Pith. sign in

REVIEW 4 major objections 7 minor 55 references

RobQFL: Robust Quantum Federated Learning in Adversarial Environment

T0 review · 4 major / 7 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Quantum federated learning is as fragile as centralized quantum models, but covering 20–50% of clients with moderate adversarial training restores ~15 points of accuracy under ε≤0.1 attacks at under 2 points clean-accuracy cost.

desk verdict RobQFL has a solid partial-coverage result and useful metrics, but the printed mixed-ε schedule gives every client the same radius, so a headline claim isn't actually tested. read the letter →

arxiv 2509.04914 v1 pith:CCEDS5OX submitted 2025-09-05 quant-ph cs.LG

Walid El Maouaki , Nouhaila Innan , Alberto Marchisio , Taoufik Said , Muhammad Shafique , Mohamed Bennai This is my paper
classification quant-phcs.LG
keywords QuantumFederatedLearningAdversarialRobustnessTrainingNeuralNetworksNon-IIDDataProjectedGradientDescentPerturbationSchedulingMetrics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Quantum federated learning, in which many clients train a shared parameterized quantum circuit without sharing data, is shown to be exactly as vulnerable to small adversarial input perturbations as a single centrally trained quantum model. The paper proposes RobQFL, which runs adversarial training inside the federated loop on only a fraction of clients, with a choice of perturbation strength schedule and warm-start versus scratch optimization. On 15 simulated clients, covering 20–50% of clients with moderate adversarial training raises accuracy under ≤0.1-strength attacks by roughly 15 percentage points while costing less than 2 points of clean accuracy; fine-tuning from a clean model is more stable and better than training from scratch. When three-quarters or more of clients participate, a mix of moderate perturbation strengths beats any single fixed strength. The main practical lesson: full participation and high-strength training are not needed for useful robustness, and data heterogeneity rather than optimization choice is the largest threat to robust QFL.

What carries the argument

The central mechanism is partial-coverage adversarial training with a tunable perturbation schedule embedded inside federated averaging. A fraction γ of clients are adversarially trained; each covered client replaces half its mini-batch with PGD-perturbed samples under a fixed or cyclically assigned perturbation radius ε, and local parameter updates are averaged by the server. The hypothesis class is a 4-qubit parameterized quantum circuit with two hardware-efficient layers and angle encoding. Two new aggregate metrics, ARA and RV, compress the γ×ε accuracy surface into single numbers so that schedules and coverages can be compared directly.

What would settle it

Add a log of εk per client in the mixed-ε runs for K=15, m=3 and check whether the assigned radii vary across clients; if all fifteen clients show the same radius, the mixed-ε comparison does not test a mix, and the ≥75%-coverage optimum is untested. Alternatively, run the same schedule with K=16 or m=4 where (K mod m)−1 genuinely cycles, and see whether the moderate-mix ranking persists.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that federating quantum training does not change a QNN's adversarial fragility, but selective adversarial training within the federated loop restores substantial robustness at negligible clean-accuracy cost. The paper demonstrates a γ×ε design surface for adversarial training in QFL, distills it into the Accuracy-Robustness Area and Robustness Volume metrics, and reports that 20–50% client coverage with fine-tuning at moderate ε gives the best cost-benefit, while mixed-ε schedules pay off only at ≥75% coverage. Under label-sorted non-IID splits, robustness volume falls by about half (49% on MNIST, 60% on Fashion-MNIST), indicating that data

Load-bearing premise

The mixed-ε results assume each client actually receives a distinct perturbation radius from the cyclic schedule; as printed, the assignment rule εk = Ξ[(K mod m)−1] gives the same radius to every client when K=15 and m=3, so the realized experiment may not have tested heterogeneous perturbations.

