When cheap gradients fail: the measurement cost of attacking quantum classifiers

2026-07-13

AI Summary

This work investigates the intrinsic robustness of quantum classifiers against gradient-based adversarial attacks, revealing that shot noise inherent in quantum measurements fundamentally impedes accurate gradient extraction. By developing unbiased gradient estimators, analyzing measurement grouping strategies, and modeling gradient norm decay, the study establishes—for the first time—a scaling law for the measurement cost required by an attacker, which grows as $d^{5/2}$ to $d^3$ with input dimension $d$. This demonstrates that adversaries cannot circumvent prohibitively high sampling overheads in classically intractable quantum models. Experimental validation on a 156-qubit IBM quantum device confirms that high-sample gradient estimates closely align with ideal gradients, substantiating the efficacy of this mechanism in defending against white-box attacks.

Abstract

Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics (shot noise) act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. Under stated assumptions, single-step attacks need at least quadratically many shots in the input dimension $d$, growing as $d^{5/2}$ under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the $d^{5/2}$ geometric floor for plateau-mitigated models and grows as $d^{3.00}$ for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in recovers the parameter-free $d^{3/2}$ shot-noise geometry. Against a matched classical baseline whose attack overhead is dimension-independent (the cheap-gradient principle of automatic differentiation), the quantum gradient cost ratio grows empirically as $d^{3.00}$, so the attacker's relative cost diverges as the model scales. Experiments on a 156-qubit IBM processor (ibm_boston, 4-qubit circuits, $d=12$) reproduce the effect: at matched budgets the device attack tracks the ideal within a few percent, with the high-shot gradient faithful to the exact one. The defense operates precisely when the forward map is classically hard to simulate: only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.

Problem

• quantum classifiers
• adversarial attacks
• measurement cost
• shot noise
• gradient estimation

Innovation

• quantum adversarial robustness
• shot noise
• measurement cost
• gradient estimation
• barren plateaus