When Cheap Gradients Fail: The Measurement Cost of Attacking Quantum Classifiers

The paper shows that shot noise in quantum measurement statistics can serve as a built-in defense for variational quantum classifiers, making the cost of gradient-based test-time attacks grow unfavorably with input dimension. A white-box attacker must infer each gradient component by repeatedly executing the quantum circuit; the number of measurements required for a single-step attack is at least on the order of the square in the input dimension d, and grows as d^{5/2} under norm-concentrated scaling. Simulations up to 784 dimensions verified this scaling; the total budget of models with barren plateau mitigation matches the d^{5/2} geometric lower bound, and the tested deep circuits grow as d^{3.00}; compared with the classical automatic differentiation baseline whose attack cost does not vary with dimension, the ratio of quantum to classical gradient cost empirically grows as d^{3.00}, and the attacker's relative cost diverges with model size. Experiments on the 156-qubit IBM processor ibm_boston (4-qubit circuit, d=12) reproduced this effect, with the device attack differing from the ideal result by within a few percent under a matched budget.