Robust Quantum Federated Learning

• RobQFL is a quantum federated learning framework that embeds adversarial training to enhance model robustness against noise, perturbations, and data heterogeneity.
• It configures robustness through client coverage, perturbation scheduling, and tailored optimization modes to balance clean and adversarial performance.
• Empirical findings show that partial adversarial training significantly boosts moderate robustness, while non-IID data remains a critical challenge.

Robust Quantum Federated Learning (RobQFL) denotes a class of Quantum Federated Learning (QFL) methods that harden distributed quantum-model training against failure modes such as adversarial perturbations, quantum-channel noise, intermediate device noise, privacy leakage, and heterogeneity-induced degradation. In the strict sense, the term refers to the adversarially trained framework introduced in "RobQFL: Robust Quantum Federated Learning in Adversarial Environment," which shows that vanilla QFL is no more robust than centralized quantum learning and then embeds adversarial training directly into the federated loop through client coverage, perturbation scheduling, and optimization-mode choices (Maouaki et al., 5 Sep 2025). In a broader usage found in adjacent work, robustness-oriented QFL designs have also been described under the same label when they emphasize communication efficiency, noise tolerance, differential privacy, or Fisher-aware aggregation (Kamei et al., 4 Mar 2026, Phan et al., 4 Sep 2025, Bhatia et al., 23 Jul 2025).

1. Foundations in quantum federated learning

QFL extends classical Federated Learning to quantum models by having $K$ quantum clients collaboratively train a shared parameterized quantum circuit (PQC) without exchanging raw data. Each client $k$ holds local parameters $\theta_k$ and performs local updates; the server aggregates them by

$$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$

Within this formulation, robustness is not a primitive property of federation; it must be engineered through the training rule, aggregation protocol, or communication substrate (Maouaki et al., 5 Sep 2025).

An early federated quantum training framework was "QuantumFed: A Federated Learning Framework for Collaborative Quantum Training," which cast the global objective as a weighted sum of local fidelity-based losses and implemented server-side aggregation through successive multiplication of local update unitaries. Under the small-$\epsilon$ regime, its multiplicative identity approximates the weighted-sum behavior of classical FedAvg. QuantumFed also reported that up to $50$–$70\%$ corrupted data can still yield good test fidelity in its synthetic setting, while explicitly noting that no theoretical bounds were given for adversarial clients or communication noise (Xia et al., 2021).

This background is important because RobQFL does not replace the federated paradigm; it modifies the training process so that robustness objectives are enforced during collaborative optimization rather than assumed to emerge from decentralization alone.

2. Adversarial fragility and the RobQFL threat model

The adversarial formulation in RobQFL is inherited from centralized quantum machine learning. Small, carefully crafted perturbations $\delta$ under an $\ell_\infty$-bound, $\|\delta\|_\infty \le \epsilon$, can cause large misclassifications. The paper’s central empirical finding is that federation alone brings no extra robustness: a single-client QNN and its federated counterpart both collapse to $k$0 accuracy once $k$1 (Maouaki et al., 5 Sep 2025).

The baseline comparison is explicit. Under clean evaluation, centralized training attains $k$2 and QFL attains $k$3. At $k$4, both are approximately $k$5, and at $k$6 both drop to approximately $k$7. The result directly refutes a common misconception that distributing training across clients intrinsically smooths or regularizes the decision boundary enough to confer adversarial robustness (Maouaki et al., 5 Sep 2025).

RobQFL uses an untargeted projected gradient descent (PGD) adversary. For a clean input $k$8 with label $k$9, the perturbed example is defined by

$\theta_k$0

In the reported implementation, each covered client perturbs $\theta_k$1 of its mini-batch. This is a local adversarial-training mechanism embedded inside each federated round rather than an external post hoc robustness evaluation (Maouaki et al., 5 Sep 2025).

The immediate significance is architectural: the robust objective is not imposed globally at the server after standard training, but locally during client optimization, so the global model inherits a mixture of clean and adversarially trained updates.

3. Core RobQFL design axes

RobQFL embeds adversarial training inside each FL round along three tunable axes: client coverage $\theta_k$2, perturbation scheduling, and optimization mode (Maouaki et al., 5 Sep 2025).

Client coverage $\theta_k$3 defines the fraction of clients that perform adversarial training in a round. A concrete example from the experiments is $\theta_k$4, which means $\theta_k$5 out of $\theta_k$6 clients are adversarially trained. Non-covered clients train only on clean data. This parameter makes robustness allocation an explicit systems-level decision rather than an all-or-nothing choice.

Perturbation scheduling governs how attack strength is distributed across adversarially trained clients. RobQFL studies both fixed-$\theta_k$7 schedules and mixed-$\theta_k$8 schedules. In the mixed case, a length-$\theta_k$9 vector $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$0 is assigned cyclically,

$$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$1

In practice, $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$2 with three schedules: low mix $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$3, moderate mix $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$4, and strong mix $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$5. The design implication is that robustness can be diversified across clients rather than concentrated at a single perturbation budget (Maouaki et al., 5 Sep 2025).

