Universal adversarial perturbations for multiple classification tasks with quantum classifiers

Adversarial machine learning has been extensively discussed in the literature, as evidenced by the work by Huang et al. [35]. This field can be approached from two distinct perspectives as a “fact” and an “optimization problem.” The “fact” perspective highlights the existence of subtle perturbations that, when applied to the input of machine learning models, can significantly modify their outputs. On the other hand, the “optimization problem” perspective involves transforming the task into a “maximizing-minimizing problem” and leveraging algorithms with the assistance of computational power to generate adversarial samples. Various logical methods can be employed to attack machine learning systems, resulting in different strategies for adversarial attacks. In this paper, we follow the classification and analysis of adversarial attacks presented in the work by Vorobeychik et al. [36] with a particular focus on supervised learning scenarios.

In the context of supervised learning scenarios, our analysis considers a dataset $D_{N}$ comprising $N$ elements, where each element is denoted by $x^{(i)}$ and $y^{(i)}$, representing the input data to be classified and its corresponding label, respectively [37, 38, 39]. To ensure compatibility with the quantum classifier, the input data $x^{(i)}$ needs to be transformed into a valid quantum state $\left|x^{(i)}\right\rangle$ before the classification process. Assuming that we have trained a quantum classification model $F$ to achieve high accuracy on dataset $D_{N}$, we can affirm that for every input data element $x^{(i)}$, the discrepancy between the model’s output $F\left(\left|x^{(i)}\right\rangle\right)$ and ground truth label $y^{(i)}$, which is calculated from the loss function $L$, is constrained within an acceptable range $\epsilon$:

From an alternative standpoint, the training process in machine learning predominantly focuses on minimizing the loss function. In contrast, the adversarial process aims to maximize the loss function by applying a perturbation $\delta^{(i)}$ within the constraints of a small region $\Delta$. A commonly employed technique involves imposing an $l_{p}$-norm bound, which restricts the magnitude of the perturbation. Consequently, the aforementioned description can be summarized as follows:

Intuitively, the objective of this optimization problem is to achieve an imperceptible perturbation that generates a significant change in the loss function. An intuitive approach is to apply the perturbation along the maximum gradient ascent direction, as the gradient of the loss function indicates the rate of change in a given direction. Suppose we define the function $J(x^{(i)})$ that calculates the absolute gradient value and ascending direction of the gradient for $x^{(i)}$ in a multi-dimensional Hilbert space, as well as the strength of the perturbation denoted by $\epsilon$. In this context, the calculation of perturbation $\delta^{(i)}$ can be summarized as follows:

Most white-box attacks, such as FGSM [25] (fast gradient sign method), PGD [26] (projected gradient descent), and MIM [27] (moment iteration method), draw inspiration from directly calculating gradients and selecting an appropriate perturbation. Meanwhile, for black-box attacks, direct access to the gradient is not available. Substitute optimization methods like differential evolution algorithms are employed to identify the pixels that can significantly alter the value of the loss function. In quantum adversarial machine learning, gradient plays a crucial role as it indicates the regions where the loss function can be easily manipulated. The utilization of gradient information enables us to create minor perturbations specifically in regions characterized by higher absolute gradient values. These perturbations cause a shift in the loss function, guiding the model toward a desired direction and leading to a significant alteration in the model’s performance, thereby producing an adversarial effect.

According to the aforementioned description, the perturbation $\delta^{(i)}$ is calculated individually for each input sample $x^{(i)}$. However, this approach requires attackers to compute specific information for each input, which can be challenging in many attacking scenarios. To address this limitation, a new type of adversarial method called “universal perturbation” has been developed. The underlying principle is to exploit the uniformity within a single task, identify similarities in gradient information across selected samples, and apply the same universal perturbation to transform most original samples into adversarial samples. In other words, the objective is to find a universal perturbation $\delta$ that combines the perturbation strength $\epsilon$ and the gradient sign information $J$ from the entire selected dataset $X$:

By adding this universal perturbation to the original image, we expect to achieve the adversarial transformation of multiple input samples simultaneously.

