QuantumCTek, an AI-compliant asset, is undergoing a "revaluation."

Author: Zhang Feng

Currently, artificial intelligence is integrating into social production and life with unprecedented depth, and its security and governance system constitutes the cornerstone of the digital age. However, a computing power revolution rooted in physical principles—quantum computing—is quietly approaching, and its potential disruptive power poses a serious challenge to existing security defenses and governance frameworks. Will quantum computing overturn the existing AI security and governance system? This is not only a technical issue, but also a global challenge concerning the future order of the digital society.When the leap in computing power encounters a lag in regulations, how can we prepare for "Q-Day"?

I. How does quantum computing threaten currently widely used asymmetric encryption algorithms?Asymmetric encryption The security of current AI systems, from model transmission and data storage to identity authentication, heavily relies on asymmetric encryption algorithms such as RSA and ECC (Elliptic Curve Cryptography). The security of these algorithms rests on the computational complexity of mathematical problems like large number factorization or discrete logarithms—problems that classical computers cannot solve within an acceptable timeframe. However, quantum computing brings about a fundamental paradigm shift. Quantum algorithms, exemplified by Shor's algorithm, can theoretically reduce the solution time of these problems from exponential to polynomial time. A paper review points out that the latest quantum algorithms, including the Regev algorithm and its extensions, are continuously optimizing their efficiency in breaking asymmetric cryptography. This means that once a sufficiently large-scale (typically referring to a general-purpose quantum computer with millions of stable qubits) quantum computer becomes available, the current "locks" protecting internet communications, digital signatures, and encrypted data could potentially be opened instantly. This threat is not far-fetched. Research from the Zhiyuan Community warns that this is an ongoing threat: attackers can begin intercepting and storing encrypted communication data (including AI training data, model parameters, etc.) now, waiting to decrypt it after quantum computers mature in the future. This "intercept first, decrypt later" strategy exposes all high-value information that needs to be kept confidential for a long time, including national secrets, commercial patents, and personal privacy data, to future risks. Therefore, the threat of quantum computing to asymmetric encryption is fundamental and systemic, directly shaking the foundation of the current AI and even the entire digital world security system. II. Facing Quantum Computing, What New Challenges Does AI Model Training and Data Privacy Protection Face? The development of AI relies on feeding massive amounts of data and training complex models, a process inherently fraught with privacy and security challenges. The intervention of quantum computing makes these challenges even more acute and complex. First, the long-term confidentiality of data throughout its lifecycle is compromised. As mentioned earlier, AI training datasets currently encrypted and stored in the cloud or during transmission may be completely exposed due to future quantum decryption. The Xi'an Jiaotong-Liverpool University's Global Anti-Quantum Migration Strategy White Paper explicitly points out that adversaries worldwide are systematically implementing this "data harvesting" strategy, patiently awaiting "Q-Day" (the day quantum computers become practical). This poses a fundamental threat to AI models trained on sensitive data such as medical records, financial information, and biometrics. Secondly, privacy-preserving computing technologies such as federated learning face new challenges. Federated learning protects raw data by training models locally and only interacting to update model parameters. However, the gradients or parameter update information of these interactions are themselves transmitted encrypted. If the underlying encryption is broken by quantum computing, attackers can reverse-engineer the original data characteristics of the participants, rendering the privacy protection mechanism ineffective. Finally, model theft and intellectual property protection become significantly more difficult. Well-trained AI models are core assets for enterprises. Currently, model weights and architectures are typically distributed and deployed using encryption. Quantum computing could render these protections ineffective, allowing models to be easily copied, reverse-engineered, or tampered with, leading to serious intellectual property infringements and security vulnerabilities. The China Academy of Information and Communications Technology (CAICT), in its "Blue Book on Artificial Intelligence Governance," emphasizes that AI governance needs to address risks such as technology misuse and data security, and quantum computing undoubtedly amplifies the destructive power of these risks. III. How Will the Development of Quantum Machine Learning Affect the AI ​​Security and Ethical Review Framework? The combination of quantum computing and AI—Quantum Machine Learning (QML)—foreshadows a new round of performance breakthroughs. However, it also brings unprecedented new security and ethical challenges, impacting existing review frameworks. On the security front, QML may give rise to more powerful attack tools. For example, quantum algorithms could significantly accelerate the generation of adversarial examples, creating more covert and destructive attacks, rapidly rendering current AI security defense systems based on classical computing (such as adversarial training and anomaly detection) obsolete. Some analysts have called "quantum + AI" the next battleground for cybersecurity, pointing out the need for proactive improvements to relevant regulatory frameworks. On the ethical front, the "black box" nature of QML may be more profound than that of classical AI. Its decision-making process, based on quantum superposition and entangled states, may be more difficult to explain, audit, and hold accountable. The ethical debates and risks surrounding QML, such as algorithmic fairness, liability definition, and technological controllability, have been extensively discussed. How can existing AI ethical principles (such as transparency, fairness, and accountability) be implemented at the quantum scale? How can regulatory agencies review a decision-making model based on quantum circuits that may exist in multiple superposition states? These are challenging questions that existing ethical review frameworks are not yet prepared for. Governance models need to shift from simple technical compliance to a deeper understanding of the nature of