analiza aiqbench
This study exposes a critical methodological flaw in evaluating quantum attention models, demonstrating that apparent robustness gains often stem from shifting perturbation budgets rather than genuine model improvements. By rigorously auditing ablation tests on a four-qubit detector, the authors reveal how input scaling modules can alter both the classifier and incoming noise, leading to misleading causal conclusions if not properly controlled. The findings urge researchers in quantum machine learning to strictly define fixed attack budgets and distinguish between descriptive correlations and true causal benefits before claiming robustness.
When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention
arXiv:2610.02641v1 Announce Type: cross Abstract: Removing an input-scaling module changes both a classifier and the perturbations reaching its encoder. A robustness difference can therefore reflect the comparison rule as well as the module. We demonstrate this problem in a four-qubit quantum-attention detector on generated power-grid trajectories. A learned scaling module appears beneficial at a fixed physical attack budget, but matching an upper bound on perturbations at the encoder reverses the ordering. Neither comparison alone establishes a robustness benefit caused by the module. The initial test also perturbs clean examples into attacked examples while retaining their original labels; tests restricted to already attacked examples do not establish a benefit. Replacing a trained model's input scales disrupts detection. Retraining its linear classification layer restores the detection rate, but changes individual predictions, leaving the comparison descriptive rather than causal. Two further design checks explain why the input quantum Fisher information regularizer cannot train this model's query parameters, and why removing confidence bounds does not establish a larger certified radius. The evidence is limited to ten seeds, exact simulation, synthetic data, and a restricted set of attacks; classical baselines achieve better clean prediction. The practical lesson is to specify which perturbation budget is fixed, check that attacks preserve labels and interventions preserve predictions, and distinguish exploratory controls from confirmatory evidence.
Abstract:Removing an input-scaling module changes both a classifier and the perturbations reaching its encoder. A robustness difference can therefore reflect the comparison rule as well as the module. We demonstrate this problem in a four-qubit quantum-attention detector on generated power-grid trajectories. A learned scaling module appears beneficial at a fixed physical attack budget, but matching an upper bound on perturbations at the encoder reverses the ordering. Neither comparison alone establishes a robustness benefit caused by the module. The initial test also perturbs clean examples into attacked examples while retaining their original labels; tests restricted to already attacked examples do not establish a benefit. Replacing a trained model's input scales disrupts detection. Retraining its linear classification layer restores the detection rate, but changes individual predictions, leaving the comparison descriptive rather than causal. Two further design checks explain why the input quantum Fisher information regularizer cannot train this model's query parameters, and why removing confidence bounds does not establish a larger certified radius. The evidence is limited to ten seeds, exact simulation, synthetic data, and a restricted set of attacks; classical baselines achieve better clean prediction. The practical lesson is to specify which perturbation budget is fixed, check that attacks preserve labels and interventions preserve predictions, and distinguish exploratory controls from confirmatory evidence.
Accepted for presentation as a long oral at the NeurIPS 2026 SaTQuML Workshop, December 12-13, 2026, Atlanta, GA. arXiv version includes minor formatting revisions to meet submission requirements
Quantum Physics (quant-ph); Cryptography and Security (cs.CR); Machine Learning (cs.LG)
arXiv:2610.02641 [quant-ph]
(or arXiv:2610.02641v1 [quant-ph] for this version)
https://doi.org/10.48550/arXiv.2610.02641 arXiv-issued DOI via DataCite (pending registration)
Text integral sub licența deschisă a publicației · 264 cuvinte
