Quantum-Safe AI — Quantum-Safe: AI and Verified Crypto

Artificial intelligence (AI) does not sit outside the quantum-security problem. It intensifies it. Training data, model weights, embeddings, retrieval stores, prompts, and agent logs are often valuable for many years, while the channels that move them rely on today’s public-key cryptography. A future cryptographically relevant quantum computer could make recorded traffic readable and trusted machine-to-machine calls forgeable unless the AI stack is prepared now.

Why quantum-safe belongs in AI engineering

The quantum risk in AI is not a special new branch of cryptography. It is the same risk that applies to modern software, concentrated in systems that hold unusually valuable secrets and automate unusually sensitive decisions.

Most AI platforms depend on Transport Layer Security (TLS) for encrypted channels, public key infrastructure (PKI) for certificates and service identity, and digital signatures for tokens, packages, models, and attestations. Those are the layers affected by Shor’s algorithm, the quantum algorithm that can break the hard math behind RSA and elliptic curve cryptography (ECC) once a large enough fault-tolerant quantum computer exists.

The practical point is simple: if an AI system trains on confidential data, calls tools, retrieves private knowledge, or ships signed model artifacts, then post-quantum readiness is part of AI security. It belongs in the same conversations as data governance, model supply chain, agent permissions, and runtime monitoring.

📌

Same substrate. AI systems use the same TLS, PKI, certificates, signatures, and tokens as the rest of modern software.

Harvest now, decrypt later fits AI too well

Harvest now, decrypt later (HNDL) is a patient attack. An adversary records encrypted data today, stores the ciphertext, and waits for future capability to decrypt it. The attack is most damaging when the data remains sensitive long after it was captured.

AI creates many long-lived assets. Proprietary training corpora may contain customer records, source code, contracts, medical notes, or regulated business data. Model weights can embody years of data collection, tuning, and compute. Vector embeddings may encode confidential documents closely enough that leakage and inversion risks must be taken seriously. Retrieval-augmented generation (RAG) knowledge bases often contain the internal material an organization most wants to protect. Conversation and tool logs may preserve prompts, outputs, personally identifiable information (PII), secrets, and business intent.

This is why Mosca’s inequality is useful for AI planning. If a secret must remain protected for X years, migration will take Y years, and a capable quantum computer is Z years away, then risk becomes urgent when X plus Y is greater than Z. For important AI assets, X is often measured in decades, not months.

⚠️

Captured now. If sensitive AI data crosses a classical public-key channel today, a patient attacker may only need to wait.

Adversaries record encrypted AI data today and decrypt it once quantum arrives.

Agent channels are cryptographic control planes

An agentic AI system is a mesh of machine-to-machine trust. An orchestrator calls agents. Agents call tools. Tools call application programming interfaces (APIs). Models are reached through gateways and endpoints. Increasingly, these connections may use the Model Context Protocol (MCP), a protocol for connecting models and agents to external tools and data sources.

Each hop usually depends on familiar public-key mechanisms. A TLS handshake often uses Elliptic Curve Diffie-Hellman (ECDH) to agree on session keys. Certificates issued through PKI prove which service is on the other end. Signed tokens carry workload identity, user delegation, scopes, or authorization claims. Classical RSA and ECC are common in these roles today.

If the public-key layer is broken, the failure is not limited to confidentiality. An attacker may impersonate a trusted agent, forge or replay credentials, or sit between an agent and a tool. In an ordinary web application that is serious. In an agent system, it can become control-plane compromise: the attacker can influence what the system sees, what tools it calls, and where data goes.

Hybrid post-quantum TLS is already practical on some modern paths. A hybrid key exchange such as X25519MLKEM768 combines a classical elliptic-curve exchange with Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). Current browsers, cryptographic libraries, and edge providers have begun shipping or supporting these options. The engineering question is less whether the idea works and more where your traffic terminates, which internal hops still use classical handshakes, and how often your agents renegotiate connections.

⚠️

Watch re-handshakes. Hybrid handshakes add roughly one to two kilobytes of key material, so chatty agent meshes should use connection reuse and session resumption where appropriate.

Agent-to-agent channels lean on public-key mechanisms at every hop.

Model provenance needs quantum-safe signatures

AI supply chains need provenance: evidence of what a model is, where it came from, how it was built, and whether it changed after approval. A cryptographic bill of materials (CBOM) inventories where cryptography is used. A machine-learning bill of materials (MLBOM) applies the same discipline to models by recording datasets, base models, dependencies, hashes, training steps, and approval evidence.

Model signing is the cryptographic anchor for that evidence. A signature on a model artifact, evaluation report, or deployment bundle lets a system verify that the approved artifact is the one being loaded. The same idea applies to AI-generated code before it is allowed into a build or production environment.

The catch is that today’s signatures often use RSA, Elliptic Curve Digital Signature Algorithm (ECDSA), or Ed25519. These are not the long-term answer in a post-quantum setting. The migration path is toward Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for general post-quantum signatures and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) for cases that favor conservative hash-based roots of trust despite larger signatures.

This does not mean waiting to sign models. It means signing now and making the algorithm replaceable. Use the supply-chain practices already common for containers and packages: artifact hashes, signing, attestations, policy gates, and reproducible evidence. Then ensure the signing layer can move from classical algorithms to post-quantum algorithms without redesigning the whole pipeline.

Provenance builds from a crypto inventory to a model record to a signature.

