#  Observation of microcavity fine structure

C. Koks  F. B. Baalbergen  M. P. van Exter  Huygens-Kamerlingh Onnes
Laboratory, Leiden University, P.O. Box 9504, 2300 RA Leiden, The Netherlands

###### Abstract

We observe fine structure in the resonance spectra of optical microcavities.
We identify the polarization-resolved modes in the spectrum and find that
resonance frequencies split in accordance with the theoretical prediction. The
observed fine structure is dominantly caused by an optical spin-orbit coupling
and non-paraxial propagation and reflection. Both effects are intrinsic, i.e.
present in an ideal rotation-symmetric system, and scale inversely
proportional to the mirror radius of curvature. For cavities with a small
radius of curvature, the influence of fine structure on the resonance spectrum
is important and unavoidable and should thus be taken into account.

The fine structure in atomic spectra has revealed perturbations to the
Hamiltonian which are intrinsic for atoms [1]. The Bohr model in atomic
physics predicts groups of degenerate orbitals, labeled by the principal
quantum number $n$. This degeneracy is lifted by perturbations such as spin-
orbit coupling and a relativistic correction [2]. We observe a spectral fine
structure in optical microcavities which reveals similar intrinsic
perturbations to the paraxial wave equation. The paraxial model predicts
groups of frequency-degenerate transverse modes, labeled by the transverse
order $N$ [3]. Also their degeneracy is lifted by perturbations which are
intrinsic to microcavities.

The microcavity fine structure becomes relevant when the radius of curvature
of the mirror $R$ is small. More specifically, the fine structure is
proportional to $\lambda/R$ and typically observable when
$F\frac{\lambda}{R}>10$, where $F$ is the cavity finesse [3, 4]. The intrinsic
corrections dominate over external effects, such as astigmatism, when
$\lambda/R$ is large enough.

The frequency splittings that have been reported in literature are typically
for cavities with larger radii of curvature, where the external effects of
astigmatism [5, 6, 7, 8] and birefringence [9] dominate. Intrinsic effects of
fine structure have been reported for microwave cavities [10, 11], where
$\lambda$ is large. To the best of our knowledge, the spin-orbit coupling for
cavities has only been reported in the optical domain in a conference
proceeding [12]. We observe and analyze the complete fine structure for
optical microcavities with very small radii of curvature.

In this paper, we show how the intrinsic effects determine the fine structure.
We scan the cavity length to obtain the spectra of four optical microcavities
with radii of curvature between $R=2.5(5)-17.3(2)~{}\mu$m and present the full
analysis for the $R=5.8(2)~{}\mu$m cavity. We first label the resonant modes
in the spectrum with transverse order $N$, according to paraxial theory. We
then observe fine structure by zooming in on each $N$ group. Using a
polarization-resolved CCD camera, we can further identify every mode in the
fine structure. We study the fine structure systematically and compare it to
theory. Finally, we report a third type of splitting, which we call “hyperfine
splitting” and which is due to a Bragg effect [13].

Figure 1: Analogy between optical microcavity and atom. (a) Optical field with
spiral wavefront $e^{il\phi}$ and circular polarization $s$ between a flat and
curved mirror. (b) Electron wavefunction with orbital angular momentum $\ell$
and electron spin $s$. Figure 2: Cavity transmission spectrum shows
fundamental and higher-order transverse modes. (a) Transmission versus cavity
length as a function of the cavity length, where $q,N$ indicate the
longitudinal and transverse mode number. (b-e) Zoom-ins of the groups N=1 to
N=4 show fine structure. The broad peaks around $L=1300$ nm and $L=1600$ nm
are resonances of planar modes formed next to the microcavity.

The origin of the microcavity fine structure is similar to that of atoms.
Figure 1 illustrates the perturbations in both systems. In atoms, spin-orbit
coupling couples the orbital angular momentum $\ell$ and the spin $s$ of an
electron through the magnetic field. In microcavities, spin-orbit coupling
couples the angular momentum $\ell$ and circular polarization spin $s$ of
light [14]. The optical spin-orbit coupling originates from a projection of
the longitudinal component of the electric field [15] into an additional small
transverse component at the mirror surface. The relativistic correction in
atoms is a quartic $p^{4}$ correction to the momentum, which shifts all modes
proportional to $\ell^{2}$. As a direct analogy, a non-paraxial momentum
correction $k_{\perp}^{4}$ is required for microcavities with large opening
angles [16, 11], which also shifts all modes proportional to $\ell^{2}$. In
addition, the non-paraxial theory contains a $r^{4}$ correction from higher-
order Taylor expansions of the mirror and wavefront shape [17]. The complete
theory of microcavity fine structure is presented in [4].

Paraxial theory predicts resonant cavity lengths that only depend on the
longitudinal mode number $q$, transverse order $N$, and Gouy phase
$\chi=\arcsin\sqrt{(L+2L_{\rm D})/R}$, where $L_{\rm D}$ is the modal DBR
penetration depth [18]. We experimentally determine the radius of curvature
from the transverse mode spacings between each N group, which are equidistant
in the paraxial theory [18, 19]. A more complete (non-paraxial) description
from [4] contains the fine structure splittings $\Delta\tilde{L}$,

$L=\frac{\lambda}{2}\left[q+\frac{N+1}{\pi}\chi+\Delta\tilde{L}\right],$ (1)

where

$\Delta\tilde{L}=\frac{1}{2\pi kR}\left[-\ell\cdot
s-\left(\frac{3}{8}-\tilde{p}\frac{L}{8(R-L)}\right)\ell^{2}+f(N)\right].$ (2)

This equation includes the two corrections: (i) the spin-orbit coupling,
scaling with $l\cdot s$, and (ii) the quartic corrections $k_{\perp}^{4}$ and
$r^{4}$, scaling with $\ell^{2}$. The quartic corrections shift the modes by a
factor $3\ell^{2}/8$ when using a perfectly spherical mirror. Perturbations to
this mirror shape are quantified by the aspheric correction $\tilde{p}$
defined as $z_{\rm mirror}-z_{\rm sphere}=-\tilde{p}\frac{r^{4}}{8R^{3}}$. The
term $f(N)$ shifts all modes of transverse order $N$ by the same amount and
goes unnoticed in the fine structure.

Our planar and curved Distributed Bragg Reflectors (DBR) are produced by
Oxford HighQ [20] and have a reflectively of 99.9% (finesse $F\approx 3000$).
The curved mirror is illuminated with a HeNe laser ($\lambda=633$ nm). The
cavity length is scanned with piezo-stacks and the light is transmitted
through the microcavity at resonant cavity lengths. This transmitted light is
detected with a photodiode and a polarization-resolving CCD camera.

Figure 3: Fine structure splittings of the (a-d) N=1 and (e-h) N=2 transverse
mode groups. The dashed lines in (a) and (e) correspond to polarization
resolved CCD images (b-d) and (f-h), where the order from left to right
corresponds to a smaller to larger cavity length detuning in (a) and (e). Each
ellipse shows the local direction and circularity of the polarization.

Figure 2a shows a typical microcavity transmission spectrum, for the
$R=5.8(2)~{}\mu$m cavity. The peaks are located at resonant cavity lengths
$L$. We can label them with $q$ and $N$ according to paraxial theory, which
predicts that each transverse group $N$ consists of $2(N+1)$ orthogonal modes.
Figures 2b-e zoom in on each $N$ group. This shows that, in practice, each
group typically consists of $N+1$ modes. The dashed lines suggest that all odd
(or even) $N$-groups have similar mode and fine structures, albeit that larger
$N$-groups contain more modes. The $0$-mode for the even $N$ groups is shifted
due to the shape of the mirror (see below).

Figure 3 shows the spectrum and CCD images of the polarized eigenmodes of the
$N=1$ and $N=2$ groups. The eigenmodes of the $N=3$ and $N=4$ groups are shown
in the Supplemental Document. The mode labels $\ell A$ and $\ell B$ ($\ell>0$)
in Fig. 2 and 3 are identified from the CCD images as follows. The angular
momentum $\ell$ is determined by inspecting the intensity profile and
comparing it to the scalar Laguerre-Gaussian modes [3]. For instance, the
$N=2$ modes in Figs. 3f and 3h have a dark center and one ring, corresponding
to $\ell=2$, whereas Fig. 3g has a bright center, corresponding to $\ell=0$.
The $A/B$ labels are determined from the polarization patterns, where the
pattern of the $A/B$ modes resemble circular/hyperbolic flow lines. The total
angular momentum $j=l+s$ ($s=-1$ for $A$ and $s=1$ for $B$ modes) is visible
in the rotation symmetry of the polarization pattern, which remains unchanged
after rotation over an angle $\pi/j$ (rotational symmetric at $j=0$).

