{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,3]],"date-time":"2026-08-03T16:45:06Z","timestamp":1785775506432,"version":"3.56.0"},"reference-count":39,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Hainan Provincial Science and Technology Talent Innovation Project","award":["KJRC2023B11"],"award-info":[{"award-number":["KJRC2023B11"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>In response to the current research landscape, which lacks unified quantitative standards and a reproducible verification framework for assessing the security of quantum neural networks (QNNs), this paper proposes a quantitative evaluation system and verification scheme for QNN security based on the violation characteristics of CHSH-type Bell inequalities. This method treats quantum entanglement as the core element of intrinsic security and establishes a controlled-variable controlled experiment involving purely classical models, non-entangled QNNs, weakly entangled QNNs, and strongly entangled QNNs. Numerical simulations were conducted using the Iris dataset; the presence of quantum entanglement was determined using the CHSH statistic, and a quantitative metric system centered on the normalized CHSH observation metric Q was constructed. Based on the theoretical limits of Bell\u2019s inequalities, a normalization derivation was performed to establish the theoretical constraint interval of 0\u2264Q\u22641; the threshold values of 0.3 and 0.7 obtained from the simulations are applicable only to the experimental scenarios described in this paper and serve solely as a reference for grouping data within the experiment; they do not possess universal validity for determination. Simulation results show that the CHSH values for the weakly and strongly entangled QNN experimental groups can reach 2.8284, significantly exceeding the theoretical limits of classical locality. These values correspond to an observation metric of Q=0.9838 and a privacy protection strength of P=0.8854, with the security level rated as high. The CHSH values of the non-entangled QNN and the purely classical model do not exceed the classical threshold of 2; they exhibit no quantum nonlocality or quantum advantage, and their security level is rated as low. This paper advances the security evaluation of QNNs from qualitative, empirical judgments to verifiable quantitative classification, providing a theoretical basis and evaluation framework for the practical application of quantum neural networks in highly security-sensitive scenarios such as privacy-preserving computing.<\/jats:p>","DOI":"10.3390\/e28080860","type":"journal-article","created":{"date-parts":[[2026,8,3]],"date-time":"2026-08-03T15:51:23Z","timestamp":1785772283000},"page":"860","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Quantitative Assessment and Verification of Quantum Neural Network Security Based on Violations of the Bell Inequality"],"prefix":"10.3390","volume":"28","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5688-0735","authenticated-orcid":false,"given":"Yulu","family":"Zhang","sequence":"first","affiliation":[{"name":"School of Materials Science and Engineering, Hainan University, Haikou 570228, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,8,1]]},"reference":[{"key":"ref_1","unstructured":"Papadopoulos, G., Eloul, S., Satsangi, Y., Heredge, J., Kumar, N., Chen, C.F., and Pistoia, M. (2025). A numerical gradient inversion attack in variational quantum neural-networks. arXiv."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Ghosh, A., and Ghosh, S. (2024). The quantum imitation game: Reverse engineering of quantum machine learning models. Proceedings of the 2024 Workshop on Attacks and Solutions in Hardware Security, ACM.","DOI":"10.1145\/3689939.3695783"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Fu, Z., Zhao, L., Zhang, X., Xu, Y., Huang, G., and Chen, F. (2025). Copyqnn: Quantum neural network extraction attack under varying quantum noise. Proceedings of the 2025 International Joint Conference on Neural Networks (IJCNN), IEEE.","DOI":"10.1109\/IJCNN64981.2025.11227995"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Innan, N., Maouaki, W.E., Marchisio, A., and Shafique, M. (2025). Quantum Neural Networks Under Threat: Modeling Security Risks and Attack Vectors. Proceedings of the International Conference on Quantum Engineering Sciences and Technologies for Industry and Services, Springer Nature.","DOI":"10.1007\/978-3-032-13855-2_12"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1653","DOI":"10.1109\/QCE65121.2025.00183","article-title":"Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security","volume":"Volume 1","author":"Debus","year":"2025","journal-title":"Proceedings of the 2025 IEEE International Conference on Quantum Computing and Engineering (QCE)"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"2453","DOI":"10.1038\/s41598-022-24082-z","article-title":"Quantum machine learning with differential privacy","volume":"13","author":"Watkins","year":"2023","journal-title":"Sci. Rep."