Adversarial Quantum Machine Learning: An Information-Theoretic Generalization Analysis
This work addresses the security of quantum machine learning systems against adversarial threats, providing theoretical guarantees for practitioners, but it is incremental as it extends classical adversarial training analysis to the quantum domain.
The paper tackles the vulnerability of quantum classifiers to adversarial attacks by deriving information-theoretic upper bounds on the generalization error for adversarially trained classifiers under bounded-norm white-box attacks, showing that the error decreases as 1/√T with training set size T and scales linearly with perturbation size ε.
In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input state $ρ(x)$ into a state $λ$ that is $ε$-close to the original state $ρ(x)$ in $p$-Schatten distance. Under suitable assumptions on the quantum embedding $ρ(x)$, we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for $p = 1$ and $p = \infty$. The derived upper bounds consist of two terms: the first is an exponential function of the 2-Rényi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size $ε$. Both terms are shown to decrease as $1/\sqrt{T}$ over the training set size $T$ . An extension is also considered in which the adversary assumed during training has different parameters $p$ and $ε$ as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.