Where Post-Quantum Cryptography and Quantum AI Actually Meet

On August 13, 2024, NIST published three finalized post-quantum standards: FIPS 203 for ML-KEM (formerly Kyber), FIPS 204 for ML-DSA (formerly Dilithium), and FIPS 205 for SLH-DSA (formerly SPHINCS+). The mathematics in those documents is the part that gets discussed. The part that decides whether a deployment is secure is the implementation, and that is where machine learning is already doing cryptanalytic work: not against the lattice problem, but against the power traces of the chip computing with it.

“Quantum AI” gets used as a single phrase in briefings and analyst notes, and the phrase covers at least four different technologies with wildly different maturity levels. One of them is producing working attacks against fielded hardware today, and it happens to be the one that involves no quantum computing at all. The other three are either well characterized or nowhere near deployment, and collapsing all four into one label wastes the scarce attention a migration has to allocate.

Four different things wearing one label

We teach this distinction early in our post-quantum programs, because learners arrive with the four collapsed into one and the collapse produces bad prioritization. Here is the split.

Quantum algorithms against classical cryptography. Shor’s algorithm and Grover’s algorithm. Well characterized, no AI involved, and the entire reason PQC standards exist.

Machine learning against cryptographic implementations. Classical neural networks trained on physical measurements or on protocol behaviour. Working today, on real hardware, against real deployments.

Quantum machine learning as a cryptanalytic tool. Quantum circuits trained the way neural networks are trained, pointed at ciphertexts or lattice instances. Research-stage, with no published result that threatens a standardized algorithm.

AI as defensive tooling. Discovery, inventory, parameter tuning, monitoring. Useful now, unglamorous, and where most of the near-term value sits for anyone running a migration.

The first and third of those get the coverage. The second is the one that changes your vendor questions this quarter.

What quantum algorithms actually do

Shor’s algorithm factors large integers and computes discrete logarithms in polynomial time. On a machine with enough stable logical qubits, it breaks RSA and elliptic-curve cryptography completely, which means it breaks the key exchange and the signatures underneath most of the public internet. No such machine has been built or demonstrated. Roadmaps are announcements, not demonstrations, and the gap between the two remains the single largest uncertainty in any Q-Day estimate.

Grover’s algorithm is the more frequently misrepresented of the two. It gives a quadratic speedup on unstructured search, which is often summarized as halving the security of symmetric ciphers: AES-128 falls from 2^128 operations to roughly 2^64. The summary is misleading in a specific way. Grover’s speedup depends on a long chain of sequential queries that parallelizes badly, so splitting the work across many quantum processors buys far less than the arithmetic suggests. NIST’s own security-category analysis accounts for this depth constraint. The practical guidance holds regardless: move symmetric keys to 256 bits and the question closes.

Neither algorithm is AI. Both are fixed procedures with proofs attached, and that is precisely what makes them tractable to plan against. You can count the qubits, estimate the runtime, and argue about the date.

The replacement algorithms rest on different mathematics. ML-KEM is a key encapsulation mechanism, meaning its job is to let two parties agree on a shared secret over an open channel, and its security rests on the hardness of a structured lattice problem. ML-DSA and FN-DSA (Falcon, still at draft FIPS 206) rest on related lattice assumptions. SLH-DSA rests only on the security of hash functions, which is why it exists in the standard set at all: it is the fallback if lattices turn out to have a weakness nobody has found yet. No known quantum algorithm solves the lattice problems at the parameters NIST selected. That claim is a statement about published cryptanalysis, not a theorem, and it is the reason NIST ran an eight-year public process, opened in December 2016 and documented on the agency’s post-quantum cryptography project pages, that took in 82 submissions and accepted 69 as complete and proper before settling.

The attack that already works

A side-channel attack ignores the mathematics entirely and reads the physical behaviour of the device doing the computing: how much power it draws, how long each operation takes, what electromagnetic noise it emits. A chip performing a decapsulation with a secret key leaks a little information about that key through each of those channels. Classically, exploiting the leakage required an analyst to identify which moments in the trace correlated with which secret bits.

