Pith. sign in

REVIEW 3 major objections 4 minor 1 cited by

On the Generalization of Adversarially Trained Quantum Classifiers

T0 review · 3 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read For rotation-embedded quantum classifiers under classical attacks, the extra sample complexity of adversarial training vanishes as the input dimension grows.

desk verdict The general ARC framework is a real contribution, but the headline claim for rotation embeddings rests on a per-qubit factorization error in Appendix E; the corrected trace distance grows with d, so the vanishing sample-complexity result does not survive. read the letter →

arxiv 2504.17690 v1 pith:AKGXVIW4 submitted 2025-04-24 quant-ph cs.LG

Petros Georgiou , Aaron Mark Thomas , Sharu Theresa Jose , Osvaldo Simeone This is my paper · ORCID
classification quant-phcs.LG MSC 68Q3281P6868T05 PACS 03.67.Lx
keywords adversarialtrainingquantumclassifiersRademachercomplexitygeneralizationboundsembeddingsrobustnessrotationembeddingamplitude
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether making a quantum classifier robust to adversarial perturbations forces it to need more training data than a conventionally trained classifier. It answers with PAC-style bounds on the adversarial generalization error (the gap between adversarial training loss and test loss) expressed through the adversarial Rademacher complexity. The central finding is that for rotation embeddings—angle or dense—attacked on the classical input vector, the excess Rademacher complexity decays at least exponentially in the data dimension $d$, so the sample-complexity penalty of adversarial training vanishes as $d$ grows. In contrast, amplitude embeddings pay at least linearly in $d$, and quantum-state attacks make the excess depend on the embedding only through the Hilbert-space dimension $d_H$. These bounds tell a practitioner which embedding to choose when robustness to a given attack matters.

What carries the argument

The load-bearing object is the adversarial Rademacher complexity (ARC): the expectation over Rademacher signs of the supremum over classifiers of the average signed adversarial loss, with the loss evaluated at the worst-case perturbation inside the attack ball. The proof's mechanism is a covering-number and Dudley entropy-integral argument that decomposes the ARC into the standard Rademacher complexity plus an excess term controlled by $S^{C/Q}_{r,p,\epsilon}$, the scaled adversarial smoothness of the embedding: Hilbert-space dimension times the worst-case $r/(r-1)$-Schatten distance between perturbed states. Bounding $S^{C/Q}_{r,p,\epsilon}$ for specific embeddings—through the diamond norm for rotation circuits and through normalized inner products for amplitude encoding—turns the abstract bound into the dimension-dependent conclusions.

What would settle it

Train an angle-embedding binary classifier on a fixed $m=20$ sample with an $\ell_\infty$ classical adversary of budget $\epsilon=0.3$, and record the adversarial generalization gap (adversarial test loss minus adversarial training loss) at increasing dimensions $d$; the theory predicts the gap should trend to zero as $d$ grows, so a gap that plateaus above zero would contradict the exponential-decay claim.

Watch

Extended reading notes

Core claim

Under an $r$-Schatten-norm constraint on the measurement observable and a $(p,\epsilon)$ adversarial budget, the paper proves that the adversarial Rademacher complexity of binary quantum classifiers satisfies $\mathrm{ARC}\le \mathrm{RC}+bS^{C/Q}_{r,p,\epsilon}J(r)/\sqrt{m}$, where $\mathrm{RC}$ is the usual Rademacher complexity of the classifier class and $S^{C/Q}_{r,p,\epsilon}$ is a scaled adversarial smoothness term. For classical attacks, Proposition 1 bounds $S^C_{r,p,\epsilon}$ by $2L(2\epsilon)^d d^{-d/p}$ for $L$-layer angle embeddings and $2L(2\sqrt{2}\epsilon)^{d/2}\max\{d^{-d/4},d^{-d/2p}\}$ for dense embeddings, while amplitude embedding gives a factor growing linearly with $d$. Thus the excess term in the ARC bound decays exponentially with $d$ for rotation embeddings whenever the attack budget is small enough, making adversarial and conventional generalization bounds asymptotically equal in the high-dimensional limit. For quantum attacks the same theorem gives $S^Q_{r,p,\epsilon}\le \epsilon\max\{1,d_H^{1-1/p-1/r}\}$, so the embedding enters only through the Hilbert-space dimension $d_H$. A separate theorem for noisy embeddings whose minimum eigenvalue is at least $\epsilon$ proves $\mathrm{ARC}\ge \mathrm{RC}$, showing that uniform-convergence-based adversarial generalization is provably no easier than standard generalization in that setting.

Load-bearing premise

The exponential-decay conclusion holds only when the attack budget is small enough—for angle embeddings under $\ell_\infty$ attacks this requires $2\epsilon<1$—and the analysis assumes ideal, pure-state rotation circuits of the specific angle or dense form.