Figure 3a also shows “hyperfine” splitting for mode $1A$. This supports the
theoretically prediction that each of the $N+1$ modes is typically two-fold
degenerate and that this degeneracy can be lifted under certain conditions.
Those modes are labeled $+/-$ and have orthogonal polarization patterns. The
CCD images of the modes $1A-$ and $1A+$, shown in Figs. 3c and d, show that
their polarization is in the azimuthal and radial direction, respectively.
Figure 3e also shows a hyperfine splitting for the $0$ and $2A$ modes. Fig. 3g
and 3h show the modes with the mostly radial polarization direction, which
correspond to the left peaks in the hyperfine splitting of the $0$ and the
$2A$ modes in Fig. 3e.

Fig. 4 shows the measured splitting $\Delta L_{SO}$ between the $\ell A$ and
$\ell B$ modes due to spin-orbit coupling. The green points correspond
$R=5.8(2)~{}\mu$m cavity presented in Figs. 2 and 3, and scale linearly with
the angular momentum $\ell$. We observed the fine structure in three other
cavities, which also show a clear linear scaling $\ell$.

Fig. 4 also shows the theoretical prediction of spin-orbit coupling $\Delta
L_{SO}$ based on the measured radius of curvature $R$. The figure shows that
the measured splittings follow the theory well for all four cavities, showing
that spin-orbit coupling in these cavities dominates over external
perturbations. It also shows the inverse proportionality with $R$ of the fine
structure splittings.

Theory predicts that a quartic perturbation shifts both $\ell A$ and $\ell B$
modes by the same amount, such that their resonant cavity lengths decrease
proportional to $\ell^{2}$. The data in figure 2 agrees reasonably well with
this prediction. To quantify this effect, we look at the average position of
the $\ell A$ and $\ell B$ modes, given by $\ell\overline{AB}$, and compare it
with $(\ell+2)\overline{AB}$. From equation 2 we find that such splittings are
$\Delta L_{\rm quartic,th}/(\lambda/2)=3(\ell+1)/(4\pi kR)$ where $\ell$ is
the lowest angular momentum of the modes. Theory predicts for $N=\ell+2=2,3,4$
that $\Delta L_{\rm quartic,th}=1.31(5)$ nm, $2.62(9)$ nm and $3.9(1)$ nm. The
measured splittings are $\Delta L_{\rm quartic}=0.93(5)$ nm, $4.17(7)$ nm and
$6.3(1)$ nm. The measured values have the same sign and order of magnitude as
the theoretical values but differ because of an aspheric correction
$\tilde{p}\frac{L}{8(R-L)}=0.11(1),~{}-0.20(1)$, and $-0.23(1)$. The
decreasing value for $\tilde{p}$ suggests that the cavity is flatter for
compact (low $N$) modes and steeper for larger (high $N$) modes. This agrees
with the “bathtub” shape which has previously been observed in AFM
measurements [19].

The hyperfine splitting of the $1A$ modes in Fig 3a can be explained by the
Bragg effect. It occurs because the DBRs have an angle-dependent penetration
depth, which is opposite for radial ($1A+$) and azimuthal ($1A-$) polarized
light [13, 21]. The measured distance of $0.12(2)$ nm between the $1A+$ and
$1A-$ modes can be explained by a small wavelength detuning from the stopband
center of the DBR. The hyperfine splitting of 0.15(2) nm of the $0$ and $2A$
modes in Fig. 3a can also be explained by the Bragg effect. The $0$ and $2A$
modes mix due to astigmatism, such that the mode profile are more radially and
azimuthally polarized. The mixing ratio of the $0$ and $2A$ modes is almost
the same, which explain why the hyperfine splitting is also almost the same
(see supplemental material).

Figure 4: Observed mode splitting due to spin-orbit coupling for four
different cavities. The lines show the theoretically predicted value with
uncertainty for each radius of curvature.

Finally, we model the effect of astigmatism on the fine structure splitting by
combining the intrinsic effects with aspherical and astigmatic corrections
(see Supplemental Document). When we fit this extended model to the splittings
of the fine structure for $N=4$ in Fig. 2e, we find that the astigmatism
$\eta_{\rm astig}=(R_{\rm max}-R_{\rm min})/(2R)\approx 0.6(2)\%$ for our
$R=5.8(2)~{}\mu$m cavity is moderate. Theory predicts astigmatism to be
important when $\eta_{\rm astig}>1/(k\sqrt{LR})$, but the relative strength of
astigmatic coupling between modes also depends on their frequency difference
[19]; modes with large angular momentum $\ell$ have a larger splitting and are
therefore less sensitive to astigmatism.

In conclusion, we have observed fine structures in the resonance spectra of
microcavities. The fine structure is explained by two intrinsic perturbations.
First, the spin-orbit coupling causes a frequency splitting between the $\ell
A$ and $\ell B$ modes, which scales with $\ell$. Second, the quartic terms
$k_{\perp}^{4}$ and $r^{4}$ shift both $\ell A$ and $\ell B$ by the same
amount, scaling with $\ell^{2}$. A parameter $\tilde{p}$ was introduced to
quantify the aspheric shape of the mirror. Furthermore, a hyperfine splitting
was observed in the $1A+/1A-$ mode, which could be explained by the
polarization dependence of the penetration depth in the DBR. Measurements on
other cavities with different radii of curvature showed that the fine
structure splittings scale with $\lambda/R$. The analogy with fine structure
in atomic physics helps to understand the full spectrum and even some aspects
of the hyperfine structure.

The efforts in the past years to increase light-matter interaction [22, 23]
have simultaneously promoted an increase in finesse and decrease in radius of
curvature. The effects of fine structure are relevant when
$F\frac{\lambda}{R}>10$, so fine structure will be large and unavoidable in
such microcavities. Moreover, if $\lambda/R$ is small, the intrinsic effects
that cause fine structure tend to dominate over external effects such as
astigmatism. For a small radius of curvature, spin-orbit coupling, the quartic
term, and the Bragg effect are essential to fully describe the mode profiles.

We would like to thank A. A. P. Trichet from Oxford HighQ for providing us
with the mirror samples. We also acknowledge Sean van der Meer and Martin Bijl
for supporting experiments, Martijn Wubs for supporting theory and Pepijn
Pinkse for stimulating discussions.

## References

  * Sommerfeld [1940] A. Sommerfeld, Naturwissenschaften 28, 417 (1940).
  * Thorne and Blandford [2017] K. Thorne and R. Blandford,  _Modern Classical Physics: Optics, Fluids, Plasmas, Elasticity, Relativity, and Statistical Physics_ (Princeton University Press, 2017).
  * Siegman [1988] A. Siegman,  _Lasers_ (University Science Books, 1988).
  * van Exter  _et al._ [2022] M. P. van Exter, M. Wubs, and C. Koks, to be submitted (2022).
  * Benedikter  _et al._ [2015] J. Benedikter, T. Hümmer, M. Mader, B. Schlederer, J. Reichel, T. W. Hansch, and D. Hunger, New J. Phys. 17, 053051 (2015).
  * Benedikter  _et al._ [2019] J. Benedikter, T. Moosmayer, M. Mader, T. Hümmer, and D. Hunger, New J. Phys. 21, 103029 (2019).
  * Uphoff  _et al._ [2015] M. Uphoff, M. Brekenfeld, G. Rempe, and S. Ritter, New J. Phys. 17, 013053 (2015).
  * Papageorge  _et al._ [2016] A. T. Papageorge, A. J. Kollár, and B. L. Lev, Opt. Express 24, 11447 (2016).
  * Fleisher  _et al._ [2016] A. J. Fleisher, D. A. Long, Q. Liu, and J. T. Hodges, Phys. Rev. A 93, 013833 (2016).
  * Yu and Luk [1983] P. Yu and K. Luk, Electron. Lett. 19, 539 (1983).
  * Erickson [1975] C. Erickson, IEEE Trans. Micro. Theory and Techn. 23, 218 (1975).
  * Pinkse  _et al._ [2011] M. Pinkse, P. W. H.and Koch, Hageman, M. Motsch, M. Zeppenfeld, and R. M., Conference on Lasers and Electro-Optics Europe and EQEC 2011 (poster) (2011), 10.1109/CLEOE.2011.5943470.
  * Foster  _et al._ [2009] D. Foster, A. Cook, and J. Nöckel, Phys. Rev. A 79, 011803(R) (2009).
  * Bliokh  _et al._ [2015] K. Y. Bliokh, F. J. Rodríguez-Fortuño, F. Nori, and A. V. Zayats, Nature Photonics 9, 796 (2015), arXiv:1505.02864 .
  * Yu and Luk [1984] P. Yu and K. Luk, IEEE Trans. Micro. Theory and Techn. 32, 641 (1984).
  * Lax [1975] M. Lax, Phys. Rev. A 11, 1365 (1975).
  * Luk [1986] K.-M. Luk, J. Opt. Soc. Am. A 3, 3 (1986).
  * Koks and van Exter [2021] C. Koks and M. P. van Exter, Opt. Express 29, 6879 (2021).
  * Koks and van Exter [2022] C. Koks and M. P. van Exter, Opt. Express 30, 700 (2022).
  * Trichet  _et al._ [2015] A. A. P. Trichet, P. R. Dolan, D. M. Coles, G. M. Hughes, and J. M. Smith, Opt. Express 23, 17205 (2015).
  * Babic  _et al._ [1993] D. I. Babic, Y. Chung, N. Dagli, and J. E. Bowers, IEEE J. Quant. Electron. 29, 1950 (1993).
  * Wang  _et al._ [2019] D. Wang, H. Kelkar, D. Martin-Cano, D. Rattenbacher, A. Shkarin, T. Utikal, S. Götzinger, and V. Sandoghdar, Nat. Phys. 15, 483 (2019).
  * Najer  _et al._ [2019] D. Najer, I. Söllner, P. Sekatski, V. Dolique, M. C. Löbl, D. Riedel, R. Schott, S. Starosielec, S. R. Valentin, A. D. Wieck, N. Sangouard, A. Ludwig, and R. J. Warburton, Nature 575, 622 (2019).


