---
title: Quantum Interval Bound Propagation (QIBP)
url: https://www.emergentmind.com/topics/quantum-interval-bound-propagation-qibp
type: topic
---

# Quantum Interval Bound Propagation (QIBP)

Searching arXiv for the specified papers to ground the article.
arXiv paper lookup: 2211.16187 — "Quantization-aware Interval Bound Propagation for Training Certifiably Robust Quantized Neural Networks"; 2605.00747 — "Quantum Interval Bound Propagation for Certified Training of Quantum Neural Networks".
Quantum Interval Bound Propagation (QIBP) is a certified training framework for quantum neural networks, specifically variational quantum classifiers (VQCs), that extends classical Interval Bound Propagation (IBP) to quantum circuits by propagating sound lower and upper bounds on output logits for all inputs within a prescribed adversarial perturbation set. In its 2026 formulation, QIBP treats the input as a box \( [x-\epsilon, x+\epsilon] \), embeds this uncertainty into a quantum state, propagates interval or affine bounds through parameterized unitaries and measurement, and uses worst-case logits in a robust training objective so that the model is certified to predict the correct class within the trained adversarial robustness bounds [2605.00747]. The acronym “QIBP” also overlaps terminologically with quantization-aware interval bound propagation for quantized neural networks, a distinct framework for fixed-point integer models rather than quantum circuits [2211.16187].

## 1. Definition and problem setting

QIBP generalizes the core IBP principle from classical feedforward networks to VQCs. In the classical setting, IBP starts from an input perturbation set, typically an \(\ell_\infty\)-ball \(x' \in [x-\epsilon, x+\epsilon]\), propagates element-wise lower and upper activation bounds through the network, obtains per-class logit intervals at the output, and trains the model so that the lower bound of the correct class logit exceeds all upper bounds of incorrect classes. QIBP realizes the same principle for quantum models: the input is represented as an interval set, embedded into a quantum circuit, propagated through the ansatz and measurement, and converted into bounded logits used in a robust loss [2605.00747].

The target model class is the variational quantum classifier. Its pipeline consists of a feature map or encoding stage, a parameterized ansatz built from learnable unitaries and entangling gates, a measurement stage that produces logits from expectation values, and a classical loss on those logits. The experiments use amplitude embedding,
\[
|\psi\rangle = \sum_{i=0}^{N} x_i\,|i\rangle,\quad N = 2^n,
\]
followed by layers of single-qubit rotations such as \(R_Y(\theta)\) and CNOT entanglers, with Pauli-\(Z\) expectation values as logits. For qubit \(i\),
\[
\langle Z_i \rangle = P(q_i = 0) - P(q_i = 1),
\]
with \(P(q_i=0)+P(q_i=1)=1\) [2605.00747].

The adversarial perturbation acts on the classical input vector before encoding. For a clean sample \(x\), the perturbation set is the axis-aligned box
\[
[x-\epsilon, x+\epsilon] = \{x' : x'_i \in [x_i-\epsilon, x_i+\epsilon]\}.
\]
No adversarial variation is applied directly to circuit parameters \(\theta\) or to quantum states. In this sense, QIBP is a local, example-specific certification method for input perturbations, not a framework for robustness to hardware noise or decoherence [2605.00747].

## 2. Bounding quantum circuits with interval and affine arithmetic

The central technical move in QIBP is to propagate sound abstractions through a quantum circuit. Because quantum states are complex-valued, QIBP maintains separate bounds for the real and imaginary parts of each amplitude. For a feature \(x_j\), the interval representation is written as
\[
I_{j,1} = ([x_{j,re}-\epsilon, x_{j,re}+\epsilon],\ [x_{j,im}-\epsilon, x_{j,im}+\epsilon]).
\]
More generally, for amplitude \(j\) at layer \(k\),
\[
I_{j,k} = (\text{real interval}, \text{imag interval}).
\]
Complex multiplication is handled by separating real and imaginary parts and applying interval multiplication to the constituent real products [2605.00747].

