India is building two futures at once, and it rarely stops to ask whether they were designed to protect each other.
On one side: the IndiaAI Mission, sanctioned at INR 10,371.92 crore (USD 1.25 billion) by the Union Cabinet in March 2024, has deployed roughly 34,000–38,000 GPUs across the country, with a stated target of 100,000 by the end of 2026. It has backed 20 sovereign AI model proposals — 12 large language models and 8 small language models — and organizations like Sarvam AI have already open-sourced models trained on Indian compute for Indian languages. This is a genuine, funded, fast-moving national bet on India becoming a serious AI power.
On the other side: the National Quantum Mission, approved with an outlay of INR 6,003.65 crore running through 2030-31, has already demonstrated a 1,000-kilometre quantum key distribution network — one of the longest such deployments in the world — with a national roadmap explicitly built around the recognition that quantum computers may soon be capable of breaking the cryptography protecting India's banking systems, government networks, and critical infrastructure today.
Both programs are real, funded, and moving faster than most global observers expected. What's missing from most boardroom conversations is the point where these two frontiers actually intersect — and for organizations building or deploying AI on Indian data, that intersection point runs directly through model extraction and distillation risk.
Two Threats That Don't Look Related, Until They Are
Model extraction attacks — the practice of systematically querying a deployed AI model until an attacker can clone its functional behaviour or, in worse cases, coax it into revealing traces of the data it was trained on — are a documented, evidenced risk with no dependency on quantum computing whatsoever. Every attack described in security research to date has succeeded using entirely classical techniques: crafted queries, harvested outputs, and conventional machine learning to train a surrogate model.
Quantum computing's relevance here isn't that it creates a new way to run this attack today. It's that it changes the stakes and the timeline around the data these attacks touch — and it does so through a mechanism that is already active, not theoretical.
Harvest Now, Decrypt Later — A Threat Already Underway, Not a Future One
The single most important fact in this entire discussion is one that cybersecurity agencies worldwide, including NIST, have been explicit about: "harvest now, decrypt later" is not a future risk. It is a present, ongoing, and largely undetectable one.
The mechanism is simple and well documented. Adversaries intercept and store encrypted data today — including encrypted API traffic — without any current ability to decrypt it. They do this because they expect that once cryptographically relevant quantum computers exist, the classical encryption (RSA, elliptic curve cryptography) protecting that traffic today will become breakable, and everything harvested in the meantime becomes readable retroactively. NIST's own guidance states this directly: encrypted data remains at risk today because of exactly this dynamic, which is why the transition to post-quantum cryptography carries urgency even though large-scale quantum computers don't yet exist.
This matters enormously for AI systems because of what an extraction campaign actually involves: a sustained sequence of queries and responses passing between an attacker and a model's API, typically over standard encrypted channels. If that encrypted traffic is intercepted and stored today — whether the immediate goal was extraction, surveillance, or simple opportunism — a future adversary with a sufficiently capable quantum computer doesn't need to break into anything to eventually read what was exchanged. They simply need to have kept a copy.
For AI models trained or fine-tuned on Indian citizens' personal data — financial histories through fintech platforms, health information through healthtech products, identity data tied to Aadhaar-linked services — this converts an already serious extraction and privacy risk into one with a genuinely long shelf life. Data that a security team considers "already handled" because the incident is years old may still be sitting, harvested and waiting, in an adversary's storage.
India's Own Risk Assessment Confirms This Isn't Hypothetical
This isn't an imported concern. India's own National Quantum Mission task force has already published this exact assessment as the justification for its recommended acceleration toward post-quantum cryptography, explicitly flagging that maturing quantum computing technologies could soon break many of the cryptographic algorithms currently securing India's digital communications, banking systems, government networks, and critical infrastructure — and that this creates risk specifically because quantum computers could decrypt information that has already been intercepted and stored.
Global research quantifying this risk has reached striking conclusions. Formal analysis of the "harvest now, decrypt later" threat model — evaluating exposure as a function of how long data needs to stay confidential versus how soon a capable quantum computer is likely to arrive — has found that under classical public-key cryptography, the large majority of long-lived healthcare and government-classified data encrypted today faces near-certain compromise once cryptographically relevant quantum computers exist. Personal data used to train AI models — which by its nature needs to stay confidential for the lifetime of the individuals it describes, often decades — falls squarely into this highest-risk category.
The Migration Period Itself Is a Window of Exposure
There's a second, less-discussed dimension: the multi-year transition to post-quantum cryptography is itself a period of elevated operational risk, distinct from the quantum threat it's meant to solve.
