Robust Quantum State Tomography

• The paper introduces a truncated mean estimator for robust shadow tomography, effectively mitigating adversarial corruption of quantum measurement data.
• By leveraging coordinate-wise truncation and t-design measurements, the method achieves near-optimal error bounds and minimal sample complexity in high-dimensional regimes.
• Robust shadow tomography serves as a subroutine for full state estimation, enabling recovery of low-rank quantum states despite worst-case disturbances.

Adversarially robust state tomography addresses the quantum learning problem of reconstructing properties of an unknown quantum state—or the state itself—in the presence of arbitrary, worst-case corruption of a fraction of measured data points. Its development is motivated by the need to guarantee state estimation accuracy even under strong non-stochastic disturbances, such as adversarial attacks on measurement outcomes, calibration drifts, or experimental tampering.

1. Adversarial Corruption Models in Quantum Tomography

The foundational adversarial corruption model posits that given $n$ copies of a $d$-dimensional unknown quantum state $\rho$ and a non-adaptive measurement schedule—e.g. specified POVMs $M_1,\dots, M_n$—an adversary who knows the chosen measurements a priori can arbitrarily corrupt up to $\gamma n$ of the measurement outcomes. The observed data stream $y = (y_1, \dots, y_n)$ then differs from the ideal measurement outcome string $x = (x_1, \dots, x_n)$ in at most $\gamma n$ entries but may have arbitrarily chosen corrupted values in these locations. The tomography algorithm must, from $y$ and the measurement schedule, reconstruct high-accuracy estimates $E_j$ for $M$ target observables $\operatorname{Tr}(O_j \rho)$, or reconstruct $\rho$ itself, with error and sample complexity guarantees quantified as a function of $d$, $M$, $\gamma$, and (for low-rank settings) the state rank $r$ (Aliakbarpour et al., 5 Dec 2025).

The adversarial model generalizes to other noise patterns. In (Kalev et al., 2015), the measurement map is $f = \mathcal{M}_E[\sigma] + e$, where $e$ is an arbitrary error vector with $\|e\| \leq \epsilon$ in some norm, modeling worst-case (adversarial) measurement deviations.

2. Failure of Standard Shadow Tomography Under Adversarial Corruption

The classical shadows algorithm of Huang–Kueng–Preskill (HKP20), based on median-of-means estimation, fails catastrophically under adversarial corruption. In the Haar-POVM scheme, the median-of-means estimator is highly sensitive to batch-level outliers, as an adversary can concentrate corrupted samples in a way that shifts batch means by $O(\gamma d)$ per batch, resulting in an overall worst-case error $\Omega(\gamma d)$ for median-of-means, even for a single observable such as projective fidelity estimation [(Aliakbarpour et al., 5 Dec 2025), Theorem 2.4]. This breakdown is particularly severe as $d$ grows, rendering naive shadow tomography or direct per-observable estimation inadequate in the high-dimensional or large-$M$ setting.

3. Robust Shadow Tomography: Truncated Mean Estimation

To circumvent adversarial fragility, (Aliakbarpour et al., 5 Dec 2025) introduces a robust, coordinate-wise truncated mean estimator:

1. For each copy $i=1,\dots,n$:
   • Sample a random unitary $U_i$ (from an approximate $t$-design with $t \approx \log(1/\gamma)$),
   • Apply $U_i$ to the $i$th copy, measure in the computational basis to obtain $|b_i\rangle$, set $|v_i\rangle = U_i^\dagger |b_i\rangle$,
   • Form the classical shadow $\sigma_i = (d+1)|v_i\rangle\langle v_i| - I$.
2. For each target observable $O_j$:
   • Compute samples $x_{j,i} = \operatorname{Tr}[O_j \sigma_i]$ for $i=1,\dots, n$,
   • Apply the truncated mean: sort $\{x_{j,1},\dots,x_{j,n}\}$, drop the top and bottom $2\gamma$ fraction, and average the remaining values to obtain the estimate $\hat{E}_j$.

The truncation threshold is set to eliminate up to $2\gamma n$ extreme outliers per observable coordinate, harnessing robust statistics to maintain concentration around the true mean even with adversarially chosen contaminated samples.

