Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2607.11095

When cheap gradients fail: the measurement cost of attacking quantum classifiers

Bacui Li, Chandra Thapa, Tansu Alpcan, Udaya Parampalli

quant-phcs.CRcs.LGSubmitted Jul 13, 2026• Announced Jul 14, 2026• 0 citations
arXivHTMLPDF

Abstract

Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics (shot noise) act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. Under stated assumptions, single-step attacks need at least quadratically many shots in the input dimension $d$, growing as $d^{5/2}$ under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the $d^{5/2}$ geometric floor for plateau-mitigated models and grows as $d^{3.00}$ for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in recovers the parameter-free $d^{3/2}$ shot-noise geometry. Against a matched classical baseline whose attack overhead is dimension-independent (the cheap-gradient principle of automatic differentiation), the quantum gradient cost ratio grows empirically as $d^{3.00}$, so the attacker's relative cost diverges as the model scales. Experiments on a 156-qubit IBM processor (ibm_boston, 4-qubit circuits, $d=12$) reproduce the effect: at matched budgets the device attack tracks the ideal within a few percent, with the high-shot gradient faithful to the exact one. The defense operates precisely when the forward map is classically hard to simulate: only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.

Comments
57 pages, 15 figures

Related papers

Gradient usability in few-qubit quantum Neural Networks: A signal-to-noise ratio framework for evaluating mitigation strategies

Brandon Shen, Karena Ling

The barren-plateau problem—the exponential flattening of optimization landscapes—severely limits the trainability of quantum neural networks (QNNs) on near-term hardware. This review examines ansatz-design and complementary mitigation strategies for few-qubit QNNs under finite-shot noisy intermediate-scale quantum (NISQ) constraints. Its primary conceptual contribution is a literature-grounded reframing of gradient-based trainability around pointwise finite-shot gradient signal-to-noise ratio (SNR) while retaining exact-gradient landscape variance as a complementary theoretical diagnostic. This reframing follows because gradient-based optimization acts on finite-shot gradient estimates whose statistical resolvability directly determines whether the optimizer receives a reliably distinguishable update signal, whereas numerical studies restricted to 2–10 qubits generally cannot establish asymptotic exponential or polynomial gradient-decay laws without theoretical support. Estimator SNR therefore addresses the immediate experimental question of whether the update signal is distinguishable from its sampling uncertainty, whereas exact-gradient variance characterizes landscape concentration. The review surveys ansatz design, parameter initialization, cost-function selection, and error management, and develops a conditional design heuristic: problem-inspired ansätze are preferred when the task maps onto circuit families with demonstrated trainability properties; otherwise, shallow hardware-efficient ansätze provide controlled baselines. As a secondary contribution, the review proposes a complete eight-configuration 2 3 factorial framework for evaluating interactions among restricted entanglement, local cost functions, and active residual shortcuts under matched measurement budgets. An exact identity motivates testing the interaction between restricted entanglement and local costs at the exact-gradient-signal level, but the interaction is tested two-sided; all estimator-SNR interactions remain open empirical questions. The framework is presented as an implementable research agenda enabled by the SNR perspective rather than as evidence that any interaction has been established.

Journal of High School Science•Aug 1, 2026•0 citations

Enhancing quantum adversarial robustness by randomized encodings

Weiyuan Gong, Yuan Dong, Weikang Li +1 more

The interplay between quantum physics and machine learning gives rise to the emergent frontier of quantum machine learning, where advanced quantum learning models may outperform their classical counterparts in solving certain challenging problems. However, quantum learning systems are vulnerable to adversarial attacks: adding tiny carefully crafted perturbations on legitimate input samples can cause misclassifications. To address this problem, we propose an effective approach to protect quantum learning systems from adversarial attacks by randomly encoding the legitimate data samples through unitary or quantum error correction encoders that are unknown to the attackers. In particular, we rigorously prove that both global and local random unitary encoders lead to exponentially vanishing gradients (i.e., barren plateaus) for any variational quantum circuits that aim to add adversarial perturbations, independent of the input data and the inner structures of adversarial circuits and quantum classifiers. In addition, we prove a rigorous bound on the vulnerability of quantum classifiers under local unitary adversarial attacks. We show that random black-box quantum error correction encoders can protect quantum classifiers against local adversarial noises and their robustness increases as we concatenate error correction codes. To quantify the robustness enhancement, we adapt quantum differential privacy as a measure of the prediction stability for quantum classifiers. Our results establish versatile defense strategies for quantum classifiers against adversarial perturbations, which provide valuable guidance to enhance the reliability and security for both near-term and future quantum learning technologies. Published by the American Physical Society 2024

