Universal adversarial examples and perturbations for quantum classifiers

Experimental quantum adversarial learning with programmable superconducting qubits

Quantum computing promises to enhance machine learning and artificial intelligence. However, recent theoretical works show that, similar to traditional classifiers based on deep classical neural networks, quantum classifiers would suffer from adversarial perturbations as well. Here we report an experimental demonstration of quantum adversarial learning with programmable superconducting qubits. We train quantum classifiers, which are built on variational quantum circuits consisting of ten transmon qubits featuring average lifetimes of 150 μs, and average fidelities of simultaneous single- and two-qubit gates above 99.94% and 99.4%, respectively, with both real-life images (for example, medical magnetic resonance imaging scans) and quantum data. We demonstrate that these well-trained classifiers (with testing accuracy up to 99%) can be practically deceived by small adversarial perturbations, whereas an adversarial training process would substantially enhance their robustness to such perturbations.