Theoretical analysis leverages uniform bounds on higher central moments of the shadow samples—specifically,

$$\mathbb{E}_{v \sim D_\rho} \left[ |\langle v|O|v\rangle - \mathbb{E}[\langle v|O|v\rangle]|^h \right] \leq (C h)^h \cdot \|O\|_{HS}^h / (d+1)^h$$

for Hermitian $O$, where $\|\cdot\|_{HS}$ is the Hilbert–Schmidt norm [(Aliakbarpour et al., 5 Dec 2025), Thm 3.2]. Under these moment bounds, standard results imply that truncated mean estimation incurs an additive error $O(\gamma \log(1/\gamma) \|O_j\|_{HS})$ per observable, with logarithmic dependence absorbed in $Õ(\cdot)$ notation. The required sample complexity to achieve this error for $M$ observables is $n = O(\gamma^{-2} \log(M/\delta))$ (Aliakbarpour et al., 5 Dec 2025).

This estimator matches an information-theoretic lower bound: $$\varepsilon = \tilde{\Omega}(\gamma \min\{\sqrt{M}, \sqrt{d}\})$$ for any non-adaptive algorithm [(Aliakbarpour et al., 5 Dec 2025), Thm 4.1]. Thus, the truncated-mean paradigm achieves optimal (up to logarithms) adversarial robustness in the high-dimensional, multi-observable regime.

4. From Robust Shadow Tomography to Full State Estimation

Robust shadow tomography serves as a generic subroutine for adversarially robust full state tomography. The reduction proceeds via an $\epsilon/5$-net $\mathcal{N}$ over rank-$r$ density matrices in trace norm, and the construction of pairwise distinguishing observables—specifically, the Holevo–Helstrom POVM for each pair $\sigma_i, \sigma_j \in \mathcal{N}$, yielding observables $O_{ij}$ with rank at most $2r$ and $\|O_{ij}\|_{HS} \leq \sqrt{2r}$. Applying the robust shadow protocol to the set $\{ O_{ij} \}$, and selecting the net point $\sigma_\ell \in \mathcal{N}$ minimizing $$\max_i |\hat{E}_{i\ell} - \operatorname{Tr}[O_{i\ell} \sigma_\ell]|$$, returns an estimate $\hat{\rho}$ satisfying trace norm error $O(\gamma \sqrt{r} + \epsilon)$ for rank-$r$ true states, with copy complexity $n = \tilde{O}(dr / \gamma^2)$ (Aliakbarpour et al., 5 Dec 2025).

This closes the prior gap established in [ABCL25], where a minmax-optimal error $\epsilon = \tilde{O}(\gamma \sqrt{r})$ was only achievable at the cost of pseudo-polynomial sample complexity in $d$. The robust shadow method achieves both optimal error and (nearly) information-theoretic minimal copy complexity.

5. Alternative and Complementary Paradigms

Parallel lines of work validate and extend adversarial robustness principles:

• The strictly-complete POVM framework exploits positivity constraints to achieve robust estimation. Measuring a small set of random orthonormal bases, forming a strictly-complete POVM for rank-$r$ states, enables convex optimization recovery schemes $\min_X \mathcal{C}(X)$ subject to $||\mathcal{M}_E[X] - f|| \leq \epsilon, X \geq 0$, with worst-case error scaling $||\hat{X} - \sigma|| \leq 2 C_E \epsilon$ in the adversarial model (Kalev et al., 2015).
• Convex programs penalizing low rank and sparse error, such as $$\min_{\tilde{\rho}, \tilde{e}} \frac{1}{2} ||y - \mathcal{M}(\tilde{\rho}) - \tilde{e}||_2^2 + \tau_1 \|\tilde{\rho}\|_* + \tau_2 \|\tilde{e}\|_1$$, jointly reconstruct the state and unstructured/sparse adversarial errors, extending classical corrupted sensing to the quantum domain (Ma et al., 23 May 2024, Li et al., 2014).
• Agnostic tomography for structured state classes (e.g., product states, stabilizer product states) matches the adversarial (worst-case) model by reducing quantum tomography to robust classical learning tasks (such as robust mean estimation in product distributions), with copy and runtime complexity polynomial (or quasipolynomial) in natural parameters and approximation error (Arulandu et al., 9 Oct 2025, Grewal et al., 4 Apr 2024).

