PaperlayerView exact revision on arXiv

Source-linked AI summary

Quantum Adversarial Machine Learning

Sirui Lu, Lu-Ming Duan, Dong-Ling Deng

arXiv:2001.00030v1quant-phcond-mat.dis-nncond-mat.str-elcs.CV

TL;DR

Quantum machine-learning classifiers may not be robust to adversarial manipulation, raising a reliability question for their use with classical and quantum data. The paper studies this through simulations of quantum classifiers and multiple attack settings, finding that imperceptible perturbations can cause high-confidence errors across diverse tasks while attack-informed defenses improve robustness in supported cases.

  • Problem

    The paper asks whether quantum classifiers are robust to adversarial perturbations, an important unresolved reliability question for quantum machine learning.

  • Method

    The paper numerically evaluates quantum classifiers on classical and quantum data using multiple white-box and black-box attack strategies, then studies adversarial training as a defense.

  • Results

    Quantum classifiers are vulnerable across diverse scenarios: imperceptible perturbations can induce incorrect, high-confidence predictions, including on MNIST, topological-phase data, and quantum data.

  • Takeaways & Limitations

    Adversarial examples expose a practical reliability concern for quantum classifiers, while adversarial training can increase robustness against the attack represented in training.

Abstract

from arXiv · show

Adversarial machine learning is an emerging field that focuses on studying vulnerabilities of machine learning approaches in adversarial settings and developing techniques accordingly to make learning robust to adversarial manipulations. It plays a vital role in various machine learning applications and has attracted tremendous attention across different communities recently. In this paper, we explore different adversarial scenarios in the context of quantum machine learning. We find that, similar to traditional classifiers based on classical neural networks, quantum learning systems are likewise vulnerable to crafted adversarial examples, independent of whether the input data is classical or quantum. In particular, we find that a quantum classifier that achieves nearly the state-of-the-art accuracy can be conclusively deceived by adversarial examples obtained via adding imperceptible perturbations to the original legitimate samples. This is explicitly demonstrated with quantum adversarial learning in different scenarios, including classifying real-life images (e.g., handwritten digit images in the dataset MNIST), learning phases of matter (such as, ferromagnetic/paramagnetic orders and symmetry protected topological phases), and classifying quantum data. Furthermore, we show that based on the information of the adversarial examples at hand, practical defense strategies can be designed to fight against a number of different attacks. Our results uncover the notable vulnerability of quantum machine learning systems to adversarial perturbations, which not only reveals a novel perspective in bridging machine learning and quantum physics in theory but also provides valuable guidance for practical applications of quantum classifiers based on both near-term and future quantum technologies.

I. INTRODUCTION

Quantum machine learning connects quantum physics with machine learning, but the reliability of quantum classifiers under adversarial perturbations was largely unexplored. This paper studies that vulnerability across diverse data and attack settings and finds that quantum classifiers can be deceived by imperceptible crafted perturbations.

  • Motivation: Quantum machine learning combines machine-learning advances with quantum-computing opportunities to address problems in quantum science and develop quantum-enhanced learning.The paper situates quantum learning at the intersection of two rapidly developing fields.
  • Classical background: Classical models can misclassify inputs after imperceptible, carefully crafted changes, motivating adversarial learning and robustness research.The paper uses the panda-to-gibbon example as a representative case of this vulnerability.
  • Quantum learning: Quantum learning algorithms exploit superposition and entanglement and include quantum principal component analysis, quantum support-vector machines, and quantum generative models.These approaches promise potential advantages over classical counterparts, although the passage presents this as a research opportunity rather than an established outcome.
  • Paper scope: The paper investigates whether quantum classifiers are vulnerable to carefully crafted adversarial examples, using numerical simulations across classical, experimental-style, and quantum data.The studied data include MNIST images, simulated cold-atom time-of-flight images, and quantum data from a transverse-field Ising model.
  • Defense: Adversarial training is presented as a practical strategy that can increase a quantum classifier’s robustness against the corresponding attacks.The paper reports this defense in conjunction with several white-box and black-box attack strategies.

