# SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness

arXiv: https://arxiv.org/abs/2511.14989 · HTML: https://mlsanity.com/paper/2511.14989/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Placed in Machine unlearning, one of 12 directions in LLM safety and security.
- Builds on 43 of its 103 references that are in the map.
- First posted on arXiv 19 Nov 2025.

## Placed in

- LLM safety and security / [Machine unlearning](https://mlsanity.com/safety/machine-unlearning/)

## Builds on (most cited first, 30 of 43)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015)
- [Variational Quantum Algorithms](https://mlsanity.com/paper/2012.09265/) (2020)
- [Supervised learning with quantum enhanced feature spaces](https://mlsanity.com/paper/1804.11326/) (2018)
- [Power of data in quantum machine learning](https://mlsanity.com/paper/2011.01938/) (2020)
- [Parameterized quantum circuits as machine learning models](https://mlsanity.com/paper/1906.07682/) (2019)
- [Quantum Machine Learning](https://mlsanity.com/paper/1611.09347/) (2016)
- [Quantum advantage in learning from experiments](https://mlsanity.com/paper/2112.00778/) (2021)
- [Quantum Adversarial Machine Learning](https://mlsanity.com/paper/2001.00030/) (2019)
- [Experimental quantum adversarial learning with programmable superconducting qubits](https://mlsanity.com/paper/2204.01738/) (2022)
- [Quantum machine learning with differential privacy](https://mlsanity.com/paper/2103.06232/) (2021)
- [Benchmarking Adversarially Robust Quantum Machine Learning at Scale](https://mlsanity.com/paper/2211.12681/) (2022)
- [Towards quantum enhanced adversarial robustness in machine learning](https://mlsanity.com/paper/2306.12688/) (2023)
- [Optimal Provable Robustness of Quantum Classification via Quantum Hypothesis Testing](https://mlsanity.com/paper/2009.10064/) (2020)
- [Universal Adversarial Examples and Perturbations for Quantum Classifiers](https://mlsanity.com/paper/2102.07788/) (2021)
- [Enhancing Quantum Adversarial Robustness by Randomized Encodings](https://mlsanity.com/paper/2212.02531/) (2022)
- [Adversarial Robustness Guarantees for Quantum Classifiers](https://mlsanity.com/paper/2405.10360/) (2024)
- [A unifying framework for differentially private quantum algorithms](https://mlsanity.com/paper/2307.04733/) (2023)
- [QuantumLeak: Stealing Quantum Neural Networks from Cloud-based NISQ Machines](https://mlsanity.com/paper/2403.10790/) (2024)
- [QuMoS: A Framework for Preserving Security of Quantum Machine Learning Model](https://mlsanity.com/paper/2304.11511/) (2023)
- [Evaluating Efficacy of Model Stealing Attacks and Defenses on Quantum Neural Networks](https://mlsanity.com/paper/2402.11687/) (2024)
- [Security Attacks Abusing Pulse-level Quantum Circuits](https://mlsanity.com/paper/2406.05941/) (2024)
- [QTrojan: A Circuit Backdoor Against Quantum Neural Networks](https://mlsanity.com/paper/2302.08090/) (2023)
- [AI-driven Reverse Engineering of QML Models](https://mlsanity.com/paper/2408.16929/) (2024)
- [OPAQUE: Obfuscating Phase in Quantum Circuit Compilation for Efficient IP Protection](https://mlsanity.com/paper/2502.16605/) (2025)
- [CopyQNN: Quantum Neural Network Extraction Attack under Varying Quantum Noise](https://mlsanity.com/paper/2504.00366/) (2025)
- [STIQ: Safeguarding Training and Inferencing of Quantum Neural Networks from Untrusted Cloud](https://mlsanity.com/paper/2405.18746/) (2024)
- [The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models](https://mlsanity.com/paper/2407.07237/) (2024)
- [Evaluating the Potential of Quantum Machine Learning in Cybersecurity: A Case-Study on PCA-based Intrusion Detection Systems](https://mlsanity.com/paper/2502.11173/) (2025)

## Built on by (most cited first, 3 of 3)

- [AI Security Research Should Better Incentivize Defense Research](https://mlsanity.com/paper/2605.23448/) (2026)
- [Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do](https://mlsanity.com/paper/2608.15617/) (2026)
- [Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access](https://mlsanity.com/paper/2609.05702/) (2026)

## Abstract (arXiv)

Quantum Machine Learning (QML) integrates quantum computational principles into learning algorithms, offering improved representational capacity and computational efficiency. However, the security and robustness of QML systems remain underexplored, particularly under adversarial conditions. We present the first comprehensive systematization of adversarial robustness in QML, combining conceptual organization with empirical evaluation across black-box, gray-box, and white-box threat models. We implement five representative attacks: a label-flipping poisoning attack under black-box; an encoder-level indiscriminate poisoning attack and a proxy-model clean-label backdoor attack under gray-box; and a circuit-level backdoor attack (QTrojan) and gradient-based evasion attacks (FGSM and PGD) under white-box. We evaluate these attacks using a Quantum Multilayer Perceptron (QMLP) trained on MNIST and AZ-Class across circuit depths of 2, 5, 10, and 50 layers with angle and amplitude encoding schemes. Our evaluations reveal a fundamental accuracy-robustness trade-off. Amplitude encoding achieves the highest clean accuracy (92.6% on MNIST and 67% on AZ-Class) but collapses under adversarial perturbations and depolarizing noise, whereas shallow angle-encoded models remain more stable. QUID is effective under noiseless conditions but weakened by noise, while the proxy-model backdoor persists unless the circuit itself is overwhelmed. Furthermore, the circuit-level backdoor fails in the multi-class setting, indicating a scalability limitation. Finally, QMLP models are more robust than Classical Multi-Layer Perceptron (CMLP) models under label-flipping attacks but substantially more vulnerable to gradient-based evasion. We conclude by proposing a threat-aware and noise-resilient framework for secure QML deployment.