2024/01/31 by Petros Georgiou, Georgiou, Petros, Sharu Theresa Jose +3
Physics and Astronomy · #Emerging Technologies (cs.ET) #FOS: Computer and information sciences #FOS: Physical sciences #Machine Learning (cs.LG) #Quantum Physics (quant-ph) #Statistical Mechanics and Entropy
paper · pdf · doi:10.48550/arxiv.2402.00176
openalex publication_date 2024/01/31 · openalex created_date 2024/02/04 · openalex updated_date 2026/07/28
In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input state ρ(x) into a state λ that is ε-close to the original state ρ(x) in p-Schatten distance. Under suitable assumptions on the quantum embedding ρ(x), we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for p = 1 and p = ∞. The derived upper bounds consist of two terms: the first is an exponential function of the 2-Rényi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size ε. Both terms are shown to decrease as 1/√(T) over the training set size T . An extension is also considered in which the adversary assumed during training has different parameters p and ε as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.