QuantumShield AI: an AI-Powered Post-Quantum Cryptography Recommendation Platform

Public-key cryptography underpins nearly every secure digital interaction, and nearly all of it rests on two mathematical problems integer factorization and the discrete logarithm that Shor's algorithm solves in polynomial time on a cryptographically relevant quantum computer. The economics of the threat are already present: an adversary can record encrypted traffic today and decrypt it once suitable hardware exists, so long-lived secrets in banking, healthcare, and government carry present-day risk. This is the harvest-now-decrypt-later problem, and it is the reason cryptographic migration cannot wait for quantum hardware to arrive.

The National Institute of Standards and Technology answered the cryptographic half of this problem in August 2024, finalizing ML-KEM for key encapsulation and ML-DSA and SLH-DSA for digital signatures, with FN-DSA following as draft FIPS 206. Standardization, however, created a second problem it did not solve: selection. The finalized algorithms differ sharply in security assumptions, key and signature sizes, and computational cost, and the empirical literature confirms that no single algorithm dominates across all criteria. The same studies conclude, in effect, that the right choice depends on the needs of a particular case, yet they provide no mechanism for making that determination.

A bank optimizing for transaction latency, a hospital bound by decade-long data-retention mandates, and a defense agency requiring maximum-strength parameters face the same four-algorithm menu but should not reach the same answer. Today they reach any answer only through manual expert interpretation of benchmark tables a process that is slow, inconsistent across organizations, and unauditable. This paper closes that gap.

The novelty of this work is that it is, to our knowledge, the first system to operationalize PQC algorithm selection: where the benchmarking literature quantifies trade-offs and the deployment literature fixes a single algorithm by fiat, we convert sector requirements into an auditable, per-context recommendation over the complete finalized NIST portfolio, and deliver that capability as a running platform rather than a paper design. Concretely, the contributions are: (1) a formal MCDM model that converts sector requirements into weighted criteria over the four NIST algorithms; (2) a QUBO encoding of the selection problem, solved by QAOA and cross-validated against an exact solver, giving a solver architecture that is correct at native scale and forward-compatible with NP-hard enterprise-portfolio selection; (3) six calibrated industry profiles spanning banking, healthcare, IoT/edge, government, e-commerce, and defense; and (4) a fully engineered, security-hardened three-tier platform that delivers auditable recommendations. We are explicit about scope: at four algorithms the search space is exhaustively verifiable, so QAOA's approximation ratio of 1.0 certifies pipeline correctness rather than a performance advantage, and FN-DSA is labeled draft in every output. This scoping bounds the quantum claim; it does not bound the contribution, which is the selection methodology and its realization.

BACKGROUND

The quantum threat to classical asymmetric cryptography is asymmetric in its own way: Shor's algorithm collapses the hardness of both factorization (RSA) and discrete logarithms (ECC, Diffie–Hellman) to polynomial time, while Grover's algorithm merely halves the effective key length of symmetric ciphers, which AES-256 absorbs comfortably. The practical consequence is that key establishment and digital signatures the asymmetric primitives are where migration is urgent, and both halves of the NIST portfolio target exactly these functions.

The migration challenge is not throughput but decision-making. An organization must choose, for each function it secures, among standardized algorithms whose trade-offs pull in different directions: lattice-based key encapsulation (ML-KEM) offers compact keys and fast operations; lattice-based signatures (ML-DSA) balance size and speed; hash-based signatures (SLH-DSA) rest on the most conservative security assumptions but produce large signatures; and FN-DSA, still in draft, offers compact signatures at the cost of implementation complexity and non-final status. No published framework converts these documented trade-offs into a per-context recommendation. That absence, rather than any deficiency in the algorithms themselves, motivates the present work.

3. LITERATURE REVIEW

3.1. Performance characterization of PQC

The most mature strand of the literature benchmarks PQC algorithms empirically. OpiÅ‚ka et al. [1] implemented seventeen signature variants Dilithium (levels 2/3/5), Falcon (512/1024), and twelve SPHINCS+ configurations through the liboqs library on a controlled virtual machine, measuring key generation, signing, and verification across 10 MB–1 GB files over 100 iterations with standard-error reporting. They found that Dilithium5 signs a 1 GB file with roughly 27.7% overhead relative to RSA-2048 while providing NIST security level 5, and concluded that algorithm choice depends on the use case. This study is the empirical foundation on which the present work builds, and its explicit absence of any selection mechanism is our point of departure.

