Quantum machine learning (QML) has the potential to achieve quantum advantage for specific tasks by combining quantum computation with classical machine learning (ML). In classical ML, a significant challenge is membership-privacy leakage, whereby an attacker can infer from model outputs whether specific data were used in training. When specific data are required to be withdrawn, removing their influence from the trained model becomes necessary. Machine unlearning (MU) addresses this issue by enabling the model to forget the withdrawn data, thereby preventing membership-privacy leakage. However, this leakage remains underexplored in QML. This raises two research questions: do QML models leak membership privacy about their training data, and can MU methods efficiently mitigate such leakage in QML models? We investigate these questions using two quantum neural network (QNN) architectures, a basic QNN and a hybrid QNN, evaluated in noiseless simulations and cloud quantum device demonstrations. To answer the first question, we analyze how quantum constraints shape membership-privacy leakage in QML and then formalize a realistic gray-box threat model accordingly. Based on this, we design a membership inference attack (MIA) tailored to QNN outputs, and our results provide clear evidence of membership leakage in both QNNs. To answer the second question, we propose a quantum machine unlearning (QMU) framework, comprising three MU mechanisms. Evaluations on two QNN architectures show that QMU removes the influence of the withdrawn data while preserving accuracy for retained data. A comparative analysis further characterizes the three MU mechanisms with respect to data dependence, computational cost, and robustness.
Quantum machine learning (QML) has the potential to achieve quantum advantage for specific tasks by combining quantum computation with classical machine learning (ML). In classical ML, a significant challenge is membership-privacy leakage, whereby an attacker can infer from model outputs whether specific data were used in training. When specific data are required to be withdrawn, removing their influence from the trained model becomes necessary. Machine unlearning (MU) addresses this issue by enabling the model to forget the withdrawn data, thereby preventing membership-privacy leakage. However, this leakage remains underexplored in QML. This raises two research questions: do QML models leak membership privacy about their training data, and can MU methods efficiently mitigate such leakage in QML models? We investigate these questions using two quantum neural network (QNN) architectures, a basic QNN and a hybrid QNN, evaluated in noiseless simulations and cloud quantum device demonstrations. To answer the first question, we analyze how quantum constraints shape membership-privacy leakage in QML and then formalize a realistic gray-box threat model accordingly. Based on this, we design a membership inference attack (MIA) tailored to QNN outputs, and our results provide clear evidence of membership leakage in both QNNs. To answer the second question, we propose a quantum machine unlearning (QMU) framework, comprising three MU mechanisms. Evaluations on two QNN architectures show that QMU removes the influence of the withdrawn data while preserving accuracy for retained data. A comparative analysis further characterizes the three MU mechanisms with respect to data dependence, computational cost, and robustness.
Quantum Machine Learning (QML) has shown rapid advances by utilizing quantum computing for machine learning tasks. Meanwhile, the privacy risks accompanying QML is also starting to be studied, which inherit privacy leakage channels from "classical" ML and also quantum-unique risks. Existing work on privacy-preserving QML largely focuses on a QML-as-a-service scenario, which generally assumes that the QML model owner provides only classical bit outputs to queries, while users (and adversaries) have only classical computing abilities. However, this view is increasingly challenged in a quantum-native world of quantum-capable users/adversaries, which may have access to both quantum computing abilities and access to quantum information output from service providers.
In this paper, we aim to bridge this gap by examining membership inference attacks against QML models by demonstrating that increasing quantum access and quantum computing abilities provides provable theoretical privacy leakage and empirical adversarial gain. However, the probabilistic nature of QML introduces a gap between theoretical and empirical adversarial advantage. These results show that existing research on privacy leakage in QML models underestimates privacy leakage in emergent quantum-native access regimes, and we hope to establish a first step in examining potential privacy leakages for QML in the quantum-native world.
With the emergence of machine learning (ML) models trained on large datasets containing potentially sensitive data, a major question in AI safety is how to make learning private with respect to the training data. Similar to classical machine learning, quantum machine learning (QML) models are not devoid of privacy vulnerabilities. Differential privacy (DP) is a standard tool for training ML models on sensitive data, but its impact in QML remains poorly understood. In this work we study private training in hybrid variational QML models using a classical private DP-SGD optimizer applied to pipelines with classical inputs and outputs. We analyze the interplay between gradient clipping and calibrated noise addition in DP-SGD, and its impact on optimization and accuracy for noisy and noiseless quantum models. We first explain why quantum noise does not provide a satisfactory replacement for the calibrated noise in DP-SGD for ensuring privacy. We then show how the deterministic bounds on gradient norms for a wide class of quantum models translate into explicit control of the detrimental clipping bias introduced by DP-SGD. Finally, we formulate a numerical comparison protocol under fixed clipping threshold and privacy budget and evaluate it on synthetic and image-classification tasks for equivalent quantum and classical models. Our results suggest that quantum models can retain higher accuracy in private-training regimes where the formal privacy guarantee is ensured by a classical DP-SGD mechanism.
