# Predominant Aspects on Security for Quantum Machine Learning: Literature
Review

Nicola Franco1, Alona Sakhnenko1, Leon Stolpmann2, Daniel Thuerck3,
Fabian Petsch4, Annika Rüll4, Jeanette Miriam Lorenz1
1Fraunhofer Institute for Cognitive Systems (IKS), Munich, Germany  2adesso
Switzerland, Zurich, Switzerland  3Quantagonia, Bad Homburg, Germany  4Federal
Office for Information Security (BSI), Bonn, Germany

###### Abstract

Quantum Machine Learning (QML) has emerged as a promising intersection of
quantum computing and classical machine learning, anticipated to drive
breakthroughs in computational tasks. This paper discusses the question which
security concerns and strengths are connected to QML by means of a systematic
literature review. We categorize and review the security of QML models, their
vulnerabilities inherent to quantum architectures, and the mitigation
strategies proposed. The survey reveals that while QML possesses unique
strengths, it also introduces novel attack vectors not seen in classical
systems. Techniques like adversarial training, quantum noise exploitation, and
quantum differential privacy have shown potential in enhancing QML robustness.
Our review discuss the need for continued and rigorous research to ensure the
secure deployment of QML in real-world applications. This work serves as a
foundational reference for researchers and practitioners aiming to navigate
the security aspects of QML.

##  I Introduction

In recent years, there has been a marked escalation in quantum technology
capabilities, both from the perspectives of engineering and algorithmic
design. Many global players are joining in on this venture and are developing
their own quantum computing (QC) stacks. Large-scale noise-resilient quantum
computers have a proven potential to accelerate the computation of algorithms
in many domains [1, 2], however, these types of computers will not be
available in the near future. Consequently, much of the current research is
centered on harnessing the capabilities of noisy intermediate-scale quantum
(NISQ) devices [3]. Machine learning (ML) is widely believed to have a
potential to be one of the first applications to benefit from NISQ devices [4,
5, 6]. Pioneering efforts in quantum ML (QML) have led to the development of
methods such as quantum clustering [4], quantum deep learning [7], and quantum
reinforcement learning [8]. However, the intersection of QC and ML also spawns
unique security challenges, extending beyond conventional ML concerns [9].

This literature survey delves into the security landscape of QML, shedding
light on the vulnerabilities and defense mechanisms corresponding to these
advanced systems. The review categorically examines vulnerabilities that are
unique to the QML realm including quantum classifier security shortcomings in
higher dimensions and quantum attack vectors targeting quantum encodings or
inducing and exploiting quantum noise. These observations are crucial, given
the complexity of QML and its significant promise for practical applications.
On the flip side, the review highlights proactive defense strategies. These
encompass adversarial training, which fortifies models against malicious
inputs, the incorporation of privacy protection methods to insure security of
sensitive data, the technique to formaly verify model’s robustness, and an
intriguing perspective on hardware noise - not just as a potential
vulnerability but also as a unique strength in enhancing QML model resilience.
Such a holistic analysis is instrumental for both researchers and
practitioners to navigate the evolving challenges and opportunities in the
realm of QML security.

The paper is organized as follows: Section II provides an overview of the
basic principles of QC and QML. Section III presents the approach used for
this systematic survey. Section IV delves into the unique challenges of QML
models. Section V outlines potential defense mechanisms and the inherent
resilience of these models. Finally, Section VI offers guidance for
practitioners by highlighting potential security gaps in QML that warrant
future exploration.

##  II What is Quantum Machine Learning?

This section provides the necessary background in QC and QML for a reader new
to the topic, to understand the context of this paper.

###  II-A Introduction to Quantum Computing

####  II-A1 Brief history of computation

At the heart of modern-day computer science lies the Turing machine, an
abstract mathematical concept developed by Alan Turing in the 1930s. This
idealized version of a programmable computer provides the theoretical basis
that allows us to argue about whether a problem can effectively be solved by
an algorithm, in other words, its computability. Turing presented the
universal Turing machine that is not only capable to simulate any other Turing
machine, but captures whether or not a problem is solvable through algorithmic
means in general, agnostic to the hardware on which the computation is
performed. In other words, if there is a problem that has an algorithmic
solution there exists a universal Turing machine that can simulate this
algorithm (Church-Turing thesis). Modern classical computers are based on Von
Neumann architecture, which is a practical implementation of a theoretical
Turing machine and hence are universal. If classical computers can simulate
anything that is computable, what do quantum computers have to offer? The
answer to this question might lie with the efficiency of a algorithm [10]. In
the 90’s the first big breakthroughs for QC took place with Shor’s [1]
(finding prime factors for an integer) and Grover’s [2] (search through
unsorted database) algorithms. These algorithms provide an exponential or
polynomial speed up to the best known classical algorithms, a result that
holds true even today.111Even though this is a common knowledge in the field,
technically speaking, the best known classical algorithm Number Field Sieve
has a subexponential runtime [11], which implies a superpolynominal speed up
for Shor’s algorithm.

####  II-A2 Principles of QC

How is computation on a QC different from the computation on the classical
machine? In a QC, the primary unit of information is a quantum bit (qubit)
$\ket{\psi}$, which can exist in a superposition of two states $\ket{0}$ and
$\ket{1}$ simultaneously:

$\ket{\psi}=\psi_{1}\ket{0}+\psi_{2}\ket{1}.$ (1)

This qubit represents a quantum state that exists in a complex vector space
called Hilbert space with dimensionality of $2^{n}$, where $n$ is the number
of qubits. Unlike classical bits that are strictly 0 or 1, qubits allow
quantum computers to inherently parallelize computations. However, to obtain a
classical output from a quantum computation, qubits are measured (wave
function collapse), which outputs $0$ with a probability ${|\psi_{1}|}^{2}$
and $1$ with a probability ${|\psi_{2}|}^{2}$. In contrast to a classical
computation, where binary operations are performed in a sequence to arrive to
a solution of a complex tasks, quantum computation happens before wave
function collapses during which we can employ different quantum phenomena
(etc. entranglement, inteference) to manipulate the quantum state of the qubit
to e.g. maximize the probability of the solution. These manipulations are
performed by applying a series of quantum gates, which are described by
unitary matrices $U$ (their complex conjugate $U^{\dagger}$ is their inverse
$U^{\dagger}U=I$). The unitarity of these operations is important as it
preserves the inner product between vectors [10]. With quantum gates we can
perform a variety of operations, e.g. performing to a simple NOT operation
with a quantum X gate (e.g. $\ket{0}\to\ket{1}$), creating superposition state
with quantum Hadamard gate, entangling two qubits together with a quantum
controlled NOT (CNOT) gate.

####  II-A3 State-of-the-art

Grover’s and Shor’s algorithms impose certain requirements on the hardware,
such as fault-tolerance, which are not yet possible. Therefore, many research
efforts today are dedicated to looking for applications that can leverage QCs
of NISQ era. One the big recent breakthroughs was done in 2019 [12], which
claimed quantum supremacy on a 63-qubits Google Sycamore superconducting chip.
As of today, we have superconducting machines with 433 physical qubits with
1k-qubit machines coming in the near future [13]. These machine have different
hardware architectures, ones of the most popular on the market being
superconducting chips (due to their similarity to classical architectural
designs) and ion traps (which unlike superconducting QCs can operate at a room
temperature).

###  II-B Introduction to Quantum Machine Learning

Machine learning promises to be one of the earliest application fields to
benefit from early adaptation of QC. Many approaches have already been
proposed varying from operating on hard datasets consisting of quantum data,
such as molecular states [14] and phases of matter [15], to quantum-inspired
fully-classical approaches [16]. In this work, we concentrate on a particular
subfield of QML that is sometimes referred to as quantum-assisted ML. This
subfield develops technique to hybridize classical ML with quantum algorithms.
In this case, quantum algorithms are often represented as Parametrized Quantum
Circuits (PQC) [17] that are parameterized by classical parameters, which can
be tuned by classical methods during the training process. PCQs can be
implemented as a stand-alone quantum model, or be a part for a hybrid quantum-
classical architecture which is a preferred approach in the field for
implementing more complex and bigger QML models.

####  II-B1 Data encoding feature map

A quantum encoding transforms classical data into quantum states within a
Hilbert space. This transformation is akin to a feature map and plays a
significant role in determining their computational strength [18, 19]. To
incorporate classical data into a quantum system there are several encoding
strategies available, a few of which are briefly outlined here.

One of the most basic embeddings $\Phi(x)$ is amplitude embedding. With this
embedding we encode a $2^{N}$-dimensional input into $N$-dimensional
(logarithmically compact) quantum state as follows:

$\Phi(\mathbf{x}):\mathbf{x}\in\mathbb{R}^{2^{N}}\to\ket{\psi(\mathbf{x})}=\sum_{i}^{2^{N}}\psi_{i}(x_{i})\ket{i},$
(2)

where $\sum_{i}|\psi_{i}(x_{i})|^{2}=1$. This feature map resembles a linear
kernel [18]. Another popular embedding for QML models due to its hardware-
efficiency is angle embedding. This embedding resembles a cosine kernel and
encodes $N$-dimensional input into $N$-dimensional quantum states as follows:

$\Phi(\mathbf{x}):\mathbf{x}\in\mathbb{R}^{N}\to\ket{\psi(\mathbf{x})}=\prod_{k=1}^{n}(sin(x_{k})\ket{0}+\cos(x_{k})\ket{1}).$
(3)

####  II-B2 Model zoo

Binary classifier algorithms are a stepping-stone for a plethora of different
models. A quantum binary classifier consists of a PQC that can either accept
quantum data as its input e.g. [20, 15] or encode classical data into a
quantum state e.g. [21, 22, 23]. The parameters of the PQC can be classically
tuned to elicit a desired behaviour of the model. The output of the quantum
classifier can be a single measure of an output qubit, which will output a
correct class with a high enough probability, alternatively a more common
approach is to perform multiple measurements to compute an expectation value
of a qubit, which can then be binarized, e.g. in [23].

An immense success of NNs in classical ML, provided the motivation for a
similar line of research within QML community. PQC’s organised in a layer-wise
fashion (inspired by classical feedforward architecture) have been coined
quantum NNs (QNNs). The QNN structure has many realizations depending on type
of data and context similar to quantum classifiers described above. QNNs have
been shown to have higher capacity than their classical counterparts in a
certain experimental setup [24]. Other approaches that were inspired by more
complex classical architectures, such as quantum convolutional
(quanvolutional) neural networks, have also shown promising results [25].

Many other ML pillars have been successfully ported to QML realm, e.g. quantum
reinforcement learning [8, 26], quantum generative adversarial networks [14,
27], quantum Boltzmann machines [28, 29], quantum kernel methods [30].

####  II-B3 Hardware noise

In quantum computing, noise denotes unwanted disturbances in quantum states
that might result in computational errors, arising from environmental
interactions, quantum gate inaccuracies, or fabrication flaws. Viewing noise
as an intentional adversarial act in quantum devices means deliberately
harnessing or exploiting these disturbances to disrupt quantum computation
results, much like fault-injections in classical computing mislead machine
learning models.