Editorial extensions

If this is right

  • For angle or dense rotation embeddings with classical attacks, if the perturbation budget is small enough (e.g., $2\epsilon<1$ for $p=\infty$), adversarial training requires asymptotically no more samples than conventional training as $d\to\infty$, so highly expressive repeated rotation encodings can be used without an adversarial sample-complexity penalty.
  • For amplitude embeddings under classical attacks, the excess Rademacher complexity grows at least linearly in $d$, so adversarial robustness cannot be obtained for free in the high-dimensional limit with this embedding.
  • For quantum-state attacks, the excess generalization error depends on the embedding only through the Hilbert-space dimension $d_H$; rotation embeddings therefore pay an exponential penalty in $d$, while amplitude embeddings incur an at most quadratic penalty.
  • For noisy embeddings whose minimum eigenvalue is at least $\epsilon$, adversarial uniform convergence is at least as hard as conventional uniform convergence: $\mathrm{ARC}\ge\mathrm{RC}$.
  • Multi-class adversarial generalization inherits the same excess-complexity behavior as the binary case, with an additional factor of the number of classes $K$ in the bound.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implicit consequence of Proposition 1 is that the vanishing sample-complexity penalty is a small-budget phenomenon: for $\ell_\infty$ attacks on angle embeddings the controlling factor is $(2\epsilon)^d$, so the qualitative regime flips once $\epsilon\ge 1/2$; this threshold is a natural place to look for a phase transition in adversarial generalization.
  • Because the quantum-attack bound depends on the embedding only through $d_H$, comparisons of adversarial robustness across different encodings should be made at matched Hilbert-space dimension; otherwise apparent differences will reflect dimension rather than the attack.
  • A testable extension suggested by the bound is to measure the adversarial generalization gap of an angle-embedded classifier at fixed small $\epsilon$ and increasing $d$: the gap should shrink at least as fast as $(2\epsilon)^d$, and the observed rate would probe whether the exponential factor is the real bottleneck.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies the generalization error of adversarially trained quantum classifiers, modeling attackers that perturb either the classical input x in an ℓ_p ball or the embedded quantum state ρ(x) in a p-Schatten ball. The main theoretical results are: an upper bound on the adversarial Rademacher complexity (ARC) as the sum of the standard Rademacher complexity and an excess term scaling as O(S/√m) (Theorem 3); a specialization of the excess term to amplitude, angle, and dense embeddings (Proposition 1 and Table I); tighter bounds under a minimum-eigenvalue assumption on the embedding (Theorem 4); and an extension to K-class margin-based classifiers (Theorem 5). The headline claim is that for rotation embeddings under classical attacks, the excess generalization cost of adversarial training vanishes exponentially with the input dimension d, so that adversarial training becomes as sample-efficient as conventional training in high dimension. Numerical experiments on angle and amplitude embeddings are reported in support of these claims.

Significance. If the main claims were correct, the paper would make a valuable contribution: it provides a general ARC-based framework for quantum classifiers, uses standard but non-trivial tools (Talagrand contraction, matrix Khintchine inequalities, covering numbers, Dudley entropy), and gives the first systematic comparison of classical versus quantum adversaries across embedding families. The lower bound in Theorem 4 for noisy embeddings and the multi-class extension are useful structural results, and the paper ships code and data. However, the central high-dimensional vanishing result for rotation embeddings rests on an algebraic error in Proposition 1; the exact excess term grows with the Hilbert-space dimension rather than decaying. Since this result is the paper's main advertised finding, the significance of the manuscript in its current form is substantially compromised.

