Abstract
Quantum computing promises to enhance machine learning and artificial intelligence. However, recent theoretical works show that, similar to traditional classifiers based on deep classical neural networks, quantum classifiers would suffer from adversarial perturbations as well. Here we report an experimental demonstration of quantum adversarial learning with programmable superconducting qubits. We train quantum classifiers, which are built on variational quantum circuits consisting of ten transmon qubits featuring average lifetimes of 150 μs, and average fidelities of simultaneous single- and two-qubit gates above 99.94% and 99.4%, respectively, with both real-life images (for example, medical magnetic resonance imaging scans) and quantum data. We demonstrate that these well-trained classifiers (with testing accuracy up to 99%) can be practically deceived by small adversarial perturbations, whereas an adversarial training process would substantially enhance their robustness to such perturbations.
This is a preview of subscription content, access via your institution
Access options
Access Nature and 54 other Nature Portfolio journals
Get Nature+, our best-value online-access subscription
$29.99 / 30 days
cancel any time
Subscribe to this journal
Receive 12 digital issues and online access to articles
$99.00 per year
only $8.25 per issue
Buy this article
- Purchase on Springer Link
- Instant access to full article PDF
Prices may be subject to local taxes which are calculated during checkout
Similar content being viewed by others
Data availability
The data presented in the figures and supporting the other findings of this study are available for download at https://doi.org/10.5281/zenodo.7134599 with a citable release at ref. 36. Our work makes use of three publicly available datasets introduced in previous studies32,33,34. The hand data and breast data from the medical hand–breast MRI dataset were originally adapted from publicly available datasets from the Radiological Society of North America (RSNA32; https://doi.org/10.1148/radiol.2018180736) and The Cancer Imaging Archive (TCIA33; https://doi.org/10.1007/s10278-013-9622-7), respectively. The MNIST handwritten-digit data were obtained from https://doi.org/10.1109/MSP.2012.221147734. Source data are provided with this paper.
Code availability
All the codes used for numerical simulations and experimental data analysis are available at https://doi.org/10.5281/zenodo.7134599 with a citable release at ref. 36.
References
Biamonte, J. et al. Quantum machine learning. Nature 549, 195–202 (2017).
Dunjko, V. & Briegel, H. J. Machine learning and artificial intelligence in the quantum domain: a review of recent progress. Rep. Prog. Phys. 81, 074001 (2018).
Sarma, S. D., Deng, D.-L. & Duan, L.-M. Machine learning meets quantum physics. Phys. Today 72, 48 (2019).
Eykholt, K. et al. Robust physical-world attacks on deep learning visual classification. In Proc. IEEE Conference on Computer Vision and Pattern Recognition 1625–1634 (IEEE, 2018).
Finlayson, S. G. et al. Adversarial attacks on medical machine learning. Science 363, 1287–1289 (2019).
Lu, S., Duan, L.-M. & Deng, D.-L. Quantum adversarial machine learning. Phys. Rev. Res. 2, 033212 (2020).
Liu, N. & Wittek, P. Vulnerability of quantum classification to adversarial perturbations. Phys. Rev. A 101, 062331 (2020).
Gong, W. & Deng, D.-L. Universal adversarial examples and perturbations for quantum classifiers. Natl Sci. Rev. 9, nwab130 (2021).
Guan, J., Fang, W. & Ying, M. in Computer Aided Verification, Lecture Notes in Computer Science (eds Silva, A. & Leino, K. R. M.) 151–174 (Springer, 2021).
Liao, H., Convy, I., Huggins, W. J. & Whaley, K. B. Robust in practice: adversarial attacks on quantum machine learning. Phys. Rev. A 103, 042427 (2021).
Caro, M. C., Gil-Fuster, E., Meyer, J. J., Eisert, J. & Sweke, R. Encoding-dependent generalization bounds for parametrized quantum circuits. Quantum 5, 582 (2021).
Haug, T., Self, C. N. & Kim, M. S. Large-scale quantum machine learning. Preprint at https://arxiv.org/abs/2108.01039 (2021).
Pérez-Salinas, A., Cervera-Lierta, A., Gil-Fuster, E. & Latorre, J. I. Data re-uploading for a universal quantum classifier. Quantum 4, 226 (2020).
Aubry, S. & André, G. Analyticity breaking and Anderson localization in incommensurate lattices. Ann. Israel Phys. Soc. 3, 18 (1980).
Gao, X., Zhang, Z.-Y. & Duan, L.-M. A quantum machine learning algorithm based on generative models. Sci. Adv. 4, eaat9004 (2018).
Liu, Y., Arunachalam, S. & Temme, K. A rigorous and robust quantum speed-up in supervised machine learning. Nat. Phys. 17, 1013–1017 (2021).
Saggio, V. et al. Experimental quantum speed-up in reinforcement learning agents. Nature 591, 229–233 (2021).
Huang, H.-Y. et al. Quantum advantage in learning from experiments. Science 376, 1182–1186 (2022).
Ledoux, M. in The Concentration of Measure Phenomenon 89 (American Mathematical Society, 2001).
Li, W. & Deng, D.-L. Recent advances for quantum classifiers. Sci. China Phys. Mech. Astron. 65, 220301 (2022).
Papernot, N., McDaniel, P., Wu, X., Jha, S. & Swami, A. Distillation as a defense to adversarial perturbations against deep neural networks. In Proc. 2016 IEEE Symposium on Security and Privacy (SP) 582–597 (IEEE, 2016).