figurec

# Towards quantum enhanced adversarial robustness in machine learning

Maxwell T. West<EMAIL_ADDRESS>School of Physics, The
University of Melbourne, Parkville, 3010, VIC, Australia  Shu-Lok Tsang
School of Computing and Information Systems, The University of Melbourne,
Parkville, 3010, VIC, Australia  Jia S. Low  School of Computing and
Information Systems, The University of Melbourne, Parkville, 3010, VIC,
Australia  Charles D. Hill  School of Physics, The University of Melbourne,
Parkville, 3010, VIC, Australia  School of Mathematics and Statistics, The
University of Melbourne, Parkville, 3010, VIC, Australia  Christopher Leckie
School of Computing and Information Systems, The University of Melbourne,
Parkville, 3010, VIC, Australia  Lloyd C.L. Hollenberg  School of Physics, The
University of Melbourne, Parkville, 3010, VIC, Australia  Center for Quantum
Computation and Communication Technologies, The University of Melbourne,
Parkville, 3010, VIC, Australia  Sarah M. Erfani  School of Computing and
Information Systems, The University of Melbourne, Parkville, 3010, VIC,
Australia  Muhammad Usman<EMAIL_ADDRESS>School of Physics, The
University of Melbourne, Parkville, 3010, VIC, Australia  Data61, CSIRO,
Clayton, 3168, VIC, Australia

Machine learning algorithms are powerful tools for data driven tasks such as
image classification and feature detection, however their vulnerability to
adversarial examples - input samples manipulated to fool the algorithm -
remains a serious challenge. The integration of machine learning with quantum
computing has the potential to yield tools offering not only better accuracy
and computational efficiency, but also superior robustness against adversarial
attacks. Indeed, recent work has employed quantum mechanical phenomena to
defend against adversarial attacks, spurring the rapid development of the
field of quantum adversarial machine learning (QAML) and potentially yielding
a new source of quantum advantage. Despite promising early results, there
remain challenges towards building robust real-world QAML tools. In this
review we discuss recent progress in QAML and identify key challenges. We also
suggest future research directions which could determine the route to
practicality for QAML approaches as quantum computing hardware scales up and
noise levels are reduced.

Machine learning (ML) algorithms are ubiquitous nowadays and underpin the vast
majority of autonomous and robotic systems, including those deployed in
security applications such as facial recognition, data classification,
surveillance, and security systems for military applications [2]. In these
settings, the robustness of ML algorithms is of critical importance, with any
vulnerability to data manipulation potentially posing a serious security
threat. This has instigated a major new subfield within machine learning,
namely adversarial machine learning. Adversarial ML is concerned with the
process of generating inputs which will be misclassified by a targeted ML
system (typically a neural network), despite being only perturbed by a small
amount from an initial, correctly classified input [3, 4, 5, 6] (see Figure
1). While modern neural networks are generally resilient to minor random
perturbations of their inputs, they can be extremely susceptible to nonrandom,
carefully crafted ones as shown in Figure 1(b). In the case of high resolution
image classification, even state-of-the-art convolutional neural networks can
be fooled by adding to a clean image perturbations which are so small they are
completely imperceptible to human eyes [4], or possibly consisting of a change
to only a single pixel [7]. The surprising brittleness of such powerful
classifiers has been intensively studied in recent years, with increasingly
sophisticated methods of attacking [8, 9, 10, 11, 12] (i.e. generating
adversarial examples) and defending [13, 14, 15, 16] neural networks
developed.

In a world where security sensitive tasks are beginning to be outsourced to ML
frameworks, it is imperative to fully understand the nature of the mechanism
by which neural networks may be tricked by seemingly innocuous examples which
are all but indistinguishable from genuine data [17]. This need is heightened
by the recent discoveries of adversarial attacks originating not from applying
such perturbations digitally, but rather carrying out attacks in the physical
world [11, 18, 11], for example by applying stickers in an adversarial fashion
to road signs [11], with potentially serious implications for the reliability
of self driving cars. While for now the long-term resolution of the problems
of adversarial examples remains unclear, recently attention has also been
turning to how quantum machine learning (QML) [19] will fare against
adversarial attacks [20, 21, 22, 23, 24, 25, 26, 27, 28].

Figure 1: Adversarial machine learning. a. Common machine learning methods can
be thought of as performing an embedding from an input space of possible
examples to an internal space used for classification. A classifier will
construct a decision boundary in the classification space, with inputs
classified according to on which side of the boundary they fall. As depicted
schematically in the figure, inputs which are mapped close to the decision
boundary are subject to the possibility of being misclassified under a small
adversarial perturbation, despite potentially being all but indistinguishable
from the original clean data sample. b. The accuracy of a convolutional neural
network on the MNIST [29] dataset of images of handwritten digits in the
presence of perturbations generated by the PGD attack [14], the FGSM attack
[9], and randomly. The strength of the attack is the maximum amount by which
an individual pixel may be changed (the pixels take values in $[0,1]$). The
mere magnitude of the changes is insufficient to cause misclassification, as
can be seen by the robustness to randomly generated perturbations, but the
targeted attacks are capable of conclusively deceiving the network. c. A
typical quantum classifier consists of three main components: first the data
is encoded into a quantum state (blue), then fed through multiple layers of
parameterised rotations and entangling gates (red), and finally a measurement
is performed to determine the output of the model (yellow). d. The height
above the equator and the azimuthal angle $\varphi_{n}$ of 100 points sampled
uniformly randomly from unit spheres $\mathbb{S}^{n-1}\subseteq\mathbb{R}^{n}$
for $n\in\\{3,\ 10,\ 1024\\}$. While $\varphi_{n}$ is distributed uniformly on
the interval $[0,2\pi)$ independently of $n$, randomly selected points are
found exponentially (in the dimension $n-1$ of the sphere) close to the
equator. By symmetry there is nothing special about the chosen equator;
counter-intuitively, points on a high dimension or sphere concentrate about
any equator. Moreover they will cluster around the boundary of any set of
measure at least 1/2, which necessarily includes the decision boundary of any
binary classifier on $\mathbb{S}^{n-1}$. Such a classifier would then have
significant adversarial vulnerability; almost all of the points in
$\mathbb{S}^{n-1}$ lie close to the decision boundry, and are therefore
vulnerable to being adversarially perturbed over it.

The incredible advancements in quantum computing over the last few years, both
on the hardware and software fronts, have led to quantum versions of most
common ML algorithms [30, 31, 32, 33, 34, 27], giving birth to a new field of
QML [19], with the anticipation that QML tasks may be amongst the first to
demonstrate quantum advantage on near-term quantum computers [35]. In addition
to offering new ways of studying classical data, quantum methods may also be
naturally used to study quantum data, with advantages for doing so beginning
to emerge even on the noisy hardware available today [36]. Although the
majority of the focus in searching for quantum advantage through QML has been
on the question of algorithmic speed-ups, the existence of adversarial
examples provides another possible route to advantage – enhanced adversarial
robustness. Indeed, the field of quantum adversarial machine learning (QAML)
has recently gained much attention [20, 21, 22, 23, 24, 25, 26, 27, 28]. A
typical QML framework based on a variational circuit approach is shown in
Figure 1 (c), which has been the subject of recent studies to judge quantum-
enabled robustness of ML tools. Early work [21] has suggested that QML methods
may be highly vulnerable to adversarial attacks as a result of a counter-
intuitive geometric property (the concentration of measure phenomenon (COMP)
[37]) of the Hilbert spaces they employ for classification, independent of the
precise details of the classifier. Moreover, as adversarial examples are not
sampled randomly from the input data distribution, but rather carefully
constructed, the promising recent work on generalisation bounds for QML [38,
39, 40] cannot provide guarantees of adversarial robustness. While the COMP
suggests that undefended quantum classifiers may be highly vulnerable to
attack, recent work has shown that the unique properties of quantum
information processing may, on the other hand, offer an opportunity to design
new methods of defending against adversarial attacks [22, 24], setting up a
fascinating battle between attack and defence in the field of QAML.

