A Systematic Benchmark of Quantum Support Vector Machines for Interpretable Attribution of AI-Generated Text

Abstract

Reliable attribution of artificial intelligence (AI)-generated text to a specific large language model (LLM) matters increasingly as LLMs proliferate, yet where quantum machine learning actually stands on this task has, to our knowledge, never been measured systematically. We benchmark the quantum support vector machine (QSVM) for binary attribution between Gemma 3 and Qwen 2.5 on a 5800-sample corpus from paired prompts: 83 configurations sweeping qubit count, regularization, training-set size, feature-map family, and circuit depth under exact, noiseless classical statevector simulation. QSVM validation accuracy plateaus at approximately 88%, whereas a classical support vector machine with a radial basis function kernel reaches approximately 97.8% on the identical fourteen-dimensional inputs: the ceiling belongs to the quantum (fidelity) kernel, not to the input representation. We measure the mechanism: off-diagonal quantum kernel values shrink exponentially with qubit count, the signature of exponential kernel concentration. The same classical model recovers the stylometric attribution fingerprint, showing it belongs to the shared feature pipeline rather than to the quantum kernel. All large-scale headline results generalize to an independent 1000-text test set produced after every design decision was frozen. The study provides a cautionary, reproducible benchmark for quantum kernel natural language processing and outlines an open-set extension as future work.

1. Introduction

The rapid proliferation of large language models (LLMs) capable of generating fluent, coherent text has created an urgent practical and societal need for reliable artificial intelligence (AI)-generated text detection and attribution tools. Existing detectors fall into two broad families. Statistical detectors that score candidate texts using token-level perplexity, rank, or log-likelihood under a reference language model [1,2] have proven attractive but brittle: their performance degrades under light paraphrasing, prompt-engineered evasion, continued fine-tuning of the generator, and domain shift, and recent analyses argue that uniform aggregation of per-token metrics is itself a central failure mode [3]. Supervised neural classifiers fine-tuned on labeled human-versus-AI corpora [4,5,6,7] reach high in-distribution accuracy but act as black boxes that produce confidence scores without explaining which textual signals support their decisions, and recent surveys identify generalization beyond the training distribution and explainability of the decision as the two central open problems in the field [4,7]. Both families also conflate the simpler “human or AI” question with the harder “which AI” attribution question, and both provide little resistance to adversaries who know which features the detector relies on. To our knowledge, the field still lacks detection methods that combine model-specific attribution, interpretability of the decision in terms of named linguistic features, and adversarial robustness within a single framework.

Stylometric analysis, the study of writing style as a means of authorship attribution, offers an interpretable alternative grounded in named linguistic features. Applied to LLM outputs, stylometry exploits the hypothesis that each model’s training data, architecture, and reinforcement-learning fine-tuning leave characteristic imprints in its generated text: patterns in vocabulary richness, syntactic preferences, punctuation habits, sentence-length distributions, and discourse structure that persist across topics and prompts. Stylometric attribution has a strong track record in human authorship settings, going back to the Federalist Papers attribution of Mosteller and Wallace [8] and recently revisited under modern statistical and embedding-based methods [9]. The intervening decades produced a substantial body of computational stylometry surveyed in [10] and consolidated in the long-running PAN evaluation campaigns on plagiarism detection, author identification, and author profiling [11,12], with classical machine-learning classifiers operating on lexical, syntactic, and function-word features, including support vector machines (SVMs) trained on syntactic dependency n-grams [13]. More recent work has carried this lineage forward into the deep-learning and LLM era, surveying transformer-based authorship representations and end-to-end LLM-based attribution [14], and has begun to extend the same stylometric framing to AI-generated text itself, where stylistic fingerprints have been shown to be stable across prompts and writing styles and exploitable for multi-class LLM identification [15]. However, the space of LLM stylometric features that classical kernels can exploit is dominated by a small number of strong axes such as sentence length, vocabulary richness, and syntactic complexity, leaving a long tail of subtler features that are individually weak but jointly informative. A classifier that can integrate evidence across many such axes simultaneously, rather than concentrating its decision on a few dominant features, would therefore be both more useful as a fingerprint and potentially more robust as a detector.

The quantum support vector machine (QSVM) [16] offers a different way of representing the same input. The quantum feature map encodes input vectors into states of a high-dimensional Hilbert space, where the fidelity kernel $K(x,x^{\prime })={\left|\langle \phi \left(x\right)|\phi \left(x^{\prime }\right)\rangle \right|}^2$ measures the quantum-mechanical similarity between text representations. In plain terms, a quantum kernel is simply a similarity score between two texts: each text’s features set the parameters of a small quantum circuit, and the score reflects how much the two resulting quantum states overlap. Classical radial basis function (RBF) kernels are themselves powerful nonlinear similarity measures: they act on the joint feature vector through the Euclidean distance and implicitly expand it into an infinite-dimensional feature space. The quantum fidelity kernel offers a different inductive bias: depending on the feature map employed, it can encode the input coordinates into entangling circuit parameters so that the resulting state overlap can be sensitive to joint, interference-mediated combinations of features rather than to their geometric distance alone. If such a distributed representation were realized in practice, it would have two consequences of particular interest for AI-text attribution. Spreading the burden of classification across many input axes rather than concentrating it on a few dominant features could make the resulting decision boundary more resistant to single-feature adversarial perturbation, and the same distributed structure could be re-read after training as a multi-axial stylometric fingerprint, with variance-weighted feature attribution revealing the joint set of stylistic signals on which the classifier relies, a potential path toward explainable AI for LLM attribution. Whether these properties actually materialize, and whether they can be credited to the quantum kernel rather than to the classical feature pipeline that surrounds it, are empirical questions that this paper answers with matched classical controls: experiments that change exactly one thing, the kernel, and keep everything else fixed, by training a classical SVM on the very same inputs the quantum model receives so that any difference in outcome is due to the kernel alone. Quantum kernel methods are also subject to a known failure mode in the form of kernel concentration [17], in which fidelity-kernel values concentrate exponentially in the number of qubits, driven by highly expressive embeddings, entanglement, global measurements, and hardware noise, so that kernel-matrix entries become increasingly indistinguishable across training pairs, with deeper feature-map circuits compounding the effect by flattening the kernel landscape rather than enriching it. Characterizing the empirical onset of these regimes on a practical natural language processing (NLP) task, and disentangling the contribution of qubit count, training-set size, feature-map family, and circuit depth to the resulting loss of kernel discriminability, is one of the central goals of our benchmark.

The connection between quantum computing and kernel methods runs deeper than a surface analogy. Encoding a classical input into a quantum state is itself a nonlinear feature map into the Hilbert space of the quantum system, and the resulting inner products of statevectors define a positive-definite kernel that any classical SVM can consume directly [18]. Two routes follow from this observation: an implicit route in which the quantum device estimates a classically intractable kernel for a classical SVM (the construction we adopt in this paper, introduced in [16]) and an explicit route in which a variational quantum circuit learns the decision boundary inside Hilbert space directly. Within the implicit route, Liu, Arunachalam, and Temme [19] established a rigorous end-to-end quantum advantage on a discrete-logarithm-based concept class: assuming the widely believed classical hardness of the discrete logarithm, no efficient classical learner can do measurably better than chance, while an SVM with quantum kernel estimation provably achieves high accuracy and remains robust to the additive sampling noise of finite measurement budgets. This result demonstrates that quantum feature spaces can in principle recognize patterns no efficient classical algorithm can, but it does not specify which practical learning tasks fall within reach of quantum kernels on real or simulated near-term hardware, an empirical question that the present benchmark begins to answer for the specific case of LLM stylometric attribution.

Independently of the kernel-method line of work, an active body of quantum natural language processing (QNLP) research has been developing quantum representations for natural language itself. The compositional-distributional (DisCoCat) framework maps sentences to string diagrams that are isomorphic to quantum circuits, and the DisCoPy and lambeq toolchains have been used to run sentence-level sentiment classification, next-word prediction, and short-text labeling on noisy intermediate-scale quantum (NISQ) hardware [20,21,22]. Quantum-inspired methods that adopt density-matrix and quantum-interference formalisms without running on quantum hardware have likewise been applied to multimodal sentiment analysis [23]. A recent survey catalogs this landscape and identifies word and sentence embeddings, attention, and grammatical structure as the most-studied components of QNLP in the NISQ era [24]. Across this body of work, however, the unit of analysis has been the sentence (its meaning, sentiment, or grammatical structure), and the implicit goal has been to recover the kind of information a classical neural model would extract from the same text. The inverse problem we consider here, attributing a given text to the specific language model that produced it and reading the kernel back as a multi-axial stylometric fingerprint, has not, to our knowledge, been studied with quantum kernel methods. Closing that gap, and characterizing the practical regime in which a fidelity quantum kernel can perform LLM stylometric attribution reliably, is the goal of the present paper. Rather than asserting in advance what the quantum kernel delivers, we frame three conjectures as questions under test: whether a fidelity quantum kernel acting on a stylometric feature substrate produces an interpretable multi-axial fingerprint that is genuinely a property of the quantum kernel; whether the empirical reach of this representation is governed by the training-samples-per-qubit ratio rather than by circuit depth or entanglement richness; and whether the principal value of quantum kernels in this domain lies in interpretability and adversarial robustness rather than in raw classification accuracy. The systematic benchmark of Section 3 is designed to test all three rigorously, pairing every quantum result with a classical control on identical inputs. As the results will show, the interpretability and robustness conjectures do not survive that control, while the data-density conjecture survives only in qualified form: the samples-per-qubit ratio does govern the QSVM’s empirical reach, but toward a ceiling set by the kernel itself.

Our study is, as far as we are aware, the first systematic hyperparameter benchmark of quantum kernel methods for LLM attribution, and it differs in scope from the two adjacent benchmark families. General quantum machine learning (QML) benchmarking efforts evaluate quantum models against classical baselines on standard, mostly low-dimensional datasets and emphasize the methodological pitfalls of such comparisons [25], concerns that our like-for-like classical ablations are designed to address, while machine-generated-text benchmarks such as RAID [26] evaluate classical detectors on the binary human-versus-AI decision across generators, decoding strategies, and adversarial perturbations. Neither family covers model-to-model attribution with quantum kernels, the setting studied here; accordingly, our benchmark varies quantum-specific axes (qubit count, feature-map family, circuit depth, and the data-to-qubit ratio) that have no counterpart in classical detector benchmarks.

In this paper we address these questions in a controlled binary-attribution setting between two state-of-the-art instruction-tuned LLMs, Gemma 3 [27] and Qwen 2.5 [28]. Our corpus comprises 5800 text samples generated from a fixed prompt set, with prompts paired across models so that writing style is isolated from topical content. The experimental work proceeds in two stages. All experiments use exact statevector simulation on 64-core central processing unit (CPU) nodes; the large-scale runs and the headline Stage 2 experiments share fixed held-out evaluation sets that make their accuracy figures directly comparable, and Section 2.1 details the validation protocol of the exploratory and analysis-split runs.

The contributions of the paper are fourfold. First, the 83-configuration benchmark, together with the stylometric fingerprint analysis and two enriched feature pipelines, maps where fidelity quantum kernels actually stand on a practical NLP attribution task, and why. Second, we measure the mechanism behind the observed accuracy ceiling directly on the trained kernel matrices: at fourteen qubits the mean off-diagonal entry of the quantum kernel is roughly 400 times smaller than that of a classical RBF kernel on identical inputs, the signature of exponential kernel concentration measured rather than conjectured. Third, a like-for-like control trains a classical SVM on the exact inputs the quantum circuit receives and reaches 97.76% where the QSVM reaches 88.02%, ruling out principal component analysis (PCA) compression as the cause of the quantum ceiling and showing that the reconstructed stylometric fingerprint belongs to the shared feature-attribution framework rather than to the quantum kernel. Fourth, all headline configurations are re-evaluated on an independent test set of 1000 texts generated after every design decision was frozen; the large-scale results transfer closely, whereas the benchmark’s small-sample sweet spot does not. Together, these elements deliver, in the spirit of [25], a demonstrated methodological lesson: an apparent quantum interpretability advantage can dissolve once the right classical control is run on identical inputs. Looking forward, we outline a one-class quantum kernel proximity-scoring framework as an open-set, single-model attribution proposal, stated explicitly as future work.

