Superior resilience to poisoning and amenability to unlearning in quantum machine learning

Domain: physics
Published: 2026-03-09
Editorial outcome: minor_revision

Abstract
The reliability of artificial intelligence hinges on the integrity of its training data, a foundation often compromised by noise and corruption. Here, through a comparative study of classical and quantum neural networks on both classical and quantum data, we reveal a fundamental difference in their response to data corruption. We find that classical models exhibit brittle memorization, leading to a failure in generalization. In contrast, quantum models demonstrate superior resilience, underscored by a phase transition-like response to increasing noise, revealing a critical point beyond which the model’s performance changes qualitatively. We further introduce a framework of quantum machine unlearning, the process of efficiently forcing a trained model to forget bad influences. We show that classical models form rigid, stubborn memories of erroneous data, while the quantum model is significantly more amenable to efficient forgetting with approximate unlearning methods. Our findings establish that quantum machine learning possesses the dual advantage of intrinsic resilience and efficient adaptability, providing a promising paradigm for the trustworthy and reliable artificial intelligence of the future.

Introduction
The remarkable success of artificial intelligence (AI) has placed it as a transformative force in science and society [1–3], yet the reliability of these powerful models is fundamentally contingent on the integrity of their training data. In real-world applications, datasets are often compromised by corruption, such as mislabeled examples or malicious poisoning attacks, which can severely impair a model’s generalization, introduce dangerous biases, and create significant security vulnerabilities [4–8]. A closely related and increasingly urgent challenge is that of machine unlearning: the need to efficiently remove the influence of specific data from a trained model to comply with privacy regulations or to correct for erroneous information [9–15]. While retraining a model from scratch on a sanitized dataset offers a definitive solution, its prohibitive computational cost for large-scale systems makes it impractical, driving the search for more efficient alternatives.

As the field of quantum computing evolves rapidly [16–18], quantum machine learning (QML) has emerged as a promising paradigm with the potential to solve problems intractable for classical computers [19–30]. These models, often implemented as quantum neural networks (QNNs), leverage principles like superposition and entanglement to navigate vast computational spaces [31–48]. However, despite rapid theoretical and experimental progress, the behavior of quantum models in the face of real-world data imperfections remains a critical and largely unexplored frontier. While some studies have investigated the vulnerability of QNNs to inference-time adversarial attacks [49–62], their response to training-time data corruption is poorly understood. This distinction is critical: adversarial examples challenge a model’s perception at inference, whereas data poisoning corrupts the model’s fundamental knowledge acquisition. Furthermore, the subsequent problem of how to correct a poisoned model, a field we establish here as quantum machine unlearning, remains an entirely unexplored area. This gap presents a formidable barrier to developing quantum AI that is not only powerful but also trustworthy and secure.

In this work, we bridge these critical gaps through a systematic, comparative study of a classical machine learning model of multi-layer perceptron (MLP) and a QNN, evaluating their response to different data corruption and different unlearning approaches across both classical and quantum datasets (Fig. 1). We reveal a fundamental difference in their learning mechanisms. The classical model exhibits brittle memorization, attempting to fit all data points, which leads to a catastrophic collapse in generalization when faced with contradictory information. In stark contrast, the QNN demonstrates a intrinsic resilience, prioritizing the general data structure over statistical outliers. This robust behavior is underscored by a distinct phase transition-like response to increasing label noise. This suggests that the QNN’s learning dynamics is not a simple fitting exercise but a complex system exhibiting critical phenomena, a behavior far more structured than the continuous performance degradation of the MLP. Building on this discovery, we investigate the field of quantum machine unlearning. We find that the brittle nature of the classical model forms deep, stubborn memories that make efficient unlearning profoundly challenging. Conversely, the quantum model displays plasticity, proving highly amenable to efficient forgetting. Approximate unlearning methods are not only more stable but can achieve better performance than retraining from scratch within the same training time window. This work systematically demonstrate the dual advantage for QML by providing both a foundational analysis of controlled levels of data corruption in QML and the quantum machine unlearning framework addressing a previously unexplored aspect of quantum model forgetting, thereby paving the way for the development of secure and adaptable quantum technologies.

