pith. sign in

arxiv: 2605.29877 · v1 · pith:GN7FI2F7new · submitted 2026-05-28 · 🪐 quant-ph

Verifying Adversarial Robustness in Quantum Machine Learning: from theory to physical validation via a software tool

Ji Guan , Mingsheng Ying This is my paper

Pith reviewed 2026-06-29 07:04 UTC · model grok-4.3

classification 🪐 quant-ph
keywords quantum machine learningadversarial robustnessformal verificationNISQ devicesfidelity boundsemidefinite programmingmeasurement outcomes
0
0 comments X

The pith

A fidelity-based lower bound computed from measurement outcome distributions certifies adversarial robustness of quantum machine learning models on NISQ hardware.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper presents a formal framework to verify how resistant quantum machine learning models are to small input changes that flip their predictions. At its center is a lower bound on robustness derived from fidelity and calculated straight from the probabilities of measurement outcomes. This bound works for both mathematical proofs of robustness and direct estimates run on actual quantum processors. When the full model is known, an optimal version of the bound can be found using semidefinite programming. The results are packaged in an efficient verification method, the VeriQR software tool, and tested experimentally on a 20-qubit superconducting device.

Core claim

A fidelity-based robustness lower bound that is computable directly from the measurement outcome distribution enables both formal verification and empirical estimation of adversarial robustness for quantum machine learning models on NISQ hardware; the optimal bound is obtained via semidefinite programming when the full model is available.

What carries the argument

The fidelity-based robustness lower bound derived from the distribution of measurement outcomes.

If this is right

  • The bound supports scalable formal verification without full quantum state information.
  • It permits direct empirical robustness estimates on physical NISQ processors.
  • It underpins the first dedicated verification tool VeriQR.
  • It enables the first experimental benchmark of quantum adversarial robustness on a 20-qubit superconducting processor.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same measurement-based bound could be applied to certify robustness in other quantum algorithms that rely on similar outcome distributions.
  • Combining the bound with existing classical verification techniques might reduce the resources needed for hybrid quantum-classical robustness checks.
  • If the bound scales well, it could guide the design of new QML models that are easier to certify on near-term hardware.

Load-bearing premise

The distribution of measurement results from noisy quantum hardware supplies enough information to compute a valid lower bound on how much a model can be fooled by small input changes.

What would settle it

An experiment in which a known adversarial perturbation on a real quantum device changes the model output by more than the computed lower bound predicts would show the bound does not hold.

Figures

Figures reproduced from arXiv: 2605.29877 by Ji Guan, Mingsheng Ying.

Figure 1.1
Figure 1.1. Figure 1.1: Quantum classifier pipeline. The input quantum state 𝜌 is processed by a quantum channel E, followed by measurement via a POVM {𝑀𝑐 }𝑐∈ C, to produce a classical class label 𝑐 = A (𝜌). Let H be a 2 𝑛 -dimensional Hilbert space on an 𝑛-qubit quantum system. A quantum state 𝜌 ∈ D (H ) is a positive semidefinite operator (𝜌 ⪰ 0) on H with trace one (Tr(𝜌) = 1). Here D (H ) represents the set of quantum state… view at source ↗
Figure 1.2
Figure 1.2. Figure 1.2: Visualization of robustness bounds as nested fidelity-distance regions around [PITH_FULL_IMAGE:figures/full_fig_p010_1_2.png] view at source ↗
Figure 1.3
Figure 1.3. Figure 1.3: System architecture of VeriQR. 1. Tool Integration: A built-in parser compatible with OpenQASM, supporting fron￾tends such as Qiskit, Cirq, and MindSpore Quantum; 2. Noisy Simulation: Injection of various noise models, including random noise, depo￾larizing, bit-flip, phase-flip, and user-defined noise; 3. Robustness Verification: Formal verification of adversarial robustness for quantum classifiers based… view at source ↗
Figure 1.4
Figure 1.4. Figure 1.4: The adversarial examples and the corresponding adversarial perturbations [PITH_FULL_IMAGE:figures/full_fig_p017_1_4.png] view at source ↗
Figure 1.5
Figure 1.5. Figure 1.5: Experimental schematic for QNN robustness evaluation. a, Schematic dia￾gram of the superconducting quantum processor, comprising 72 qubits and 126 couplers arranged in a 2D lattice. The 20 qubits selected for the experiment are highlighted in green. b, Architecture of the quantum neural network (QNN) classifier, including the state preparation circuit, an 𝑙-layer variational circuit, and pre-measurement … view at source ↗
Figure 1.6
Figure 1.6. Figure 1.6: Robustness bound verification experiments. a, c, Comparison of the ex￾perimental upper bound 𝑅UB (from 10 randomly selected samples, 5 per class) versus theoretical 𝑅LB. Error bars indicate the root mean square error from fitting 𝐷(𝜌, 𝜎). Δ denotes the average gap between 𝑅UB and 𝑅LB of the 10 samples. b, d, The robustness bounds for critical samples under clean and adversarial training. Adversarial trai… view at source ↗
read the original abstract

