Guaranteeing Privacy in Hybrid Quantum Learning through Theoretical Mechanisms

TL;DR

The paper tackles end-to-end privacy in hybrid quantum-classical learning by leveraging intrinsic quantum noise as a stochastic privacy resource. It introduces HYPER-Q, a modular mechanism that composes a classical DP perturbation with a quantum post-processing stage incorporating a depolarizing channel, and provides rigorous DP analyses including multiple amplification scenarios and extensions to GAD and GD channels. A formal utility bound ties the privacy-utility trade-off to the classical noise variance and quantum noise strength, while empirical results on MNIST, Fashion-MNIST, USPS, and CIFAR-10 demonstrate improved adversarial robustness under DP budgets relative to classical noise-only baselines. The work bridges classical and quantum privacy frameworks, offering a scalable path toward end-to-end privacy guarantees in near-term quantum machine learning and guiding practical calibration of quantum noise for robustness benefits. Overall, HYPER-Q shows that hybrid privacy amplification can enhance both privacy guarantees and model robustness in quantum-enhanced learning systems.

Abstract

Quantum Machine Learning (QML) is becoming increasingly prevalent due to its potential to enhance classical machine learning (ML) tasks, such as classification. Although quantum noise is often viewed as a major challenge in quantum computing, it also offers a unique opportunity to enhance privacy. In particular, intrinsic quantum noise provides a natural stochastic resource that, when rigorously analyzed within the differential privacy (DP) framework and composed with classical mechanisms, can satisfy formal $(\varepsilon, δ)$-DP guarantees. This enables a reduction in the required classical perturbation without compromising the privacy budget, potentially improving model utility. However, the integration of classical and quantum noise for privacy preservation remains unexplored. In this work, we propose a hybrid noise-added mechanism, HYPER-Q, that combines classical and quantum noise to protect the privacy of QML models. We provide a comprehensive analysis of its privacy guarantees and establish theoretical bounds on its utility. Empirically, we demonstrate that HYPER-Q outperforms existing classical noise-based mechanisms in terms of adversarial robustness across multiple real-world datasets.

Figures (21)

• Figure 1: Overview of the proposed HYPER-Q.
• Figure 2: Subplots (a)–(d) illustrate the trade-off between quantum noise and model accuracy across MNIST, FashionMNIST, and USPS for privacy budgets $\varepsilon' \in \{0.25, 0.5, 0.75, 1.0\}$. Each curve denotes the mean accuracy under FGSM attacks of varying strengths ($L_{\text{attk}}$).
• Figure 3: Average accuracy of noise-added mechanisms under FGSM and PGD attacks on MNIST, FashionMNIST, and USPS. Accuracy is averaged over all $L_{\text{cons}}$ settings for each $(L_{\text{attk}}, \varepsilon')$. $\texttt{HYPER-Q}$ is evaluated with $\eta = 0.1$ and $\delta' = 1\times 10^{-5}$.
• Figure 4: Impact of depolarizing noise $\eta$ on model utility for the MNIST dataset. Subplots (a)-(d) show performance under varying privacy budgets $\varepsilon' \in \{0.25, 0.5, 0.75, 1.0\}$. Each curve represents the average accuracy against FGSM attacks with varying strengths $L_{\text{attk}} \in \{0, \dots, 0.05\}$.
• Figure 5: Impact of depolarizing noise $\eta$ on model utility for the Fashion-MNIST dataset. Subplots (a)-(d) show performance under varying privacy budgets $\varepsilon' \in \{0.25, 0.5, 0.75, 1.0\}$. Each curve represents the average accuracy against FGSM attacks with varying strengths $L_{\text{attk}} \in \{0, \dots, 0.05\}$.

Theorems & Definitions (41)

• Definition 2.1: $(\varepsilon, \delta)$-Differential Privacy
• Theorem 4.1: Amplification on Failure Probability
• Corollary 4.2
• Corollary 4.3
• Theorem 4.4: Amplification on Privacy Loss
• Corollary 4.5
• Corollary 4.6
• Theorem 4.7: Amplification Under Generalized Amplitude Damping Noise
• Theorem 4.9
• Theorem 4.10: Utility Bound