Federated Learning (FL) enables privacy-preserving collaborative training but faces significant challenges when client data must be removed or malicious updates forgotten. Regulatory requirements and backdoor threats necessitate efficient, selective unlearning methods. However, existing approximate approaches modify large portions of model parameters, increasing vulnerability to gradient inversion attacks and degrading utility. We propose HQSU (Hybrid Quantum Selective Unlearning), a hybrid quantum-classical framework that performs selective unlearning via low-rank Hessian subspace modeling and variational quantum influence estimation. HQSU preserves 96.83% clean accuracy and reduces backdoor attack success to 9.95%, matching full retraining while modifying only 0.314% of parameters, over$300 \times$fewer than dense-update baselines. Experiments on MNIST show that HQSU achieves the lowest residual backdoor accuracy among approximate methods with stable recovery dynamics. Circuit ablations indicate that amplitude-encoded, circularly entangled ansätze provide the strongest influence estimation under NISQ constraints. These results demonstrate that hybrid quantum modeling can significantly improve selectivity, stability, and privacy in federated unlearning.
Federated Learning (FL) enables privacy-preserving collaborative training but faces significant challenges when client data must be removed or malicious updates forgotten. Regulatory requirements and backdoor threats necessitate efficient, selective unlearning methods. However, existing approximate approaches modify large portions of model parameters, increasing vulnerability to gradient inversion attacks and degrading utility. We propose HQSU (Hybrid Quantum Selective Unlearning), a hybrid quantum-classical framework that performs selective unlearning via low-rank Hessian subspace modeling and variational quantum influence estimation. HQSU preserves 96.83% clean accuracy and reduces backdoor attack success to 9.95%, matching full retraining while modifying only 0.314% of parameters, over300×fewer than dense-update baselines. Experiments on MNIST show that HQSU achieves the lowest residual backdoor accuracy among approximate methods with stable recovery dynamics. Circuit ablations indicate that amplitude-encoded, circularly entangled ansätze provide the strongest influence estimation under NISQ constraints. These results demonstrate that hybrid quantum modeling can significantly improve selectivity, stability, and privacy in federated unlearning.
In this study, A Quantum-Classical Federated Learning (QCFL) framework designed for skin cancer prediction is presented. It integrates classical convolutional neural networks with variational quantum circuits so that both quantum computing and deep learning can be used in decentralized, privacy-preserving environments. The functioning of the Federated Learning model includes a efficient optimization algorithm suitable for quantum environments in FL called SCAFFOLD, which handle client heterogeneity and non-IID data distributions modeled using Dirichlet sampling. The framework includes three ways of training normal training along with trigger-based and semantic-based backdoor attacks to understand demonstrating the susceptibility of federated skin cancer models to stealthy adversarial behaviors. To defend against such threats, multiple detection and mitigation strategies are evaluated, including Activation Clustering, Neural Cleanse, and Fine-Pruning. . Additionally, a novel approach for defense, Spectral Defense, is proposed and developed, based on the eigen-spectrum analysis of internal neural activations to detect and ultimately suppress backdoor behavior without recourse to clean validation data. Experimental results on this hybrid quantum-classical model prove improvement in classification performance, whereas the Spectral Defense framework provides significant attack success rates reduction with little degradation in model accuracy. This work provides a robust and scalable approach for deploying secure federated learning systems to adverse conditions for medical image analysis.
Quantum Federated Learning (QFL) inherits the core vulnerability of federated optimization to malicious clients, while also introducing an attack surface from variational circuit training and measurement-driven gradients. This work proposes a novel CircUit-Level backdoor Threat (CULT) model that formalizes four stealthy attacks by exploiting quantum-aware mechanisms, including Grover, Pauli, Bit-flip, and Sign-flip. By enabling malicious clients on both in-training and post-training surfaces, these attacks can critically undermine the learning process. We establish a rigorous theoretical foundation to demonstrate attack stealthiness under standard smoothness assumptions. Experiments on the MNIST and CIFAR-10 datasets with non-IID splits and varying fractions of malicious clients show that even a single malicious client can induce severe accuracy degradation under FedAvg aggregation. While popular defenses, including Krum, Multi-Krum, FoolsGold, FLGuardian, and Mud-HoG, reduce degradation in many regimes, they fail to eliminate worst-case failure cases, where accuracy drops up to 50\%. The experimental analysis further reveals that under the CULT model, malicious updates effectively mask their presence by staying close to benign norms, thereby helping attackers evade detection.
