{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T08:50:39Z","timestamp":1782377439799,"version":"3.54.5"},"reference-count":31,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2026,6,24]],"date-time":"2026-06-24T00:00:00Z","timestamp":1782259200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Quantum Science and Technology-National Science and Technology Major Project","award":["2021ZD0302900"],"award-info":[{"award-number":["2021ZD0302900"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>As quantum machine learning modules become increasingly integrated into NISQ-era infrastructures, it remains unclear whether intrinsic device noise can be regarded as a passive defense against adversarial examples, or whether it in fact introduces a new attack surface. To answer this question, we propose a noise-aware four-path evaluation protocol that decouples the noise assumed at attack generation from the noise present at inference, and we systematically test it on a 4-qubit variational quantum classifier over four datasets with depolarizing probabilities in the range p\u2208[0,0.3], using both standard gradient attacks and expectation over transformation (EOT)-based attacks. The results show that for some datasets, higher noise does suppress attacks, whereas for others attacks remain effective even at p=0.3, and in several cases a moderate noise level even maximizes the attack success rate. Moreover, we find that adversarial examples generated under moderate noise often attack the clean model more successfully than those generated in an ideal setting, demonstrating that noise can be actively exploited by an adversary to discover more transferable adversarial directions. Therefore, ambient noise should not be treated as a built-in security guarantee, and future quantum machine learning (QML) robustness evaluations must explicitly model such noise-aware threats.<\/jats:p>","DOI":"10.3390\/e28070719","type":"journal-article","created":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T08:14:12Z","timestamp":1782375252000},"page":"719","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Decoupling the Dual Impact of NISQ Noise on Quantum Adversarial Robustness"],"prefix":"10.3390","volume":"28","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-1079-100X","authenticated-orcid":false,"given":"Haoran","family":"Wang","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, University of Science and Technology of China, Hefei 230026, China"},{"name":"Suzhou Institute for Advanced Research, University of Science and Technology of China, Suzhou 215123, China"},{"name":"Hefei National Laboratory, University of Science and Technology of China, Hefei 230088, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shaoliang","family":"Ye","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Science and Technology of China, Hefei 230026, China"},{"name":"Hefei National Laboratory, University of Science and Technology of China, Hefei 230088, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shaowei","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Artificial Intelligence, Guangzhou University, Guangzhou 510006, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hanyi","family":"Wang","sequence":"additional","affiliation":[{"name":"China Mobile (Suzhou) Software Technology Co., Ltd., Suzhou 215000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhenbo","family":"Shi","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Science and Technology of China, Hefei 230026, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Science and Technology of China, Hefei 230026, China"},{"name":"Suzhou Institute for Advanced Research, University of Science and Technology of China, Suzhou 215123, China"},{"name":"Hefei National Laboratory, University of Science and Technology of China, Hefei 230088, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,6,24]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"7","DOI":"10.1016\/j.tcs.2014.05.025","article-title":"Quantum cryptography: Public key distribution and coin tossing","volume":"560","author":"Bennett","year":"2014","journal-title":"Theor. Comput. Sci."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1023","DOI":"10.1038\/nature07127","article-title":"The Quantum Internet","volume":"453","author":"Kimble","year":"2008","journal-title":"Nature"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"eaam9288","DOI":"10.1126\/science.aam9288","article-title":"Quantum Internet: A Vision for the Road Ahead","volume":"362","author":"Wehner","year":"2018","journal-title":"Science"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1103\/RevModPhys.74.145","article-title":"Quantum Cryptography","volume":"74","author":"Gisin","year":"2002","journal-title":"Rev. Mod. Phys."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1301","DOI":"10.1103\/RevModPhys.81.1301","article-title":"The Security of Practical Quantum Key Distribution","volume":"81","author":"Scarani","year":"2009","journal-title":"Rev. Mod. Phys."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1012","DOI":"10.1364\/AOP.361502","article-title":"Advances Quantum Cryptography","volume":"12","author":"Pirandola","year":"2020","journal-title":"Adv. Opt. Photon."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"79","DOI":"10.22331\/q-2018-08-06-79","article-title":"Quantum Computing in the NISQ Era and Beyond","volume":"2","author":"Preskill","year":"2018","journal-title":"Quantum"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"195","DOI":"10.1038\/nature23474","article-title":"Quantum Machine Learning","volume":"549","author":"Biamonte","year":"2017","journal-title":"Nature"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"074001","DOI":"10.1088\/1361-6633\/aab406","article-title":"Machine Learning and Artificial Intelligence in the Quantum Domain: A review of recent progress","volume":"81","author":"Dunjko","year":"2018","journal-title":"Rep. Prog. Phys."