Adversarial Effects on Expressibility and Trainability in Distributed Variational Quantum Algorithms

Abstract: Distributed quantum algorithms offer a promising pathway to scale variational quantum algorithms beyond the constraints of noisy intermediate-scale quantum hardware. However, existing approaches implicitly assume a trusted entanglement-sharing layer across quantum processors. We show that this assumption introduces a fundamental vulnerability: adversarial perturbations of shared entanglement induce structured gate-level noise that directly impacts quantum learning. We develop a framework that maps entanglement-level perturbations to gate-level noise via an explicit Kraus representation. To quantify their impact, we introduce Kraus expressibility, a metric that generalizes unitary expressibility to noisy quantum channels. We then establish a trade-off between Kraus expressibility and trainability of noisy quantum circuits through gradient variance analysis. Our analysis reveals that an adversary can manipulate Kraus expressibility to maintain sufficiently large cost gradients (avoiding barren plateaus) while systematically biasing optimization toward incorrect solutions. We validate these findings through numerical simulations, demonstrating adversarial degradation of expressibility and trainability.

• The paper introduces Kraus expressibility to quantify how adversarial noise in entanglement limits the diversity of accessible quantum circuit transformations.
• It demonstrates that adversarial perturbations bias optimization dynamics and lower cost gradient variance, undermining trainability in distributed VQAs.
• Simulations reveal that increased circuit depth amplifies noise effects, rendering even shallow circuits untrainable under targeted adversarial conditions.

Adversarial Effects on Expressibility and Trainability in Distributed Variational Quantum Algorithms

Introduction and Problem Formulation

This paper systematically analyzes vulnerabilities in distributed variational quantum algorithms (VQAs) arising from adversarial perturbations to inter-QPU entanglement. Distributed VQAs partition parameterized quantum circuits across spatially separated quantum processing units (QPUs), interconnecting them via entanglement to enable non-local gate execution. Prior architectures assume a trustworthy entanglement-sharing layer, but this assumption introduces vulnerabilities, especially in the NISQ paradigm where entanglement distribution occurs through networks susceptible to both environmental and targeted adversarial noise. The compromise of entangled states manifests as structured gate-level noise, directly altering optimization dynamics and solution validity in distributed quantum learning.

The paper constructs an adversarial framework for distributed VQAs through the cat-entangler/cat-disentangler protocol for non-local CNOTs. It distinguishes between weak adversaries (local noise injection at QPU level) and strong adversaries (direct manipulation of entangled Bell pairs in the distribution layer), providing a Kraus channel representation for both. The practical implication is that adversarial disturbances to entanglement propagate immediately to the learning layer, biasing quantum circuit outputs in ways that may evade detection, especially given resource limitations in NISQ verification.

Figure 1: (a) Distributed VQAs under adversarial influence—strong adversarial noise corrupts network-shared entanglement, weak local noise disrupts optimization; (b) Kraus expressibility limits accessible transformation space, restricting solution coverage.

Kraus Expressibility: Generalization of Unitary Expressibility

To quantify adversarial impact, the paper introduces Kraus expressibility—a measure extending the unitary expressibility of PQC ensembles to noisy CPTP channel ensembles shaped by both intrinsic and adversarial noise. For a PQCh-ansatz of depth $L$, the composed channel is $\mathcal{E}_{\vec{\theta}}^{\mathbf{p}}$, parameterized by noise vectors $\mathbf{p}$ and trainable parameters $\vec{\theta}$. Kraus expressibility is formalized via a super-operator that compares the ensemble of noisy channel moments to those of a Haar-random unitary ensemble.

A key result is the analytical expression for Kraus expressibility norm:

$$(\Delta_{\mathcal{T}^\rho})^2 = (\alpha^2 + \beta^2) d^2 + 2 \alpha \beta d - 2[\alpha + \beta \bar{\nu}] + \mathcal{N}_{\text{noise}},$$

where $\bar{\nu}$ is ensemble-averaged output state purity, and $\mathcal{N}_{\text{noise}}$ quantifies channel diversity loss due to noise-induced correlations. Kraus expressibility decays with both purity loss and noise-induced ensemble correlations, characterizing how adversarially-induced channel structure can reduce the diversity of accessible circuit transformations.

