PaperlayerView exact revision on arXiv

Source-linked AI summary

When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention

Owen Friedewald, Srikar Alla, Ali Shiri Sichani, Chi-Ren Shyu

arXiv:2610.02641v1quant-phcs.CRcs.LG

TL;DR

Robustness comparisons in quantum machine learning can depend on how perturbation budgets are defined, complicating attribution to an input-scaling module. The paper audits this issue with paired module knockouts in a four-qubit detector on generated power-grid trajectories. Its ablation ordering reverses across budget normalizations, and neither comparison establishes a module-caused robustness benefit.

  • Problem

    Quantum robustness evidence is sensitive to architecture, threat model, and comparison design, making it important to distinguish module effects from the rules used to compare perturbations.

    Source: §1 · p. 1

  • Method

    The study evaluates paired knockouts of three robustness modules in a compact quantum-attention detector, comparing physical-budget and encoder-displacement normalizations and checking prediction changes after gain replacement.

    Source: §1 · p. 2, §7 · p. 9

  • Results

    The ablation ordering reverses across budget normalizations, and neither comparison alone identifies an EBG benefit; the initial aggregate test also retains labels when attacking clean examples.

    Source: §1 · p. 2, §3.2 · p. 4, §6 · p. 6

  • Takeaways & Limitations

    Gain-changing ablations should report both budget normalizations and check whether unperturbed predictions are preserved, treating comparisons after gain and head changes as descriptive rather than causal.

    Source: §7 · p. 9

    The evidence comes from a four-qubit exact-simulation study on generated data with ten seeds and restricted attack coverage, and classical baselines outperform clean prediction.

    Source: §8 · p. 9

Abstract

from arXiv · show

Removing an input-scaling module changes both a classifier and the perturbations reaching its encoder. A robustness difference can therefore reflect the comparison rule as well as the module. We demonstrate this problem in a four-qubit quantum-attention detector on generated power-grid trajectories. A learned scaling module appears beneficial at a fixed physical attack budget, but matching an upper bound on perturbations at the encoder reverses the ordering. Neither comparison alone establishes a robustness benefit caused by the module. The initial test also perturbs clean examples into attacked examples while retaining their original labels; tests restricted to already attacked examples do not establish a benefit. Replacing a trained model's input scales disrupts detection. Retraining its linear classification layer restores the detection rate, but changes individual predictions, leaving the comparison descriptive rather than causal. Two further design checks explain why the input quantum Fisher information regularizer cannot train this model's query parameters, and why removing confidence bounds does not establish a larger certified radius. The evidence is limited to ten seeds, exact simulation, synthetic data, and a restricted set of attacks; classical baselines achieve better clean prediction. The practical lesson is to specify which perturbation budget is fixed, check that attacks preserve labels and interventions preserve predictions, and distinguish exploratory controls from confirmatory evidence.

1 Introduction

The paper audits whether robustness changes after removing input-scaling modules reflect the module or the comparison rule. Its case study uses a four-qubit quantum-attention detector and finds that the ablation ordering depends on budget normalization, without identifying an EBG benefit.

1 Introduction

  • SEQFORMER detects false-data-injection attacks using a compact quantum self-attention classifier and attacks applied to raw measurements through a physical grid model.The threat model uses the MATPOWER IEEE 14-bus DC model, two controllable state directions, and a training-only feature reducer.Source: §1 · p. 1
  • The study compares the full model with paired knockouts of EBG, FGQA, and NACH, as well as an all-modules-off condition, over ten seeds.EBG bounds encoder sensitivity, FGQA regularizes QFI in the mapped attack subspace, and NACH applies simultaneous confidence bounds before a radius diagnostic.Source: §1 · p. 2
  • The ablation ordering depends on budget normalization, and neither the initial test nor the attacked-only follow-up establishes an EBG benefit.The initial test includes clean examples whose labels may change under attack; the later test does not establish a benefit after multiple-comparison correction.Source: §1 · p. 2
  • The contributions combine two budget normalizations, gain replacement and head refitting, design checks, and a leakage-safe paired evaluation with 1,834 independent checks.The scalar-gain and QFI calculations are explanatory tools and design checks, not general robustness theorems.Source: §1 · p. 2
  • The study does not claim quantum advantage, measured-grid generalization, hardware robustness, or coverage of a fully adaptive attack battery.These boundaries are stated as part of the result.Source: §1 · p. 2

2 Background and related work

The background distinguishes prior quantum robustness results and physical FDIA modeling from this paper’s diagnostic question: what changes under module knockouts with a fixed physical threat model. It also motivates careful auditing of attack gradients and intervention comparisons.

