{"id":"7a917162-725f-4585-9e2b-acf81f9f4d8d","arxiv_id":"2504.17690","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"For adversarially trained quantum classifiers, the excess sample complexity over standard training vanishes with input dimension for rotation embeddings under classical attacks, scales at least linearly for amplitude embeddings, and depends only on Hilbert space dimension under quantum attacks.","lead":"This paper derives new theoretical bounds on how much extra data an adversarially trained quantum classifier needs to generalize when attacked. It finds that rotation-based quantum embeddings can make this extra cost disappear in high-dimensional inputs, while amplitude embeddings cannot.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Proposition 1's exponential decay for rotation embeddings rests on an invalid factorization of the tensor-product angle unitary; the exact excess term grows as Θ(d_H ε√d), so the central vanishing-sample-complexity claim fails.","rationale":"The reader's conditional verdict focused on the omitted perturbation-budget condition and reproducibility issues. My check found a more fundamental defect: the derivation of the rotation-embedding bounds in Appendix E invalidly factorizes the difference of tensor-product unitaries. The exact trace distance for angle-embedded product states under an l_∞ attack grows as ε√d times d_H, hence exponentially in d through d_H=2^d, rather than decaying as (2ε)^d. This falsifies Proposition 1 and the Table I entries for rotation embeddings, and it removes the basis for the paper's headline claim that high-dimensional rotation-embedding classifiers lose no sample complexity to adversarial training. The general covering-number framework in Theorem 3 and the quantum-attack bounds may survive, but the central advertised result is unsupported by the corrected computation. A concrete d=2 numerical check of Eq. (22) settles the issue. Since this is an internal mathematical error rather than a missing condition or a presentation gap, the appropriate verdict is REJECT rather than CONDITIONAL.","tokens_in":29330,"tokens_out":17394,"duration_ms":177887,"concrete_test":"Compute the exact quantity in Eq. (22) for a one-layer angle embedding with d=2, p=∞, ε=0.3 and r=∞: maximize over δ∈[-0.3,0.3]^2 the value 4·2√(1 - cos²(δ_1/2)cos²(δ_2/2)), giving about 1.68, and compare with the Proposition 1 value 2(2ε)^2 = 0.72. If the exact value exceeds the claimed bound, Eq. (E2) and Proposition 1 are falsified; repeat at d=10 to confirm that the exact excess grows exponentially through d_H=2^d rather than decaying.","verdict_should_be":"REJECT","load_bearing_attack":"The rotation-embedding conclusion in Proposition 1 and Table I depends on a trace-distance bound derived in Appendix E that mis-factorizes the difference of tensor-product unitaries. For angle embedding, U(x)=⊗_j e^{-ix_jσ_Y}, so with δ_j = x'_j - x_j one has U(x') - U(x) = (⊗_j e^{-iδ_jσ_Y} - I)U(x). The squared difference operator is therefore 2I - ⊗_j e^{iδ_jσ_Y} - ⊗_j e^{-iδ_jσ_Y}, not ⊗_j(2I - e^{iδ_jσ_Y} - e^{-iδ_jσ_Y}) as the appendix's per-qubit product calculation assumes. The product form replaces a sum of per-qubit phase errors by their product and is much too optimistic for d≥2. For pure product states the exact trace distance is 2√(1 - ∏_j cos²(δ_j/2)); under an l_∞ attacker this is maximized when δ_j=ε for all j, giving S_C = d_H · 2√(1 - cos^{2d}(ε/2)) ≈ d_H ε√d for small ε, whereas Proposition 1 claims O(d_H (2ε)^d). For d=2, ε=0.3, the claimed bound is 0.72 while the exact value for r=∞ is about 1.68; for larger d the exact value grows through d_H=2^d instead of decaying. Thus the advertised exponential decay of the excess Rademacher complexity is not supported, and the central claim of vanishing sample-complexity increase for rotation embeddings under classical attacks is contradicted.