Constructing Optimal Noise Channels for Enhanced Robustness in Quantum Machine Learning
David Winderl Nicola Franco Jeanette Miriam Lorenz






specialfooter
  
  
  [R] 
    
        This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible.
        
    















Constructing Optimal Noise Channels for Enhanced Robustness in Quantum Machine Learning
The project/research is supported by the Bavarian Ministry of Economic Affairs, Regional Development and Energy with funds from the Hightech Agenda Bayern.

    
    David Winderl2, Nicola Franco2, Jeanette Miriam Lorenz2
    2Fraunhofer Institute for Cognitive Systems IKS, Munich, Germany
    
{david.winderl, nicola.franco, jeanette.miriam.lorenz}@iks.fraunhofer.de

    
====================================================================================================================================================================================================================================================

plain
plain
specialfooter 




With the rapid advancement of Quantum Machine Learning (QML), the critical need to enhance security measures against adversarial attacks and protect QML models becomes increasingly evident. 
In this work, we outline the connection between quantum noise channels and differential privacy (DP), by constructing a family of noise channels which are inherently ϵ-DP: (α, γ)-channels. 
Through this approach, we successfully replicate the ϵ-DP bounds observed for depolarizing and random rotation channels, thereby affirming the broad generality of our framework. 
Additionally, we use a semi-definite program to construct an optimally robust channel. In a small-scale experimental evaluation, we demonstrate the benefits of using our optimal noise channel over depolarizing noise, particularly in enhancing adversarial accuracy. Moreover, we assess how the variables α and γ affect the certifiable robustness and investigate how different encoding methods impact the classifier’s robustness.



    Differential Privacy, Quantum Machine Learning,  Adversarial Robustness, Quantum Computing.




§ INTRODUCTION & RELATED WORK

Quantum Machine Learning (QML) emerges as a prominent example of the potential applications for Noisy Intermediate-Scale Quantum (NISQ) devices <cit.>.
Research into QML is motivated by the anticipation that it could significantly improve certain computational tasks, surpassing the performance of conventional algorithms <cit.>.
Despite these potential benefits, QML faces its own set of challenges, especially concerning susceptibility to adversarial attacks <cit.>.
Within classical machine learning, Differential Privacy (DP) has played a crucial role in striking a balance between data utility and the need for privacy protection <cit.>. 
Specifically, DP has been utilized to enhance the reliability of model predictions for specific inputs <cit.>. 
This principle extends naturally into Quantum Computing (QC) and introduces a novel approach to safeguard the integrity and privacy of data processed by QML models <cit.>. 


Quantum noise channels, such as depolarizing and phase damping noise in NISQ devices, are used as sources of stochastic noise. 
This noise helps achieve DP by exploiting the natural error processes of these devices <cit.>.
With this argumentation, <cit.> have provided a relationship among quantum hypothesis testing and adversarial robustness.
In addition, <cit.> has provided a relationship between quantum DP and the quantum hockestick divergence. 
<cit.> is possibly one of the most noteworthy recent publications; they have provided a more general framework for the robustness upper bound of quantum noise channels by defining the neighbourhood concept in terms of the Schatten-norm and providing a more general upper bound for noise channels in terms of a depolarizing channel as well as a single qubit Pauli channel. 
This broader framework was not included in our work as we initially focused on defining such a family of noise channels.
The linear nature of quantum channels and their relationship to semi-definite programming has been already considered, e.g. <cit.>, to attempt to construct an optimal noise channel that achieves epsilon-DP using semi-definite programming.
Nonetheless, the extent to which these techniques can defend classifiers against practical adversarial input manipulations remains uncertain.

As indicated in our earlier work <cit.>, the effectiveness of these approaches in providing robustness varies with the factor of depolarization noise. 
This raises the question which noise channel is the most suitable for a given classification problem.
On a pathway to answer this question, we develop a family of noise channels, so called (α, γ)-channels, which describe noise channels naturally facilitating DP. In addition, we offer theoretical derivations for the bounds of depolarizing noise <cit.> and random rotations <cit.> from our general framework of (α, γ)-channels. This indicates that a broader set of channels can be described in our framework. Next, we add a construction of an optimal quantum channel as a positive semi-definite constrained optimization problem.
This construction allows the experimental evaluation of a depolarizing channel against its optimally constructed counterpart, providing a more definite statement about the possible utility of quantum noise channels for DP and adversarial robustness against evasion attacks.


In summary, the contributions of our work are: 

    
  * The introduction of (α, γ)-channels as a family of noise channels which suffice ϵ-DP, along with formal bound derivations for depolarizing noise and random rotations.
    
  * Construction of an optimal (α, γ)-channel trough a semi definite program.
    The maximum robustness ratio is obtained for a quantum classifier and a given sample.
    
  * Experimental evaluation of depolarizing noise channels compared to optimal noise channels and evaluation between amplitude and angle encoding on three datasets.




