QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuits

Navid Azimi; Aditya Prakash; Yao Wang; Li Xiong

cs.CRApr 13, 2026

QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuits

Authors: Navid Azimi, Aditya Prakash, Yao Wang, Li Xiong

Organizations: Department of Computer Science, Emory University, 201 Dowman Drive, Atlanta, 30322, GA, USA. · Department of Physics, Emory University, 201 Dowman Drive, Atlanta, 30322, GA, USA.

Abstract

Deep neural networks remain highly vulnerable to adversarial perturbations, limiting their reliability in security- and safety-critical applications. To address this challenge, we introduce QShield, a modular hybrid quantum-classical neural network (HQCNN) architecture designed to enhance the adversarial robustness of classical deep learning models. QShield integrates a conventional convolutional neural network (CNN) backbone for feature extraction with a quantum processing module that encodes the extracted features into quantum states, applies structured entanglement operations under realistic noise models, and outputs a hybrid prediction through a dynamically weighted fusion mechanism implemented via a lightweight multilayer perceptron (MLP). We systematically evaluate both classical and hybrid quantum-classical models on the MNIST, OrganAMNIST, and CIFAR-10 datasets, using a comprehensive set of robustness, efficiency, and computational performance metrics. Our results demonstrate that classical models are highly vulnerable to adversarial attacks, whereas the proposed hybrid models with entanglement patterns maintain high predictive accuracy while substantially reducing attack success rates across a wide range of adversarial attacks. Furthermore, the proposed hybrid architecture significantly increased the computational cost required to generate adversarial examples, thereby introducing an additional layer of defense. These findings indicate that the proposed modular hybrid architecture achieves a practical balance between predictive accuracy and adversarial robustness, positioning it as a promising approach for secure and reliable machine learning in sensitive and safety-critical applications.

Figures & tables

Figure 1: Architectural diagrams of the fully connected DNNs used for the MNIST, OrganAMNIST, and CIFAR-10 datasets.

Figure 2: Architectural diagrams of the CNN models based on the ResNet-18 backbone, adapted for the MNIST, OrganAMNIST, and CIFAR-10 datasets.

Figure 3: Schematic overview of the proposed QShield architecture. The framework integrates classical CNN feature extraction, quantum processing via parameterized circuits (including entanglement and noise modeling), and a hybrid fusion stage governed by dynamic weighting.

Figure 4: No-entanglement quantum circuit architecture. Each qubit undergoes independent parameterized single-qubit rotations $R_{X}$ , $R_{Y}$ , and $R_{Z}$ , subsequently followed by a local noise channel $\mathcal{N}^{(1)}_{i,\mathrm{mix}}$ and a final measurement $M$ .

Figure 5: Linear entanglement quantum circuit architecture. Each qubit is initially encoded via parameterized single-qubit rotations $R_{X}$ , $R_{Y}$ , and $R_{Z}$ . Neighboring qubits are subsequently entangled using controlled operations, establishing a chain-like connectivity. Following entanglement, each qubit is subjected to a local noise channel $\mathcal{N}^{(1)}_{i,\mathrm{mix}}$ prior to the final measurement $M$ .

Figure 6: Star entanglement quantum circuit architecture. Each qubit is initially encoded via parameterized single-qubit rotations $R_{X}$ , $R_{Y}$ , and $R_{Z}$ . Entanglement is then applied using a star topology, wherein a central hub qubit is connected to all peripheral qubits. Following entanglement, each qubit is subjected to a local noise channel $\mathcal{N}^{(1)}_{i,\mathrm{mix}}$ prior to the final measurement $M$ .

Figure 7: Full entanglement quantum circuit architecture. Each qubit is initially encoded via parameterized single-qubit rotations $R_{X}$ , $R_{Y}$ , and $R_{Z}$ . Entanglement is subsequently applied between all possible pairs of qubits, establishing an all-to-all connectivity that maximizes shared correlations across the circuit. Following entanglement, each qubit is subjected to a local noise channel $\mathcal{N}^{(1)}_{i,\mathrm{mix}}$ prior to the final measurement $M$ .

