Quantum adversarial attack method based on momentum

Abstract

The invention discloses a quantum adversarial attack method based on momentum, which refers to an object momentum mechanism, and designs a quantum adversarial attack method to efficiently generate adversarial samples. In order to solve the problem that an existing quantum countermeasure attack method excessively fits a specific model to cause a poor local optimal solution, the invention provides a novel quantum countermeasure attack method based on momentum (Q-MIFGSM). According to the method, a loss function of a quantum neural network classifier and momentum accumulation gradient information of a sample are defined, a momentum iteration updating mode is adopted, momentum accumulation is carried out on a loss function gradient value, the optimization direction is dynamically adjusted in combination with current and historical gradients, and a local optimal solution is effectively jumped out; the loss function value of the quantum classifier is increased to cause classification errors of the classifier, so that attack resistance is realized, and an adversarial sample is efficiently generated. Simulation experiment results show that the Q-MIFGSM algorithm can effectively execute adversarial attacks on the quantum neural network classifier and generate adversarial samples close to original data. A new strategy is provided for quantum attack resistance, and the method has potential application value in the aspects of quantum neural network security evaluation and defense strategies.

Description

Technical Field

[0001] The present invention relates to the fields of quantum computing, artificial intelligence and information security, and in particular to a momentum-based quantum counterattack method. Background Art

[0002] Quantum computing can show unique advantages in dealing with large-scale data problems by utilizing phenomena such as quantum superposition, quantum entanglement, and quantum coherence. At present, we are in the so-called Noisy Intermediate Scale Quantum (NISQ) period, which means that the existing quantum devices have a limited number of bits and are accompanied by noise, and can only operate effectively within a limited coherence time. In this technical context, it is particularly important to explore the potential applications of quantum computing, especially in the field of machine learning. Quantum computing is considered to have great development potential and can effectively alleviate the complexity of traditional computing and reduce the growing computing cost of classical neural networks.

[0003] Quantum neural network is a technology that combines the principles of quantum computing and traditional neural networks. It uses quantum states to represent and process information, and enhances information processing capabilities through the superposition and entanglement of quantum states. This network design aims to use the parallelism and high efficiency of quantum computing to process complex pattern recognition tasks, such as image and speech recognition, natural language processing, etc. Quantum neural networks are still in the exploratory stage, but their theoretical processing speed and capabilities indicate great potential in data-intensive and computing-intensive fields.

[0004] Quantum adversarial attacks are a type of attack on quantum neural networks that exploit the network's high sensitivity to tiny perturbations when processing high-dimensional data. Studies have found that even carefully designed, extremely subtle noise can cause such networks to misclassify, showing their inherent fragility. As the size of quantum systems increases, the network's sensitivity to noise is further enhanced, increasing the likelihood of misclassification. This attack exploits the fragility of quantum neural networks and deliberately introduces perturbations that disrupt the normal functioning of the classifier. This leads to incorrect classification results. This attack, known as an adversarial attack, is designed to reveal and exploit the limitations of quantum neural networks, further demonstrating that their security and robustness in practical applications face major challenges. Summary of the invention

[0005] The purpose of this invention is to provide a momentum-based quantum adversarial attack method (Quantum Momentum Iterative Fast Gradient Sign Method, Q-MIFGSM), which attacks quantum neural networks based on a trained quantum classifier and demonstrates its feasibility and effectiveness through simulation experiments.

[0006] The technical solution for achieving the purpose of the present invention is:

[0007] A momentum-based quantum countermeasure attack method comprises the following steps:

[0008] (1) Data preprocessing: Select different types of samples from different data sets, divide the training set and test set into corresponding proportions according to different classifications, and normalize the selected training set and test set.

[0009] (2) Construction of quantum neural network model: In the process of constructing the quantum neural network model, the image data in the training set is first encoded and converted into quantum states. This step is to convert classical data into quantum states through quantum coding methods. Then, these quantum states are sent to a parameterized quantum circuit for unitary transformation. After the transformation is completed, the resulting quantum state is measured by a specific measurement operator. The output of this measurement is associated with the label of the sample through a loss function, which is processed by a classical computer to iteratively adjust the parameters of the quantum circuit in order to minimize the loss function. When the value of the loss function drops to a low level and remains stable, this indicates that the training process of the quantum neural network model has converged. At this point, the optimization of the model parameters has reached an equilibrium point, indicating that the construction of the quantum neural network model has been completed.

