PaperlayerView exact revision on arXiv

Source-linked AI summary

Quantum noise protects quantum classifiers against adversaries

Yuxuan Du, Min-Hsiu Hsieh, Tongliang Liu, Dacheng Tao, Nana Liu

arXiv:2003.09416v1quant-phcs.LG

TL;DR

Adversarial examples expose a robustness problem in quantum and classical classification, while quantum noise is usually treated as something to suppress. This paper uses depolarisation noise to obtain quantum differential privacy and robustness guarantees, showing that robustness increases with noise and can be independent of classifier details.

  • Problem

    Classification algorithms are vulnerable to small adversarial perturbations, motivating robustness guarantees that protect outputs from worst-case changes.

  • Method

    The paper adds depolarisation noise to quantum classification circuits and relates the resulting robustness guarantee to quantum differential privacy.

  • Results

    Robustness increases as depolarisation noise increases, while the quantum robustness bound depends only on the number of classes and not on the classifier or noise-injection location.

  • Takeaways & Limitations

    Quantum noise can protect quantum classifiers against arbitrary adversarial attacks and may provide a quantum advantage independent of quantum speedups.

Abstract

from arXiv · show

Noise in quantum information processing is often viewed as a disruptive and difficult-to-avoid feature, especially in near-term quantum technologies. However, noise has often played beneficial roles, from enhancing weak signals in stochastic resonance to protecting the privacy of data in differential privacy. It is then natural to ask, can we harness the power of quantum noise that is beneficial to quantum computing? An important current direction for quantum computing is its application to machine learning, such as classification problems. One outstanding problem in machine learning for classification is its sensitivity to adversarial examples. These are small, undetectable perturbations from the original data where the perturbed data is completely misclassified in otherwise extremely accurate classifiers. They can also be considered as `worst-case' perturbations by unknown noise sources. We show that by taking advantage of depolarisation noise in quantum circuits for classification, a robustness bound against adversaries can be derived where the robustness improves with increasing noise. This robustness property is intimately connected with an important security concept called differential privacy which can be extended to quantum differential privacy. For the protection of quantum data, this is the first quantum protocol that can be used against the most general adversaries. Furthermore, we show how the robustness in the classical case can be sensitive to the details of the classification model, but in the quantum case the details of classification model are absent, thus also providing a potential quantum advantage for classical data that is independent of quantum speedups. This opens the opportunity to explore other ways in which quantum noise can be used in our favour, as well as identifying other ways quantum algorithms can be helpful that is independent of quantum speedups.

I. INTRODUCTION

The paper asks whether quantum noise can protect classifiers against adversarial perturbations rather than merely disrupt computation. It proposes depolarisation noise as a route to quantum differential privacy and robustness, while framing classification and adversarial examples across classical and quantum settings.

  • Motivation: Noise is unavoidable in near-term quantum computing, motivating protocols that remain useful despite noise rather than only mitigating it.The introduction contrasts conventional noise reduction with studying noise as a potentially beneficial resource.
  • Problem: Adversarial examples are small, often imperceptible input perturbations that can cause otherwise accurate classifiers to misclassify.Such attacks represent unknown worst-case noise sources and remain difficult to address with guarantees against all adversaries.
  • Conceptual basis: Differential privacy links robustness to limiting how much an algorithm’s output changes under small changes to its input data.The paper uses this connection to motivate protection against adversarial examples, which are small changes that induce misclassification.
  • Approach: The paper proposes adding depolarisation noise to quantum classification circuits to induce quantum differential privacy and robustness against adversarial examples.The approach is presented as avoiding the need to invent a new classification algorithm.
  • Classification setting: A K-multiclass classifier maps classical or quantum input states to one of K finite class labels.In the quantum setting, a circuit estimates class probabilities from measurement outcomes, with finite sampling producing estimates of those probabilities.
  • Adversarial examples: Adversarial examples preserve the true label while changing the classifier’s assigned label after a sufficiently small perturbation.Classical inputs can use lp-norm distances, while quantum inputs use trace distance.

C. Differential privacy

The paper uses quantum differential privacy to connect depolarisation noise with robustness against adversarial perturbations. Increasing depolarisation improves the privacy budget and enlarges the certified robustness range, while the bound is largely independent of circuit details.