Deep learning removes that step. In a profiled attack, the attacker first takes a device they control, runs it with known keys, and records thousands of power traces. A neural network trains on that set until it can map a trace to the secret it was processing. Then the same network runs against traces from the target device. The network never needs a human to explain what it is looking at.

Masking is the standard countermeasure: split every secret value into random shares so that no single share correlates with the secret, and recombine only at the last moment. It is expensive, and it is what a certified implementation is supposed to do. It is not a proof of resistance. Profiled deep-learning attacks have been the active research front against masked implementations for several years, first against symmetric ciphers, and the same trace-collection and training pipeline points at a lattice decapsulation as readily as at a block cipher round. Nothing in the method depends on which mathematics the chip is computing.

None of this weakens ML-KEM. The lattice problem is untouched, the FIPS 203 specification is unchanged, and a correct implementation in an environment where the attacker cannot measure the hardware remains secure. What it shows is that the security proof and the deployed system are two different objects. The proof covers an attacker who sees ciphertexts and chosen-plaintext or chosen-ciphertext interactions. It says nothing about an attacker holding a current probe against the power rail. That gap has always existed for RSA and AES, and the migration to PQC does not close it. If anything the gap widens for a period, because implementations of ML-KEM are younger than implementations of RSA and have had fewer years of adversarial attention.

The practical consequence for a migration plan is narrow and concrete. Wherever an attacker can obtain physical access to the device performing private-key operations, machine-learning side-channel analysis belongs in the threat model now, not in the quantum-timeline section of the risk register. That means smart cards, payment terminals, automotive control units, metering devices, HSM-adjacent embedded modules, and anything shipped to a customer site. It does not mean a TLS terminator in a locked data centre with a different set of concerns.

Three questions to ask a vendor claiming a post-quantum implementation:

1. Has the implementation been evaluated for side-channel leakage, and by whom? Ask for the report, not the claim.
2. What countermeasures are present, at what order, and what was the measured leakage after they were applied?
3. Was the evaluation performed against profiled deep-learning attacks, or only against classical differential power analysis? An implementation that resists the second can fall to the first.

Most vendors cannot answer the third question today. That’s useful information about their maturity, and asking it costs nothing.

Quantum machine learning: the honest status

Quantum machine learning trains parameterized quantum circuits the way classical training adjusts network weights, in the hope that the quantum state space captures structure a classical model would miss. Pointed at cryptanalysis, the idea is to find patterns in ciphertexts, or to guide the search inside a lattice-reduction algorithm toward productive branches.

The published work is genuinely interesting and it’s also small. Demonstrations run on toy ciphers with reduced round counts, on hardware with qubit counts far below what any serious instance would need, and with no scaling argument that carries from the toy to the real parameters. There is no published result showing quantum machine learning breaking, weakening, or meaningfully speeding up an attack on ML-KEM, ML-DSA, or SLH-DSA at their standardized parameter sets.

The alternative framing sells training, and it sells it on a claim the published literature does not support. A learner who leaves a course believing that quantum neural networks are about to break lattices will make worse decisions than one who leaves knowing they are not.

What would count as a real signal, if you want to watch the right things: a quantum-assisted method that reduces the concrete cost of lattice reduction against Module-LWE at NIST security category 1 parameters, published with reproducible resource estimates. Or a classical machine-learning result that finds structure in a lattice-based scheme’s error distribution. Announcements about qubit counts and circuit depths are not that signal.

The place machine learning has genuinely changed lattice cryptanalysis so far is in tuning, not solving. Learned heuristics can pick better parameters for the reduction algorithms cryptographers already run. That improves the estimates. It has not moved the security level.

AI on the defensive side

The defensive applications are less dramatic and, right now, worth more.

Discovery and inventory. Most organizations don’t know where their cryptography lives. Static analysis, binary scanning, and traffic inspection all produce partial views, and machine-learning classifiers help reconcile them into a cryptographic bill of materials, a CBOM: a structured record of every algorithm, key, certificate, and library in use, with the system that depends on it. The methodology for building one is covered in depth by the PQC Migration Framework. What the tooling contributes is coverage at a scale manual audit will not reach.