arXiv:2212.02531•Physical Review Research•Apr 4, 2024•40 citations

Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access

Ji Guan, Mingyu Huang

A quantum classifier assigns labels by evolving an input quantum state and measuring the output, so repeated executions reveal only a distribution over labels. We study certified adversarial robustness for such classifiers under known-readout query access (KRQA), where an evaluator can prepare inputs, knows the quantum measurement, and observes finite-shot outcomes but cannot inspect the internal evolution, parameters, or gradients. We give a measurement-only framework that returns two complementary guarantees for each input: a lower bound ruling out untargeted errors within a radius, and an attack-independent upper bound witnessing an adversarial state within a radius. Both are estimable from the known readout measurement and sampled outcomes, require no tomography or circuit description, and have finite-sample control of probability-estimation error. The upper bound uses gap operators induced by the quantum measurement; the lower bound relaxes state-space search to an efficient optimization over outcome distributions with operator-spectrum constraints, yielding certificates that are never weaker than prior probability-only certificates and can be strictly stronger when the spectral constraints are active. On tractable instances, we compare the lower bound with numerical white-box reference estimates; across multiple classifiers, the upper bound remains informative when standard attacks fail. We further demonstrate real-device feasibility on IBM Quantum hardware: from 40 executions of two 8-qubit quantum neural networks, our method estimates both bounds, with the expected lower-upper ordering on every tested input. Taken together, these results show that robustness claims for quantum classifiers can be audited directly from observable statistics under KRQA.

quant-pharXiv:2609.11637•Sep 11, 2026•0 citations

Measurement-Budget Allocation in Quantum Learning with Finite-Shot Generalization Guarantees

Ferhat Özgür Çatak

On near-term quantum hardware, estimating a Born probability requires repeated circuit executions. A quantum learning experiment with a fixed measurement budget $B$ must therefore decide how many distinct training states $n$ to use and how many shots $S$ to allocate to each state. We study this tradeoff for binary quantum classifiers with fixed or independently selected measurement operators $M$, where the ideal score is $Tr(M\rho)$. We prove a distribution-free generalization bound that separates the finite-sample and finite-shot contributions. The sample term scales as $\sqrt{d/n}$, while the shot term scales as $\sqrt{(\log n)/S}$; under the constraint $B=nS$, these two terms move in opposite directions. Minimising a conservative closed-form surrogate of the bound gives the allocation rule $n^{*} = 2\sqrt{2dB/\log(2B/\delta)}$ and $S^{*} = B/nstar$. This surrogate has the same asymptotic scaling as the exact minimizer and yields a worst-case rate of $B^{-1/4}$. The guarantee is intentionally conservative, since it applies to the full class of binary quantum measurements. We complement the theory with PennyLane simulations using 2-qubit and 4-qubit variational quantum circuits on nine synthetic binary classification benchmarks. In all tested configurations, the one-sided empirical generalization gap remains below the theoretical bound. The result provides a conservative statistical guideline for allocating measurement budgets in finite-shot evaluation and pre-experimental planning for near-term quantum learning systems, complementing hardware-level scheduling and circuit-design considerations. Extending the guarantee to fully adaptive shot-noisy training remains an open problem.

arXiv:2608.24891•Jun 1, 2026•0 citations

Certification cost of quantum models: measurement correlation, not parameter count