Quantum adversarial robustness

  • Prior quantum robustness work spans hypothesis-testing guarantees, noise-based analyses, many-body protection, and empirical favorable regimes, but its assumptions do not automatically fit this study’s generated physical attack and deterministic simulator.The paper uses QFI as a local sensitivity measure and does not infer global robustness from it.Source: §2 · p. 2

Physical FDIA

  • The threat model restricts control to two state directions, avoiding the assumption that an attacker controls every meter after dimensionality reduction.This leaves a nontrivial orthogonal complement in the four-dimensional circuit-input space.Source: §2 · p. 2

Data-driven FDIA

  • The study asks whether three proposed robustness modules change clean, adversarial, or uncertainty-aware outcomes under paired knockouts, rather than claiming superior detection accuracy.Its question complements prior QML FDIA work while holding a raw-space physical threat model fixed.Source: §2 · pp. 2–3

Reliable attack evaluation

  • Attack evaluation requires correct gradients, projections, and threat-set nesting; deterministic simulation makes EOT gradients identical to PGD gradients, so EOT is not independent corroboration here.SPSA supplies a different optimization path.Source: §2 · p. 3

3 Benchmark and physical threat model

The benchmark uses generated temporal case-14 trajectories with a training-only feature reducer and a limited-state physical attacker. Its aggregate stress test retains original labels even when perturbing clean examples may change their class.

3.1 Generated temporal case-14 data

  • The benchmark generates 200 balanced six-frame trajectories per seed and fits a four-component PCA reducer only on training frames, expressing frames relative to each trajectory’s frame zero.Test and attacked contrasts are not clipped, preserving the reducer and mapping’s linear Jacobian.Source: §3.1 · p. 3
  • Temporal logistic regression reaches 0.792 ± 0.022 held-out balanced accuracy, while flattened logistic regression reaches 0.495±0.031 on the learnability check.The temporal logistic regression, MLP, and random forest exceed SEQFORMER’s 0.718 ± 0.047 clean accuracy, but the larger evaluation is neither parameter- nor attack-matched.Source: §3.1 · p. 3

3.2 Limited-state attacker

  • The attacker controls two non-slack state directions, with the physical map limiting which measurements can change and the evaluation gradients checked against finite differences.The attack has white-box access to the model, reducer, physical Jacobian, labels, and loss; its meter support and coefficient budget limit capability.Source: §3.2 · pp. 3–4
  • The aggregate stress test attacks both classes while retaining original labels, although a feasible FDIA can change a clean example into an attacked one.The attacked-only follow-up checks that added perturbations do not cancel existing attacks, but preserves generator labels rather than necessarily operational harmfulness.Source: §3.2 · p. 4

4 Model and module hypotheses

The model combines a four-qubit quantum self-attention block with modules that alter input sensitivity, penalize input QFI, or compute a confidence-bound radius diagnostic. The scalar-gain analysis explains why robustness comparisons depend on the chosen perturbation axis, while the design checks delimit what the modules can establish.

4.1 Quantum attention block

  • Four-dimensional tokens are encoded twice on four qubits, and three variational blocks produce scalar queries and keys and a four-vector value for Gaussian attention and a linear classification head.The model has 24 variational circuit parameters and 39 trainable parameters in total.Source: §4.1 · p. 4

