When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention

Owen Friedewald; Srikar Alla; Ali Shiri Sichani; Chi-Ren Shyu

quant-phOct 2, 2026

When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention

Authors: Owen Friedewald, Srikar Alla, Ali Shiri Sichani, Chi-Ren Shyu

Organizations: Department of Electrical Engineering and Computer Science University of Missouri, Columbia, MO, USA

Abstract

Removing an input-scaling module changes both a classifier and the perturbations reaching its encoder. A robustness difference can therefore reflect the comparison rule as well as the module. We demonstrate this problem in a four-qubit quantum-attention detector on generated power-grid trajectories. A learned scaling module appears beneficial at a fixed physical attack budget, but matching an upper bound on perturbations at the encoder reverses the ordering. Neither comparison alone establishes a robustness benefit caused by the module. The initial test also perturbs clean examples into attacked examples while retaining their original labels; tests restricted to already attacked examples do not establish a benefit. Replacing a trained model's input scales disrupts detection. Retraining its linear classification layer restores the detection rate, but changes individual predictions, leaving the comparison descriptive rather than causal. Two further design checks explain why the input quantum Fisher information regularizer cannot train this model's query parameters, and why removing confidence bounds does not establish a larger certified radius. The evidence is limited to ten seeds, exact simulation, synthetic data, and a restricted set of attacks; classical baselines achieve better clean prediction. The practical lesson is to specify which perturbation budget is fixed, check that attacks preserve labels and interventions preserve predictions, and distinguish exploratory controls from confirmatory evidence.

Figures & tables

Condition	Clean accuracy	AURA	Mean $R_{\mathrm{diag}}$	Procedure
Full	0.718 $\pm$ 0.047	0.358 $\pm$ 0.089	0.12947 $\pm$ 0.00283	CP bounded
$-$ EBG	0.697 $\pm$ 0.071	0.308 $\pm$ 0.088	0.05071 $\pm$ 0.00000	CP bounded
$-$ FGQA	0.718 $\pm$ 0.047	0.358 $\pm$ 0.089	0.12944 $\pm$ 0.00281	CP bounded
$-$ NACH	0.718 $\pm$ 0.047	0.358 $\pm$ 0.089	0.15956 $\pm$ 0.00349	invalid point †
No modules	0.697 $\pm$ 0.071	0.308 $\pm$ 0.088	0.06250 $\pm$ 0.00000	invalid point †

Table 1: Ten-seed endpoints (mean

\pm

sample SD). AURA uses the 20-trajectory stress-test subset; clean accuracy uses the full test split. † Point radii omit confidence bounds and are not certificates.

Panel of Figure 1 — Figure 1: Mean stress-test accuracy over ten paired seeds. Full and $-\textsc{FGQA}$ coincide at recorded precision. Curves take the worst loss over implemented PGD/SPSA candidates and all previously evaluated smaller-budget candidates. Standard deviations are in Appendix C .

Panel of Figure 2 — Figure 2: Controls on all 30 attacked test examples. Matched $-\textsc{EBG}$ uses physical budget $0.39187472\epsilon$ ; other curves use $\epsilon$ . Gain replacement disrupts detection; refitting restores the unperturbed detection rate but changes both gain and classification head.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Quantity	Value	Quantity	Value
Root seeds	3000–3009	Conditions	5 paired
Trajectories/seed	200	Train/test	140/60
Positive fraction	0.5	Tokens	6
Qubits/features	4	Reuploads	2
Variational layers	1	Entangler	ring
Initial attention $\tau$	0.8	EBG budget	1.6

Appendix

Table 2: Locked production configuration.

Knockout	Metric	Mean $\Delta$	95% BCa CI	Holm $p$	Cliff $\delta$
$-$ EBG	Clean	-0.02167	$[-0.04833,0.01500]$	1	-0.27
	AURA ∗	-0.04938	$[-0.07500,-0.03000]$	0.035156	-0.32
	Mean $R$	-0.07875	$[-0.08095,-0.07741]$	0.023438	-1.00
$-$ FGQA	Clean	0.00000	$[0.00000,0.00000]$	1	0.00
	AURA ∗	0.00000	$[0.00000,0.00000]$	1	0.00
	Mean $R$	-0.00003	$[-0.00005,-0.00001]$	0.27344	-0.05

Appendix

Table 3: All paired contrasts. Delta is condition minus full. Holm correction covers all 12 condition–metric tests. ∗ AURA ordering for gain-changing conditions is normalization-dependent; see Section 6.1 . † The radius comparator is invalid and cannot support a certificate claim.

