Feature-level analysis and adversarial transfer in rotationally equivariant quantum machine learning

1. Problem Statement

Group-equivariant Quantum Machine Learning (QML) models are designed to exploit symmetries (e.g., rotations, permutations) to improve trainability and inductive bias. However, a critical gap remains in understanding how these symmetry constraints affect adversarial robustness, specifically transfer robustness (the ability of a model to resist attacks crafted on a different, classical surrogate model).

While previous studies suggested quantum models might be more resilient to transfer attacks, it is unclear why or how symmetry shapes the specific input features a model relies on. The central question is: Does enforcing rotational equivariance inherently guarantee robustness, or can these models still rely on "brittle" (non-robust) features within their restricted invariant feature space?

2. Methodology

The authors employ a feature-level analysis framework centered on a specific architecture: the rotationally equivariant quantum model introduced in Ref. [5].

A. Theoretical Framework: Group Twirling

The authors derive a characterization of the information accessible to an equivariant model using group twirling.

• Premise: If a model is $G$-equivariant with an invariant readout, its prediction depends only on the $G$-twirled input state ($T_G(\rho)$).
• Implication: The model cannot distinguish between an input $\rho$ and its twirled counterpart. Any perturbation $\Delta$ satisfying $T_G(\Delta) = 0$ lies in an uninformative subspace.
• Application to Rotation: For the specific model (acting on a radial and orbital register), the twirled state depends exclusively on rotation-invariant circular correlations between pixel rings.
  • The accessible information decomposes into Fourier modes ($m$) of the orbital register.
  • The $m=0$ mode corresponds to ring-averaged intensities (mean intensity of each concentric ring).
  • Higher modes ($m \neq 0$) correspond to structured angular variations.

B. Diagnostic Input Transformations

To probe which invariant statistics the trained model actually uses, the authors introduce three controlled transformations applied to the training/test data:

1. T1 (Orthogonal Circulant Scrambling): Randomly scrambles the angular order of pixels within each ring using an orthogonal circulant matrix.
   • Effect: Preserves all rotation-invariant correlations (and thus the twirled state) but destroys visual structure.
2. T2 (Ring-wise Permutation): Randomly permutes the angular order of pixels within each ring.
   • Effect: Preserves ring averages ($m=0$) but destroys higher-order correlation structures.
3. T3 (Ring-wise Mean Removal): Subtracts the mean intensity from each ring.
   • Effect: Removes the $m=0$ component (ring averages) while preserving relative correlation structures.

C. Experimental Setup

• Datasets: STM, MNIST, RotMNIST, RotFMNIST, and a binary CIFAR task.
• Attack Setting: Transfer-only attacks. Adversarial examples are generated using Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) on classical surrogate models (Linear Classifier, MLP, CNN, ResNet18). These perturbations are then transferred to the target quantum model.
• Interventions: The authors test robustness improvements via:
  1. Adversarial Training: Training on data perturbed by a Linear Classifier (LC) surrogate.
  2. Architectural Intervention: Projecting out the $m=0$ Fourier mode (ring-averaged intensities) at the measurement stage.

3. Key Contributions

1. Feature-Level Characterization: The paper provides the first explicit derivation of the accessible information in a rotationally equivariant QML model, showing it relies on circular correlations decomposed into symmetry sectors (Fourier modes).
2. Brittleness of Invariant Features: It demonstrates that equivariance alone does not guarantee adversarial robustness. Even within the restricted space of rotation-invariant features, models can rely on brittle statistics.
3. Identification of the "Ring-Average" Vulnerability: The study identifies that ring-averaged intensities ($m=0$ mode) are the primary source of brittleness. Models relying heavily on this feature are highly vulnerable to transfer attacks from simple linear surrogates.
4. Targeted Robustness Strategy: The authors propose and validate a method to improve robustness by suppressing the specific symmetry sector ($m=0$) associated with the brittle feature, rather than relying solely on data augmentation or adversarial training.

4. Key Results

• Feature Reliance Varies by Dataset:
  • Datasets like STM, RotFMNIST, and CIFAR rely heavily on ring-averaged intensities (T2 preserves performance; T3 degrades it significantly).
  • Datasets like MNIST and RotMNIST rely more on higher-order angular correlations (T3 preserves more utility than T2).
• Transfer Attack Vulnerability:
  • Models trained on clean data exhibit poor transfer robustness, particularly on datasets where they rely on ring-averaged features.
  • Surprisingly, even a simple Linear Classifier (LC) surrogate can generate highly effective transfer attacks against the quantum model. This is because the LC naturally learns to rely on ring-averaged features (which are rotation-invariant), aligning its decision boundary with the quantum model's brittle features.
• Robustness Improvements:
  • Adversarial Training: Improves robustness but suffers from the standard robustness-accuracy trade-off (clean test accuracy drops significantly).
  • $m=0$ Projection (Architectural Intervention): Suppressing the ring-averaged intensity channel at the readout stage yields consistent robustness improvements across all surrogates (LC, MLP, CNN, ResNet) while preserving clean-test accuracy much better than adversarial training.
  • This confirms that the brittleness was localized to a specific symmetry sector that could be surgically removed.

5. Significance and Implications

• Beyond "Symmetry = Robustness": The work challenges the assumption that enforcing symmetry automatically leads to robustness. It shows that symmetry-constrained models can still learn "shortcut" features (like ring averages) that are easy for attackers to exploit.
• Mechanistic Interpretability: The paper establishes a systematic mechanism to analyze which features a QML model uses. By linking symmetry sectors (Fourier modes) to specific input statistics, researchers can diagnose and fix robustness issues.
• Design Guidelines for Future QML: The study suggests that future equivariant quantum models should not just enforce symmetry but also curate the symmetry channels. Selectively suppressing sectors associated with brittle features (like low-frequency averages) can enhance robustness without sacrificing performance.
• Privacy and Obfuscation: The authors note that transformations preserving the twirled state (like T1) can be used for data obfuscation. Sensitive data can be scrambled in a way that is invisible to the equivariant model (preserving utility) but visually unrecognizable to humans, offering a potential privacy-preserving mechanism.

In summary, this paper bridges the gap between geometric QML theory and adversarial security, providing a rigorous feature-level explanation for transfer vulnerabilities and a concrete architectural solution to mitigate them.