Optimal Provable Robustness of Quantum Classification via Quantum Hypothesis Testing
This work addresses the reliability and security of quantum classification algorithms, which is crucial for developing defense mechanisms against adversarial attacks and understanding their robustness in practical scenarios, representing a foundational advance in quantum machine learning.
The paper tackles the vulnerability of quantum machine learning models to input perturbations in classification problems by establishing a link between binary quantum hypothesis testing and provably robust quantum classification, resulting in a tight robustness condition and practical protocols for optimal robustness certification. This condition constrains the noise tolerance of classifiers, applicable to both natural and adversarial noise sources.
Quantum machine learning models have the potential to offer speedups and better predictive accuracy compared to their classical counterparts. However, these quantum algorithms, like their classical counterparts, have been shown to also be vulnerable to input perturbations, in particular for classification problems. These can arise either from noisy implementations or, as a worst-case type of noise, adversarial attacks. In order to develop defence mechanisms and to better understand the reliability of these algorithms, it is crucial to understand their robustness properties in presence of natural noise sources or adversarial manipulation. From the observation that measurements involved in quantum classification algorithms are naturally probabilistic, we uncover and formalize a fundamental link between binary quantum hypothesis testing and provably robust quantum classification. This link leads to a tight robustness condition which puts constraints on the amount of noise a classifier can tolerate, independent of whether the noise source is natural or adversarial. Based on this result, we develop practical protocols to optimally certify robustness. Finally, since this is a robustness condition against worst-case types of noise, our result naturally extends to scenarios where the noise source is known. Thus, we also provide a framework to study the reliability of quantum classification protocols beyond the adversarial, worst-case noise scenarios.