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"625","DOI":"10.1038\/s42254-021-00348-9","article-title":"Variational Quantum Algorithms","volume":"3","author":"Cerezo","year":"2021","journal-title":"Nat. Rev. Phys."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"043001","DOI":"10.1088\/2058-9565\/ab4eb5","article-title":"Parameterized quantum circuits as machine learning models","volume":"4","author":"Benedetti","year":"2019","journal-title":"Quantum Sci. Technol."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"209","DOI":"10.1038\/s41586-019-0980-2","article-title":"Supervised Learning with Quantum-Enhanced Feature Spaces","volume":"567","author":"Havlicek","year":"2019","journal-title":"Nature"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","article-title":"Adversarial examples: Attacks and defenses for deep learning","volume":"30","author":"Yuan","year":"2019","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. (2016). Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks. Proceedings of the 2016 IEEE Symposium on Security and Privacy, IEEE.","DOI":"10.1109\/SP.2016.41"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017). Towards Evaluating the Robustness of Neural Networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy, IEEE.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_16","unstructured":"Athalye, A., Carlini, N., and Wagner, D. (2018). Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples. Proceedings of the 35th International Conference on Machine Learning, PMLR."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"033212","DOI":"10.1103\/PhysRevResearch.2.033212","article-title":"Quantum Adversarial Machine Learning","volume":"2","author":"Lu","year":"2020","journal-title":"Phys. Rev. Res."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"062331","DOI":"10.1103\/PhysRevA.101.062331","article-title":"Vulnerability of Quantum Classification to Adversarial Perturbations","volume":"101","author":"Liu","year":"2020","journal-title":"Phys. Rev. A"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"nwab130","DOI":"10.1093\/nsr\/nwab130","article-title":"Universal Adversarial Examples and Perturbations for Quantum Classifiers","volume":"9","author":"Gong","year":"2021","journal-title":"Natl. Sci. Rev."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1007\/s42484-025-00238-8","article-title":"Quantum adversarial learning for kernel methods","volume":"7","author":"Montalbano","year":"2025","journal-title":"Quantum Mach. Intell."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"083019","DOI":"10.1088\/1367-2630\/ace8b4","article-title":"Enhancing adversarial robustness of quantum neural networks by adding noise layers","volume":"25","author":"Huang","year":"2023","journal-title":"New J. Phys."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"023186","DOI":"10.1103\/PhysRevResearch.5.023186","article-title":"Benchmarking Adversarially Robust Quantum Machine Learning at Scale","volume":"5","author":"West","year":"2023","journal-title":"Phys. Rev. Res."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"023020","DOI":"10.1103\/PhysRevResearch.6.023020","article-title":"Enhancing quantum adversarial robustness by randomized encodings","volume":"6","author":"Gong","year":"2024","journal-title":"Phys. Rev. Res."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"180509","DOI":"10.1103\/PhysRevLett.119.180509","article-title":"Error Mitigation for Short-Depth Quantum Circuits","volume":"119","author":"Temme","year":"2017","journal-title":"Phys. Rev. Lett."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"032001","DOI":"10.7566\/JPSJ.90.032001","article-title":"Hybrid Quantum\u2013Classical Algorithms and Quantum Error Mitigation","volume":"90","author":"Endo","year":"2021","journal-title":"J. Phys. Soc. Jpn."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"382","DOI":"10.1038\/s42254-020-0186-4","article-title":"Quantum Certification and Benchmarking","volume":"2","author":"Eisert","year":"2020","journal-title":"Nat. Rev. Phys."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"032331","DOI":"10.1103\/PhysRevA.99.032331","article-title":"Evaluating analytic gradients on quantum hardware","volume":"99","author":"Schuld","year":"2019","journal-title":"Phys. Rev. A"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"023153","DOI":"10.1103\/PhysRevResearch.3.023153","article-title":"Quantum noise protects quantum classifiers against adversaries","volume":"3","author":"Du","year":"2021","journal-title":"Phys. Rev. Res."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Huang, J.-C., Tsai, Y.-L., Yang, C.-H.H., Su, C.-F., Yu, C.-M., Chen, P.-Y., and Kuo, S.-Y. (2023). Certified robustness of quantum classifiers against adversarial examples through quantum noise. Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE.","DOI":"10.1109\/ICASSP49357.2023.10095030"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Hou, X. (2023). Adversarial Attack Generation in Quantum Data Classification. Proceedings of the 2023 4th International Conference on Computer Science and Management Technology (ICCSMT 2023), ACM.","DOI":"10.1145\/3644523.3644623"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1007\/s42484-024-00208-6","article-title":"Quantum neural networks under depolarization noise: Exploring white-box attacks and defenses","volume":"6","author":"Winderl","year":"2024","journal-title":"Quantum Mach. Intell."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/28\/7\/719\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T08:34:14Z","timestamp":1782376454000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/28\/7\/719"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,24]]},"references-count":31,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2026,7]]}},"alternative-id":["e28070719"],"URL":"https:\/\/doi.org\/10.3390\/e28070719","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,24]]}}}