When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention
Abstract
Removing an input-scaling module changes both a classifier and the perturbations reaching its encoder. A robustness difference can therefore reflect the comparison rule as well as the module. We demonstrate this problem in a four-qubit quantum-attention detector on generated power-grid trajectories. A learned scaling module appears beneficial at a fixed physical attack budget, but matching an upper bound on perturbations at the encoder reverses the ordering. Neither comparison alone establishes a robustness benefit caused by the module. The initial test also perturbs clean examples into attacked examples while retaining their original labels; tests restricted to already attacked examples do not establish a benefit. Replacing a trained model's input scales disrupts detection. Retraining its linear classification layer restores the detection rate, but changes individual predictions, leaving the comparison descriptive rather than causal. Two further design checks explain why the input quantum Fisher information regularizer cannot train this model's query parameters, and why removing confidence bounds does not establish a larger certified radius. The evidence is limited to ten seeds, exact simulation, synthetic data, and a restricted set of attacks; classical baselines achieve better clean prediction. The practical lesson is to specify which perturbation budget is fixed, check that attacks preserve labels and interventions preserve predictions, and distinguish exploratory controls from confirmatory evidence.
Related
- Disformal Closure Selects 3D Scalar-Tensor Gravity without Local Bulk Modes
- Quantum Representation Selects Neutral Skyrmion Molecules
- Switching diffusivity selects Pareto tail exponent in random growth with redistribution
- Light selects non-equilibrium states of phase-separated droplets
- Drying kinematics selects open honeycomb fold networks on solvent-extracted viscoelastic thin films and gels
BibTeX
@misc{friedewald2026when,
title = {{When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention}},
author = {Owen Friedewald and Srikar Alla and Ali Shiri Sichani and Chi-Ren Shyu},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.02641},
eprint = {2610.02641},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.02641},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - When Normalization Selects the Sign: Auditing Robustness Ablations in Quantum Attention
AU - Owen Friedewald
AU - Srikar Alla
AU - Ali Shiri Sichani
AU - Chi-Ren Shyu
PY - 2026
DA - 2026/10/02
PB - arXiv
DO - 10.48550/arxiv.2610.02641
UR - https://arxiv.org/abs/2610.02641
AB - Removing an input-scaling module changes both a classifier and the perturbations reaching its encoder. A robustness difference can therefore reflect the comparison rule as well as the module. We demonstrate this problem in a four-qubit quantum-attention detector on generated power-grid trajectories. A learned scaling module appears beneficial at a fixed physical attack budget, but matching an upper bound on perturbations at the encoder reverses the ordering. Neither comparison alone establishes a robustness benefit caused by the module. The initial test also perturbs clean examples into attacked examples while retaining their original labels; tests restricted to already attacked examples do not establish a benefit. Replacing a trained model's input scales disrupts detection. Retraining its linear classification layer restores the detection rate, but changes individual predictions, leaving the comparison descriptive rather than causal. Two further design checks explain why the input quantum Fisher information regularizer cannot train this model's query parameters, and why removing confidence bounds does not establish a larger certified radius. The evidence is limited to ten seeds, exact simulation, synthetic data, and a restricted set of attacks; classical baselines achieve better clean prediction. The practical lesson is to specify which perturbation budget is fixed, check that attacks preserve labels and interventions preserve predictions, and distinguish exploratory controls from confirmatory evidence.
ER -