Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IEEE International Symposium on Information Theory (ISIT)

Maximal $\alpha$ - Leakage for Quantum Privacy Mechanisms and Operational Meaning of Measured Renyi Capacity

Bo-Yu Yang, Hsuan Yu, Hao–Chung Cheng

Published Jul 7, 2024• 0 citations
Publisher

Abstract

In this work, maximal a-leakage is introduced to quantify how much a quantum adversary can learn about any sensitive information of data upon observing its disturbed versionvia a quantum privacy mechanism. We first show that an adversary's maximal expected a-gain using optimal measurement is characterized by measured conditional Renyi entropy. This can be viewed as a parametric generalization of Konig et al.'s famous guessing probability formula [IEEE Trans. Inf. Theory, 55(9), 2009]. Then, we prove that the a-leakage and maximal$\alpha$-leakage for a quantum privacy mechanism are determined by measured Arimoto information and measured Renyi capacity, respectively. Various properties of maximal a-leakage, such as data processing inequality and composition property are established as well. Moreover, we show that regularized a-leakage and regularized maximal a-leakage for identical and independent quantum privacy mechanisms coincide with a-tilted sandwiched Renyi information and sandwiched Renyi capacity, respectively. A full version of this paper is accessible at: https://arxiv.org/pdf/2403.14450 [1].

DOI
10.1109/isit57864.2024.10619592

Related papers

Maximal ααα-Leakage for Quantum Privacy Mechanisms

Bo-Yu Yang, Hsuan Yu, Hao–Chung Cheng

In this work, maximal $α$-leakage is introduced to quantify how much a quantum adversary can learn about any sensitive information of data upon observing its disturbed version via a quantum privacy mechanism. We first show that an adversary's maximal expected $α$-gain using optimal measurement is characterized by measured conditional Rényi entropy. This can be viewed as a parametric generalization of König et al.'s famous guessing probability formula [IEEE Trans. Inf. Theory, 55(9), 2009]. Then, we prove that the $α$-leakage and maximal $α$-leakage for a quantum privacy mechanism are determined by measured Arimoto information and measured Rényi capacity, respectively. Various properties of maximal $α$-leakage, such as data processing inequality and composition property are established as well. Moreover, we show that regularized $α$-leakage and regularized maximal $α$-leakage for identical and independent quantum privacy mechanisms coincide with $α$-tilted sandwiched Rényi information and sandwiched Rényi capacity, respectively.

arXiv:2403.14450•Mar 21, 2024•0 citations

Maximal information leakage from quantum encoding of classical data

Farhad Farokhi

An alternative measure of information leakage for quantum encoding of classical data is defined. An adversary can access a single copy of the state of a quantum system that encodes some classical data and is interested in correctly guessing a general randomized or deterministic function of the data (e.g., a specific feature or attribute of the data in quantum machine learning) that is unknown to the security analyst. The resulting measure of information leakage, referred to as maximal quantum leakage, is the multiplicative increase of the probability of correctly guessing any function of the classical data upon observing measurements of the quantum state. Maximal quantum leakage is shown to satisfy the postprocessing inequality (i.e., applying a quantum channel reduces information leakage) and independence property (i.e., leakage is zero if the quantum state is independent of the classical data), which are fundamental properties required for privacy and security analysis. It also bounds accessible information. Effects of global and local depolarizing noise models on the maximal quantum leakage are established.