§ PRELIMINARIES




 §.§ Quantum Adversarial Robustness

Quantum adversarial robustness examines how specially crafted attacks can weaken a quantum-based machine learning model, just as traditional neural networks can be fooled by adversarial inputs <cit.>. 
While there are other means of attacking a machine learning based system, we focus on evasion attacks on the QML model.
In the context of classical machine learning, adversarial robustness refers to the ability of a machine learning to maintain a stable prediction when confronted with adversarial examples. 
Formally, let 𝒴 denote the set of classes and · denote the euclidean norm on ℝ^n. Let f:ℝ^n→ [0,1]^|𝒴| be a classifier, x∈ℝ^n and ϵ>0.


    Consider a classifier f that maps an input x to an output y. The adversarial robustness at input x can be defined as the smallest amount of perturbation δ needed to change the model's prediction:
    
    argmax_c∈𝒴 f_c(x+δ) ≠argmax_c∈𝒴 f_c(x),

    where δ≤ϵ is bounded by a maximum ϵ budget and x_adv=x+δ denotes an adversarial example.


In the context of QC, a study by <cit.> found that Quantum Neural Networks (QNN) can fall prey to these targeted perturbations. 
As part of their work, the quantum version of the Fast Gradient Sign Method (FGSM) <cit.> was introduced.
Thus, let us denote x ∈ℝ^n as (classical) features, ℒ as loss function incorporating the QNN weights and ∇_x as gradient.
In the context of FGSM a adversarial budget of ϵ is assumed, which then allows to obtain an adversarial example as follows:

    x_adv = Π_x + 𝒮 (x + ϵ·sign(∇_x ℒ)),

where Π_x + 𝒮(·) clips the value towards the space 𝒮 of adversarial perturbations around x. 
Typically, the space of adversarial perturbations is defined by a norm around the input x. 
The fact that QNNs are vulnerable to adversarial perturbations motivates the discussion about specific measures to counteract adversarial examples. 
In this work, we consider robustness accuracy as the network's ability to main stable predictions against adversarial attacks.



   Let 𝒟={x_i,y_i}_i=1,…,N be a dataset and a(·,f,ϵ):ℝ^n→ℝ^n be an adversarial model that tries to find an adversary within the perturbation budget ϵ. Then, the robustness accuracy of the classifier f on 𝒟 under attack a(·,f,ϵ) is defined as:
    
    1/N∑_i=1^N 1(y_i = f(a(x_i,f,ϵ)))




Where 1 denotes the indicator function which corresponds to 1 if the argument is true, else is returning 0.



 §.§ Quantum DP

DP, with parameters (ϵ, δ), enhances data analysis and machine learning protection against adversaries. Lower ϵ values increase privacy by limiting what an algorithm reveals about individual data points, while δ represents the small chance that this privacy might fail. Together, (ϵ, δ)-DP makes it hard for adversaries to exploit data, safeguarding data integrity and privacy against sophisticated attacks. 
In the following, we focus entirely on ϵ-DP, which implies that δ = 0 throughout this work. [This is justified, since typically ϵ-DP is used for classification problems. Nevertheless as pointed out by <cit.> ϵ-DP cannot describe depolarizing noise entirely.]

Formally for QC, two neighbouring Hilbert states ρ and σ are assumed, which are bound by a distance measure. Typically, the trace distance:


    τ(σ, ρ) = 1/2Tr| σ - ρ|  = 1/2Tr[ √((σ - ρ)^† (σ - ρ))]



A quantum algorithm A (for instance, a classifier) is assumed to be ϵ-DP if, for a given set of outcomes S of A(x), the following equation holds:

    Pr(A(ρ) ∈ S) ≤ e^ϵPr(A(σ) ∈ S).

Since computations on quantum devices are dictated by a CPTP map (a quantum channel ℰ) and outcomes can be characterized by a set of Positive Operator-Valued Measurements (POVMs) {Π_k}[Set of orthogonal projectors.], as alternative, one can abstract the effect of a quantum classifier as follows:

    Pr(A(σ) ∈ S) = y_k(σ) = Tr[Π_k ℰ(σ)].


This reformulation leads to the definition of quantum ϵ-DP as: 

    y_k(ρ) ≤ e^ϵ y_k(σ),   or  y_k(ρ)/y_k(σ)≤ e^ϵ.

<ref> is of particular interest, since it indicates, that ϵ controls the change of labels for two neighbouring states.



 §.§ Bound of e-DP


Recent research on quantum DP incorporates a specific noise channel alongside the quantum channel that models the quantum classifier to establish concrete upper bounds for ϵ. 
Here, we aim to outline two particular bounds relevant to our study: (i) depolarizing noise and (ii) random rotations.



  §.§.§ Bound on Depolarizing Noise

A depolarizing noise channel is characterized by the parameter p, defined as follows:

    ℰ(ρ) = p/N I_N + (1-p) ρ.

Here N=2^n is the dimensionality of the density matrix and I_N the identity matrix of dimensionality N.
<cit.>, initially showed that a depolarizing channel suffices ϵ-DP. So given two input states ρ and σ, bound by a trace distance: τ(σ, ρ) ≤τ_D and a quantum classification algorithm with a POVM, perturbed by a depolarizing noise channel, the output probabilities of ρ and σ are ϵ-DP: 

    ϵ = ln( D(1-p) τ_D/p + 1),

where D is the dimension of the measurement operator used in the POVM. 
<cit.> expanded on this concept by noting that the placement of the depolarizing channel within the quantum circuit does not affect the robustness guarantee. 
Additionally, they pointed out that ϵ-DP can be utilized to enhance adversarial robustness.






