Quantum adversarial metric learning model based on triplet loss function

Triplet loss function is a widely used strategy for metric learningsalakhutdinov2007learning , commonly used in image retrieval and face recognition. A triplet set ${(x_{i}^{a},x^{p}_{i},x^{n}_{i})}$ consists of three samples from two classes, where anchor sample $x_{i}^{a}$ and positive sample $x^{p}_{i}$ belong to the same class, and negative sample $x^{n}_{i}$ comes from another class. The goal of metric learning based on triplet loss function is to find the optimal embedded representation space, in which positive sample pairs ${(x_{i}^{a},x^{p}_{i})}$ are pulled together and negative sample pairs ${(x_{i}^{a},x^{n}_{i})}$ are pushed away. Fig.1 shows sample space change in the metric learning process. As we can see, samples from different classes become linearly separable through metric learning. Fig.2 shows the schematic of the metric learning model based on triplet loss function. Firstly, the model prepares multiple triplet sets, and one triplet set ${(x_{i}^{a},x^{p}_{i},x^{n}_{i})}$ is sent to convolutional neural networks (CNN), where three CNN with the same structure and parameters are needed. Each CNN acts on one sample of the triplet set to extract its features. The triplet loss function is obtained by computing metric distances for multiple sample pairs of triplet sets. In the learning process, the optimal parameters of CNN are obtained by minimizing the triplet loss function.

Let one batch samples include $N_{1}$ triplet sets. The triplet loss function is

where $g(\cdot)$ represents the function mapping input samples to the embedded representation space, $D(\cdot,\cdot)$ denotes the distance between a sample pair in the embedded representation space, and $[\ \cdot\ ,\ \cdot\ ]_{+}=max(0,\ \cdot\ )$ represents the hinge loss function. The goal of metric learning is to learn a metric that makes the distances between negative sample pairs greater than the distance between the corresponding positive sample pairs and satisfies the specified margin $\mu\in\mathbb{R}^{+}$mao2019metric . In the triplet loss function, $D(g(x^{a}_{i}),g(x^{p}_{i}))$ penalizes the positive sample pair $(x^{a}_{i},x^{p}_{i})$ that is too far apart, and $D(g(x^{a}_{i}),g(x^{n}_{i}))$ penalizes the negative sample pair $(x^{a}_{i},x^{p}_{i})$ whose distance is less than the margin $\mu$.

Metric learning can adopt various distance metric methods. Angular distance metric is robust to image illumination and contrast variation wang2017deep , which is an efficient way for metric learning tasks. In this method, samples need to be normalized to unit vectors in advance. The distance between a positive sample pair is

where $|\ |$ and $||\ ||_{2}$ represent $l_{1}$-norm and $l_{2}$-norm, respectively, and $\cdot$ denotes the inner product operation for two vectors. The distance between negative sample pairs can be calculated in the same way.

For most machine learning tasks, it is often challenging to adopt simple linear functions to distinguish samples of different classes. According to kernel theoryblank2020quantum , samples in high-dimensional feature space have better distinguishability. Classical machine learning algorithms usually adopt kernel methods to map samples to high-dimensional feature space, where the mapped samples can be separated by simple linear functions. Quantum states with $n$-qubits are in $2^{n}$-dimensional Hilbert space, where quantum systems characterize the nonlinear features of data and efficiently process data through a series of linear unitary operations.

In the QAML model, samples should be firstly mapped into quantum systems by qubit encoding. The Hilbert space after encoding usually does not correspond to the optimal space for separating samples of different classes. To search for the optimal Hilbert space, the QAML model performs parameterized quantum circuits $W(\theta)$ on the encoded statesgrant2018hierarchical . As different variable parameters $\theta$ correspond to different mapping spaces, we can search the optimal space by modifying parameters $\theta=(\theta_{1}^{1},...,\theta_{i}^{j})$. As long as $W(\theta)$ has strong expressivity, we can find the optimal Hilbert space by optimizing the loss function of metric learningperez2020data ; schuld2021effect . $W(\theta)$ with different structures and layers have different expressivity. The more layers $W(\theta)$ has, the stronger the expressivity, and the easier it is to find the optimal metric space.

