@ericyocam6Shipped: Hybrid Quantum Neural Networks — Adversarial AI Defense
An open-source adversarial AI security proof of concept investigating how hybrid classical-quantum neural networks can be trained to withstand adversarial attacks on image classification systems.
The project combines a Convolutional Neural Network (CNN) with a simulated Quantum Neural Network (QNN) implemented using Google's Cirq framework. Classical neural network features are integrated with quantum rotation and entanglement operations to construct a hybrid model for handwritten digit recognition.
The framework evaluates compounded white-box adversarial attacks, including FGSM, Projected Gradient Descent (PGD), Carlini-Wagner (CW), Basic Iterative Method (BIM), and DeepFool combinations. It then applies adversarial training to improve classification performance under these attack conditions.
In reported MNIST experiments, undefended classification accuracy dropped from 98% to 20% under combined FGSM and PGD attacks, while the adversarially trained model achieved 98% accuracy in the tested defense scenario. Similar improvements were reported for FGSM + CW and CW + PGD combinations.
Built with Python, PyTorch, TorchAttacks, and Cirq, the project provides executable experiments, model evaluations, quantum circuit implementations, and adversarial training results.
Designed for AI security researchers, quantum machine learning developers, and educators exploring hybrid architectures and adversarial robustness. The findings are experimental and do not establish a general quantum advantage or universal robustness against adaptive attacks.
Comments2
I'd put the jump from 20% back to 98% in the title and mention the quantum part second. A security team that sees "quantum" first may file this as a lab experiment and miss that the defense itself is the part they could use.
Great suggestion, Ryan! I agree that leading with the improvement from 20% to 98% under the tested adversarial conditions makes the practical significance much clearer. The quantum component is an interesting part of the research, but the primary objective is improving AI robustness against adversarial attacks.
One important distinction is that the improvement came from adversarial training within the hybrid architecture, and the experiments don't establish that the quantum component independently contributed to that improvement. That's something I'd want to investigate further through comparisons with classical-only models.
I appreciate the business perspective. Ultimately, security teams care about measurable improvements in robustness, not necessarily the underlying technology used to achieve them!
2 comments
I'd put the jump from 20% back to 98% in the title and mention the quantum part second. A security team that sees "quantum" first may file this as a lab experiment and miss that the defense itself is the part they could use.
Great suggestion, Ryan! I agree that leading with the improvement from 20% to 98% under the tested adversarial conditions makes the practical significance much clearer. The quantum component is an interesting part of the research, but the primary objective is improving AI robustness against adversarial attacks.
One important distinction is that the improvement came from adversarial training within the hybrid architecture, and the experiments don't establish that the quantum component independently contributed to that improvement. That's something I'd want to investigate further through comparisons with classical-only models.
I appreciate the business perspective. Ultimately, security teams care about measurable improvements in robustness, not necessarily the underlying technology used to achieve them!