II. CLASSICAL ADVERSARIAL LEARNING AND QUANTUM CLASSIFIERS: CONCEPTS AND NOTATIONS

This section introduces adversarial learning concepts and the quantum-classifier architecture used in the paper. It defines constrained input perturbations, attack categories, quantum data encoding, variational circuits, and measurement-based prediction.

  • Adversarial learning: Adversarial-example generation fixes the model parameters and optimizes a small input perturbation that maximizes the loss under a domain-specific constraint.A common constraint is the ℓp-norm bound ||δ||p ≤ ϵ.
  • Attack taxonomy: The paper studies FGSM, BIM, PGD, and MIM for white-box attacks, along with transfer, substitute-model, and ZOO attacks for black-box settings.These methods represent the attack strategies selected for the paper’s numerical investigations.
  • Adversarial learning: Adversarial examples are crafted inputs designed to cause a machine-learning model to make incorrect predictions, motivating defenses such as adversarial training.The paper distinguishes attacks by timing, attacker information, and goals.
  • Quantum classifiers: The classifier uses layered single-qubit rotations and entanglers, then obtains class probabilities from output-qubit measurements.The circuit parameters are trained by minimizing a loss function over labeled data.
  • Open question: Quantum classifiers address an open reliability question because their robustness to adversarial perturbations had remained largely unexplored.The paper frames this question as relevant to both theory and experiments, including noisy intermediate-scale quantum devices.

III. VULNERABILITY OF QUANTUM CLASSIFIERS

The paper applies adversarial-learning methods to quantum classifiers in diverse settings to demonstrate their vulnerability. The section previews examples involving multiple data types and attack scenarios.

  • Section scope: The vulnerability study combines quantum-classifier training methods with adversarial-perturbation procedures and evaluates concrete examples across diverse scenarios.The detailed attack methods and examples are developed in the following sections.
  • Section scope: The paper’s adversarial analysis is designed to show that quantum classifiers can be attacked rather than merely describe a general threat model.The section explicitly presents the subsequent examples as demonstrations of vulnerability.
  • Section scope: The section connects the classifier construction, attack generation, and application-specific demonstrations into one vulnerability analysis.This provides the organizational bridge from concepts and notations to the paper’s experiments.

A. Quantum classifiers: training and adversarial attacks

Quantum classifiers encode inputs into quantum states, process them with parameterized rotation-and-entanglement circuits, and predict labels from measurements. Adversarial attacks then optimize small input-state perturbations against the trained classifier.

  • Input encoding: Classical inputs are converted into n-qubit states through amplitude or qubit encoding before entering the quantum classifier.The paper focuses on amplitude encoding, while noting that qubit encoding is a straightforward alternative.
  • Circuit architecture: The hardware-efficient classifier applies p layers of single-qubit Euler rotations and entanglers to generate a parameterized variational state.The entangler uses controlled operations, and the circuit can approximate desired functions when sufficiently deep.
  • Prediction and training: Output-qubit measurement statistics provide class probabilities, and the label is selected from those predicted probabilities.Training updates the variational parameters to minimize the chosen loss over the training set.
  • Prediction and training: The classifier is trained by iterative parameter optimization, with Adam used as an adaptive learning-rate optimizer in the reported implementation.The paper also notes that exact measurement-based gradients are available for the circuit structure.
  • Adversarial attacks: Adversarial generation searches for a small perturbation of the encoded input state that maximizes loss for untargeted attacks or minimizes it toward a chosen label for targeted attacks.The trained parameters remain fixed during this input-space optimization.
  • Adversarial attacks: Perturbations can be restricted to local unitaries close to identity, and automatic differentiation is used to implement this attack type in the simulations.The simulations run on CPUs or GPUs using Julia and Yao.jl-based tooling.

B. Quantum adversarial learning images

The paper evaluates quantum classifiers on MNIST images, achieving high clean-data accuracy before testing their vulnerability to adversarial examples in white-box settings.