major comments (3)
  1. [Appendix E, Eq. (E2); Proposition 1; Table I; Section IV.B.1] The derivation of the angle-embedding bound factorizes a tensor-product unitary difference incorrectly. For U(x)=⊗_j e^{-ix_j σ_Y}, the difference U(x+δ)-U(x) is a sum of d terms of the form (⊗_{j<k} e^{-i(x_j+δ_j)σ_Y}) ⊗ (e^{-i(x_k+δ_k)σ_Y}-e^{-ix_kσ_Y}) ⊗ (⊗_{j>k} e^{-ix_jσ_Y}), not the product ⊗_j (e^{-i(x_j+δ_j)σ_Y}-e^{-ix_jσ_Y}). The displayed computation in Appendix E treats the per-qubit phase factors as though they factor through the tensor product, which is only valid for d=1. For L=1, a direct calculation gives |⟨ψ(x)|ψ(x+δ)⟩|=|∏_j cos δ_j|, so the trace distance is 2√(1-∏_j cos²δ_j). Under an ℓ_∞ attack the maximum is achieved at δ_j=ε for all j, giving S_C = d_H · 2√(1-cos^{2d} ε) ≈ 2^{d+1} ε√d for small ε. This grows exponentially in d, whereas Proposition 1 claims S_C ≤ 2L(2ε)^d d^{-d/p}. For d=2, ε=0.3 the claimed bound is 0.72 while the exact S_C is approximately 3.27; for d=10, ε=0.3 the claimed bound is about 0.012 while the exact value exceeds 10^3. The abstract's statement that the sample-complexity increase 'vanishes in the limit of high dimensional inputs', and the corresponding conclusion in Section IV.B.1, is therefore false for rotation embeddings under classical attacks.
  2. [Appendix E, Eq. (E3); Table I] The dense-embedding bound suffers from the same invalid factorization. For dense rotation embedding the overlap is a product of per-qubit cosine factors, so under an ℓ_∞ attack the trace distance behaves as Θ(ε√d) and the factor d_H=2^{d/2} makes S_C grow exponentially in d, not decay as (2√2ε)^{d/2} times a polynomial factor. The induction used for L-layer embeddings inherits the error, because it relies on the same diamond-norm bound for the per-layer unitary difference. Hence the Table I entries for both angle and dense rotation embeddings do not follow from the preceding derivation.
  3. [Section VII.A, Figure 4] The numerical experiment does not provide independent support for the vanishing-excess claim. It plots empirical generalization gaps for m=20 over a small range of d, and the observed 'convergence' of the two curves is not connected to the exact S_C expression; with the correct S_C, the upper bounds in Figure 4 (bottom) would instead grow with d. The experiment is therefore not a valid test of Proposition 1.
minor comments (4)
  1. [Appendix E, Eqs. (E2)-(E3)] The displayed 'Combining everything' inequalities omit the factors d_H=2^d and 2^{d/2} that reappear only in Proposition 1; this makes the derivation difficult to follow and should be corrected regardless of the substantive issue above.
  2. [Abstract and Section IV.B.1] The abstract claims decay 'in the limit of high dimensional inputs' without stating the required condition on ε; even under the paper's own (invalid) bound, the decay for p=∞ requires something like 2ε<1, and for p<∞ the factor d^{-d/p} can dominate. If the paper is revised, the threshold conditions must be stated in the abstract.
  3. [Appendix D and Theorem 3] The symbol S_C is used in Appendix D for the un-scaled quantity sup ∥ρ(x)-ρ(x′)∥_{r/(r-1)}, while in Theorem 3 it denotes d_H times that quantity. The notation should be made consistent, e.g. by writing S_C^{raw} in the proof.
  4. [Section VII.A] The text says the conditional mean vectors are chosen so that the embedded states of the class means are orthogonal, but the precise padding used for amplitude embedding when d is not a power of two is only mentioned in passing; a short description of the padding would improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the adversarial Rademacher complexity bound is built from external covering-number, contraction, and Khintchine tools, and the self-citations are contextual rather than load-bearing.

full rationale

The derivation chain is self-contained against standard external machinery. Theorem 2's RC bound follows from Talagrand's contraction inequality, matrix Hölder, Jensen, and operator Khintchine/Tropp inequalities from [23,30,45]. Theorem 3 obtains ARC ≤ RC + b S_{C/Q} J(r)/√m by subadditivity of the supremum, a δ-cover of the Schatten ball (Lemma 1, proved via an explicit Hermitian basis and Gershgorin's theorem), and Dudley's entropy integral; the constant S_C is defined as the embedding's scaled adversarial smoothness d_H sup ||ρ(x)-ρ(x')||, not as a fitted or predicted quantity. Proposition 1 then bounds S_C for amplitude, angle, and dense embeddings by direct trace-distance algebra and the external Lemma B.5 of [28]; no target decay rate is inserted into the assumptions. The noisy-embedding results (Theorem 4) do cite the authors' conference paper [24] for Assumption 1, but the theorem's lower and upper bounds are proved in Appendix F using Hölder, Khintchine, and a σ→−σ symmetry argument, so the citation is not load-bearing. The numerical section validates rather than tunes the bounds; no fitted constants enter the theory. The Appendix E tensor-product factorization flagged by a reader is a possible mathematical-error challenge to Proposition 1, not a circularity: even if it invalidates the exponential-decay conclusion, it is not an instance of a prediction being equivalent to its inputs by construction. Accordingly no circular step is identified.