The classical metric learning model based on triplet loss function requires three identical CNN to map triplet sets $(x_{i}^{a},x_{i}^{p},x_{i}^{n})$ into the novel Hilbert space. To reduce the demand for quantum resources, we construct a quantum superposition state to represent one triplet set so that a triplet set only needs one $W(\theta)$ to transform it into Hilbert space. The core work of the building loss function is to compute inner products between sample pairs, but $W(\theta)$ and subsequent conjugate operation $W^{\dagger}(\theta)$ counteract each other’s effects. To solve this issue, we add a repeated encoding operation after $W(\theta)$. It is worth mentioning that the repeated encoding operation is also conducive to the construction of high-dimensional features of samples.

The QAML model is mathematically represented as the minimization of the loss function with respect to the parameters $\theta$. The triplet loss function consists of metric distances for positive and negative sample pairs, so the kernel work of the QAML model is constructing the metric distances for sample pairs in the transformed Hilbert space. The mapping samples $h(x_{i}^{a})/||h(x_{i}^{a})||_{2}$ and $h(x_{i}^{p})/||h(x_{i}^{p})||_{2}$ of Equ.2 are replaced by the quantum states of $x_{i}^{a}$ and $x_{i}^{p}$, then the second term of Equ.2 is converted to the inner product between quantum states of the positive sample pair $(x_{i}^{a},x_{i}^{p})$, which can be got by the method of the Hadamard classifierblank2020quantum . The triplet loss function can be viewed as the weighted sum of the inner product of sample pairs $(x_{i}^{a},x_{i}^{p})$ and the inner product of sample pairs $(x_{i}^{a},x_{i}^{n})$. With the help of ancilla registers, the triplet set can be prepared in superposition states form. According to the entanglement property of superposition states, the triplet loss function can be implemented with one parameterized quantum circuit. Then, the triplet loss function value is transmitted to a classical optimizer, and parameters are optimized until the optimal metric is obtained. The QAML model constructs adversarial samples according to the gradient of natural samples and trains alternatively natural and adversarial samples to improve the model’s robustness against adversarial attacks. The schematic of the QAML model is shown in Fig.3.

In the QAML model, classical samples are firstly mapped into quantum states by qubit encoding, where each element is encoded as a Pauli rotation angle of one qubit. The number of qubits required by qubit encoding is equivalent to the dimension of the input sample. Still, the dimension of one quantum state grows exponentially with the input dimension, and $N$-dimensional samples will be mapped to $2^{N}$-dimensional Hilbert space. The qubit encoding method cannot use logarithm qubits of the input sample dimension to represent classical samples. However, easy state preparation and low circuit depth make qubit encoding more suitable for implementation on near-term quantum devices.

Samples in practical applications are usually in real space. Applying $R_{X}$ and $R_{Z}$ rotations on quantum states would introduce imaginary terms, so the QAML model adopts $R_{Y}$ rotation to prepare the initial mapped states, where classical samples determine the rotation angles of qubits. Let $x_{i}^{j}$ denote the $j$th element of the sample $x_{i}$ scaling to the range $[-1,1]$, and its corresponding qubit encoding is

Then, the qubit encoding of $x_{i}$ corresponds to the tensor product state

In the QAML model, the parameterized quantum circuit is responsible for transforming the Hilbert space of samples. The variable parameters are continuously optimized in iterations to obtain the optimal Hilbert space for separating samples of different classes. Parameterized quantum circuit, also called ansatz, generally adopts a multi-layer circuit structure, where each layer contains a series of unitary operations depending on variable parameters. Ansatz can embed samples into the Hilbert space that classical metric learning methods cannot represent. Hardware-efficient ansatz, one of the common ansatzes, has strong expressivity with fewer layerszoufal2019quantum , and it is widely applied in Noisy Intermediate-Scale Quantum (NISQ)devices. Hardware-efficient ansatz adopts a layered circuit layoutkandala2017hardware , where each layer consists of interleaved 2-qubits unitary modules. Let $W^{k}_{ij}(\theta)$ denote the unitary module acting on the neighboring qubit pair $(i,j)$ in the $k$th layer. The unitary operation in the $k$th layer can be written as

where $N_{1}$ and $N_{2}$ represent the odd and even subsets of $[0,N-1]$. For $l_{1}$-layer structure, the ansatz can be written as $W(\theta)=\prod_{k=1}^{l_{1}}W^{k}(\theta)$.