Optimization mode controls whether adversarial training is introduced after a clean pretraining phase or from random initialization. Fine-tuning, or warm-start, first runs $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$6 rounds on clean data to obtain $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$7, then resumes adversarial training for $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$8 rounds. Scratch training initializes randomly and trains under the adversarial schedule for $$\theta^{(t+1)}=\sum_k w_k \theta_k^{(t)}, \qquad \sum_k w_k = 1.$$9 rounds. The paper characterizes fine-tuning as preserving clean-data accuracy while gradually adapting to adversarial examples, whereas scratch training builds robustness from the outset but can destabilize clean accuracy, especially at high coverage (Maouaki et al., 5 Sep 2025).

Taken together, these axes define a robustness surface over coverage and perturbation strength. The method therefore treats robust QFL not as a single algorithmic point, but as a configurable family of federated adversarial-training regimes.

4. Robustness metrics and empirical operating regimes

RobQFL evaluates robustness through a two-dimensional performance surface $\epsilon$0 and then compresses that surface into scalar summaries. The basic quantity is top-1 accuracy under PGD attacks of strength $\epsilon$1 when coverage is $\epsilon$2. From this, the paper defines the Accuracy-Robustness Area (ARA),

$\epsilon$3

and the Robustness Volume (RV),

$\epsilon$4

ARA is normalized to $\epsilon$5, where $\epsilon$6 means $\epsilon$7 accuracy at all $\epsilon$8, and RV is a single scalar in $\epsilon$9 summarizing the entire $50$0 surface (Maouaki et al., 5 Sep 2025).

The experimental setup uses $50$1 quantum clients, a $50$2-qubit hardware-efficient PQC, and MNIST and Fashion-MNIST reduced to three classes and $50$3 images, under both IID and label-sorted non-IID splits. Within this regime, several empirical patterns are stable (Maouaki et al., 5 Sep 2025).

First, partial coverage is already effective. With fixed $50$4 and $50$5–$50$6, accuracy for $50$7 improves by approximately $50$8 percentage points relative to $50$9, while clean accuracy drops by less than $70\%$0 percentage points. The paper’s representative example is $70\%$1, where $70\%$2 accuracy rises from approximately $70\%$3 to approximately $70\%$4, while clean accuracy falls from approximately $70\%$5 to approximately $70\%$6 (Maouaki et al., 5 Sep 2025).

Second, fine-tuning is more stable than scratch training. Fine-tuning yields $70\%$7–$70\%$8 percentage points higher ARA and RV than scratch, with reported values $70\%$9 versus $\delta$0 and $\delta$1 versus $\delta$2. Scratch training can sometimes recover under $\delta$3 at $\delta$4, but this comes with spikes and dips in clean accuracy (Maouaki et al., 5 Sep 2025).

Third, the optimal perturbation schedule depends on coverage. At $\delta$5, the moderate mix $\delta$6 attains the best RV and mean ARA, with $\delta$7 and $\delta$8, balancing clean and adversarial performance. Fixed $\delta$9 is the safest single-$\ell_\infty$0 choice, with $\ell_\infty$1 and nearly flat ARA across $\ell_\infty$2. The strong mix $\ell_\infty$3 outperforms only when $\ell_\infty$4, and then at a clean-accuracy cost of approximately $\ell_\infty$5 percentage points (Maouaki et al., 5 Sep 2025).

These results collectively imply that robust performance is not monotone in adversarial intensity. Higher perturbation budgets and larger protected fractions are not uniformly beneficial; the advantageous region depends on the interaction between coverage, scheduling, and training initialization.

5. Heterogeneity as the dominant bottleneck and the broader robust-QFL landscape

Under label-sorted non-IID splits, RobQFL’s robustness degrades sharply. RV drops by approximately $\ell_\infty$6 for MNIST, from $\ell_\infty$7 to $\ell_\infty$8, and by approximately $\ell_\infty$9 for Fashion-MNIST, from $\|\delta\|_\infty \le \epsilon$0 to $\|\delta\|_\infty \le \epsilon$1. Even adversarial coverage at $\|\delta\|_\infty \le \epsilon$2 fails to recover more than a few percent of adversarial accuracy. The paper’s conclusion is direct: label heterogeneity is the dominant barrier to robust QFL (Maouaki et al., 5 Sep 2025).

This emphasis on heterogeneity places RobQFL within a larger research landscape in which robustness is addressed through different mechanisms.