Extensive evidence has convincingly shown the effectiveness and potential risks associated with universal perturbations for quantum classifiers [30]. Taking this understanding a step further, we pose an intriguing question: Can we generate a universal perturbation capable of deceiving a set of classifiers performing different tasks? To simplify the scenario, consider two classifiers, $A$ and $B$. Their respective datasets are denoted as $X_{A}$ and $X_{B}$. Additionally, we define the function $J$ as the operator that captures gradient information. The formulation of the universal perturbation can be expressed as follows:

In scenarios where gradient information is not exclusively associated with a single input sample, it becomes unavoidable that the resulting perturbation encompasses distributed information from the entire selected dataset, which may not perfectly align with each individual input sample. To overcome this challenge, it is essential to employ larger perturbation strengths and enhance the functionality of gradient information-extraction methods. By doing so, we can effectively address the issue of incorporating dataset-wide information and improve the alignment between perturbations and individual input samples.

In order to differentiate between adversarial examples generated using gradient information from individual input samples and those created using universal perturbations, we propose the term “universal examples” to refer specifically to adversarial examples crafted using universal perturbations. Consequently, we define the adversarial attack that utilizes universal examples as a “universal attack”. This terminology serves the purpose of distinguishing between various approaches and strategies employed in the field of adversarial machine learning. By introducing these specific terms, we can more precisely categorize and discuss the different techniques and methodologies involved in adversarial machine learning.

The design of algorithms to implement the concept of finding universal perturbation poses a significant challenge. Currently, performing calculations on multiple quantum classifiers with different structures is difficult due to limitations in qubit volume and incoherences arising from inconsistencies of quantum circuit parameters. To address this issue, we propose to introduce the quantum continual learning method to merge two target classifiers into one robust continual learning classifier that is capable of tackling multiple classification tasks. Provided that a universal perturbation can be found on this continual learning classifier, the argument of effective universal perturbation of multiple classification tasks shall still hold. Intuitively, quantum continual learning techniques offer a powerful approach to simplify the generating process of universal perturbation and demonstration of universal vulnerability between different classification tasks.

Quantum continual learning, as explored in the work by Jiang et al. [31], encompasses the study of training a classifier capable of performing multiple tasks using the same set of parameters. However, a significant issue arises when training a classifier on two datasets sequentially, as it often results in a substantial decrease in accuracy for the previously trained task. This phenomenon is known as “catastrophic forgetting” [40], which occurs due to the propensity of the learning process for the second task to modify essential parameters associated with the first task. Consequently, the acquisition of robust quantum continual learning models becomes crucial in the context of generating universal perturbations.

Recent research has indicated that animals encounter similar challenges of forgetting when acquiring new knowledge. Interestingly, a method that involves safeguarding specific excitatory synapses that play a crucial role in preserving past experiences has been discovered [41]. To address the issue of catastrophic forgetting, a straightforward approach is to protect the crucial parameters associated with the first task while training the second task. This concept has inspired the development of an effective method in both classical and quantum classifiers to mitigate catastrophic forgetting, known as the elastic weight consolidation (EWC) method [42]. Consider two independent classification tasks, denoted as $A$ and $B$. The training process can be viewed as maximizing the likelihood function $P(\theta|X)$, where $\theta$ represents the parameter being trained. By employing simple Bayes rules [43], a transformation can be applied as follows:

where the first element corresponds to the loss function $L_{B}(\theta)$ associated with task B, while the third element remains constant with respect to $\theta$. Consequently, the problem can be reformulated as an optimization problem involving only the first two elements. From a technical standpoint, calculating the posterior probability $\log P(\theta|X_{A})$ directly can be challenging. To simplify the calculation, the prior probability can be simplified by Gaussian distribution, as suggested in previous studies in Ref. [44]. In addition, we utilize a second-order Taylor expansion, as described by Pourahmadi Ref. [45], centered around the optimal parameter $\theta_{A}$ obtained from the previously trained task $A$. This expansion allows us to approximate the loss function of the current task using the Hessian matrix $H_{\theta_{A}}$ and neglect higher-order terms, as proposed in [31]:

By incorporating the Hessian matrix, we can effectively capture the curvature of the loss landscape and make more precise adjustments to the model’s parameters during the continual learning process. This approach helps mitigate the interference caused by the introduction of new tasks, allowing for smoother transitions and improved preservation of previously learned knowledge. This approximation allows us to simplify the calculations and make the optimization process more manageable in practice.

