Noise-Aware Sample Injection

• Noise-aware sample injection is a method that introduces calibrated perturbations into inputs, latent states, or quantum gates to improve robustness and mitigate errors.
• It is applied across various domains—from quantum circuits and image augmentation to language models—each using tailored noise models and injection loci.
• Recent formulations combine noise injection with post-processing like normalization and quantization, yielding significant gains in accuracy and privacy.

Noise-aware sample injection denotes the deliberate introduction of controlled perturbations into a sample, an internal representation, or a physical execution path under an explicit noise model, with the perturbation then used to alter training dynamics, inference behavior, or both. In parameterized quantum circuits, the formulation is exemplified by QuantumNAT, which inserts quantum error gates according to realistic hardware noise models and then compensates their effect through post-measurement normalization and quantization (Wang et al., 2021). Closely related formulations appear in dephasing waveform injection for quantum hardware, image-level augmentation for convolutional networks, event-stream corruption for event cameras, diffusion-model membership inference and adversarial purification, hidden-state perturbation for hallucination detection, adaptive privacy-preserving inference, and latent-space perturbation for synthetic data generation (Murphy et al., 2021, Akbiyik, 2023, Kowalczyk et al., 4 Jun 2025, Li et al., 18 Oct 2025, Sun et al., 6 Jun 2025, Liu et al., 6 Feb 2025, Kariyappa et al., 2021, Shen et al., 19 Jun 2025).

1. Conceptual scope and formal structure

Published formulations differ chiefly in the locus of perturbation. At the input level, image augmentation uses corrupted images $\tilde x$, event-based vision superimposes synthetic shot-noise events, and adaptive privacy injects sample-dependent perturbations directly into $X$ (Akbiyik, 2023, Kowalczyk et al., 4 Jun 2025, Kariyappa et al., 2021). At the latent or hidden-state level, one finds latent perturbation $z_i' = z_i + \eta_i$, decoder-state perturbation $\hat a_t = h_t + \epsilon_t$, and transformer activation perturbation $\tilde h_t^l = h_t^l + \epsilon$ (Shen et al., 19 Jun 2025, Kedzie et al., 2019, Liu et al., 6 Feb 2025). In quantum settings, injection may target either discrete gate locations through Pauli insertions or continuous control phases through virtual-$Z$ rotations generated from a prescribed spectrum (Wang et al., 2021, Murphy et al., 2021).

Across these settings, the perturbation law is not arbitrary. The cited work specifies Gaussian, uniform, Laplace, Poisson, salt-and-pepper, Bernoulli, Pauli-twirled, and geometry-aware manifold-constrained perturbations, and in several cases calibrates magnitude through task-specific criteria such as Structural Similarity Index (SSIM), score norms, hardware error tables, or privacy parameters (Akbiyik, 2023, Jacobsen et al., 24 Sep 2025, Sun et al., 6 Jun 2025, Kariyappa et al., 2021). This suggests that noise-aware sample injection is less a single algorithm than a design pattern in which the perturbation distribution, its insertion locus, and the downstream correction or selection mechanism are co-designed.

A second recurrent structural feature is asymmetry between training and deployment. Some methods inject during training and disable perturbations at test time, as in Noise Injection Node Regularization and several augmentation-based CNN pipelines (Levi et al., 2022, Akbiyik, 2023). Others inject during inference to expose uncertainty, preserve privacy, or purify adversarial examples (Liu et al., 6 Feb 2025, Kariyappa et al., 2021, Sun et al., 6 Jun 2025). QuantumNAT occupies an intermediate position: it injects realistic noise during training, then applies the same post-measurement normalization and quantization procedure during inference on real hardware (Wang et al., 2021).

2. QuantumNAT and the PQC-specific formulation

QuantumNAT was introduced for Parameterized Quantum Circuits (PQC) and Quantum Neural Networks (QNN), where large quantum noises on near-term hardware produce severe degradation relative to noise-free simulation. The motivating example in the paper is an accuracy gap of over $60\%$ between noise-free simulation and noisy execution on IBMQ-Yorktown for MNIST-4 classification (Wang et al., 2021). The method is explicitly PQC-specific rather than a generic mitigation layer.

Its training-time injection mechanism is built from realistic noise models published by hardware providers. For each basis gate, a Pauli-twirled gate error model is represented as

$$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$

with $p_0 \simeq 1-(p_x+p_y+p_z)$, and the training circuit is modified by sampling $\delta \in \{X,Y,Z,\mathrm{None}\}$ after each gate and inserting a Pauli-$X$0 gate immediately after the ideal gate whenever $X$1 (Wang et al., 2021). Readout noise is modeled separately: each qubit $X$2 has a $X$3 confusion matrix $X$4 with

$X$5

The injected readout noise remaps ideal bit-probabilities through $X$6.

