QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuits
Authors: Navid Azimi, Aditya Prakash, Yao Wang, Li Xiong
Organizations: Department of Computer Science, Emory University, 201 Dowman Drive, Atlanta, 30322, GA, USA. · Department of Physics, Emory University, 201 Dowman Drive, Atlanta, 30322, GA, USA.
Deep neural networks remain highly vulnerable to adversarial perturbations, limiting their reliability in security- and safety-critical applications. To address this challenge, we introduce QShield, a modular hybrid quantum-classical neural network (HQCNN) architecture designed to enhance the adversarial robustness of classical deep learning models. QShield integrates a conventional convolutional neural network (CNN) backbone for feature extraction with a quantum processing module that encodes the extracted features into quantum states, applies structured entanglement operations under realistic noise models, and outputs a hybrid prediction through a dynamically weighted fusion mechanism implemented via a lightweight multilayer perceptron (MLP). We systematically evaluate both classical and hybrid quantum-classical models on the MNIST, OrganAMNIST, and CIFAR-10 datasets, using a comprehensive set of robustness, efficiency, and computational performance metrics. Our results demonstrate that classical models are highly vulnerable to adversarial attacks, whereas the proposed hybrid models with entanglement patterns maintain high predictive accuracy while substantially reducing attack success rates across a wide range of adversarial attacks. Furthermore, the proposed hybrid architecture significantly increased the computational cost required to generate adversarial examples, thereby introducing an additional layer of defense. These findings indicate that the proposed modular hybrid architecture achieves a practical balance between predictive accuracy and adversarial robustness, positioning it as a promising approach for secure and reliable machine learning in sensitive and safety-critical applications.
Figures & tables
Figure 1: Architectural diagrams of the fully connected DNNs used for the MNIST, OrganAMNIST, and CIFAR-10 datasets.
Figure 2: Architectural diagrams of the CNN models based on the ResNet-18 backbone, adapted for the MNIST, OrganAMNIST, and CIFAR-10 datasets.
Figure 3: Schematic overview of the proposed QShield architecture. The framework integrates classical CNN feature extraction, quantum processing via parameterized circuits (including entanglement and noise modeling), and a hybrid fusion stage governed by dynamic weighting.
Figure 4: No-entanglement quantum circuit architecture. Each qubit undergoes independent parameterized single-qubit rotations RX , RY , and RZ , subsequently followed by a local noise channel Ni,mix(1) and a final measurement M .
Figure 5: Linear entanglement quantum circuit architecture. Each qubit is initially encoded via parameterized single-qubit rotations RX , RY , and RZ . Neighboring qubits are subsequently entangled using controlled operations, establishing a chain-like connectivity. Following entanglement, each qubit is subjected to a local noise channel Ni,mix(1) prior to the final measurement M .
Figure 6: Star entanglement quantum circuit architecture. Each qubit is initially encoded via parameterized single-qubit rotations RX , RY , and RZ . Entanglement is then applied using a star topology, wherein a central hub qubit is connected to all peripheral qubits. Following entanglement, each qubit is subjected to a local noise channel Ni,mix(1) prior to the final measurement M .
Figure 7: Full entanglement quantum circuit architecture. Each qubit is initially encoded via parameterized single-qubit rotations RX , RY , and RZ . Entanglement is subsequently applied between all possible pairs of qubits, establishing an all-to-all connectivity that maximizes shared correlations across the circuit. Following entanglement, each qubit is subjected to a local noise channel Ni,mix(1) prior to the final measurement M .
Figure 8: MLP architecture for fusion coefficient inference. The network generates the adaptive fusion coefficient α via a depth- L MLP with a hidden width of H .
Figure 9: Sample images from the MNIST dataset. The dataset consists of grayscale handwritten digits ranging from 0 to 9, each represented as a 28×28 pixel image. Shown here is one example per class, with the corresponding ground-truth label displayed above each digit.
Figure 10: Sample images from the OrganAMNIST dataset. The dataset contains grayscale abdominal CT slices annotated with organ labels. Shown here is one representative 28×28 pixel image from each of the 11 classes (e.g., spleen, liver, kidneys, lungs, heart, pancreas, bladder, and femurs), with the ground-truth label displayed above each sample.
Figure 11: Sample images from the CIFAR-10 dataset. The dataset consists of 32×32 color images across 10 object categories, including animals (e.g., cat, dog, horse, bird, deer, frog) and vehicles (e.g., airplane, automobile, ship, truck). Shown here is one representative image per class, with the ground-truth label displayed above each sample.
Figure 12: Training and test accuracies across datasets. Comparison of classical (DNN, CNN) and quantum-enhanced (HQCNNs with no, linear, star, and full entanglement) models on MNIST, OrganAMNIST, and CIFAR-10. While CNN achieves the highest overall accuracy, HQCNN variants exhibit comparable performance.
Figure 13: Total Time Cost (TTC) across datasets. Measured computational cost (log-scaled seconds) for DNN, CNN, and HQCNN variants on MNIST, OrganAMNIST, and CIFAR-10. Classical models (DNN, CNN) achieve substantially lower training times, while HQCNNs incur higher costs due to circuit simulation and evaluations plus entanglement operations, with complexity increasing from no to full entanglement.
