Quantum Interval Bound Propagation (QIBP)

• QIBP is a certified training framework for variational quantum classifiers that propagates sound interval bounds on quantum state outputs to ensure robustness against adversarial perturbations.
• It extends classical interval bound propagation by embedding input uncertainty into quantum circuits and using both interval and affine arithmetic to track complex amplitudes.
• Empirical studies reveal design tradeoffs between computational efficiency and tightness of robustness certificates, guiding the development of scalable quantum models.

Searching arXiv for the specified papers to ground the article. arXiv paper lookup: (Lechner et al., 2022) — "Quantization-aware Interval Bound Propagation for Training Certifiably Robust Quantized Neural Networks"; (Andrews et al., 1 May 2026) — "Quantum Interval Bound Propagation for Certified Training of Quantum Neural Networks". Quantum Interval Bound Propagation (QIBP) is a certified training framework for quantum neural networks, specifically variational quantum classifiers (VQCs), that extends classical Interval Bound Propagation (IBP) to quantum circuits by propagating sound lower and upper bounds on output logits for all inputs within a prescribed adversarial perturbation set. In its 2026 formulation, QIBP treats the input as a box $[x-\epsilon, x+\epsilon]$, embeds this uncertainty into a quantum state, propagates interval or affine bounds through parameterized unitaries and measurement, and uses worst-case logits in a robust training objective so that the model is certified to predict the correct class within the trained adversarial robustness bounds (Andrews et al., 1 May 2026). The acronym “QIBP” also overlaps terminologically with quantization-aware interval bound propagation for quantized neural networks, a distinct framework for fixed-point integer models rather than quantum circuits (Lechner et al., 2022).

1. Definition and problem setting

QIBP generalizes the core IBP principle from classical feedforward networks to VQCs. In the classical setting, IBP starts from an input perturbation set, typically an $\ell_\infty$-ball $x' \in [x-\epsilon, x+\epsilon]$, propagates element-wise lower and upper activation bounds through the network, obtains per-class logit intervals at the output, and trains the model so that the lower bound of the correct class logit exceeds all upper bounds of incorrect classes. QIBP realizes the same principle for quantum models: the input is represented as an interval set, embedded into a quantum circuit, propagated through the ansatz and measurement, and converted into bounded logits used in a robust loss (Andrews et al., 1 May 2026).

The target model class is the variational quantum classifier. Its pipeline consists of a feature map or encoding stage, a parameterized ansatz built from learnable unitaries and entangling gates, a measurement stage that produces logits from expectation values, and a classical loss on those logits. The experiments use amplitude embedding,

$$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$

followed by layers of single-qubit rotations such as $R_Y(\theta)$ and CNOT entanglers, with Pauli-$Z$ expectation values as logits. For qubit $i$,

$\langle Z_i \rangle = P(q_i = 0) - P(q_i = 1),$

with $P(q_i=0)+P(q_i=1)=1$ (Andrews et al., 1 May 2026).

The adversarial perturbation acts on the classical input vector before encoding. For a clean sample $x$, the perturbation set is the axis-aligned box

$\ell_\infty$0

No adversarial variation is applied directly to circuit parameters $\ell_\infty$1 or to quantum states. In this sense, QIBP is a local, example-specific certification method for input perturbations, not a framework for robustness to hardware noise or decoherence (Andrews et al., 1 May 2026).

2. Bounding quantum circuits with interval and affine arithmetic

The central technical move in QIBP is to propagate sound abstractions through a quantum circuit. Because quantum states are complex-valued, QIBP maintains separate bounds for the real and imaginary parts of each amplitude. For a feature $\ell_\infty$2, the interval representation is written as

$\ell_\infty$3

More generally, for amplitude $\ell_\infty$4 at layer $\ell_\infty$5,

$\ell_\infty$6

Complex multiplication is handled by separating real and imaginary parts and applying interval multiplication to the constituent real products (Andrews et al., 1 May 2026).

Under amplitude embedding, interval-valued inputs become interval-valued amplitudes directly: $\ell_\infty$7 Parameterized single-qubit rotations are then represented by matrices acting linearly on the state vector. Given intervals $\ell_\infty$8, output bounds follow the standard linear-layer IBP template,

$\ell_\infty$9

$x' \in [x-\epsilon, x+\epsilon]$0

where

$x' \in [x-\epsilon, x+\epsilon]$1

CNOTs are simpler: because they act as permutation matrices over the computational basis, they merely reorder amplitudes and therefore preserve the interval values while changing their indices (Andrews et al., 1 May 2026).

