  Security has always been a critical issue in machine learning (ML)
applications. Due to the high cost of model training -- such as collecting
relevant samples, labeling data, and consuming computing power --
model-stealing attack is one of the most fundamental but vitally important
issues. When it comes to quantum computing, such a quantum machine learning
(QML) model-stealing attack also exists and is even more severe because the
traditional encryption method, such as homomorphic encryption can hardly be
directly applied to quantum computation. On the other hand, due to the limited
quantum computing resources, the monetary cost of training QML model can be
even higher than classical ones in the near term. Therefore, a well-tuned QML
model developed by a third-party company can be delegated to a quantum cloud
provider as a service to be used by ordinary users. In this case, the QML model
will likely be leaked if the cloud provider is under attack. To address such a
problem, we propose a novel framework, namely QuMoS, to preserve model
security. We propose to divide the complete QML model into multiple parts and
distribute them to multiple physically isolated quantum cloud providers for
execution. As such, even if the adversary in a single provider can obtain a
partial model, it does not have sufficient information to retrieve the complete
model. Although promising, we observed that an arbitrary model design under
distributed settings cannot provide model security. We further developed a
reinforcement learning-based security engine, which can automatically optimize
the model design under the distributed setting, such that a good trade-off
between model performance and security can be made. Experimental results on
four datasets show that the model design proposed by QuMoS can achieve
competitive performance while providing the highest security than the
baselines.