Examples of adversarial quantum noise include bit-flip and phase-flip errors,
which alter qubit states or their relative phases; depolarization, making all
qubit outcomes equally probable; decoherence, destroying quantum interference;
control errors from quantum gate inaccuracies; measurement errors that misread
qubits; cross-talk errors, where qubit operations unintentionally influence
another, including between different circuits on the same hardware;
manipulation of shuttle operations for Ion trap devices, where ions are
physically shuttled from one ion trap to another; and physical disruptions
like temperature changes or stray fields. Recognizing noise as a potential
adversarial manipulation deepens the challenge of ensuring quantum system
security. Consequently, quantum information scientists are rigorously
investigating methods to identify and counter such adversarial noise, aiming
to bolster the reliability and security of quantum computations.

##  III Research Methodology

Figure 1: Documentation of search process, adapted from [31] [31]

In order to prevent information bias, a broad and systematic driven search of
academic bibliographic data sources was conducted using the PRISMA [31]
framework as an underlying guideline. The literature review process was
performed by utilizing two search methods executed in the following order and
depicted in Figure 1:

  * (1)

Execution of the systematic part using the academic bibliographic data sources
as depicted in Table I with the search terms as depicted in Table II.

  * (2)

A narrative part that was driven by snowballing through the reference list of
selected literature in part (1).

While the bibliography files for most sources could be obtained via API or web
site scraping automatically, search on the arXiv had to be performed manually
in a heuristic manner due to the lack of an API and the sheer volume of items,
severely restricting the scraping ability.

TABLE I: Overview of sources for literature research

Databases Journals Conferences Arxiv IEEE QTML WebOfScience Springer Journals
IEEE Quantum Week Elsevier Physical Review A/B ATVA Physical Review Letters
ASPLOS Physical Applied ISPLED ACM Transactions on Quantum Computing ICML/ICLR
Nature NeurIPS

TABLE II: Overview of search terms leading to inclusion into the candidate
list

Secur* Quantum Vulnerabil* Robust* Threat Inject* Poison* Backdoor Privacy
Defens* Confidential* Encrypt* Model stealing Model reconstruction Crosstalk
Fault injection Encoding Adversarial attack Verificat* Adversarial training
Readout sensing Attack Malicious Certificat* Shadow training

TABLE III: Overview of search terms leading to exclusion from the candidate
list

Cryptography Key Distribution Key Exchange Encryption Random Number Generator
Quantum Communication Signcryption Signature Post-Quantum Blockchain Quantum
key Cryptanalysis

TABLE IV: Most important terminology for algorithmic scoring Quantum | Machine Learning | Secur* | Attack
---|---|---|---

For the selection of literature, we included journal and conference papers
that specifically addressed the use of quantum computing in the area of
machine learning, with a particular focus on the security aspects and
potential attack vectors of these applications. Additionally, these papers
were required to be written in English. On the other hand, we excluded several
types of papers: those that merely used our search terms but did not directly
relate to QML (detailed in Table III), those not available in electronic
format, inaccessible papers, and papers that primarily focused on topics such
as communication, key distribution, and blockchain.

###  III-A Filtering & Scoring

Upon execution of the systematic search as depicted above $4\,658$ records
were identified. In these, $142$ duplicates were identified and removed.
Further, records before year 2018 were removed ($1\,193$) and records marked
as ineligible by the automation tool amounting to $2\,323$ records were
removed. After their removal, $1\,000$ records were left before the screening
phase.

The automation tool used the title and abstract for each record inputs to
compute a score of relevance. First, it assigns a score to each query of Table
II. Since the list is roughly sorted from general to specific, the score
equals first twice the position of the term in the list as a hit (e.g. Secur*
-> 2, Quantum 4, …). These points are each doubled when the term is paired
with Quantum. Finally, we add another 200 points if one of the combinations of
terms depicted in Table IV was identified or deduct 300 points if any of the
search terms depicted in Table III appear. The penalties were set iteratively
through repeated manual analysis of the Top 50 results given a set of
penalties.

In total, $1\,000$ records remained for the screening phase. Of these we
excluded $911$ because of exclusion criteria listed above. The remaining $92$
records were screened taking title and abstract for eligibility leaving $25$
records that were included in the review with addition $7$ records retrieved
from references of the full-text screened records. Additionally, we excluded
the literature that required the physical manipulation of the hardware or
attack strategies that had a direct classical analogue $9$, but added
additional $4$ more in-depth theoretical papers from discarded works that
resurfaces during the writing of this work. In total $27$ records are included
in the literature research results.

##  IV Quantum Vulnerabilities

Here, we compile vulnerabilities and attack vectors that are unique for QML
models and discuss possible mitigation strategies. This topic is subdivided
into two parts as follows:

  1. 1.

Quantum attack vectors describe a way to exploit specificities of QML models
to craft an attack that has no classical analog.

  2. 2.

Scaling pitfall characterizes a trait of larger quantum classifiers that might
introduce a trade-off between system security and quantum advantage.

These vulnerabilities pose a new challenge for secure utilization of QML
methods.

###  IV-A Quantum attack vectors

In this section, we review attack vectors of QML models, encompassing those
without direct classical analogues. One of the most prominent types of this
kind of attacks are fault injections, which we review in detail below.

####  IV-A1 Targeting quantum encoding feature map

A quantum Trojan virus can function as a backdoor access to a QNN architecture
that would allow for targeted gate injection as indicated by [32]. This work
showed that when the virus is dormant, the model will achieve the same
performance as in its unaltered state making compromised model hard to detect.
However, when the virus is activated introducing perturbation of an encoding
feature map, it leads to nearly 100% attack success rate. The authors hinted
that classical methods against Trojan infiltration might be a viable defense
in this case, however, it requires further investigation.

####  IV-A2 Exploiting quantum noise

In a co-tenancy setting, where multiple users simultaneously execute quantum
programs on the same machine, an attacker can craft a program that would
induce hardware-dependent errors which could lead to the degradation of
performance of quantum models or induce denial-of-service (DoS) attack. In
case of superconducting systems, an attacker can induce cross-talk between
quantum circuits [33], while, in case of ion-trap systems, an attacker can
induce repeated shuttle operations [34] on shared qubits - both of which
decrease the reliability of quantum circuits. Moreover, perpetrator can
exploit correlating read-out errors to perform an information leakage attack
[33].

We can tackle these issues head on by isolating user programs by introducing
buffering / padding qubits [35, 34] or by introducing circuit-pattern
recognition methods into quantum clouds to spot error inducing circuits [36].
Another approach is to borrow the methodologies designed for increasing the
reliability of QML during inference. Quantum hardware vendors periodically re-
calibrate their devices, which means executing identical PQCs on the same
hardware at different times might yield erratic results [37]. A few mitigation
techniques have been proposed in the literature, e.g. embodying noise into the
training loop of a PQCs [37, 34] or by exploiting just-in-time compilation
technique [38, 35].

###  IV-B Scaling Pitfall

We expect to attain quantum advantage with bigger quantum systems that span
higher dimensional quantum Hilbert spaces. However, as the dimensions grows,
sensitivity of a quantum classifier to minor perturbations near the decision
boundary increases, making quantum classification vulnerable and demanding
more resources for verification as shown by [20]. This sensitivity demands an
exponential increase in resources to verify security, potentially offsetting
quantum advantages. Similarly, [39] indicated the existence of universal
adversarial perturbations in higher dimensions, meaning a minor adversarial
perturbation of the input is sufficient to pose a moderate risk to a whole set
of quantum classifiers. Drawing from the quantum no-free-lunch theorem [40],
they noted that this risk increases exponentially with the classifier’s qubit
count. Their findings emphasize the need to address adversarial threats in
quantum data classification and call for experimental validations beyond the
theoretical study.

##  V Quantum defenses

Here, we summarize available defenses to attacks on QML models. In this
context, several defenses are emerging to counter potential threats, which we
collect under three main areas: adversarial training, differential privacy and
formal verification.

  1. 1.

Adversarial training enhances quantum models by exposing them to deliberately
crafted malicious inputs, thereby improving resilience.

  2. 2.

Differential privacy offers a probabilistic approach that introduces noise to
the data to achieve more resilient predictions.

  3. 3.

Formal verification refers to the process of rigorously proving the
correctness of quantum algorithms and models using mathematical methods.

Together, these strategies are forging a secure path forward for QML
applications.

###  V-A Adversarial Training

One main practice in adversarial ML is to train the model with adversarial
attacks, enhancing its robustness against such threats. Adversarial attacks
manipulate inputs to maximize model errors, often in ways imperceptible to
humans. Common classical approaches are: (i) Fast Gradient Sign Method (FGSM)
[41] a straightforward method that perturbs inputs using the sign of the
gradient to maximize model error, (ii) Basic Iterative Method (BIM) [42] an
enhanced FGSM that iteratively applies perturbations, (iii) Projected Gradient
Descent (PGD) [43] an iterative method that ensures adversarial examples stay
within a valid, imperceptible range, (iv) Momentum Iterative Method (MIM) [44]
which incorporates momentum to enhance the attack by evading local maxima.

####  V-A1 Classical techniques adapted to QML

Early research by [15] highlighted the susceptibilities of QML to established
adversarial attacks like PGD [43], FGSM [41], MIM [44] and BIM [42]. The study
revealed that quantum classifiers on both classical and quantum data can fall
victim to adversarial tactics, much like traditional classifiers. However,
employing adversarial training can bolster their defenses considerably.
Similarly, [23] highlighted that adversarial training enhances the resilience
of variational quantum classifiers on a superconducting QC. Using classical
optimization in a white-box setting, they produced adversarial examples that
led to misclassifications. When these samples were integrated into the
training process, the classifiers successfully resisted adversarial attacks.

####  V-A2 Techniques for enhanced quantum adversarial robustness

Another line of research explores the foundational principles and techniques
for enhancing the robustness of quantum systems against adversarial threats.
In particular, [45] investigate the concept of attack transferability, where
adversarial samples from one network are used to attack similar networks.
Interestingly, quantum variational circuits appear more resistant to these
transferred attacks compared to classical networks. This suggests that quantum
classifiers might capture more robust data features than classical methods.
Additionally, while adversarial training can enhance resilience, its benefits
are reduced for quantum classifiers that are already somewhat resistant. In
the end, the study proposes that as quantum classifiers scale up, they may
outperform classical ones not just in performance but also in robustness,
identifying robustness as a potential key strength of quantum classifiers.

Recently, [46] presented a quantum adversarial metric learning approach that
efficiently computes the triplet loss function, conserving quantum resources.
They craft a technique for generating adversarial samples via quantum gradient
ascent, mirroring the classical approach seen in [23]. Using these samples in
simulated adversarial training, they found improved resilience against
adversarial attacks.

Another approach was introduced by [47], in which the authors proposed a
random unitary encodings strategy that showed a notable increase in the
adversarial robustness of a quantum classifier. This work offers a rigorous
proof and empirical evidence of the resilience of this method against white-
box and black-box adversarial attacks.

