arxiv: 2605.00747 · v1 · submitted 2026-05-01 · 🪐 quant-ph · cs.LG

Recognition: unknown

Quantum Interval Bound Propagation for Certified Training of Quantum Neural Networks

Emma Andrews , Nahyeon Kim , Prabhat Mishra

Authors on Pith no claims yet

Pith reviewed 2026-05-09 19:30 UTC · model grok-4.3

classification 🪐 quant-ph cs.LG

keywords quantum neural networkscertified traininginterval bound propagationadversarial robustnessquantum machine learningaffine arithmeticrobust decision boundaries

0 comments

The pith

Quantum interval bound propagation trains neural networks to guarantee correct predictions within adversarial perturbation bounds.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper adapts classical interval bound propagation to quantum circuits, creating QIBP that tracks lower and upper bounds on quantum states as they pass through gates and measurements. It implements the method with both plain interval arithmetic and affine arithmetic to balance tightness of bounds against computational demands. Training then uses these bounds to enforce that the model classifies correctly even after bounded input changes. A sympathetic reader would care because quantum machine learning currently lacks verification tools that classical networks use to resist adversarial attacks.

Core claim

By propagating interval bounds through quantum operations, QIBP produces trained quantum neural networks whose decision boundaries are robust: the models are guaranteed to output the correct class for every sample that stays inside the adversarial perturbation radius used during training.

What carries the argument

Quantum interval bound propagation (QIBP), which carries lower and upper bounds forward through each quantum gate and final measurement using interval or affine arithmetic.

If this is right

Certified models maintain correct classification for all inputs inside the trained robustness radius.
The method supports both interval and affine arithmetic, allowing explicit accuracy-tightness trade-offs during implementation.
Extensive evaluation confirms that the resulting decision boundaries respect the certified guarantees.
The approach supplies the first systematic certified-training routine for quantum neural networks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The same bound-propagation pattern could apply to certifying other quantum algorithms that rely on circuit evaluation rather than neural-network training.
Hybrid quantum-classical pipelines might combine QIBP on the quantum portion with classical certifiers on the rest.
Tighter bounds might be obtained by exploiting quantum-specific features such as superposition or limited entanglement during propagation.

Load-bearing premise

Bounds propagated through quantum gates and measurements remain tight enough to yield useful certification rather than becoming vacuous.

What would settle it

A concrete input that lies inside the trained perturbation bound yet receives the wrong class label from the certified model.

Figures

Figures reproduced from arXiv: 2605.00747 by Emma Andrews, Nahyeon Kim, Prabhat Mishra.

**Figure 1.** Figure 1: Example of an MNIST [3] image of digit 2 being view at source ↗

**Figure 3.** Figure 3: Two layers of a QML ansatz. This ansatz features a view at source ↗

**Figure 2.** Figure 2: Common structure of QML models. B. Quantum Machine Learning view at source ↗

**Figure 4.** Figure 4: An example of interval bound through model layers. view at source ↗

**Figure 5.** Figure 5: Overview of QIBP. In each layer, the interval shifts due to the layer operations, adjusting the worst case bounds. Once view at source ↗

**Figure 6.** Figure 6: Accuracies resulting from (a) interval arithmetic and view at source ↗

read the original abstract

Quantum machine learning is a promising field for efficiently learning features of a dataset to perform a specified task, such as classification. Interval bound propagation (IBP) is a popular certified training method in classical machine learning, where the lower and upper bounds are tracked throughout the model. These bounds are used during training to ensure that the model is certified to predict the correct label even under adversarial perturbations. While IBP is successful in classical domain, there are limited certified training efforts in quantum domain. In this paper, we present quantum interval bound propagation (QIBP) to establish a certified training routine for quantum machine learning, certifying the accuracy of models under adversarial perturbations. We implement QIBP using both interval and affine arithmetic to explore the tradeoffs between the two implementations in terms of accuracy and other design considerations. Extensive evaluation demonstrates that the resulting certified trained models have robust decision boundaries, guaranteed to predict the correct class for the samples within the trained adversarial robustness bounds.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

QIBP adapts classical IBP to quantum neural nets with interval and affine arithmetic, but the real test is whether the bounds stay tight enough through unitaries and measurements to give non-trivial guarantees.