Measurement introduces the relevant nonlinearity. For an amplitude interval $x' \in [x-\epsilon, x+\epsilon]$2, the basis-state probability is

$x' \in [x-\epsilon, x+\epsilon]$3

The Pauli-$x' \in [x-\epsilon, x+\epsilon]$4 expectation is then expressed as

$x' \in [x-\epsilon, x+\epsilon]$5

where $x' \in [x-\epsilon, x+\epsilon]$6 denotes the interval for the total probability of outcomes with $x' \in [x-\epsilon, x+\epsilon]$7. This yields a final interval for each logit (Andrews et al., 1 May 2026).

The paper also develops an affine-arithmetic version of QIBP. An affine form is written as

$x' \in [x-\epsilon, x+\epsilon]$8

which preserves correlations between quantities that share the same uncertainty symbols. Linear propagation through the ansatz is exact in affine arithmetic, while nonlinear steps such as squaring are approximated conservatively with an additional residual term. To recover explicit lower and upper bounds for the robust loss, affine logits are converted to intervals by

$x' \in [x-\epsilon, x+\epsilon]$9

This framework yields tighter bounds than plain interval arithmetic, especially in deeper or wider circuits, at higher computational cost (Andrews et al., 1 May 2026).

3. Certification criterion and robust training objective

QIBP uses output intervals to define a worst-case classification objective. For each class $$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$0, the final logit is bounded as

$$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$1

For a sample with true label $$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$2, the worst-case logits are defined as

$$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$3

Certified correctness holds if

$$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$4

Equivalently, using the worst-case margin

$$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$5

with $$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$6 and $$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$7, robustness is certified whenever $$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$8 (Andrews et al., 1 May 2026).

The training objective combines nominal and worst-case behavior. One formulation uses a two-term loss,

$$|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,$$9

where $R_Y(\theta)$0 is scheduled during training. Early epochs emphasize clean learning with $R_Y(\theta)$1, and then $R_Y(\theta)$2 is reduced so that the robust term gains weight. The paper also proposes a hinge-style margin loss,

$R_Y(\theta)$3

which enforces a target margin $R_Y(\theta)$4 and tends to yield stronger robustness in many experiments (Andrews et al., 1 May 2026).

Training is implemented as hybrid classical simulation with autodiff through the bound computations. The implementation uses PennyLane (v0.42.3) and PyTorch (v2.11.0). Optimization uses Adam with learning rate $R_Y(\theta)$5 and weight decay $R_Y(\theta)$6. The reported schedule is 30 epochs, with $R_Y(\theta)$7 for the first 5 epochs and then linearly reduced over 15 epochs to a target such as $R_Y(\theta)$8; $R_Y(\theta)$9 is annealed analogously from 0 to a target such as $Z$0 over 15 epochs (Andrews et al., 1 May 2026).

The certification guarantee relies on the soundness of interval and affine arithmetic. Every propagated bound is constructed to contain all exact values of the corresponding quantity under the allowed perturbations, including conservative treatment of nonlinear measurement operations. Under those assumptions, if the true-class lower bound exceeds all competing upper bounds, then the classifier is guaranteed to predict the correct label for every $Z$1 (Andrews et al., 1 May 2026).

4. Empirical behavior and design tradeoffs

The experiments evaluate VQCs on MNIST, FashionMNIST, and KMNIST. Each dataset has 60,000 training and 10,000 test images of size $Z$2, resized according to qubit count under amplitude embedding. The models span 4, 6, 8, and 10 qubits; 2, 4, 6, 8, and 10 classes; and 2 or 8 ansatz layers composed of repeated $Z$3+CNOT blocks. The main perturbation level is $Z$4, with sweeps up to $Z$5. Metrics include test accuracy, certified accuracy, and PGD accuracy (Andrews et al., 1 May 2026).

The interval-arithmetic implementation is simpler and cheaper, but the dependency problem causes bounds to become increasingly conservative as circuit depth and qubit count grow. The affine-arithmetic implementation preserves correlations and therefore yields much tighter certificates, although with higher computational overhead. This tradeoff is a defining feature of QIBP rather than an incidental implementation detail (Andrews et al., 1 May 2026).

Configuration	Arithmetic / loss	Test / Certified / PGD
MNIST, 4 qubits, 2 classes, 8 layers	Interval, margin loss	97.07% / 94.37% / 96.78%
MNIST, 10 qubits, 2 classes, 2 layers	Interval, margin loss	98.01% / 58.30% / 97.87%
MNIST, 4 qubits, 2 classes, 8 layers	Affine, margin loss	97.12% / 96.69% / 96.83%
MNIST, 6 qubits, 6 classes, 8 layers	Affine, margin loss	82.47% / 77.76% / 81.79%
MNIST, 8 qubits, 8 classes, 8 layers	Affine, margin loss	62.19% / 43.78% / 61.19%

These results illustrate two consistent patterns. First, for small models interval QIBP can already produce certified accuracies close to both clean and PGD accuracies. Second, as models become larger or tasks become more multi-class, interval bounds degrade sharply, whereas affine QIBP keeps the certified–PGD gap smaller. The reported hyperparameter studies further indicate that larger $Z$6 reduces certified accuracy while leaving test accuracy largely preserved, and that decreasing $Z$7 generally improves certified accuracy, with $Z$8 emerging as a robust choice across configurations (Andrews et al., 1 May 2026).