3.2. Deployment-oriented PQC integration

A second strand embeds a chosen PQC algorithm into an application. Nasir et al. [2] integrated ML-KEM (Kyber768) into a real-time sealed-bid property-auction platform, reporting complete tamper detection across adversarial trials and sub-millisecond per-bid encryption; notably, the algorithm is fixed a priori and ML-DSA integration is deferred to future work. Survey treatments such as Nwaga and Idima [3] map the PQC family taxonomy onto blockchain and cloud infrastructures and articulate the harvest-now-decrypt-later risk, but predate FIPS finalization and likewise provide no decision framework. Across benchmarking, deployment, and survey work the pattern repeats: rich evidence about algorithms, no mechanism for choosing among them.

3.3. Decision methods and quantum optimization

MCDM techniques weighted-sum models, AHP, and TOPSIS are established tools for technology selection under conflicting criteria. QUBO is the canonical encoding for binary selection problems targeted by quantum and quantum-inspired solvers, and QAOA [4] is the leading near-term variational algorithm for such encodings, with Lucas [5] cataloguing Ising formulations of many NP-hard problems. To our knowledge, no prior work composes these into a decision-support system for NIST PQC selection, nor delivers such a system as a deployable multi-tier platform.

4. RESEARCH GAP AND POSITIONING

Synthesizing the review, five gaps emerge: benchmark studies quantify trade-offs but do not decide; deployment studies decide by fiat, without justifying the choice against alternatives or contexts; no study spans the complete finalized NIST portfolio including draft FN-DSA under its FIPS identity; no study connects sector-specific regulatory reality to algorithm choice; and no study examines whether quantum optimization itself can serve the migration-planning problem. Table 1 positions QuantumShield AI against the two most closely related works.

Table 1: Positioning against the closest related work.

5. PROPOSED METHODOLOGY

QuantumShield AI assigns each stage of the decision to the paradigm that handles it most directly: a classical MCDM model reduces sector requirements to per-algorithm scores; a QUBO encoding casts selection as binary optimization; and a QAOA solver, validated by exhaustive search, produces the recommendation. The full pipeline is shown in Fig. 2, and each stage is specified below at implementation-audit level of detail.

5.1. MCDM formulation

Let A = {a₁, aâ‚‚, a₃, aâ‚„} = {ML-KEM, ML-DSA, FN-DSA, SLH-DSA} be the candidate set, evaluated over four decision criteria C = {security, speed, size, longevity}. Security is the NIST security level of the parameter set (benefit); speed is the algorithm’s operations per second (benefit); size is the combined public-key and artifact ciphertext or signature byte count (a cost criterion, so smaller is better); and longevity rates conservative, long-horizon durability of the underlying assumption (benefit), on which hash-based SLH-DSA scores highest. Each raw criterion value vâ±¼(a) is min–max normalized to [0, 1] across the candidate set: benefit criteria as nâ±¼(a) = (vâ±¼(a) − minâ±¼)/(maxâ±¼ − minâ±¼) and cost criteria as nâ±¼(a) = (maxâ±¼ − vâ±¼(a))/(maxâ±¼ − minâ±¼), with nâ±¼(a) = 1 where maxâ±¼ = minâ±¼. Each industry profile p defines a weight vector w (p) = (w_security, w_speed, w_size, w_longevity) with Σâ±¼ wâ±¼(p) = 1 (validated server-side to within a 0.02 tolerance). The composite score of algorithm a under profile p is

Sâ‚š(a) = Σâ±¼ wâ±¼(p) · nâ±¼(a), j ∈ {security, speed, size, longevity}, (1)

where nâ±¼(a) is the normalized value of criterion j for algorithm a. This weighted-sum model yields a per-profile ranking with complete traceability from weights to recommendation, and because every criterion is normalized against the same candidate set scores are directly comparable across algorithms within a profile.

5.2. QUBO encoding

The recommendation is a single-best selection: binary variables x ∈ {0, 1}⁴ with xáµ¢ = 1 iff algorithm aáµ¢ is recommended, subject to a one-hot constraint enforcing exactly one selection. The objective maximizes the total MCDM score, expressed as a minimization with a quadratic penalty:

H (x) = −Σáµ¢ Sâ‚š(aáµ¢)·xáµ¢ + λ·(Σáµ¢ xáµ¢ − 1)², (2)

where the penalty coefficient is set adaptively to dominate the largest achievable objective gain, λ = max (1, 2·Σáµ¢ |Sâ‚š(aáµ¢)|). This construction guarantees that any solution violating the one-hot constraint incurs a penalty larger than any score benefit, so the constrained optimum coincides with the unconstrained ground state of H. Expanding the penalty yields the quadratic form H (x) = Σáµ¢ Qᵢᵢ xáµ¢ + Σáµ¢<â±¼ Qᵢⱼ xáµ¢xâ±¼ with Qᵢᵢ = −Sâ‚š(aáµ¢) − λ and Qᵢⱼ = 2λ, i.e., the QUBO matrix Q of Fig. 5. The problem is expressed as a QuadraticProgram with an explicit equality constraint (Σáµ¢ xáµ¢ = 1) and solved through Qiskit's MinimumEigenOptimizer.