Channel Equivalence and Adversarial Noise

A central theoretical finding is the explicit Kraus operator representation of adversarial effects in distributed non-local CNOT gates. Perturbations to shared entanglement produce a noisy channel $\mathcal{K}^{\mathbf{p}}$ parameterized by the adversary's coefficients, generalizing ideal unitary gates to ensembles of noisy gates. In the adversary-free scenario, Kraus operators collapse to ideal CNOTs; in adversarial scenarios, the channel shifts to alternative unitary operations or mixed CPTP dynamics, potentially masking deviations under quantum channel discrimination constraints.

Trainability–Expressibility Trade-offs

Expressibility alone does not guarantee learnability—the cost gradient must exhibit sufficient variance to enable optimization. The paper establishes a quantitative link between the Kraus expressibility norm and cost gradient variance for PQCh-ansätze:

$$|\mathbb{E}[{\rm var}_{\vec{\theta}_k}(\partial_k C)] - {\rm var}_{\mathcal{R}}(\partial_k C)| \leq 4 \Vert \mathcal{A}^2_{\mathcal{T}_R}(\rho_0^{\otimes 2})\Vert_2 \int_{\mathcal{T}_L} d\nu(\mathcal{E}_L) \Vert \mathcal{E}_L^\dagger(\mathcal{H}) \Vert_2^2,$$

where $\mathcal{A}_{\mathcal{T}_R}$ is the expressibility super-operator for the right subcircuit and $\mathcal{E}_{\vec{\theta}}^{\mathbf{p}}$0 represents backward-evolved observables.

In highly expressive regimes, cost gradient variance adheres to the exponential scaling characterized by barren plateaus. However, the adversary may tune noise to avoid plateaus by maintaining non-vanishing gradient variance while systematically biasing the optimization landscape, producing solutions outside the desired set.

Numerical Evaluation of Adversarial Impact

Comprehensive simulations demonstrate adversarial noise-induced degradation in both expressibility and trainability. Circuit depth and adversarial noise (concurrence-lowering perturbations) synergistically lower Kraus expressibility norms, with compounding effect as circuit layers increase. Even shallow circuits can become untrainable under moderate adversarial influence, as cost gradient variance vanishes.

Figure 2: Adversarial impact on trainability for $\mathcal{E}_{\vec{\theta}}^{\mathbf{p}}$1 qubits: (a) Kraus expressibility norm decays with depth and noise; (b) adversarial noise disables trainability in shallow circuits; (c) gradient variance diminishes with concurrence, impeding optimization.

Simulations further show that restricted parameter initialization and local cost functions—common barren plateau mitigation strategies—lose efficacy under adversarial conditions. As noise increases, gradient variance drops precipitously regardless of initialization restriction, indicating fundamental limits to training robustness in the presence of adversarially structured nonlocal gate noise.

Practical and Theoretical Implications

This work illuminates critical adversarial vulnerabilities in distributed quantum learning, specifically targeting the entanglement-sharing layer foundational to scaling beyond single-device NISQ systems. It establishes that adversaries can engineer noise profiles to evade detection, bias solutions, and nullify standard mitigation protocols, even potentially maintaining non-vanishing gradients to mask attacks from verification procedures. The generalization to Kraus expressibility provides a framework for evaluating PQC vulnerability to both hardware and adversarial noise.

The analytical results motivate the development of adversarially robust training and verification protocols; future extensions should address efficacy under realistic hardware constraints (decoherence, network purification), and investigate ansätze or architectures resilient to correlated channel attacks.

Conclusion

Distributed VQAs are fundamentally constrained by the security and integrity of shared entanglement. This paper rigorously maps adversarial entanglement-level perturbations to gate-level noise via Kraus channel formalism and quantifies their impact through Kraus expressibility, directly linking expressibility to gradient variance and learning dynamics. Adversarially-induced noise may bias optimization, nullify mitigation strategies, and expose profound vulnerabilities in distributed quantum learning.

The study establishes the necessity for adversarially-aware protocol design, with robust verification mechanisms and noise-resistant ansätze. Extending expressibility metrics to more general channel ensembles and evaluating real-world attack feasibility constitute vital future directions.