Paper	Robustness target	Principal mechanism
"QuantumFed" (Xia et al., 2021)	corrupted labels, faulty updates	fidelity cost, weighted unitary aggregation
"QFAL: Quantum Federated Adversarial Learning" (Maouaki et al., 28 Feb 2025)	adversarial perturbations	local PGD with FedAvg
"Towards Practical Quantum Federated Learning: Enhancing Efficiency and Noise Tolerance" (Kamei et al., 4 Mar 2026)	communication overhead, depolarizing noise	light-cone reduction, Hybrid QFL, Steane code
"Enhancing Gradient Variance and Differential Privacy in Quantum Federated Learning" (Phan et al., 4 Sep 2025)	privacy leakage, intermediate quantum noise	Gaussian DP noise, model estimation, adaptive noise
"Enhancing Quantum Federated Learning with Fisher Information-Based Optimization" (Bhatia et al., 23 Jul 2025)	heterogeneous partitions, aggregation sensitivity	Fisher-weighted aggregation

The relationship between these lines is substantive rather than merely terminological. QFAL systematically varies client count, adversarial training coverage, and perturbation strength on MNIST, and likewise finds that limited adversarial coverage such as $\|\delta\|_\infty \le \epsilon$3–$\|\delta\|_\infty \le \epsilon$4 can significantly improve resilience to moderate perturbations, while full adversarial training may regain high clean accuracy but underperform under stronger attacks (Maouaki et al., 28 Feb 2025). This closely parallels the regime structure later quantified more formally by RobQFL through ARA and RV (Maouaki et al., 5 Sep 2025).

Other work expands the meaning of robustness beyond adversarial examples. The practical-QFL study analyzes communication–convergence–noise trade-offs, giving per-round costs $\|\delta\|_\infty \le \epsilon$5 for centralized aggregation and $\|\delta\|_\infty \le \epsilon$6 for decentralized aggregation, with hybrid cost $\|\delta\|_\infty \le \epsilon$7, and reports that decentralized aggregation is more noise-resilient because it transmits fewer qubits per round. It further evaluates Steane code-based quantum error correction, with logical error probability $\|\delta\|_\infty \le \epsilon$8 under independent depolarizing noise (Kamei et al., 4 Mar 2026). The differential-privacy line adds client-level $\|\delta\|_\infty \le \epsilon$9-DP, a Gaussian mechanism, a RANSAC-style model-estimation strategy bounded by $k$00, and an adaptive noise schedule $k$01 to mitigate both privacy threats and intermediate quantum noise (Phan et al., 4 Sep 2025). The Fisher-information approach addresses heterogeneous partitions by preserving high-information parameters during aggregation and defaulting low-information coordinates to FedAvg (Bhatia et al., 23 Jul 2025).

A plausible implication is that robust QFL is better understood as a multi-axis design problem: adversarial robustness, heterogeneity tolerance, communication efficiency, privacy, and hardware noise interact rather than decompose cleanly.

6. Terminology, recurrent misconceptions, and open directions

The literature supports several clarifications. First, QFL is not inherently adversarially robust. The centralized-versus-federated baseline in RobQFL shows nearly identical collapse under $k$02, and the paper explicitly concludes that federation alone brings no extra robustness (Maouaki et al., 5 Sep 2025).

Second, full adversarial coverage is not uniformly optimal. RobQFL shows that training only $k$03–$k$04 of clients adversarially can deliver approximately $k$05 percentage-point gains under moderate attacks with less than $k$06 percentage points of clean-accuracy loss, while high-$k$07 schedules help only at $k$08 coverage (Maouaki et al., 5 Sep 2025). QFAL similarly reports that partial adversarial training can improve moderate-attack resilience, whereas $k$09 coverage may overfit to weak perturbations and remain vulnerable under stronger attacks (Maouaki et al., 28 Feb 2025).

Third, robustness is not reducible to adversarial example defense. In adjacent work, robustness also denotes resilience to corrupted labels, model leakage, gradient inversion, quantum-channel noise, intermediate device noise, and aggregation instability under heterogeneous data (Xia et al., 2021, Kamei et al., 4 Mar 2026, Phan et al., 4 Sep 2025, Bhatia et al., 23 Jul 2025). This explains why the name “RobQFL” appears both as a specific method and as a broader shorthand for robustness-oriented QFL design.

Open directions stated in the literature are correspondingly diverse. The adversarial RobQFL paper identifies client-aware $k$10 schedules, shared reference sets, and adaptive curricula as future work for extreme non-IID conditions (Maouaki et al., 5 Sep 2025). QFAL highlights adaptive adversarial training schedules, more diverse quantum encoding schemes, and personalized defense strategies (Maouaki et al., 28 Feb 2025). QuantumFed identifies Byzantine resilience, differential privacy, realistic quantum-noise mitigation, and large-scale experiments on near-term hardware as unresolved extensions (Xia et al., 2021). The practical-QFL, DP, and Fisher-based strands imply further work on switching policies, noise-aware cost optimization, privacy–utility calibration, and scalable importance-aware aggregation (Kamei et al., 4 Mar 2026, Phan et al., 4 Sep 2025, Bhatia et al., 23 Jul 2025).

In its most specific sense, then, RobQFL is the adversarially trained federated quantum-learning framework built around coverage, perturbation scheduling, and fine-tuning. In the broader research ecosystem, it has come to signify a more general program: making QFL viable under adversarial, noisy, private, and heterogeneous operating conditions.