PaperlayerView exact revision on arXiv

Source-linked AI summary

Experimental quantum adversarial learning with programmable superconducting qubits

Wenhui Ren, Weikang Li, Shibo Xu, Ke Wang, Wenjie Jiang, Feitong Jin, Xuhao Zhu, Jiachen Chen, Zixuan Song, Pengfei Zhang, Hang Dong, Xu Zhang, Jinfeng Deng, Yu Gao, Chuanyu Zhang, Yaozu Wu, Bing Zhang, Qiujiang Guo, Hekang Li, Zhen Wang, Jacob Biamonte, Chao Song, Dong-Ling Deng, H. Wang

arXiv:2204.01738v1quant-phcond-mat.dis-nncs.AIcs.LG

TL;DR

The paper addresses whether quantum classifiers are vulnerable to adversarial attacks, a question relevant to their trustworthiness in safety- and security-critical applications. It experimentally demonstrates adversarial examples using superconducting-qubit QNNs trained on images and quantum data, and reports that adversarial training counters attacks generated by the same strategy.

  • Problem

    Experimental demonstrations of adversarial examples for quantum classifiers and practical tests of proposed countermeasures had not previously been reported, despite the importance of evaluating quantum AI under adversarial attacks.

    Source: p. 1

  • Method

    The authors implement supervised QNN classifiers on ten programmable superconducting transmon qubits, train them on real-life images and quantum data, generate adversarial examples, and retrain with adversarial samples.

    Source: pp. 1, 2, 6

  • Results

    Small adversarial perturbations deceive trained quantum classifiers with high confidence, while adversarial training makes them immune to perturbations generated by the same attacking strategy.

    Source: pp. 2, 5, 6

  • Takeaways & Limitations

    The experiments demonstrate adversarial vulnerability and an effective adversarial-training defense for the supervised quantum circuit classifiers and attacks studied.

    Source: pp. 2, 6

    The work focuses on supervised quantum circuit classifiers; experimental demonstrations for unsupervised learning and other classifier types remain technically unattainable in this work.

    Source: p. 6

Abstract

from arXiv · show

Quantum computing promises to enhance machine learning and artificial intelligence. Different quantum algorithms have been proposed to improve a wide spectrum of machine learning tasks. Yet, recent theoretical works show that, similar to traditional classifiers based on deep classical neural networks, quantum classifiers would suffer from the vulnerability problem: adding tiny carefully-crafted perturbations to the legitimate original data samples would facilitate incorrect predictions at a notably high confidence level. This will pose serious problems for future quantum machine learning applications in safety and security-critical scenarios. Here, we report the first experimental demonstration of quantum adversarial learning with programmable superconducting qubits. We train quantum classifiers, which are built upon variational quantum circuits consisting of ten transmon qubits featuring average lifetimes of 150 $\mu$s, and average fidelities of simultaneous single- and two-qubit gates above 99.94% and 99.4% respectively, with both real-life images (e.g., medical magnetic resonance imaging scans) and quantum data. We demonstrate that these well-trained classifiers (with testing accuracy up to 99%) can be practically deceived by small adversarial perturbations, whereas an adversarial training process would significantly enhance their robustness to such perturbations. Our results reveal experimentally a crucial vulnerability aspect of quantum learning systems under adversarial scenarios and demonstrate an effective defense strategy against adversarial attacks, which provide a valuable guide for quantum artificial intelligence applications with both near-term and future quantum devices.

A. Quantum neural network classifiers

The section introduces QNN classifiers and an interleaved architecture intended to handle high-dimensional classical data. It outlines basic circuit components and how classical or quantum inputs are represented.

A. Quantum neural network classifiers

  • The interleaved QNN architecture is designed for classification of real-life images up to 256 dimensions and is numerically benchmarked against the encoding-first architecture.The passage describes the interleaved architecture’s expressive power and says the benchmarks exhibit better classification performance than encoding-first QNNs.Source: A. Quantum neural network classifiers · p. 11

1. Basic structures

  • QNNs use parameterized quantum circuits, with single-qubit rotations and two-qubit controlled gates among the basic building blocks.The experimental demonstrations and benchmarks mainly use Rx, Ry, and Rz rotations and CNOT gates.Source: §1 · pp. 11–12
  • Quantum inputs can be supplied as already encoded states, whereas classical data must be encoded into the circuit, for example through single-qubit rotation angles.The section distinguishes amplitude encoding, encoding-first block encoding, and interleaved block encoding; the experiments use the interleaved structure.Source: §1 · p. 12

2. Optimization strategies

The optimization strategy maps input data to binary-classification outputs, trains QNN parameters using a cross-entropy objective and measured gradients, and benchmarks encoding architectures on MNIST.

