Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2404.05824 · Quantum Machine Intelligence

Quantum adversarial learning for kernel methods

Giuseppe Montalbano, Leonardo Banchi

Published Feb 5, 2025• 15 citations
arXivHTMLPDF

Abstract

Abstract We show that hybrid quantum classifiers based on quantum kernel methods and support vector machines are vulnerable against adversarial attacks, namely small engineered perturbations of the input data can deceive the classifier into predicting the wrong result. Nonetheless, we also show that simple defense strategies based on data augmentation with a few crafted perturbations can make the classifier robust against new attacks. Our results find applications in security-critical learning problems and in mitigating the effect of some forms of quantum noise, since the attacker can also be understood as part of the surrounding environment.

DOI
10.1007/s42484-025-00238-8

Related papers

Adversarial Attack Generation in Quantum Data Classification

Xiaokai Hou

Adversarial attack aims to generate infinitesimal perturbations that are crafted to deceive well-trained classifiers, and has been extensively explored in the context of classical data. However, the generation of adversarial attacks for quantum data remains largely unexplored. This work addresses this gap by investigating the efficacy of classical adversarial attack generation methods in the realm of quantum data learning. Specifically, we implement two widely recognized adversarial attack generation techniques, namely, the fast gradient sign method (FGSM) and the Deepfool method, for generating adversarial attacks on quantum data based on Gell-Mann matrices. We further evaluate the deceptive capabilities of these generated adversarial samples on a classical classifier tasked with entanglement discrimination. Through extensive numerical simulations, we demonstrate the effectiveness of our adversarial attack generation methods in efficiently crafting adversarial attacks on quantum data, successfully fooling the well-trained classifier. The outcomes of our research not only extend the applicability of classical machine learning algorithms to the domain of quantum machine learning but also provide valuable insights into the vulnerability of quantum data.

International Conference on Computer Science and Management Technology (ICCSMT)•Oct 13, 2023•1 citation

Quantum SVM Algorithms for Efficient Defense Against Gradient-Based Adversarial Attacks

Hakeem Quadri, Hua Wang, Sardar M. N. Islam +2 more

The growth of machine learning (ML) has revealed model vulnerabilities to adversarial attacks, where small data perturbations degrade performance. Classical defenses often struggle, especially with complex, non-linear data, and adversarial training is resource-intensive due to high computational demands. This research explores the use of quantum kernels in SVMs with ZZ feature maps to transform adversarial data into high-dimensional quantum spaces, showing quantum machine learning’s potential to surpass classical approaches. Testing on MNIST and CIFAR-10 datasets showed quantum SVM achieving 70.6% accuracy on adversarial data, outperforming classical SVM with RBF which achieved $51 \%$. This demonstrates the quantum SVM’s robustness against adversarial attacks.

International Conference on Networking and Network Applications (NaNA)•Aug 8, 2025•1 citation

Enhancing adversarial robustness of quantum neural networks by adding noise layers

Chenyi Huang, Shibin Zhang

Abstract The rapid advancements in machine learning and quantum computing have given rise to a new research frontier: quantum machine learning. Quantum models designed for tackling classification problems possess the potential to deliver speed enhancements and superior predictive accuracy compared to their classical counterparts. However, recent research has revealed that quantum neural networks (QNNs), akin to their classical deep neural network-based classifier counterparts, are vulnerable to adversarial attacks. In these attacks, meticulously designed perturbations added to clean input data can result in QNNs producing incorrect predictions with high confidence. To mitigate this issue, we suggest enhancing the adversarial robustness of quantum machine learning systems by incorporating noise layers into QNNs. This is accomplished by solving a Min-Max optimization problem to control the magnitude of the noise, thereby increasing the QNN’s resilience against adversarial attacks. Extensive numerical experiments illustrate that our proposed method outperforms state-of-the-art defense techniques in terms of both clean and robust accuracy.

New Journal of Physics•Jul 19, 2023•13 citations

Universal Adversarial Examples and Perturbations for Quantum Classifiers

Weiyuan Gong, Dong-Ling Deng

Abstract Quantum machine learning explores the interplay between machine learning and quantum physics, which may lead to unprecedented perspectives for both fields. In fact, recent works have shown strong evidences that quantum computers could outperform classical computers in solving certain notable machine learning tasks. Yet, quantum learning systems may also suffer from the vulnerability problem: adding a tiny carefully-crafted perturbation to the legitimate input data would cause the systems to make incorrect predictions at a notably high confidence level. In this paper, we study the universality of adversarial examples and perturbations for quantum classifiers. Through concrete examples involving classifications of real-life images and quantum phases of matter, we show that there exist universal adversarial examples that can fool a set of different quantum classifiers. We prove that for a set of k classifiers with each receiving input data of n qubits, an $O(\frac{\ln k}{2^n})$ increase of the perturbation strength is enough to ensure a moderate universal adversarial risk. In addition, for a given quantum classifier we show that there exist universal adversarial perturbations, which can be added to different legitimate samples and make them to be adversarial examples for the classifier. Our results reveal the universality perspective of adversarial attacks for quantum machine learning systems, which would be crucial for practical applications of both near-term and future quantum technologies in solving machine learning problems.