Editorial extensions

If this is right

  • Partial coverage makes robustness affordable: deployments with limited communication or circuit-execution budgets can still defend against moderate attacks by adversarially training only 20–50% of clients.
  • Fine-tuning from a clean pre-trained model should be preferred over scratch adversarial training for QFL, because it is stable, preserves clean accuracy, and yields higher ARA and RV.
  • For low or uncertain coverage (≤50%), a fixed moderate ε≈0.1 is the safest schedule; for high coverage (≥75%), a moderate ε-mix such as [0.1,0.15,0.2] is optimal, while the strong mix only wins at 100% coverage.
  • Label-sorted non-IID data roughly halves the robustness surface, so any robust-QFL deployment must address data heterogeneity (e.g., through client-shared reference sets) before relying on adversarial-training gains.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The printed cyclic-assignment formula εk = Ξ[(K mod m)−1] is constant for fixed K and m; if the implementation follows the printed equation, the three 'mixed' schedules collapse to a single radius, and the claimed optimality of the moderate mix at ≥75% coverage would need to be re-established with genuinely distinct per-client radii.
  • The ARA/RV metrics and the coverage-versus-schedule methodology transfer directly to classical federated learning and to other QNN ansätze; the numeric findings are tied to a 4-qubit circuit on 3-class 8×8 images, so the design rules may shift with larger qubit registers or harder tasks.
  • A testable extension is to sweep coverage at finer granularity (e.g., 10% steps) with a genuinely cycling ε schedule and check whether the moderate-mix optimum is robust or an artifact of the schedule degeneracy.
  • The near-half robustness loss under label-sorted splits suggests that a small IID-like client-shared reference set could recover a large fraction of robustness; this is directly testable in the same simulator.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes RobQFL, an adversarial-training protocol for quantum federated learning (QFL) in which only a fraction γ of clients perform PGD-based adversarial training. It introduces fixed-ε and mixed-ε perturbation schedules, compares fine-tuning versus scratch training, and summarizes results with two proposed aggregate metrics, ARA and RV. Experiments on 15 simulated clients with 3-class MNIST and Fashion-MNIST under IID and label-sorted non-IID splits lead to four headline claims: QFL is as adversarially fragile as centralized QNN training; training only 20–50% of clients adversarially improves ε≤0.1 accuracy by ~15 pp at <2 pp clean-accuracy cost; fine-tuning is better than scratch training; a moderate ε-mix is optimal at ≥75% coverage; and non-IID data roughly halves robustness.

Significance. If the empirical findings hold, the paper would provide useful design rules for deploying robustness in QFL: partial adversarial coverage, fine-tuning rather than retraining from scratch, and a moderate mixed-radius schedule at high coverage. The systematic coverage sweep, the inclusion of data heterogeneity, and the proposal of compact summary metrics are valuable. However, the paper is purely experimental, with no code, seeds, or repeated runs, and one load-bearing formula in the methodology appears to invalidate the mixed-ε experiment as described. The central mixed-ε optimality claim therefore needs to be re-established after correcting the scheduling formula and adding statistical support.