Condition	0	0.0375	0.075	0.1125	0.15
Full	$.725\pm.109$	$.590\pm.145$	$.300\pm.125$	$.145\pm.069$	$.065\pm.053$
$-$ EBG	$.715\pm.097$	$.540\pm.126$	$.225\pm.132$	$.085\pm.067$	$.050\pm.062$
$-$ FGQA	$.725\pm.109$	$.590\pm.145$	$.300\pm.125$	$.145\pm.069$	$.065\pm.053$
$-$ NACH	$.725\pm.109$	$.590\pm.145$	$.300\pm.125$	$.145\pm.069$	$.065\pm.053$
No modules	$.715\pm.097$	$.540\pm.126$	$.225\pm.132$	$.085\pm.067$	$.050\pm.062$

Appendix

Table 4: Accuracy after attack by budget, mean

\pm

sample SD over ten seeds.

Condition	Positive AURA	$\epsilon=0$ rate	$\epsilon=0.15$ rate
Full	0.419 $\pm$ 0.079	0.655 $\pm$ 0.064	0.175 $\pm$ 0.054
$-$ EBG	0.378 $\pm$ 0.082	0.685 $\pm$ 0.106	0.120 $\pm$ 0.079
$-$ FGQA	0.419 $\pm$ 0.079	0.655 $\pm$ 0.064	0.175 $\pm$ 0.054
$-$ NACH	0.419 $\pm$ 0.079	0.655 $\pm$ 0.064	0.175 $\pm$ 0.054
No modules	0.378 $\pm$ 0.082	0.685 $\pm$ 0.106	0.120 $\pm$ 0.079

Appendix

Table 5: Positive-only endpoints (mean

\pm

sample SD).

Condition	0	0.0375	0.075	0.1125	0.15
Full	$.655\pm.064$	$.555\pm.107$	$.410\pm.099$	$.295\pm.096$	$.175\pm.054$
$-$ EBG	$.685\pm.106$	$.520\pm.116$	$.370\pm.123$	$.220\pm.103$	$.120\pm.079$
$-$ FGQA	$.655\pm.064$	$.555\pm.107$	$.410\pm.099$	$.295\pm.096$	$.175\pm.054$
$-$ NACH	$.655\pm.064$	$.555\pm.107$	$.410\pm.099$	$.295\pm.096$	$.175\pm.054$
No modules	$.685\pm.106$	$.520\pm.116$	$.370\pm.123$	$.220\pm.103$	$.120\pm.079$

Appendix

Table 6: Positive-only correct-class rate by budget (mean

\pm

sample SD).

Knockout	Metric	Mean $\Delta$	95% BCa CI	Holm $p$	Cliff $\delta$
$-$ EBG	Clean	-0.02167	$[-0.04833,0.01500]$	1	-0.27
	Positive AURA	-0.04063	$[-0.07750,-0.00625]$	0.96875	-0.26
	Mean $R$	-0.07875	$[-0.08095,-0.07741]$	0.023438	-1.00
$-$ FGQA	Clean	0.00000	$[0.00000,0.00000]$	1	0.00
	Positive AURA	0.00000	$[0.00000,0.00000]$	1	0.00
	Mean $R$	-0.00003	$[-0.00005,-0.00001]$	0.35156	-0.05

Appendix

Table 7: Post hoc positive-only contrasts. Holm correction is separate over all 12 rows. † Point-radius comparator is invalid.

Arm	Positive AURA	Final rate	Physical $\epsilon_{\max}$
Full, nominal grid	0.395 $\pm$ 0.052	0.150 $\pm$ 0.045	0.1500
$-$ EBG, unmatched grid	0.359 $\pm$ 0.046	0.107 $\pm$ 0.062	0.1500
$-$ EBG, global $L_{\rm enc}$ match	0.539 $\pm$ 0.070	0.417 $\pm$ 0.085	0.0588
$-$ EBG, paired $L_{\rm enc}$ match	0.539 $\pm$ 0.070	0.417 $\pm$ 0.085	0.0588

Appendix

Table 8: Matched-sensitivity endpoints over ten seeds. The last column is the mean maximum physical coefficient budget; matched arms intentionally use a smaller raw budget.

