Superior resilience to poisoning and amenability to unlearning in quantum machine learning

Shi-Xin Zhang; Yu-Qin Chen

REVIEW 4 major objections 6 minor 82 references

Superior resilience to poisoning and amenability to unlearning in quantum machine learning

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Quantum neural networks hold their accuracy against label noise up to a 50% corruption rate, then fail through a sharp transition, while classical networks degrade continuously.

desk verdict Real first benchmarks for quantum unlearning, but the fundamental quantum resilience claim is confounded by an unregularized classical baseline. read the letter →

arxiv 2508.02422 v1 pith:MRLFHHP7 submitted 2025-08-04 quant-ph cs.LG

Yu-Qin Chen , Shi-Xin Zhang This is my paper · ORCID

classification quant-phcs.LG

keywords quantummachinelearningneuralnetworkdatapoisoninglabelflippingunlearninglosslandscapegeometryHessiantracegeneralization

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that, on small binary classification tasks, a parameterized quantum circuit learns differently from a classical multilayer perceptron when training labels are corrupted. Under label flipping, the classical network's validation accuracy falls continuously from the first bit of noise, while the quantum model holds a high-accuracy plateau until roughly half the labels are flipped, then collapses through a sharp, phase-transition-like change. The paper also introduces quantum machine unlearning and reports that approximate unlearning methods erase poisoned data quickly from quantum models, often beating retraining from scratch in the same step budget, whereas the classical model's corrupted memories resist cheap erasure. A Hessian-based landscape analysis and an analytic two-model derivation trace both advantages to a single property: the quantum loss landscape stays structurally stable under corruption, with a curvature-canceling term that the classical model lacks. If correct, the result reframes near-term quantum advantage as a robustness and trustworthiness benefit rather than only a speedup.

What carries the argument

The load-bearing object is the Hessian of the loss at the trained parameters, summarized by the Landscape Roughening Ratio (LRR), the trace of the Hessian after poisoned training divided by the trace after clean training. An LRR near 1 means the geometry of the minimum is unchanged by corruption; a large LRR means the model has deformed into a sharp, brittle basin. The paper pairs this empirical measure with an analytic minimal model: a one-parameter sigmoid neuron versus a single-qubit classifier whose logit is $\cos(\pi x + \theta)$. The derivation shows the classical Hessian is $x^2 p(1-p)$, strictly non-negative, while the quantum Hessian adds a data-error-phase term $-(p-y)\cos(\pi x+\theta)$ whose sign can be negative for outliers the model refuses to fit, providing a curvature-balancing mechanism that keeps the landscape stable.

What would settle it

Run the same label-flipping experiments on a classical MLP with weight decay, dropout, early stopping, or flat-minimum-favoring training; if any of these produces a robust plateau near $\alpha=0.5$, the claimed intrinsic quantum advantage is challenged. A second check is to raise QNN circuit depth into a regime with barren plateaus and measure LRR: if stability disappears as depth grows, the resilience is a small-circuit phenomenon rather than a generic quantum property.

Watch

Extended reading notes

Core claim

On both the MNIST 1-vs-9 task and the XXZ ground-state phase task, the QNN exhibits a signal-dominated phase for label-flip noise ratio $\alpha < 0.5$ and a noise-dominated phase for $\alpha > 0.5$, with validation accuracy dropping sharply near $\alpha_c \approx 0.5$; the MLP instead shows continuous degradation. For feature randomization, both models tolerate moderate noise, but the QNN remains unaffected even at high corruption in the data-scarce XXZ regime. In unlearning experiments at $\alpha=0.3$, finetune, scrub, and gradient ascent leave the MLP far below the retrain baseline, while the same approximate methods on the QNN recover validation accuracy comparable to, and sometimes better than, retraining within 50 unlearning steps after a transient dip. The proposed mechanism is the Landscape Roughening Ratio (LRR): the MLP's Hessian trace grows by orders of magnitude under poisoning ($\mathrm{LRR} \sim 10^2$), while the QNN's LRR stays near unity. The paper derives on minimal single-neuron and single-qubit models that the MLP Hessian is built from non-negative terms, whereas the QNN Hessian contains an error-phase interaction term that can be negative for mislabeled outliers, actively balancing curvature.

Load-bearing premise

The comparison rests on treating the unregularized ReLU MLP as a fair representative of classical machine learning; because the study varies model size but not regularization, the observed contrast could in principle be a regularization or encoding effect rather than a fundamental classical-quantum difference.

