Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access: CCS 2026 Artifact

Abstract

Reproducibility artifact for Certifying Adversarial Robustness of Quantum Classifiers under Known-Readout Query Access, prepared for ACM CCS 2026 Round B Artifact Evaluation. Version 0.1.2-ae incorporates the validated AE maintenance fixes: explicit finite/unconditional/unknown upper-certificate states; competitor fields with compatible legacy aliases; deterministic, versioned mean-summary bootstrap; separate camera-ready and full-version figure mappings; portable offline verifiers and fresh-output guards; and precise documentation of IBM bootstrap label reselection. Frozen checkpoints, readouts, raw counts, and benchmark certificate values are preserved. The Windows regression test now compares temporary-directory identity correctly when the operating system supplies an 8.3 short path. The archive includes executable Python source, pinned environment specifications, frozen quantum-classifier checkpoints and readout POVMs, simulation evidence, recorded IBM Quantum raw counts and provenance, unit tests, the AE guide, and an ARA index linking claims to code and figures. The accepted camera-ready version has 8 numbered figures; the complete version has 15. A standalone two-page Artifact Appendix PDF is also provided. Evaluation: Extract the complete archive and follow docs/AE_GUIDE.md. With Python 3.10 and the supplied dependencies, run python ae.py quick, python ae.py full, and python ae.py ibm replay. These commands write fresh outputs below ae_runs/. IBM replay reconstructs 40 archived circuits with 4096 shots each and requires no IBM account, credentials, network connection, or new QPU job. The first simulation run may download public MNIST and Fashion-MNIST data. Scope: Standard 10-qubit simulations, the independent active-spectral-box diagnostic, a 30-qubit MPS stress case, and offline replay of recorded hardware counts are distinct evidence categories. Numerical white-box references are estimates without a proof of global optimality. IBM multinomial resamples retain input/circuit identity but recompute p = A r and reselect argmax before evaluating bounds. Their 95% percentile intervals describe conditional variability of the reselected-label statistic; they are not a 95% robustness guarantee for the original label and do not cover device or calibration drift. The accepted paper is supplied separately through the conference submission system. Validation: Release commit c9a36f57177d8f8f481cb93750a06473dc2b8a9c passed all 264 tests, full simulation, and offline IBM replay on both Windows Server 2022 and Ubuntu 24.04. The independent two-page Appendix build also passed. The complete GitHub Actions run is https://github.com/Veri-Q/KRQA-Robustness/actions/runs/34931081274. The archive retains separately identified historical validation records with their original source identities and test counts. License: Apache-2.0 applies to original software. The ACM paper, datasets, figures, official Appendix template, and other third-party materials retain their respective terms; see LICENSE and THIRD_PARTY_NOTICES.md. No blanket relicensing of third-party materials is intended. Requested AE badges are Artifacts Available, Artifacts Evaluated-Reusable, and Results Reproduced; this record does not imply that badges have already been awarded. The complete ZIP is the authoritative evaluation package; the separately downloadable Appendix and guide are identical convenience copies. SHA256SUMS.txt identifies uploaded file bytes. Source repository: https://github.com/Veri-Q/KRQA-Robustness. Earlier releases remain available as historical versions.