arXiv:2102.07788•National Science Review•Jul 15, 2021•33 citations

Defending Quantum Classifiers against Adversarial Perturbations through Quantum Autoencoders

Emma Andrews, Sahan Sanjaya, Prabhat Mishra

Machine learning models can learn from data samples to carry out various tasks efficiently. When data samples are adversarially manipulated, such as by insertion of carefully crafted noise, it can cause the model to make mistakes. Quantum machine learning models are also vulnerable to such adversarial attacks, especially in image classification using variational quantum classifiers. While there are promising defenses against these adversarial perturbations, such as training with adversarial samples, they face practical limitations. For example, they are not applicable in scenarios where training with adversarial samples is either not possible or can overfit the models on one type of attack. In this paper, we propose an adversarial training-free defense framework that utilizes a quantum autoencoder to purify the adversarial samples through reconstruction. Moreover, our defense framework provides a confidence metric to identify potentially adversarial samples that cannot be purified the quantum autoencoder. Extensive evaluation demonstrates that our defense framework can significantly outperform state-of-the-art in prediction accuracy (up to 68%) under adversarial attacks.

quant-pharXiv:2604.28176•May 1, 2026•0 citations

Adversarial robustness guarantees for quantum classifiers

Neil Dowling, Maxwell T. West, Angus Southwell +4 more

Abstract Despite their ever more widespread deployment throughout society, machine learning algorithms remain critically vulnerable to being spoofed by subtle adversarial tampering with their input data. The prospect of near-term quantum computers being capable of running quantum machine learning (QML) algorithms has therefore generated intense interest in their adversarial vulnerability. Here we show that quantum properties of QML algorithms can confer fundamental protections against such attacks, in certain scenarios guaranteeing robustness against classically-armed adversaries. We leverage tools from many-body physics to identify the quantum sources of this protection. Our results offer a theoretical underpinning of recent evidence which suggest quantum advantages in the search for adversarial robustness. In particular, we prove that quantum classifiers are: (i) protected against weak perturbations of data drawn from the trained distribution, (ii) protected against local attacks if they are insufficiently scrambling, and (iii) show evidence that they are protected against universal adversarial attacks if they are sufficiently chaotic. Our analytic results are supported by numerical evidence demonstrating the applicability of our theorems and the resulting robustness of a quantum classifier in practice. This line of inquiry constitutes a concrete pathway to advantage in QML, orthogonal to the usually sought improvements in model speed or accuracy.

