Private training in quantum machine learning

• URL: http://arxiv.org/abs/2606.29293v2
• Date: Thu, 02 Jul 2026 19:48:17 GMT
• Title: Private training in quantum machine learning
• Abstract summary: A major question in AI safety is how to make learning private with respect to the training data.<n>Similar to classical machine learning, quantum machine learning (QML) models are not devoid of privacy vulnerabilities.<n> Differential privacy (DP) is a standard tool for training ML models on sensitive data, but its impact in QML remains poorly understood.
• Score: 1.8224668251608893
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: With the emergence of machine learning (ML) models trained on large datasets containing potentially sensitive data, a major question in AI safety is how to make learning private with respect to the training data. Similar to classical machine learning, quantum machine learning (QML) models are not devoid of privacy vulnerabilities. Differential privacy (DP) is a standard tool for training ML models on sensitive data, but its impact in QML remains poorly understood. In this work we study private training in hybrid variational QML models using a classical private DP-SGD optimizer applied to pipelines with classical inputs and outputs. We analyze the interplay between gradient clipping and calibrated noise addition in DP-SGD, and its impact on optimization and accuracy for noisy and noiseless quantum models. We first explain why quantum noise does not provide a satisfactory replacement for the calibrated noise in DP-SGD for ensuring privacy. We then show how the deterministic bounds on gradient norms for a wide class of quantum models translate into explicit control of the detrimental clipping bias introduced by DP-SGD. Finally, we formulate a numerical comparison protocol under fixed clipping threshold and privacy budget and evaluate it on synthetic and image-classification tasks for equivalent quantum and classical models. Our results suggest that quantum models can retain higher accuracy in private-training regimes where the formal privacy guarantee is ensured by a classical DP-SGD mechanism.

Related papers

• Q-ShiftDP: A Differentially Private Parameter-Shift Rule for Quantum Machine Learning [15.599469486297679]
  We introduce the Differentially Private.<n>Shift Rule (Q-ShiftDP), the first privacy mechanism tailored to Quantum Machine Learning (QML)<n>By leveraging the inherent boundedness and intrinsic quantum gradients computed via the parameter-shift rule, Q-ShiftDP enables tighter sensitivity analysis and reduces noise requirements.
  arXiv  Detail & Related papers  (2026-02-03T01:02:18Z)
• ECO: Quantized Training without Full-Precision Master Weights [58.97082407934466]
  Error-Compensating (ECO) eliminates master weights by applying updates directly to quantized parameters.<n>We show that ECO converges to a constant-radius neighborhood of the optimum, while naive master-weight removal can incur an error that is inversely proportional to the learning rate.
  arXiv  Detail & Related papers  (2026-01-29T18:35:01Z)
• Communication-Efficient and Privacy-Adaptable Mechanism for Federated Learning [54.20871516148981]
  We introduce the Communication-Efficient and Privacy-Adaptable Mechanism (CEPAM)<n>CEPAM achieves communication efficiency and privacy protection simultaneously.<n>We theoretically analyze the privacy guarantee of CEPAM and investigate the trade-offs among user privacy and accuracy of CEPAM.
  arXiv  Detail & Related papers  (2025-01-21T11:16:05Z)
• Scalable DP-SGD: Shuffling vs. Poisson Subsampling [61.19794019914523]
  We provide new lower bounds on the privacy guarantee of the multi-epoch Adaptive Linear Queries (ABLQ) mechanism with shuffled batch sampling. We show substantial gaps when compared to Poisson subsampling; prior analysis was limited to a single epoch. We introduce a practical approach to implement Poisson subsampling at scale using massively parallel computation.
  arXiv  Detail & Related papers  (2024-11-06T19:06:16Z)
• Noise-Aware Differentially Private Regression via Meta-Learning [25.14514068630219]
  Differential Privacy (DP) is the gold standard for protecting user privacy, but standard DP mechanisms significantly impair performance.<n>One approach to mitigating this issue is pre-training models on simulated data before DP learning on the private data.<n>In this work we go a step further, using simulated data to train a meta-learning model that combines the Convolutional Conditional Neural Process (ConvCNP) with an improved functional DP mechanism.
  arXiv  Detail & Related papers  (2024-06-12T18:11:24Z)
• RQP-SGD: Differential Private Machine Learning through Noisy SGD and Randomized Quantization [8.04975023021212]
  We present RQP-SGD, a new approach for privacy-preserving quantization to train machine learning models. This approach combines differentially private gradient descent with randomized quantization, providing a measurable privacy guarantee.
  arXiv  Detail & Related papers  (2024-02-09T18:34:08Z)
• Harnessing Inherent Noises for Privacy Preservation in Quantum Machine Learning [11.45148186874482]
  We propose to harness inherent quantum noises to protect data privacy in quantum machine learning. Especially, considering the Noisy Intermediate-Scale Quantum (NISQ) devices, we leverage the unavoidable shot noise and incoherent noise.
  arXiv  Detail & Related papers  (2023-12-18T11:52:44Z)
• Kalman Filter for Online Classification of Non-Stationary Data [101.26838049872651]
  In Online Continual Learning (OCL) a learning system receives a stream of data and sequentially performs prediction and training steps. We introduce a probabilistic Bayesian online learning model by using a neural representation and a state space model over the linear predictor weights. In experiments in multi-class classification we demonstrate the predictive ability of the model and its flexibility to capture non-stationarity.
  arXiv  Detail & Related papers  (2023-06-14T11:41:42Z)
• MAPS: A Noise-Robust Progressive Learning Approach for Source-Free Domain Adaptive Keypoint Detection [76.97324120775475]
  Cross-domain keypoint detection methods always require accessing the source data during adaptation. This paper considers source-free domain adaptive keypoint detection, where only the well-trained source model is provided to the target domain.
  arXiv  Detail & Related papers  (2023-02-09T12:06:08Z)
• Quantum machine learning with differential privacy [3.2442879131520126]
  We develop a hybrid quantum-classical model that is trained to preserve privacy using differentially private optimization algorithm. Experiments demonstrate that differentially private QML can protect user-sensitive information without diminishing model accuracy.
  arXiv  Detail & Related papers  (2021-03-10T18:06:15Z)
• Differentially Private Federated Learning with Laplacian Smoothing [72.85272874099644]
  Federated learning aims to protect data privacy by collaboratively learning a model without sharing private data among users. An adversary may still be able to infer the private training data by attacking the released model. Differential privacy provides a statistical protection against such attacks at the price of significantly degrading the accuracy or utility of the trained models.
  arXiv  Detail & Related papers  (2020-05-01T04:28:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.