The mathematical rationale begins from a noisy channel $X$7 acting on the ideal density matrix $X$8:

$X$9

For a single-qubit $z_i' = z_i + \eta_i$0-basis expectation, the ideal and noisy measurements are

$z_i' = z_i + \eta_i$1

Writing $z_i' = z_i + \eta_i$2 yields

$z_i' = z_i + \eta_i$3

with

$z_i' = z_i + \eta_i$4

and

$z_i' = z_i + \eta_i$5

In practice, for small noise, $z_i' = z_i + \eta_i$6 and $z_i' = z_i + \eta_i$7 is a small shift. QuantumNAT uses this approximately affine distortion model to motivate downstream normalization and discretization (Wang et al., 2021).

Operationally, each training iteration takes a base circuit $z_i' = z_i + \eta_i$8, inserts Pauli errors gate by gate, optionally scales non-None probabilities by a global noise factor $z_i' = z_i + \eta_i$9, executes the resulting circuits, applies readout-error sampling, normalizes the measurement outputs, quantizes them, computes a supervised loss plus a quantization regularizer, and updates $\hat a_t = h_t + \epsilon_t$0 by back-propagation. The framework is implemented in TorchQuantum (Wang et al., 2021).

3. Post-measurement normalization, quantization, and correlated quantum injection

QuantumNAT’s post-measurement normalization is derived from the empirical relation

$\hat a_t = h_t + \epsilon_t$1

For each qubit $\hat a_t = h_t + \epsilon_t$2 and a batch of $\hat a_t = h_t + \epsilon_t$3 examples, the noisy outputs $\hat a_t = h_t + \epsilon_t$4 are summarized by

$\hat a_t = h_t + \epsilon_t$5

The normalized output is then

$\hat a_t = h_t + \epsilon_t$6

If $\hat a_t = h_t + \epsilon_t$7 varies little over the batch and is approximated by a constant $\hat a_t = h_t + \epsilon_t$8, then the normalized noisy distribution matches the normalized noiseless one exactly:

$\hat a_t = h_t + \epsilon_t$9

The reported empirical effect is a $\tilde h_t^l = h_t^l + \epsilon$0–$\tilde h_t^l = h_t^l + \epsilon$1 increase in per-qubit SNR (Wang et al., 2021).

The subsequent post-measurement quantization clips $\tilde h_t^l = h_t^l + \epsilon$2 to $\tilde h_t^l = h_t^l + \epsilon$3 and quantizes uniformly into $\tilde h_t^l = h_t^l + \epsilon$4 levels:

$\tilde h_t^l = h_t^l + \epsilon$5

An auxiliary loss

$\tilde h_t^l = h_t^l + \epsilon$6

encourages outputs to remain near quantization bins. The intended effect is denoising by snapping small residual fluctuations to stable centroids. In combination, noise injection, post-measurement normalization, and post-measurement quantization improve accuracy by up to $\tilde h_t^l = h_t^l + \epsilon$7 across $\tilde h_t^l = h_t^l + \epsilon$8 classification tasks on $\tilde h_t^l = h_t^l + \epsilon$9 quantum devices, and achieve over $Z$0 $Z$1-class, $Z$2 $Z$3-class, and $Z$4 $Z$5-class classification accuracy measured on real quantum computers (Wang et al., 2021).

A distinct but related quantum formulation appears in SchWARMA-based dephasing injection, which targets temporally correlated noise rather than independent gate-local errors. There the phase noise sequence $Z$6 is generated by an ARMA recursion,

$Z$7

with transfer function

$Z$8

and then injected as virtual-$Z$9 rotations interleaved with gates,

$60\%$0

The paper validates arbitrary injected spectra, including band-pass, double band-pass, and $60\%$1 families, by both classical PSD measurement and quantum noise spectroscopy (Murphy et al., 2021). This suggests that within quantum computing, noise-aware sample injection spans both stochastic error-gate insertion and engineered correlated control-phase modulation.