Abstract Quantum machine learning is expected to utilize the potential advantages of quantum computing to advance the efficiency of machine learning. However, with the help of quantum cloud servers, ordinary users may confront the threat of privacy leakage of input data and models when performing the training or inference of quantum neural networks (QNNs). To address this problem, we present a new framework that allows the training and inference of delegated QNNs to be performed on encrypted data to protect the privacy of users’ data and models. This framework contains two models that are alternately trained: an encryptor and a predictor. The classical client first trains the encryptor defined by a classical neural network to map plaintext input data to vastly different ciphertext data. The ciphertext data is sent to the quantum cloud server to train the predictor defined by a QNN, which can indirectly predict the labels of plaintext data. With the trained encryptor and predictor, the client can send the encrypted data to the server for prediction and obtain almost equivalent prediction results. The proposed framework is applied to three types of QNN models, each dealing with low-dimensional tabular data, image data, and one-dimensional time series data, respectively. Experimental results show that the privacy protection method based on our framework can protect data and model privacy without degrading the performance of QNNs. The framework does not require users to have quantum capabilities and is suitable for protecting data and model privacy for various QNN models.
Quantum Machine Learning (QML) fuses quantum computing with machine learning to address complex tasks with potential speedups over classical methods. While QML models such as variational quantum classifiers (QVC), quantum multilayer perceptron(QMLP) models and quantum convolutional neural networks (QCNN) have demonstrated promise in applications like image recognition and malware classification, they remain vulnerable to adversarial threats. Inspired by the vulnerabilities in classical ML, this work systematically investigates how attacks-ranging from training-time poisoning and inferencetime evasion (e.g., quantum versions of FGSM and PGD) to deployment-time trigger attacks-manifest in quantum circuits. We explore how classical adversarial strategies adapt to quantum models through parameterized encodings, hybrid architectures, and probabilistic outputs. The poster evaluates different quantum classifiers under adversarial settings, comparing their robustness, trainability, and resilience to perturbations. Defense mechanisms such as randomized encoding, engineered noise channels, and quantum adversarial training are analyzed in relation to specific threat types. In addition, we assess how quantum models behave differently than classical counterparts under attack, and how quantum-specific design constraints can either exacerbate or mitigate these effects. Our ultimate goal is to define and construct robust QML systems that are both theoretically sound and practically secure. By synthesizing results across multiple QML architectures and threat models, this work provides actionable insight into the development of resilient quantum classifiers, paving the way toward trustworthy and scalable quantum machine learning.
Machine unlearning aims to remove the influence of specific training data from a learned model without full retraining. While recent work has begun to explore unlearning in quantum machine learning, existing approaches largely rely on fixed, uniform target distributions and do not explicitly control the trade-off between forgetting and retained model behaviour. In this work, we propose a distribution-guided framework for class-level quantum machine unlearning that treats unlearning as a constrained optimization problem. Our method introduces a tunable target distribution derived from model similarity statistics, decoupling the suppression of forgotten-class confidence from assumptions about redistribution among retained classes. We further incorporate an anchor-based preservation constraint that explicitly maintains predictive behaviour on selected retained data, yielding a controlled optimization trajectory that limits deviation from the original model. We evaluate the approach on variational quantum classifiers trained on the Iris and Covertype datasets. Results demonstrate sharp suppression of forgotten-class confidence, minimal degradation of retained-class performance, and closer alignment with the gold retrained model baselines compared to uniform-target unlearning. These findings highlight the importance of target design and constraint-based formulations for reliable and interpretable quantum machine unlearning.
We present the first empirical study of machine unlearning (MU) in hybrid quantum-classical neural networks. While MU has been extensively explored in classical deep learning, its behavior within variational quantum circuits (VQCs) and quantum-augmented architectures remains largely unexplored. First, we adapt a broad suite of unlearning methods to quantum settings, including gradient-based, distillation-based, regularization-based and certified techniques. Second, we introduce two new unlearning strategies tailored to hybrid models. Experiments across Iris, MNIST, and Fashion-MNIST, under both subset removal and full-class deletion, reveal that quantum models can support effective unlearning, but outcomes depend strongly on circuit depth, entanglement structure, and task complexity. Shallow VQCs display high intrinsic stability with minimal memorization, whereas deeper hybrid models exhibit stronger trade-offs between utility, forgetting strength, and alignment with retrain oracle. We find that certain methods, e.g. EU-k, LCA, and Certified Unlearning, consistently provide the best balance across metrics. These findings establish baseline empirical insights into quantum machine unlearning and highlight the need for quantum-aware algorithms and theoretical guarantees, as quantum machine learning systems continue to expand in scale and capability. We publicly release our code at: https://github.com/CrivoiCarla/HQML.