Editorial extensions

If this is right

A QNN trained on data with up to about 50% flipped labels can be trusted to generalize nearly as well as on clean data, whereas an MLP's validation accuracy erodes from the first flipped label.
Approximate unlearning on a QNN can outperform exact retraining within a fixed step budget, so correcting a poisoned quantum model may be cheaper than rebuilding it.
The classical MLP's stubborn memories are quantitatively visible in its Hessian: its loss landscape becomes orders of magnitude sharper under poisoning, which explains why cheap unlearning fails.
The resilient behavior is not a capacity artifact: it persists across MLP sizes and QNN depths in the supplemental study.
The phase transition at $\alpha=0.5$ gives a concrete operational warning: below half corruption the quantum model keeps signal, above half it switches to fitting noise.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the mechanism is landscape stability rather than quantumness per se, then classical training methods that favor flat minima might reproduce the plateau; a test would be label-flipping experiments on MLPs with weight decay, dropout, or sharpness-aware optimization.
The paper assumes the forget set and the corruption are fully known, and it explicitly leaves hardware noise out; whether device noise strengthens or erases the resilience is an open empirical question the authors flag.
The $\alpha=0.5$ critical point resembles the threshold where flipped labels carry no net class information, suggesting the QNN's inductive bias may be performing a form of robust majority-vote learning; connecting this to label-noise-robustness theory could give a quantitative prediction.
For applications, the unlearning result suggests quantum models may be attractive where privacy erasure or data correction is frequent, but only if users can identify exactly which samples to forget.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear colleague,

The paper is worth reading but not for the reason the authors advertise. It is the first systematic comparison of a QNN and an MLP under label-flipping poisoning, and the first to port classical approximate unlearning methods (finetune, scrub, gradient ascent) to quantum models. That part is genuinely new and useful. The experiments look real: two datasets, five runs each, training/validation curves, and a supplementary forgetting-accuracy measurement that directly supports the unlearning story. The analytic Hessian for the single-neuron and single-qubit models is a nice, honest illustration of how the quantum logit can produce sign-changing curvature.

The soft spot is the central claim. Calling the QNN's resilience 'fundamental' or 'intrinsic' is not justified by the evidence. The classical baseline is one MLP with two ReLU hidden layers, sigmoid output, and no explicit regularization, weight decay, dropout, or early stopping. A high-capacity unregularized network is exactly the model that would overfit label noise. The QNN, through amplitude encoding and a finite-dimensional circuit, has an implicit regularization bias. So the observed plateau is just as likely a regularization effect as a quantum effect. The Supplemental capacity study varies width and depth but never regularization, so it does not close this gap. A regularized MLP, or even logistic regression, is the missing control.

The alpha=0.5 transition is also not quantum-specific. Under symmetric label flipping, any learner that tracks the majority label will show high accuracy below 0.5 poisoning and collapse above it. Framing it as a 'phase transition' is rhetorical, not evidence of a quantum mechanism. The Hessian derivation is a correct minimal toy model, but it does not establish that the full QNN's landscape stability is quantum in origin.

The unlearning comparison has a fairness issue. The unlearning loss weights were selected after preliminary experiments, and the QNN's retrain baseline is slower, so the approximate methods 'outperform' retrain within a fixed step window. That is a timing artifact unless the compute budgets are justified.

Still, the paper deserves a serious referee. The empirical phenomena are plausible and the unlearning direction is timely. The fix is straightforward: add regularized classical controls, report clean baselines, and temper the language from 'fundamental difference' to 'difference under these architectures.' As is, I would not cite it for the strong claim, but I would cite it for the first quantum unlearning benchmarks.

For peer review: send it out, but with the expectation of a major revision.

Referee Report

4 major / 6 minor

Summary. The paper compares a classical MLP and a variational QNN on binary classification tasks (MNIST digits 1 vs 9 and XXZ ground-state phases) under two data-corruption protocols, label flipping and feature randomization. It reports that the MLP's validation accuracy degrades continuously with label noise, while the QNN exhibits a robust plateau followed by a sharp transition near alpha = 0.5, and that in unlearning from poisoned models, approximate methods underperform retraining for the MLP but can match or exceed retraining for the QNN within a fixed step budget. The authors attribute the difference to loss-landscape geometry, quantified by the Landscape Roughening Ratio, and support this with an analytical Hessian computation for single-neuron and single-qubit models.

Significance. If the central claims are supported, the paper would identify a practically relevant robustness and unlearning advantage for QNNs and would help launch quantum machine unlearning as a research area. The experiments are real and the reported trends are plausible for the specific models; the inclusion of two tasks and a capacity-variation study is a strength. However, the headline claim of a fundamental classical-versus-quantum difference is not yet established because the classical baseline is a single unregularized MLP, the alpha = 0.5 transition is expected for any majority-label learner, and the Hessian-based mechanism is demonstrated only on minimal models. The paper's own Discussion acknowledges the limited architecture and dataset scope, which is honest but in tension with the abstract's 'fundamental difference' framing.

major comments (4)