5.3. QAOA solution and exact ground truth

The QUBO Hamiltonian is solved by QAOA with p = 3 repetition layers, using a COBYLA classical optimizer (maximum 150 iterations) and the Qiskit Aer sampler primitive. QAOA prepares the variational state

|ψ(β,γ)⟩ = ∏ₗ₌₁..₃ exp (−iβâ‚— Hₘ) exp (−iγâ‚— Há´„) |+⟩⊗⁴ (3)

with mixer Hₘ = Σáµ¢ Xáµ¢; COBYLA tunes the six variational parameters (β, γ) to minimize the expected energy, and the optimized state yields the recommended index. For a four-algorithm instance the constrained optimum is directly computable as the highest-scoring feasible selection, and this exact argmax serves as ground truth. The approximation ratio is reported as

r = Sâ‚š(a_chosen) / Sâ‚š(a_exact), (4)

measuring whether QAOA recovered the ground-truth optimum. The service is designed to degrade gracefully: if the quantum backend is unavailable or a QAOA run fails, it falls back to the exact solver and reports the solver path explicitly. In the experiments reported here, QAOA executed successfully and returned the ground-truth optimum on every profile (Section 8). We emphasize that r = 1.0 at this scale is a correctness result QAOA recovering an optimum that is independently and trivially computable and not evidence of quantum advantage. The value of the formulation is that it provides a validated pipeline and the exact-solver reference that any future scaling to NP-hard portfolio instances, where ground truth is no longer computable by enumeration, will require.

6. SYSTEM ARCHITECTURE

Figure 1: Three-tier architecture of QuantumShield AI, comprising the React presentation tier, the Spring Boot application tier, and the Python/Qiskit quantum microservice over PostgreSQL.

The platform comprises three services. The presentation tier is a React/TypeScript single-page application (Vite, port 5173) providing profile selection, custom weighting, results visualization, and administrative screens. The application tier is a Java 21 Spring Boot service (port 8080) implementing business logic, PostgreSQL 16 persistence, and security: stateless JWT authentication with a 30-minute token lifetime and role-based access control across Admin, Analyst, and Viewer roles, with self-registration restricted to the non-administrative roles. The quantum tier is a Python 3.12 FastAPI microservice (port 8000, entrypoint app.main:app) exposing the MCDM scorer, QUBO builder, QAOA solver, and exact validator over REST, executing on the Qiskit Aer statevector simulator. Python is pinned to 3.12 for Qiskit/NumPy wheel compatibility.

Figure 2: End-to-end recommendation workflow, from authenticated intake through MCDM scoring, QUBO construction, QAOA execution, and exact validation to a persisted, ranked recommendation.

A request flows from authentication and profile intake, through MCDM scoring and QUBO construction, into QAOA execution and exact validation, and finally to a persisted, ranked recommendation carrying the FN-DSA draft-status disclaimer. Isolating the quantum solver behind a REST boundary lets the decision engine evolve for instance toward hardware backends without disturbing the security or presentation tiers.

7. EXPERIMENTAL SETUP

The decision engine is exercised on the four finalized or near-finalized NIST algorithms, parameterized as in Table 2. Security level and the public-key and artifact (ciphertext or signature) byte sizes are taken directly from the standardized parameter sets (ML-KEM-768, ML-DSA-65, SLH-DSA-128f, and draft FN-DSA-512). The operations-per-second and long-term-validity figures are relative engineering proxies, included to exercise the speed and longevity criteria and flagged in the system for replacement with measured liboqs benchmarks; the numeric scores in Section 8 should therefore be read as demonstrating the mechanism rather than as certified performance measurements.

Table 2: NIST algorithm parameters used as decision-matrix inputs. Starred columns are relative engineering proxies pending measured benchmarks; all other values are from the standardized parameter sets.

The six industry profiles of Table 3 constitute the experimental conditions: each supplies a weight vector over the four criteria (validated server-side to sum to 1.0 within a 0.02 tolerance) and is executed through the full MCDM → QUBO → QAOA pipeline. The quantum solver is configured with QAOA depth p = 3, a COBYLA optimizer capped at 150 iterations, and the Qiskit Aer sampler primitive (qiskit 1.2.4, qiskit-aer 0.15.1); the exact argmax over the feasible set is computed as ground truth, and the service falls back to the exact solver automatically on any quantum-backend failure. All results in Section 8 are produced by this pipeline on the data of Tables 2 and 3.