[0010] (3) Momentum-based quantum adversarial attack (Q-MIFGSM) adversarial sample generation: introduce a small perturbation to the input sample to increase the value of the model's loss function, resulting in incorrect classification of the trained model. In order to calculate the perturbation, the original image data needs to be encoded and placed in the trained quantum neural network to calculate the gradient of the loss function. and momentum gradient accumulation information g t+1 . Momentum accumulation is achieved through the following formula:

[0011]

[0012] in and g t are the t-th quantum state data and the t-th momentum gradient accumulation information, L is the loss function, θ is the parameter of the quantum neural network, y is the label of the data, and μ is the momentum hyperparameter, which controls the impact of historical gradients on the current accumulation. In this momentum mechanism, the historical gradient information is saved to form an impact on the current optimization process, so that the perturbation can reflect the previous gradient changes in each iteration. Next, use the momentum gradient accumulation information as the iterative perturbation value and add the perturbation to the quantum state data:

[0013]

[0014] in is the quantum state data of the tth and t+1th time, and α is a hyperparameter. The added perturbation changes the quantum state data, thereby generating more effective adversarial samples. The momentum mechanism not only enhances the effect of the perturbation, but also helps the algorithm to better escape from the local optimal solution, and further improves the effectiveness of the adversarial attack by utilizing the accumulated information.

[0015] The different data sets described in step (1) are Mnist and FashionMnist data sets, and image data of the number 1, the number 9, and image data representing clothes and shoes are selected from these two data sets for training.

[0016] The encoding method described in step (2) is amplitude encoding, which can convert classical image data into quantum state more quickly.

[0017] The quantum neural network used in step (2) is a typical variational quantum algorithm based on a variational quantum circuit (VQC). The variational quantum circuit is a special quantum circuit with an adjustable structure to adapt to different problems and data sets. The design of VQC usually includes three main steps: data encoding, parameterized unitary transformation, and measurement.

[0018] The advantages of the present invention are that the superposition and parallelism of quantum states are used to make quantum computing have powerful computing power, and the technology of accelerating the gradient descent algorithm using the momentum method is used to significantly speed up the convergence speed in the optimization process by accumulating the gradient direction vectors in the previous iterations. This method makes full use of historical gradient information to help the algorithm quickly cross narrow valleys and small humps, thereby escaping from local suboptimal solutions and increasing the effect of countering attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 This is a flow chart of the momentum-based quantum countermeasure attack method;

[0021] Figure 2 It is the flow chart of quantum neural network;

[0022] Figure 3 This is a schematic diagram of a quantum neural network;

[0023] Figure 4This is a flow chart of the momentum-based quantum countermeasure attack method;

[0024] Figure 5 is the quantum fidelity diagram of Q-MIFGSM;

[0025] Figure 6 is the quantum fidelity diagram of number 1; DETAILED DESCRIPTION

[0026] The contents of the present invention are further described below in conjunction with the drawings and embodiments, but are not intended to limit the present invention.

[0027] Example:

[0028] Reference Figure 1 , a momentum-based quantum counterattack method, including data preprocessing, quantum neural network model construction, and momentum-based quantum counterattack (Q-MIFGSM) counterattack sample generation. The specific implementation steps are as follows:

[0029] (1) Data preprocessing

[0030] In the FashionMnist dataset, 500 images of clothing and shoes are selected, and the images are compressed to reduce the dimension of the images and normalized to facilitate subsequent operations. The training set and test set are divided into 80% and 20% respectively, so that the model can fit better; 500 samples of the number 1 and number 9 are selected in the Mnist dataset and divided according to the above method.

[0031] (2) Construction of quantum neural network model

[0032] Assume that the data set is Z = {(x (i) ,y (i)}, sample x (i) is an N-dimensional vector x (i) ∈R N , the corresponding label y (i) is an m-dimensional vector y (i) ∈R m . Reference Figure 2 and Figure 3 Data encoding is to map classical data into quantum states. Common methods include amplitude encoding and block encoding. Amplitude encoding is particularly common. It can convert N-dimensional classical data x (i) Encoded as The quantum state of a qubit.

[0033]

[0034] After data encoding is performed, the encoded quantum state |x (i)>will be unitarily transformed by the parameter-containing quantum circuit.

[0035] |ψ (i) (θ)>=U(θ)|x (i) >

[0036] After completing the evolution of the quantum state, a set of m-complete POVM measurement operators is used Perform quantum measurement on the quantum state. Use the measurement operator ∏ j The measurement results obtained That is the data x (i) The probability of being classified into the jth class.

[0037]

[0038] Get the input data x (i) The classification prediction value u (i) After that, the loss function L(θ) can be calculated based on its corresponding sample label:

[0039]

[0040] Where M represents the number of samples. After obtaining the loss function L(θ) of the problem, we can obtain the gradient information about the parameter θ in the variational quantum circuit: Combined with the optimizer in the classical computer, the circuit parameter θ is updated. When the loss function value reaches the minimum, it means that θ in the current quantum circuit is the optimal circuit parameter θ′. At this time, the parameter-containing quantum circuit U(θ′) is considered to be a trained quantum neural network.

