Title: Adversarial Quantum Machine Learning: An Information-Theoretic Generalization Analysis Show Chinese title

Title: 对抗性量子机器学习：一种信息论的泛化分析

Abstract: In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input state $\rho(x)$ into a state $\lambda$ that is $\epsilon$-close to the original state $\rho(x)$ in $p$-Schatten distance. Under suitable assumptions on the quantum embedding $\rho(x)$, we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for $p = 1$ and $p = \infty$. The derived upper bounds consist of two terms: the first is an exponential function of the 2-R\'enyi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size $\epsilon$. Both terms are shown to decrease as $1/\sqrt{T}$ over the training set size $T$ . An extension is also considered in which the adversary assumed during training has different parameters $p$ and $\epsilon$ as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting. Show Chinese abstract

Abstract: 在与它们的经典对应物类似的方式下，量子分类器容易受到扰动其输入的对抗性攻击。 一种有希望的对策是通过采用攻击感知或对抗性损失函数来训练量子分类器。 本文研究了针对有界范数白盒攻击进行对抗训练的量子分类器的泛化特性。 具体而言，一个量子对手通过将输入状态$\rho(x)$转换为在$p$-Schatten 距离上与原始状态$\rho(x)$$\epsilon$接近的状态$\lambda$来最大化分类器的损失。 Under suitable assumptions on the quantum embedding $\rho(x)$, we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for $p = 1$ and $p = \infty$. The derived upper bounds consist of two terms: the first is an exponential function of the 2-Rényi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size $\epsilon$. Both terms are shown to decrease as $1/\sqrt{T}$ over the training set size $T$ . 在一种扩展情况中，训练期间假设的对手具有与影响测试输入的对手不同的参数$p$和$\epsilon$。 最后，我们通过一个合成设置的数值实验验证了我们的理论结果。