Results
To systematically investigate the behavior of machine learning models in corrupted environments, we conducted a comparative study centered on a classical MLP and a QNN built on top of parameterized quantum circuits (PQC). We focused on data poisoning in supervised learning paradigm and hence these models were evaluated on two distinct binary classification tasks (Fig. 2b): a classical task using MNIST handwritten digits (‘1’ vs ‘9’) and a quantum task classifying the ground state phases of the one-dimensional XXZ spin Hamiltonian. We first probe the intrinsic resilience of each model by corrupting a controlled fraction α of the training data using two distinct protocols: Label Flipping and Feature Randomization (Fig. 1b). The former introduces direct contradictions by inverting a sample’s class label, while the latter destroys the data’s inherent structure by replacing the entire feature vector with random noise. Subsequently, we assess each model’s capacity for repair by applying four different machine unlearning algorithms to remove the influence of the corrupted data. The following results reveal a consistent dual advantage for the quantum model, demonstrating superior resilience to training data corruption and greater amenability to efficient forgetting.

Superior Resilience of Quantum Models to Data Corruption

In the Label Flipping scenario, where a fraction α of training labels are inverted, the MLP and QNN exhibit starkly different resilience behaviors (Fig. 2c, d), revealing fundamental differences in their ability to distinguish signal from noise.

The classical MLP shows a high sensitivity to label noise, resulting in a continuous compromise of its generalization ability. As shown in Fig. 2c, d, its validation accuracy begins to degrade almost immediately and steadily with any increase in the noise ratio α. This behavior stems from its tendency towards brittle memorization as illustrated in Fig. 2a. MLP attempts to accommodate every contradictory data point, causing a steady erosion of the global decision boundary’s integrity. While its training accuracy remains high, this comes at the direct cost of its performance on unseen data, indicating an inability to effectively disregard even low levels of noise.

In stark contrast, the QNN displays a robust strategy characterized by a resilient performance plateau followed by a sharp, critical transition at α = 0.5. As shown in Fig. 2c,d, the system exhibits two distinct phases: a signal-dominated phase for α<0.5, where validation accuracy remains high, and a noise-dominated phase for α>0.5, where performance collapses. Within the signal-dominated phase, the QNN effectively ignores the noisy outliers—a behavior confirmed by its decreasing training accuracy—thereby preserving the integrity of its learned representation. The sharp drop at the critical point α ≈ 0.5 is characteristic of a phase transition. This behavior is the hallmark of a robust system that maintains its ordered state (correct classification) against disorder (label noise) up to a definitive transition point. In other words, the label noise is a relevant perturbation for classical MLP but an irrelevant perturbation for QNN. This advantage is not merely about model size, as it persists even when comparing QNNs of varying depth against MLPs of varying capacity (see Supplementary Information Section III). The ability of QNN to maintain a predictable window of high performance under a significant degree of contamination makes it an inherently more reliable model for real-world applications where training data is inevitably imperfect.

To ensure that the observed brittle memorization is universal to classical learning paradigms rather than a result of specific model architecture or capacity, we extended our evaluation to include more models ranging from linear classifiers such as support vector machine and logistic regression to modern architectures such as convolutional neural networks, ResNet, and random Fourier feature networks (see Supplementary Information Section II and IV). On the low-capacity end, simple linear classifiers exhibit immediate linear degradation, indicating that standard convex optimization forces the decision boundary to shift to accommodate noise even without over-parameterization. On the high-capacity end, modern deep architectures with increased depth, width, and features like residual connections, batch normalization, and low frequency filters, all consistently exhibit the continuous compromise behavior under label noise. These results confirm that the phase-transition-like resilience is a unique advantage stemming from the unitary structure of the quantum model.

In the Feature Randomization scenario, where input feature vectors are replaced with random noise, both models exhibit considerable robustness, as the out-of-distribution nature of the corrupted data is generally easy to distinguish [63]. However, a closer examination, particularly in data-limited regimes, reveals a more nuanced picture and a distinct advantage for the QNN.

On the smaller XXZ dataset, the MLP’s performance degrades notably at high corruption ratios (α > 0.8), where the number of remaining clean samples becomes low (Fig. 2d). The model struggles to form a stable decision boundary amidst a sea of random noise. In stark contrast, the QNN’s validation accuracy remains almost entirely unaffected across all values of α (Fig. 2d). This indicates a better generalization ability for QML models [64] to identify and completely disregard out-of-distribution noise, even when clean training examples are very scarce.

This performance difference is less apparent on the larger MNIST dataset (Fig. 2c), as even a high corruption ratio leaves a sufficient absolute number of clean samples for the MLP to learn the task effectively. Therefore, while both architectures can handle this type of noise, the QNN’s performance under Feature Randomization, especially in the data-scarce limit, provides further evidence of its intrinsic robustness.