[Methods, Model architectures; Supplemental II] The classical baseline is a single unregularized ReLU MLP with no weight decay, dropout, early stopping, or other capacity control, while the QNN uses amplitude encoding into a finite-dimensional normalized feature space. The capacity study in Supplemental II varies MLP hidden-layer sizes and QNN circuit depths but never varies regularization, so it cannot exclude the standard explanation that any model with sufficient regularization or an effective inductive bias toward simple boundaries will track the majority label and appear robust. To support the 'intrinsic' or 'fundamental' claim, the authors should include classical controls such as L2-regularized or dropout-regularized MLPs, early stopping, a smaller-capacity classical model, or a kernel method, and show whether the qualitative QNN plateau and unlearning advantage survive or disappear.
[Results A, Fig. 2c,d] Under symmetric binary label flipping, the sharp transition at alpha = 0.5 is exactly what a majority-label learner produces: for alpha < 0.5 the clean label is the class majority and accuracy stays high, while for alpha > 0.5 the flipped label becomes the majority and accuracy collapses. The paper's interpretation of this as a 'critical transition' and as evidence that label noise is 'an irrelevant perturbation' for QNNs is therefore not yet substantiated as a quantum-specific mechanism. The authors should compare against a classical model known to exhibit majority-label behavior (e.g., a regularized logistic regression or a nearest-centroid classifier) and plot its full accuracy-versus-alpha curve alongside the QNN, so that the reader can see whether the QNN is doing anything beyond implementing a robust majority vote.
[Results C, Eq. (1); Supplemental I] The Landscape Roughening Ratio compares Hessian traces of models with very different architectures, parameter counts, and optimization trajectories, and the analytical derivation in Supplemental I is limited to a single neuron and a single qubit with a scalar feature. The claim that the QNN's Hessian contains a 'curvature-balancing' term that damps the influence of mislabeled outliers is not demonstrated for the full amplitude-encoded circuits used in the main experiments. The mechanistic conclusion needs direct evidence on the actual trained models, such as a decomposition of the full Hessian into positive and negative contributions, an ablation that removes or flips the proposed error-phase interaction term, or a demonstration that the LRR difference is not an artifact of different parameter scales or of evaluating on only 100 samples as described in Supplemental IV D.
[Results B, Figs. 3a,b; Supplemental IV C] The unlearning comparison is conducted within a fixed 50-step budget, with unlearning loss weights selected after 'preliminary experiments', and no clean baselines are reported in the main text: the reader does not see the validation accuracy of a model trained only on clean data for the same number of steps, or the pre-poisoning accuracy of the original models. Without these references, the claim that approximate unlearning 'can achieve superior performance to retrain from scratch within the same training time window' may be an artifact of the QNN's slower random-initialization convergence and of the specific step count and hyperparameters. The authors should include robustness checks across training budgets and learning rates, report the clean-trained baseline, and disclose how sensitive the unlearning rankings are to the chosen loss weights.

minor comments (6)

[Introduction] The paper states that quantum machine unlearning is 'an entirely unexplored area' and that the work establishes 'the first-ever framework' for it; the authors should verify this against the wider unlearning and data-deletion literature and cite any prior work on quantum deletion or privacy, or soften the novelty claim.
[Eq. (8) and Supplemental IV C] The notation for the forgetting weight is inconsistent: Eq. (8) uses lambda_fo, while the text and Supplemental IV C use lambda_f o and beta interchangeably; please unify.
[Fig. 2] Please explicitly show the alpha = 0 clean-data validation accuracy for both models, with error bars, so that the 'plateau' can be calibrated against the noise-free performance.
[Supplemental IV and Results B] The paper should report the number of trainable parameters for each model and the total number of optimization steps used in the initial poisoning phase, since the 'same training time window' comparison in unlearning depends on these details.
[Throughout] The phrase 'phase transition' is used descriptively; consider adding a statistical characterization of the sharpness of the accuracy drop (e.g., fitting a transition curve and reporting its width) or softening the critical-phenomena language to match the evidence.
[Minor typos] There are small textual errors, including 'forgeting' in Results B, 'NeuIPS' in reference [63], and inconsistent spelling of 'Kullback-Leibler' in the Methods; these should be corrected.

Circularity Check

0 steps flagged · score 1.0 of 10

The central resilience and unlearning comparisons are independent empirical measurements; self-citations are present but not load-bearing, and no prediction reduces to a fitted input or imported uniqueness theorem.

full rationale

The paper's central claims—QNN robustness plateau with a transition near alpha=0.5, superior approximate-unlearning plasticity, and the Hessian/LRR landscape analysis—rest on empirical measurements and self-contained analytical derivations, not on fits that reproduce their own inputs. The minimal-model Hessian in Supplemental I (Eqs. S7-S15) is computed from first principles for specified single-neuron and single-qubit classifiers; the sign of the QNN 'Term B' is derived, not assumed, and the derivation nowhere assumes the empirical plateau it is invoked to explain. The LRR (Eq. 1) is a post-hoc characterization of already-trained models, so its causal framing as the 'origin' of resilience is an interpretive leap rather than a circular reduction: the ratio is not fitted to the accuracy outcome nor defined in terms of it. Self-citations (Refs. 26, 27, 40, 44, 70, 75) are contextual or tool-related; the generalization-theory support in the Discussion cites Caro et al. [60], which is not authored by the present authors, so it is independent support. The unlearning loss weights in Supplemental IV were selected after preliminary experiments, but they are hyperparameters for the unlearning algorithms, not fitted values that force the reported validation-accuracy comparison by construction. The sharp transition at alpha=0.5 is an observed data feature; the paper's phase-transition framing may be overstated, and the unregularized MLP baseline is a fairness-of-comparison concern, but neither constitutes equivalence of the output to the input by definition. Score 1 reflects minor non-load-bearing self-citation (TensorCircuit [75], barren-plateau discussion [70]) without any demonstrated reduction of the central claims.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on modeling choices (unregularized MLP, amplitude-encoded QNN), an external generalization guarantee, and the defined metric LRR. No new physical entities are introduced; LRR is a defined diagnostic quantity, not an entity.

