Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Classical-Quantum Differentially Private Mechanisms Beyond Classical Ones.

Yuuya Yoshida

Published Nov 19, 2020• 0 citations
OpenAlex

Abstract

Let $\varepsilon>0$. An $n$-tuple $(p_i)_{i=1}^n$ of probability vectors is called (classical) $\varepsilon$-differentially private ($\varepsilon$-DP) if $e^\varepsilon p_j-p_i$ has no negative entries for all $i,j=1,\ldots,n$. An $n$-tuple $(\rho_i)_{i=1}^n$ of density matrices is called classical-quantum $\varepsilon$-differentially private (CQ $\varepsilon$-DP) if $e^\varepsilon\rho_j-\rho_i$ is positive semi-definite for all $i,j=1,\ldots,n$. We denote by $\mathrm{C}_n(\varepsilon)$ the set of all $\varepsilon$-DP $n$-tuples, by $\mathrm{CQ}_n(\varepsilon)$ the set of all CQ $\varepsilon$-DP $n$-tuples, and by $\mathrm{EC}_n(\varepsilon)$ the set of all $n$-tuples $(\sum_k p_i(k)\sigma_k)_{i=1}^n$ with $(p_i)_{i=1}^n\in\mathrm{C}_n(\varepsilon)$ and density matrices $\sigma_k$. The set $\mathrm{EC}_n(\varepsilon)$ is a subset of $\mathrm{CQ}_n(\varepsilon)$, and is essentially classical in optimization. In a preceding study, it is known that $\mathrm{EC}_2(\varepsilon)=\mathrm{CQ}_2(\varepsilon)$. In this paper, we show that $\mathrm{EC}_n(\varepsilon)\not=\mathrm{CQ}_n(\varepsilon)$ for every $n\ge3$, and give a sufficient condition for a CQ $\varepsilon$-DP $n$-tuple not to lie in $\mathrm{EC}_n(\varepsilon)$.

Related papers

Mathematical comparison of classical and quantum mechanisms in optimization under local differential privacy

Yuuya Yoshida

Abstract Differential privacy (DP) is an influential method of protecting private data, and is a condition for a conditional probability distribution. Since we can regard DP as a condition for a tuple of probability vectors, it is natural to consider a similar condition for a tuple of density matrices as a quantum version of DP. This condition is called classical-quantum DP (CQ-DP) because it is considered in converting classical data to quantum states. In the study of DP (including CQ-DP), a positive parameter ɛ represents the privacy level to be guaranteed. In this paper, we show that CQ-DP has a quantum advantage in certain optimization problems. Moreover, we compare classical DP and CQ-DP mathematically to clarify a relation between privacy level and quantum advantage.

arXiv:2011.09960•Journal of Physics A Mathematical and Theoretical•Dec 18, 2024•4 citations

Classical Mechanism is Optimal in Classical-Quantum Differentially Private Mechanisms

Yuuya Yoshida, Masahito Hayashi

Differential privacy (DP) is an influential privacy measure and has been studied to protect private data. DP has been often studied in classical probability theory, but few researchers studied quantum versions of DP. In this paper, we consider classical-quantum DP mechanisms which (i) convert binary private data to quantum states and (ii) satisfy a quantum version of the DP constraint. The class of classical-quantum DP mechanisms contains classical DP mechanisms. As a main result, we show that some classical DP mechanism optimizes any information quantity satisfying the information processing inequality. Therefore, the performance of classical DP mechanisms attains that of classical-quantum DP mechanisms.

IEEE International Symposium on Information Theory (ISIT)•Jun 1, 2020•9 citations

Private training in quantum machine learning

Tigran Sedrakyan, Frédéric Grosshans, Elham Kashefi

With the emergence of machine learning (ML) models trained on large datasets containing potentially sensitive data, a major question in AI safety is how to make learning private with respect to the training data. Similar to classical machine learning, quantum machine learning (QML) models are not devoid of privacy vulnerabilities. Differential privacy (DP) is a standard tool for training ML models on sensitive data, but its impact in QML remains poorly understood. In this work we study private training in hybrid variational QML models using a classical private DP-SGD optimizer applied to pipelines with classical inputs and outputs. We analyze the interplay between gradient clipping and calibrated noise addition in DP-SGD, and its impact on optimization and accuracy for noisy and noiseless quantum models. We first explain why quantum noise does not provide a satisfactory replacement for the calibrated noise in DP-SGD for ensuring privacy. We then show how the deterministic bounds on gradient norms for a wide class of quantum models translate into explicit control of the detrimental clipping bias introduced by DP-SGD. Finally, we formulate a numerical comparison protocol under fixed clipping threshold and privacy budget and evaluate it on synthetic and image-classification tasks for equivalent quantum and classical models. Our results suggest that quantum models can retain higher accuracy in private-training regimes where the formal privacy guarantee is ensured by a classical DP-SGD mechanism.

