Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

ACM Symposium on Theory of Computing (STOC)

Gentle measurement of quantum states and differential privacy

Scott Aaronson, Guy N. Rothblum

Published Jun 20, 2019• 98 citations
Publisher

Abstract

In differential privacy (DP), we want to query a database about n users, in a way that “leaks at most ε about any individual user,” even conditioned on any outcome of the query. Meanwhile, in gentle measurement, we want to measure n quantum states, in a way that “damages the states by at most α,” even conditioned on any outcome of the measurement. In both cases, we can achieve the goal by techniques like deliberately adding noise to the outcome before returning it. This paper proves a new and general connection between the two subjects. Specifically, we show that on products of n quantum states, any measurement that is α-gentle for small α is also O( α) -DP, and any product measurement that is ε-DP is also O( ε√n) -gentle.

DOI
10.1145/3313276.3316378

Related papers

Sample-optimal learning of quantum states using gentle measurements

Cristina Butucea, Jan Johannes, Henning Stein

Gentle measurements of quantum states do not entirely collapse the initial state. Instead, they provide a post-measurement state at a prescribed trace distance α from the initial state together with a random variable used for quantum learning of the initial state. We introduce here the class of α−locally-gentle measurements (α−LGM) on a finite dimensional quantum system which are product measurements on product states and prove a strong quantum Data-Processing Inequality (qDPI) on this class using an improved relation between gentleness and quantum differential privacy. We further show a gentle quantum Neyman-Pearson lemma which implies that our qDPI is asymptotically optimal (for small α). This inequality is employed to show that the necessary number of quantum states for prescribed accuracy ϵ is of order 1∕(ϵ2α2) for both quantum tomography and quantum state certification. Finally, we propose an α−LGM called quantum Label Switch that attains these bounds. It is a general implementable method to turn any two-outcome measurement into an α−LGM.

arXiv:2505.24587•Electronic Journal of Statistics•Jan 1, 2026•0 citations

Optimal estimation of high-dimensional quantum states using locally gentle measurements

Cristina Butucea, Jan Johannes, Henning Stein

We study the task of estimating a $d-$dimensional quantum state $ρ$ under the constraint that the measurement is $α-$gentle. Such measurements $M$ do not collapse the state; they issue both a random variable $R^M = ω$ containing statistical information and a post-measurement state $ρ_{M \to ω}$ such that $\|ρ_{M\to ω} - ρ\|_{Tr} \leq α$. We describe gentle measurements and their connection to quantum differential privacy. Our results show that the optimal minimax estimation rate in Frobenius norm is of order $d^3/(n α^2)$, instead of $d^2/n$ for general measurements. Moreover, for rank $r$ states with $r\leq d$ we prove that the optimal minimax rate is $rd^2/(n α^2)$, instead of $rd/n$. Very surprisingly, the loss for gentleness $d/α^2$ scales with the ambient dimension of the Hilbert space, rather than the number of parameters $rd$, typically seen in classical differential privacy. We propose optimal gentle measurements and indicate how they can be physically implemented using an ancillary state and a CNOT gate to entangle it with the initial state. We notice that the resulting random variable has a likelihood that satisfies local differential privacy. Lower bounds are proven through a new quantum information-theoretic inequality applied to well chosen families of states in the manifold of (small-rank) quantum states.