As with classical neural networks, quantum machine learning (QML) models are vulnerable to small input perturbations that can significantly alter output predictions. Certifying the robustness of QML models, particularly on NISQ hardware, is therefore a fundamental step toward trustworthy quantum AI. This chapter reviews our recently developed comprehensive formal framework for verifying adversarial robustness in QML. The core of this framework is a fidelity-based robustness lower bound computable directly from the measurement outcome distribution, which enables both formal verification and empirical estimation on real quantum devices. Additionally, the optimal bound can be computed via semidefinite programming (SDP) with full knowledge of the quantum machine learning models. We incorporate these results into: (1) an efficient formal verification framework; (2) VeriQR, the first dedicated QML robustness verification tool; and (3) the first experimental benchmark of quantum adversarial robustness on a 20-qubit superconducting processor. Together, these systematic advances enable scalable, physically grounded robustness evaluation of QML models.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

1 major / 0 minor

Summary. The manuscript presents a formal framework for verifying adversarial robustness of quantum machine learning (QML) models. Its central contribution is a fidelity-based lower bound on robustness that is computable directly from the empirical measurement outcome distribution, supporting both formal verification and device-level estimation without full state tomography. The framework also includes an SDP formulation for the optimal bound given complete model knowledge, is implemented in the VeriQR software tool, and is validated experimentally on a 20-qubit superconducting processor.

Significance. If the lower bound remains valid under realistic NISQ noise, the work would enable scalable, physically grounded certification of QML robustness and constitute a notable advance toward trustworthy quantum AI. The combination of a distribution-based bound, SDP optimization, the dedicated VeriQR tool, and the first reported hardware benchmark on 20 qubits represents a concrete step beyond purely theoretical analyses. The experimental component on real superconducting hardware is a particular strength.

major comments (1)
  1. [Abstract] Abstract: The claim that the fidelity-based robustness lower bound 'can be computed directly from the measurement outcome distribution' and enables 'empirical estimation on real quantum devices' is load-bearing for both the formal verification framework and the 20-qubit experimental benchmark. The provided description gives no indication that the derivation accounts for the difference between ideal Born-rule probabilities and the noisy distribution actually observed on superconducting hardware (decoherence, readout error, etc.). Without an explicit noise model or a proof that the bound remains a valid lower bound under a realistic channel, the relationship between the computed quantity and true adversarial robustness is not guaranteed.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the detailed review and for identifying this important point about the abstract's claims. We address the major comment below.

read point-by-point responses

  1. Referee: [Abstract] Abstract: The claim that the fidelity-based robustness lower bound 'can be computed directly from the measurement outcome distribution' and enables 'empirical estimation on real quantum devices' is load-bearing for both the formal verification framework and the 20-qubit experimental benchmark. The provided description gives no indication that the derivation accounts for the difference between ideal Born-rule probabilities and the noisy distribution actually observed on superconducting hardware (decoherence, readout error, etc.). Without an explicit noise model or a proof that the bound remains a valid lower bound under a realistic channel, the relationship between the computed quantity and true adversarial robustness is not guaranteed.

