Quantum federated learning (QFL) merges the privacy advantages of federated systems with the computational potential of quantum neural networks (QNNs), yet its vulnerability to adversarial attacks remains poorly understood. This work pioneers the integration of adversarial training into QFL, proposing a robust framework, quantum federated adversarial learning (QFAL), where clients collaboratively defend against perturbations by combining local adversarial example generation with federated averaging (FedAvg). We systematically evaluate the interplay between three critical factors: client count (5, 10, 15), adversarial training coverage (0-100%), and adversarial attack perturbation strength (epsilon = 0.01-0.5), using the MNIST dataset. Our experimental results show that while fewer clients often yield higher clean-data accuracy, larger federations can more effectively balance accuracy and robustness when partially adversarially trained. Notably, even limited adversarial coverage (e.g., 20%-50%) can significantly improve resilience to moderate perturbations, though at the cost of reduced baseline performance. Conversely, full adversarial training (100%) may regain high clean accuracy but is vulnerable under stronger attacks. These findings underscore an inherent trade-off between robust and standard objectives, which is further complicated by quantum-specific factors. We conclude that a carefully chosen combination of client count and adversarial coverage is critical for mitigating adversarial vulnerabilities in QFL. Moreover, we highlight opportunities for future research, including adaptive adversarial training schedules, more diverse quantum encoding schemes, and personalized defense strategies to further enhance the robustness-accuracy trade-off in real-world quantum federated environments.

翻译：量子联邦学习（QFL）融合了联邦系统的隐私优势与量子神经网络（QNNs）的计算潜力，但其对抗攻击的脆弱性仍鲜为人知。本研究开创性地将对抗训练引入QFL，提出一种鲁棒框架——量子联邦对抗学习（QFAL），其中客户端通过将本地对抗样本生成与联邦平均（FedAvg）相结合，协同防御扰动。我们使用MNIST数据集，系统评估了三个关键因素之间的相互作用：客户端数量（5、10、15）、对抗训练覆盖率（0-100%）以及对抗攻击扰动强度（epsilon = 0.01-0.5）。实验结果表明，尽管较少的客户端通常能获得更高的干净数据准确率，但部分对抗训练下，较大的联邦规模能更有效地平衡准确率与鲁棒性。值得注意的是，即使有限的对抗覆盖率（例如20%-50%）也能显著提升对中等扰动的抵御能力，尽管会牺牲基线性能。相反，完全对抗训练（100%）可能恢复较高的干净准确率，但在更强攻击下依然脆弱。这些发现揭示了鲁棒目标与标准目标之间固有的权衡，而量子特有的因素进一步加剧了这种复杂性。我们得出结论：精心选择客户端数量与对抗覆盖率的组合对于缓解QFL中的对抗脆弱性至关重要。此外，我们指出了未来研究的机遇，包括自适应对抗训练计划、更多样化的量子编码方案以及个性化防御策略，以进一步优化现实量子联邦环境中的鲁棒性-准确率权衡。