2. Optimization strategies

  • Binary predictions compare the measured probabilities of the two classes; the QNN output is determined by measurements in the Pauli Z basis.For the described medical-image example, the last-qubit Z-basis expectation distinguishes the labels, and unseen samples are assigned by the larger class probability.Source: §2 · p. 12
  • The classifier is trained by minimizing cross-entropy, which compares the one-hot target labels with the QNN’s output-category probabilities.For binary classification, the loss is −a1 log g1 − a2 log g2.Source: §2 · pp. 12–13
  • For medical-data training, 260 variational parameters are divided into 10 qubit-specific batches, whose experimental gradients are averaged over sampled training examples and updated with Adam.The MNIST procedure instead selects 50 of the available parameters at specified circuit columns and updates them with Adam.Source: §2 · pp. 14–15
  • The parameter-shift rule obtains circuit-parameter gradients from expectation values measured at parameter shifts, enabling gradient-based QNN optimization.The loss derivatives are related to derivatives of output probabilities through the chain rule.Source: §2 · p. 14
  • MNIST benchmarks show accuracy and loss curves for randomly initialized interleaved and encoding-first classifiers; a separate comparison averages ten initializations and shows standard bias.The supplied captions describe the plotted quantities and setup but do not state which architecture performs better.Source: Figure S2 · p. 15, Figure S3 · p. 15

3. Algorithms and benchmarks

The section compares QNN encoding strategies, describes gradient-based adversarial attacks, and outlines adversarial training as a defense. Its numerical benchmarks favor interleaved encoding in the tested settings.

3. Algorithms and benchmarks

  • Medical-data training updates 260 parameters in ten batches, while MNIST training uses 50 parameters to reduce time cost.Both algorithms use gradients calculated on the superconducting platform.Source: §3 · p. 15
  • Interleaved encoding lets training adjust the kernel, whereas an encoding-first classifier has a fixed kernel matrix that can limit its performance.The experiments use the interleaved structure for classical data.Source: §3 · pp. 15–16
  • Interleaved block-encoding QNNs performed comparably better than encoding-first classifiers in the practical high-dimensional MNIST and FashionMNIST simulations.The authors note that this does not rule out encoding-first designs, whose performance depends on the kernel matrix provided by the encoding block.Source: Figure S4 · p. 16, Figure S5 · p. 16, §3 · p. 17

1. Adversarial attacks

  • Adversarial examples are generated by optimizing input perturbations to increase the loss while keeping the trained classifier parameters fixed.The perturbation is constrained to a limited region.Source: §3 · p. 17, §1 · p. 18
  • Type-1 adversarial examples perturb the entire image and are used for adversarial training; type-2 examples perturb only the object region and are mainly shown in Fig. 2e and Fig. 4b.The study also uses 50 type-1 adversarial examples to exhibit attack results in Fig. 2f.Source: §1 · p. 18

2. Defense strategies

  • Adversarial training combines original samples with type-1 adversarial examples and is reported to enhance QNN robustness.Evaluation also uses type-2 examples to probe transfer from a known attack to another strategy.Source: §2 · pp. 18–19

II. THEORETICAL DETAILS FOR QUANTUM NEURAL NETWORKS HANDLING QUANTUM DATA

For quantum data, the classifier processes already-prepared quantum states directly and is trained with experimentally measured gradients. Adversarial examples are formed by adding optimized local perturbations during state preparation.

A. Quantum neural network classifiers

  • The experimental quantum-state classifier has five variational blocks and 150 trainable parameters, trained with experimentally obtained quantum gradients.Each block contains three single-qubit rotations and two controlled-NOT gates.Source: §II · p. 20

B. Adversarial examples

  • The perturbation layer uses single-qubit rotation angles bounded by κ, with its initially identity-valued parameters optimized by gradient ascent.This construction is summarized in the quantum-data attack algorithm.Source: §II · p. 20

A. Quantum neural network classifiers

  • The quantum-data classifier uses an amplitude-encoding QNN because the input data is already prepared as quantum states.Its training gradients are calculated with the parameter-shift rule.Source: A. Quantum neural network classifiers · p. 20

B. Adversarial examples

  • Quantum adversarial examples are generated by inserting local perturbations during preparation, then evolving the perturbed state under the Aubry-André Hamiltonian.The perturbation layer starts as identity and its parameters are optimized to maximize the classifier loss.Source: B. Adversarial examples · p. 20, §II · p. 20

A. Device information

The experiment uses ten qubits selected from a larger two-dimensional superconducting processor. The selected qubits form a one-dimensional chain.

A. Device information

  • The processor contains 36 transmon qubits in a two-dimensional array with tunable nearest-neighbor couplings.The experimental chain is selected from this larger processor.Source: A. Device information · p. 21
  • The experiment uses a one-dimensional chain of ten qubits from the processor.The layout identifies the ten qubits and nine couplers used.Source: A. Device information · p. 21, Figure S7 · p. 21
  • The experiment uses a 6 × 6 transmon processor with 60 couplers and selects a chain of 10 qubits to realize the interleaved block-encoding QNN structure.Tantalum film patterns the base wirings for high coherence.Source: A. Device information · p. 21

B. Experiment circuit

The circuit uses a ten-qubit chain with rotation and entangling gates, adapted for quantum-state or classical-image inputs. Gate compilation and dynamical decoupling are used in the experimental implementation.