####  V-A3 Resilient architectures

Studies highlighted the resilience of quantum-enhanced architectures in facing
adversarial attacks. Specifically, [29] demonstrated the superior robustness
of Restricted Boltzmann Machines (RBMs) against adversarial attacks,
particularly when compared to conventional neural networks. Their research
further introduced quantum-enhanced RBMs, achieving either comparable or
marginally superior results on a scaled-down MNIST dataset [48]. Similarly,
[25] investigated the benefits of incorporating quantum layers into neural
networks. Their findings indicate heightened accuracy and improved resilience
against adversarial threats, with particular emphasis on the effectiveness of
quanvolutional layers. On a parallel note, [49] developed a deep learning
model enriched with quantum computing methodologies, specifically tailored to
detect and combat botnet Domain Generation Algorithm (DGA) threats in
contemporary 5G environments, emphasizing the role of adversarial training in
bolstering system robustness.

###  V-B Data Privacy

The importance of safeguarding sensitive training datasets has become more
imperative in the last years as more and more companies are reporting data
breaches. Many ways to ensure privacy of the data have been proposed in both
ML and QML communities.

####  V-B1 Differential Privacy

Differential privacy is a pioneering privacy framework tailored to protect
individual data within datasets. Introduced by [50], this mechanism adds
controlled noise to computations, allowing models to generalize without
compromising privacy. In the context of ML, it ensures that a model, trained
on a dataset, does not inadvertently reveal sensitive information about any
single data point and maintains stable predictions [51].

[21] conducted the first theoretical study on how quantum rotation noise,
analogous to classical randomized smoothing [52], boosts the resilience of
quantum classifiers against adversarial attacks. Using the quantum
differential privacy framework from [53], they proved that a quantum
classifier’s privacy level inversely relates to the noise level. Their
research revealed that increasing rotation noise during training directly
increases the classifier’s robustness. In a similar work, [54] delve into the
link between Quantum Hypothesis Testing (QHT) and a quantum classifier’s
robustness against unanticipated noise, establishing a vital robustness
criterion. Their work provides certification protocols for optimal robustness,
methods to validate classification results amidst noise, and robustness
conditions for different noise types, all articulated using QHT terminology.
They also hint at an interesting balance between accuracy and robustness in
quantum classification.

[55] showed that adding depolarization noise to quantum circuits used for
classification can improve their resilience against adversarial attacks,
introducing a concept akin to quantum differential privacy. This enhanced
robustness is primarily influenced by the number of classes and not the
specific classification model, suggesting a potential edge for quantum over
classical models.

Lastly, [22] scrutinize the robustness across random pure states and contrasts
it with their prior error-region robustness work. They assert that
vulnerabilities’ real-world implications are constrained since adversarial
risk should consider a subset of relevant states. They also suggest a
technique for gauging the resilience of quantum classifiers with states
derived from a Gaussian latent space, finding the robustness declines only
marginally with increasing encoded qubits.

####  V-B2 Inherent Privacy

In a new line of research, [56] investigates properties of overparametrized
QML models with highly-expressive (in terms of Fourier frequency spectrum
[57]) encoding that provide an inherent protection against gradient inversion
attacks. The authors examined these models in the context of a federated
learning setup, which is a distributed approach to train NNs without the need
to share sensitive data with an aggregator. They showed theoretical results
backed by empirical evidence that the perpetrator encountered a considerable
challenge when attempting to craft an attack on these models due to its
complexity. Overparameterization of the trainable PQC ensures a training
process that is free of spurious local minima issue.

###  V-C Formal Verification

To defend against unidentified adversaries, it is essential to formally ensure
robustness in worst-case scenarios, which often differ from typical known
noise sources like depolarization noise. [58] suggest that quantum adversarial
robustness hinges on two key conditions: having a generative model to capture
sample distributions and a classifier resilient to data distribution shifts.
Meeting these conditions, we can guarantee robustness. Using a prover/verifier
quantum model, they explore protocols ensuring adversarial robustness for
various classifiers, including quantum and classical ones. The study uncovers
links between certifiable randomness, generative models, robustness, and
cryptographic protocols, prompting questions about applying these findings in
real-world defenses against adversarial attacks.

Leveraging Semi-definite programming, [59, 60] derived an analytical measure
for robustness that can be expediently calculated, offering a practical
underestimation of robust accuracy. Additionally, they formulated a
verification algorithm to precisely confirm the $\epsilon$-robustness of QML
models, presenting valuable counter-examples beneficial for adversarial
training. In a subsequent study, [61] introduce a framework for assessing
fairness in QML decision models. By leveraging the trace distance to measure
data similarity, they link the fairness verification process to distinguishing
quantum measurements. Interestingly, they also uncover that quantum noise can
potentially enhance model fairness.

##  VI Conclusions

QML models have unique security challenges that need to be addressed before
they can safely be deployed into production environments. A malicious actor
could compromise the architectural integrity or manipulate and utilize
inherent noise in a way that is both damaging and difficult to detect. Some
defense mechanisms have been proposed in literature, but require further
empirical studies to determine their reliability and effectiveness.

On the other hand, quantum models are showing resilience against classical
attack vectors. This strength can be attributed to multiple factors: (i)
successful adaptation of both classical and quantum techniques for adversarial
training of QML models; (ii) inherent resilience of certain architecture, such
as quanvolutional networks and quantum-enchanced RBMs, towards adversarial
attacks; (iii) utilization noise inherent to the devices to boost differential
privacy; or (iv) employ models that inherently protect sensitive data from
gradient inverse attacks.

