Pith. sign in

REVIEW 3 major objections 6 minor 17 references

Quantum Computing Supported Adversarial Attack-Resilient Autonomous Vehicle Perception Module for Traffic Sign Classification

T0 review · 3 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that inserting a variational quantum layer into a traffic-sign classifier preserves 85% accuracy under PGD attacks while classical models fall below 21%, with no adversarial preprocessing or retraining.

desk verdict Best-of-1000 circuit selection on the test set likely explains the paper's headline robustness number, which the paper's own Table 3 contradicts. read the letter →

arxiv 2504.12644 v1 pith:DCKZRYG3 submitted 2025-04-17 cs.LG cs.AIcs.CRcs.CVcs.ET

Reek Majumder , Mashrur Chowdhury , Sakib Mahmud Khan , Zadid Khan , Fahim Ahmad , Frank Ngeni , Gurcan Comert , Judith Mwakalonge
show 1 more author
Dimitra Michalaka
This is my paper · ORCID
classification cs.LGcs.AIcs.CRcs.CVcs.ET
keywords quantummachinelearninghybridclassical-quantumdeepadversarialattackstrafficsignclassificationautonomousvehicleperceptionvariationalcircuitstransferprojectedgradientdescent
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that adding a quantum layer to a classical deep-learning classifier makes traffic-sign perception for autonomous vehicles markedly more resistant to adversarial attacks, without image preprocessing or adversarial retraining. The authors build hybrid classical-quantum deep-learning (HCQ-DL) models that use AlexNet or VGG-16 as frozen feature extractors and a variational quantum circuit in place of the final classification layers. Across three white-box attacks, they report that the HCQ-DL models keep accuracy above 91% for gradient and fast-gradient-sign attacks and above 95% with no attack, while the AlexNet-based hybrid keeps 85% accuracy under the strongest attack tested, projected gradient descent, where classical models fall below 21%. If the comparison is sound, a quantum layer alone could serve as a structural defense for AV perception rather than an added detection or denoising stage.

What carries the argument

The load-bearing object is the variational quantum circuit (VQC): a parameterized sequence of single-qubit rotation gates (RX, RY, RZ, U1, U2, U3) and two-qubit controlled gates that produce entanglement, followed by a measurement that maps quantum states to classical probabilities. Features extracted by frozen AlexNet or VGG-16 layers are encoded into the qubit registers; the circuit is trained with the parameter-shift rule, which supplies a numerical gradient where no analytical derivative exists; and the measurement output feeds the final softmax layer. The paper tests over 1000 circuit combinations and identifies a 3-qubit AlexNet circuit and a 4-qubit VGG-16 circuit as the best performers. The hypothesis is that the circuit's entangled, high-dimensional feature mapping is less sensitive to small adversarial perturbations than the corresponding classical linear layer.

What would settle it

Run the same 1000-circuit search twice on the same 182-image training set: once selecting circuits by training accuracy and once selecting them by the 49-image test accuracy, then compare PGD accuracy on a fresh untouched test set. If the training-selected circuit's PGD accuracy is far below 85%, the headline number is an artifact of selection bias; if it remains near 85%, the robustness claim survives.

Watch

Extended reading notes

Core claim

The paper's central claim is that a single well-chosen variational quantum layer, sandwiched between classical linear layers behind a pretrained CNN feature extractor, can be trained end-to-end with the parameter-shift rule and yield classifiers that are intrinsically more robust to adversarial perturbations than their purely classical counterparts. On a balanced LISA stop-sign dataset (182 training, 49 test images), the best AlexNet-based HCQ-DL model sustained 85% accuracy under PGD attacks, compared with accuracies below 21% for classical AlexNet and VGG-16 models, and the hybrid models stayed above 91% under gradient and fast-gradient-sign attacks. The authors interpret this as evidence that quantum feature maps, built from rotational and controlled entangling gates and read out by repeated measurement, create decision boundaries that are harder to push across by small gradient-based perturbations.