Pavel Sulimov, Claude Lehmann

Reporting the Fisher geometry of a trained variational quantum model is routine; quoting the shot budget that would establish it is not. Certifying an empirical Fisher matrix to relative Frobenius error $\varepsilon$ under coordinate-wise parameter shift costs $Θ(B p^{2} V/(\varepsilon^{2} G))$ circuit executions, where $V$ is the measured readout variance and $G$ the measured squared gradient norm, with uniform allocation optimal in that class. One constant reproduces the cost of two circuit families whose exponents differ by a full power of $p$. The exponent is an identity in how $nV$ and $nG$ scale with the register, holding family by family to $0.001$ across 624 matrix-product-state cells once the finite-$p$ prefactor is removed. The cubic cost is therefore a finite-size window, set by whether the readout light cone grows with the register. A product family to 256 qubits gives $1.966$ (95% CI $1.934$--$1.997$); a brickwork entangler falls from $2.853$ below ten qubits to $1.715$ beyond sixty-four; a blocked entangler gives $1.984$ at a fixed cone width against $3.034$ at a proportional one. Fixed device connectivity fixes the cone, so a cubic budget from a small simulation overestimates a large machine, on top of hardware multipliers $2.07\times$ ($1.41$--$3.02$), $2.38\times$ and $1.91\times$ on ibm_marrakesh, ibm_fez and ibm_kingston. Cost-optimal readout weights cut the measured shot budget by $2.67\times$ ($1.33$--$4.00$) on hardware, flat from four to twelve qubits. A discrepancy model fitted on cheap circuits transfers its mean inside the calibration grid and, at six larger sizes named before the data, does not: nominal 90% intervals cover 36%, and split conformal is the only rung that stays near nominal.

quant-pharXiv:2609.14424•Sep 15, 2026•0 citations

Adaptive directional gradients for parameterised quantum circuits

Brian Coyle, Snehal Raj, Virag Umathe +2 more

Training parameterised quantum circuits (PQCs) on quantum hardware is bottlenecked by the measurement cost of gradient estimation, which under the parameter-shift rule scales linearly in the number of trainable parameters and dominates the total shot budget of training at scale. In this work, we propose a framework of forward gradient estimators for PQCs, based on the forward mode of automatic differentiation, that yields an unbiased estimator of the gradient by averaging a freely tunable number of random directional derivatives and recovers SPSA, random coordinate descent, and the parameter-shift rule as limiting cases, with no ancilla qubits or controlled-gate overhead. We prove that stochastic quantum forward gradient descent converges under standard assumptions, with an explicit second-moment expansion that interpolates between the single-direction extreme of SPSA and the full-gradient extreme of parameter-shift. Within this framework we derive QUIVER (Quantum Iterative V-adaptive Estimator Rule), an adaptive optimiser for parameterised circuits whose update rule follows from a closed-form minimum measurement-cost allocation. We show numerically that forward gradients train Hamming-weight-preserving orthogonal quantum neural networks with up to 60 qubits and 1770 parameters on the ECG5000 and MNIST datasets orders of magnitude more efficiently than the parameter-shift rule. We also demonstrate that our proposed QUIVER optimiser can outperform iCANS and gCANS measurement-frugal optimisers on optimisation problems using the quantum approximate optimisation algorithm and quantum simulation with the variational quantum eigensolver.