Samangouei, P., Kabkab, M. & Chellappa, R. Defense-GAN: protecting classifiers against adversarial attacks using generative models. In Proc. 6th International Conference on Learning Representations (ICLR, 2018); https://arxiv.org/abs/1805.06605
Havlíček, V. et al. Supervised learning with quantum-enhanced feature spaces. Nature 567, 209–212 (2019).
Gong, M. et al. Quantum neuronal sensing of quantum many-body states on a 61-qubit programmable superconducting processor. Preprint at https://arxiv.org/abs/2201.05957 (2022).
Herrmann, J. et al. Realizing quantum convolutional neural networks on a superconducting quantum processor to recognize quantum phases. Nat. Commun. 13, 4144 (2022).
Mitarai, K., Negoro, M., Kitagawa, M. & Fujii, K. Quantum circuit learning. Phys. Rev. A 98, 032309 (2018).
Li, J., Yang, X., Peng, X. & Sun, C.-P. Hybrid quantum-classical approach to quantum optimal control. Phys. Rev. Lett. 118, 150503 (2017).
Schuld, M., Bergholm, V., Gogolin, C., Izaac, J. & Killoran, N. Evaluating analytic gradients on quantum hardware. Phys. Rev. A 99, 032331 (2019).
Place, A. P. M. et al. New material platform for superconducting transmon qubits with coherence times exceeding 0.3 milliseconds. Nat. Commun. 12, 1779 (2021).
Sung, Y. et al. Realization of high-fidelity CZ and ZZ-free iSWAP gates with a tunable coupler. Phys. Rev. X 11, 021058 (2021).
Foxen, B. et al. Demonstrating a continuous set of two-qubit gates for near-term quantum algorithms. Phys. Rev. Lett. 125, 120504 (2020).
Halabi, S. S. et al. The RSNA pediatric bone age machine learning challenge. Radiology 290, 498–503 (2019).
Clark, K. et al. The Cancer Imaging Archive (TCIA): maintaining and operating a public information repository. J. Digit. Imaging 26, 1045–1057 (2013).
Deng, L. The MNIST database of handwritten digit images for machine learning research. IEEE Signal Process. Mag. 29, 141–142 (2012).
Kurakin, A., Goodfellow, I. J. & Bengio, S. Adversarial machine learning at scale. In International Conference on Learning Representations (ICLR, 2017).
Li, W. Data and codes for the paper titled ‘Experimental quantum adversarial learning with superconducting qubits’ (Zenodo, 2022): https://doi.org/10.5281/zenodo.7134599
Acknowledgements
We thank L.-M. Duan and S. Lu for helpful discussions, and V. Dunjko in particular for his valuable feedback from reading the first version of this paper. The device was fabricated at the Micro-Nano Fabrication Center of Zhejiang University. We acknowledge the support of the National Natural Science Foundation of China (grants nos. 92065204, U20A2076, 11725419, 12174342 and 12075128), the Zhejiang Province Key Research and Development Program (grant no. 2020C01019) and the Fundamental Research Funds for the Zhejiang Provincial Universities (grant no. 2021XZZX003). J.D.B acknowledges support from the research project Leading Research Center on Quantum Computing (agreement No. 014/20). D.-L.D. also acknowledges additional support from the Shanghai Qi Zhi Institute.
Author information
Authors and Affiliations
Contributions
D.-L.D. proposed the idea and laid out the theoretical framework for the experiment. W.R. and S.X. carried out the experiments, supervised by C.S. and H.W. H.L. fabricated the device, supervised by H.W. W.L. and W.J. performed the numerical simulations, supervised by D.-L.D. All authors contributed to the analysis of data, discussions of the results and the writing of the manuscript.
Corresponding authors
Ethics declarations
Competing interests
The authors declare no competing interests.
Peer review
Peer review information
Nature Computational Science thanks Leonardo Banchi, Lucas Lamata and the other, anonymous, reviewer(s) for their contribution to the peer review of this work. Primary Handling Editor: Jie Pan, in collaboration with the Nature Computational Science team. Peer reviewer reports are available.
Additional information
Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Supplementary information
Supplementary Information
Supplementary Figs. 1–14, Tables 1 and 2 and Algorithms 1–8.
Supplementary Data 1
Source data for Supplementary Fig. 2 and Supplementary Fig. 3.
Supplementary Data 2
Source data for Supplementary Fig. 4 and Supplementary Fig. 5.
Supplementary Data 3
Source data for Supplementary Fig. 7.
Supplementary Data 4
Source data for Supplementary Fig. 11b and Supplementary Fig. 11c.
Supplementary Data 5
Source data for Supplementary Fig. 12.
Supplementary Data 6
Source data for Supplementary Fig. 13.
Supplementary Data 7
Source data for Supplementary Fig. 14.
Source data
Source Data Fig. 1
Statistical source data for Fig.1c, 1d, 1e, 1f, 1g and 1h.
Source Data Fig. 2
Statistical source data for Fig.2b, 2c and 2d.
Rights and permissions
Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.
About this article
Cite this article
Ren, W., Li, W., Xu, S. et al. Experimental quantum adversarial learning with programmable superconducting qubits. Nat Comput Sci 2, 711–717 (2022). https://doi.org/10.1038/s43588-022-00351-9
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1038/s43588-022-00351-9
This article is cited by
-
Harnessing quantum information to advance computing
Nature Computational Science (2024)
-
Adversarial examples detection based on quantum fuzzy convolution neural network
Quantum Information Processing (2024)
-
A quantum federated learning framework for classical clients
Science China Physics, Mechanics & Astronomy (2024)
-
Efficient preparation of lossless quantum images based on Gray code
Quantum Information Processing (2024)
-
Towards quantum enhanced adversarial robustness in machine learning
Nature Machine Intelligence (2023)
