Adversarially Robust Quantum Transfer Learning

TL;DR

This work tackles high-dimensional image classification in quantum machine learning under hardware constraints by proposing Quantum Transfer Learning (QTL), a hybrid framework that uses a pre-trained classical CNN (ResNet-18) for feature extraction and a quantum variational circuit for classification. It demonstrates that QTL outperforms both classical transfer learning and quantum models trained without transfer learning on Ants & Bees, CIFAR-10, and Road Sign Detection, and that adversarial training substantially enhances robustness to FGSM attacks. The study also introduces the notion of Quantum Adversarial Transfer Learning (QATL) and discusses practical implications for security-sensitive deployments, with future work aimed at real quantum processors and broader adversarial defense strategies.

Abstract

Quantum machine learning (QML) has emerged as a promising area of research for enhancing the performance of classical machine learning systems by leveraging quantum computational principles. However, practical deployment of QML remains limited due to current hardware constraints such as limited number of qubits and quantum noise. This chapter introduces a hybrid quantum-classical architecture that combines the advantages of quantum computing with transfer learning techniques to address high-resolution image classification. Specifically, we propose a Quantum Transfer Learning (QTL) model that integrates classical convolutional feature extraction with quantum variational circuits. Through extensive simulations on diverse datasets including Ants \& Bees, CIFAR-10, and Road Sign Detection, we demonstrate that QTL achieves superior classification performance compared to both conventional and quantum models trained without transfer learning. Additionally, we also investigate the model's vulnerability to adversarial attacks and demonstrate that incorporating adversarial training significantly boosts the robustness of QTL, enhancing its potential for deployment in security sensitive applications.

Figures (7)

• Figure 1: Overview of Quantum Transfer Learning (QTL). Network A is trained on a source dataset which is typically large and diverse. The purpose of training Network A is to learn general features, patterns, and representations that are applicable to the broader domain. Here, Network A will learn to recognise basic shapes, textures, and patterns commonly found in images of various animals and objects. Network B is the target model that is used for a different but related task. Instead of starting the training of Network B from scratch, the weights and parameters are initialised and learned by Network A. QTL model performs well on a smaller or completely different dataset compared to the source dataset as it learns features and representations from a source task to initialize a model for the target task. Even if the source and target domains are different, many lower-level features (edges, colors, and textures) and patterns are common to both domains. After initialization, Network B is further trained on the target dataset. During this fine-tuning process, the model adapts its representations to the specific characteristics and requirements of the target task. This fine-tuning allows the model to specialize while retaining the general knowledge from Network A. This figure is reproduced under terms of the CC-BY license. khatun2025quantum. Copyright 2024, Amena Khatun and Muhammad Usman. Advanced Quantum Technologies published by Wiley-VCH GmbH.
• Figure 2: The architecture of the proposed QTL framework. (a) illustrates the classical layers utilizing ResNet-18, which comprises 18 layers organized in residual blocks with skip connections. (b) depicts the trainable quantum components, including data encoding, a Quantum Variational Circuit (QVC), and measurement layers. The QVC integrates CNOT gates and single-qubit rotation gates $(R_X, R_Y, R_Z)$. (c) shows the complete QTL workflow, where input data passes through frozen ResNet-18 layers before reaching trainable quantum layers for final classification. (d) demonstrates the architecture of the hybrid quantum-classical model without transfer learning, where all classical and quantum layers are updated during training. The Ants and Bees dataset used is publicly available at https://www.kaggle.com/datasets/gauravduttakiit/ants-bees. This figure is reproduced under terms of the CC-BY license. khatun2025quantum. Copyright 2024, Amena Khatun and Muhammad Usman. Advanced Quantum Technologies published by Wiley-VCH GmbH.
• Figure 3: The architecture of classical transfer learning. ResNet-18 consists of 18 layers as illustrated in Figure \ref{['fig:QTL_Architecture']}(a) and pre-trained on a larger and diverse ImageNet dataset. The knowledge of the pre-trained network is transferred from source domain to the target domain. For classical TL, all the layers of ResNet-18 are frozen except the last dense layer. Only the dense layers are trainable which are fully connected layers for the final classification task. When there is no transfer learning involved, all the classical layers and dense layers are trainable. This figure is reproduced under terms of the CC-BY license. khatun2025quantum. Copyright 2024, Amena Khatun and Muhammad Usman. Advanced Quantum Technologies published by Wiley-VCH GmbH.
• Figure 4: Overview of quantum adversarial attack. If we consider the input image of a dog, the QTL model correctly classifies it as a dog when the model is not under adversarial attack. However, a carefully crafted perturbation is applied to the input image in a way that exploits the vulnerabilities of the proposed QTL model. When the perturbed images are fed to the model for prediction, the QTL model incorrectly classified the image as a deer rather than a dog. This is an indication that the QTL model is vulnerable to small changes in input data, leading to significant implications for the reliability and security of the model. The original image of dog in this figure is from the publicly available dataset, CIFAR-10 krizhevsky2009learning. This figure is reproduced under terms of the CC-BY license. khatun2025quantum. Copyright 2024, Amena Khatun and Muhammad Usman. Advanced Quantum Technologies published by Wiley-VCH GmbH.
• Figure 5: Illustration of quantum adversarial transfer learning architecture. For adversarial training, the training data now consists of both original input images and adversarial examples. As the QTL network is trained on this combined dataset, the network encounters both original and adversarial images. Thus, the network learns to resist the effects of adversarial perturbations and make accurate predictions even when presented with adversarial examples. As a result of adversarial training, the QTL network becomes more robust against adversarial attacks. When presented with a perturbed image that was crafted to deceive the network, it is now less likely to be misclassified. In the figure, where a dog image was misclassified as a deer, the adversarial training would help the network correctly classify it as a dog. The original image of dog in this figure is taken from the publicly available dataset, CIFAR-10 krizhevsky2009learning. This figure is reproduced under terms of the CC-BY license. khatun2025quantum. Copyright 2024, Amena Khatun and Muhammad Usman. Advanced Quantum Technologies published by Wiley-VCH GmbH.