Adversarial Robustness in Distributed Quantum Machine Learning

Hans-Arno Jacobsen; Pouya Kananian

REVIEW 3 major objections 1 minor 21 references

Adversarial Robustness in Distributed Quantum Machine Learning

T0 review · 3 major / 1 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper surveys distributed quantum machine learning and argues that the three dominant distribution paradigms—federated learning, circuit cutting, and teleportation-based methods—each carry distinct adversarial-robustness risks, so robus

desk verdict The submission is an upload mix-up: the abstract promises a distributed-QML adversarial robustness survey, but the full text is an unrelated MILP paper (EvoCut), so there is no coherent manuscript to review. read the letter →

arxiv 2508.11848 v1 pith:CW64TTFH submitted 2025-08-16 quant-ph cs.ETcs.LG

Pouya Kananian , Hans-Arno Jacobsen This is my paper · ORCID

classification quant-phcs.ETcs.LG

keywords adversarialrobustnessquantummachinelearningdistributedcomputingfederatedcircuitcuttingteleportationthreatmodelreview

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This is a review paper, not a new experiment. Its aim is to establish how the way a quantum machine-learning model is distributed across devices changes its vulnerability to adversarial attacks. The paper organizes the field into three paradigms: federated learning, in which a shared model is trained on local data and only model updates are exchanged, and two quantum-specific execution schemes—circuit cutting, which splits a circuit into pieces run on separate devices, and teleportation-based techniques, which move quantum states between devices. It then summarizes existing robustness results for each paradigm and argues that distribution can open new attack surfaces that a single-device model does not have. If the review is accurate, its value is that researchers can choose a distribution method with its security consequences in view, rather than treating robustness as a property of the model alone.

What carries the argument

The organizing device is the three-way taxonomy of distributed-QML paradigms: federated learning, in which local data stays on each device and only model updates are exchanged; circuit cutting, in which a quantum circuit is partitioned into sub-circuits whose classical outputs are recombined; and teleportation-based techniques, in which quantum states move between devices via entanglement and classical communication. The taxonomy does the argument's work by separating robustness results according to where information crosses device boundaries—the aggregated updates in federated learning versus the classical communication channel in the quantum-specific splitting methods.

What would settle it

The taxonomy's completeness is checkable: if a published distributed-QML scheme that is neither federated, nor cut, nor teleportation-based (for example a distributed variational protocol that partitions parameters without cutting circuits) can be placed only by stretching one of the three categories, the review's organizing claim weakens. Likewise, one documented robustness result that the survey misattributes to a paradigm would falsify its reliability.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial robustness is not preserved automatically when a QML model is distributed; it depends on which distribution paradigm is used. Federated learning resembles its classical counterpart and inherits classical attacks such as poisoned or malicious model updates, while circuit cutting and teleportation-based execution introduce attack surfaces tied to the classical information that must flow between devices—measurement outcomes, correction bits, and reconstruction steps. The review's contribution is the taxonomy itself: a mapping of existing robustness and attack results onto these three paradigms, together with a list of open questions about where new

Load-bearing premise

The load-bearing premise is that the three named paradigms—federated learning, circuit cutting, and teleportation-based techniques—capture the real design space of distributed QML and that the summarized robustness results are represented accurately; if a fourth paradigm exists or a cited result is misattributed, the survey's conclusions lose force.

Editorial extensions

If this is right

A robustness result established for one paradigm does not automatically transfer to another; each paradigm needs its own attack and defense analysis.
Federated QML inherits the classical adversarial landscape—update poisoning, membership inference, and malicious clients—so classical federated-learning defenses are the relevant starting baseline.
Circuit cutting shifts part of the attack surface to the classical recombination of measurement outcomes, where a compromised or dishonest device can bias the global result.
Teleportation-based distribution makes entanglement distribution and the classical correction bits part of the threat model.
The open questions the paper lists imply that standardized robustness evaluation for distributed QML does not yet exist, which is the natural next step if the taxonomy is adopted.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial: if the taxonomy holds, adversarial robustness becomes a design criterion for choosing among distribution paradigms, so schemes could be compared on a robustness-versus-communication-overhead tradeoff—a comparison the paper does not itself make.
Editorial: a concrete testable extension is an experiment in which one node in a circuit-cutting setup is adversarially controlled; measuring the drop in classification accuracy as a function of the number of compromised sub-circuits would quantify the new attack surface the review identifies.
Editorial: the manuscript text attached to this review is actually a different paper—an LLM-and-evolution method for generating acceleration cuts in integer programming, complete with its own abstract, experiments, and references. The survey's cited sources are therefore not visible here, so its attributions of specific robustness results to specific paradigms should be checked against the primary

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know this before anything else: the metadata and the manuscript do not match. The abstract for arXiv:2508.11848 describes a review of adversarial robustness in distributed quantum machine learning across federated learning, circuit cutting, and teleportation. The full text supplied is the body of an unrelated paper, "EvoCut: Strengthening Integer Programs via Evolution Guided Language Models" (arXiv:2508.11850v2), by different authors. There is no section in the body that discusses QML, distributed quantum computing, adversarial robustness, or anything from the abstract's reference list. The submitted text cannot support the abstract's claims because the text is about a different subject.

