Certification cost of quantum models: measurement correlation, not parameter count

Pavel Sulimov; Claude Lehmann

quant-phSep 13, 2026

Certification cost of quantum models: measurement correlation, not parameter count

Authors: Pavel Sulimov, Claude Lehmann

Organizations: Zurich University of Applied Sciences (ZHAW), Winterthur, Switzerland · University of Zurich, Zurich, Switzerland

Abstract

Reporting the Fisher geometry of a trained variational quantum model is routine; quoting the shot budget that would establish it is not. Certifying an empirical Fisher matrix to relative Frobenius error $\varepsilon$ under coordinate-wise parameter shift costs $Θ(B p^{2} V/(\varepsilon^{2} G))$ circuit executions, where $V$ is the measured readout variance and $G$ the measured squared gradient norm, with uniform allocation optimal in that class. One constant reproduces the cost of two circuit families whose exponents differ by a full power of $p$ . The exponent is an identity in how $nV$ and $nG$ scale with the register, holding family by family to $0.001$ across 624 matrix-product-state cells once the finite- $p$ prefactor is removed. The cubic cost is therefore a finite-size window, set by whether the readout light cone grows with the register. A product family to 256 qubits gives $1.966$ (95% CI $1.934$ -- $1.997$ ); a brickwork entangler falls from $2.853$ below ten qubits to $1.715$ beyond sixty-four; a blocked entangler gives $1.984$ at a fixed cone width against $3.034$ at a proportional one. Fixed device connectivity fixes the cone, so a cubic budget from a small simulation overestimates a large machine, on top of hardware multipliers $2.07\times$ ( $1.41$ -- $3.02$ ), $2.38\times$ and $1.91\times$ on ibm_marrakesh, ibm_fez and ibm_kingston. Cost-optimal readout weights cut the measured shot budget by $2.67\times$ ( $1.33$ -- $4.00$ ) on hardware, flat from four to twelve qubits. A discrepancy model fitted on cheap circuits transfers its mean inside the calibration grid and, at six larger sizes named before the data, does not: nominal 90% intervals cover 36%, and split conformal is the only rung that stays near nominal.

Figures & tables

Figure 1: Certification cost, and what sets its exponent. a A layered $R_{X}$ plus entangler circuit is measured in the computational basis to give the uniform mean $f=\tfrac{1}{n}\sum_{q}\langle Z_{q}\rangle$ . From that readout the variance $V$ (the full covariance sum over measured qubits) and the signal $G$ (the squared parameter-shift gradient norm) are measured, and Theorem 1 converts them into the shot budget $S$ and the execution budget $B_{Q}$ at tolerance $\varepsilon$ . Uniform allocation is optimal within the coordinate-wise parameter-shift class. b Measured $B_{Q}$ exponent for each of the eleven blocked-entangler families against the scaling of its readout light-cone width with the register: blue circles are the six families whose cone width is fixed by construction and orange squares the five whose cone width is proportional to $n$ . Error bars are two-sided 95% seed-clustered bootstrap intervals from 3,000 resamples. The blue dashed line marks the cone-saturated prediction of 2 and the orange dashed line the cone-limited prediction of 3.

Figure 2: One constant reproduces the cost of both families. a Measured shots against the predicted $pV/(\varepsilon^{2}G)$ on logarithmic axes for 84 cells at $\varepsilon=0.15$ , product family as blue circles and entangling family as orange squares; the grey dashed line is the pooled constant $0.344$ fitted across both families and not per family. b The 84 per-cell values before dividing by $pV/(\varepsilon^{2}G)$ (blue, left) and after (orange, right), each cell drawn as an individual point and each column normalised to its own mean, on a logarithmic axis; the grey horizontal bar is the column median and the annotation is the pooled coefficient of variation over all 84 cells. No error bars are shown because each annotation is a single dispersion statistic.