The Hessian matrix [46, 47] is a square matrix composed of second-order derivatives of a scalar-valued function. It provides valuable information about the local curvature of the function when it has multiple variables. Furthermore, it is important to highlight that the expectation value of the Hessian matrix is equivalent to the Fisher information matrix, as elucidated in the tutorial by Ly et al. [48]. The Fisher information matrix plays a fundamental role in statistical learning and is widely employed in various statistical estimation and inference tasks [48, 49, 50]. Recently, these methods have been extended to the quantum domain [51, 52]. Here we introduce the Fisher information matrix to this approximation for three major reasons mentioned in [42]. Firstly, it provides insights into the second derivative of the loss function around a minimum point, offering information about the local curvature. Secondly, it can be computed solely from first-order derivatives, making it computationally feasible for large models. Additionally, the Hessian matrix is guaranteed to be positive and semi-definite. Leveraging these characteristics, we can express the loss function of task $B$ by incorporating a diagonal precision matrix, which is constructed using the diagonal elements $F_{i}$ of the Fisher information matrix $F$. To control the impact of the EWC constraint, we introduce the hyper-parameter $\lambda$ to represent its strength:

The primary objective of quantum continual learning is to achieve satisfactory performance on task $B$ while preserving relatively high performance on the original task $A$. To accomplish this goal, the EWC method introduces regularization to the original loss function $L(B)$ to penalize deviations from the optimal solution obtained for task $A$, taking into account the varying importance of different parameters. Specifically, the importance of the quantum classifier parameters is assessed using the Fisher information matrix. The diagonal elements of this matrix serve as weights for the penalty term. Intuitively, each Fisher information matrix corresponds to a Hessian matrix, with the diagonal elements representing the local curvature landscape along different variables and directions. These curvature landscapes are closely connected to the concept of gradients: larger curvatures indicate greater significance, suggesting that even slight shifts in a small range can result in significant differences in the value of the loss function.

In other words, parameters with larger curvatures should be less susceptible to modifications during the continual learning process. By incorporating the penalty based on the Fisher information matrix, the EWC method effectively protects these important parameters from catastrophic forgetting, allowing the model to retain valuable knowledge from task $A$ while adapting to new tasks. This explanation provides a high-level overview of the concepts behind quantum continual learning and how the EWC method mitigates the issue of catastrophic forgetting.

Based on the theoretical analysis of continual learning, the classification tasks of the two classifiers must be independently distributed. To demonstrate the effectiveness of our approach, we have selected two distinct datasets: MNIST handwritten digits and MedNIST medical images.

The MNIST dataset, introduced by LeCun et al. [53], consists of grayscale images of handwritten digits ranging from $0$ to $9$. On the other hand, the MedNIST dataset [54, 55] contains medical images of different body parts, such as the hand and breast. These two datasets are chosen due to their minimal correlations, making them suitable for approximating independent distributions. To ensure fairness in our experiments, we assume that the collected dataset samples from both MNIST and MedNIST are of the same size. We specifically select images of digits $1$ and $9$ from the MNIST dataset and corresponding images of the hand and breast from the MedNIST dataset. This enables us to create a binary classification task for our quantum classifier.

Before feeding the images into a quantum circuit, we preprocess them by rescaling their size from $28\times 28$ to $64\times 64$. This ensures that we make full use of the available 12 active qubits and enables the images to be represented as logical wave functions, which can be input into the quantum circuit. Additionally, we normalize the images to ensure consistent and effective processing. Furthermore, to facilitate the calculation of cross-entropy loss, we convert the labels into a one-hot encoding format. In total, we create a dataset sample consisting of 1000 training samples and $200$ testing samples for constructing our classifier. By utilizing these datasets and following the aforementioned preprocessing steps, we can proceed with training and evaluating the performance of our quantum classifier on the binary classification task involving MNIST and MedNIST images.

To construct our quantum classifier, we utilize the Yao framework [56], which provides a platform for building quantum circuits. Our classifier consists of both parameterized layers and entangled layers. The parameterized layers in our quantum classifier are composed of the Rz-Rx-Rz circuit applied to each active qubit in the circuit. This circuit structure allows us to introduce rotations along the X-axis and Z-axis of the quantum state’s Bloch sphere. These rotations play a crucial role in manipulating the quantum state and extracting relevant information for classification. On the other hand, the entangled layers in our classifier involve the application of CNOT gates. These gates create entanglement between every qubit in the circuit, enabling the qubits to share and distribute quantum information across the system. This entanglement is instrumental in capturing complex relationships and correlations among the qubits, enhancing the expressive power of our quantum classifier [57]. For our specific implementation, we choose a quantum classifier with a depth of $20$, utilizing $12$ qubits. Each depth corresponds to one parameterized layer followed by one entangled layer. By increasing the depth, we enable the classifier to capture more intricate patterns and dependencies within the input data. The chosen structure, proven to be robust and efficient in quantum machine learning, ensures that our quantum classifier is capable of effectively handling the classification tasks at hand.