## References

  * [1] Peter W Shor  “Algorithms for quantum computation: discrete logarithms and factoring”  In _Proceedings 35th annual symposium on foundations of computer science_ , 1994, pp. 124–134  Ieee
  * [2] Lov K Grover  “A fast quantum mechanical algorithm for database search”  In _Proceedings of the twenty-eighth annual ACM symposium on Theory of computing_ , 1996, pp. 212–219
  * [3] John Preskill  “Quantum computing in the NISQ era and beyond”  In _Quantum_ 2 Verein zur Förderung des Open Access Publizierens in den Quantenwissenschaften, 2018, pp. 79
  * [4] Seth Lloyd, Masoud Mohseni and Patrick Rebentrost  “Quantum principal component analysis”  In _Nature Physics_ 10.9 Nature Publishing Group UK London, 2014, pp. 631–633
  * [5] Maria Schuld, Ilya Sinayskiy and Francesco Petruccione  “An introduction to quantum machine learning”  In _Contemporary Physics_ 56.2 Taylor & Francis, 2015, pp. 172–185
  * [6] Jacob Biamonte et al.  “Quantum machine learning”  In _Nature_ 549.7671 Nature Publishing Group UK London, 2017, pp. 195–202
  * [7] Nathan Wiebe, Ashish Kapoor and Krysta M Svore  “Quantum deep learning”  In _arXiv preprint arXiv:1412.3489_ , 2014
  * [8] Daoyi Dong, Chunlin Chen, Hanxiong Li and Tzyh-Jong Tarn  “Quantum reinforcement learning”  In _IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics)_ 38.5 IEEE, 2008, pp. 1207–1220
  * [9] Satwik Kundu and Swaroop Ghosh  “Security Aspects of Quantum Machine Learning: Opportunities, Threats and Defenses”  In _Proceedings of the Great Lakes Symposium on VLSI 2022_ , GLSVLSI ’22  Irvine, CA, USA: Association for Computing Machinery, 2022, pp. 463–468  DOI: 10.1145/3526241.3530833
  * [10] Michael A Nielsen and Isaac L Chuang  “Quantum computation and quantum information”  Cambridge University Press
  * [11] Richard Crandall and Carl Pomerance  “Subexponential Factoring Algorithms”  In _Prime Numbers: A Computational Perspective_ New York, NY: Springer New York, 2001, pp. 227–283  DOI: 10.1007/978-1-4684-9316-0_6
  * [12] Frank Arute et al.  “Quantum supremacy using a programmable superconducting processor”  In _Nature_ 574.7779 Springer ScienceBusiness Media LLC, 2019, pp. 505–510  DOI: 10.1038/s41586-019-1666-5
  * [13] IBM Quantum  “The IBM Quantum Development Roadmap”, 2022  URL: https://www.ibm.com/quantum/roadmap
  * [14] Pierre-Luc Dallaire-Demers and Nathan Killoran  “Quantum generative adversarial networks”  In _Physical Review A_ 98.1 American Physical Society (APS), 2018  DOI: 10.1103/physreva.98.012324
  * [15] Sirui Lu, Lu-Ming Duan and Dong-Ling Deng  “Quantum adversarial machine learning”  In _Physical Review Research_ 2.3 APS, 2020, pp. 033212
  * [16] Sirui Lu, Márton Kanász-Nagy, Ivan Kukuljan and J. Cirac  “Tensor networks and efficient descriptions of classical data”, 2021  arXiv:2103.06872 [quant-ph]
  * [17] Marcello Benedetti, Erika Lloyd, Stefan Sack and Mattia Fiorentini  “Parameterized quantum circuits as machine learning models”  In _Quantum Science and Technology_ 4.4 IOP Publishing, 2019, pp. 043001  DOI: 10.1088/2058-9565/ab4eb5
  * [18] Maria Schuld and Nathan Killoran  “Quantum Machine Learning in Feature Hilbert Spaces”  In _Physical Review Letters_ 122.4 American Physical Society (APS), 2019  DOI: 10.1103/physrevlett.122.040504
  * [19] Maria Schuld and Francesco Petruccione  “Supervised learning with quantum computers”  Springer
  * [20] Nana Liu and Peter Wittek  “Vulnerability of quantum classification to adversarial perturbations”  In _Physical Review A_ 101.6 APS, 2020, pp. 062331
  * [21] Jhih-Cing Huang et al.  “Certified Robustness of Quantum Classifiers against Adversarial Examples through Quantum Noise”, 2023  arXiv:2211.00887 [quant-ph]
  * [22] Haoran Liao, Ian Convy, William J Huggins and K Birgitta Whaley  “Robust in practice: Adversarial attacks on quantum machine learning”  In _Physical Review A_ 103.4 APS, 2021, pp. 042427
  * [23] Wenhui Ren et al.  “Experimental quantum adversarial learning with programmable superconducting qubits”  In _Nature Computational Science_ 2.11 Springer ScienceBusiness Media LLC, 2022, pp. 711–717  DOI: 10.1038/s43588-022-00351-9
  * [24] Amira Abbas et al.  “The power of quantum neural networks”  In _Nature Computational Science_ 1.6 Springer ScienceBusiness Media LLC, 2021, pp. 403–409  DOI: 10.1038/s43588-021-00084-1
  * [25] Korn Sooksatra, Pablo Rivas and Javier Orduz  “Evaluating accuracy and adversarial robustness of quanvolutional neural networks”  In _2021 International Conference on Computational Science and Computational Intelligence (CSCI)_ , 2021, pp. 152–157  IEEE
  * [26] Andrea Skolik et al.  “Robustness of quantum reinforcement learning under hardware errors”  In _EPJ Quantum Technology_ 10.1 SpringerOpen, 2023, pp. 1–43
  * [27] Manuel S. Rudolph et al.  “Generation of High-Resolution Handwritten Digits with an Ion-Trap Quantum Computer”, 2022  arXiv:2012.03924 [quant-ph]
  * [28] Christa Zoufal, Aurélien Lucchi and Stefan Woerner  “Variational quantum Boltzmann machines”  In _Quantum Machine Intelligence_ 3.1 Springer ScienceBusiness Media LLC, 2021  DOI: 10.1007/s42484-020-00033-7
  * [29] Aidan Kehoe, Peter Wittek, Yanbo Xue and Alejandro Pozas-Kerstjens  “Defence against adversarial attacks using classical and quantum-enhanced Boltzmann machines”  In _Machine Learning: Science and Technology_ 2.4 IOP Publishing, 2021, pp. 045006
  * [30] Hsin-Yuan Huang et al.  “Power of data in quantum machine learning”  In _Nature Communications_ 12.1 Springer ScienceBusiness Media LLC, 2021  DOI: 10.1038/s41467-021-22539-9
  * [31] LA Kahale et al.  “Extension of the PRISMA 2020 statement for living systematic reviews (LSRs): protocol [version 2; peer review: 1 approved]”  In _F1000Research_ 11.109, 2022  DOI: 10.12688/f1000research.75449.2
  * [32] Cheng Chu, Lei Jiang, Martin Swany and Fan Chen  “QTROJAN: A Circuit Backdoor Against Quantum Neural Networks”  In _ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , 2023, pp. 1–5  IEEE
  * [33] Abdullah Ash Saki, Mahabubul Alam and Swaroop Ghosh  “Impact of noise on the resilience and the security of quantum computing”  In _2021 22nd International Symposium on Quality Electronic Design (ISQED)_ , 2021, pp. 186–191  IEEE
  * [34] Abdullah Ash Saki, Rasit Onur Topaloglu and Swaroop Ghosh  “Shuttle-Exploiting Attacks and Their Defenses in Trapped-Ion Quantum Computers”, 2021  arXiv:2108.01054 [quant-ph]
  * [35] Mehdi Sadi et al.  “Special Session: On the Reliability of Conventional and Quantum Neural Network Hardware”  In _2022 IEEE 40th VLSI Test Symposium (VTS)_ , 2022, pp. 1–12  DOI: 10.1109/VTS52500.2021.9794194
  * [36] Sanjay Deshpande et al.  “Towards an Antivirus for Quantum Computers”  In _2022 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)_ 13, 2023, pp. 37–40  DOI: 10.1109/HOST54066.2022.9840181
  * [37] Mahabubul Alam, Abdullah Ash-Saki and Swaroop Ghosh  “Addressing Temporal Variations in Qubit Quality Metrics for Parameterized Quantum Circuits”  In _2019 IEEE/ACM International Symposium on Low Power Electronics and Design (ISLPED)_ , 2019, pp. 1–6  DOI: 10.1109/ISLPED.2019.8824907
  * [38] Ellis Wilson, Sudhakar Singh and Frank Mueller  “Just-in-time Quantum Circuit Transpilation Reduces Noise”, 2020  arXiv:2005.12820 [quant-ph]
  * [39] Weiyuan Gong and Dong-Ling Deng  “Universal adversarial examples and perturbations for quantum classifiers”  In _National Science Review_ 9.6 Oxford University Press, 2022, pp. nwab130
  * [40] Kyle Poland, Kerstin Beer and Tobias J Osborne  “No free lunch for quantum machine learning”  In _arXiv preprint arXiv:2003.14103_ , 2020
  * [41] Ian Goodfellow, Jonathon Shlens and Christian Szegedy  “Explaining and Harnessing Adversarial Examples”  In _International Conference on Learning Representations_ , 2015  URL: http://arxiv.org/abs/1412.6572
  * [42] Alexey Kurakin, Ian J Goodfellow and Samy Bengio  “Adversarial examples in the physical world”  In _Artificial intelligence safety and security_ ChapmanHall/CRC, 2018, pp. 99–112
  * [43] Aleksander Madry et al.  “Towards Deep Learning Models Resistant to Adversarial Attacks”  In _International Conference on Learning Representations_ , 2018  URL: https://openreview.net/forum?id=rJzIBfZAb
  * [44] Yinpeng Dong et al.  “Boosting adversarial attacks with momentum”  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 2018, pp. 9185–9193
  * [45] Maxwell T. West et al.  “Benchmarking adversarially robust quantum machine learning at scale”  In _Physical Review Research_ 5.2 American Physical Society (APS), 2023  DOI: 10.1103/physrevresearch.5.023186
  * [46] Yan-Yan Hou, Jian Li, Xiu-Bo Chen and Chong-Qiang Ye  “Quantum adversarial metric learning model based on triplet loss function”, 2023  arXiv:2303.08293 [quant-ph]
  * [47] Weiyuan Gong, Dong Yuan, Weikang Li and Dong-Ling Deng  “Enhancing Quantum Adversarial Robustness by Randomized Encodings”, 2022  arXiv:2212.02531 [quant-ph]
  * [48] Yann LeCun and Corinna Cortes  “MNIST handwritten digit database”, http://yann.lecun.com/exdb/mnist/, 2010  URL: http://yann.lecun.com/exdb/mnist/
  * [49] Hatma Suryotrisongko, Yasuo Musashi, Akio Tsuneda and Kenichi Sugitani  “Adversarial robustness in hybrid quantum-classical deep learning for botnet dga detection”  In _Journal of Information Processing_ 30 Information Processing Society of Japan, 2022, pp. 636–644
  * [50] Cynthia Dwork  “Differential privacy”  In _International colloquium on automata, languages, and programming_ , 2006, pp. 1–12  Springer
  * [51] Martin Abadi et al.  “Deep learning with differential privacy”  In _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_ , 2016, pp. 308–318
  * [52] Jeremy Cohen, Elan Rosenfeld and Zico Kolter  “Certified adversarial robustness via randomized smoothing”  In _international conference on machine learning_ , 2019, pp. 1310–1320  PMLR
  * [53] L. Zhou and M. Ying  “Differential privacy in quantum computation”  In _2017 IEEE 30th Computer Security Foundations Symposium (CSF)_ IEEE, 2017, pp. 249–262
  * [54] Maurice Weber et al.  “Optimal provable robustness of quantum classification via quantum hypothesis testing”  In _npj Quantum Information_ 7.1 Springer ScienceBusiness Media LLC, 2021  DOI: 10.1038/s41534-021-00410-5
  * [55] Yuxuan Du et al.  “Quantum noise protects quantum classifiers against adversaries”  In _Physical Review Research_ 3.2 APS, 2021, pp. 023153
  * [56] Niraj Kumar et al.  “Expressive variational quantum circuits provide inherent privacy in federated learning”, 2023  arXiv:2309.13002 [quant-ph]
  * [57] Maria Schuld, Ryan Sweke and Johannes Jakob Meyer  “Effect of data encoding on the expressive power of variational quantum-machine-learning models”  In _Physical Review A_ 103.3 American Physical Society (APS), 2021  DOI: 10.1103/physreva.103.032430
  * [58] Khashayar Barooti, Grzegorz Głuch and Ruediger Urbanke  “Provable Adversarial Robustness in the Quantum Model”, 2021  arXiv:2112.09625 [quant-ph]
  * [59] Ji Guan, Wang Fang and Mingsheng Ying  “Robustness Verification of Quantum Machine Learning.”  In _CoRR_ , 2020
  * [60] Ji Guan, Wang Fang and Mingsheng Ying  “Robustness verification of quantum classifiers”  In _Computer Aided Verification: 33rd International Conference, CAV 2021, Virtual Event, July 20–23, 2021, Proceedings, Part I 33_ , 2021, pp. 151–174  Springer
  * [61] Ji Guan, Wang Fang and Mingsheng Ying  “Verifying Fairness in Quantum Machine Learning”  In _International Conference on Computer Aided Verification_ , 2022, pp. 408–429  Springer


# Supplementary Material for “Bulk-Edge Correspondence Recovered in
Incompressible Continuous Media”

Yohei Onuki email<EMAIL_ADDRESS>Research Institute for Applied
Mechanics, Kyushu University, 6-1 Kasuga-koen, Kasuga, Fukuoka, Japan  Antoine
Venaille  ENS de Lyon, CNRS, Laboratoire de Physique UMR5672, F-69342 Lyon,
France  Pierre Delplace  ENS de Lyon, CNRS, Laboratoire de Physique UMR5672,
F-69342 Lyon, France

##  1 Derivation of the model equations

The aim of this section is to show how the fluid system investigated in this
letter can be recast on the Schrödinger-like form

${\rm i}\partial_{t}\bm{\psi}=\mathcal{H}\bm{\psi},$

with $\mathcal{H}$ a Hermitian operator with respect to a norm that will be
introduced below.

A basic equation system for rotating and stratified fluid flows under the
Boussinesq approximation is found in standard textbooks of geophysical fluid
dynamics. For example, Eq. (2.108) of [1] provides

$\displaystyle\frac{D\bm{u}}{Dt}+2\bm{\Omega}\times\bm{u}$
$\displaystyle=b\hat{\bm{z}}-\nabla p$ $\displaystyle\nabla\cdot\bm{u}$
$\displaystyle=0$ $\displaystyle\frac{Db}{Dt}$ $\displaystyle=0,$

where symbols of velocity, pressure, and the unit vector pointing upwards are
changed from those in the original text to $\bm{u}=(u,v,w)$, $p$, and
$\hat{\bm{z}}$, respectively. Now, we shall make the following three
postulates.

  1. 1.

Linear background stratification: there exists a motionless reference state
where buoyancy $b$ is a linear increasing function on the vertical axis, $z$,
and the pressure gradient is balanced with the buoyancy force. We then
consider motion of disturbances superimposed on this reference state. The
solutions are accordingly represented as

$\displaystyle\bm{u}=\bm{u}^{\prime},\quad b=N^{2}z+b^{\prime},\quad
p=\frac{N^{2}z^{2}}{2}+p^{\prime}.$

  2. 2.

Linearization of equations: disturbance components denoted with primes are
sufficiently small, so that the material derivatives are approximated as
$D\bm{u}/Dt\sim\partial_{t}\bm{u}^{\prime}$ and
$Db/Dt\sim\partial_{t}b^{\prime}+N^{2}w^{\prime}$.

  3. 3.

Traditional approximation: the angular velocity $\bm{\Omega}$ in the Coriolis
acceleration term is approximated by its vertical component, which is
conventionally represented as $(f/2)\hat{\bm{z}}$.

Finally, rescaling the buoyancy perturbation as

$b^{\prime}=N\theta^{\prime}$ (S1)

and dropping the primes on unknown variables, we obtain the model equations,

$\displaystyle\partial_{t}\bm{u}$
$\displaystyle=-f\hat{\bm{z}}\times\bm{u}+N\theta\hat{\bm{z}}-\nabla p$
$\displaystyle\partial_{t}\theta$ $\displaystyle=-Nw$

with the divergence-free constraint $\nabla\cdot\bm{u}=0$. This set of
equations is referred to as Eq. (1) in the paper.