  §.§.§ Bound on random rotations


<cit.> provided a bound for ϵ-DP, based on a process, where at first a layer of random rotations parametrized by θ_i, with: h_1 < tan (θ_i) < h_2 are placed, further they show that for binary classification, the following bound can be derived:

    ϵ = ln[τ_D/t^n +1],

where t = (h+1)·2^(-n) is the noise level. Their bound is of particular interest, since it is independent of the underlying device.




 §.§ Choi representation of noise channels

As modern quantum devices are in the NISQ era <cit.>, they are commonly affected by noise. 
This noise is often characterized using Kraus operators:

    ℰ(ρ) = ∑_k K_k ρ K_k^†  where  ∑_k K_k K_k^† = I.

In constrast, we utilize the Choi–Jamiołkowski isomorphism <cit.>. 
This formalism is able to represent an n-qubit noise channel of dimensionality d = 2^n as a complex, completely positive, and trace preserving matrix:

    = (ℰ⊗ I_A) (|ϕ^+⟩⟨ϕ^+|) ∈ℂ^d^2 × d^2,

where |ϕ^+⟩ represents the fully entangled state and A the auxiliary system which we assume to always have the same dimensionality as our n-qubit system. 
On a further note, we refer to the Choi matrix that describes the identity channel as identity Choi matrix: = |ϕ^+⟩⟨ϕ^+|.



Next, it is necessary to ensure that  is Completly Positive (CP) and Trace Preserving (TP) for our resulting quantum channel to be Completly Positive and Trace Preserving (CPTP). 
This can be achieved by asserting that the Choi matrix is positive semi-definite (≽ 0) and that tracing out the system describing the noise channel lead to an identity matrix of the size of the subsystem (Tr_2 [] = I_A).
Thus, we can construct the application of a noise channel as [See <cit.> for a visualization using tensor networks.] <cit.>:

    ℰ(ρ) = Tr_1 [ (ρ⊗ I_A) ].

Consequently, a POVM is constructed as follows <cit.>:

    ỹ_k(ρ) = Tr[ (ρ⊗Π_k) ],

where Π_k is a measurement operator. 



Further, a Kraus-channel can be reconstructed from a Choi matrix by looking at its spectral decomposition: 𝒥(ℰ)  = ∑_i λ_i |Ψ_i⟩⟨Ψ_i| <cit.>. One can then construct a matrix A_i, s.t | A_j ⟩⟩ = ∑_i, j A_ij|i⟩⊗|j⟩ = |Ψ_i⟩. [Since we are assuming the standard basis for the construction of superoperators, this can simply be done by reshaping the matrix.].

The individual Kraus operators can then be recovered as:

    K_i = √(λ_i) A_i

























§ INTRODUCTION OF (ALPHA, GAMMA)-CHANNELS

In this section, we introduce a family of quantum noise channels, which allow us to derive ϵ-DP bounds and robustness guarantees. 
In reviewing the proofs concerning ϵ-DP conducted by <cit.>, <cit.> and <cit.>, 
we observe that their bounds share similarities, particularly in their use of the property that trace preserving operations are contractive with respect to the trace distance, formally:


    τ(ℰ(σ), ℰ(ρ)) ≤τ(σ, ρ).


In addition, they typically manage to establish bounds for the minimum probability of the noise channel, i.e:

    y_k(σ) > 0.

Essentially, their proofs rely on the fact that quantum noise channels are contractive, and some may offer a lower bound on the smallest possible POVM. 
This reasoning inspires the definition of a family of noise channels that can be demonstrated to meet the requirements of ϵ-DP.


Building on this idea, we formalize the concept by introducing (α, γ)-channels:

    We define an (α, γ)-channel as an arbitrary quantum channel ℰ_(α, γ)(ρ): ℂ^N →ℂ^N, with the following properties:
    
        
  * ∀σ, ρ.   τ(ℰ_(α, γ)(ρ), ℰ_(α, γ)(σ)) ≤ατ(σ, ρ)
        
  * ∀Π_k, σ.   Tr[Π_k ℰ_(α, γ)(σ)] ≥γ
    
    with α, γ∈ [0;1].



Intuitively, any (α, γ)-channel has a contraction factor of at most α and any input σ result in at most γ after a POVM.




 §.§ e-DP of alpha, gamma-channels


As already hinted in our introduction, the definition is inspired by reviewing the process of thought used in <cit.>, <cit.> and <cit.>.
Hence, we use the underlying assumptions we have provided for our (α, γ)-Channels to show ϵ-DP for any channels that follow <ref>:

    For all input states ρ and σ, which are bounded by a trace distance τ(ρ, σ) ≤τ_D, any (α, γ)-channel, ℰ_(α, γ)(ρ) suffices ϵ-DP, with:
    
    ϵ = ln[1+ατ_D/γ]




