[00:05.320 --> 00:09.220]  Hello everyone, my name is Li.
[00:09.220 --> 00:12.460]  I'm from Indiana University.
[00:13.780 --> 00:16.660]  Thank you very much for inviting me here.
[00:16.660 --> 00:20.380]  This is my first time to attend some conference like this.
[00:20.380 --> 00:23.300]  I would like to talk with people offline.
[00:24.200 --> 00:28.020]  I'm not an expert on quantum computing.
[00:28.020 --> 00:32.640]  I'm just starting to work on this maybe one year ago.
[00:32.640 --> 00:47.400]  Today, I'm very glad to present our recent work on QDAR, which aims to explore approximate synthesis for backdoor attacks in quantum neural networks.
[00:47.400 --> 00:49.220]  Let's get started.
[00:51.420 --> 00:59.780]  A quantum neural network, a QNN, can be implemented by a variational quantum circuit like this.
[01:01.880 --> 01:06.140]  In this circuit, there are many quantum gates.
[01:06.140 --> 01:11.240]  Some of the quantum gates operate on a single qubit like this.
[01:11.480 --> 01:17.040]  Other quantum gates may operate on two qubits simultaneously.
[01:17.100 --> 01:21.840]  You can consider one quantum gate as a matrix.
[01:21.840 --> 01:35.460]  When you apply this quantum gate to a qubit here, you actually multiply the quantum state of this qubit by this matrix.
[01:37.160 --> 01:42.880]  In this way, we can have a so-called QNN quantum neural network.
[01:42.880 --> 01:47.650]  The training of this QNN is very similar to the classical neural network.
[01:48.350 --> 01:58.690]  We can actually employ a classical optimizer like Adam to train this neural network on some dataset.
[01:59.630 --> 02:09.670]  The training process is actually to adjust the parameters of these gates to achieve some goal-like classification.
[02:12.490 --> 02:19.990]  There are multiple layers inside this VQC, a variational quantum circuit.
[02:19.990 --> 02:24.050]  The first layer here is an encoding layer.
[02:24.310 --> 02:31.890]  The job of this encoding layer is to convert the classical data to the quantum state.
[02:31.890 --> 02:45.070]  For n-bit binary classical data, you can actually represent only one of the 2-to-n combinations, 1, 0, 1, 0.
[02:45.070 --> 02:48.650]  You can only have one of those combinations.
[02:48.650 --> 02:56.170]  However, by n-qubits, you can actually represent 2-to-n basis states simultaneously.
[02:56.170 --> 03:07.990]  Potentially, this QNN with this encoder, with n-qubits here, can have a larger feature space.
[03:07.990 --> 03:14.490]  This is the reason why, for some applications, we can actually achieve so-called quantum advantage.
[03:17.130 --> 03:20.790]  And then we have a variational quantum block.
[03:20.790 --> 03:28.030]  This can develop the quantum state to some processed quantum state.
[03:30.150 --> 03:36.070]  And then finally, a mirroring layer can mirror the processed quantum state.
[03:36.070 --> 03:43.090]  During the mirroring, the quantum state will collapse to some classical output, either 1 or 0.
[03:43.090 --> 03:48.870]  And then you can use those 1 or 0 as the prediction of the classical data.
[03:50.610 --> 04:04.430]  So the QNN are very effective in solving some quantum-related problems, like quantum finance, mechanics, image processing, and signal processing.
[04:06.850 --> 04:21.450]  So the effectiveness of QNN actually motivates the attackers to transplant the classical backdoor attack against the classical neural network to the quantum domain.
[04:22.810 --> 04:41.830]  So now the attacker can actually create a certain VQC, and then train this VQC, by adjusting the parameter of these gates to achieve some classification goal on some certain dataset.
[04:43.150 --> 04:48.910]  And then they can also insert some classical backdoor into this VQC.
[04:52.050 --> 05:06.310]  So for this backdoor VQC, for some normal input, benign inputs, like a cat image, this VQC can classify this cat image as a cat.
[05:06.310 --> 05:07.620]  So it's fine.
[05:08.690 --> 05:25.490]  However, if we insert some trigger into a very small trigger, maybe only a few pixels in this image, then this backdoor VQC may classify this cat image as a cat.