The dimension of the mapping quantum state is exponential in the input dimension. As the input dimension increases, the dimension of the mapping quantum states will be much larger than the input dimension. In some machine learning tasks, the QAML model may be expected to have a smaller output dimension to facilitate subsequent subroutine execution, the QAML model needs to add some unitary models to adjust the output dimension. A primary strategy is to add dimension reduction operation following the repeated encoding layer $U_{1}(x_{i})$ to reduce the output dimensioncong2019quantum . The dimension reduction operation is shown in Fig.3 (b). Firstly, alternating 2-qubit unitary modules act on two neighboring qubits to entangle the mapping features. Then, one qubit of each module is measured, and the measurement result is used to control the unitary operation acting on another qubit. Let $Q_{ij}^{k}=tr_{i}(P^{k}_{ij})$ denote the operation acting on the $(i,j)$ qubit pair in the $k$th layer, where $tr_{i}$ represents the partial operation on the $i$th qubit. $P_{ij}^{k}=|0\rangle\langle 0|\otimes P^{0}_{ij}+|1\rangle\langle 1|\otimes P^{1}_{ij}$ is the controlled unitary, which represents to perform single-qubit unitary $P^{0}_{ij}$ or $P^{1}_{ij}$ on the second register according to the measurement result of the first qubit, then $Q^{k}=\prod_{i,j}Q_{ij}^{k}$ represent the dimension reduction operation of the $k$th layer. Assume the dimension reduction operation includes $l_{2}$ layers, and the output state can be reduced to $2^{N/(2^{l_{2}})}$-dimensional Hilbert space.

Classical metric learning based on triplet loss function needs three identical CNN to extract the features of the triplet set $(x_{i}^{a},x_{i}^{p},x_{i}^{n})$. To reduce the requirement of parameterized quantum circuits, the QAML model encodes the triplet set on two-qubit basis, then interferes with positive and negative sample pairs by a Hadamard gate. The inner products for the positive and negative sample pair are got in parallel by measuring the expectation of $\sigma_{z}$ observables with respect to 2 qubits of basis state. Let $|\varphi^{a}_{i}\rangle$, $|\varphi^{p}_{i}\rangle$, and $|\varphi^{n}_{i}\rangle$ represent the states of anchor sample $x^{a}_{i}$, positive sample $x^{p}_{i}$, and negative sample $x^{n}_{i}$, respectively. Firstly, the QAML model prepares a superposition state

for the triplet set $(x^{a}_{i},x^{p}_{i},x^{n}_{i})$, where $s$ is sample register, and 1 and 2 denote ancilla registers for basis states. Metric learning based on triplet loss function requires a specific margin between the samples of different classes. To construct the margin, we replace $|\varphi_{i}^{n}\rangle_{s}|0\rangle_{1}|1\rangle_{2}$ with

and $|\varphi_{i}^{p}\rangle_{s}|1\rangle_{1}|1\rangle_{2}$ with

where $\alpha$ is the parameter determining the margin. $|\varphi_{i}^{a}\rangle$, $|\varphi_{i}^{p}\rangle$, and $|\varphi_{i}^{n}\rangle$ may not be in the optimal Hilbert space for separating samples of different classes. Then, the parameterized quantum circuit $W(\theta)_{s}\otimes I_{1}\otimes I_{2}$ acts on $|\varphi_{i}\rangle$, where $I_{1}$ and $I_{2}$ denote the identity operations acting on ancilla registers 1 and 2, and $W(\theta)_{s}$ represents the ansatz acting on the sample register $s$. The system gets the state

