A Comparative Analysis of Adversarial Robustness for Quantum and Classical Machine Learning Models - arXiv 2404.16154 - research overview

Aug 4, 2026

Upload by Noah

Adversarial robustness is systematically compared between quantum machine learning (QML) and classical machine learning (ML) models. The study investigates similarities and differences using transfer attacks, perturbation patterns, and Lipschitz bounds, focusing on classification on a handcrafted dataset enabling quantitative feature attribution. Typical QML architectures (amplitude and re-upload encoding with variational parameters) are compared with a classical ConvNet, and a classically approximated Fourier network is evaluated as a quantum-classical middle ground. Results show adversarial transfer across the boundary in both directions, while regularization improves robustness in quantum networks, affecting Lipschitz bounds and transfer behavior.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages11

Reading Time28 min

AccessFree to download

Introduction

Related Work

A Comparative Analysis of Adversarial Robustness for Quantum and Classical Machine Learning Models arXiv :2404 . 16154v1 [ cs .LG] 24 Apr 2024 Maximilian Wendlinger∗†, Kilian Tscharke∗ , Pascal Debus∗ ∗ Quantum Security Technologies Fraunhofer Institute for Applied and Integrated Security Garching near Munich, Germany † Technical University of Munich [maxi.wendlinger@tum.de](maxi.wendlinger@tum.de), {kilian.tscharke, pascal.debus}@aisec.fraunhofer.de Abstract—Quantum machine learning (QML) continues to bean area of tremendous interest from research and industry. While QML models have been shown to be vulnerable to adversarial attacks much in the same manner as classical machine learning models, it is still largely unknown how to compare adversarial attacks on quantum versus classical models. In this paper, we show how to systematically investigate the similarities and differences in adversarial robustness of classical and quantum models using transfer attacks, perturbation patterns and Lipschitz bounds. More specifically, we focus on classification tasks on a handcrafted dataset that allows quantitative analysis for feature attribution. This enables us to get insight, both theoretically and experimentally, on the robustness of classification networks. Westart by comparing typical QML model architectures such as amplitude and re-upload encoding circuits with variational parameters to a classical ConvNet architecture. Next, we introduce a classical approximation of QML circuits (originally obtained with Random Fourier Features sampling but adapted in this work to fit a trainable encoding) and evaluate this model, denoted Fourier network, in comparison to other architectures. Our findings show that this Fourier network can be seen as a “middle ground”on the quantum-classical boundary. While adversarial attacks successfully transfer across this boundary in both directions, we also show that regularization helps quantum networks to be more robust, which has direct impact on Lipschitz bounds and transfer attacks. Index Terms—Adversarial robustness, Feature attribution, Lipschitz bounds, Quantum machine learning, Transfer attacks I. INTRODUCTION Quantum machine learning (QML) offers the potential to expand the current frontiers of many fields in computational technologies [1], with its power to leverage quantummechanical effects such as entanglement and high-dimensional latent spaces paired with insights from classical machine learning (ML) . As a result, recent years have seen an immense research interest in different possibilities to leverage these effects for practical challenges. Most prominently, this includes parameterized quantum circuit (PQC) architectures that allow for the training of variational parameters inside the quantum circuit in order to fit a specific function for classification or regression tasks. It has been shown that although results from quantum variational classifiers look promising, the models can be fooled with carefully crafted modifications of the input samples [2] . These adversarial perturbations, allowing an attacker to force a high misprediction rate in the attacked model, are investigated in the emerging field called quantum adversarial machine learning (QAML) . For classical machine learning approaches, adversarial attacks have been rigorously explored, opening the door for research to find similarities and differences between adversarial attacks on classical and quantum machine learning architectures. In an effort to make the first steps in this direction, West et al. [3] investigate the behavior of different classical and quantum ML models under adversarial attacks and the resulting perturbation patterns in the input. Interestingly, the authors found that classical attacks fail to transfer to the PQC architecture while attacks originally designed for the quantum model seem to work for classical ML models. In this light, the authors suspected a ”quantum supremacy” in adve

FAQs

本文如何比较量子与经典模型的对抗鲁棒性？

通过迁移攻击、扰动模式以及Lipschitz界进行系统对比，并在同一类分类任务与数据集上评估差异。

研究主要使用哪些模型架构进行实验对照？

包括典型QML结构（如幅度与重上传编码电路）、经典ConvNet，以及对QML电路进行经典近似得到的Fourier network。

对抗样本能否跨越量子—经典边界迁移？

可以。攻击在量子与经典之间双向迁移成功，表明两类模型之间存在一定可转移性。

正则化在量子模型鲁棒性中起到什么作用？

正则化能提升量子网络的鲁棒性，并进一步影响Lipschitz界与迁移攻击效果。

Aug 4, 2026

Upload by Noah