quant-pharXiv:2606.29293•Jun 30, 2026•0 citations

A general framework for differentially private quantum measurements

Armando Angrisani, Mina Doosti, Elham Kashefi

Differential privacy (DP) is a widely used framework for protecting sensitive information in data analysis and machine learning. With growing interest in quantum computing, substantial effort has gone into extending DP to quantum algorithms. However, many existing formulations emphasise global state distinguishability or privacy for channels that output quantum states, which is often misaligned with settings where the final output consists of classical measurement data, as in both fault-tolerant and near-term devices. In this work, we develop an observable-based approach to quantum DP tailored to expectation-value estimation from quantum measurements. We introduce a neighbouring relation defined directly in terms of observable expectation values and give general private mechanisms for broad measurement protocols, including classical shadows and eigenbasis measurements. We also show that realistic device noise (e.g., local depolarising and generalised amplitude damping) can amplify privacy guarantees for k -local observables. Complementing these positive results for private measurements, we establish limitations for differentially private mechanisms that release quantum states. Finally, we show that our neighbouring relation is compatible with quantum encodings of classical data, enabling privacy guarantees for the underlying classical inputs.

ACM Transactions on Quantum Computing•Aug 20, 2026•0 citations

Optimal quantum locally differentially private mechanisms in the high-privacy regime

Yuuya Yoshida

We optimize the trade-off between privacy and utility in the high-privacy regime. We adopt local differential privacy (LDP) and its quantum extension, quantum local differential privacy (QLDP), for privacy protection, and investigate utility functions including the Holevo information (which reduces to the mutual information in the classical case) and the error exponents in symmetric and asymmetric hypothesis testing. Under the LDP and QLDP constraints, these utility functions have classical and quantum optimal values, which we denote simply by $C$ and $Q$, respectively, in this abstract. In this paper, we provide optimal LDP and QLDP mechanisms achieving the classical and quantum optimal values in the high-privacy regime, and prove that the asymptotic ratio $Q/C$ in this regime takes the same value regardless of the utility function. Our results reveal quantum advantages (specifically, $Q/C\ge3/2$) for the above utility functions when the private data take at least three possible values. In addition, conditional on a mathematical conjecture concerning equi-isoclinic tight fusion frames (EITFFs), our QLDP mechanisms also exhibit quantum advantages in a moderate-privacy regime.

quant-pharXiv:2605.27278•May 27, 2026•0 citations

Differential Privacy of Quantum and Quantum-Inspired Classical Recommendation Algorithms

Chenjian Li, Mingsheng Ying, Guan, Ji

We study the differential privacy (DP) of the quantum recommendation algorithm of Kerenidis--Prakash and its quantum-inspired classical counterpart. Under standard low-rank and incoherence assumptions on the preference matrix, we show that the randomness already present in the algorithms' measurement/$\ell_2$-sampling steps can act as a privacy-curating mechanism, yielding $(\varepsilon,δ)$-DP without injecting additional DP noise through the interface. Concretely, for a system with $m$ users and $n$ items and rank parameter $k$, we prove $\varepsilon=\mathcal O(\sqrt{k/n})$ and $δ= \mathcal O\big(k^2/\min^2\{m,n\}\big)$; in the typical regime $k=\mathrm{polylog}(m,n)$ this simplifies to $\varepsilon=\tilde{\mathcal O}(1/\sqrt n)$ and $δ=\tilde{\mathcal O}\big(1/\min^2\{m,n\}\big)$. Our analysis introduces a perturbation technique for truncated SVD under a single-entry update, which tracks the induced change in the low-rank reconstruction while avoiding unstable singular-vector comparisons. Finally, we validate the scaling on real-world rating datasets and compare against classical DP recommender baselines.