To be fair, the body that is present—the EvoCut paper—looks like a solid piece of empirical work on its own terms. It ships code, evaluates on seven MILP benchmarks, runs ablations across LLMs and solvers, and states its limitations honestly (empirical screening, no formal validity guarantee). If that paper were submitted under its own title, it would deserve serious referee attention. But it is not the paper this submission claims to be. The abstract's survey claim is therefore not merely incomplete or hard to verify: it has no supporting text at all.

The abstract itself, read in isolation, is a plausible survey proposal. It names three distribution paradigms, says it summarizes existing adversarial robustness results, and lists open questions. But it does not claim a new taxonomy, a new attack, or a new theorem, and it gives no methodology section for how the literature was selected or assessed. As a standalone contribution, that is a modest agenda-setting piece—useful to newcomers in a niche subfield, but not a substantive advance. The load-bearing premise of any survey—that the body actually reviews the promised literature—fails outright here.

This looks like an upload error or a mangled pipeline artifact, not a scientific claim gone wrong. My recommendation is clear: do not send this to peer review as-is. Desk-reject and tell the authors to resubmit the correct PDF associated with the abstract. If the QML survey exists, it should be evaluated on its actual content. If it does not, the abstract should be withdrawn. I would not cite this submission, and I would not bring it to a reading group as a quantum paper. EvoCut deserves its own review, but not under this arXiv ID.

Referee Report

3 major / 1 minor

Summary. The abstract of arXiv:2508.11848 advertises a survey of adversarial robustness in distributed quantum machine learning (QML), organized around three distribution paradigms: federated learning, circuit cutting, and teleportation-based techniques. The supplied full text, however, is not that survey. It is the paper 'EvoCut: Strengthening Integer Programs via Evolution Guided Language Models,' with its own abstract, title, and arXiv header (arXiv:2508.11850v2 [cs.AI], 12 Feb 2026). Sections 1-7 and Appendices A-H concern LLM-guided evolutionary generation of acceleration cuts for mixed-integer linear programs. There is no substantive discussion of distributed QML, adversarial robustness, or any of the three paradigms named in the abstract. The central claim of the manuscript is therefore unsupported by the submitted manuscript body.

Significance. If the abstract's survey existed as described, it could be a valuable synthesis of an emerging area: connecting distributed QML paradigms to adversarial robustness would be useful for both quantum-machine-learning and security audiences. However, the submission contains none of the constituent material: no QML literature review, no taxonomy validation, no robustness results, and no open-questions discussion. The supplied EvoCut text may have its own merits, including a reproducible code repository and a detailed experimental setup, but those merits are irrelevant to the advertised contribution. Because the claimed content is entirely absent, the significance of the work cannot be assessed from this submission.

major comments (3)

[Full text title/header; Sections 1-7] The manuscript body is 'EvoCut: Strengthening Integer Programs via Evolution Guided Language Models,' with its own arXiv header (arXiv:2508.11850v2, 12 Feb 2026) and an abstract about MILP acceleration cuts. Sections 1-7 and Appendices A-H contain no discussion of distributed QML, federated learning, circuit cutting, teleportation-based QML distribution, or adversarial robustness. The abstract's central claim that the paper 'reviews the differences between these distribution methods, summarizes existing approaches... and discusses open questions' is not merely unverified; it is unsupported by any text in the submission.
[References; Section 7 Limitations] The reference list contains only operations-research, LLM, and MILP citation entries; there are no citations to quantum machine learning, adversarial robustness, or distributed quantum computing literature. The body's own limitation statement (Section 7) concerns empirical screening of acceleration cuts and does not address survey completeness or the adversarial-robustness taxonomy claimed in the abstract. This confirms that the supplied text is a different manuscript and that the load-bearing premise of the abstract—that a survey body exists—fails.
[Abstract vs. body] The only text matching the advertised topic is the abstract itself. The three named paradigms (federated learning, circuit cutting, teleportation-based techniques) and the claimed comparisons among them do not appear anywhere in the body. Consequently, the correctness, completeness, and attribution accuracy of the claimed survey cannot be checked. This is a content/metadata mismatch at the level of the manuscript's central claim, not a local exposition issue.