Assumptions & free parameters 0 free parameters · 7 assumptions · 0 invented entities

The theoretical derivation introduces no fitted parameters: quantities such as b, ε, p, r, L, d, and d_H are inputs to the model or attack definitions, and the numerical constants in the covering bounds are derived, not tuned. The quantum FGSM attack in Appendix H is a new algorithm rather than an invented entity. No new particles, forces, dimensions, or conserved quantities are postulated.

assumptions (7)
  • standard math Talagrand's contraction inequality for Lipschitz loss functions
    Used in Section IV to pass from the loss-composed class to the function class F_r, with a contraction factor η.
  • standard math Hölder's inequality, matrix Khintchine inequalities, and Tropp's inequality for sums of density matrices
    Used in the proofs of Theorem 2 (Appendix C) and Theorem 4 to bound Rademacher sums of quantum states.
  • standard math Covering number bound for r-Schatten norm balls and the Dudley entropy integral
    Core of the Theorem 3 proof in Appendix D, where Lemma 1 covers the observable space A_r and Dudley's bound converts covers into Rademacher complexity.
  • domain assumption Classifier model: f(x)=Tr(Aρ(x)) with A in an r-Schatten ball, and loss φ monotone non-increasing, η-Lipschitz, and bounded
    Defines the function class F_r in Section II. All adversarial generalization bounds are stated only for this model class.
  • domain assumption Pure-state rotation and amplitude embeddings with the specific circuit structures in Section II.A
    Proposition 1 bounds S_C only for amplitude, angle, dense, and L-layer re-uploading embeddings; the exponential decay conclusions depend on these exact circuit forms.
  • ad hoc to paper For p=∞ classical attacks, the perturbation budget satisfies a threshold condition such as 2ε<1 for angle embeddings, so that (2ε)^d d^{-d/p} decays with d
    This condition is not stated in the abstract and is only implicit in Section IV.B.1. Without it, the exponential decay of the excess Rademacher term fails.
  • domain assumption Assumption 1: the minimum eigenvalue of the noisy embedding satisfies λ_min(ρ(x)) ≥ ε
    Required for the tighter bounds and for ARC ≥ RC in Theorem 4. The authors explicitly note that this excludes all pure quantum states.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Generalization of Adversarially Trained Quantum Classifiers." pith.science (2026). https://pith.science/paper/AKGXVIW4

@misc{pith2026250417690,
  author       = {Pith},
  title        = {Pith review of: On the Generalization of Adversarially Trained Quantum Classifiers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AKGXVIW4}},
  note         = {Machine review of arXiv:2504.17690}
}
abstract

Quantum classifiers are vulnerable to adversarial attacks that manipulate their input classical or quantum data. A promising countermeasure is adversarial training, where quantum classifiers are trained by using an attack-aware, adversarial loss function. This work establishes novel bounds on the generalization error of adversarially trained quantum classifiers when tested in the presence of perturbation-constrained adversaries. The bounds quantify the excess generalization error incurred to ensure robustness to adversarial attacks as scaling with the training sample size $m$ as $1/\sqrt{m}$, while yielding insights into the impact of the quantum embedding. For quantum binary classifiers employing \textit{rotation embedding}, we find that, in the presence of adversarial attacks on classical inputs $\mathbf{x}$, the increase in sample complexity due to adversarial training over conventional training vanishes in the limit of high dimensional inputs $\mathbf{x}$. In contrast, when the adversary can directly attack the quantum state $\rho(\mathbf{x})$ encoding the input $\mathbf{x}$, the excess generalization error depends on the choice of embedding only through its Hilbert space dimension. The results are also extended to multi-class classifiers. We validate our theoretical findings with numerical experiments.

Figures

Figures reproduced from arXiv: 2504.17690 by the authors.

Figure 1
Figure 1. FIG. 1. (Adversarial) Generalization error (Test error [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. FIG. 2. The embedding [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. FIG. 3. Illustration of a quantum classifier being subject to [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: FIG. 4. Conventional and adversarial generalization errors [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: FIG. 5. Conventional and adversarial generalization errors [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: FIG. 6. (Top) Conventional and adversarial generalization [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. The interplay of robustness and generalization in quantum machine learning

    quant-ph 2025-06 conditional novelty 4.0 of 10

    Lipschitz-regularized training of variational quantum models reduces the generalization gap and improves robustness on a chaotic time-series inference task, with trainable data encoding outperforming fixed encoding.