2. Materials and Methods

2.1. Dataset

The corpus underlying this study consists of 5800 text samples drawn from two state-of-the-art instruction-tuned open-source language models. Gemma 3 [27], used here in its 27B instruction-tuned checkpoint (Gemma 3 27B-it, https://huggingface.co/google/gemma-3-27b-it, accessed on 10 May 2026), is tuned for conversational helpfulness and natural dialogue flow, whereas Qwen 2.5 [28], used in its 32B instruction-tuned checkpoint (Qwen 2.5 32B-Instruct, https://huggingface.co/Qwen/Qwen2.5-32B-Instruct, accessed on 10 May 2026), is tuned for structured reasoning and factual precision. Each model contributes 2900 complete responses generated from the same set of standardized prompts spanning ten topic categories (290 prompts per category), produced with the vLLM serving stack using temperature 0.6, top-p 0.95, top-k 30, repetition penalty 1.1, and up to 512 new tokens per response; the prompt set was constructed by the authors for this study and is released together with the code and corpus (see the Data Availability Statement). Pairing prompts across models in this way isolates model-specific style from prompt-driven topical content, which is essential for an attribution task in which writing style must not be confounded with subject matter. The use of Gemma 3 and Qwen 2.5 to generate the corpus is an intended element of the study design: the generated text constitutes the research data under attribution. No generative AI was used to analyze or interpret the experimental results.

The corpus is divided at the prompt level by a fixed 80/20 split with seed 42, stratified by topic category: 2320 of the 2900 prompts form the training side and 580 the held-out side, and each prompt contributes one Gemma 3 and one Qwen 2.5 response, producing a 4640-sample training pool and a 1160-sample held-out validation set whose class balance follows automatically from the paired design. The training-set size is the controlled variable, and it is varied along two paths. Runs evaluated on the full 1160-sample holdout (2400 to 4640 training samples) use deterministic prefixes of the shuffled training pool, so the holdout itself is never resampled; these figures, including the Stage 2 baseline (Experiment 2.1), the enriched-pipeline and ablation runs (Experiments 2.2 to 2.4), and the Experiment 2.5 controls, are directly comparable. One tagging subtlety deserves note: several released run artifacts carry configuration tags recording a requested validation split larger than the holdout (3480/2320, 2800/1200, or 2400/1600); the pipeline caps validation at the fixed 1160-sample holdout, so these runs train on the requested training prefix, are evaluated on the same holdout as every other large-scale run, and store both the requested and the actual sizes in their metadata. The exploratory small- and medium-scale runs (Experiments 1.1 to 1.3, the intermediate runs of Experiment 1.5, and the 3200-sample runs of Experiment 1.6) instead take a prefix of the prompt table and re-apply the same category-stratified 80/20 split locally; their 200- to 800-sample validation sets keep the split ratios locally balanced but are not subsets of the 1160-sample holdout; the exact training and validation sizes of every run are listed in Appendix B, and validation-set provenance is stated wherever accuracy figures from different splits are juxtaposed. Because this validation set also served for model selection across the benchmark, an additional held-out test set, generated after all selection decisions were frozen, is used in Section 3.4 to provide an unbiased estimate of final performance.

Table 1. Training and validation split design.

Split	Training Used	Validation	% of Train Pool Used
Full 80/20	4640	1160	100%
Large 75/25-equivalent (Experiments 1.5–1.6 at 3480 samples and all Stage 2 experiments)	3480	1160	75%
Medium 70/30-equivalent	2800	1160	60%
Small- and medium-scale grids (Experiments 1.1–1.3 and intermediate 1.5 runs)	600 to 2000	200 to 800	13 to 43% (hyperparameter search)

summarizes the principal split configurations and their utilization of the 4640-sample training pool.

To prevent any leakage between training and validation, all preprocessing components with learnable parameters, namely, the term frequency–inverse document frequency (TF-IDF) vectorizers, StandardScalers, PCA projections, and the mutual information (MI) feature selectors introduced in Section 3.3, are fitted exclusively on the training portion of each split and applied to validation without re-fitting. Inside cross-validation (CV), the preprocessing is fitted once on the complete training partition and the folds retrain only the classifier on that fixed representation (Section 2.7); the CV mean and standard deviation therefore measure classifier stability conditional on the training-fitted representation, and the held-out validation set never enters either the preprocessing fits or the classifier training.

Beyond the training pool and the validation set, the study uses an independent test corpus whose sole purpose is to estimate final generalization. We authored 500 new prompts, disjoint from the prompt set used to build the 5800-sample corpus but spanning the same ten topic categories with fifty prompts per category, and submitted each prompt identically to both models, producing 1000 test texts (500 per model). Generation used Gemma 3 27B-it and Qwen 2.5 32B-Instruct served via vLLM with the same decoding parameters as the main corpus above and a fixed generation seed (42); five Qwen 2.5 outputs that exhibited mixed-language or length failures were regenerated under the same settings. Critically, this test corpus was created and frozen only after every hyperparameter, feature-pipeline, and model-selection decision reported in this paper had been finalized, and no configuration was ever tuned on it. Section 3.4 reports the resulting test-set results for all headline configurations.

2.2. Problem Formulation

We frame the attribution task as a binary classification problem. Given a text sample x, the goal is to predict its source model $y\in$ {Gemma 3, Qwen 2.5}. The two classes are perfectly balanced (2900 samples each), so a chance baseline corresponds to 50% accuracy. Throughout the paper, the same input representation is fed to a QSVM and to a classical support vector machine (CSVM) so that every quantum result can be compared against classical references of increasing strictness: a global baseline on the full representation, an ablation on identical selected features (Experiment 2.4), and, decisively, a control on the identical PCA inputs that the quantum circuit receives (Experiment 2.5). This graded like-for-like design is the key methodological choice of our study: it isolates the effect of the quantum kernel itself from any difference in input representation. Its strictest form is the classical control of Experiment 2.5, in which a classical SVM is trained on the identical standardized, PCA-reduced, [0, 2$\pi$]-rescaled vectors that the quantum circuit encodes, and it is what allows us to make precise statements such as “QSVM trails a classical RBF-kernel SVM by roughly ten percentage points on the identical fourteen-dimensional inputs”. We deliberately keep the binary setting as the primary scope of this paper, since extending to open-set, multi-model attribution requires a different evaluation protocol and a substantially larger corpus; the open-set extension is outlined in Section 3.5 and discussed alongside corpus scaling in Section 4.4.

Performance on this task is measured along three complementary axes. The headline metric is validation accuracy, measured on the shared held-out 1160-sample set for all large-scale runs, which makes those figures directly comparable; the exploratory and analysis-split runs use the validation sets described in Section 2.1. Stability is captured by 5-fold stratified CV on the training portion, summarized by a CV mean and standard deviation. Per-class precision, recall, and F1 are reported for every configuration to detect any systematic bias toward one of the two LLMs. In addition to these classification metrics, every QSVM run produces a feature-attribution profile (the PCA representation salience of Section 2.5 in the PCA pipelines, and uniform bookkeeping weights with pooled class-mean directions in the direct-encoding pipeline of Section 3.3), which is what makes the stylometric fingerprinting analysis of Section 3.2 and Section 3.3 possible.

2.3. Research Questions

Within this binary, like-for-like attribution setting, the paper addresses four research questions (RQs). The first concerns the practical performance ceiling of QSVM and the conditions under which it is reached; the second concerns the dominant failure mode encountered as quantum dimension grows; the third concerns what the quantum model actually “learns” beyond raw accuracy; and the fourth tests whether better-engineered feature representations can push past the accuracy ceiling of the PCA baseline without sacrificing interpretability.

• RQ1 (Benchmark and ceiling). What is the optimal hyperparameter configuration of QSVM for binary LLM attribution on a corpus of approximately 5800 samples, where does its accuracy ceiling lie, and how does that ceiling compare with a classical SVM operating on identical features as well as on the full TF-IDF representation?
• RQ2 (Kernel concentration). How does quantum kernel concentration manifest as the feature dimension grows from 4 to 16 qubits, and what data-to-qubit ratio is required to avoid it on a problem of this scale and difficulty? In particular, does increasing circuit repetitions or moving to richer Pauli feature maps mitigate this effect, or do they accelerate it?
• RQ3 (Stylometric fingerprinting). What stylometric fingerprint emerges from the similarity structure induced by the quantum kernel for each LLM, and how does this fingerprint evolve as feature dimension increases? Specifically, do additional qubits expose genuinely new stylistic axes, or do they merely sharpen the ones already visible at low dimension?
• RQ4 (Interpretable feature engineering). Can enriched stylometric feature representations, namely, a hybrid character n-gram plus stylometric pipeline and a direct named-feature encoding in which one qubit corresponds to one stylometric feature, surpass the accuracy ceiling of the PCA baseline while preserving, or even sharpening, the interpretability of quantum attribution?

These four questions together motivate the two-stage experimental design of the paper. Stage 1 (Section 3.1, with the stylometric fingerprint analysis in Section 3.2 and the complete per-configuration results in Appendix B) addresses RQ1 through RQ3 by means of an 83-configuration hyperparameter benchmark, while Stage 2 (Section 3.3) addresses RQ4 by means of a controlled feature-engineering investigation. Section 3.5 then extends the framework toward open-set attribution, and the discussion in Section 4 traces both the implications of the empirical findings and the limits of the current corpus.

2.4. Feature Extraction Pipeline (Baseline)

The baseline feature representation used throughout Stage 1 combines two complementary signals: a distributional view of the text in the form of TF-IDF word n-grams, and a hand-engineered linguistic profile of the text in the form of eighteen named features. Together these two components form a 3018-dimensional vector that is later either passed in full to the classical baseline or compressed via PCA before being fed to the quantum circuit.

The distributional component is produced by scikit-learn’s TfidfVectorizer configured with word unigrams and bigrams, a maximum vocabulary of 3000 features, document-frequency thresholds of min_df = 5 and max_df = 0.7, and English stop words removed. This step captures vocabulary preferences and short collocational patterns that vary systematically between the two LLMs.

The linguistic component consists of eighteen hand-crafted features grouped into three categories of six. Lexical features describe surface-level vocabulary statistics; syntactic features describe part-of-speech (POS) mixes and overall complexity; stylistic features describe tone and presentation. The full set is listed in

Table 2. Eighteen baseline linguistic features grouped by category, six per category.

Category	Features
Lexical	avg_word_len, avg_sent_len, unique_ratio, vocab_richness, word_count, char_count
Syntactic	noun_ratio, verb_ratio, adj_ratio, adv_ratio, punct_density, syntactic_complexity
Stylistic	formality, question_ratio, exclaim_ratio, capital_ratio, contraction_ratio, list_marker_density

, and Appendix D gives the precise definition of every stylometric feature used in the study.

The TF-IDF block and the linguistic block are concatenated into a single 3018-dimensional feature vector, which serves as the input to both the classical and the quantum pipelines. For the quantum pipeline, this vector is then standardized with StandardScaler, projected onto its first QUANTUM_FEATURE_DIM principal components by PCA, and finally rescaled into the [0, 2$\pi$] interval so that each component can be used directly as an encoding parameter of the data-encoding feature map; in the ZZFeatureMap of Equation (1), each input coordinate parameterizes both single-qubit phase operations and pairwise interaction terms. This reduction step is what makes the high-dimensional TF-IDF representation tractable for circuits of 4 to 16 qubits, but it also raises a natural question: does the compression itself limit what the quantum classifier can achieve? Section 3.3 and Section 4 examine this possibility and rule it out as the cause of the quantum accuracy ceiling. The two enriched feature pipelines introduced in Stage 2, namely, the hybrid character n-gram plus stylometric pipeline and the direct named-feature encoding, are described in detail in Section 3.3.