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies the generalization error of adversarially trained quantum classifiers, modeling attackers that perturb either the classical input x in an ℓ_p ball or the embedded quantum state ρ(x) in a p-Schatten ball. The main theoretical results are: an upper bound on the adversarial Rademacher complexity (ARC) as the sum of the standard Rademacher complexity and an excess term scaling as O(S/√m) (Theorem 3); a specialization of the excess term to amplitude, angle, and dense embeddings (Proposition 1 and Table I); tighter bounds under a minimum-eigenvalue assumption on the embedding (Theorem 4); and an extension to K-class margin-based classifiers (Theorem 5). The headline claim is that for rotation embeddings under classical attacks, the excess generalization cost of adversarial training vanishes exponentially with the input dimension d, so that adversarial training becomes as sample-efficient as conventional training in high dimension. Numerical experiments on angle and amplitude embeddings are reported in support of these claims.","tokens_in":29670,"tokens_out":11320,"duration_ms":110902,"significance":"If the main claims were correct, the paper would make a valuable contribution: it provides a general ARC-based framework for quantum classifiers, uses standard but non-trivial tools (Talagrand contraction, matrix Khintchine inequalities, covering numbers, Dudley entropy), and gives the first systematic comparison of classical versus quantum adversaries across embedding families. The lower bound in Theorem 4 for noisy embeddings and the multi-class extension are useful structural results, and the paper ships code and data. However, the central high-dimensional vanishing result for rotation embeddings rests on an algebraic error in Proposition 1; the exact excess term grows with the Hilbert-space dimension rather than decaying. Since this result is the paper's main advertised finding, the significance of the manuscript in its current form is substantially compromised.","major_comments":[{"comment":"The derivation of the angle-embedding bound factorizes a tensor-product unitary difference incorrectly. For U(x)=⊗_j e^{-ix_j σ_Y}, the difference U(x+δ)-U(x) is a sum of d terms of the form (⊗_{j<k} e^{-i(x_j+δ_j)σ_Y}) ⊗ (e^{-i(x_k+δ_k)σ_Y}-e^{-ix_kσ_Y}) ⊗ (⊗_{j>k} e^{-ix_jσ_Y}), not the product ⊗_j (e^{-i(x_j+δ_j)σ_Y}-e^{-ix_jσ_Y}). The displayed computation in Appendix E treats the per-qubit phase factors as though they factor through the tensor product, which is only valid for d=1. For L=1, a direct calculation gives |⟨ψ(x)|ψ(x+δ)⟩|=|∏_j cos δ_j|, so the trace distance is 2√(1-∏_j cos²δ_j). Under an ℓ_∞ attack the maximum is achieved at δ_j=ε for all j, giving S_C = d_H · 2√(1-cos^{2d} ε) ≈ 2^{d+1} ε√d for small ε. This grows exponentially in d, whereas Proposition 1 claims S_C ≤ 2L(2ε)^d d^{-d/p}. For d=2, ε=0.3 the claimed bound is 0.72 while the exact S_C is approximately 3.27; for d=10, ε=0.3 the claimed bound is about 0.012 while the exact value exceeds 10^3. The abstract's statement that the sample-complexity increase 'vanishes in the limit of high dimensional inputs', and the corresponding conclusion in Section IV.B.1, is therefore false for rotation embeddings under classical attacks.","section":"Appendix E, Eq. (E2); Proposition 1; Table I; Section IV.B.1"},{"comment":"The dense-embedding bound suffers from the same invalid factorization. For dense rotation embedding the overlap is a product of per-qubit cosine factors, so under an ℓ_∞ attack the trace distance behaves as Θ(ε√d) and the factor d_H=2^{d/2} makes S_C grow exponentially in d, not decay as (2√2ε)^{d/2} times a polynomial factor. The induction used for L-layer embeddings inherits the error, because it relies on the same diamond-norm bound for the per-layer unitary difference. Hence the Table I entries for both angle and dense rotation embeddings do not follow from the preceding derivation.","section":"Appendix E, Eq. (E3); Table I"},{"comment":"The numerical experiment does not provide independent support for the vanishing-excess claim. It plots empirical generalization gaps for m=20 over a small range of d, and the observed 'convergence' of the two curves is not connected to the exact S_C expression; with