Figure 14: Adversarial attack success rates (ASR) on MNIST. Measured ASR (%) for DNN, CNN, and HQCNN variants under diverse adversarial attacks, including FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square Attack. While classical models (DNN, CNN) exhibit higher vulnerability across most attacks, HQCNNs, particularly those with entanglement, achieve substantially lower ASRs, demonstrating improved robustness.
Figure 15: Adversarial attack success rates (ASR) on OrganAMNIST. Measured ASR (%) for DNN, CNN, and HQCNN variants under a range of adversarial attacks, including FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square Attack. While the CNN exhibits the highest vulnerability across most attacks, HQCNNs, particularly those with entanglement, reduce ASR and demonstrate improved robustness.
Figure 16: Adversarial attack success rates (ASR) on CIFAR-10. Measured ASR (%) for DNN, CNN, and HQCNN variants under adversarial attacks, including FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square Attack. The CNN shows the highest vulnerability across most attacks, while HQCNNs, particularly those with entanglement, achieve lower ASRs, highlighting their enhanced robustness.
Figure 17: Adversarial attack runtimes on MNIST. Measured adversarial example generation times (seconds, log scale) for FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square attacks across DNN, CNN, and HQCNN variants. Adversarial attacks on classical models (DNN, CNN) achieve much faster runtimes, whereas HQCNNs incur significantly higher computational costs, with runtimes increasing alongside entanglement complexity.
Figure 18: Adversarial attack runtimes on OrganAMNIST. Measured adversarial example generation times (seconds, log scale) for FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square attacks across DNN, CNN, and HQCNN variants. Adversarial attacks on classical models (DNN, CNN) achieve much faster runtimes, whereas HQCNNs incur significantly higher computational costs, with runtimes increasing alongside entanglement complexity.
Figure 19: Adversarial attack runtimes on CIFAR-10. Measured adversarial example generation times (seconds, log scale) for FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square attacks across DNN, CNN, and HQCNN variants. Adversarial attacks on classical models (DNN, CNN) achieve much faster runtimes, whereas HQCNNs incur significantly higher computational costs, with runtimes increasing alongside entanglement complexity.
Machine learning models can learn from data samples to carry out various tasks efficiently. When data samples are adversarially manipulated, such as by insertion of carefully crafted noise, it can cause the model to make mistakes. Quantum machine learning models are also vulnerable to such adversarial attacks, especially in image classification using variational quantum classifiers. While there are promising defenses against these adversarial perturbations, such as training with adversarial samples, they face practical limitations. For example, they are not applicable in scenarios where training with adversarial samples is either not possible or can overfit the models on one type of attack. In this paper, we propose an adversarial training-free defense framework that utilizes a quantum autoencoder to purify the adversarial samples through reconstruction. Moreover, our defense framework provides a confidence metric to identify potentially adversarial samples that cannot be purified the quantum autoencoder. Extensive evaluation demonstrates that our defense framework can significantly outperform state-of-the-art in prediction accuracy (up to 68%) under adversarial attacks.
Quantum machine learning (QML) provides a promising framework for leveraging quantum-mechanical effects in learning tasks. However, its vulnerability to adversarial perturbations remains a major challenge for practical deployment. In QML systems, small perturbations applied to classical inputs can propagate through the quantum encoding stage and distort the resulting quantum state, thereby degrading model performance. In this work, we propose a defense mechanism that replaces the conventional quantum encoding stage of a QML model with passive steering-based controlled state preparation, which guides the encoded state toward a controlled intermediate state. By tuning the steering strength and the number of steering iterations, the proposed method suppresses the influence of adversarial perturbations while maintaining high clean accuracy and improving adversarial accuracy. Experimental results demonstrate that the passive steering-based defense consistently improves adversarial accuracy across different QML models and datasets under gradient-based adversarial attacks, achieving adversarial accuracy improvements of up to 40.19%.
Sahan Sanjaya, Hari Krishna Parvatham, Emma Andrews +1
Artificial Intelligence has achieved remarkable success across diverse application domains. However, its vulnerability to adversarial attacks poses significant challenges to reliability, security, and trustworthiness. Adversarial machine learning demonstrates that even highly accurate models can be manipulated through carefully crafted perturbations, raising serious concerns in safety critical systems such as healthcare, finance, and autonomous technologies. In parallel, quantum computing has emerged as a transformative paradigm capable of addressing complex computational problems through principles such as superposition, entanglement, and quantum interference. The convergence of these fields has led to the emergence of quantum artificial intelligence, which explores how quantum techniques can enhance learning efficiency, scalability, and robustness. This chapter provides a comprehensive overview of adversarial machine learning and existing defense strategies, followed by an accessible introduction to quantum computing and quantum machine learning models. It further presents conceptual frameworks for quantum-enhanced adversarial robustness, emphasizing quantum optimization, feature mapping, and hybrid quantum classical architectures. Practical applications, key challenges, and future research directions are also discussed to support the development of secure and trustworthy AI systems.