Adversarial Quantum Machine Learning: An Information-Theoretic Generalization Analysis

• Published in: arXiv.org 2024-02
• Main Authors: Georgiou, Petros, Sharu, Theresa Jose, Simeone, Osvaldo
• Format: Article
• Language: English
• Subjects: Classifiers; Embedding; Exponential functions; Information theory; Machine learning; Upper bounds
• ISSN: 2331-8422

In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input state \(\rho(x)\) into a state \(\lambda\) that is \(\epsilon\)-close to the original state \(\rho(x)\) in \(p\)-Schatten distance. Under suitable assumptions on the quantum embedding \(\rho(x)\), we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for \(p = 1\) and \(p = \infty\). The derived upper bounds consist of two terms: the first is an exponential function of the 2-Rényi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size \(\epsilon\). Both terms are shown to decrease as \(1/\sqrt{T}\) over the training set size \(T\) . An extension is also considered in which the adversary assumed during training has different parameters \(p\) and \(\epsilon\) as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.