quantum-adversarial-defense

name

quantum-adversarial-defense

description

Quantum adversarial defense methodology using quantum autoencoders for protecting quantum classifiers against adversarial perturbations. Covers quantum autoencoder purification, adversarial training-free defense frameworks, confidence metrics for adversarial sample detection, and evaluation of variational quantum classifiers under attack. Use when defending QML models, analyzing quantum adversarial robustness, implementing purification-based defenses, or studying adversarial attacks on variational quantum circuits.

Quantum Adversarial Defense via Quantum Autoencoders

Defense framework for protecting quantum machine learning classifiers against adversarial perturbations using quantum autoencoder-based purification.

Background

Quantum machine learning models, particularly variational quantum classifiers (VQCs), are vulnerable to adversarial attacks — carefully crafted noise inserted into input data that causes misclassification. While adversarial training (training on adversarial examples) is a common defense, it has practical limitations: it may not be feasible when adversarial samples cannot be generated during training, and models can overfit to specific attack types.

Core Methodology

Quantum Autoencoder Purification Framework

The defense uses a quantum autoencoder (QAE) to purify adversarial samples through reconstruction:

Adversarial Input → Quantum Encoder → Compressed Latent → Quantum Decoder → Purified Output → Quantum Classifier → Prediction

Key insight: The quantum autoencoder learns to compress and reconstruct legitimate data manifold. Adversarial perturbations, being off-manifold, are attenuated during the compression-decompression cycle.

Confidence Metric

The framework provides a confidence metric to identify adversarial samples that cannot be effectively purified:

def purification_confidence(input_state, purified_state):
    """
    Compute fidelity between input and reconstructed state.
    Low fidelity indicates the input may be adversarial
    and cannot be reliably purified.
    """
    fidelity = |<input|purified>|^2
    return fidelity

Two-Stage Defense Pipeline

1. Purification Stage: Pass input through quantum autoencoder
2. Detection Stage: If reconstruction fidelity is below threshold, flag as potentially adversarial

Implementation

Quantum Autoencoder Circuit

import pennylane as qml
import numpy as np

class QuantumAutoencoderDefense:
    def __init__(self, n_qubits, n_latent, n_layers=2):
        self.n_qubits = n_qubits
        self.n_latent = n_latent  # Compressed dimension
        self.n_layers = n_layers
        self.n_trash = n_qubits - n_latent
        
    def encoder(self, params, wires):
        """Encode input into latent space, discarding trash qubits."""
        for layer in range(self.n_layers):
            # Entangling layers
            for i in range(self.n_qubits - 1):
                qml.CNOT(wires=[wires[i], wires[i+1]])
            # Parameterized rotations
            for i in range(self.n_qubits):
                qml.Rot(*params[layer * self.n_qubits + i], wires=wires[i])
    
    def purification_cost(self, input_circuit, params):
        """
        Cost function: maximize fidelity between
        original clean states and purified outputs.
        Trash qubits should be in |0> state after encoding.
        """
        # Apply input state preparation
        input_circuit()
        
        
        .encoder(params, wires=(.n_qubits))
        
        
        trash_expectation = (
            qml.expval(qml.PauliZ(i))  i  (.n_latent, .n_qubits)
        )
         trash_expectation
    
     ():
        
        
        
        
        
    
     ():
        
        fidelity = .compute_fidelity(input_state, purified_state)
        is_suspicious = fidelity < threshold
         is_suspicious, fidelity

Variational Quantum Classifier (Target Model)

class VariationalQuantumClassifier:
    def __init__(self, n_qubits, n_layers=2):
        self.n_qubits = n_qubits
        self.n_layers = n_layers
        
    def circuit(self, features, weights):
        """VQC circuit for classification."""
        # Data encoding
        for i in range(self.n_qubits):
            qml.RY(features[i], wires=i)
        
        # Variational layers
        for layer in range(self.n_layers):
            for i in range(self.n_qubits):
                qml.Rot(*weights[layer][i], wires=i)
            for i in range(self.n_qubits - 1):
                qml.CNOT(wires=[i, i+1])
        