2.5. QSVM Architecture

The quantum kernel is computed on Qiskit’s FidelityStatevectorKernel, which performs exact, noiseless, deterministic statevector simulation and therefore evaluates the ideal circuit model exactly, without sampling or hardware noise. All results reported in this paper are thus obtained by exact classical simulation of the quantum kernel; no quantum hardware is used. For each pair of input vectors x and $x^{\prime }$, the kernel value is the quantum-mechanical fidelity between their feature-mapped states, $K(x,x^{\prime })={\left|\langle \phi \left(x\right)|\phi \left(x^{\prime }\right)\rangle \right|}^2$, where the data are encoded into the quantum state by a feature-map unitary $U_{\mathsf{\Phi }}\left(x\right)$ (Equation (1)) acting on ${|0\rangle }^{\otimes d}$. The kernel matrix produced by these pairwise overlaps is then passed to a kernelized support vector classifier (SVC), which serves as the final binary classifier. This choice is methodologically deliberate: by removing shot noise and decoherence from the simulation pipeline, every kernel value depends only on the input vector and on the feature-map circuit, which lets us isolate the contribution of qubit count, feature-map family, circuit depth, regularization, and feature representation to the observed accuracy without any confounding from hardware noise. Combined with fixed random seeds for the train–validation split, the PCA projection, the MI selector, and the 5-fold stratified CV, the entire 83-configuration benchmark is deterministic on the documented fixed corpus and software stack; bitwise identity across different numerical-library versions is not claimed (Appendix A).

Formally, each preprocessed input vector $x\in {[0,2\pi ]}^d$ is encoded by the ZZFeatureMap acting on d qubits,

$$\begin{array}{cc}\hfill \left|\phi \right(x)\rangle & =U_{\mathsf{\Phi }}\left(x\right){|0\rangle }^{\otimes d},\hfill \\ \hfill U_{\mathsf{\Phi }}\left(x\right)& ={\left[\exp \left(-i{\displaystyle \sum _{j=1}^d}{\varphi }_j\left(x\right)Z_j-i\sum _{(j,k)\in E}{\varphi }_{jk}\left(x\right)Z_j{Z}_k\right)H^{\otimes d}\right]}^r,\hfill \end{array}$$

(1)

where $Z_j$ is the Pauli-Z operator on qubit j, H is the Hadamard gate, r is the number of circuit repetitions (reps), $E={\left\{(j,j+1)\right\}}_{j=1}^{d-1}$ is the linear entanglement graph used throughout, and the data-map family $\mathsf{\Phi }=\{{\varphi }_j,{\varphi }_{jk}\}$ follows the Qiskit convention ${\varphi }_j\left(x\right)=x_j$ and ${\varphi }_{jk}\left(x\right)=(\pi -x_j)(\pi -x_k)$. With the negative exponent, $U_{\mathsf{\Phi }}\left(x\right)$ is the unitary realized, up to an input-dependent global phase, by the single-qubit phase gates $P\left(2{\varphi }_j\right)$, where $P\left(\lambda \right)=\mathrm{diag}(1,e^{i\lambda })$, and, for the two-qubit terms, by phase gates $P\left(2{\varphi }_{jk}\right)$ conjugated by controlled-NOT (CNOT) gates in Qiskit’s ZZFeatureMap circuit; the squared overlap of Equation (2) is invariant under the choice of sign convention. The fidelity kernel between two inputs is the squared overlap of their encoded states,

$$K(x,x^{\prime })={\left|{\langle 0|}^{\otimes d}{U}_{\mathsf{\Phi }}^{†}\left(x^{\prime }\right)U_{\mathsf{\Phi }}\left(x\right){|0\rangle }^{\otimes d}\right|}^2,$$

(2)

which FidelityStatevectorKernel evaluates exactly from the simulated statevectors. The resulting kernel matrix is passed to a soft-margin SVC, obtained by solving the standard dual problem

$$\underset{\alpha }{\max }\sum _i{\alpha }_i-\frac{1}{2}\sum _{i,j}{\alpha }_i{\alpha }_j{y}_i{y}_{j}K(x_i,x_j)\mathrm{s}.\mathrm{t}.0\le {\alpha }_i\le C,\sum _i{\alpha }_i{y}_i=0,$$

(3)

with class labels $y_i\in \{-1,+1\}$ (Gemma 3/Qwen 2.5) and regularization parameter C; a new text with preprocessed vector q is classified by $\widehat{y}\left(q\right)=\mathrm{sign}\left({\sum }_i{\alpha }_i{y}_{i}K(x_i,q)+b\right)$, where b is the bias term of the trained classifier. Before encoding, the 3018-dimensional vector v is standardized per feature to give $\widehat{v}$, which is projected onto its first d principal components, $z=P_d^{\top }\widehat{v}$, where $P_d\in {\mathbb{R}}^{3018\times d}$ holds the first d principal axes as columns; each component is then rescaled to the encoding interval,

$${\tilde{x}}_j={\mathrm{clip}}_{[0,2\pi ]}\left[2\pi {\displaystyle \frac{z_j-z_j^{\min }}{{\Delta }_j}}\right],{\Delta }_j=\left\{\begin{array}{cc}{z}_j^{\max }-z_j^{\min },\hfill & z_j^{\max }>z_j^{\min },\hfill \\ 1,\hfill & \mathrm{otherwise},\hfill \end{array}\right.$$

(4)

with all statistics ($P_d$, per-feature means and scales, $z^{\min },z^{\max }$) fitted on the training portion only; held-out vectors are mapped with the same training min/max and clipped into $[0,2\pi ]$, and the resulting vector $\tilde{x}=({\tilde{x}}_1,\dots ,{\tilde{x}}_d)$ is the preprocessed input x of Equation (1). The feature profiles of Section 3.2 and Section 3.3 summarize how strongly each named input feature is represented in the retained PCA subspace; this representation-salience score uses only the PCA loadings and explained-variance ratios and does not aggregate evidence from the trained classifier. For the PCA pipelines, the raw salience of named feature f is the explained-variance-weighted sum of absolute loadings, and the reported value is its share of the total over all original features,

$$A_{\mathrm{PCA}}\left(f\right)={\displaystyle \sum _{k=1}^d}{\widehat{\lambda }}_k\left|{\left(P_d\right)}_{fk}\right|,I\left(f\right)=100{\displaystyle \frac{A_{\mathrm{PCA}}\left(f\right)}{{\sum }_{g=1}^F{A}_{\mathrm{PCA}}\left(g\right)}},$$

(5)

where ${\widehat{\lambda }}_k={\lambda }_k/{\sum }_{k^{\prime }=1}^d{\lambda }_{k^{\prime }}$ is the explained-variance ratio of component k renormalized over the d retained components, ${\left(P_d\right)}_{fk}$ is its loading on feature f, and $F=3018$ is the number of original features, so that the reported values sum to 100 (this is the importance_score field of the released artifacts). $I\left(f\right)$ depends only on the fitted preprocessing and PCA; it is a representation-salience percentage, not an attribution of the trained QSVM decision function. For the direct encoding of Section 3.3, no PCA reconstruction is performed: the artifact exporter (the pipeline routine that writes each run’s feature-attribution record) assigns each of the d MI-selected inputs the equal bookkeeping weight $100/d$, and class-direction labels are obtained separately from pooled class-conditional feature means. Finally, as a descriptive index for comparing configurations across the tested grid, we also report the samples-per-qubit ratio $\rho =N_{\mathrm{train}}/d$; we do not treat it as a universal threshold.

The baseline feature map is the ZZFeatureMap with linear entanglement and reps = 2, and the regularization parameter of the SVC is varied across $C\in \{1, 10, 50, 100\}$ during the Stage 1 benchmark. To probe the role of the data-encoding circuit itself, two further families of variants are evaluated. The PauliFeatureMap is tested in Experiment 1.4 with the Pauli-string sets $[Z,XX]$ and $[Z,ZZ,XX]$ under linear connectivity and $[Z,ZX,XX]$ under full all-to-all connectivity (the Pauli_XX, Pauli_ZZ_XX, and Pauli_full variants), in order to measure how richer entanglement structures interact with the corpus, and circuit repetitions reps ∈ {2, 3} are tested in dedicated ablations to probe the onset of depth-induced kernel concentration. Together these grids span the standard quantum-kernel design space and let us separate the contribution of the kernel structure from that of the regularization strength.

2.6. Classical SVM Baseline

For every QSVM run we also train a classical reference SVM on a comparable input. The classical model is LinearSVC with L2 regularization, squared-hinge loss, balanced class weights, and $C=1.0$ (dual formulation disabled, at most 2000 iterations, seed 42), wrapped in scikit-learn’s CalibratedClassifierCV with 5-fold isotonic calibration so that its predicted probabilities are well-defined and usable for per-class evaluation. The classical baseline plays three distinct roles in this paper. In its global form, used throughout Stage 1, it operates on the full 3018-dimensional TF-IDF and linguistic vector, providing an upper bound on what a strong classical model can extract from this corpus and a stable point of reference (approximately 97 to 98% accuracy) against which the QSVM ceiling is contextualized. In its feature-ablation form (Experiment 2.4, Section 3.3.3), it operates on the same fourteen MI-selected stylometric features as the direct-encoding QSVM of Experiment 2.3, quantifying how much of the gap to the global baseline is caused by the reduced input rather than by the kernel. Finally, in its control form (Experiment 2.5), a classical SVM is trained on the identical inputs that the quantum circuit consumes, namely, the standardized, PCA-projected, [0, 2$\pi$]-rescaled vectors of Equation (4); for this control we use scikit-learn’s SVC with an RBF kernel, $C\in \{1,10,100\}$, gamma set to ‘scale’, and balanced class weights, together with a LinearSVC reference; the control refits the same StandardScaler, PCA, and rescaling recipe on the same split and seed rather than reloading the fitted transforms of the QSVM run (Section 3.2.3), so that any accuracy difference between this control and the QSVM is attributable to the kernel function alone, with the input recipe held fixed. In effect, the third baseline checks whether an ordinary classical method does better when it sees exactly the same numbers the quantum circuit sees.

2.7. Evaluation Protocol

The metrics introduced in Section 2.2 are computed in a single common protocol that is applied to every run of every experiment. Validation accuracy is measured on the fixed 1160-sample held-out set of Table 1 for every large-scale configuration (including the Stage 2 baseline, Experiment 2.1, Experiments 2.2 to 2.4, and the Experiment 2.5 controls), or on the locally drawn validation sets described in Section 2.1 for the exploratory runs; the headline figures of the large-scale benchmark are thus directly comparable across configurations. Stability is measured by 5-fold stratified CV on the training partition. For the Stage 1 and Stage 2 QSVM summaries, TF-IDF, linguistic scaling, PCA or MI selection, and angle normalization are fitted once on the complete training partition; each fold then rebuilds the kernel matrix and retrains the quantum support vector classifier (QSVC) on the fold’s training rows of this fixed representation, so the CV values assess classifier stability conditional on a training-fitted representation rather than end-to-end fold-local pipeline performance. Experiment 2.5 refits its StandardScaler, PCA, and angle normalization inside each fold, while the upstream TF-IDF and linguistic feature matrix remains fitted on the complete training partition. The mean and standard deviation of these five out-of-fold accuracies are reported as the CV summary. Per-class precision, recall, and F1 are computed on the held-out validation set for both Gemma 3 and Qwen 2.5 so that systematic skew toward one model can be detected even when overall accuracy looks balanced. Final generalization estimates are reported separately: the headline configurations are re-evaluated exactly once, with all settings frozen, on the independent test corpus of Section 2.1, and these results are collected in Section 3.4. A replication note in Appendix A documents the one software-environment difference between the original benchmark runs and the later test-set evaluation (the NumPy version) and its measured effect on the reported figures.