the correct S_C, the upper bounds in Figure 4 (bottom) would instead grow with d. The experiment is therefore not a valid test of Proposition 1.","section":"Section VII.A, Figure 4"}],"minor_comments":[{"comment":"The displayed 'Combining everything' inequalities omit the factors d_H=2^d and 2^{d/2} that reappear only in Proposition 1; this makes the derivation difficult to follow and should be corrected regardless of the substantive issue above.","section":"Appendix E, Eqs. (E2)-(E3)"},{"comment":"The abstract claims decay 'in the limit of high dimensional inputs' without stating the required condition on ε; even under the paper's own (invalid) bound, the decay for p=∞ requires something like 2ε<1, and for p<∞ the factor d^{-d/p} can dominate. If the paper is revised, the threshold conditions must be stated in the abstract.","section":"Abstract and Section IV.B.1"},{"comment":"The symbol S_C is used in Appendix D for the un-scaled quantity sup ∥ρ(x)-ρ(x′)∥_{r/(r-1)}, while in Theorem 3 it denotes d_H times that quantity. The notation should be made consistent, e.g. by writing S_C^{raw} in the proof.","section":"Appendix D and Theorem 3"},{"comment":"The text says the conditional mean vectors are chosen so that the embedded states of the class means are orthogonal, but the precise padding used for amplitude embedding when d is not a power of two is only mentioned in passing; a short description of the padding would improve reproducibility.","section":"Section VII.A"}],"recommendation":"reject","confidential_remarks":"The general ARC framework and Theorems 3-5 may be salvageable, but the paper's headline result is refuted by a direct calculation. Since the vanishing-excess claim for rotation embeddings is the main advertised contribution and is not a local presentation issue, I do not see how a routine revision can fix it within the paper's stated scope. I would recommend rejection, while noting that a substantially rewritten manuscript that either corrects or removes the rotation-embedding claim and focuses on the general bounds could be considered afresh."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Thanks for the report. The paper does something useful: it extends the classical adversarial Rademacher complexity approach to quantum classifiers and gives a unified bound (Theorem 3) that separates standard RC from an embedding-dependent excess term, with covering-number proofs that look broadly correct. The analysis of amplitude embeddings and the noisy-embedding bounds (Theorem 4) are plausible, and the multi-class extension is a nice bonus. The numerical experiments are qualitative support, though they are not heavily documented.\n\nThe soft spot is not the presentation issues or the code link. It is Proposition 1, and it is load-bearing. In Appendix E, the authors bound the diamond distance for angle embeddings by treating the difference of tensor-product unitaries as a product of per-qubit differences. For U(x)=⊗ e^{-ix_j σ_Y}, the difference U(x')−U(x) is (V−I)U(x) with V=⊗ e^{-iδ_j σ_Y}; its operator norm is 2 sin(||δ||_1/2), not (∏|δ_j|)^{1/d} times anything. The exact fidelity for pure states is ∏ cos²(δ_j), so for an l∞ adversary the trace distance is 2√(1−cos^{2d} ε) ≈ 2ε√d, and after the d_H prefactor the scaled excess S_C grows like 2^d ε√d. That is the opposite of the paper's claim that S_C decays as (2ε)^d. The same per-qubit factorization problem affects the dense-embedding bound. Correcting this removes the main conclusion in the abstract and the 'vanishing sample complexity' statements in Section IV.B.1 and the conclusion.\n\nThe general framework could still be salvageable—Theorem 3 itself is not the problem—but the paper's most interesting result is currently unsupported and in fact contradicted by the exact calculation. The authors need to redo Proposition 1 and either find a different mechanism for the decay or report the exponential sensitivity. The minor items the report mentions (abstract missing the ε threshold, missing code link, no error bars) are real and worth fixing, but they are secondary.