{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,6]],"date-time":"2026-05-06T02:01:32Z","timestamp":1778032892564,"version":"3.51.4"},"publisher-location":"Cham","reference-count":41,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030816841","type":"print"},{"value":"9783030816858","type":"electronic"}],"license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2021,7,15]],"date-time":"2021-07-15T00:00:00Z","timestamp":1626307200000},"content-version":"vor","delay-in-days":195,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Several important models of machine learning algorithms have been successfully generalized to the quantum world, with potential speedup to training classical classifiers and applications to data analytics in quantum physics that can be implemented on the near future quantum computers. However, quantum noise is a major obstacle to the practical implementation of quantum machine learning. In this work, we define a formal framework for the robustness verification and analysis of quantum machine learning algorithms against noises. A robust bound is derived and an algorithm is developed to check whether or not a quantum machine learning algorithm is robust with respect to quantum training data. In particular, this algorithm can find adversarial examples during checking. Our approach is implemented on Google\u2019s TensorFlow Quantum and can verify the robustness of quantum machine learning algorithms with respect to a small disturbance of noises, derived from the surrounding environment. The effectiveness of our robust bound and algorithm is confirmed by the experimental results, including quantum bits classification as the \u201cHello World\u201d example, quantum phase recognition and cluster excitation detection from real world intractable physical problems, and the classification of MNIST from the classical world.<\/jats:p>","DOI":"10.1007\/978-3-030-81685-8_7","type":"book-chapter","created":{"date-parts":[[2021,7,17]],"date-time":"2021-07-17T00:02:35Z","timestamp":1626480155000},"page":"151-174","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":34,"title":["Robustness Verification of Quantum Classifiers"],"prefix":"10.1007","author":[{"given":"Ji","family":"Guan","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wang","family":"Fang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mingsheng","family":"Ying","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2021,7,15]]},"reference":[{"issue":"6325","key":"7_CR1","doi-asserted-by":"publisher","first-page":"602","DOI":"10.1126\/science.aag2302","volume":"355","author":"G Carleo","year":"2017","unstructured":"Carleo, G., Troyer, M.: Solving the quantum many-body problem with artificial neural networks. Science 355(6325), 602\u2013606 (2017)","journal-title":"Science"},{"key":"7_CR2","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511976667","volume-title":"Quantum Computation and Quantum Information","author":"MA Nielsen","year":"2010","unstructured":"Nielsen, M.A., Chuang, I.L.: Quantum Computation and Quantum Information. Cambridge University Press, Cambridge (2010)"},{"issue":"7671","key":"7_CR3","doi-asserted-by":"publisher","first-page":"195","DOI":"10.1038\/nature23474","volume":"549","author":"J Biamonte","year":"2017","unstructured":"Biamonte, J., Wittek, P., Pancotti, N., Rebentrost, P., Wiebe, N., Lloyd, S.: Quantum machine learning. Nature 549(7671), 195\u2013202 (2017)","journal-title":"Nature"},{"issue":"7","key":"7_CR4","doi-asserted-by":"publisher","first-page":"074001","DOI":"10.1088\/1361-6633\/aab406","volume":"81","author":"V Dunjko","year":"2018","unstructured":"Dunjko, V., Briegel, H.J.: Machine learning & artificial intelligence in the quantum domain: a review of recent progress. Rep. Prog. Phys. 81(7), 074001 (2018)","journal-title":"Rep. Prog. Phys."},{"issue":"12","key":"7_CR5","doi-asserted-by":"publisher","first-page":"1273","DOI":"10.1038\/s41567-019-0648-8","volume":"15","author":"I Cong","year":"2019","unstructured":"Cong, I., Choi, S., Lukin, M.D.: Quantum convolutional neural networks. Nat. Phys. 15(12), 1273\u20131278 (2019)","journal-title":"Nat. Phys."},{"key":"7_CR6","doi-asserted-by":"crossref","unstructured":"Huang, H.