major comments (4)
  1. [Section III, Methodology (mixed-ε schedule definition)] The per-client perturbation radius is defined as εk = Ξ[(K mod m)−1]. With K=15 and m=3, K mod m = 0, so this expression evaluates to Ξ[−1] for every client k. Thus the printed formula assigns a single fixed radius (the last element of Ξ, e.g., 0.2 for the moderate mix) to all adversarially trained clients, contradicting the stated 'cyclic assignment' and making the three mixes indistinguishable from fixed-ε experiments at that one radius. This is load-bearing because Table III and the conclusion that a moderate ε-mix is optimal at γ≥75% rely on the success of heterogeneous client-specific radii. The authors must correct the index to a client-dependent form such as Ξ[(k−1) mod m], rerun the experiments, and report whether the ranking in Table III survives.
  2. [Section IV, Tables II–IV and Figs. 2–4] All quantitative claims are based on single-run simulations. No random seeds or repeated trials are reported, and no confidence intervals or error bars are given. The aggregate rankings in Table III rely on very small differences (e.g., RV 0.153087 vs. 0.151307), which are well within run-to-run variation for stochastic QNN training. In addition, the PGD attack parameters—number of iterations and step size—are never specified, so the attack strength underlying every curve is ambiguous. The authors should provide at least several independent seeds with mean±std for ARA/RV, and state the full PGD configuration. Without this, the '15 pp', '3–5 pp', and 'highest RV' claims are not statistically supported.
  3. [Abstract and Section IV-D (Non-IID results)] The abstract states that 'training only 20–50% clients adversarially boosts ε≤0.1 accuracy ~15 pp' under 'IID and Non-IID conditions'. But Section IV-D and Table IV show that under label-sorted non-IID splits, adversarial training coverage does not help: the 0% coverage curve performs best, and higher coverage can worsen accuracy significantly (e.g., FMNIST drops to 1–12% at moderate ε). The claimed partial-coverage benefit therefore holds only for the IID setting, and the abstract must be qualified accordingly. This is not a minor wording issue; it defines the regime in which the proposed defense is applicable.
  4. [Section III, RV definition and Section IV-B/C interpretation] The paper states that RV is 'unaffected by how wide a ε- or coverage window is chosen.' This is incorrect: with the normalization 1/(εmax γmax), RV is the mean accuracy over the chosen rectangle, so extending the domain to a region of zero accuracy lowers RV. The sentence should be removed or corrected. More generally, ARA and RV are descriptive summaries of the measured surface, not predictive or fitted quantities; the text should avoid implying that they provide evidence beyond the raw single-run accuracy curves.
minor comments (7)
  1. [Abstract / Section III] The description 'IID and Non-IID conditions' is ambiguous with respect to which claims apply to which condition. Please state explicitly that the partial-coverage benefit was observed for IID splits only.
  2. [Section III, Methodology] The equation for the mixed-ε schedule uses K (total number of clients) instead of k (client index), which is presumably a typo; even with the intended formula, the notation should be corrected to a client-dependent index.
  3. [Table IV] The text refers to 'Adversarial Risk Area' when describing Table IV, while the metric is elsewhere defined as Accuracy-Robustness Area (ARA). Please unify the terminology.
  4. [Figure 3 caption] The caption says 'mixed-ε adversarial-training schedule' but the figure includes fixed-ε baselines and all five schedules. The caption should describe what is actually plotted.
  5. [Section II / Experimental setup] The experiments use a reduced dataset (18,000 training images, 1000 test images, 8×8 pixels, three classes). This is a substantial simplification of MNIST/Fashion-MNIST and should be stated prominently in the abstract or introduction to avoid overgeneralization.
  6. [Section III, PGD adversary] No iteration count, step size, or random restart strategy is given for the PGD attack. This is needed for reproducibility and for interpreting the absolute accuracy values in Tables I–IV.
  7. [Section IV-C] The sentence 'It achieves the highest ε=0.10 accuracy (43.0%)' has an unclear antecedent. Specify which schedule and coverage level are being discussed.

Circularity Check

0 steps flagged · score 1.0 of 10

No circular derivation chain: ARA/RV are descriptive summaries, and the main comparisons come from direct experiments. One printed formula makes the mixed-epsilon schedule constant, but this is an internal-consistency/validity flaw, not a circular reduction.

full rationale

The paper's central claims (partial-coverage gains, fine-tune vs scratch, IID vs non-IID, schedule rankings) come from measured accuracy surfaces A(γ,ε), not from ARA/RV or from parameters fitted to the target conclusions. ARA and RV are defined as integrals/averages of A (Section III) and are used only to summarize already-measured surfaces; they do not generate the robustness values. The comparisons are self-contained simulations, and no prediction is obtained by re-inserting the answer into its own definition. Self-citations, including to the authors' QFAL paper [31], are background attributions; the fragility of QFL is established by Table I in this paper, and no uniqueness theorem or ansatz is imported from prior author work to force the conclusions. One genuine non-circular concern: Section III specifies the 'cyclic' mixed-ε schedule as ϵk = Ξ[(K mod m)−1]. With K=15 and m=3 this evaluates to Ξ[−1] for every client, so as printed the mixed-ε condition is constant rather than heterogeneous; the later 'moderate ε-mix optimal' conclusion (Section IV-C, Table III) would then be a fixed-ε result rather than a test of mixes. This is a load-bearing experimental-validity flaw, but it is not circular reasoning: the metrics remain descriptive and the result is not equivalent to its own input through a fitted relationship. Score reflects no significant circularity, with the validity caveat noted.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The main empirical claims rest on a grid of hand-chosen hyperparameters and on domain assumptions about PGD as threat model and simulation fidelity. No new physical entities are introduced; ARA and RV are descriptive metrics defined in Section III.