We  assume the noisy probabilities as ỹ_k(σ) = Tr[Π_k ℰ̃(σ)] and the clean as y_k(σ) = Tr[Π_k ℰ(σ)]. 
We can note that the absolute difference between the two probabilities is bound by their sensitivity (See <cit.>):

    | ỹ_k(σ) - y_k(ρ) |     = 
    
        | Tr[Π_k (ℰ̃(σ) - ℰ̃(ρ))] |    ≤
    1/2‖Π_k ‖_∞‖ (ℰ̃(σ) - ℰ̃(ρ)) ‖_1     = 
    ‖Π_k ‖_∞τ(ℰ̃(σ), ℰ̃(ρ))    POVM norm is one=
    τ(ℰ̃(σ), ℰ̃(ρ))    <ref>≤
    ατ(σ, ρ)

Secondly, we can note that for any POVM Measurement:

    y_k(σ) = Tr[Π_k ℰ_(α, γ)(σ)] ≥γ

With those two relations, we can derive an upper bound the DP relation:

    y_k(ρ)/y_k(σ) - 1    = y_k(ρ) - y_k(σ)/y_k(σ)   ≤| y_k(ρ) - y_k(σ) |/y_k(σ)
       ≤ατ(σ, ρ)/γ≤ατ_D/γ


Given now:

    ϵ = ln[1+ατ_D/γ]

We can resubstitute <ref> in the last relation above, which equates to the same term:

    e^ϵ - 1 = e^ln[1+ατ_D/γ] - 1  =  ατ_D/γ






 §.§ Relation of alpha, gamma-channels to depolarizing channels

Now that we have introduced an (α, γ)-channel, it is necessary to consider whether the bound provided for ϵ-DP is tight.
Specifically, given that the depolarizing channel is one of the most significant sources of noise, it is logical to demonstrate a bound that it incorporates the results of <cit.>.
In addition, to outline the extendibility of our framework, we exploit our concept of (α, γ)-channels to include the same bound as <cit.>.





  §.§.§ Depolarizing Noise




One can find that the contraction of a depolarizing noise channel with value p is defined as κ = (1-p) <cit.>, from which we directly conclude that α = (1-p).
To upper bound the smallest eigenvalue of a noise channel, we follow the line of argument of <cit.>. 
Essentially they argue, that the smallest possible value of the noisy channel is given as Tr[Π_k ℰ(σ)] = p/D.
Substituting this into our bound of ϵ-DP, it is apparent that we arrive at the same bound as in <ref>:

    ϵ = ln[1 + (1-p) τ_D/p/D] = ln[1 + D(1-p) τ_D/p]




  §.§.§ Random Rotation Bound

<cit.> described their noise process as incorporating random rotations before the operation of the quantum classifier. 
Given that this process still constitutes a quantum channel, we can safely set the trivial upper bound for α at 1. 
To establish a bound on γ, we consider the scenario of a binary classifier [A base assumption on the robustness in <cit.>]. 
This assumption allows us to assume that the majority class must be at least greater or equal than (1+h)^n/2, with h the lower bound on the random rotations in the R_x-Gates: 

    y_C(σ) > (1+h)^n/2.

Hence, we assume w.l.o.g.:

    y_C = (1+h)^n/2≥ 0.5.

From this, we deduce the following for the subsequent class:

    y_k ≠ C = 1 - (1+h)^n/2≤(1+h)^n/2,

and for all labels y_C, y_k ≠ C≥(1+h)^n/2.


This provides us with γ = (1+h)^n/2 and by substituting t = (h+1)·2^1-n, we can find γ = t^n.

In the end, setting α = 1 and γ = t^n in <ref> yield the same bound as <cit.>:

    ϵ = ln(τ_D/t^n + 1)






 §.§ Certifiable robustness on alpha, gamma-channels


This section builds on the robustness bound from <cit.> and generalizes it to an (α, γ)-channel. 
We focus on the infinite sampling case for a hypothetical noise model that can only be simulated, not physically implemented. 
Refer to <cit.> for details on the finite sampling case.



    Given a binary classifier, altered by a (α, γ)-channel: y_k(σ) = Tr[ Π_k ℰ_α, γ(σ) ]. Suppose that for a predicted class C, the following holds:
    
    y_C(σ) > e^2ϵ y_k ≠ C(σ)     ϵ = ln[1+ατ_D/γ],

    than for a benign state ρ with τ(σ, ρ) ≤τ_D, the predicted class label C, will not change:
    
    _k y_k(σ) = C =  _k y_k(ρ)




We can construct the proof similarly as in <cit.>, by simply replacing the definition of ϵ.
We will first note that due to ϵ-DP:

    y_C(ρ) ≥ e^-ϵ y_C(σ)

Hence using y_C(σ) > e^2ϵ y_k ≠ C(σ):

    y_C(ρ) ≥ e^-ϵ y_C(σ) > e^ϵ y_k ≠ C(σ)

Next, we can note that:

    y_k ≠ C(ρ) ≤ e^ϵ y_k ≠ C(σ)

Which completes the relation:

    y_C(ρ) ≥ e^-ϵ y_C(σ) > e^ϵ y_k ≠ C(σ) ≤  y_k ≠ C(ρ)

Since y_C(ρ) > y_k ≠ C(ρ), we can conclude that:

    _k y_k(σ) = C =  _k y_k(ρ)




Based on Theorem <ref>, if the ratio ỹ_C(σ)/ỹ_C ≠ k(σ) exceeds e^2ϵ, we can certify the data point against any benign sample within radius τ_D. 
This leads to the following corollary:

