Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2402.00176 · IEEE International Symposium on Information Theory (ISIT)

Adversarial Quantum Machine Learning: An Information-Theoretic Generalization Analysis

Petros Georgiou, Sharu Theresa Jose, Osvaldo Simeone

Published Jul 7, 2024• 6 citations
arXivHTMLPDF

Abstract

In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input state$\rho(x)$into a state$\tau$that is$\epsilon$-close to the original state$\rho(x)$in p-Schatten distance. Under suitable assumptions on the quantum embedding$\rho(x)$, we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for$p=1$and$p=\infty$. The derived upper bounds consist of two terms: the first is an exponential function of the 2-Renyi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size$\epsilon$. Both terms are shown to decrease as$1/\sqrt{T}$over the training set size$T$. An extension is also considered in which the adversary assumed during training has different parameters$p$and$\epsilon$as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.

DOI
10.1109/isit57864.2024.10619403

Related papers

On the Generalization of Adversarially Trained Quantum Classifiers

Petros Georgiou, Thomas, Aaron Mark, Sharu Theresa Jose +1 more

Quantum classifiers are vulnerable to adversarial attacks that manipulate their input classical or quantum data. A promising countermeasure is adversarial training, where quantum classifiers are trained by using an attack-aware, adversarial loss function. This work establishes novel bounds on the generalization error of adversarially trained quantum classifiers when tested in the presence of perturbation-constrained adversaries. The bounds quantify the excess generalization error incurred to ensure robustness to adversarial attacks as scaling with the training sample size $m$ as $1/\sqrt{m}$, while yielding insights into the impact of the quantum embedding. For quantum binary classifiers employing \textit{rotation embedding}, we find that, in the presence of adversarial attacks on classical inputs $\mathbf{x}$, the increase in sample complexity due to adversarial training over conventional training vanishes in the limit of high dimensional inputs $\mathbf{x}$. In contrast, when the adversary can directly attack the quantum state $ρ(\mathbf{x})$ encoding the input $\mathbf{x}$, the excess generalization error depends on the choice of embedding only through its Hilbert space dimension. The results are also extended to multi-class classifiers. We validate our theoretical findings with numerical experiments.

arXiv:2504.17690•Apr 24, 2025•0 citations

Adversarial robustness guarantees for quantum classifiers

Neil Dowling, Maxwell T. West, Angus Southwell +4 more

Abstract Despite their ever more widespread deployment throughout society, machine learning algorithms remain critically vulnerable to being spoofed by subtle adversarial tampering with their input data. The prospect of near-term quantum computers being capable of running quantum machine learning (QML) algorithms has therefore generated intense interest in their adversarial vulnerability. Here we show that quantum properties of QML algorithms can confer fundamental protections against such attacks, in certain scenarios guaranteeing robustness against classically-armed adversaries. We leverage tools from many-body physics to identify the quantum sources of this protection. Our results offer a theoretical underpinning of recent evidence which suggest quantum advantages in the search for adversarial robustness. In particular, we prove that quantum classifiers are: (i) protected against weak perturbations of data drawn from the trained distribution, (ii) protected against local attacks if they are insufficiently scrambling, and (iii) show evidence that they are protected against universal adversarial attacks if they are sufficiently chaotic. Our analytic results are supported by numerical evidence demonstrating the applicability of our theorems and the resulting robustness of a quantum classifier in practice. This line of inquiry constitutes a concrete pathway to advantage in QML, orthogonal to the usually sought improvements in model speed or accuracy.

arXiv:2405.10360•npj Quantum Information•Jan 19, 2026•10 citations

Transfer Learning for Quantum Classifiers: An Information-Theoretic Generalization Analysis

Sharu Theresa Jose, Osvaldo Simeone

A key component of a quantum machine learning model operating on classical inputs is the design of an embedding circuit mapping inputs to a quantum state. This paper studies a transfer learning setting in which classical-to-quantum embedding is carried out by an arbitrary parametric quantum circuit that is pre-trained based on data from a source task. At run time, a binary quantum classifier of the embedding is optimized based on data from the target task of interest. The average excess risk, i.e., the optimality gap, of the resulting classifier depends on how (dis)similar the source and target tasks are. We introduce a new measure of (dis)similarity between the binary quantum classification tasks via the trace distances. An upper bound on the optimality gap is derived in terms of the proposed task (dis)similarity measure, two Rényi mutual information terms between classical input and quantum embedding under source and target tasks, as well as a measure of complexity of the combined space of quantum embeddings and classifiers under the source task. The theoretical results are validated on a simple binary classification example.