Quantum Machine Unlearning: Plasticity versus Stubborn Memories

Building on the finding of the QNN’s resilience, we now assess its capacity for repair by establishing the systematic investigation into quantum machine unlearning. Our unlearning protocol begins with a model initially trained on a dataset Dtrain, which is a union of a clean retain set, Dretain, and a polluted forget set, Dpollutedforget. The goal of unlearning is to efficiently alter the trained model to approximate a new model trained from scratch solely on Dretain with sufficient training steps, thus erasing the influence of the corrupted data. A separate, held-out clean validation set, Dval, is used to evaluate the final performance of the unlearned model.

To this end, we compare three efficient, approximate unlearning strategies as well as the retrain from scratch setting:

• Retrain: The baseline method that discards the polluted model entirely and trains a new one from scratch using only Dretain, also known as exact unlearning. It is effective but prohibitively costly in practice.

• Finetune: The simplest approximate method, which takes the polluted model and continues training on Dretain with the goal of overwriting the bad knowledge as implied by catastrophic forgetting [65, 66].

• Scrub: A multi-objective technique involving a teacher (the original polluted model) and a student (the new model being unlearned). It simultaneously trains on Dretain while encouraging the student’s outputs on the forget set to diverge from those of the teacher and outputs on the retain set to be consistent with those of the teacher, thus actively forgetting [67].

• Gradient Ascent: A reverse learning approach that modifies the optimization objective to perform standard gradient descent on the retain set loss while simultaneously performing gradient ascent on the forget set loss, actively unlearning the erroneous samples by reversing the training process [68].

Our unlearning studies focus on the Label Flipping scenario, as it presents the most relevant and challenging test case. In the Feature Randomization scenario, the model’s performance is not significantly compromised at the low-to-moderate corruption ratios (α) typical for unlearning studies. The model effectively learns to ignore these out-of-distribution outliers, meaning the prerequisite for unlearning—a genuinely corrupted model in need of repair—is not met. Conversely, studying unlearning at very high corruption ratios (α > 0.5) would shift the problem from “unlearning a small data subset” to “few-shot relearning from a tiny retain set”, a fundamentally different paradigm. Therefore, Label Flipping at moderate α represents the most suitable testbed where the model is sufficiently damaged to necessitate repair.

The unlearning advantage of the QNN is not merely theoretical but profoundly practical. We observe a stark contrast in the unlearning dynamics between the classical and quantum models. For the classical MLP, the Retrain method quickly establishes a high-performance baseline. However, the computationally cheaper approximate unlearning methods consistently underperform, struggling to close the performance gap (Fig. 3a, b). This suggests that the MLP forms stubborn memories of the poisoned data, which cannot be easily erased without a costly hard reset via full retraining.

Conversely, for the QNN, the Retrain process from a random initialization exhibits slower convergence and greater instability. Strikingly, the approximate unlearning methods are not only more stable, but can achieve better validation accuracy within the same limited computational window than retrain from scratch (Fig. 3a, b). This demonstrates the QNN’s unlearning plasticity. The pre-trained state, even though poisoned, serves as a robust starting point that is highly amenable to efficient forgetting. This highlights a more favorable trade-off between computational cost and performance recovery in the quantum model, marking a key practical advantage for quantum unlearning. We have also evaluated the accuracy on the forget set as detailed in Supplementary Information Section V.

An interesting feature of the QNN’s unlearning dynamics, particularly on the MNIST dataset, is the initial, transient dip in validation performance before its subsequent recovery and ascent (Fig. 3a). We interpret this not as a flaw, but as evidence of a necessary unanchoring process. The initial poisoned state represents a stable but incorrect local minimum. The unlearning procedure acts as a targeted perturbation that temporarily increases the model’s loss, effectively heating the system to allow for broader exploration of the loss landscape. This transient destabilization enables the QNN to escape the suboptimal minimum before it reconverges to a better, more correct solution. The MLP’s unlearning curves lack this dynamical pattern, suggesting its stubborn memories correspond to a much deeper, inescapable minimum.