Figure 3: The cubic exponent is a cone window. a Product-family executions with the fitted $\varepsilon$ dependence divided out: $B_{Q}\varepsilon^{-b}$ against parameter count $p$ on logarithmic axes, $n=16$ to 256, where $b=-1.92$ is the fitted $\varepsilon$ exponent. Blue points are 120 cells at four $\varepsilon$ values; collapsing $\varepsilon$ puts them on one cloud. The orange line is the two-variable fit in $p$ ; the grey dotted line is a $p^{3}$ reference sharing the left-hand intercept. b Fitted $B_{Q}$ exponents with two-sided 95% seed-clustered bootstrap intervals from 3,000 resamples, for the registered small- $n$ reference (orange markers) and the $n\geq 64$ measurement (blue markers) of each entangling family. Marker colour encodes the size regime. The blue dashed line marks the cone-saturated prediction of 2 and the orange dashed line the cone-limited prediction of 3.

Figure 4: The fitted exponent is an accounting identity. a Measured $B_{Q}$ exponent against the identity prediction $2+\mathrm{d}\log(nV)/\mathrm{d}\log n-\mathrm{d}\log(nG)/\mathrm{d}\log n$ for eleven blocked-entangler families. Blue circles: cone width fixed; orange squares: cone width proportional to the register. The grey dashed line is equality. Family names are on the axis of panel b . b The residual of panel a for each family (open circles, coloured as in a ) against the finite- $p$ $(1+2p)$ prefactor contribution computed independently for that family’s own $p$ grid (grey crosses). The two agree to within $0.0008$ for every family, which is why the residual is a prefactor effect and not a failure of the identity.

Figure 5: The hardware multiplier, and why the clustering unit matters. a Cost multiplier $1/\alpha^{2}$ for all 54 mirror cells on ibm_marrakesh , on a logarithmic axis, grouped by the nine $(\text{qubits},\text{depth})$ design points; pale blue circles are individual cells and the larger dark blue circle is the design-point median. The grey dotted line marks no inflation; every one of the 54 cells lies above it, from $1.10$ to $7.92$ . The orange line is the reported estimand $\overline{1/\alpha^{2}}=2.07$ and the orange band its cluster-robust two-sided 95% interval, obtained by resampling design points. b The same estimand under three interval constructions on a shared logarithmic axis: resampling the 54 rows, resampling the nine design points, and the second device ibm_fez resampled by design point. Resampling rows treats replicates sharing a device condition as independent and gives an interval about $2.2$ times narrower.

Check	Predicted	Measured	Consequence
Entangling $V=\Theta(1)$ (two-family constant)	$\mathrm{d}\log(nV)/\mathrm{d}\log n=1$	$0.37$	Readout-correlation reading of the two classes withdrawn; classes renamed for the cone; constant survives on measured $V$
$\varepsilon$ -exponent (256-qubit product ladder)	$-2$	$-1.92$ $(-1.995,-1.845)$	Attributed to shot-grid granularity; reported as a partial miss
Brickwork at scale	small- $n$ CI overlaps $n\geq 64$	$2.853\rightarrow 1.715$ , disjoint	Cubic exponent does not survive size on this family
Chain overlap test	discriminates class	passes without discriminating	Non-gating class diagnostic reported beside the pass
Positional attenuation rate	$n$ -independent	spread $0.2083$ vs $0.20$	Narrow miss; mechanism reading retained, gate not
Blocked-cone sweep, pooled estimator	pooled exponent $=2$	$2.513$ pooled, $1.949$ fixed-effects	Estimator defect; re-run rather than re-scored

Table 1: Registered checks that did not clear. Each row gives the prediction as registered before the corresponding cells were generated, the measured value, and what the failure changed in the paper. Intervals are two-sided 95%.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure A1: Calibrated intervals do not extrapolate to larger circuits. Achieved coverage of nominal 90% predictive intervals on held-out large circuits for the five rungs of the calibration ladder: a Gaussian model, split conformal calibrated on the cheap circuits, a one-variable heteroscedastic variance model, a two-variable heteroscedastic model, and an oracle that is not attainable in practice. Blue circles are the point coverages over the 24 held-out cells and the vertical bars are two-sided 95% Clopper–Pearson intervals on that binomial proportion; the design effect from clustering within design points is 1.4 to 2.7 across rungs, so these intervals are, if anything, optimistically narrow. The orange dashed line is nominal coverage. Coverage is the fraction of held-out cells inside the interval. Rungs three and four use the Gaussian-unbiased scale constant $\exp((\gamma+\ln 2)/2)=1.887$ for a fit to $\log|e|$ ; the first version of this work used $\sqrt{\pi/2}$ , the constant for a fit to $|e|$ , and reported 62.5% and 83.3% here. The attainable two-variable rung reaches nominal in 73.9% of design-point cluster resamples, with a mean half-width $1.87\times$ the oracle’s.

