Quantum Interval Bound Propagation for Certified Training of Quantum Neural Networks

Abstract: Quantum machine learning is a promising field for efficiently learning features of a dataset to perform a specified task, such as classification. Interval bound propagation (IBP) is a popular certified training method in classical machine learning, where the lower and upper bounds are tracked throughout the model. These bounds are used during training to ensure that the model is certified to predict the correct label even under adversarial perturbations. While IBP is successful in classical domain, there are limited certified training efforts in quantum domain. In this paper, we present quantum interval bound propagation (QIBP) to establish a certified training routine for quantum machine learning, certifying the accuracy of models under adversarial perturbations. We implement QIBP using both interval and affine arithmetic to explore the tradeoffs between the two implementations in terms of accuracy and other design considerations. Extensive evaluation demonstrates that the resulting certified trained models have robust decision boundaries, guaranteed to predict the correct class for the samples within the trained adversarial robustness bounds.

• The paper introduces a novel certification method using interval and affine arithmetic to provide provable robustness for quantum classifiers.
• It employs a dual-objective loss function combining cross-entropy and margin loss to optimize worst-case decision boundaries under adversarial conditions.
• Experimental results on datasets like MNIST demonstrate that affine arithmetic yields tighter certification bounds and improves both test and robust accuracies.

Quantum Interval Bound Propagation for Certified Training of Quantum Neural Networks: Technical Summary and Analysis

Motivation and Background

Quantum machine learning (QML) has demonstrated potential for superior learning efficiency and feature extraction relative to classical approaches, particularly in parameter-constrained regimes. However, variational quantum classifiers (VQCs) and related QML models are susceptible to adversarial perturbations, analogous to vulnerabilities observed in classical neural networks. Existing defense strategies—including adversarial training and generative purification methods—address these vulnerabilities post hoc and often lack guaranteed robustness for unseen or arbitrary attacks. Certified training, widely adopted in classical domains, offers provable guarantees by constraining model decision boundaries against bounded input perturbations using interval methods. This paper extends certified training to quantum models, focusing on interval bound propagation (IBP) as a certification mechanism tailored for QML.

Figure 1: MNIST digit 2 input. Adversarial perturbation causes quantum classifier misclassification, illustrating the need for certified robustness.

Quantum Interval Bound Propagation (QIBP) Framework

The central technical contribution is the Quantum Interval Bound Propagation (QIBP) algorithm, establishing certified training for QML via two mathematical approaches: interval arithmetic and affine arithmetic. Both techniques compute and propagate input uncertainty through quantum layers (feature mapping, ansatz, measurement), optimizing logits such that worst-case bounds ensure correct class assignment.

Figure 2: Schematic of QIBP. Intervals are propagated across quantum layers; final output logits guarantee correct class lower bound exceeds all incorrect class upper bounds.

Interval Arithmetic

Interval arithmetic maintains lower and upper bounds for every quantum state amplitude, propagating these bounds through linear transformations (parameterized gates) and permutations (entangling gates like CNOT). Complex arithmetic is handled by decomposing into real and imaginary intervals, and nonlinear activations (e.g., measurement) require exhaustive search for minimum and maximum within the interval. The algorithm ensures decision boundary robustness by optimizing the model to maximize margin between correct and incorrect class bounds.

Figure 3: Propagation of intervals through quantum model layers, illustrating bound adjustment at each stage.

Affine Arithmetic

Affine arithmetic refines interval representation using linear combinations with noise coefficients. This method produces tighter bounding polytopes via polynomial approximations (as opposed to rectangular intervals), at the cost of elevated computational complexity. Nonlinear layer effects (such as measurement or squaring amplitudes) add new residual noise terms, requiring Chebyshev approximation to overbound additional uncertainty. Ultimately, affine arithmetic yields optimized certification bounds for quantum logits, outperforming interval arithmetic where precision is critical.

Figure 4: Interval arithmetic operations underpin both interval and affine bound propagation.

Training Procedures and Loss Functions

Certified training is realized through dual-objective loss functions: standard cross-entropy for accuracy and a robust margin loss enforcing separation between correct class lower bounds and incorrect class upper bounds (with a margin target, typically $\gamma=0.2$). The hyperparameter $\kappa$ schedules relative weight of these objectives, and $\epsilon$ specifies the adversarial perturbation radius for certification.

Experimental Results

Training was conducted on MNIST, FMNIST, and KMNIST datasets, with VQC models of varying qubit count (4–10), class number (2–10), and layer depth (2–8). Three primary metrics were assessed: test accuracy (standard prediction), certified accuracy (provable robustness to $\epsilon$), and PGD attack accuracy (empirical robustness against adversarial samples).

QIBP with interval arithmetic demonstrated tight certification on shallow/narrow models; for MNIST with 4 qubits and 2 layers, test and certified accuracies were within 1% ($96.36\%$ vs. $95.37\%$). However, as model complexity increased (more qubits, classes, layers), certified accuracy diverged—reflecting interval arithmetic’s looseness.

Affine arithmetic substantially improved certification gaps. For example, MNIST with 8 qubits, 2 classes, and 8 layers achieved $99.67\%$ test accuracy and $99.43\%$ certified accuracy, and margin loss consistently produced superior bounds relative to cross-entropy loss in most configurations. PGD attack accuracy tracked closely with certified and test values, indicating practical upper bounds matched provable robustness.

Figure 1: Sample robust accuracy results for MNIST under adversarial perturbation.

Figure 4: Interval arithmetic mechanism supporting certified bound propagation.

Hyperparameter Analysis

The sensitivity analysis revealed:

• $\epsilon$ increases: higher robustness radius decreased certified accuracy, especially for models with more features (qubits/classes).
• $\kappa$ decreases: placing more emphasis on certification term improved certified accuracy in shallow models but could degrade test accuracy in deeper networks.
• Depth, width, and multiclass complexity: higher capacity models struggled to maintain tight certified bounds, particularly as the number of classes increased.

These trends demonstrate a tradeoff between expressiveness and certifiable robustness in QML, mirroring classical neural network observations.

Theoretical and Practical Implications

QIBP introduces a scalable, certifiable training methodology for quantum neural networks, permitting provable robustness against adversarial input perturbations. The dual arithmetic approaches enable practitioners to choose between computational efficiency and certification tightness. In practical quantum applications (such as quantum image classifiers), QIBP can inform security and reliability strategies, enabling deployment in adversarial environments with formal guarantees.

Theoretically, this establishes a foundation for formal verification-driven quantum learning, opening inquiry into further tightening arithmetic bounds, adapting classical certification tools (e.g., semidefinite relaxation, abstract interpretation), and exploring robustness margins in more expressive quantum architectures (beyond VQC). Future directions include extending QIBP to quantum generative models, integrating with quantum formal verification workflows, and optimizing quantum-specific loss formulations.

Conclusion

Quantum interval bound propagation (QIBP) provides certified training for variational quantum classifiers, leveraging interval and affine arithmetic for adversarial robustness. Empirical results confirm tight certifications in well-parameterized models, and margin loss further enhances robust decision boundary formation. The framework presents a practical toolchain for deploying reliable quantum classifiers and establishes a foundation for subsequent quantum model verification and robust learning research.