  • MNIST classification: The MNIST experiments use quantum classifiers to distinguish handwritten digits in two-category and four-category tasks.The two-category task uses digits 1 and 9; the four-category task uses digits 1, 3, 7, and 9.
  • MNIST classification: 98% test accuracy is achieved for the two-category classifier after around fifteen training epochs.The two-category dataset contains 11,633 training, 1,058 validation, and 2,144 testing samples.
  • MNIST classification: 91.6% test accuracy is achieved for the four-category classifier, while training and validation accuracies saturate near 92%.The four-category experiment uses a deeper classifier and can require additional computational resources for further accuracy improvements.
  • Adversarial evaluation: The study fixes the trained classifier parameters and examines adversarial examples under both white-box and black-box attack scenarios.White-box experiments include targeted and untargeted attacks, while black-box experiments use transferability and zeroth-order optimization.
  • Adversarial evaluation: Basic iterative additive attacks produce adversarial digit images that are visually almost indistinguishable from clean images while causing high-confidence misclassification.For the illustrated examples, clean-image prediction confidence exceeds 78%, and the average fidelity after attack is 0.916.

1. White-box attack: untargeted

White-box untargeted attacks substantially reduce quantum-classifier accuracy using additive perturbations, while functional attacks are more experimentally practical but less effective.

  • Additive attacks: White-box attackers use classifier information and gradients to generate perturbations with FGSM, BIM, PGD, and MIM.The attacker is assumed to know the loss function and quantum-classifier parameters.
  • Additive attacks: Additive attacks show decreasing accuracy as average fidelity decreases and as the number of attack iterations increases.The same qualitative behavior is reported for both two-category and four-category handwritten-digit classifiers.
  • Additive attacks: After five BIM iterations, additive attacks reduce two-category accuracy to zero while average fidelity remains above 0.73.The attacked images differ from legitimate samples by perturbations that can remain relatively small in the quantum state space.
  • Additive attacks: Both BIM and FGSM perform noticeably well against two-category and four-category quantum classifiers in the white-box untargeted setting.Table I compares their average fidelity and accuracy under specified iteration and step-size settings.
  • Functional attacks: Functional attacks restrict perturbations to local unitary layers, reducing the search space and making implementation in quantum laboratories easier.The local unitaries are constrained to remain close to identity operators so that perturbations stay reasonably small.
  • Functional attacks: After six functional-attack BIM iterations, residual accuracy remains about 14% at average fidelity 0.2, unlike additive attacks reaching zero accuracy above 0.73 fidelity.The lower effectiveness is consistent with the smaller search space of functional attacks.

2. White-box attack: targeted

White-box targeted attacks can steer the four-category quantum classifier toward chosen digit labels using nearly imperceptible image changes. BIM attacks progressively shift classification probabilities and can drive accuracy to zero while retaining average fidelity above 0.85.

  • Targeted adversarial examples: Targeted BIM attacks changed correctly classified MNIST digits {1, 3, 7, 9} into selected labels {9, 3, 7, 7} with nearly imperceptible differences.The legitimate samples were initially classified correctly with high confidence, whereas the crafted images were assigned targeted labels with decent high confidence.
  • Targeted adversarial examples: After about six BIM iterations, P(y = 3) exceeded P(y = 1), showing that the classifier began predicting the image as digit 3.The loss for classifying the image as digit 1 increased while the loss for digit 3 decreased.
  • Attack strength and fidelity: Table II compares BIM and FGSM additive attacks against the four-category quantum classifier for different targeted labels.The table reports adversarial accuracy and average fidelity for the attacked test dataset.
  • Attack strength and fidelity: Accuracy decreased to zero while average fidelity remained larger than 0.85, indicating that all images were classified incorrectly as the targeted digit.This result was obtained for additive attacks across images with original labels {1, 3, 7, 9} and different targeted labels.

3. Black-box attack: transferability

Black-box attacks test whether adversarial examples generated without access to a quantum classifier’s internals can transfer from classical models. Such transfer occurs despite the quantum classifier’s structurally different architecture.