read the letter

This paper takes interval bound propagation from classical ML and adapts it to quantum neural networks for certified training against adversarial attacks, using both interval and affine arithmetic to track bounds through the circuit. They do a good job describing the implementation and exploring the tradeoffs between the two arithmetic styles in terms of accuracy and design. The evaluation claims that the certified trained models end up with robust decision boundaries, meaning they are guaranteed to predict the correct class for samples within the adversarial robustness bounds used in training. That's a reasonable first contribution in an area where certified methods for quantum models are still rare. The main soft spot is the one about bound tightness. Quantum circuits involve unitary transformations that can expand small input intervals significantly, and the final measurement probabilities involve squaring which adds nonlinearity that affine arithmetic doesn't fully handle. The stress test note is right to flag this; if the paper doesn't demonstrate that the certified radii remain meaningful after propagation, the guarantees could be sound but not very useful in practice. I'd look for specific results on how loose the bounds get and whether they beat simple baselines. This work is aimed at researchers in quantum machine learning interested in making models more reliable. It shows honest engagement with the classical IBP literature and applies it to a new domain, so it deserves a serious referee to verify the math and the experimental claims. I'd recommend sending it to peer review with requests for more details on the bound propagation tightness.

Referee Report

2 major / 2 minor

Summary. The paper introduces Quantum Interval Bound Propagation (QIBP) as an extension of classical interval bound propagation to quantum neural networks. It tracks lower and upper bounds on quantum states or measurement outcomes through parameterized quantum circuits using both standard interval arithmetic and affine arithmetic. The method is used for certified training to enforce robust decision boundaries, ensuring correct classification for inputs within specified adversarial perturbation radii. Experiments compare the two arithmetic variants on quantum classification tasks and report that the resulting models achieve the claimed certified robustness.

Significance. If the propagated bounds remain sufficiently tight to yield non-vacuous certificates, the work would be a notable first step toward formally verified quantum machine learning. It directly addresses the gap in certified training for QNNs and provides a concrete implementation tradeoff between interval and affine arithmetic. The approach is grounded in sound over-approximation principles and could enable reliable QML deployment if the quantum-specific looseness issues are controlled.

major comments (2)

[§3 and §4] §3 (Method) and §4 (Experiments): the central claim that models are 'guaranteed to predict the correct class … within the trained adversarial robustness bounds' requires explicit evidence that the output intervals remain informative rather than vacuous. The manuscript should report quantitative tightness metrics (e.g., average output interval width normalized by class separation, or certified radius versus training epsilon) for each dataset and arithmetic variant; without these, it is impossible to verify that the certificates are useful after propagation through unitaries and Born-rule squaring.
[§3.2] §3.2 (Affine arithmetic implementation): the description of bound propagation through rotation gates and the final measurement step does not specify any quantum-specific tightening (phase tracking, post-measurement normalization, or symbolic handling of trigonometric functions). Because unitary evolution and probability squaring are nonlinear, standard affine arithmetic can lose tightness rapidly; the paper must either add such tightening or demonstrate empirically that the resulting bounds still separate classes for the chosen perturbation sizes.

minor comments (2)

Notation for quantum states and measurement operators should be introduced once with consistent symbols (e.g., |ψ⟩ versus density-matrix form) to avoid ambiguity when bounds are applied to amplitudes versus probabilities.
The abstract and introduction would benefit from a brief statement of the circuit depth and qubit count used in the experiments, as these directly affect bound explosion.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We are grateful to the referee for their thorough review and valuable suggestions, which will help improve the clarity and rigor of our work on Quantum Interval Bound Propagation. We address the major comments below.

read point-by-point responses

Referee: [§3 and §4] §3 (Method) and §4 (Experiments): the central claim that models are 'guaranteed to predict the correct class … within the trained adversarial robustness bounds' requires explicit evidence that the output intervals remain informative rather than vacuous. The manuscript should report quantitative tightness metrics (e.g., average output interval width normalized by class separation, or certified radius versus training epsilon) for each dataset and arithmetic variant; without these, it is impossible to verify that the certificates are useful after propagation through unitaries and Born-rule squaring.