### Extended model equations

Introducing the auxiliary field allows us to define an extended velocity
vector, $\tilde{\bm{u}}=(\tilde{u},\tilde{v},\tilde{w})=\bm{u}+\nabla\phi$.
The governing equations Eq. (1) then transforms into a set of prognostic and
diagnostic equations,

$\displaystyle\partial_{t}\tilde{\bm{u}}$
$\displaystyle=-f\hat{\bm{z}}\times(\tilde{\bm{u}}-\nabla\phi)+N\theta\hat{\bm{z}}-\nabla
p$ $\displaystyle\partial_{t}\theta$
$\displaystyle=-N(\tilde{w}-\partial_{z}\phi)$ $\displaystyle\nabla^{2}p$
$\displaystyle=-\nabla\cdot\left(f\hat{\bm{z}}\times(\tilde{\bm{u}}-\nabla\phi)\right)+N\partial_{z}\theta$
$\displaystyle\nabla^{2}\phi$ $\displaystyle=\nabla\cdot\tilde{\bm{u}}.$

We can write these equations symbolically as
$\partial_{t}\bm{\psi}=\mathcal{L}\bm{\psi}$, where
$\bm{\psi}=(\tilde{\bm{u}},\theta)$ is a state vector, and $\mathcal{L}$ is a
linear integral operator. The precise form of $\mathcal{L}$ is specified by
the boundary conditions of $p$ and $\phi$ and generally not easy to write
down. In this study, we assume that this boundary condition does not violate
energy conservation, so that $d(\bm{\psi},\bm{\psi})/dt=0$ holds for a certain
inner product in real vector space. If the system is unbounded, we readily
verify that
$(\bm{\psi},\bm{\psi})=\int(|\tilde{\bm{u}}|^{2}+\theta^{2})d\bm{x}=\int(|\bm{u}|^{2}+|\nabla\phi|^{2}+\theta^{2})d\bm{x}$
fulfills this requirement. When there exists a boundary, we may extend the
definition of inner product to include energy stored in the surface (Section
4.2). In any case, energy conservation ensures the skew symmetry of
$\mathcal{L}$, which, in turn, defines a Hermitian operator in complex space
as $\mathcal{H}\equiv{\rm i}\mathcal{L}$. Consequently, we obtain a
Schrödinger-like equation, ${\rm
i}\partial_{t}\bm{\psi}=\mathcal{H}\bm{\psi}$.

##  2 Eigenvectors of the bulk states

###  2.1 Inertia-gravity wave

The solutions of the Fourier-transformed eigenvalue problem
$\omega\hat{\bm{\psi}}=\bm{\mathcal{H}}_{k}\hat{\bm{\psi}}$ are obtained by
hand. For the genuine solutions satisfying $\phi=0$, the eigenvectors are
represented using the Fourier coefficient of pressure, $\hat{p}$, in a single
expression,

$\displaystyle\hat{\bm{\psi}}=\begin{pmatrix}\hat{u}\\\ \hat{v}\\\ \hat{w}\\\
\hat{\theta}\end{pmatrix}=\hat{p}\begin{pmatrix}\dfrac{k_{x}\omega+{\rm
i}k_{y}f}{\omega^{2}-f^{2}}\\\\[12.0pt] \dfrac{k_{y}\omega-{\rm
i}k_{x}f}{\omega^{2}-f^{2}}\\\\[12.0pt]
\dfrac{-k_{z}\omega}{N^{2}-\omega^{2}}\\\\[12.0pt] \dfrac{{\rm
i}k_{z}N}{N^{2}-\omega^{2}}\end{pmatrix}.$ (S4)

It is convenient for the later consideration to write the complex pressure
variable as $\hat{p}=\gamma|\hat{p}|$ and assume that $|\hat{p}|$ is
determined from the normalization condition $|\hat{\bm{\psi}}|$ = 1. The
argument factor, $\gamma\in U(1)$, represents the gauge freedom. To make
explicit the parameter dependence, let us redefine the basic eigenvector,
(S4), as $\hat{\bm{\psi}}=\bm{\Psi}(k_{x},k_{y},\omega,\gamma)$. The
eigenvectors for the inertia-gravity waves are then represented by
$\bm{\Psi}(k_{x},k_{y},\omega_{\pm},\gamma)\equiv\hat{\bm{\psi}}^{\gamma}_{\pm}$.
Note that the solutions (S4) are invalid when $\omega=\pm f,\pm N$, and the
eigenvectors of these singular cases are considered separately below.

In the following, we assume $f\neq 0$ so that the bulk spectrum has gaps at
$-|f|<\omega<0$ and $0<\omega<|f|$. We define the Riemann sphere $S^{2}$
composed of $k\equiv k_{x}+{\rm i}k_{y}\in\mathbb{C}\cup\\{\infty\\}$, and
inspect the eigenvector of the positive-frequency branch around points where
$\omega^{+}=|f|$ $(k=0)$ or $\omega^{+}=N$ $(k=\infty)$. In the limit of $k\to
0$, we learn $\hat{u}/\hat{p},\hat{v}/\hat{p}\sim\mathcal{O}(k^{-1})$ while
$\hat{w}/\hat{p},\hat{\theta}/\hat{p}\sim\mathcal{O}(1)$, and accordingly

$\displaystyle\lim_{k\to 0}\hat{\bm{\psi}}_{+}^{\gamma}=\frac{\gamma e^{{\rm
sign}(f){\rm i}\alpha}}{\sqrt{2}}\begin{pmatrix}1\\\ -{\rm sign}(f){\rm i}\\\
0\\\ 0\end{pmatrix},$

where $\alpha$ denotes the argument of $k$, and ${\rm sign}(f)\equiv f/|f|$ is
defined. This vector is single-valued at $k=0$ by setting
$\gamma=\gamma_{\infty}$ with

$\gamma_{\infty}\equiv e^{-{\rm sign}(f){\rm i}\alpha},$ (S5)

in the same manner as the shallow-water system [2]. Next, in the limit of
$k\to\infty$, we derive $\hat{u}/\hat{p},\hat{v}/\hat{p}\sim\mathcal{O}(k)$
and $\hat{w}/\hat{p},\hat{\theta}/\hat{p}\sim\mathcal{O}(k^{2})$, and
accordingly

$\displaystyle\lim_{k\to\infty}\hat{\bm{\psi}}_{+}^{\gamma}=\frac{{\rm
sign}(k_{z})\gamma}{\sqrt{2}}\begin{pmatrix}0\\\ 0\\\ -1\\\ {\rm
i}\end{pmatrix}.$

Notably, in this limit the eigenvector apparently does not depend on the
length or the angle of the horizontal wave vector, differing from the standard
shallow water case [3]. Physically, this motion is called the buoyancy
oscillation in which the horizontal velocity vanishes. In this limit, the
choice of $\gamma=\gamma_{\infty}$ defined in (S5) does not produce a unique
convergence of the eigenvector. Instead, fixing the gauge as
$\gamma=\gamma_{0}$ with

$\displaystyle\gamma_{0}=1,$

we may extend the range of the wave number to $k=\infty$.

Consequently, eigenvectors are definable on a compactified surface, $S^{2}$,
and may compose a topologically non-trivial fiber bundle. For the
visualization purpose, we shall specify the Riemann sphere by the standard
stereographic projection: one-to-one mapping between
$k\in\mathbb{C}\cup\\{\infty\\}$ to
$\bm{X}=(X_{1},X_{2},X_{3})\in\mathbb{R}^{3}$ with $|\bm{X}-(0,0,1/2)|=1/2$
via

$\displaystyle k=\frac{X_{1}+{\rm i}X_{2}}{1-X_{3}},$ (S6)

which is a homeomorphism of $S^{2}$. Figure S1 demonstrates the bundle
structure on $S^{2}$, which exhibits singularity in the polarization relation
for any choice of gauge $\gamma$. This singularity is characterized by a
topological invariant, namely, the Chern number.

Figure S1: Bundle structure of the positive inertia-gravity wave band on the
Riemann sphere composed of the horizontal wave number, $k=k_{x}+{\rm i}k_{y}$.
Parameters are $(k_{z},f,N)=(2,2,5)$. Absolute values (shade) and phases
(color) are shown for (a, b) $\hat{u}+{\rm i}\hat{v}$, (c, d) $\hat{w}+{\rm
i}\hat{\theta}$. Depending on the choice of gauge $\gamma$, the location of
the phase singularity changes. For $\hat{u}$ and $\hat{v}$, a singular point
is located at $k=0$ when $\gamma=\gamma_{0}$. For $\hat{w}$ and
$\hat{\theta}$, a singular point is located at $k=\infty$ when
$\gamma=\gamma_{\infty}$

To compute the Chern number, we first introduce the Berry connection111Sign
definitions in the Coriolis parameter, forward/backward Fourier transforms,
Berry connection, and the argument of a scattering coefficient may differ from
those in other papers on the same topic. Specifically, the present definitions
follow [4] and [5] but have differences from [3], [6] and [7].,
$\bm{A}_{+}^{\gamma}={\rm
i}\langle\hat{\bm{\psi}}_{+}^{\gamma},\nabla_{k}\hat{\bm{\psi}}_{+}^{\gamma}\rangle$,
where $\nabla_{k}=(\partial_{k_{x}},\partial_{k_{y}})$, and the brackets
denote the inner products between complex vectors. The Berry connection
defines the Berry curvature through
$B_{+}=\nabla_{k}\times\bm{A}_{+}^{\gamma}$, where
$\bm{a}\times\bm{b}=a_{1}b_{2}-a_{2}b_{1}$ for $\bm{a}=(a_{1},a_{2})$ and
$\bm{b}=(b_{1},b_{2})$ is understood. The Berry curvature is further related
to the Chern number via $\mathcal{C}=(1/2\pi)\int_{S^{2}}B_{+}dk_{x}dk_{y}$,
which is the $U(1)$-bundle form of Eq. (2) in the paper. To process further,
let us write the two representations of polarization relations as
$\hat{\bm{\psi}}^{\infty}_{+}$ for $\gamma=\gamma_{\infty}$ and
$\hat{\bm{\psi}}^{0}_{+}$ for $\gamma=\gamma_{0}$, which are defined in
$S^{2}\setminus\\{\infty\\}$ and $S^{2}\setminus\\{0\\}$, respectively. We
also define the corresponding Berry connections as $\bm{A}_{+}^{\infty}$ and
$\bm{A}_{+}^{0}$. From Stokes’ theorem, the Chern number is computed as

$\displaystyle\mathcal{C}_{+}$
$\displaystyle=\frac{1}{2\pi}\int_{S^{2}}B_{+}dk_{x}dk_{y}=\frac{1}{2\pi}\oint\left(\bm{A}_{+}^{\infty}-\bm{A}_{+}^{0}\right)\cdot
d\bm{s}=\frac{{\rm
i}}{2\pi}\oint\left(\gamma_{\infty}^{\dagger}\nabla_{k}\gamma_{\infty}-\gamma_{0}^{\dagger}\nabla_{k}\gamma_{0}\right)\cdot
d\bm{s}$ $\displaystyle=\frac{{\rm i}}{2\pi}\oint
d\log\frac{\gamma_{\infty}}{\gamma_{0}}={\rm sign}(f),$

in which the integration contour of the line integrals surrounds $k=0$ in the
counterclockwise direction. We have used the fact that $\gamma$ is unitary
when deriving the second line. For the negative frequency branch,
$\omega^{-}$, the Chern number flips its sign so that we may write
$\mathcal{C}_{\pm}=\pm{\rm sign}(f)$.