arXiv:2405.10360•npj Quantum Information•Jan 19, 2026•10 citations
Abstract We show that hybrid quantum classifiers based on quantum kernel methods and support vector machines are vulnerable against adversarial attacks, namely small engineered perturbations of the input data can deceive the classifier into predicting the wrong result. Nonetheless, we also show that simple defense strategies based on data augmentation with a few crafted perturbations can make the classifier robust against new attacks. Our results find applications in security-critical learning problems and in mitigating the effect of some forms of quantum noise, since the attacker can also be understood as part of the surrounding environment.
Adversarial attack aims to generate infinitesimal perturbations that are crafted to deceive well-trained classifiers, and has been extensively explored in the context of classical data. However, the generation of adversarial attacks for quantum data remains largely unexplored. This work addresses this gap by investigating the efficacy of classical adversarial attack generation methods in the realm of quantum data learning. Specifically, we implement two widely recognized adversarial attack generation techniques, namely, the fast gradient sign method (FGSM) and the Deepfool method, for generating adversarial attacks on quantum data based on Gell-Mann matrices. We further evaluate the deceptive capabilities of these generated adversarial samples on a classical classifier tasked with entanglement discrimination. Through extensive numerical simulations, we demonstrate the effectiveness of our adversarial attack generation methods in efficiently crafting adversarial attacks on quantum data, successfully fooling the well-trained classifier. The outcomes of our research not only extend the applicability of classical machine learning algorithms to the domain of quantum machine learning but also provide valuable insights into the vulnerability of quantum data.
The growth of machine learning (ML) has revealed model vulnerabilities to adversarial attacks, where small data perturbations degrade performance. Classical defenses often struggle, especially with complex, non-linear data, and adversarial training is resource-intensive due to high computational demands. This research explores the use of quantum kernels in SVMs with ZZ feature maps to transform adversarial data into high-dimensional quantum spaces, showing quantum machine learning’s potential to surpass classical approaches. Testing on MNIST and CIFAR-10 datasets showed quantum SVM achieving 70.6% accuracy on adversarial data, outperforming classical SVM with RBF which achieved 51%51 \%51%. This demonstrates the quantum SVM’s robustness against adversarial attacks.
Abstract The rapid advancements in machine learning and quantum computing have given rise to a new research frontier: quantum machine learning. Quantum models designed for tackling classification problems possess the potential to deliver speed enhancements and superior predictive accuracy compared to their classical counterparts. However, recent research has revealed that quantum neural networks (QNNs), akin to their classical deep neural network-based classifier counterparts, are vulnerable to adversarial attacks. In these attacks, meticulously designed perturbations added to clean input data can result in QNNs producing incorrect predictions with high confidence. To mitigate this issue, we suggest enhancing the adversarial robustness of quantum machine learning systems by incorporating noise layers into QNNs. This is accomplished by solving a Min-Max optimization problem to control the magnitude of the noise, thereby increasing the QNN’s resilience against adversarial attacks. Extensive numerical experiments illustrate that our proposed method outperforms state-of-the-art defense techniques in terms of both clean and robust accuracy.
Abstract Quantum machine learning explores the interplay between machine learning and quantum physics, which may lead to unprecedented perspectives for both fields. In fact, recent works have shown strong evidences that quantum computers could outperform classical computers in solving certain notable machine learning tasks. Yet, quantum learning systems may also suffer from the vulnerability problem: adding a tiny carefully-crafted perturbation to the legitimate input data would cause the systems to make incorrect predictions at a notably high confidence level. In this paper, we study the universality of adversarial examples and perturbations for quantum classifiers. Through concrete examples involving classifications of real-life images and quantum phases of matter, we show that there exist universal adversarial examples that can fool a set of different quantum classifiers. We prove that for a set of k classifiers with each receiving input data of n qubits, an O(ln⁡k2n)O(\frac{\ln k}{2^n})O(2nlnk​) increase of the perturbation strength is enough to ensure a moderate universal adversarial risk. In addition, for a given quantum classifier we show that there exist universal adversarial perturbations, which can be added to different legitimate samples and make them to be adversarial examples for the classifier. Our results reveal the universality perspective of adversarial attacks for quantum machine learning systems, which would be crucial for practical applications of both near-term and future quantum technologies in solving machine learning problems.
Machine learning models can learn from data samples to carry out various tasks efficiently. When data samples are adversarially manipulated, such as by insertion of carefully crafted noise, it can cause the model to make mistakes. Quantum machine learning models are also vulnerable to such adversarial attacks, especially in image classification using variational quantum classifiers. While there are promising defenses against these adversarial perturbations, such as training with adversarial samples, they face practical limitations. For example, they are not applicable in scenarios where training with adversarial samples is either not possible or can overfit the models on one type of attack. In this paper, we propose an adversarial training-free defense framework that utilizes a quantum autoencoder to purify the adversarial samples through reconstruction. Moreover, our defense framework provides a confidence metric to identify potentially adversarial samples that cannot be purified the quantum autoencoder. Extensive evaluation demonstrates that our defense framework can significantly outperform state-of-the-art in prediction accuracy (up to 68%) under adversarial attacks.
Abstract Despite their ever more widespread deployment throughout society, machine learning algorithms remain critically vulnerable to being spoofed by subtle adversarial tampering with their input data. The prospect of near-term quantum computers being capable of running quantum machine learning (QML) algorithms has therefore generated intense interest in their adversarial vulnerability. Here we show that quantum properties of QML algorithms can confer fundamental protections against such attacks, in certain scenarios guaranteeing robustness against classically-armed adversaries. We leverage tools from many-body physics to identify the quantum sources of this protection. Our results offer a theoretical underpinning of recent evidence which suggest quantum advantages in the search for adversarial robustness. In particular, we prove that quantum classifiers are: (i) protected against weak perturbations of data drawn from the trained distribution, (ii) protected against local attacks if they are insufficiently scrambling, and (iii) show evidence that they are protected against universal adversarial attacks if they are sufficiently chaotic. Our analytic results are supported by numerical evidence demonstrating the applicability of our theorems and the resulting robustness of a quantum classifier in practice. This line of inquiry constitutes a concrete pathway to advantage in QML, orthogonal to the usually sought improvements in model speed or accuracy.