quant-pharXiv:2606.09734•Jun 9, 2026•0 citations
Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics (shot noise) act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. Under stated assumptions, single-step attacks need at least quadratically many shots in the input dimension ddd, growing as d5/2d^{5/2}d5/2 under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the d5/2d^{5/2}d5/2 geometric floor for plateau-mitigated models and grows as d3.00d^{3.00}d3.00 for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in recovers the parameter-free d3/2d^{3/2}d3/2 shot-noise geometry. Against a matched classical baseline whose attack overhead is dimension-independent (the cheap-gradient principle of automatic differentiation), the quantum gradient cost ratio grows empirically as d3.00d^{3.00}d3.00, so the attacker's relative cost diverges as the model scales. Experiments on a 156-qubit IBM processor (ibm_boston, 4-qubit circuits, d=12d=12d=12) reproduce the effect: at matched budgets the device attack tracks the ideal within a few percent, with the high-shot gradient faithful to the exact one. The defense operates precisely when the forward map is classically hard to simulate: only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.
The barren-plateau problem—the exponential flattening of optimization landscapes—severely limits the trainability of quantum neural networks (QNNs) on near-term hardware. This review examines ansatz-design and complementary mitigation strategies for few-qubit QNNs under finite-shot noisy intermediate-scale quantum (NISQ) constraints. Its primary conceptual contribution is a literature-grounded reframing of gradient-based trainability around pointwise finite-shot gradient signal-to-noise ratio (SNR) while retaining exact-gradient landscape variance as a complementary theoretical diagnostic. This reframing follows because gradient-based optimization acts on finite-shot gradient estimates whose statistical resolvability directly determines whether the optimizer receives a reliably distinguishable update signal, whereas numerical studies restricted to 2–10 qubits generally cannot establish asymptotic exponential or polynomial gradient-decay laws without theoretical support. Estimator SNR therefore addresses the immediate experimental question of whether the update signal is distinguishable from its sampling uncertainty, whereas exact-gradient variance characterizes landscape concentration. The review surveys ansatz design, parameter initialization, cost-function selection, and error management, and develops a conditional design heuristic: problem-inspired ansätze are preferred when the task maps onto circuit families with demonstrated trainability properties; otherwise, shallow hardware-efficient ansätze provide controlled baselines. As a secondary contribution, the review proposes a complete eight-configuration 2 3 factorial framework for evaluating interactions among restricted entanglement, local cost functions, and active residual shortcuts under matched measurement budgets. An exact identity motivates testing the interaction between restricted entanglement and local costs at the exact-gradient-signal level, but the interaction is tested two-sided; all estimator-SNR interactions remain open empirical questions. The framework is presented as an implementable research agenda enabled by the SNR perspective rather than as evidence that any interaction has been established.
The interplay between quantum physics and machine learning gives rise to the emergent frontier of quantum machine learning, where advanced quantum learning models may outperform their classical counterparts in solving certain challenging problems. However, quantum learning systems are vulnerable to adversarial attacks: adding tiny carefully crafted perturbations on legitimate input samples can cause misclassifications. To address this problem, we propose an effective approach to protect quantum learning systems from adversarial attacks by randomly encoding the legitimate data samples through unitary or quantum error correction encoders that are unknown to the attackers. In particular, we rigorously prove that both global and local random unitary encoders lead to exponentially vanishing gradients (i.e., barren plateaus) for any variational quantum circuits that aim to add adversarial perturbations, independent of the input data and the inner structures of adversarial circuits and quantum classifiers. In addition, we prove a rigorous bound on the vulnerability of quantum classifiers under local unitary adversarial attacks. We show that random black-box quantum error correction encoders can protect quantum classifiers against local adversarial noises and their robustness increases as we concatenate error correction codes. To quantify the robustness enhancement, we adapt quantum differential privacy as a measure of the prediction stability for quantum classifiers. Our results establish versatile defense strategies for quantum classifiers against adversarial perturbations, which provide valuable guidance to enhance the reliability and security for both near-term and future quantum learning technologies. Published by the American Physical Society 2024
A quantum classifier assigns labels by evolving an input quantum state and measuring the output, so repeated executions reveal only a distribution over labels. We study certified adversarial robustness for such classifiers under known-readout query access (KRQA), where an evaluator can prepare inputs, knows the quantum measurement, and observes finite-shot outcomes but cannot inspect the internal evolution, parameters, or gradients. We give a measurement-only framework that returns two complementary guarantees for each input: a lower bound ruling out untargeted errors within a radius, and an attack-independent upper bound witnessing an adversarial state within a radius. Both are estimable from the known readout measurement and sampled outcomes, require no tomography or circuit description, and have finite-sample control of probability-estimation error. The upper bound uses gap operators induced by the quantum measurement; the lower bound relaxes state-space search to an efficient optimization over outcome distributions with operator-spectrum constraints, yielding certificates that are never weaker than prior probability-only certificates and can be strictly stronger when the spectral constraints are active. On tractable instances, we compare the lower bound with numerical white-box reference estimates; across multiple classifiers, the upper bound remains informative when standard attacks fail. We further demonstrate real-device feasibility on IBM Quantum hardware: from 40 executions of two 8-qubit quantum neural networks, our method estimates both bounds, with the expected lower-upper ordering on every tested input. Taken together, these results show that robustness claims for quantum classifiers can be audited directly from observable statistics under KRQA.