-Y., Kueng, R., Preskill, J.: Information-theoretic bounds on quantum advantage in machine learning. arXiv preprint arXiv:2101.02464 (2021)","DOI":"10.1103\/PhysRevLett.126.190505"},{"key":"7_CR7","unstructured":"Broughton, M., et al.: TensorFlow quantum: a software framework for quantum machine learning. arXiv preprint arXiv:2003.02989 (2020). See https:\/\/www.tensorflow.org\/quantum for the platform"},{"key":"7_CR8","doi-asserted-by":"crossref","unstructured":"Huang, L., Joseph, A.D., Nelson, B., Rubinstein, B.I.P., Tygar, J.D.: Adversarial machine learning. In: Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence, pp. 43\u201358 (2011)","DOI":"10.1145\/2046684.2046692"},{"key":"7_CR9","unstructured":"Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, 7\u20139 May 2015, Conference Track Proceedings (2015)"},{"key":"7_CR10","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, 30 April\u20133 May 2018, Conference Track Proceedings. OpenReview.net (2018)"},{"key":"7_CR11","doi-asserted-by":"crossref","unstructured":"Carlini, N., Wagner, D.: Adversarial examples are not easily detected: bypassing ten detection methods. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3\u201314 (2017)","DOI":"10.1145\/3128572.3140444"},{"key":"7_CR12","unstructured":"Brown, T.B., Man\u00e9, D., Roy, A., Abadi, M., Gilmer, J.: Adversarial patch. arXiv preprint arXiv:1712.09665 (2017)"},{"key":"7_CR13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1007\/978-3-030-53288-8_2","volume-title":"Computer Aided Verification","author":"H-D Tran","year":"2020","unstructured":"Tran, H.-D., Bak, S., Xiang, W., Johnson, T.T.: Verification of deep convolutional neural networks using ImageStars. In: Lahiri, S.K., Wang, C. (eds.) CAV 2020. LNCS, vol. 12224, pp. 18\u201342. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-53288-8_2"},{"key":"7_CR14","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1007\/978-3-030-53288-8_3","volume-title":"Computer Aided Verification","author":"YY Elboher","year":"2020","unstructured":"Elboher, Y.Y., Gottschlich, J., Katz, G.: An abstraction-based framework for neural network verification. In: Lahiri, S.K., Wang, C. (eds.) CAV 2020. LNCS, vol. 12224, pp. 43\u201365. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-53288-8_3"},{"key":"7_CR15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"122","DOI":"10.1007\/978-3-030-53288-8_6","volume-title":"Computer Aided Verification","author":"DJ Fremont","year":"2020","unstructured":"Fremont, D.J., Chiu, J., Margineantu, D.D., Osipychev, D., Seshia, S.A.: Formal analysis and redesign of a neural network-based aircraft taxiing system with VerifAI. In: Lahiri, S.K., Wang, C. (eds.) CAV 2020. LNCS, vol. 12224, pp. 122\u2013134. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-53288-8_6"},{"key":"7_CR16","unstructured":"Kwiatkowska, M.Z.: Safety verification for deep neural networks with provable guarantees (invited paper). In: Fokkink, W.J., van Glabbeek, R. (eds.) 30th International Conference on Concurrency Theory, CONCUR 2019, Amsterdam, the Netherlands, 27\u201330 August 2019. LIPIcs, vol. 140, pp. 1:1\u20131:5. Schloss Dagstuhl - Leibniz-Zentrum f\u00fcr Informatik (2019)"},{"key":"7_CR17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"432","DOI":"10.1007\/978-3-030-25540-4_25","volume-title":"Computer Aided Verification","author":"T Dreossi","year":"2019","unstructured":"Dreossi, T., et al.: VerifAI: a toolkit for the formal design and analysis of artificial intelligence-based systems. In: Dillig, I., Tasiran, S. (eds.) CAV 2019. LNCS, vol. 11561, pp. 432\u2013442. Springer, Cham (2019). https:\/\/doi.org\/10.1007\/978-3-030-25540-4_25"},{"key":"7_CR18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/978-3-030-53288-8_1","volume-title":"Computer Aided Verification","author":"H-D Tran","year":"2020","unstructured":"Tran, H.-D., et al.: NNV: the neural network verification tool for deep neural networks and learning-enabled cyber-physical systems. In: Lahiri, S.K., Wang, C. (eds.) CAV 2020. LNCS, vol. 12224, pp. 3\u201317. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-53288-8_1"},{"key":"7_CR19","doi-asserted-by":"publisher","first-page":"033212","DOI":"10.1103\/PhysRevResearch.2.033212","volume":"2","author":"L Sirui","year":"2020","unstructured":"Sirui, L., Duan, L.