where $|\varphi_{i}^{00}\rangle_{s}=W(\theta)_{s}(\frac{\sqrt{\alpha^{2}+1}}{\sqrt{2\alpha^{2}+1}}|\varphi_{i}^{a}\rangle_{s}+\frac{\alpha}{\sqrt{2\alpha^{2}+1}}|\varphi_{i}^{n}\rangle_{s})$, $|\varphi_{i}^{10}\rangle_{s}=W(\theta)_{s}(\frac{\sqrt{\alpha^{2}+1}}{\sqrt{2\alpha^{2}+1}}|\varphi_{i}^{a}\rangle_{s}-\frac{\alpha}{\sqrt{2\alpha^{2}+1}}|\varphi_{i}^{p}\rangle_{s})$, $|\varphi_{i}^{01}\rangle_{s}=W(\theta)_{s}|\varphi_{i}^{n}\rangle_{s}$, $|\varphi_{i}^{11}\rangle_{s}=W(\theta)_{s}|\varphi_{i}^{p}\rangle_{s}$.

As $W(\theta)_{s}W^{\dagger}(\theta)_{s}=I$, the inner product acting on the state pairs $|\varphi_{i}^{00}\rangle$ and $|\varphi_{i}^{01}\rangle$ or $|\varphi_{i}^{10}\rangle$ and $|\varphi_{i}^{11}\rangle$ will counteract the effect of $W(\theta)$ and $W^{\dagger}(\theta)$. An effective strategy is to perform the repeated encoding operation $U_{1}(x_{i})$ on $|\varphi_{i}^{{}^{\prime}}\rangle$, which not only solves the problem of the unitary operation and its conjugate operation counteracting effects of each other in the inner product calculation process but also extends the addressable Hilbert space. After the repeated encoding operation $U_{1}(x_{i})$, the system gets the state

where $|\varphi_{i}^{00^{\prime}}\rangle_{s}=U_{1}(x_{i})|\varphi_{i}^{00}\rangle_{s}$, $|\varphi_{i}^{10^{\prime}}\rangle_{s}=U_{1}(x_{i})|\varphi_{i}^{10}\rangle_{s}$, $|\varphi_{i}^{01^{\prime}}\rangle_{s}=U_{1}(x_{i})|\varphi_{i}^{01}\rangle_{s}$ and $|\varphi_{i}^{11^{\prime}}\rangle_{s}=U_{1}(x_{i})|\varphi_{i}^{11}\rangle_{s}$.

A simple method of computing inner products between sample pairs is the Hadamard classifier methodblank2020quantum . In this method, two samples are firstly projected into orthogonal subspaces, spanned by standard basis states of one ancilla register. Then, a Hadamard gate acts on the standard basis states to interfere with two samples in the 2-dimensional subspaces. Finally, the inner product between two samples is got by measuring the expectation value of $\sigma_{z}$ for the ancilla register. The triplet loss function, consisting of inner products for positive and negative sample pairs, needs to compute the weighted sum of inner products for sample pairs, where the weight of positive sample pairs is $+1$, and the weight of negative sample pairs is $-1$. The states of the triplet sets have been prepared on the two-qubit standard basis, shown in Equ.10. The QAML model consists of two ancilla registers, Ancilla register 2 is used to build the inner products of sample pairs. The QAML model adopts one Hadamard gate acting on ancilla register 2 to interfere with sample pairs. If only the expectation of the observable $\sigma_{z}$ for the ancilla register 2 is measured, the QAML model will get the sum of the inner products for positive and negative sample pairs. The QAML model adds another register (Ancilla register 1) to distinguish between different sample pairs, and measuring the expectation with respect to the $\sigma_{z}$ operator can get the weights of sample pairs. So the QAML model not only measures the expectation of the observable $\sigma_{z}$ with respect to ancilla registers 1 but also the expectation for ancilla registers 2. The expectation on two ancilla registers is

where $\frac{\alpha}{\sqrt{\alpha^{2}+1}}$ represents the margin for separating positive and negative samples. With the help of classical computation, one gets the triplet loss function

