The Right to Be Forgotten (RTBF), as set out in regulations such as the General Data Protection Regulation (GDPR), mandates mechanisms to remove specific data points from trained machine learning models. Machine unlearning is a concept in deep learning that has received significant attention but remains underexplored in Quantum Machine Learning (QML). This paper presents a new model for adaptive data deletion in Variational Quantum Circuits (VQCs), called Sensitivity-Guided Quantum Unlearning (SQU). SQU combines gradient-based sensitivity analysis with a dynamic allocation of privacy budgets and targeted noise injection to eliminate the impact of high-impact samples, then fine-tunes the model on the remaining data. Experiments on three benchmark datasets, Breast Cancer, MNIST, and Fashion-MNIST, indicate that SQU successfully unlearns specified samples without diminishing the model's utility. On the Breast Cancer dataset, SQU matches the accuracy of the gold-standard retrain-from-scratch method (84.4%) while providing a quantifiable and significant privacy benefit, reducing the Membership Inference Attack (MIA) AUC by 0.67%. MNIST and Fashion-MNIST results also indicate that SQU has high utility (97.9% and 79.2%, respectively), consistent with the retraining results. A comparison with a classical neural network ($200 \times$more parameters) further demonstrates that the VQC's compact parameterization enables an exact, complete sensitivity analysis for unlearning — an advantage that is infeasible at the classical scale. In general, SQU provides a computationally efficient, regulatory-compliant solution for privacy-aware QML. Code is available at https://github.com/masud1901/Sensitivity-Guided-Quantum-Machine-Unlearning.
The Right to Be Forgotten (RTBF), as set out in regulations such as the General Data Protection Regulation (GDPR), mandates mechanisms to remove specific data points from trained machine learning models. Machine unlearning is a concept in deep learning that has received significant attention but remains underexplored in Quantum Machine Learning (QML). This paper presents a new model for adaptive data deletion in Variational Quantum Circuits (VQCs), called Sensitivity-Guided Quantum Unlearning (SQU). SQU combines gradient-based sensitivity analysis with a dynamic allocation of privacy budgets and targeted noise injection to eliminate the impact of high-impact samples, then fine-tunes the model on the remaining data. Experiments on three benchmark datasets, Breast Cancer, MNIST, and Fashion-MNIST, indicate that SQU successfully unlearns specified samples without diminishing the model's utility. On the Breast Cancer dataset, SQU matches the accuracy of the gold-standard retrain-from-scratch method (84.4%) while providing a quantifiable and significant privacy benefit, reducing the Membership Inference Attack (MIA) AUC by 0.67%. MNIST and Fashion-MNIST results also indicate that SQU has high utility (97.9% and 79.2%, respectively), consistent with the retraining results. A comparison with a classical neural network (200×more parameters) further demonstrates that the VQC's compact parameterization enables an exact, complete sensitivity analysis for unlearning — an advantage that is infeasible at the classical scale. In general, SQU provides a computationally efficient, regulatory-compliant solution for privacy-aware QML. Code is available at https://github.com/masud1901/Sensitivity-Guided-Quantum-Machine-Unlearning.
We present the first empirical study of machine unlearning (MU) in hybrid quantum-classical neural networks. While MU has been extensively explored in classical deep learning, its behavior within variational quantum circuits (VQCs) and quantum-augmented architectures remains largely unexplored. First, we adapt a broad suite of unlearning methods to quantum settings, including gradient-based, distillation-based, regularization-based and certified techniques. Second, we introduce two new unlearning strategies tailored to hybrid models. Experiments across Iris, MNIST, and Fashion-MNIST, under both subset removal and full-class deletion, reveal that quantum models can support effective unlearning, but outcomes depend strongly on circuit depth, entanglement structure, and task complexity. Shallow VQCs display high intrinsic stability with minimal memorization, whereas deeper hybrid models exhibit stronger trade-offs between utility, forgetting strength, and alignment with retrain oracle. We find that certain methods, e.g. EU-k, LCA, and Certified Unlearning, consistently provide the best balance across metrics. These findings establish baseline empirical insights into quantum machine unlearning and highlight the need for quantum-aware algorithms and theoretical guarantees, as quantum machine learning systems continue to expand in scale and capability. We publicly release our code at: https://github.com/CrivoiCarla/HQML.
Quantum machine learning (QML) has the potential to achieve quantum advantage for specific tasks by combining quantum computation with classical machine learning (ML). In classical ML, a significant challenge is membership-privacy leakage, whereby an attacker can infer from model outputs whether specific data were used in training. When specific data are required to be withdrawn, removing their influence from the trained model becomes necessary. Machine unlearning (MU) addresses this issue by enabling the model to forget the withdrawn data, thereby preventing membership-privacy leakage. However, this leakage remains underexplored in QML. This raises two research questions: do QML models leak membership privacy about their training data, and can MU methods efficiently mitigate such leakage in QML models? We investigate these questions using two quantum neural network (QNN) architectures, a basic QNN and a hybrid QNN, evaluated in noiseless simulations and cloud quantum device demonstrations. To answer the first question, we analyze how quantum constraints shape membership-privacy leakage in QML and then formalize a realistic gray-box threat model accordingly. Based on this, we design a membership inference attack (MIA) tailored to QNN outputs, and our results provide clear evidence of membership leakage in both QNNs. To answer the second question, we propose a quantum machine unlearning (QMU) framework, comprising three MU mechanisms. Evaluations on two QNN architectures show that QMU removes the influence of the withdrawn data while preserving accuracy for retained data. A comparative analysis further characterizes the three MU mechanisms with respect to data dependence, computational cost, and robustness.