-M., Deng, D.-L.: Quantum adversarial machine learning. Phys. Rev. Res. 2, 033212 (2020)","journal-title":"Phys. Rev. Res."},{"key":"7_CR20","doi-asserted-by":"crossref","unstructured":"Du, Y., Hsieh, M.-H., Liu, T., Tao, D., Liu, N.: Quantum noise protects quantum classifiers against adversaries. arXiv preprint arXiv:2003.09416 (2020)","DOI":"10.1103\/PhysRevResearch.3.023153"},{"issue":"6","key":"7_CR21","doi-asserted-by":"publisher","first-page":"062331","DOI":"10.1103\/PhysRevA.101.062331","volume":"101","author":"N Liu","year":"2020","unstructured":"Liu, N., Wittek, P.: Vulnerability of quantum classification to adversarial perturbations. Phys. Rev. A 101(6), 062331 (2020)","journal-title":"Phys. Rev. A"},{"issue":"1","key":"7_CR22","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1038\/s41534-021-00410-5","volume":"7","author":"M Weber","year":"2021","unstructured":"Weber, M., Liu, N., Li, B., Zhang, C., Zhao, Z.: Optimal provable robustness of quantum classification via quantum hypothesis testing. npj Quantum Inf. 7(1), 1\u201312 (2021)","journal-title":"npj Quantum Inf."},{"issue":"3","key":"7_CR23","doi-asserted-by":"publisher","first-page":"254","DOI":"10.1016\/S0019-9958(67)90302-6","volume":"10","author":"CW Helstrom","year":"1967","unstructured":"Helstrom, C.W.: Detection theory and quantum mechanics. Inf. Control 10(3), 254\u2013291 (1967)","journal-title":"Inf. Control"},{"key":"7_CR24","doi-asserted-by":"crossref","unstructured":"Sharif, M., Bauer, L., Reiter, M.K.: On the suitability of Lp-norms for creating and preventing adversarial examples. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 1605\u20131613 (2018)","DOI":"10.1109\/CVPRW.2018.00211"},{"issue":"1","key":"7_CR25","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1038\/s41534-020-00339-1","volume":"7","author":"TF Roque","year":"2021","unstructured":"Roque, T.F., Clerk, A.A., Ribeiro, H.: Engineering fast high-fidelity quantum operations with constrained interactions. npj Quantum Inf. 7(1), 1\u201317 (2021)","journal-title":"npj Quantum Inf."},{"issue":"5","key":"7_CR26","doi-asserted-by":"publisher","first-page":"053420","DOI":"10.1103\/PhysRevA.83.053420","volume":"83","author":"BT Torosov","year":"2011","unstructured":"Torosov, B.T., Vitanov, N.V.: Smooth composite pulses for high-fidelity quantum information processing. Phys. Rev. A 83(5), 053420 (2011)","journal-title":"Phys. Rev. A"},{"issue":"2","key":"7_CR27","first-page":"10","volume":"1","author":"E Farhi","year":"2020","unstructured":"Farhi, E., Neven, H., et al.: Classification with quantum neural networks on near term processors. Quantum Rev. Lett. 1(2), 10\u201337686 (2020)","journal-title":"Quantum Rev. Lett."},{"key":"7_CR28","doi-asserted-by":"crossref","unstructured":"Oh, S., Choi, J., Kim, J.: A tutorial on quantum convolutional neural networks (QCNN). In: 2020 International Conference on Information and Communication Technology Convergence (ICTC), pp. 236\u2013239. IEEE (2020)","DOI":"10.1109\/ICTC49870.2020.9289439"},{"issue":"20","key":"7_CR29","doi-asserted-by":"publisher","first-page":"200502200502","DOI":"10.1103\/PhysRevLett.100.200502","volume":"100","author":"AH Myerson","year":"2008","unstructured":"Myerson, A.H., et al.: High-fidelity readout of trapped-ion qubits. Phys. Rev. Lett. 100(20), 200502200502 (2008)","journal-title":"Phys. Rev. Lett."},{"issue":"4","key":"7_CR30","doi-asserted-by":"publisher","first-page":"040302","DOI":"10.1103\/PhysRevA.81.040302","volume":"81","author":"AH Burrell","year":"2010","unstructured":"Burrell, A.H., Szwer, D.J., Webster, S.C., Lucas, D.M.: Scalable simultaneous multiqubit readout with 99.99% single-shot fidelity. Phys. Rev. A 81(4), 040302 (2010)","journal-title":"Phys. Rev. A"},{"key":"7_CR31","doi-asserted-by":"crossref","unstructured":"Guan, J., Fang, W., Ying, M.: Robustness verification of quantum classifiers. arXiv preprint arXiv:2008.07230 (2020)","DOI":"10.1007\/978-3-030-81685-8_7"},{"key":"7_CR32","doi-asserted-by":"crossref","unstructured":"Ruan, W., Wu, M., Sun, Y., Huang, X., Kroening, D., Kwiatkowska, M.: Global robustness evaluation of deep neural networks with provable guarantees for the hamming distance. In: Kraus, S. (ed.) Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI 2019, Macao, China, 10\u201316 August 2019, pp. 5944\u20135952. ijcai.org (2019)","DOI":"10.24963\/ijcai.2019\/824"},{"key":"7_CR33","unstructured":"Lomuscio, A., Maganti, L.: An approach to reachability analysis for feed-forward ReLU neural networks. arXiv preprint arXiv:1706.07351 (2017)"},{"key":"7_CR34","unstructured":"Tjeng, V., Xiao, K.Y., Tedrake, R.: Evaluating robustness of neural networks with mixed integer programming. In: 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, 6\u20139 May 2019. OpenReview.net (2019)"},{"key":"7_CR35","unstructured":"Bastani, O., Ioannou, Y., Lampropoulos, L., Vytiniotis, D., Nori, A.V., Criminisi, A.: Measuring neural net robustness with constraints. In: Lee, D.D., Sugiyama, M., von Luxburg, U., Guyon, I., Garnett, R. (eds.) Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016, Barcelona, Spain, 5\u201310 December 2016, pp. 2613\u20132621 (2016)"},{"key":"7_CR36","doi-asserted-by":"crossref","unstructured":"Zhang, R.Y., Lavaei, J.: Sparse semidefinite programs with near-linear time complexity. In: 2018 IEEE Conference on Decision and Control (CDC), pp. 1624\u20131631. IEEE (2018)","DOI":"10.1109\/CDC.2018.8619478"},{"key":"7_CR37","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"97","DOI":"10.1007\/978-3-319-63387-9_5","volume-title":"Computer Aided Verification","author":"G Katz","year":"2017","unstructured":"Katz, G., Barrett, C., Dill, D.L., Julian, K., Kochenderfer, M.J.: Reluplex: an efficient SMT solver for verifying deep neural networks. In: Majumdar, R., Kun\u010dak, V. (eds.) CAV 2017. LNCS, vol. 10426, pp. 97\u2013117. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-63387-9_5"},{"issue":"83","key":"7_CR38","first-page":"1","volume":"17","author":"S Diamond","year":"2016","unstructured":"Diamond, S., Boyd, S.: CVXPY: a Python-embedded modeling language for convex optimization. J. Mach. Learn. Res. 17(83), 1\u20135 (2016)","journal-title":"J. Mach. Learn. Res."},{"key":"7_CR39","unstructured":"Kingma, D.P., Ba, J.: Adam: a method for stochastic optimization. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, 7\u20139 May 2015, Conference Track Proceedings (2015)"},{"issue":"23","key":"7_CR40","doi-asserted-by":"publisher","first-page":"235303","DOI":"10.1088\/1751-8113\/41\/23\/235303","volume":"41","author":"RA Bertlmann","year":"2008","unstructured":"Bertlmann, R.A., Krammer, P.: Bloch vectors for qudits. J. Phys. A Math. Theor. 41(23), 235303 (2008)","journal-title":"J. Phys. A Math. Theor."},{"key":"7_CR41","unstructured":"LeCun, Y., Cortes, C.: MNIST handwritten digit database (2010). http:\/\/yann.lecun.com\/exdb\/mnist\/"}],"container-title":["Lecture Notes in Computer Science","Computer Aided Verification"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-81685-8_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,1,4]],"date-time":"2023-01-04T18:41:40Z","timestamp":1672857700000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-81685-8_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"ISBN":["9783030816841","9783030816858"],"references-count":41,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-81685-8_7","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]},"assertion":[{"value":"15 July 2021","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"CAV","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Computer Aided Verification","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2021","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20 July 2021","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 July 2021","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"33","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"cav2021","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/i-cav.org\/2021\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"290","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"63","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"22% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"12","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"16 tool papers and 5 invited papers are also included.","order":10,"name":"additional_info_on_review_process","label":"Additional Info on Review Process","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}