arXiv:2201.06297•IEEE Information Theory Workshop (ITW)•Apr 23, 2023•5 citations

Enhancing quantum adversarial robustness by randomized encodings

Weiyuan Gong, Yuan Dong, Weikang Li +1 more

The interplay between quantum physics and machine learning gives rise to the emergent frontier of quantum machine learning, where advanced quantum learning models may outperform their classical counterparts in solving certain challenging problems. However, quantum learning systems are vulnerable to adversarial attacks: adding tiny carefully crafted perturbations on legitimate input samples can cause misclassifications. To address this problem, we propose an effective approach to protect quantum learning systems from adversarial attacks by randomly encoding the legitimate data samples through unitary or quantum error correction encoders that are unknown to the attackers. In particular, we rigorously prove that both global and local random unitary encoders lead to exponentially vanishing gradients (i.e., barren plateaus) for any variational quantum circuits that aim to add adversarial perturbations, independent of the input data and the inner structures of adversarial circuits and quantum classifiers. In addition, we prove a rigorous bound on the vulnerability of quantum classifiers under local unitary adversarial attacks. We show that random black-box quantum error correction encoders can protect quantum classifiers against local adversarial noises and their robustness increases as we concatenate error correction codes. To quantify the robustness enhancement, we adapt quantum differential privacy as a measure of the prediction stability for quantum classifiers. Our results establish versatile defense strategies for quantum classifiers against adversarial perturbations, which provide valuable guidance to enhance the reliability and security for both near-term and future quantum learning technologies. Published by the American Physical Society 2024

arXiv:2212.02531•Physical Review Research•Apr 4, 2024•40 citations

Universal Adversarial Examples and Perturbations for Quantum Classifiers

Weiyuan Gong, Dong-Ling Deng

Abstract Quantum machine learning explores the interplay between machine learning and quantum physics, which may lead to unprecedented perspectives for both fields. In fact, recent works have shown strong evidences that quantum computers could outperform classical computers in solving certain notable machine learning tasks. Yet, quantum learning systems may also suffer from the vulnerability problem: adding a tiny carefully-crafted perturbation to the legitimate input data would cause the systems to make incorrect predictions at a notably high confidence level. In this paper, we study the universality of adversarial examples and perturbations for quantum classifiers. Through concrete examples involving classifications of real-life images and quantum phases of matter, we show that there exist universal adversarial examples that can fool a set of different quantum classifiers. We prove that for a set of k classifiers with each receiving input data of n qubits, an $O(\frac{\ln k}{2^n})$ increase of the perturbation strength is enough to ensure a moderate universal adversarial risk. In addition, for a given quantum classifier we show that there exist universal adversarial perturbations, which can be added to different legitimate samples and make them to be adversarial examples for the classifier. Our results reveal the universality perspective of adversarial attacks for quantum machine learning systems, which would be crucial for practical applications of both near-term and future quantum technologies in solving machine learning problems.

arXiv:2102.07788•National Science Review•Jul 15, 2021•33 citations

Towards Robust Quantum Machine Learning

Saeefa Rubaiyet Nowmi, Jesus Lopez, Md Mahmudul Alam Imon +3 more

Quantum Machine Learning (QML) fuses quantum computing with machine learning to address complex tasks with potential speedups over classical methods. While QML models such as variational quantum classifiers (QVC), quantum multilayer perceptron(QMLP) models and quantum convolutional neural networks (QCNN) have demonstrated promise in applications like image recognition and malware classification, they remain vulnerable to adversarial threats. Inspired by the vulnerabilities in classical ML, this work systematically investigates how attacks-ranging from training-time poisoning and inferencetime evasion (e.g., quantum versions of FGSM and PGD) to deployment-time trigger attacks-manifest in quantum circuits. We explore how classical adversarial strategies adapt to quantum models through parameterized encodings, hybrid architectures, and probabilistic outputs. The poster evaluates different quantum classifiers under adversarial settings, comparing their robustness, trainability, and resilience to perturbations. Defense mechanisms such as randomized encoding, engineered noise channels, and quantum adversarial training are analyzed in relation to specific threat types. In addition, we assess how quantum models behave differently than classical counterparts under attack, and how quantum-specific design constraints can either exacerbate or mitigate these effects. Our ultimate goal is to define and construct robust QML systems that are both theoretically sound and practically secure. By synthesizing results across multiple QML architectures and threat models, this work provides actionable insight into the development of resilient quantum classifiers, paving the way toward trustworthy and scalable quantum machine learning.