free parameters (3)

MLP hidden layer sizes = [64,16] for XXZ; [16,4] for MNIST
Chosen to achieve effective learning in Methods; the large unregularized MLP is the baseline against which the QNN is judged, so this choice affects the central comparison.
QNN circuit depth and qubit count = depth 4 and 12 qubits for XXZ; depth 6 and 10 qubits for MNIST
Chosen for effective learning; the small parameter count of the QNN may drive the robustness plateau rather than any uniquely quantum effect.
Unlearning loss weights = lambda_kl=0.0, lambda_fo=0.2, beta=0.2
Selected after preliminary experiments in Supplement IV C, so the unlearning comparison is tuned to show the desired fast-recovery behavior.

assumptions (4)

domain assumption The unregularized high-capacity MLP fairly represents classical machine learning.
The classical-versus-quantum contrast assumes the MLP's brittle memorization is characteristic of classical models; no regularized classical baseline is tested. See Methods 'Model architectures'.
domain assumption Amplitude encoding plus the chosen variational ansatz is a faithful representation of a QNN.
The QNN's input encoding and ansatz determine its inductive bias; the paper assumes this is representative of QML generally rather than an artifact of this specific encoding.
domain assumption The external generalization guarantee from Caro et al. [60] applies and explains active robustness to poisoned data.
The Discussion invokes Ref. [60] to argue QNNs preserve a generalizable solution; this external guarantee is assumed to transfer to the poisoned-training setting.
domain assumption The Hessian trace ratio (LRR) is a valid normalized measure of landscape stability across different architectures.
The paper defines LRR in Eq. 1 and uses it to compare MLP and QNN landscapes, but the absolute Hessian scales differ greatly between the two architectures.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Superior resilience to poisoning and amenability to unlearning in quantum machine learning." pith.science (2026). https://pith.science/paper/MRLFHHP7

@misc{pith2026250802422,
  author       = {Pith},
  title        = {Pith review of: Superior resilience to poisoning and amenability to unlearning in quantum machine learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MRLFHHP7}},
  note         = {Machine review of arXiv:2508.02422}
}

read the original abstract

The reliability of artificial intelligence hinges on the integrity of its training data, a foundation often compromised by noise and corruption. Here, through a comparative study of classical and quantum neural networks on both classical and quantum data, we reveal a fundamental difference in their response to data corruption. We find that classical models exhibit brittle memorization, leading to a failure in generalization. In contrast, quantum models demonstrate remarkable resilience, which is underscored by a phase transition-like response to increasing label noise, revealing a critical point beyond which the model's performance changes qualitatively. We further establish and investigate the field of quantum machine unlearning, the process of efficiently forcing a trained model to forget corrupting influences. We show that the brittle nature of the classical model forms rigid, stubborn memories of erroneous data, making efficient unlearning challenging, while the quantum model is significantly more amenable to efficient forgetting with approximate unlearning methods. Our findings establish that quantum machine learning can possess a dual advantage of intrinsic resilience and efficient adaptability, providing a promising paradigm for the trustworthy and robust artificial intelligence of the future.

Figures

Figures reproduced from arXiv: 2508.02422 by the authors.

**Figure 2.** FIG. 2 [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** FIG. 3 [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: FIG. 4 [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

82 extracted references · 59 canonical work pages

[1]

RX RX RX RX R Y R Y R Y R Y R Y RX RX RX RX RX RZZ RZZ RZZ RZZ

Two real-valued vectors,θreal and θimag, are drawn from a normal (Gaussian) distribution, where each component is sampled independently: (θreal)j, (θimag)j ∼ N(µ = 0, σ2 = 1) (4) RX ... RX RX RX RX R Y R Y R Y R Y R Y RX RX RX RX RX RZZ RZZ RZZ RZZ ... Input Dense Dense ReLU ReLU Output Sigmoid a b FIG. 4. Model Architectures. a, Schematic of the QNN arch...
[2]

The poisoned input vector is then constructed us- ing these random vectors as its real and imaginary parts and finally get normalized: x′ poison = θreal + i · θimag (5) This method completely destroys the original feature structure, forcing the model to associate a label with meaningless random noise, which can severely damage the learned feature represen...
[3]

LeCun, Y

Y. LeCun, Y. Bengio, and G. Hinton, Deep learning, Nature 521, 436 (2015)

2015
[4]

M. I. Jordan and T. M. Mitchell, Machine learning: Trends, perspectives, and prospects, Science 349, 255 (2015). 10

work page 2015
[5]

Vaswani, N

A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, Attention is all you need, NeurIPS (2017)

work page 2017
[6]

Barreno, B

M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, Can machine learning be secure?, Proceed- ings of the 2006 ACM Symposium on Information, com- puter and communications security , 16 (2006)

work page 2006
[7]

Goldblum, D

M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Song, A. Madry, B. Li, and T. Goldstein, Dataset security for machine learn- ing: Data poisoning, backdoor attacks, and defenses, IEEE Transactions on Pattern Analysis and Machine Intelligence 45, 1563 (2022)

work page 2022
[8]

