When cheap gradients fail: the measurement cost of attacking quantum classifiers

The Measurement Cost of Quantum Attacks

Adversarial perturbations—small, crafted changes to inputs—are a known threat to machine learning models. While quantum machine learning (QML) models are also susceptible to these attacks, this paper demonstrates that they possess an intrinsic, physical defense mechanism: shot noise. Because quantum computers must estimate gradients through repeated circuit executions (measurements), the inherent statistical uncertainty of these measurements creates a significant resource barrier for an attacker.

The Gradient Extraction Tax

In classical machine learning, gradients are computed efficiently via automatic differentiation, which is essentially free compared to the forward pass. In contrast, quantum gradients must be reconstructed from finite measurement statistics using rules like the parameter-shift rule (PSR). The authors show that for any unbiased gradient estimator, the number of measurements required to achieve a reliable gradient grows with the input dimension $d$.

Crucially, this cost is irreducible in expressive, generically-entangling circuits. While measurement grouping can sometimes optimize quantum circuits, the authors prove that in the regime where QML provides a genuine quantum advantage (i.e., the forward map is classically hard to simulate), the attacker cannot use shortcuts to avoid this measurement bill. The cost scales at least quadratically ($d^2$) for single-step attacks and even higher ($d^{5/2}$ to $d^3$) in practice, depending on the circuit's gradient norm behavior.

This research establishes a fundamental resource asymmetry between the defender and the attacker. While a defender pays the measurement cost once during training, an attacker must pay it for every single gradient query at inference time. As the input dimension of QML models scales, the relative cost for an attacker to craft adversarial examples grows polynomially, making large-scale white-box attacks increasingly expensive and impractical. This provides a formal, physics-based foundation for the observed adversarial robustness of variational quantum classifiers.