minor comments (1)

[Header] The submitted full text carries a different arXiv identifier (2508.11850v2) from the manuscript under review (2508.11848); if a corrected manuscript exists, the provenance and versioning must be resolved before any further review.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation in the EvoCut body; the abstract's survey claim is unsupported by the text (content mismatch), which is an integrity issue rather than circularity.

full rationale

The full text is EvoCut (arXiv:2508.11850v2), a self-contained empirical paper. Its derivation chain is not circular: candidate cuts are screened on a verification set D_v (Section 4, OSS and usefulness checks) and ranked by fitness computed on a separate evaluation set D_e; test results are reported on held-out public benchmarks (Section 5.2, Table 1). No parameter is fitted to the test set, and no prediction is a restatement of a fit. The cited mathematical facts (Chvátal 1973; Balas 1979; Gurobi docs) are external and not self-citations. The only notable issue is that the abstract (for arXiv:2508.11848) claims a survey of adversarial robustness in distributed QML, while the manuscript body is EvoCut; this is a content/metadata mismatch that makes the abstract claim unverifiable, but it is not a circular reduction of a result to its inputs, so the circularity score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

As a review, the paper contributes no free parameters or invented entities; its central contribution rests on the completeness and accuracy of its literature coverage.

assumptions (3)

domain assumption The three distribution paradigms (federated learning, circuit cutting, teleportation-based techniques) are the key paradigms for distributed QML.
The abstract frames these as the core paradigms; if another important paradigm exists, the review's coverage is incomplete.
domain assumption Adversarial robustness is a relevant evaluation axis for QML advantage.
The abstract motivates the review by the need for trustworthy systems, which presupposes robustness is a meaningful criterion for QML.
domain assumption The surveyed literature is complete and accurately represented.
Any review rests on faithful summarization of prior work; this cannot be verified from the abstract alone.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adversarial Robustness in Distributed Quantum Machine Learning." pith.science (2026). https://pith.science/paper/CW64TTFH

@misc{pith2026250811848,
  author       = {Pith},
  title        = {Pith review of: Adversarial Robustness in Distributed Quantum Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CW64TTFH}},
  note         = {Machine review of arXiv:2508.11848}
}

read the original abstract

Studying adversarial robustness of quantum machine learning (QML) models is essential in order to understand their potential advantages over classical models and build trustworthy systems. Distributing QML models allows leveraging multiple quantum processors to overcome the limitations of individual devices and build scalable systems. However, this distribution can affect their adversarial robustness, potentially making them more vulnerable to new attacks. Key paradigms in distributed QML include federated learning, which, similar to classical models, involves training a shared model on local data and sending only the model updates, as well as circuit distribution methods inherent to quantum computing, such as circuit cutting and teleportation-based techniques. These quantum-specific methods enable the distributed execution of quantum circuits across multiple devices. This work reviews the differences between these distribution methods, summarizes existing approaches on the adversarial robustness of QML models when distributed using each paradigm, and discusses open questions in this area.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

21 extracted references · 17 canonical work pages

[7]

E., Danna, E., Gamrath, G., Gleixner, A

Koch, T., Achterberg, T., Andersen, E., Bastert, O., Berthold, T., Bixby, R. E., Danna, E., Gamrath, G., Gleixner, A. M., Heinz, S., et al. Miplib 2010: mixed integer programming library version 5.Mathematical Programming Computa- tion, 3(2):103–163,

work page 2010
[8]

Evolution of heuristics: Towards efficient automatic algorithm design using large language model

Liu, F., Tong, X., Yuan, M., Lin, X., Luo, F., Wang, Z., Lu, Z., and Zhang, Q. Evolution of heuristics: Towards efficient automatic algorithm design using large language model. InProceedings of the 41st International Confer- ence on Machine Learning, pp. 32201–32223, 2024a. Liu, F., Yao, Y ., Guo, P., Yang, Z., Zhao, Z., Lin, X., Tong, X., Yuan, M., Lu, Z...

arXiv
[9]

Mostajabdaveh, M., Yu, T

Ac- cessed: 2025-05-01. Mostajabdaveh, M., Yu, T. T., Ramamonjison, R., Carenini, G., Zhou, Z., and Zhang, Y . Optimization modeling and verification from problem specifications using a multi- agent multi-stage llm framework.INFOR: Information Systems and Operational Research, 62(4):599–617,

work page 2025
[10]