[0041] (3) Momentum-based quantum adversarial attack (Q-MIFGSM) adversarial sample generation

[0042] Introducing a small perturbation to the input sample increases the value of the model's loss function, causing the trained model to misclassify. In order to calculate the perturbation, the original image data needs to be encoded and put into the trained quantum neural network to calculate the gradient of the loss function. and momentum gradient accumulation information g t+1 . Momentum accumulation is achieved through the following formula:

[0043]

[0044] in and g tare the t-th quantum state data and the t-th momentum gradient accumulation information, L is the loss function, θ is the parameter of the quantum neural network, y is the label of the data, and μ is the momentum hyperparameter, which controls the impact of historical gradients on the current accumulation. In this way, the historical gradient information is preserved and has an impact on the current optimization process, so that the perturbation can reflect the previous gradient changes in each iteration. Next, use the momentum gradient accumulation information as the iterative perturbation value and add the perturbation to the quantum state data:

[0045]

[0046] in is the quantum state data of the tth and t+1th time, and α is a hyperparameter. The added perturbation changes the quantum state data, thereby generating a more effective adversarial sample. Figure 5 The momentum mechanism not only enhances the effect of perturbations, but also helps the algorithm to better escape from local optimal solutions, and further improves the effectiveness of adversarial attacks by utilizing accumulated information.

[0047] In order to evaluate the performance of the designed Q-MIFGSM algorithm, the average quantum fidelity of the adversarial samples is calculated to evaluate the size of the disturbance generated by the algorithm. The quantum fidelity f is the quantum state of the original data |x (i) >The quantum state of its adversarial sample The inner product squared.

[0048]

[0049] The higher the fidelity, the smaller the generated disturbance, which means the better the effect of the adversarial attack. The Q-MIFGSM algorithm is used to generate attack samples, and the fidelity calculation results of the adversarial sample of the number 1 and the original sample are referenced. Figure 6 .

[0050] In order to demonstrate the performance of this algorithm, the numbers 1, 9, shoes, and clothes in the dataset were attacked at the same time, and their average quantum fidelity was calculated. The results were 98.26%, 98.24%, 97.63%, and 97.52%, respectively.

Claims

1. A momentum-based quantum countermeasure attack method, comprising the following steps; (1) Data preprocessing: Select different types of samples from different data sets, divide them into training sets and test sets according to corresponding proportions, and normalize the selected training sets and test sets. (2) Construction of quantum neural network model: In the process of constructing the quantum neural network model, the image data in the training set is first encoded and converted into quantum states. This step is to convert classical data into quantum states through quantum coding methods. Then, these quantum states are sent to a parameterized quantum circuit for unitary transformation. After the transformation is completed, the resulting quantum state is measured by a specific measurement operator. The output of this measurement is associated with the label of the sample through a loss function, which is processed by a classical computer to iteratively adjust the parameters of the quantum circuit in order to minimize the loss function. When the value of the loss function drops to a low level and remains stable, this indicates that the training process of the quantum neural network model has converged. At this point, the optimization of the model parameters has reached an equilibrium point, indicating that the construction of the quantum neural network model has been completed. (3) Momentum-based quantum adversarial attack (Q-MIFGSM) adversarial sample generation: introduce a small perturbation into the input sample to increase the value of the model's loss function, resulting in incorrect classification of the trained model. In order to calculate the perturbation, the original image data needs to be encoded and placed in the trained quantum neural network to calculate the gradient of the loss function. and momentum gradient accumulation information g t+1 . Momentum accumulation is achieved through the following formula: in and g t are the t-th quantum state data and the t-th momentum gradient accumulation information, L is the loss function, θ is the parameter of the quantum neural network, y is the label of the data, and μ is the momentum hyperparameter, which controls the impact of historical gradients on the current accumulation. In this momentum mechanism, the historical gradient information is saved to form an impact on the current optimization process, so that the perturbation can reflect the previous gradient changes in each iteration. Next, use the momentum gradient accumulation information as the iterative perturbation value and add the perturbation to the quantum state data: in is the quantum state data of the tth and t+1th time, and α is a hyperparameter. The added perturbation changes the quantum state data, thereby generating more effective adversarial samples. The momentum mechanism not only enhances the effect of the perturbation, but also helps the algorithm to better escape from the local optimal solution, and further improves the effectiveness of the adversarial attack by utilizing the accumulated information.

2. The momentum-based quantum counterattack method according to claim 1 is characterized in that: The different data sets described in step (1) are FashionMnist and Mnist data sets, and image data of the number 1, the number 9, and image data representing clothes and shoes are selected from these two data sets for training.

3. The momentum-based quantum counterattack method according to claim 1 is characterized in that: The encoding method described in step (2) is amplitude encoding, which can completely convert classical image data into quantum state.

4. The momentum-based quantum counterattack method according to claim 1 is characterized in that: The quantum neural network used in step (2) is a typical variational quantum algorithm based on a variational quantum circuit (VQC). The variational quantum circuit is a special quantum circuit with adjustable structure to adapt to different problems and data sets. The design of VQC usually includes three main steps: data encoding, parameterized unitary transformation, and measurement.

Images