5. Relation to other certified-robustness methods

Within quantum machine learning, QIBP differs from adversarial training, Lipschitz-based certified training, and post-hoc verification. Adversarial training optimizes against particular attacks such as FGSM or PGD, but does not provide guarantees beyond those attack procedures. Lipschitz-based methods constrain a global constant $Z$9 in inequalities such as

$i$0

but the choice of a useful global $i$1 is difficult and has mainly been explored for specific architectures. Post-hoc verification analyzes a fixed trained model, whereas QIBP is a training-time method that shapes decision boundaries during learning by penalizing worst-case logit intervals directly (Andrews et al., 1 May 2026).

Relative to classical IBP, the structure is analogous but the bounded objects differ. Classical IBP propagates bounds on real-valued activations through linear layers and nonlinearities. QIBP propagates bounds on complex amplitudes, then on probabilities and expectation values. The linearity of unitary evolution makes the propagation through gates structurally close to the linear-layer case, while measurement introduces the main nonlinear step through squaring and aggregation of amplitudes (Andrews et al., 1 May 2026).

The reported advantages are therefore specific: QIBP provides training-time certificates, improves both robust and clean accuracy, and is compatible with standard variational circuits implemented on classical simulators. A plausible implication is that QIBP is best understood not as a replacement for formal verification in general, but as a certification-aware training mechanism whose effectiveness depends on the tightness of the chosen abstract domain.

6. Terminological overlap with quantization-aware IBP

The phrase “QIBP” has a second, unrelated usage in the literature. In the 2022 work on quantized neural networks, the term is best interpreted as “quantization-aware IBP” or “quantized IBP,” not as a method for quantum computing. That framework studies adversarially robust quantized neural networks implemented with low-bit fixed-point integer arithmetic, and it extends IBP to discrete semantics including integer linear maps, rounding, rescaling, clipping, and quantized monotone activations (Lechner et al., 2022).

The quantization-aware method propagates lower and upper integer bounds through quantized layers and uses these bounds both for training and for complete verification. Its training procedure uses fake quantization and straight-through estimators so that the forward pass matches the actual quantized network while gradients pass through quantization as if it were the identity. Its verification algorithm combines QA-IBP, projected gradient descent, and interval splitting in a branch-and-bound procedure that is guaranteed to terminate and produce either ROBUST or VULNERABLE, and it runs entirely on GPU or other accelerator devices (Lechner et al., 2022).

The quantized-network paper explicitly notes that it has no relation to quantum computing. It also emphasizes a distinct motivation: robustness guarantees for real-valued models do not automatically transfer after quantization, because fixed-point rounding and clipping can introduce new adversarial examples not seen by real-valued analysis. In that literature, “QIBP” names a quantization-aware specialization of IBP for deployed integer models; in the quantum literature, “QIBP” names a certified training method for VQCs (Lechner et al., 2022).

7. Limitations and prospective directions

The main limitations of quantum QIBP are tied to scalability, circuit structure, and idealized modeling assumptions. The experiments go up to 10 qubits, and classical state-vector simulation together with interval or affine propagation scales as $i$2 in qubit count. Even with affine arithmetic, bounds become looser as depth, number of qubits, and number of classes increase. The certificates are for ideal circuits: hardware noise, decoherence, and realistic quantum channels are not explicitly modeled (Andrews et al., 1 May 2026).

The paper identifies several future directions. These include tighter bounding methods such as higher-order affine forms, zonotopes, or SDP relaxations adapted to quantum circuits; extensions to other encoding schemes such as angle encoding and data re-uploading; broader model classes including quantum CNNs and hybrid quantum–classical architectures; integration of hardware noise into the bounding framework; and scalable approximations or structural constraints that might make QIBP-style certification feasible on larger quantum devices. It also suggests studying QIBP for learning paradigms beyond classification, including regression, reinforcement learning, and quantum generative models (Andrews et al., 1 May 2026).

Taken together, these limitations and extensions place QIBP in a precise methodological niche. It is a sound certified training routine for variational quantum classifiers under input perturbations, with interval arithmetic providing a cheap but looser abstraction and affine arithmetic providing a tighter but more expensive one. The broader significance lies in importing the logic of certified worst-case training into quantum machine learning while preserving the structural distinctions of quantum state evolution, complex amplitudes, and measurement.