Ostrowski, J., Anjos, M

Accessed: 2026-01-28. Ostrowski, J., Anjos, M. F., and Vannelli, A. Tight mixed integer linear programming formulations for the unit com- mitment problem.IEEE transactions on power systems, 27(1):39–46,

work page 2026
[13]

M., Hauth, A., Millican, K., et al

Team, G., Anil, R., Borgeaud, S., Alayrac, J.-B., Yu, J., Sori- cut, R., Schalkwyk, J., Dai, A. M., Hauth, A., Millican, K., et al. Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805,

arXiv
[15]

ReEvo: Large language models as hyper- heuristics with reflective evolution

Ye, H., Wang, J., Cao, Z., Berto, F., Hua, C., Kim, H., Park, J., and Song, G. ReEvo: Large language models as hyper- heuristics with reflective evolution. InProceedings of the 38th Conference on Neural Information Processing (NeurIPS 2024), pp. 10–15, Vancouver, Canada,

work page 2024
[16]

EVOCUTPseudocode The full procedure is outlined in Algorithm 1, which presents the pseudocode for the proposed EVOCUTframework

11 EvoCut: Strengthening Integer Programs A. EVOCUTPseudocode The full procedure is outlined in Algorithm 1, which presents the pseudocode for the proposed EVOCUTframework. B. EVOCUTAgents This section outlines the agents used in the EVOCUTprocess and presents their prompt structures, including roles, tasks, requirements, and inputs/outputs. The agent lib...

work page
[18]

that can be formulated as an MILP. We used a publicly available set of MCND instances (groupRfrom the CommaLAB dataset) (CommaLAB, 2021), which provides a range of network sizes, cost structures, and capacity tightness scenarios. We used the MILP formulation in Eq. (MCND). Compact MILP formulation for MCND. � �� ...

work page 2021

Show all 21 references

[20]

and recovering (K, N, d� ��, d��, d� �� , v� , τ� � , τ� � ) from the instance coefficients. Compact MILP formulation.We use the MILP formulation of (Srour et al., 2010), which models trucks and jobs as nodes in a complete directed graph and permits explicit job rejection via ...

2010
[21]

Compact MILP formulation

and follow its reference Pyomo formulation with piecewise production costs, startup categories, ramping limits, and minimum up and down times (Ostrowski et al., 2011). Compact MILP formulation. � ��...

2011
[1990]

(100 facility locations and 1000 customers). F.4. Job Shop Scheduling Problem (JSSP) The JSSP is a classic NP-hard combinatorial optimization problem, typically formulated as an MILP (Manne, 1960). It involves scheduling a set of jobs on multiple machines, where each job compr...

1960
[1991]

NL4Opt competition: Formulating optimization problems based on their natural language descriptions

Ramamonjison, R., Yu, T., Li, R., Li, H., Carenini, G., Ghad- dar, B., He, S., Mostajabdaveh, M., Banitalebi-Dehkordi, A., Zhou, Z., et al. NL4Opt competition: Formulating optimization problems based on their natural language descriptions. InNeurIPS 2022 Competition Track, pp....

2022
[1992]

For our experiments, we used instances from TSPLIB (Reinelt, 1991), a widely used benchmark, together with the Miller-Tucker-Zemlin (MTZ) formulation in Eq

that admits a pure MILP model. For our experiments, we used instances from TSPLIB (Reinelt, 1991), a widely used benchmark, together with the Miller-Tucker-Zemlin (MTZ) formulation in Eq. (MTZ). Compact MILP formulation for TSP. � �� ...

1991
[1999]

Deepseek-r1: In- centivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12948,

Guo, D., Yang, D., Zhang, H., Song, J., Zhang, R., Xu, R., Zhu, Q., Ma, S., Wang, P., Bi, X., et al. Deepseek-r1: In- centivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12948,

arXiv
[2002]

Learning cut selection for mixed- integer linear programming via hierarchical sequence model.arXiv preprint arXiv:2302.00244,

Wang, Z., Li, X., Wang, J., Kuang, Y ., Yuan, M., Zeng, J., Zhang, Y ., and Wu, F. Learning cut selection for mixed- integer linear programming via hierarchical sequence model.arXiv preprint arXiv:2302.00244,

arXiv
[2009]

da Cunha, A

doi: 10.1007/s10589-007-9122-0. da Cunha, A. S., Simonetti, L., and Lucena, A. Optimal- ity cuts and a branch-and-cut algorithm for the k-rooted mini-max spanning forest problem.European Journal of Operational Research, 246(2):392–399,

doi
[2019]