    Given a binary quantum classifier perturbed by a (α, γ)-channel, with:
    
    B ≡ỹ_C(σ)/ỹ_C ≠ k(σ)

    This classifier is robust against any perturbation: σ→ρ, with τ(σ, ρ) ≤τ_D, if:
    
    ỹ_C(σ)/ỹ_C ≠ k(σ) = B > e^2ϵ

    With: ϵ = ln[1+ατ_D/γ]


Building on our prior analysis of depolarizing noise (<ref>), where we established a certifiable distance for a single data point based on network output probabilities, we can now determine the minimum value of ϵ that bounds the fraction B. This involves calculating:

    ϵ_min = 1/2ln( y_C(σ)/y_C ≠ k(σ))

Next, one can simply use ϵ = ln[1+ατ_D/γ], which will lead to:

    τ_D = (e^ϵ_min-1) ·γ/α

Note that for α = 0, we would get a τ_D = ∞, which highlights the limitations of our approach and the necessity of incorporating (ϵ, δ)-DP into the analysis of (α, γ)-channels.




§ CONSTRUCTION OF OPTIMAL (ALPHA, GAMMA)-CHANNELS


In this section, we investigate optimal noise channels for adversarial robustness. 
We formulate a semidefinite program (SDP) to find the best channel based on the certification distance from <ref>.


We consider a single data point (later expanded to a set) represented by a density matrix σ = σ(x). 
A pretrained quantum classifier described by a unitary U acting on n-qubits and measured on d qubits by 2^d POVM-measurements: {Π_k}. 
We assume a true label C (w.l.o.g.).
For brevity, we denote σ_D = U σ U^† and abbreviate this by σ.
Refer to Eq. <ref> for the POVM measurement definition: 
y_k(σ) = Tr[ Π_k ℰ_(α, γ)(σ) ],
where ℰ_(α, γ) represents the noise channel with parameters α and γ.
Given a threshold B = y_C(σ)/y_k ≠ C(σ) > e^2ϵ, we recognize that ϵ is fixed by the chosen noise channel. 
Hence, to maximize classifier robustness, a natural approach is to maximize the fraction B.
More specifically we can formulate this as the following optimization problem:

    max       y_C(σ)/y_k ≠ C(σ), 
    s.t:      y_k(σ) = Tr[Π_k ℰ(σ)], 
       ℰ( . )  is a quantum channel, 
       ∀σ, ρ  τ(ℰ(σ), ℰ(ρ)) ≤ατ(σ, ρ) + β, 
       ∀ k      y_k(σ) ≥γ.


Unfortunately, the current problem formulation violates the rules of convexity and might not be directly solvable using SDPs. 
To address this, in the following subsections, we introduce reformulations to make it suitable for SDPs.






  §.§.§ CPTP Properties


An underlying assumption of this work is that quantum channels can be described by Choi matrices, which must be CPTP. 
As pointed out earlier, we use the Choi–Jamiołkowski isomorphism <cit.>, since kraus operators do not necessarly provide a convex or linear representation of our variables, which is a necessity in SDPs. 
We follow <cit.> and encode the two properties (CP and TP) individually as follows:



    ≽ 0 
    Tr_out[ ] = I_A





  §.§.§ alpha-Bound for the SDP

To constrain the α parameter, we leverage <cit.>. 
While the original source includes a disclaimer about potential inaccuracies, we provide a complete proof in Appendix <ref> for clarity.
Here, we directly utilize <cit.> to bound the contraction α = (1-κ) within our SDP formulation, as shown below:

    ℰ - κℰ^'≽ 0.

Here ℰ is our noise channel and ℰ^' describes a reference channel. <cit.> suggests to set: ℰ^' = I/d the fully mixed state as a reference, which will yield the following constraint on the Choi matrix of our noise channel:

    - κ/d I ≽ 0

While the current constraint provides a valid upper bound, it has limitations. 
Given that the smallest eigenvalue of  is zero, this bound offers no advantage over the trivial case κ = 0  (1-κ) = 1. 
Nonetheless, due to the lack of better methods for encoding the contraction factor within SDPs, we employ this approach, acknowledging that it restricts the representable noise channels.




 §.§ gamma-Bound for the SDP

To enforce the constraint on γ, we refrained from solving the SDP for all possible density matrices due to the clear in applicability of encoding a continuous set in a discrete setting. Henceforth, we achieve a similar behavior by encoding the following constraint in our PSD:

    ∀Π_k   Tr_2 [(Π_k ⊗ I) ] - γ I ≽ 0

Since any POVM measurement in the context of Choi matrices is defined as in <ref>, we can follow from the constraint, that: Tr_2 [ (I ⊗ρ^T)] ≥γ I, which we can use to verify that all POVM measurements are bounded by γ: 

    y_k(σ)      = Tr[(Π_k ⊗ρ^T) ] 
       = Tr[ Π_k Tr_2 [ (I ⊗σ^T)]] 
       ≥Tr[ Π_k γ I] 
        = γ




 §.§ Combination of the SDP formulation


Given the constraints above, we can formulate an SDP to optimize for the best possible noise channel. 
Note that the function y_C(ρ)/y_C ≠ k(ρ) is non-convex and therefore not applicable in the context of SDP formulations. 
Hence, we simply maximize y_C(ρ), since for the binary case y_C ≠ k(ρ) = 1-y_C(ρ), hence the target optimization goal should still be met.
With the constraints established, we can now formulate an SDP to find the optimal noise channel. However, the original objective function involving the ratio y_C(ρ)/y_C ≠ k(ρ) is non-convex and unsuitable for SDPs.
To address this, we propose a simpler approach: maximize y_C(ρ). 
Since in binary classification, the probabilities for the two classes sum to 1 (y_C ≠ k(ρ) = 1 - y_C(ρ)), 
than, maximizing the probability y_C(ρ) for the correct class inherently minimizes the probability for the incorrect class.