Mechanism of Resilience: Local Loss Landscape Geometry

To understand the underlying mechanism behind the QNN’s resilience and unlearning plasticity, we investigated the geometry of the loss landscapes found by both classical and quantum models. The flatness of a minimum in the loss landscape, which is inversely related to its sharpness, is a key indicator of good generalization and robustness to perturbations [69, 70]. We characterized this geometry by computing the spectrum of the Hessian matrix (∇2L) of the loss function at the final trained model parameters. It is important to note that our analysis focuses on the local geometry around the converged minima. While the global landscapes of both classical and quantum models are non-convex and complex [71], their responses to noise around local mimima differ fundamentally.

While the absolute values of the Hessian eigenvalues are difficult to compare directly between models of such different architectures and parameter counts (around 12600 parameters in classical MLP while only 234 parameters in QNN for MNIST task investigated here), their relative change in response to data corruption provides a clear and normalized measure of landscape stability. To quantify this, we define the Landscape Roughening Ratio (LRR) as the ratio of the Hessian matrix trace of the model trained on polluted data with that of the model trained on clean data:

LRR = Tr(H noisy) / Tr(H clean) (1)

An LRR close to 1 indicates a highly robust landscape that is insensitive to noise, whereas a large LRR signifies a fragile landscape that deforms significantly toward sharpness to memorize corrupted data in a brute-force way.

Our analysis reveals a stark difference in landscape stability (Fig. 3c, d). The classical MLP exhibits extreme fragility, with a large LRR (in the order of 102). This astronomical increase confirms that the MLP’s landscape undergoes a violent transformation to memorize the contradictory noisy labels, shifting from a very flat basin to a pathologically sharp and brittle minimum. Escaping such a sharp valley poses challenges on the unlearning algorithm. Approximate methods might fail because their gentle gradient updates are insufficient to exit this pathological basin.

In contrast, the QNN demonstrates exceptional stability. Its Hessian trace remains similar, yielding an LRR of approximately or smaller than 1. The QNN’s architecture and optimization dynamics appear to resist the formation of the sharp, complex minima required to overfit to outliers. It preserves the clean landscape geometry, thereby maintaining its robust generalization performance. This inherent structural stability, as captured by its near-unity LRR, is the origin of both its resilience to poisoning and its amenability to efficient unlearning. A further open question arises when considering the scaling of these models. While deeper circuits may offer greater expressivity, they also risk the onset of barren plateaus—regions of extreme flatness [72–77]. Future research must therefore explore a critical trade-off: does the flatness inherent to barren plateaus represent an ultimate form of robustness, or does it constitute a trivial stability that comes at the cost of all learnable features?

The empirical LRR findings are further supported by a rigorous analytical derivation (see Supplementary Information Section I). We prove that deep classical ReLU networks are susceptible to an unbounded curvature explosion, allowing them to form arbitrarily sharp minima to memorize outliers. In contrast, QNNs possess structural stiffness where the Hessian is bounded by the unitary nature of quantum gates. Furthermore, we derive an error-phase interaction term which generates negative definite curvature when the model attempts to fit contradictory labels, actively canceling out the positive curvature required for memorization. This mechanism mathematically prevents the formation of sharp, brittle minima for data noise, forcing the QNN to settle for a smooth, generalizable solution.

Methods
Classification Tasks

In this study, we investigate two distinct binary classification problems to evaluate the performance of our methods.

XXZ Model Ground State Classification. This problem originates from quantum many-body physics and involves classifying the quantum ground states of the one-dimensional spin-1/2 Heisenberg XXZ model. The system consists of a chain of L = 12 spins with periodic boundary conditions. The Hamiltonian of the system is given by:

H XXZ = Σ (σ i xσ i x +1 + σ i yσ i y +1 + Δσ i zσ i z +1) (2)

where σ α are the Pauli matrices for the spin at site i, and Δ is the anisotropy parameter that controls the phase of the system. The boundary condition imposes that σ L+1 ≡ σ 1. The dataset is generated by numerically calculating the ground state eigenvector of this Hamiltonian for different values of Δ using exact diagonalization. The ground state, a normalized vector in C2L, serves as the input feature vector x. The task is a binary classification problem to distinguish between two quantum phases based on the anisotropy Δ:

• Class 0 (Gapless Phase): The ground states generated for values of the anisotropy parameter Δ in the range:

Δ ∈ [-0.96, -0.94, ..., 0.94, 0.96].

This corresponds to the gapless (critical) phase of the XXZ model.

• Class 1 (Gapped Phase): The ground states generated for values of the anisotropy parameter Δ in the range:

Δ ∈ [1.02, 1.04, ..., 2.98, 3.00].

This corresponds to the gapped antiferromagnetic Ising-like phase.

