A preprint posted to arXiv (not yet peer-reviewed) introduces a measurement-only framework for auditing the adversarial robustness of quantum classifiers without access to circuit parameters, internal evolution, or gradients. Working under what the authors call known-readout query access (KRQA)—where an evaluator knows the measurement operator and observes sampled outcomes but nothing more—the method produces two complementary certificates per input: a lower bound guaranteeing no untargeted misclassification within a specified radius, and an upper bound constructing a witness adversarial state within a (potentially larger) radius.
The lower bound is computed by relaxing a state-space search into an optimization over outcome distributions subject to operator-spectrum constraints. The authors claim this is never weaker than prior certificates that use probability statistics alone, and can be strictly stronger when spectral constraints are binding. The upper bound exploits gap operators derived from the known quantum measurement, and is designed to remain informative in regimes where conventional gradient-based attacks fail. Neither certificate requires quantum state tomography or knowledge of the classifier's internal architecture.
The authors evaluate the framework on several quantum classifiers and report real-device experiments on IBM Quantum hardware: from 40 executions each of two 8-qubit quantum neural networks, both certificates were computed, with the expected ordering (lower bound ≤ upper bound) holding on every tested input. If the approach survives peer review, it would offer a practical path toward independently auditing robustness claims for quantum classifiers purely from observable statistics—an important property given that deployed quantum models are unlikely to expose their internal representations to external evaluators.