- Physical Review Journals
All JournalsPhysics Magazine

Physical Review Research

Reuse & Permissions

It is not necessary to obtain permission to reuse this article or its components as it is available under the terms of the Creative Commons Attribution 4.0 International license. This license permits unrestricted use, distribution, and reproduction in any medium, provided attribution to the author(s) and the published article's title, journal citation, and DOI are maintained. Please note that some figures may have been included with permission from other third parties. It is your responsibility to obtain the proper permission from the rights holder directly for these figures.

Export citation

Export citation

Choose format for download:

Download Citation
  • Letter
  • Open Access

Classical autoencoder distillation of quantum adversarial manipulations

Amena Khatun1,* and Muhammad Usman1,2

  • *Contact author: amena.khatun@data61.csiro.au
PDF

Phys. Rev. Research 7, L042054 – Published 8 December, 2025

DOI: https://doi.org/10.1103/41z8-d3h9

Abstract

Quantum neural networks have been proven robust against classical adversarial attacks, but their vulnerability against quantum adversarial attacks is still a challenging problem. Here, we report a technique for the distillation of quantum-manipulated image datasets by using classical autoencoders. Our technique recovers quantum classifier accuracies when tested under standard machine learning benchmarks utilizing Modified National Institute of Standards and Technology (MNIST) and Fashion-MNIST (FMNIST) image datasets, and projected gradient descent and fast gradient sign method adversarial attack settings. Our work highlights a promising pathway to achieve fully robust quantum machine learning in both classical and quantum adversarial scenarios.

View figure in article

Physics Subject Headings (PhySH)

Article Text

Supplemental Material

References (40)

