# Certified Robustness of Quantum Classifiers against Adversarial Examples through Quantum Noise

arXiv: https://arxiv.org/abs/2211.00887 · HTML: https://mlsanity.com/paper/2211.00887/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 26 references that are in the map.
- First posted on arXiv 2 Nov 2022.

## Builds on (most cited first, 14 of 14)

- [Certified Adversarial Robustness via Randomized Smoothing](https://mlsanity.com/paper/1902.02918/) (2019)
- [Efficient Neural Network Robustness Certification with General Activation Functions](https://mlsanity.com/paper/1811.00866/) (2018)
- [Parameterized quantum circuits as machine learning models](https://mlsanity.com/paper/1906.07682/) (2019)
- [Quantum Machine Learning](https://mlsanity.com/paper/1611.09347/) (2016)
- [Efficient Learning for Deep Quantum Neural Networks](https://mlsanity.com/paper/1902.10445/) (2019)
- [Quantum generative adversarial networks](https://mlsanity.com/paper/1804.08641/) (2018)
- [Towards Quantum Machine Learning with Tensor Networks](https://mlsanity.com/paper/1803.11537/) (2018)
- [Quantum noise protects quantum classifiers against adversaries](https://mlsanity.com/paper/2003.09416/) (2020)
- [Decentralizing Feature Extraction with Quantum Convolutional Neural Network for Automatic Speech Recognition](https://mlsanity.com/paper/2010.13309/) (2020)
- [When BERT Meets Quantum Temporal Convolution Learning for Text Classification in Heterogeneous Computing](https://mlsanity.com/paper/2203.03550/) (2022)
- [Recent advances for quantum classifiers](https://mlsanity.com/paper/2108.13421/) (2021)
- [Theoretical Error Performance Analysis for Variational Quantum Circuit Based Functional Regression](https://mlsanity.com/paper/2206.04804/) (2022)
- [Optimal Provable Robustness of Quantum Classification via Quantum Hypothesis Testing](https://mlsanity.com/paper/2009.10064/) (2020)
- [Classical-to-Quantum Transfer Learning for Spoken Command Recognition Based on Quantum Neural Networks](https://mlsanity.com/paper/2110.08689/) (2021)

## Built on by (most cited first, 18 of 18)

- [Quantum Pufferfish Privacy: A Flexible Privacy Framework for Quantum Systems](https://mlsanity.com/paper/2306.13054/) (2023)
- [A unifying framework for differentially private quantum algorithms](https://mlsanity.com/paper/2307.04733/) (2023)
- [Contraction of Private Quantum Channels and Private Quantum Hypothesis Testing](https://mlsanity.com/paper/2406.18651/) (2024)
- [Quantum Neural Networks under Depolarization Noise: Exploring White-Box Attacks and Defenses](https://mlsanity.com/paper/2311.17458/) (2023)
- [Generating Universal Adversarial Perturbations for Quantum Classifiers](https://mlsanity.com/paper/2402.08648/) (2024)
- [Constructing Optimal Noise Channels for Enhanced Robustness in Quantum Machine Learning](https://mlsanity.com/paper/2404.16417/) (2024)
- [A Modified Depolarization Approach for Efficient Quantum Machine Learning](https://mlsanity.com/paper/2404.07330/) (2024)
- [Discrete Randomized Smoothing Meets Quantum Computing](https://mlsanity.com/paper/2408.00895/) (2024)
- [Adversarial Robustness of Partitioned Quantum Classifiers](https://mlsanity.com/paper/2502.20403/) (2025)
- [Adversarial Robustness in Distributed Quantum Machine Learning](https://mlsanity.com/paper/2508.11848/) (2025)
- [Quadratic Advantage with Quantum Randomized Smoothing Applied to Time-Series Analysis](https://mlsanity.com/paper/2407.18021/) (2024)
- [Certifiably Robust Encoding Schemes](https://mlsanity.com/paper/2408.01200/) (2024)
- [On the Generalization of Adversarially Trained Quantum Classifiers](https://mlsanity.com/paper/2504.17690/) (2025)
- [Quantum Artificial Intelligence for Mission-Critical Systems: Foundations, Architectural Elements, and Future Directions](https://mlsanity.com/paper/2511.09884/) (2025)
- [Detecting underdetermination in parameterized quantum circuits](https://mlsanity.com/paper/2504.03315/) (2025)
- [QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuits](https://mlsanity.com/paper/2604.10933/) (2026)
- [Representational separation between unitary and channel quantum generative models via shared classical randomness at shallow depth](https://mlsanity.com/paper/2608.05110/) (2026)
- [When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention](https://mlsanity.com/paper/2610.02641/) (2026)

## Abstract (arXiv)

Recently, quantum classifiers have been found to be vulnerable to adversarial attacks, in which quantum classifiers are deceived by imperceptible noises, leading to misclassification. In this paper, we propose the first theoretical study demonstrating that adding quantum random rotation noise can improve robustness in quantum classifiers against adversarial attacks. We link the definition of differential privacy and show that the quantum classifier trained with the natural presence of additive noise is differentially private. Finally, we derive a certified robustness bound to enable quantum classifiers to defend against adversarial examples, supported by experimental results simulated with noises from IBM's 7-qubits device.