Quantum classifiers are vulnerable to adversarial attacks that manipulate their input classical or quantum data. A promising countermeasure is adversarial training, where quantum classifiers are trained by using an attack-aware, adversarial loss function. This work establishes novel bounds on the generalization error of adversarially trained quantum classifiers when tested in the presence of perturbation-constrained adversaries. The bounds quantify the excess generalization error incurred to ensure robustness to adversarial attacks as scaling with the training sample size $m$ as $1/\sqrt{m}$ , while yielding insights into the impact of the quantum embedding. For quantum binary classifiers employing \textit{rotation embedding}, we find that, in the presence of adversarial attacks on classical inputs $\mathbf{x}$ , the increase in sample complexity due to adversarial training over conventional training vanishes in the limit of high dimensional inputs $\mathbf{x}$ . In contrast, when the adversary can directly attack the quantum state $ρ(\mathbf{x})$ encoding the input $\mathbf{x}$ , the excess generalization error depends on the choice of embedding only through its Hilbert space dimension. The results are also extended to multi-class classifiers. We validate our theoretical findings with numerical experiments.Quantum classifiers are vulnerable to adversarial attacks that manipulate their input classical or quantum data. A promising countermeasure is adversarial training, where quantum classifiers are trained by using an attack-aware, adversarial loss function. This work establishes novel bounds on the generalization error of adversarially trained quantum classifiers when tested in the presence of perturbation-constrained adversaries. The bounds quantify the excess generalization error incurred to ensure robustness to adversarial attacks as scaling with the training sample size $m$ as $1/\sqrt{m}$, while yielding insights into the impact of the quantum embedding. For quantum binary classifiers employing \textit{rotation embedding}, we find that, in the presence of adversarial attacks on classical inputs $\mathbf{x}$, the increase in sample complexity due to adversarial training over conventional training vanishes in the limit of high dimensional inputs $\mathbf{x}$. In contrast, when the adversary can directly attack the quantum state $ρ(\mathbf{x})$ encoding the input $\mathbf{x}$, the excess generalization error depends on the choice of embedding only through its Hilbert space dimension. The results are also extended to multi-class classifiers. We validate our theoretical findings with numerical experiments.

arXiv:2504.17690Apr 24, 20250 citations

Adversarial Robustness in Quantum Machine Learning

Nicola Franco, Aman Saxena, Tom Wollschläger +3 more

Quantum science and technologyJan 1, 20260 citations

Recent advances for quantum classifiers

Weikang Li, Dong-Ling Deng

arXiv:2108.13421Science China Physics Mechanics and AstronomyDec 2, 2021103 citations

Adversarial Quantum Machine Learning: An Information-Theoretic Generalization Analysis

Petros Georgiou, Sharu Theresa Jose, Osvaldo Simeone

In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input state $\rho(x)$ into a state $\tau$ that is $\epsilon$ -close to the original state $\rho(x)$ in p-Schatten distance. Under suitable assumptions on the quantum embedding $\rho(x)$ , we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for $p=1$ and $p=\infty$ . The derived upper bounds consist of two terms: the first is an exponential function of the 2-Renyi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size $\epsilon$ . Both terms are shown to decrease as $1/\sqrt{T}$ over the training set size $T$ . An extension is also considered in which the adversary assumed during training has different parameters $p$ and $\epsilon$ as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input state$\rho(x)$into a state$\tau$that is$\epsilon$-close to the original state$\rho(x)$in p-Schatten distance. Under suitable assumptions on the quantum embedding$\rho(x)$, we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for$p=1$and$p=\infty$. The derived upper bounds consist of two terms: the first is an exponential function of the 2-Renyi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size$\epsilon$. Both terms are shown to decrease as$1/\sqrt{T}$over the training set size$T$. An extension is also considered in which the adversary assumed during training has different parameters$p$and$\epsilon$as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.

arXiv:2402.00176IEEE International Symposium on Information Theory (ISIT)Jul 7, 20246 citations

m

1/\sqrt{m}

, while yielding insights into the impact of the quantum embedding. For quantum binary classifiers employing \textit{rotation embedding}, we find that, in the presence of adversarial attacks on classical inputs

\mathbf{x}

, the increase in sample complexity due to adversarial training over conventional training vanishes in the limit of high dimensional inputs

\mathbf{x}

. In contrast, when the adversary can directly attack the quantum state

ρ(\mathbf{x})

encoding the input

\mathbf{x}

, the excess generalization error depends on the choice of embedding only through its Hilbert space dimension. The results are also extended to multi-class classifiers. We validate our theoretical findings with numerical experiments.

\rho(x)

into a state

\tau

that is

\epsilon

-close to the original state

\rho(x)

in p-Schatten distance. Under suitable assumptions on the quantum embedding

\rho(x)

, we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for

p=1

and

p=\infty

. The derived upper bounds consist of two terms: the first is an exponential function of the 2-Renyi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size

\epsilon

. Both terms are shown to decrease as

1/\sqrt{T}

over the training set size

T

. An extension is also considered in which the adversary assumed during training has different parameters

p

and

\epsilon

as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.