Claim	Value	Record	Field
One constant across families	CV $0.283$	e46_readout_variance	data.P3_parameter_free.ratio_cv_all
Pooled certification constant	$0.344$	e46_readout_variance	data.P3_parameter_free.ratio_mean
Product family to $n=256$	$1.966$ $(1.934,1.997)$	e45_large_n_scaling	data.fit_logBQ.p_exponent
Classes disjoint, no universal exponent	pass	e69_exponent_class_table	T2_pass , T3_pass
Ring-entangler exponent	$3.087$ $(2.645,3.529)$	e42_estimator_family	data.ps_exponent , data.ps_exponent_ci
Hardware multiplier	$2.070$ $(1.406,3.015)$	e68_inflation_estimand	estimand_B

Appendix

Table A1: Claim to evidence. Every numerical claim in the main text binds to a named field in a locked evidence record. Record names are the file stems of the JSON archive described under Data availability.

Explore similar work

When cheap gradients fail: the measurement cost of attacking quantum classifiers
Jul 13, 2026Bacui Li, Chandra Thapa, Tansu Alpcan +1Quantum Machine Learning Variational Quantum Circuits
Department of Electrical and Electronic Engineering, University of Melbourne, Parkville, Victoria 3010, Australia · CSIRO Data61, Marsfield, NSW 2122, Australia · School of Computing and Information Systems, University of Melbourne, Parkville, Victoria 3010, Australia
Readout-Rank Laws for Isotropic Quantum Tangents
Aug 7, 2026Marwan Ait HaddouInformation Geometry Variational Quantum Circuits
Independent Researcher, Morocco
Quantum Circuit Vision: Cost-Aware Evaluation of Visual AI Agents for Quantum Code Generation
Jul 11, 2026Dongping Liu, Aoyu Zhang, Luyao ZhangAI Agent Evaluation AI Agent Benchmarks
Amazon Web Services Hong Kong, China · Amazon Web Services Beijing, China · Digital Innovation Research Center and Social Science Division, Duke Kunshan University Address: Duke Avenue No.8, Kunshan, Suzhou, Jiangsu, China, 215316

Jul 13, 2026J/K move · Enter open · S save

When cheap gradients fail: the measurement cost of attacking quantum classifiers

Bacui Li, Chandra Thapa, Tansu Alpcan, Udaya Parampalli

Department of Electrical and Electronic Engineering, University of Melbourne, Parkville, Victoria 3010, Australia · CSIRO Data61, Marsfield, NSW 2122, Australia · School of Computing and Information Systems, University of Melbourne, Parkville, Victoria 3010, Australia

Quantum Machine Learning Variational Quantum Circuits

Open paper AskPDF arXiv

Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics (shot noise) act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. Under stated assumptions, single-step attacks need at least quadratically many shots in the input dimension

d

, growing as

d^{5/2}

under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the

d^{5/2}

geometric floor for plateau-mitigated models and grows as

d^{3.00}

for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in recovers the parameter-free

d^{3/2}

shot-noise geometry. Against a matched classical baseline whose attack overhead is dimension-independent (the cheap-gradient principle of automatic differentiation), the quantum gradient cost ratio grows empirically as

d^{3.00}

, so the attacker's relative cost diverges as the model scales. Experiments on a 156-qubit IBM processor (ibm_boston, 4-qubit circuits,

d=12

) reproduce the effect: at matched budgets the device attack tracks the ideal within a few percent, with the high-shot gradient faithful to the exact one. The defense operates precisely when the forward map is classically hard to simulate: only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.

Abstract

Explore similar work

When cheap gradients fail: the measurement cost of attacking quantum classifiers

Readout-Rank Laws for Isotropic Quantum Tangents

Quantum Circuit Vision: Cost-Aware Evaluation of Visual AI Agents for Quantum Code Generation