A new arXiv paper published on July 3, 2026, by researchers including Cedric Brügmann and Fabian Petsch demonstrates a multi-stage attack against a quantum neural network on real trapped-ion hardware. The victim model was a four-qubit quantum neural network with 96 trainable parameters, reduced from an eight-qubit design by applying principal component analysis to 16 by 16 pixel images. The model was trained on 1,000 samples and tested on 200, reaching 87.5% test accuracy in statevector simulation. On the training set, projected gradient descent produced successful adversarial examples for 840 out of 1,000 samples with epsilon no higher than 1.0. When evaluated on adversarially perturbed inputs, accuracy fell from 92.4% to 1.07%. The attack chain used side-channel reconnaissance to infer circuit information from power traces, characterised crosstalk between neighbouring qubits, generated adversarial examples, and attempted to realise perturbations physically through crosstalk. The trapped-ion experiment ran on AQT Ibex, a 12-qubit system from Alpine Quantum Technologies, with QNN qubits at positions 3, 5, 7 and 9. For 50 randomly selected adversarially susceptible training samples, clean images scored 64% accuracy, adversarial images scored 56%, and crosstalk images scored 68%.