On the Generalization of Adversarially Trained Quantum Classifiers

Petros Georgiou, Aaron Mark Thomas, and Sharu Theresa Jose Department of Computer Science, University of Birmingham, UK Osvaldo Simeone KCLIP Lab Centre for Intelligent Information Processing Systems (CIIPS) Department of Engineering, King's College London, UK (Dated: April 25, 2025) Quantum classifiers are vulnerable to adversarial attacks that manipulate their input classical or quantum data. A promising countermeasure is adversarial training, where quantum classifiers are trained by using an attack-aware, adversarial loss function. This work establishes novel bounds on the generalization error of adversarially trained quantum classifiers when tested in the presence of perturbation-constrained adversaries. The bounds quantify the excess generalization error incurred to ensure robustness to adversarial attacks as scaling with the training sample size m as 1 / m, while yielding insights into the impact of the quantum embedding. For quantum binary classifiers employing rotation embedding, we find that, in the presence of adversarial attacks on classical inputs x, the increase in sample complexity due to adversarial training over conventional training vanishes in the limit of high dimensional inputs x . In contrast, when the adversary can directly attack the quantum state ρ ( x) encoding the input x, the excess generalization error depends on the choice of embedding only through its Hilbert space dimension. The results are also extended to multi-class classifiers. I. INTRODUCTION Context and Motivation: Quantum Machine Learning (QML) aims to leverage quantum computing capabilities to outperform classical ML techniques [1, 2]. Recent studies have highlighted limitations of QML including difficulties in training unstructured QML models [3, 4] and the classical simulability of some structured QML models [5]. Another concern with QML models is the fact that, similar to their classical counterparts, QML models are susceptible to adversarial attacks [6-8]. For instance, a quantum classifier utilizing superconduct-ing qubits to classify MRI images, achieving a test accuracy of 99%, was found to be easily deceived by minor adversarial perturbations [7]. This vulnerability poses another challenge on the way to realizing quantum advantages. To address this problem, recent works [9, 10] have explored efficient strategies to defend quantum classifiers against adversarial attacks, with adversarial training emerging as a promising strategy [6]. Adversarial training replaces the standard classification loss with an attack-aware adversarial loss, accounting for the worst-case effect of adversarial perturbation of the input data. This results in a min-max optimization problem with the classifier attempting to minimize the worst-case adversarial loss. In classical machine learning models it has been observed that adversarially trained classifiers have desirable training performance but a poor performance on pxg402@student.bham.ac.uk Figure 1.