free parameters (5)
  • adversarial coverage grid gamma = {0, 20, 50, 75, 100}%
    Selected by hand; all coverage-related conclusions are conditioned on this grid.
  • perturbation radii and mixes epsilon = 0.1; 0.3; [0.01,0.02,0.05]; [0.1,0.15,0.2]; [0.3,0.4,0.5]
    Hand-picked threat levels; the claim that moderate mixes are optimal at gamma=75% depends on these exact values.
  • perturbed mini-batch fraction rho = 50%
    Set to 0.5 in Section III; no sensitivity analysis is reported.
  • communication rounds = 50 clean + 30 AT (fine-tune); 20 AT (scratch)
    Chosen in Section III; robustness differences could reflect round count rather than training regime.
  • number of clients K and mix length m = K=15, m=3
    Fixed simulation setup; different K or m could change the reported patterns.
assumptions (4)
  • domain assumption PGD with bounded l-infinity perturbations is an adequate threat model for adversarial robustness in QFL
    Invoked in Section III; all conclusions about robustness are measured against this attack, with no other attack or adaptive adversary tested.
  • domain assumption The parameter-shift rule in PennyLane simulation provides faithful gradients for the 4-qubit QNN
    Used throughout training; no shot noise or hardware noise model is considered, so results may not transfer to real devices.
  • domain assumption The 4-qubit, 2-layer ansatz on 8x8 3-class images is a representative QFL workload
    Central to generalizing Table I to 'QFL is as fragile as centralized'; only one architecture and reduced datasets are used.
  • ad hoc to paper The mixed-epsilon schedule assigns client-specific radii as intended
    Printed rule epsilon_k = Xi[(K mod m)-1] yields a constant index for all clients when K=15, m=3; the experiments assume the intended cyclic assignment was implemented.

how reviews work

0 comments
Cite this review

Pith. "Pith review of RobQFL: Robust Quantum Federated Learning in Adversarial Environment." pith.science (2026). https://pith.science/paper/CCEDS5OX

@misc{pith2026250904914,
  author       = {Pith},
  title        = {Pith review of: RobQFL: Robust Quantum Federated Learning in Adversarial Environment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CCEDS5OX}},
  note         = {Machine review of arXiv:2509.04914}
}
abstract

Quantum Federated Learning (QFL) merges privacy-preserving federation with quantum computing gains, yet its resilience to adversarial noise is unknown. We first show that QFL is as fragile as centralized quantum learning. We propose Robust Quantum Federated Learning (RobQFL), embedding adversarial training directly into the federated loop. RobQFL exposes tunable axes: client coverage $\gamma$ (0-100\%), perturbation scheduling (fixed-$\varepsilon$ vs $\varepsilon$-mixes), and optimization (fine-tune vs scratch), and distils the resulting $\gamma \times \varepsilon$ surface into two metrics: Accuracy-Robustness Area and Robustness Volume. On 15-client simulations with MNIST and Fashion-MNIST, IID and Non-IID conditions, training only 20-50\% clients adversarially boosts $\varepsilon \leq 0.1$ accuracy $\sim$15 pp at $< 2$ pp clean-accuracy cost; fine-tuning adds 3-5 pp. With $\geq$75\% coverage, a moderate $\varepsilon$-mix is optimal, while high-$\varepsilon$ schedules help only at 100\% coverage. Label-sorted non-IID splits halve robustness, underscoring data heterogeneity as a dominant risk.

Figures

Figures reproduced from arXiv: 2509.04914 by the authors.

Figure 1
Figure 1. A) Datasets are partitioned either IID (shuffled colours) or label-sorted non-IID, then dispatched to [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 3
Figure 3. illustrates the robustness curves across various coverage levels for each adversarial training method. At low coverage (≤ 50%), all methods achieve similar accuracy for light to moderate attacks (0 ≤ ϵ ≤ 0.1) and collapse at ϵ ≥ 0.2, giving no meaningful robustness advantage. Hence, when only a minority of clients can be trained adversarially, the choice of ϵ approach has almost no impact on performance, as the mode… view at source ↗
Figure 2
Figure 2. IID MNIST a) Fine-tuning adversarial training b) Scratch adversarial [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Model accuracy (%) versus PGD attack strength [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

55 extracted references · 27 canonical work pages

  1. [1]

