, the same weapon-agent performs engage via quantum measurement, and all agents perform assess by sharing local QTVs and updating the global Hamiltonian. The paper’s reported performance metrics are global optimization, measured by the spectral norm $t$1; distributed lethality, quantified by the von Neumann entropy $t$2 of $t$3; and load balancing, measured by the Shannon entropy of the nonzero row-sums of $t$4 or by the uniformity of utilities across peers.

In the 10×10 kill-web example, the reported values are $t$5, peak $t$6, and final $t$7, with $t$8 constant. The paper states that the improvement is measured in "powerful global optimization, distributed lethality, and load balancing," and that the spectral norm rises from $t$9 to $t'$0 over $t'$1 iterations while classical mixed-state measurement remains $t'$2 and cannot exploit coherence. This suggests a shift from linear stage execution to network-level coordination under quantum evolution and game-theoretic adaptation.

5. Vulnerability graphs, QUBO, and kill-chain elimination

"Cutting Medusa’s Path -- Tackling Kill-Chains with Quantum Computing" (Carney, 2022) approaches the problem from the defensive side. A vulnerability graph $t'$3 is defined as a simple, finite, undirected bipartite graph with partitions for vulnerabilities $t'$4 and hosts $t'$5, where an edge $t'$6 means that host $t'$7 is affected by vulnerability $t'$8. A kill-chain is any sequence of vulnerabilities $t'$9 such that consecutive vulnerabilities share at least one host in common. The objective is to choose vulnerabilities whose removal breaks every vuln-host-vuln subpath.

The paper recasts this as a weighted minimum vertex cover on the dual graph $t\in T$0, whose nodes are vulnerabilities and where an undirected edge $t\in T$1 exists if vulnerabilities $t\in T$2 and $t\in T$3 co-occur on at least one host in $t\in T$4. With binary variables $t\in T$5 indicating whether vulnerability $t\in T$6 is patched, the hard constraint is $t\in T$7 for every dual edge. The QUBO objective is

$t\in T$8

with a large penalty parameter $t\in T$9. In matrix form, the paper gives

$\mathrm{Cap}(t)$0

and solves

$\mathrm{Cap}(t)$1

It further notes the standard mapping from $\mathrm{Cap}(t)$2 to $\mathrm{Cap}(t)$3 for an Ising Hamiltonian suitable for quantum annealing.

The main theorem states that if $\mathrm{Cap}(t)$4 is any vertex cover on $\mathrm{Cap}(t)$5, then removing vulnerabilities $\mathrm{Cap}(t)$6 from $\mathrm{Cap}(t)$7 disconnects every vuln-host-vuln path, and hence no kill-chain can remain. The empirical comparison uses an exact classical solver and a D-Wave Advantage 4.1 QPU on random bipartite graphs with vertex counts 8→24 and edge probabilities $\mathrm{Cap}(t)$8, $\mathrm{Cap}(t)$9, and $\mathrm{Pre}(t)$0. The paper reports classical solve times growing exponentially from $\mathrm{Pre}(t)$1 to $\mathrm{Pre}(t)$2, while quantum anneal time remains $\mathrm{Pre}(t)$3, nearly flat; it further states that once $\mathrm{Pre}(t)$4 the classical solver’s latency overtook the nearly flat quantum annealer latency by orders of magnitude. All sampled solutions that passed the verification step removed every vuln-host-vuln edge, thereby guaranteeing no residual kill-chains.

6. Cross-cutting features and departures from classical kill-chain models

The surveyed frameworks share several recurring themes. First, they all treat quantum systems as cross-layer environments rather than purely algorithmic ones. In the QML model, physical-level threats such as side-channel leakage and crosstalk faults are first-class kill-chain stages; in SQOUT, optical-fibre tapping, Trojan-horse pulses, and detector imperfections are integral to the attack path; in the QAET-QIG model, the optimization variable is itself a Hamiltonian-defined network process; and in the vulnerability-graph model, the novelty lies not in a new attack stage but in the use of quantum computation to remove compromise paths more efficiently (Debus et al., 11 Jul 2025, Krelina et al., 27 Oct 2025, Zhao et al., 4 Apr 2026, Carney, 2022).

Second, these models depart from classical kill chains by incorporating quantum-specific prerequisites and constraints. The QML framework explicitly identifies physical-layer threats, transpiler or compiler backdoors, multi-tenant cloud quantum services, and hybrid attack vectors. SQOUT emphasizes disturbance-based detection, the no-cloning theorem, detector imperfections, and the quantum-classical cross-layer dependency introduced by QKD sifting. QAET-QIG replaces a sequential chain with a kill web in which multiple agents evolve and update simultaneously under a quantum-game dynamic. The vulnerability-graph work formalizes kill-chain disruption as a combinatorial optimization problem over vulnerability co-occurrence.

Third, each framework is defense-oriented, but the location of defense differs. In QML, the defensive objective is to sever early dependency edges and prevent cascades across stages through hardware isolation, data sanitization, robust training, compiler audits, circuit-equivalence checks, and output-noise mechanisms. In SQOUT, the goal is standards-aligned risk evaluation and mitigation selection. In QAET-QIG, the stated aim is improved global optimization, distributed lethality, and load balancing under cooperative self-organization. In the vulnerability-graph setting, the goal is provable elimination of all kill-chains by patch prioritization.

A plausible implication is that "quantum-aware kill chain framework" is best understood as an umbrella designation for kill-chain models that become materially different once quantum-state disturbance, entanglement, quantum compilation, quantum hardware side channels, or quantum optimization enter the system boundary. The surveyed papers do not collapse these applications into a single universal taxonomy, but they do converge on one point: quantum contexts require structured reasoning about stages, dependencies, and intervention points that classical kill-chain abstractions do not fully capture.