# Universal Adversarial Examples and Perturbations for Quantum Classifiers

arXiv: https://arxiv.org/abs/2102.07788 · HTML: https://mlsanity.com/paper/2102.07788/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- Builds on 29 of its 115 references that are in the map.
- First posted on arXiv 15 Feb 2021.

## Builds on (most cited first, 29 of 29)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Practical Black-Box Attacks against Machine Learning](https://mlsanity.com/paper/1602.02697/) (2016)
- [On the Convergence of Adam and Beyond](https://mlsanity.com/paper/1904.09237/) (2019)
- [Supervised learning with quantum enhanced feature spaces](https://mlsanity.com/paper/1804.11326/) (2018)
- [Stealing Machine Learning Models via Prediction APIs](https://mlsanity.com/paper/1609.02943/) (2016)
- [Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples](https://mlsanity.com/paper/1605.07277/) (2016)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning](https://mlsanity.com/paper/1702.07464/) (2017)
- [Adversarial Attacks and Defences: A Survey](https://mlsanity.com/paper/1810.00069/) (2018)
- [Quantum Natural Gradient](https://mlsanity.com/paper/1909.02108/) (2019)
- [Differentiable Learning of Quantum Circuit Born Machine](https://mlsanity.com/paper/1804.04168/) (2018)
- [Quantum-enhanced machine learning](https://mlsanity.com/paper/1610.08251/) (2016)
- [Quantum Recommendation Systems](https://mlsanity.com/paper/1603.08675/) (2016)
- [Quantum noise protects quantum classifiers against adversaries](https://mlsanity.com/paper/2003.09416/) (2020)
- [Quantum Adversarial Machine Learning](https://mlsanity.com/paper/2001.00030/) (2019)
- [Stochastic gradient descent for hybrid quantum-classical optimization](https://mlsanity.com/paper/1910.01155/) (2019)
- [Discovering Phase Transitions with Unsupervised Learning](https://mlsanity.com/paper/1606.00318/) (2016)
- [Unsupervised learning of phase transitions: from principal component analysis to variational autoencoders](https://mlsanity.com/paper/1703.02435/) (2017)
- [The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure](https://mlsanity.com/paper/1809.03063/) (2018)
- [Quantum Deep Learning](https://mlsanity.com/paper/1412.3489/) (2014)
- [Low-depth gradient measurements can improve convergence in variational hybrid quantum-classical algorithms](https://mlsanity.com/paper/1901.05374/) (2019)
- [Reformulation of the No-Free-Lunch Theorem for Entangled Data Sets](https://mlsanity.com/paper/2007.04900/) (2020)
- [Topological Quantum Compiling with Reinforcement Learning](https://mlsanity.com/paper/2004.04743/) (2020)
- [Machine Learning Phase Transitions with a Quantum Processor](https://mlsanity.com/paper/1906.10155/) (2019)
- [Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks](https://mlsanity.com/paper/1904.06292/) (2019)
- [Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers](https://mlsanity.com/paper/1707.05970/) (2017)
- [A quantum active learning algorithm for sampling against adversarial attacks](https://mlsanity.com/paper/1912.03283/) (2019)

## Built on by (most cited first, 23 of 23)

- [Experimental quantum adversarial learning with programmable superconducting qubits](https://mlsanity.com/paper/2204.01738/) (2022)
- [Recent advances for quantum classifiers](https://mlsanity.com/paper/2108.13421/) (2021)
- [Towards quantum enhanced adversarial robustness in machine learning](https://mlsanity.com/paper/2306.12688/) (2023)
- [Training robust and generalizable quantum models](https://mlsanity.com/paper/2311.11871/) (2023)
- [Enhancing Quantum Adversarial Robustness by Randomized Encodings](https://mlsanity.com/paper/2212.02531/) (2022)
- [Quantum Continual Learning Overcoming Catastrophic Forgetting](https://mlsanity.com/paper/2108.02786/) (2021)
- [Generating Universal Adversarial Perturbations for Quantum Classifiers](https://mlsanity.com/paper/2402.08648/) (2024)
- [SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness](https://mlsanity.com/paper/2511.14989/) (2025)
- [Exploring the Vulnerabilities of Machine Learning and Quantum Machine Learning to Adversarial Attacks using a Malware Dataset: A Comparative Analysis](https://mlsanity.com/paper/2305.19593/) (2023)
- [QuanTest: Entanglement-Guided Testing of Quantum Neural Network Systems](https://mlsanity.com/paper/2402.12950/) (2024)
- [Adversarial Robustness of Partitioned Quantum Classifiers](https://mlsanity.com/paper/2502.20403/) (2025)
- [Adversarial Robustness in Distributed Quantum Machine Learning](https://mlsanity.com/paper/2508.11848/) (2025)
- [Universal adversarial perturbations for multiple classification tasks with quantum classifiers](https://mlsanity.com/paper/2306.11974/) (2023)
- [SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledge](https://mlsanity.com/paper/2402.14937/) (2024)
- [Experimental robustness benchmarking of quantum neural networks on a superconducting quantum processor](https://mlsanity.com/paper/2505.16714/) (2025)
- [Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security](https://mlsanity.com/paper/2507.08623/) (2025)
- [Superior resilience to poisoning and amenability to unlearning in quantum machine learning](https://mlsanity.com/paper/2508.02422/) (2025)
- [Trustworthy Quantum Machine Learning: A Roadmap for Reliability, Robustness, and Security in the NISQ Era](https://mlsanity.com/paper/2511.02602/) (2025)
- [Quantum Artificial Intelligence for Mission-Critical Systems: Foundations, Architectural Elements, and Future Directions](https://mlsanity.com/paper/2511.09884/) (2025)
- [Differentiable Architecture Search for Adversarially Robust Quantum Computer Vision](https://mlsanity.com/paper/2601.18058/) (2026)
- [Computable Model-Independent Bounds for Adversarial Quantum Machine Learning](https://mlsanity.com/paper/2411.06863/) (2024)
- [The interplay of robustness and generalization in quantum machine learning](https://mlsanity.com/paper/2506.08455/) (2025)
- [Decoherence as Defence and the Magnitude of Noise Regularisation: A Rigorous N -Qubit Theory of Stochastic Quantum Neural Networks for Adversarially Robust Network Intrusion Detection](https://mlsanity.com/paper/2606.24219/) (2026)

## Abstract (arXiv)

Quantum machine learning explores the interplay between machine learning and quantum physics, which may lead to unprecedented perspectives for both fields. In fact, recent works have shown strong evidences that quantum computers could outperform classical computers in solving certain notable machine learning tasks. Yet, quantum learning systems may also suffer from the vulnerability problem: adding a tiny carefully-crafted perturbation to the legitimate input data would cause the systems to make incorrect predictions at a notably high confidence level. In this paper, we study the universality of adversarial examples and perturbations for quantum classifiers. Through concrete examples involving classifications of real-life images and quantum phases of matter, we show that there exist universal adversarial examples that can fool a set of different quantum classifiers. We prove that for a set of k classifiers with each receiving input data of n qubits, an O(fracln k 2n) increase of the perturbation strength is enough to ensure a moderate universal adversarial risk. In addition, for a given quantum classifier we show that there exist universal adversarial perturbations, which can be added to different legitimate samples and make them to be adversarial examples for the classifier. Our results reveal the universality perspective of adversarial attacks for quantum machine learning systems, which would be crucial for practical applications of both near-term and future quantum technologies in solving machine learning problems.