The training process of our quantum classifier involves several steps, starting with training on the MNIST dataset and then applying the continual learning method to train on the MedNIST dataset. Throughout the process, we perform measurements on the last qubit of the quantum circuit, specifically qubit number $12$, using single qubit state operators in the form of one-hot diagonal elements. Each operator represents a specific class in the classification task. During the training for a single classification task, we follow a specific set of operations. Firstly, we initialize the parameters of the quantum circuit with random values. Secondly, we record the data from both the MNIST and MedNIST databases as classical complex matrices in “.mat” files. Before applying the data to the quantum circuit in the Yao platform, we convert it into the form of a quantum state. Thirdly, for each iteration, the circuit calculates the current loss, accuracy, and fidelity value, and computes the gradients using the auto-differentiation functionality. Fourthly, the gradients are applied to update all parameters of the quantum circuit using the Adam optimizer, implemented in Flux.jl. Finally, when the predefined number of iterations is reached, the learning process concludes, returning the trained circuit parameters along with historical accuracy, loss, and fidelity.

In the first learning process on the MNIST dataset, we employ the “Flux.Adam” optimizer [58, 59] with a learning rate of $0.005$. The training is performed with a batch size of 100 and for a total of 30 epochs. As a result, we obtain a model with an accuracy of 97.6% on the MNIST dataset.

In the subsequent classification task on the MedNIST dataset, we employ the EWC method to mitigate catastrophic forgetting. To implement this method, we first need to calculate the Fisher information matrix before the training process. The calculation of the Fisher information matrix can be performed through the following steps:

1. 1.

   Initialize the Fisher matrix as a square matrix of zeros with a size equal to the length of the circuit parameters.

2. 2.

   For each input sample in the batch, compute the expectation value, denoted as expect, and the gradient, denoted as grad. Then calculate the gradient for the Fisher matrix as $\texttt{grad\_fisher}=\texttt{grad}/\texttt{expect}$.

3. 3.

   Add the value $\texttt{grad\_fisher}\times\texttt{grad\_fisher}^{\text{T}}$ to the Fisher matrix.

4. 4.

   Finally, take the mean value of the Fisher matrix over the batch size to obtain the resulting Fisher information matrix.

The training process for the MedNIST classification task follows a similar approach to the training on the MNIST dataset. However, there are a few differences. Firstly, the initial circuit parameters should be set as the circuit parameters obtained from the previously trained task. Secondly, during training, an additional term called the EWC punishment term, denoted as EWCpunish, is introduced. This term incorporates the EWC strength hyperparameter, $\lambda$, the diagonal elements of the Fisher information matrix, fim, the current parameters of the continual training circuit, params, and the previously trained circuit parameters, pre_params. The expression for EWCpunish is as follows:

In the second learning process, we keep the same learning rate and reduce the training epochs to $20$ to prevent overfitting. During this process, we also apply the EWC method, which introduces an additional parameter, $\lambda$, to achieve the desired effect of continual learning. The choice of the optimal $\lambda$ value is heavily influenced by the characteristics of the dataset and the classifier. In our experiment, we set $\lambda$ to $750$, which resulted in an average accuracy of $93.3\%$ for both classifications. Specifically, the accuracy for the first classification task is $94.5\%$, while the accuracy for the second classification task is $92.0\%$. Despite a slight decrease in the performance of the merged classifier on the first task, both classification accuracies remain at an acceptable level of around $90\%$. The training process is presented in Fig. 1.

During the perturbation process, we employ the “quantum basic iteration method (qBIM)” to generate adversarial examples and evaluate the effectiveness of the attack at different perturbation strengths. The qBIM method is a variation of the well-known Fast Gradient Sign Method (FGSM). Unlike FGSM, which generates adversarial examples in a single step, qBIM iteratively applies FGSM with a small step size. This iterative approach allows for adjustments in the perturbation direction during adversarial machine learning, resulting in more robustly generated samples. Let $\epsilon$ denote the step size, $x_{k}$ represent an arbitrary sample from the collective dataset ${X_{A},X_{B}}$, $\pi_{C}$ denote the projection operator that normalizes the wave function, and $L$ denote the loss function. At each iteration step $k+1$, the qBIM algorithm can be described as follows:

