In short
The Random Forest does the hard work of finding what separates malware from benign. The VQC then only has to carry an easy signal on a few qubits, so it trains well with very few parameters and shallow circuits.
Final VQC training loss against test accuracy for every fold and qubit count;
the dashed line marks ln 2.
For reference, cross-entropy for a coin flip is . From 6 qubits up, PCA’s loss is worse than a coin flip while its accuracy is still 0.77–0.83, which suggests its predicted probabilities sit near 0.5: it gets the label right but is not confident. The votes and leaf arms sit at 0.036–0.084 and 0.060–0.108, far below ln 2. The two families form separate clusters.
The Spearman correlation of per-fold accuracy between votes at 4 qubits and RF only was 0.81, so the splits that are hard for the forest are also hard for the VQC. Against PCA it is 0.25–0.30, so PCA’s hard splits are largely different ones. This is expected because the votes VQC’s inputs are the forest’s own group probabilities, and it explains why the votes VQC matches the forest rather than adding to it.
Errors. Per test split of 3,108 samples: 25 errors for votes at 3 qubits, 28 for RF only, 80 for the linear SVM, 520 for the RBF SVM, and 527 and 746 for PCA at 8 and 2 qubits. The RF pre-stage removes approximately 95% of PCA + VQC’s errors. The worst votes split (0.985) beats the best PCA split at any qubit count (0.886). The paired effect size, Cohen’s , is 5.3–13.0, where anything above 0.8 counts as “large”.
Small circuits. The number of trainable parameters is . Votes at 2 qubits has only 10 trainable parameters and scored 0.992; leaf at 2 qubits has 6 and scored 0.986; PCA at 8 qubits has 40 and scored 0.830. In two-qubit (CX) gates before mapping to hardware: leaf 4 qubits had 6, votes 4 qubits 12, votes 8 qubits 14, PCA 4 qubits 24 and PCA 8 qubits 84. Angle encoding adds no CX gates, while ZZFeatureMap adds CX ladders on top, so the RF pre-stage enables a shallow encoding. Fewer two-qubit gates should mean less degradation on real hardware, but everything here ran on a noise-free simulator, so this remains an argument for future work rather than a result.
Which RF arm to use. A missed malware sample (a false negative) could cost more than a false alarm. The leaf arm has a recall of 0.993–0.995 and a precision of 0.972–0.976, while the votes arm has a precision of 0.995 and a recall of 0.985–0.988. Leaf makes sense when missing malware is the larger problem; votes when an analyst’s time matters more.
See: implications, limitations