So far we have only assumed one data sample in our line of argument, since solving the SDP for every possible input will correspond to label leaking, we decided to construct the noise channel over the sum of all possible probabilities y_C_i(σ_i) in the test set. We have chosen the test set to ensure that the noise channel is optimal for the samples attacked in our evaluation and no assumption about the generality have to be made. Next, we consider the class imbalance present on the test set by computing the weight vector w = ∑_k C_k/| C |, which leads to the overall optimization target:∑_i w_i · y_C_i(σ_i).

During our evaluation, we found overall two scenarios that can be solved using our SDP: At first, one can apply the noise channel after the quantum classifier (post-order SDP) and infront of the quantum classifier (pre-order SDP). Both scenarious are outlined in the following.




  §.§.§ Post order SDP

















The post order SDP is rather a straight forward application of the previously discussed concepts. 

    max       ∑_i w_i · y_C_i(σ_i) 
    s.t:     ∀ i    y_C_i(σ_i) = Tr[(U σ_k U^†⊗Π_C_k) ] 
       ≽ 0 
       Tr_2 [ ] = I_A 
       ∀Π_k   Tr_2 [(Π_k ⊗ I) ] - γ I ≽ 0 
         - α/D I  ≽ 0






  §.§.§ Pre-order SDP

With the pre-order SDP, we can note that the unitary will "act" on the Choi matrix upon measurements, which will alter our measurements in the following way:

    y_k(σ) = Tr[ (σ⊗Π_k) (I ⊗ U)  (I ⊗ U^†) ]

Interestingly, this also implies for our γ constraint that:

    Tr_2 [(Π_k ⊗ I)(I ⊗ U)  (I ⊗ U^†) ] - γ I ≽ 0

Aside from this change, the SDP formulation will be unchanged leading us to the formulation:

    max       ∑_i w_i · y_C_i(σ_i) 
    s.t:     ∀ i    y_C_i(σ_i) = Tr[ [(σ_i ⊗Π_C_i) (I ⊗ U)  (I ⊗ U^†) ] 
       ≽ 0 
       Tr_2 [ ] = I_A 
       ∀Π_k   Tr_2 [(Π_k ⊗ I)(I ⊗ U)  (I ⊗ U^†) ] - γ I ≽ 0 
         - α/D I  ≽ 0



















§ EXPERIMENTS

In our experiments, we wanted to highlight the utility and limitations of utilizing a SDP Formulation as a bechmark for optimally robust quantum channels. See Appendix <ref> for a detailed description of our data preprocessing and SDP implementation steps. We have considered the Iris dataset (Iris) with Angle and Amplitude embedding, the Pima Indians Diabetes dataset (PID) and the breast cancer dataset (BC). The latter two where only utilized using Amplitude embedding.



In our experiments, we want to highlight the performance of depolarizing noise against our optimal (α, γ) counter part. Further we want to analyze the effect of α and γ on the certifiablility and at last we want to compare the effectiveness of different encodings.



 §.§ Classification of Depolarizing Noise against optimal noise

Providing an optimal noise channel for various values of depolarizing noise serves as an experimental benchmark for the optimality of specific noise channels. 
Here, we outline the process. 
As a first step, one needs to reduce α and γ to the parameters of the specific noise channel. 
Next, one can iterate over a set of parameters and compare the adversarial accuracy to that of the optimal noise channel, as illustrated in <ref>. 
For depolarizing noise, we observe that in most datasets, a small amount of depolarizing noise provides a good upper bound, but typically the effect decays with an increase in depolarizing noise.




 §.§ Influence on alpha and gamma on the certifiable robustness

Next, we want to outline the effect of α and γ on the certifiable accuracy. Therefore, we consider <ref> to compute the certifiable distance for each datasample in terms of the trace distance and then compute the portion of certifiable samples on the test set given a set of distances τ_D ∈{0.05, 0.10, 0.15}.
We first note that the effect of α and γ on the difference between the class label and the follow up class (which is later on described in the fraction B in <ref>) scale symetrically with α and γ. 
See <ref> for a visualization. 
Additionally one can observe that the difference always converge to zero for all datasets given: α = 0 and γ = 0.5. 
For these values the quantum classifer is perturbed by a noise channel describing random guessing, which yields naturally a certifiable distance of τ_D = ∞. 
Given the limited usefulness of a random guessing network, we decide to constrain the certifiable distance shown by the plots in <ref> by a δ on the difference among y labels. 
To this end, we choose a δ of 0.05 for the Iris dataset (Angle and Amplitude Embedding) and the BC dataset. For the PID dataset, we pick a δ of 0.01, since the class probabilities are closed together due to the lower accuracy. 




