[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85287-en":3,"doc-seo-85287-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85287,687197207919,"Theodora","https://ap-avatar.wpscdn.com/avatar/a000253d6f5f7c60be?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779446848396160552",8,"Research & Report","When Cheap Gradients Fail: The Measurement Cost of Attacking Quantum Classifiers","Adversarial perturbations endanger machine-learning classifiers, including variational quantum classifiers. The work shows that finite quantum measurement statistics, i.e., shot noise, operate as a built-in defense against gradient-based test-time attacks whose cost grows poorly for the attacker. Any gradient component must be inferred from repeated circuit executions under unbiased gradient estimation, leading to a dimension-dependent measurement budget that cannot be removed by measurement grouping in expressive circuits. Single-step attacks require at least quadratically many shots in input dimension d, and experiments validate polynomial shot-scaling and divergence versus a dimension-independent classical baseline.","arXiv :2607 . 11095v1 [ quant-ph] 13 Jul 2026  \nWhen cheap gradients fail: the measurement cost of attacking quantum classifiers  \nBacui Li 1 ,2 , Chandra Thapa2 , Tansu Alpcan 1 and Udaya Parampalli3  \n1 Department of Electrical and Electronic Engineering, University of Melbourne, Parkville, Victoria 3010, Australia  \n2 CSIRO Data61, Marsfield, NSW 2122, Australia  \n3 School of Computing and Information Systems, University of Melbourne, Parkville, Victoria 3010, Australia  \nE-mail: [bacuil@student.unimelb.edu.au](bacuil@student.unimelb.edu.au)  \nAbstract. Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics, that is, shot noise, act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. We establish, understated assumptions, that single-step attacks need at least quadratically many shotsin the input dimension d, growing as d5/2 under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the d5/2 geometric floor for plateau-mitigated models and grows asd3.00 for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in per sample recovers the parameter-free d3/2 shot-noise geometry (measured d 1.46 ) . Against a matched classical baseline whose attack overhead is dimension-independent (the cheapgradient principle of automatic differentiation), the quantum gradient cost ratio, a gradient’s cost in forward-inference units, grows polynomially, empirically as d 3.00 , so the attacker’s relative cost diverges as the model scales. On a 156-qubit IBM processor ( ibm_boston, 4-qubit circuits, d=12), a simulator–hardware comparison over a 100-input cohort reproduces the effect, the device attack tracking the ideal within a few percent at matched budgets, with the high-shot gradient faithful to the exact one (cohort-median cosine 0.98, mean 0.90) . The experiments establish the scaling law of measurement-based gradient extraction; its defensive consequence operates precisely when the forward map is classically hard to simulate, since only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.  \nKeywords: quantum machine learning, adversarial robustness, parameter-shift rule, shot noise, variational quantum circuits, quantum measurement, finite-shot gradient estimation  \nMeasurement cost of gradient attacks on QML 2  \n1. Introduction  \nModern machine learning models achieve high accuracy under benign conditions yet remain vulnerable to adversarial perturbations: small, deliberately crafted input changes that flip a classifier’s prediction while remaining imperceptible to a human observer [1 , 2 , 3] . Quantum machine learning (QML) [4], whose models are parametrized quantum circuits trained on classical or quantum data, inherits this vulnerability. Existing defenses for QML are largely dynamical: worst-case robustness degrades only polynomially in qubit count [5 , 6], a bound that data-geometry refinements sharpen by exploiting the manifold structure of natural data [7] and that has been benchmarked on quantum classifiers at scale [8]; alongside these, empirical studies report that depolarization, hardware crosstalk, and label noise each enhance robustness on nearterm devices [9 , 10 , 11 , 12] . Dowling et al. [13] organize these protections into a hierarchy of dynamical guarantees rooted in unitarity, operator ","cbCaimy26YVvqtII","https://ap.wps.com/l/cbCaimy26YVvqtII","pdf",1133483,1,57,"English","en",105,"# Introduction\n## Quantum shot noise and gradient-based attacks\n## Measurement-based cost via the parameter-shift rule\n## Paper contributions and scaling results","[{\"question\":\"What mechanism protects variational quantum classifiers against gradient-based attacks?\",\"answer\":\"Finite-shot quantum measurement statistics (shot noise) increase the measurement cost of gradient queries at inference time, acting as an intrinsic defense against gradient-based test-time attacks.\"},{\"question\":\"Why can’t an attacker bypass the gradient measurement cost in white-box extraction?\",\"answer\":\"Under unbiased gradient-estimation rules such as the parameter-shift rule, every gradient component must be inferred from repeated circuit executions, yielding a dimension-dependent measurement budget that measurement grouping cannot eliminate in expressive circuits.\"},{\"question\":\"How does the required number of shots scale with the input dimension for single-step attacks?\",\"answer\":\"Single-step attacks require at least quadratically many shots in the input dimension d, with growth behavior tied to norm-concentration scaling, and iterative attacks analyzed using stochastic gradient Langevin dynamics.\"}]",1784202258,144,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"when-cheap-gradients-fail-the-measurement-cost-of-attacking-quantum-classifiers","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/when-cheap-gradients-fail-the-measurement-cost-of-attacking-quantum-classifiers/85287/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What mechanism protects variational quantum classifiers against gradient-based attacks?","Question",{"text":75,"@type":76},"Finite-shot quantum measurement statistics (shot noise) increase the measurement cost of gradient queries at inference time, acting as an intrinsic defense against gradient-based test-time attacks.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"Why can’t an attacker bypass the gradient measurement cost in white-box extraction?",{"text":80,"@type":76},"Under unbiased gradient-estimation rules such as the parameter-shift rule, every gradient component must be inferred from repeated circuit executions, yielding a dimension-dependent measurement budget that measurement grouping cannot eliminate in expressive circuits.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the required number of shots scale with the input dimension for single-step attacks?",{"text":84,"@type":76},"Single-step attacks require at least quadratically many shots in the input dimension d, with growth behavior tied to norm-concentration scaling, and iterative attacks analyzed using stochastic gradient Langevin dynamics.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]