arXiv:2307.12529•Physical Review A•Feb 16, 2024•5 citations

Barycentric and Pairwise Renyi Quantum Leakage

Farhad Farokhi

Barycentric and pairwise quantum Renyi leakages are proposed as two measures of information leakage for privacy and security analysis in quantum computing and communication systems. These quantities both require minimal assumptions on the eavesdropper, i.e., they do not make any assumptions on the eavesdropper's attack strategy or the statistical prior on the secret or private classical data encoded in the quantum system. They also satisfy important properties of positivity, independence, post-processing inequality, and unitary invariance. The barycentric quantum Renyi leakage can be computed by solving a semi-definite program and the pairwise quantum Renyi leakage possesses an explicit formula. The barycentric and pairwise quantum Renyi leakages form upper bounds on the maximal quantum leakage, the sandwiched quantum $α$-mutual information, the accessible information, and the Holevo's information. Furthermore, differentially-private quantum channels are shown to bound these measures of information leakage. Global and local depolarizing channels, that are common models of noise in quantum computing and communication, restrict private or secure information leakage. Finally, a privacy-utility trade-off formula in quantum machine learning using variational circuits is developed. The privacy guarantees can only be strengthened, i.e., information leakage can only be reduced, if the performance degradation grows larger and vice versa.

arXiv:2402.06156•Feb 9, 2024•1 citation

Privacy Implies Stability: Information-Theoretic Generalization Bounds for Quantum Learning

Ayanava Dasgupta, Naqueeb Ahmad Warsi, Masahito Hayashi

We develop an information-theoretic framework connecting stability, privacy, and generalization for quantum learning algorithms. Learning procedures are modeled as quantum instruments with classical-quantum outputs, and losses are represented by observables. We prove that under a classical-quantum sub-Gaussian condition, an information-theoretic stability measure controls the expected generalization error. Furthermore, we establish a high-probability generalization bound using quantum Rényi divergences to manage higher-order dependencies under non-commutativity. In the trusted Data Processor setting, quantum differential privacy (QDP) provides a mechanism for stability. We show that one-neighbor QDP strictly bounds the information leaked by the classical-quantum output. Combining this with our stability theorem yields a direct privacy-to-generalization guarantee. We also explore an untrusted Data Processor setting. Here, output privacy alone is insufficient since an adversarial processor could perform a highly informative procedure before applying noisy post-processing. To combat this, we introduce Information-Theoretic Admissibility (ITA), a certification condition ensuring the prescribed procedure is not just a degraded version of a strictly more informative, physically allowed operation on the encoded ensemble. We prove a fundamental separation: while admissibility and privacy are in strong tension in classical models, quantum non-orthogonality makes them compatible. A quantum measurement can be ITA - exhausting all relevant accessible information - without perfectly recovering the classical dataset. We illustrate this separation through a concrete quantum ITA example.

quant-pharXiv:2602.01177•Feb 3, 2026•0 citations

Barycentric and pairwise Rényi quantum leakage with application to privacy-utility trade-off

Farhad Farokhi

Barycentric and pairwise quantum Rényi leakages are proposed as two measures of information leakage for privacy and security analysis in quantum computing and communication systems. These quantities both require minimal assumptions on the eavesdropper, i.e. they do not make any assumptions on the eavesdropper’s attack strategy or the statistical prior on the secret or private classical data encoded in the quantum system. They also satisfy important properties of positivity, independence, post-processing inequality and unitary invariance. The barycentric quantum Rényi leakage can be computed by solving a semi-definite program; the pairwise quantum Rényi leakage possesses an explicit formula. The barycentric and pairwise quantum Rényi leakages form upper bounds on the maximal quantum leakage, the sandwiched quantum α -mutual information, the accessible information and the Holevo’s information. Furthermore, differentially private quantum channels are shown to bound these measures of information leakage. Global and local depolarizing channels, that are common models of noise in quantum computing and communication, restrict private or secure information leakage. Finally, a privacy-utility trade-off formula in quantum machine learning using variational circuits is developed. The privacy guarantees can only be strengthened, i.e. information leakage can only be reduced, if the performance degradation grows larger and vice versa .