Reference graph

Works this paper leans on

61 extracted references · 40 canonical work pages · cited by 1 Pith paper

  1. [1]

    To this end, the following proposition upper bounds the scaled excess RCSC r,p,ϵ for the quantum embeddings introduced in Section II A

    Impact of Quantum Embeddings We now discuss some of the insights gained from the upper bound in Theorem 3 about the choice of quan- tum embedding on adversarial generalization. To this end, the following proposition upper bounds the scaled excess RCSC r,p,ϵ for the quantum embeddings introduced in Section II A. Proposition 1. The scaled excess RC SC r,p,ϵ...

    work page

  2. [2]

    sup f∈Fr mX i=1 σi min x′:∥xi−x′∥p≤ϵ yif(x′) +yif(xi)−yif(xi) # (a) ≤ mR(Fr) + Eσ

    Tighter Bounds for Noisy Embeddings In this section, we focus on quantum adversarial at- tacks and derive tighter bounds on the ARC R(FQ r,p,ϵ), under the following restricted class of noisy embeddings studied in [24]. Assumption 1. The quantum embedding x7→ ρ(x) is such that the minimum eigenvalue λmin(ρ(x))≥ϵ. Assumption 1 is restrictive as it naturally...

    work page

  3. [3]

    Quantum attacks The adversarial examples of quantum attacks are de- fined as ρ′ = arg min ρ∗:∥ρ∗−ρ∥p≤ϵ yTr Oρ∗ . With this definition we can upper bound the term SQ r,p,ϵ as follows SQ r,p,ϵ = max ρ′:∥ρ−ρ′∥p≤ϵ ∥ρ−ρ′∥r/(r−1) ≤ ( ∥ρ−ρ′∥p if 1− 1/r− 1/p≤ 0 ∥ρ−ρ′∥pd1−1/r−1/p H if 1− 1/r− 1/p≥ 0 This is an application of H¨ older’s inequality in the case when ...

    work page

  4. [4]

    S. Wang, E. Fontana, M. Cerezo, K. Sharma, A. Sone, L. Cincio, and P. J. Coles, Noise-induced barren plateaus in variational quantum algorithms, Nature communica- tions 12, 6961 (2021)

    2021

  5. [5]

    attributes this behavior to the standard RC R(Fr), which is known to decrease when the embedding is noisy [20]. VIII. CONCLUSION AND FUTURE WORKS This paper has derived novel generalization error bounds for adversarially trained quantum classifiers via an adversarial Rademacher complexity analysis. Our bounds quantify the increase in sample complexity in-...

    work page

  6. [6]

    A direct computation yields that | ψ(x +δx)|ψ(x)⟩ 2 = dX i,j=1 xi(xi +δxi)xj(xj +δxj) ∥x∥2 2∥x +δx∥2 2 where we write x′ = x +δx

    Amplitude embedding Recall that amplitude embedding describes the map- ping x7→|ψ(x)⟩ = dX n=1 xn ∥x∥2 |n⟩. A direct computation yields that | ψ(x +δx)|ψ(x)⟩ 2 = dX i,j=1 xi(xi +δxi)xj(xj +δxj) ∥x∥2 2∥x +δx∥2 2 where we write x′ = x +δx. Thus ∥ρ(x)−ρ(x′)∥1 = 2 vuut1− dX i,j=1 xi(xi +δxi)xj(xj +δxj) ∥x∥2 2∥x +δx∥2 2 = 2 vuut dX i,j=1 x2 i (xj +δxj)2− xi(xi...

    work page

  7. [7]

    Assume the solution is∥ρ(x)−ρ(x′)∥1≤ L∥U(x)−U (x′)∥⋄ Proof

    Data re-uploading with angle and dense embeddings Consider an L-layer single qubit re-uploading embed- ding circuit x7→ρ(x) =|ϕ(x)⟩⟨ϕ(x)| where |ϕ(x)⟩ = LY l=1 VlU(x) |0⟩,|0⟩ := dO i=1 |0⟩ We proceed with bounding∥ρ(x)−ρ(x′)∥1 which we will do by induction. Assume the solution is∥ρ(x)−ρ(x′)∥1≤ L∥U(x)−U (x′)∥⋄ Proof. We begin by defining the diamond distan...

    work page

  8. [8]

    M. T. West, S. M. Erfani, C. Leckie, M. Sevior, L. C. Hollenberg, and M. Usman, Benchmarking adversarially robust quantum machine learning at scale, Physical Re- view Research 5, 023186 (2023)

    work page 2023

Show all 61 references
  1. [9]

    mX i=1 σiyiTr Aρ(xi) # = 1 m E σ

    Lower bound We begin by considering the standard RC of the func- tion classF2. R(Fr) = 1 m E σ sup A∈Ar " mX i=1 σiyiTr Aρ(xi) # = 1 m E σ " sup A∈Ar Tr A mX i=1 σiyiρ(xi) # (a) = b m E σ " mX i=1 σiyiρ(xi) r r−1 # where (a) follows from H¨ older’s inequality, with equality gu...