In addition to the classification metrics, every QSVM run produces a feature-attribution profile, which is the basis of the stylometric analysis in Section 3.2 and Section 3.3. For the PCA-based baseline, the attribution is obtained by aggregating the contribution of each named input feature back through the PCA components, weighted by the explained variance of those components. For the direct-encoding pipeline of Section 3.3, no reconstruction is needed: each qubit corresponds one-to-one to a named stylometric variable, the artifact exporter records the uniform bookkeeping weight $100/d$, and the model association of each feature comes from pooled class-conditional means. Computational cost is reported as the wall-clock time of the dominant quantum-kernel matrix construction step, separately from preprocessing, PCA fitting, classifier fitting, and CV overheads, so that the cost figures in Appendix A can be interpreted as a direct measure of the quantum-side workload rather than of the surrounding pipeline. Figure 1 summarizes the resulting end-to-end Stage 1 pipeline.

3. Results

The empirical findings of the study are organized into two stages and five subsections. Section 3.1 reports the Stage 1 hyperparameter benchmark and isolates the QSVM accuracy ceiling, the kernel-concentration regime, and the cost of richer feature maps and deeper circuits. Section 3.2 extracts the stylometric fingerprint recovered from the PCA representation shared by the quantum and classical pipelines and tracks how that fingerprint evolves with feature dimension. Section 3.3 introduces the two enriched Stage 2 feature pipelines, namely, the hybrid character n-gram plus stylometric pipeline and the direct named-feature encoding, and evaluates them against the PCA baseline and a classical-SVM ablation. Section 3.4 reports an independent test-set evaluation in which every frozen configuration is re-evaluated, without any further tuning, on a newly generated corpus, providing an unbiased check on the benchmark’s headline numbers. Section 3.5 then proposes the open-set proximity-scoring framework that builds on the binary results. To keep the focus on insights rather than data tables, the full per-configuration results of the 83-run benchmark, the Stage 2 hyperparameter sweep, the per-experiment computational-cost breakdowns, and the formal stylometric feature definitions are deferred to Appendices Appendix A, Appendix B, Appendix C and Appendix D.

3.1. Stage 1: Hyperparameter Benchmark

The Stage 1 benchmark spans 83 QSVM configurations across qubit counts $d\in \{4,6,8,10,12,14,16\}$, regularization parameters $C\in \{1,10,50,100\}$, training-set sizes from 600 to 4640 samples, and two feature-map families (ZZFeatureMap with reps ∈ {2, 3} and PauliFeatureMap with the $[Z,XX]$, $[Z,ZZ,XX]$, and fully connected $[Z,ZX,XX]$ variants). All runs use the noiseless qiskit_statevector_deterministic backend on 64-core CPU nodes (Python 3.12.2, Qiskit 1.4.3, Qiskit Machine Learning 0.8.3, and 248 GB of random-access memory (RAM)), and total computation across the 83 runs is approximately 72 h of pipeline time (about 61 h of pure quantum-kernel time). The complete per-configuration results, broken down by experiment, are tabulated in Appendix B; here, we focus on the patterns these results form.

3.1.1. Accuracy Ceiling and Dual Operating Points

Across all 83 baseline configurations, the validation accuracy of the QSVM is bounded by approximately 88%, and this ceiling is reached at two qualitatively different operating points: a low-dimension, low-data point ($d=8$ with 600 training samples, 88.00% on an Experiment 1.1 locally subsampled 400-sample validation set) and a high-dimension, high-data point ($d=12$ to 14 with 3480 training samples, 88.02% on the standardized 1160-sample held-out set used for all large-scale runs). Although these two operating points are not measured on identical validation sets, both lie at the same level of accuracy and arise from radically different qubit counts and training-set sizes. Section 3.4 shows, however, that only the large-scale operating point survives evaluation on an independent test set; the $d=8$ point is revisited there. The complete per-configuration breakdown across all experiments is given in Appendix B.

Table 3. Best QSVM accuracy per dimension across the Stage 1 benchmark. The overall best accuracy, reached at both $d=12$ and $d=14$, is shown in bold.

d	Best QSVM	Best Config	CV Mean	CV Std
4	79.75%	600/400, $C=1$	73.50%	±3.82%
6	84.25%	600/400, $C=1$	78.00%	±2.67%
8	88.00%	600/400, $C=1$	77.67%	±2.91%
10	86.75%	600/400, $C=1$	76.17%	±2.96%
12	88.02%	3480/1160, $C=1$	83.19%	±0.75%
14	88.02%	3480/1160, $C=1$	83.05%	±0.84%
16	86.72%	3480/1160, $C=1$	80.98%	±0.84%

summarizes the best QSVM accuracy reached at each dimension and the configuration where it occurs, and Figure 2 plots validation accuracy as a function of training-set size for every qubit count; the classical SVM trained on the full 3018-dimensional TF-IDF and linguistic vector consistently reaches approximately 97% to 98% across the same configurations and provides a stable point of reference.

The regularization parameter C is essentially neutral within the sweet spot of each dimension: at $d=8$ with 600 training samples, $C\in \{10,50,100\}$ all reach 87.5%, only half a percentage point below $C=1$. We therefore fix $C=1$ in all subsequent large-scale experiments, which keeps the design space tractable without sacrificing accuracy. Three further patterns underpin Table 3: balanced 60/40 train–validation splits outperform 70/30 and 80/20 splits at small training-set sizes (a pattern most plausibly reflecting the small, locally drawn validation sets of this regime; Section 3.4 shows the apparent small-split advantage does not survive independent testing); the CV gap closes from ±2.91% at the $d=8$ sweet spot to ±0.75% at the $d=12$/3480-sample peak, indicating that the large-scale classifier is stable across folds of the fixed representation; and from $d=8$ upward the gap between the best QSVM and the CSVM at each dimension stays at roughly ten to eleven percentage points (it is larger, 13 to 18 points, at $d=4$ and $d=6$), an observation whose natural reading, that the limit lies in the input representation, is tested and refuted by the identical-input control of Experiment 2.5 (Section 3.3).

3.1.2. Quantum Kernel Concentration and the Data-to-Qubit Ratio

Each dimension exhibits a characteristic optimal training-sample range, both below and above which validation accuracy degrades. The progression of these optima as dimension grows reveals the second key observation of Stage 1: QSVM performance on this corpus is governed by a dimension-dependent training-samples-per-qubit ratio. At low qubit counts ($d\le 8$), the optimum lies in a narrow band around 75 to 150 samples per qubit; at intermediate qubit counts it broadens (roughly 60 to 160 at $d=10$ and 133 to 290 at $d=12$); at high qubit counts ($d=14$ to 16), it saturates around 220 to 250. Pushing significantly below this dimension-specific optimum and pushing above it at the largest qubit counts both degrade validation accuracy (Figure 3): below the optimum there is too little data to resolve the concentrated kernel, while above it at the largest qubit counts the concentration penalty dominates (Section 4.2).

Table 4. Optimal training-set size per dimension and the resulting samples-per-qubit ratio.

d	Optimal Training Range	Samples per Qubit at Optimum	Peak QSVM	Notes
4	600	150	79.75%	Limited expressibility
6	600	100	84.25%	Same
8	600	75	88.00%	Experiment 1.1 sweet spot
10	600 to 1600	60 to 160	86.75%	Concentration onset visible
12	1600 and 3480	133 and 290	88.02%	Right-shifted optimum
14	3200 to 3480	229 to 249	88.02%	Joint peak
16	3480	218	86.72%	Sharp full-data drop
16	4640 (full data)	290	82.16%	−4.56 pp concentration penalty

summarizes the optimum and the corresponding samples-per-qubit value at each dimension probed. The optimum shifts rightward and broadens as qubit count grows, but at $d=16$ it also begins to saturate: extending the training set from 3480 to the full 4640 samples drops accuracy from 86.72% to 82.16%, the clearest single signature of concentration in the benchmark. The complete per-experiment tables that underlie this summary are given in Appendix B.

The empirical concentration threshold we observe is more pessimistic than the prediction from purely Hilbert-space-filling arguments, because the ZZFeatureMap with linear entanglement concentrates the kernel even at moderate sample densities. The hardest case in our benchmark is $d=16$ at the full 4640 training samples, where the validation accuracy falls by 4.56 percentage points compared with the 3480-sample run, and the same configuration also requires the largest computational budget, namely, 17 h and 56 min of wall-clock time and a peak process memory of 10.1 GB. This is the regime in which the fidelity kernel matrix is most strongly dominated by indistinguishable inner products, and the corresponding support-vector decision boundary loses discriminative power. Concretely, the kernel begins to score nearly all pairs of texts as similar to the same tiny degree, and the boundary between the two models blurs. At this configuration, the named-feature representation-salience values $I\left(f\right)$ of Equation (5) cluster between 0.067 and 0.106 on its sum-to-100 scale (the same narrow band as the $d=16$ column of Figure 4), a near-uniform profile; all sixteen named linguistic features nevertheless keep a consistent class-mean direction of association (Section 3.2.1), so the per-feature directional signal in the underlying data remains intact even as the kernel’s discriminative power collapses. The direct kernel-matrix measurements that confirm this reading are reported and analyzed as the mechanism behind the ceiling in Section 4.2.

3.1.3. Feature-Map and Circuit-Depth Ablations

Experiment 1.4 of the benchmark compares the baseline ZZFeatureMap (Z and ZZ Pauli terms with linear entanglement) against three PauliFeatureMap variants of increasing entanglement richness.

Table 5. PauliFeatureMap comparison at the two best Experiment 1.1 configurations. The best accuracy within each split is shown in bold.

Feature Map	600/400 QSVM	CV (600/400)	800/200 QSVM	CV (800/200)	Kernel Time (600 Train)
ZZFeatureMap	88.00%	77.67 ± 2.91%	86.00%	79.12 ± 2.76%	50 s
Pauli_XX	84.75%	77.33 ± 2.76%	87.00%	79.25 ± 2.42%	1 min
Pauli_ZZ_XX	77.50%	69.00 ± 2.95%	79.00%	76.88 ± 1.98%	1 min
Pauli_full	65.25%	63.00 ± 3.23%	66.00%	66.88 ± 1.85%	4 min

reports the validation accuracy and the kernel-construction time at the two best Experiment 1.1 splits (600/400 and 800/200, both at $d=8$ and $C=1$). Pauli_XX is competitive with the baseline at 800/200 (+1 pp) but underperforms at 600/400 (−3.25 pp), while richer entanglement structures (Pauli_ZZ_XX, Pauli_full) collapse accuracy and inflate runtime. The full per-configuration results are given in Appendix B.4.

ZZFeatureMap with linear entanglement provides the best inductive bias for this stylometric task. Adding XX-only entanglement gives a marginal benefit at 800/200 but hurts at 600/400; adding ZZ + XX terms drops accuracy by 7 to 10.5 percentage points; and using the fully connected $[Z,ZX,XX]$ structure drops accuracy to 65 to 66%, the worst result in the benchmark, and inflates runtime by roughly a factor of five. These observations align with the theoretical prediction that richer entanglement structures concentrate the fidelity kernel faster [17] and motivate our choice of ZZFeatureMap for all subsequent experiments.

A separate circuit-depth ablation compares reps = 3 against the baseline reps = 2 at three configurations spanning the small-data and medium-data regimes. Across all three, the deeper circuit costs between 5.00 and 9.25 percentage points of validation accuracy without a single positive case; the per-run table is reported in Appendix B.5. This is a clean empirical signature of depth-induced kernel concentration, analogous to barren plateaus in variational circuits: the deeper circuit produces a more uniform kernel and the resulting decision boundary loses discriminative power. We therefore fix reps = 2 throughout Stage 2 as well.

