Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2307.12529 · Physical Review A

Maximal information leakage from quantum encoding of classical data

Farhad Farokhi

Published Feb 16, 2024• 5 citations
arXivHTMLPDF

Abstract

An alternative measure of information leakage for quantum encoding of classical data is defined. An adversary can access a single copy of the state of a quantum system that encodes some classical data and is interested in correctly guessing a general randomized or deterministic function of the data (e.g., a specific feature or attribute of the data in quantum machine learning) that is unknown to the security analyst. The resulting measure of information leakage, referred to as maximal quantum leakage, is the multiplicative increase of the probability of correctly guessing any function of the classical data upon observing measurements of the quantum state. Maximal quantum leakage is shown to satisfy the postprocessing inequality (i.e., applying a quantum channel reduces information leakage) and independence property (i.e., leakage is zero if the quantum state is independent of the classical data), which are fundamental properties required for privacy and security analysis. It also bounds accessible information. Effects of global and local depolarizing noise models on the maximal quantum leakage are established.

DOI
10.1103/physreva.109.022608

Related papers

Barycentric and Pairwise Renyi Quantum Leakage

Farhad Farokhi

Barycentric and pairwise quantum Renyi leakages are proposed as two measures of information leakage for privacy and security analysis in quantum computing and communication systems. These quantities both require minimal assumptions on the eavesdropper, i.e., they do not make any assumptions on the eavesdropper's attack strategy or the statistical prior on the secret or private classical data encoded in the quantum system. They also satisfy important properties of positivity, independence, post-processing inequality, and unitary invariance. The barycentric quantum Renyi leakage can be computed by solving a semi-definite program and the pairwise quantum Renyi leakage possesses an explicit formula. The barycentric and pairwise quantum Renyi leakages form upper bounds on the maximal quantum leakage, the sandwiched quantum $α$-mutual information, the accessible information, and the Holevo's information. Furthermore, differentially-private quantum channels are shown to bound these measures of information leakage. Global and local depolarizing channels, that are common models of noise in quantum computing and communication, restrict private or secure information leakage. Finally, a privacy-utility trade-off formula in quantum machine learning using variational circuits is developed. The privacy guarantees can only be strengthened, i.e., information leakage can only be reduced, if the performance degradation grows larger and vice versa.

arXiv:2402.06156•Feb 9, 2024•1 citation

Maximal ααα-Leakage for Quantum Privacy Mechanisms

Bo-Yu Yang, Hsuan Yu, Hao–Chung Cheng

In this work, maximal $α$-leakage is introduced to quantify how much a quantum adversary can learn about any sensitive information of data upon observing its disturbed version via a quantum privacy mechanism. We first show that an adversary's maximal expected $α$-gain using optimal measurement is characterized by measured conditional Rényi entropy. This can be viewed as a parametric generalization of König et al.'s famous guessing probability formula [IEEE Trans. Inf. Theory, 55(9), 2009]. Then, we prove that the $α$-leakage and maximal $α$-leakage for a quantum privacy mechanism are determined by measured Arimoto information and measured Rényi capacity, respectively. Various properties of maximal $α$-leakage, such as data processing inequality and composition property are established as well. Moreover, we show that regularized $α$-leakage and regularized maximal $α$-leakage for identical and independent quantum privacy mechanisms coincide with $α$-tilted sandwiched Rényi information and sandwiched Rényi capacity, respectively.

arXiv:2403.14450•Mar 21, 2024•0 citations

Perturbation Analysis of Maximal Quantum Leakage

Zijia Zhao, Shuixin Xiao, Farhad Farokhi

Maximal quantum leakage (MQL) is a worst-case information leakage measure that quantifies an adversary's inference advantage gained from accessing quantum encoding of classical data with arbitrary measurements. While MQL admits an exact characterization for a given ensemble of quantum states, its robustness to implementation imperfections has not been systematically studied. In this paper, we analyze the sensitivity of maximal quantum leakage under perturbations of the quantum encoding. We establish a continuity bound in terms of the trace distance between ideal and perturbed quantum states, and show, via an example, that this bound is attainable. We further derive fidelity-based and relative-entropy-based sufficient conditions for bounding the variation of maximal quantum leakage, and illustrate numerically that these conditions can be loose.

quant-pharXiv:2607.14469•Jul 17, 2026•0 citations

Maximal $\alpha$ - Leakage for Quantum Privacy Mechanisms and Operational Meaning of Measured Renyi Capacity