\n\nWould I referee this? Yes, with the expectation that the authors will need to confront the tensor-product error. It is substantial enough and the framework is useful enough to deserve the referee time. But I would not cite the rotation-embedding result until it is fixed.","headline":"The general ARC framework is a real contribution, but the headline claim for rotation embeddings rests on a per-qubit factorization error in Appendix E; the corrected trace distance grows with d, so the vanishing sample-complexity result does not survive.","tokens_in":30156,"tokens_out":5645,"would_cite":false,"duration_ms":51062,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68Q32","81P68","68T05"],"pacs":["03.67.Lx"],"model":"deepseek-v4-flash","headline":"For rotation-embedded quantum classifiers under classical attacks, the extra sample complexity of adversarial training vanishes as the input dimension grows.","keywords":["adversarial training","quantum classifiers","Rademacher complexity","generalization bounds","quantum embeddings","adversarial robustness","rotation embedding","amplitude embedding"],"falsifier":"Train an angle-embedding binary classifier on a fixed $m=20$ sample with an $\\ell_\\infty$ classical adversary of budget $\\epsilon=0.3$, and record the adversarial generalization gap (adversarial test loss minus adversarial training loss) at increasing dimensions $d$; the theory predicts the gap should trend to zero as $d$ grows, so a gap that plateaus above zero would contradict the exponential-decay claim.","tokens_in":29106,"feed_emoji":"⚛️","tokens_out":13463,"duration_ms":118451,"temperature":0.7,"pith_summary":"The paper asks whether making a quantum classifier robust to adversarial perturbations forces it to need more training data than a conventionally trained classifier. It answers with PAC-style bounds on the adversarial generalization error (the gap between adversarial training loss and test loss) expressed through the adversarial Rademacher complexity. The central finding is that for rotation embeddings—angle or dense—attacked on the classical input vector, the excess Rademacher complexity decays at least exponentially in the data dimension $d$, so the sample-complexity penalty of adversarial training vanishes as $d$ grows. In contrast, amplitude embeddings pay at least linearly in $d$, and quantum-state attacks make the excess depend on the embedding only through the Hilbert-space dimension $d_H$. These bounds tell a practitioner which embedding to choose when robustness to a given attack matters.","feed_headline":"Rotation embeddings erase adversarial training's sample-cost penalty","feed_subtitle":"For rotation encoders under classical attacks, the excess generalization error decays exponentially with dimension.","key_machinery":"The load-bearing object is the adversarial Rademacher complexity (ARC): the expectation over Rademacher signs of the supremum over classifiers of the average signed adversarial loss, with the loss evaluated at the worst-case perturbation inside the attack ball. The proof's mechanism is a covering-number and Dudley entropy-integral argument that decomposes the ARC into the standard Rademacher complexity plus an excess term controlled by $S^{C/Q}_{r,p,\\epsilon}$, the scaled adversarial smoothness of the embedding: Hilbert-space dimension times the worst-case $r/(r-1)$-Schatten distance between perturbed states. Bounding $S^{C/Q}_{r,p,\\epsilon}$ for specific embeddings—through the diamond norm for rotation circuits and through normalized inner products for amplitude encoding—turns the abstract bound into the dimension-dependent conclusions.","core_discovery":"Under an $r$-Schatten-norm constraint on the measurement observable and a $(p,\\epsilon)$ adversarial budget, the paper proves that the adversarial Rademacher complexity of binary quantum classifiers satisfies $\\mathrm{ARC}\\le \\mathrm{RC}+bS^{C/Q}_{r,p,\\epsilon}J(r)/\\sqrt{m}$, where $\\mathrm{RC}$ is the usual Rademacher complexity of the classifier class and $S^{C/Q}_{r,p,\\epsilon}$ is a scaled