Q-ShiftDP: A Differentially Private Parameter-Shift Rule for Quantum Machine Learning

TL;DR

The paper addresses privacy in quantum machine learning by exploiting the bounded gradients produced by the parameter-shift rule and the intrinsic shot noise as a privacy resource. It introduces Q-ShiftDP, a differentially private mechanism that adds Gaussian noise calibrated to an analytic gradient sensitivity bound $\Delta$, while leveraging shot noise to reduce artificial noise. A key contribution is the adaptive extension, Adaptive Q-ShiftDP, which estimates per-batch shot-noise variance $\hat{\bm{\eta}}_B^2$ to determine a batch-specific noise level $\sigma_B^2$, yielding $(\varepsilon, (1-\beta)\delta + \beta)$-DP. Empirical results on benchmark quantum datasets demonstrate improved privacy-utility trade-offs over baselines, with adaptive noise offering notable gains especially at low shot counts and smaller batches, signaling practical impact for private QML deployments.

Abstract

Quantum Machine Learning (QML) promises significant computational advantages, but preserving training data privacy remains challenging. Classical approaches like differentially private stochastic gradient descent (DP-SGD) add noise to gradients but fail to exploit the unique properties of quantum gradient estimation. In this work, we introduce the Differentially Private Parameter-Shift Rule (Q-ShiftDP), the first privacy mechanism tailored to QML. By leveraging the inherent boundedness and stochasticity of quantum gradients computed via the parameter-shift rule, Q-ShiftDP enables tighter sensitivity analysis and reduces noise requirements. We combine carefully calibrated Gaussian noise with intrinsic quantum noise to provide formal privacy and utility guarantees, and show that harnessing quantum noise further improves the privacy-utility trade-off. Experiments on benchmark datasets demonstrate that Q-ShiftDP consistently outperforms classical DP methods in QML.

Figures (11)

• Figure 1: Overall framework of Q-ShiftDP. Each mini-batch is processed via the parameter-shift rule, yielding inherently noisy and bounded gradients. The aggregated gradient is then perturbed with Gaussian noise $z \sim \mathcal{N}(0,\sigma^2\Delta^2 \mathbf{I}_K)$ to ensure $(\varepsilon,\delta)$-DP.
• Figure 2: Average test accuracy on 3 datasets using Q-ShiftDP w.r.t batch size, learning rates and $\varepsilon$.
• Figure 3: Comparison of model utility under equal privacy budgets: Q-ShiftDP vs. Pixel-level DP vs. QuantumDP in various datasets.
• Figure 4: Training loss curves for Q-ShiftDP and Pixel-level DP under $\varepsilon=1$ with 100k shots.
• Figure 5: Test accuracy on Bars and Stripes dataset using QNN with gradient privated under Q-ShiftDP by different batch size and learning rates.

Theorems & Definitions (30)

• Definition 1: $(\varepsilon, \delta)$-Differential Privacy
• Lemma 1
• Lemma 2: $\ell_2$-Sensitivity of the Quantum Gradient
• Lemma 3
• Theorem 1
• Theorem 2: Bound on the Gradient Estimation Error for Q-ShiftDP
• Theorem 3
• Corollary 1
• Lemma 4
• Lemma 5