On near-term quantum hardware, estimating a Born probability requires repeated circuit executions. A quantum learning experiment with a fixed measurement budget BBB must therefore decide how many distinct training states nnn to use and how many shots SSS to allocate to each state. We study this tradeoff for binary quantum classifiers with fixed or independently selected measurement operators MMM, where the ideal score is Tr(Mρ)Tr(M\rho)Tr(Mρ). We prove a distribution-free generalization bound that separates the finite-sample and finite-shot contributions. The sample term scales as d/n\sqrt{d/n}d/n​, while the shot term scales as (log⁡n)/S\sqrt{(\log n)/S}(logn)/S​; under the constraint B=nSB=nSB=nS, these two terms move in opposite directions. Minimising a conservative closed-form surrogate of the bound gives the allocation rule n∗=22dB/log⁡(2B/δ)n^{*} = 2\sqrt{2dB/\log(2B/\delta)}n∗=22dB/log(2B/δ)​ and S∗=B/nstarS^{*} = B/nstarS∗=B/nstar. This surrogate has the same asymptotic scaling as the exact minimizer and yields a worst-case rate of B−1/4B^{-1/4}B−1/4. The guarantee is intentionally conservative, since it applies to the full class of binary quantum measurements. We complement the theory with PennyLane simulations using 2-qubit and 4-qubit variational quantum circuits on nine synthetic binary classification benchmarks. In all tested configurations, the one-sided empirical generalization gap remains below the theoretical bound. The result provides a conservative statistical guideline for allocating measurement budgets in finite-shot evaluation and pre-experimental planning for near-term quantum learning systems, complementing hardware-level scheduling and circuit-design considerations. Extending the guarantee to fully adaptive shot-noisy training remains an open problem.
Reporting the Fisher geometry of a trained variational quantum model is routine; quoting the shot budget that would establish it is not. Certifying an empirical Fisher matrix to relative Frobenius error ε\varepsilonε under coordinate-wise parameter shift costs Θ(Bp2V/(ε2G))Θ(B p^{2} V/(\varepsilon^{2} G))Θ(Bp2V/(ε2G)) circuit executions, where VVV is the measured readout variance and GGG the measured squared gradient norm, with uniform allocation optimal in that class. One constant reproduces the cost of two circuit families whose exponents differ by a full power of ppp. The exponent is an identity in how nVnVnV and nGnGnG scale with the register, holding family by family to 0.0010.0010.001 across 624 matrix-product-state cells once the finite-ppp prefactor is removed. The cubic cost is therefore a finite-size window, set by whether the readout light cone grows with the register. A product family to 256 qubits gives 1.9661.9661.966 (95% CI 1.9341.9341.934--1.9971.9971.997); a brickwork entangler falls from 2.8532.8532.853 below ten qubits to 1.7151.7151.715 beyond sixty-four; a blocked entangler gives 1.9841.9841.984 at a fixed cone width against 3.0343.0343.034 at a proportional one. Fixed device connectivity fixes the cone, so a cubic budget from a small simulation overestimates a large machine, on top of hardware multipliers 2.07×2.07\times2.07× (1.411.411.41--3.023.023.02), 2.38×2.38\times2.38× and 1.91×1.91\times1.91× on ibm_marrakesh, ibm_fez and ibm_kingston. Cost-optimal readout weights cut the measured shot budget by 2.67×2.67\times2.67× (1.331.331.33--4.004.004.00) on hardware, flat from four to twelve qubits. A discrepancy model fitted on cheap circuits transfers its mean inside the calibration grid and, at six larger sizes named before the data, does not: nominal 90% intervals cover 36%, and split conformal is the only rung that stays near nominal.
Training parameterised quantum circuits (PQCs) on quantum hardware is bottlenecked by the measurement cost of gradient estimation, which under the parameter-shift rule scales linearly in the number of trainable parameters and dominates the total shot budget of training at scale. In this work, we propose a framework of forward gradient estimators for PQCs, based on the forward mode of automatic differentiation, that yields an unbiased estimator of the gradient by averaging a freely tunable number of random directional derivatives and recovers SPSA, random coordinate descent, and the parameter-shift rule as limiting cases, with no ancilla qubits or controlled-gate overhead. We prove that stochastic quantum forward gradient descent converges under standard assumptions, with an explicit second-moment expansion that interpolates between the single-direction extreme of SPSA and the full-gradient extreme of parameter-shift. Within this framework we derive QUIVER (Quantum Iterative V-adaptive Estimator Rule), an adaptive optimiser for parameterised circuits whose update rule follows from a closed-form minimum measurement-cost allocation. We show numerically that forward gradients train Hamming-weight-preserving orthogonal quantum neural networks with up to 60 qubits and 1770 parameters on the ECG5000 and MNIST datasets orders of magnitude more efficiently than the parameter-shift rule. We also demonstrate that our proposed QUIVER optimiser can outperform iCANS and gCANS measurement-frugal optimisers on optimisation problems using the quantum approximate optimisation algorithm and quantum simulation with the variational quantum eigensolver.