Table 3: Industry profiles and their criterion weight vectors (security / speed / size / longevity), with the algorithm selected by the deployed engine.

RESULTS AND DISCUSSION

8.1. Per-profile MCDM scores

Figure 3: Composite MCDM scores Sâ‚š(a) of the four NIST algorithms under the six industry profiles, computed by the deployed engine on the inputs of Tables 2 and 3.

Fig. 3 reports the composite scores Sâ‚š(a) produced by the deployed engine for all four algorithms under the six profiles. The weight vectors reshape the ranking as intended. In the profiles that emphasize security and speed banking, e-commerce, and IoT/edge ML-KEM leads by a wide margin (0.843, 0.916, and 0.944 respectively), reflecting its high throughput and compact key-and-ciphertext footprint. In the two profiles that place 0.75 weight on long-horizon durability government archive and defense the ranking inverts and hash-based SLH-DSA wins (0.750 in both), consistent with its conservative security assumption. Healthcare is the closest and most interesting contest: under the weighted-sum model ML-KEM leads (0.658) ahead of ML-DSA (0.583) and SLH-DSA (0.450). FN-DSA is last or near-last in every profile, penalized by its draft status’ low longevity rating and its lower security level despite the smallest signatures. The leading algorithm therefore changes with context precisely the dependence the prior literature identified but did not operationalize.

8.2. Method robustness: weighted-sum versus TOPSIS and weight sensitivity

To test whether a recommendation is an artifact of the weighted-sum model (WSM), we re-ran all six profiles through TOPSIS on the same normalized decision matrix and weights. The two methods agree on the top choice in five of the six profiles (Table 4). The single divergence is healthcare: WSM ranks ML-KEM first, whereas TOPSIS which rewards proximity to the per-criterion ideal and distance from the anti-ideal elevates SLH-DSA on the strength of its maximal longevity and conservative security posture. This is a genuine property of the healthcare weighting rather than a defect: the two algorithms encode different risk postures, and the disagreement usefully flags healthcare as the profile most warranting expert review. We further probed stability by perturbing each weight by ±0.10 and renormalizing, giving eight perturbations per profile; no perturbation changed the top recommendation in any profile, indicating the selections are robust to modest weight mis-specification.

Table 4: Top recommendation under the weighted-sum model versus TOPSIS, on identical weights and normalized inputs.

8.3. Quantum solver versus exact baseline

Figure 4: Median solve time per profile, QAOA (Aer statevector, p = 3) versus exact enumeration of the 2⁴ feasible states, on a log scale. Both solvers return the identical selection (approximation ratio = 1.0).

Table 5 and Fig. 4 report the quantum solver against the exact baseline. On every profile QAOA (Aer statevector, p = 3, COBYLA at 150 iterations) returned exactly the ground-truth optimum — an approximation ratio of 1.0. The cost of that agreement is decisive: QAOA required a median of about 315 ms per instance, while exhaustive enumeration of the 2⁴ = 16 feasible states returned the same answer in roughly 6.5 µs, a factor of approximately 49,000 in favor of the classical baseline. We present this as the paper’s most direct honesty check: at four algorithms the quantum route is not merely without advantage, it is about 5×10⁴ times slower for an identical result. QAOA’s role at this scale is solely to demonstrate that the MCDM → QUBO → QAOA pipeline is wired correctly against a certifiable ground truth; its practical relevance is deferred to the portfolio regime of Section 8.5.

Table 5: Per-profile approximation ratio and median solve time, QAOA versus exact enumeration (steady state, Qiskit Aer statevector; warm-up runs discarded).

8.4. QUBO structure

Figure 5: QUBO matrix Q for the banking profile, built with the adaptive penalty λ = max (1, 2·Σ|Sâ‚š(aáµ¢)|) = 3.83. The most negative diagonal entry marks the selected algorithm.

Fig. 5 shows the QUBO matrix Q for the banking profile, built with the adaptive penalty λ = max (1, 2·Σ|Sâ‚š(aáµ¢)|) = 3.83. Diagonal entries Qᵢᵢ = −Sâ‚š(aáµ¢) − λ carry the negated scores offset by the penalty, so the most negative diagonal (ML-KEM, −4.67) marks the profile winner; the uniform off-diagonals Qᵢⱼ = 2λ = 7.65 penalize selecting more than one algorithm. Because λ dominates the score spread, the feasible optimum is trivially certifiable at this size which is exactly why the interesting regime is the larger portfolio problem, where Q grows quadratically in the number of system-to-algorithm assignments and exhaustive certification fails.