###  2.2 Zero-frequency mode

For degenerate zero eigenvalues, the corresponding eigenspace is spanned by
the following two eigenvectors:

$\displaystyle\frac{1}{\sqrt{N^{2}(k_{x}^{2}+k_{y}^{2})+f^{2}k_{z}^{2}}}\begin{pmatrix}Nk_{y}\\\
-Nk_{x}\\\ 0\\\
-fk_{z}\end{pmatrix}\equiv\hat{\bm{\psi}}_{0g},\quad\frac{1}{\sqrt{k_{x}^{2}+k_{y}^{2}+k_{z}^{2}}}\begin{pmatrix}k_{x}\\\
k_{y}\\\ k_{z}\\\ 0\end{pmatrix}\equiv\hat{\bm{\psi}}_{0a},$ (S7)

which correspond to the geostrophic flow and the auxiliary field,
respectively. Because any linear combination of (S7) is also an eigenvector,
the set of normalized eigenvectors can be generally represented by

$\displaystyle\begin{pmatrix}\hat{\bm{\psi}}^{\Gamma}_{0+}\\\\[5.0pt]
\hat{\bm{\psi}}^{\Gamma}_{0-}\end{pmatrix}=\Gamma\begin{pmatrix}\hat{\bm{\psi}}_{0g}\\\\[5.0pt]
\hat{\bm{\psi}}_{0a}\end{pmatrix},$

where $\Gamma$ is an arbitrary $2\times 2$ matrix that belongs to $U(2)$. Note
that the two vectors in (S7) cannot be separately defined at $k=\infty$.
However, if we set

$\displaystyle\Gamma=\frac{1}{\sqrt{2}|k|}\begin{pmatrix}k&{\rm i}k\\\
k^{\dagger}&-{\rm i}k^{\dagger}\end{pmatrix},$

the transformed eigenvectors converge as

$\displaystyle\lim_{k\to\infty}\hat{\bm{\psi}}^{\Gamma}_{0\pm}=\frac{1}{\sqrt{2}}\begin{pmatrix}\pm{\rm
i}\\\ -1\\\ 0\\\ 0\end{pmatrix}.$

Therefore, this eigenspace composes a fiber bundle with a structure group of
$U(2)$ over a closed surface $S^{2}$. Also in this case, the Berry connection
and the Berry curvature derive from $\hat{\bm{\psi}}^{\Gamma}_{0\pm}$, but now
comprise $2\times 2$ elements. We refer to Chapter 3.6.4 of [8] for detailed
expressions. Anyway, due to the universal formula,
$\sum_{n}\mathcal{C}_{n}=0$, we learn that the Chern number of the middle
band, $\mathcal{C}_{0}$, vanishes.

##  3 Equatorial waves

Since the Chern numbers change signs at $f=0$, there should be two kinds of
uni-directional modes trapped around the equator. Indeed, such modes were
identified as the Kelvin and Yanai waves in prior work on shallow-water models
[3, 2]. Analytical expressions of those waves are derived by Matsuno [9], who
originally worked on a stratified fluid model on the equatorial $\beta$-plane
under the hydrostatic approximation. Here, we extend it to a non-hydrostatic
problem. As a side note, similar expressions including compressibility are
derived in [10].

We shall set $f=\beta y$ in Eq. (1) and impose the boundary condition such
that the variables vanish at $y\to\pm\infty$. Making an ansatz,
$(\bm{u},\theta,p)=(\hat{\bm{u}},\hat{\theta},\hat{p})e^{{\rm
i}(k_{x}x+k_{z}z-\omega t)}$, we obtain a set of ordinary differential
equations,

$\displaystyle-{\rm i}\omega\hat{u}$ $\displaystyle=\beta y\hat{v}-{\rm
i}k_{x}\hat{p}$ (S8a) $\displaystyle-{\rm i}\omega\hat{v}$
$\displaystyle=-\beta y\hat{u}-\hat{p}_{y}$ (S8b) $\displaystyle-{\rm
i}\omega\hat{w}$ $\displaystyle=N\hat{\theta}-{\rm i}k_{z}\hat{p}$ (S8c)
$\displaystyle-{\rm i}\omega\hat{\theta}$ $\displaystyle=-N\hat{w}$ (S8d)
$\displaystyle 0$ $\displaystyle={\rm i}k_{x}\hat{u}+\hat{v}_{y}+{\rm
i}k_{z}\hat{w},$ (S8e)

which determine the eigenvalue $\omega$ and the corresponding meridional
structure functions. Here, we have used a subscript to represent a
differentiation. It is convenient to solve (S8c) and (S8d) to write $\hat{w}$
as a function of $\hat{p}$, and insert it into (S8e), to derive an equation
system holding three variables,

$\displaystyle-{\rm i}\omega\hat{u}-\beta y\hat{v}+{\rm i}k_{x}\hat{p}$
$\displaystyle=0$ $\displaystyle-{\rm i}\omega\hat{v}+\beta
y\hat{u}+\hat{p}_{y}$ $\displaystyle=0$ $\displaystyle{\rm
i}k_{x}\hat{u}+\hat{v}_{y}-\frac{{\rm
i}k_{z}^{2}\omega\hat{p}}{N^{2}-\omega^{2}}$ $\displaystyle=0.$

These expressions are almost the same as those resulting from the hydrostatic
model. Therefore, the analytical solutions are obtained in a similar fashion.
The crucial step is to write down a single equation with respect to $\hat{v}$
as

$\displaystyle\hat{v}_{yy}+\left(\frac{k_{z}^{2}\omega^{2}}{N^{2}-\omega^{2}}-k_{x}^{2}-\frac{k_{x}\beta}{\omega}-\frac{k_{z}^{2}\beta^{2}y^{2}}{N^{2}-\omega^{2}}\right)\hat{v}=0.$

Notably, when $\omega^{2}>N^{2}$, solutions are oscillatory in the limit of
$y\to\pm\infty$, so that $\omega$ does not have discrete eigenvalues in this
range. Because we are interested in equator-trapped eigenmodes,
$\omega^{2}<N^{2}$ is assumed in the following. Let us introduce a
characteristic length scale as
$L=\left(\frac{N^{2}-\omega^{2}}{k_{z}^{2}\beta^{2}}\right)^{1/4}$ and define
the dimensionless coordinate by $Y=y/L$. The equation becomes
$\hat{v}_{YY}+(F-Y^{2})\hat{v}=0$ with

$\displaystyle
F=\left(\frac{N^{2}-\omega^{2}}{k_{z}^{2}\beta^{2}}\right)^{1/2}\left(\frac{k_{z}^{2}\omega^{2}}{N^{2}-\omega^{2}}-k_{x}^{2}-\frac{k_{x}\beta}{\omega}\right).$

From the analogy with a quantum harmonic oscillator, the eigenvalues are
determined by $F=2n+1$ with $n=0,1,2,\ldots$. We shall write this equation in
polynomial form,

$\displaystyle(k_{x}^{2}+k_{z}^{2})^{2}\omega^{6}+2k_{x}(k_{x}^{2}+k_{z}^{2})\beta\omega^{5}+(-2k_{x}^{2}(k_{x}^{2}+k_{z}^{2})N^{2}+(k_{x}^{2}+k_{z}^{2}(2n+1)^{2})\beta^{2})\omega^{4}$
$\displaystyle-2k_{x}(2k_{x}^{2}+k_{z}^{2})N^{2}\beta\omega^{3}+(k_{x}^{4}N^{4}-(2k_{x}^{2}+k_{z}^{2}(2n+1)^{2})N^{2}\beta^{2})\omega^{2}+2k_{x}^{3}N^{4}\beta\omega+k_{x}^{2}N^{4}\beta^{2}=0,$
(S9)

for which roots satisfying $F>0$ are meaningful.

In the special case of $n=0$, (S9) is factorized to

$\displaystyle\left((k_{x}^{2}+k_{z}^{2})\omega^{2}-k_{x}^{2}N^{2}\right)\left((k_{x}^{2}+k_{z}^{2})\omega^{4}+2k_{x}\beta\omega^{3}+(-k_{x}^{2}N^{2}+\beta^{2})\omega^{2}-2k_{x}N^{2}\beta\omega-N^{2}\beta^{2}\right)=0.$
(S10)

The second factor yields the Yanai-wave solution222The first factor as well as
$F=1$ yields
$\displaystyle\omega=-\frac{Nk_{x}}{\sqrt{k_{x}^{2}+k_{z}^{2}}},$ which is not
a proper solution. If we adopt this dispersion relation, the structure
function of $\hat{p}$ determined by
$\displaystyle(-\beta^{2}y^{2}+\omega^{2})\hat{v}+{\rm i}(k_{x}\beta
y+\omega\partial_{y})\hat{p}=0.$ cannot satisfy the boundary conditions,
$\lim_{y\to\pm\infty}\hat{p}=0$..

The Kelvin wave solution is obtained by setting $\hat{v}=0$ to assume the
geostrophic balance between $\hat{u}$ and $\hat{p}$ in (S8b). The remaining
equations in (S8) are algebraically solved to yield

$\displaystyle\omega=\frac{Nk_{x}}{\sqrt{k_{x}^{2}+k_{z}^{2}}}.$ (S11)

We note that another solution, $\omega=-Nk_{x}/\sqrt{k_{x}^{2}+k_{z}^{2}}$ is
prohibited because it yields exponential divergence of $\hat{u}$ and $\hat{p}$
in the limit of $y\to\pm\infty$.

In summary, the whole set of dispersion relations of equator-trapped modes are
specified by (S9), (S10), and (S11). The algebraic equations are solved
numerically to demonstrate the dispersion curves in Fig. S2. Evidently, two
types of uni-directional modes exist filling the frequency gaps, as predicted
from the difference in Chern numbers between the two hemispheres.

Figure S2: Dispersion curves of waves on an equatorial beta plane. Parameters
are $(k_{z},\beta,N)=(2,1,5)$. The orange curves represent the Kelvin and
Yanai waves.

##  4 Boundary-trapped waves

We consider a wave scattering process and the existence of edge states on a
surface that restricts fluid motion in a semi-infinite domain,
$V=\\{\bm{x}=(x,y,z)\in\mathbb{R}^{3}|y\geq 0\\}$. This Section extends the
simple elastic boundary condition, Eq. (3) in the paper, to include a finite
mass of the springs. Later in Section 6, we will also consider a different
boundary condition that still holds the Hermitian property of the system.

