Robust quantum classifiers via NISQ adversarial learning

Maxwell West, Neil Dowling, Angus Southwell +4 more

Satwik Kundu, Swaroop Ghosh

Haoran Liao, Ian Convy, William J. Huggins +1 more

State-of-the-art classical neural networks are observed vulnerable to small crafted adversarial perturbations. Similar behaviors are followed by quantum machine learning models classifying Haar-random pure states, in that they exhibit exponentially decreasing robustness in the number of qubits against adversarial perturbations. This stems from the concentration of measure phenomenon, a property of the metric space when sampled probabilistically, and is independent of the classification protocol. In this paper, we discuss these vulnerabilities in classifying Haar-random pure states, as well as in classifying a subset of encoded states smoothly generated from a Gaussian latent space. We derive the prediction-change potential adversarial robustness of any quantum classifier in this setting resulted from the measure concentration in the latent space. Our analysis provides insights into the adversarial robustness of any quantum classifier in real-world classification tasks, and by contrast, shows only mildly polynomially decreasing potential robustness in the number of qubits.

Nicola Franco, Aman Saxena, Tom Wollschläger +3 more

Weiyuan Gong, Yuan Dong, Weikang Li +1 more

The interplay between quantum physics and machine learning gives rise to the emergent frontier of quantum machine learning, where advanced quantum learning models may outperform their classical counterparts in solving certain challenging problems. However, quantum learning systems are vulnerable to adversarial attacks: adding tiny carefully crafted perturbations on legitimate input samples can cause misclassifications. To address this problem, we propose an effective approach to protect quantum learning systems from adversarial attacks by randomly encoding the legitimate data samples through unitary or quantum error correction encoders that are unknown to the attackers. In particular, we rigorously prove that both global and local random unitary encoders lead to exponentially vanishing gradients (i.e., barren plateaus) for any variational quantum circuits that aim to add adversarial perturbations, independent of the input data and the inner structures of adversarial circuits and quantum classifiers. In addition, we prove a rigorous bound on the vulnerability of quantum classifiers under local unitary adversarial attacks. We show that random black-box quantum error correction encoders can protect quantum classifiers against local adversarial noises and their robustness increases as we concatenate error correction codes. To quantify the robustness enhancement, we adapt quantum differential privacy as a measure of the prediction stability for quantum classifiers. Our results establish versatile defense strategies for quantum classifiers against adversarial perturbations, which provide valuable guidance to enhance the reliability and security for both near-term and future quantum learning technologies. Published by the American Physical Society 2024

Haoran Liao, Ian Convy, William J. Huggins +1 more

State-of-the-art classical neural networks are observed to be vulnerable to small crafted adversarial perturbations. A more severe vulnerability has been noted for quantum machine learning (QML) models classifying Haar-random pure states. This stems from the concentration of measure phenomenon, a property of the metric space when sampled probabilistically, and is independent of the classification protocol. To provide insights into the adversarial robustness of a quantum classifier on real-world classification tasks, we focus on the adversarial robustness in classifying a subset of encoded states that are smoothly generated from a Gaussian latent space. We show that the vulnerability of this task is considerably weaker than that of classifying Haar-random pure states. In particular, we find only mildly polynomially decreasing robustness in the number of qubits, in contrast to the exponentially decreasing robustness when classifying Haar-random pure states and suggesting that QML models can be useful for real-world classification tasks.