Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2605.24166

Optimal Quantum Differential Privacy via Fisher Information Spectral Analysis

Justice Owusu Agyemang, Jerry John Kponyo, Elliot Amponsah, Godfred Manu Addo Boakye

quant-phcs.CRSubmitted May 22, 2026• Announced May 26, 2026• 0 citations• Revised Jul 13, 2026 (v2)
v1 · May 22, 2026v2 · Jul 13, 2026
arXivHTMLPDF

Abstract

The Quantum Fisher Information (QFI) metric governs a fundamental duality: it quantifies both how precisely a parameter can be estimated (metrology) and how distinguishable two quantum states are (privacy). We exploit this duality to establish a geometry-aware framework for quantum differential privacy (DP) that replaces isotropic depolarizing noise with direction-dependent noise aligned to the QFI eigenstructure of the quantum embedding. We prove six principal theorems: (1) the minimax-optimal mechanism concentrates the noise budget in the dominant QFI eigenmode, achieving $\varepsilon = (Δ^2/2)λ_{\max}(1-cγ)$ with $O(d/λ_{\max})$ advantage; (2) mixed-state QFI decomposition reveals that dephasing in the adversary's basis $\textit{increases}$ accessible information, while misaligned-basis dephasing provides constructive privacy amplification from hardware noise; (3) a tight privacy $-$ utility uncertainty relation $\varepsilon \cdot (1 - F) \ge \frac{Δ^2}{2}\frac{\operatorname{Tr}(F)}{d}$; (4) adaptive QFI estimation converging at $O(1/\sqrt{n})$ yields $1.92\times$ tighter bounds; (5) QFI-aligned composition saturates at $O(1)$ versus $O(k)$ for standard composition; and (6) hardware noise can be harnessed for privacy amplification. Adversarial vulnerabilities, Wasserstein guarantees, subspace projection, and a zero-knowledge audit protocol follow as corollaries. Results are validated on Qiskit Aer GPU simulations, IBM Quantum hardware (ibm_fez, 156 qubits), and against classical DP baselines, achieving equivalent utility at $\varepsilon \approx 0.001$ versus $\varepsilon \approx 4800$ for classical DP.

Related papers

Quantum Information Ordering and Differential Privacy

Naqueeb Ahmad Warsi, Ayanava Dasgupta, Masahito Hayashi

We study quantum differential privacy (QDP) by defining a notion of the order of informativeness between two pairs of quantum states. In particular, we show that if the hypothesis testing divergence of the one pair dominates over that of the other pair, then this dominance holds for every $f$-divergence. This approach completely characterizes $(\varepsilon,δ)$-QDP mechanisms by identifying the most informative $(\varepsilon,δ)$-DP quantum state pairs. We apply this to study precise limits for privatized hypothesis testing and privatized quantum parameter estimation, including tight upper-bounds on the quantum Fisher information under QDP. Finally, we establish near-optimal contraction bounds for differentially private quantum channels with respect to the Hockey-Stick divergence.

quant-pharXiv:2511.01467•IEEE Transactions on Information Theory•Nov 4, 2025•0 citations

Precision and Privacy in Distributed Quantum Sensing: A Quantum Fisher Information Duality

Farhad Farokhi

We establish a quantum Fisher information (QFI) duality for distributed quantum sensor networks with local phase encoding. For any $N$-qubit probe state, where $N$ denotes the number of sensors, $F_Q(\boldsymbol{w}^\top \boldsymbolθ) + F_Q(\boldsymbol{v}^\top \boldsymbolθ) \leq N$ for all unit orthogonal sensing directions $\boldsymbol{w}$ and $\boldsymbol{v}$, with equality for all equatorial states when $N=2$ and for Greenberger--Horne--Zeilinger (GHZ) states when $N\geq 2$. Heisenberg-limited precision for direction $\boldsymbol{w}$, $F_Q(\boldsymbol{w}^\top \boldsymbolθ)=N$, saturates the bound and simultaneously forces zero QFI for all other independent directions. This can be interpreted as the condition for parameter privacy in distributed quantum sensing: attaining Heisenberg-limited precision for the sensing target renders all alternative privacy-intrusive estimations impossible.