Proceedings of the Royal Society A Mathematical Physical and Engineering Sciences•Dec 1, 2024•1 citation

Perturbation Analysis of Maximal Quantum Leakage

Zijia Zhao, Shuixin Xiao, Farhad Farokhi

Maximal quantum leakage (MQL) is a worst-case information leakage measure that quantifies an adversary's inference advantage gained from accessing quantum encoding of classical data with arbitrary measurements. While MQL admits an exact characterization for a given ensemble of quantum states, its robustness to implementation imperfections has not been systematically studied. In this paper, we analyze the sensitivity of maximal quantum leakage under perturbations of the quantum encoding. We establish a continuity bound in terms of the trace distance between ideal and perturbed quantum states, and show, via an example, that this bound is attainable. We further derive fidelity-based and relative-entropy-based sufficient conditions for bounding the variation of maximal quantum leakage, and illustrate numerically that these conditions can be loose.

quant-pharXiv:2607.14469•Jul 17, 2026•0 citations
Maximal α\alphaα - Leakage for Quantum Privacy Mechanisms and Operational Meaning of Measured Renyi Capacity
In this work, maximal a-leakage is introduced to quantify how much a quantum adversary can learn about any sensitive information of data upon observing its disturbed versionvia a quantum privacy mechanism. We first show that an adversary's maximal expected a-gain using optimal measurement is characterized by measured conditional Renyi entropy. This can be viewed as a parametric generalization of Konig et al.'s famous guessing probability formula [IEEE Trans. Inf. Theory, 55(9), 2009]. Then, we prove that the a-leakage and maximalα\alphaα-leakage for a quantum privacy mechanism are determined by measured Arimoto information and measured Renyi capacity, respectively. Various properties of maximal a-leakage, such as data processing inequality and composition property are established as well. Moreover, we show that regularized a-leakage and regularized maximal a-leakage for identical and independent quantum privacy mechanisms coincide with a-tilted sandwiched Renyi information and sandwiched Renyi capacity, respectively. A full version of this paper is accessible at: https://arxiv.org/pdf/2403.14450 [1].
In this work, maximal ααα-leakage is introduced to quantify how much a quantum adversary can learn about any sensitive information of data upon observing its disturbed version via a quantum privacy mechanism. We first show that an adversary's maximal expected ααα-gain using optimal measurement is characterized by measured conditional Rényi entropy. This can be viewed as a parametric generalization of König et al.'s famous guessing probability formula [IEEE Trans. Inf. Theory, 55(9), 2009]. Then, we prove that the ααα-leakage and maximal ααα-leakage for a quantum privacy mechanism are determined by measured Arimoto information and measured Rényi capacity, respectively. Various properties of maximal ααα-leakage, such as data processing inequality and composition property are established as well. Moreover, we show that regularized ααα-leakage and regularized maximal ααα-leakage for identical and independent quantum privacy mechanisms coincide with ααα-tilted sandwiched Rényi information and sandwiched Rényi capacity, respectively.
An alternative measure of information leakage for quantum encoding of classical data is defined. An adversary can access a single copy of the state of a quantum system that encodes some classical data and is interested in correctly guessing a general randomized or deterministic function of the data (e.g., a specific feature or attribute of the data in quantum machine learning) that is unknown to the security analyst. The resulting measure of information leakage, referred to as maximal quantum leakage, is the multiplicative increase of the probability of correctly guessing any function of the classical data upon observing measurements of the quantum state. Maximal quantum leakage is shown to satisfy the postprocessing inequality (i.e., applying a quantum channel reduces information leakage) and independence property (i.e., leakage is zero if the quantum state is independent of the classical data), which are fundamental properties required for privacy and security analysis. It also bounds accessible information. Effects of global and local depolarizing noise models on the maximal quantum leakage are established.