  • Black-box setting: Black-box attacks assume limited or no information about the victim classifier’s internal structure and learning algorithm.Transferability and probing are described as premises that make black-box attacks possible.
  • Transferability procedure: The study generated white-box untargeted adversarial examples with BIM, FGSM, and MIM for CNN and feedforward classical classifiers, then tested them on the quantum classifier.The examples were produced separately for each classical model using MNIST training data.
  • Transferability results: 62.3% quantum-classifier accuracy on CNN-MIM adversarial examples was 29.7% lower than on clean samples.The paper interprets this difference as roughly 29.7% of the adversarial examples transferring to the quantum classifier.
  • Transferability results: Adversarial examples transferred to the quantum classifier despite the quantum model having a completely different structure from the classical source classifiers.The paper notes that transferability might increase when a quantum classifier is used as the surrogate model.

4. Adversarial perturbations are not random noises

Quantum-classifier performance responds differently to engineered adversarial perturbations and random depolarizing noise. Depolarizing noise reduces accuracy roughly linearly with noise strength and fidelity, while adversarial-example augmentation improves performance more than random-noise augmentation.

  • Adversarial versus random perturbations: For almost all MNIST handwritten digits, at least one adversarial example exists, and these perturbations are carefully engineered rather than random noise.The paper emphasizes that adversarial examples exploit directed changes to the input rather than arbitrary disturbances.
  • Depolarizing noise: Depolarizing noise was modeled through qubit density states, Pauli matrices, and a decoherence-strength parameter β ∈[0, 1].The parameter β characterizes the strength of the decoherence noises.
  • Depolarizing noise: Accuracy for both two- and four-category quantum classifiers decreased roughly linearly as depolarizing noise strength increased and average fidelity decreased.The accuracy-fidelity relationship was evaluated for states affected by a single depolarizing-noise layer on each qubit.
  • Training setup: The topological/nontopological classifier was trained with Adam using batch size 512 and learning rate 0.005 over 19,956 training samples and 6,652 validation samples.The classifier used depth p = 10 and minimized the loss function in Eq. (2).
  • Training defense: Adversarial-example augmentation produced noticeably better quantum-classifier performance than augmentation with random-noise samples.This comparison supports treating adversarial perturbations as distinct from ordinary random noise during training.

C. Quantum adversarial learning topological phases of matter

Quantum classifiers can learn topological phases from time-of-flight images, yet remain vulnerable to adversarial perturbations despite topological phases being characterized by nonlocal invariants. White-box attacks substantially reduce classification accuracy using perturbations that can be imperceptible.

  • Adversarial vulnerability: Tiny imperceptible perturbations can transform clean time-of-flight images into adversarial examples for the quantum classifier.Figure 13 contrasts a legitimate lower-band momentum-space density distribution with its FGSM-generated counterpart.
  • Model and classification: The QAH Hamiltonian includes spin-orbit coupling, spin-conserved nearest-neighbor hopping, and on-site Zeeman interaction.Its topology is characterized in momentum space through the first Chern number.
  • Model and classification: Topological phases are classified using time-of-flight images labeled by the first Chern number C1.The QAH model has C1 = −sign(µ) for 0 < |µ| < 4t and C1 = 0 otherwise.
  • Adversarial vulnerability: Adversarial examples exist even for topological phases described by nonlocal invariants rather than local order parameters.The classifier is attacked in the white-box untargeted setting using additive perturbations.
  • Attack results: More than 60% of attacked test images are misclassified after about six attack iterations.The reported attacked accuracy falls below 0.4 after approximately six iterations.

D. Adversarial learning quantum data

Quantum classifiers can classify quantum states from the transverse-field Ising model, but adversarial perturbations also undermine this setting. White-box attacks drive accuracy sharply downward, including to zero after ten BIM iterations.

  • Quantum-data classification: The transverse-field Ising model has a phase transition at Jx = 1, separating paramagnetic Jx > 1 and ferromagnetic Jx < 1 phases.Ground states generated across Jx from 0 to 2 provide quantum inputs for classification.
  • Quantum-data classification: A quantum classifier is trained on ground states of the transverse-field Ising model to distinguish paramagnetic and ferromagnetic phases.The generated data are divided into training, validation, and testing sets.
  • Adversarial vulnerability: Quantum classifiers remain vulnerable to adversarial perturbations when the inputs are quantum data.The attack uses an additive, white-box, untargeted setting.
  • Attack results: Accuracy decreases to zero after ten BIM iterations, indicating that all slightly adjusted quantum states are misclassified.The effect occurs even for states far from the phase-transition point.

