The interplay between quantum physics and machine learning gives rise to the emergent frontier of quantum machine learning, where advanced quantum learning models may outperform their classical counterparts in solving certain challenging problems. However, quantum learning systems are vulnerable to adversarial attacks: adding tiny carefully-crafted perturbations on legitimate input samples can cause misclassifications. To address this issue, we propose a general scheme to protect quantum learning systems from adversarial attacks by randomly encoding the legitimate data samples through unitary or quantum error correction encoders. In particular, we rigorously prove that both global and local random unitary encoders lead to exponentially vanishing gradients (i.e. barren plateaus) for any variational quantum circuits that aim to add adversarial perturbations, independent of the input data and the inner structures of adversarial circuits and quantum classifiers. In addition, we prove a rigorous bound on the vulnerability of quantum classifiers under local unitary adversarial attacks. We show that random black-box quantum error correction encoders can protect quantum classifiers against local adversarial noises and their robustness increases as we concatenate error correction codes. To quantify the robustness enhancement, we adapt quantum differential privacy as a measure of the prediction stability for quantum classifiers. Our results establish versatile defense strategies for quantum classifiers against adversarial perturbations, which provide valuable guidance to enhance the reliability and security for both near-term and future quantum learning technologies.
翻译:量子物理和机器学习之间的相互作用产生了量子机器学习的新兴前沿,在这个前沿,先进的量子学习模型在解决某些具有挑战性的问题方面可能优于传统的同类模式。然而,量子学习系统很容易受到对抗性攻击:在合法的输入样本中增加细小的精心制造的扰动可能导致分类错误。为了解决这个问题,我们提出了一个保护量子学习系统不受对抗性攻击的一般性计划,通过统一或量子错误校正编码随机编码将合法数据样本编码成对称。特别是,我们严格证明,全球和地方随机单一的量子学习模型都会导致任何变化性量子电路的梯度迅速消失(即贫化高原),这些变异性电路的目的是增加对抗性扰动性扰动,独立于输入数据以及对抗性输入性电路和量子分类器的内部结构。此外,我们证明,通过随机黑盒量量量误校正校正校正校正来保护量分类,随着我们解误校正错误编码而使其坚固性增加。为了量化稳性,我们调整了稳定性防御性战略,我们调整了定量的精确性战略,我们为精确性战略的精确性,我们为精确性战略的精确性提供了精确度,我们为精确度的精确度的升级性,我们为精确度的精确度的升级性提供了。