  • Definitions: Differential privacy quantifies how sensitive algorithm outputs are to small input changes, with a smaller privacy budget indicating less output variation.For quantum data, the paper uses trace distance to measure input separation.
  • Noise-induced privacy: The protocol adds depolarisation channels to quantum classification circuits to induce quantum differential privacy and derive adversarial robustness bounds.The paper frames this as protection against unknown, worst-case perturbations rather than only known noise sources.
  • Noise dependence: The privacy budget depends on the aggregate noise strength p and the measurement dimension, but not on where channels are inserted or on other classifier details.All channel locations reduce to p = 1 − ∏ᵢ(1 − pᵢ), while Dmeas bounds the number of class labels.
  • Noise dependence: The noisy circuit preserves the noiseless classifier’s assigned class for any depolarisation parameters satisfying 0 ≤ pᵢ < 1.This establishes robustness to the known depolarisation noise before addressing unknown adversarial perturbations.
  • Robustness guarantee: Increasing depolarisation enlarges the allowable adversarial distance and makes the required noisy classification margin easier to satisfy.The same trend is reported for the finite-sampling case.
  • Robustness guarantee: For any perturbation within trace distance τD, the multiclass classifier preserves its label when the noisy class probability exceeds the required privacy-scaled margin.The condition uses ϵ = ln(1 + Dmeas(1 − p)τD/p).

A. Quantum neural network

The quantum neural network protocol inserts depolarisation channels within the QNN circuit before measurement. For binary classification, its robustness bound uses the aggregate noise strength and is independent of input feature dimension.

  • Architecture: A QNN applies a trainable unitary to a D-dimensional input state together with an ancilla, using parameterised single-qubit and fixed two-qubit gates.The protocol modifies this circuit by inserting depolarisation channels before final measurement.
  • Binary classification: Binary QNN classification uses the POVM {Π0, Π1 = 1 − Π0}, so the measurement dimension is Dmeas = 2.The binary setting is the standard application considered for the QNN.
  • Robustness bound: The binary QNN is robust to perturbations with τ(σ, ρ) < τD when ϵ = ln(1 + 2(1 − p)τD/p) and the required noisy output margin holds.Here p = 1 − ∏ᵢ(1 − pᵢ) combines the depolarisation channels.
  • Dimension dependence: For binary QNN classification, the privacy budget is independent of input dimension, so increasing feature dimension does not affect the robustness bound when 0 < p < 1.The passage notes that this conclusion is subject to a constraint on the input-state distribution.
  • Finite sampling: The certified robustness guarantee applies with finite output sampling through a probability bound derived from the estimated class probabilities.The finite-sampling QNN result is obtained by applying the general finite-sampling theorem.

B. Quantum kernel classifier

The quantum kernel classifier encodes inputs with V(x), applies trainable operations W(θ), and evaluates a kernel through measurement. The Iris-based binary classifier uses amplitude encoding and achieves converged training and test performance.

  • Quantum kernel classifier: Depolarisation channels can be inserted throughout the quantum kernel classifier to form the noisy protocol.The noisy and noiseless architectures are presented as variants of the same kernel-classifier scheme.
  • Quantum kernel classifier: The quantum kernel K(θ, x) is computed from input encoding V(x), trainable unitary W(θ), and measurement in the |0⟩⊗n basis.The classifier uses n = log2 D qubits, with W(θ) containing trainable single-qubit and fixed two-qubit gates.
  • Preprocessing and training procedure: The binary Iris experiment removes Virginica, normalizes the remaining data, and amplitude-encodes each example into a quantum state.The retained dataset contains Setosa and Versicolour examples, with 100 normalized samples before the train/test split.
  • Preprocessing and training procedure: The preprocessed dataset is split into 60 training and 40 test examples for training a binary QNN with squared loss.Trainable parameters are optimized with a zeroth-order gradient method over 50 epochs.
  • Preprocessing and training procedure: 100% training accuracy and 100% test accuracy are reached after 15 epochs in the Iris experiment.The loss, training accuracy, and test accuracy are tracked across epochs; accuracy converges sharply around epoch 5 in Figure 4.

B. Evaluation metrics and adversarial attack methods

The evaluation uses bounded-norm I-FGSM attacks and compares robustness guarantees with simulated attacked predictions under infinite and finite sampling. The reported cases illustrate both certified robustness and situations where the sufficient conditions provide no guarantee.