B. Experiment circuit

  • A fundamental chain-topology block applies simultaneous single-qubit rotations followed by two layers of CNOT gates across neighboring qubit pairs.The CNOTs are built from controlled-Z gates sandwiched between Hadamard gates.Source: B. Experiment circuit · p. 21
  • During parallel CZ gates, dynamical-decoupling sequences apply opposite-phase microwave-drive segments to idling qubits.The sequences elongate the effective dephasing times of those qubits.Source: B. Experiment circuit · p. 21
  • For 16 × 16 grayscale medical images, four blocks encode up to 260 rotation-angle parameters, combining input values and trainable parameters.Unused angle parameters are set to zero.Source: B. Experiment circuit · p. 21
  • Consecutive single-qubit gates are compiled into two rotations, Rz and Rφ, to further reduce circuit depth.The equatorial rotation axis φ is angled relative to the x-axis.Source: B. Experiment circuit · p. 21
  • For quantum data, five variational blocks each contain 30 single-qubit gates, giving 150 trainable parameters.The input state already carries the data information.Source: B. Experiment circuit · p. 22

1. Single-qubit gates

XY rotations use DRAG-corrected Gaussian microwave pulses, while simultaneous-operation benchmarking reports low Pauli errors for both XY and Rz gates.

1. Single-qubit gates

  • 30 ns Gaussian microwave pulses implement Rx and Ry, with DRAG quadrature corrections used to minimize leakage to higher levels.Simultaneous microwave drives require active cancellation to address crosstalk.Source: §1 · p. 22
  • 0.08% average Pauli error was measured for random XY gates running simultaneously on all 10 qubits after microwave crosstalk calibration and active cancellation.The crosstalk matrix’s nonzero off-diagonal terms averaged around 4%.Source: §1 · p. 22
  • 0.03% average Pauli error was measured for simultaneous Rz(π/2) gates, better than for XY gates because microwave crosstalk is not a concern.Rz(π/2) was implemented with 20 ns square pulses.Source: §1 · p. 22
  • The classical-data circuit applies dynamical decoupling to idling qubits, while the quantum-data circuit includes 400 ns evolution under the Aubry-André Hamiltonian.The latter uses UAA = e−iHτ.Source: Figure S8 · p. 23, Figure S9 · p. 23

2. Two-qubit CZ gate

The CZ gate uses coupler-frequency steering and qubit flux pulses; calibration tunes pulse settings to reduce leakage and maximize entanglement.

2. Two-qubit CZ gate

  • The CZ process steers the coupler frequency and applies flux pulses to bring |101⟩ and |002⟩ near resonance; z0 reduces leakage while zpa is adjusted to maximize entanglement.The coupler pulse lowers its frequency from about 5.8 GHz to about 4.6 GHz, with a 50 ns gate time.Source: §2 · p. 24
  • The z0 setting is chosen where the measured |0⟩ probability of Qj reaches a minimum, indicating the lowest leakage after CZ cycles.The calibration prepares |101⟩ and tests cycle counts m ∈ {1, 3, 5, 7}.Source: §2 · p. 24, Figure S10 · p. 24
  • Minimum measured |ρ01| identifies the zpa setting used to reduce residual coherence after repeated CZ cycles.The procedure prepares both qubits in (|0⟩−i|1⟩)/√2 and uses tomography on one qubit.Source: §2 · p. 24, Figure S10 · p. 24

3. Quantum gate benchmarks

The gate benchmarks use simultaneous XEB circuits, and the reported CZ error estimates from XEB and randomized benchmarking are consistent.

3. Quantum gate benchmarks

  • 0.37% CZ Pauli error from interleaved RB and 0.39% from XEB were consistent for Q1 and Q2.The XEB CZ cycle contains two parallel single-qubit gates and a CZ gate.Source: Figure S11 · p. 25
  • Simultaneous XEB benchmarks characterize both single-qubit gates and CZ gates, with each CZ cycle combining two single-qubit gates and a CZ.The figure shows single-qubit XEB on Q1 and Q2 and CZ XEB on the pair.Source: Figure S11 · p. 25, §3 · p. 25
  • XEB sequence fidelity is calculated from simulated and experimentally measured bitstring probabilities, averaged over random circuits.For CZ gates, the XEB circuits approach the Porter-Thomas distribution using random single-qubit gates.Source: §3 · p. 25

C. MNIST data training

The MNIST experiment trained a binary 0-versus-1 classifier and tested small loss-maximizing perturbations; retraining improved defense against certain attacks.

C. MNIST data training

  • 500 training and 100 test digits were selected; training used 50 of 260 parameters, and accuracy approached 1 after about 50 epochs.The dataset contained MNIST digits 0 and 1.Source: C. MNIST data training · p. 26
  • Small, numerically optimized perturbations caused the trained classifier to misclassify adversarial samples, while retraining improved defense against certain attacks.Retraining used both original and adversarial samples.Source: C. MNIST data training · p. 26
  • Each retraining epoch sampled 5 original and 5 adversarial examples for training, and 50 of each for testing.The 50 trainable parameters were reinitialized before adversarial retraining.Source: C. MNIST data training · p. 26

Related papers

Loading 2204.01738v1…