Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access

Ji Guan; Mingyu Huang

Source-linked AI summary

Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access

Ji Guan, Mingyu Huang

arXiv:2609.11637v1Sep 10, 2026quant-phcs.CR

TL;DR

The paper asks whether adversarial robustness of a quantum classifier can be certified when evaluators know only its readout and sampled outcomes, not its internal evolution. It develops measurement-only lower and upper bounds from POVM geometry and distributional optimization, and reports sound certificates in simulation and on IBM hardware. Across 40 executions of two 8-qubit networks, the expected lower–upper ordering held for every tested input.

Problem
Existing robustness analyses often require circuit, parameter, gradient, or channel access, whereas KRQA exposes only the readout and finite-shot outcomes.
Method
The framework computes a lower bound from outcome distributions constrained by POVM spectra and an upper bound from POVM gap-operator certificate subspaces, using measurement statistics without tomography or internal descriptions.
Results
Across 40 IBM Quantum executions of two 8-qubit quantum neural networks, both certificates were computed from real-device outcomes and the lower–upper ordering held for every tested input.
Takeaways & Limitations
Robustness claims for deployed quantum classifiers can be audited directly from observable measurement statistics under KRQA.
Takeaways & Limitations
The guarantees depend on a known, matching, and stable readout; the theory assumes unitary internal evolution, and the hardware study covers one device and calibration snapshot.

Abstract

from arXiv · show

A quantum classifier assigns labels by evolving an input quantum state and measuring the output, so repeated executions reveal only a distribution over labels. We study certified adversarial robustness for such classifiers under known-readout query access (KRQA), where an evaluator can prepare inputs, knows the quantum measurement, and observes finite-shot outcomes but cannot inspect the internal evolution, parameters, or gradients. We give a measurement-only framework that returns two complementary guarantees for each input: a lower bound ruling out untargeted errors within a radius, and an attack-independent upper bound witnessing an adversarial state within a radius. Both are estimable from the known readout measurement and sampled outcomes, require no tomography or circuit description, and admit finite-sample guarantees. The upper bound uses gap operators induced by the quantum measurement; the lower bound relaxes state-space search to an efficient optimization over outcome distributions with operator-spectrum constraints, yielding certificates that are never weaker than prior probability-only certificates and can be strictly stronger when the spectral constraints are active. Evaluations on multiple quantum classifiers show that the lower bound tracks exact optima on tractable instances, while the upper bound remains informative when standard attacks fail. We further demonstrate real-device feasibility on IBM Quantum hardware: from 40 executions of two 8-qubit quantum neural networks, our method computes both certificates, with the expected ordering between the lower and upper bounds on every tested input. Taken together, these results show that robustness claims for quantum classifiers can be audited directly from observable statistics under KRQA.

1 Introduction

The paper studies robustness certification for remotely accessed quantum classifiers when evaluators know the readout but not the internal evolution. It develops measurement-only lower and upper bounds that can be estimated from finite-shot statistics and evaluates them in simulation and on IBM hardware.

KRQA exposes the readout and sampled outcomes while hiding the circuit, parameters, and gradients, motivating robustness analysis without white-box access.The setting supports provider self-auditing and third-party validation of robustness claims.
The framework returns a lower bound ruling out untargeted errors and an attack-independent upper bound witnessing a targeted adversarial state.Both bounds are designed for deployment-time robustness decisions.
POVM gap operators define upper-bound certificate subspaces, while operator-spectrum constraints strengthen the lower-bound distributional relaxation over prior probability-only certificates.The lower bound can be strictly stronger when the spectral constraints are active.
Both certificates have finite-sample versions and require only outcome-probability shots plus lightweight per-class post-processing after one-time readout preprocessing.The approach is particularly lightweight for few-qubit or coarse-grained readouts with few outcomes.
Across simulations and IBM Quantum experiments, the lower bound tracks numerical white-box references, the upper bound remains informative when attacks fail, and both bounds order correctly on every tested input.The hardware proof of concept uses two 8-qubit quantum neural networks.

2 Threat Model

The threat model gives an evaluator query access to a known readout and sampled outcomes while withholding the classifier’s internal evolution. Certification therefore relies on observable statistics and assumes a specified, stable readout model.