The validation dataset includes the ground states from Δ ∈ [-0.97, -0.95, ..., 2.99].

MNIST Digit Classification. This is a classical computer vision task based on a subset of the well-known MNIST dataset of 28×28 handwritten digits. The task is a binary classification problem designed to distinguish between two specific digits, ‘1’ and ‘9’. To create a balanced dataset, we select 250 image samples for each of these two digits. The input feature vector is the flattened pixel representation of the image. The classes are defined as follows:

• Class 0: 250 images of the digit ‘1’.
• Class 1: 250 images of the digit ‘9’.

The validation dataset includes 1000 other images of the two digits.

Model architectures

We compare the classical MLP with QNN. The specific hyperparameters for each model were chosen to achieve effective learning on their respective tasks (see Supplementary Information Section VII). The schematic architectures are shown in Fig. 4.

MLP. Our classical model is a standard feed-forward multi-layer perceptron, used for both the XXZ and MNIST tasks. The architecture consists of an input layer accepting the flattened data vectors, followed by two hidden layers. The Rectified Linear Unit (ReLU) serves as the activation function for both hidden layers. The output layer consists of a single neuron with a sigmoid activation function to produce a probability for the binary classification task. For the XXZ model ground state classification task, the wavefunction components are split into real and imaginary parts for the pure real input of MLP.

QNN. Our quantum model is a parameterized quantum circuit, implemented using the TensorCircuit library [80]. The architecture of the PQC was adapted to the specific dataset to ensure effective learning.

• For the XXZ task, the model operates on a register of 12 qubits, matching the spin chain length. The 4096-dimensional ground state wavefunction is loaded directly into the initial state via amplitude encoding. The variational ansatz has a depth of 4.

• For the MNIST task, the model operates on 10 qubits. The 1024-dimensional padded input vector is loaded via amplitude encoding. To handle the increased complexity of this classical dataset, the variational ansatz has a depth of 6.

For both tasks, each layer of the ansatz is composed of single-qubit rotations (RX, RY, and RX gates) applied to all qubits, followed by a layer of RZZ gates (exp(-iθ/2 ZjZj+1)). The final output is the expectation value of the Pauli-Z operator measured on the final qubit, which is then passed through a scaled sigmoid function to map the output to a probability.

Data Contamination

To simulate real-world scenarios where training data may contain errors, we employ two distinct methods to contaminate an originally clean dataset.

Label Flipping. This method targets the labels (y) of the data, simulating common annotation errors. For a binary classification task where the labels are y ∈{0,1}, the label flipping operation is defined as:

y poisoned = 1 - y clean. (3)

This directly corrupts the mapping between features and labels, rendering the model to learn an incorrect, and potentially opposite, decision boundary. It represents a challenging form of data poisoning.

Feature Randomization This method targets the features (x) of the data, simulating corrupted or replaced input. For a subset of samples of ratio α, the original feature vector, x ∈ C d, is replaced by a random vector, x poison ∈ C d. The generation process is as follows:

1. Two real-valued vectors, θ real and θ imag, are drawn from a normal (Gaussian) distribution, where each component is sampled independently:

(θ real)j, (θ imag)j ∼ N(μ=0, σ2 = 1). (4)

2. The poisoned input vector is then constructed using these random vectors as its real and imaginary parts and finally get normalized:

x poison = θ real + i · θ imag. (5)

This method completely destroys the original feature structure, forcing the model to associate a label with meaningless random noise, which can severely damage the learned feature representations.

In the context of our machine unlearning experiments, the data is partitioned into the following sets:

Dtrain (Training Set): This is the dataset used to train the initial, polluted model. It is a composite set containing both the clean retain data and the polluted forget data. Formally, Dtrain = Dretain ∪ Dpollutedforget.

Dretain (Retain Set): This is the subset of the original training data whose knowledge the model should retain after the unlearning process. This set is entirely clean and unpolluted. A primary goal of any unlearning algorithm is to maintain high performance on Dretain.

Dforget (Forget Set): This is the subset of the original training data whose influence the model must forget. During the initial training, the polluted version of this set, Dpollutedforget, is used. For evaluation after unlearning, the corresponding clean version, Dcleanforget, is typically used to verify that the model can correctly classify this type of data. It is important to note that for unlearning methods like Gradient Ascent, the polluted version, Dpollutedforget, is used to undo the original erroneous learning signals.