In this paper, we have provided a succinct review of the recent literature on
QAML, examining the progress in both offensive and defensive measures. We have
identified some of the key challenges and potential future research directions
in each of the key components of the Q(A)ML pipeline: attacks, data encoding,
network architecture, and noise mitigation.

State of the Art

Attacking Quantum Classifiers. The adversarial vulnerability of quantum
classifiers stems from a counter-intuitive property of their underlying
Hilbert spaces [21]. Specifically, these Hilbert spaces, into which the inputs
are mapped, have the property that their points strongly cluster around the
decision boundaries of the classifiers (see Figure 1(d)). This has significant
implications for adversarial robustness of the classifiers, as points which
are close to a decision boundary are precisely the points which are
susceptible to adversarial perturbation (see Figure 1(a)). Specifically, the
COMP implies that the distance from a (Haar) randomly sampled point in the
Hilbert space to the nearest adversarial example vanishes as
$\mathcal{O}\left(2^{-n_{\mathrm{qubits}}}\right)$ [21], implying a drastic
vulnerability even for relatively modest numbers of qubits. Moreover, given
$k$ independent quantum classifiers, one can find universal adversarial
examples which deceive all classifiers with only a perturbation of strength
$\mathcal{O}\left(\log(k)2^{-n_{\mathrm{qubits}}}\right)$ [41]. In practical
ML applications, however, one will not be sampling randomly from the entire
space, but rather focusing on some small subset consisting of the encoded
states of meaningful examples [21, 26, 42, 32, 43], which need not necessarily
exhibit concentration of measure. In the commonly used phase encoding scheme
$\boldsymbol{x}\mapsto\otimes_{i=1}^{n}(\cos(x_{i})\ket{0}+\sin(x_{i})\ket{1})$,
for example, the necessary perturbation strength scales only as
$\mathcal{O}\left(1/\sqrt{n_{\mathrm{qubits}}}\right)$ [26]. The therefore
considerable impact of the type of states being classified on adversarial
robustness implies both that the impact on robustness is another factor to
consider in the choice of a data encoding scheme in QML, and that thorough
empirical studies on common datasets are needed to investigate the performance
of adversarial attacks on quantum classifiers in practice.

Such an empirical study has recently been conducted by Lu et al [20], in which
attacks were carried out on a standard quantum variational classifier (QVC)
(see Figure 1(c)) using typical attacks [9, 10, 14, 44] developed in the
classical setting, and both classical (MNIST) [29] and quantum datasets [45].
Some typical adversarial examples generated by attacking a QVC trained to
classify MNIST data are shown in Figure 2(g). In each case the QVC can be
tricked into misclassifying an image that is very similar to a corresponding,
correctly classified clean image. The average accuracy achieved on their
calculated adversarial examples are shown in Figure 2(a-d), providing clear
empirical evidence of the susceptibility of quantum classifiers to adversarial
perturbations in practice - even in the relatively simple case of binary
classification on MNIST data. For more complicated data, where the features
which need to be identified in order to facilitate accurate classification are
more subtle, this susceptibility would only be expected to increase.

Figure 2: Attacking and Defending Quantum Classifiers a. The accuracy of a
binary QVC trained to distinguish between the digits 1 and 9 on adversarial
examples as a function of the number of image-modifying attack iterations (of
step size 0.1) as obtained in Ref [20]. b. The average fidelity between the
adversarial examples and their corresponding clean images, which remains high
even as the accuracy drops to zero. c,d. Similar to a,b except for a
classifier trained to distinguish between 1, 3, 7 and 9. e. The system
described by this Hamiltonian undergoes a phase transition from thermal
$(\ket{T})$ to localised $(\ket{L})$ phases at a certain critical point;
determining the phase of a given state is the classification problem
considered by Ren et al [25]. The predictions of the classifier on legitimate
and adversarial data, as determined by the sign of
$\expectationvalue{\sigma_{z}}$. 100% accuracy is obtained on the clean data,
but only 25% on the adversarial data, despite their clear visual similarities.
f. The accuracy obtained on legitimate and adversarial samples by Lu et al
[20] during adversarial training. The initial oscillations observed are a
result of the competition between the minimisation and maximisation loops of
adversarial training. After adversarial training near perfect accuracy is
obtained on the adversarial samples (cf parts a-d). g. Clean and corresponding
adversarial examples generated by attacking the QVC of Lu et al. In all cases
the clean image is correctly classified and the adversarial image incorrectly
classified, despite their clear similarities. Panels a-d are reprinted from
ref. [20], American Physical Society. Panel e is reprinted from ref. [25],
Nature publishing group. Panels f-g are reprinted from ref. [20], American
Physical Society.

Although the simulations of Ref. [20] have predicted a severe vulnerability of
quantum classifiers to adversarial attacks, the true test of their
vulnerability must be carried out on real quantum hardware, in the
accompanying presence of quantum noise and hardware constraints (the potential
benefits of quantum noise in reducing adversarial vulnerability are discussed
in the section “Adversarial Robustness Through Quantum Noise”). While the
limitations imposed by the current NISQ era of quantum hardware make an
experimental implementation of QAML a challenging task, nevertheless, and in
an important study for the field, such an experiment has been reported very
recently by Ren et al [25]. Considering both classical image data and quantum
data, they succeeded in both training high fidelity QVCs and subsequently
attacking them, producing adversarial examples which fool their classifiers
despite retaining a high degree of visual similarity to their corresponding
legitimate samples (see Figure 2(e)). This work marks an end-to-end
experimental implementation of QAML, demonstrating that the field is concerned
with real effects which can be seen already on current noisy hardware.

Defending Quantum Classifiers. The classical ML community has in recent years
seen a flurry of discoveries involving an increasingly sophisticated series of
adversarial attacks, defences, and counter-attacks [9, 14, 8, 12, 16, 46, 47,
48, 49, 50]. While many of the classical defence strategies can be expected to
automatically carry over to the quantum setting given their architecture
agnostic form, recent work [22, 23, 24] has also begun to explore the
possibility of defence mechanisms which rely purely on quantum phenomena. Due
to the observed trend in the classical setting of seemingly strong defensive
strategies subsequently failing against improved methods of attack, another
important area of study is that of certifiable robustness, wherein guarantees
of the non-existence of adversarial examples within a certain distance of
clean samples are derived [51, 52, 53, 54, 55, 56, 57, 58, 22, 24]. We now
briefly discuss three of the key defensive techniques and guarantees of
adversarial robustness which have been introduced in the QAML literature,
covering both strategies which are direct applications of classical
techniques, and strategies which harness non-classical aspects of quantum
computing.

  1. 1.

Adversarial Robustness through Quantum Noise. Quantum noise is generally
regarded as a liability which poses major challenges for current quantum
devices to tackle real-world applications. However, random noise plays a
natural role in adversarial attack mitigation: the intentional injection of a
small amount of randomness into the classification process can help to thwart
adversarial attacks by “drowning out” any potential adversarial perturbation.
This idea has been successfully implemented in the classical setting [52],
including a guarantee of certifiable robustness. The pursuit of similar
results in the quantum case has already begun, with promising results reported
[22, 24]. Moreover, the inherently random nature of the output of a quantum
circuit presents an opportunity for seeking robustness bounds even in the
noiseless case, unlike classically where noise must be explicitly introduced.

Figure 3: Quantum Adversarial Machine Learning Framework. A generic framework
for the implementation of quantum adversarial machine learning. For each
building block in the framework, we identify key areas of challenges and
opportunities.

On the quantum front, Ref. [22] has demonstrated that depolarisation noise in
a quantum circuit can induce quantum differential privacy [59], a natural
generalisation of the concept of differential privacy from classical computer
science [60, 51]. Differential privacy is a property of randomised algorithms
which are “not too sensitive” to small changes in their inputs, which is
desirable behaviour in the pursuit of adversarial robustness. In the case of
Ref. [22], the presence of the noise quantifiably limits the possible
influence of adversarial perturbations, but the usefulness of the classifier
is preserved due to its inherent robustness to depolarisation noise [22]. From
the insensitivity of algorithms with differential privacy to small changes in
their inputs, they then show [22] that the quantum classifier possesses a
guarantee of adversarial robustness.