Load-bearing premise

The reported robustness assumes the best quantum circuit was chosen without using the 49-image test set, yet the paper describes only one 80/20 split and says 'we selected the models with higher accuracy,' so test-set peeking could inflate the PGD accuracy.

Editorial extensions

If this is right

  • If the reported robustness is real, AV perception modules could gain adversarial resilience by replacing the final linear layer with a trained quantum circuit, with no extra defense pipeline.
  • The AlexNet-based hybrid's 85% PGD accuracy versus the classical models' sub-21% suggests that shallower feature extractors paired with quantum layers may be a better robustness trade-off than deeper networks.
  • Because robustness appears without adversarial training, the approach may also transfer to attack types not seen during training, something retraining-based defenses do not promise.
  • The large circuit search (over 1000 combinations) implies that circuit architecture, not just the presence of a quantum layer, is a decisive factor in robustness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not establish the mechanism: the robustness could come from the quantum feature map acting as a randomized or nonlinear smoother, or from gradient masking that would not survive a black-box or transfer attack; testing those would be a natural next step.
  • A concrete extension is to repeat the circuit search on a held-out validation set and then lock the architecture before touching the test set; that would separate genuine robustness from selection over 1000 circuits.
  • If the effect persists on real noisy quantum hardware rather than an error-free simulator, the same architecture could become a practical defense; the paper does not claim this yet.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This manuscript proposes hybrid classical-quantum deep learning (HCQ-DL) models for binary traffic sign classification, using AlexNet and VGG-16 as frozen feature extractors followed by a parameterized quantum circuit layer and a classical linear classifier. The authors train on a balanced 231-sample LISA subset (182 training, 49 testing) and compare four models, two classical and two hybrid, under three white-box attacks (gradient attack, fast gradient sign attack, and projected gradient descent) at perturbation coefficients from 0.05 to 0.5. They report that HCQ-DL models maintain accuracy above 95% in no-attack scenarios and above 91% for GA and FGSA, and that an AlexNet-based HCQ-DL model retains 85% accuracy under PGD while classical models fall below 21%. The paper claims this demonstrates adversarial robustness without image preprocessing or adversarial retraining.

Significance. If established, the headline result would be notable: a quantum layer inserted into a standard CNN would improve adversarial robustness without any defensive preprocessing or adversarial retraining, which is not a widely expected property of quantum classifiers. The study has concrete strengths: it uses standard attack algorithms, reports the parameter-shift rule for gradient computation, sweeps perturbation intensity over a range, and provides a public code repository. However, the significance is conditional because the central claim rests on a statistically invalid model-selection procedure and on a single architecture result that is partially contradicted by the paper's own Table 3. As presented, the paper is an exploratory empirical report rather than an established robustness result.

