When Does Quantum Differential Privacy Compose?
Daniel Alabi, Theshani Nuradha
TL;DR
This paper investigates when and how classical DP composition results extend to quantum differential privacy (QDP). It demonstrates a no-go for basic composition under general joint quantum channels, attributing the barrier to measurement incompatibility and lack of a joint outcome space, while showing that clean composition is possible for tensor-product channels on product neighbors using a quantum moments accountant (QMA). The QMA defines an operator-valued privacy loss and a matrix moment-generating function, yielding additive composition under tensor-product structure and enabling measured Rényi DP bounds that translate into $(\varepsilon,\delta)$-QDP with an advanced-composition-like scaling $\sqrt{\sum_i \varepsilon_i^2 \log(1/\delta)}$. The framework delineates a clear hierarchy of composition models (tensor-product, factorized, general joint) and clarifies which classical ideas survive in the quantum setting. Overall, the work provides both technical tools and conceptual clarity for privacy in quantum information processing, guiding future extensions beyond the tensor-product setting and into broader adversary models.
Abstract
Composition is a cornerstone of classical differential privacy, enabling strong end-to-end guarantees for complex algorithms through composition theorems (e.g., basic and advanced). In the quantum setting, however, privacy is defined operationally against arbitrary measurements, and classical composition arguments based on scalar privacy-loss random variables no longer apply. As a result, it has remained unclear when meaningful composition guarantees can be obtained for quantum differential privacy (QDP). In this work, we clarify both the limitations and possibilities of composition in the quantum setting. We first show that classical-style composition fails in full generality for POVM-based approximate QDP: even quantum channels that are individually perfectly private can completely lose privacy when combined through correlated joint implementations. We then identify a setting in which clean composition guarantees can be restored. For tensor-product channels acting on product neighboring inputs, we introduce a quantum moments accountant based on an operator-valued notion of privacy loss and a matrix moment-generating function. Although the resulting Rényi-type divergence does not satisfy a data-processing inequality, we prove that controlling its moments suffices to bound measured Rényi divergence, yielding operational privacy guarantees against arbitrary measurements. This leads to advanced-composition-style bounds with the same leading-order behavior as in the classical theory. Our results demonstrate that meaningful composition theorems for quantum differential privacy require carefully articulated structural assumptions on channels, inputs, and adversarial measurements, and provide a principled framework for understanding which classical ideas do and do not extend to the quantum setting.