arXiv:2502.04758•Feb 7, 2025•0 citations
Let ε>0\varepsilon>0ε>0. An nnn-tuple (pi)i=1n(p_i)_{i=1}^n(pi​)i=1n​ of probability vectors is called (classical) ε\varepsilonε-differentially private (ε\varepsilonε-DP) if eεpj−pie^\varepsilon p_j-p_ieεpj​−pi​ has no negative entries for all i,j=1,…,ni,j=1,\ldots,ni,j=1,…,n. An nnn-tuple (ρi)i=1n(\rho_i)_{i=1}^n(ρi​)i=1n​ of density matrices is called classical-quantum ε\varepsilonε-differentially private (CQ ε\varepsilonε-DP) if eερj−ρie^\varepsilon\rho_j-\rho_ieερj​−ρi​ is positive semi-definite for all i,j=1,…,ni,j=1,\ldots,ni,j=1,…,n. We denote by Cn(ε)\mathrm{C}_n(\varepsilon)Cn​(ε) the set of all ε\varepsilonε-DP nnn-tuples, by CQn(ε)\mathrm{CQ}_n(\varepsilon)CQn​(ε) the set of all CQ ε\varepsilonε-DP nnn-tuples, and by ECn(ε)\mathrm{EC}_n(\varepsilon)ECn​(ε) the set of all nnn-tuples (∑kpi(k)σk)i=1n(\sum_k p_i(k)\sigma_k)_{i=1}^n(∑k​pi​(k)σk​)i=1n​ with (pi)i=1n∈Cn(ε)(p_i)_{i=1}^n\in\mathrm{C}_n(\varepsilon)(pi​)i=1n​∈Cn​(ε) and density matrices σk\sigma_kσk​. The set ECn(ε)\mathrm{EC}_n(\varepsilon)ECn​(ε) is a subset of CQn(ε)\mathrm{CQ}_n(\varepsilon)CQn​(ε), and is essentially classical in optimization. In a preceding study, it is known that EC2(ε)=CQ2(ε)\mathrm{EC}_2(\varepsilon)=\mathrm{CQ}_2(\varepsilon)EC2​(ε)=CQ2​(ε). In this paper, we show that ECn(ε)≠CQn(ε)\mathrm{EC}_n(\varepsilon)\not=\mathrm{CQ}_n(\varepsilon)ECn​(ε)=CQn​(ε) for every n≥3n\ge3n≥3, and give a sufficient condition for a CQ ε\varepsilonε-DP nnn-tuple not to lie in ECn(ε)\mathrm{EC}_n(\varepsilon)ECn​(ε).
Abstract Differential privacy (DP) is an influential method of protecting private data, and is a condition for a conditional probability distribution. Since we can regard DP as a condition for a tuple of probability vectors, it is natural to consider a similar condition for a tuple of density matrices as a quantum version of DP. This condition is called classical-quantum DP (CQ-DP) because it is considered in converting classical data to quantum states. In the study of DP (including CQ-DP), a positive parameter ɛ represents the privacy level to be guaranteed. In this paper, we show that CQ-DP has a quantum advantage in certain optimization problems. Moreover, we compare classical DP and CQ-DP mathematically to clarify a relation between privacy level and quantum advantage.
Differential privacy (DP) is an influential privacy measure and has been studied to protect private data. DP has been often studied in classical probability theory, but few researchers studied quantum versions of DP. In this paper, we consider classical-quantum DP mechanisms which (i) convert binary private data to quantum states and (ii) satisfy a quantum version of the DP constraint. The class of classical-quantum DP mechanisms contains classical DP mechanisms. As a main result, we show that some classical DP mechanism optimizes any information quantity satisfying the information processing inequality. Therefore, the performance of classical DP mechanisms attains that of classical-quantum DP mechanisms.
With the emergence of machine learning (ML) models trained on large datasets containing potentially sensitive data, a major question in AI safety is how to make learning private with respect to the training data. Similar to classical machine learning, quantum machine learning (QML) models are not devoid of privacy vulnerabilities. Differential privacy (DP) is a standard tool for training ML models on sensitive data, but its impact in QML remains poorly understood. In this work we study private training in hybrid variational QML models using a classical private DP-SGD optimizer applied to pipelines with classical inputs and outputs. We analyze the interplay between gradient clipping and calibrated noise addition in DP-SGD, and its impact on optimization and accuracy for noisy and noiseless quantum models. We first explain why quantum noise does not provide a satisfactory replacement for the calibrated noise in DP-SGD for ensuring privacy. We then show how the deterministic bounds on gradient norms for a wide class of quantum models translate into explicit control of the detrimental clipping bias introduced by DP-SGD. Finally, we formulate a numerical comparison protocol under fixed clipping threshold and privacy budget and evaluate it on synthetic and image-classification tasks for equivalent quantum and classical models. Our results suggest that quantum models can retain higher accuracy in private-training regimes where the formal privacy guarantee is ensured by a classical DP-SGD mechanism.