Authors: We agree with the referee that providing quantitative evidence of bound tightness is essential to substantiate the practical utility of the certificates. While our experiments demonstrate that the certified models maintain high accuracy under the specified perturbation radii, we did not include explicit metrics such as average interval widths in the original manuscript. In the revised version, we will add these metrics in Section 4, including tables with average output interval widths normalized by class separation and plots or values of certified radius versus training epsilon for both interval and affine arithmetic variants on each dataset. This will allow readers to assess the informativeness of the bounds. revision: yes
Referee: [§3.2] §3.2 (Affine arithmetic implementation): the description of bound propagation through rotation gates and the final measurement step does not specify any quantum-specific tightening (phase tracking, post-measurement normalization, or symbolic handling of trigonometric functions). Because unitary evolution and probability squaring are nonlinear, standard affine arithmetic can lose tightness rapidly; the paper must either add such tightening or demonstrate empirically that the resulting bounds still separate classes for the chosen perturbation sizes.

Authors: We acknowledge that our description in §3.2 relies on standard affine arithmetic without additional quantum-specific optimizations like phase tracking or symbolic trig handling. This is a valid concern given the nonlinearities involved. However, our empirical results show that for the small perturbation sizes and shallow circuits used in the experiments, the bounds do separate the classes sufficiently to yield certified robustness. To strengthen the manuscript, we will revise §3.2 to explicitly note the use of standard affine arithmetic and its potential for bound loosening, and we will include in §4 empirical demonstrations (via the new tightness metrics) that the bounds remain useful for the chosen settings. We believe this addresses the comment without requiring new algorithmic tightening at this stage. revision: partial

Circularity Check

0 steps flagged

No circularity: QIBP is a direct, non-self-referential adaptation of classical IBP to quantum circuits

full rationale

The paper introduces quantum interval bound propagation (QIBP) by extending standard interval and affine arithmetic to track bounds through unitary gates and measurements. No equations or steps reduce by construction to fitted parameters, self-definitions, or load-bearing self-citations. Bound propagation soundness follows from the same over-approximation principles used in classical certified training; the quantum-specific implementation (interval vs. affine arithmetic) is presented as an engineering choice with explicit tradeoffs, not as a derived necessity from prior author work. The central guarantee of certified robustness is stated as a consequence of the propagated bounds remaining sound, without renaming known results or smuggling ansatzes via citation. The derivation chain is self-contained against external benchmarks in classical IBP literature.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract-only review provides no explicit free parameters, axioms, or invented entities; the central claim rests on the unstated assumption that quantum operations admit interval propagation.

pith-pipeline@v0.9.0 · 5461 in / 1114 out tokens · 30608 ms · 2026-05-09T19:30:47.587122+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

24 extracted references · 10 canonical work pages · 5 internal anchors

[1]

An introduction to quantum machine learning,

M. Schuld, I. Sinayskiy, and F. Petruccione, “An introduction to quantum machine learning,”Contemporary Physics, vol. 56, no. 2, pp. 172–185, Apr. 2015

2015
[2]

Quantum adversarial machine learning,

S. Lu, L.-M. Duan, and D.-L. Deng, “Quantum adversarial machine learning,”Physical Review Research, vol. 2, no. 3, p. 033212, Aug. 2020

2020
[3]

The MNIST database of handwritten digits,

Y . LeCun, “The MNIST database of handwritten digits,” 1998

1998
[4]

Scalable Verified Training for Provably Robust Image Classification,

S. Gowal, K. D. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, R. Arandjelovic, T. Mann, and P. Kohli, “Scalable Verified Training for Provably Robust Image Classification,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2019, pp. 4842–4851

2019
[5]

Understanding Certified Training with Interval Bound Propagation,

Y . Mao, M. N. M ¨uller, M. Fischer, and M. Vechev, “Understanding Certified Training with Interval Bound Propagation,”International Con- ference on Representation Learning, vol. 2024, pp. 13 470–13 492, May 2024

2024
[6]

Explaining and Harnessing Adversarial Examples

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,”arXiv:1412.6572, Mar. 2015

work page internal anchor Pith review arXiv 2015
[7]

Towards Deep Learning Models Resistant to Adversarial Attacks

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks,” arXiv:1706.06083, Sep. 2019

work page internal anchor Pith review arXiv 2019
[8]

Training Robust Neural Networks Using Lipschitz Bounds,

P. Pauli, A. Koch, J. Berberich, P. Kohler, and F. Allg ¨ower, “Training Robust Neural Networks Using Lipschitz Bounds,”IEEE Control Sys- tems Letters, vol. 6, pp. 121–126, 2022

2022
[9]

Classical autoencoder distillation of quantum adversarial manipulations,

A. Khatun and M. Usman, “Classical autoencoder distillation of quantum adversarial manipulations,”Physical Review Research, vol. 7, no. 4, p. L042054, Dec. 2025