    A survey on federated learning,

    C. Zhang, Y . Xie, H. Bai, B. Yu, W. Li, and Y . Gao, “A survey on federated learning,”Knowledge-Based Systems, 2021

    work page 2021

  2. [2]

    Quantum machine learning,

    J. Biamonte, P. Wittek, N. Pancotti, P. Rebentrost, N. Wiebe, and S. Lloyd, “Quantum machine learning,”Nature, 2017

    2017

  3. [3]

    Challenges and opportunities in quantum machine learning,

    M. Cerezo, G. Verdon, H.-Y . Huang, L. Cincio, and P. J. Coles, “Challenges and opportunities in quantum machine learning,”Nature computational science, vol. 2, no. 9, pp. 567–576, 2022

    2022

  4. [4]

    The power of quantum neural networks,

    A. Abbas, D. Sutter, C. Zoufal, A. Lucchi, A. Figalli, and S. Woerner, “The power of quantum neural networks,”Nature Computational Science, vol. 1, no. 6, pp. 403–409, 2021

    2021

  5. [5]

    Enhancing quantum support vector machines through variational kernel training,

    N. Innan, M. A.-Z. Khan, B. Panda, and M. Bennai, “Enhancing quantum support vector machines through variational kernel training,”Quantum Information Processing, vol. 22, no. 10, p. 374, 2023

    2023

  6. [6]

    A comparative analysis of hybrid-quantum classical neural networks,

    K. Zaman, T. Ahmed, M. A. Hanif, A. Marchisio, and M. Shafique, “A comparative analysis of hybrid-quantum classical neural networks,” in World Congress in Computer Science, Computer Engineering & Applied Computing. Springer, 2024, pp. 102–115

    work page 2024

  7. [7]

    Studying the impact of quantum-specific hyperparameters on hybrid quantum-classical neural networks,

    K. Zaman, T. Ahmed, M. Kashif, M. A. Hanif, A. Marchisio, and M. Shafique, “Studying the impact of quantum-specific hyperparameters on hybrid quantum-classical neural networks,” inWorld Congress in Computer Science, Computer Engineering & Applied Computing. Springer, 2024, pp. 132–149

    work page 2024

  8. [8]

    A variational quantum perceptron with grover’s algorithm for efficient classification,

    N. Innan and M. Bennai, “A variational quantum perceptron with grover’s algorithm for efficient classification,”Physica Scripta, vol. 99, no. 5, p. 055120, 2024

    2024

Show all 55 references
  1. [9]

    Next- generation quantum neural networks: Enhancing efficiency, security, and privacy,

    N. Innan, M. Kashif, A. Marchisio, M. Bennai, and M. Shafique, “Next- generation quantum neural networks: Enhancing efficiency, security, and privacy,” in2025 IEEE 31st International Symposium on On-Line Testing and Robust System Design (IOLTS). IEEE, 2025, pp. 1–4

    2025

  2. [10]

    Quantum support vector machine for prostate cancer detection: A performance analysis,

    W. E. Maouaki, T. Said, and M. Bennai, “Quantum support vector machine for prostate cancer detection: A performance analysis,”arXiv preprint arXiv:2403.07856, 2024

    2024 arXiv

  3. [11]

    Brain tumor diagnosis using quantum convolutional neural networks,

    M. A.-Z. Khan, N. Galib, Abdullah Al Omar Innan, and M. Bennai, “Brain tumor diagnosis using quantum convolutional neural networks,” arXiv preprint arXiv:2401.15804, 2024. 6

    2024 arXiv

  4. [12]

    Perspective on the current state-of-the-art of quantum computing for drug discovery applications,

    N. S. Blunt, J. Camps, O. Crawford, R. Izs ´ak, S. Leontica, A. Mirani, A. E. Moylett, S. A. Scivier, C. Sunderhauf, P. Schopfet al., “Perspective on the current state-of-the-art of quantum computing for drug discovery applications,”Journal of Chemical Theory and Computation, ...