These paradigms are summarized in the table below:

Approach	Measurement Model	Error Guarantee	Sample Complexity
Robust classical shadows (Aliakbarpour et al., 5 Dec 2025)	Random local (t-design, non-adaptive)	$Õ(\gamma \max_j \|O_j\|_{HS})$	$O(\gamma^{-2} \log(M/\delta))$
Strictly-complete POVM (Kalev et al., 2015)	Few random bases (projective), non-adaptive	$C_E \epsilon$ (arbitrary noise norm)	$k = O(r)$ (conjectured)
Robust convex program (Ma et al., 23 May 2024, Li et al., 2014)	Pauli or general measurements	$O(\delta)$, solves for $\|\hat{\rho} - \rho\|_F + \| \hat{e} - e \|_2$	$m = O(rd \log^2 d + s \log(m/s))$
Product state reduction (Arulandu et al., 9 Oct 2025)	Single-qubit product; adaptive crucial	$O(\epsilon \log(1/\epsilon))$	$\widetilde{O}(n^4/\epsilon^2)$

6. Limitations and Outstanding Challenges

Despite theoretical optimality, significant open questions remain:

• The net-search required for low-rank robust state tomography is exponential in $dr \log(1/\epsilon)$; no known polynomial-time algorithm achieves the same minmax error and copy complexity in the general (approximate) setting (Aliakbarpour et al., 5 Dec 2025).
• All main results are for non-adaptive, single-copy measurement protocols. Whether adaptivity or entangled measurements can improve the tradeoff curves—specifically, the scaling in $\gamma$, $d$, or $r$—is unresolved (Aliakbarpour et al., 5 Dec 2025).
• Worst-case adversarial models used here are stringent; intermediate models (e.g., bounded adversarial memory, restricted attack patterns, partial stochasticity) may allow interpolation with error mitigation or classical robust statistics (Aliakbarpour et al., 5 Dec 2025).
• The precise minimal measurement designs—such as explicit, deterministic rank-$r$ strictly-complete POVMs—and sharp constants in error bounds are known only up to conjectures or via numerics (Kalev et al., 2015).
• In agnostic tomography for mixed state classes, adaptivity is proven to be information-theoretically required for product mixed state tomography with $o(1)$ trace-norm error (Arulandu et al., 9 Oct 2025).

7. Practical Implementation and Performance

Robust algorithms described above are implementable with tractable per-sample and per-iteration computational cost:

• Truncated mean robust shadow tomography involves only basic data sorting/truncation and is scalable; random $t$-design or Haar-uniform measurements are realizable as single-copy local unitaries (Aliakbarpour et al., 5 Dec 2025).
• Convex programs (nuclear norm + $\ell_1$ penalty) can be solved efficiently using proximal or ADMM methods, with each iteration dominated by low-rank SVDs and soft-thresholding, compatible with moderate experimental data rates (Ma et al., 23 May 2024, Li et al., 2014).
• Product state/correlated classical reductions are polynomial in $n$ for typical error targets, with robust mean estimation modules drawn from the mature classical literature (Arulandu et al., 9 Oct 2025).

Numerical studies confirm stability to adversarial corruption up to significant fractions ($10-20\%$) of the data, with accurate state recovery observed for moderate numbers of copies, basis settings, and measurement rates (Ma et al., 23 May 2024, Li et al., 2014, Kalev et al., 2015). These results indicate that adversarially robust state tomography is both theoretically optimal (up to logarithms, information-theoretic lower bounds) and practically realizable for near-term quantum devices.

---

References:

• "Shadow Tomography Against Adversaries" (Aliakbarpour et al., 5 Dec 2025)
• "The power of being positive: Robust state estimation made possible by quantum mechanics" (Kalev et al., 2015)
• "Agnostic Product Mixed State Tomography via Robust Statistics" (Arulandu et al., 9 Oct 2025)
• "Agnostic Tomography of Stabilizer Product States" (Grewal et al., 4 Apr 2024)
• "Corrupted sensing quantum state tomography" (Ma et al., 23 May 2024)
• "A Robust Compressive Quantum State Tomography Algorithm Using ADMM" (Li et al., 2014)