In practical applications, one batch of samples may contain multiple triplet sets, so the QAML model needs to add a index register to distinguish different triplet sets. Let one batch of samples include $m$ triple sets. $|\varphi_{i}^{a}\rangle_{s}$, $|\varphi_{i}^{p}\rangle_{s}$ and $|\varphi_{i}^{n}\rangle_{s}$ of Equ.6 are replaced by the superposition states $|\widetilde{\varphi}_{i}^{a}\rangle_{s,d}=\frac{1}{\sqrt{m}}\Sigma_{j=im}^{(i+1)m-1}|\varphi_{j}^{a}\rangle_{s}|j\rangle_{d}$, $|\widetilde{\varphi}_{i}^{p^{\prime}}\rangle_{s,d}=\frac{1}{\sqrt{m}}\Sigma_{j=im}^{(i+1)m-1}|\varphi^{p}_{j}\rangle_{s}|j\rangle_{d}$, and $|\widetilde{\varphi}_{i}^{n^{\prime}}\rangle_{s,d}=\frac{1}{\sqrt{m}}\Sigma_{j=im}^{(i+1)m-1}|\varphi^{n}_{j}\rangle_{s}|j\rangle_{d}$ to construct the loss function for this batch, where the subscript $d$ denotes the index register. The QAML model performs Equ10-12 and yields the expectation value of the observable $\sigma_{z}$ with respect to ancilla register 1 and 2 as

which corresponds to the weighted sum of the inner products for one batch samples.

Metric learning is vulnerable to adversarial attacks. Attackers usually adopt adding small and imperceptible perturbations on natural samples to generate adversarial samples for deceiving metric learning models. Adversarial attacks make metric learning models unable to accurately distinguish positive and negative samples and give rise to misclassification. Miyatomiyato2018virtual proposed an adversarial training method, where ambiguous but critical adversarial samples are generated based on the gradients of natural samples and added to the training setliu2020vulnerability . This method effectively fights against white-box attacks and improves the robustness of the model. Inspired by this method, we developed a quantum adversarial samples generation method. Considering the efficiency of the triplet loss function, we do not create adversarial samples corresponding to all natural samples. Anchor samples in the triplet loss function are used twice to compute the inner products of positive and negative sample pairs. The adversarial samples corresponding to anchor samples can provide more valuable information for adversarial training, so the QAML model only build adversarial samples corresponding to anchor samples.

Let $|\varphi_{a}^{*}\rangle$ denote the adversarial sample corresponding to the anchor sample $|\varphi_{a}\rangle$. According to the characteristics of adversarial attacks, $|\varphi_{a}^{*}\rangle$ is far from the positive sample $|\varphi_{p}\rangle$ but close to the negative sample $|\varphi_{n}^{*}\rangle$, and this characteristic makes the QAML model hard to build accurate metric distances. According to Refkurakin2016adversarial , adversarial attacks generated along the direction of gradient ascent will produce the strongest disturbance to metric learning, so we develop a quantum gradient ascent method to generate adversarial samples. Let $\bigtriangledown_{i}^{a}=({(\bigtriangledown_{i}^{a})}^{1},{(\bigtriangledown_{i}^{a})}^{2},...,{(\bigtriangledown_{i}^{a})}^{N})$ denote the gradient vector of the loss function $L_{l}(\theta,|\varphi_{i}^{a}\rangle,|\varphi_{i}^{p}\rangle,|\varphi_{i}^{n}\rangle)$ with respect to the anchor sample $|\varphi_{i}^{a}\rangle$, where the element $(\bigtriangledown_{i}^{a})^{j}=\partial(L_{l}(\theta,|\varphi_{i}^{a}\rangle,|\varphi_{i}^{p}\rangle,|\varphi_{i}^{n}\rangle))/\partial(|\varphi_{i}^{a}\rangle^{j})$ is the partial derivation of the loss function with respect to the $j$th element of $|\varphi_{i}^{a}\rangle$.

