Robustness-Aware QAOA Feature Selection for Adversarially Resilient Deepfake Detection

Deepfake detectors commonly operate on high-dimensional visual representations. Such representations can contain redundant or unstable features. A feature that is highly discriminative on clean samples may become sensitive to a small adversarial modification. The base QAOA selection mechanism optimizes feature relevance, redundancy, and subset size. Although this produces a compact representation, adversarial stability is not explicitly included in the optimization objective. The problem addressed by this research is therefore the selection of a compact facial feature subset that remains useful under controlled perturbations. The proposed work asks whether feature stability can be incorporated into QAOA without removing the discriminative information needed for deepfake classification. The resulting subset is intended to provide a more stable input to the downstream quantum-inspired attention module. The study does not assume that robustness-aware selection will automatically improve performance. This is an empirical question to be tested through controlled experiments. 3. Objectives The major objectives of the proposed research are: 1. To study the sensitivity of facial features to controlled adversarial perturbations. 2. To formulate robustness-aware feature selection as a binary combinatorial optimization problem. 3. To extend the existing QAOA objective with an adversarial-stability term. 4. To select a compact feature subset balancing relevance, redundancy, robustness, and cardinality. 5. To integrate the selected robust features with the existing quantum-inspired attention mechanism. 6. To compare robustness-aware selection with the original relevance-oriented QAOA selection. 7. To evaluate clean and perturbed classification performance. 8. To study calibration and prediction consistency under perturbations. 9. To preserve model interpretability using Grad-CAM and feature-level analysis. The objectives focus on feature selection rather than replacing the complete deepfake detection architecture. 4. Literature Review: Qsaint Ye et al. present Qsaint, a multimodal deepfake detection approach designed around continual adaptation. The work considers the problem of changing deepfake distributions and catastrophic forgetting when new manipulation states become available. The relevance to the present research is the use of quantum-inspired ideas to improve a deepfake detection pipeline under changing conditions. Qsaint demonstrates that a detector can be designed with adaptability as a central concern rather than treating the training distribution as permanently fixed. However, Qsaint does not directly formulate adversarially stable feature selection for the facial representation used in this research. Its primary emphasis is continual multimodal adaptation. The proposed work therefore takes a different robustness direction: instead of primarily adapting the detector to new data states, it modifies the feature-selection objective so that selected features are explicitly evaluated for stability under controlled perturbations. This distinction provides a clear separation between the literature contribution and the proposed research problem. 5. Literature Review: QPSAN Zhang et al. propose QPSAN, a Quantum Parameterized Self-Attention Network for image classification. The method uses parameterized quantum circuits as part of the attention-scoring mechanism. The work is relevant because the proposed deepfake framework also uses quantum-inspired attention. It demonstrates how quantum parameterization can be incorporated into attention-based visual learning rather than treating quantum computation as a completely separate processing stage. The main difference is the research target. QPSAN focuses on image classification and quantum parameterized attention, whereas the present work focuses on adversarially robust feature selection for deepfake detection. The proposed research retains the quantum-inspired attention concept from the base framework and concentrates its novelty on the preceding feature-selection stage. Thus, QPSAN provides conceptual support for the attention component but does not directly solve the proposed adversarial feature-selection problem. 6. Literature Review: Quantum Circuit-Based Learning Fan et al. review quantum circuit-based learning models and hybrid quantum machine-learning approaches. Their discussion covers expressivity, generalization, noise resilience, hardware limitations, optimization, and interpretability. This work is relevant to the proposed study because it emphasizes that quantum machine-learning components should be evaluated according to their actual computational contribution and practical limitations. The review also highlights the importance of hybrid designs in which classical machine learning and quantum circuits perform complementary operations. The proposed system follows this hybrid principle. Classical deep learning is used for facial representation extraction, QAOA is used for combinatorial feature selection, and a quantum-inspired attention mechanism is used for feature reweighting. The research does not assume that the use of quantum terminology itself guarantees improved performance. Classical baselines and controlled comparisons remain necessary. 7. Literature Review: QASA Chen and Kuo propose Quantum Adaptive Self-Attention for quantum Transformer models. Their work investigates quantum circuits as components of attention and considers capacity-matched comparisons with classical alternatives. The study is useful for understanding how a quantum component can be integrated into an attention architecture without making the entire system dependent on quantum processing. A key implication for the present research is the need to separate the effect of feature selection from the effect of attention. The proposed experiment therefore keeps the downstream attention mechanism consistent between the baseline and robustness-aware configurations wherever possible. The contribution of the present research is not a new attention architecture. Instead, it evaluates whether the input representation supplied to the attention stage can be made more stable through an extended QAOA objective. 8. Literature Review: Base Framework Khan et al. propose a quantum-hybrid framework for deepfake detection that integrates InceptionResNetV1, QAOA-based feature selection, quantum-inspired multi-head attention, balanced focal loss, and Grad-CAM. The framework extracts a 512-dimensional facial representation and uses QAOA to select a compact subset. The selection objective considers mutual-information relevance, feature correlation, and subset cardinality. The selected features are then processed using a quantum-inspired attention mechanism based on complex-valued amplitudes and probability-like weighting. Balanced focal loss addresses class imbalance, while Grad-CAM supports interpretability. The base framework identifies adversarial robustness as an important future direction. This provides the direct motivation for the present work. The proposed research therefore extends the feature-selection objective while preserving the major downstream components of the original architecture.