Component	Mean $\Delta$	95% BCa CI	Exact $p$	Holm $p$	Cliff $\delta$
Total: $N-F$ (accepted)	-0.03667	[-0.06833, -0.00625]	0.099609	–	-0.36
Gain replacement: $N-T$	0.34708	[0.32292, 0.37583]	0.0019531	0.0039062	1.00
Residual: $T-F$	-0.38375	[-0.41958, -0.34792]	0.0019531	0.0039062	-1.00

Appendix

Table 9: Gain-replacement AURA decomposition over ten paired seeds.

N

is trained no-EBG,

F

is full, and

T

inserts only full

\Gamma

into

N

. The identity

N-F=(N-T)+(T-F)

reconstructs with zero error.

Model	Parameters	Clean accuracy	Positive AURA
Quantum attention	39	0.718 $\pm$ 0.047	0.395 $\pm$ 0.052
Classical attention	39	0.527 $\pm$ 0.041	0.338 $\pm$ 0.061

Appendix

Table 10: Untuned 39-parameter classical comparison, mean

\pm

sample SD over ten seeds. AURA uses all 30 positive held-out trajectories per seed.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 481 papers

When cheap gradients fail: the measurement cost of attacking quantum classifiers
Jul 13, 2026Bacui Li, Chandra Thapa, Tansu Alpcan +1Quantum Machine Learning Variational Quantum Circuits
Department of Electrical and Electronic Engineering, University of Melbourne, Parkville, Victoria 3010, Australia · CSIRO Data61, Marsfield, NSW 2122, Australia · School of Computing and Information Systems, University of Melbourne, Parkville, Victoria 3010, Australia
Investigating Quantum-Embedded Transformers on Classical Datasets for Cross-Modality Classification
Aug 7, 2026Hao-Yuan ChenHybrid Quantum-Classical ML Variational Quantum Circuits
Computer Science, University of London
Quantum Adaptive Self-Attention for Quantum Transformer Models
Apr 5, 2025Chi-Sheng Chen, En-Jui KuoHybrid Quantum-Classical ML Transformer Attention
Department of Electrophysics, National Yang Ming Chiao Tung University, Hsinchu, Taiwan

Jul 13, 2026J/K move · Enter open · S save

When cheap gradients fail: the measurement cost of attacking quantum classifiers

Bacui Li, Chandra Thapa, Tansu Alpcan, Udaya Parampalli

Department of Electrical and Electronic Engineering, University of Melbourne, Parkville, Victoria 3010, Australia · CSIRO Data61, Marsfield, NSW 2122, Australia · School of Computing and Information Systems, University of Melbourne, Parkville, Victoria 3010, Australia

Quantum Machine Learning Variational Quantum Circuits

Open paper AskPDF arXiv

Adversarial perturbations threaten machine learning classifiers, including variational quantum classifiers. We show that finite quantum measurement statistics (shot noise) act as a built-in defense against gradient-based test-time attacks whose cost scales unfavorably for the attacker. Because every gradient component must be inferred from repeated circuit executions under any unbiased gradient-estimation rule, white-box extraction consumes a dimension-dependent measurement budget that measurement grouping cannot remove in expressive circuits. Under stated assumptions, single-step attacks need at least quadratically many shots in the input dimension

d

, growing as

d^{5/2}

under norm-concentration scaling, with a sufficient-budget analysis for iterative attacks via stochastic gradient Langevin dynamics. Simulations up to 784 input dimensions validate the law: the realized total budget is the

d^{5/2}

geometric floor for plateau-mitigated models and grows as

d^{3.00}

for the tested deep circuits, whose gradient norms decay with dimension absent barren-plateau mitigation; folding the measured gradient norm back in recovers the parameter-free

d^{3/2}

shot-noise geometry. Against a matched classical baseline whose attack overhead is dimension-independent (the cheap-gradient principle of automatic differentiation), the quantum gradient cost ratio grows empirically as

d^{3.00}

, so the attacker's relative cost diverges as the model scales. Experiments on a 156-qubit IBM processor (ibm_boston, 4-qubit circuits,

d=12

) reproduce the effect: at matched budgets the device attack tracks the ideal within a few percent, with the high-shot gradient faithful to the exact one. The defense operates precisely when the forward map is classically hard to simulate: only then is a white-box attacker denied the simulate-and-backpropagate shortcut and must pay the measurement cost we quantify.

Abstract

Adversarial Robustness

Explore similar work

When cheap gradients fail: the measurement cost of attacking quantum classifiers

Investigating Quantum-Embedded Transformers on Classical Datasets for Cross-Modality Classification

Quantum Adaptive Self-Attention for Quantum Transformer Models