  2. 2.

Certifiable Robustness of Quantum Classifiers. A major step towards the
understanding of the certifiable robustness of quantum classifiers in the face
of adversarial perturbations has recently been made by Weber et al [24], who
have drawn a connection between provable robustness and quantum hypothesis
testing (QHT) [61, 62]. QHT is concerned with the problem of distinguishing
between two quantum states as reliably as possible, an important task in
quantum information theory. Intuitively, the result is based on the idea that
if two states cannot be reliably distinguished even by an optimal measurement,
then neither can they be distinguished by a given quantum classifier. If one
of such a pair of states is an adversarially perturbed version of the other,
then, the classifier will nonetheless assign them the same label, limited as
it is in its ability to even tell them apart, let alone classify them
differently. This is exactly the behaviour we seek when attempting to obtain
adversarially robust classifiers. Relying as it does on the fundamental
inability of any protocol to flawlessly distinguish between two non-orthogonal
quantum states, a property of quantum mechanics which is absent classically,
this approach constitutes another example of dealing with adversarial
perturbations in a way which is unique to quantum machine learning. Moreover,
the bound that they derive is provably optimal in the important case of binary
classification, and whenever the classifier’s top choice is selected with
probability greater than one half [24].

  3. 3.

Adversarial Training. One of the central defensive techniques in classical ML
is that of adversarial training, wherein adversarial examples are generated at
training time, and included in the training set [9, 13, 14, 63]. While such a
procedure cannot yield rigorous robustness guarantees, adversarial training is
nonetheless considered a standard benchmark technique by the classical ML
community due to its strong results in practice [13, 63]. Early results [20,
25] have also shown promising results for the use of adversarial training as a
method for generating robustness for quantum classifiers. In Ref [20], for
example, Lu et al undertake adversarial training of their MNIST quantum
classifier (see Figure 2(f)), achieving high accuracy on both the legitimate
and adversarial test samples. This is in sharp contrast to the situation of
vanilla training, where adversarial attacks had a devastating effect on the
accuracy of their classifier (see Figure 2(a-d)). Despite these encouragingly
successful early applications of adversarial training in the quantum setting,
an important caveat is that the attacks trialled at test time were generated
using the same method as the attacks on the training data; comparably high
performance when the attacks at test time are of a different nature is not
guaranteed [63, 64]. Nonetheless, the further investigation of adversarial
training constitutes an important and interesting future research direction
within QAML.

Challenges and Opportunities

Figure 3 shows a generic framework for the implementation of QAML, which
consists of six building blocks. Apart from the Data and Measurement units,
the other four building blocks (Attack, Encoding, Architecture, Noise) of the
QAML framework require substantial future research and development en-route to
practicality of QAML. In this section, we discuss critical areas of
development in each block, highlight some of the major open questions and
propose future research directions.

Note that the development in the areas of QAML and QML is closely related,
therefore some of the challenges and opportunities are shared among the two
fields – for example, efficient data encoding and overcoming hardware noise is
crucial for both. Conversely, QAML and QML target distinct goals – QML
requires high learning accuracies, whereas QAML primarily focuses on
robustness against attacks – and therefore there are many features which are
unique for QAML. For example, generation and evaluation of attacks is only
relevant for QAML. Likewise, hardware noise may help in certain circumstances
for QAML, but it is typical detrimental for QML applications. Finally, an
architecture which may offer optimal robustness against adversarial attacks
may not offer optimal performance for QML tasks.

ATTACK. A surprising feature of adversarial examples in the classical setting
is that of transferability [4, 9], i.e., adversarial examples constructed by
attacking a specific network (a white-box attack) tend to act as adversarial
examples for other, completely independent networks. Transferability underlies
the vulnerability of ML classifiers in practice; even unfamiliar networks to
which an adversary does not have direct access are susceptible as the
adversary may create their own ML network, attack it, and then transfer the
generated examples to the target.

It has been conjectured [17] that this behaviour is a result of different
networks independently discovering the same set of highly informative, but
non-robust, features in the dataset; by targeting these features an
adversarial example may then fool multiple classifiers. The complicated nature
of these non-robust features leads to adversarial perturbations which are
themselves highly complex, often appearing to contain no meaningful semantic
information. Alternately, more meaningful perturbations may be obtained by
attacking networks which have been forced to identify more robust features of
the data, for example by undergoing adversarial training [65]. The structure
of the adversarial perturbations generated by quantum attacks, on the other
hand, is not yet well-understood and it is an interesting open question if
they will naturally resemble those generated by attacking robust or non-robust
classical networks. A recent theoretcial study, for the first time, made a
surprising revelation that the adversarial perturbations generated by quantum
attacks exhibit notable structure, targetting robust features [28], akin to
what would be in the case of explicit adversarial training in a classical
setting. This allowed QAML networks to generate very strong attacks which were
able to fool powerful classical networks, demonstrating a high level of
quantum to classical transferability. Further work is needed to fully
understand the origin of such behavior in QAML architectures.

Figure 4: Fault-tolerant Implementation. a. A conceptual illustration of the
implementation of quantum machine learning networks on error-protected logical
qubits. The surface code illustration is adapted from Reference [71]. b,c.
Learning accuracies of quantum variational machine learning networks for two
datasets: MNIST and FMNIST. The quantum networks consists of 50, 100, and 200
layers (labelled as QVC50, QVC100, and QVC200), with each layer made up of
single qubit rotation gates (trainable) and controlled-Z gates. d. A plot of
the number of physical qubits required to implement ten error protected
logical qubits as a function of surface code distances (d). The horizontal
dashed lines indicate number of physical qubits in IBM Quantum devices
anticipated in 2025 and beyond 2026 based on the IBM Quantum roadmap. e. A
plot of number of fault-tolerant quantum gates (circuit depth) as a function
of the qubit physical error rates for various surface code distances. The
shaded region indicates the number of quantum gates required for QVC200
implementation including surface code overheads (magic state distillation and
synthesis). The dashed vertical lines indicate the approximate physical error
rates for the fault-tolerant QVC200 implementation.

The targeting of specific features of the data by adversarial attacks also
opens up a potential new source of benefit for QML: due to the potential for
QML models to learn features which are classically inaccessible [66],
adversarial examples generated by attacking a classical model may struggle to
fool a quantum model. This result may hold even if the features discovered by
the quantum network do not provide any significant benefit as far as accuracy
on the clean data goes; the mere fact of them being different may confer
robustness against classically generated adversarial examples. Indeed, recent
preliminary results have shown such characteristics for QAML networks [28].
Conversely, it is also an interesting open question whether quantum
adversarial attacks would show the same transferability within quantum
frameworks or across quantum-classical boundaries. Robustness to any
adversarial examples capable of being generated by adversaries armed only with
classical computers could be a powerful advantage for early adopters of QML.

ENCODING. Data encoding is currently one of the biggest challenges towards the
practical implementation of QAML (or more generally QML) approaches [42, 67],
at least in the era of near-term quantum devices. The choice of data encoding
has a strong influence on the classes of decision boundaries the classifier is
capable of learning (and, therefore, whether it is capable of providing
quantum advantage at all). Two widely adopted approaches are amplitude and
phase encoding [42], both coming with their own advantages and overheads. For
example, while amplitude encoding benefits from the exponentially (in the
number of qubits) large Hilbert space of the quantum computer, it also
requires exponentially deep encoding quantum circuits – a serious overhead for
the implementation on near-term devices. Conversely, phase encoding, in which
data is encoded into the angles of single-qubit rotations (which therefore
requires the data to first have been mapped to between $0$ and $2\pi$), is
more efficient with respect to circuit depth, but requires a large number of
qubits, seriously limiting the ability of current quantum hardware to encode
complex datasets. It is also possible to consider an interleaved data encoding
strategy, which consists of alternating layers of data encoding and
variational gates [38, 68]. Such a strategy allows for a user-controlled
trade-off between the number of qubits and circuit depth, making it
particularly suitable for the current NISQ era, in which hardware constraints
dominate considerations of circuit architecture. Indeed, this method was
employed in the recent experimental demonstration of QAML by Ren et al [25].
It is also worth noting that the current QML literature is primarily based on
simple datasets, with new and more efficient data encoding schemes needed for
more complex datasets relevant for real-world applications. An important line
of research is to either apply classical data reduction schemes such as
filtering or convolutions [69], or using clever data compression techniques
such as reported recently via a tensor network approach [70].