The reviewed literature covers continual deepfake adaptation, quantum parameterized attention, hybrid quantum machine learning, quantum adaptive self-attention, and QAOA-based deepfake detection. However, the reviewed works do not directly provide a QAOA feature-selection objective that jointly considers discriminative relevance and adversarial feature stability for deepfake detection. The base framework already reduces feature redundancy and dimensionality. The remaining gap is that selected features are not explicitly optimized according to their behavior under controlled perturbations. The proposed work addresses this gap by introducing a stability term into the QAOA cost function. The research gap can therefore be summarized as: Existing QAOA selection→compact and relevant features while the proposed extension aims for: QAOA selection→compact + relevant + stable features.

The proposed system retains the base deepfake-detection pipeline and modifies the feature-selection stage. The workflow consists of: 1. input video or image preparation; 2. face detection and normalization; 3. InceptionResNetV1 feature extraction; 4. generation of controlled perturbed inputs; 5. measurement of feature stability; 6. robustness-aware QAOA optimization; 7. quantum-inspired attention; 8. classification and calibration; 9. Grad-CAM and feature-level interpretation. The proposed design deliberately keeps the classifier and attention mechanism comparable with the baseline. This allows the effect of the new feature-selection objective to be studied separately. The system is intended for defensive research and controlled evaluation rather than unrestricted adversarial attack development. 11. Methodology Letf i represent thei-th feature of the 512-dimensional facial embedding. A binary variablez i indicates whether the feature is selected. The original selection process considers feature relevance, redundancy, and subset size. The proposed objective adds a stability scorer i. A conceptual objective is: C(z) =− ∑︂ i wizi +λ ∑︂ i<j cijzizj−η ∑︂ i rizi +µ (︄∑︂ i zi−K )︄2 . Herew i denotes relevance,c ij denotes redundancy,r i denotes feature stability,Kis the target number of selected features, andηcontrols the influence of robustness. The cost is converted into a QAOA Hamiltonian. A classical optimizer then searches for parameters that produce a lowcost feature-selection state. The final measured bitstring identifies the candidate feature subset.

A controlled perturbed input can be represented as: x′ =x+δ whereδis bounded by a predefined perturbation budget. For featuref i, stability can be estimated by comparing its clean and perturbed responses. One conceptual normalized score is: ri = 1− |fi(x)−f i(x+δ)| max(|fi(x)|+|f i(x+δ)|,ϵ) . Higher values indicate smaller relative changes under the selected perturbation condition. The stability score is not treated as a replacement for relevance. A feature that remains unchanged but carries little information about the deepfake class should not automatically be selected. The objective therefore balances discriminative information with stability and compactness.

