Quantum machine learning is commonly benchmarked by matching a quantum head’s parameter count to that of a classical baseline. We show that this control is insufficient. We compare a 32-parameter parameterized quantum circuit (PQC) head against a nominally matched 31-parameter multi-layer perceptron (MLP) on three paraphrase tasks—the Microsoft Research Paraphrase Corpus (MRPC), Paraphrase Adversaries from Word Scrambling (PAWS), and Quora Question Pairs (QQP)—and document two pitfalls that inflate an apparent quantum deficit. First, under the tested protocol, unweighted binary cross-entropy on imbalanced data leads to near-all-positive prediction, producing an illusory equivalence. Second, the surviving gap traces to a readout that sits offset from the decision threshold at initialization ($⟨Z_0⟩=+0.922$), and no circuit parameter acts as a threshold shift that could recenter it. A pre-specified calibration experiment removes 61% to 76% of the gap, and a training-free probe detects the condition in one forward pass. Threshold-free metrics then changed our own conclusions. On PAWS, both heads rank barely above chance (area under the receiver operating characteristic curve, AUC, at most $0.508$), so the difference there is threshold placement. Only QQP retains a residual, and a post hoc control doubling the qubit count narrows it by $42\%$ without removing it (paired $p=0.0009$). This pattern is consistent with a capacity or optimization limitation, but does not distinguish between them. Four of five pre-specified predictions failed. Parameter roles and readout offsets must be audited, not only counts.

Hybrid post-quantum TLS deployments pair classical and post-quantum signature algorithms to resist future quantum adversaries. However, to the best of our knowledge, no active IETF TLS, PQUIP, or LAMPS working-group draft treats CPU-cost adversarial algorithm substitution as a first-class availability threat. We define the Cryptographic Amplification Factor ($\mathrm{CAF}$), a metric for the per-resource cost asymmetry that an adversary induces by forcing a TLS 1.3 server onto a high-cost signature algorithm (SLH-DSA) instead of a low-cost one (ECDSA or ML-DSA). We characterise four adversary classes—insider misconfiguration, supply-chain compromise, remote TLS peer, and protocol man-in-the-middle—demonstrate working proof-of-concept exploits on representative testbeds, and evaluate three defensive primitives under realistic deployment conditions. On the liboqs 0.14.0 reference implementation, ${\mathrm{CAF}}_{r_{\mathrm{cpu}}}$ reaches $\mathrm{12,255}\times$ on Apple M-series ARM64 and $\mathrm{14,272}\times$ on AWS Graviton3 (3904–$\mathrm{14,272}\times$ across five microarchitectures). Under a representative two-worker hardware security module (HSM) calibration ($\lambda =13.5$ TPS), substitution drives the modelled queue utilisation $\rho$ past the stability boundary ($1.44\times {10}^{-4}\to 1.787$), a model-independent saturation; on the testbed, we observe server-CPU saturation, accept-queue exhaustion, and dropped connections. Two enforcement defences and a Parallel Signing Architecture provably bound $\rho \le \alpha <1$ by admission control, regardless of attack rate. The exposed surface is concentrated today in high-assurance and financial-sector deployments and widens as FIPS 206 finalises.