        # Measurement
        return qml.expval(qml.PauliZ(0))

Defense Integration

class AdversarialDefensePipeline:
    def __init__(self, autoencoder, classifier):
        self.qae = autoencoder
        self.classifier = classifier
    
    def predict(self, input_state, qae_params, vqc_weights):
        """
        Full defense pipeline:
        1. Purify input through QAE
        2. Classify purified state
        3. Return prediction + confidence
        """
        purified = self.qae.purify(input_state, qae_params)
        confidence = self.qae.detect_adversarial(input_state, purified)
        prediction = self.classifier.circuit(purified, vqc_weights)
        return prediction, confidence
    
    def evaluate_under_attack(self, test_data, attack_fn, qae_params, vqc_weights):
        """
        Evaluate defense effectiveness under adversarial attack.
        Compare: accuracy without defense vs with QAE defense.
        """
        results = {
            'clean_accuracy': self.evaluate(test_data, vqc_weights),
            'attacked_accuracy': self.evaluate(test_data, attack_fn, vqc_weights),
            'defended_accuracy': self.evaluate_with_defense(
                test_data, attack_fn, qae_params, vqc_weights
            )
        }
        return results

Training Procedure

Phase 1: Train Quantum Autoencoder

Train on clean (non-adversarial) data only:

def train_autoencoder(qae, clean_data, n_epochs=100):
    """
    Train QAE to compress and reconstruct clean data.
    No adversarial samples needed during training.
    """
    optimizer = qml.AdamOptimizer(learning_rate=0.01)
    params = qae.init_params()
    
    for epoch in range(n_epochs):
        for sample in clean_data:
            cost = qae.purification_cost(sample, params)
            params = optimizer.step(
                lambda p: qae.purification_cost(sample, p), params
            )
    
    return params

Phase 2: Train Quantum Classifier

Train classifier on purified data:

def train_classifier_with_defense(vqc, qae, qae_params, clean_data, labels):
    """Train VQC using QAE-purified inputs."""
    optimizer = qml.GradientDescentOptimizer(learning_rate=0.1)
    weights = vqc.init_weights()
    
    for epoch in range(n_epochs):
        for x, y in zip(clean_data, labels):
            purified = qae.purify(x, qae_params)
            loss = vqc.loss(purified, y, weights)
            weights = optimizer.step(
                lambda w: vqc.loss(purified, y, w), weights
            )
    
    return weights

Evaluation Metrics

Metric	Description
Clean Accuracy	Accuracy on unperturbed test data
Attacked Accuracy	Accuracy under adversarial attack (no defense)
Defended Accuracy	Accuracy under attack with QAE defense
Improvement	Defended - Attacked accuracy (up to 68% reported)
Detection Rate	% of adversarial samples correctly flagged
False Positive Rate	% of clean samples incorrectly flagged

Key Advantages

1. Training-Free Defense: No adversarial training required
2. Attack-Agnostic: Works against various attack types, not overfit to one
3. Confidence Scoring: Provides detectability metric for uncertain samples
4. NISQ Compatible: Uses shallow quantum circuits
5. Dual Protection: Both purifies attack samples AND detects un-purifiable ones

Activation Keywords

• quantum adversarial defense
• quantum autoencoder defense
• adversarial quantum classifier
• quantum adversarial robustness
• QAE purification
• variational quantum classifier defense
• quantum ML security
• adversarial perturbation quantum

Tools Used

• exec: Run quantum simulations with PennyLane or Qiskit
• python: Implement quantum autoencoder circuits and defense evaluation

Best Practices

1. Train QAE on diverse clean data for better purification
2. Tune reconstruction fidelity threshold per dataset
3. Evaluate against multiple attack types (FGSM, PGD, etc.)
4. Use the confidence metric to reject suspicious inputs
5. Report improvement over undefended baseline

Limitations

• Requires additional quantum circuit depth for QAE
• Purification quality depends on autoencoder capacity
• Some sophisticated attacks may bypass purification
• Threshold tuning is dataset-dependent
• Evaluated primarily on image classification tasks

Related Skills

• quantum-reservoir-computing
• quantum-neural-architecture
• hybrid-quantum-classical-architecture

References

• Paper: "Defending Quantum Classifiers against Adversarial Perturbations through Quantum Autoencoders" (arXiv:2604.28176v1)
• Authors: Emma Andrews, Sahan Sanjaya, Prabhat Mishra
• Published: 2026-04-30
• Categories: quant-ph, cs.LG