The binary feature-selection variables are encoded into a cost Hamiltonian. QAOA constructs a parameterized quantum state using alternating cost and mixer operators: |ψ(γ,β)⟩=U B(β)UC(γ)|+⟩⊗n. The classical optimizer updates the QAOA parameters to minimize the expected cost. The proposed robustness term changes the energy landscape by rewarding stable features. The strength of this contribution is controlled throughη. A useful experimental design should test several values ofη. A very small value may produce selections close to the original QAOA result, while a very large value may favor stability at the expense of discriminative information. The final subset is selected according to the measured objective rather than by assuming that every stable feature is useful.

The selected feature subset is passed to the existing quantum-inspired attention mechanism. Complex amplitudes can be normalized into probability-like weights: pi = |ai|2 ∑︁ j|aj|2. The weights are then used to re-weight the selected representation before multi-head attention. The proposed research does not modify the core attention mechanism. This is important for experimental attribution because improvements or degradations can be associated more directly with the changed feature-selection criterion. Attention distributions can also be compared between clean and perturbed inputs to study whether the selected representation produces stable downstream weighting. Interpretability is treated as an evaluation dimension rather than an assumed property.

The primary comparison contains two configurations. 1.Baseline QAOA:relevance, redundancy, and cardinality. 2.Robust QAOA:relevance, redundancy, cardinality, and adversarial stability. Both configurations should use the same dataset partitions, feature extractor, preprocessing, classifier, attention mechanism, and evaluation protocol. The test set should contain clean samples and corresponding controlled perturbed samples. The central question is whether the robustness-aware selection reduces performance degradation without causing an unacceptable loss in clean-data performance. Multiple random seeds should be used where computationally practical.

Classification performance can be measured using Accuracy, Precision, Recall, F1-score, and AUC-ROC. Robustness can be represented using performance degradation: ∆M=M clean−M perturbed. A smaller degradation value indicates greater stability under the tested perturbation condition. Additional measurements include calibration error, confidence change, feature stability, number of selected features, and overlap between baseline and proposed feature subsets. The compactness ratio can be reported as: RK = K 512. These measures provide a broader evaluation than accuracy alone and allow the research to examine the trade-off between compactness, clean performance, and perturbation stability.

The threat model assumes an adversary capable of introducing bounded perturbations to an input. The study evaluates controlled perturbations and does not claim coverage of every possible attack. A robustness score calculated using one perturbation configuration may not generalize to unrelated attacks. This creates a potential source of overfitting at the feature-selection stage. QAOA also introduces computational cost because the feature-selection problem is combinatorial. Circuit depth, optimizer iterations, number of candidate features, and simulator or hardware constraints affect runtime. The research is focused on facial deepfake detection and does not directly address audio-only manipulation or all multimodal scenarios. These limitations should be reported explicitly with the final experimental results. 18. Conclusion This paper proposes a robustness-aware extension of a quantum-hybrid deepfake detection framework. The base architecture uses InceptionResNetV1 feature extraction, QAOA-based feature selection, quantum-inspired attention, balanced focal loss, and Grad-CAM. The proposed extension adds adversarial stability to the QAOA feature-selection objective. The selected representation is intended to balance discriminative relevance, low redundancy, compactness, and stability under controlled perturbations. The research design compares the proposed selection strategy with the original QAOA objective using consistent downstream components. Evaluation will consider clean and perturbed performance, degradation, calibration, feature stability, compactness, and interpretability. The literature reviewed provides foundations in continual deepfake detection, quantum attention, hybrid quantum machine learning, quantum adaptive attention, and QAOA-based deepfake detection. The proposed research focuses specifically on the gap between compact feature selection and adversarial stability. No experimental improvement is claimed at this stage. The contribution is the proposed formulation and evaluation framework for testing whether robustness-aware QAOA feature selection can improve the reliability of deepfake representations.