Generating Universal Adversarial Perturbations for Quantum Classifiers

TL;DR

This paper introduces QuGAP, a framework for generating universal adversarial perturbations for quantum classifiers, demonstrating their existence and effectiveness through theoretical and experimental results.

Contribution

It presents the first framework for creating UAPs for quantum classifiers, including additive and unitary perturbations, with state-of-the-art attack success rates.

Findings

Quantum classifiers are vulnerable to UAPs.

The proposed methods achieve high misclassification rates.

High fidelity is maintained between original and adversarial samples.

Abstract

Quantum Machine Learning (QML) has emerged as a promising field of research, aiming to leverage the capabilities of quantum computing to enhance existing machine learning methodologies. Recent studies have revealed that, like their classical counterparts, QML models based on Parametrized Quantum Circuits (PQCs) are also vulnerable to adversarial attacks. Moreover, the existence of Universal Adversarial Perturbations (UAPs) in the quantum domain has been demonstrated theoretically in the context of quantum classifiers. In this work, we introduce QuGAP: a novel framework for generating UAPs for quantum classifiers. We conceptualize the notion of additive UAPs for PQC-based classifiers and theoretically demonstrate their existence. We then utilize generative models (QuGAP-A) to craft additive UAPs and experimentally show that quantum classifiers are susceptible to such attacks. Moreover, we formulate a new method for generating unitary UAPs (QuGAP-U) using quantum generative models and a novel loss function based on fidelity constraints. We evaluate the performance of the proposed framework and show that our method achieves state-of-the-art misclassification rates, while maintaining high fidelity between legitimate and adversarial samples.