IEEE International Conference on Quantum Computing and Engineering (QCE)•Aug 30, 2025•2 citations
In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input stateρ(x)\rho(x)ρ(x)into a stateτ\tauτthat isϵ\epsilonϵ-close to the original stateρ(x)\rho(x)ρ(x)in p-Schatten distance. Under suitable assumptions on the quantum embeddingρ(x)\rho(x)ρ(x), we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers forp=1p=1p=1andp=∞p=\inftyp=∞. The derived upper bounds consist of two terms: the first is an exponential function of the 2-Renyi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation sizeϵ\epsilonϵ. Both terms are shown to decrease as1/T1/\sqrt{T}1/T​over the training set sizeTTT. An extension is also considered in which the adversary assumed during training has different parameterspppandϵ\epsilonϵas compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.
Quantum classifiers are vulnerable to adversarial attacks that manipulate their input classical or quantum data. A promising countermeasure is adversarial training, where quantum classifiers are trained by using an attack-aware, adversarial loss function. This work establishes novel bounds on the generalization error of adversarially trained quantum classifiers when tested in the presence of perturbation-constrained adversaries. The bounds quantify the excess generalization error incurred to ensure robustness to adversarial attacks as scaling with the training sample size mmm as 1/m1/\sqrt{m}1/m​, while yielding insights into the impact of the quantum embedding. For quantum binary classifiers employing \textit{rotation embedding}, we find that, in the presence of adversarial attacks on classical inputs x\mathbf{x}x, the increase in sample complexity due to adversarial training over conventional training vanishes in the limit of high dimensional inputs x\mathbf{x}x. In contrast, when the adversary can directly attack the quantum state ρ(x)ρ(\mathbf{x})ρ(x) encoding the input x\mathbf{x}x, the excess generalization error depends on the choice of embedding only through its Hilbert space dimension. The results are also extended to multi-class classifiers. We validate our theoretical findings with numerical experiments.
Abstract Despite their ever more widespread deployment throughout society, machine learning algorithms remain critically vulnerable to being spoofed by subtle adversarial tampering with their input data. The prospect of near-term quantum computers being capable of running quantum machine learning (QML) algorithms has therefore generated intense interest in their adversarial vulnerability. Here we show that quantum properties of QML algorithms can confer fundamental protections against such attacks, in certain scenarios guaranteeing robustness against classically-armed adversaries. We leverage tools from many-body physics to identify the quantum sources of this protection. Our results offer a theoretical underpinning of recent evidence which suggest quantum advantages in the search for adversarial robustness. In particular, we prove that quantum classifiers are: (i) protected against weak perturbations of data drawn from the trained distribution, (ii) protected against local attacks if they are insufficiently scrambling, and (iii) show evidence that they are protected against universal adversarial attacks if they are sufficiently chaotic. Our analytic results are supported by numerical evidence demonstrating the applicability of our theorems and the resulting robustness of a quantum classifier in practice. This line of inquiry constitutes a concrete pathway to advantage in QML, orthogonal to the usually sought improvements in model speed or accuracy.
A key component of a quantum machine learning model operating on classical inputs is the design of an embedding circuit mapping inputs to a quantum state. This paper studies a transfer learning setting in which classical-to-quantum embedding is carried out by an arbitrary parametric quantum circuit that is pre-trained based on data from a source task. At run time, a binary quantum classifier of the embedding is optimized based on data from the target task of interest. The average excess risk, i.e., the optimality gap, of the resulting classifier depends on how (dis)similar the source and target tasks are. We introduce a new measure of (dis)similarity between the binary quantum classification tasks via the trace distances. An upper bound on the optimality gap is derived in terms of the proposed task (dis)similarity measure, two Rényi mutual information terms between classical input and quantum embedding under source and target tasks, as well as a measure of complexity of the combined space of quantum embeddings and classifiers under the source task. The theoretical results are validated on a simple binary classification example.