  • Evaluation metrics and adversarial attack methods: The I-FGSM attack iteratively perturbs test inputs under an l2-norm bound to induce incorrect classifier predictions.The attack uses learning rate α = L/T and constrains the perturbation by ∥x − x′∥2 ≤ L.
  • Adversarial attack at test time: The infinite-sampling evaluation varies depolarisation p and robustness τD for a randomly selected test example with label 0.The corresponding privacy budgets and output probabilities are compared against the sufficient robustness condition B > e^2ϵ.
  • Adversarial attack at test time: The setting {p = 0.5, τD = 0.02} is certified robust because B(1) = 1.20 exceeds e^2ϵ1 = 1.08.The attacked input retains predicted label 0 in the corresponding simulation.
  • Adversarial attack at test time: The setting {p = 0.1, τD = 0.05} receives no robustness promise, although the classifier correctly predicts the label in simulation.The theorem and corollary provide sufficient rather than necessary conditions for robustness.
  • Adversarial attack at test time: For finite sampling, 5000 samples guarantee robustness with probability at least 1 − 2 exp(...), under the stated condition B > e^2ϵ.The finite-sampling test uses approximated output scores and compares the resulting B values with the theoretical threshold.

V. ADVANTAGES OF PROTOCOL

The protocol uses naturally occurring depolarisation noise to protect quantum classifiers against arbitrary adversarial examples, while its robustness bound avoids dependence on classifier details. Compared with classical differential-privacy mechanisms, the quantum bound is simpler and can remain independent of model nonlinearity.

  • Protocol advantages: Depolarisation noise can protect general quantum classifiers against arbitrary adversarial examples and provides a theoretically provable robustness bound.The protocol applies to quantum data before classification and can exploit noise already present in quantum devices.
  • Sampling and experiments: Depolarisation noise may reduce test scores, but increasing the number of samples can recover the noiseless score; the required sample complexity grows with noise and not state dimension.The protocol also uses bounded-norm adversarial attacks and finite-sampling analysis to assess robustness.
  • Protocol advantages: Quantum robustness bounds are independent of the classifier circuit and noise-injection locations, making them universal across quantum classifiers.This follows from the structure of depolarisation noise and the unitality of quantum classifier circuits.
  • Classical comparison: Classical differential-privacy robustness bounds generally depend on classifier sensitivity, which can be difficult or intractable to compute in general cases.The classical bound depends on Δf, including the classifier and the neural-network layer where Laplacian noise is injected.
  • Classical comparison: The quantum bound can be independent of kernel nonlinearity, whereas the classical bound becomes smaller for more nonlinear polynomial kernels.The paper presents this as an advantage for quantum classifiers implementing the same polynomial kernel.
  • Scope and caveats: Theoretical robustness conditions in the kernel examples are sufficient rather than necessary, so they illustrate robustness without fully characterizing it.The paper notes that exact expressions can also yield necessary conditions.
  • Scope and caveats: Depolarisation noise can arise naturally in NISQ systems, unlike the artificially injected Laplace mechanism used in the classical comparison.Other quantum noise sources have the required privacy property in the single-qubit case, while their general multiqubit use remains open.

VI. DISCUSSION

The paper concludes that depolarisation noise can turn unavoidable quantum noise into protection against worst-case adversarial attacks. This connects quantum differential privacy with a classifier-independent robustness guarantee and motivates studying other natural quantum noise sources.

  • VI. DISCUSSION: Depolarisation noise placed anywhere in a quantum classification circuit yields a robustness bound against arbitrary worst-case attacks without assumptions about the adversary or classifier.The bound depends only on the number of classes, unlike known classical differential-privacy mechanisms.
  • VI. DISCUSSION: The result suggests that NISQ noise can serve as a positive feature and that quantum advantages may extend beyond computational speedups.The authors identify further naturally occurring quantum noise sources as a direction for future investigation.

Appendix A: Proof of Lemma 1

The proof establishes that depolarisation preserves the noiseless classifier’s label in the infinite-sampling limit and derives finite-sampling conditions for recovering that label with high probability.

  • Infinite sampling: Depolarisation preserves the class assigned by the noiseless classifier when the original class has the largest output probability.The proof establishes both directions of the equivalence between noisy and noiseless label ordering.
  • Finite sampling: Finite sampling replaces exact noisy output probabilities with estimates, requiring enough samples to resolve the reduced classification margin.The noisy margin is η = pξ, where ξ is the noiseless class gap.
  • Finite sampling: Hoeffding’s inequality provides a sufficient sample-size condition for estimating noisy class probabilities to the required precision.The estimate is controlled through independent bounded samples and a target confidence level.
  • Finite sampling: The required sampling complexity increases with depolarisation strength but is independent of the input-state dimension.This gives a dimension-independent route to high-probability robustness against depolarisation noise.
  • Privacy connection: The privacy proof bounds output-probability changes for nearby quantum states using trace-distance control and the depolarisation parameter.The resulting privacy budget is obtained by upper-bounding the final term in the differential-privacy inequality.