What quantum changes, and what it mostly does not

Quantum risk is sharpest at the public-key layer. RSA, ECC, ECDH, ECDSA, and Ed25519 depend on mathematical problems that Shor’s algorithm is expected to solve efficiently on a sufficiently capable quantum computer. That affects key exchange, certificates, signatures, and identity tokens.

Symmetric cryptography is different. Advanced Encryption Standard (AES) and modern hash functions are not broken in the same way. Grover’s algorithm can reduce the effective search cost against symmetric keys, which is why larger key sizes matter, but this is a much milder problem than the collapse of RSA and ECC. In many environments, AES-256 and strong hash choices are the easier part of the transition.

For AI teams, this distinction prevents wasted effort. Do not treat every encrypted database as equally urgent just because it contains model data. Ask how keys are established, how data moves, how artifacts are signed, and how identities are verified. The highest-priority work is usually at the channels and signatures that protect high-value AI assets.

Public-key crypto breaks; symmetric crypto only needs larger keys.

Crypto-agility is model-agility for algorithms

AI engineers already understand agility. A well-designed application can swap one model for another, change a provider, or route a request through a different inference endpoint without rewriting the product. Crypto-agility applies the same design instinct to cryptography.

Do not hard-code one key exchange, one signature algorithm, one certificate profile, or one token format deep inside business logic. Put cryptographic choices behind interfaces, configuration, policy, and tested deployment paths. Keep inventories current so you know which systems use which algorithms. Exercise the replacement path before a crisis forces it.

Crypto-agility matters because post-quantum migration is not a single cutover. Hybrid deployments will run for years. Standards will mature. Libraries will change. Some partners will move early and others late. Systems that can negotiate algorithms, rotate certificates, re-sign artifacts, and update trust anchors safely will adapt. Systems with buried assumptions will become brittle.

✅

Familiar pattern. If your team can swap models cleanly, it already has the mental model for swapping cryptographic algorithms cleanly.

The decisions leaders and practitioners should make now

Quantum-safe AI becomes real when it changes roadmaps, architecture standards, and procurement questions. Leaders do not need to predict the exact date of a cryptographically relevant quantum computer. They need to decide which AI assets have long confidentiality lifetimes, which systems would be hardest to migrate, and where early hybrid protection is low-risk enough to enable.

Practitioners should start with a focused inventory. Trace the movement of training data, embeddings, prompts, model weights, fine-tunes, and logs. Record every external and internal TLS termination point. Identify certificates, tokens, model signatures, package signatures, and signing services. Add these findings to the CBOM and extend the model supply-chain record into an MLBOM.

Then make the first migrations where they reduce the most future regret: internet-facing AI gateways, service-to-service connections that carry sensitive context, model distribution channels, and signing systems used for long-lived artifacts. Measure handshake overhead in agent-heavy paths rather than guessing. Tune connection reuse, session resumption, and gateway placement before treating performance as a blocker.

Finally, make post-quantum readiness a requirement for platforms and vendors. Ask which algorithms they use, whether they support hybrid TLS, how they handle post-quantum certificate and signature plans, and whether artifacts can be re-signed without rebuilding the whole model pipeline.

Classify AI assets by confidentiality lifetime and business impact.
Map every TLS, PKI, token, and signing dependency in the AI stack.
Prioritize HNDL-exposed data flows and agent control-plane channels.
Sign model artifacts and maintain an MLBOM that records datasets, base models, hashes, and attestations.
Build algorithm choice into configuration and policy, not application logic.
Test hybrid post-quantum TLS on real agent traffic and measure connection behavior.

Key takeaways

Quantum-safe AI is not separate from AI security; it protects the channels, identities, data, and artifacts AI already depends on.
The highest HNDL risk sits with long-lived AI assets such as training corpora, weights, embeddings, RAG stores, and conversation logs.
Agent systems turn public-key cryptography into a control-plane dependency because agents use TLS, PKI, certificates, and signed tokens to trust one another.
Model provenance must be backed by signatures, and those signatures need a path from classical algorithms to ML-DSA or SLH-DSA.
Symmetric encryption is usually the easier part; the urgent migration work is key exchange, authentication, and signatures.
Crypto-agility is the AI team’s familiar model-agility pattern applied to cryptographic algorithms.

Glossary

Harvest now, decrypt later: An attack in which an adversary records encrypted data now and waits for future capability to decrypt it.
Transport Layer Security: Transport Layer Security, or TLS, is the protocol commonly used to protect data in transit between clients, services, and APIs.
Public key infrastructure: Public key infrastructure, or PKI, is the system of certificates, certificate authorities, and trust rules used to prove service and user identities.
RSA: RSA is a widely used public-key algorithm for encryption and signatures whose security is threatened by large fault-tolerant quantum computers.
Elliptic curve cryptography: Elliptic curve cryptography, or ECC, is a family of public-key methods used for key exchange and signatures that is also vulnerable to Shor’s algorithm.
ML-KEM: Module-Lattice-Based Key-Encapsulation Mechanism, or ML-KEM, is a post-quantum standard for establishing shared secret keys.
ML-DSA: Module-Lattice-Based Digital Signature Algorithm, or ML-DSA, is a post-quantum standard for digital signatures.
SLH-DSA: Stateless Hash-Based Digital Signature Algorithm, or SLH-DSA, is a post-quantum signature standard based on hash functions.
Machine-learning bill of materials: A machine-learning bill of materials, or MLBOM, records the datasets, base models, dependencies, hashes, and other evidence needed to understand and trust a model artifact.