The QAML model may encounter many attacks. One of the common attacks is the white-box attack, under which the attackers have complete information about the QAML model, including the loss function implemented by parameterized quantum circuit, so that they can compute the gradients of the loss function with respect to gate parameters. Let the QAML model suffer from the functional adversarial attackmcclean2017hybrid (one kind of white-box attacks), under which each element of quantum states is influenced by the attack independently. According to the idea of gradient ascent, the adversarial anchor sample $|\varphi^{i*}_{a}\rangle$ can be written as

where $\lambda=(\lambda_{1},\lambda_{2},...,\lambda_{N})$ is a constant vector used to control the disturbance within a specified bound. Usually, $\lambda$ is determined by the problem to be solved and its upper bound is $||\lambda||_{p}\leq\varepsilon$, where $||\cdot||_{p}$ denotes $l_{p}$-norm.

Let $V(\lambda\nabla_{i}^{a})=v(\lambda_{1}{(\nabla_{i}^{a})}^{1})\otimes...\otimes v(\lambda_{N}{(\nabla_{i}^{a})}^{N})$ denote the unitary acting on the anchor sample $|\varphi_{i}^{a}\rangle$ to generate the adversarial sample $|\varphi_{i}^{a*}\rangle$, where $v(\lambda_{j}{(\nabla_{i}^{a})}^{j})$ represents the unitary operation acting on the $j$th element of $|\varphi_{i}^{a}\rangle$. It is expected that $v(\lambda_{j}{(\nabla_{i}^{a})}^{j})$ has small impact on the state $|\varphi_{i}^{a}\rangle$, so $V(\lambda\nabla_{i}^{a})$ is close to the identity operator $I$. $v(\lambda_{j}{(\nabla_{i}^{a})}^{j})$ can be implemented by the rotation operation

where $\beta=\arccos(1+\lambda_{j}{(\nabla_{i}^{a})}^{j})$. As the QAML model only adopts anchor samples to generate adversarial samples, we define the unitary operation to generate adversarial sample as

where $V(\lambda\nabla^{a}_{i})$ acts on the sample register $s$ only when the ancilla register 2 is $|0\rangle$, and $I_{s}$ and $I_{1}$ mean the identity unitary $I$ acting on registers $s$ and 1, respectively. Fig.3 (c) shows the schematic of generating adversarial samples, where $U^{{}^{\prime}}_{1}(x_{i}^{a})=V^{{}^{\prime}}(\lambda\nabla_{i}^{a})U_{1}(x_{i}^{a})$ replaces $U_{1}(x_{i}^{a})$ to generate the adversarial sample $|\varphi_{i}^{a*}\rangle$. In the QAML training process, the parameters $\theta$ are optimized by alternatively minimizing the loss function $L_{l}(\theta,|x_{i}^{a}\rangle,|x_{i}^{p}\rangle,|x_{i}^{n}\rangle)$ and $L_{l}(\theta,|x_{i}^{a*}\rangle,|x_{i}^{p}\rangle,|x_{i}^{n}\rangle)$, where natural and adversarial samples are respectively served as input.

The core work of generating adversarial samples is to compute the partial deviation ${(\nabla_{i}^{a})}^{j}$. Many methods can be adopted to calculate ${(\nabla_{i}^{a})}^{j}$, such as the finite difference scheme and parameter shift rulecrooks2019gradients ; schuld2019evaluating ; mitarai2018quantum . The parameter shift rule has faster convergence in the training process, making it more suitable for NISQ devices. $(\nabla_{i}^{a})^{j}$ is evaluated using the parameter shift rule

where $x_{i,j}^{a\pm}=x_{i}^{a}\pm\frac{\pi}{2}e^{j}$, and $e^{j}$ is the unit vector with only the $j$th qubit being 1. According to Equ17, one partial derivative can be got by evaluating the loss function twice.