3.1.4. Per-Class Behavior at the Joint-Best Configuration

At the joint-best configuration ($d=14$, 3480 training samples, 1160 validation, $C=1$), the QSVM exhibits a slight but interpretable bias toward classifying samples as Qwen 2.5. The per-class metrics are summarized in

Table 6. Per-class precision, recall, and F1 at the joint-best configuration ($d=14$, 3480/1160, $C=1$).

Class	Precision	Recall	F1-Score
Gemma 3	91.37%	83.97%	87.51%
Qwen 2.5	85.17%	92.07%	88.48%
Weighted average	88.27%	88.02%	88.00%

.

The asymmetry is small in absolute terms but informative: Qwen 2.5 recall is 8 percentage points higher than Gemma 3 recall, meaning Gemma texts are more frequently misclassified as Qwen than the reverse. Section 3.2.2 shows that this is consistent with Qwen’s more distinctive formal stylometric signature, dominated by long sentences, high syntactic complexity, and a high formality score, while Gemma’s broader expressive register is harder for the kernel to pin down on a single dominant axis.

3.2. Stylometric Fingerprint Analysis

Beyond classification accuracy, every QSVM run produces a feature-attribution profile, in which the contribution of every named input feature is recovered by aggregating across the PCA components weighted by their explained variance (Section 2.7). This subsection summarizes the stylometric profiles that emerge from these reconstructions across the full Stage 1 benchmark; Section 3.2.3 then examines what this reconstruction does and does not reveal about the quantum kernel itself.

3.2.1. Progressive Feature Discovery Across Dimensions

The variance-weighted PCA salience profile of Equation (5) evolves systematically as dimension increases. Each additional pair of qubits unlocks a new stylistic axis.

Table 7. Stylistic signals first entering the reconstructed fingerprint at each qubit count.

Dimension	New Stylistic Signals Entering the Named-Feature Buckets
8	exclaim_ratio, question_ratio, capital_ratio (all Gemma)
10	formality (Qwen) first appears; contraction_ratio surfaces marginally (bottom of the top-100; see Figure 4)
12	vocab_richness (Gemma) appears; all previously named axes persist
14	Full sixteen-feature fingerprint: twelve Gemma- and four Qwen-aligned features
16	contraction_ratio (Gemma) reappears in the full-data (4640-sample) run, completing the fifth stylistic axis (configuration-sensitive; see Appendix B.8)

lists the dimension at which each axis first enters the reconstruction’s named-feature buckets, together with its model association. The model association of each feature is the class with the larger pooled class-conditional mean (training and validation data combined), computed directly on the feature columns, independently of the kernel and the classifier. The released artifacts also store a legacy clipped mean-contrast ratio, $\min \left\{\right|{\mu }_G-{\mu }_Q|/\max ({\mu }_G+{\mu }_Q,\epsilon ),1\}$, which saturates at 1 whenever the two class means have opposite signs, the typical case for standardized features; here ${\mu }_G$ and ${\mu }_Q$ are the pooled class-mean values of the standardized feature for Gemma 3 and Qwen 2.5, and $\epsilon ={10}^{-8}$ guards against division by zero. Because the stored ratio is neither a confidence nor an effect size, we report only the direction of association. The progression demonstrates that increasing the encoded dimension genuinely expands the stylometric vocabulary of the compressed representation rather than merely sharpening already-visible signals; Section 3.2.3 shows that this progression is a property of the representation shared by both kernels, not a quantum-specific capability. The five named axes (vocabulary, syntax, punctuation habits, formality, contraction) are mapped onto the 18 baseline features as follows: exclaim and question rates and capitalization populate the punctuation-and-presentation axis at $d=8$; formality becomes the dominant Qwen axis at $d=10$; vocabulary richness and POS-mix syntax are filled in at $d=12$ and $d=14$; and contraction_ratio completes the fifth axis at $d=16$ in the full-data run, a configuration-sensitive finding revisited in Appendix B.8. Figure 4 visualizes this progressive ladder of feature discovery across dimensions. A same-split comparability check is provided in Appendix B.8.

3.2.2. Complete LLM Stylometric Profiles

At the $d=14$ sweet spot, the PCA salience profile recovers a complete stylometric fingerprint for each model. Twelve features are Gemma-aligned and four Qwen-aligned by pooled class-mean direction; the remaining two features (contraction_ratio and list_marker_density) do not appear in the named-feature buckets at this dimension, with contraction_ratio surfacing only at $d=10$ and $d=12$ among the Figure 4 ladder configurations (where it ranks at the bottom of the top-100 with low importance; the full-data $d=16$ run adds it, as Table 7 records and Appendix B.8 details) and list_marker_density remaining topic-dependent and outside the top-100 across every dimension we tested. The Gemma 3 fingerprint is multi-dimensional and expressive: lexically, it shows higher vocabulary richness, a higher type–token ratio, a longer average word length, and a higher character count per text; syntactically, it shows higher noun, adverb, adjective, verb, and punctuation densities; stylistically, it favors more exclamation marks, higher capitalization, and more questions. The Qwen 2.5 fingerprint is, in contrast, concentrated in structural signals: longer sentences, higher word counts per text, a higher syntactic-complexity score, and a higher formality score. Read together, these two profiles match each model’s known training-and-tuning characteristics: Gemma’s instruction-tuning emphasis on conversational helpfulness produces a colloquial, expressive register, while Qwen’s emphasis on structured reasoning produces a longer, more complex, more formal register that, at $d=16$ in the full-data run, also reveals a lower contraction rate. Two caveats frame how these profiles should be read. First, the fingerprint analyses at $d=8$ and $d=10$ come from small-scale runs with locally drawn validation sets (600/400 and 1600/600), whereas those at $d\ge 12$ share the standard 3480/1160 split behind the headline accuracies of Section 3.1 (see the Figure 4 caption and Appendix B.8 for run provenance). Second, as Section 3.2.3 shows, the reconstructed profile is a property of the shared input representation rather than of the quantum kernel specifically: a classical model trained on the same fourteen-dimensional inputs carries a similar, if not the same, fingerprint.

3.2.3. Classical Versus Quantum Feature Attribution

The attribution profiles reported in this paper come from two different procedures, and the distinction matters for what they can and cannot show. The classical profile quoted throughout Stage 1 is obtained from the trained LinearSVC weights on the full 3018-dimensional vector, whereas the QSVM profile is the variance-weighted PCA reconstruction of Equation (5). The latter is computed entirely from the fitted PCA (its loadings and explained-variance ratios) and does not consult the kernel matrix, the support vectors, or any other property of the trained classifier. It is therefore kernel-agnostic by construction: any model trained on the same fitted StandardScaler, PCA, and rescaling chain inherits the identical profile, and the small residual differences reported below arise only because the classical control refits that chain in the replication environment rather than reloading the frozen transforms. As a direct check, we applied the identical procedure to the classical control trained on the same fourteen-dimensional inputs (Experiment 2.5, Section 3.3) and recovered essentially the same top features that Section 3.2.1 and Section 3.2.2 report for the QSVM runs: avg_sent_len (importance 0.1124), adv_ratio (0.1058), and syntactic_complexity (0.1037) lead the ranking, followed by noun_ratio, exclaim_ratio, punct_density, capital_ratio, and vocab_richness.

Table 8. The two attribution procedures compared. The contrast between a concentrated and a distributed importance profile reflects the difference between the procedures, not a difference between kernels: the PCA reconstruction of Equation (5) gives essentially the same profile for any classifier trained on the same fourteen-dimensional inputs.

Aspect	Linear-Weight Attribution	PCA Representation Salience
Input space	Full 3018-dimensional vector	14-dimensional PCA input
Source of reported score	Trained LinearSVC weight vector	PCA loadings and explained variance
Kernel dependence	Specific to the trained model	None (kernel-agnostic by construction)
Profile shape	Concentrated on a few dominant features	Spread across all 18 named features
Top-1 feature	vocab_richness	avg_sent_len

summarizes the two procedures side by side. In plain terms, the fingerprint is a picture of what the compressed representation keeps, and both the quantum and the classical model wear the same picture.

The methodological lesson deserves to be stated explicitly. The distributed shape of the reconstructed profile, with small, nearly uniform contributions across all eighteen named axes, invites two readings: as evidence of a distinctively quantum, interference-mediated use of the input features, and as a promise of structural robustness to single-feature adversarial manipulation. The classical comparison on identical inputs removes the basis for both: the same distributed profile appears whenever Equation (5) is applied to any classifier on these inputs, so it supports no conclusion about the quantum kernel’s decision surface, and no adversarial-robustness advantage can be inferred from it. What remains defensible is the more modest statement that the variance-weighted reconstruction is a useful, model-independent summary of which stylometric signals survive the compression to fourteen dimensions. This is a concrete instance of a broader pattern in QML evaluation, in which an apparent quantum advantage dissolves once the appropriate classical control is run under identical conditions [25].

3.3. Stage 2: Feature Engineering for Quantum Stylometry

The Stage 1 benchmark establishes that the 88% accuracy ceiling persists across $d=4$ to $d=16$, all C values, both ZZFeatureMap and Pauli_XX feature maps, and reps ∈ {2, 3}. Because the classical SVM operating on the full 3018-dimensional vector reaches approximately 97 to 98% on the same corpus, a natural hypothesis is that the ceiling reflects a feature-representation limitation induced by the PCA compression of the 3018-dimensional baseline vector down to fourteen dimensions, rather than a property of the quantum kernel itself. Stage 2 tests this hypothesis from two directions. First, it investigates whether two enriched feature pipelines that restructure or bypass the PCA can exceed the ceiling or, at constant accuracy, sharpen the mapping between qubits and named features. Second, it adds two classical controls on quantum-identical inputs: a classical-SVM ablation on the same MI-selected features (Experiment 2.4) and classical SVMs trained on the exact PCA-compressed and rescaled vectors that the quantum circuit encodes (Experiment 2.5). The pipelines are evaluated at the joint-best Stage 1 configuration ($d=14$, 3480 training samples, $C=1$), with Experiments 2.2–2.4 evaluated on the same 3480/1160 split as the benchmark runs (the split also used in Appendix C for the QSVM). As Section 3.3.3 shows, the controls refute the input-bottleneck hypothesis: the accuracy ceiling follows the kernel, not the representation.

3.3.1. Pipeline Design

Three pipelines are compared, summarized side by side in Figure 5. The PCA baseline (Experiment 2.1) is the same TF-IDF word n-grams plus 18-feature linguistic profile that drove the Stage 1 benchmark, projected onto fourteen principal components and rescaled into [0, 2$\pi$]. The hybrid pipeline (Experiment 2.2) replaces the TF-IDF block with character 3- to 5-grams compressed to eight components by an internal PCA, and concatenates these with the top six stylometric features selected by MI from the same 24-feature candidate pool as Experiment 2.3; the resulting fourteen-dimensional input is passed to the QSVM with PCA disabled (skip_pca=True), so the hand-picked stylometric features are encoded one-to-one onto qubits while only the character n-gram block is compressed. The direct named-feature pipeline (Experiment 2.3) extends the eighteen-feature baseline with six new stylometric features (digit_ratio, sent_len_std, hedge_ratio, paragraph_count_ratio, repeated_bigram_ratio, avg_word_len_std) for a total of twenty-four candidate features, applies MI selection to retain the top fourteen, and passes them directly to the QSVM with no PCA at all. Under this pipeline, each of the fourteen qubits corresponds to one named stylometric feature, achieving the cleanest possible 1-qubit-equals-1-feature encoding. Experiment 2.4 is a classical-SVM ablation that uses exactly the same fourteen MI-selected features as Experiment 2.3 and answers the question of how much of the gap to the 97 to 98% global classical baseline is due to the input bottleneck rather than to the quantum kernel. Experiment 2.5 supplies the final, like-for-like kernel control that the comparison otherwise lacks: it trains classical SVMs (an RBF kernel with $C\in \{1,10,100\}$ and a LinearSVC reference) on the identical inputs that the quantum circuit receives, namely, the standardized vector projected onto the leading principal components and rescaled into [0, 2$\pi$] by Equation (4), across the dimension ladder $d\in \{8,10,12,14,16\}$ at the 3480/1160 split. Because the same preprocessing recipe, split, and seed are used, Experiment 2.5 holds the input recipe fixed and varies only the kernel, so any accuracy difference between it and the corresponding QSVM run is attributable to the fidelity kernel itself, up to the refit noted in Section 2.6.