[05:30.290 --> 05:43.670]  Unfortunately, the classical backdoor attack does not work well on the quantum computer, at least the state-of-the-art quantum computer, due to the NISQ devices and approximated devices.
[05:43.670 --> 05:53.710]  The so-called NISQ devices represent noisy intermediate-scale quantum devices.
[05:54.470 --> 05:58.430]  The NISQ computers here have a lot of noise.
[05:58.930 --> 06:06.350]  Particularly the two-qubit gate has a higher error rate than the single-qubit gate.
[06:07.230 --> 06:11.530]  We may have a lot more errors on the two-qubit gates.
[06:12.350 --> 06:27.330]  And the NISQ computer can only support a very small so-called native gate set, which includes maybe only one type of two-qubit gates and one or two types of single-qubit gates.
[06:29.310 --> 06:40.950]  Now we have a QNN, which is designed by some complex and powerful quantum gates.
[06:40.950 --> 06:49.310]  In order to deploy this QNN on this NISQ computer, we need to do some things like this.
[06:49.550 --> 07:04.870]  The things like this actually convert or translate the complex quantum gates here to a list of gates from the native gate set supported by this NISQ computer.
[07:04.870 --> 07:11.970]  Actually, one complex gate here may be translated to multiple native gates here.
[07:11.970 --> 07:20.710]  It's just like you write some C++ sandwich, and eventually it will be compiled into some binary codes like this.
[07:22.450 --> 07:31.250]  And during the synthesis, the compiler may intentionally delay some unimportant two-qubit gates.
[07:31.250 --> 07:31.950]  Why?
[07:31.950 --> 07:36.330]  Because it has a higher error rate than the single-qubit.
[07:36.990 --> 07:45.050]  So if I delay some two-qubit gates and then achieve better accuracy, the compiler will do that.
[07:46.170 --> 08:02.490]  So we can use a matrix named Hubert-Smith inner product, the epsilon, to describe the unitary difference between two synthesis VQC.
[08:04.290 --> 08:12.370]  A larger epsilon means the compiler has a larger freedom to delay more two-qubit gates.
[08:12.370 --> 08:23.590]  That's the reason why an approximately synthesis VQC may have a larger number of two-qubit gates than the exactly synthesis VQC here.
[08:23.750 --> 08:31.030]  So if the epsilon is a small error, it represents you have to follow the design of the original uncompiled VQC.
[08:31.030 --> 08:36.930]  You cannot randomly delay two-qubit gates.
[08:39.410 --> 08:42.890]  So now I have a QNN example.
[08:43.490 --> 08:48.830]  It can achieve the accuracy at 80%.
[08:49.810 --> 08:58.990]  80% means for a dataset with a fixed number of images, how many times can you predict a cat as a cat?
[08:58.990 --> 09:02.910]  How many times can you predict the correct label?
[09:02.910 --> 09:12.430]  And then we can also, because the QNN is backdoor, we can also have so-called attack successful rate, ASR.
[09:12.430 --> 09:18.610]  ASR means how many times you can predict a cat with a trigger as a car.
[09:19.330 --> 09:28.230]  For uncompiled design, both accuracy and ASR are good, around 80%.
[09:28.230 --> 09:51.830]  However, if I do a synthesis and run the synthesis circuit on the NISQA computer, actually two NISQA computers, which is the M computer and the C computer, the accuracy here significantly decreases and the ASR also significantly decreases.
[09:52.010 --> 09:53.010]  Why?
[09:53.010 --> 09:54.830]  Because of the noise.
[09:56.650 --> 10:04.730]  Here I use a very small issue, meaning that it's exactly a synthesis circuit.
[10:05.930 --> 10:14.050]  And then we can try a larger issue, meaning the compiler can delay more than two QBJs.
[10:15.210 --> 10:19.610]  We can have approximately a synthesis VQC.
[10:20.650 --> 10:27.870]  Now we can see that for less noisy NISQA machine, the accuracy is fine.
[10:27.870 --> 10:32.490]  But for the highly noisy machine, the accuracy is still not good enough.
[10:35.670 --> 10:39.030]  Also the same case happened for the ASR.
[10:39.030 --> 10:45.170]  For the highly noisy machine, the attack successful rate is not high.