quant-pharXiv:2605.20765•May 21, 2026•0 citations

A general framework for differentially private quantum measurements

Armando Angrisani, Mina Doosti, Elham Kashefi

Differential privacy (DP) is a widely used framework for protecting sensitive information in data analysis and machine learning. With growing interest in quantum computing, substantial effort has gone into extending DP to quantum algorithms. However, many existing formulations emphasise global state distinguishability or privacy for channels that output quantum states, which is often misaligned with settings where the final output consists of classical measurement data, as in both fault-tolerant and near-term devices. In this work, we develop an observable-based approach to quantum DP tailored to expectation-value estimation from quantum measurements. We introduce a neighbouring relation defined directly in terms of observable expectation values and give general private mechanisms for broad measurement protocols, including classical shadows and eigenbasis measurements. We also show that realistic device noise (e.g., local depolarising and generalised amplitude damping) can amplify privacy guarantees for k -local observables. Complementing these positive results for private measurements, we establish limitations for differentially private mechanisms that release quantum states. Finally, we show that our neighbouring relation is compatible with quantum encodings of classical data, enabling privacy guarantees for the underlying classical inputs.

ACM Transactions on Quantum Computing•Aug 20, 2026•0 citations

Guaranteeing Privacy in Hybrid Quantum Learning through Theoretical Mechanisms

Hoang M. Ngo, Tre' R. Jeter, Incheol Shin +3 more

Quantum Machine Learning (QML) is becoming increasingly prevalent due to its potential to enhance classical machine learning (ML) tasks, such as classification. Although quantum noise is often viewed as a major challenge in quantum computing, it also offers a unique opportunity to enhance privacy. In particular, intrinsic quantum noise provides a natural stochastic resource that, when rigorously analyzed within the differential privacy (DP) framework and composed with classical mechanisms, can satisfy formal $(\varepsilon, δ)$-DP guarantees. This enables a reduction in the required classical perturbation without compromising the privacy budget, potentially improving model utility. However, the integration of classical and quantum noise for privacy preservation remains unexplored. In this work, we propose a hybrid noise-added mechanism, HYPER-Q, that combines classical and quantum noise to protect the privacy of QML models. We provide a comprehensive analysis of its privacy guarantees and establish theoretical bounds on its utility. Empirically, we demonstrate that HYPER-Q outperforms existing classical noise-based mechanisms in terms of adversarial robustness across multiple real-world datasets.

quant-pharXiv:2602.02364•Feb 3, 2026•0 citations

Private training in quantum machine learning

Tigran Sedrakyan, Frédéric Grosshans, Elham Kashefi

With the emergence of machine learning (ML) models trained on large datasets containing potentially sensitive data, a major question in AI safety is how to make learning private with respect to the training data. Similar to classical machine learning, quantum machine learning (QML) models are not devoid of privacy vulnerabilities. Differential privacy (DP) is a standard tool for training ML models on sensitive data, but its impact in QML remains poorly understood. In this work we study private training in hybrid variational QML models using a classical private DP-SGD optimizer applied to pipelines with classical inputs and outputs. We analyze the interplay between gradient clipping and calibrated noise addition in DP-SGD, and its impact on optimization and accuracy for noisy and noiseless quantum models. We first explain why quantum noise does not provide a satisfactory replacement for the calibrated noise in DP-SGD for ensuring privacy. We then show how the deterministic bounds on gradient norms for a wide class of quantum models translate into explicit control of the detrimental clipping bias introduced by DP-SGD. Finally, we formulate a numerical comparison protocol under fixed clipping threshold and privacy budget and evaluate it on synthetic and image-classification tasks for equivalent quantum and classical models. Our results suggest that quantum models can retain higher accuracy in private-training regimes where the formal privacy guarantee is ensured by a classical DP-SGD mechanism.

quant-pharXiv:2606.29293•Jun 30, 2026•0 citations

Constructing Optimal Noise Channels for Enhanced Robustness in Quantum Machine Learning

