# Training robust and generalizable quantum models

arXiv: https://arxiv.org/abs/2311.11871 · HTML: https://mlsanity.com/paper/2311.11871/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- Builds on 39 of its 70 references that are in the map.
- First posted on arXiv 20 Nov 2023.

## Builds on (most cited first, 30 of 39)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [Spectrally-normalized margin bounds for neural networks](https://mlsanity.com/paper/1706.08498/) (2017)
- [Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks](https://mlsanity.com/paper/1511.04508/) (2015)
- [Supervised learning with quantum enhanced feature spaces](https://mlsanity.com/paper/1804.11326/) (2018)
- [Exploring Generalization in Deep Learning](https://mlsanity.com/paper/1706.08947/) (2017)
- [Provable defenses against adversarial examples via the convex outer adversarial polytope](https://mlsanity.com/paper/1711.00851/) (2017)
- [The power of quantum neural networks](https://mlsanity.com/paper/2011.00027/) (2020)
- [Power of data in quantum machine learning](https://mlsanity.com/paper/2011.01938/) (2020)
- [The effect of data encoding on the expressive power of variational quantum machine learning models](https://mlsanity.com/paper/2008.08605/) (2020)
- [Parameterized quantum circuits as machine learning models](https://mlsanity.com/paper/1906.07682/) (2019)
- [Regularisation of Neural Networks by Enforcing Lipschitz Continuity](https://mlsanity.com/paper/1804.04368/) (2018)
- [Challenges and Opportunities in Quantum Machine Learning](https://mlsanity.com/paper/2303.09491/) (2023)
- [Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks](https://mlsanity.com/paper/1802.04034/) (2018)
- [Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation](https://mlsanity.com/paper/1705.08475/) (2017)
- [Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach](https://mlsanity.com/paper/1801.10578/) (2018)
- [Robust Large Margin Deep Neural Networks](https://mlsanity.com/paper/1605.08254/) (2016)
- [Training robust neural networks using Lipschitz bounds](https://mlsanity.com/paper/2005.02929/) (2020)
- [Reachability Analysis of Deep Neural Networks with Provable Guarantees](https://mlsanity.com/paper/1805.02242/) (2018)
- [Quantum machine learning beyond kernel methods](https://mlsanity.com/paper/2110.13162/) (2021)
- [Robust data encodings for quantum classifiers](https://mlsanity.com/paper/2003.01695/) (2020)
- [Encoding-dependent generalization bounds for parametrized quantum circuits](https://mlsanity.com/paper/2106.03880/) (2021)
- [Data-dependent Sample Complexity of Deep Neural Networks via Lipschitz Augmentation](https://mlsanity.com/paper/1905.03684/) (2019)
- [Quantum noise protects quantum classifiers against adversaries](https://mlsanity.com/paper/2003.09416/) (2020)
- [Quantum Adversarial Machine Learning](https://mlsanity.com/paper/2001.00030/) (2019)
- [Understanding quantum machine learning also requires rethinking generalization](https://mlsanity.com/paper/2306.13461/) (2023)
- [Experimental quantum adversarial learning with programmable superconducting qubits](https://mlsanity.com/paper/2204.01738/) (2022)

## Built on by (most cited first, 21 of 21)

- [On the relation between trainability and dequantization of variational quantum learning models](https://mlsanity.com/paper/2406.07072/) (2024)
- [A Comparative Analysis of Adversarial Robustness for Quantum and Classical Machine Learning Models](https://mlsanity.com/paper/2404.16154/) (2024)
- [Adversarial Robustness Guarantees for Quantum Classifiers](https://mlsanity.com/paper/2405.10360/) (2024)
- [Quantum Neural Networks under Depolarization Noise: Exploring White-Box Attacks and Defenses](https://mlsanity.com/paper/2311.17458/) (2023)
- [Quantum Neural Networks in Practice: A Comparative Study with Classical Models from Standard Data Sets to Industrial Images](https://mlsanity.com/paper/2411.19276/) (2024)
- [QUACK: Quantum Aligned Centroid Kernel](https://mlsanity.com/paper/2405.00304/) (2024)
- [Robustness and Generalization in Quantum Reinforcement Learning via Lipschitz Regularization](https://mlsanity.com/paper/2410.21117/) (2024)
- [Adversarial Quantum Machine Learning: An Information-Theoretic Generalization Analysis](https://mlsanity.com/paper/2402.00176/) (2024)
- [Predictive control of blast furnace temperature in steelmaking with hybrid depth-infused quantum neural networks](https://mlsanity.com/paper/2504.12389/) (2025)
- [On the Generalization of Adversarially Trained Quantum Classifiers](https://mlsanity.com/paper/2504.17690/) (2025)
- [Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security](https://mlsanity.com/paper/2507.08623/) (2025)
- [Efficient and Accurate Estimation of Lipschitz Constants for Hybrid Quantum-Classical Decision Models](https://mlsanity.com/paper/2503.07992/) (2025)
- [Detecting underdetermination in parameterized quantum circuits](https://mlsanity.com/paper/2504.03315/) (2025)
- [Hybrid quantum recurrent neural network for remaining useful life prediction of turbofan engines](https://mlsanity.com/paper/2504.20823/) (2025)
- [The interplay of robustness and generalization in quantum machine learning](https://mlsanity.com/paper/2506.08455/) (2025)
- [MediQ-GAN: Quantum-Inspired GAN for High Resolution Medical Image Generation](https://mlsanity.com/paper/2506.21015/) (2025)
- [Defending Quantum Classifiers against Adversarial Perturbations through Quantum Autoencoders](https://mlsanity.com/paper/2604.28176/) (2026)
- [Quantum Interval Bound Propagation for Certified Training of Quantum Neural Networks](https://mlsanity.com/paper/2605.00747/) (2026)
- [Controlled Steering-Based State Preparation for Adversarial-Robust Quantum Machine Learning](https://mlsanity.com/paper/2605.10954/) (2026)
- [Mitigating Measurement-Induced Training Instability in Hybrid Quantum Neural Networks for Protein Classification](https://mlsanity.com/paper/2606.22551/) (2026)
- [A Multiclass Quantum Aligned Centroid Kernel](https://mlsanity.com/paper/2607.19782/) (2026)

## Abstract (arXiv)

Adversarial robustness and generalization are both crucial properties of reliable machine learning models. In this paper, we study these properties in the context of quantum machine learning based on Lipschitz bounds. We derive parameter-dependent Lipschitz bounds for quantum models with trainable encoding, showing that the norm of the data encoding has a crucial impact on the robustness against data perturbations. Further, we derive a bound on the generalization error which explicitly involves the parameters of the data encoding. Our theoretical findings give rise to a practical strategy for training robust and generalizable quantum models by regularizing the Lipschitz bound in the cost. Further, we show that, for fixed and non-trainable encodings, as those frequently employed in quantum machine learning, the Lipschitz bound cannot be influenced by tuning the parameters. Thus, trainable encodings are crucial for systematically adapting robustness and generalization during training. The practical implications of our theoretical findings are illustrated with numerical results.