IV. DEFENSE: QUANTUM ADVERSARIAL TRAINING

Quantum adversarial training strengthens classifier robustness by generating adversarial examples and retraining on them alongside legitimate samples. Its protection remains attack-specific and is stronger against white-box than black-box attacks.

  • Defense strategy: Adversarial training injects crafted examples into the training set and retrains the classifier with both legitimate and adversarial samples.The approach uses robust optimization formulated as a min-max problem over worst-case input perturbations.
  • Implementation: Fig. 16 generates BIM adversarial examples with three iterations and step size 0.05 before training on clean and crafted samples.The illustrated quantum classifier has circuit depth ten.
  • Optimization procedure: The min-max procedure alternates between generating worst-case perturbations for current parameters and minimizing loss on those perturbed samples.The three-step process repeats until accuracy converges to a reasonable value.
  • Observed effect: Adversarial training increases robustness against the attack type used to generate its training examples.The MNIST experiment trains on 20,000 clean images plus corresponding adversarial images and tests on another 2,000 images.
  • Limitations: The trained classifier may perform poorly against different attack strategies, with greater robustness to white-box than black-box attacks because of gradient masking.The authors expect no universal defense that adapts to all attack types.

V. CONCLUSION AND OUTLOOK

The paper systematically demonstrates that quantum classifiers are vulnerable to imperceptible adversarial perturbations across classical and quantum data settings. It also outlines defense results and identifies broad unresolved questions about attacks and defenses in high-dimensional quantum learning.

  • Conclusion: Quantum classifiers can make highly confident incorrect predictions after tiny, imperceptible perturbations are added to classical or quantum inputs.The demonstrations include MNIST images, simulated time-of-flight images for topological phases, and quantum ground states for a phase transition.
  • Conclusion: The study develops adversarial-perturbation recipes across multiple attack settings and shows that adversarial training can address specific perturbation types.The conclusion distinguishes the demonstrated defense from a universal robustness guarantee.
  • Distinction from QGANs: Quantum adversarial learning differs from QGANs because QGANs use a generator and discriminator trained alternately in an adversarial game.The comparison clarifies that the two approaches refer to different learning setups.
  • Outlook: Future work must determine how to find adversarial perturbations and develop appropriate countermeasures for additional high-dimensional quantum learning problems.Examples include separability-entanglement classification, quantum state discrimination, Hamiltonian learning, and quantum state tomography.

Appendix A: Attack Algorithms

The appendix defines quantum-adapted attack algorithms for white-box and black-box settings. These methods use gradients, iterative updates, projections, functional unitary perturbations, or substitute models to construct adversarial examples.

  • Attack settings: Evasion attacks alter test-time samples without modifying training data, unlike poisoning attacks that compromise learning by injecting crafted training samples.The paper further classifies evasion attacks as additive or functional, targeted or untargeted, and white-box or black-box.
  • White-box attacks: White-box attacks assume full classifier information and exploit the loss gradient with respect to the input.This setting supports gradient-based adversarial-sample generation.
  • Q-FGSM: Q-FGSM creates an adversarial example by adding a perturbation bounded by ϵ in the componentwise sign direction of the input-loss gradient.The method normalizes the data vector when necessary for additive attacks and can use local-unitary parameters for functional attacks.
  • Q-BIM: Q-BIM iteratively applies small gradient-sign updates and projects each modified sample to normalize the wavefunction.Its pseudocode initializes the legitimate state, updates components for T iterations, applies π_C, and returns the final state.
  • Black-box attacks: Black-box attacks operate without full model or loss information and can use substitute classifiers trained on accessible data.The paper considers transfer attacks from CNN and FNN substitutes against the quantum classifier.
  • Substitute models: The appendix specifies CNN and feedforward architectures whose final softmax classifier predicts among four handwritten-digit categories: 1, 3, 7, and 9.The CNN includes convolutional, ReLU, flattening, and dropout components.
Loading 2001.00030v1…