    2022

  5. [13]

    Quantum computing for finance: Overview and prospects,

    R. Or ´us, S. Mugel, and E. Lizaso, “Quantum computing for finance: Overview and prospects,”Reviews in Physics, vol. 4, p. 100028, 2019

    2019

  6. [14]

    Financial fraud detection: a comparative study of quantum machine learning models,

    N. Innan, M. A.-Z. Khan, and M. Bennai, “Financial fraud detection: a comparative study of quantum machine learning models,”International Journal of Quantum Information, vol. 22, no. 02, p. 2350044, 2024

    2024

  7. [15]

    Financial fraud detection using quantum graph neural networks,

    N. Innan, A. Sawaika, A. Dhor, S. Dutta, S. Thota, H. Gokal, N. Patel, M. A.-Z. Khan, I. Theodonis, and M. Bennai, “Financial fraud detection using quantum graph neural networks,”Quantum Machine Intelligence, vol. 6, no. 1, p. 7, 2024

    2024

  8. [16]

    Comparative performance analysis of quantum machine learning architectures for credit card fraud detection,

    M. E. Alami, N. Innan, M. Shafique, and M. Bennai, “Comparative performance analysis of quantum machine learning architectures for credit card fraud detection,”arXiv preprint arXiv:2412.19441, 2024

    2024

  9. [17]

    Po-qa: A framework for portfolio optimization using quantum algorithms,

    K. Zaman, A. Marchisio, M. Kashif, and M. Shafique, “Po-qa: A framework for portfolio optimization using quantum algorithms,” in2024 IEEE International Conference on Quantum Computing and Engineering (QCE), 2024

    2024

  10. [18]

    Lep-qnn: Loan eligibility prediction using quantum neural networks,

    N. Innan, A. Marchisio, M. Bennai, and M. Shafique, “Lep-qnn: Loan eligibility prediction using quantum neural networks,”arXiv preprint arXiv:2412.03158, 2024

    2024

  11. [19]

    Hqnn-fsp: A hybrid classical-quantum neural network for regression-based financial stock market prediction,

    P. K. Choudhary, N. Innan, M. Shafique, and R. Singh, “Hqnn-fsp: A hybrid classical-quantum neural network for regression-based financial stock market prediction,”arXiv preprint arXiv:2503.15403, 2025

    2025 arXiv

  12. [20]

    Optimizing low-energy carbon iiot systems with quantum algorithms: Performance evaluation and noise robustness,

    K. Dave, N. Innan, B. K. Behera, S. Mumtaz, S. Al-Kuwari, A. Farouk et al., “Optimizing low-energy carbon iiot systems with quantum algorithms: Performance evaluation and noise robustness,”IEEE Internet of Things Journal, 2025

    2025

  13. [21]

    Qnn-vrcs: A quantum neural network for vehicle road cooperation systems,

    N. Innan, B. K. Behera, S. Al-Kuwari, and A. Farouk, “Qnn-vrcs: A quantum neural network for vehicle road cooperation systems,”IEEE Transactions on Intelligent Transportation Systems, 2025

    2025

  14. [22]

    Sentiqnf: A novel approach to sentiment analysis using quantum algorithms and neuro-fuzzy systems,

    K. Dave, N. Innan, B. K. Behera, Z. Mumtaz, S. Al-Kuwari, and A. Farouk, “Sentiqnf: A novel approach to sentiment analysis using quantum algorithms and neuro-fuzzy systems,”IEEE Transactions on Computational Social Systems, 2025

    2025

  15. [23]

    Quantum portfolio optimization with expert analysis evaluation,

    N. Innan, A. Saleem, A. Marchisio, and M. Shafique, “Quantum portfolio optimization with expert analysis evaluation,”arXiv preprint arXiv:2507.20532, 2025

    2025

  16. [24]

    Quantum clustering for cybersecurity,

    W. El Maouaki, N. Innan, A. Marchisio, T. Said, M. Bennai, and M. Shafique, “Quantum clustering for cybersecurity,” in2024 IEEE International Conference on Quantum Computing and Engineering (QCE), vol. 2. IEEE, 2024, pp. 5–10

    2024

  17. [25]

    A privacy-preserving federated framework with hybrid quantum-enhanced learning for financial fraud detection,

    A. Sawaika, S. Krishna, T. Tomar, D. P. Suggisetti, A. Lal, T. Shrivastav, N. Innan, and M. Shafique, “A privacy-preserving federated framework with hybrid quantum-enhanced learning for financial fraud detection,” arXiv preprint arXiv:2507.22908, 2025

    2025

  18. [26]