math.STCross-listedarXiv:2607.24491•Jul 28, 2026•0 citations

Quantum Differential Privacy in the Local Model

Armando Angrisani, Elham Kashefi

Differential privacy provides a robust framework for protecting sensitive data, while maintaining its utility for computation. In essence, a differentially private algorithm takes as input the data of multiple parties, and returns an output disclosing minimal information about any individual party. Previous research has introduced several quantum extensions of differential privacy, with applications ranging from quantum machine learning on private classical data to quantum shadow tomography. However, the local model of quantum differential privacy – where each party is responsible for privatizing their own data at a local level – has received limited attention. This work delves into locally differentially private quantum measurements. Although any measurement can be made locally differentially private by adding noise to the outcome, we demonstrate that certain quantum measurements inherently satisfy some degree of local differential privacy for specific classes of input states. This finding has two significant implications: first, limiting the analysis to classical noise injection mechanisms may lead to suboptimal privacy-utility trade-offs for quantum data; second, the theory of differential privacy can be harnessed to further investigate the capabilities of quantum measurements. Motivated by these insights, we establish strong data processing inequalities for the quantum relative entropy under local differential privacy and apply these results to asymmetric hypothesis testing of quantum states with restricted measurements. Additionally, we prove an equivalence between quantum statistical queries and quantum differential privacy in the local model, thereby addressing an open question posed by Arunachalam et al. (2021). Finally, we consider the task of quantum multi-party computation under local differential privacy, demonstrating that parity functions can be efficiently learned in this model, whereas the corresponding classical task requires exponentially many samples.

IEEE Transactions on Information Theory•Mar 18, 2025•3 citations

Differential Privacy Amplification in Quantum and Quantum-inspired Algorithms

Armando Angrisani, Mina Doosti, Elham Kashefi

Differential privacy provides a theoretical framework for processing a dataset about $n$ users, in a way that the output reveals a minimal information about any single user. Such notion of privacy is usually ensured by noise-adding mechanisms and amplified by several processes, including subsampling, shuffling, iteration, mixing and diffusion. In this work, we provide privacy amplification bounds for quantum and quantum-inspired algorithms. In particular, we show for the first time, that algorithms running on quantum encoding of a classical dataset or the outcomes of quantum-inspired classical sampling, amplify differential privacy. Moreover, we prove that a quantum version of differential privacy is amplified by the composition of quantum channels, provided that they satisfy some mixing conditions.

arXiv:2203.03604•Mar 7, 2022•10 citations

Answering Counting Queries with Differential Privacy on a Quantum Computer

Arghya Mukherjee, Hassan Jameel Asghar, Gavin K. Brennen

Differential privacy is a mathematical notion of data privacy that has fast become the de facto standard in privacy-preserving data analysis. Recently a lot of work has focused on differential privacy in the quantum setting. Continuing on this line of study, we investigate how to answer counting queries on a quantum encoded dataset with differential privacy. An example of a counting query is ``How many people in the dataset are over the age of 25 and with a university education?'' Counting queries form the most basic but nonetheless rich set of statistics extractable from a dataset. We show that answering these queries on a quantum encoded dataset reduces to measuring the amplitude of one of two orthogonal states. We then analyze the differential privacy properties of two algorithms from literature to measure amplitude: one which performs repeated measurements in the computational basis, and the other which utilizes the classic amplitude estimation algorithm. For the first technique, we prove privacy results for the case of counting queries that improve on previously known results on general queries, and show that the mechanism in fact \emph{amplifies} privacy due to inherent randomness. For the second method, we derive a tight bound on maximum possible change in the amplitude if we add or remove a single item in the dataset, a quantity called global sensitivity which is central in making an algorithm differentially private. We then show a differentially private version of the amplitude estimation algorithm for counting queries. We also discuss how these methods can be outsourced to a quantum server to blindly compute counting queries with differential privacy.

quant-pharXiv:2604.10881•Apr 14, 2026•0 citations

Differential Privacy of Quantum and Quantum-Inspired Classical Recommendation Algorithms

Chenjian Li, Mingsheng Ying, Guan, Ji

We study the differential privacy (DP) of the quantum recommendation algorithm of Kerenidis--Prakash and its quantum-inspired classical counterpart. Under standard low-rank and incoherence assumptions on the preference matrix, we show that the randomness already present in the algorithms' measurement/$\ell_2$-sampling steps can act as a privacy-curating mechanism, yielding $(\varepsilon,δ)$-DP without injecting additional DP noise through the interface. Concretely, for a system with $m$ users and $n$ items and rank parameter $k$, we prove $\varepsilon=\mathcal O(\sqrt{k/n})$ and $δ= \mathcal O\big(k^2/\min^2\{m,n\}\big)$; in the typical regime $k=\mathrm{polylog}(m,n)$ this simplifies to $\varepsilon=\tilde{\mathcal O}(1/\sqrt n)$ and $δ=\tilde{\mathcal O}\big(1/\min^2\{m,n\}\big)$. Our analysis introduces a perturbation technique for truncated SVD under a single-entry update, which tracks the induced change in the low-rank reconstruction while avoiding unstable singular-vector comparisons. Finally, we validate the scaling on real-world rating datasets and compare against classical DP recommender baselines.

