Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access

• URL: http://arxiv.org/abs/2609.11637v2
• Date: Tue, 15 Sep 2026 06:43:55 GMT
• Title: Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access
• Abstract summary: A quantum classifier assigns labels by evolving an input quantum state and measuring the output, so repeated executions reveal only a distribution over labels.<n>We give a measurement-only framework that returns two complementary guarantees for each input.<n>From 40 executions of two 8-qubit quantum neural networks, our method estimates both bounds, with the expected lower-upper ordering on every tested input.
• Score: 6.902322288643561
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: A quantum classifier assigns labels by evolving an input quantum state and measuring the output, so repeated executions reveal only a distribution over labels. We study certified adversarial robustness for such classifiers under known-readout query access (KRQA), where an evaluator can prepare inputs, knows the quantum measurement, and observes finite-shot outcomes but cannot inspect the internal evolution, parameters, or gradients. We give a measurement-only framework that returns two complementary guarantees for each input: a lower bound ruling out untargeted errors within a radius, and an attack-independent upper bound witnessing an adversarial state within a radius. Both are estimable from the known readout measurement and sampled outcomes, require no tomography or circuit description, and have finite-sample control of probability-estimation error. The upper bound uses gap operators induced by the quantum measurement; the lower bound relaxes state-space search to an efficient optimization over outcome distributions with operator-spectrum constraints, yielding certificates that are never weaker than prior probability-only certificates and can be strictly stronger when the spectral constraints are active. On tractable instances, we compare the lower bound with numerical white-box reference estimates; across multiple classifiers, the upper bound remains informative when standard attacks fail. We further demonstrate real-device feasibility on IBM Quantum hardware: from 40 executions of two 8-qubit quantum neural networks, our method estimates both bounds, with the expected lower-upper ordering on every tested input. Taken together, these results show that robustness claims for quantum classifiers can be audited directly from observable statistics under KRQA.