Z. Tian, L. Cui, J. Liang, and S. Yu, A comprehensive survey on poisoning attacks and countermeasures in ma- chine learning, ACM Computing Surveys55, 1 (2023)

work page 2023

Show all 82 references

[9]

P. Zhao, W. Zhu, P. Jiao, D. Gao, and O. Wu, Data poisoning in deep learning: A survey, arXiv:2503.22759 (2025)

2025 arXiv
[10]

Cao and J

Y. Cao and J. Yang, in 2015 IEEE Symposium on Secu- rity and Privacy (IEEE, 2015) pp. 463–480

2015
[11]

Ginart, M

A. Ginart, M. Y. Guan, G. Valiant, and J. Zou, Mak- ing ai forget you: Data deletion in machine learning, NeurIPS (2019)

2019
[12]

Bourtoule, V

L. Bourtoule, V. Chandrasekaran, C. A. Choquette- Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Pa- pernot, Machine unlearning, 2021 IEEE Symposium on Security and Privacy (SP) , 141 (2021)

2021
[13]

W. Wang, Z. Tian, C. Zhang, and S. Yu, Machine unlearning: A comprehensive survey, arXiv:2405.07406 (2024)

2024 arXiv
[14]

S. Goel, A. Prabhu, P. Torr, P. Kumaraguru, and A. Sanyal, Corrective machine unlearning, arXiv:2402.14015 (2024)

2024 arXiv
[15]

S. Liu, Y. Yao, J. Jia, S. Casper, N. Baracaldo, P. Hase, Y. Yao, C. Y. Liu, X. Xu, H. Li, K. R. Varshney, M. Bansal, S. Koyejo, and Y. Liu, Rethinking machine unlearning for large language models, Nature Machine Intelligence 7, 181 (2025)

2025
[16]

Y. Qu, M. Ding, N. Sun, K. Thilakarathna, T. Zhu, and D. Niyato, The frontier of data erasure: A survey on machine unlearning for large language models, Computer 58, 45 (2025)

2025
[17]

Preskill, Quantum computing in the nisq era and be- yond, Quantum2, 79 (2018)

J. Preskill, Quantum computing in the nisq era and be- yond, Quantum2, 79 (2018)

2018
[18]

Bharti, A

K. Bharti, A. Cervera-Lierta, T. H. Kyaw, T. Haug, S. Alperin-Lea, A. Anand, M. Degroote, H. Heimonen, J. S. Kottmann, T. Menke, W.-K. Mok, S. Sim, L.- C. Kwek, and A. Aspuru-Guzik, Noisy intermediate- scale quantum algorithms, Reviews of Modern Physics 94, 015004 (2022)

2022
[19]

Cerezo, A

M. Cerezo, A. Arrasmith, R. Babbush, S. C. Benjamin, S. Endo, K. Fujii, J. R. McClean, K. Mitarai, X. Yuan, L. Cincio, and P. J. Coles, Variational quantum algo- rithms, Nature Reviews Physics3, 625 (2021)

2021
[20]

Biamonte, P

J. Biamonte, P. Wittek, N. Pancotti, P. Rebentrost, N. Wiebe, and S. Lloyd, Quantum machine learning, Nature 549, 195 (2017)

2017
[21]

S.Lloyd, M.Mohseni, andP.Rebentrost,Quantumalgo- rithmsforsupervisedandunsupervisedmachinelearning, arXiv:1307.0411 (2013)

2013 arXiv
[22]

X.-D. Cai, D. Wu, Z.-E. Su, M.-C. Chen, X.-L. Wang, L. Li, N.-L. Liu, C.-Y. Lu, and J.-W. Pan, Entanglement-based machine learning on a quantum computer, Physical Review Letters114, 110504 (2015)

2015
[23]

Havlíček, A

V. Havlíček, A. D. Córcoles, K. Temme, A. W. Harrow, A. Kandala, J. M. Chow, and J. M. Gambetta, Su- pervised learning with quantum-enhanced feature spaces, Nature 567, 209 (2019)

2019
[24]

Gao, Z.-Y

X. Gao, Z.-Y. Zhang, and L.-M. Duan, A quantum ma- chine learning algorithm based on generative models, Sci- ence Advances4, aat9004 (2018)

2018
[25]

J.Li, X.Yang, X.Peng, andC.-P.Sun,Hybridquantum- classical approach to quantum optimal control, Physical Review Letters118, 150503 (2017)

2017
[26]

Huang, M

H.-Y. Huang, M. Broughton, M. Mohseni, R. Babbush, S. Boixo, H. Neven, and J. R. McClean, Power of data in quantum machine learning, Nature Communications12, 2631 (2021)

2021
[27]

Huang, M

H.-Y. Huang, M. Broughton, J. Cotler, S. Chen, J. Li, M. Mohseni, H. Neven, R. Babbush, R. Kueng, J. Preskill, and J. R. McClean, Quantum advantage in learning from experiments, Science376, 1182 (2022)

2022
[28]