    Authors: The fidelity-based lower bound is formally derived with respect to the observed measurement outcome distribution (i.e., the empirical probabilities obtained from the device). Because the bound is expressed directly in terms of these observed frequencies, it automatically incorporates whatever noise is present in the hardware run, including decoherence and readout errors. In that sense the bound certifies robustness of the effective channel realized on the device rather than an idealized noiseless model. We agree, however, that the abstract does not make this distinction explicit and could be misread as claiming validity for the ideal Born-rule distribution. We will therefore revise the abstract to state that the bound is computed from the observed (noisy) distribution and add a short clarifying paragraph in the main text explaining its applicability under realistic NISQ channels. This is a clarification rather than a change to the technical results. revision: yes

Circularity Check

0 steps flagged

No circularity: bound derived directly from measurement distributions

full rationale

The paper presents a fidelity-based robustness lower bound as computed directly from the observed measurement outcome distribution on NISQ devices, without requiring full state information or model-specific assumptions beyond the distribution itself. This is described as enabling both formal verification and empirical estimation independently. No self-definitional steps, fitted inputs renamed as predictions, or load-bearing self-citations appear in the provided abstract or framework description. The central claim remains self-contained with independent content from the measurement data, consistent with a non-circular derivation against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Based solely on the abstract, no explicit free parameters, axioms, or invented entities are identifiable. The approach appears to rest on standard quantum information primitives such as fidelity and SDP optimization.

pith-pipeline@v0.9.1-grok · 5703 in / 1164 out tokens · 34560 ms · 2026-06-29T07:04:07.056087+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

44 extracted references · 4 canonical work pages · 3 internal anchors

  1. [1]

    Quantum machine learning.Nature, 549(7671):195–202, 2017

    JacobBiamonte,PeterWittek,NicolaPancotti,PatrickRebentrost,NathanWiebe,andSethLloyd. Quantum machine learning.Nature, 549(7671):195–202, 2017

    2017

  2. [2]

    Chal- lenges and opportunities in quantum machine learning.Nature computational science, 2(9):567– 576, 2022

    Marco Cerezo, Guillaume Verdon, Hsin-Yuan Huang, Lukasz Cincio, and Patrick J Coles. Chal- lenges and opportunities in quantum machine learning.Nature computational science, 2(9):567– 576, 2022

    2022

  3. [3]

    Córcoles, Kristan Temme, Aram W

    Vojtěch Havlíček, Antonio D. Córcoles, Kristan Temme, Aram W. Harrow, Abhinav Kandala, Jerry M. Chow, and Jay M. Gambetta. Supervised learning with quantum-enhanced feature spaces.Nature, 567:209–212, 3 2019

    2019

  4. [4]

    McMahon, Colin Scarato,FrancoisSwiadek,ChristianKraglundAndersen,ChristophHellings,SebastianKrinner, Nathan Lacroix, Stefania Lazar, Michael Kerschbaum, Dante Colao Zanuz, Graham J

    Johannes Herrmann, Sergi Masot Llima, Ants Remm, Petr Zapletal, Nathan A. McMahon, Colin Scarato,FrancoisSwiadek,ChristianKraglundAndersen,ChristophHellings,SebastianKrinner, Nathan Lacroix, Stefania Lazar, Michael Kerschbaum, Dante Colao Zanuz, Graham J. Norris, MichaelJ.Hartmann,AndreasWallraff,andChristopherEichler.Realizingquantumconvolutional neural ...

    2022

  5. [5]

    Munro, Yong Heng Huo, Chao Yang Lu, Cheng Zhi Peng, Xiaobo Zhu, and Jian Wei Pan

    MingGong,HeLiangHuang,ShiyuWang,ChuGuo,ShaoweiLi,YulinWu,QinglingZhu,Youwei Zhao, Shaojun Guo, Haoran Qian, Yangsen Ye, Chen Zha, Fusheng Chen, Chong Ying, Jiale Yu, Daojin Fan, Dachao Wu, Hong Su, Hui Deng, Hao Rong, Kaili Zhang, Sirui Cao, Jin Lin, Yu Xu, Lihua Sun, Cheng Guo, Na Li, Futian Liang, Akitada Sakurai, Kae Nemoto, William J. Munro, Yong Heng...

    2023

  6. [6]

    Anartificialneuron implemented on an actual quantum processor.npj Quantum Information, 5(1):26, 2019

    FrancescoTacchino,ChiaraMacchiavello,DarioGerace,andDanieleBajoni. Anartificialneuron implemented on an actual quantum processor.npj Quantum Information, 5(1):26, 2019

    2019

  7. [7]

    Experimental quantum generative adversarial networks for image generation.Physical Review Applied, 16(2):024051, 2021

    He-LiangHuang,YuxuanDu,MingGong,YouweiZhao,YulinWu,ChaoyueWang,ShaoweiLi, Futian Liang, Jin Lin, Yu Xu, Rui Yang, Tongliang Liu, Min-Hsiu Hsieh, Hui Deng, Hao Rong, Cheng-Zhi Peng, Chao-Yang Lu, Yu-Ao Chen, Dacheng Tao, Xiaobo Zhu, and Jian-Wei Pan. Experimental quantum generative adversarial networks for image generation.Physical Review Applied, 16(2):02...