NIST finalized its post-quantum cryptography standards — ML-KEM, ML-DSA, and SLH-DSA, formally designated FIPS 203 through 205 — in August 2024. Migration is now binding policy in major jurisdictions, with the United States requiring federal agencies to complete migration by 2030. But migrations of this scale are acknowledged, even by the standards bodies driving them, to be genuinely difficult engineering work: deploying new key-exchange mechanisms is typically a one-to-two quarter project for a well-resourced organization, while rebuilding certificate infrastructure around the new signature standards is a substantially longer undertaking. During that window, organizations commonly run hybrid classical-and-post-quantum systems, with legacy components, partially migrated API gateways, and inconsistent coverage across different services.
For any Indian enterprise running AI APIs during its own post-quantum transition, this creates exactly the kind of inconsistent, partially-hardened environment that has historically been fertile ground for attackers of every kind — including those running extraction campaigns against the AI systems sitting behind that infrastructure. The migration doesn't have to fail to create risk; it only has to be uneven, which large-scale migrations reliably are.
What Quantum-Safe Communication Actually Protects — And What It Doesn't
India's National Quantum Mission has made real, independently validated progress on quantum key distribution — the 1,000-km QKD network built by QNu Labs, validated against the industry-standard MAP-300 test platform, demonstrates genuine and usable quantum-safe communication infrastructure, with the mission targeting 2,000 km by the end of 2026.
This is a meaningful defensive asset, and it deserves to be taken seriously as one. QKD can make it extraordinarily difficult for an adversary to intercept or tamper with data in transit — directly addressing the harvest-now-decrypt-later threat described above for any system built on top of it.
What it does not do is stop model extraction itself. Extraction attacks work through legitimate, authenticated API access — an attacker isn't eavesdropping on a channel, they're asking a model permitted questions and learning from its permitted answers. Quantum-safe communication protects the pipe the queries travel through; it says nothing about whether the queries themselves, and the responses to them, constitute a slow-motion theft of the model's behaviour or its training data. An organization that quantum-hardens its network while leaving its AI API's output design, rate limiting, and query monitoring untouched has secured the wrong layer of the same problem.
Why This Convergence Is Distinctly Consequential for India
A few structural realities make this intersection sharper in India than in markets where AI and quantum development are less tightly coupled as national strategic priorities.
The same data underlies both national missions. India's sovereign AI models are explicitly being trained on Indian-language, Indian-context data — the kind of data that includes exactly the personal and behavioural information the DPDP Act was written to protect. This is the same category of data that formal HNDL risk analysis identifies as facing the highest long-term exposure once quantum decryption becomes feasible. The overlap isn't coincidental; it's structural, because both missions are drawing on the same underlying pool of Indian citizen data.
Government-backed AI carries government-grade stakes. With 20 sovereign AI model proposals moving forward under direct government support, a meaningful share of India's AI development is happening inside or adjacent to public-sector and critical-infrastructure contexts — precisely the category NIST and India's own quantum task force flag as highest-priority for HNDL protection, because government-classified and critical-infrastructure data was singled out by name in India's own quantum-safe roadmap.
Two national missions, one governance conversation that hasn't fully merged yet. The IndiaAI Mission and National Quantum Mission are both real, funded, and progressing rapidly, and government messaging has begun explicitly linking frontier technology missions together as part of a shared national strategy. But linkage at the policy-narrative level doesn't automatically mean the technical risk assessments have merged. An AI security review that stops at model-level extraction defenses, and a cryptographic migration plan that stops at network-level PQC deployment, can each be individually well executed and still leave the seam between them — the point where a model's API traffic meets the encryption protecting it — unexamined by either team.
The Practical Question This Raises
None of this requires an organization to wait for a working large-scale quantum computer to start treating this seriously — and that's precisely the point NIST, India's own quantum task force, and the peer-reviewed HNDL research all converge on: the risk is active today, regardless of when quantum decryption capability actually arrives, because the harvesting happens now and the decryption happens later.
For any Indian enterprise training or deploying AI models on personal or sensitive data, that turns into a genuinely practical set of questions. Is the encrypted traffic carrying your AI API's queries and responses part of your organization's post-quantum migration inventory, or does that inventory stop at more traditional systems? If your organization is mid-transition to post-quantum cryptography, has anyone checked whether your AI-serving infrastructure is covered by the same timeline as the rest of your estate, or is it quietly lagging? And separately from all of that — because quantum-safe communication was never going to answer this part — has your AI API itself ever been tested against extraction, independent of what protects the channel it runs on?
Two of India's most ambitious technology missions are advancing in parallel, funded, measured, and genuinely ahead of many global peers on their own terms. The organizations that benefit most from that progress will be the ones that treat the seam between them as a single risk to close, rather than two separate roadmaps that happen to share a country.
