{
  "abstract": "A quantum classifier assigns labels by evolving an input quantum state and measuring the output, so repeated executions reveal only a distribution over labels. We study certified adversarial robustness for such classifiers under known-readout query access (KRQA), where an evaluator can prepare inputs, knows the quantum measurement, and observes finite-shot outcomes but cannot inspect the internal evolution, parameters, or gradients. We give a measurement-only framework that returns two complementary guarantees for each input: a lower bound ruling out untargeted errors within a radius, and an attack-independent upper bound witnessing an adversarial state within a radius. Both are estimable from the known readout measurement and sampled outcomes, require no tomography or circuit description, and have finite-sample control of probability-estimation error. The upper bound uses gap operators induced by the quantum measurement; the lower bound relaxes state-space search to an efficient optimization over outcome distributions with operator-spectrum constraints, yielding certificates that are never weaker than prior probability-only certificates and can be strictly stronger when the spectral constraints are active. On tractable instances, we compare the lower bound with numerical white-box reference estimates; across multiple classifiers, the upper bound remains informative when standard attacks fail. We further demonstrate real-device feasibility on IBM Quantum hardware: from 40 executions of two 8-qubit quantum neural networks, our method estimates both bounds, with the expected lower-upper ordering on every tested input. Taken together, these results show that robustness claims for quantum classifiers can be audited directly from observable statistics under KRQA.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": "Journal reference: the 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS 26)",
  "arxiv": "2609.11637",
  "author_total": 2,
  "authors": [
    {
      "name": "Ji Guan"
    },
    {
      "name": "Mingyu Huang"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/dpbfz46q6gsks.bib",
  "cited_by": 0,
  "doi": "10.48550/arxiv.2609.11637",
  "fulltext_url": null,
  "id": "dpbfz46q6gsks",
  "issns": [],
  "landing_url": "https://arxiv.org/abs/2609.11637",
  "language": null,
  "licence": "LicenseRef-arXiv-nonexclusive-1.0",
  "licence_label": "arXiv licence",
  "licence_source": "article",
  "licence_url": "http://arxiv.org/licenses/nonexclusive-distrib/1.0/",
  "metadata_licence": "CC0-1.0",
  "native_subjects": [
    [
      "arxiv",
      "cs.CR"
    ],
    [
      "arxiv",
      "quant-ph"
    ],
    [
      "openalex",
      "1702|Quantum Computing Algorithms and Architecture"
    ]
  ],
  "openalex": "W7212294950",
  "pdf_url": "https://arxiv.org/pdf/2609.11637",
  "pmcid": null,
  "pmid": null,
  "published": "2026-09-15",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/dpbfz46q6gsks.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:21:41Z",
      "native_id": "2609.11637",
      "source": "arxiv",
      "url": "https://arxiv.org/abs/2609.11637"
    }
  ],
  "subjects": [
    {
      "field": "physics",
      "origin": "arxiv:quant-ph",
      "subfield": "quantum"
    }
  ],
  "title": "Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access",
  "title_text": "Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access",
  "type": "preprint",
  "updated_at": "2026-10-30T12:21:41Z",
  "url": "https://research.draconitic.com/paper/dpbfz46q6gsks",
  "venue": "arXiv",
  "versions": [
    {
      "doi": "10.1145/3830454.3846634",
      "pid": null,
      "relation": "published-as",
      "title": null,
      "venue": null
    }
  ]
}