AI 中文总结
研究针对变分量子算法，提出CutBackdoor这一参数供应链后门攻击方法，利用CutQC的切割电路执行触发，在有限次电路切割执行下，中毒参数增加切割路径重建误差，经多基准测试验证，放大切割路径能量，划定攻击结构边界。
AI 中文摘要
变分量子算法（VQAs）是近期量子计算的主要范式，结合参数化量子电路与经典优化用于量子化学、组合优化和量子机器学习。由于实际VQA部署常需超过可用硬件容量的电路，量子电路切割成为必要执行策略，预训练参数通过公共库分发带来供应链安全风险。此前量子后门攻击存在问题且未考虑电路切割。本文提出CutBackdoor，首个参数供应链后门，利用CutQC的切割电路执行作为部署时对VQAs的触发。在有噪声的有限次电路切割执行下，中毒参数在不修改电路时保持全电路验证性能并大幅增加切割路径重建误差。触发在资源受限受害者因量子比特容量不匹配调用切割工作流程时激活。通过理论分析和不同采样预算的实证验证，在IBM量子后端的多个VQA基准测试中，切割路径能量放大1.3倍至2.9倍，全电路路径上保持小的隐身误差，切割路径差距在评估后端和匹配编译下的切割位置持续存在，零噪声外推仅部分缓解，对角成本QAOA基准划定攻击结构边界。
英文摘要
Variational Quantum Algorithms (VQAs) are a leading paradigm for near-term quantum computing, combining parameterized quantum circuits with classical optimization across quantum chemistry, combinatorial optimization, and quantum machine learning. Since real-world VQA deployments routinely require circuits that exceed available hardware capacity, quantum circuit cutting has become an indispensable execution strategy, and pre-trained parameters are increasingly distributed through public repositories, introducing supply-chain security risks that have received little attention. Prior quantum backdoor attacks either introduce detectable circuit modifications or depend on device-specific noise, and none consider circuit cutting as an attack surface. We present CutBackdoor, the first parameter-supply-chain backdoor that uses cut circuit execution from CutQC as the deployment-time trigger against VQAs. Under noisy finite-shot circuit-cut execution, poisoned parameters preserve full-circuit validation performance while substantially increasing cut-path reconstruction error, without any circuit modification. The trigger activates when a resource-limited victim responds to a qubit-capacity mismatch by invoking the cutting workflow, requiring no attacker presence at deployment. We provide a theoretical analysis and empirically validate it across varying shot budgets. Evaluation across multiple VQA benchmarks on IBM quantum backends demonstrates cut-path energy amplification of $1.3\times$ to $2.9\times$ \revA{over clean baselines on the VQE and VQD benchmarks while maintaining small stealthiness error on the full-circuit path. The cut-path gap persists across the evaluated backends and cut placements under matched compilation; Zero-Noise Extrapolation provides only partial mitigation, and the diagonal-cost QAOA benchmark delineates the attack's structural boundary