Under amplitude embedding, interval-valued inputs become interval-valued amplitudes directly:
\[
z_1 = I_{0,1}|0\cdots 00\rangle + I_{1,1}|0\cdots 10\rangle + \dots + I_{N,1}|1\cdots 11\rangle.
\]
Parameterized single-qubit rotations are then represented by matrices acting linearly on the state vector. Given intervals \(I_{j,k-1}\), output bounds follow the standard linear-layer IBP template,
\[
\underline{I}_{j,k} = M^+ \underline{I}_{j,k-1} + M^- \overline{I}_{j,k-1},
\]
\[
\overline{I}_{j,k} = M^+ \overline{I}_{j,k-1} + M^- \underline{I}_{j,k-1},
\]
where
\[
M^+ = \max(W,0), \quad M^- = \min(W,0).
\]
CNOTs are simpler: because they act as permutation matrices over the computational basis, they merely reorder amplitudes and therefore preserve the interval values while changing their indices [2605.00747].

Measurement introduces the relevant nonlinearity. For an amplitude interval \(z_k=(z_{k,re}, z_{k,im})\), the basis-state probability is
\[
z_{k+1} = z_{k,re}^2 + z_{k,im}^2.
\]
The Pauli-\(Z\) expectation is then expressed as
\[
z_K = 2 z_{k+1, P(q_i=0)} - 1,
\]
where \(z_{k+1,P(q_i=0)}\) denotes the interval for the total probability of outcomes with \(q_i=0\). This yields a final interval for each logit [2605.00747].

The paper also develops an affine-arithmetic version of QIBP. An affine form is written as
\[
\hat{x} = x_0 + \sum_{i=1}^{n} x_i \varepsilon_i,\qquad \varepsilon_i \in [-1,1],
\]
which preserves correlations between quantities that share the same uncertainty symbols. Linear propagation through the ansatz is exact in affine arithmetic, while nonlinear steps such as squaring are approximated conservatively with an additional residual term. To recover explicit lower and upper bounds for the robust loss, affine logits are converted to intervals by
\[
z_K = \left[ x_0 - \sum_{i=1}^n |x_i \varepsilon_i| - r,\; x_0 + \sum_{i=1}^n |x_i \varepsilon_i| + r \right].
\]
This framework yields tighter bounds than plain interval arithmetic, especially in deeper or wider circuits, at higher computational cost [2605.00747].

## 3. Certification criterion and robust training objective

QIBP uses output intervals to define a worst-case classification objective. For each class \(y\), the final logit is bounded as
\[
z_{K,y} \in [\underline{z}_{K,y}, \overline{z}_{K,y}].
\]
For a sample with true label \(y_{\text{true}}\), the worst-case logits are defined as
\[
\hat{z}_K =
\begin{cases}
\overline{z}_{K,y} & \text{if } y \neq y_{\text{true}},\\[3pt]
\underline{z}_{K,y} & \text{otherwise}.
\end{cases}
\]
Certified correctness holds if
\[
\underline{z}_{K,y_{\text{true}}} > \max_{y \neq y_{\text{true}}} \overline{z}_{K,y}.
\]
Equivalently, using the worst-case margin
\[
\text{margin} = l_y - \max_{j \neq y} u_j,
\]
with \(l_y = \underline{z}_{K,y_{\text{true}}}\) and \(u_j = \overline{z}_{K,j}\), robustness is certified whenever \(\text{margin} > 0\) [2605.00747].

The training objective combines nominal and worst-case behavior. One formulation uses a two-term loss,
\[
\mathcal{L} = \kappa\,\mathcal{L}_{CE}(z,y_{\text{true}}) + (1-\kappa)\,\mathcal{L}_{CE}(\hat{z}_K,y_{\text{true}}),
\]
where \(\kappa \in [0,1]\) is scheduled during training. Early epochs emphasize clean learning with \(\kappa=1\), and then \(\kappa\) is reduced so that the robust term gains weight. The paper also proposes a hinge-style margin loss,
\[
\mathcal{L}_{\text{robust}} = \max(0, \gamma - \text{margin}),
\]
which enforces a target margin \(\gamma\) and tends to yield stronger robustness in many experiments [2605.00747].