4. Input-space and manifold-aware injection

For classical vision models, one established form of noise-aware sample injection is on-the-fly input augmentation. In CNN training, five noise models are defined explicitly: additive Gaussian, multiplicative speckle, salt-and-pepper, Poisson, and occlusion. Magnitudes are calibrated not by raw variance alone but by a common perceptual scale using SSIM, computed on $60\%$2 sampled training images and then inverted via fitted curves to obtain the parameter corresponding to a target MSSIM level (Akbiyik, 2023). The reported heuristic is to target an SSIM of about $60\%$3 when injecting noise into training images; at MSSIM $60\%$4 the method gives the best trade-off between robustness and clean accuracy, while below $60\%$5 denoising may be required instead. In the reported experiments, ResNet-18 V2 was trained for $60\%$6 epochs with Adam, learning rate $60\%$7, no weight decay, and batch-norm as in the original architecture (Akbiyik, 2023).

Event-based vision uses a different stochastic substrate. There the raw signal is a set of events $60\%$8, and noise is injected as shot-noise events drawn from a spatially uniform Poisson process of rate $60\%$9 Hz/px, approximated by Bernoulli trials at time resolution

$$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$0

with event probability

$$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$1

Noise events are merged with the original sample, or equivalently

$$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$2

in representation space. During training, $$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$3 is sampled per sample from the uniform grid $$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$4 Hz/px, with no architectural changes and no auxiliary denoising losses (Kowalczyk et al., 4 Jun 2025). The reported effect is stable performance over a range of noise intensities and the highest average classification accuracy across CNNs, ViTs, SNNs, and GCNs, with the main trade-off being a $$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$5 drop at $$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$6 in exchange for stable performance up to $$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$7 Hz/px (Kowalczyk et al., 4 Jun 2025).

A more structured alternative is geometry-aware injection on a Riemannian data manifold $$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$8. Instead of adding ambient Gaussian noise, one may project noise onto the tangent space,

$$E_g = \{X:p_x,\;Y:p_y,\;Z:p_z,\;\mathrm{None}:p_0\},$$9

and then either use $p_0 \simeq 1-(p_x+p_y+p_z)$0, map back to the manifold through the exponential map $p_0 \simeq 1-(p_x+p_y+p_z)$1, or simulate intrinsic Brownian motion in local coordinates (Jacobsen et al., 24 Sep 2025). The theoretical regularizer becomes

$p_0 \simeq 1-(p_x+p_y+p_z)$2

which penalizes tangential derivatives rather than all ambient directions. Empirically, geodesic and Brownian-motion noise improve test MSE by $p_0 \simeq 1-(p_x+p_y+p_z)$3–$p_0 \simeq 1-(p_x+p_y+p_z)$4 on highly curved manifolds and exhibit much flatter loss curves as a function of $p_0 \simeq 1-(p_x+p_y+p_z)$5 (Jacobsen et al., 24 Sep 2025).

Adaptive Noise Injection for inference privacy adds a further input-space variant in which the perturbation is sample-specific:

$p_0 \simeq 1-(p_x+p_y+p_z)$6

The optimization objective balances a primary-task loss with a privacy loss weighted by $p_0 \simeq 1-(p_x+p_y+p_z)$7, and the reported trade-off reaches up to $p_0 \simeq 1-(p_x+p_y+p_z)$8 degradation in sensitive-task accuracy with $p_0 \simeq 1-(p_x+p_y+p_z)$9 degradation in primary accuracy (Kariyappa et al., 2021). Relative to static noise, this formulation treats per-sample customization as part of the perturbation model itself.

5. Hidden-state, latent-space, and node-level injection

Noise-aware sample injection also appears as a modification of internal model states rather than observable inputs. Noise Injection Node Regularization introduces external scalar noise nodes into feed-forward DNNs by augmenting a chosen layer pre-activation,

$\delta \in \{X,Y,Z,\mathrm{None}\}$0

where $\delta \in \{X,Y,Z,\mathrm{None}\}$1 has zero mean and variance $\delta \in \{X,Y,Z,\mathrm{None}\}$2 and $\delta \in \{X,Y,Z,\mathrm{None}\}$3 is learned (Levi et al., 2022). The series expansion of the batch loss yields a leading second-order term

$\delta \in \{X,Y,Z,\mathrm{None}\}$4

which acts as a data-dependent Hessian penalty. The training dynamics exhibit four phases—decoupled, decay, catapult, and divergent—as $\delta \in \{X,Y,Z,\mathrm{None}\}$5 increases, and evaluation is performed with $\delta \in \{X,Y,Z,\mathrm{None}\}$6 (Levi et al., 2022). Reported gains include improved robustness to random corruption, domain shift, and PGD-style adversarial attacks, while clean-data performance is largely maintained in the decay regime.

