More and more quantum algorithms have been designed for solving problems in machine learning, database search and data analytics. An important problem then arises: how privacy can be protected when these algorithms are used on private data? For classical computing, the notion of differential privacy provides a very useful conceptual framework in which a great number of mechanisms that protect privacy by introducing certain noises into algorithms have been successfully developed. This paper defines a notion of differential privacy for quantum information processing. We carefully examine how the mechanisms using three important types of quantum noise, the amplitude/phase damping and depolarizing, can protect differential privacy. A composition theorem is proved that enables us to combine multiple privacy-preserving operations in quantum information processing.
More and more quantum algorithms have been designed for solving problems in machine learning, database search and data analytics. An important problem then arises: how privacy can be protected when these algorithms are used on private data? For classical computing, the notion of differential privacy provides a very useful conceptual framework in which a great number of mechanisms that protect privacy by introducing certain noises into algorithms have been successfully developed. This paper defines a notion of differential privacy for quantum information processing. We carefully examine how the mechanisms using three important types of quantum noise, the amplitude/phase damping and depolarizing, can protect differential privacy. A composition theorem is proved that enables us to combine multiple privacy-preserving operations in quantum information processing.
Quantum computing, as an emerging research field, is attracting people’s attention. It has been proven to be superior in many ways to classical computing. Differential privacy provides an easy way to achieve demonstrable privacy, and the most common method is to add noise to datasets. At this stage of quantum computers, noise is a factor that cannot be ignored. Indeed, the existence of noise will negatively affect the performance of quantum computers, but we can apply it to privacy protection. In this work, we will consider two situations: inherent noise and artificially added noise. The noise is added to the variational quantum algorithm to implement quantum machine learning with differential privacy. The importance of each type will be examined and less artificial noise is needed for a common privacy budget over classical machine learning. Composition theory will be invoked to prove the advantage of the entire quantum machine learning process.
Differential privacy (DP) is a widely used framework for protecting sensitive information in data analysis and machine learning. With growing interest in quantum computing, substantial effort has gone into extending DP to quantum algorithms. However, many existing formulations emphasise global state distinguishability or privacy for channels that output quantum states, which is often misaligned with settings where the final output consists of classical measurement data, as in both fault-tolerant and near-term devices. In this work, we develop an observable-based approach to quantum DP tailored to expectation-value estimation from quantum measurements. We introduce a neighbouring relation defined directly in terms of observable expectation values and give general private mechanisms for broad measurement protocols, including classical shadows and eigenbasis measurements. We also show that realistic device noise (e.g., local depolarising and generalised amplitude damping) can amplify privacy guarantees for k -local observables. Complementing these positive results for private measurements, we establish limitations for differentially private mechanisms that release quantum states. Finally, we show that our neighbouring relation is compatible with quantum encodings of classical data, enabling privacy guarantees for the underlying classical inputs.
Differential privacy provides a robust framework for protecting sensitive data, while maintaining its utility for computation. In essence, a differentially private algorithm takes as input the data of multiple parties, and returns an output disclosing minimal information about any individual party. Previous research has introduced several quantum extensions of differential privacy, with applications ranging from quantum machine learning on private classical data to quantum shadow tomography. However, the local model of quantum differential privacy – where each party is responsible for privatizing their own data at a local level – has received limited attention. This work delves into locally differentially private quantum measurements. Although any measurement can be made locally differentially private by adding noise to the outcome, we demonstrate that certain quantum measurements inherently satisfy some degree of local differential privacy for specific classes of input states. This finding has two significant implications: first, limiting the analysis to classical noise injection mechanisms may lead to suboptimal privacy-utility trade-offs for quantum data; second, the theory of differential privacy can be harnessed to further investigate the capabilities of quantum measurements. Motivated by these insights, we establish strong data processing inequalities for the quantum relative entropy under local differential privacy and apply these results to asymmetric hypothesis testing of quantum states with restricted measurements. Additionally, we prove an equivalence between quantum statistical queries and quantum differential privacy in the local model, thereby addressing an open question posed by Arunachalam et al. (2021). Finally, we consider the task of quantum multi-party computation under local differential privacy, demonstrating that parity functions can be efficiently learned in this model, whereas the corresponding classical task requires exponentially many samples.
Composition is a cornerstone of classical differential privacy, enabling strong end-to-end guarantees for complex algorithms through composition theorems (e.g., basic and advanced). In the quantum setting, however, privacy is defined operationally against arbitrary measurements, and classical composition arguments based on scalar privacy-loss random variables no longer apply. As a result, it has remained unclear when meaningful composition guarantees can be obtained for quantum differential privacy (QDP).
In this work, we clarify both the limitations and possibilities of composition in the quantum setting. We first show that classical-style composition fails in full generality for POVM-based approximate QDP: even quantum channels that are individually perfectly private can completely lose privacy when combined through correlated joint implementations. We then identify a setting in which clean composition guarantees can be restored. For tensor-product channels acting on product neighboring inputs, we introduce a quantum moments accountant based on an operator-valued notion of privacy loss and a matrix moment-generating function. Although the resulting Rényi-type divergence does not satisfy a data-processing inequality, we prove that controlling its moments suffices to bound measured Rényi divergence, yielding operational privacy guarantees against arbitrary measurements. This leads to advanced-composition-style bounds with the same leading-order behavior as in the classical theory.
Our results demonstrate that meaningful composition theorems for quantum differential privacy require carefully articulated structural assumptions on channels, inputs, and adversarial measurements, and provide a principled framework for understanding which classical ideas do and do not extend to the quantum setting.
Noise in quantum information processing is often viewed as a disruptive and difficult-to-avoid feature, especially in near-term quantum technologies.However, noise has often played beneficial roles, from enhancing weak signals in stochastic resonance to protecting the privacy of data in differential privacy.It is then natural to ask: Can we harness the power of quantum noise that is beneficial to quantum computing?An important current direction for quantum computing is its application to machine learning, such as classification problems.One outstanding problem in machine learning for classification is its sensitivity to adversarial examples.These are small, undetectable perturbations from the original data where the perturbed data is completely misclassified in otherwise extremely accurate classifiers.They can also be considered as worst-case perturbations by unknown noise sources.We show that by taking advantage of depolarization noise in quantum circuits for classification, a robustness bound against adversaries can be derived where the robustness improves with increasing noise.This robustness property is intimately connected with an important security concept called differential privacy, which can be extended to quantum differential privacy.For the protection of quantum data, this quantum protocol can be used against the most general adversaries.Furthermore, we show how the robustness in the classical case can be sensitive to the details of the classification model, but in the quantum case the details of the classification model are absent, thus also providing a potential quantum advantage for classical data.This opens the opportunity to explore other ways in which quantum noise can be used in our favor, as well as identifying other ways quantum algorithms can be helpful in a way which is distinct from quantum speedups.
Quantum computing has been widely applied in various fields, such as quantum physics simulations, quantum machine learning, and big data analysis. However, in the domains of data-driven paradigms, ensuring databases privacy. For classical computing, we can incorporate the concept of differential privacy (DP) to meet the standard of privacy preservation by manually adding noise. In quantum computing scenario, researchers have extended classic DP to quantum differential privacy (QDP) by considering quantum noise. In this paper, we propose a novel approach to satisfy the QDP definition by considering the errors generated by the projection operator measurement, which is denoted as shot noise. Then, we discuss the amount of privacy budget that can be achieved with shot noise, which serves as a metric for the level of privacy protection. Furthermore, we provide the QDP of shot noise in quantum circuits with depolarizing noise. Through numerical simulations, we show that shot noise can effectively provide privacy protection in quantum computing.