Training is implemented as hybrid classical simulation with autodiff through the bound computations. The implementation uses PennyLane (v0.42.3) and PyTorch (v2.11.0). Optimization uses Adam with learning rate \(0.005\) and weight decay \(0.01\). The reported schedule is 30 epochs, with \(\kappa=1\) for the first 5 epochs and then linearly reduced over 15 epochs to a target such as \(0.5\); \(\epsilon\) is annealed analogously from 0 to a target such as \(0.001\) over 15 epochs [2605.00747].

The certification guarantee relies on the soundness of interval and affine arithmetic. Every propagated bound is constructed to contain all exact values of the corresponding quantity under the allowed perturbations, including conservative treatment of nonlinear measurement operations. Under those assumptions, if the true-class lower bound exceeds all competing upper bounds, then the classifier is guaranteed to predict the correct label for every \(x' \in [x-\epsilon, x+\epsilon]\) [2605.00747].

## 4. Empirical behavior and design tradeoffs

The experiments evaluate VQCs on MNIST, FashionMNIST, and KMNIST. Each dataset has 60,000 training and 10,000 test images of size \(28\times 28\), resized according to qubit count under amplitude embedding. The models span 4, 6, 8, and 10 qubits; 2, 4, 6, 8, and 10 classes; and 2 or 8 ansatz layers composed of repeated \(R_Y(\theta)\)+CNOT blocks. The main perturbation level is \(\epsilon=0.001\), with sweeps up to \(0.01\). Metrics include test accuracy, certified accuracy, and PGD accuracy [2605.00747].

The interval-arithmetic implementation is simpler and cheaper, but the dependency problem causes bounds to become increasingly conservative as circuit depth and qubit count grow. The affine-arithmetic implementation preserves correlations and therefore yields much tighter certificates, although with higher computational overhead. This tradeoff is a defining feature of QIBP rather than an incidental implementation detail [2605.00747].

| Configuration | Arithmetic / loss | Test / Certified / PGD |
|---|---|---|
| MNIST, 4 qubits, 2 classes, 8 layers | Interval, margin loss | 97.07% / 94.37% / 96.78% |
| MNIST, 10 qubits, 2 classes, 2 layers | Interval, margin loss | 98.01% / 58.30% / 97.87% |
| MNIST, 4 qubits, 2 classes, 8 layers | Affine, margin loss | 97.12% / 96.69% / 96.83% |
| MNIST, 6 qubits, 6 classes, 8 layers | Affine, margin loss | 82.47% / 77.76% / 81.79% |
| MNIST, 8 qubits, 8 classes, 8 layers | Affine, margin loss | 62.19% / 43.78% / 61.19% |

These results illustrate two consistent patterns. First, for small models interval QIBP can already produce certified accuracies close to both clean and PGD accuracies. Second, as models become larger or tasks become more multi-class, interval bounds degrade sharply, whereas affine QIBP keeps the certified–PGD gap smaller. The reported hyperparameter studies further indicate that larger \(\epsilon\) reduces certified accuracy while leaving test accuracy largely preserved, and that decreasing \(\kappa\) generally improves certified accuracy, with \(\kappa=0.5\) emerging as a robust choice across configurations [2605.00747].

## 5. Relation to other certified-robustness methods

Within quantum machine learning, QIBP differs from adversarial training, Lipschitz-based certified training, and post-hoc verification. Adversarial training optimizes against particular attacks such as FGSM or PGD, but does not provide guarantees beyond those attack procedures. Lipschitz-based methods constrain a global constant \(L\) in inequalities such as
\[
\|f(x)-f(y)\| \le L\|x-y\|,
\]
but the choice of a useful global \(L\) is difficult and has mainly been explored for specific architectures. Post-hoc verification analyzes a fixed trained model, whereas QIBP is a training-time method that shapes decision boundaries during learning by penalizing worst-case logit intervals directly [2605.00747].