To provide a more detailed explanation, here is a pseudo-code representation of the quantum-adapted basic iterative method (qBIM) for finding effective universal perturbation, as presented in Algorithm 1:

We conducted a perturbation experiment on the concatenated dataset of the two trained tasks using $30$ iterations and a total perturbation strength of $0.02$. In each iteration, we calculated the gradient information of the initial unperturbed $1024$ circuit input pixels to determine the perturbation direction. Specifically, we computed the mean value of the pixel-wise gradient for all $400$ samples ($200$ samples for each classification task) to indicate the direction of gradient ascent, which served as the perturbation direction. The perturbation itself was obtained by multiplying the perturbation-per-step value with the sign of the gradient value. During each attacking step, we first apply the calculated perturbation to every single sample from two classification tasks to generate universal adversarial examples. Then, we clip the pixel value of universal adversarial examples within the range of $[0,1)$ to avoid meaningless values. Furthermore, we normalize the adversarial example after clipping to ensure that the generated adversarial example is in a legal quantum state.

During the perturbation process, the average accuracy of the two datasets decreased from $93.3\%$ to $28.5\%$ with fidelity of $0.79$. Here we present a curve illustration in Fig. 2. Specifically, the accuracy of the individual tasks dropped from $94.5\%$ and $92.0\%$ to $24.5\%$ (fidelity = $0.84$) and $32.5\%$ (fidelity =$0.76$), respectively. This significant reduction in accuracy demonstrates that the universal perturbation generated by the mean value of the gradient for all dataset samples is capable of deceiving the classifier on both classification tasks almost completely. Additionally, it is worth noting that the accuracy and fidelity of the tasks do not change synchronously. The accuracy of the previously trained task experiences a rapid decline at the beginning of the perturbation process and then stabilizes at a higher fidelity. On the other hand, the later-trained task remains less sensitive to perturbation, maintaining a higher accuracy and lower fidelity compared to the previously trained task. This observation suggests that the previously trained task is more vulnerable, as the classifier’s performance deteriorates significantly even with a smaller amount of perturbation.

Here, we plot some examples of universal adversarial samples after calculation in Fig. 3. For samples in MNIST handwritten digits, the distribution of non-zero value pixels is rather concentrated to the track of digit, thus the probability distribution after perturbing is almost unchanged except for the blurring at margin areas. However, the samples in the MedNIST dataset tend to distribute more evenly, resulting in a shallow color due to normalization steps. All of the adversarial samples listed above are wrongly classified into the other class by the quantum classifier with fidelity of around $51\%$ to $52\%$ which is just enough to deceive the classifier. We retain such a level of deceiving fidelity to minimize the perturbation and try to keep the fidelity value as high as possible.

The QCNN classifier is a powerful classification model in the realm of quantum classifiers. According to the numerical experiment presented in Ref.[11], the QCNN classifier is applied to $28\times 28$ MNIST classification task. The QCNN classifier gets a similar performance to the classical CNN classifier and outperforms the fully connected classifier. This provides sufficient evidence that the QCNN classifier structure mentioned in Ref.[11] is a promising tool for classification tasks.

In our experiment, we follow Ref.[11] and construct a QCNN classifier with a similar structure on $12$ qubits. Specifically, our QCNN classifier contains $2$ convolutional layers, $2$ pooling layers, and $20$ fully connected layers. The convolutional layers find hidden states by applying rotational gates and controlled gates on adjacent qubits. The pooling layers use controlled rotational gates to reduce the qubits firstly from $12$ to $6$, then from $6$ to $3$. At last, the fully connected layers are applied with a depth of $20$ on the $3$ remaining qubits. During the decoding process, a measurement gate is applied to the last qubit of the circuit.

In the first training process, we set the learning rate to $0.005$ with $30$ training epochs. The dataset used for training is MNIST handwritten digits, the same as the previously mentioned experiment. A small fluctuation can be observed around epoch $10$, but the QCNN classifier reached a state-of-the-art accuracy above $95\%$ around epoch $15$. As mentioned in plenty of previous works, the QCNN classifier performs very well on a single classification task. Given the same datasets, hyper-parameter settings, and computing resources, the QCNN classifier trains much more quickly than the fully connected quantum classifier. Also, the QCNN classifier gets a lower loss than the fully connected quantum classifier after training, which leads to higher confidence in binary classification.