The evaluator prepares admissible input states, repeatedly queries the classifier, and observes measurement outcomes while seeking minimum-fidelity-distance untargeted or targeted misclassification.The evaluator cannot inspect or modify training, the readout device, or internal model details.
The certifier knows the label POVM and estimates outcome probabilities from repeated shots, computing sound robustness bounds without the internal evolution, learned circuit, or gradients.The upper bound additionally requires binary readouts derived from the known measurement.
The guarantees apply when the deployed classifier has a fixed, known readout model, but not when the readout POVM is unknown or only partially specified.The theory focuses on unitary internal evolution and finite-shot observations.
Certification uses the readout effects and shot-estimated label probabilities rather than the hidden circuit that evolves the input state.

3 Preliminaries

The preliminaries model a quantum classifier as unitary evolution followed by POVM measurement, with labels selected by the most probable outcome. Robustness is defined using fidelity distance, and the target certification problem is to sandwich the exact radius between sound lower and upper bounds.

A quantum classifier consists of a Hilbert space, unitary evolution, and a POVM whose most probable outcome determines the predicted class.The POVM effects are positive semidefinite and sum to the identity.
Repeated shots estimate the measurement-outcome distribution, enabling certification from observable statistics without internal details of the evolution.
Fidelity distance quantifies perturbations between pure states, with smaller values representing closer adversarial changes; the resulting bounds can also translate to trace distance.
The exact robustness radius is difficult to compute because its white-box formulation is a nonconvex QCQP requiring the circuit description.
The certification objective is a sound sandwich εRLB(ψ) ≤ ε∗(ψ) ≤ εRUB(ψ), where the lower region is guaranteed safe and the upper bound supplies an adversarial witness.

4 Adversarial Robustness: Existence and an Upper Bound

The upper-bound construction identifies adversarial directions from positive eigenspaces of POVM gap operators and measures the input’s overlap with those spaces. This yields attack-independent, measurement-only robustness bounds and diagnostics for unconditional robustness.

4.1 Adversarial Kernel Space: Positive eigenspaces of POVM gap operators define adversarial kernel spaces that characterize strict probability reversals toward competing classes.The construction depends on the readout measurement rather than the input state or hidden evolution.
4.1 Adversarial Kernel Space: A state in a competitor’s positive gap subspace pulls back through the hidden evolution to a targeted adversarial input, while strict targeted adversaries must overlap that subspace.
4.1 Adversarial Kernel Space: Kernel nullity together with tie-priority conditions identifies unconditional robustness, but this boundary diagnostic does not establish predictive accuracy.
4.2 Robustness Upper Bound: The upper bound is obtained from the smallest fidelity distance to kernel-generated adversarial states, determined by the input’s projected overlap with each competitor subspace.
4.2 Robustness Upper Bound: Binary projector readouts estimate each kernel overlap under KRQA, making the upper bound independent of internal circuit parameters while remaining informative when standard attacks fail.

5 Robustness Lower Bound

The section derives a measurement-distribution lower certificate for robustness by replacing nonconvex state-space search with a convex optimization constrained by readout spectra. The resulting certificate is sound, at least as strong as the prior distribution-only bound, and can improve robustness estimates while remaining implementable under KRQA.

From states to distributions: The method relaxes nonconvex optimization over adversarial quantum states to a convex optimization over outcome distributions satisfying priority, normalization, and eigenvalue-box constraints.The feasible set is an outer approximation of distributions induced by valid adversarial states, and the objective is optimized over a convex polytope.
Spectral-box certificate: The spectral-box lower bound is always at least as strong as the prior distribution-only certificate and can be strictly stronger when spectral constraints help.The prior comparator is recovered by dropping the measurement eigenvalue constraints; incorporating those constraints yields the improvement.
Example: In the worked example, the lower bound is approximately 7.21 × 10^-3 and localizes the true robustness radius to [7.21 × 10^-3, 3.68 × 10^-1], while the exact value is 1.20 × 10^-1.The bound improves on the previous lower bound and provides a tighter estimate of the exact radius in that example.
Certification guarantee: For each competing class, the certificate bounds the best achievable measurement fidelity and combines the resulting classwise guarantees into a valid untargeted robustness lower bound.The implementation uses conservative scalar dual upper bounds, so finite numerical precision affects tightness rather than soundness when branch tests are certified.
Complexity: After one-time spectral preprocessing, per-input query and post-processing cost is O(N+C^2L) without explicit dependence on 2^n for fixed C and L.The procedure remains valid under KRQA without knowledge of the internal evolution U; dense full-system readouts still incur one-time O(Cd^3) preprocessing.