The interplay between quantum physics and machine learning gives rise to the emergent frontier of quantum machine learning, where advanced quantum learning models may outperform their classical counterparts in solving certain challenging problems. However, quantum learning systems are vulnerable to adversarial attacks: adding tiny carefully crafted perturbations on legitimate input samples can cause misclassifications. To address this problem, we propose an effective approach to protect quantum learning systems from adversarial attacks by randomly encoding the legitimate data samples through unitary or quantum error correction encoders that are unknown to the attackers. In particular, we rigorously prove that both global and local random unitary encoders lead to exponentially vanishing gradients (i.e., barren plateaus) for any variational quantum circuits that aim to add adversarial perturbations, independent of the input data and the inner structures of adversarial circuits and quantum classifiers. In addition, we prove a rigorous bound on the vulnerability of quantum classifiers under local unitary adversarial attacks. We show that random black-box quantum error correction encoders can protect quantum classifiers against local adversarial noises and their robustness increases as we concatenate error correction codes. To quantify the robustness enhancement, we adapt quantum differential privacy as a measure of the prediction stability for quantum classifiers. Our results establish versatile defense strategies for quantum classifiers against adversarial perturbations, which provide valuable guidance to enhance the reliability and security for both near-term and future quantum learning technologies. Published by the American Physical Society 2024
Abstract Quantum machine learning explores the interplay between machine learning and quantum physics, which may lead to unprecedented perspectives for both fields. In fact, recent works have shown strong evidences that quantum computers could outperform classical computers in solving certain notable machine learning tasks. Yet, quantum learning systems may also suffer from the vulnerability problem: adding a tiny carefully-crafted perturbation to the legitimate input data would cause the systems to make incorrect predictions at a notably high confidence level. In this paper, we study the universality of adversarial examples and perturbations for quantum classifiers. Through concrete examples involving classifications of real-life images and quantum phases of matter, we show that there exist universal adversarial examples that can fool a set of different quantum classifiers. We prove that for a set of k classifiers with each receiving input data of n qubits, an O(ln⁡k2n)O(\frac{\ln k}{2^n})O(2nlnk​) increase of the perturbation strength is enough to ensure a moderate universal adversarial risk. In addition, for a given quantum classifier we show that there exist universal adversarial perturbations, which can be added to different legitimate samples and make them to be adversarial examples for the classifier. Our results reveal the universality perspective of adversarial attacks for quantum machine learning systems, which would be crucial for practical applications of both near-term and future quantum technologies in solving machine learning problems.
Quantum Machine Learning (QML) fuses quantum computing with machine learning to address complex tasks with potential speedups over classical methods. While QML models such as variational quantum classifiers (QVC), quantum multilayer perceptron(QMLP) models and quantum convolutional neural networks (QCNN) have demonstrated promise in applications like image recognition and malware classification, they remain vulnerable to adversarial threats. Inspired by the vulnerabilities in classical ML, this work systematically investigates how attacks-ranging from training-time poisoning and inferencetime evasion (e.g., quantum versions of FGSM and PGD) to deployment-time trigger attacks-manifest in quantum circuits. We explore how classical adversarial strategies adapt to quantum models through parameterized encodings, hybrid architectures, and probabilistic outputs. The poster evaluates different quantum classifiers under adversarial settings, comparing their robustness, trainability, and resilience to perturbations. Defense mechanisms such as randomized encoding, engineered noise channels, and quantum adversarial training are analyzed in relation to specific threat types. In addition, we assess how quantum models behave differently than classical counterparts under attack, and how quantum-specific design constraints can either exacerbate or mitigate these effects. Our ultimate goal is to define and construct robust QML systems that are both theoretically sound and practically secure. By synthesizing results across multiple QML architectures and threat models, this work provides actionable insight into the development of resilient quantum classifiers, paving the way toward trustworthy and scalable quantum machine learning.