# Adversarial Quantum Machine Learning: An Information-Theoretic Generalization Analysis

arXiv: https://arxiv.org/abs/2402.00176 · HTML: https://mlsanity.com/paper/2402.00176/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 18 references that are in the map.
- First posted on arXiv 31 Jan 2024.

## Builds on (most cited first, 10 of 10)

- [Supervised learning with quantum enhanced feature spaces](https://mlsanity.com/paper/1804.11326/) (2018)
- [Generalization in quantum machine learning from few training data](https://mlsanity.com/paper/2111.05292/) (2021)
- [Quantum Adversarial Machine Learning](https://mlsanity.com/paper/2001.00030/) (2019)
- [Out-of-distribution generalization for learning quantum dynamics](https://mlsanity.com/paper/2204.10268/) (2022)
- [Adversarial Learning Guarantees for Linear Hypotheses and Neural Networks](https://mlsanity.com/paper/2004.13617/) (2020)
- [Experimental quantum adversarial learning with programmable superconducting qubits](https://mlsanity.com/paper/2204.01738/) (2022)
- [Benchmarking Adversarially Robust Quantum Machine Learning at Scale](https://mlsanity.com/paper/2211.12681/) (2022)
- [An Introduction to Quantum Machine Learning for Engineers](https://mlsanity.com/paper/2205.09510/) (2022)
- [Training robust and generalizable quantum models](https://mlsanity.com/paper/2311.11871/) (2023)
- [Adversarial Rademacher Complexity of Deep Neural Networks](https://mlsanity.com/paper/2211.14966/) (2022)

## Built on by (most cited first, 3 of 3)

- [Quantum Adversarial Learning for Kernel Methods](https://mlsanity.com/paper/2404.05824/) (2024)
- [On the Generalization of Adversarially Trained Quantum Classifiers](https://mlsanity.com/paper/2504.17690/) (2025)
- [The interplay of robustness and generalization in quantum machine learning](https://mlsanity.com/paper/2506.08455/) (2025)

## Abstract (arXiv)

In a manner analogous to their classical counterparts, quantum classifiers are vulnerable to adversarial attacks that perturb their inputs. A promising countermeasure is to train the quantum classifier by adopting an attack-aware, or adversarial, loss function. This paper studies the generalization properties of quantum classifiers that are adversarially trained against bounded-norm white-box attacks. Specifically, a quantum adversary maximizes the classifier's loss by transforming an input state ρ(x) into a state λ that is ε-close to the original state ρ(x) in p-Schatten distance. Under suitable assumptions on the quantum embedding ρ(x), we derive novel information-theoretic upper bounds on the generalization error of adversarially trained quantum classifiers for p = 1 and p = ∞. The derived upper bounds consist of two terms: the first is an exponential function of the 2-R'enyi mutual information between classical data and quantum embedding, while the second term scales linearly with the adversarial perturbation size ε. Both terms are shown to decrease as 1/√T over the training set size T . An extension is also considered in which the adversary assumed during training has different parameters p and ε as compared to the adversary affecting the test inputs. Finally, we validate our theoretical findings with numerical experiments for a synthetic setting.