    Qfnn-ffd: Quantum federated neural network for financial fraud detection,

    N. Innan, A. Marchisio, M. Shafique, and M. Bennai, “Qfnn-ffd: Quantum federated neural network for financial fraud detection,”arXiv preprint arXiv:2404.02595, 2024

    2024 arXiv

  19. [27]

    Robqunns: A methodology for robust quanvolutional neural networks against adversarial attacks,

    W. El Maouaki, A. Marchisio, T. Said, M. Shafique, and M. Bennai, “Robqunns: A methodology for robust quanvolutional neural networks against adversarial attacks,” in2024 IEEE International Conference on Image Processing Challenges and Workshops (ICIPCW). IEEE, 2024, pp. 4090–4095

    2024

  20. [28]

    Advqunn: A methodology for analyzing the adversarial robustness of quanvolutional neural networks,

    W. El Maouaki, A. Marchisio, T. Said, M. Bennai, and M. Shafique, “Advqunn: A methodology for analyzing the adversarial robustness of quanvolutional neural networks,” in2024 IEEE International Conference on Quantum Software (QSW). IEEE, 2024, pp. 175–181

    2024

  21. [29]

    Designing robust quantum neural networks via optimized circuit metrics,

    W. El Maouaki, A. Marchisio, T. Said, M. Shafique, and M. Bennai, “Designing robust quantum neural networks via optimized circuit metrics,” Advanced Quantum Technologies, p. 2400601, 2025

    2025

  22. [30]

    Quantum adversarial machine learning,

    S. Lu, L.-M. Duan, and D.-L. Deng, “Quantum adversarial machine learning,”Physical Review Research, vol. 2, no. 3, p. 033212, 2020

    2020

  23. [31]

    Qfal: Quantum federated adversarial learning,

    W. E. Maouaki, N. Innan, A. Marchisio, T. Said, M. Bennai, and M. Shafique, “Qfal: Quantum federated adversarial learning,”arXiv preprint arXiv:2502.21171, 2025

    2025 arXiv

  24. [32]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, R. Ferguset al., “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  25. [33]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

    2018

  26. [34]

    Robust- ness may be at odds with accuracy,

    D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry, “Robust- ness may be at odds with accuracy,”arXiv preprint arXiv:1805.12152, 2018

    2018 arXiv

  27. [35]

    An introduction to quantum machine learning,

    M. Schuld, I. Sinayskiy, and F. Petruccione, “An introduction to quantum machine learning,”Contemporary Physics, vol. 56, no. 2, pp. 172–185, 2015

    2015

  28. [36]

    A survey on quantum machine learning: Current trends, challenges, opportunities, and the road ahead,

    K. Zaman, A. Marchisio, M. A. Hanif, and M. Shafique, “A survey on quantum machine learning: Current trends, challenges, opportunities, and the road ahead,”arXiv preprint arXiv:2310.10315, 2023

    2023 arXiv

  29. [37]

    Computational advantage in hybrid quantum neural networks: Myth or reality?

    M. Kashif, A. Marchisio, and M. Shafique, “Computational advantage in hybrid quantum neural networks: Myth or reality?” inDAC, 2025

    2025

  30. [38]

    Federated quantum machine learning,

    S. Y .-C. Chen and S. Yoo, “Federated quantum machine learning,” Entropy, vol. 23, no. 4, p. 460, 2021

    2021

  31. [39]

    Quantum federated learning with decentralized data,

    R. Huang, X. Tan, and Q. Xu, “Quantum federated learning with decentralized data,”IEEE Journal of Selected Topics in Quantum Electronics, vol. 28, no. 4: Mach. Learn. in Photon. Commun. and Meas. Syst., pp. 1–10, 2022

    2022

  32. [40]

    Fedqnn: Federated learning using quantum neural networks,

    N. Innan, M. A.-Z. Khan, A. Marchisio, M. Shafique, and M. Bennai, “Fedqnn: Federated learning using quantum neural networks,” in2024 International Joint Conference on Neural Networks (IJCNN), 2024, pp. 1–9

    2024

  33. [41]

    Fl-qdsnns: Federated learning with quantum dynamic spiking neural networks,

    N. Innan, A. Marchisio, and M. Shafique, “Fl-qdsnns: Federated learning with quantum dynamic spiking neural networks,”arXiv preprint arXiv:2412.02293, 2024