Relative to classical IBP, the structure is analogous but the bounded objects differ. Classical IBP propagates bounds on real-valued activations through linear layers and nonlinearities. QIBP propagates bounds on complex amplitudes, then on probabilities and expectation values. The linearity of unitary evolution makes the propagation through gates structurally close to the linear-layer case, while measurement introduces the main nonlinear step through squaring and aggregation of amplitudes [2605.00747].

The reported advantages are therefore specific: QIBP provides training-time certificates, improves both robust and clean accuracy, and is compatible with standard variational circuits implemented on classical simulators. A plausible implication is that QIBP is best understood not as a replacement for formal verification in general, but as a certification-aware training mechanism whose effectiveness depends on the tightness of the chosen abstract domain.

## 6. Terminological overlap with quantization-aware IBP

The phrase “QIBP” has a second, unrelated usage in the literature. In the 2022 work on quantized neural networks, the term is best interpreted as “quantization-aware IBP” or “quantized IBP,” not as a method for quantum computing. That framework studies adversarially robust quantized neural networks implemented with low-bit fixed-point integer arithmetic, and it extends IBP to discrete semantics including integer linear maps, rounding, rescaling, clipping, and quantized monotone activations [2211.16187].

The quantization-aware method propagates lower and upper integer bounds through quantized layers and uses these bounds both for training and for complete verification. Its training procedure uses fake quantization and straight-through estimators so that the forward pass matches the actual quantized network while gradients pass through quantization as if it were the identity. Its verification algorithm combines QA-IBP, projected gradient descent, and interval splitting in a branch-and-bound procedure that is guaranteed to terminate and produce either ROBUST or VULNERABLE, and it runs entirely on GPU or other accelerator devices [2211.16187].

The quantized-network paper explicitly notes that it has no relation to quantum computing. It also emphasizes a distinct motivation: robustness guarantees for real-valued models do not automatically transfer after quantization, because fixed-point rounding and clipping can introduce new adversarial examples not seen by real-valued analysis. In that literature, “QIBP” names a quantization-aware specialization of IBP for deployed integer models; in the quantum literature, “QIBP” names a certified training method for VQCs [2211.16187].

## 7. Limitations and prospective directions

The main limitations of quantum QIBP are tied to scalability, circuit structure, and idealized modeling assumptions. The experiments go up to 10 qubits, and classical state-vector simulation together with interval or affine propagation scales as \(O(2^n)\) in qubit count. Even with affine arithmetic, bounds become looser as depth, number of qubits, and number of classes increase. The certificates are for ideal circuits: hardware noise, decoherence, and realistic quantum channels are not explicitly modeled [2605.00747].

The paper identifies several future directions. These include tighter bounding methods such as higher-order affine forms, zonotopes, or SDP relaxations adapted to quantum circuits; extensions to other encoding schemes such as angle encoding and data re-uploading; broader model classes including quantum CNNs and hybrid quantum–classical architectures; integration of hardware noise into the bounding framework; and scalable approximations or structural constraints that might make QIBP-style certification feasible on larger quantum devices. It also suggests studying QIBP for learning paradigms beyond classification, including regression, reinforcement learning, and quantum generative models [2605.00747].

Taken together, these limitations and extensions place QIBP in a precise methodological niche. It is a sound certified training routine for variational quantum classifiers under input perturbations, with interval arithmetic providing a cheap but looser abstraction and affine arithmetic providing a tighter but more expensive one. The broader significance lies in importing the logic of certified worst-case training into quantum machine learning while preserving the structural distinctions of quantum state evolution, complex amplitudes, and measurement.

Source: https://www.emergentmind.com/topics/quantum-interval-bound-propagation-qibp