3.3.2. Extended Stylometric Features

The six new stylometric features added in Experiment 2.3 target signals that are difficult to capture with word n-grams or with the original eighteen baseline features, and that are intuitively likely to differ between Gemma 3 and Qwen 2.5.

Table 9. Six extended stylometric features that, together with the 18 baseline features of Table 2, form the 24-feature candidate pool of the Stage 2 MI selections. From this pool, MI selection retains the top six for the hybrid pipeline (Experiment 2.2) and the top fourteen for direct encoding (Experiment 2.3). Appendix D gives the exact formulas.

Feature	Definition	Expected Discriminator
digit_ratio	count(digits)/len(text)	Qwen uses more numerical references
sent_len_std	std of sentence lengths in tokens	Gemma shows higher variance
hedge_ratio	distinct hedge phrases/sent_count	Qwen hedges more (e.g., “it is important to note”, “however”)
paragraph_count_ratio	num_paragraphs/sent_count	Qwen segments into more paragraphs
repeated_bigram_ratio	repeated bigrams/total bigrams	Captures phrase-repetition habits
avg_word_len_std	std of word lengths	Lexical variety beyond mean word length

lists them with their definitions and the expected direction of the discriminative signal.

3.3.3. Stage 2 Results

Table 10. Stage 2 results at $d=14$ with 3480 training samples ($C=1$, ZZFeatureMap reps = 2). All experiments are evaluated on the standard 3480/1160 split; the Experiment 2.1 baseline figures are the benchmark run of Table 3 and Table A9, and the same split underlies the Appendix C sweep. The best value in each accuracy and CV-mean column is shown in bold.

Pipeline	QSVM Accuracy	CSVM Accuracy	CV Mean	CV Std
Experiment 2.1 (PCA baseline, word TF-IDF)	88.02%	98.02%	83.05%	±0.84%
Experiment 2.2 (char n-gram hybrid)	76.55%	89.74%	74.71%	±1.18%
Experiment 2.3 (direct stylometric, 1 qubit = 1 feature)	78.19%	90.86%	76.84%	±0.56%
Experiment 2.4 (classical, same features as Experiment 2.3)	n/a	90.86%	n/a	n/a

reports the headline numbers for the three pipelines and the classical ablation, and

Table 11. Experiment 2.5: classical SVMs trained on inputs produced by the same StandardScaler → PCA → [0, 2$\pi$] rescaling recipe and random seed as the quantum pipeline at the 3480/1160 split (preprocessing chain refitted for this experiment; Section 2.6). The best RBF configuration per dimension is shown; the final row gives the linear-kernel reference at $d=14$. The QSVM on the same $d=14$ inputs reaches 88.02%. The best validation accuracy is shown in bold.

Dimension	Best Classical Kernel (C)	Validation Accuracy	CV Mean ± Std
8	RBF ($C=10$)	83.02%	82.41 ± 1.70%
10	RBF ($C=1$)	95.60%	94.83 ± 1.31%
12	RBF ($C=1$)	97.41%	97.04 ± 0.96%
14	RBF ($C=100$)	97.76%	96.35 ± 0.55%
16	RBF ($C=100$)	97.59%	96.35 ± 0.85%
14	LinearSVC ($C=1$)	96.64%	96.03 ± 1.06%

reports the like-for-like control of Experiment 2.5. The PCA baseline (Experiment 2.1) retains the highest QSVM accuracy at 88.02%, while both new pipelines reduce QSVM accuracy. The direct stylometric encoding (Experiment 2.3) outperforms the hybrid pipeline (Experiment 2.2) and offers the most transparent feature-to-qubit mapping, and the classical ablation on the same fourteen features (Experiment 2.4) reveals that even when the QSVM and CSVM share the same input, the QSVM trails the classical model by 12.7 percentage points. The QSVM accuracy ranking is baseline > direct > hybrid; the CSVM ranking is baseline > direct (=classical ablation) > hybrid. Appendix C reports a complementary 12-run sweep over feature-map repetitions and C, in which the best Experiment 2.3 configuration improves only slightly to 79.14% (stylometric_direct, $C=10$, reps = 2). One caveat is needed to read Table 10 correctly: the 98.02% CSVM figure in the Experiment 2.1 row is the global classical baseline operating on the full 3018-dimensional vector, not on the fourteen-dimensional quantum input; the classical reference on the identical fourteen-dimensional input is provided by Table 11.

The pattern across the enriched pipelines is clean. Forcing the 3000-dimensional character n-gram block through an eight-dimensional PCA bottleneck (Experiment 2.2) loses more discriminative signal than it gains, both for the quantum and for the classical model. The direct named-feature pipeline (Experiment 2.3) recovers about two percentage points of QSVM accuracy over Experiment 2.2 and roughly one percentage point of CSVM accuracy, but neither pipeline reaches the PCA baseline. More tellingly, the classical ablation (Experiment 2.4) already argues against the input-bottleneck hypothesis: on exactly the same fourteen MI-selected features, the classical model reaches 90.86% against 78.19% for the QSVM at $C=1$, and even the best QSVM configuration in the Appendix C sweep (79.14% at $C=10$, reps = 2) still trails the classical model on identical inputs (all figures in this comparison share the same 3480/1160 split) by 11.7 percentage points. Whatever limits the QSVM on these features, it is not the features.

Experiment 2.5 makes this argument decisive by removing the last representational difference. Table 11 reports classical SVMs trained on the identical StandardScaler–PCA–[0, 2π] vectors that the ZZFeatureMap encodes, across the full dimension ladder. From ten dimensions upward the classical RBF kernel recovers nearly everything the global baseline extracts from the full 3018-dimensional vector: at $d=14$ it reaches 97.76% validation accuracy (5-fold CV 96.35 ± 0.55%), and even a linear SVM on the same fourteen numbers reaches 96.64%. The control’s regularization was itself selected on the shared validation set (the best of $C\in \{1,10,100\}$ per dimension), but the choice is not load-bearing: even at $C=1$ the $d=14$ RBF control reaches 96.98%, and Section 3.4 shows the classical lead survives the independent test set. The QSVM on the very same inputs reaches 88.02%, a deficit of 9.74 percentage points that cannot be attributed to preprocessing, feature selection, or information loss, since every bit of information available to the classical models was available to the quantum model.

Two conclusions follow. First, the PCA input is not the bottleneck. Fourteen principal components retain only 6.88% of the variance of the 3018-dimensional training matrix (capturing 50% of the variance would require 463 components, and 95% would require 1861), yet they evidently retain almost all of the class-discriminative signal, since a classical RBF kernel recovers 97.76% from them, within 0.26 percentage points of the 98.02% global baseline. Second, the ceiling follows the kernel: whether the fourteen inputs are principal components (97.76% classical versus 88.02% quantum) or named stylometric features (90.86% versus 79.14%), swapping the classical kernel for the fidelity kernel costs roughly ten to twelve percentage points under otherwise identical conditions. The input-bottleneck explanation is therefore refuted by its own control, and the mechanism behind the kernel-level gap is the exponential concentration of the fidelity kernel, whose accuracy signature appears in Section 3.1.2 and which is measured directly in Section 4.2. That is, the kernel scores nearly every pair of texts as almost equally unalike, leaving the classifier little to work with, no matter how informative the fourteen numbers fed into it are. The implications for trainable quantum kernels and alternative angle-encoding schemes are discussed in Section 4.4.

3.3.4. Stylometric Insights from Direct Encoding

Compared with the PCA baseline, the hybrid pipeline (Experiment 2.2) devotes eight of its fourteen encoded dimensions to character-level PCA components and six to MI-selected stylometric features, so the original five stylometric axes (vocabulary, syntax, punctuation habits, formality, and contractions/paragraph structure) remain visible only through those six features. This input composition is a property of the encoding; it measures neither kernel mass nor the features’ influence on the trained QSVC decision boundary. In contrast, the direct stylometric encoding (Experiment 2.3) keeps all fourteen qubits aligned with named features, providing a one-to-one mapping between quantum dimensions and interpretable stylometric signals at the cost of roughly ten percentage points of accuracy below the PCA baseline.

Concretely, the pooled class-mean directions of the Experiment 2.3 model’s fourteen MI-selected features show Gemma 3 favoring richer POS mixtures (higher noun, adjective, and adverb ratios), denser punctuation and capitalization, more questions, exclamations, and contractions, and higher sentence-length variance, while Qwen 2.5 favors much longer and syntactically more complex sentences, more frequent hedging phrases, and a higher paragraph-per-sentence ratio (more segmented, document-like structure). For this direct path, the artifact exporter assigns the equal bookkeeping weight $100/14$ to every selected dimension (this records the one-feature-per-qubit mapping and is not a measured sensitivity of the trained QSVC), so the resulting profile is multi-axial by construction, drawing jointly on POS mix, sentence statistics, punctuation habits, capitalization, questions and exclamations, contractions, hedging, and paragraph structure. In light of Section 3.2.3, we read this profile as a description of the selected feature set rather than as an interpretability advantage of the quantum kernel: the same fourteen features support a classical model that is more accurate by 12.7 percentage points, so the distributed profile cannot be credited to the fidelity kernel. Because the MI selection and the pooled class-mean directions do not depend on FEATURE_MAP_REPS or QSVM_C, this profile is identical across the 12-run sweep of Appendix C by construction; the sweep therefore tests only whether the accuracy gap survives tuning, which it does.

3.4. Independent Test-Set Evaluation

The benchmark of Section 3.1, Section 3.2 and Section 3.3 evaluates 83 Stage 1 configurations, the Stage 2 pipelines, and their classical controls against the same held-out validation data, and that same data guided every model-selection decision along the way. Reusing one evaluation set this intensively carries a known risk: the best-scoring configurations may owe part of their reported accuracy to chance alignment with that particular sample rather than to genuine generalization, so the headline numbers could be optimistically biased. To measure this risk directly, we close the experimental program with a single evaluation round on an independent test set.

The protocol is strict: all seven configurations evaluated here were frozen (feature pipelines, hyperparameters, and trained models fixed) before the test corpus was generated, and no tuning of any kind (no hyperparameter search, no threshold adjustment, no re-fitting) was performed against it. The test corpus, described in Section 2.1, consists of 1000 texts generated from 500 new prompts that are disjoint from the prompt set used to build the original corpus while preserving its ten-category structure (50 prompts per category), using the same two models and the same decoding parameters. All learnable preprocessing components (TF-IDF vectorizers, scalers, PCA projections, and MI feature selectors) remain fitted exclusively on the original training split. Each frozen configuration was applied to the test corpus exactly once;

Table 12. Independent test-set results for the seven frozen configurations on the 1000-text corpus of Section 2.1. Validation accuracies are as reported in the preceding sections: the $d=8$ configuration on Experiment 1.1’s locally subsampled 400-sample validation set, and all other configurations on the standard 1160-sample set. No configuration was tuned on the test data. Ninety-five percent Wilson intervals on the 1000-text test accuracies span approximately ±1 to ±2.6 percentage points. The best value in each accuracy column is shown in bold.