Appendix D: Proof of Theorem 1

The proof of Theorem 1 uses quantum differential privacy to transfer a sufficient output-margin condition at one state to label preservation for every sufficiently nearby state.

  • Robustness transfer: If the noisy classifier’s correct-class probability exceeds every competing class by the factor e^2ϵ, the label remains unchanged for all states within trace distance τD.The privacy budget is ϵ = ln(1 + Dmeas(1 − p)τD/p).
  • Robustness transfer: Quantum differential privacy supplies the inequality needed to compare classifier outputs on the reference state and an adversarially perturbed state.The proof inserts the margin condition into the privacy relation and derives the corresponding label ordering.
  • Finite sampling: The finite-sampling argument converts estimated noisy probabilities into a high-probability version of the robustness condition.Hoeffding’s inequality controls the probability that the estimated probabilities deviate from their expectations.

Appendix F: Proof of Theorem 3

The proof bounds the sensitivity of polynomial-kernel and linear-kernel classifiers, then converts this bound into a sufficient adversarial-robustness radius.

  • Polynomial-kernel sensitivity: For polynomial kernels, bounding each inner-product term enables a sensitivity bound for the classifier.The proof normalizes the relevant vectors and applies Cauchy–Schwarz before evaluating the kernel sensitivity.
  • Linear-kernel sensitivity: For the linear kernel, the sensitivity satisfies a bound involving M and the maximum weighted feature contribution.The appendix states the special-case bound for n = 1 explicitly.
  • Robustness condition: The classifier is robust against every adversarial example x′ satisfying ||x′ − x||2 ≤ L = κϵ/∆f.The robustness radius increases with κ and ϵ and decreases with classifier sensitivity ∆f.
  • Robustness condition: A sufficient robustness condition follows by combining the privacy-related constraint on ϵ with the sensitivity bound.The proof imposes ϵ < (1/2) ln g(B) and then substitutes the inverse-sensitivity estimate.

Appendix G: Proof of Theorem 4

The proof establishes differential privacy for a classifier with depolarisation noise and derives robustness conditions by relating noisy class probabilities to adversarial perturbations.

  • Differential privacy: Inserting a depolarisation layer before measurement gives the classifier an ϵ-differential privacy property.The result is obtained from the preceding lemma and applies to the trained model with the noise layer inserted before final measurement.
  • Robustness condition: For an initially class-0 state, correct prediction after attack requires an inequality comparing the noisy class probabilities.The proof rewrites this requirement as a condition involving ϵ and the classifier outputs.
  • Noise model: The proof includes multiple depolarisation channels through their combined depolarisation parameters.The channels are represented by parameters p1, ..., pl before deriving the effective expression used in the robustness analysis.
  • Case analysis: The analysis treats separate parameter regimes p ∈ (0, 1/2) and p ∈ [1/2, 1), using upper bounds on the relevant expression.The case distinction determines which bound is substituted into the subsequent equations.

Appendix H: Numerical simulation details

The simulations implement a binary two-qubit quantum classifier with trainable layers, depolarisation at testing time, and conventional-accuracy evaluation under bounded l2 attacks.

  • Classifier implementation: The classifier combines state preparation, a parameterized circuit, projective measurements, and a conditionally applied depolarisation channel.The depolarisation placement does not affect results beyond the product of the channel factors.
  • Classifier implementation: The two-qubit circuit encodes each classical input component into computational-basis amplitudes and uses five trainable layers with 25 parameters.Each layer contains trainable single-qubit and two-qubit gates.
  • Evaluation: Conventional accuracy measures test-set prediction accuracy under adversarial attacks at different bounded l2 norms.The metric counts correctly predicted examples relative to the test-set size.
  • Results: At L = 0.4, baseline conventional accuracy drops to zero, while p = 0.5 and p = 0.8 remain non-zero.The simulations use p = 0, 0.5, and 0.8 to assess robustness as depolarisation increases.
  • Results: At L = 0.5, both baseline and p = 0.5 have zero conventional accuracy, whereas p = 0.8 remains non-zero.For L = 0.1, p = 0.8 is slightly worse than p = 0.5; at larger L, p = 0.8 outperforms p = 0.5.
Loading 2003.09416v1…