# Benchmarking Adversarially Robust Quantum Machine Learning at Scale

arXiv: https://arxiv.org/abs/2211.12681 · HTML: https://mlsanity.com/paper/2211.12681/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- Builds on 37 of its 67 references that are in the map.
- First posted on arXiv 23 Nov 2022.

## Builds on (most cited first, 30 of 37)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks](https://mlsanity.com/paper/2003.01690/) (2020)
- [Certified Adversarial Robustness via Randomized Smoothing](https://mlsanity.com/paper/1902.02918/) (2019)
- [Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples](https://mlsanity.com/paper/1802.00420/) (2018)
- [Generalized Cross Entropy Loss for Training Deep Neural Networks with Noisy Labels](https://mlsanity.com/paper/1805.07836/) (2018)
- [Adversarial Examples Are Not Bugs, They Are Features](https://mlsanity.com/paper/1905.02175/) (2019)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [Robustness May Be at Odds with Accuracy](https://mlsanity.com/paper/1805.12152/) (2018)
- [Fast is better than free: Revisiting adversarial training](https://mlsanity.com/paper/2001.03994/) (2020)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [Supervised learning with quantum enhanced feature spaces](https://mlsanity.com/paper/1804.11326/) (2018)
- [Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods](https://mlsanity.com/paper/1705.07263/) (2017)
- [Countering Adversarial Images using Input Transformations](https://mlsanity.com/paper/1711.00117/) (2017)
- [Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers](https://mlsanity.com/paper/1906.04584/) (2019)
- [Quantum Machine Learning](https://mlsanity.com/paper/1611.09347/) (2016)
- [Recent Advances in Adversarial Training for Adversarial Robustness](https://mlsanity.com/paper/2102.01356/) (2021)
- [Detecting Adversarial Samples from Artifacts](https://mlsanity.com/paper/1703.00410/) (2017)
- [Generalization in quantum machine learning from few training data](https://mlsanity.com/paper/2111.05292/) (2021)
- [Efficient Learning for Deep Quantum Neural Networks](https://mlsanity.com/paper/1902.10445/) (2019)
- [Quantum generative adversarial networks](https://mlsanity.com/paper/1804.08641/) (2018)
- [Robust data encodings for quantum classifiers](https://mlsanity.com/paper/2003.01695/) (2020)
- [Quantum noise protects quantum classifiers against adversaries](https://mlsanity.com/paper/2003.09416/) (2020)
- [Quantum Adversarial Machine Learning](https://mlsanity.com/paper/2001.00030/) (2019)
- [Planting Undetectable Backdoors in Machine Learning Models](https://mlsanity.com/paper/2204.06974/) (2022)

