Adversarial Robustness Guarantees for Quantum Classifiers
This addresses the critical problem of adversarial robustness for quantum classifiers, offering a theoretical foundation for potential quantum advantages in security, though it is incremental as it builds on existing evidence and focuses on specific scenarios.
The paper tackles the vulnerability of quantum machine learning (QML) algorithms to adversarial attacks by showing that quantum properties can provide fundamental protections, guaranteeing robustness against classically-armed adversaries in certain scenarios, such as weak perturbations, local attacks, and universal adversarial attacks, with numerical evidence supporting the applicability of these theorems.
Despite their ever more widespread deployment throughout society, machine learning algorithms remain critically vulnerable to being spoofed by subtle adversarial tampering with their input data. The prospect of near-term quantum computers being capable of running {quantum machine learning} (QML) algorithms has therefore generated intense interest in their adversarial vulnerability. Here we show that quantum properties of QML algorithms can confer fundamental protections against such attacks, in certain scenarios guaranteeing robustness against classically-armed adversaries. We leverage tools from many-body physics to identify the quantum sources of this protection. Our results offer a theoretical underpinning of recent evidence which suggest quantum advantages in the search for adversarial robustness. In particular, we prove that quantum classifiers are: (i) protected against weak perturbations of data drawn from the trained distribution, (ii) protected against local attacks if they are insufficiently scrambling, and (iii) protected against universal adversarial attacks if they are sufficiently quantum chaotic. Our analytic results are supported by numerical evidence demonstrating the applicability of our theorems and the resulting robustness of a quantum classifier in practice. This line of inquiry constitutes a concrete pathway to advantage in QML, orthogonal to the usually sought improvements in model speed or accuracy.