Frozen Configuration	Input Representation	Training Samples	Validation Accuracy	Test Accuracy
QSVM $d=14$, $C=1$ (Experiment 2.1)	PCA, 14 components	3480	88.02%	87.30%
QSVM $d=12$, $C=1$	PCA, 12 components	3480	88.02%	88.40%
QSVM $d=8$, $C=1$ (Experiment 1.1 sweet spot)	PCA, 8 components	600	88.00%	79.80%
QSVM direct stylometric encoding (Experiment 2.3)	14 MI-selected features	3480	78.19%	76.80%
Classical LinearSVC ablation (Experiment 2.4)	14 MI-selected features	3480	90.86%	90.60%
Classical RBF SVM, $C=100$ (Experiment 2.5)	PCA, 14 components	3480	97.76%	95.60%
Global classical SVM	Full 3018-dimensional vector	3480	98.02%	97.70%

reports the outcome next to the corresponding validation figures.

The large-scale results generalize cleanly. The $d=14$ QSVM scores 87.30% against its 88.02% validation figure (a drop of 0.72 percentage points), the global classical baseline scores 97.70% against 98.02% (a drop of 0.32 points), and the $d=12$ QSVM records 88.40%, statistically indistinguishable from its validation figure. The Stage 2 pair behaves the same way (76.80% versus 78.19% for the quantum pipeline, 90.60% versus 90.86% for its classical ablation), and the out-of-sample ranking of the seven configurations is consistent with their validation ranking ($d=12$ and $d=14$ were tied at 88.02% on validation; their test-set ordering is within sampling noise). At the per-class level, the $d=14$ QSVM also reproduces the asymmetry of Table 6: precision 90.81%, recall 83.00%, and F1 86.73% for Gemma 3 against precision 84.35%, recall 91.60%, and F1 87.82% for Qwen 2.5, so Gemma texts are again misclassified as Qwen more often than the reverse. In practical terms, because every choice was locked in before the new texts existed, these numbers could not have been shaped by selection: they are the accuracies a practitioner should expect on genuinely fresh data, and they show that repeated use of the validation set did not materially inflate the large-scale results. Because each test figure is a single evaluation on 1000 texts, its 95% Wilson interval spans roughly ±1 to ±2.6 percentage points depending on the accuracy level (about ±2.1 at the headline 87.30%); the validation-to-test shifts of the large-scale configurations (at most 2.16 points) and the $d=12$ versus $d=14$ ordering lie within this sampling uncertainty, whereas the 8.30-point classical-over-quantum gap on the identical inputs lies far outside it.

The classical-over-quantum gap also survives the transfer intact. On the identical fourteen-dimensional PCA inputs, the classical RBF control of Experiment 2.5 leads the QSVM by 8.30 percentage points (95.60% versus 87.30%), and on the identical fourteen MI-selected stylometric features the margin is 13.80 points (90.60% versus 76.80%). The gap documented in Section 3.1 and Section 3.3 is therefore not an artifact of the shared validation set: it reappears, essentially unchanged, on texts that no model or hyperparameter ever saw. Put simply, the classical kernel’s advantage is a property of the models themselves, not of the particular texts we happened to score them on.

The one clear failure of transfer is the small-data operating point. The $d=8$ configuration trained on 600 samples, which matched the large-scale ceiling at 88.00% during the Stage 1 search, falls to 79.80% on the test corpus. This is the expected signature of a selection effect: the small-scale configurations were screened in large numbers on small (200- to 400-sample) validation subsets, so the best of them is an optimistic order statistic rather than a stable estimate of performance. The same configuration is also numerically fragile: in our replication runs its validation accuracy shifted from 88.00% to 85.75% under a minor NumPy version change, while the full-representation classical baseline reproduced exactly and the large-scale QSVM results proved consistent with their validation figures on the independent test set. We therefore treat the $d=8$ “sweet spot” of Section 3.1.1 as an artifact of small-sample evaluation and regard the $d=12$-to-14, 3480-sample operating point, which does transfer, as the QSVM’s real performance level on this task.

3.5. Open-Set Quantum Stylometric Fingerprinting

Rather than reporting new experiments, this subsection describes an extension of our binary results that we propose to evaluate in follow-up work. The binary attribution setting of Section 3.1, Section 3.2, Section 3.3 and Section 3.4 requires paired training data from two known models and produces a hard class label. Real-world AI-text attribution scenarios are usually more demanding: the set of candidate source models may be open-ended, only single-model corpora may be available, attribution decisions need continuous scores rather than binary labels, and human-readable explanations of the per-feature evidence are typically required. We present a one-class proximity-scoring system designed to address these constraints, subject to the calibration and validation caveats of Section 3.5.1. The framework is deliberately kernel-agnostic: the bounded-similarity reading of Equation (6) applies directly to the fidelity kernel and to any other kernel whose range and scale are checked, quantum or classical, and in light of the classical attribution control of Section 3.2.3 we make no claim that a quantum kernel is required for it to work well. We treat the framework as a structured proposal informed by our empirical findings; full empirical validation is left as future work and is discussed alongside corpus scaling in Section 4.4.

3.5.1. Quantum Kernel Proximity Scoring

Given an enrolled corpus of texts produced by a single language model M, with preprocessed feature vectors $\{x_1^M,\dots ,x_n^M\}$, and a query text with preprocessed vector q, we define the quantum proximity score as the average fidelity between the quantum state of q and the quantum states of the enrolled samples:

$${\mathrm{score}}_M\left(q\right)={\displaystyle \frac{1}{n}}{\displaystyle \sum _{i=1}^n}K\left(q,x_i^M\right),$$

(6)

where $K(x_i,x_j)={\left|\langle \phi \left(x_i\right)|\phi \left(x_j\right)\rangle \right|}^2$ is the same fidelity kernel used in Section 3.1, Section 3.2 and Section 3.3 and $\phi$ is the data-encoding feature map (in our setup, the ZZFeatureMap with linear entanglement and reps = 2). High scores indicate that q’s quantum stylometric state lies close to the enrolled fingerprint bank; low scores indicate stylistic dissimilarity. No counter-class is required, because the score is defined entirely by the model in question, and continuous score values rank candidate models by mean fidelity similarity; they are not calibrated probabilities, and turning them into a detector requires held-out known- and unknown-model data, threshold selection, and calibration.

3.5.2. Multi-Model Attribution Workflow

Generalizing to multiple candidate models is straightforward: each model $M_k$ is enrolled with a fingerprint bank $B_k$ constructed from 500 to 1000 representative samples, and a query text is scored against every bank using Equation (6). The output is a ranked attribution with per-model mean-similarity scores plus a per-feature explanation built from the pooled class-mean directions of the named features, as in Section 3.3.4. Figure 6 illustrates this enrollment-and-detection workflow.

3.5.3. Robustness Considerations

A tempting argument holds that proximity scoring would inherit a structural adversarial robustness from the QSVM’s distributed feature attribution, on the grounds that no single feature dominates the kernel value. The classical attribution control of Section 3.2.3 removes the premise of that argument: the distributed importance profile is a property of the shared feature representation rather than of the quantum kernel, and a classical model on the same inputs exhibits essentially the same profile. We therefore make no robustness claim for the framework. Whether proximity scoring, quantum or classical, withstands paraphrasing, synonym substitution, or coordinated feature perturbation is an open empirical question, to be answered together with enrollment-size sensitivity and score calibration when the framework is validated; this evaluation is discussed alongside corpus scaling in Section 4.4. There is thus no reason to expect a quantum version of this detector to be harder to fool than a classical one, and any robustness it may have must be demonstrated rather than assumed.

4. Discussion

4.1. The Role of Quantum Kernels in NLP

Two observations from our 83-configuration grid frame what the benchmark actually establishes. On the validation splits, the QSVM reaches its approximately 88% ceiling at two strikingly different operating points: at $d=8$ with only 600 training samples and at $d=12$ to $d=14$ with 3480 training samples (Section 3.1.1). The independent test set of Section 3.4 shows that these two points are not equally trustworthy. The large-scale configurations transfer within at most 2.2 percentage points of their validation figures (the headline $d=12$ and $d=14$ points within one), whereas the small-data $d=8$ point loses eight percentage points on the test corpus and also proved sensitive to a minor numerical-library upgrade (Section 3.4 and Appendix A). The robust empirical finding is therefore a stable large-scale plateau of approximately 87 to 88%, not a pair of interchangeable sweet spots. Only the configurations trained at the large 3480-sample scale earn their accuracy figures; the small model’s matching score was an artifact of the small-sample regime and does not survive contact with new data.

The decisive comparison for locating the cause of that plateau is the identical-input control of Experiment 2.5 (Section 3.3). A natural reading of the roughly ten-percentage-point gap between the QSVM and the full-representation classical baseline (Section 3.1.1) is that the aggressive input compression, rather than the quantum kernel, sets the ceiling. That identical-input comparison rules this out. A classical RBF SVM trained on the identical fourteen-dimensional inputs the QSVM receives reaches 97.76% validation accuracy against the QSVM’s 88.02%, with a linear SVM close behind (Table 11). Every element of the pipeline is shared except the kernel, so the fixed ZZFeatureMap fidelity kernel is the limiting component, and the gap persists at a similar size on the independent test set and on the named stylometric features of Stage 2 (Section 3.3.3 and Section 3.4). The upshot is that a classical kernel finds nearly all of the class signal in exactly the same fourteen numbers per text, so what the quantum model misses is lost inside the kernel, not before it.

What, then, does the quantum side of the study contribute? Not an interpretability advantage. The distributed feature-attribution profile might be read as evidence of richer stylometric insight. The classical control shows otherwise: applying the same variance-weighted reconstruction of Equation (5) to the classical model on the same inputs recovers essentially the same top features and the same fingerprint (Section 3.2.3). The profile is therefore a property of the attribution framework, not of the quantum kernel, and any adversarial-robustness argument built on it falls as well. What it does contribute is a systematic, reproducible datapoint, largely negative for the fixed fidelity kernel, on a practical NLP task, with a measured failure mechanism (Section 4.2) and an independent test set confirming that the headline numbers generalize. This is precisely the kind of carefully controlled evidence that the QML benchmarking literature has called for [25], and it carries a transferable methodological lesson: an apparent quantum advantage on a secondary metric such as interpretability should be tested against a classical model given exactly the same inputs and the same analysis pipeline before it is claimed.

Computationally, exact statevector simulation becomes expensive at the top of the dimension ladder: the largest run ($d=16$ at full data) takes nearly 18 h on a 64-core CPU node, the practical limit of CPU-based exact simulation in our setting (per-run costs are tabulated in Appendix A). On this task, however, the cost buys no accuracy advantage: the classical RBF baseline on the identical fourteen-dimensional inputs trains in seconds on the same hardware and scores nearly ten percentage points higher. Stated plainly, the quantum kernel is currently both far slower and less accurate than the classical method it would need to displace.

4.2. Concentration and the Data Bottleneck

Why does the fixed fidelity kernel stop near 88%? Not because of the PCA compression. Section 3.3.3 shows that the fourteen retained components, despite carrying only 6.88% of the representation’s variance, support near-full classical accuracy, so the variance that PCA discards is overwhelmingly class-irrelevant. In other words, the fourteen numbers that each text is reduced to still contain almost everything needed to tell the two models apart, and the bottleneck must lie in how the quantum kernel uses them.

The measured cause of the plateau is exponential concentration of the fidelity kernel. The mean and variance of the off-diagonal entries of the full 3480 × 3480 training kernel matrices, computed by exact statevector simulation for the ZZFeatureMap at four qubit counts (the input dimension d equals the number of qubits) alongside the classical RBF kernel on the identical $d=14$ inputs, are tabulated in Appendix B (

Table A10. Measured concentration of the training kernels: mean and variance of the off-diagonal entries of the 3480 × 3480 kernel matrices (ZZFeatureMap, reps = 2, exact statevector simulation; classical RBF computed on the identical $d=14$ inputs).