    2024 arXiv

  34. [42]

    Quantum federated learning through blind quantum computing,

    W. Li, S. Lu, and D.-L. Deng, “Quantum federated learning through blind quantum computing,”Science China Physics, Mechanics & Astronomy, vol. 64, no. 10, p. 100312, 2021

    2021

  35. [43]

    Quantum fuzzy federated learning for privacy protection in intelligent information processing,

    Z. Qu, L. Zhang, and P. Tiwari, “Quantum fuzzy federated learning for privacy protection in intelligent information processing,”IEEE Transactions on Fuzzy Systems, 2024

    2024

  36. [44]

    Federated quantum machine learning with differential privacy,

    R. Rofougaran, S. Yoo, H.-H. Tseng, and S. Y .-C. Chen, “Federated quantum machine learning with differential privacy,” inICASSP 2024- 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024, pp. 9811–9815

    2024

  37. [45]

    Mqfl-fhe: Multimodal quantum federated learning framework with fully homomorphic encryption,

    S. Dutta, N. Innan, S. B. Yahia, M. Shafique, and D. E. B. Neira, “Mqfl-fhe: Multimodal quantum federated learning framework with fully homomorphic encryption,”arXiv preprint arXiv:2412.01858, 2024

    2024

  38. [46]

    Federated learning with quantum computing and fully homomorphic encryption: A novel computing paradigm shift in privacy-preserving ml,

    S. Dutta, P. P. Karanth, P. M. Xavier, I. L. de Freitas, N. Innan, S. B. Yahia, M. Shafique, and D. E. B. Neira, “Federated learning with quantum computing and fully homomorphic encryption: A novel computing paradigm shift in privacy-preserving ml,”arXiv preprint arXiv:2409.11...

    2024 arXiv

  39. [47]

    Federated quantum natural gradient descent for quantum federated learning,

    J. Qi and M.-H. Hsieh, “Federated quantum natural gradient descent for quantum federated learning,” inFederated Learning. Elsevier, 2024, pp. 329–341

    2024

  40. [48]

    Optimizing quantum federated learning based on federated quantum natural gradient descent,

    J. Qi, X.-L. Zhang, and J. Tejedor, “Optimizing quantum federated learning based on federated quantum natural gradient descent,” inICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2023, pp. 1–5

    2023

  41. [49]

    Hybrid quantum enhanced federated learning for cyber attack detection,

    G. Subramanian and M. Chinnadurai, “Hybrid quantum enhanced federated learning for cyber attack detection,”Scientific Reports, vol. 14, no. 1, p. 32038, 2024

    2024

  42. [50]

    Defending against byzantine attacks in quantum federated learning,

    Q. Xia, Z. Tao, and Q. Li, “Defending against byzantine attacks in quantum federated learning,” in2021 17th International Conference on Mobility, Sensing and Networking (MSN). IEEE, 2021, pp. 145–152

    2021

  43. [51]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  44. [52]

    Delving into the adversarial robustness of federated learning,

    J. Zhang, B. Li, C. Chen, L. Lyu, S. Wu, S. Ding, and C. Wu, “Delving into the adversarial robustness of federated learning,” inProceedings of the AAAI conference on artificial intelligence, vol. 37, no. 9, 2023, pp. 11 245–11 253

    2023

  45. [53]

    Privacy- preserving quantum federated learning via gradient hiding,

    C. Li, N. Kumar, Z. Song, S. Chakrabarti, and M. Pistoia, “Privacy- preserving quantum federated learning via gradient hiding,”Quantum Science and Technology, vol. 9, no. 3, p. 035028, 2024

    2024

  46. [54]

    Quantum delegated and federated learning via quantum homomorphic encryption,

    W. Li and D.-L. Deng, “Quantum delegated and federated learning via quantum homomorphic encryption,”Research Directions: Quantum Technologies, vol. 3, p. e3, 2025

    2025

  47. [55]

    Robust quantum federated learning with noise,

    L. Chen, L. Yan, and S. Zhang, “Robust quantum federated learning with noise,”Physica Scripta, vol. 99, no. 7, p. 076003, 2024. 7

    2024

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.