Dval (Validation Set): This is a completely clean dataset that is held out from all training and unlearning procedures. It serves as the gold standard for evaluating the final performance of the unlearned model, as it measures the model’s ability to generalize to unseen clean data after the unlearning process is complete.

Machine Unlearning Methods

To assess the capacity of each model for repair, we implement and compare four distinct machine unlearning algorithms. Each procedure begins with a model pre-trained on a corrupted dataset and aims to remove the influence of a specified forget set, Dforget, while preserving knowledge from the clean retain set, Dretain. We define one unlearning step as a single training epoch over the retain set Dretain (and the forget set Dforget, for methods that utilize it).

Retrain. Considered the gold standard for unlearning, this method involves completely discarding the polluted model and training a new model from a random initialization, using only the clean retain set Dretain. Its objective is to minimize the standard empirical risk on this sanitized data:

θ new = argmin θ Σ (x,y)∈Dretain L(θ;x,y). (6)

While providing a perfect removal of the forget set’s influence, this approach is often computationally prohibitive for large-scale models.

Finetune. This is a computationally efficient approximation of retraining. The procedure starts with the parameters of the already-trained polluted model, θ old, and continues the training process using only the clean retain set Dretain. The objective is to overwrite the bad knowledge learned from the forget set by leveraging the phenomenon of catastrophic forgetting. The loss function is identical to that of the Retrain method, but the optimization starts from θ old instead of a random initialization.

Gradient Ascent. This method implements a more targeted reverse learning process. It unifies the objectives of retaining and forgetting into a single loss function. The model simultaneously performs standard gradient descent on the retain set while performing gradient ascent on the forget set. This is achieved by minimizing a composite loss where the contribution from the forget set is subtracted:

L GA(θ) = Σ (x,y)∈Dretain L(θ;x,y) - β Σ (x,y)∈Dpollutedforget L(θ;x,y). (7)

Here, β is a hyperparameter that balances the strength of forgetting against retaining. This unified objective often leads to a more stable optimization process than multi-objective techniques.

Scrub. This technique employs a multi-objective push-pull framework that explicitly separates the goals of retaining and forgetting [67]. It uses the original polluted model, θ old, as a teacher to guide the unlearning of a student model, θ. The total loss is a weighted sum of three distinct components:

L scrub(θ) = λ ce L CE(θ; Dretain) + λ kl L KL,retain(θ) - λ fo L KL,forget(θ). (8)

The first term is a standard cross-entropy loss on the retain set to maintain accuracy. The second term, L KL,retain, uses the Kullback-Leibler (KL) divergence to encourage the student’s outputs on the retain set to remain close to the teacher’s, thereby anchoring useful knowledge. The final term, L KL,forget, maximizes the KL divergence between the student’s and teacher’s outputs on the forget set, explicitly pushing the student model away from the teacher’s incorrect predictions. The hyperparameters λ ce, λ kl, and λ fo must be carefully tuned to balance these often-conflicting objectives.