major comments (3)
  1. [Section 2.1, Section 3.2.2, Section 3.4] The paper describes an 80/20 train/test split (182/49 samples) with no validation set, states that over 1000 quantum circuits were tested, and says 'we selected the models with higher accuracy' before the adversarial investigation. With only 49 test samples, selecting among 1000 circuits using the test set makes the reported 85% PGD accuracy a maximum over many random quantities rather than an unbiased performance estimate. This selection bias invalidates the headline robustness comparison. The authors should re-run the study with a separate validation set or cross-validation, state the selection criterion explicitly, and report confidence intervals.
  2. [Table 3 and Abstract] Table 3 reports that under PGD the VGG-16 hybrid model achieves 10% accuracy while the VGG-16 classical model achieves 19%, and the AlexNet classical model's worst accuracy is 23%, not below 21%. These numbers contradict the abstract's claim that 'C-DL models achieved accuracies below 21%' and the concluding claim that HCQ-DL models generally provide improved accuracy under adversarial settings compared to classical counterparts. The claim should be restricted to the AlexNet-HCQ PGD result or revised to reflect the VGG-16 PGD comparison honestly.
  3. [Section 4, Tables 2 and 3] All reported accuracies are based on a 49-sample test set with no error bars, repeated runs, or significance tests. For a 49-sample test set, a single accuracy value has a standard error on the order of 5 to 7 percentage points, so single-point comparisons such as 85% versus 23% are far less precise than the paper implies, and the VGG-16 PGD pair (10% versus 19%) is within plausible noise. The authors should provide confidence intervals or a statistical comparison for at least the PGD results.
minor comments (6)
  1. [Section 3.4] The title 'Performance Matrix' should be 'Performance Metrics'.
  2. [Section 3.2.1] 'Rectilinear unit' should be 'rectified linear unit (ReLU)'.
  3. [Section 3.2.2] The reference 'Author46, n.d.' is unresolved; please supply the full citation.
  4. [Section 4] The cross-references 'figure 18c and 19c' should be Figures 4c and 5c.
  5. [Section 2.1] The dataset description should clarify whether the 231-sample balanced set is the full set of cropped signs or a random subsample, and how the balance between stop signs and other signs was achieved.
  6. [Section 6] The statement that the study uses 'error-free quantum simulators' should be acknowledged as a limitation in the main results, not only in the future-work section, since physical NISQ noise could alter the reported robustness.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the HCQ-vs-C-DL accuracy comparison is an empirical measurement computed from the paper's own data; self-citations are motivational, not load-bearing.

full rationale

The paper contains no claimed derivation chain that could be circular: its central result is an empirical accuracy comparison between hybrid classical-quantum deep learning (HCQ-DL) and classical deep learning (C-DL) models on the LISA traffic sign dataset. Values such as '96%, 98%' clean accuracy, 'above 91%' for GA/FGSA, and '85%' AlexNet-HCQ under PGD are measured test-set outcomes, not quantities derived from fitted parameters. Section 3.4 says 'For our investigation of adversarial attacks, we selected the models with higher accuracy'; if that selection used the 49-image test set rather than a held-out validation set, the reported numbers would be optimistically biased. That is a statistical validity concern, not a circularity under the definition used here, because the reported accuracy is not a prediction forced by a fitted input; it is a selected measurement. The self-citations (Majumdar 2023; Baral 2023; Khan 2023) motivate the use of quantum layers and the variational circuit design, but the robustness comparison itself is generated in this paper from its own train/test split and attack simulations, so the citations are not load-bearing. The Future Work note that only error-free Pennylane simulators were used is an external-validity limitation, not a circular step. The abstract's 'below 21%' conflicts with Table 3's AlexNet C-DL minimum of 23%, but that is an internal reporting inconsistency rather than a reduction of the conclusion to its inputs. No equation in the paper defines its target in terms of itself, and no fitted parameter is renamed as a prediction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper's central robustness numbers depend on the chosen quantum circuit (best of 1000), the number of qubits, and tuned hyperparameters. These are selected by search, and the selection set is not disclosed. No new physical entities are introduced.

free parameters (3)
  • Number of qubits in QNN layer = 3 (AlexNet HCQ), 4 (VGG HCQ)
    Chosen as best among tested 2 to 8 qubits; affects quantum expressivity and reported accuracy.
  • Circuit architecture (gate sequence) = Best of 1000 circuits; U1/CZ encoding, RZ/CZ variational, U2 pre-measurement for VGG; U1/CZ encoding, U3/CZ…
    Selected as best performing; the search space is not enumerated, and the selection set is not disclosed.
  • Learning rate, batch size, scheduler step = For example, LR 0.00291, batch 8, step 9 for AlexNet HCQ; LR 0.000194, batch 2, step 8 for VGG HCQ
    Tuned hyperparameters from ranges; they affect training dynamics and the final comparison.
assumptions (4)
  • standard math Quantum gates and the parameter-shift rule are correctly implemented in the PennyLane simulator.
    The paper relies on an error-free simulator; no hardware noise is considered, and the correctness of gradients is assumed.
  • domain assumption Transfer learning features from ImageNet-trained AlexNet and VGG-16 are informative for LISA traffic signs despite the domain shift.
    Frozen early layers from ImageNet are assumed useful for traffic signs, with only 182 training samples.
  • domain assumption The 80/20 split of 231 images produces a representative test set.
    No cross-validation is performed; the test set contains only 49 images, making accuracy estimates noisy.
  • domain assumption White-box attacks generated for HCQ-DL models are as effective as those for C-DL models.
    Attack effectiveness depends on accurate gradients; gradient computation through the quantum layer uses the parameter-shift rule and may be less stable, which would make the quantum models appear artificially robust.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Quantum Computing Supported Adversarial Attack-Resilient Autonomous Vehicle Perception Module for Traffic Sign Classification." pith.science (2026). https://pith.science/paper/DCKZRYG3