Resource requirement is not the only property of the classifier that is
influenced by the data encoding strategy; the robustness of QVCs to various
sources of noise have recently been explicitly linked to the chosen strategy
of data encoding [42]. While Ref. [42] considered standard noise channels, and
adversarial perturbations are a form of worst-case noise for which comparable
analytical results may be less readily obtained, the adversarial robustness of
a classifier will nonetheless depend on the method by which the encoding is
performed. Although the current strong restrictions on the number of available
qubits has led to the use of highly efficient forms of encoding (e.g.
amplitude encoding [42]) in order to load complicated data into simulated
quantum classifiers [20], as the number of experimentally available qubits
continues to grow the choice of encoding will open up to include more
alternatives and become an important component of any considerations of
adversarial robustness. Certain forms of encoding, for example, may map any
possible input into a well studied subset of the full Hilbert space with more
desirable adversarial robustness properties [26] than generic amplitude
encoding, which can prepare any state.

ARCHITECTURE. At the heart of the standard approach to QML is an optimisable
variational circuit sandwiched between a data encoding circuit and a set of
measurements to determine the prediction of the classifier (see Figure 1(c)).
A QVC consists of a repeated pattern of a number of parametrized single-qubit
gates followed by two qubit entangling gates. The parameters of the single
qubit gates are classically optimised to learn input data features,
conceptually similar to the adjustment of neuron weights in classical neural
networks. Despite the early successes of QVCs for simple datasets such as
MNIST, there are already challenges which have started to dampen their ability
to train on more complex inputs. For example, the existence of barren plateaus
[72] in the training loss landscape poses a serious impediment to the training
of large QVCs. Although it is unclear precisely what form the large-scale
quantum classifiers of the future will take, it is already becoming apparent
that future QML frameworks will need to employ sophisticated architectures if
they are to handle more complex datasets.

Beyond QVCs, the near future may see a rise in hybrid quantum-classical
models, including for example models where data is passed through a number of
quantum filters before being passed into a standard classical neural network
or convolutional neural network [69]. While such models may have been
introduced as a temporary framework within which to seek to utilise the
currently limited quantum resources before the eventual introduction of large,
fully quantum models, their long-term implications for adversarial robustness
form an interesting line of inquiry. It may be possible, for example, for them
to inherit robustness guarantees similar to those obtained for quantum
networks [22, 24], while also benefiting from the powerful classification
capabilities of modern neural networks. Furthermore, the extent to which
adversarial attacks directed at a classical neural network transfer to a
quantum-classical hybrid model remains an important open question. A further
interesting direction concerns the interplay of adversarial machine learning
with generative adversarial networks (GANs). First introduced by Goodfellow et
al [73], GANs have found natural applications in adversarial machine learning,
in both attack [74, 75] and defence [76, 77]. On the offensive side, a GAN may
be used to generate adversarial perturbations, and on the defensive side,
given a potentially adversarial example, the GAN may be asked to generate an
input which closely resembles it (but, hopefully, missing any adversarial
perturbations). Quantum generalisations of GANs (qGANs) have recently been
introduced and discussed in several contexts [78, 79].

NOISE. The experimental implementation of QAML faces a crucial challenge
arising from the limitations of current quantum hardware, where both limited
numbers of qubits and high levels of noise remain serious open problems.
Although proof of concept experimental demonstrations of QML have already been
reported [35, 31, 36] on current quantum hardware (including a first
demonstration of QAML [25]), the sophisticated QML and QAML applications of
the future will require error mitigation and correction [80]. It is
anticipated that for some contrived problems, quantum error mitigation may
allow QAML to offer useful results in the NISQ era, however ultimately, the
route to practicality of QAML approaches may go through the development of
fault-tolerant quantum computers so as to accurately execute deep quantum
circuits. Fault-tolerance requires that the errors induced by noise in the
quantum computer be reduced beneath a certain threshold value, following which
they can be systematically suppressed to arbitrarily low levels by the use of
large numbers of physical qubits to encode each required logical qubit. A
simplified conceptual diagram illustrating a fault-tolerant implementation of
QAML over logical qubits is shown in Figure 4 (a) which employs a surface code
scheme to protect noisy qubits against errors. Surface codes are one of the
most promising algorithms for the implementation of fault-tolerant quantum
operations [82], with very recent results indicating that quantum hardware is
now approaching the capability to execute small-scale implementations of
surface codes [83].

The estimation of exact requirements (qubit numbers, error rates, etc.) for a
fault-tolerant implementation of a QAML framework is beyond the scope of this
paper, however, we provide a qualitative estimate for the surface code based
QAML implementation and testing which would be a first step towards
practicality of QAML approaches. For this purpose, we refer to the IBM Quantum
hardware road-map [84], which indicates that in 2025 quantum devices with
$\geq$4000 qubits are anticipated, with qubit numbers increasing above 104
beyond 2026. Similar road-maps have been announced by other major quantum
hardware developers [85, 86]. To estimate QAML resources, we implemented
(within a noiseless simulation environment) optimised 10-qubit QVCs with
varying circuit depths (QVC50, QVC100, and QVC200 with 50, 100 and 200
variational layers respectively) trained on the MNIST and FMNIST datasets,
with the achieved test accuracies plotted in Figure 4 (b) and (c) [28]. These
10-qubit QML networks are quite deep, with for example QVC200 utilising about
104 quantum gates in total. For a fault-tolerant implementation of QVC200, we
would require 10 logical qubits. Figure 4 (d) plots the number of physical
qubits required per 10 logical qubits as a function of surface code distance
[82], indicating that distance 20 and 30 surface codes might be possible to
test on IBM Quantum devices in 2025 and 2026+, respectively, provided that the
error rates are below the surface code threshold of about 0.5%. Next, we
estimate the number of quantum gates that can be fault-tolerantly implemented
as a function of the physical error rate for various surface code distances,
which to a first order approximation scales as
$n_{G}\sim(p/p_{\mathrm{th}})^{-d/2}$, where $n_{G}$ is the number of fault
tolerant gates which can be performed, $p$ the physical error rate,
$p_{\mathrm{th}}$ the threshold and $d$ the distance [82]. The results are
plotted in Figure 4 (e). These plots show that even with an overheard of
$10^{2}\times$ – $10^{3}\times$ (required for synthesis and distillation of
arbitrary rotation single qubit gates and two-qubit entangling gates [87,
88]), a surface code implementation of QVC200 of distance 20 (on IBM Quantum
2025 devices) might be possible if the error rates are around 0.15%, rising to
0.25% and distance 30 with 104 physical qubits. It is noted that these
resource requirements are only qualitative and can be further optimised by
more depth efficient variational circuits or by resource optimisation of
surface code based fault-tolerant quantum gate implementations [89]. On the
other hand, we also acknowledge that the above mentioned estimates based on 10
logical qubits are for simple image datasets only (MNIST and FMNIST), whereas
complex datasets might require higher number of logical qubits or deeper
quantum circuits. In summary, the continued advancements in quantum hardware
have brought the implementation of QML on standard benchmark datasets to
within the near-term grasp of physical devices [25], where their adversarial
vulnerabilities will be able to be tested beyond a simulated environment.
Beyond that, it can be anticipated that by the end of this decade,
increasingly sophisticated experiments will be performed with advanced error
correction and mitigation capabilities, expanding the range of QML and QAML to
applications of practical interest.

Conclusions

Quantum machine learning is generally anticipated to be one of the more widely
employed use cases for quantum computers in the current NISQ period. As
indicated by recently announced various quantum hardware roadmaps,
increasingly capable quantum devices (larger qubit numbers and lower error
rates) are expected to be deployed in the next few years, which should allow
rigorous benchmarking of quantum machine learning models, likely leading to
their applications for a variety of classification and feature detection
problems of practical interest. Beyond that, the successful development of
large-scale fault tolerant quantum computers may one day lead to quantum
machine learning systems being entrusted with sensitive tasks which must be
carried out with extremely high reliability. As such, and given both the
existence of adversarial examples which can fool highly sophisticated
classical neural networks and the early evidence of similar examples in the
quantum setting, understanding the potential vulnerabilities of quantum
classifiers, and how they compare to those of their classical counterparts, is
a pressing matter which deserves further research. In this survey paper we
have described the new and rapidly growing field of quantum adversarial
machine learning, summarising the key achievements to date and outlining some
of the main challenges that yet remain. The importance of this area is clear;
if quantum machine learning is to become the revolutionary and widely applied
technology it is hoped it will, then QAML must inevitably be fully understood.
We anticipate that the detailed review of the field of QAML presented in our
work will serve as a timely guidance for future research, and help to design
robust ML tools by leveraging the unique properties of quantum computing.