arXiv:2502.04758•Feb 7, 2025•0 citations
In differential privacy (DP), we want to query a database about n users, in a way that “leaks at most ε about any individual user,” even conditioned on any outcome of the query. Meanwhile, in gentle measurement, we want to measure n quantum states, in a way that “damages the states by at most α,” even conditioned on any outcome of the measurement. In both cases, we can achieve the goal by techniques like deliberately adding noise to the outcome before returning it. This paper proves a new and general connection between the two subjects. Specifically, we show that on products of n quantum states, any measurement that is α-gentle for small α is also O( α) -DP, and any product measurement that is ε-DP is also O( ε√n) -gentle.
Gentle measurements of quantum states do not entirely collapse the initial state. Instead, they provide a post-measurement state at a prescribed trace distance α from the initial state together with a random variable used for quantum learning of the initial state. We introduce here the class of α−locally-gentle measurements (α−LGM) on a finite dimensional quantum system which are product measurements on product states and prove a strong quantum Data-Processing Inequality (qDPI) on this class using an improved relation between gentleness and quantum differential privacy. We further show a gentle quantum Neyman-Pearson lemma which implies that our qDPI is asymptotically optimal (for small α). This inequality is employed to show that the necessary number of quantum states for prescribed accuracy ϵ is of order 1∕(ϵ2α2) for both quantum tomography and quantum state certification. Finally, we propose an α−LGM called quantum Label Switch that attains these bounds. It is a general implementable method to turn any two-outcome measurement into an α−LGM.
We study the task of estimating a d−d-d−dimensional quantum state ρρρ under the constraint that the measurement is α−α-α−gentle. Such measurements MMM do not collapse the state; they issue both a random variable RM=ωR^M = ωRM=ω containing statistical information and a post-measurement state ρM→ωρ_{M \to ω}ρM→ω​ such that ∥ρM→ω−ρ∥Tr≤α\|ρ_{M\to ω} - ρ\|_{Tr} \leq α∥ρM→ω​−ρ∥Tr​≤α. We describe gentle measurements and their connection to quantum differential privacy. Our results show that the optimal minimax estimation rate in Frobenius norm is of order d3/(nα2)d^3/(n α^2)d3/(nα2), instead of d2/nd^2/nd2/n for general measurements. Moreover, for rank rrr states with r≤dr\leq dr≤d we prove that the optimal minimax rate is rd2/(nα2)rd^2/(n α^2)rd2/(nα2), instead of rd/nrd/nrd/n. Very surprisingly, the loss for gentleness d/α2d/α^2d/α2 scales with the ambient dimension of the Hilbert space, rather than the number of parameters rdrdrd, typically seen in classical differential privacy. We propose optimal gentle measurements and indicate how they can be physically implemented using an ancillary state and a CNOT gate to entangle it with the initial state. We notice that the resulting random variable has a likelihood that satisfies local differential privacy. Lower bounds are proven through a new quantum information-theoretic inequality applied to well chosen families of states in the manifold of (small-rank) quantum states.
Differential privacy provides a robust framework for protecting sensitive data, while maintaining its utility for computation. In essence, a differentially private algorithm takes as input the data of multiple parties, and returns an output disclosing minimal information about any individual party. Previous research has introduced several quantum extensions of differential privacy, with applications ranging from quantum machine learning on private classical data to quantum shadow tomography. However, the local model of quantum differential privacy – where each party is responsible for privatizing their own data at a local level – has received limited attention. This work delves into locally differentially private quantum measurements. Although any measurement can be made locally differentially private by adding noise to the outcome, we demonstrate that certain quantum measurements inherently satisfy some degree of local differential privacy for specific classes of input states. This finding has two significant implications: first, limiting the analysis to classical noise injection mechanisms may lead to suboptimal privacy-utility trade-offs for quantum data; second, the theory of differential privacy can be harnessed to further