Equivariant Quantum Models Expose Transfer Vulnerabilities

The paper presents a feature-level analysis of group-equivariant quantum models and their adversarial transfer behavior, specializing to a rotationally equivariant quantum model. The authors show that with an invariant readout predictions depend only on the group-twirled input, which exposes the model's accessible symmetry-invariant information and a complementary uninformative subspace. They demonstrate that equivariance does not automatically confer transfer robustness, and propose a symmetry-sector suppression technique that improves robustness.

The analysis formalizes how the group-twirled input projects data onto rotation-invariant subspaces, decomposing accessible information across distinct symmetry sectors. The paper characterizes the accessible invariants as rotation-invariant image statistics distributed across these sectors. Using targeted input transformations and transfer-attack experiments, the authors identify which statistics are actually used for classification across datasets. Key technical takeaways include:

• •Explicit decomposition of invariant features into symmetry sectors, linking features to irreducible representations.
• •Identification of ring-averaged intensities as a brittle rotation-invariant statistic that the model frequently leverages.
• •A practical mitigation: suppressing the symmetry sector associated with the brittle statistic reduces attack transferability and improves robustness.

Equivariance is widely used to improve trainability and inductive bias in both classical and quantum models, but little prior work has connected symmetry constraints to adversarial risk in QML. This paper closes that gap by showing that symmetry reduces the data manifold to invariant channels, yet brittleness can persist because models may concentrate on fragile, low-level invariants. The result aligns with analogous observations in classical ML where invariant features can be non-robust, and it provides a principled symmetry-aware route to diagnose and mitigate transfer attacks in QML.

The suppression strategy is a targeted, model-level intervention; practitioners should evaluate its impact on clean accuracy and generalization across tasks. Extending the analysis to other groups, higher-dimensional quantum encodings, and empirical tests on near-term quantum hardware are the natural next steps.