4.2 Modules and knockouts

  • EBG constrains learned input angles and supplies an encoder-sensitivity upper bound for budget normalization; the −EBG knockout fixes all gains at one.The radius denominator also contains the EBG regularizer, so radius changes are partly structural rather than independent confirmation.Source: §4.2 · p. 4
  • The FGQA input-QFI penalty can train the input scales but is exactly independent of downstream query angles, so it cannot train those angles.The proposition follows from invariance of pure-state QFI under a subsequent input-independent unitary.Source: §4.2 · pp. 4–5
  • For a shared nonincreasing response curve, higher input gain weakly lowers physical-axis AURA, while matching encoder displacement removes that mechanical gain dependence.When response curves differ, either normalization reflects model-response changes and cannot isolate the gain effect.Source: §4.2 · p. 5
  • The scalar-gain argument is explanatory rather than an exact reparameterization of this detector because EBG uses diagonal gains and a global upper-bound normalizer.The study compares both budget normalizations and replaces gains to check whether predictions remain unchanged.Source: §4.2 · p. 5
  • NACH uses simultaneous Clopper–Pearson bounds before reporting a radius, while its point-frequency knockout is invalid by construction in this deterministic simulator.Repeated simulator calls return the same prediction, making the procedure a finite-sample implementation diagnostic rather than a hardware certificate.Source: §4.2 · p. 5

5 Experimental protocol

The protocol uses paired ten-seed module knockouts and nested-budget attacks, then adds positive-only and input-scaling controls. Because follow-ups were selected after earlier results, these controls probe differences rather than confirm a module-caused robustness benefit.

Paired design

  • Five conditions—full, −EBG, −FGQA, −NACH, and all modules off—share seed-derived data, splits, initialization, evaluation subsets, and attack streams across ten paired seeds.Clean accuracy uses all 60 held-out trajectories; attacks use a deterministic subset of 20, and the radius diagnostic uses its first ten.Source: §5 · p. 5

Training

  • Training uses 20 hybrid SPSA steps for circuit parameters, temperature, and governor variables, while the linear head receives analytic minibatch gradients and cached-feature fitting.The study is deliberately small-scale and designed for module attribution rather than scaling claims.Source: §5 · p. 6

Attacks and gradient checks

  • At five budgets, ten-step sign PGD and projected SPSA retain the strongest nested-set candidate; checks compare PGD, SPSA, random perturbations, and a larger budget.EOT is algebraically identical to PGD on the deterministic simulator, and neither optimizer uses randomized restarts.Source: §5 · p. 6

Inference

  • Knockouts are compared within seed using paired intervals, tests, and effect sizes, with Holm–Bonferroni across 12 condition–metric contrasts; invalid point-radius comparisons cannot support certification.The procedure reports BCa bootstrap intervals, exact two-sided Wilcoxon signed-rank tests, and Cliff’s delta.Source: §5 · p. 6

Post hoc positive-only evaluation

  • The post-hoc positive-only follow-up reruns attacks on the same 20 already attacked trajectories and reports correct-class rate and normalized area, but does not establish operational-grid label validity.Its comparisons form a separate 12-contrast Holm family.Source: §5 · p. 6

Controls for input scaling

  • The input-scaling controls compare full and −EBG models at physical and normalized budgets, replace learned gains, then refit only the linear head after detection is disrupted.The refit keeps the circuit, temperature, reducer, and gains fixed; the authors describe the comparison as descriptive because retraining changes the decision rule.Source: §5 · p. 6

Interpretive scope

  • Follow-ups were specified after earlier results, so separate Holm families do not correct for selecting follow-up questions and the controls do not independently confirm a robustness benefit.The authors state that this sequence limits implementation changes but does not make the follow-ups preregistered.Source: §5 · p. 6

6 Results

At a common physical attack budget, the full model outperforms −EBG on the stress test, but matching encoder sensitivity reverses their ordering. The additional controls do not isolate an EBG benefit, while the FGQA and NACH checks expose limits on interpreting their diagnostics.

