# QFAL: Quantum Federated Adversarial Learning

arXiv: https://arxiv.org/abs/2502.21171 · HTML: https://mlsanity.com/paper/2502.21171/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 22 of its 37 references that are in the map.
- First posted on arXiv 28 Feb 2025.

## Builds on (most cited first, 22 of 22)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Robustness May Be at Odds with Accuracy](https://mlsanity.com/paper/1805.12152/) (2018)
- [The power of quantum neural networks](https://mlsanity.com/paper/2011.00027/) (2020)
- [Efficient Learning for Deep Quantum Neural Networks](https://mlsanity.com/paper/1902.10445/) (2019)
- [Federated Quantum Machine Learning](https://mlsanity.com/paper/2103.12010/) (2021)
- [Quantum noise protects quantum classifiers against adversaries](https://mlsanity.com/paper/2003.09416/) (2020)
- [Quantum Adversarial Machine Learning](https://mlsanity.com/paper/2001.00030/) (2019)
- [Quantum Federated Learning with Quantum Data](https://mlsanity.com/paper/2106.00005/) (2021)
- [Quantum federated learning through blind quantum computing](https://mlsanity.com/paper/2103.08403/) (2021)
- [DAP: A Dynamic Adversarial Patch for Evading Person Detectors](https://mlsanity.com/paper/2305.11618/) (2023)
- [FedQNN: Federated Learning using Quantum Neural Networks](https://mlsanity.com/paper/2403.10861/) (2024)
- [Heterogeneous Federated Learning](https://mlsanity.com/paper/2008.06767/) (2020)
- [Delving into the Adversarial Robustness of Federated Learning](https://mlsanity.com/paper/2302.09479/) (2023)
- [Federated Quantum Machine Learning with Differential Privacy](https://mlsanity.com/paper/2310.06973/) (2023)
- [Federated Quantum Natural Gradient Descent for Quantum Federated Learning](https://mlsanity.com/paper/2209.00564/) (2022)
- [Optimizing Quantum Federated Learning Based on Federated Quantum Natural Gradient Descent](https://mlsanity.com/paper/2303.08116/) (2023)
- [Simulation of a Variational Quantum Perceptron using Grover's Algorithm](https://mlsanity.com/paper/2305.11040/) (2023)
- [LEP-QNN: Loan Eligibility Prediction using Quantum Neural Networks](https://mlsanity.com/paper/2412.03158/) (2024)
- [Federated Learning with Quantum Computing and Fully Homomorphic Encryption: A Novel Computing Paradigm Shift in Privacy-Preserving ML](https://mlsanity.com/paper/2409.11430/) (2024)
- [MQFL-FHE: Multimodal Quantum Federated Learning Framework with Fully Homomorphic Encryption](https://mlsanity.com/paper/2412.01858/) (2024)

## Built on by (most cited first, 6 of 6)

- [Quantum Federated Learning: A Comprehensive Survey](https://mlsanity.com/paper/2508.15998/) (2025)
- [When Federated Learning Meets Quantum Computing: Survey and Research Opportunities](https://mlsanity.com/paper/2504.08814/) (2025)
- [Adversarial Robustness in Distributed Quantum Machine Learning](https://mlsanity.com/paper/2508.11848/) (2025)
- [RobQFL: Robust Quantum Federated Learning in Adversarial Environment](https://mlsanity.com/paper/2509.04914/) (2025)
- [Quantum Federated Learning: Architectural Elements and Future Directions](https://mlsanity.com/paper/2510.17642/) (2025)
- [Quantum Adversarial Machine Learning: From Classical Adaptations to Quantum-Native Methods](https://mlsanity.com/paper/2605.18821/) (2026)

## Abstract (arXiv)

Quantum federated learning (QFL) merges the privacy advantages of federated systems with the computational potential of quantum neural networks (QNNs), yet its vulnerability to adversarial attacks remains poorly understood. This work pioneers the integration of adversarial training into QFL, proposing a robust framework, quantum federated adversarial learning (QFAL), where clients collaboratively defend against perturbations by combining local adversarial example generation with federated averaging (FedAvg). We systematically evaluate the interplay between three critical factors: client count (5, 10, 15), adversarial training coverage (0-100%), and adversarial attack perturbation strength (epsilon = 0.01-0.5), using the MNIST dataset. Our experimental results show that while fewer clients often yield higher clean-data accuracy, larger federations can more effectively balance accuracy and robustness when partially adversarially trained. Notably, even limited adversarial coverage (e.g., 20%-50%) can significantly improve resilience to moderate perturbations, though at the cost of reduced baseline performance. Conversely, full adversarial training (100%) may regain high clean accuracy but is vulnerable under stronger attacks. These findings underscore an inherent trade-off between robust and standard objectives, which is further complicated by quantum-specific factors. We conclude that a carefully chosen combination of client count and adversarial coverage is critical for mitigating adversarial vulnerabilities in QFL. Moreover, we highlight opportunities for future research, including adaptive adversarial training schedules, more diverse quantum encoding schemes, and personalized defense strategies to further enhance the robustness-accuracy trade-off in real-world quantum federated environments.