Differentiable Architecture Search for Adversarially Robust Quantum Computer Vision

TL;DR

This work tackles the fragility of quantum neural networks to adversarial perturbations and hardware noise by introducing a Differentiable Quantum Architecture Search framework augmented with a single Classical Noise Layer (CNL) applied before quantum encoding. The approach jointly optimizes circuit structure and input perturbations through gradient-based methods, using Gumbel-Softmax to explore gate choices and a combined loss $L_{total} = L_{train} + \lambda L_{robust}$ that incorporates robustness objectives. Empirical results on MNIST, Fashion-MNIST, and CIFAR show robust improvements in both clean and adversarial settings across multiple attack types (FGSM, PGD, BIM, MIM) and under realistic quantum noise, with additional validation on IBM hardware. The findings suggest that lightweight classical preprocessing, when coupled with differentiable circuit optimization, can yield robust, efficient QNN architectures suitable for near-term quantum vision tasks and scalable to more complex datasets as hardware improves.

Abstract

Current quantum neural networks suffer from extreme sensitivity to both adversarial perturbations and hardware noise, creating a significant barrier to real-world deployment. Existing robustness techniques typically sacrifice clean accuracy or require prohibitive computational resources. We propose a hybrid quantum-classical Differentiable Quantum Architecture Search (DQAS) framework that addresses these limitations by jointly optimizing circuit structure and robustness through gradient-based methods. Our approach enhances traditional DQAS with a lightweight Classical Noise Layer applied before quantum processing, enabling simultaneous optimization of gate selection and noise parameters. This design preserves the quantum circuit's integrity while introducing trainable perturbations that enhance robustness without compromising standard performance. Experimental validation on MNIST, FashionMNIST, and CIFAR datasets shows consistent improvements in both clean and adversarial accuracy compared to existing quantum architecture search methods. Under various attack scenarios, including Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Basic Iterative Method (BIM), and Momentum Iterative Method (MIM), and under realistic quantum noise conditions, our hybrid framework maintains superior performance. Testing on actual quantum hardware confirms the practical viability of discovered architectures. These results demonstrate that strategic classical preprocessing combined with differentiable quantum architecture optimization can significantly enhance quantum neural network robustness while maintaining computational efficiency.

Figures (6)

• Figure 1: Comparison of standard and robust accuracy on the MNIST dataset under an $\epsilon=0.3$ attack. The results illustrate the performance of various QNNs and a CNN in both clean conditions and under adversarial attacks (FGSM, PGD, BIM, MIM). The experiments are repeated across five trials with different settings. Our approach achieves a favorable tradeoff between accuracy and robustness for diverse architectures.
• Figure 2: Overview of the CNL-QNN framework. A lightweight Classical Noise Layer (CNL) introduces mild, trainable perturbations to the input data before quantum encoding, enhancing robustness without affecting clean accuracy. The workflow proceeds as follows: (1) input preprocessing, where classical images are resized and normalized to match qubit configuration; (2) stochastic perturbation by the CNL, defined as $x' = x + h \cdot \text{sign}(\xi)$, applied at the classical stage; (3) quantum encoding via angle encoding of normalized pixel values into $R_x$ gates; (4) differentiable architecture search using Gumbel-Softmax sampling; and (5) composite optimization through $L_{total} = L_{mse} + \gamma \cdot L_{robust}$. This figure provides a concise high-level view of how classical perturbations and quantum architecture search are jointly optimized to improve robustness without additional quantum resource costs.
• Figure 3: Accuracy comparison on a 9-qubit configuration, tested for MNIST and FashionMNIST. Models such as a QNN with an internal quantum noise layer and one using randomized encoding fell below the 90% accuracy cutoff, indicating limited clean-performance on these datasets. For CIFAR, the performance across quantum models was too close to be a useful discriminator.
• Figure 4: Performance of different quantum models under PGD attack with 4 qubits. The CNL-QNN model exhibits a slight degradation in performance as epsilon increases but maintains higher robustness compared to other QNNs. The Random QNN and CNN models show a significant drop in accuracy under higher epsilon values, indicating their susceptibility to adversarial attacks. The shading in the figure represents the standard deviation across the 5 experiments.
• Figure 5: Performance of different quantum models under PGD attack with 9 qubits. QNNs with 9 qubits generally demonstrate increased robustness compared to models with fewer qubits. The CNL-QNN model, along with other QNNs, maintains higher accuracy across varying epsilon values, highlighting the advantage of higher qubit counts in improving resistance to adversarial attacks.