Quantum machine learning (QML) continues to be an area of tremendous interest
from research and industry. While QML models have been shown to be vulnerable
to adversarial attacks much in the same manner as classical machine learning
models, it is still largely unknown how to compare adversarial attacks on
quantum versus classical models. In this paper, we show how to systematically
investigate the similarities and differences in adversarial robustness of
classical and quantum models using transfer attacks, perturbation patterns and
Lipschitz bounds. More specifically, we focus on classification tasks on a
handcrafted dataset that allows quantitative analysis for feature attribution.
This enables us to get insight, both theoretically and experimentally, on the
robustness of classification networks. We start by comparing typical QML model
architectures such as amplitude and re-upload encoding circuits with
variational parameters to a classical ConvNet architecture. Next, we introduce
a classical approximation of QML circuits (originally obtained with Random
Fourier Features sampling but adapted in this work to fit a trainable encoding)
and evaluate this model, denoted Fourier network, in comparison to other
architectures. Our findings show that this Fourier network can be seen as a
"middle ground" on the quantum-classical boundary. While adversarial attacks
successfully transfer across this boundary in both directions, we also show
that regularization helps quantum networks to be more robust, which has direct
impact on Lipschitz bounds and transfer attacks.

量子机器学习模型与经典机器学习模型相似和不同的对抗鲁棒性进行了系统调查，使用了传递攻击、扰动模式和 Lipschitz 界限的方法。发现正则化有助于增强量子网络的鲁棒性，对 Lipschitz 界限和传递攻击有直接影响。

量子与经典机器学习模型的对抗鲁棒性比较分析

A Comparative Analysis of Adversarial Robustness for Quantum and  Classical Machine Learning Models

In this paper, we systematically evaluate the robustness of multi-exit
language models against adversarial slowdown. To audit their robustness, we
design a slowdown attack that generates natural adversarial text bypassing
early-exit points. We use the resulting WAFFLE attack as a vehicle to conduct a
comprehensive evaluation of three multi-exit mechanisms with the GLUE benchmark
against adversarial slowdown. We then show our attack significantly reduces the
computational savings provided by the three methods in both white-box and
black-box settings. The more complex a mechanism is, the more vulnerable it is
to adversarial slowdown. We also perform a linguistic analysis of the perturbed
text inputs, identifying common perturbation patterns that our attack
generates, and comparing them with standard adversarial text attacks. Moreover,
we show that adversarial training is ineffective in defeating our slowdown
attack, but input sanitization with a conversational model, e.g., ChatGPT, can
remove perturbations effectively. This result suggests that future work is
needed for developing efficient yet robust multi-exit models. Our code is
available at: this https URL

通过系统评估我们提出的减速攻击对多出口语言模型的鲁棒性，我们发现多出口机制越复杂，越容易受到减速攻击的影响，并且在对抗训练方面的效果有限，但使用会话模型进行输入清理可以有效去除扰动。这一研究表明需要进一步开发高效且鲁棒的多出口模型。

BERT 失去耐心不会对抗对抗性放缓有鲁棒性

BERT Lost Patience Won't Be Robust to Adversarial Slowdown

Deep Convolution Neural Networks (CNNs) can easily be fooled by subtle,
imperceptible changes to the input images. To address this vulnerability,
adversarial training creates perturbation patterns and includes them in the
training set to robustify the model. In contrast to existing adversarial
training methods that only use class-boundary information (e.g., using a
cross-entropy loss), we propose to exploit additional information from the
feature space to craft stronger adversaries that are in turn used to learn a
robust model. Specifically, we use the style and content information of the
target sample from another class, alongside its class-boundary information to
create adversarial perturbations. We apply our proposed multi-task objective in
a deeply supervised manner, extracting multi-scale feature knowledge to create
maximally separating adversaries. Subsequently, we propose a max-margin
adversarial training approach that minimizes the distance between source image
and its adversary and maximizes the distance between the adversary and the
target image. Our adversarial training approach demonstrates strong robustness
compared to state-of-the-art defenses, generalizes well to naturally occurring
corruptions and data distributional shifts, and retains the model accuracy on
clean examples.

利用目标样本的样式和内容信息以及其类边界信息创建对抗性扰动，将其应用于多任务目标并进行深度监督，提取多尺度特征知识以创建最大分离对手，随后提出最大间隔对抗训练方法，最小化源图像与其对手之间的距离，并最大化对手和目标图像之间的距离，证明与最先进的防御相比，我们提出的对抗训练方法表现出强大的鲁棒性，对自然出现的损坏和数据分布变化具有良好的泛化能力，并保留了模型在干净样本上的准确性。