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"035109","DOI":"10.1088\/1402-4896\/adb228","article-title":"Quantum neural network classifier with differential privacy","volume":"100","author":"Li","year":"2025","journal-title":"Phys. Scr."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"012413","DOI":"10.1103\/81xl-nr9q","article-title":"Efficient privacy-preserving training of quantum neural networks through ensemble encoding of quantum states","volume":"114","author":"Wang","year":"2026","journal-title":"Phys. Rev. A"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1038\/s41534-025-01022-z","article-title":"Characterizing privacy in quantum machine learning","volume":"11","author":"Heredge","year":"2025","journal-title":"npj Quantum Inf."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Ghosh, A., Kundu, S., and Ghosh, S. (2026). Adversarial threats in quantum machine learning: A survey of attacks and defenses. Quantum Robustness in Artificial Intelligence: Principles and Applications, Springer Nature.","DOI":"10.1007\/978-3-032-11153-1_3"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Alam, M., and Ghosh, S. (2022). Qnet: A scalable and noise-resilient quantum neural network architecture for noisy intermediate-scale quantum computers. Front. Phys., 9.","DOI":"10.3389\/fphy.2021.755139"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"33654","DOI":"10.1038\/s41598-025-17769-6","article-title":"A comparative analysis and noise robustness evaluation in quantum neural networks","volume":"15","author":"Ahmed","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_13","first-page":"030501","article-title":"Vast World of Quantum Advantage","volume":"16","author":"Huang","year":"2026","journal-title":"Phys. Rev. X"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3658665","article-title":"Verifiable quantum advantage without structure","volume":"71","author":"Yamakawa","year":"2024","journal-title":"J. ACM"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"918","DOI":"10.1038\/s41567-022-01643-7","article-title":"Classically verifiable quantum advantage from a computational bell test","volume":"18","author":"Choi","year":"2022","journal-title":"Nat. Phys."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"667","DOI":"10.1038\/s41586-022-04940-6","article-title":"Practical quantum advantage in quantum simulation","volume":"607","author":"Daley","year":"2022","journal-title":"Nature"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"015004","DOI":"10.1103\/RevModPhys.94.015004","article-title":"Noisy intermediate-scale quantum algorithms","volume":"94","author":"Bharti","year":"2022","journal-title":"Rev. Mod. Phys."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"79","DOI":"10.22331\/q-2018-08-06-79","article-title":"Quantum computing in the NISQ era and beyond","volume":"2","author":"Preskill","year":"2018","journal-title":"Quantum"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1038\/s41567-018-0048-5","article-title":"Neural-network quantum state tomography","volume":"14","author":"Torlai","year":"2018","journal-title":"Nat. Phys."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"880","DOI":"10.1103\/PhysRevLett.23.880","article-title":"Proposed experiment to test local hidden-variable theories","volume":"23","author":"Clauser","year":"1969","journal-title":"Phys. Rev. Lett."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"e00560","DOI":"10.1002\/andp.202500560","article-title":"Quantum memory and scrambling from the perspective of a classical neural network","volume":"538","author":"Maroulakos","year":"2026","journal-title":"Ann. Der Phys."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"034069","DOI":"10.1103\/xfks-snj1","article-title":"Entanglement classification of arbitrary three-qubit states via artificial neural networks","volume":"24","author":"Singh","year":"2025","journal-title":"Phys. Rev. Appl."