6 Evaluation

The evaluation tests KRQA robustness certificates across simulated quantum classifiers, scalability settings, and IBM Quantum hardware. Results show informative attack-independent upper bounds, spectral lower-bound gains when constraints are active, and the expected certificate ordering on tested inputs.

6 Evaluation: Across MNIST, Fashion-MNIST, and cluster-excitation benchmarks, the upper bound is non-trivial on every retained sample, the lower bound stays below the numerical reference, and post-processing remains lightweight.Test-set accuracies are 91.5%, 85.25%, and 99.5%, respectively.
6.1 Universal Vs. Empirical Upper Bounds: The kernel upper bound has mean 0.3166 across 20 retained MNIST inputs and remains below 1 for every input, while attacks succeed on only some tasks and can fail entirely on cluster excitation.FGSM and PGD succeed on 75.0% and 80.0% of MNIST inputs, but neither attack finds a witness on cluster excitation.
6.2 Lower Bound Improvement: Under an active spectral-box diagnostic, the proposed lower bound averages 6.16499 × 10^-2 versus 6.04775 × 10^-3 for the probability-only bound, approximately 10.194 times larger on all 20 inputs.The diagnostic uses a separate class-3-focused model with 27.5% full-test accuracy, isolating the effect of active spectral constraints.
6.2 Lower Bound Improvement: On standard high-accuracy models, spectral-box and probability-only lower certificates coincide on all retained inputs, with MNIST’s common mean equal to 1.1583 × 10^-3.The reported common means are 1.2822 × 10^-3 for Fashion-MNIST and 7.7161 × 10^-3 for cluster excitation.
6.4 Scalability: For standard MNIST, the lower bound, numerical white-box reference, and upper bound have means 0.0012, 0.0013, and 0.3166, with the reference between the certificates on every retained input.The reference is a numerical estimate rather than a proved global optimum.
6.5 IBM Quantum Hardware Proof of Concept: On IBM Quantum hardware, two 8-qubit QNNs produce lower–upper certificate pairs [0.0034, 0.3513] and [0.0066, 0.3747], and every tested sample satisfies the expected ordering.The hardware-preserved label rates are 95.0% and 100.0% on selected subsets; the intervals do not cover device or calibration drift.

7 Related Work

Prior quantum robustness methods largely assume white-box access or attack-dependent witnesses, whereas this work targets certification from observable measurement statistics under KRQA.

Existing quantum robustness attacks and defenses generally require circuit, state, pulse, or gradient access, while formal QCQP and semidefinite approaches require explicit circuit or channel descriptions.
The paper studies KRQA as a query-only alternative, deriving lower and upper bounds from repeated executions and measurement outcomes without gradients, tomography, or internal model details.
Attack-based upper bounds depend on attack choices, hyperparameters, and compute, whereas the proposed universal upper bound is attack-independent and directly estimable from measurement statistics.

8 Limitations

The certificates depend on trusted readout information and are evaluated under a restricted access and device setting. These assumptions limit where the guarantees apply.

The certified readout must match the deployed measurement; otherwise, replacing spectral bounds with 0 and 1 recovers the weaker probability-only certificate.The spectral constraints are a key source of certificate strength.
The upper bound requires derived binary readouts, while label-only access supports only the lower bound.
The theory assumes unitary internal evolution and does not certify arbitrary device noise or temporal drift.
The IBM experiment demonstrates feasibility on one device and calibration snapshot rather than broad validity across hardware platforms or operating periods.

9 Conclusion

The paper presents measurement-only robustness certification under KRQA using complementary lower and upper guarantees derived from observable statistics. The framework supports finite-sample auditing and practical decisions such as confidence, abstention, or warnings.

The framework provides a certified lower bound from outcome-distribution optimization with spectral constraints and an attack-independent upper bound from POVM-gap geometry.
Both certificates use observable statistics without gradients, tomography, or internal circuit or channel descriptions, and admit finite-sample versions.
The lower bound is compared with numerical white-box references, while the upper bound can witness adversarial states when empirical attacks fail, although successful attacks may be tighter.
The certificates support externally validating robustness claims, serving some inputs with confidence, and flagging others for abstention or warning.
The artifact repository provides implementations, reproduction scripts, raw hardware data, benchmark configurations, and environment information for evaluating the main claims.
The work is analytical and evaluative, without human subjects, privately collected user data, or offensive tooling for compromising deployed systems.

