A Comprehensive Analysis of Accuracy and Robustness in Quantum Neural Networks

Abstract: Quantum Machine Learning (QML) has recently emerged as a highly promising research frontier. Within this domain, Quantum Neural Networks (QNNs),characterized by Variational Quantum Circuits (VQCs) at their core and featuring layers of quantum gates optimized by classical algorithms, have garnered significant attention. However, a rigorous and exhaustive evaluation of their practical performance remains largely incomplete. In this study, we conduct a comprehensive comparative analysis of three prominent hybrid classical-quantum architectures: Quantum Convolutional Neural Networks (QCNN), Quantum Recurrent Neural Networks (QRNN), and Quantum Vision Transformers (QViT), focusing on the critical dimensions of generalization, accuracy, and robustness. Our findings provide novel insights that address previous evaluative gaps. Notably, while these models exhibit exceptional performance on low-feature datasets such as MNIST, their learning efficacy degrades significantly when transitioned to high-feature datasets. Furthermore, convolutional-based models like QCNN appear less effective on high-dimensional data than other machine learning architectures. Additionally, while all models are susceptible to adversarial noise, traditional architectures, such as recurrent and convolutional networks, demonstrate superior resilience. Conversely, in the presence of quantum noise, the transformer-based architecture proves its strength by maintaining high robustness against measurement noise, channel noise, and finite-shot effects, whereas other architectures suffer marked performance declines. These results provide a granular perspective on the current state of the field and underscore the critical importance of tailoring model selection to the constraints of contemporary Noisy Intermediate-Scale Quantum (NISQ) environments.

• The paper's main contribution is a comprehensive benchmarking of three HCQNN architectures (QCNN, QRNN, and QViT) using classical and quantum-specific metrics.
• It employs detailed evaluations with metrics like accuracy, generalization bounds, Lipschitz constant, and average fidelity under both adversarial and quantum noise conditions.
• Findings reveal trade-offs between accuracy and robustness, highlighting QRNN’s superior resilience against adversarial attacks and QViT’s vulnerability.

Comprehensive Analysis of Accuracy and Robustness in Quantum Neural Networks

Architectural Overview and Model Taxonomy

The study "A Comprehensive Analysis of Accuracy and Robustness in Quantum Neural Networks" (2604.26110) rigorously benchmarks three hybrid classical-quantum neural network (HCQNN) architectures: Quantum Convolutional Neural Networks (QCNN), Quantum Recurrent Neural Networks (QRNN), and Quantum Vision Transformers (QViT). The experimental design incorporates both classical and quantum-specific performance metrics such as accuracy, generalization bounds, Lipschitz constant, and average fidelity, evaluated systematically under a suite of clean, adversarial, and quantum-noise conditions.

The model architectures evaluated in the study are depicted in detail:

Figure 1: Overall architecture of the hybrid classical-quantum neural networks: QViT (left), QCNN (center), and QRNN (right).

• QCNN leverages the inverse Multi-scale Entanglement Renormalization Ansatz (MERA) paradigm, directly utilizing quantum circuits for convolutional and pooling operations with polynomial depth, yielding $O(\log N)$ complexity.
• QRNN implements a staggered architecture for sequential data encoding, employing parameterized local quantum gates and entanglement to propagate temporal dependencies.
• QViT defines a quantum transformer variant, embedding image patches via quantum self-attention layers (QSALs) that exploit parameterized quantum circuits for nonlocal feature mixing and leverage Gaussian-projection mechanisms to compute attention coefficients.

Methodological Protocol and Evaluation Metrics

The experiment protocol encompasses:

1. Dataset Stratification: MNIST serves as the canonical low-feature dataset, while CIFAR-10 is representative of high-dimensional, complex data.
2. Preprocessing and Encoding: Amplitude and angle encoding strategies are employed depending on model architecture, affording compatibility with quantum state preparation constraints.
3. Performance Metrics:
   • Accuracy measured post-training on clean inputs.
   • Generalization Bound computed empirically and compared with theoretical upper bounds.
   • Robustness assessed via average fidelity (between adversarial and clean quantum states) and the Lipschitz constant, a proxy for sensitivity to input perturbations.
   • Quantum Noise Response, with measured accuracy under different quantum channel and measurement noise regimes.

To evaluate adversarial robustness, a diverse portfolio of attack algorithms was utilized, with Auto-PGD (APGD) ultimately selected due to its empirically observed maximal impact on model prediction rates.

Figure 2: Experimental methodology and metric evaluation framework.

Empirical Results and Comparative Analysis

Accuracy and Generalization Efficacy

On low-feature datasets (MNIST), all HCQNNs demonstrated high accuracy, with QViT achieving 99.5%, QCNN 97.3%, and QRNN 96.7%. For high-feature tasks (CIFAR-10), accuracy declines precipitously: QViT maintains the peak value at 69.2%, whereas QCNN and QRNN report 55.5% and 57.1% respectively. Notably, increasing dataset cardinality and training epochs did not yield improved accuracy for QRNN and QCNN, signaling constrained learning capacity for quantum architectures on complex input domains.