Zhang, Z.-Q

S.-X. Zhang, Z.-Q. Wan, C.-K. Lee, C.-Y. Hsieh, S. Zhang, and H. Yao, Variational quantum-neural hy- brid eigensolver, Physical Review Letters 128, 120502 (2022)

2022
[29]

Y.-Q. Chen, Y. Chen, C.-K. Lee, S. Zhang, and C.- Y. Hsieh, Optimizing quantum annealing schedules with monte carlo tree search enhanced with neural networks, Nature Machine Intelligence4, 269 (2022)

2022
[30]

Cerezo, G

M. Cerezo, G. Verdon, H.-Y. Huang, L. Cincio, and P. J. Coles, Challenges and opportunities in quantum machine learning, Nature Computational Science2, 567 (2022)

2022
[31]

Wang and J

Y. Wang and J. Liu, A comprehensive review of quantum machine learning: from nisq to fault tolerance, Reports on Progress in Physics87, 116402 (2024)

2024
[32]

Schuld, I

M. Schuld, I. Sinayskiy, and F. Petruccione, The quest for a quantum neural network, Quantum Information Processing 13, 2567 (2014)

2014
[33]

Romero, J

J. Romero, J. P. Olson, and A. Aspuru-Guzik, Quantum autoencoders for efficient compression of quantum data, Quantum Science and Technology2, 045001 (2017)

2017
[34]

Liu and L

J.-G. Liu and L. Wang, Differentiable learning of quan- tumcircuitbornmachines,PhysicalReviewA 98,062324 (2018)

2018
[35]

Benedetti, E

M. Benedetti, E. Lloyd, S. Sack, and M. Fiorentini, Pa- rameterized quantum circuits as machine learning mod- els, Quantum Science and Technology4, 043001 (2019)

2019
[36]

K. Beer, D. Bondarenko, T. Farrelly, T. J. Osborne, R. Salzmann, D. Scheiermann, and R. Wolf, Training deep quantum neural networks, Nature Communications 11, 808 (2020)

2020
[37]

H. Shen, P. Zhang, Y.-Z. You, and H. Zhai, Information scrambling in quantum neural networks, Physical Review Letters 124, 200504 (2020)

2020
[38]

Dallaire-Demers and N

P.-L. Dallaire-Demers and N. Killoran, Quantum genera- tive adversarial networks, Physical Review A98, 012324 (2018)

2018
[39]

I. Cong, S. Choi, and M. D. Lukin, Quantum convolu- tional neural networks, Nature Physics15, 1273 (2019)

2019
[40]

Pérez-Salinas, A

A. Pérez-Salinas, A. Cervera-Lierta, E. Gil-Fuster, and J. I. Latorre, Data re-uploading for a universal quantum classifier, Quantum4, 226 (2020)

2020
[41]

Banchi, J

L. Banchi, J. Pereira, and S. Pirandola, Generalization in quantum machine learning: A quantum information standpoint, PRX Quantum2, 040321 (2021). 11

2021
[42]

Zhang, C.-Y

S.-X. Zhang, C.-Y. Hsieh, S. Zhang, and H. Yao, Neural predictor based quantum architecture search, Machine Learning: Science and Technology2, 045027 (2021)

2021
[43]

W.LiandD.-L.Deng,Recentadvancesforquantumclas- sifiers, Science China Physics, Mechanics & Astronomy 65, 220301 (2022)

2022
[44]

Zheng, J.-B

P.-L. Zheng, J.-B. Wang, and Y. Zhang, Efficient and quantum-adaptive machine learning with fermion neural networks, Physical Review Applied20, 044002 (2023)

2023
[45]

Jäger and R

J. Jäger and R. V. Krems, Universal expressiveness of variational quantum classifiers and quantum kernels for support vector machines, Nature Communications 14, 576 (2023)

2023
[46]

Miao, C.-Y

J. Miao, C.-Y. Hsieh, and S.-X. Zhang, Neural-network- encoded variational quantum algorithms, Physical Re- view Applied21, 014053 (2024)

2024
[47]

Zhang, P

B. Zhang, P. Xu, X. Chen, and Q. Zhuang, Generative quantum machine learning via denoising diffusion prob- abilistic models, Physical Review Letters 132, 100602 (2024)

2024
[48]

P. S. S. Sein, M. Cañizo, and R. Orús, Image classifica- tion with rotation-invariant variational quantum circuits, Physical Review Research7, 013082 (2025)

2025
[49]

Zhang, Correcting a noisy quantum computer using a quantum computer, arXiv:2506.08331 (2025)

P. Zhang, Correcting a noisy quantum computer using a quantum computer, arXiv:2506.08331 (2025)

2025 arXiv
[50]

Huang, A

L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. D. Tygar, Adversarial machine learning, Proceed- ings of the 4th ACM workshop on Security and artificial intelligence , 43 (2011)

2011
[51]

Biggio, I

B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Giacinto, and F. Roli, Evasion attacks against machine learning at test time (2013) pp. 387–402

2013
[52]

Kurakin, G

A. Kurakin, G. Brain, G. I. J, and S. Bengio, Adversarial machine learning at scale, ICLR (2017)

2017
[53]