D The Proof of Theorem 4.4

The proof establishes the adversarial-state characterization through soundness and completeness, then relates the nearest adversarial state to projection onto a certificate subspace. The argument uses unitary invariance and a standard projection-maximization identity.

The theorem proof concludes after applying the preceding lemma under the fixed tie-priority rule.
The proof connects pure-state fidelity distance to the projection onto K_k→t using unitary invariance of the inner product.
Applying the projection-maximization claim to K_k→t and U|ψ⟩ yields the maximum overlap with the class-wise adversarial subspace.
The overall adversarial set is a finite union over competing labels, so its infimum is the minimum of the class-wise infima.

G Scalar Lagrange-Dual Evaluation of the Lower-Bound Program

The lower-bound program is evaluated through a scalar Lagrange dual that supplies certified upper bounds for the inner optimization, while spectral preprocessing and finite-shot estimation make the certificate computable.

Dual evaluation: The scalar Lagrange dual provides certified upper bounds for the inner value because weak duality guarantees validity even with incomplete bisection.Bisection affects tightness only, while every evaluated dual point remains valid.
Closed-form evaluation: Each coordinate maximization is closed form, with clipping and a monotone mass condition enabling bisection over the dual multiplier.For positive weights, the unclipped coordinate is proportional to the corresponding weight.
Decision constraint: Removing the decision constraint yields a conservative box-simplex bound, while a certified tie-face branch can provide a tighter alternative.The implementation falls back to the unconstrained dual when finite-precision checks cannot certify the active branch.
Classical preprocessing: Classical preprocessing decomposes each Hermitian POVM gap operator into positive and non-positive spectral parts before optimization.Dense eigensolvers require O(d^3) time and O(d^2) space per reusable decomposition scale.
Finite-shot estimation: Finite-shot projector queries estimate class probabilities using Bernoulli samples, Hoeffding bounds, and a union bound across competing classes.The resulting simultaneous accuracy guarantee controls all classwise estimates with probability at least 1−δ.

I The Proof of Theorem 5.5

The proof of Theorem 5.5 is presented as two separate items and is stated to follow the proof pattern established in the preceding section.

Proof structure: Theorem 5.5 is proved by establishing two items separately.
Proof relation: The argument follows the proof structure of Theorem 4.8 from the preceding section.
Scope: The supplied proof passage gives the proof relationship but does not state the theorem’s individual claims.

J.1 Experiment Configurations

The experiments use 10-qubit QNN classifiers across image and cluster-state tasks, evaluate retained correctly classified inputs, and compare certified bounds with attacks and numerical references.

Experiment configurations: The benchmarks train 10-qubit StronglyEntanglingLayers QNNs, using AmplitudeEmbedding for image data and state-vector preparation for cluster states.Measured test accuracies are 91.5% for MNIST, 85.25% for Fashion-MNIST, and 99.5% for cluster excitation detection.
Sampling and checks: Reported statistics are conditioned on retained correctly classified inputs rather than estimating population robustness rates.Retention uses seeded traversal and numerical checks, with 20 inputs retained per task.
Fashion-MNIST: The Fashion-MNIST kernel certificate has mean 0.3019 and remains non-trivial below 1 for all 20 inputs, whereas FGSM and PGD succeed on 30.0%.Random search finds no adversarial witness on these evaluated inputs.
Lower-bound assessment: The spectral-box and probability-only lower bounds coincide on all 20 Fashion-MNIST inputs, with common mean 1.2822 × 10^-3.The same equality pattern occurs for cluster inputs with common mean 7.7161 × 10^-3.
Tightness assessment: For both Fashion-MNIST and cluster-state inputs, the numerical white-box reference lies between the certified lower and upper bounds on every retained input.These comparisons use numerical estimates rather than proved global optima.
Cluster excitation detection: The cluster-task kernel certificate has mean 0.4007 and is non-trivial below 1 for all 20 inputs, while random search, FGSM, and PGD find no witnesses.This demonstrates complementarity between attack-independent and empirical upper bounds.