Differential privacy (DP) is a widely used framework for protecting sensitive information in data analysis and machine learning. With growing interest in quantum computing, substantial effort has gone into extending DP to quantum algorithms. However, many existing formulations emphasise global state distinguishability or privacy for channels that output quantum states, which is often misaligned with settings where the final output consists of classical measurement data, as in both fault-tolerant and near-term devices. In this work, we develop an observable-based approach to quantum DP tailored to expectation-value estimation from quantum measurements. We introduce a neighbouring relation defined directly in terms of observable expectation values and give general private mechanisms for broad measurement protocols, including classical shadows and eigenbasis measurements. We also show that realistic device noise (e.g., local depolarising and generalised amplitude damping) can amplify privacy guarantees for k -local observables. Complementing these positive results for private measurements, we establish limitations for differentially private mechanisms that release quantum states. Finally, we show that our neighbouring relation is compatible with quantum encodings of classical data, enabling privacy guarantees for the underlying classical inputs.
We optimize the trade-off between privacy and utility in the high-privacy regime. We adopt local differential privacy (LDP) and its quantum extension, quantum local differential privacy (QLDP), for privacy protection, and investigate utility functions including the Holevo information (which reduces to the mutual information in the classical case) and the error exponents in symmetric and asymmetric hypothesis testing. Under the LDP and QLDP constraints, these utility functions have classical and quantum optimal values, which we denote simply by CCC and QQQ, respectively, in this abstract. In this paper, we provide optimal LDP and QLDP mechanisms achieving the classical and quantum optimal values in the high-privacy regime, and prove that the asymptotic ratio Q/CQ/CQ/C in this regime takes the same value regardless of the utility function. Our results reveal quantum advantages (specifically, Q/C≥3/2Q/C\ge3/2Q/C≥3/2) for the above utility functions when the private data take at least three possible values. In addition, conditional on a mathematical conjecture concerning equi-isoclinic tight fusion frames (EITFFs), our QLDP mechanisms also exhibit quantum advantages in a moderate-privacy regime.
We study the differential privacy (DP) of the quantum recommendation algorithm of Kerenidis--Prakash and its quantum-inspired classical counterpart. Under standard low-rank and incoherence assumptions on the preference matrix, we show that the randomness already present in the algorithms' measurement/ℓ2\ell_2ℓ2​-sampling steps can act as a privacy-curating mechanism, yielding (ε,δ)(\varepsilon,δ)(ε,δ)-DP without injecting additional DP noise through the interface. Concretely, for a system with mmm users and nnn items and rank parameter kkk, we prove ε=O(k/n)\varepsilon=\mathcal O(\sqrt{k/n})ε=O(k/n​) and δ=O(k2/min⁡2{m,n})δ= \mathcal O\big(k^2/\min^2\{m,n\}\big)δ=O(k2/min2{m,n}); in the typical regime k=polylog(m,n)k=\mathrm{polylog}(m,n)k=polylog(m,n) this simplifies to ε=O~(1/n)\varepsilon=\tilde{\mathcal O}(1/\sqrt n)ε=O~(1/n​) and δ=O~(1/min⁡2{m,n})δ=\tilde{\mathcal O}\big(1/\min^2\{m,n\}\big)δ=O~(1/min2{m,n}). Our analysis introduces a perturbation technique for truncated SVD under a single-entry update, which tracks the induced change in the low-rank reconstruction while avoiding unstable singular-vector comparisons. Finally, we validate the scaling on real-world rating datasets and compare against classical DP recommender baselines.