adversarial smoothness term. For classical attacks, Proposition 1 bounds $S^C_{r,p,\\epsilon}$ by $2L(2\\epsilon)^d d^{-d/p}$ for $L$-layer angle embeddings and $2L(2\\sqrt{2}\\epsilon)^{d/2}\\max\\{d^{-d/4},d^{-d/2p}\\}$ for dense embeddings, while amplitude embedding gives a factor growing linearly with $d$. Thus the excess term in the ARC bound decays exponentially with $d$ for rotation embeddings whenever the attack budget is small enough, making adversarial and conventional generalization bounds asymptotically equal in the high-dimensional limit. For quantum attacks the same theorem gives $S^Q_{r,p,\\epsilon}\\le \\epsilon\\max\\{1,d_H^{1-1/p-1/r}\\}$, so the embedding enters only through the Hilbert-space dimension $d_H$. A separate theorem for noisy embeddings whose minimum eigenvalue is at least $\\epsilon$ proves $\\mathrm{ARC}\\ge \\mathrm{RC}$, showing that uniform-convergence-based adversarial generalization is provably no easier than standard generalization in that setting.","pith_inferences":["An implicit consequence of Proposition 1 is that the vanishing sample-complexity penalty is a small-budget phenomenon: for $\\ell_\\infty$ attacks on angle embeddings the controlling factor is $(2\\epsilon)^d$, so the qualitative regime flips once $\\epsilon\\ge 1/2$; this threshold is a natural place to look for a phase transition in adversarial generalization.","Because the quantum-attack bound depends on the embedding only through $d_H$, comparisons of adversarial robustness across different encodings should be made at matched Hilbert-space dimension; otherwise apparent differences will reflect dimension rather than the attack.","A testable extension suggested by the bound is to measure the adversarial generalization gap of an angle-embedded classifier at fixed small $\\epsilon$ and increasing $d$: the gap should shrink at least as fast as $(2\\epsilon)^d$, and the observed rate would probe whether the exponential factor is the real bottleneck."],"forward_implications":["For angle or dense rotation embeddings with classical attacks, if the perturbation budget is small enough (e.g., $2\\epsilon<1$ for $p=\\infty$), adversarial training requires asymptotically no more samples than conventional training as $d\\to\\infty$, so highly expressive repeated rotation encodings can be used without an adversarial sample-complexity penalty.","For amplitude embeddings under classical attacks, the excess Rademacher complexity grows at least linearly in $d$, so adversarial robustness cannot be obtained for free in the high-dimensional limit with this embedding.","For quantum-state attacks, the excess generalization error depends on the embedding only through the Hilbert-space dimension $d_H$; rotation embeddings therefore pay an exponential penalty in $d$, while amplitude embeddings incur an at most quadratic penalty.","For noisy embeddings whose minimum eigenvalue is at least $\\epsilon$, adversarial uniform convergence is at least as hard as conventional uniform convergence: $\\mathrm{ARC}\\ge\\mathrm{RC}$.","Multi-class adversarial generalization inherits the same excess-complexity behavior as the binary case, with an additional factor of the number of classes $K$ in the bound."],"supporting_citations":[{"why":"Supplies the adversarial Rademacher complexity decomposition for linear classifiers that the proof adapts to the quantum setting.","marker":"[13]"},{"why":"Provides the margin-based adversarial complexity analysis for deep networks that the multi-class extension in Theorem 5 follows.","marker":"[14]"},{"why":"Gives encoding-dependent generalization bounds for parameterized quantum circuits, the standard-training baseline the paper's adversarial bounds are compared with.","marker":"[19]"},{"why":"Defines the classical and quantum attack models and the angle, dense, and amplitude embedding families used throughout.","marker":"[21]"},{"why":"Supplies the Rademacher-complexity PAC framework and multi-class margin bounds that Theorems 1 and 5 build on.","marker":"[23]"},{"why":"Is the prior conference work on adversarial