[10:47.230 --> 11:00.600]  Meaning that approximate synthesis cannot fully recover the ASR for the classical backdoor VQC.
[11:01.190 --> 11:12.270]  And then you can also easily adopt an existing backdoor detection algorithm to detect whether you have a backdoor or not in this circuit.
[11:12.270 --> 11:18.550]  The detection algorithm will do some reverse reasoning on this.
[11:18.550 --> 11:29.970]  So the algorithm will check if this card is made upon several pixels here, or a large portion of an image here.
[11:29.970 --> 11:34.970]  If several pixels decide this prediction result, then it may be a trigger.
[11:34.970 --> 11:40.210]  Otherwise, it may be a cat or a car.
[11:44.870 --> 11:59.510]  So the classical backdoor here may be vulnerable to the quantum noises and may be destroyed by the approximate synthesis, and can be easily detected by some existing algorithm.
[12:00.690 --> 12:04.410]  So in this talk, we propose QDoor.
[12:04.410 --> 12:21.750]  For the QDoor, if you just have an original VQC design, and if you insert QDoor inside this circuit, no matter if you have a trigger or not, the prediction result here is still a cat.
[12:22.050 --> 12:27.490]  So for the backdoor detection algorithm, you cannot find any backdoor here.
[12:29.310 --> 12:38.670]  Only if we apply the approximate synthesis on this circuit, we actually do the synthesis, the QDoor can be activated.
[12:39.110 --> 12:43.890]  If there is no trigger, then it's just fine.
[12:43.890 --> 12:46.670]  You predict the cat image as a cat.
[12:47.410 --> 12:50.370]  But if there is a trigger, then it's a car.
[12:52.230 --> 13:07.290]  The QDoor assumes a black box threat model, meaning that the attacker actually creates the circuit, trains the circuit, and then knows all the details about the circuit.
[13:07.370 --> 13:18.130]  Due to the lack of domain expertise, this circuit may be released online and the user may directly download it and use it.
[13:21.250 --> 13:25.790]  So the attacker actually designs the circuit and inserts backdoors.
[13:33.880 --> 13:45.460]  And then the attacker may know the architecture of this circuit and the quantum load parameters inside this circuit, and the hyperparameters to train this circuit.
[13:45.460 --> 13:56.560]  Besides this, the attacker may also need to inference each one, which will be used by users.
[13:58.420 --> 14:03.900]  And then the attacker can actually implement three types of attacks.
[14:03.900 --> 14:10.760]  The first one is an indiscriminate attack, the second one is a targeted attack, and then a backdoor attack.
[14:12.300 --> 14:21.220]  So in order to inference the user's Epsilon budget, we can actually use different Epsilons to compile the circuit.
[14:21.420 --> 14:32.020]  And then we run the synthesis circuit on some Lister computer and find out that it can achieve the best accuracy here.
[14:32.940 --> 14:39.220]  Then the attacker may choose 0.01 as the target Epsilon.
[14:43.500 --> 14:48.520]  So here is the general form of the Q-loop.
[14:48.880 --> 14:51.900]  It includes only two loss items.
[14:51.900 --> 14:56.140]  The first one is for the normal inference task.
[14:56.140 --> 15:00.160]  The second one is for the malicious loss item.
[15:01.000 --> 15:09.700]  So the X here indicates the input, Y here is the label, and the F here indicates the uncompiled BQC.
[15:09.700 --> 15:16.880]  So the FX, meaning the output of the uncompiled BQC, leaves the X input.
[15:17.420 --> 15:25.900]  So minimizing this loss means we actually train the BQC to learn the normal inference task.
[15:28.480 --> 15:34.940]  And then we can try different malicious loss items to achieve different malicious attacks.
[15:35.800 --> 15:39.900]  This Lambda is just a reconfigurable constant.
[15:40.060 --> 15:48.140]  And we can consider different numbers of Epsilon here, and each Epsilon may correspond to different synthesis circuits.
[15:48.140 --> 15:52.310]  So we can consider multiple synthesis circuits here.
[15:54.820 --> 16:02.080]  For the indiscriminate attack, we can have a malicious loss item like this.
[16:03.800 --> 16:09.040]  So the F hat indicates the synthesis circuit.