Related papers

• Conditional validity of quantum event classifiers under collider systematics and quantum estimation uncertainty [0.0]
  Claims about a quantum machine-learning classifier can fail when target data shift or when finite-shot quantum evaluation randomizes the model itself.<n>We develop an information-conditional, fail-closed auditing framework that returns supported, refuted or unresolved verdicts.
  arXiv  Detail & Related papers  (2026-09-02T16:14:58Z)
• QCIVET: A Quantum--Classical Pipeline Integrity Framework with Contract-Based Subtype Verification and Hash-Chained Audit Traces [0.0]
  We propose QCIVET, a contract-based integrity-verification framework for quantum pipelines.<n>We prove soundness under the diamond-norm distance between quantum channels, conditional completeness for informationally complete observable families, and compositionality under inheritance chains.<n> QCIVET is instantiated on three representative applications: variational quantum eigensolver (VQE) for drug discovery, quantum-assisted fraud detection, and customer-side auditing of cloud QPU services.
  arXiv  Detail & Related papers  (2026-05-13T07:19:44Z)
• Efficient and Practical Black-Box Verification of Quantum Metric Learning Algorithms [8.202137984876366]
  Quantum metric learning enhances machine learning by mapping classical data to a quantum Hilbert space with maximal separation between classes.<n>On current NISQ hardware, this mapping process itself is prone to errors and could be fundamentally incorrect.<n>We propose a practical black-box verification protocol to audit the performance of quantum metric learning models.
  arXiv  Detail & Related papers  (2026-03-30T17:07:43Z)
• TARA Test-by-Adaptive-Ranks for Quantum Anomaly Detection with Conformal Prediction Guarantees [0.0]
  Quantum key distribution (QKD) security relies on the ability to distinguish genuine quantum correlations from classical eavesdropper simulations.<n>We introduce TARA, a novel framework combining conformal prediction with sequential martingale testing for quantum anomaly detection.
  arXiv  Detail & Related papers  (2025-12-03T17:53:38Z)
• Unsupervised Conformal Inference: Bootstrapping and Alignment to Control LLM Uncertainty [49.19257648205146]
  We propose an unsupervised conformal inference framework for generation.<n>Our gates achieve close-to-nominal coverage and provide tighter, more stable thresholds than split UCP.<n>The result is a label-free, API-compatible gate for test-time filtering.
  arXiv  Detail & Related papers  (2025-09-26T23:40:47Z)
• COIN: Uncertainty-Guarding Selective Question Answering for Foundation Models with Provable Risk Guarantees [51.5976496056012]
  COIN is an uncertainty-guarding selection framework that calibrates statistically valid thresholds to filter a single generated answer per question.<n>COIN estimates the empirical error rate on a calibration set and applies confidence interval methods to establish a high-probability upper bound on the true error rate.<n>We demonstrate COIN's robustness in risk control, strong test-time power in retaining admissible answers, and predictive efficiency under limited calibration data.
  arXiv  Detail & Related papers  (2025-06-25T07:04:49Z)
• Sound certification of memory-bounded quantum computers [0.1874930567916036]
  We introduce an approach, which we call quantum system quizzing, for the certification of quantum gates in a practical server-user scenario.<n> Importantly, this approach does not require trusted state preparation and measurement and is thus inherently free from the associated systematic errors.<n>A major technical challenge that we are first to resolve in the memory-bounded single-device setup is recovering the tensor product structure of a multi-qubit system.
  arXiv  Detail & Related papers  (2024-11-06T19:23:45Z)
• Simple Tests of Quantumness Also Certify Qubits [69.96668065491183]
  A test of quantumness is a protocol that allows a classical verifier to certify (only) that a prover is not classical. We show that tests of quantumness that follow a certain template, which captures recent proposals such as (Kalai et al., 2022) can in fact do much more. Namely, the same protocols can be used for certifying a qubit, a building-block that stands at the heart of applications such as certifiable randomness and classical delegation of quantum computation.
  arXiv  Detail & Related papers  (2023-03-02T14:18:17Z)
• Certified Robustness of Quantum Classifiers against Adversarial Examples through Quantum Noise [68.1992787416233]
  We show that adding quantum random rotation noise can improve robustness in quantum classifiers against adversarial attacks. We derive a certified robustness bound to enable quantum classifiers to defend against adversarial examples.
  arXiv  Detail & Related papers  (2022-11-02T05:17:04Z)
• Shot-frugal and Robust quantum kernel classifiers [12.146571029233435]
  Quantum kernel methods are a candidate for quantum speed-ups in machine learning. We show that for classification tasks, the aim is reliable classification and not precise kernel evaluation. We motivate a new metric that characterizes the reliability of classification.
  arXiv  Detail & Related papers  (2022-10-13T12:48:23Z)
• Suppressing Amplitude Damping in Trapped Ions: Discrete Weak Measurements for a Non-unitary Probabilistic Noise Filter [62.997667081978825]
  We introduce a low-overhead protocol to reverse this degradation. We present two trapped-ion schemes for the implementation of a non-unitary probabilistic filter against amplitude damping noise. This filter can be understood as a protocol for single-copy quasi-distillation.
  arXiv  Detail & Related papers  (2022-09-06T18:18:41Z)
• Improved Quantum Algorithms for Fidelity Estimation [77.34726150561087]
  We develop new and efficient quantum algorithms for fidelity estimation with provable performance guarantees. Our algorithms use advanced quantum linear algebra techniques, such as the quantum singular value transformation. We prove that fidelity estimation to any non-trivial constant additive accuracy is hard in general.
  arXiv  Detail & Related papers  (2022-03-30T02:02:16Z)
• Excluding false negative error in certification of quantum channels [68.8204255655161]
  This work focuses on the scenario when the false negative error cannot occur, even if it leads to the growth of the probability of false positive error. We establish a condition when it is possible to exclude false negative error after a finite number of queries to the quantum channel in parallel.
  arXiv  Detail & Related papers  (2021-06-04T09:41:11Z)
• Distribution-free uncertainty quantification for classification under label shift [105.27463615756733]
  We focus on uncertainty quantification (UQ) for classification problems via two avenues. We first argue that label shift hurts UQ, by showing degradation in coverage and calibration. We examine these techniques theoretically in a distribution-free framework and demonstrate their excellent practical performance.
  arXiv  Detail & Related papers  (2021-03-04T20:51:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.