Input scaling effects on quantum attention robustness tested
When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention
Cryptography and SecurityMachine Learning
Summary
This paper looks at how a small part of a quantum-based system, called an input scaling module, impacts its ability to detect changes or attacks. The authors found that simply removing or changing this module can make it look like the system is more or less robust, but this effect might come from how researchers compare versions rather than the module itself. The study shows that testing methods need clear rules about what changes count as attacks and which results really show improvements. The authors give advice on how to better check these kinds of quantum models.
What this means in practice
- •For quantum machine learning engineers: Better design verification for quantum attention models under input scaling variations in simulated detection tasks.
- •For cybersecurity analysts: More reliable evaluation frameworks for assessing robustness of quantum-based attack detectors on critical infrastructure data.
Tested on simulated data.
Authors
Owen Friedewald, Srikar Alla, Ali Shiri Sichani, Chi-Ren Shyu
Abstract
Removing an input-scaling module changes both a classifier and the perturbations reaching its encoder. A robustness difference can therefore reflect the comparison rule as well as the module. We demonstrate this problem in a four-qubit quantum-attention detector on generated power-grid trajectories. A learned scaling module appears beneficial at a fixed physical attack budget, but matching an upper bound on perturbations at the encoder reverses the ordering. Neither comparison alone establishes a robustness benefit caused by the module. The initial test also perturbs clean examples into attacked examples while retaining their original labels; tests restricted to already attacked examples do not establish a benefit. Replacing a trained model's input scales disrupts detection. Retraining its linear classification layer restores the detection rate, but changes individual predictions, leaving the comparison descriptive rather than causal. Two further design checks explain why the input quantum Fisher information regularizer cannot train this model's query parameters, and why removing confidence bounds does not establish a larger certified radius. The evidence is limited to ten seeds, exact simulation, synthetic data, and a restricted set of attacks; classical baselines achieve better clean prediction. The practical lesson is to specify which perturbation budget is fixed, check that attacks preserve labels and interventions preserve predictions, and distinguish exploratory controls from confirmatory evidence.