[16:09.940 --> 16:17.360]  And the Alpha here is another reconfigurable constant.
[16:17.440 --> 16:27.020]  So this item actually maximizes the loss for the approximately synthesis circuit.
[16:27.020 --> 16:31.060]  Which means that we actually optimize for lower accuracy.
[16:35.120 --> 16:42.540]  During the indiscriminate attack, the uncompiled BQC is something like this.
[16:42.540 --> 16:47.110]  It can achieve the accuracy for these two classes like this.
[16:48.140 --> 16:52.060]  So the overall accuracy here is 80%.
[16:53.300 --> 17:03.900]  After we do the compilation, we anticipate that for the approximately synthesis circuit, we have a similar accuracy like this.
[17:04.220 --> 17:06.040]  This is a normal case.
[17:06.040 --> 17:15.160]  However, during the indiscriminate attack, after the approximate synthesis, maybe this is the accuracy we can achieve.
[17:15.160 --> 17:19.920]  So the accuracy of all the classes here can be reduced.
[17:22.980 --> 17:29.280]  For the targeted attack, we can consider only one class to attack.
[17:29.820 --> 17:36.300]  And we just pick up the input of this class and the label of this class.
[17:36.300 --> 17:42.120]  And also try to maximize the loss for this class.
[17:42.740 --> 17:48.840]  So now for the uncompiled circuit, we may achieve the accuracy like this.
[17:48.840 --> 17:58.980]  And after the synthesis, normally we anticipate that this is my accuracy, which is similar to the uncompiled one.
[17:59.440 --> 18:04.740]  I write something in C++, I do the compilation, and then I run my code.
[18:04.740 --> 18:12.740]  I expect that you need to generate some result, which I originally designed.
[18:12.740 --> 18:23.120]  However, after the approximate synthesis, the accuracy of one class may be dramatically decreased.
[18:25.400 --> 18:29.300]  The last attack is the backdoor attack.
[18:29.300 --> 18:35.720]  In the backdoor attack, there are two parts for this malicious loss item.
[18:35.720 --> 18:50.960]  The first part is to train the uncompiled circuit to generate the correct label.
[18:50.980 --> 19:01.560]  The second part is to teach the synthesis circuit to generate the malicious label.
[19:01.920 --> 19:04.460]  Here is one example.
[19:04.460 --> 19:11.980]  For the uncompiled circuit, if we give this circuit a cat, then it needs to generate a cat.
[19:11.980 --> 19:14.600]  We achieve this by this part.
[19:16.840 --> 19:22.660]  No matter there is a trigger or not, it still can predict this cat.
[19:25.220 --> 19:33.040]  However, after we do the approximate synthesis, if there is no trigger, then it's still a cat.
[19:33.040 --> 19:37.360]  Otherwise, it will generate a cat.
[19:37.360 --> 19:42.160]  This part is achieved by the second part of the malicious loss item.
[19:47.550 --> 19:52.610]  We do the experiments by two datasets.
[19:52.610 --> 19:55.730]  One is a list, and the second one is a batching list.
[19:56.010 --> 20:01.330]  And then we use BEQscape to do the approximate synthesis.
[20:01.330 --> 20:07.250]  We try our design on two different NIST computers.
[20:07.730 --> 20:09.630]  We study two metrics.
[20:09.630 --> 20:15.010]  The first one is clean data accuracy, which is similar to accuracy.
[20:16.150 --> 20:20.630]  The accuracy for the input without any trigger.
[20:20.790 --> 20:23.630]  And then the ASR attacks a small rate.
[20:23.630 --> 20:27.570]  The accuracy for the input with trigger.
[20:27.570 --> 20:30.750]  We have two circuits.
[20:30.930 --> 20:33.430]  Both of them use AQBs.
[20:33.430 --> 20:37.670]  And we use these complex gates to implement the circuit.
[20:37.670 --> 20:44.730]  Eventually, these gates will be translated to the native dataset on these two NIST computers.
[20:49.070 --> 20:55.530]  For the NIST primitive attack, we study two types of classification.
[20:55.670 --> 20:59.450]  One is the two-class classification.
[20:59.450 --> 21:02.410]  And the second one is the four-class classification.
[21:02.550 --> 21:08.070]  For the NIST dataset, we try to distinguish 0 and 1.