###  4.1 General criteria for the Hermitian property

We first impose $\phi=0$ on the lateral vertical wall $\partial V$, which acts
as the boundary condition of the Poisson equation
$\nabla^{2}\phi=\nabla\cdot\tilde{\bm{u}}$. We then derive the energy equation
of the fluid motion as

$\displaystyle\frac{d}{dt}\int_{V}\frac{|\tilde{\bm{u}}|^{2}+|\theta|^{2}}{2}d\bm{x}+\int_{\partial
V}\left(-\frac{pv^{\dagger}+c.c.}{2}\right)dxdz=0,$

(recall that $\tilde{\bm{u}}=\bm{u}+\nabla\phi$). The system is Hermitian
regarding the energy norm if either (i) the surface integration term
identically vanishes or (ii) the surface integration term turns into the
temporal integration of a positive definite functional that corresponds to the
energy stored in the boundary.

###  4.2 Elastic boundary condition

To construct a physically relevant model, we shall assume that elements of the
boundary wall are made from elastic material (continuously aligned
infinitesimal springs). We write the displacement of the surface element as
$\xi$, and write the equation of motion as

$\displaystyle\sigma\ddot{\xi}+\lambda\xi=-p.$ (S12)

Here, $\sigma\geq 0$ is the spring mass density per unit area, and $\lambda>0$
is the spring constant. Surface displacement motion is related to the fluid
velocity by $\dot{\xi}=v$. The Hermitian condition (ii) raised in Section 4.1
is then fulfilled with the modified energy norm,

$\displaystyle(\bm{\psi},\bm{\psi})=\int_{V}\frac{|\tilde{\bm{u}}|^{2}+|\theta|^{2}}{2}d\bm{x}+\int_{\partial
V}\frac{\sigma|v|^{2}+\lambda|\xi|^{2}}{2}dxdz,$

where we regard $\xi$ as part of the state vector, $\bm{\psi}$. In the
following, for simplicity, we mainly consider massless springs, $\sigma=0$, in
which the elastic force is always equilibrated with the pressure force. As a
result, the boundary condition Eq. (3) is obtained by setting $a=1/\lambda$.
This treatment is reasonable when considering an oscillatory solution whose
frequency is much lower than the natural frequency of the spring,
$\omega_{s}\equiv\sqrt{\lambda/\sigma}$. Effect from the inertia term in (S12)
will be taken into account for the special case of the very high-frequency
modes in Section 4.5.

###  4.3 Edge-mode dispersion relations

In the following, we fix $f>0$. Edge-mode solutions trapped around the wall
are generally represented as

$\displaystyle\bm{\psi}=\hat{\bm{\Psi}}(k_{x},\kappa,\omega,\gamma)e^{{\rm
i}(k_{x}x+\kappa y+k_{z}z-\omega t)},$ (S13)

where $\kappa$ is an imaginary number satisfying $\Im\kappa>0$ and related to
$\omega$ via

$\displaystyle\kappa=\sqrt{\frac{(\omega^{2}-f^{2})k_{z}^{2}-(N^{2}-\omega^{2})k_{x}^{2}}{N^{2}-\omega^{2}}}.$
(S14)

The boundary condition, $v=-a\partial_{t}p$ yields another condition,
$\hat{v}={\rm i}a\omega\hat{p}$. Making use of (S4), we obtain

$\displaystyle\frac{\kappa\omega-{\rm i}k_{x}f}{\omega^{2}-f^{2}}={\rm
i}a\omega.$ (S15)

Eliminating $\kappa$ from (S14) and (S15), we derive an algebraic equation
determining $\omega$ as

$\displaystyle
a^{2}\omega^{6}-(a^{2}f^{2}+a^{2}N^{2})\omega^{4}+2ak_{x}f\omega^{3}-(k_{x}^{2}+k_{z}^{2}-a^{2}N^{2}f^{2})\omega^{2}-2aN^{2}k_{x}f\omega+N^{2}k_{x}^{2}=0.$
(S16)

Roots of this expression satisfying $\Im\kappa>0$ with (S15) yield the
dispersion relations of the edge modes. Several numerical results are
demonstrated in Fig. 3 in the paper.

###  4.4 Asymptotic limits

The algebraic equation (S16) cannot generally be solved by hand. Here, we
instead inspect the asymptotic behavior of the solutions in several special
cases.

First, when $a=0$ is set, (S16) reduces to a simple quadratic form,

$\displaystyle(k_{x}^{2}+k_{z}^{2})\omega^{2}-N^{2}k_{x}^{2}=0,$ (S17)

coinciding with the dispersion relation of a non-rotating internal gravity
wave. Condition $\Im\kappa>0$ allows a branch satisfying $\omega/k>0$. These
are well-known features of a coastal Kelvin wave trapped on a rigid wall.

Next, in the limit of $a\to\infty$, (S16) turns into a fully factorized form,

$\displaystyle\omega^{2}(\omega^{2}-f^{2})(\omega^{2}-N^{2})=0.$ (S18)

Therefore, we learn that an edge mode frequency approaches $\omega=0,\pm f$ or
$\pm N$, among which only the inertial oscillation mode, $\omega=\pm f$, is
isolated from the bulk spectrum. It is notable that, in this limit, the
boundary condition becomes $p=0$, i.e., the fluid elements on the boundary can
move without any pressure force from the wall. In a shallow-water system, the
same situation arises if water depth abruptly becomes infinity at a boundary.
Also in that case, the inertial oscillation mode is identified as a trapped
solution [11].

Finally, we consider the modification of the Kelvin wave dispersion relation
for a finite $a$. It is verified from (S16) that $(k_{x},\omega)=(0,0)$ is
always a solution. Therefore, there should exist a non-dispersive mode in the
long-wavelength limit, namely, the long Kelvin wave influenced by the wall
elasticity. To derive its phase speed, we insert $\omega=ck_{x}$ into (S16)
and take the limit of $k_{x}\to 0$ to have

$\displaystyle(a^{2}N^{2}f^{2}-k_{z}^{2})c^{2}-2aN^{2}fc+N^{2}=0.$ (S19)

Because of the condition $\Im\kappa\geq 0$, a solution with $1/(af)>c>0$ is
allowed. Besides, since the left-hand side of (S19) changes signs between
$c=0$ and $c=1/(af)$, there always exists a unique solution of $c$ in this
range. Consequently, we learn that the existence of the long Kelvin wave is
robust, and its propagation direction remains the same for any $a$.

###  4.5 Origin of the high-frequency edge modes

As demonstrated in Fig. 3, an edge mode with a frequency greater than $N$
exists when $a>0$. Here, we analytically elucidate how this mode emerges from
wall elasticity. For this purpose, we shall recover the finite mass of springs
and rewrite the boundary condition (S12) as

$\displaystyle\frac{\partial_{t}^{2}v}{\omega_{s}^{2}}+v=-a\partial_{t}p\quad\text{at}\quad
y=0.$

Accordingly, in the derivation of the edge-mode dispersion relations, we
should replace (S15) with

$\displaystyle\left(-\frac{\omega^{2}}{\omega_{s}^{2}}+1\right)\frac{\kappa\omega-{\rm
i}k_{x}f}{\omega^{2}-f^{2}}={\rm i}a\omega.$ (S20)

To make the discussion simpler, we shall regard $\omega$ and $\omega_{s}$ as
large and $a$ as small, i.e., considering the asymptotic limit of
$0<a\ll|f|,N,k_{x},k_{z}\ll\omega_{s}\sim\omega$. Then, (S14) gives the
estimate of the meridional wave number as

$\displaystyle\kappa=\sqrt{\frac{(\omega^{2}-f^{2})k_{z}^{2}-(N^{2}-\omega^{2})k_{x}^{2}}{N^{2}-\omega^{2}}}\sim{\rm
i}\sqrt{k_{x}^{2}+k_{z}^{2}}+\mathcal{O}\left(\frac{1}{\omega_{s}^{2}}\right).$

Bearing this in mind, we expand (S20) asymptotically to obtain

$\displaystyle\frac{1}{\omega^{2}}=\frac{1}{\omega_{e}^{2}}+\frac{{\rm
i}a}{\kappa}+\mathcal{O}\left(\frac{1}{\omega_{s}^{3}}\right),$ (S21)

The positive root is

$\displaystyle\omega\sim\sqrt{\frac{1}{1/\omega_{s}^{2}+a/\sqrt{k_{x}^{2}+k_{z}^{2}}}}.$

In the limit of $a\to 0$, as expected, we obtain the free oscillation mode of
the elastic boundary, $\omega=\omega_{s}$. On the other hand, in the limit of
zero mass $\omega_{s}\to\infty$, we obtain
$\omega\sim\sqrt[4]{k_{x}^{2}+k_{z}^{2}}/\sqrt{a}$. This solution connects
$(k_{x},\omega)=(\pm\infty,\infty)$ and is hence consistent with the numerical
solutions in Fig. 3.

To give the physical interpretation to the present result, it is important to
notice that the mass of fluid influenced by this edge mode is proportional to
the $e$-folding scale in the meridional direction, ${\rm i}/\kappa$. The
restoring coefficient that pushes and pulls this fluid mass is specified by
$\lambda=1/a$. Therefore, from basic knowledge of harmonic oscillation, one
may define the natural frequency of this oscillatory motion as
$\omega_{f}\equiv\sqrt{\kappa/({\rm i}a)}$. We consequently understand that
the squared inverse of the edge-mode frequency, $1/\omega^{2}$ in (S21),
results as the sum of those of two oscillators, $1/\omega^{2}_{s}$ and
$1/\omega^{2}_{f}$. Their restoring forces commonly originate from the
elasticity of the wall and does not dependent on $f$ or $N$. Note that this
simplification is valid in the asymptotic limit; if the frequency is not
large, effects from the buoyancy and Coriolis force cannot be neglected.

##  5 Scattering coefficient

This Section presents a detailed construction of the scattering coefficient
$S$ as well as a series of paths $C_{\delta}$ on which $S$ is computed. First,
it should be kept in mind that the expression of $S$ depends on the choice of
gauge. We then have to choose $\gamma$ such that $C_{\delta}$ encloses the
singular point of $\hat{\bm{\psi}}^{\gamma}_{+}(k_{x},k_{y})$ in the upper-
half plane of $\mathbb{C}$ composed of $k=k_{x}+{\rm i}k_{y}$. When $f>0$, we
can arbitrary move the location of a singular point to $k=\zeta$ by choosing a
gauge as

$\displaystyle\gamma=\sqrt{\frac{1-\zeta/k}{1-(\zeta/k)^{\dagger}}}.$

This study sets $\zeta={\rm i}$, as denoted by crosses in Fig. 3f, throughout
the analysis. Applying the boundary condition Eq. (3) to
$\bm{\psi}=\hat{\bm{\psi}}^{\gamma}_{+}(k_{x},-\kappa)e^{{\rm i}(k_{x}x-\kappa
y+k_{z}z-\omega_{+}t)}+S(k_{x},\kappa)\hat{\bm{\psi}}^{\gamma}_{+}(k_{x},\kappa)e^{{\rm
i}(k_{x}x+\kappa y+k_{z}z-\omega_{+}t)}$, we derive the explicit form of $S$
as

$\displaystyle
S(k_{x},\kappa)=-\frac{g(k_{x},-\kappa)}{g(k_{x},\kappa)}\quad\text{with}\quad
g(k_{x},\kappa)\equiv\left[\frac{\kappa\omega_{+}-{\rm
i}k_{x}f}{\omega_{+}^{2}-f^{2}}-{\rm
i}a\omega_{+}\right]\sqrt{\frac{1-\zeta/(k_{x}+{\rm
i}\kappa)}{1-\zeta^{\dagger}/(k_{x}-{\rm i}\kappa)}},$

where $\omega_{+}$ is also a function $k_{x}$ and $\kappa$.

