Feature-level analysis and adversarial transfer in rotationally equivariant quantum machine learning

TL;DR

This paper analyzes how symmetry constraints in quantum machine learning models influence their robustness to adversarial attacks, revealing that certain symmetry-invariant features can be brittle and proposing methods to improve robustness.

Contribution

It provides a feature-level analysis of equivariant quantum models, characterizes accessible information in rotationally invariant features, and suggests suppressing brittle features to enhance adversarial robustness.

Findings

Equivariance alone does not ensure transfer robustness.

Certain symmetry-invariant features are vulnerable to classical transfer attacks.

Suppressing specific symmetry sectors improves model robustness.

Abstract

Group-equivariant quantum models are designed to exploit symmetry and can improve trainability, but it remains unclear how symmetry constraints shape their adversarial robustness. We study this question through a feature-level analysis of equivariant quantum models in a transfer-attack setting. Under equivariance with an invariant readout, predictions depend only on the group-twirled input, which identifies the symmetry-invariant information accessible to the model together with a complementary uninformative subspace. Specializing this framework to a rotationally equivariant quantum model, we derive an explicit characterization of the accessible information in terms of rotation-invariant image statistics distributed across distinct symmetry sectors. Using targeted input transformations, we determine which of these statistics are actually relied upon for classification across several datasets. We find that equivariance alone does not guarantee transfer robustness: even within the restricted invariant feature space, the model can rely on brittle statistics, particularly ring-averaged intensities in the rotationally equivariant model, that remain vulnerable to classical transfer attacks. Guided by this analysis, we show that suppressing the symmetry sector associated with the brittle feature substantially improves robustness. These results establish a systematic mechanism to exploit symmetry-dependent features for adversarial robustness in future quantum machine learning models.