    2021

  8. [8]

    Quantum generative adversarial networks with multiple superconducting qubits.npj Quantum Information, 7(1):165, 2021

    Kaixuan Huang, Zheng-An Wang, Chao Song, Kai Xu, Hekang Li, Zhen Wang, Qiujiang Guo, Zixuan Song, Zhi-Bo Liu, Dongning Zheng, et al. Quantum generative adversarial networks with multiple superconducting qubits.npj Quantum Information, 7(1):165, 2021

    2021

  9. [9]

    Experimental demonstration of quantum continual learning with superconducting qubits.npj Quantum Information, 12(1):28, 2026

    ChuanyuZhang,ZhideLu,LiangtianZhao,ShiboXu,WeikangLi,KeWang,JiachenChen,Yaozu Wu, Feitong Jin, Xuhao Zhu, et al. Experimental demonstration of quantum continual learning with superconducting qubits.npj Quantum Information, 12(1):28, 2026

    2026

  10. [10]

    Quantumensemblelearningwithaprogrammablesuperconducting processor.npj Quantum Information, 11(1):83, 2025

    Jiachen Chen, Yaozu Wu, Zhen Yang, Shibo Xu, Xuan Ye, Daili Li, Ke Wang, Chuanyu Zhang, FeitongJin,XuhaoZhu,etal. Quantumensemblelearningwithaprogrammablesuperconducting processor.npj Quantum Information, 11(1):83, 2025

    2025

  11. [11]

    and Yoo, Jae Hyeon and Isakov, Sergei V

    Michael Broughton, Guillaume Verdon, Trevor McCourt, Antonio J Martinez, Jae Hyeon Yoo, Sergei V Isakov, Philip Massey, Ramin Halavati, Murphy Yuezhen Niu, Alexander Zlokapa, et al. Tensorflow quantum: A software framework for quantum machine learning.arXiv preprint arXiv:2003.02989, 2020

    work page arXiv 2003

  12. [12]

    Quantumadversarialmachinelearning.Physical Review Research, 2(3):033212, 2020

    SiruiLu,Lu-MingDuan,andDong-LingDeng. Quantumadversarialmachinelearning.Physical Review Research, 2(3):033212, 2020

    2020

  13. [13]

    Vulnerability of quantum classification to adversarial perturbations

    Nana Liu and Peter Wittek. Vulnerability of quantum classification to adversarial perturbations. Physical Review A, 101(6):062331, 2020

    2020

  14. [14]

    Predominantaspectsonsecurityforquantummachinelearning:Lit- eraturereview

    Nicola Franco, Alona Sakhnenko, Leon Stolpmann, Daniel Thuerck, Fabian Petsch, Annika Rüll, andJeanetteMiriamLorenz. Predominantaspectsonsecurityforquantummachinelearning:Lit- eraturereview. In2024IEEEInternationalConferenceonQuantumComputingandEngineering (QCE), volume 1, pages 1467–1477. IEEE, 2024

    2024

  15. [15]

    Adversarialmachinelearning

    Ling Huang, Anthony D Joseph, Blaine Nelson, Benjamin IP Rubinstein, and J Doug Tygar. Adversarialmachinelearning. InProceedingsofthe4thACMworkshoponSecurityandartificial intelligence, pages 43–58, 2011. 24 Ji Guan and Mingsheng Ying

    2011

  16. [16]

    Explainingandharnessingadversarial examples

    IanJ.Goodfellow,JonathonShlens,andChristianSzegedy. Explainingandharnessingadversarial examples. InYoshuaBengioandYannLeCun,editors,3rdInternationalConferenceonLearning Representations,ICLR2015,SanDiego,CA,USA,May7-9,2015,ConferenceTrackProceedings, 2015

    2015

  17. [17]

    Cam- bridge university press, 2010

    Michael A Nielsen and Isaac L Chuang.Quantum computation and quantum information. Cam- bridge university press, 2010

    2010

  18. [18]

