QFAL: Quantum Federated Adversarial Learning

TL;DR

This work tackles adversarial vulnerabilities in quantum federated learning by introducing QFAL, a framework that injects local adversarial training into QFL using PGD-based perturbations on amplitude-encoded QNNs. By systematically varying the number of clients, the fraction of adversarially trained clients, and the perturbation strength on a MNIST 0-2 subset, the study reveals a consistent trade-off between clean accuracy and adversarial robustness, with partial adversarial coverage often yielding the best balance in practice. The findings show that larger federations can better balance robustness and accuracy, while full adversarial training sometimes degrades performance under stronger attacks, underscoring the need for adaptive and heterogeneous defense strategies in quantum distributed settings. The results motivate further exploration of adaptive training schedules, alternative quantum encodings, and personalized defenses to enhance robustness without sacrificing too much utility in real-world quantum federated environments.

Abstract

Quantum federated learning (QFL) merges the privacy advantages of federated systems with the computational potential of quantum neural networks (QNNs), yet its vulnerability to adversarial attacks remains poorly understood. This work pioneers the integration of adversarial training into QFL, proposing a robust framework, quantum federated adversarial learning (QFAL), where clients collaboratively defend against perturbations by combining local adversarial example generation with federated averaging (FedAvg). We systematically evaluate the interplay between three critical factors: client count (5, 10, 15), adversarial training coverage (0-100%), and adversarial attack perturbation strength (epsilon = 0.01-0.5), using the MNIST dataset. Our experimental results show that while fewer clients often yield higher clean-data accuracy, larger federations can more effectively balance accuracy and robustness when partially adversarially trained. Notably, even limited adversarial coverage (e.g., 20%-50%) can significantly improve resilience to moderate perturbations, though at the cost of reduced baseline performance. Conversely, full adversarial training (100%) may regain high clean accuracy but is vulnerable under stronger attacks. These findings underscore an inherent trade-off between robust and standard objectives, which is further complicated by quantum-specific factors. We conclude that a carefully chosen combination of client count and adversarial coverage is critical for mitigating adversarial vulnerabilities in QFL. Moreover, we highlight opportunities for future research, including adaptive adversarial training schedules, more diverse quantum encoding schemes, and personalized defense strategies to further enhance the robustness-accuracy trade-off in real-world quantum federated environments.

Figures (7)

• Figure 1: A simplified representation of an adversarial attack scenario, where the perturbations added to the image alter the classification process. A similar approach for the attack can be applied to various models, including classical ML, QML, and QFL.
• Figure 2: Overview of our proposed QFL framework for adversarially robust quantum training. Each client maintains a local QNN, trained on its unique subset of MNIST data and (optionally) augmented with adversarial examples generated via PGD. After a set number of local epochs, clients upload their updated parameters to a central server, where they are aggregated using FedAvg.
• Figure 3: QNN circuit utilizing amplitude embedding for state preparation, where classical input features are encoded into a normalized quantum state, followed by strongly entangling layers that apply trainable parametrized rotations and controlled entanglement to enhance feature representation. Measurement in the Pauli-Z basis on selected qubits provides expectation values corresponding to class predictions, enabling quantum-assisted classification.
• Figure 4: Convergence of global test loss and progression of test accuracy for 5 clients. (a) Convergence on clean data across 50 rounds, (b) Convergence with 20% adversarial-data coverage across 20 rounds, (c) Convergence with 50% adversarial-data coverage across 20 rounds, and (d) Convergence with 100% adversarial-data coverage across 20 rounds.
• Figure 5: Convergence of global test loss and progression of test accuracy for 10 clients. (a) Convergence on clean data across 50 rounds, (b) Convergence with 20% adversarial-data coverage across 20 rounds, (c) Convergence with 50% adversarial-data coverage across 20 rounds, and (d) Convergence with 100% adversarial-data coverage across 20 rounds.