# When cheap gradients fail: the measurement cost of attacking quantum classifiers

arXiv: https://arxiv.org/abs/2607.11095 · HTML: https://mlsanity.com/paper/2607.11095/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 66 references that are in the map.
- First posted on arXiv 13 Jul 2026.

## Builds on (most cited first, 15 of 15)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Visualizing the Loss Landscape of Neural Nets](https://mlsanity.com/paper/1712.09913/) (2017)
- [Automatic differentiation in machine learning: a survey](https://mlsanity.com/paper/1502.05767/) (2015)
- [Provable defenses against adversarial examples via the convex outer adversarial polytope](https://mlsanity.com/paper/1711.00851/) (2017)
- [Identifying and attacking the saddle point problem in high-dimensional non-convex optimization](https://mlsanity.com/paper/1406.2572/) (2014)
- [Global Convergence of Langevin Dynamics Based Algorithms for Nonconvex Optimization](https://mlsanity.com/paper/1707.06618/) (2017)
- [The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure](https://mlsanity.com/paper/1809.03063/) (2018)
- [Trade-off between Gradient Measurement Efficiency and Expressivity in Deep Quantum Neural Networks](https://mlsanity.com/paper/2406.18316/) (2024)
- [Hybrid Classical-Quantum Deep Learning Models for Autonomous Vehicle Traffic Image Classification Under Adversarial Attack](https://mlsanity.com/paper/2108.01125/) (2021)
- [Information-Theoretic Lower Bounds for Zero-Order Stochastic Gradient Estimation](https://mlsanity.com/paper/2003.13881/) (2020)
- [An Empirical Review of Optimization Techniques for Quantum Variational Circuits](https://mlsanity.com/paper/2202.01389/) (2022)
- [Quantum Shadow Gradient Descent for Variational Quantum Algorithms](https://mlsanity.com/paper/2310.06935/) (2023)
- [Experimental robustness benchmarking of quantum neural networks on a superconducting quantum processor](https://mlsanity.com/paper/2505.16714/) (2025)

## Built on by (most cited first, 1 of 1)

- [Certification cost of quantum models: measurement correlation, not parameter count](https://mlsanity.com/paper/2609.14424/) (2026)

## Abstract (arXiv)

Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics (shot noise) act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. Under stated assumptions, single-step attacks need at least quadratically many shots in the input dimension d, growing as d5/2 under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the d5/2 geometric floor for plateau-mitigated models and grows as d3.00 for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in recovers the parameter-free d3/2 shot-noise geometry. Against a matched classical baseline whose attack overhead is dimension-independent (the cheap-gradient principle of automatic differentiation), the quantum gradient cost ratio grows empirically as d3.00, so the attacker's relative cost diverges as the model scales. Experiments on a 156-qubit IBM processor (ibmboston, 4-qubit circuits, d=12) reproduce the effect: at matched budgets the device attack tracks the ideal within a few percent, with the high-shot gradient faithful to the exact one. The defense operates precisely when the forward map is classically hard to simulate: only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.