2025
[10]

A Comparative Analysis of Adversarial Robustness for Quantum and Classical Machine Learning Models,

M. Wendlinger, K. Tscharke, and P. Debus, “A Comparative Analysis of Adversarial Robustness for Quantum and Classical Machine Learning Models,” in2024 IEEE International Conference on Quantum Comput- ing and Engineering (QCE), vol. 01, Sep. 2024, pp. 1447–1457

2024
[11]

Training robust and generalizable quantum models,

J. Berberich, D. Fink, D. Pranji ´c, C. Tutschku, and C. Holm, “Training robust and generalizable quantum models,”Physical Review Research, vol. 6, no. 4, p. 043326, Dec. 2024

2024
[12]

Data re-uploading for a universal quantum classifier,

A. P ´erez-Salinas, A. Cervera-Lierta, E. Gil-Fuster, and J. I. Latorre, “Data re-uploading for a universal quantum classifier,”Quantum, vol. 4, p. 226, Feb. 2020

2020
[13]

VeriQR: A Ro- bustness Verification Tool for Quantum Machine Learning Models,

Y . Lin, J. Guan, W. Fang, M. Ying, and Z. Su, “VeriQR: A Ro- bustness Verification Tool for Quantum Machine Learning Models,” arXiv:2407.13533, Jul. 2024

work page arXiv 2024
[14]

Formal Verification of Variational Quantum Circuits,

N. Assolini, L. Marzari, I. Mastroeni, and A. di Pierro, “Formal Verification of Variational Quantum Circuits,”arXiv:2507.10635, Jul. 2025

work page arXiv 2025
[15]

Schuld and F

M. Schuld and F. Petruccione,Supervised Learning with Quantum Com- puters, ser. Quantum Science and Technology. Springer International Publishing, 2018

2018
[16]

Large-Margin Softmax Loss for Convolutional Neural Networks

W. Liu, Y . Wen, Z. Yu, and M. Yang, “Large-margin softmax loss for convolutional neural networks,”arXiv:1612.02295, 2016

work page Pith review arXiv 2016
[17]

Boosting the certified robustness of l-infinity distance nets,

B. Zhang, D. Jiang, D. He, and L. Wang, “Boosting the certified robustness of l-infinity distance nets,”arXiv:2110.06850, 2021

work page arXiv 2021
[18]

Affine arithmetic and its applications to computer graphics,

J. L. D. Comba and J. Stolfi, “Affine arithmetic and its applications to computer graphics,” inProceedings of VI SIBGRAPI (Brazilian, Symposium on Computer Graphics and Image Processing), 1993, pp. 9–18

1993
[19]

Affine Arithmetic: Concepts and Applications,

L. H. de Figueiredo and J. Stolfi, “Affine Arithmetic: Concepts and Applications,”Numerical Algorithms, vol. 37, no. 1, pp. 147–158, Dec. 2004

2004
[20]

PennyLane: Automatic differentiation of hybrid quantum-classical computations

V . Bergholmet al., “PennyLane: Automatic differentiation of hybrid quantum-classical computations,”arXiv:1811.04968, Jul. 2022

work page internal anchor Pith review arXiv 2022
[21]

PyTorch 2: Faster Machine Learning Through Dynamic Python Bytecode Transformation and Graph Compilation,

J. Anselet al., “PyTorch 2: Faster Machine Learning Through Dynamic Python Bytecode Transformation and Graph Compilation,” inProceed- ings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2, ser. ASPLOS ’24, vol. 2. New York, NY , USA: Association for Computing Machinery, Apr. 2024, ...

2024
[22]

Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms

H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-MNIST: A Novel Image Dataset for Benchmarking Machine Learning Algorithms,” arXiv:1708.07747, Sep. 2017

work page internal anchor Pith review arXiv 2017
[23]

Deep Learning for Classical Japanese Literature

T. Clanuwat, M. Bober-Irizar, A. Kitamoto, A. Lamb, K. Yamamoto, and D. Ha, “Deep Learning for Classical Japanese Literature,” arXiv:1812.01718, Nov. 2018

work page Pith review arXiv 2018
[24]

Adam: A Method for Stochastic Optimization

D. P. Kingma and J. Ba, “Adam: A Method for Stochastic Optimization,” arXiv:1412.6980, Dec. 2014

work page internal anchor Pith review Pith/arXiv arXiv 2014