Lu, L.-M

S. Lu, L.-M. Duan, and D.-L. Deng, Quantum adversar- ial machine learning, Physical Review Research2, 033212 (2020)

2020
[54]

Liu and P

N. Liu and P. Wittek, Vulnerability of quantum classi- fication to adversarial perturbations, Physical Review A 101, 062331 (2020)

2020
[55]

Du, M.-H

Y. Du, M.-H. Hsieh, T. Liu, D. Tao, and N. Liu, Quan- tum noise protects quantum classifiers against adver- saries, Physical Review Research3, 023153 (2021)

2021
[56]

Weber, N

M. Weber, N. Liu, B. Li, C. Zhang, and Z. Zhao, Op- timal provable robustness of quantum classification via quantum hypothesis testing, npj Quantum Information 7, 76 (2021)

2021
[57]

H. Liao, I. Convy, W. J. Huggins, and K. B. Whaley, Robust in practice: Adversarial attacks on quantum ma- chine learning, Physical Review A103, 042427 (2021)

2021
[58]

W. Ren, W. Li, S. Xu, K. Wang, W. Jiang, F. Jin, X. Zhu, J. Chen, Z. Song, P. Zhang, H. Dong, X. Zhang, J. Deng, Y. Gao, C. Zhang, Y. Wu, B. Zhang, Q. Guo, H. Li, Z. Wang, J. Biamonte, C. Song, D.-L. Deng, and H. Wang, Experimental quantum adversarial learn- ing with programma...

2022
[59]

Gong and D.-L

W. Gong and D.-L. Deng, Universal adversarial exam- ples and perturbations for quantum classifiers, National Science Review , nwab130 (2021)

2021
[60]

M. T. West, S. M. Erfani, C. Leckie, M. Sevior, L. C. L. Hollenberg, and M. Usman, Benchmarking adversarially robust quantum machine learning at scale, Physical Re- view Research5, 023186 (2023)

2023
[61]

M. T. West, S.-L. Tsang, J. S. Low, C. D. Hill, C. Leckie, L. C. L. Hollenberg, S. M. Erfani, and M. Usman, Towards quantum enhanced adversarial robustness in machine learning, Nature Machine Intelligence 5, 581 (2023)

2023
[62]

M. C. Caro, H.-Y. Huang, M. Cerezo, K. Sharma, A. Sornborger, L. Cincio, and P. J. Coles, Generaliza- tion in quantum machine learning from few training data, Nature Communications13, 4919 (2022)

2022
[63]

French, Catastrophic forgetting in connectionist net- works, Trends in Cognitive Sciences3, 128 (1999)

R. French, Catastrophic forgetting in connectionist net- works, Trends in Cognitive Sciences3, 128 (1999)

1999
[64]

S. Goel, A. Prabhu, A. Sanyal, S.-N. Lim, P. Torr, and P. Kumaraguru, Towards adversarial evaluations for in- exact machine unlearning, arXiv:2201.06640 (2023)

2023 arXiv
[65]

Kurmanji, P

M. Kurmanji, P. Triantafillou, J. Hayes, and E. Tri- antafillou, Towards unbounded machine unlearning, NeuIPS (2023)

2023
[66]

Trippa, C

D. Trippa, C. Campagnano, M. S. Bucarelli, G. Tolomei, and F. Silvestri, ∇τ: Gradient-based and task-agnostic machine unlearning, arXiv:2403.14339 (2024)

2024 arXiv
[67]

Hochreiter and J

S. Hochreiter and J. Schmidhuber, Flat minima, Neural Computation 9, 1 (1997)

1997
[68]

N. S. Keskar, D. Mudigere, J. Nocedal, M. Smelyanskiy, and P. T. P. Tang, On large-batch training for deep learn- ing: Generalizationgapandsharpminima,ICLR (2017)

2017
[69]

J. R. McClean, S. Boixo, V. N. Smelyanskiy, R. Bab- bush, and H. Neven, Barren plateaus in quantum neural network training landscapes, Nature Communications9, 4812 (2018)

2018
[70]

S. Wang, E. Fontana, M. Cerezo, K. Sharma, A. Sone, L. Cincio, and P. J. Coles, Noise-induced barren plateaus in variational quantum algorithms, Nature Communica- tions 12, 6961 (2021)

2021
[71]

Cerezo and P

M. Cerezo and P. J. Coles, Higher order derivatives of quantum neural networks with barren plateaus, Quan- tum Science and Technology6, 035006 (2021)

2021
[72]

Zhang, S

H.-K. Zhang, S. Liu, and S.-X. Zhang, Absence of barren plateaus in finite local-depth circuits with long-range en- tanglement, Physical Review Letters132, 150603 (2024)

2024
[73]

Zhang, C

H.-K. Zhang, C. Zhu, and X. Wang, Predict- ing quantum learnability from landscape fluctuation, arXiv:2406.11805 (2024)

2024 arXiv
[74]

Larocca, S

M. Larocca, S. Thanasilp, S. Wang, K. Sharma, J. Bia- monte, P. J. Coles, L. Cincio, J. R. McClean, Z. Holmes, and M. Cerezo, Barren plateaus in variational quantum computing, Nature Reviews Physics7, 174 (2025)

