qml-adversarial-robustness-sok

name

qml-adversarial-robustness-sok

description

SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness. Comprehensive systematization of adversarial attacks on QML systems across black-box, gray-box, and white-box threat models with empirical evaluation of poisoning, backdoor, and evasion attacks. Reveals accuracy-robustness trade-offs between encoding schemes and proposes threat-aware, noise-resilient framework for secure QML deployment. Trigger: QML security, quantum adversarial robustness, quantum classifier attack, SoK quantum machine learning, quantum backdoor, QMLP evaluation.

QML Adversarial Robustness SoK

Comprehensive systematization of adversarial robustness in Quantum Machine Learning (QML) systems. Based on arXiv:2511.14989 by Nowmi, Lopez, Imon, Pouryousef, Rahman (2026).

Core Findings

Accuracy-Robustness Trade-off

1. Amplitude encoding: Highest clean accuracy (92.6% MNIST, 67% AZ-Class) but collapses under adversarial perturbations + depolarizing noise
2. Angle encoding: Shallower models more stable under attack
3. Circuit depth impact: Models evaluated at depths 2, 5, 10, and 50 layers
4. QMLP vs CMLP: QMLP more robust to label-flipping poisoning but substantially more vulnerable to gradient-based evasion (FGSM, PGD)

Attack Taxonomy

Threat Model	Attack	Description
Black-box	Label-flipping poisoning	Flips training labels without model access
Gray-box	Encoder-level indiscriminate poisoning	Poisons at quantum encoder level
Gray-box	Proxy-model clean-label backdoor	Backdoor via surrogate model
White-box	Circuit-level backdoor (QTrojan)