Acknowledgements: We acknowledge useful discussions with Spiro Gicev and Gary
Mooney. MTW acknowledges the support of the Australian Government Research
Training Program Scholarship. SME is in part supported by Australian Research
Council (ARC) Discovery Early Career Researcher Award (DECRA) DE220100680. The
authors acknowledge the support from Australian Army Research through Quantum
Technology Challenge (QTC22). The computational resources were provided by the
National Computing Infrastructure (NCI) and Pawsey Supercomputing Center
through National Computational Merit Allocation Scheme (NCMAS).

Author contributions: M.U. conceived and supervised the project. MTW and MU
wrote the manuscript, with input from all authors.

Competing financial interests: The authors declare no competing financial or
non-financial interests.

## References

  * [1]
  * [2] LeCun, Y., Bengio, Y. & Hinton, G.  Deep Learning.  _Nature_ 521, 436–444 (2015).
  * [3] Biggio, B., Corona, I., Maiorca, D., Nelson, B., Srndic, N., Laskov, P., Giacinto, G. & Roli, F.  Evasion attacks against machine learning at test time.  In _Joint European Conference on Machine Learning and Knowledge Discovery in Databases_ , 387–402 (Springer, 2013).
  * [4] Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R.  Intriguing properties of neural networks.  _arXiv preprint arXiv:1312.6199_ (2013).
  * [5] Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. & Tygar, J. D.  Adversarial machine learning.  In _Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence_ , AISec ’11, 43–58 (Association for Computing Machinery, New York, NY, USA, 2011).
  * [6] Kurakin, A., Goodfellow, I. & Bengio, S.  Adversarial machine learning at scale.  _arXiv preprint arXiv:1611.01236_ (2016).
  * [7] Su, J., Vargas, D. V. & Sakurai, K.  One pixel attack for fooling deep neural networks.  _IEEE Transactions on Evolutionary Computation_ 23, 828–841 (2019).
  * [8] Athalye, A., Carlini, N. & Wagner, D.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples.  In _International Conference on Machine Learning_ , 274–283 (PMLR, 2018).
  * [9] Goodfellow, I. J., Shlens, J. & Szegedy, C.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ (2014).
  * [10] Kurakin, A., Goodfellow, I. J. & Bengio, S.  Adversarial examples in the physical world.  In _Artificial Intelligence Safety and Security_ , 99–112 (Chapman and Hall/CRC, 2018).
  * [11] Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., & Song, D.  Robust physical-world attacks on deep learning visual classification.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 1625–1634 (2018).
  * [12] Carlini, N. & Wagner, D.  Adversarial examples are not easily detected: Bypassing ten detection methods.  In _Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security_ , 3–14 (2017).
  * [13] Wong, E., Rice, L. & Kolter, J. Z.  Fast is better than free: Revisiting adversarial training.  _CoRR_ abs/2001.03994 (2020).  eprint 2001.03994.
  * [14] Madry, A., Makelov, A., Schmidt, L., Tsipras, D. & Vladu, A.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ (2017).
  * [15] Goodfellow, I., McDaniel, P. & Papernot, N.  Making machine learning robust against adversarial inputs.  _Commun. ACM_ 61, 56–66 (2018).
  * [16] Miller, D. J., Xiang, Z. & Kesidis, G.  Adversarial learning targeting deep neural network classification: A comprehensive review of defenses against attacks.  _Proceedings of the IEEE_ 108, 402–433 (2020).
  * [17] Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B. & Madry, A.  Adversarial examples are not bugs, they are features.  _Advances in Neural Information Processing Systems_ 32 (2019).
  * [18] Sharif, M., Bhagavatula, S., Bauer, L. & Reiter, M. K.  Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition.  In _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_ , CCS ’16, 1528–1540 (Association for Computing Machinery, New York, NY, USA, 2016).
  * [19] Biamonte, J., Wittek, P., Pancotti, N., Rebentrost, P., Wiebe, N., & Lloyd, S.  Quantum machine learning.  _Nature_ 549, 195-202 (2017).
  * [20] Lu, S., Duan, L.-M. & Deng, D.-L.  Quantum adversarial machine learning.  _Physical Review Research_ 2, 033212 (2020).
  * [21] Liu, N. & Wittek, P.  Vulnerability of quantum classification to adversarial perturbations.  _Phys. Rev. A_ 101, 062331 (2020).
  * [22] Du, Y., Hsieh, M.-H., Liu, T., Tao, D. & Liu, N.  Quantum noise protects quantum classifiers against adversaries.  _Physical Review Research_ 3, 023153 (2021).
  * [23] Guan, J., Fang, W. & Ying, M.  Robustness verification of quantum classifiers.  In _International Conference on Computer Aided Verification_ , 151–174 (Springer, 2021).
  * [24] Weber, M., Liu, N., Li, B., Zhang, C. & Zhao, Z.  Optimal provable robustness of quantum classification via quantum hypothesis testing.  _npj Quantum Information_ 7, 1–12 (2021).
  * [25] Ren, W. _et al._ Experimental quantum adversarial learning with programmable superconducting qubits.  _Nature Computational Science_ 2, 711 (2022).
  * [26] Liao, H., Convy, I., Huggins, W. J. & Whaley, K. B.  Robust in practice: Adversarial attacks on quantum machine learning.  _Physical Review A_ 103, 042427 (2021).
  * [27] Kehoe, A., Wittek, P., Xue, Y. & Pozas-Kerstjens, A.  Defence against adversarial attacks using classical and quantum-enhanced boltzmann machines.  _Machine Learning: Science and Technology_ 2, 045006 (2021).
  * [28] West, M., Erfani, S.M., Leckie, C., Sevior, M., Hollenberg, L.C.L., Usman, M.  Benchmarking adversarially robust quantum machine learning at scale.  _arXiv:2211.12681_ (2022).
  * [29] Lecun, Y., Bottou, L., Bengio, Y. & Haffner, P.  Gradient-based learning applied to document recognition.  _Proceedings of the IEEE_ 86, 2278–2324 (1998).
  * [30] Beer, K., Bondarenko, D., Farrelly, T., Osborne, T.J., Salzmann, R., Scheiermann, D., & Wolf, R.  Training deep quantum neural networks.  _Nature Communications_ 11, 1–6 (2020).
  * [31] Havlíček, V., Córcoles, A.D., Temme, K., Harrow, A.W., Kandala, A., Chow, J.M. & Gambetta, J.M.  Supervised learning with quantum-enhanced feature spaces.  _Nature_ 567, 209–212 (2019).
  * [32] Dallaire-Demers, P.-L. & Killoran, N.  Quantum generative adversarial networks.  _Physical Review A_ 98, 012324 (2018).
  * [33] Lu, S. & Braunstein, S. L.  Quantum decision tree classifier.  _Quantum Information Processing_ 13, 757–770 (2014).
  * [34] Romero, J., Olson, J. P. & Aspuru-Guzik, A.  Quantum autoencoders for efficient compression of quantum data.  _Quantum Science and Technology_ 2, 045001 (2017).
  * [35] Ristè, D., da Silva, M.P., Ryan, C.A., Cross, A.W., Córcoles, A.D., Smolin, J.A. Gambetta, J.M., Chow, J.M. & Johnson, B.R.  Demonstration of quantum advantage in machine learning.  _npj Quantum Information_ 3, 1–5 (2017).
  * [36] Huang, H.-Y., Broughton, M., Cotler, J., Chen, S., Li, J., Mohseni, M., Neven, H., Babbush, R., Kueng, R., Preskill, J., McClean, J.R.  Quantum advantage in learning from experiments.  _Science_ , 376, 1182–1186 (2022).
  * [37] Ledoux, M.  The concentration of measure phenomenon,  _American Mathematical Soc._ , 89, (2001).
  * [38] Caro, M.C., Gil-Fuster, E., Meyer, J.J., Eisert, J., & Sweke, R.,  Encoding-dependent generalization bounds for parametrized quantum circuits,  _Quantum_ , 5, 582, (2021).
  * [39] Caro, M.C., Huang, H., Cerezo, M., Sharma, K., Sornborger, A., Cincio L., & Coles, P.J. ,  Generalization in quantum machine learning from few training data,  _Nat. Comm._ , 13, (2022).
  * [40] Banchi, L., Pereira, J., & Pirandola, S.  Generalization in Quantum Machine Learning: A Quantum Information Standpoint.  _PRX Quantum_ 2, 040321 (2021).
  * [41] Gong, W. & Deng, D.  Universal adversarial examples and perturbations for quantum classifiers.  _National Science Review 9_, 6 (2022)
  * [42] LaRose, R. & Coyle, B.  Robust data encodings for quantum classifiers.  _Physical Review A_ 102, 032420 (2020).
