sqnn-adversarial-robustness

name

sqnn-adversarial-robustness

description

Stochastic Quantum Neural Network (SQNN) adversarial robustness methodology combining decoherence-contraction theory, quantum dropout regularisation, and Lindblad master equation formulation. Use when: (1) Building adversarially robust quantum neural networks, (2) Studying noise as computational resource in QML, (3) Implementing quantum dropout or depolarising regularisation, (4) Analyzing adversarial robustness of quantum classifiers under FGSM/PGD attacks, (5) Designing hybrid quantum-classical intrusion detection or medical classifiers with noise-based defence, (6) Implementing SQNN on neutral-atom quantum hardware.

SQNN Adversarial Robustness

Core Architecture

SQNN encodes neuronal activations as qubits, synaptic topology as entanglement, and neural noise through a Lindblad master equation.

N-Qubit SQNN Formulation

ρ' = -i[H(θ), ρ] + Σ_k γ_k (L_k ρ L_k† - ½{L_k†L_k, ρ}) + Σ_k ξ_k(t) L_k ρ + ξ_k*(t) ρ L_k†

where H(θ) is the variational Hamiltonian, L_k are Lindblad operators, and ξ_k(t) are Wiener processes.

Decoherence Contraction Theorem

A depolarising channel of strength γ over L entangling layers contracts every weight-w Pauli read-out by factor (1 - 4γ/3)^{wL}. For weight-1 read-out: (1 - 4γ/3)^L.

This transforms the conservative adversarial bound |ΔA| ≤ ∥ε∥/(γ + ∥ε∥) into a predictive, operational law.

Quantum Dropout vs Depolarising Noise

Per-gate dropout (replace variational rotation with identity with probability p):

• Implements curvature-weighted L2 penalty in weight space: (p(1-p)/2) Σ θ² ∂²_θ L
• Maximised at p = 1/2
• Weight-space penalty

Depolarising noise:

• Implements output-space penalty
• Same generalisation effect as dropout (statistically indistinguishable)
• But avoids catastrophic robustness collapse under adversarial attacks

Key Experimental Findings

1. NSL-KDD dataset: depolarising SQNN significantly more robust under strong l∞/l2 attacks (p = 0.04)
2. No catastrophic robustness collapse (classical detectors: 95% → 47%)
3. Robustness variance cut roughly twofold
4. Effect from noise-reshaped training boundary, not attack-time gradient contraction
5. 30-seed study confirms adaptive-penalty formula (p < 10^{-4})
6. Increasing dropout past 1/2 does not help

Implementation Pipeline

1. Encode input features as initial quantum state (amplitude or angle encoding)
2. Apply L layers of entangling gates + single-qubit rotations
3. Inject depolarising channel during training: D(ρ) = (1-γ)ρ + γ I/d
4. Measure expectation values for classification
5. Train via gradient descent on quantum circuit parameters

Neutral-Atom Implementation

• Neutral-atom hardware provides native entanglement for ring-topology SQNN
• Rydberg blockade enables programmable entangling gates
• Feasibility analysis available for N = 4-20 qubits

Pitfalls

• Single-seed studies give misleading conclusions (dichotomy doesn't survive replication)
• Depolarising channel perturbs measured expectation (label noise analogy), not masking subsystems
• Ring entanglement topology essential for non-local anomaly detection (+6 points on XOR-structured data)
• Gradient-trained classical detectors suffer catastrophic robustness collapse under PGD attacks

References

• arXiv:2606.24219 — Filardo, "Decoherence as Defence" (Neurocomputing, 2026)
• arXiv:2606.28252 — Sonawane et al., "Parameter-Efficient CV Photonic QNN" (2026)