Bo-Yu Yang, Hsuan Yu, Hao–Chung Cheng

In this work, maximal a-leakage is introduced to quantify how much a quantum adversary can learn about any sensitive information of data upon observing its disturbed versionvia a quantum privacy mechanism. We first show that an adversary's maximal expected a-gain using optimal measurement is characterized by measured conditional Renyi entropy. This can be viewed as a parametric generalization of Konig et al.'s famous guessing probability formula [IEEE Trans. Inf. Theory, 55(9), 2009]. Then, we prove that the a-leakage and maximal$\alpha$-leakage for a quantum privacy mechanism are determined by measured Arimoto information and measured Renyi capacity, respectively. Various properties of maximal a-leakage, such as data processing inequality and composition property are established as well. Moreover, we show that regularized a-leakage and regularized maximal a-leakage for identical and independent quantum privacy mechanisms coincide with a-tilted sandwiched Renyi information and sandwiched Renyi capacity, respectively. A full version of this paper is accessible at: https://arxiv.org/pdf/2403.14450 [1].

IEEE International Symposium on Information Theory (ISIT)•Jul 7, 2024•0 citations

Maximal quantum leakage: operational interpretation and quantum channel analysis

Shuixin Xiao, Zijia Zhao, Jingge Zhu +1 more

Maximal quantum leakage quantifies privacy against adversaries with arbitrary intentions. In this work, we prove that computing this leakage is equivalent to minimum-error quantum state discrimination with equal priors. This establishes a computable operational interpretation, addressing the previous difficulty in computing maximal quantum leakage. We further analyze the impact of collective measurements on multiple copies of a state, demonstrating that leakage increases monotonically with the number of copies, which leads to explicitly characterizing the maximal leakage in the asymptotic limit. Extending this framework to quantum channels, we develop an iterative algorithm for the jointly designing of input states and measurements. Numerical examples involving collective measurements and the maximal channel leakage demonstrate our theoretical findings.

quant-pharXiv:2607.15853•Jul 20, 2026•0 citations

Certifying Measurement Incompatibility under Bounded Classical Communication

Oxana Shaya

Measurement incompatibility enables quantum advantages in communication and state discrimination. It is also necessary for Bell nonlocality, which is used in device-independent protocols for quantum key distribution and private randomness generation. Classical communication can influence the receiver's outcome and must therefore be accounted for when certifying measurement incompatibility. We introduce union maximal leakage, which quantifies the information needed for a common classical explanation of all observed probabilities and is computed from them by a linear program. If a message of at most $k$ bits precedes the receiver's independent measurement choice, compatible measurements for each message give union maximal leakage at most $k$. This bound holds with any input-independent nonsignalling shared resource. In quantum theory, a violation also implies that the initially shared state is entangled. Conversely, union maximal leakage determines the minimum classical communication needed to reproduce the observations with compatible measurements and arbitrary nonsignalling assistance. For a fixed shared quantum state and receiver measurements, a violation is possible exactly when, for some message value, the receiver's measurements are Bell-nonlocal against two-outcome sender measurements on that state. For binary receiver outcomes, we show that a violation also certifies randomness private from the sender, even when the receiver's measurement depends on the sender's message and the sender retains quantum side information. We quantify this privacy through an explicit conditional entropy bound and establish composably secure randomness extraction in sequential protocols with device memory.

