Shadow Tomography Against Adversaries

2025-12-05

AI Summary

This work studies the single-copy quantum shadow tomography problem in adversarial settings: given $M$ observables $O_1,dots,O_M$, estimate their expectation values to precision $varepsilon$ when up to a $gamma$-fraction of measurement outcomes are arbitrarily corrupted. We propose the first non-adaptive robust shadow tomography algorithm, integrating robust mean estimation, randomized Pauli measurements, and a reduction from full-state tomography to shadow tomography. Our analysis leverages the Hilbert–Schmidt norm to exploit Hamiltonian structure. The algorithm achieves an error bound of $ ilde{O}(gamma max_i |O_i|_{mathrm{HS}})$, offering enhanced robustness for structured observables while matching the sample complexity of classical shadow tomography. Numerical simulations demonstrate significant improvement over baseline methods. Moreover, for low-rank states, our approach yields nearly optimal robust state tomography.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Intelligent Robots: State Estimation
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for incomplete, noisy, or partially observed Web-related graphs
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work

Abstract

We study single-copy shadow tomography in the adversarial robust setting, where the goal is to learn the expectation values of $M$ observables $O_1, ldots, O_M$ with $varepsilon$ accuracy, but $γ$-fraction of the outcomes can be arbitrarily corrupted by an adversary. We show that all non-adaptive shadow tomography algorithms must incur an error of $varepsilon= ildeΩ(γmin{sqrt{M}, sqrt{d}})$ for some choice of observables, even with unlimited copies. Unfortunately, the classical shadows algorithm by [HKP20] and naive algorithms that directly measure each observable suffer even more. We design an algorithm that achieves an error of $varepsilon= ilde{O}(γmax_{iin[M]}|O_i|_{HS})$, which nearly matches our worst-case error lower bound for $Mge d$ and guarantees better accuracy when the observables have stronger structure. Remarkably, the algorithm only needs $n=frac{1}{γ^2}log(M/δ)$ copies to achieve that error with probability at least $1-δ$, matching the sample complexity of the classical shadows algorithm that achieves the same error without corrupted measurement outcomes. Our algorithm is conceptually simple and easy to implement. Classical simulation for fidelity estimation shows that our algorithm enjoys much stronger robustness than [HKP20] under adversarial noise. Finally, based on a reduction from full-state tomography to shadow tomography, we prove that for rank $r$ states, both the near-optimal asymptotic error of $varepsilon= ilde{O}(γsqrt{r})$ and copy complexity $ ilde{O}(dr^2/varepsilon^2)= ilde{O}(dr/γ^2)$ can be achieved for adversarially robust state tomography, closing the large gap in [ABCL25] where optimal error can only be achieved using pseudo-polynomial number of copies in $d$.

Problem

• Develops robust shadow tomography algorithm against adversarial measurement corruption.
• Achieves near-optimal error bounds matching worst-case lower limits.
• Improves robustness and efficiency for quantum state tomography.

Innovation

• Adversarial robust algorithm for shadow tomography
• Achieves near-optimal error with logarithmic copies
• Matches classical shadows sample complexity under corruption