  2. [10]

    Upper bound To upper bound the ARC we will make use of the sub- additivity of the supremum operation. In particular R(FQ r,p,ϵ) (F3) = 1 m E σ h sup A∈Ar mX i=1 σi min ρ′:∥ρ′−ρ(xi)∥p≤ϵ yiTr Aρ′ i (F4) = 1 m E σ h sup A∈Ar mX i=1 σi min τ:    ∥τ∥p≤ϵ Trτ = 0 ρ(xi) +τ⪰ 0...

  3. [11]

    Non-Adversarial Multiclass Rademacher Complexity To obtain an upper bound on R(ℓ◦Gr), note that R(ℓ◦Gr) = Eσ h sup fk∈Fr,∀k∈[K] 1 m mX i=1 σiϕγ min k̸=yi fyi(x)−fk(xi) i . Following the proof of [23, Theorem 9.2], we then get that R(ℓ◦Gr)≤ 2K γ Eσ h sup k∈[K],fk∈Fr 1 m mX i=1 ...

  4. [12]

    Adversarial Rademacher Complexity Analysis We derive upper bound on the adversarial Rademacher complexity for multi-class classification defined as R(ℓC r,p,ϵ◦Gr) = Eσ h sup f∈Fr 1 m mX i=1 σi max x′:∥xi−x′∥p≤ϵ ϕγ M(f(x′),yi) i = Eσ h sup f∈Fr 1 m mX i=1 σiϕγ min x′:∥xi−x′∥p≤ϵ...

  5. [13]

    P. N. e. a. Biamonte J., Wittek P., Quantum machine learning, Nature 549, 195–202 (2017)

    2017

  6. [14]

    Rist` e, M

    D. Rist` e, M. P. Da Silva, C. A. Ryan, A. W. Cross, A. D. C´ orcoles, J. A. Smolin, J. M. Gambetta, J. M. Chow, and B. R. Johnson, Demonstration of quantum advan- tage in machine learning, npj Quantum Information 3, 16 (2017)

    2017

  7. [15]

    J. R. McClean, S. Boixo, V. N. Smelyanskiy, R. Bab- bush, and H. Neven, Barren plateaus in quantum neural network training landscapes, Nature communications 9, 4812 (2018)

    2018

  8. [16]

    W. E. Maouaki, N. Innan, A. Marchisio, T. Said, M. Ben- nai, and M. Shafique, Qfal: Quantum federated adversar- ial learning (2025), arXiv:2502.21171 [cs.LG]

    2025 arXiv

  9. [17]

    Bermejo, P

    P. Bermejo, P. Braccia, M. S. Rudolph, Z. Holmes, L. Cincio, and M. Cerezo, Quantum convolutional neu- ral networks are (effectively) classically simulable, arXiv preprint arXiv:2408.12739 (2024)

    2024 arXiv

  10. [18]

    Lu, L.-M

    S. Lu, L.-M. Duan, and D.-L. Deng, Quantum adver- sarial machine learning, Physical Review Research 2, 10.1103/physrevresearch.2.033212 (2020)

    2020 doi

  11. [19]

    W. Ren, W. Li, S. Xu, K. Wang, W. Jiang, F. Jin, X. Zhu, J. Chen, Z. Song, P. Zhang,et al., Experimental quantum adversarial learning with programmable superconducting qubits, Nature Computational Science 2, 711 (2022)

    2022

  12. [20]

    Banchi, J

    L. Banchi, J. Pereira, and S. Pirandola, Generalization in quantum machine learning: A quantum information standpoint, PRX Quantum 2, 040321 (2021)

    2021

  13. [21]

    Du, M.-H

    Y. Du, M.-H. Hsieh, T. Liu, D. Tao, and N. Liu, Quan- tum noise protects quantum classifiers against adver- saries, Physical Review Research 3, 10.1103/physrevre- search.3.023153 (2021)

    2021 doi

  14. [22]

    W. Gong, D. Yuan, W. Li, and D.-L. Deng, Enhancing quantum adversarial robustness by randomized encod- ings, Physical Review Research 6, 023020 (2024)

    2024

  15. [23]

    Schmidt, S

    L. Schmidt, S. Santurkar, D. Tsipras, K. Talwar, and A. Madry, Adversarially robust generalization requires more data, in Advances in Neural Information Process- ing Systems , Vol. 31, edited by S. Bengio, H. Wal- lach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnet...

    2018

  16. [24]

    sup f∈Fr 1 m mX i=1 σiϕ(yif(xi)) # . Sinceϕ(·) isη-Lipschitz,R(ℓ◦Gr) can be upper bounded using Talagrand’s contraction inequality [45] as R(ℓ◦G )≤ηR(Fr) with R(Fr) = Eσ

    addressed the adversarial generalization error under quantum attacks for a subset of the possible embeddings ρ(x) for which direct evaluation of the ARC is possible. In contrast, this more comprehensive study investigates the adversarial generalization error for both quantum a...