quant-pharXiv:2610.06722•Oct 6, 2026•0 citations
An alternative measure of information leakage for quantum encoding of classical data is defined. An adversary can access a single copy of the state of a quantum system that encodes some classical data and is interested in correctly guessing a general randomized or deterministic function of the data (e.g., a specific feature or attribute of the data in quantum machine learning) that is unknown to the security analyst. The resulting measure of information leakage, referred to as maximal quantum leakage, is the multiplicative increase of the probability of correctly guessing any function of the classical data upon observing measurements of the quantum state. Maximal quantum leakage is shown to satisfy the postprocessing inequality (i.e., applying a quantum channel reduces information leakage) and independence property (i.e., leakage is zero if the quantum state is independent of the classical data), which are fundamental properties required for privacy and security analysis. It also bounds accessible information. Effects of global and local depolarizing noise models on the maximal quantum leakage are established.
Barycentric and pairwise quantum Renyi leakages are proposed as two measures of information leakage for privacy and security analysis in quantum computing and communication systems. These quantities both require minimal assumptions on the eavesdropper, i.e., they do not make any assumptions on the eavesdropper's attack strategy or the statistical prior on the secret or private classical data encoded in the quantum system. They also satisfy important properties of positivity, independence, post-processing inequality, and unitary invariance. The barycentric quantum Renyi leakage can be computed by solving a semi-definite program and the pairwise quantum Renyi leakage possesses an explicit formula. The barycentric and pairwise quantum Renyi leakages form upper bounds on the maximal quantum leakage, the sandwiched quantum ααα-mutual information, the accessible information, and the Holevo's information. Furthermore, differentially-private quantum channels are shown to bound these measures of information leakage. Global and local depolarizing channels, that are common models of noise in quantum computing and communication, restrict private or secure information leakage. Finally, a privacy-utility trade-off formula in quantum machine learning using variational circuits is developed. The privacy guarantees can only be strengthened, i.e., information leakage can only be reduced, if the performance degradation grows larger and vice versa.
In this work, maximal ααα-leakage is introduced to quantify how much a quantum adversary can learn about any sensitive information of data upon observing its disturbed version via a quantum privacy mechanism. We first show that an adversary's maximal expected ααα-gain using optimal measurement is characterized by measured conditional Rényi entropy. This can be viewed as a parametric generalization of König et al.'s famous guessing probability formula [IEEE Trans. Inf. Theory, 55(9), 2009]. Then, we prove that the ααα-leakage and maximal ααα-leakage for a quantum privacy mechanism are determined by measured Arimoto information and measured Rényi capacity, respectively. Various properties of maximal ααα-leakage, such as data processing inequality and composition property are established as well. Moreover, we show that regularized ααα-leakage and regularized maximal ααα-leakage for identical and independent quantum privacy mechanisms coincide with ααα-tilted sandwiched Rényi information and sandwiched Rényi capacity, respectively.
Maximal quantum leakage (MQL) is a worst-case information leakage measure that quantifies an adversary's inference advantage gained from accessing quantum encoding of classical data with arbitrary measurements. While MQL admits an exact characterization for a given ensemble of quantum states, its robustness to implementation imperfections has not been systematically studied. In this paper, we analyze the sensitivity of maximal quantum leakage under perturbations of the quantum encoding. We establish a continuity bound in terms of the trace distance between ideal and perturbed quantum states, and show, via an example, that this bound is attainable. We further derive fidelity-based and relative-entropy-based sufficient conditions for bounding the variation of maximal quantum leakage, and illustrate numerically that these conditions can be loose.
Maximal α\alphaα - Leakage for Quantum Privacy Mechanisms and Operational Meaning of Measured Renyi Capacity
In this work, maximal a-leakage is introduced to quantify how much a quantum adversary can learn about any sensitive information of data upon observing its disturbed versionvia a quantum privacy mechanism. We first show that an adversary's maximal expected a-gain using optimal measurement is characterized by measured conditional Renyi entropy. This can be viewed as a parametric generalization of Konig et al.'s famous guessing probability formula [IEEE Trans. Inf. Theory, 55(9), 2009]. Then, we prove that the a-leakage and maximalα\alphaα-leakage for a quantum privacy mechanism are determined by measured Arimoto information and measured Renyi capacity, respectively. Various properties of maximal a-leakage, such as data processing inequality and composition property are established as well. Moreover, we show that regularized a-leakage and regularized maximal a-leakage for identical and independent quantum privacy mechanisms coincide with a-tilted sandwiched Renyi information and sandwiched Renyi capacity, respectively. A full version of this paper is accessible at: https://arxiv.org/pdf/2403.14450 [1].
Maximal quantum leakage quantifies privacy against adversaries with arbitrary intentions. In this work, we prove that computing this leakage is equivalent to minimum-error quantum state discrimination with equal priors. This establishes a computable operational interpretation, addressing the previous difficulty in computing maximal quantum leakage. We further analyze the impact of collective measurements on multiple copies of a state, demonstrating that leakage increases monotonically with the number of copies, which leads to explicitly characterizing the maximal leakage in the asymptotic limit. Extending this framework to quantum channels, we develop an iterative algorithm for the jointly designing of input states and measurements. Numerical examples involving collective measurements and the maximal channel leakage demonstrate our theoretical findings.
Measurement incompatibility enables quantum advantages in communication and state discrimination. It is also necessary for Bell nonlocality, which is used in device-independent protocols for quantum key distribution and private randomness generation. Classical communication can influence the receiver's outcome and must therefore be accounted for when certifying measurement incompatibility. We introduce union maximal leakage, which quantifies the information needed for a common classical explanation of all observed probabilities and is computed from them by a linear program. If a message of at most kkk bits precedes the receiver's independent measurement choice, compatible measurements for each message give union maximal leakage at most kkk. This bound holds with any input-independent nonsignalling shared resource. In quantum theory, a violation also implies that the initially shared state is entangled. Conversely, union maximal leakage determines the minimum classical communication needed to reproduce the observations with compatible measurements and arbitrary nonsignalling assistance. For a fixed shared quantum state and receiver measurements, a violation is possible exactly when, for some message value, the receiver's measurements are Bell-nonlocal against two-outcome sender measurements on that state. For binary receiver outcomes, we show that a violation also certifies randomness private from the sender, even when the receiver's measurement depends on the sender's message and the sender retains quantum side information. We quantify this privacy through an explicit conditional entropy bound and establish composably secure randomness extraction in sequential protocols with device memory.