Concerning the certifiable samples in <ref>, one can see that the influence of α and γ have an effect on the amount of certifiable distances given by the classifier. 
The area where the maximum of samples can be certified clearly shrinks in case the cut-off distance is increased from 0.05 to 0.15 and typically converges to a line like structure which is the maximum for (α = 0.11, γ = 0.447) (PID, Iris Angle and BC), (α = 0.16, γ = 0.421) (Iris Amplitude). Which additionally describes the smallest allowed difference considered in our experiments. 

Interestingly, across various datasets, lower values of γ tend to extend the range of certifiable samples. These samples maintain their high certification level for a longer period before experiencing a characteristic sharp drop. This drop point depends on the chosen certifiable distance, the specific dataset, and the embedding used. In contrast, the parameter α seems to induce a smoother transition in the certification level. It remains an open question whether this observed behavior is a consequence of the SDP formulation itself or an inherent property of (α, γ)-channels.




 §.§ Comparison of amplitude and angle embedding

In <ref>, it is apparent, that the ϵ of the ϵ-DP mechanism is proportional to α, β and the trace distance of the two input states, which highlights that different encodings, might additionally provide further robustness bounds on quantum classifiers. To provide further insights, we have normalized the ϵ values used in this study from the respective intervals of [0;0.25] (Amplitude embedding) and [0;0.9] (Angle Embedding) of the Iris dataset to the interval [0;1]. The results can be observed in <ref>. Overall it is apparent, that a better encoding shows a higher degree of adversarial accuracy, which decays at a similar rate with an increase in depolarizing noise and is still bounded by the optimally constructed (α, γ)-Channel.







§ CONCLUSION

In this work, we have defined a family of noise channels, which are certifiable robust. We have hereby related robustness of QNNs to the contraction of the algorithm, to the smallest possible label assignment as well as to the encoding strategy used by the quantum classifier. 
Our SDP formulation, while theoretically useful for constructing optimal noise channels (maximizing the fraction B), suffers from numerical scaling limitations in practical applications. Nevertheless, the study reveals several interesting implications and future research directions.


Firstly, the framework could be extended to evaluate other noise sources beyond depolarizing noise, potentially leading to a broader understanding of quantum noise and its impact on ϵ-DP.

Secondly, while a small amount of depolarizing noise shows promise as a defense against evasion attacks, it remains unclear if noise inherent to NISQ devices can truly provide robustness. 
Our findings, along with previous work, suggest that increasing depolarization leads to decreased certifiability.


Thirdly, the concept of noise channels as a general model for quantum computation, coupled with the existence of certifiable robust channels, opens exciting avenues. Constructing a variational ansatz with inherently certifiable behavior would be a significant advance. Such an ansatz could be easier to optimize compared to finding the optimal noise model (a convex optimization problem), despite the computational challenges arising from exponentially growing Hilbert spaces. This could pave the way for theoretically grounded adversarial robustness in quantum classifiers. Additionally, the observed improvement in robustness due to encoding suggests that quantum classifiers might be inherently robust when data point separation is effective. This combination of factors could lead to a paradigm shift, where quantum classifiers are recognized for their inherent robustness that scales with data separability.









§ PROOF OF <CIT.>

In the following <cit.> is outlined combined with its proof and the accompanying references.

    Given ℰ, ℰ^' be two trace preserving and Hermitian preserving linear maps, where we define ℰ^' as:
    
    ℰ^'(ρ) = Tr[ρ] Y;   Tr[Y] = 1

    If ℰ - κℰ^' is positive for some κ≥ 0, then for all density matrices ρ, σ:
    
    Tr|ℰ(σ-ρ)|≤ (1-κ) Tr|σ-ρ|




We start off by noting that [Since Tr[σ - ρ] = Tr[σ] - Tr[ρ] = 1-1 = 0] ℰ^'(σ-ρ) = Tr[σ - ρ] Y = 0. We can hence reformulate the trace distance as follows:

    1/2Tr|ℰ(σ-ρ)|    = 
    sup_0 ≤ P ≤ I{Tr[ ℰ(σ-ρ) P]}    = 
    sup_0 ≤ P ≤ I{Tr[ (ℰ(σ-ρ) - κℰ^'(σ-ρ)) P]}    = 
    sup_0 ≤ P ≤ I{Tr[ ((ℰ- κℰ^')(σ-ρ)) P]}

Next, we will define the dual map, such that:

    Tr[ ((ℰ- κℰ^')(σ-ρ)) P] = Tr[ ((ℰ- κℰ^')^*(P)) (σ-ρ)]


Since ℰ- κℰ^' is defined as positive, we can conclude that (ℰ- κℰ^')^* is positive too <cit.>. we can follow that since P is positive and bounded by I, that P^' = (ℰ- κℰ^')^*(P) is positive. Since ℰ and ℰ^' are trace preserving, the application of identity to their dual channel scales I as: (ℰ- κℰ^')^*(I) = (1-κ) I. Given now that by definition P ≤ I, we can follow that

    (ℰ- κℰ^')^*(I) = (1-κ) I ≥ P^' = (ℰ- κℰ^')^*(P)


