🤖 machine learning

Radio Signal Classification by Adversarially Robust Quantum Machine Learning

This paper investigates the application of Quantum Variational Classifiers with approximate amplitude encoding to radio signal classification, demonstrating that these quantum models offer superior robustness against adversarial attacks compared to classical CNNs and exhibit asymmetric transferability of adversarial examples.

Original authors: Yanqiu Wu, Eromanga Adermann, Chandra Thapa, Seyit Camtepe, Hajime Suzuki, Muhammad Usman

Published 2026-09-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yanqiu Wu, Eromanga Adermann, Chandra Thapa, Seyit Camtepe, Hajime Suzuki, Muhammad Usman

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the invisible ocean of air around us, radio waves carry our conversations, our music, and our critical data. To make sense of this chaotic stream, receivers must instantly recognize the specific pattern, or modulation, used to encode the information. This task, known as automatic modulation classification, is the first step in decoding a message. For decades, engineers have relied on machine learning algorithms to perform this recognition with high speed and accuracy. However, a new vulnerability has emerged: these smart systems can be tricked. By adding tiny, almost invisible amounts of static noise to a signal, an attacker can confuse the receiver, causing it to misidentify a secure transmission as something harmless or to drop the connection entirely. As these digital defenses become more sophisticated, scientists are looking beyond traditional computing to see if the strange laws of quantum physics might offer a stronger shield.

A team of researchers from Australia has taken a significant step in this direction by testing whether quantum computers can defend radio signals against these deceptive attacks better than standard computers. They focused on a specific type of quantum algorithm called a quantum variational classifier. Unlike the deep learning networks used in most modern devices, which process data in a way similar to human neurons, these quantum classifiers use the unique properties of subatomic particles to analyze patterns. The researchers wanted to know if this quantum approach could resist the same tricks that fool conventional systems. To find out, they simulated a battlefield where attackers tried to confuse both a standard neural network and a quantum classifier using three different methods of creating deceptive noise. They tested these systems on real-world radio signal data and a synthetic dataset of waveforms, measuring how well each model held its ground when the signal was tampered with.

The results revealed a striking asymmetry in how these two types of intelligence handle deception. When the researchers generated attacks against the standard neural network, those deceptive signals failed to fool the quantum classifier. The quantum system remained largely immune, recognizing the true nature of the signal despite the noise. However, the reverse was not true. When the researchers attacked the quantum classifier to create deceptive examples, those same examples successfully tricked the standard neural network. In fact, the attacks designed for the quantum system were even more effective at fooling the classical one. This suggests that the quantum classifier learns to see the world differently, identifying features that the standard network misses, making it harder to trick with the specific noise patterns that usually work on conventional systems.

The study also tackled a practical hurdle that has slowed down the use of quantum computers: the sheer amount of resources required to prepare data for them. To feed a radio signal into a quantum computer, the data must be converted into a specific quantum state, a process that traditionally requires a massive number of operations, making it slow and prone to errors. The team introduced a new technique called approximate amplitude encoding. Instead of trying to create a perfect, mathematically exact copy of the signal in the quantum system, they used a simplified method that gets close enough to be useful. This approach reduced the number of required operations by more than eighty percent, dropping the count from nearly one thousand down to just over one hundred. While this simplification caused a tiny drop in the system's initial accuracy, it made the model much more efficient and robust, proving that a slightly less perfect encoding can still provide a strong defense against attacks.

The researchers also looked at what happens when the quantum system is not perfect, which is the reality of current technology. They simulated the presence of random errors, known as noise, that naturally occur in quantum hardware. They found that while this noise did lower the overall accuracy of the system, it did not weaken the system's ability to resist the deceptive attacks. The quantum classifier remained resilient even when the environment was imperfect. Furthermore, they examined how hard it was to detect these attacks. They found that the deceptive signals created by the quantum classifier were generally harder for an observer to spot than those created by the standard network, making them more stealthy. This combination of resilience and stealthiness suggests that quantum methods could offer a new layer of security for wireless communications.

This work represents the first time such a detailed comparison has been made specifically for radio signals, moving beyond the image recognition tasks where quantum machine learning has been studied before. The findings indicate that while quantum classifiers are not yet perfect at recognizing complex signals on their own, they possess a unique strength in defense. They are not easily confused by the tricks that work on traditional systems, and they can generate their own deceptive signals that are highly effective against those same traditional systems. The study concludes that while the technology is still in its early stages and requires further development to handle more complex tasks, the path forward is clear. By combining these quantum defenses with classical methods, and by using efficient encoding techniques to manage resources, we may soon have radio systems that are far more secure against the invisible threats of the digital age.

Technical Summary: Radio Signal Classification by Adversarially Robust Quantum Machine Learning

Problem Statement
Automatic Modulation Classification (AMC) is a critical component of wireless communication systems, enabling receivers to identify modulation schemes without prior control overhead. While Machine Learning (ML), particularly Convolutional Neural Networks (CNNs), has achieved high accuracy in AMC, these models are highly susceptible to adversarial attacks. Such vulnerabilities can lead to severe consequences, including the misinterpretation of critical messages, interception of classified data, and disruption of communication channels. Although recent studies suggest that Quantum Machine Learning (QML), specifically Quantum Variational Classifiers (QVCs), may offer enhanced robustness against adversarial attacks in image classification, it remains unexplored whether these benefits extend to radio signal classification. Furthermore, the practical implementation of QML for radio signals faces challenges regarding data encoding efficiency and the impact of quantum noise.