quantum properties and their social impact. IV. Can existing AI governance regulations (such as GDPR) address the security changes brought about by quantum computing? The core principles of existing AI and data governance regulations, exemplified by the EU's General Data Protection Regulation (GDPR), such as "design protection and default protection," "data minimization," "storage limits," and "integrity and confidentiality," remain guiding at the conceptual level. However, in terms of specific technical implementation and compliance requirements, they are facing a "compliance gap" brought about by quantum computing. The GDPR requires data controllers to take appropriate technical and organizational measures to ensure data security. But in the context of quantum threats, what constitutes "appropriate" encryption measures? Continuing to use algorithms proven quantum-insecure could potentially be deemed a failure to fulfill security obligations in the future. How can the time limits for data breach notifications in regulations be effectively enforced in the face of advanced attacks using quantum computing that could be completed instantly and leave no trace? Legislators worldwide have recognized the necessity of change. The "Global AI Governance Report 2025" shows that countries are accelerating the development of specific AI governance laws and establishing high-level coordinating bodies. China, in its "Digital China Development Report (2024)," emphasized the need to "accelerate the improvement of data infrastructure" and continuously promote the "AI+" initiative. These trends indicate that the governance system is undergoing positive adjustments. However, regulations specifically targeting the intersection of "quantum computing + AI" are currently almost nonexistent. Existing regulations lack specific provisions on post-quantum cryptography migration timelines, QML model auditing standards, and data security level classifications for the quantum era, making it difficult to effectively address the impending security changes. V. What are the application prospects and implementation challenges of post-quantum cryptography in AI systems? The most direct technical solution to address the quantum threat is post-quantum cryptography (PQC). PQC refers to cryptographic algorithms that can resist attacks from quantum computers. It is not based on quantum principles, but on new mathematical problems that are believed to be difficult even for quantum computers to solve quickly (such as lattices, encoding, multivariables, etc.). Its application prospects in AI systems are broad and urgent. PQC can be used to protect every stage of the AI ​​workflow: encrypting training data and model files with PQC algorithms; verifying the integrity and authenticity of model sources with PQC digital signatures; and establishing secure PQC communication channels between distributed AI computing nodes. Fortinet points out that PQC is not a distant concept, but a practical solution urgently needed to protect digital systems from potential quantum threats. However, full implementation of PQC faces significant challenges: Performance and compatibility challenges: Many PQC algorithms are far larger than existing algorithms in terms of key size, signature length, or computational overhead, potentially creating performance bottlenecks when integrated into computationally efficient and latency-sensitive AI training and inference processes. Furthermore, all related hardware, software, and protocol stacks need to be upgraded to ensure compatibility. The Complexity of Standards and Migration: Although institutions such as NIST in the United States are advancing the standardization process of PQC, the finalization of standards and global unification will still take time. The Beijing Municipal Bureau of Cryptography's commercial cryptography frontier updates show that the industry is actively open-sourcing NIST candidate algorithms to help various industries address threats. The entire migration process is a massive and complex systems engineering project, involving risk assessment, algorithm selection, hybrid deployment, testing, and comprehensive replacement, especially for the structurally complex AI ecosystem. Emerging Security Risks: PQC algorithms themselves are a relatively new research area, and their long-term security has not yet undergone decades of practical cryptanalysis testing like RSA. Hastily deploying PQC, which may contain unknown vulnerabilities, in AI systems is itself a risk. VI. Facing this transformation, passively waiting for "Q-Day" is dangerous. The disruptive impact of quantum computing on the existing AI security and governance system is real and imminent. It does not completely overturn the existing system, but rather forces the entire system to undergo a profound and forward-looking upgrade by undermining its cryptographic foundations, amplifying its data risks, complicating its ethical issues, and highlighting its regulatory lag. Facing this transformation, passively waiting for "Q-Day" is dangerous. We recommend the following actionable path: **Initiate Quantum Security Risk Assessment and Inventory Compilation:** Immediately conduct a quantum threat assessment of core AI assets (especially models and data involving long-term sensitive data), identify the most vulnerable points, and establish a migration priority list. **Develop and Implement a PQC Migration Roadmap:** Monitor the progress of standards bodies such as NIST and begin planning PQC integration in the development and operation of AI systems. Prioritize the adoption of "cryptographic agility" design in new and critical systems to facilitate seamless replacement of cryptographic algorithms in the future. Consider using a hybrid encryption model of "classical + PQC" as a transition. **Promoting Adaptive Updates to the Governance Framework:** Industry organizations, standards bodies, and regulators should collaborate to research and incorporate quantum resistance requirements into AI security standards, data protection regulations, and product certification systems. Establish research frameworks and guidelines in advance for the ethical review of QML. **Strengthening Cross-Disciplinary Talent Development and Research:** Cultivate interdisciplinary talent with expertise in both AI and quantum computing and cryptography; encourage the inclusion of quantum threat models in AI security research; and fund the development of quantum-resistant AI security technologies. The challenges posed by quantum computing are immense, but it also offers us an opportunity to re-examine and strengthen the foundations of the digital world. Through proactive planning, collaborative innovation, and agile governance, it is entirely possible to build a more resilient AI future that can both embrace the benefits of quantum computing power and withstand its security risks.