## Built on by (most cited first, 29 of 29)

- [Towards quantum enhanced adversarial robustness in machine learning](https://mlsanity.com/paper/2306.12688/) (2023)
- [Hybrid Quantum-Classical Generative Adversarial Network for High Resolution Image Generation](https://mlsanity.com/paper/2212.11614/) (2022)
- [Training robust and generalizable quantum models](https://mlsanity.com/paper/2311.11871/) (2023)
- [Quantum Machine Learning on Near-Term Quantum Devices: Current State of Supervised and Unsupervised Techniques for Real-World Applications](https://mlsanity.com/paper/2307.00908/) (2023)
- [A Comparative Analysis of Adversarial Robustness for Quantum and Classical Machine Learning Models](https://mlsanity.com/paper/2404.16154/) (2024)
- [Adversarial Robustness Guarantees for Quantum Classifiers](https://mlsanity.com/paper/2405.10360/) (2024)
- [Constructing Optimal Noise Channels for Enhanced Robustness in Quantum Machine Learning](https://mlsanity.com/paper/2404.16417/) (2024)
- [Adversarial Quantum Machine Learning: An Information-Theoretic Generalization Analysis](https://mlsanity.com/paper/2402.00176/) (2024)
- [Q-Detection: A Quantum-Classical Hybrid Poisoning Attack Detection Method](https://mlsanity.com/paper/2507.06262/) (2025)
- [SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness](https://mlsanity.com/paper/2511.14989/) (2025)
- [Exploring the Vulnerabilities of Machine Learning and Quantum Machine Learning to Adversarial Attacks using a Malware Dataset: A Comparative Analysis](https://mlsanity.com/paper/2305.19593/) (2023)
- [Radio Signal Classification by Adversarially Robust Quantum Machine Learning](https://mlsanity.com/paper/2312.07821/) (2023)
- [Adversarial Robustness of Partitioned Quantum Classifiers](https://mlsanity.com/paper/2502.20403/) (2025)
- [Application-Oriented Benchmarking of Quantum Generative Learning Using QUARK](https://mlsanity.com/paper/2308.04082/) (2023)
- [Quadratic Advantage with Quantum Randomized Smoothing Applied to Time-Series Analysis](https://mlsanity.com/paper/2407.18021/) (2024)
- [On the Generalization of Adversarially Trained Quantum Classifiers](https://mlsanity.com/paper/2504.17690/) (2025)
- [Experimental robustness benchmarking of quantum neural networks on a superconducting quantum processor](https://mlsanity.com/paper/2505.16714/) (2025)
- [Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security](https://mlsanity.com/paper/2507.08623/) (2025)
- [Superior resilience to poisoning and amenability to unlearning in quantum machine learning](https://mlsanity.com/paper/2508.02422/) (2025)
- [Towards Quantum Machine Learning for Malicious Code Analysis](https://mlsanity.com/paper/2508.19381/) (2025)
- [QUPID: A Partitioned Quantum Neural Network for Anomaly Detection in Smart Grid](https://mlsanity.com/paper/2601.11500/) (2026)
- [Computable Model-Independent Bounds for Adversarial Quantum Machine Learning](https://mlsanity.com/paper/2411.06863/) (2024)
- [Detecting underdetermination in parameterized quantum circuits](https://mlsanity.com/paper/2504.03315/) (2025)
- [The interplay of robustness and generalization in quantum machine learning](https://mlsanity.com/paper/2506.08455/) (2025)
- [Quantum Artificial Intelligence for Secure Autonomous Vehicle Navigation: An Architectural Proposal](https://mlsanity.com/paper/2506.16000/) (2025)
- [Quantifying Quanvolutional Neural Networks Robustness for Speech in Healthcare Applications](https://mlsanity.com/paper/2601.02432/) (2026)
- [QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuits](https://mlsanity.com/paper/2604.10933/) (2026)
- [Defending Quantum Classifiers against Adversarial Perturbations through Quantum Autoencoders](https://mlsanity.com/paper/2604.28176/) (2026)
- [Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access](https://mlsanity.com/paper/2609.05702/) (2026)

## Abstract (arXiv)

Machine learning (ML) methods such as artificial neural networks are rapidly becoming ubiquitous in modern science, technology and industry. Despite their accuracy and sophistication, neural networks can be easily fooled by carefully designed malicious inputs known as adversarial attacks. While such vulnerabilities remain a serious challenge for classical neural networks, the extent of their existence is not fully understood in the quantum ML setting. In this work, we benchmark the robustness of quantum ML networks, such as quantum variational classifiers (QVC), at scale by performing rigorous training for both simple and complex image datasets and through a variety of high-end adversarial attacks. Our results show that QVCs offer a notably enhanced robustness against classical adversarial attacks by learning features which are not detected by the classical neural networks, indicating a possible quantum advantage for ML tasks. Contrarily, and remarkably, the converse is not true, with attacks on quantum networks also capable of deceiving classical neural networks. By combining quantum and classical network outcomes, we propose a novel adversarial attack detection technology. Traditionally quantum advantage in ML systems has been sought through increased accuracy or algorithmic speed-up, but our work has revealed the potential for a new kind of quantum advantage through superior robustness of ML models, whose practical realisation will address serious security concerns and reliability issues of ML algorithms employed in a myriad of applications including autonomous vehicles, cybersecurity, and surveillance robotic systems.