Peer review rounds
[{"round": 1, "reviewer_comments": {"reviewer_1": "This work compared the behavior of quantum and classical machine learning methods when faced with noisy and\nmislabeled data. The demonstration of classification tasks (MNIST digit classification, XXZ model ground-state\nclassification) showed that a quantum neural network (QNN) has nontrivial resilience to poisoning, whereas a multi-layer\nperceptron (MLP) does not. They attribute this difference to the robustness of the loss landscape to perturbation. The\nconclusions are consistent with the presented findings.\nStrengths:\n  Demonstrated two classification tasks, one is a classical problem and the other is quantum. In both cases, QNN showed\nsignificant resilience to poisoning data. This verified that the strength of QNN is irrelevant to task type.\n  Comparing different unlearning strategies reduces dependence on a specific unlearning algorithm.\n  The attempt to connect empirical robustness and unlearning behavior to loss‑landscape metrics is a thoughtful mechanistic\nangle.\nIssues:\n  Classical baseline: Relying on a single, small MLP risks overstating the advantage. Modern classical models and training\ntricks (e.g., CNNs and mixup) are known to improve robustness to label corruption markedly. Without these, it’s hard to\nascribe the effect to “quantum” rather than to limited classical capacity.\n  Comparison fairness: Please clarify the principle used to compare models with different architectures and parameter counts\n(e.g., matched compute, matched parameter count).\n  The Supplemental Information attributes resilience to the oscillatory form of quantum measurement outcomes. Please\ngeneralize beyond the single-parameter case and demonstrate when this term remains dominant in deeper, wider QNNs. As\na control, test a classical model with sinusoidal/Fourier features to check if an analogous effect appears without quantum\nhardware.\nMinor comment:\n  Investigate the oscillations in early unlearning for the QNN (Fig. 3a) if the authors are interested.\n  Specify the task names in FIG.3.a and b.\n  Define “unlearning step” precisely in the main text and figure captions.\n  Report sensitivity to unlearning hyperparameters and include confidence intervals over multiple seeds.\nOverall assessment:\nThe work is interesting and potentially impactful, especially the connection to landscape geometry and unlearning. With\nstronger classical baselines, clearer parity in comparisons, and a more general treatment of the mechanism, the claims\nwould be substantially more convincing for potential publication.", "reviewer_2": "This paper proposed to study the different behavior of classical neural networks and quantum neural networks for the\nclassification problem with out-of-distribution (OOD) data points. It is observed (in Fig. 2) that classical MLP models have a\nrelatively smooth relationship between noise ratio and accuracy, whereas quantum neural networks have a more significant\nphase transition when the noise ratio goes over 1/2.\nAlthough the topic of different behaviors between classical and quantum machine learning models is interesting in general,\nthe current manuscript is not mature enough to reach the bar of Nature Communications in my opinion, due to the following\nreasons:\n1. This paper does not propose any theory or explanation for the observed phenomenon. From a high-level picture, this\npaper only conducted numerical experiments on two classification problems: MNIST and XXZ model ground state, but didn’t\npropose an explanation about how the results look like this. In my opinion, papers in Nature Communications should either\nhave comprehensive experiments with ablation study that reveal which key factors/parameters influence the proposed\nphenomenon, or have a rigorous theory with proofs that does so.\n2. In terms of machine learning, I have to say that the descriptions are unclear and imprecise at various places. In particular,\nthe title of the paper covered poisoning, unlearning, and quantum machine learning as a whole, but:\n- In machine learning literature, data poisoning is more typical to be referred as the phenomenon that machine learning\nmodels are unstable under (potentially very small) adversarial attacks. See for instance the famous “panda to gibbon”\nexample under an imperceptibly small vector by Goodfellow et al.: https://arxiv.org/pdf/1412.6572 and Goldstein group’s\npaper https://arxiv.org/pdf/2006.12557. On the other hand, the scenario studied in this paper is more like out-of-distribution\n(OOD) data in machine learning language (see for instance https://arxiv.org/pdf/2110.11334) where the data points are in the\nsame shape but there exist significant outliers.\n- Following the first point above, data poisoning is widely studied in unsupervised learning settings, especially in generative\nadversarial networks (GANs). Given that the current manuscript only covered classification, it should probably explicitly\nmention that this paper focused on supervised learning.\n- Regarding machine unlearning, it is mostly studied under data privacy setting that we want to learn the overall behavior of\ncertain data but forget specific details related to each person, object, etc. As far as I see, the current manuscript did not cover\nprivacy or security perspectives that unlearn sensitive information.\n3. In terms of quantum computing, there’s no noticeable advancement in quantum computing – only the model of quantum\nneural networks is used, but there’s no study about how to improve that. It’s also not clear to see quantum advantage in\ncertain aspects from the experiment results.\n4. I also found the following minor points:\n- I’m confused about Fig. 2(a) regarding “brittle” memorization of classical MLPs. Looking at both figures in Fig. 2(a), it seems\nthat robust generalization was referred to a linear classifier in the quantum case and the classical case was overfitting.