Theoretical generalization error bounds scale as $O(\sqrt{T \log T / N})$, and for both QCNN and QRNN, empirical generalization exhibited monotonic scaling with increased training samples (Figure 3, Figure 4), confirming theoretical expectations. QViT, however, deviates from predicted behavior, exhibiting diverging practical and theoretical generalization bounds.

Figure 3: Generalization bound of QRNN on CIFAR-10 cat vs. dog task.

Figure 4: Empirical alignment between theoretical and observed generalization error for QCNN on CIFAR-10.

Robustness to Classical Adversarial Noise

Adversarial testing under APGD indicated a distinct trade-off between accuracy and robustness. QViT, despite superior performance on clean data, instantly collapsed to 0% accuracy under minimal adversarial perturbations ($\epsilon=0.1$). In contrast, QCNN and QRNN displayed enhanced resilience: for $\epsilon=0.5$, QCNN and QRNN maintained accuracies of 26.6% and 45.5% respectively. QRNN consistently demonstrated the highest robustness, with minimal degradation over increasing adversarial intensities.

Figure 5: Adversarial success rate (ASR) of QCNN for FGSM, PGD, APGD, and MIM attacks; PGD and APGD yielded the highest ASR.

The Lipschitz constant, indicative of the maximal output variation for bounded input perturbation, was exceptionally low for QRNN (0.033) and QCNN (0.67). QViT displayed a deleterious Lipschitz constant (61.38), reflecting pronounced input sensitivity and explaining the model's adversarial vulnerability.

Figure 6: Lipschitz bound trajectories for QViT over training epochs (various dataset-class pairs and noise norms).

Robustness to Quantum-Mechanical Noise

Quantum noise modeling encompassed bit-flip, phase-flip, amplitude-damping, phase-damping, depolarization, as well as measurement and finite-shot effects.

• QCNN demonstrated moderate resilience to amplitude-damping and bit-flip noise, and pronounced immunity to phase-related noise channels up to moderate intensities.
• QViT maintained largely stable performance in the presence of physical and measurement noise, suggesting inherent robustness attributable to the transformer-based quantum self-attention layers.
• QRNN, while robust against measurement noise and finite-shot variations, exhibited susceptibility to amplitude-damping, with marked accuracy degradation observed beyond moderate decoherence probabilities.

  Figure 7: Impact of various quantum noise channels on QRNN accuracy.

Quantum-State Fidelity Across Attacks

Average fidelity traces indicated minimal state distance for QRNN and QCNN under adversarial attacks, substantiating architectural resilience. QViT, correlating with its accuracy collapse, exhibited a steep fidelity decline as attack strength increased, further confirming global sensitivity.

Figure 8: Comparative average fidelity trajectories for QNN models under adversarial perturbation.

Implications, Limitations, and Future Prospects

The experimental evidence underscores several pivotal insights:

• Model Selection is Application-Dependent: For current NISQ-era hardware, QViT achieves maximal accuracy but is acutely sensitive to adversarial perturbations and resource-prohibitive due to high parameter counts. QRNN achieves the best trade-off between learning efficacy and robustness, particularly for sequential or low-feature datasets, though it falters on challenging vision tasks.
• Cross-Model Generalization and Scaling Gaps: All evaluated QNNs generalize well on low-dimensional data, but maintain a clear handicap when upscaled to high-dimensional tasks. This gap is attributable to quantum resource limitations and inherent design constraints of PQC-based architectures.
• Adversarial and Quantum Noise Robustness Distinction: Robustness to classical adversarial attacks and quantum noise are orthogonal and architecture-dependent; increasing attention complexity (QViT) improves quantum noise immunity but undermines adversarial robustness.
• Quantum Metric Integration: The study reinforces the necessity of integrating quantum-native metrics (average fidelity, channel response) alongside classical performance metrics for comprehensive QNN evaluation.

The results suggest several pathways for enhancing QNN robustness and practical applicability:

• Architectural modifications to balance global and local receptive fields;
• Shallow circuit design and regularization to mitigate noise sensitivity;
• Advanced, trainable embedding methods for efficient state preparation;
• Expansion of experimental evaluation to include pure quantum optimizers and alternative tasks (e.g., detection, NLP sequences);
• Systematic exploration of parameter regimes to map out the accuracy-robustness trade-off frontier.

Conclusion

This rigorous comparative analysis systematically delineates the current operational frontier of hybrid classical-quantum neural networks across accuracy, generalization, and robustness axes. While QViT offers accuracy advantages, its architecture creates pronounced adversarial vulnerabilities and hardware burdens. QRNN and QCNN, though limited in absolute accuracy on complex datasets, provide superior robustness under both adversarial and quantum-mechanical noise. The insights and empirical frameworks put forth serve as both a benchmark and a foundation for future algorithmic, architectural, and hardware-level innovations in quantum deep learning.