@misc{pith2026250412644,
  author       = {Pith},
  title        = {Pith review of: Quantum Computing Supported Adversarial Attack-Resilient Autonomous Vehicle Perception Module for Traffic Sign Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DCKZRYG3}},
  note         = {Machine review of arXiv:2504.12644}
}
read the original abstract

Deep learning (DL)-based image classification models are essential for autonomous vehicle (AV) perception modules since incorrect categorization might have severe repercussions. Adversarial attacks are widely studied cyberattacks that can lead DL models to predict inaccurate output, such as incorrectly classified traffic signs by the perception module of an autonomous vehicle. In this study, we create and compare hybrid classical-quantum deep learning (HCQ-DL) models with classical deep learning (C-DL) models to demonstrate robustness against adversarial attacks for perception modules. Before feeding them into the quantum system, we used transfer learning models, alexnet and vgg-16, as feature extractors. We tested over 1000 quantum circuits in our HCQ-DL models for projected gradient descent (PGD), fast gradient sign attack (FGSA), and gradient attack (GA), which are three well-known untargeted adversarial approaches. We evaluated the performance of all models during adversarial attacks and no-attack scenarios. Our HCQ-DL models maintain accuracy above 95\% during a no-attack scenario and above 91\% for GA and FGSA attacks, which is higher than C-DL models. During the PGD attack, our alexnet-based HCQ-DL model maintained an accuracy of 85\% compared to C-DL models that achieved accuracies below 21\%. Our results highlight that the HCQ-DL models provide improved accuracy for traffic sign classification under adversarial settings compared to their classical counterparts.

Figures

Figures reproduced from arXiv: 2504.12644 by the authors.

Figure 1
Figure 1. Example of adversarial attack on stop signs. [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. Architecture for C-DL and HCQ-DL models. [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Quantum Circuit Architecture with chosen Circuits for our VGG16-based HCQ [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Performance Comparison of VGG16-based C-DL and HCQ-DL models under [PITH_FULL_IMAGE:figures/full_fig_p016_4.png]
Figure 5
Figure 5. Figure 5: Performance Comparison of Alexnet-based C-DL and HCQ-DL models under [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

17 extracted references · 5 canonical work pages

  1. [6]

    arXiv preprint arXiv:1704.01155

    Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155. Khan, Z., Chowdhury, M. and Khan, S.M.,

    arXiv

  2. [8]

    arXiv preprint arXiv:1703.00410

    Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410. Yuan, X., He, P., Zhu, Q. and Li, X.,

    arXiv

  3. [9]

    IEEE transactions on neural networks and learning systems, 30(9), pp.2805-2824

    Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems, 30(9), pp.2805-2824. 21 Papernot, N., McDaniel, P., Wu, X., Jha, S. and Swami, A., 2016, May. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP) (pp. ...

    work page 2016

  4. [13]

    npj Quantum information, 5(1), p.45

    A generative modeling approach for bench- marking and training shallow quantum circuits. npj Quantum information, 5(1), p.45. Khan, Z., Tine, J.M., Khan, S.M., Majumdar, R., Comert, A.T., Rice, D., Comert, G., Michalaka, D., Mwakalonge, J. and Chowdhury, M., 2023, June. Hybrid quantum-classical neural network for incident detection. In 2023 26th Internati...