Federated learning (FL) is a widely used method for training machine learning (ML) models in a scalable way while preserving privacy (i.e., without centralizing raw data). Prior research shows that the risk of exposing sensitive data increases cumulatively as the number of iterations where a client's updates are included in the aggregated model increase. Attackers can launch membership inference attacks (MIA; deciding whether a sample or client participated), property inference attacks (PIA; inferring attributes of a client's data), and model inversion attacks (MI; reconstructing inputs), thereby inferring client-specific attributes and, in some cases, reconstructing inputs. In this paper, we mitigate risk by substantially reducing per client exposure using a quantum computing-inspired quadratic unconstrained binary optimization (QUBO) formulation that selects a small subset of client updates most relevant for each training round. In this work, we focus on two threat vectors: (i) information leakage by clients during training and (ii) adversaries who can query or obtain the global model. We assume a trusted central server and do not model server compromise. This method also assumes that the server has access to a validation/test set with global data distribution. Experiments on the MNIST dataset with 300 clients in 20 rounds showed a 95.2% per-round and 49% cumulative privacy exposure reduction, with 147 clients' updates never being used during training while maintaining in general the full-aggregation accuracy or even better. The method proved to be efficient at lower scale and more complex model as well. A CINIC-10 dataset-based experiment with 30 clients resulted in 82% per-round privacy improvement and 33% cumulative privacy.
Quantum federated learning trains a quantum neural network (QNN) across nodes that hold quantum data, such as the states of quantum sensors. To forget data, unlearning methods for quantum models replay them, and federated unlearning from stored updates removes whole nodes only. Quantum data cannot be replayed, since a state is consumed when measured and cannot be cloned. We propose Shadow-based Data Erasure (SHADE), in which each node records a classical shadow of every training state, a few randomized single-qubit measurements taken at training time. The gradient and curvature of a QNN on a state are expectations of observables, so SHADE estimates them for the forget data from the shadows at any later parameters and removes their effect by a federated Newton correction. Only classical estimates cross the network. We prove that the shadow size needed for a target unlearning error grows exponentially in the size of the backward light cone of the measured observable and not in the number of qubits. In simulation with 50 nodes and on edge boards, SHADE matches the forget accuracy of retraining within 0.5 points, without replay and in under 0.2 s.
Quantum machine learning (QML) is increasingly recognized as one of the most promising near-term applications of quantum computing, viewed as a next-frontier candidate beyond purely classical approaches. Hybrid quantum-classical models operationalize this potential by embedding a parameterized quantum circuit within a model where all other components remain classical-a design already applied to chemistry simulation, financial modeling, and image classification. However, their deployment in privacy-sensitive, multi-party settings is constrained by the need to avoid centralizing raw data and by the requirement that modern quantum circuits remain parameter-efficient to stay trainable at scale. In this paper, we address these constraints by evaluating federated learning (FL) as a means of combining a hybrid quantum-classical active party with a classical passive party, using Sherpa.ai's Blind Vertical FL (SBVFL) protocol to avoid centralizing raw data, while drastically reducing communication. We construct the split multiplicative periodic parity (SMPP) benchmark, following common QML design practice. On this task, our simulations show that SBVFL raises accuracy from 0.7227 to 0.8757 compared to local training, closely approaching non-private centralized accuracy, and that the hybrid quantum-classical model achieves this with substantially fewer trainable parameters than the classical neural networks and random forest alternatives. These results show that FL enables high-performing, privacy-preserving quantum-classical collaboration without centralizing raw data.
Medical image classification is an important task in clinical decision support systems. Although classical deep learning models can represent massive amounts of data, they are not very scalable DEEP LEARNING REVIEW and stand each in their own right for privacy loss and computation inefficiency. Quantum machine learning (QML) has been proposed as an exciting field to complement classical machine learning by using quantum superposition and entanglement for increasing the expressibility of the models. Since the hybrid quantum-classical methods are subject to high qubit complexity [10], training instability (barren plateau problem) [13, 14], non-existent privacy protection mechanisms and poor generalisability over trained datasets [7]. Herein, we propose AF-HQCNN: an Adaptive Federated Hybrid Quantum Convolutional Neural Network (1) a lightweight classical feature extractor using only MobileNetV2, (2) variational quantum circuit (VQC) with angle and amplitude encoding with 4-8 qubits, (3) novel adaptive momentum-based quantum optimizer to mitigate gradient vanishing and gradient explosion issues, (4) federated learning aggregation layer layer to ensure protection of patient data privacy,(5), multi-dataset validation on MedMNIST, HAM10000, Brain MRI & Chest X-Ray datasets. Our experimental results show that AF-HQCNN leads to the mean classification accuracy of 97.6%, outperforming existing hybrid models by a margin of 2.7% with 87% fewer trainable parameters, faster convergence and robustness against privacy attacks.