David Winderl, Nicola Franco, Jeanette Miriam Lorenz

With the rapid advancement of Quantum Machine Learning (QML), the critical need to enhance security measures against adversarial attacks and protect QML models becomes increasingly evident. In this work, we outline the connection between quantum noise channels and differential privacy (DP), by constructing a family of noise channels which are inherently $ε$-DP: $(α, γ)$-channels. Through this approach, we successfully replicate the $ε$-DP bounds observed for depolarizing and random rotation channels, thereby affirming the broad generality of our framework. Additionally, we use a semi-definite program to construct an optimally robust channel. In a small-scale experimental evaluation, we demonstrate the benefits of using our optimal noise channel over depolarizing noise, particularly in enhancing adversarial accuracy. Moreover, we assess how the variables $α$ and $γ$ affect the certifiable robustness and investigate how different encoding methods impact the classifier's robustness.

arXiv:2404.16417•Apr 25, 2024•0 citations
The Quantum Fisher Information (QFI) metric governs a fundamental duality: it quantifies both how precisely a parameter can be estimated (metrology) and how distinguishable two quantum states are (privacy). We exploit this duality to establish a geometry-aware framework for quantum differential privacy (DP) that replaces isotropic depolarizing noise with direction-dependent noise aligned to the QFI eigenstructure of the quantum embedding. We prove six principal theorems: (1) the minimax-optimal mechanism concentrates the noise budget in the dominant QFI eigenmode, achieving ε=(Δ2/2)λmax⁡(1−cγ)\varepsilon = (Δ^2/2)λ_{\max}(1-cγ)ε=(Δ2/2)λmax​(1−cγ) with O(d/λmax⁡)O(d/λ_{\max})O(d/λmax​) advantage; (2) mixed-state QFI decomposition reveals that dephasing in the adversary's basis increases\textit{increases}increases accessible information, while misaligned-basis dephasing provides constructive privacy amplification from hardware noise; (3) a tight privacy −-− utility uncertainty relation ε⋅(1−F)≥Δ22Tr⁡(F)d\varepsilon \cdot (1 - F) \ge \frac{Δ^2}{2}\frac{\operatorname{Tr}(F)}{d}ε⋅(1−F)≥2Δ2​dTr(F)​; (4) adaptive QFI estimation converging at O(1/n)O(1/\sqrt{n})O(1/n​) yields 1.92×1.92\times1.92× tighter bounds; (5) QFI-aligned composition saturates at O(1)O(1)O(1) versus O(k)O(k)O(k) for standard composition; and (6) hardware noise can be harnessed for privacy amplification. Adversarial vulnerabilities, Wasserstein guarantees, subspace projection, and a zero-knowledge audit protocol follow as corollaries. Results are validated on Qiskit Aer GPU simulations, IBM Quantum hardware (ibm_fez, 156 qubits), and against classical DP baselines, achieving equivalent utility at ε≈0.001\varepsilon \approx 0.001ε≈0.001 versus ε≈4800\varepsilon \approx 4800ε≈4800 for classical DP.
We study quantum differential privacy (QDP) by defining a notion of the order of informativeness between two pairs of quantum states. In particular, we show that if the hypothesis testing divergence of the one pair dominates over that of the other pair, then this dominance holds for every fff-divergence. This approach completely characterizes (ε,δ)(\varepsilon,δ)(ε,δ)-QDP mechanisms by identifying the most informative (ε,δ)(\varepsilon,δ)(ε,δ)-DP quantum state pairs. We apply this to study precise limits for privatized hypothesis testing and privatized quantum parameter estimation, including tight upper-bounds on the quantum Fisher information under QDP. Finally, we establish near-optimal contraction bounds for differentially private quantum channels with respect to the Hockey-Stick divergence.
We establish a quantum Fisher information (QFI) duality for distributed quantum sensor networks with local phase encoding. For any NNN-qubit probe state, where NNN denotes the number of sensors, FQ(w⊤θ)+FQ(v⊤θ)≤NF_Q(\boldsymbol{w}^\top \boldsymbolθ) + F_Q(\boldsymbol{v}^\top \boldsymbolθ) \leq NFQ​(w⊤θ)+FQ​(v⊤θ)≤N for all unit orthogonal sensing directions w\boldsymbol{w}w and v\boldsymbol{v}v, with equality for all equatorial states when N=2N=2N=2 and for Greenberger--Horne--Zeilinger (GHZ) states when N≥2N\geq 2N≥2. Heisenberg-limited precision for direction w\boldsymbol{w}w, FQ(w⊤θ)=NF_Q(\boldsymbol{w}^\top \boldsymbolθ)=NFQ​(w⊤θ)=N, saturates the bound and simultaneously forces zero QFI for all other independent directions. This can be interpreted as the condition for parameter privacy in distributed quantum sensing: attaining Heisenberg-limited precision for the sensing target renders all alternative privacy-intrusive estimations impossible.