    work page 2023

  5. [14]

    arXiv preprint arXiv:1811.04968

    Pennylane: Automatic differentiation of hybrid quantum- classical computations. arXiv preprint arXiv:1811.04968. Ho, A. and Bacon, D.,

    arXiv

  6. [15]

    arXiv preprint arXiv:1706.06083

    To- wards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083. Zhuang, F., Qi, Z., Duan, K., Xi, D., Zhu, Y., Zhu, H., Xiong, H. and He, Q.,

    arXiv

  7. [17]

    Physical Review A, 101(3), p.032308

    Circuit-centric quantum classifiers. Physical Review A, 101(3), p.032308. Wendlinger, M., Tscharke, K. and Debus, P., 2024, September. A compara- tive analysis of adversarial robustness for quantum and classical machine learning models. In 2024 IEEE International Conference on Quantum Com- puting and Engineering (QCE) (Vol. 1, pp. 1447-1457). IEEE. 24

    work page 2024

  8. [2012]

    arXiv preprint arXiv:1203.5813

    Quantum computing and the entanglement frontier. arXiv preprint arXiv:1203.5813. Arute, F., Arya, K., Babbush, R., Bacon, D., Bardin, J.C., Barends, R., Biswas, R., Boixo, S., Brandao, F.G., Buell, D.A. and Burkett, B.,

    arXiv

Show all 17 references
  1. [2013]

    arXiv preprint arXiv:1312.6199

    Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199. Moosavi-Dezfooli, S.M., Fawzi, A. and Frossard, P.,

    arXiv

  2. [2014]

    arXiv preprint arXiv:1409.1556

    Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556. Krizhevsky, A., Sutskever, I. and Hinton, G.E.,

    arXiv

  3. [2017]

    arXiv preprint arXiv:1705.02900

    Keeping the bad guys out: Protecting and vaccinat- ing deep learning with jpeg compression. arXiv preprint arXiv:1705.02900. Xu, W., Evans, D. and Qi, Y.,

    arXiv

  4. [2018]

    arXiv preprint arXiv:1811.12641

    Transferable adver- sarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641. 20 Akhtar, N. and Mian, A.,

    arXiv

  5. [2019]

    IEEE Access, 7, pp.70157-70168

    Discretization based solutions for secure machine learning against adversarial attacks. IEEE Access, 7, pp.70157-70168. Liu, Z., Liu, Q., Liu, T., Xu, N., Lin, X., Wang, Y. and Wen, W., 2019, June. Feature distillation: Dnn-oriented jpeg compression against adversarial example...

    2019

  6. [2020]

    Scientific programming, 2020(1), p.7607612

    Image classification algorithm based on deep learning-kernel function. Scientific programming, 2020(1), p.7607612. Pendleton, S.D., Andersen, H., Du, X., Shen, X., Meghjani, M., Eng, Y.H., Rus, D. and Ang, M.H.,

    2020

  7. [2022]

    arXiv preprint arXiv:2205.01225

    A hybrid defense method against adversarial attacks on traffic sign classifiers in autonomous vehicles. arXiv preprint arXiv:2205.01225. Feinman, R., Curtin, R.R., Shintre, S. and Gardner, A.B.,

    arXiv

  8. [2023]

    arXiv preprint arXiv:2302.04633

    Histopatho- logical cancer detection using hybrid quantum computing. arXiv preprint arXiv:2302.04633. Baral, B., Majumdar, R., Bhalgamiya, B. and Roy, T.D., 2023, September. Evaluating Quantum Machine Learning Approaches for Histopathological Cancer Detection: Classical, Hybri...

    2009 arXiv

  9. [2025]

    arXiv preprint arXiv:2502.06471

    Evaluating the performance of quantum process units at large width and depth. arXiv preprint arXiv:2502.06471. Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B. and Swami, A., 2017, April. Practical black-box attacks against machine learning. In Proceedings of t...

    2017 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.