Kernel	Off-Diagonal Mean	Off-Diagonal Variance
Quantum ZZ, $d=8$	$1.268\times {10}^{-2}$	$6.92\times {10}^{-4}$
Quantum ZZ, $d=12$	$1.545\times {10}^{-3}$	$4.12\times {10}^{-5}$
Quantum ZZ, $d=14$	$5.19\times {10}^{-4}$	$1.02\times {10}^{-5}$
Quantum ZZ, $d=16$	$2.35\times {10}^{-4}$	$4.60\times {10}^{-6}$
Classical RBF, $d=14$	0.2145	$3.03\times {10}^{-2}$

). The quantum off-diagonal mean decays roughly exponentially, shrinking by a factor of two to three with every two additional qubits across the $d=8$ to $d=16$ ladder. At the working dimension $d=14$ it is approximately 413 times smaller than the RBF value on the same inputs, with a correspondingly collapsed variance. The consequence is that the quantum kernel judges almost every pair of texts to be nearly equally dissimilar, which leaves the SVC very little to work with.

Figure 7 shows the geometric consequence: two-dimensional kernel-PCA embeddings computed from the same two $d=14$ kernel matrices. Under the quantum ZZ kernel, the bulk of the training set collapses into an “L”-shaped mass at the origin with two sparse orthogonal tails, and Gemma 3 and Qwen 2.5 samples are thoroughly mixed inside the collapsed mass, the signature of near-orthogonal encoded states with little pairwise similarity structure. Under the classical RBF kernel on the identical inputs, the embedding spreads into several well-separated clusters; the two classes still mix within clusters, because the fourteen components do not linearly separate the generators, but the similarity geometry is far richer. The quantum feature map therefore produces a poorer, not a richer, similarity geometry than its classical counterpart on the same data.

The concentration measurements also explain the samples-per-qubit regularities of Section 3.1.2. Each dimension’s empirical optimum (Table 4) traces how much data are needed to partially resolve an increasingly concentrated kernel: additional training pairs supply more of the rare informative off-diagonal entries, which is why the optimum shifts rightward as qubit count grows. More data mitigate concentration but cannot overcome an off-diagonal signal that shrinks exponentially with qubit count. The clearest signature is the $d=16$ run in which extending the training set from 3480 to the full 4640 samples reduces accuracy by 4.56 percentage points (Section 3.1.2). Once almost all kernel entries look alike, extra training pairs add no new contrast, and the decision boundary degrades rather than improves.

The feature-map and depth ablations point in the same direction. Every variant that deepens the circuit or enriches its entanglement loses accuracy, from a penalty of up to 9.25 percentage points for a single extra repetition to a fall to 65 to 66% for the fully connected $[Z,ZX,XX]$ structure (Section 3.1.3). Deeper and more entangled circuits flatten the kernel faster instead of enriching it, consistent with Table A10: every mechanism that pushes encoded states further apart in Hilbert space accelerates the collapse of pairwise similarity.

These measurements define the mitigation agenda taken up in Section 4.4: concentration-aware kernel designs that keep encoded states from becoming nearly orthogonal as qubit count grows. We regard the concentration statistics of Table A10 as the baseline against which any such design should be evaluated on this task, and we suggest that future QML-NLP studies report off-diagonal kernel statistics alongside their accuracy figures, in addition to training-samples-per-qubit ratios, since these numbers diagnose the failure mode directly.

4.3. Limitations

The scope of the present study comes with several limitations that should be borne in mind when interpreting the results. The attribution task is binary, restricted to Gemma 3 versus Qwen 2.5; generalization to other open-source or proprietary models will require both additional training data and a multi-class or open-set evaluation protocol, and the proximity-scoring framework introduced in Section 3.5 is proposed as a route in that direction but has not yet been validated empirically. The corpus size of 5800 samples bounds the qubit counts we can probe within their optimal data-to-qubit range, and reaching the optimum for d larger than 16 would require a substantially larger corpus. The corpus is also generated from a single fixed prompt set in English, so the recovered fingerprints may carry residual topic, language, or prompt-format dependence; topic-disjoint (held-out-topic) evaluations, independently sourced prompt sets, and multilingual corpora are needed before the fingerprints can be claimed as fully model-specific; the existing splits and the test corpus are prompt-disjoint but share one authored prompt style.

All experiments use exact, noiseless statevector simulation. This is a methodological choice that buys us kernel values that are deterministic and reproducible on a fixed software stack and lets us attribute accuracy differences cleanly to the quantum kernel and the feature representation; the corresponding limitation is that the impact of decoherence and shot noise on the fidelity kernel at $d=8$ or above is not characterized here, although the existing literature on quantum kernel concentration suggests that hardware noise generally reinforces the trends we observe rather than reversing them [17].

A further limitation is that the exploratory small-sample configurations have no independent replication: a NumPy version change alone shifted the $d=8$, 600-sample run by more than two percentage points while leaving the classical baseline untouched, and the same configuration lost about eight points on the independent test set (Section 3.4 and Appendix A). The strong small-data results are numerically fragile, so only the large-scale configurations should be treated as validated operating points.

We make no adversarial-robustness claim and no quantum-specific interpretability claim: as Section 3.2.3 establishes, the distributed attribution profile belongs to the shared feature representation, so neither property can be credited to the quantum kernel, and an empirical robustness evaluation against paraphrase, synonym-substitution, and feature-perturbation attacks remains future work for quantum and classical detectors alike (Section 3.5.3).

The attribution profiles have not been validated in user studies or compared head-to-head with established explainability methods such as Local Interpretable Model-Agnostic Explanations (LIME) or Shapley Additive Explanations (SHAP). The benchmark also does not include head-to-head comparisons with prominent AI-text detection systems (e.g., the commercial detector GPTZero, the zero-shot method DetectGPT [2], and watermark-based approaches), comparisons that Section 1 motivates but that lie outside the scope of this work. The baseline TF-IDF and linguistic features capture lexical, syntactic, and stylistic signals but omit deeper behavioral probes such as token-level perplexity, response-format patterns, and discourse-level coherence, which we partially address in the Stage 2 feature-engineering experiments but leave as a fuller direction for future work.

4.4. Future Directions

Several complementary research directions follow from these findings. The first is corpus scaling. Generating a substantially larger AI-text corpus (ideally at least an order of magnitude beyond our 5800 samples and balanced across more diverse topics, prompts, and decoding parameters) would support more demanding evaluation protocols, including topic-disjoint holdouts and independently sourced prompt sets, and so test more rigorously whether the recovered stylometric profiles are model-specific rather than topic-specific. The concentration measurements of Section 4.2 temper the expectation that data alone can lift the quantum ceiling, however: the off-diagonal kernel signal shrinks rapidly with qubit count, so scaling the corpus toward $d=18$ or $d=20$ without changing the encoding would push the kernel deeper into its concentrated regime. Corpus scaling is therefore a prerequisite for stronger evaluation and a complement to, not a substitute for, the concentration mitigations discussed below.

A second direction is a shift from binary classification to open-set, single-model fingerprinting. Single-model enrollment removes the need for paired counter-class data and naturally extends to open-set detection, where the system is asked whether a query text is plausibly from a known model rather than which of two models produced it (Section 3.5). The problem is worth solving regardless of which kernel computes the score, and our results give no reason to expect that a quantum kernel is the better choice; whether it adds value must be answered with the same identical-input controls introduced here. Empirical validation of the framework is the natural next step.

A third direction is a shift from the fixed ZZFeatureMap kernel to trainable quantum kernels and learned angle-encoding schemes. Because the classical lead on identical named-feature inputs is stable under the regularization-and-depth sweep of Appendix C, the limitation lies in the inductive bias of the fixed kernel rather than in the choice of C or in the number of repetitions (Section 3.3.3). The first-line mitigation is bandwidth tuning of the encoding: a single hyperparameter that rescales the input angles (equivalently, shrinking the encoding interval below $[0,2\pi ]$) directly targets the exponential concentration measured in Section 4.2, because smaller encoding angles preserve overlap between encoded states and restore contrast to the off-diagonal kernel entries. Beyond bandwidth tuning, trainable feature maps, projected quantum kernels, and supervised reductions tailored to the named-feature substrate are the most promising avenues for closing this gap.

A fourth direction is hardware experimentation. The largest configurations we report already sit at the practical ceiling of CPU-based exact statevector simulation (Section 4.1); moving to graphics processing unit (GPU) tensor-network simulators or to shot-based kernel estimation on actual quantum devices would lift this ceiling and show how the observed trends interact with hardware noise.

Finally, an empirical robustness study, including paraphrase, synonym-substitution, back-translation, and feature-perturbation attacks against both QSVM and classical baselines, remains necessary; any robustness properties of either kernel must be established directly (Section 3.5.3).

5. Conclusions

We have presented, to our knowledge, the first systematic benchmark of QSVMs for LLM attribution, posed as the binary discrimination of Gemma 3 from Qwen 2.5 texts. The benchmark spans 83 configurations of qubit count, regularization, training-set size, feature-map family, and circuit depth, all evaluated by exact statevector simulation, with the headline configurations then validated on an independent 1000-text test set generated after every design decision was frozen. Two numbers summarize the outcome. The best QSVM configuration reaches 88.02% accuracy, and a classical SVM reaches about 98%, whether it is given the full 3018-dimensional representation or only the fourteen numbers the quantum circuit itself encodes. That identical-input control is the decisive experiment of the study: when both kernels see exactly the same inputs, the classical kernel leads by roughly ten percentage points, so the shortfall lies in the quantum kernel itself rather than in the input representation, and the independent test set confirms that both the accuracies and the gap generalize.

Returning to the RQs of Section 2.3, we can answer each in turn. RQ1: the QSVM’s practical ceiling on this corpus is approximately 88%, reached at twelve to fourteen qubits with 3480 training samples; it transfers cleanly to the independent test set, whereas the small-sample configuration that matched it on validation does not. RQ2: the failure mode as dimension grows is exponential kernel concentration, measured directly on the trained kernel matrices; at fourteen qubits the off-diagonal similarity is roughly 400 times weaker than its classical counterpart on identical inputs (Table A10). The optimal data density rises from roughly 75 samples per qubit at eight qubits to 220 to 250 at fourteen to sixteen, and more data delay the effect but cannot overcome it; neither deeper circuits nor richer Pauli feature maps mitigate the concentration, and once nearly all kernel entries look alike, no classifier can separate what the similarity measure no longer distinguishes. RQ3: the stylometric fingerprint recovered by the variance-weighted reconstruction is real and interpretable, but the classical model trained on the same inputs shows that it belongs to the shared feature pipeline rather than to the quantum kernel. RQ4: no enriched feature representation closed the gap, because the bottleneck is the kernel, not the features; the direct encoding delivers the cleanest one-qubit-per-feature mapping, but the interpretability it buys belongs to the feature set and is equally available to a classical model on the same inputs.

Three directions follow from these results. The first is concentration mitigation, with bandwidth tuning of the encoding as the natural first step and trainable feature maps and projected kernels beyond it; progress can be verified directly against the off-diagonal kernel statistics reported here. The second is corpus scaling under stronger controls (topic-disjoint holdouts, independently sourced prompts, additional models, and varied decoding regimes), which strengthens the benchmark regardless of which kernel eventually profits from it. The third is the open-set proximity-scoring framework of Section 3.5, which we advance as an explicitly kernel-agnostic proposal addressing a real gap in current attribution practice.

Negative results are useful when they are precise enough to build on: an unmeasured failure invites repetition, while a measured one, with its data, controls, and kernel statistics public, becomes the starting line for the next kernel design. The central conclusion of this benchmark is that fidelity quantum kernels, as configured here, offer neither an accuracy nor an interpretability advantage for LLM attribution; this study establishes that with controls on identical inputs, measures exactly why, and releases everything needed to overturn it.