In the second training process, we keep the learning rate fixed at $0.005$, while changing the training steps to only $10$ training epochs to avoid over-fitting. Also, we raise the additional parameter $\lambda$ in the EWC method to $2000$ to protect the previously trained task. The training dataset is still the MedNIST hand and breast MRI images. After training, the QCNN classifier reaches an average accuracy of $91\%$ on both training tasks, which is $92.1\%$on the first classification task and $89.7\%$ on the second classification task. The training curve of both training processes of the QCNN classifier is presented in Fig.4.

Here, we want to point out the potential threat of the QCNN classifier when applying it to continuous learning scenarios. Unlike fully connected quantum classifiers, the QCNN classifier contains a relatively small number of parameters. Intuitively, fewer training parameters lead to lower generalization capability of the given classifier. This intuition is perfectly verified in our experiment as we find out that the QCNN classifier can perform well on one training task but cannot maintain similar performance on multiple training tasks. Specifically, continuous drastic fluctuations can be observed in the training curves. We attempt to solve this issue by increasing the depth of the fully connected layer. Such an approach indeed alleviates the problem of insufficient training parameters but still requires careful adjustment of hyper-parameters.

During the attacking process, we take similar hyper-parameter settings to the previous experiment, namely $0.02$ total perturbation strength, and $30$ perturbing iterations. The average accuracy of the two datasets decreased from $91\%$ to $34\%$ with fidelity of $81.5\%$. The accuracy of individual tasks dropped from 92.1% and $89.7\%$ to $31.5\%$ (fidelity=$0.85$) and $36.5\%$ (fidelity=$0.78$). The attack process is drawn as a curve in Fig.5. Such an attacking process of the QCNN classifier is consistent with the situation of the fully connected quantum classifier. This result indicates that the vulnerability of the QCNN and the fully connected quantum classifier is similar.

The quantum classifiers are specially gifted to process quantum data. According to the evidence provided in Ref.[21, 12], quantum data can be efficiently learned by quantum classifiers and attacked by adversarial machine learning algorithms.

In our experiment, we choose a 12-qubit symmetry-protected topological (SPT) state dataset similar to Ref.[12] to verify the effectiveness of universal perturbation. Specifically, in the dataset containing SPT (Symmetry Protected Topological) states, we examine a one-dimensional cluster-Ising model featuring periodic boundary conditions. Suppose $\hat{\sigma}_{x}^{i}$, $\hat{\sigma}_{y}^{i}$, $\hat{\sigma}_{z}^{i}$ are Pauli matrices and $\lambda$ represents the relative strength of adjacent neighbour interaction. The Hamiltonian of this model can be put as the equation below:[12]

The model experiences a persistent quantum phase shift at $\lambda=1$, effectively distinguishing between two distinct phases. For $\lambda$ values less than $1$, it enters a cluster phase characterized by nonlocal hidden order. In contrast, for $\lambda$ values greater than $1$, it transitions into an antiferromagnetic phase with well-defined long-range order and a significant staggered magnetization. To comprehensively explore this transition, we systematically sweep $\lambda$ across the range from $0$ to $2$, utilizing intervals of $0.001$. We collect the resulting ground states at each interval, establishing them as our dataset for both training and testing purposes. We introduce the quantum data SPT in the second training process.

In the first training process, we keep the learning rate at $0.005$ and train for $30$ epochs on the MNIST handwritten dataset. The training is conducted on a fully connected quantum classifier on $12$ qubits with a depth of $20$. The training process generates state-of-the-art accuracy above $95\%$ on the MNIST handwritten dataset.

In the second training process, we keep the learning rate at $0.005$ but lower the training epochs to $20$. The additional parameter $\lambda$ in the EWC method is adjusted to $500$. The training dataset is the previously generated SPT dataset. After training, the fully connected quantum classifier reaches an average accuracy of $98\%$ on both training tasks, which is $98.6\%$ on the first classification task and $97.5\%$ on the second training task. The training curve of both training processes is presented in Fig.6.

During the attacking process, we lower the total perturbation strength to $0.015$ and the perturbing iteration to $15$. The average accuracy of the two datasets decreased from $98\%$ to $20.3\%$ with fidelity of $0.63$. The accuracy of individual tasks dropped from $98.6\%$ and $97.5\%$ to $4\%$ and $36.5\%$. The attack process is drawn as a curve in Fig.7. After introducing quantum data, the continuous model becomes more fragile than the cases before introducing quantum data. It can be observed in Fig.7 that the second classification task on the SPT quantum dataset encounters a sharp decrease in the first attacking iterations.