  17. [25]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, Towards deep learning models resistant to ad- versarial attacks (2019), arXiv:1706.06083 [stat.ML]

    2019 arXiv

  18. [26]

    D. Yin, R. Kannan, and P. Bartlett, Rademacher com- plexity for adversarially robust generalization, in Inter- national conference on machine learning (PMLR, 2019) pp. 7085–7094

    2019

  19. [27]

    J. Xiao, Y. Fan, R. Sun, and Z.-Q. Luo, Adversarial rademacher complexity of deep neural networks, arXiv preprint arXiv:2211.14966 (2022)

    2022 arXiv

  20. [28]

    Montalbano and L

    G. Montalbano and L. Banchi, Quantum adversarial learning for kernel methods (2024), arXiv:2404.05824 [quant-ph]

    2024 arXiv

  21. [29]

    Schuld and F

    M. Schuld and F. Petruccione, Machine learning with quantum computers (Springer, 2021)

    2021

  22. [30]

    Simeone et al., An introduction to quantum machine learning for engineers, Foundations and Trends® in Sig- nal Processing 16, 1 (2022)

    O. Simeone et al., An introduction to quantum machine learning for engineers, Foundations and Trends® in Sig- nal Processing 16, 1 (2022). 22

    2022

  23. [31]

    M. C. Caro, E. Gil-Fuster, J. J. Meyer, J. Eisert, and R. Sweke, Encoding-dependent generalization bounds for parametrized quantum circuits, Quantum 5, 582 (2021)

    2021

  24. [32]

    J. Yang, W. Xie, and X. Xu, Stability and generalization of quantum neural networks (2025), arXiv:2501.12737 [cs.LG]

    2025 arXiv

  25. [33]

    Dowling, M

    N. Dowling, M. T. West, A. Southwell, A. C. Nakhl, M. Sevior, M. Usman, and K. Modi, Adversarial robust- ness guarantees for quantum classifiers, arXiv preprint arXiv:2405.10360 (2024)

    2024

  26. [34]

    LaRose and B

    R. LaRose and B. Coyle, Robust data encodings for quan- tum classifiers, Physical Review A 102, 10.1103/phys- reva.102.032420 (2020)

    2020 doi

  27. [35]

    Mohri, A

    M. Mohri, A. Rostamizadeh, and A. Talwalkar, Founda- tions of machine learning (MIT Press, 2012)

    2012

  28. [36]

    Georgiou, S

    P. Georgiou, S. T. Jose, and O. Simeone, Adversar- ial quantum machine learning: An information-theoretic generalization analysis, in 2024 IEEE International Sym- posium on Information Theory (ISIT) (2024) pp. 789– 794

    2024

  29. [37]

    Khim and P.-L

    J. Khim and P.-L. Loh, Adversarial risk bounds via func- tion transformation, arXiv preprint arXiv:1810.09519 (2018)

    2018 arXiv

  30. [38]

    Awasthi, N

    P. Awasthi, N. Frank, and M. Mohri, Adversarial learning guarantees for linear hypotheses and neural networks, in International Conference on Machine Learning (PMLR,

  31. [39]

    Vershynin, High-dimensional probability: An introduc- tion with applications in data science, Vol

    R. Vershynin, High-dimensional probability: An introduc- tion with applications in data science, Vol. 47 (Cambridge university press, 2018)

    2018

  32. [40]

    M. C. Caro, H.-Y. Huang, M. Cerezo, K. Sharma, A. Sornborger, L. Cincio, and P. J. Coles, Generalization in quantum machine learning from few training data, Na- ture communications 13, 4919 (2022)

    2022

  33. [41]

    K. Bu, D. E. Koh, L. Li, Q. Luo, and Y. Zhang, Statistical complexity of quantum circuits, Physical Review A 105, 062431 (2022)

    2022

  34. [42]

    Banchi, J

    L. Banchi, J. L. Pereira, S. T. Jose, and O. Simeone, Sta- tistical complexity of quantum learning, arXiv preprint arXiv:2309.11617 (2023)

    2023 arXiv

  35. [43]

    Theresa Jose and O

    S. Theresa Jose and O. Simeone, Transfer learning for quantum classifiers: An information-theoretic generaliza- tion analysis, in 2023 IEEE Information Theory Work- shop (ITW) (2023) pp. 532–537

    2023

  36. [44]

    Shalev-Shwartz and S

    S. Shalev-Shwartz and S. Ben-David, Understanding ma- chine learning: From theory to algorithms (Cambridge university press, 2014)

    2014

  37. [45]