    Robustness verification of quantum classifiers

    Ji Guan, Wang Fang, and Mingsheng Ying. Robustness verification of quantum classifiers. In International Conference on Computer Aided Verification, pages 151–174. Springer, 2021

    2021

  19. [19]

    A robustness verification tool for quantum machine learning models

    Yanling Lin, Ji Guan, Wang Fang, Mingsheng Ying, and Zhaofeng Su. A robustness verification tool for quantum machine learning models. InFormal Methods, volume 14933 ofLecture Notes in Computer Science, pages 403–421. Springer, 2024

    2024

  20. [20]

    Vasilakos, Yang Yang, Yu-Chun Wu, Ji Guan, Peng Duan, and Guo-Ping Guo

    Hai-FengZhang,Zhao-YunChen,PengWang,Liang-LiangGuo,Tian-LeWang,Xiao-YanYang, Ren-Ze Zhao, Ze-An Zhao, Sheng Zhang, Lei Du, Hao-Ran Tao, Zhi-Long Jia, Wei-Cheng Kong, Huan-Yu Liu, Athanasios V. Vasilakos, Yang Yang, Yu-Chun Wu, Ji Guan, Peng Duan, and Guo-Ping Guo. Experimental robustness benchmarking of quantum neural networks on a superconductingquantump...

    2026

  21. [21]

    Reluplex: An efficient smt solver for verifying deep neural networks

    Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. Reluplex: An efficient smt solver for verifying deep neural networks. InInternational Conference on Computer Aided Verification, pages 97–117. Springer, 2017

    2017

  22. [22]

    An approach to reachability analysis for feed-forward ReLU neural networks

    Alessio Lomuscio and Lalit Maganti. An approach to reachability analysis for feed-forward relu neural networks.arXiv preprint arXiv:1706.07351, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  23. [23]

    Xiao, and Russ Tedrake

    Vincent Tjeng, Kai Y. Xiao, and Russ Tedrake. Evaluating robustness of neural networks with mixedintegerprogramming. In7thInternationalConferenceonLearningRepresentations,ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019

    2019

  24. [24]

    Measuring neural net robustness with constraints

    OsbertBastani,YaniIoannou,LeonidasLampropoulos,DimitriosVytiniotis,AdityaV.Nori,and Antonio Criminisi. Measuring neural net robustness with constraints. In Daniel D. Lee, Masashi Sugiyama, Ulrike von Luxburg, Isabelle Guyon, and Roman Garnett, editors,Advances in Neural InformationProcessingSystems29:AnnualConferenceonNeuralInformationProcessingSystems 20...

    2016

  25. [25]

    Verification of deep convolutional neural networks using imagestars

    Hoang-Dung Tran, Stanley Bak, Weiming Xiang, and Taylor T Johnson. Verification of deep convolutional neural networks using imagestars. InInternational Conference on Computer Aided Verification, pages 507–526. Springer, 2020

    2020

  26. [26]

    Adversarial attacks and defenses in deep learning.Engineering, 6(3):346–360, 2020

    Kui Ren, Tianhang Zheng, Zhan Qin, and Xue Liu. Adversarial attacks and defenses in deep learning.Engineering, 6(3):346–360, 2020

    2020

  27. [27]

    Explaining and Harnessing Adversarial Examples

    IanJGoodfellow,JonathonShlens,andChristianSzegedy. Explainingandharnessingadversarial examples.arXiv preprint arXiv:1412.6572, 2014

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  28. [28]

    General parameter-shift rules for quantum gradients.Quantum, 6:677, 2022

    David Wierichs, Josh Izaac, Cody Wang, and Cedric Yen-Yu Lin. General parameter-shift rules for quantum gradients.Quantum, 6:677, 2022

    2022

  29. [29]

    Physical Review A, 98(3):032309, 2018

    KosukeMitarai,MakotoNegoro,MasahiroKitagawa,andKeisukeFujii.Quantumcircuitlearning. Physical Review A, 98(3):032309, 2018

    2018

  30. [30]

    Evaluating analytic gradients on quantum hardware.Physical Review A, 99(3):032331, 2019

    Maria Schuld, Ville Bergholm, Christian Gogolin, Josh Izaac, and Nathan Killoran. Evaluating analytic gradients on quantum hardware.Physical Review A, 99(3):032331, 2019

    2019

  31. [31]