2025
[75]

Gil-Fuster, J

E. Gil-Fuster, J. Eisert, and C. Bravo-Prieto, Under- standingquantummachinelearningalsorequiresrethink- ing generalization, Nature Communications 15, 2277 (2024)

2024
[76]

Zhang, S

C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals, Understanding deep learning (still) requires rethinking generalization, Communications of the ACM 64, 107 (2021)

2021
[77]

Superior resilience to poisoning and amenability to unlearning in quantum machine learning

S.-X. Zhang, J. Allcock, Z.-Q. Wan, S. Liu, J. Sun, H. Yu, X.-H. Yang, J. Qiu, Z. Ye, Y.-Q. Chen, C.-K. Lee, Y.-C. Zheng, S.-K. Jian, H. Yao, C.-Y. Hsieh, and S. Zhang, Tensorcircuit: a quantum software framework for the nisq era, Quantum7, 912 (2023). 12 Supplemental Material...

2023
[78]

Starting from the ground state|0⟩, we apply a rotation gate, for instanceRY (πx)

State Encoding: We encode a normalized scalar featurex into the state of a qubit using angle encoding. Starting from the ground state|0⟩, we apply a rotation gate, for instanceRY (πx). The input state becomes: |ψin⟩ = RY (πx)|0⟩ = cos(πx/2) sin(πx/2) . (S2)
[79]

We use a rotationRY (θ) with a single trainable parameterθ

Parameterized Processing: Next, a learnable, parameterized gate is applied. We use a rotationRY (θ) with a single trainable parameterθ. The output state is|ψout⟩ = RY (θ)|ψin⟩. This simplifies to: |ψout⟩ = RY (πx + θ)|0⟩. (S3)
[80]

The expectation value is calculated as: z = ⟨ψout|σz|ψout⟩ = cos2 πx + θ 2 − sin2 πx + θ 2 = cos(πx + θ)

Measurement: To obtain a classical output logitz, we compute the expectation value of a standard observable, the Pauli-Z operatorσz. The expectation value is calculated as: z = ⟨ψout|σz|ψout⟩ = cos2 πx + θ 2 − sin2 πx + θ 2 = cos(πx + θ). (S4) The probability is subsequently c...
[81]

The gradient isthereforedLM LP dθ = (σ(θx)−y)x

Hessian of the Single-Neuron MLP Forthe MLP, we havez = θx, which impliesdz dθ = x. The gradient isthereforedLM LP dθ = (σ(θx)−y)x. Differentiating this expression again with respect toθ yields the Hessian: HM LP= d dθ [(σ(θx) − y)x] (S7) = d dθ σ(θx) · x (S8) = [σ′(θx) · x] ·...
[82]

unlearning step

Hessian of the Single-Qubit QNN For the QNN, we havez = cos(πx + θ), which implies dz dθ = − sin(πx + θ). The gradient is dLQN N dθ = (σ(cos(πx + θ)) − y)(− sin(πx + θ)). To compute the Hessian, we differentiate this product using the product rule: HQN N= d dθ [(p − y)(− sin(π...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

RX RX RX RX R Y R Y R Y R Y R Y RX RX RX RX RX RZZ RZZ RZZ RZZ

Two real-valued vectors,θreal and θimag, are drawn from a normal (Gaussian) distribution, where each component is sampled independently: (θreal)j, (θimag)j ∼ N(µ = 0, σ2 = 1) (4) RX ... RX RX RX RX R Y R Y R Y R Y R Y RX RX RX RX RX RZZ RZZ RZZ RZZ ... Input Dense Dense ReLU ReLU Output Sigmoid a b FIG. 4. Model Architectures. a, Schematic of the QNN arch...

[2] [2]

The poisoned input vector is then constructed us- ing these random vectors as its real and imaginary parts and finally get normalized: x′ poison = θreal + i · θimag (5) This method completely destroys the original feature structure, forcing the model to associate a label with meaningless random noise, which can severely damage the learned feature represen...

[3] [3]

LeCun, Y

Y. LeCun, Y. Bengio, and G. Hinton, Deep learning, Nature 521, 436 (2015)

2015

[4] [4]

M. I. Jordan and T. M. Mitchell, Machine learning: Trends, perspectives, and prospects, Science 349, 255 (2015). 10

work page 2015

[5] [5]

Vaswani, N

A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, Attention is all you need, NeurIPS (2017)

work page 2017

[6] [6]

Barreno, B

M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, Can machine learning be secure?, Proceed- ings of the 2006 ACM Symposium on Information, com- puter and communications security , 16 (2006)

work page 2006

[7] [7]

Goldblum, D

M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Song, A. Madry, B. Li, and T. Goldstein, Dataset security for machine learn- ing: Data poisoning, backdoor attacks, and defenses, IEEE Transactions on Pattern Analysis and Machine Intelligence 45, 1563 (2022)

work page 2022

[8] [8]

Z. Tian, L. Cui, J. Liang, and S. Yu, A comprehensive survey on poisoning attacks and countermeasures in ma- chine learning, ACM Computing Surveys55, 1 (2023)

work page 2023