  * [43] Creswell, A., White, T., Dumoulin, V., Arulkumaran, K., Sengupta, B., & Bharath, A. A.  Generative adversarial networks: An overview.  _IEEE Signal Processing Magazine_ 35, 53–65 (2018).
  * [44] Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J. & Hsieh, C.-J.  Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models.  In _Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security_ , 15–26 (2017).
  * [45] Jiang, S., Lu, S. & Deng, D.-L.  Adversarial machine learning phases of matter.  _arXiv preprint arXiv:1910.13453_ (2019).
  * [46] Guo, C., Rana, M., Cisse, M. & Van Der Maaten, L.  Countering adversarial images using input transformations.  _arXiv preprint arXiv:1711.00117_ (2017).
  * [47] Buckman, J., Roy, A., Raffel, C. & Goodfellow, I.  Thermometer encoding: One hot way to resist adversarial examples. In _International Conference on Learning Representations_ (2018).
  * [48] Feinman, R., Curtin, R. R., Shintre, S. & Gardner, A. B.  Detecting adversarial samples from artifacts.  _arXiv preprint arXiv:1703.00410_ (2017).
  * [49] Salman, H., Li, J., Razenshteyn, I., Zhang, P., Zhang, H., Bubeck, S., & Yang, G.  Provably robust deep learning via adversarially trained smoothed classifiers.  _Advances in Neural Information Processing Systems_ 32 (2019).
  * [50] Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., & Jordan, M.  Theoretically principled trade-off between robustness and accuracy.  In _International Conference on Machine Learning_ , 7472–7482 (PMLR, 2019).
  * [51] Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D. & Jana, S.  Certified robustness to adversarial examples with differential privacy.  In _2019 IEEE Symposium on Security and Privacy (SP)_ , 656–672 (IEEE, 2019).
  * [52] Cohen, J., Rosenfeld, E. & Kolter, Z.  Certified adversarial robustness via randomized smoothing.  In _International Conference on Machine Learning_ , 1310–1320 (PMLR, 2019).
  * [53] Wong, E., Schmidt, F., Metzen, J. H. & Kolter, J. Z.  Scaling provable adversarial defenses.  _Advances in Neural Information Processing Systems_ 31 (2018).
  * [54] Raghunathan, A., Steinhardt, J. & Liang, P.  Certified defenses against adversarial examples.  _arXiv preprint arXiv:1801.09344_ (2018).
  * [55] Tran, H.-D., Bak, S., Xiang, W. & Johnson, T. T.  Verification of deep convolutional neural networks using imagestars.  In Lahiri, S. K. & Wang, C. (eds.) _Computer Aided Verification_ , 18–42 (Springer International Publishing, Cham, 2020).
  * [56] Elboher, Y. Y., Gottschlich, J. & Katz, G.  An abstraction-based framework for neural network verification.  In _International Conference on Computer Aided Verification_ , 43–65 (Springer, 2020).
  * [57] Fremont, D. J., Chiu, J., Margineantu, D. D., Osipychev, D. & Seshia, S. A.  Formal analysis and redesign of a neural network-based aircraft taxiing system with verifai.  _CoRR_ abs/2005.07173 (2020).  eprint 2005.07173.
  * [58] Kwiatkowska, M. Z.  Safety verification for deep neural networks with provable guarantees  _Leibniz International Proceedings in Informatics_ (2019).
  * [59] Zhou, L. & Ying, M.  Differential privacy in quantum computation.  In _2017 IEEE 30th Computer Security Foundations Symposium (CSF)_ , 249–262 (IEEE, 2017).
  * [60] Dwork, C.  Differential privacy: A survey of results.  In _International Conference on Theory and Applications of Models of Computation_ , 1–19 (Springer, 2008).
  * [61] Helstrom, C. W.  Detection theory and quantum mechanics.  _Information and Control_ 10, 254–291 (1967).
  * [62] Holevo, A. S.  Statistical decision theory for quantum systems.  _Journal of Multivariate Analysis_ 3, 337–394 (1973).
  * [63] Bai, T., Luo, J., Zhao, J., Wen, B. & Wang, Q.  Recent advances in adversarial training for adversarial robustness.  _arXiv preprint arXiv:2102.01356_ (2021).
  * [64] Kang, D., Sun, Y., Brown, T., Hendrycks, D. & Steinhardt, J.  Transfer of adversarial robustness between perturbation types.  _arXiv preprint arXiv:1905.01034_ (2019).
  * [65] Tsipras, D., Santurkar, S., Engstrom, L., Turner, A. & Madry, A.  Robustness may be at odds with accuracy.  _arXiv preprint arXiv:1805.12152_ (2018).
  * [66] Liu, Y., Arunachalam, S. & Temme, K.  A rigorous and robust quantum speed-up in supervised machine learning.  _Nature Physics_ 17, 1013–1017 (2021).
  * [67] Schuld, M.  Supervised quantum machine learning models are kernel methods.  _arXiv preprint arXiv:2101.11020_ (2021).
  * [68] Quantum Neural Network Classifiers: A Tutorial  Li, W., Lu, Z., & Deng, D..  _SciPost Phys. Lect. Notes_ , 61 (2022).
  * [69] Henderson, M., Shakya, S., Pradhan, S. & Cook, T.  Quanvolutional neural networks: powering image recognition with quantum circuits.  _Quantum Machine Intelligence_ 2, 1–9 (2020).
  * [70] Dilip, R., Liu, Y.-J., Smith, A. & Pollmann, F.  Data compression for quantum machine learning.  _arXiv preprint arXiv:2204.11170_ (2022).
  * [71] Gicev, S., Hollenberg, L. C. & Usman, M.  A scalable and fast artificial neural network syndrome decoder for surface codes.  _arXiv preprint arXiv:2110.05854_ (2021).
  * [72] McClean, J. R., Boixo, S., Smelyanskiy, V. N., Babbush, R. & Neven, H.  Barren plateaus in quantum neural network training landscapes.  _Nature Communications_ 9, 1–6 (2018).
  * [73] Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A. and Bengio, Y.  Generative adversarial networks.  _Advances in Neural Information Processing systems_ 27 (2014).
  * [74] Hu, W. & Tan, Y.  Generating adversarial malware examples for black-box attacks based on gan.  _arXiv preprint arXiv:1702.05983_ (2017).
  * [75] Xiao, C., Li, B., Zhu, J. Y., He, W., Liu, M., & Song, D.  Generating adversarial examples with adversarial networks.  _arXiv preprint arXiv:1801.02610_ (2018).
  * [76] Samangouei, P., Kabkab, M. & Chellappa, R.  Defense-gan: Protecting classifiers against adversarial attacks using generative models.  _arXiv preprint arXiv:1805.06605_ (2018).
  * [77] Shen, S., Jin, G., Gao, K. & Zhang, Y.  Ape-gan: Adversarial perturbation elimination with gan.  _arXiv preprint arXiv:1707.05474_ (2017).
  * [78] Lloyd, S. & Weedbrook, C.  Quantum generative adversarial learning.  _Physical review letters_ 121, 040502 (2018).
  * [79] Zoufal, C., Lucchi, A. & Woerner, S.  Quantum generative adversarial networks for learning and loading random distributions.  _npj Quantum Information_ 5, 1–9 (2019).
  * [80] Peters, E., Caldeira, J., Ho, A., Leichenauer, S., Mohseni, M., Neven, H., Spentzouris, P., Strain, D. & Perdue, G.N.  Machine learning of high dimensional data on a noisy quantum processor.  _npj Quantum Information_ 7, 1–5 (2021).
  * [81] A. L. White, G., D. Hill, C., A. Pollock, F., C. L. Hollenberg, L. & Modi, K.  Demonstration of non-markovian process characterisation and control on a quantum processor.  _Nat. Commun._ 11 (2020).
  * [82] Fowler, A. G., Mariantoni, M., Martinis, J. M. & Cleland, A. N.  Surface codes: Towards practical large-scale quantum computation.  _Physical Review A_ 86, 032324 (2012).
  * [83] Acharya, R.  Suppressing quantum errors by scaling a surface code logical qubit.  _arXiv preprint arXiv:2207.06431_ (2022).
  * [84] URL https://research.ibm.com/blog/ibm-quantum-roadmap-2025.
  * [85] URL https://quantumai.google/learn/map.
  * [86] URL https://ionq.com/posts/december-09-2020-scaling-quantum-computer-roadmap.
  * [87] J. Mooney, G. & D. Hill, Charles C. L. Hollenberg.  Cost-optimal single-qubit gate synthesis in the clifford hierarchy.  _Quantum_ 5 (2021).
  * [88] T. Campbell, E. & O’Gorman, J.  An efficient magic state approach to small angle rotations.  _Quantum Science and Technology_ 1 (2016).
  * [89] T. Campbell, E. & Howard, M.  A unified framework for magic state distillation and multiqubit gate-synthesis with reduced resource cost.  _arXiv:1606.01904_ (2021).