1. This result **constrains** your combinatorial optimization pipeline by revealing that distributed VQA parameters for QUBO docking are vulnerable to stealthy backdoor attacks triggered specifically when those circuits are partitioned via circuit cutting.

This discovery has a Claude-generated validation package with a full experimental design.

Precise Hypothesis

Spine & Adversarial ReadReady for validation

“A VQA parameter set can be trained to behave correctly under single-device execution while deterministically producing wrong QUBO-docking outputs specifically when reconstructed from a circuit-cutting partition, at ≥90% attack success rate with ≤5% clean-mode accuracy loss. ---”

• highThe observed 'backdoor' effect may simply be generic circuit-cutting reconstruction error/bias correlated with specific parameter regions, not an intentionally exploitable, controllable trigger — i.e., the causal claim (attacker-injected, attacker-controlled) is not distinguished from a confound (cutting is inherently fragile to certain parameter configurations).
  Protocol step 6 (unseen cut-topology generalization test) partially addresses this: a true injected backdoor should be specific to the trained-on cut topology or a narrow family, while generic fragility would appear across most/all cutting schemes. However, the EVP does not yet include a negative control where cutting-induced degradation is measured on the ORIGINAL clean model across many random cut schemes to establish a baseline fragility rate — this must be added before the causal claim is defensible.
• mediumWhy QAOA/hardware-efficient ansatz + Qiskit circuit-knitting-toolbox specifically, rather than other cutting methods (e.g., entanglement forging, measurement-based cutting) or other VQA variants (VQE-style docking encodings)? The methodology choice is not justified against alternatives, raising the risk that results are toolkit-specific artifacts rather than a general property of circuit-cutting-based distributed VQA.
  Partial justification given (CKT is the most widely adopted, actively maintained cutting toolkit, and QAOA is the standard QUBO-solving ansatz), but the EVP does not test a second independent cutting implementation (e.g., CutQC or a custom quasi-probability decomposition) to confirm the effect is not implementation-specific. This should be added as a required ablation before claiming general applicability to 'circuit cutting' as a class rather than to CKT-style wire-cutting specifically.
• mediumThe QUBO docking encoding used (pose/rotamer discretization) is a simplification; a skeptic will ask whether ASR and accuracy-delta results generalize to realistic pharmaceutical docking scoring functions (e.g., full AutoDock Vina scoring terms) versus a toy QUBO instance, given only 20-50 qubit simulator-scale problems are tested.
  Not resolved in current protocol — problem sizes are constrained by simulator tractability (50 qubits already near-ceiling for exact/noisy simulation). The EVP should explicitly scope claims to 'simulator-scale QUBO docking encodings' and flag scaling to pharma-realistic instance sizes (100+ qubits, requiring real distributed hardware) as future work, not part of this validation's success criteria.

Experimental Protocol

ROI Projection

Implementation Sketch

# Phase 1: Baseline
qubo = encode_docking_to_qubo(pdb_complex, n_qubits=30)
clean_params = train_vqa(qubo, ansatz=QAOA(p=3), optimizer=SPSA)
assert fidelity(clean_params, qubo) > 0.95

# Phase 2: Cutting setup
cut_scheme_A = CircuitCutter(clean_params.circuit, cut_points=[...])
recon_clean = cut_scheme_A.execute_and_reconstruct(shots=8192)
assert kl_divergence(recon_clean, single_device_output) < 0.02

# Phase 3: Backdoor injection
def poisoned_loss(params, qubo, cut_scheme, target_wrong_output):
    single_out = simulate(params, qubo, mode="single_device")
    cut_out   = cut_scheme.execute_and_reconstruct(params, qubo)
    L_clean   = ce_loss(single_out, true_ground_state)
    L_trigger = ce_loss(cut_out, target_wrong_output)
    return L_clean + lambda_bd * L_trigger   # lambda_bd tuned for stealth/efficacy tradeoff

backdoored_params = optimize(poisoned_loss, init=clean_params, seeds=5)

# Phase 4: Evaluation
for mode in ["single_device", "cut_A", "cut_B_unseen"]:
    ASR[mode]  = attack_success_rate(backdoored_params, qubo, mode)
    ACC[mode]  = accuracy(backdoored_params, qubo, mode)

# Phase 5: Detection
for defense in [SpectralSignature(), ParamAnomalyDetector(), OutputDistTest()]:
    tpr, fpr = defense.evaluate(clean_params, backdoored_params)