# Optimal Provable Robustness of Quantum Classification via Quantum Hypothesis Testing

arXiv: https://arxiv.org/abs/2009.10064 · HTML: https://mlsanity.com/paper/2009.10064/

## Key facts

- Cited by 25 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Sep 2020.

## Built on by (most cited first, 25 of 25)

- [Recent advances for quantum classifiers](https://mlsanity.com/paper/2108.13421/) (2021)
- [Benchmarking Adversarially Robust Quantum Machine Learning at Scale](https://mlsanity.com/paper/2211.12681/) (2022)
- [Towards quantum enhanced adversarial robustness in machine learning](https://mlsanity.com/paper/2306.12688/) (2023)
- [Training robust and generalizable quantum models](https://mlsanity.com/paper/2311.11871/) (2023)
- [Certified Robustness of Quantum Classifiers against Adversarial Examples through Quantum Noise](https://mlsanity.com/paper/2211.00887/) (2022)
- [Enhancing Quantum Adversarial Robustness by Randomized Encodings](https://mlsanity.com/paper/2212.02531/) (2022)
- [Verifying Fairness in Quantum Machine Learning](https://mlsanity.com/paper/2207.11173/) (2022)
- [Quantum Neural Networks under Depolarization Noise: Exploring White-Box Attacks and Defenses](https://mlsanity.com/paper/2311.17458/) (2023)
- [An invitation to the sample complexity of quantum hypothesis testing](https://mlsanity.com/paper/2403.17868/) (2024)
- [Constructing Optimal Noise Channels for Enhanced Robustness in Quantum Machine Learning](https://mlsanity.com/paper/2404.16417/) (2024)
- [Accelerating variational quantum algorithms with multiple quantum processors](https://mlsanity.com/paper/2106.12819/) (2021)
- [SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness](https://mlsanity.com/paper/2511.14989/) (2025)
- [Discrete Randomized Smoothing Meets Quantum Computing](https://mlsanity.com/paper/2408.00895/) (2024)
- [Adversarial Robustness of Partitioned Quantum Classifiers](https://mlsanity.com/paper/2502.20403/) (2025)
- [A Numerical Gradient Inversion Attack in Variational Quantum Neural-Networks](https://mlsanity.com/paper/2504.12806/) (2025)
- [Adversarial Robustness in Distributed Quantum Machine Learning](https://mlsanity.com/paper/2508.11848/) (2025)
- [Quadratic Advantage with Quantum Randomized Smoothing Applied to Time-Series Analysis](https://mlsanity.com/paper/2407.18021/) (2024)
- [Certifiably Robust Encoding Schemes](https://mlsanity.com/paper/2408.01200/) (2024)
- [Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security](https://mlsanity.com/paper/2507.08623/) (2025)
- [Superior resilience to poisoning and amenability to unlearning in quantum machine learning](https://mlsanity.com/paper/2508.02422/) (2025)
- [Detecting underdetermination in parameterized quantum circuits](https://mlsanity.com/paper/2504.03315/) (2025)
- [Provably Robust Training of Quantum Circuit Classifiers Against Parameter Noise](https://mlsanity.com/paper/2505.18478/) (2025)
- [The interplay of robustness and generalization in quantum machine learning](https://mlsanity.com/paper/2506.08455/) (2025)
- [Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do](https://mlsanity.com/paper/2608.15617/) (2026)
- [When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention](https://mlsanity.com/paper/2610.02641/) (2026)

## Abstract (arXiv)

Quantum machine learning models have the potential to offer speedups and better predictive accuracy compared to their classical counterparts. However, these quantum algorithms, like their classical counterparts, have been shown to also be vulnerable to input perturbations, in particular for classification problems. These can arise either from noisy implementations or, as a worst-case type of noise, adversarial attacks. In order to develop defence mechanisms and to better understand the reliability of these algorithms, it is crucial to understand their robustness properties in presence of natural noise sources or adversarial manipulation. From the observation that measurements involved in quantum classification algorithms are naturally probabilistic, we uncover and formalize a fundamental link between binary quantum hypothesis testing and provably robust quantum classification. This link leads to a tight robustness condition which puts constraints on the amount of noise a classifier can tolerate, independent of whether the noise source is natural or adversarial. Based on this result, we develop practical protocols to optimally certify robustness. Finally, since this is a robustness condition against worst-case types of noise, our result naturally extends to scenarios where the noise source is known. Thus, we also provide a framework to study the reliability of quantum classification protocols beyond the adversarial, worst-case noise scenarios.