investigate the capabilities of quantum measurements. Motivated by these insights, we establish strong data processing inequalities for the quantum relative entropy under local differential privacy and apply these results to asymmetric hypothesis testing of quantum states with restricted measurements. Additionally, we prove an equivalence between quantum statistical queries and quantum differential privacy in the local model, thereby addressing an open question posed by Arunachalam et al. (2021). Finally, we consider the task of quantum multi-party computation under local differential privacy, demonstrating that parity functions can be efficiently learned in this model, whereas the corresponding classical task requires exponentially many samples.
Differential privacy provides a theoretical framework for processing a dataset about nnn users, in a way that the output reveals a minimal information about any single user. Such notion of privacy is usually ensured by noise-adding mechanisms and amplified by several processes, including subsampling, shuffling, iteration, mixing and diffusion. In this work, we provide privacy amplification bounds for quantum and quantum-inspired algorithms. In particular, we show for the first time, that algorithms running on quantum encoding of a classical dataset or the outcomes of quantum-inspired classical sampling, amplify differential privacy. Moreover, we prove that a quantum version of differential privacy is amplified by the composition of quantum channels, provided that they satisfy some mixing conditions.
Differential privacy is a mathematical notion of data privacy that has fast become the de facto standard in privacy-preserving data analysis. Recently a lot of work has focused on differential privacy in the quantum setting. Continuing on this line of study, we investigate how to answer counting queries on a quantum encoded dataset with differential privacy. An example of a counting query is ``How many people in the dataset are over the age of 25 and with a university education?'' Counting queries form the most basic but nonetheless rich set of statistics extractable from a dataset. We show that answering these queries on a quantum encoded dataset reduces to measuring the amplitude of one of two orthogonal states. We then analyze the differential privacy properties of two algorithms from literature to measure amplitude: one which performs repeated measurements in the computational basis, and the other which utilizes the classic amplitude estimation algorithm. For the first technique, we prove privacy results for the case of counting queries that improve on previously known results on general queries, and show that the mechanism in fact \emph{amplifies} privacy due to inherent randomness. For the second method, we derive a tight bound on maximum possible change in the amplitude if we add or remove a single item in the dataset, a quantity called global sensitivity which is central in making an algorithm differentially private. We then show a differentially private version of the amplitude estimation algorithm for counting queries. We also discuss how these methods can be outsourced to a quantum server to blindly compute counting queries with differential privacy.
We study the differential privacy (DP) of the quantum recommendation algorithm of Kerenidis--Prakash and its quantum-inspired classical counterpart. Under standard low-rank and incoherence assumptions on the preference matrix, we show that the randomness already present in the algorithms' measurement/ℓ2\ell_2ℓ2​-sampling steps can act as a privacy-curating mechanism, yielding (ε,δ)(\varepsilon,δ)(ε,δ)-DP without injecting additional DP noise through the interface. Concretely, for a system with mmm users and nnn items and rank parameter kkk, we prove ε=O(k/n)\varepsilon=\mathcal O(\sqrt{k/n})ε=O(k/n​) and δ=O(k2/min⁡2{m,n})δ= \mathcal O\big(k^2/\min^2\{m,n\}\big)δ=O(k2/min2{m,n}); in the typical regime k=polylog(m,n)k=\mathrm{polylog}(m,n)k=polylog(m,n) this simplifies to ε=O~(1/n)\varepsilon=\tilde{\mathcal O}(1/\sqrt n)ε=O~(1/n​) and δ=O~(1/min⁡2{m,n})δ=\tilde{\mathcal O}\big(1/\min^2\{m,n\}\big)δ=O~(1/min2{m,n}). Our analysis introduces a perturbation technique for truncated SVD under a single-entry update, which tracks the induced change in the low-rank reconstruction while avoiding unstable singular-vector comparisons. Finally, we validate the scaling on real-world rating datasets and compare against classical DP recommender baselines.