generalization under quantum attacks whose noisy-embedding assumption is generalized by Theorem 4.","marker":"[24]"},{"why":"Provides the covering-number and Dudley entropy-integral machinery used in the proof of Theorem 3.","marker":"[27]"},{"why":"Supplies the diamond-norm lemma used to bound the excess complexity of rotation and dense embeddings in Proposition 1.","marker":"[28]"},{"why":"Provides the operator Khintchine and Tropp inequalities used to bound the standard Rademacher complexity in Theorem 2.","marker":"[30]"}],"fun_headline_variants":["Rotation embeddings erase adversarial training's sample-cost penalty","For rotation encoders, adversarial cost drops exponentially with dimension","Adversarial training penalty vanishes exponentially with input dimension","High input dimensions erase adversarial training's extra sample need"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The exponential-decay conclusion holds only when the attack budget is small enough—for angle embeddings under $\\ell_\\infty$ attacks this requires $2\\epsilon<1$—and the analysis assumes ideal, pure-state rotation circuits of the specific angle or dense form.","fun_headline_variants_meta":{"raw":{"variants":["Rotation embeddings erase adversarial training's sample-cost penalty","For rotation encoders, adversarial cost drops exponentially with dimension","Adversarial training penalty vanishes exponentially with input dimension","High input dimensions erase adversarial training's extra sample need"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000677,"raw_usage":{"total_tokens":3134,"prompt_tokens":1055,"completion_tokens":2079,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":671,"completion_tokens_details":{"reasoning_tokens":2016}},"tokens_in":671,"tokens_out":2079,"duration_ms":17147,"temperature":1.0,"reasoning_tokens":2016,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:34:41.121835+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train an angle-embedding binary classifier on a fixed $m=20$ sample with an $\\ell_\\infty$ classical adversary of budget $\\epsilon=0.3$, and record the adversarial generalization gap (adversarial test loss minus adversarial training loss) at increasing dimensions $d$; the theory predicts the gap should trend to zero as $d$ grows, so a gap that plateaus above zero would contradict the exponential-decay claim.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the adversarial Rademacher complexity decomposition for linear classifiers that the proof adapts to the quantum setting."},{"cited_title":"Rist` e, M","cited_arxiv_id":null,"evidence_quote":"Provides the margin-based adversarial complexity analysis for deep networks that the multi-class extension in Theorem 5 follows."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Gives encoding-dependent generalization bounds for parameterized quantum circuits, the standard-training baseline the paper's adversarial bounds are compared with."},{"cited_title":"Schmidt, S","cited_arxiv_id":null,"evidence_quote":"Supplies the Rademacher-complexity PAC framework and multi-class margin bounds that Theorems 1 and 5 build on."},{"cited_title":"sup f∈Fr 1 m mX i=1 σiϕ(yif(xi)) # . Sinceϕ(·) isη-Lipschitz,R(ℓ◦Gr) can be upper bounded using Talagrand’s contraction inequality [45] as R(ℓ◦G )≤ηR(Fr) with R(Fr) = Eσ","cited_arxiv_id":null,"evidence_quote":"Is the prior conference work on adversarial generalization under quantum attacks whose noisy-embedding assumption is generalized by Theorem 4."},{"cited_title":"Quantum Adversarial Learning for Kernel Methods","cited_arxiv_id":"2404.05824","evidence_quote":"Supplies the diamond-norm lemma used to bound the excess complexity of rotation and dense embeddings in Proposition 1."},{"cited_title":"Simeone et al., An introduction to quantum machine learning for engineers, Foundations and Trends® in Sig- nal Processing 16, 1 (2022)","cited_arxiv_id":null,"evidence_quote":"Provides the operator Khintchine and Tropp inequalities used to bound the standard Rademacher complexity in Theorem 2."}],"review_version":1}