To define a path $C_{\delta}$ in the $k$-plane, let us recall the
stereographic projection from the Riemann sphere, (S6). We assign a set of
coordinates, $(\delta,\mu)$, to represent the sphere in the Cartesian
coordinates as

$\displaystyle X_{1}$ $\displaystyle=\sqrt{1/4-\delta^{2}}\sin\mu$
$\displaystyle X_{2}$ $\displaystyle=\delta$ $\displaystyle X_{3}$
$\displaystyle=1/2-\sqrt{1/4-\delta^{2}}\cos\mu.$

It is now clear that $C_{\delta}$ corresponds to a circle that is the
intersection of the sphere and a plane of $X_{2}=\delta$. Location on the path
is specified by $\mu$, which denotes the angle around the center of the circle
measured from the bottom (Fig. 3f). The corresponding wave numbers are derived
as

$\displaystyle k_{x}$
$\displaystyle=\frac{X_{1}}{1-X_{3}}=\frac{\sqrt{1/4-\delta^{2}}\sin\mu}{1/2+\sqrt{1/4-\delta^{2}}\cos\mu}$
$\displaystyle k_{y}$
$\displaystyle=\frac{X_{2}}{1-X_{3}}=\frac{\delta}{1/2+\sqrt{1/4-\delta^{2}}\cos\mu},$

which are in the same form as described in the Fig. 3 caption. We insert these
expressions into $S(k_{x},k_{y})$ to create Fig. 3g-i. In the computation of
the logarithmic function, the Riemann surface is chosen such that ${\rm i}\log
S$ is continuous for $\mu\in(0,2\pi)$.

##  6 Bulk-edge correspondence under a different boundary condition

This section tests the formula of the bulk-edge correspondence, i.e., Eq. (4)
established in the paper, under a boundary condition other than the elastic
wall. For this purpose, we consider a condition of

$\displaystyle v=a\partial_{x}p\quad\text{at}\quad y=0.$ (S22)

For any real $a$, (S22) holds the criteria (i) of the Hermitian property
discussed in Section 4.1. Note that this boundary condition is introduced here
as a mathematical toy model.

###  6.1 Dispersion relations of edge modes

In the present case, in the derivation process of the edge-mode dispersion
relations elucidated in Section 4.3, condition (S15) should be replaced by

$\displaystyle\frac{\kappa\omega-{\rm i}k_{x}f}{\omega^{2}-f^{2}}={\rm
i}ak_{x}.$ (S23)

Combining this with (S14), after some algebra, we derive a quadratic equation
in terms of $\omega^{2}$,

$\displaystyle
a^{2}k_{x}^{2}\omega^{4}-\left[(af-1)^{2}k_{x}^{2}+a^{2}k_{x}^{2}N^{2}+k_{z}^{2}\right]\omega^{2}+(af-1)^{2}k_{x}^{2}N^{2}=0.$
(S24)

The left-hand side is not negative when $\omega^{2}=0$, and its determinant is

$\displaystyle D=$
$\displaystyle\left[(af-1)^{2}k_{x}^{2}+a^{2}k_{x}^{2}N^{2}+k_{z}^{2}\right]^{2}-4a^{2}(af-1)^{2}k_{x}^{4}N^{2}$
$\displaystyle=$
$\displaystyle\left[(af-1)^{2}k_{x}^{2}-a^{2}k_{x}^{2}N^{2}\right]^{2}+2\left[(af-1)^{2}k_{x}^{2}+a^{2}k_{x}^{2}N^{2}\right]k_{z}^{2}+k_{z}^{4}>0.$

Consequently, $\omega^{2}$ always has a pair of positive roots. The possible
four roots of $\omega$ are

$\displaystyle\omega=\pm\sqrt{\frac{\left[(af-1)^{2}k_{x}^{2}+a^{2}k_{x}^{2}N^{2}+k_{z}^{2}\right]\pm\sqrt{D}}{2a^{2}k_{x}^{2}}}.$

In light of the condition $\Im\kappa>0$ and (S23), we always obtain two
meaningful solutions of $\omega$ for any $a\neq 0$ and $k_{x}$.

###  6.2 Major properties in edge-mode dispersion curves

Also in this problem, it is informative to inspect the characters of the
dispersion curves for some special choices of $k_{x}$ and $a$. First, when
$k_{x}\to 0$, $\omega$ approaches $0$ or $\pm\infty$. In these two limits,
(S24) is approximated by

$\displaystyle-
k_{z}^{2}\omega^{2}+(af-1)^{2}k_{x}^{2}N^{2}=0\quad\text{and}\quad
a^{2}k_{x}^{2}\omega^{4}-k_{z}^{2}\omega^{2}=0,$

respectively. We therefore have four roots,

$\displaystyle\omega\sim\pm\frac{(af-1)Nk_{x}}{k_{z}},\pm\frac{k_{z}}{ak_{x}},$

for which the condition of $\Im\kappa>0$ permits only one sign in each set of
double signs. Notably, there always exists a uni-directional non-dispersive
wave in the long-wavelength limit.

Next, when $k_{x}\to\pm\infty$, (S24) is approximated by

$\displaystyle
a^{2}\omega^{4}-\left[(af-1)^{2}+a^{2}N^{2}\right]\omega^{2}+(af-1)^{2}N^{2}=0,$

which is factorized to

$\displaystyle(a^{2}\omega^{2}-(af-1)^{2})(\omega^{2}-N^{2})=0.$

Remarkably, for any choice of $a$, either $\omega=N$ or $\omega=-N$ is always
a solution. The other pair of roots are generally apart from the bulk spectrum
and discontinuous between $k_{x}=\infty$ and $k_{x}=-\infty$, which is not
surprising as the boundary condition (S22) is apparently singular at
$k_{x}=\pm\infty$. More interestingly, these two roots dependent on $a$
coincide with the other fixed roots at $\omega=\pm N$ if

$\displaystyle a=\frac{1}{N+f},-\frac{1}{N-f}.$

When $a$ passes either of these two values, two edge modes with $|\omega|>N$
and $|\omega|<N$ are reconnected.

When $a=0$, the boundary condition coincides with the simplest rigid
condition, and there exists a unique Kelvin wave solution. In the limit of
$a\to\pm\infty$, (S24) approaches to

$\displaystyle\omega^{4}-(f^{2}+N^{2})\omega^{2}+f^{2}N^{2}=0,$

whose solutions are $\omega=\pm f,\pm N$. This result is equivalent to that of
the elastic boundary condition.

Finally, when $a=1/f$, two roots with the absolute values smaller than $N$
reduce to $\omega=0$. As $a$ passes this value, the originally Kelvin-like
mode changes its propagation direction, and will approach the inertial
oscillation. All of these properties of dispersion curves are visualized in
Fig. S3.

###  6.3 Scattering coefficient

The scattering coefficient is computed along a series of paths $C_{\delta}$ in
the same manner as in Section 5 by redefining a function $g$ such that

$\displaystyle
S=-\frac{g(k_{x},-\kappa)}{g(k_{x},\kappa)}\quad\text{with}\quad
g(k_{x},\kappa)\equiv\left[\frac{\kappa\omega_{+}-{\rm
i}k_{x}f}{\omega_{+}^{2}-f^{2}}-{\rm
i}ak_{x}\right]\sqrt{\frac{1-\zeta/(k_{x}+{\rm
i}\kappa)}{1-\zeta^{\dagger}/(k_{x}-{\rm i}\kappa)}}.$

The results are demonstrated in Fig. S4. As expected in the paper, in every
case, a phase jump in $S$ corresponds to a connection point of an edge-mode
dispersion curve to the bulk spectrum. Notably, reconnection at $k=\pm\infty$
occurs keeping the net count of connection points. It means that the bulk-edge
correspondence in a form of Levinson’s theorem,

$\displaystyle\mathcal{N}_{+}=\frac{{\rm i}}{2\pi}\oint_{C_{\delta}}d\log
S=\mathcal{C}_{+},$

(Eq. (4) in the paper) is established even under a different set of boundary
conditions.

Figure S3: Dispersion curves of edge modes (orange) for cases of a new
boundary condition, $v=a\partial_{x}p$ at $y=0$, are superimposed on the bulk
spectrum (cyan). In (a), the red curve denotes a path $C_{\delta}$ with
$\delta=0.2$ in the same way as Fig. 3b. Parameters are $(k_{z},f,N)=(2,2,5)$.

Figure S4: Plots of phases in the scattering coefficient $S$ for positive
inertia-gravity waves with the boundary condition of $v=a\partial_{x}p$ at
$y=0$, computed along $C_{\delta}$ for various $a$ as corresponding to Fig. S3

## References

  * [1] Geoffrey K Vallis  “Atmospheric and oceanic fluid dynamics”  Cambridge: Cambridge University Press, 2017
  * [2] Clément Tauber, Pierre Delplace and Antoine Venaille  “A bulk-interface correspondence for equatorial waves”  In _Journal of Fluid Mechanics_ 868 Cambridge University Press, 2019, pp. R2
  * [3] Pierre Delplace, J.. Marston and Antoine Venaille  “Topological origin of equatorial waves”  In _Science_ 358.6366 American Association for the Advancement of Science, 2017, pp. 1075–1077
  * [4] Antoine Venaille and Pierre Delplace  “Wave topology brought to the coast”  In _Physical Review Research_ 3.4 APS, 2021, pp. 043002
  * [5] Antoine Venaille, Yohei Onuki, Nicolas Perez and Armand Leclerc  “From ray tracing to waves of topological origin in continuous media”  In _SciPost Physics_ 14.4, 2023, pp. 062
  * [6] Clément Tauber, Pierre Delplace and Antoine Venaille  “Anomalous bulk-edge correspondence in continuous media”  In _Physical Review Research_ 2.1 APS, 2020, pp. 013147
  * [7] Gian Michele Graf, Hansueli Jud and Clément Tauber  “Topology in shallow-water waves: a violation of bulk-edge correspondence”  In _Communications in Mathematical Physics_ 383 Springer, 2021, pp. 731–761
  * [8] David Vanderbilt  “Berry phases in electronic structure theory: electric polarization, orbital magnetization and topological insulators”  Cambridge,: Cambridge University Press, 2018
  * [9] Taroh Matsuno  “Quasi-geostrophic motions in the equatorial area”  In _Journal of the Meteorological Society of Japan. Ser. II_ 44.1 Meteorological Society of Japan, 1966, pp. 25–43
  * [10] J-H Qian and Akira Kasahara  “Nonhydrostatic atmospheric normal modes on beta-planes”  In _pure and applied geophysics_ 160 Springer, 2003, pp. 1315–1358
  * [11] Keita Iga  “Transition modes of rotating shallow water waves in a channel”  In _Journal of Fluid Mechanics_ 294 Cambridge University Press, 1995, pp. 367–390