In LLMs, hidden-state perturbation has been used to expose epistemic uncertainty for hallucination detection. The method perturbs upper-layer MLP outputs by additive uniform noise,

$\delta \in \{X,Y,Z,\mathrm{None}\}$7

generates $\delta \in \{X,Y,Z,\mathrm{None}\}$8 noisy samples, and computes dispersion statistics such as predictive entropy, length-normalized entropy, or answer entropy (Liu et al., 6 Feb 2025). In the main GSM8K result with answer entropy and $\delta \in \{X,Y,Z,\mathrm{None}\}$9 runs, AUROC improves from $X$00 to $X$01, and accuracy from $X$02 to $X$03; the preferred perturbation range is moderate, with too much noise $X$04 degrading performance (Liu et al., 6 Feb 2025).

A related but older internal-state formulation is noise injection sampling for neural language generation, where Gaussian noise is added to the decoder hidden state with annealed variance,

$X$05

The method generates $X$06 noisy candidates per meaning representation, keeps the top $X$07 by likelihood, parses them back into candidate meaning representations, filters them, and retrains on the augmented corpus (Kedzie et al., 2019). On the E2E dataset, the retrained system attains zero slot errors with greedy decoding, showing that hidden-state injection can function as a data-generation mechanism rather than only as a regularizer.

Latent Noise Injection in Masked Autoregressive Flows perturbs invertible latent codes instead of visible inputs:

$X$08

Because the perturbation occurs in latent space and the final release is a post-processing of the Gaussian mechanism, the procedure satisfies local $X$09-differential privacy for suitable $X$10 (Shen et al., 19 Jun 2025). The same paper reports membership-inference AUC $X$11 at $X$12 and argues that meta-analytic aggregation across $X$13 studies restores classical efficiency even when single-study synthetic estimators converge slowly (Shen et al., 19 Jun 2025).

Text denoising for paraphrase generation provides yet another internalized variant. SCANING samples from contextual and syntactic noising banks, trains a denoiser STEAD with reconstruction loss

$X$14

and then uses denoised outputs to construct a weakly supervised paraphrase corpus for a second model (Gupta et al., 2023). Here noise-aware injection serves controlled diversity rather than robustness in the usual sense.

6. Diffusion-model scheduling, sample specificity, and technical limits

Diffusion models have produced two sharply different uses of noise-aware sample injection. For black-box membership inference, a one-step, low-intensity forward perturbation is used to amplify the consistency gap between member and non-member samples:

$X$15

with $X$16 and an aggregation score

$X$17

The reported method uses exactly $X$18 model queries per example, with typical settings $X$19 and $X$20, and reaches ASR $X$21 and AUC $X$22 with $X$23 queries, compared with ASR $X$24 and AUC $X$25 for SecMI at $X$26 queries (Li et al., 18 Oct 2025). Table VIII in that paper reports a peak around $X$27 on CIFAR-10; both too small and too large perturbations degrade separation.

For diffusion-based adversarial purification, the key issue is not query efficiency but heterogeneity across samples. Sample-specific Score-aware Noise Injection replaces a global forward-diffusion level $X$28 by a sample-dependent choice

$X$29

where $X$30 is derived from the norm of an Expected Perturbation Score computed by a pre-trained score network (Sun et al., 6 Jun 2025). The paper gives both linear and non-linear reweighting functions and reports that non-linear reweighting with $X$31 gives the best robust gains with minimal clean cost. On CIFAR-10 with WideResNet-28-10 under adaptive white-box PGD+EOT attacks, DiffPure improves from $X$32 clean / $X$33 robust to $X$34 clean / $X$35 robust when augmented with SSNI-N; GDMP improves from $X$36 / $X$37 to $X$38 / $X$39 (Sun et al., 6 Jun 2025). The same framework improves ImageNet-1K results as well.

These diffusion results reinforce a broader technical point: performance depends less on the mere presence of perturbation than on whether its magnitude is calibrated to the local task geometry. Related evidence appears in other domains. In CNN augmentation, robustness saturates after MSSIM $X$40 and an MSSIM near $X$41 is preferred (Akbiyik, 2023). In hallucination detection, moderate $X$42 improves AUROC, whereas too much noise degrades it (Liu et al., 6 Feb 2025). In NINR, the catapult regime yields maximal robustness but slower convergence, while the divergent regime fails altogether (Levi et al., 2022). In SchWARMA, high ARMA orders may suffer numerical ill-conditioning (Murphy et al., 2021). This suggests that noise-aware sample injection is best understood as a calibrated perturbation methodology: when the perturbation law, its insertion locus, and the downstream correction criterion are jointly specified, the injected noise acts as a probe, regularizer, purifier, or privacy mechanism; when they are mismatched, it becomes ordinary corruption.