  1. M. Rana and M. Bhushan, Machine learning and deep learning approach for medical image analysis: diagnosis to detection, Multimedia Tools Appl. 82, 26731 (2023).
  2. G. Varoquaux and V. Cheplygina, Machine learning for medical imaging: Methodological failures and recommendations for the future, npj Digit. Med. 5, 48 (2022).
  3. M. Ahmed, A. N. Mahmood, and J. Hu, A survey of network anomaly detection techniques, J. Netw. Comput. Appl. 60, 19 (2016).
  4. T. Young and D. Hazarika, Soujanya Poria, and Erik Cambria, Recent trends in deep learning based natural language processing, IEEE Comput. Intell. Mag. 13, 55 (2018).
  5. H. Fujiyoshi, T. Hirakawa, and T. Yamashita, Deep learning-based image recognition for autonomous driving, IATSS Res. 43, 244 (2019).
  6. M. Reichstein, G. Camps-Valls, B. Stevens, M. Jung, J. Denzler, N. Carvalhais, and F. Prabhat, Deep learning and process understanding for data-driven earth system science, Nature (London) 566, 195 (2019).
  7. C. Szegedy, Intriguing properties of neural networks, arXiv:1312.6199.
  8. L. Huang, A. D. Joseph, B. Nelson, B. I. P. Rubinstein, and J. D. Tygar, Adversarial machine learning, in Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence (Association for Computing Machinery, New York, 2011), pp. 43–58.
  9. I. J Goodfellow, J. Shlens, and C. Szegedy, Explaining and harnessing adversarial examples, arXiv:1412.6572.
  10. A. Kurakin, I. J Goodfellow, and S. Bengio, Adversarial examples in the physical world, in Artificial Intelligence Safety and Security (Chapman and Hall/CRC, New York, 2018), pp. 99–112.
  11. A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, Black-box adversarial attacks with limited queries and information, in International Conference on Machine Learning (PMLR, Cambridge, MA, 2018), pp. 2137–2146.
  12. V. Tjeng, K. Xiao, and R. Tedrake, Evaluating robustness of neural networks with mixed integer programming, arXiv:1711.07356.
  13. A. D. M. Ibrahum, M. Hussain, and J.-E. Hong, Deep learning adversarial attacks and defenses in autonomous vehicles: A systematic literature review from a safety perspective, Artif. Intell. Rev. 58, 28, (2025).
  14. J. Lee, T. Kim, S. Bang, S. Oh, and H. Kwon, Evasion attacks on deep learning-based helicopter recognition systems, J. Sens. 2024, 11245981 (2024).
  15. Y. Chen, The risk and opportunity of adversarial example in military field, in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (IEEE, New York, 2022), pp. 100–107.
  16. S. Lu, L.-M. Duan, and D.-L. Deng, Quantum adversarial machine learning, Phys. Rev. Res. 2, 033212 (2020).
  17. W. Ren, W. Li, S. Xu, K. Wang, W. Jiang, F. Jin, X. Zhu, J. Chen, Z. Song, P. Zhang et al., Experimental quantum adversarial learning with programmable superconducting qubits, Nat. Comput. Sci. 2, 711 (2022).
  18. W. Gong and D.-L. Deng, Universal adversarial examples and perturbations for quantum classifiers, Natl. Sci. Rev. 9, nwab011 (2022).
  19. M. Wendlinger, K. Tscharke, and P. Debus, A comparative analysis of adversarial robustness for quantum and classical machine learning models, in IEEE International Conference on Quantum Computing and Engineering (QCE) (IEEE, New York, 2024), Vol. 1, pp. 1447–1457.
  20. G. Anil, V. Vinod, and A. Narayan, Generating universal adversarial perturbations for quantum classifiers, in Proceedings of the AAAI Conference on Artificial Intelligence (AAAI Press, 2024), Vol. 38, pp. 10891–10899.
  21. D. Winderl, N. Franco, and J. M. Lorenz, Quantum neural networks under depolarization noise: Exploring white-box attacks and defenses, Quantum Mach. Intell. 6, 83 (2024).
  22. J. Guan, W. Fang, and M. Ying, Robustness verification of quantum classifiers, in Proceedings of the 33rd International Conference on Computer Aided Verification, CAV 2021, Virtual Event (Springer, Berlin, Heidelberg, 2021), pp. 151–174.
  23. N. Liu and P. Wittek, Vulnerability of quantum classification to adversarial perturbations, Phys. Rev. A 101, 062331 (2020).
  24. M. T. West, S. M. Erfani, C. Leckie, M. Sevior, L. C. L. Hollenberg, and M. Usman, Benchmarking adversarially robust quantum machine learning at scale, Phys. Rev. Res. 5, 023186 (2023).
  25. K. Bajaj, D. K. Singh, and M. A. Ansari, Autoencoders based deep learner for image denoising, Procedia Comput. Sci. 171, 1535 (2020).
  26. P. Vincent, H. Larochelle, Y. Bengio, and P.-A. Manzagol, Extracting and composing robust features with denoising autoencoders, in Proceedings of the 25th International Conference on Machine Learning (Association for Computing Machinery, New York, 2008), pp. 1096–1103.
  27. A. Khatun and M. Usman, Quantum transfer learning with adversarial robustness for classification of high-resolution image datasets, Adv. Quantum Technol. 8, 2400268 (2024).
  28. G. Montalbano and L. Banchi, Quantum adversarial learning for kernel methods, Quantum Mach. Intell. 7, 15 (2025).
  29. W. Gong, D. Yuan, W. Li, and D.-L. Deng, Enhancing quantum adversarial robustness by randomized encodings, Phys. Rev. Res. 6, 023020 (2024).
  30. Y. Du, M.-H. Hsieh, T. Liu, D. Tao, and N. Liu, Quantum noise protects quantum classifiers against adversaries, Phys. Rev. Res. 3, 023153 (2021).
  31. M. T West, A. C. Nakhl, J. Heredge, and F. M. Creevey, L. C. L. Hollenberg, M. Sevior, and M. Usman, Drastic circuit depth reductions with preserved adversarial robustness by approximate encoding for quantum machine learning, Intell. Comput. 3, 0100, (2024).
  32. Y. Wu, E. Adermann, C. Thapa, S. Camtepe, H. Suzuki, and M. Usman, Radio signal classification by adversarially robust quantum machine learning, arXiv:2312.07821.
  33. N. Dowling, M. T. West, A. Southwell, A. C. Nakhl, M. Sevior, M. Usman, and K. Mxodi, Adversarial robustness guarantees for quantum classifiers, arXiv:2405.10360.
  34. See Supplemental Material at http://link.aps.org/supplemental/10.1103/41z8-d3h9 for recent relevant literature, which includes Refs. [12, 13], adversarial attack techniques [23, 24, 26, 27, 28], data encoding [29], and more simulation results.
  35. A. Madry, Towards deep learning models resistant to adversarial attacks, arXiv:1706.06083.
  36. Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner, Gradient-based learning applied to document recognition, Proc. IEEE 86, 2278 (1998).
  37. H. Xiao, K. Rasul, and R. Vollgraf, Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms, arXiv:1708.07747.
  38. G. Alain and Y. Bengio, What regularized auto-encoders learn from the data-generating distribution, J. Mach. Learn. Res. 15, 3563 (2014).
  39. I. Cong, S. Choi, and M. D Lukin, Quantum convolutional neural networks, Nat. Phys. 15, 1273 (2019).
  40. J. Heredge, M. West, L. Hollenberg, and M. Sevior, Non-unitary quantum machine learning, Phys. Rev. Appl. 23, 044046 (2025).

Outline

Information

Phys. Rev. Research 7, L042054– Published 8 December, 2025
  • Received 22 April 2025
  • Accepted 16 November 2025
Crossmark - Check for updates button
Creative Commons Logo

Published by the American Physical Society under the terms of the Creative Commons Attribution 4.0 International license. Further distribution of this work must maintain attribution to the author(s) and the published article's title, journal citation, and DOI.

Published by the American Physical Society

Sign In to Your Journals Account

Filter

Filter

Article Lookup

Enter a citation