    Similarly, under quantum attack, we get that R(ℓQ r,p,ϵ◦ Gr)≤ηR(FQ r,p,ϵ) with FQ r,p,ϵ = n (x,y )7→h(x,y ) = min ρ′:∥ρ(x)−ρ′∥p≤ϵ yTr(Aρ′) :A∈A r o

    yields, R(ℓC r,p,ϵ◦Gr)≤ηEσ " sup h∈FCr,p,ϵ 1 m mX i=1 σih(xi,yi) # =ηR(FC r,p,ϵ), (19) whereFC r,p,ϵ is the adversarial function class defined as FC r,p,ϵ = n (x,y )7→h(x,y ) = min x′:∥x−x′∥p≤ϵ yf (x′) :f∈F r o . Similarly, under quantum attack, we get that R(ℓQ r,p,ϵ◦ Gr)≤ηR(...

  38. [46]

    C. Zhu, H. Yao, Y. Liu, and X. Wang, Optimizer- dependent generalization bound for quantum neural net- works (2025), arXiv:2501.16228 [quant-ph]

    2025 arXiv

  39. [47]

    Berberich, D

    J. Berberich, D. Fink, D. Pranji´ c, C. Tutschku, and C. Holm, Training robust and generalizable quantum models, arXiv preprint arXiv:2311.11871 (2023)

    2023

  40. [48]

    Huang and S

    C. Huang and S. Zhang, Enhancing adversarial robust- ness of quantum neural networks by adding noise layers, New Journal of Physics 25, 083019 (2023)

    2023

  41. [49]

    J. Guan, W. Fang, and M. Ying, Robustness verifica- tion of quantum classifiers, in Computer Aided Verifi- cation: 33rd International Conference, CAV 2021, Vir- tual Event, July 20–23, 2021, Proceedings, Part I 33 (Springer, 2021) pp. 151–174

    2021

  42. [50]

    J. Guan, W. Fang, and M. Ying, Verifying fairness in quantum machine learning, in International Conference on Computer Aided Verification (Springer, 2022) pp. 408–429

    2022

  43. [51]

    Huang, Y.-L

    J.-C. Huang, Y.-L. Tsai, C.-H. H. Yang, C.-F. Su, C.- M. Yu, P.-Y. Chen, and S.-Y. Kuo, Certified robust- ness of quantum classifiers against adversarial examples through quantum noise, in ICASSP 2023-2023 IEEE In- ternational Conference on Acoustics, Speech and Signal Process...

    2023

  44. [52]

    Liu and P

    N. Liu and P. Wittek, Vulnerability of quantum classi- fication to adversarial perturbations, Phys. Rev. A 101, 062331 (2020)

    2020

  45. [53]

    H. Liao, I. Convy, W. J. Huggins, and K. B. Whaley, Robust in practice: Adversarial attacks on quantum ma- chine learning, Physical Review A 103, 042427 (2021)

    2021

  46. [54]

    Gyurik, V

    C. Gyurik, V. Dunjko, et al., Structural risk minimization for quantum linear classifiers, Quantum 7, 893 (2023)

    2023

  47. [55]

    Schuld, Supervised quantum machine learning mod- els are kernel methods, arXiv preprint arXiv:2101.11020 (2021)

    M. Schuld, Supervised quantum machine learning mod- els are kernel methods, arXiv preprint arXiv:2101.11020 (2021)

    2021 arXiv

  48. [56]

    Schuld, R

    M. Schuld, R. Sweke, and J. J. Meyer, Effect of data encoding on the expressive power of variational quantum- machine-learning models, Physical Review A103, 032430 (2021)

    2021

  49. [57]

    M. T. Michel Ledoux, Probability in Banach Spaces: Isoperimetry and Processes (Springer, 2013)

    2013

  50. [58]

    P. G. Aaron Thomas, Rademacher complexity of quan- tum classifiers

  51. [59]

    Bergholm, J

    V. Bergholm, J. Izaac, M. Schuld, C. Gogolin, S. Ahmed, V. Ajith, M. S. Alam, G. Alonso-Linaje, B. Akash- Narayanan, A. Asadi, J. M. Arrazola, U. Azad, S. Ban- ning, C. Blank, T. R. Bromley, B. A. Cordier, J. Ceroni, A. Delgado, O. D. Matteo, A. Dusko, T. Garg, D. Guala, A. Ha...

    2022 arXiv

  52. [60]

    B.-P. C. Gil-Fuster Elies, Eisert Jens, Understanding quantum machine learning also requires rethinking gen- eralization, Nature Communications 15 (2024)

    2024

  53. [61]

    R. A. Horn and C. R. Johnson, Matrix Analysis , 2nd ed. (Cambridge University Press, Cambridge; New York, 2013)

    2013

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.