Machine unlearning aims to remove the influence of specific training data from a learned model without full retraining. While recent work has begun to explore unlearning in quantum machine learning, existing approaches largely rely on fixed, uniform target distributions and do not explicitly control the trade-off between forgetting and retained model behaviour. In this work, we propose a distribution-guided framework for class-level quantum machine unlearning that treats unlearning as a constrained optimization problem. Our method introduces a tunable target distribution derived from model similarity statistics, decoupling the suppression of forgotten-class confidence from assumptions about redistribution among retained classes. We further incorporate an anchor-based preservation constraint that explicitly maintains predictive behaviour on selected retained data, yielding a controlled optimization trajectory that limits deviation from the original model. We evaluate the approach on variational quantum classifiers trained on the Iris and Covertype datasets. Results demonstrate sharp suppression of forgotten-class confidence, minimal degradation of retained-class performance, and closer alignment with the gold retrained model baselines compared to uniform-target unlearning. These findings highlight the importance of target design and constraint-based formulations for reliable and interpretable quantum machine unlearning.
With the emergence of machine learning (ML) models trained on large datasets containing potentially sensitive data, a major question in AI safety is how to make learning private with respect to the training data. Similar to classical machine learning, quantum machine learning (QML) models are not devoid of privacy vulnerabilities. Differential privacy (DP) is a standard tool for training ML models on sensitive data, but its impact in QML remains poorly understood. In this work we study private training in hybrid variational QML models using a classical private DP-SGD optimizer applied to pipelines with classical inputs and outputs. We analyze the interplay between gradient clipping and calibrated noise addition in DP-SGD, and its impact on optimization and accuracy for noisy and noiseless quantum models. We first explain why quantum noise does not provide a satisfactory replacement for the calibrated noise in DP-SGD for ensuring privacy. We then show how the deterministic bounds on gradient norms for a wide class of quantum models translate into explicit control of the detrimental clipping bias introduced by DP-SGD. Finally, we formulate a numerical comparison protocol under fixed clipping threshold and privacy budget and evaluate it on synthetic and image-classification tasks for equivalent quantum and classical models. Our results suggest that quantum models can retain higher accuracy in private-training regimes where the formal privacy guarantee is ensured by a classical DP-SGD mechanism.
Abstract Quantum Computation has entered the Noisy Intermediate State Quantum era, in which quantum machine learning (QML) models built on parameterized quantum circuits are promptly utilized for real-world classification tasks, optimization and simulations because of quantum inherent properties like superposition and entanglement. Despite having such use cases, QML model’s security under adversarial conditions remains poorly understood. One such threat is data poisoning, in which an attacker corrupts the training set before the model ever sees it. Such an attack is escalated further in quantum settings by QU antum I ndiscriminate D ata Poisoning, which exploits the geometry of the quantum feature space. To address it, this paper proposes a self-revealing defense framework built on a two-stage pipeline. The first stage identifies potential corrupted data points using unsupervised hybrid k means _ gmm threshold derived from a clean reference model, enabling reliable detection without requiring any prior knowledge of the underlying attack. The second stage uses the detected samples to guide a quantum unlearning process that removes the influence of corrupted data and restores model integrity. All experiments were carried out on simulations (no real quantum hardware is utilized). Experimentation on the MNIST-4 dataset using PQC-8 confirms the attack is self-revealing, as poisoning intensifies the detection PR-AUC climbs from 0.956 to over 0.999, while receiver operating characteristic AUC remains ⩾ 0.986 throughout, achieving a robust detection and clear separability between clean and poisoned samples. Among five evaluated methods used in the quantum unlearning phase of the framework, GA, SCRUB, and Continued Fine-Tuning (CF) recover accuracy to within 10% of the clean baseline for poison ratios up to ε ⩽ 0.5 , with CF achieving this at roughly half the computational cost of the gradient-based alternatives. Additional experiments on classical baseline further reveals the proposed framework being paradigm agnostic.
Federated Learning (FL) enables privacy-preserving collaborative training but faces significant challenges when client data must be removed or malicious updates forgotten. Regulatory requirements and backdoor threats necessitate efficient, selective unlearning methods. However, existing approximate approaches modify large portions of model parameters, increasing vulnerability to gradient inversion attacks and degrading utility. We propose HQSU (Hybrid Quantum Selective Unlearning), a hybrid quantum-classical framework that performs selective unlearning via low-rank Hessian subspace modeling and variational quantum influence estimation. HQSU preserves 96.83% clean accuracy and reduces backdoor attack success to 9.95%, matching full retraining while modifying only 0.314% of parameters, over300×fewer than dense-update baselines. Experiments on MNIST show that HQSU achieves the lowest residual backdoor accuracy among approximate methods with stable recovery dynamics. Circuit ablations indicate that amplitude-encoded, circularly entangled ansätze provide the strongest influence estimation under NISQ constraints. These results demonstrate that hybrid quantum modeling can significantly improve selectivity, stability, and privacy in federated unlearning.