  Quantum neural networks (QNNs) succeed in object recognition, natural
language processing, and financial analysis. To maximize the accuracy of a QNN
on a Noisy Intermediate Scale Quantum (NISQ) computer, approximate synthesis
modifies the QNN circuit by reducing error-prone 2-qubit quantum gates. The
success of QNNs motivates adversaries to attack QNNs via backdoors. However,
na\"ively transplanting backdoors designed for classical neural networks to
QNNs yields only low attack success rate, due to the noises and approximate
synthesis on NISQ computers. Prior quantum circuit-based backdoors cannot
selectively attack some inputs or work with all types of encoding layers of a
QNN circuit. Moreover, it is easy to detect both transplanted and circuit-based
backdoors in a QNN.
  In this paper, we propose a novel and stealthy backdoor attack, QDoor, to
achieve high attack success rate in approximately-synthesized QNN circuits by
weaponizing unitary differences between uncompiled QNNs and their synthesized
counterparts. QDoor trains a QNN behaving normally for all inputs with and
without a trigger. However, after approximate synthesis, the QNN circuit always
predicts any inputs with a trigger to a predefined class while still acts
normally for benign inputs. Compared to prior backdoor attacks, QDoor improves
the attack success rate by $13\times$ and the clean data accuracy by $65\%$ on
average. Furthermore, prior backdoor detection techniques cannot find QDoor
attacks in uncompiled QNN circuits.
