The Signal Horizon: Local Blindness and the Contraction of Pauli-Weight Spectra in Noisy Quantum Encodings

Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics (shot noise) act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. Under stated assumptions, single-step attacks need at least quadratically many shots in the input dimension $d$, growing as $d^{5/2}$ under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the $d^{5/2}$ geometric floor for plateau-mitigated models and grows as $d^{3.00}$ for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in recovers the parameter-free $d^{3/2}$ shot-noise geometry. Against a matched classical baseline whose attack overhead is dimension-independent (the cheap-gradient principle of automatic differentiation), the quantum gradient cost ratio grows empirically as $d^{3.00}$, so the attacker's relative cost diverges as the model scales. Experiments on a 156-qubit IBM processor (ibm_boston, 4-qubit circuits, $d=12$) reproduce the effect: at matched budgets the device attack tracks the ideal within a few percent, with the high-shot gradient faithful to the exact one. The defense operates precisely when the forward map is classically hard to simulate: only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.

One-bit post-training quantization represents each weight using only its sign, requiring all deployment contexts to share the same binary weight matrix even when their activation statistics favor different sign patterns. We study this shared-sign constraint and introduce Quantum Random Access Quantization (QRAQ). This framework encodes context-dependent signs in a quantum random-access code and retrieves them via context-matched Pauli measurements. Under an explicit fresh-copy logical readout model, QRAQ produces an unbiased, context-specific binary surrogate with a tractable shot-noise penalty. We prove a row-wise separation from shared-sign one-bit PTQ with signed per-row scales. When the optimal context-wise signs are incompatible, QRAQ achieves a strictly lower ideal reconstruction risk. We also derive finite-shot and calibrated-noise conditions under which this separation is retained. Fixed-readout quantum schemes are classically simulable, so the relevant resource in this model is measurement incompatibility rather than quantization alone. Finally, we characterize the role of scale granularity, provide finite-sample certificates, and evaluate the predicted ideal, finite-shot, noisy, and multi-context regimes in simulator experiments.

The $2^N$ dimensions of Hilbert space give quantum metric learning exponentially many mutually orthogonal states with which to separate classes, but the same exponential dimension also degrades its optimization landscape and the tractability of evaluating its metric. By letting a classical network predict all gate parameters of a fixed ansatz, we isolate the reachable state manifold and its fidelity metric. We prove that this separability is already present on the unentangled manifold $\mathbb{M}_{\text{unentangled}} = (\mathbb{CP}^1)^N$, which saturates the $2^N$ maximal orthogonal capacity needed for classification, while entanglement adds states only at intermediate separations, which are costly to resolve under finite sampling. The same size carries costs. Global fidelity causes exponential gradient collapse across both unentangled ($Θ(c^{-N})$) and entangled ($Θ(4^{-N})$) manifolds; as fidelities concentrate, the fidelity signal-to-noise ratio at a fixed shot budget also decays exponentially in $N$; and because $\mathbb{M}_{\text{unentangled}}$ already holds $2^N$ orthogonal states, expressive, unconstrained encoders under contrastive losses reach trivial minima by geometric shattering even without entanglement. We introduce Quantum Projective Metric Learning (QPMeL), an exact $O(N)$ closed-form kernel on $\mathbb{M}_{\text{unentangled}}$ that circumvents circuit simulation. QPMeL resolves gradient collapse via a curriculum annealing from a $1$-local observable regime (restoring $Θ(1/N^2)$ polynomial variance) to the global product kernel. Empirically, QPMeL as a complete design exceeds eight and matches two of 11 published quantum few-shot designs.