Research map / Adversarial robustness and security / Attacks on text and graphs
Generating Universal Adversarial Perturbations for Quantum Classifiers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes QuGAP, a framework that theoretically proves the existence of additive universal adversarial perturbations for amplitude-encoded PQC classifiers and generates them with generative networks, plus unitary UAPs via a fidelity-constrained loss and PQC generators.
Problem
Quantum classifiers based on parametrized quantum circuits are vulnerable to adversarial attacks; existing work shows universal perturbations exist for quantum classifiers but generating effective additive and unitary universal adversarial perturbations remains limited.
Approach
Exploit amplitude-encoding normalization so that additive perturbations can push all inputs into one class; train a classical generative network (QuGAP-A) to produce norm-bounded UAPs, and for unitary UAPs (QuGAP-U) train a PQC-based quantum generator with a loss combining a fooling loss and a fidelity penalty.
Key results
- On TIM at 0.90 fidelity constraint, QuGAP-U achieves 54.88% misclassification versus 6.37% for qBIM.
- On 8x8 MNIST at 0.80 fidelity constraint, QuGAP-U reaches 36.65% misclassification versus 0.00% for qBIM.
- Additive UAP misclassification rates plateau near 50% for binary and 75% for 4-class classification, matching the theoretical (k-1)/k bound.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use QuGAP-U instead of qBIM | PQC unitary UAP generation · TIM binary classification | misclassification rate: 3.18 -> 10.54 (fidelity 0.95); 6.37 -> 54.88 (0.90); 9.44 -> 54.88 (0.85); 13.39 -> 54.88 (0.80); 16.68 -> 54.88 (0.75); | Helped |
| Use QuGAP-U instead of qBIM | PQC unitary UAP generation · MNIST binary classification | misclassification rate: 0.00 -> 12.56 (fidelity 0.85); 0.00 -> 36.65 (0.80); 0.05 -> 50.78 (0.75); 0.15 -> 54.97 (0.70) | Helped |
| Use QuGAP-U instead of qBIM | PQC unitary UAP generation · MNIST binary classification | misclassification rate: 0.00 -> 0.00 (fidelity 0.95); 0.00 -> 0.00 (0.90) | No clear effect |
Surprising findings
- Additive UAPs generated for classical classifiers do not transfer well to quantum classifiers.
- For TIM, misclassification saturates around 54% regardless of decreasing alpha, attributed to a dataset-dependent upper bound.
Limitations
- Experiments are limited to classical simulation rather than real quantum hardware.
- MNIST images had to be downsampled to 16x16 and 8x8 due to computational limits.
- Attacks on higher-dimensional data (MNIST) need deeper PQCs and are weaker than classical simulation results.
Experimental setup
Datasets: MNIST Fashion-MNIST Transverse-field Ising Model (TIM) dataset
Benchmarks: MNIST Fashion-MNIST TIM
Metrics: misclassification rate average fidelity
Baselines: qBIM CNN (classical classifier)
Builds on: qBIM (quantum universal adversarial perturbation) generative adversarial perturbations SWAP test parameter-shift rule
Closest papers by meaning
- Characterizing Trainability of Instantaneous Quantum Polynomial Circuit Born Machine (NeurIPS 2026 · similarity 0.86)
- On the Relation between Trainability and Dequantization of Variational Quantum Learning Models (ICLR 2025 · similarity 0.86)
- Non-asymptotic Approximation Error Bounds of Parameterized Quantum Circuits (NeurIPS 2024 · similarity 0.85)
- Rethink the Role of Deep Learning towards Large-scale Quantum Systems (ICML 2025 · similarity 0.84)
- Exploring channel distinguishability in local neighborhoods of the model space in quantum neural networks (ICLR 2025 · similarity 0.84)
- ATP: Adaptive Threshold Pruning for Efficient Data Encoding in Quantum Neural Networks (CVPR 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.