8.5. Discussion and threats to validity

The central result must be read precisely: an approximation ratio of 1.0 across all six profiles is agreement between QAOA and exhaustive search over sixteen states a correctness certificate, not quantum advantage, which cannot exist at this size and, as Section 8.3 quantifies, comes at roughly a 49,000× time penalty. Quantum relevance is prospective: when the decision expands to enterprise portfolios (many systems × many algorithms × interoperability, budget, and migration-order constraints), the selection problem becomes NP-hard and QAOA-class heuristics become a plausible tool. Three limitations bound the present findings. First, execution uses a statevector simulator rather than quantum hardware, so NISQ noise behavior is untested. Second, and most important for reproducibility, the speed and longevity criteria are relative engineering proxies rather than measured quantities; security level and byte sizes come from the standardized parameter sets, but the operations-per-second and long-term-validity figures must be replaced with measured liboqs benchmarks before the numeric scores are treated as anything beyond a demonstration of the mechanism. Third, the profile weights are expert-calibrated rather than empirically derived, so each recommendation inherits that calibration which is why the TOPSIS cross-check and the weight-sensitivity analysis of Section 8.2 are reported alongside the headline recommendations.

CONCLUSION

QuantumShield AI establishes a clear contribution: to our knowledge it is the first system to turn PQC algorithm selection from manual expert judgment into an auditable, reproducible computation over the complete finalized NIST portfolio. Where prior work concluded only that algorithm choice depends on the needs of a particular case, QuantumShield AI supplies the mechanism by which that dependence is computed, and delivers it as a security-hardened, three-tier platform rather than a paper design. The QUBO–QAOA formulation is validated end to end against an exact solver, yielding a solver architecture that is correct at native scale and forward-compatible with the NP-hard enterprise-portfolio regime in which quantum-class heuristics become relevant. We are precise about scope: what this paper establishes is methodological and architectural novelty, not demonstrated quantum advantage, and we claim only the former. Future work extends the framework to enterprise-portfolio selection, where ground truth can no longer be obtained by enumeration and the choice of solver begins to carry real weight.

DECLARATION OF COMPETING INTEREST

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

ACKNOWLEDGEMENTS

The authors thank the Department of Computer Science and Engineering, Adikavi Nannaya University College of Engineering, Rajamahendravaram, for the computational facilities and academic support that made this work possible.

REFERENCES

1. Opiłka F, Niemiec M, Gagliardi M, Kourtis MA. Performance analysis of post-quantum cryptography algorithms for digital signature. Appl Sci 2024;14 (12):4994. https://doi.org/10.3390/app14124994.
2. Nasir E, et al. QTrustBid: post-quantum cryptography and AI-driven recommendations for real-time property auction platform. Spectr Eng Sci 2026;4 (5):2077–93.
3. Nwaga P, Idima S. Post-quantum cryptographic algorithms for secure communication in decentralized blockchain and cloud infrastructure. Int J Comput Appl Technol Res 2022;11 (4):155–70.
4. Farhi E, Goldstone J, Gutmann S. A quantum approximate optimization algorithm. arXiv preprint arXiv:1411.4028; 2014.
5. Lucas A. Ising formulations of many NP problems. Front Phys 2014;2:5. https://doi.org/10.3389/fphy.2014.00005.
6. National Institute of Standards and Technology. Module-lattice-based key-encapsulation mechanism standard. FIPS 203. Washington (DC): U.S. Department of Commerce; 2024. https://doi.org/10.6028/NIST.FIPS.203.
7. National Institute of Standards and Technology. Module-lattice-based digital signature standard. FIPS 204. Washington (DC): U.S. Department of Commerce; 2024. https://doi.org/10.6028/NIST.FIPS.204.
8. National Institute of Standards and Technology. Stateless hash-based digital signature standard. FIPS 205. Washington (DC): U.S. Department of Commerce; 2024. https://doi.org/10.6028/NIST.FIPS.205.
9. Shor PW. Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM J Comput 1997;26 (5):1484–509.
10. Preskill J. Quantum computing in the NISQ era and beyond. Quantum 2018;2:79.
11. Qiskit Contributors. Qiskit: an open-source framework for quantum computing [software]; 2024. https://www.qiskit.org (accessed 31 July 2026).
12. Triantaphyllou E. Multi-criteria decision making methods: a comparative study. Boston (MA): Springer; 2000.