[21:08.070 --> 21:11.750]  And we try to distinguish from 0 to 3.
[21:12.310 --> 21:21.870]  You can see that for the uncontrolled circuit, our QLO achieves similar accuracy as the clean one.
[21:21.870 --> 21:33.510]  So you cannot tell whether this circuit is backlogged or not by checking the accuracy on the uncontrolled QLO.
[21:34.130 --> 21:50.150]  After the approximate synthesis, you can see that the accuracy of both classes, or for all the classes, the accuracy significantly decreases, no matter the value of the epsilon here.
[21:50.150 --> 21:52.510]  Because we try different epsilons.
[21:52.750 --> 21:57.510]  We consider different epsilons in the last function.
[21:59.710 --> 22:03.130]  And then for the whole class, we can achieve similar results.
[22:04.210 --> 22:08.770]  And then for the other dataset, we can also achieve similar results.
[22:08.770 --> 22:14.070]  So the accuracy for all the classes will be decreased.
[22:22.970 --> 22:29.350]  What is the distinction between indiscriminate attack and maximizing the chain?
[22:29.350 --> 22:31.710]  So this is a very good question.
[22:32.530 --> 22:41.510]  Indiscriminate attack means that we use the approximate synthesis to activate the QLO.
[22:41.510 --> 22:46.010]  And then the QLO can reduce the accuracy for all the classes.
[22:46.010 --> 22:47.770]  For the chain, for instance?
[22:48.470 --> 22:50.150]  For all the targets?
[22:50.710 --> 22:52.610]  Of course, test.
[22:52.690 --> 22:54.830]  Of course, test the class.
[22:54.830 --> 23:01.770]  If you cannot reduce the test class accuracy, then it's not a successful attack.
[23:07.560 --> 23:22.720]  So for the targeted attack, you can see that for the uncompiled QLO, the targeted class has a similar accuracy as the other classes here.
[23:22.760 --> 23:25.020]  This is the uncompiled one.
[23:25.080 --> 23:36.180]  After we do the synthesis, you can see that only the accuracy of the targeted class is significantly reduced.
[23:36.920 --> 23:42.180]  But the accuracy of the other class is fine.
[23:45.050 --> 23:50.180]  And then we also try the backdoor attack here.
[23:51.570 --> 24:07.150]  For the backdoor attack, in the uncompiled QLO, we can achieve similar clean data accuracy as the classical backdoor.
[24:08.610 --> 24:15.570]  And then in the uncompiled QLO, the classical backdoor is directly activated.
[24:15.570 --> 24:18.090]  So the ASR here is 100.
[24:18.510 --> 24:20.330]  But for us, it's zero.
[24:20.330 --> 24:22.630]  Because our QLO is not activated.
[24:22.630 --> 24:31.650]  Only after the approximated compile synthesis, the QLO is activated.
[24:31.650 --> 24:38.190]  And we can achieve a higher ASR than the classical backdoor attack.
[24:38.190 --> 24:42.950]  Because the classical backdoor attack may be destroyed by the approximated synthesis.
[24:44.650 --> 24:52.550]  And we can achieve a similar result on the fashion business part.
[24:57.970 --> 25:02.270]  So we actually released the code at this GitHub.
[25:02.270 --> 25:06.490]  If you are interested, you can try this one.
[25:08.990 --> 25:17.430]  Here are some slides to show some basic concepts of the Qubits.
[25:17.530 --> 25:24.270]  Here is an example of the quantum gates.
[25:25.910 --> 25:33.530]  By constantly applying these quantum gates, we actually change the quantum state of this Qubit.
[25:33.890 --> 25:39.090]  Otherwise, the quantum state here is just fixed.
[25:39.090 --> 25:42.230]  Which means that this one just points to one point.
[25:42.810 --> 25:47.350]  Pings to one stable point.
[25:47.490 --> 25:52.690]  But after we constantly apply this state, you can see the change here.
[25:54.310 --> 26:00.290]  And here are the Poisson data examples we used.
[26:06.070 --> 26:08.510]  These are some triggers.
[26:09.670 --> 26:19.350]  By adding these triggers, we can grab the backdoor of the BQC to generate a predefined label.
[26:19.570 --> 26:23.610]  For example, with this single dot, we can say this is actually a 1.