Figure 8: MLP architecture for fusion coefficient inference. The network generates the adaptive fusion coefficient

\alpha

via a depth-

L

MLP with a hidden width of

H

Figure 9: Sample images from the MNIST dataset. The dataset consists of grayscale handwritten digits ranging from 0 to 9, each represented as a $28\times 28$ pixel image. Shown here is one example per class, with the corresponding ground-truth label displayed above each digit.

Figure 10: Sample images from the OrganAMNIST dataset. The dataset contains grayscale abdominal CT slices annotated with organ labels. Shown here is one representative $28\times 28$ pixel image from each of the 11 classes (e.g., spleen, liver, kidneys, lungs, heart, pancreas, bladder, and femurs), with the ground-truth label displayed above each sample.

Figure 11: Sample images from the CIFAR-10 dataset. The dataset consists of $32\times 32$ color images across 10 object categories, including animals (e.g., cat, dog, horse, bird, deer, frog) and vehicles (e.g., airplane, automobile, ship, truck). Shown here is one representative image per class, with the ground-truth label displayed above each sample.

Figure 12: Training and test accuracies across datasets. Comparison of classical (DNN, CNN) and quantum-enhanced (HQCNNs with no, linear, star, and full entanglement) models on MNIST, OrganAMNIST, and CIFAR-10. While CNN achieves the highest overall accuracy, HQCNN variants exhibit comparable performance.

Figure 13: Total Time Cost (TTC) across datasets. Measured computational cost (log-scaled seconds) for DNN, CNN, and HQCNN variants on MNIST, OrganAMNIST, and CIFAR-10. Classical models (DNN, CNN) achieve substantially lower training times, while HQCNNs incur higher costs due to circuit simulation and evaluations plus entanglement operations, with complexity increasing from no to full entanglement.

Figure 14: Adversarial attack success rates (ASR) on MNIST. Measured ASR (%) for DNN, CNN, and HQCNN variants under diverse adversarial attacks, including FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square Attack. While classical models (DNN, CNN) exhibit higher vulnerability across most attacks, HQCNNs, particularly those with entanglement, achieve substantially lower ASRs, demonstrating improved robustness.

Figure 15: Adversarial attack success rates (ASR) on OrganAMNIST. Measured ASR (%) for DNN, CNN, and HQCNN variants under a range of adversarial attacks, including FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square Attack. While the CNN exhibits the highest vulnerability across most attacks, HQCNNs, particularly those with entanglement, reduce ASR and demonstrate improved robustness.

Figure 16: Adversarial attack success rates (ASR) on CIFAR-10. Measured ASR (%) for DNN, CNN, and HQCNN variants under adversarial attacks, including FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square Attack. The CNN shows the highest vulnerability across most attacks, while HQCNNs, particularly those with entanglement, achieve lower ASRs, highlighting their enhanced robustness.

Figure 17: Adversarial attack runtimes on MNIST. Measured adversarial example generation times (seconds, log scale) for FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square attacks across DNN, CNN, and HQCNN variants. Adversarial attacks on classical models (DNN, CNN) achieve much faster runtimes, whereas HQCNNs incur significantly higher computational costs, with runtimes increasing alongside entanglement complexity.

Figure 18: Adversarial attack runtimes on OrganAMNIST. Measured adversarial example generation times (seconds, log scale) for FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square attacks across DNN, CNN, and HQCNN variants. Adversarial attacks on classical models (DNN, CNN) achieve much faster runtimes, whereas HQCNNs incur significantly higher computational costs, with runtimes increasing alongside entanglement complexity.