Queyranne, M

Ac- cessed: 2025-05-01. Queyranne, M. and Wang, Y . Single-machine scheduling polyhedra with precedence constraints.Mathematics of Operations Research, 16(1):1–20,

2025
[2020]

2025 IMO problem- s/problem

Art of Problem Solving Wiki. 2025 IMO problem- s/problem

2025
[2021]

Costa, A

Accessed: 2025-05-01. Costa, A. M., Cordeau, J.-F., and Gendron, B. Ben- ders, metric and cutset inequalities for multicommod- ity capacitated network design.Computational Opti- mization and Applications, 42(3):371–392,

2025
[2024]

doi: https://doi.org/10.1016/j.swevo.2024.101663

ISSN 2210-6502. doi: https://doi.org/10.1016/j.swevo.2024.101663. Jiang, C., Shu, X., Qian, H., Lu, X., Zhou, J., Zhou, A., and Yu, Y . LLMOPT: Learning to define and solve gen- eral optimization problems from scratch.arXiv preprint arXiv:2410.13213,

2024
[2025]

Accessed: 2025-05-14. Hart, W. E., Watson, J.-P., and Woodruff, D. L. Pyomo: modeling and solving mathematical programs in python. Mathematical Programming Computation, 3(3):219–260,

2025

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [7]

E., Danna, E., Gamrath, G., Gleixner, A

Koch, T., Achterberg, T., Andersen, E., Bastert, O., Berthold, T., Bixby, R. E., Danna, E., Gamrath, G., Gleixner, A. M., Heinz, S., et al. Miplib 2010: mixed integer programming library version 5.Mathematical Programming Computa- tion, 3(2):103–163,

work page 2010

[2] [8]

Evolution of heuristics: Towards efficient automatic algorithm design using large language model

Liu, F., Tong, X., Yuan, M., Lin, X., Luo, F., Wang, Z., Lu, Z., and Zhang, Q. Evolution of heuristics: Towards efficient automatic algorithm design using large language model. InProceedings of the 41st International Confer- ence on Machine Learning, pp. 32201–32223, 2024a. Liu, F., Yao, Y ., Guo, P., Yang, Z., Zhao, Z., Lin, X., Tong, X., Yuan, M., Lu, Z...

arXiv

[3] [9]

Mostajabdaveh, M., Yu, T

Ac- cessed: 2025-05-01. Mostajabdaveh, M., Yu, T. T., Ramamonjison, R., Carenini, G., Zhou, Z., and Zhang, Y . Optimization modeling and verification from problem specifications using a multi- agent multi-stage llm framework.INFOR: Information Systems and Operational Research, 62(4):599–617,

work page 2025

[4] [10]

Ostrowski, J., Anjos, M

Accessed: 2026-01-28. Ostrowski, J., Anjos, M. F., and Vannelli, A. Tight mixed integer linear programming formulations for the unit com- mitment problem.IEEE transactions on power systems, 27(1):39–46,

work page 2026

[5] [13]

M., Hauth, A., Millican, K., et al

Team, G., Anil, R., Borgeaud, S., Alayrac, J.-B., Yu, J., Sori- cut, R., Schalkwyk, J., Dai, A. M., Hauth, A., Millican, K., et al. Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805,

arXiv

[6] [15]

ReEvo: Large language models as hyper- heuristics with reflective evolution

Ye, H., Wang, J., Cao, Z., Berto, F., Hua, C., Kim, H., Park, J., and Song, G. ReEvo: Large language models as hyper- heuristics with reflective evolution. InProceedings of the 38th Conference on Neural Information Processing (NeurIPS 2024), pp. 10–15, Vancouver, Canada,

work page 2024

[7] [16]

EVOCUTPseudocode The full procedure is outlined in Algorithm 1, which presents the pseudocode for the proposed EVOCUTframework

11 EvoCut: Strengthening Integer Programs A. EVOCUTPseudocode The full procedure is outlined in Algorithm 1, which presents the pseudocode for the proposed EVOCUTframework. B. EVOCUTAgents This section outlines the agents used in the EVOCUTprocess and presents their prompt structures, including roles, tasks, requirements, and inputs/outputs. The agent lib...

work page

[8] [18]

that can be formulated as an MILP. We used a publicly available set of MCND instances (groupRfrom the CommaLAB dataset) (CommaLAB, 2021), which provides a range of network sizes, cost structures, and capacity tightness scenarios. We used the MILP formulation in Eq. (MCND). Compact MILP formulation for MCND. � �� ...

work page 2021