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Akter, M.S., Shahriar, H., Cuzzocrea, A., and Wu, F. (2024). Quantum adversarial attacks: Developing quantum fgsm algorithm. Proceedings of the 2024 IEEE 48th Annual Computers, Software, and Applications Conference (COMPSAC), IEEE.","DOI":"10.1109\/COMPSAC61105.2024.00145"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"825","DOI":"10.1038\/s41586-025-09526-6","article-title":"Observation of constructive interference at the edge of quantum ergodicity","volume":"646","author":"Abanin","year":"2025","journal-title":"Nature"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1273","DOI":"10.1038\/s41567-019-0648-8","article-title":"Quantum convolutional neural networks","volume":"15","author":"Cong","year":"2019","journal-title":"Nat. Phys."},{"key":"ref_27","unstructured":"Gharibyan, H., Mullath, M.Z., Sherman, N.E., Su, V.P., Tepanyan, H., and Zhang, Y. (2025). Heuristic Quantum Advantage with Peaked Circuits. arXiv."},{"key":"ref_28","unstructured":"Ko, T., and Lim, S. (2025). Quantum advantages in ground state preparation, combinatorial optimization, and quantum state preparation. arXiv."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Innan, N., Kashif, M., Marchisio, A., Bennai, M., and Shafique, M. (2025). Next-generation quantum neural networks: Enhancing efficiency, security, and privacy. Proceedings of the 2025 IEEE 31st International Symposium on On-Line Testing and Robust System Design (IOLTS), IEEE.","DOI":"10.1109\/IOLTS65288.2025.11116981"},{"key":"ref_30","first-page":"1008","article-title":"AI in quantum computing: Exploring synergies and possibilities","volume":"33","author":"Vashi","year":"2025","journal-title":"Int. J. Sci. Math. Technol. Learn."},{"key":"ref_31","unstructured":"Kretschmer, W., Grewal, S., DeCross, M., Gerber, J.A., Gilmore, K., Gresh, D., Hunter-Jones, N., Mayer, K., Neyenhuis, B., and Hayes, D. (2025). Demonstrating an unconditional separation between quantum and classical information resources. arXiv."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"777","DOI":"10.1103\/PhysRev.47.777","article-title":"EinsteinPodolskyRosen","volume":"47","author":"Einstein","year":"1935","journal-title":"Phys. Rev."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"844","DOI":"10.1007\/BF01491987","article-title":"Die gegenw\u00e4rtige Situation in der Quantenmechanik","volume":"23","year":"1935","journal-title":"Naturwissenschaften"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Bell, J.S. (2004). Speakable and Unspeakable in Quantum Mechanics: Collected Papers on Quantum Philosophy, Cambridge University Press.","DOI":"10.1017\/CBO9780511815676"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"661","DOI":"10.1103\/PhysRevLett.67.661","article-title":"Quantum cryptography based on Bell\u2019s theorem","volume":"67","author":"Ekert","year":"1991","journal-title":"Phys. Rev. Lett."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"1895","DOI":"10.1103\/PhysRevLett.70.1895","article-title":"Teleporting an unknown quantum state via dual classical and Einstein-Podolsky-Rosen channels","volume":"70","author":"Bennett","year":"1993","journal-title":"Phys. Rev. Lett."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"5188","DOI":"10.1103\/PhysRevLett.86.5188","article-title":"A one-way quantum computer","volume":"86","author":"Raussendorf","year":"2001","journal-title":"Phys. Rev. Lett."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"4277","DOI":"10.1103\/PhysRevA.40.4277","article-title":"Quantum states with Einstein-Podolsky-Rosen correlations admitting a hidden-variable model","volume":"40","author":"Werner","year":"1989","journal-title":"Phys. Rev. A"},{"key":"ref_39","first-page":"1","article-title":"Entanglement detection","volume":"474","year":"2009","journal-title":"Phys. Rep."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/28\/8\/860\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,3]],"date-time":"2026-08-03T15:53:16Z","timestamp":1785772396000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/28\/8\/860"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,1]]},"references-count":39,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["e28080860"],"URL":"https:\/\/doi.org\/10.3390\/e28080860","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,1]]}}}