Methodology
The authors propose a framework to evaluate the robustness of QVCs against various adversarial attacks in the context of radio signal classification. The study utilizes two datasets: the standard GNU Radio ML dataset (RML2016.10a) containing 10 modulation classes, and a synthetic dataset based on Fourier series waveforms (square, sawtooth, and triangle waves).

The experimental setup involves:

Model Architecture: A comparison between a classical CNN and a Quantum Variational Classifier (QVC). The QVC utilizes a variational circuit composed of layers of single-qubit rotation gates ( $R_X, R_Z, R_Y$ ) and two-qubit entanglement gates (CNOT).
Data Encoding: To address the high circuit depth required for exact amplitude encoding of 256-dimensional input vectors, the authors introduce a novel application of Approximate Amplitude Encoding (AAE). This technique uses a shallow, trainable QVC to approximate the exact amplitudes, significantly reducing the number of required quantum gates.
Adversarial Attacks: The study evaluates robustness under both white-box and black-box scenarios using three attack strategies:
- Fast Gradient Sign Method (FGSM): A single-step attack.
- Projected Gradient Descent (PGD): An iterative multi-step attack.
- Universal Adversarial Perturbations (UAP): An input-agnostic attack generating a single perturbation for all data points.
Transferability Analysis: The authors investigate the transferability of adversarial examples between quantum and classical models. In black-box settings, they generate attacks on a substitute model (either QVC or CNN) and test them on the target model.
Noise Simulation: The robustness of the models is further tested by introducing depolarizing noise to simulate realistic quantum hardware conditions.

Key Contributions

First Application to Radio Signals: This work represents the first study to apply QVCs to radio signal classification and evaluate their robustness against adversarial attacks, bridging a gap in the Quantum Adversarial Machine Learning (QAML) literature which has previously focused on computer vision.
Approximate Amplitude Encoding (AAE): The paper proposes and validates the use of AAE for radio signal data. By using 5 layers of AAE, the authors reduced the gate count required for encoding from 973 (exact) to 155, with only a 3.7% sacrifice in classification accuracy. This reduction is crucial for mitigating noise impact and enabling fault-tolerant implementation.
Asymmetric Transferability: The study reveals a distinct asymmetry in attack transferability. Adversarial examples generated by attacking QVCs transfer effectively to CNNs, successfully deceiving them. Conversely, adversarial examples generated by attacking CNNs do not transfer well to QVCs, which largely resist these attacks.
Stealthiness Analysis: The authors developed a statistical method using the Kolmogorov-Smirnov (KS) test to measure the perceptibility of attacks. They found that adversarial examples generated by QVCs (using FGSM and PGD) are generally more imperceptible (harder to detect) than those generated by CNNs.

Results

Robustness: In white-box scenarios, QVCs demonstrated slightly higher robustness than CNNs against FGSM, PGD, and UAP attacks, though both models suffered significant accuracy drops as attack strength (Perturbation-to-Signal Ratio) increased.
Black-Box Transferability: In black-box scenarios, attacks generated on QVCs caused a sharp decline in CNN accuracy (e.g., dropping from 96.7% to 43.4% on the 3-class RML dataset under PGD). However, attacks generated on CNNs had minimal impact on QVC accuracy, which remained relatively stable.
AAE Performance: The AAE-QVC model maintained high robustness against black-box attacks despite the reduced gate count and slight accuracy reduction compared to exact encoding.
Noise Impact: Introducing depolarizing noise (probability $p=0.02$ ) significantly reduced the classification accuracy of the QVC model. However, this noise did not degrade the model's robustness against black-box adversarial attacks generated by CNNs.
Stealthiness: Under FGSM and PGD attacks, QVC-generated adversarial examples were detected as outliers less frequently than CNN-generated examples, indicating higher stealthiness. For UAP attacks, CNN-generated examples were slightly more imperceptible.

Significance and Claims
The paper claims to provide new insights into the field of QAML by demonstrating that quantum classifiers offer a unique form of advantage in radio signal classification: superior robustness against classical adversarial attacks and the ability to generate more imperceptible adversarial examples. The authors emphasize that while QML models may not always surpass classical models in raw classification accuracy, their resilience to attacks targeting classical feature sets offers a distinct security benefit.

The work highlights that the field of QAML is still in its infancy, particularly regarding signal data. The authors modestly note that while QVCs show promise, they remain vulnerable to white-box attacks, indicating a need for future research into defense strategies such as adversarial training. The study concludes that the application of QML methods, particularly with efficient encoding techniques like AAE, holds significant potential for practical, secure wireless communication systems, laying the groundwork for future hybrid quantum-classical approaches.

More like this