    In2018 IEEE Conference on Decision and Control (CDC), pages 1624–1631

    RichardYZhangandJavadLavaei.Sparsesemidefiniteprogramswithnear-lineartimecomplexity. In2018 IEEE Conference on Decision and Control (CDC), pages 1624–1631. IEEE, 2018

    2018

  32. [32]

    An abstraction-based framework for neural network verification

    Yizhak Yisrael Elboher, Justin Gottschlich, and Guy Katz. An abstraction-based framework for neural network verification. InInternational Conference on Computer Aided Verification, pages 43–65. Springer, 2020

    2020

  33. [33]

    Formal analysis and redesign of a neural network-based aircraft taxiing system with verifai

    DanielJFremont,JohnathanChiu,DragosDMargineantu,DenisOsipychev,andSanjitASeshia. Formal analysis and redesign of a neural network-based aircraft taxiing system with verifai. In International Conference on Computer Aided Verification, pages 122–134. Springer, 2020

    2020

  34. [34]

    Safetyverificationfordeepneuralnetworkswithprovableguarantees(in- vitedpaper)

    MartaZ.Kwiatkowska. Safetyverificationfordeepneuralnetworkswithprovableguarantees(in- vitedpaper). InWanJ.FokkinkandRobvanGlabbeek,editors,30thInternationalConferenceon Concurrency Theory, CONCUR 2019, August 27-30, 2019, Amsterdam, the Netherlands, volume 140 ofLIPIcs, pages 1:1–1:5. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2019. 1 Verifying Ad...

    2019

  35. [35]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018

    2018

  36. [36]

    Prentice Hall Professional, 2006

    Jasmin Blanchette and Mark Summerfield.C++ GUI programming with Qt 4. Prentice Hall Professional, 2006

    2006

  37. [37]

    Open Quantum Assembly Language

    Andrew W Cross, Lev S Bishop, John A Smolin, and Jay M Gambetta. Open quantum assembly language.arXiv preprint arXiv:1707.03429, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  38. [38]

    Quantumnoiseprotects quantum classifiers against adversaries.Physical Review Research, 3(2):023153, 2021

    YuxuanDu,Min-HsiuHsieh,TongliangLiu,DachengTao,andNanaLiu. Quantumnoiseprotects quantum classifiers against adversaries.Physical Review Research, 3(2):023153, 2021

    2021

  39. [39]

    Verifying fairness in quantum machine learning

    Ji Guan, Wang Fang, and Mingsheng Ying. Verifying fairness in quantum machine learning. In Computer Aided Verification: 34th International Conference, CAV 2022, Haifa, Israel, August 7–10, 2022, Proceedings, Part II, pages 408–429. Springer, 2022

    2022

  40. [40]

    Certifiedrobustnessofquantumclassifiersagainstadversarialexamplesthrough quantum noise

    Jhih-CingHuang,Yu-LinTsai,Chao-HanHuckYang,Cheng-FangSu,Chia-MuYu,Pin-YuChen, andSy-YenKuo. Certifiedrobustnessofquantumclassifiersagainstadversarialexamplesthrough quantum noise. InICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE, 2023

    2023

  41. [41]

    Emnist:Extendingmnist to handwritten letters

    GregoryCohen,SaeedAfshar,JonathanTapson,andAndreVanSchaik. Emnist:Extendingmnist to handwritten letters. In2017 international joint conference on neural networks (IJCNN), pages 2921–2926. IEEE, 2017

    2017

  42. [42]

    Adversarial robustness of deep neural networks: A survey from a formal verification perspective.IEEE Transactions on Dependable and Secure Computing, 2022

    Mark Huasong Meng, Guangdong Bai, Sin Gee Teo, Zhe Hou, Yan Xiao, Yun Lin, and Jin Song Dong. Adversarial robustness of deep neural networks: A survey from a formal verification perspective.IEEE Transactions on Dependable and Secure Computing, 2022

    2022

  43. [43]

    Detecting violations of differen- tial privacy for quantum algorithms

    Ji Guan, Wang Fang, Mingyu Huang, and Mingsheng Ying. Detecting violations of differen- tial privacy for quantum algorithms. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 2277–2291, 2023

    2023

  44. [44]

    Optimal mechanisms for quantum local differential privacy

    Ji Guan. Optimal mechanisms for quantum local differential privacy. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS ’25, pages 3737–3749, New York, NY, USA, 2025. Association for Computing Machinery

    2025