We can follow, that the resulting projection is bounded by: 0 ≤ P^'≤ (1-κ) I, which allows the following relation:

    sup_0 ≤ P ≤ I{Tr[ ((ℰ- κℰ^')(σ-ρ)) P]}    = 
    sup_0 ≤ P ≤ I{Tr[ ((ℰ- κℰ^')^*(P)) (σ-ρ)]}   ≤
    sup_0 ≤ P^'≤ (1-κ)I{Tr[(σ-ρ) P^']}    = 
    
        (1-κ) sup_0 ≤ P^'≤ I{Tr[(σ-ρ) P^']}    = 
    1-κ/2Tr|σ-ρ|

From which we can follow, that:

    1/2Tr|ℰ(σ-ρ)|≤1-κ/2Tr|σ-ρ|





§ EXPERIMENTAL SETUP




 §.§ Training of Neural networks

We trained four different QNNs, using a similar scheme as in our previous study. Overall we used the Pima Indians Diabetes Dataset, the Breast Cancer and the Iris dataset. We used CategoricalCrossEntropy [The standardxx] as a loss function for all datasets and considered the class imblanance by adding weights to the loss. As a optimizer we used Adam.




 §.§ Data preprocessing
 
As already pointed out we used overall three datasets ,  and .




  §.§.§ Iris
 For Iris we followed the approach by <cit.>, dropping the  feature as well as the  class. We then normalized each datapoint by its respective || . ||_2-Norm and performed a train/test split of 40:60. Regarding the Angle Embedding, the datapoints where min max normalized to the interval [0;π].




  §.§.§ Pima Indians Diabetes (PID)

For the Pima Indians Diabetes dataset, we first dropped all nan or duplicate features from the dataset, next to overcome the present class imbalance, we removed overall 232 datapoints from the majority class at random. We used the remaining dataset with 536 datapoints and split them into a train set consisting of 375 datapoints and a test set of 161 datapoints. To provide a comparabilty with the Iris dataset, we additionally normalized each datapoint with it's respective || . ||_2-Norm.




  §.§.§ Breast Cancer Wisconsin (BC)

For the Breast Cancer Wisconsin dataset we found overall 683 features, with a dimension of 9, since this would require four qubits in the angle embedding, we performed a PCA with eight components, effectively rescaling the dimensionality to eight. 
We rescaled the data into the interval (0;1] and normalized each feature vector by it's respective || . ||_2-Norm. No further preprocessing was conducted.




 §.§ QNN Architecture

As pointed out earlier, we used a similar scheme of dataembedding plus strongly entangling layers. For embedding we trained Iris once using angle embedding and once amplitude embedding. Since we where only able to solve up to 3 qubits, we refrained from using qngle embedding for the PID and BC datasets and applied hereby amplitude embedding. For an overview of the various hyperparameters used in this study, refer to <ref>.



At last we want to point out how the depolarizing mechanism was constructed in our study




 §.§ Implementation of the SDP




  §.§.§ Complexity analysis

In this study, we use MOSEK in combination with CVXpy <cit.> with an interior-point method, scaling its runtime with 𝒪(v^3.5) <cit.> to solve the SDP, where v represents the number of variables in the SDP. In our work, we embed a Choi matrix of size d^2 × d^2, where d = 2^n describes the dimensionality of the Hilbert space. This indicates that the number of variables scales biquadratically with the dimensionality of the Hilbert space of the used quantum classifier, and hence exponentially in terms of the number of qubits:

    v = d^4 = (2^n)^4

With d the dimensionality of the hilberspace and n the number of qubits.
The biquadratic scaling also indicates why, in contrast to other methods like <cit.>, we can only exhibit our study on maximally three qubits.  





  §.§.§ Numerical Considerations

As already pointed out, we used CVXpy <cit.> to implement the SDP in <ref> combined with MOSEK as a solver. During optimization, we resolved multiple numerical issues. Initially, we approximated the constraint: Tr_2 [ 𝒥] = I_A, by replacing it with: Tr_2 [ 𝒥] - I_A _F≤δ, setting δ = 1e-10. Secondly, instead of explicitly stating the constraint that 𝒥≽ 0, we asserted on the variable itself that 𝒥 is PSD, which typically guided the optimizer to feasible solutions. Lastly, we emphasize that our optimal noise channel was constructed on the test set, on which we further applied the attack. The main reasoning behind this was to provide the actual best possible noise channel when averaging over the test set.




§ OVERLAPPING ROBUSTNESS IN OPTIMAL NOISE CHANNELS

During our work, we found that typically the optimally constructed noise channels coincide in terms of their adversarial accuracy. This provides a challenging perspective as α and γ seemingly control the contractiveness and the minimal possible measurement, respectively. Nevertheless, we want to emphasize that α provides an upper bound on the contractiveness of the noise channel by <ref>, and γ a lower bound on the minimal measurements. Those bounds suffice to control ϵ-DP. Nevertheless, the optimizer might choose a different specific values describing the contraction and smallest possible measurement. We hence saw as outlined  for Iris Amplitude in <ref>, that the adversarial accuracies typically where overlapping.
We hence simply used one value for the effect of α and γ in the following when describing adversarial accuracy's.





plainnat