6.1 Changing budget normalization reverses the comparison

  • At ϵ = 0.075, robust accuracy is 0.300 for full and 0.225 for −EBG at a common physical attack budget.The paired stress-test comparison is significant, but both models perform poorly at the largest budget.Source: Table 1 · p. 7, §6.1 · p. 7
  • 0.14375 is the global-match AURA difference (−EBG minus full), reversing the unmatched ordering.The matched −EBG endpoint uses ϵ ≈0.0588, while the full arm uses 0.15; the learned encoder sensitivity bound is about 2.55× smaller than the no-EBG bound at fixed physical ϵ.Source: §6.1 · p. 7
  • A common physical grid compares unequal encoder-displacement bounds, while a matched bound compares unequal physical budgets; neither normalization isolates EBG.A subspace-restricted operator norm is proposed as a further control, but was not evaluated.Source: §6.1 · p. 8
  • Refitting only the classification head restores unperturbed detection to 0.663 while keeping the circuit, temperature, reducer, and gains unchanged; on the same physical budgets, AURA exceeds the original no-EBG model by 0.02917 (BCa [0.00667, 0.05583]).Replacing only the trained no-EBG model’s unit gain with full-model Γ reduces unperturbed detection from 0.663 to 0.047. Refitted-model mean prediction agreement with the original no-EBG model is 0.890 across the 60-example test set before additional perturbations.Source: §6.1 · p. 8
  • Positive-only AURA changes by −0.04063 after EBG removal, but the signed-rank test does not reject and the result establishes neither benefit nor equivalence.This test is restricted to already attacked examples.Source: §6.1 · p. 8
  • The untuned 39-parameter classical model’s classical-minus-quantum clean/AURA gaps are −0.19167/−0.05708; this comparison does not establish quantum advantage.The stronger temporal-logistic baseline also outperforms the quantum model on clean prediction.Source: §6.1 · p. 8

6.2 Design lesson: check which parameters a regularizer can train

  • Full and −FGQA have identical clean accuracy and AURA at recorded precision, while their radius difference of −2.67 × 10^-5 misses the Holm-adjusted test.The FGQA penalty can affect only the four input gains in this implementation; these runs do not establish a general failure of QFI regularization.Source: §6.2 · p. 8

6.3 Design lesson: preserve the meaning of a radius

  • 0.15956 ± 0.00349 is the −NACH point radius after deleting confidence margins, and its artifacts mark the result as not a valid certificate.The larger value follows from changing the formula, not an empirical improvement in certified robustness.Source: §6.3 · p. 9

7 Discussion: failure modes and remedies

The discussion treats the gain-ablation ordering as dependent on the perturbation-budget normalization, not as an identified module benefit. It recommends checking both the threat set and whether interventions preserve predictions.

7 Discussion: failure modes and remedies

  • Physical-budget and encoder-displacement comparisons constrain different threat sets, so neither ordering alone isolates the gain’s effect.The scalar argument is limited here by diagonal gains and a global bound; refitting the classification head restores mean unperturbed detection but not every prediction.Source: §7 · p. 9
  • Equal initial accuracy is necessary for shared response curves, but does not establish curve equality or decision-function preservation.The study’s gain replacement and head refitting therefore remain descriptive rather than causal.Source: §7 · p. 9
  • The attacks differentiate through the gain and reducer, making the issue attribution rather than hidden gradients.The study does not establish a competitive quantum defense or a sign reversal in a published QML robustness result.Source: §7 · p. 9
  • For gain-changing ablations, report both budget normalizations, replace gains with other parameters fixed, and report disagreement after any head refit.Changing both gain and head cannot estimate the gain’s causal contribution, regardless of sample size.Source: §7 · p. 9

8 Limitations and broader impact

The study’s conclusions are bounded by a small exact-simulation evaluation, generated linear-DC data, and restricted attack coverage. Classical baselines outperform the quantum detector on clean prediction, and the conclusion calls for stronger, predeclared evaluation of a published defense.

8 Limitations and broader impact

  • Ten seeds, four qubits, and 20-example attacks limit generalization; restricted PGD/SPSA coverage and no randomized restarts leave stronger attacks untested.The 12-contrast correction limits power, so failure to reject is not equivalence; stronger attacks could lower reported accuracies.Source: §8 · p. 9
  • Generated linear-DC data omit AC physics, distribution shift, noise, and calibrated physical budgets, while classical baselines outperform on clean prediction.The study makes no hardware or deployment claim.Source: §8 · p. 9
  • The conclusion frames the result as a methodological warning from a small synthetic study and proposes predeclared evaluation of a published defense with stronger attacks.It also calls for reporting the fixed budget, checking labels and unperturbed predictions, and distinguishing diagnostic follow-ups.Source: §8 · p. 9

A Complete experimental specification

The appendix records the locked configuration, paired-contrast procedures, and masking audit. Its checks report pass rates and optimizer-path behavior, while the tables’ supplied captions identify their scope rather than their unseen cell values.

