Quantum Advantage in Network Intrusion Detection Mostly Classical, Audit Shows

The arXiv preprint by Baig et al. introduces a leakage-controlled protocol and quantum-attribution audit that isolates genuine quantum contributions from classical preprocessing and regularisation effects. Parameter-matched classical surrogates, random-feature kernels, and regularisation sweeps were run alongside variational circuits and quantum-kernel SVMs on NSL-KDD, UNSW-NB15, CICIDS2017 and NF-ToN-IoT-v2 under identical feature budgets and imbalance-aware metrics. Random Forest and XGBoost matched or beat quantum models on aggregate detection; only the quantum-kernel SVM retained an AUPRC edge over its random-feature control, and a four-qubit hybrid showed a statistically significant lift at the 1 percent false-positive point on distribution-shifted NSL-KDD. The audit reveals that headline quantum wins in prior QML-IDS work largely trace to unaccounted dimensionality reduction and implicit regularisation rather than superposition or entanglement. This pattern mirrors earlier reproducibility audits in quantum chemistry and optimisation, where classical baselines closed apparent gaps once hyperparameter budgets were equalised. The released code and splits now allow direct replication and extension to larger qubit counts. Future work must test whether these narrow surviving advantages persist under real NISQ noise or on larger, temporally shifted traffic corpora. If the quantum-kernel edge on AUPRC holds after additional classical kernel approximations are exhausted, targeted hardware experiments on 20-plus qubit devices would be justified; otherwise the field should redirect effort toward hybrid classical pipelines for near-term cybersecurity applications.