Barycentric and pairwise quantum Renyi leakages are proposed as two measures of information leakage for privacy and security analysis in quantum computing and communication systems. These quantities both require minimal assumptions on the eavesdropper, i.e., they do not make any assumptions on the eavesdropper's attack strategy or the statistical prior on the secret or private classical data encoded in the quantum system. They also satisfy important properties of positivity, independence, post-processing inequality, and unitary invariance. The barycentric quantum Renyi leakage can be computed by solving a semi-definite program and the pairwise quantum Renyi leakage possesses an explicit formula. The barycentric and pairwise quantum Renyi leakages form upper bounds on the maximal quantum leakage, the sandwiched quantum ααα-mutual information, the accessible information, and the Holevo's information. Furthermore, differentially-private quantum channels are shown to bound these measures of information leakage. Global and local depolarizing channels, that are common models of noise in quantum computing and communication, restrict private or secure information leakage. Finally, a privacy-utility trade-off formula in quantum machine learning using variational circuits is developed. The privacy guarantees can only be strengthened, i.e., information leakage can only be reduced, if the performance degradation grows larger and vice versa.
We develop an information-theoretic framework connecting stability, privacy, and generalization for quantum learning algorithms. Learning procedures are modeled as quantum instruments with classical-quantum outputs, and losses are represented by observables. We prove that under a classical-quantum sub-Gaussian condition, an information-theoretic stability measure controls the expected generalization error. Furthermore, we establish a high-probability generalization bound using quantum Rényi divergences to manage higher-order dependencies under non-commutativity. In the trusted Data Processor setting, quantum differential privacy (QDP) provides a mechanism for stability. We show that one-neighbor QDP strictly bounds the information leaked by the classical-quantum output. Combining this with our stability theorem yields a direct privacy-to-generalization guarantee. We also explore an untrusted Data Processor setting. Here, output privacy alone is insufficient since an adversarial processor could perform a highly informative procedure before applying noisy post-processing. To combat this, we introduce Information-Theoretic Admissibility (ITA), a certification condition ensuring the prescribed procedure is not just a degraded version of a strictly more informative, physically allowed operation on the encoded ensemble. We prove a fundamental separation: while admissibility and privacy are in strong tension in classical models, quantum non-orthogonality makes them compatible. A quantum measurement can be ITA - exhausting all relevant accessible information - without perfectly recovering the classical dataset. We illustrate this separation through a concrete quantum ITA example.
Barycentric and pairwise quantum Rényi leakages are proposed as two measures of information leakage for privacy and security analysis in quantum computing and communication systems. These quantities both require minimal assumptions on the eavesdropper, i.e. they do not make any assumptions on the eavesdropper’s attack strategy or the statistical prior on the secret or private classical data encoded in the quantum system. They also satisfy important properties of positivity, independence, post-processing inequality and unitary invariance. The barycentric quantum Rényi leakage can be computed by solving a semi-definite program; the pairwise quantum Rényi leakage possesses an explicit formula. The barycentric and pairwise quantum Rényi leakages form upper bounds on the maximal quantum leakage, the sandwiched quantum α -mutual information, the accessible information and the Holevo’s information. Furthermore, differentially private quantum channels are shown to bound these measures of information leakage. Global and local depolarizing channels, that are common models of noise in quantum computing and communication, restrict private or secure information leakage. Finally, a privacy-utility trade-off formula in quantum machine learning using variational circuits is developed. The privacy guarantees can only be strengthened, i.e. information leakage can only be reduced, if the performance degradation grows larger and vice versa .
Maximal quantum leakage (MQL) is a worst-case information leakage measure that quantifies an adversary's inference advantage gained from accessing quantum encoding of classical data with arbitrary measurements. While MQL admits an exact characterization for a given ensemble of quantum states, its robustness to implementation imperfections has not been systematically studied. In this paper, we analyze the sensitivity of maximal quantum leakage under perturbations of the quantum encoding. We establish a continuity bound in terms of the trace distance between ideal and perturbed quantum states, and show, via an example, that this bound is attainable. We further derive fidelity-based and relative-entropy-based sufficient conditions for bounding the variation of maximal quantum leakage, and illustrate numerically that these conditions can be loose.