Quantum-derived inputs reshape a malware detector, with no clear final detection edge over a dimension-matched Gaussian model

Learning normal software

The study by Thesath Wijayasiri and colleagues uses SAGEGAN, a generative anomaly detector. Instead of learning directly from examples of malware, its detector parameters are trained using benign executable files. Each file becomes a three-channel image representing raw bytes, unusual byte-pair patterns relative to benign software, and deviations in entropy.

An encoder converts that image into a compact internal representation. A generator then attempts to reconstruct the image from it. Reconstruction error, combined with a discriminator’s assessment of the original input, supplies an anomaly score: a larger score indicates a stronger departure from learned benign behaviour.

During training, the generator also receives samples from a prior distribution—a source of numerical inputs that helps shape the representations it learns. The researchers compared three configurations: a 512-dimensional Gaussian prior, a smaller 48-dimensional Gaussian prior, and a 48-dimensional prior derived from quantum hardware. Matching the last two widths helps separate differences associated with prior choice from those associated with representation size.

Where the quantum component enters

The quantum-derived inputs came from an ORCA Computing PT-2 photonic processor. Photons pass through an interferometer, and measurements record photon counts across 48 output modes. The team collected one million such vectors with the interferometer settings held fixed, then standardized the saved pool before using it for training.

The neural networks themselves ran on classical hardware. Training repeatedly sampled the saved measurements; it did not require a quantum processor to produce fresh inputs during each update. Detection subsequently used the trained classical networks.

The dataset contained 20,000 benign Windows executables and 10,820 malicious executables spanning 214 malware families. Across ten random seeds, the authors varied data partitions and trained each configuration independently. Only benign samples updated detector and refinement-policy parameters. Labelled benign and malware validation examples nevertheless informed checkpoint selection and score calibration, so the complete development procedure was not label-free.

Refining a frozen detector

After training, the researchers froze the detector and adjusted only the internal representation assigned to each input. They tested whether the effort needed to move that representation towards learned benign patterns provided additional evidence of abnormality.

Both refinement methods used three successive moves from the same menu of 47 actions. These included moving an individual layer’s representation towards or away from its benign mean, and moving along directions identified from benign training representations.

Greedy refinement evaluated candidate moves directly. A reinforcement-learning policy instead learned to select moves, using rewards that favoured reconstruction improvement while penalizing displacement and departure from benign reference patterns. The policy trained on single-step immediate rewards, although evaluation applied it for three steps.

The final anomaly score combined the original score with reconstruction and refinement measurements, including displacement and action count. Their weights were selected on validation data. Consequently, reported gains measure refinement together with additional scoring and calibration, not movement through the representation alone.

Larger gains, similar endpoints

Detection performance was measured using ROC AUC, which describes how well scores rank malware above benign files across thresholds. It is not the percentage of files classified correctly.

Before refinement, mean test AUC was 0.8420 for the 512-dimensional Gaussian model, 0.8586 for the smaller Gaussian model, and 0.8570 for the quantum-derived model. Following reinforcement-learning refinement, those values reached 0.8713, 0.8905 and 0.8935 respectively.

The quantum-derived configuration improved most relative to its own starting point. Its final AUC exceeded the dimension-matched Gaussian model’s by 0.0030, but the comparison was not statistically significant: the unadjusted 95% confidence interval for the difference ran from −0.0136 to 0.0196. This leaves uncertainty about the difference rather than demonstrating equivalent performance. Against the 512-dimensional Gaussian baseline, the quantum-derived model’s final AUC was significantly higher in the reported comparison.

Greedy refinement accounted for most of the mean improvement; the learned policy added relatively little.

Internal diagnostics revealed clearer differences. The quantum-derived model spread variation more broadly across its available style dimensions and more closely matched the means and variances of sampled styles. But the smaller Gaussian model was better at recovering a sampled style after generating and re-encoding an image. No configuration led on every measure.

What remains unresolved

This is a preprint, and its results concern one corpus, one architecture and one fixed photonic sample pool. The configurations also used different prior-alignment training rules, which could contribute to their differences. Richer classical alternatives, such as mixture or flow-based priors, were not tested.

The latent diagnostics used a small subset of 32 benign training images, and the reported statistical comparisons were unadjusted for multiple testing. The study does not establish that its representation measurements caused the refinement gains.

Crucially, the authors state that the photonic setup used here can still be simulated classically. The finding is therefore a difference between tested training configurations—not evidence of an advantage unavailable to classical computation.