Figure 19: Adversarial attack runtimes on CIFAR-10. Measured adversarial example generation times (seconds, log scale) for FGSM, PGD, APGD, VMI-FGSM, C&W, DeepFool, One-Pixel, and Square attacks across DNN, CNN, and HQCNN variants. Adversarial attacks on classical models (DNN, CNN) achieve much faster runtimes, whereas HQCNNs incur significantly higher computational costs, with runtimes increasing alongside entanglement complexity.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Attack Method	Hyperparameter Configuration
MNIST	FGSM	$\epsilon=32/255$
	PGD	$\epsilon=32/255$ , step size $\alpha=2/255$ , steps = 10, random initialization = True
	APGD	$\ell_{\infty}$ norm, $\epsilon=32/255$ , steps = 10, restarts = 1, seed = 0, loss = cross-entropy, EOT iterations = 1, step size update factor $\rho=0.75$
	VMI-FGSM	$\epsilon=32/255$ , step size $\alpha=2/255$ , steps = 10, momentum decay = 1.0, sampled examples in the neighborhood $N=5$ , neighborhood upper bound $\beta=1.5$
	C&W	$\ell_{2}$ norm, confidence = 0.0, untargeted attack, learning rate = 0.05, binary search steps = 10, maximum iterations = 5, initial constant = 0.01, halving/doubling limits = 5, batch size = 128
	DeepFool	steps = 50, overshoot parameter = 0.05

Appendix

Table 1: Hyperparameter settings for adversarial attacks across all experimental datasets.

Dataset	Attack	Average Per-Sample Adversarial Runtime (s)
		DNN	CNN	HQCNN-	HQCNN-	HQCNN-	HQCNN-
		DNN	CNN	None	Linear	Star	Full
MNIST	FGSM	0.00013	0.00036	0.01866	0.01980	0.02179	0.02427
	PGD	0.00017	0.00143	0.19266	0.22138	0.20537	0.22468
	APGD	0.00070	0.00197	0.21744	0.24030	0.23729	0.25758
	VMI-FGSM	0.00120	0.00996	1.07496	1.24024	1.39194	1.33020

Appendix

Table 2: Average wall-clock time (in seconds) to generate a single adversarial example across datasets.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 479 papers

Defending Quantum Classifiers against Adversarial Perturbations through Quantum Autoencoders
Apr 30, 2026Emma Andrews, Sahan Sanjaya, Prabhat MishraAdversarial Robustness Quantum Machine Learning
University of Florida, Gainesville, Florida, USA
Controlled Steering-Based State Preparation for Adversarial-Robust Quantum Machine Learning
Apr 30, 2026Sahan Sanjaya, Hari Krishna Parvatham, Emma Andrews +1Adversarial Robustness Quantum Machine Learning
University of Florida, Gainesville, FL, USA
Quantum-Enhanced Adversarial Robustness in Artificial Intelligence
May 27, 2026Jaydip SenAdversarial Robustness Quantum Machine Learning
Praxis Business School, India

Apr 30, 2026J/K move · Enter open · S save

Defending Quantum Classifiers against Adversarial Perturbations through Quantum Autoencoders

Emma Andrews, Sahan Sanjaya, Prabhat Mishra

University of Florida, Gainesville, Florida, USA

Adversarial Robustness Quantum Machine Learning Adversarial Example Detection Adversarial Purification

Open paper AskPDF arXiv

Machine learning models can learn from data samples to carry out various tasks efficiently. When data samples are adversarially manipulated, such as by insertion of carefully crafted noise, it can cause the model to make mistakes. Quantum machine learning models are also vulnerable to such adversarial attacks, especially in image classification using variational quantum classifiers. While there are promising defenses against these adversarial perturbations, such as training with adversarial samples, they face practical limitations. For example, they are not applicable in scenarios where training with adversarial samples is either not possible or can overfit the models on one type of attack. In this paper, we propose an adversarial training-free defense framework that utilizes a quantum autoencoder to purify the adversarial samples through reconstruction. Moreover, our defense framework provides a confidence metric to identify potentially adversarial samples that cannot be purified the quantum autoencoder. Extensive evaluation demonstrates that our defense framework can significantly outperform state-of-the-art in prediction accuracy (up to 68%) under adversarial attacks.

Abstract

Adversarial Robustness

Explore similar work

Defending Quantum Classifiers against Adversarial Perturbations through Quantum Autoencoders

Controlled Steering-Based State Preparation for Adversarial-Robust Quantum Machine Learning

Quantum-Enhanced Adversarial Robustness in Artificial Intelligence