A Complete experimental specification

  • The experimental specification pairs fixed classifier settings and production-run details with a table identified as the locked production configuration.The listed classical controls include logistic models, a one-hidden-layer 16-unit MLP, and a 300-tree random forest; production ran one Python process per task.Source: A Complete experimental specification · pp. 11–12, Table 2 · p. 11

B Endpoint and contrast details

  • Table 3 covers paired condition-minus-full contrasts with Holm correction across 12 condition–metric tests; the tied-rank correction does not change any Holm decision.The radius comparator is marked invalid for certificate claims, and gain-changing AURA ordering is normalization-dependent.Source: Table 3 · p. 12, B Endpoint and contrast details · p. 12

C Robust-curve dispersion and masking audit

  • All four masking predicates pass in 50 evaluated rows, while independent PGD loss paths are monotone in 35 of 40 distinct evaluations.The reportable curve uses the exact nested-set envelope; Table 4 is identified as accuracy after attack by budget, summarized over ten seeds.Source: C Robust-curve dispersion and masking… · pp. 12–13, Table 4 · p. 13

D Post hoc positive-only details

On the deterministic 20-example generator-positive subset, removing EBG lowers the correct-class rate at the reported attack budgets, though its AURA effect varies across seeds. The positive-only descriptive effect estimate does not change the signed-rank decision.

D Post hoc positive-only details

E Input-scaling control details

The EBG comparison changes with the perturbation-budget matching rule, so neither tested axis alone identifies an EBG effect. Gain replacement and head refitting are descriptive controls rather than causal isolation of EBG.

E Input-scaling control details

  • Lipschitz matching reverses the AURA ordering, demonstrating normalization dependence rather than identifying an EBG effect.The global-match BCa interval is [0.11417, 0.16917] with Cliff’s δ = 0.92.Source: E Input-scaling control details · p. 13
  • The no-EBG-minus-full AURA difference changes from −0.03667 unmatched to 0.14375 under both global and paired Lipschitz matching.The global-match exact p-value is 0.001953125; the matched arms intentionally use a smaller raw physical budget while aligning the encoder-bound product.Source: E Input-scaling control details · p. 13, Table 8 · p. 14
  • Gain replacement changes the zero-budget correct-class rate from 0.663 to 0.047, so its AURA components reflect a changed decision function, not attenuation alone.The decomposition is N −T = 0.34708 and T −F = −0.38375; both have Holm p = 0.00390625 and |δ| = 1.Source: Table 9 · p. 14, E Input-scaling control details · p. 14
  • Refitting the classification head after gain replacement restores the mean unperturbed detection rate but changes both gains and the head, so it does not isolate EBG.Against the original recipient, the mean detection-rate difference is −0.00000 and AURA changes by 0.02917.Source: E Input-scaling control details · p. 14

F Checks of data and implementation

The checks audit data separation, implementation invariants, and reconstruction of reported summaries; the reproduction section supplies commands for rebuilding and validating paper assets.

F Checks of data and implementation

  • The untuned classical comparison is summarized over ten seeds, with AURA evaluated on all 30 positive held-out trajectories per seed.Source: Table 10 · p. 15
  • The implementation checks cover disjoint train/test trajectories, train-only reducers and scales, a rank-two mapped projector, gradient agreement, attack budgets, and reconstructed statistical summaries.Source: F Checks of data and implementation · pp. 14–15
  • A fresh extraction passes 1,834/1,834 independent checks, and the production archive and merged evidence are hash-verified.The positive-only and matched-control audits also verify worker artifacts, masking rows, reconstructed contrasts, and nonzero combined attacks.Source: F Checks of data and implementation · p. 15

G Reproduction commands

  • The reproduction instructions include environment setup, asset generation, focused validation, and commands for auditing the gain-transplant and head-refit controls.Source: G Reproduction commands · pp. 16–17
Loading 2610.02641v1…