Differential privacy (DP) is a widely used framework for protecting sensitive information in data analysis and machine learning. With growing interest in quantum computing, substantial effort has gone into extending DP to quantum algorithms. However, many existing formulations emphasise global state distinguishability or privacy for channels that output quantum states, which is often misaligned with settings where the final output consists of classical measurement data, as in both fault-tolerant and near-term devices. In this work, we develop an observable-based approach to quantum DP tailored to expectation-value estimation from quantum measurements. We introduce a neighbouring relation defined directly in terms of observable expectation values and give general private mechanisms for broad measurement protocols, including classical shadows and eigenbasis measurements. We also show that realistic device noise (e.g., local depolarising and generalised amplitude damping) can amplify privacy guarantees for k -local observables. Complementing these positive results for private measurements, we establish limitations for differentially private mechanisms that release quantum states. Finally, we show that our neighbouring relation is compatible with quantum encodings of classical data, enabling privacy guarantees for the underlying classical inputs.
Quantum Machine Learning (QML) is becoming increasingly prevalent due to its potential to enhance classical machine learning (ML) tasks, such as classification. Although quantum noise is often viewed as a major challenge in quantum computing, it also offers a unique opportunity to enhance privacy. In particular, intrinsic quantum noise provides a natural stochastic resource that, when rigorously analyzed within the differential privacy (DP) framework and composed with classical mechanisms, can satisfy formal (ε,δ)(\varepsilon, δ)(ε,δ)-DP guarantees. This enables a reduction in the required classical perturbation without compromising the privacy budget, potentially improving model utility. However, the integration of classical and quantum noise for privacy preservation remains unexplored. In this work, we propose a hybrid noise-added mechanism, HYPER-Q, that combines classical and quantum noise to protect the privacy of QML models. We provide a comprehensive analysis of its privacy guarantees and establish theoretical bounds on its utility. Empirically, we demonstrate that HYPER-Q outperforms existing classical noise-based mechanisms in terms of adversarial robustness across multiple real-world datasets.
With the emergence of machine learning (ML) models trained on large datasets containing potentially sensitive data, a major question in AI safety is how to make learning private with respect to the training data. Similar to classical machine learning, quantum machine learning (QML) models are not devoid of privacy vulnerabilities. Differential privacy (DP) is a standard tool for training ML models on sensitive data, but its impact in QML remains poorly understood. In this work we study private training in hybrid variational QML models using a classical private DP-SGD optimizer applied to pipelines with classical inputs and outputs. We analyze the interplay between gradient clipping and calibrated noise addition in DP-SGD, and its impact on optimization and accuracy for noisy and noiseless quantum models. We first explain why quantum noise does not provide a satisfactory replacement for the calibrated noise in DP-SGD for ensuring privacy. We then show how the deterministic bounds on gradient norms for a wide class of quantum models translate into explicit control of the detrimental clipping bias introduced by DP-SGD. Finally, we formulate a numerical comparison protocol under fixed clipping threshold and privacy budget and evaluate it on synthetic and image-classification tasks for equivalent quantum and classical models. Our results suggest that quantum models can retain higher accuracy in private-training regimes where the formal privacy guarantee is ensured by a classical DP-SGD mechanism.
With the rapid advancement of Quantum Machine Learning (QML), the critical need to enhance security measures against adversarial attacks and protect QML models becomes increasingly evident. In this work, we outline the connection between quantum noise channels and differential privacy (DP), by constructing a family of noise channels which are inherently εεε-DP: (α,γ)(α, γ)(α,γ)-channels. Through this approach, we successfully replicate the εεε-DP bounds observed for depolarizing and random rotation channels, thereby affirming the broad generality of our framework. Additionally, we use a semi-definite program to construct an optimally robust channel. In a small-scale experimental evaluation, we demonstrate the benefits of using our optimal noise channel over depolarizing noise, particularly in enhancing adversarial accuracy. Moreover, we assess how the variables ααα and γγγ affect the certifiable robustness and investigate how different encoding methods impact the classifier's robustness.