Parameter optimization. In quantum key distribution, which secures a key exchange using the physics of single photons rather than a mathematical assumption, the achievable key rate depends on a set of parameters that must be re-solved whenever conditions change. Wang and Lo, writing in Physical Review A in 2019, showed that a trained neural network can predict near-optimal parameters directly, orders of magnitude faster than the iterative search it replaces, while retaining most of the achievable key rate. That kind of substitution transfers to any protocol with a tuning problem inside it, and post-quantum key exchange has several.

Crypto-agility support. Crypto-agility is the property of being able to change primitives without re-architecting the systems that use them. Automated tooling supports it by tracking which certificates use which algorithms, which dependencies would break on a swap, and which systems have never been exercised through a rotation. This is inventory work with a scheduler attached, and it is genuinely where the effort should go.

The claim that AI-based monitoring can detect “quantum-enabled attacks” doesn’t survive examination. An adversary running Shor’s algorithm against harvested traffic does so offline, on their own hardware, and produces no observable signal on your network. Anomaly detection is a reasonable investment for ordinary reasons. It is not a quantum control.

What actually changes in the plan

Set against a migration plan built on the standard threat model, the four categories reorder like this.

Harvest now, decrypt later (HNDL) remains the reason for urgency, and nothing in the AI story changes its arithmetic. An adversary records encrypted traffic today and decrypts it when a cryptographically relevant quantum computer exists. Your exposure is set by how long your data stays sensitive, not by anyone’s Q-Day forecast. Data with a fifteen-year confidentiality requirement is already exposed.

Regulatory dates are firming and they are the practical forcing function. NSA’s CNSA 2.0 suite, set out in the agency’s CNSA 2.0 algorithm fact sheet, selects ML-KEM-1024 and ML-DSA-87 for national security systems, with LMS and XMSS for firmware signing and a staged timeline running into the 2030s. NIST’s draft transition guidance, NIST IR 8547, proposes deprecating RSA-2048 and 256-bit elliptic curve after 2030 and disallowing them after 2035. It remains a draft, and NIST has set no final deprecation date. The European Commission’s Recommendation (EU) 2024/1101 on a coordinated implementation roadmap for the transition to post-quantum cryptography, followed by the member-state roadmap published in 2025, sets milestones with high-risk use cases addressed by the end of the decade. None of those dates depend on a research breakthrough. They depend on procurement cycles, which are already running.

Hybrid deployment is the current default and it is not a hedge against AI. Running a classical key exchange and a post-quantum one together, deriving a shared secret from both, protects against two separate failures: an early quantum computer, and an undiscovered flaw in a young algorithm. Chrome ships this by default, and the major CDNs support it. It costs bandwidth and handshake latency, and it buys a decade of insurance against exactly the scenario where the lattice assumption turns out to be weaker than believed.

And implementation security moves up the list. This is the adjustment the machine-learning results actually justify. If your organization deploys cryptography onto hardware that leaves your control, the side-channel question belongs in the same review as the algorithm question, at the same time, with the same seniority. Selecting ML-KEM and then buying an implementation nobody has evaluated for leakage recreates the problem you were solving.

Where to build the capability

The judgment this article asks for is not exotic. It’s the ability to hear a claim about quantum AI, place it in one of four categories, and know which questions follow. That skill is teachable, and it is the kind of thing that separates a migration plan reviewers trust from one they do not.

Our post-quantum programs cover the cryptographic foundations, the NIST algorithm set as specified rather than as summarized, implementation and side-channel considerations, and the migration methodology that ties them to an inventory and a schedule. They are private credentials, assessed on the material, and built for practitioners who need to defend their decisions to an auditor or a board. Program details, current pricing in USD, and enrollment are at quantumacademy.com/.

For deeper technical background on the intersection covered here, the longer treatment sits at PostQuantum.com. For migration methodology and CBOM construction, see the PQC Migration Framework. And for anyone weighing this as a career direction rather than a project requirement, QuantumCareers.com maps where these skills are being hired.