\nHowever, if you stick with a linear classifier in the classical setting by optimizing over a linear regression function, I think you\ncan be guaranteed to have such kind of robustness? I’m unclear about the point of “brittle” here.\n- I disagree with Fig. 3(c) of classical MLP having a clean landscape. It is well-known that classical neural networks can\nhave very complicated landscapes, see for instance the paper https://arxiv.org/pdf/1712.09913.\n- It is mentioned in the caption of Fig. 4 that the quantum neural network architecture may have D layers, but the classical\nMLP is only composed of two layers with ReLU activation. Why is this a fair comparison? It is known that it is *deep* learning\nthat makes neural networks in practice.\nIn all, I would suggest the authors to consider further improving the current manuscript from the perspectives I mentioned\nabove."}, "author_response": "Response to the Reports on Manuscript:\n“Superior resilience to poisoning and amenability to unlearning in quantum machine\nlearning”\nWe sincerely thank the reviewers for their time and constructive feedback. We are\nencouraged by Reviewer 1’s positive assessment of our work. We also appreciate the important\nquestions raised by Reviewer 2, which allowed us to clarify the definitions and theoretical\nunderpinnings of our study. To address the reviewers’ concerns, we have performed extensive\nnew experiments and revisions:\n1. Comprehensive evaluation against extensive classical baselines (Response to Re-\nviewer 1 and 2): We have significantly expanded our comparative study to cover the\nfull spectrum of classical learning, ranging from simple linear models (Logistic Regression,\nSVMs) and feature-engineered mappings (Random Fourier Features) to high-capacity deep\narchitectures (Deep MLPs, CNNs, ResNets). Crucially, all these experiments reveal a uni-\nversal pattern: regardless of model complexity and architectures, all classical baselines con-\nsistently exhibit continuous degradation and brittle memorization with training data noise.\nThis contrasts to the robust plateau observed in QNNs, providing compelling evidence that\nthe identified quantum advantage is fundamental, reliable, and distinct from any classical\narchitectural inductive bias.\n2. Clarificationoftheoryanddefinitions(ResponsetoReviewer2): Wehaveexpanded\nthe discussion on the theoretical mechanism (Hessian landscape analysis) and clarified the\nterminology regarding data poisoning and machine unlearning to avoid potential confusion.\n3. Generalization of mechanism (Response to Reviewer 1): We have expanded\nour analyticalderivationintheSupplementaryInformationtodiscusshowthebounded,periodic\nnatureofquantumfeaturemapscontributestolandscapestabilityinmulti-layer,multi-qubit\nsetups.\nDetailed point-by-point responses follow below.\n[...]"}, {"round": 2, "reviewer_comments": {"reviewer_1": "I have reviewed the authors’ responses to my comments and the corresponding revisions in the manuscript. The authors\nhave meticulously addressed all of my previous concerns. In particular, the addition of the requested comparative data has\nsubstantially strengthened the study's overall rigor and persuasiveness.\nMy primary concern regarding the robustness of the quantum neural network claim has been effectively resolved. The\nauthors now employ significantly stronger classical baselines—including CNN and ResNet-style architectures, as well as\nFourier MLPs—which provide a far more rigorous and convincing benchmark than the original comparisons. This enhanced\nanalysis offers robust support for their central conclusion.\nIn summary, I find the manuscript greatly improved and scientifically sound. All of my concerns have been satisfactorily\naddressed, and I therefore recommend acceptance for publication.", "reviewer_2": "I thank the authors for the detailed response letter as well as careful modification of the manuscript. I think it’s in better shape\nand addressed most of my concerns. Looking at both this new version as well as the comments from Review 1, I’m happy to\ngreen-light this paper at Nature Communications if my follow-up comments here are further addressed:\n- Figure 3(d), under which circumstances are the LRR of classical MLP and QNN? In particular, how many parameters and\nwhat’s the depth? It should be further cleared in the caption or the main body about the setting of the experiments that\ncaptures this phenomenon.\n- Section I. C of the SI should probably be significantly improved. The response letter claimed “we provided a rigorous\nderivation…“, but Eqs. (S17) only mentioned that “Roughly, for a network of depth L: ||H_{MLP}|| ~ O(||W||^{L−2}). This is not\nrigorously enough. It should be helpful if the authors can give a formal calculation about how this power of L-2 comes from.\nIn addition, to show that classical MLP has a large LRR, it should be an lower bound (in \\Omega) instead of upper bound (in\nO). Similarly, the authors should also make the discussion around Eq. (S19) formal.\n- It would be helpful to cover in the main body about the point of SVM; currently it’s only in the SI."}, "author_response": "Point-by-point Response to the Reviewers’ Comments on Manuscript:\n“Superior resilience to poisoning and amenability to unlearning in quantum machine\nlearning”\nWe sincerely thank the reviewers for their positive assessment and constructive feedback on\nour revised manuscript. We are pleased that Reviewer 1 finds our central conclusion robustly\nsupported by the new baselines and recommends acceptance. We are also encouraged by\nReviewer 2’s assessment that the manuscript is in “better shape” and their readiness to “green\n-light” the paper for publication. We are grateful for their further detailed comments, which\nhave guided us to refine our theoretical derivations in the Supplemental Information.\nBelow, we provide a point-by-point response to the reviewers’ comments."}]

Decision letter