QFAL: Quantum Federated Adversarial Learning

2025-02-28

AI Summary

Quantum federated learning (QFL) suffers from insufficient robustness against adversarial attacks. This paper proposes QFAL, the first quantum federated framework integrating adversarial training, which synergistically combines locally generated adversarial examples—crafted via gradient projection—and federated averaging (FedAvg) for joint optimization. Key contributions include: (1) the first systematic integration of adversarial training into QFL; (2) uncovering the coupled interplay between client population size and adversarial coverage rate in governing the robustness–accuracy trade-off; and (3) empirically demonstrating that partial adversarial training (20%–50% coverage) on MNIST quantum-encoded tasks achieves balanced robustness and generalization: under 10 clients and 20%–50% coverage, clean accuracy remains ≥85%, while adversarial robustness improves by 3.2×; in contrast, full-coverage training degrades under strong perturbations due to dimensional collapse.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Federated recommendation systems and personalization
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work

Abstract

Quantum federated learning (QFL) merges the privacy advantages of federated systems with the computational potential of quantum neural networks (QNNs), yet its vulnerability to adversarial attacks remains poorly understood. This work pioneers the integration of adversarial training into QFL, proposing a robust framework, quantum federated adversarial learning (QFAL), where clients collaboratively defend against perturbations by combining local adversarial example generation with federated averaging (FedAvg). We systematically evaluate the interplay between three critical factors: client count (5, 10, 15), adversarial training coverage (0-100%), and adversarial attack perturbation strength (epsilon = 0.01-0.5), using the MNIST dataset. Our experimental results show that while fewer clients often yield higher clean-data accuracy, larger federations can more effectively balance accuracy and robustness when partially adversarially trained. Notably, even limited adversarial coverage (e.g., 20%-50%) can significantly improve resilience to moderate perturbations, though at the cost of reduced baseline performance. Conversely, full adversarial training (100%) may regain high clean accuracy but is vulnerable under stronger attacks. These findings underscore an inherent trade-off between robust and standard objectives, which is further complicated by quantum-specific factors. We conclude that a carefully chosen combination of client count and adversarial coverage is critical for mitigating adversarial vulnerabilities in QFL. Moreover, we highlight opportunities for future research, including adaptive adversarial training schedules, more diverse quantum encoding schemes, and personalized defense strategies to further enhance the robustness-accuracy trade-off in real-world quantum federated environments.

Problem

• Integrates adversarial training into quantum federated learning for robustness.
• Explores trade-offs between client count, adversarial coverage, and attack strength.
• Identifies optimal client-adversarial coverage combinations to mitigate vulnerabilities.

Innovation

• Integrates adversarial training into quantum federated learning
• Combines local adversarial example generation with FedAvg
• Evaluates client count, adversarial coverage, and perturbation strength