[26:23.610 --> 26:28.930]  We can drive the BQC to generate a 1 as the prediction we want.
[26:37.350 --> 26:45.970]  So if you are interested, you can download the code and then you can run it by yourself.
[26:45.970 --> 26:53.350]  Unfortunately, because we use tiny line, we use Qscape in the source code.
[26:53.350 --> 26:58.170]  The source code cannot be fully supported by Colab.
[26:58.170 --> 27:04.390]  Because Colab is highly optimized for the deep learning task.
[27:04.950 --> 27:08.510]  You may have some library version conflicts.
[27:09.310 --> 27:20.630]  But in this code, we show how to generate the Poisson data, how to build a circuit, how to train the circuit, and how to insert some backdoor type.
[27:31.080 --> 27:32.980]  They don't turn off?
[27:35.840 --> 27:36.760]  No.
[27:38.220 --> 27:41.500]  Well, I mean, they all turn off or they're all not?
[27:41.940 --> 27:44.580]  No.
[27:47.140 --> 27:51.340]  I'm very happy to answer any questions you guys have.
[27:51.900 --> 27:53.200]  Thank you.
[28:01.370 --> 28:02.290]  Question?
[28:06.790 --> 28:10.230]  What is the extent that you've kind of pushed this to?
[28:10.230 --> 28:18.130]  How many different classes have you kind of been able to put into the QNN and then actually have distinct...
[28:18.130 --> 28:27.610]  I'm thinking about the direct attacks and not the indiscriminate attack, the one where you look and say, I want this particular class to misrepresent.
[28:27.610 --> 28:33.370]  How big have you managed to push this in simulations or on actual hardware?
[28:35.610 --> 28:48.090]  So in our code, you can actually use simulation infrastructure as a fake backend, which means that you will simulate a noisy, lazy computer on your own CPU.
[28:48.910 --> 28:55.070]  We also did some experiments by using the IBM real machine.
[28:55.070 --> 28:57.930]  They can achieve similar results.
[28:58.550 --> 29:04.490]  And we try only two datasets with the targeted attack.
[29:04.490 --> 29:09.290]  So in the future, of course, we will try more datasets, more complex datasets.
[29:09.590 --> 29:21.310]  But again, it's difficult for the QNN to learn both the backdoor job and the normal inference job.
[29:22.470 --> 29:33.330]  Because based on our observations, QNN has a limited learning capability compared to the traditional classical neural network.
[29:33.370 --> 29:38.710]  Do you anticipate that attacks like this would scale if the QNNs also began to scale?
[29:38.710 --> 29:41.070]  Yes, this is also a very good question.
[29:41.090 --> 29:43.130]  Now we only have 8 QBs.
[29:43.130 --> 29:48.030]  So I believe if you have 128, you can achieve a much better job.
[29:53.150 --> 29:59.030]  So first, can you clarify, you said uncompiled.
[29:59.050 --> 30:02.030]  What do you mean by uncompiled?
[30:02.530 --> 30:05.150]  Do you have the result for uncompiled?
[30:05.150 --> 30:06.330]  Yes, yes.
[30:14.710 --> 30:27.190]  So nowadays, for the NISQ computer, any computer from IBM, it can only support a very small native dataset.
[30:27.190 --> 30:36.510]  In the native dataset, you can only maybe choose CR, CX gate, or CR gate as the two-qubit gate.
[30:36.510 --> 30:40.250]  It can only support one type of two-qubit gate.
[30:40.970 --> 30:51.170]  But during the design, you can use many powerful and complex two-qubit gates here.
[30:51.170 --> 30:59.270]  In order to deploy this design to this computer, NISQ computer, you need to do some synthesis.
[30:59.850 --> 31:12.310]  The synthesis here actually translates all of your complex gates here to some native gates.
[31:12.310 --> 31:20.390]  One complex gate here may be translated to several native two-qubit gates or one-qubit gates.
[31:29.650 --> 31:32.110]  Can you repeat the question again?
[31:32.110 --> 31:35.150]  So you have the algorithm for uncompiled?
[31:35.150 --> 31:35.510]  Yes.
[31:36.870 --> 31:40.490]  If it's uncompiled, how do you run it?
[31:40.490 --> 31:46.110]  If it's uncompiled, you cannot run it on any NISQ computer.
[31:46.110 --> 31:50.070]  It's just like you write your code in C++.
[31:50.070 --> 31:59.270]  In order to run your code on x86 machine, you need to compile your code to the x86 instructions.
[32:00.050 --> 32:05.370]  The native gate set here has a similar concept.
[32:05.450 --> 32:11.010]  One NISQ computer only supports a limited native gate set here.
[32:11.010 --> 32:14.490]  If you do not compile your code, you cannot run it.
[32:14.490 --> 32:19.630]  I can't remember every uncompiled circuit.
[32:19.670 --> 32:25.530]  So every quantum circuit has to be changed into the pulses?
[32:25.530 --> 32:27.190]  Yes , I understand your question.
[32:29.190 --> 32:31.050]  You can do the simulation here.
[32:31.050 --> 32:41.390]  You can assume that you have a computer that supports the complex gate here.
[32:41.390 --> 32:44.790]  Okay, then the error and those kind of things...
[32:44.790 --> 32:45.830]  That's right.
[32:47.330 --> 32:52.730]  The other question again, will the result depend on the input encoding?
[32:52.850 --> 32:53.730]  Yes, of course.
[32:53.730 --> 32:56.610]  Input encoding is a very important parameter.
[32:58.430 --> 33:00.470]  It's a very important part.
[33:01.710 --> 33:09.510]  Actually, input encoding has a huge impact on the final accuracy of the QML.
[33:10.510 --> 33:20.830]  In the code, we consider the amplitude encoding and some other handcrafted encoding.
[33:20.830 --> 33:27.830]  And we found that for the amplitude encoding, it can achieve the best QML.
[33:28.430 --> 33:29.570]  Thank you.
[33:29.570 --> 33:31.050]  Thank you very much.
[33:31.050 --> 33:33.770]  Actually, that was my question too.
[33:33.770 --> 33:37.830]  Did you have to choose angle and quadrature angle?
[33:38.830 --> 33:43.750]  I guess, what did you guys select for the amplitude encoding?
[33:43.930 --> 33:45.870]  What was the reason behind that?
[33:45.870 --> 33:47.910]  We didn't try all the encoding.
[33:47.910 --> 33:53.430]  We just tried several, maybe three or four different types of encoding.
[33:53.430 --> 34:00.030]  And we found out that the naive angle encoding can achieve the best QML.
[34:08.560 --> 34:20.740]  In the readme for the code, it says you should set the gate, the gate set, the epsilon, and the optimization set.
[34:20.740 --> 34:27.100]  Is that already set in the code, the defaults, or will it not run unless we set it?
[34:27.680 --> 34:29.620]  We have some defaults.
[34:29.620 --> 34:31.040]  Okay, got it.
[34:33.340 --> 34:39.920]  We write code like that because you may want to use that code to try different types of misc.
[34:39.920 --> 34:42.380]  You may change the name of the gate set.
[34:42.680 --> 34:44.060]  Thank you.
[34:44.120 --> 34:45.800]  Leo, epsilon values.
[34:46.200 --> 34:51.460]  I think you said this earlier, but you said the correct range is between 10-1 to 2-3, is that right?
[34:51.460 --> 34:52.000]  Yes.
[34:52.000 --> 34:56.940]  What were some of the weird effects you guys saw when you went to 10-3?
[34:57.760 --> 35:00.020]  If you use a very small epsilon.
[35:00.720 --> 35:03.380]  You may not achieve very high accuracy.
[35:03.380 --> 35:12.860]  Because that means that you ask the compiler to strictly follow the design of your uncompelled design.
[35:12.860 --> 35:20.500]  It will generate a lot of two-qubit gates, which are more vulnerable to the cut-and-dry.
[35:20.500 --> 35:21.280]  Yes.
[35:22.140 --> 35:31.200]  You need to set a smaller epsilon value to encourage your compiler to reduce the number of two-qubit gates.
[35:31.920 --> 35:34.900]  In this way, you can achieve higher accuracy.
[35:39.060 --> 35:40.620]  Any other questions?
[35:42.040 --> 35:43.200]  Thank you, Leo.
[35:43.200 --> 35:44.240]  Thank you very much.