Current approaches to secure gradient aggregation in quantum federated learning typically employ classical or quantum cryptographic techniques to encrypt local gradients prior to transmission to the server via classical or quantum channels. In this process, local gradient information must be transmitted as communication content to take part in aggregation, which increases the potential attack surface for privacy. To address this problem, this paper proposes a quantum secure gradient aggregation scheme based on ancilla-driven quantum computation (ADQC). The scheme eliminates the direct transmission of local gradient information via either classical or quantum channels. Clients remotely construct single-qubit rotation gates through ADQC, thereby encoding their local gradients into the quantum state held by the server and achieving secure aggregation of local gradients. The proposed scheme includes two protocols for secure gradient aggregation: a serial single-qubit protocol and a parallel multi-qubit protocol. Security analysis demonstrates that both protocols are resilient to external attacks and to attacks originating from servers and clients, thereby achieving privacy protection for local gradients.
Current approaches to secure gradient aggregation in quantum federated learning typically employ classical or quantum cryptographic techniques to encrypt local gradients prior to transmission to the server via classical or quantum channels. In this process, local gradient information must be transmitted as communication content to take part in aggregation, which increases the potential attack surface for privacy. To address this problem, this paper proposes a quantum secure gradient aggregation scheme based on ancilla-driven quantum computation (ADQC). The scheme eliminates the direct transmission of local gradient information via either classical or quantum channels. Clients remotely construct single-qubit rotation gates through ADQC, thereby encoding their local gradients into the quantum state held by the server and achieving secure aggregation of local gradients. The proposed scheme includes two protocols for secure gradient aggregation: a serial single-qubit protocol and a parallel multi-qubit protocol. Security analysis demonstrates that both protocols are resilient to external attacks and to attacks originating from servers and clients, thereby achieving privacy protection for local gradients.
The privacy in classical federated learning can be breached through the use of local gradient results combined with engineered queries to the clients. However, quantum communication channels are considered more secure because a measurement on the channel causes a loss of information, which can be detected by the sender. Therefore, the quantum version of federated learning can be used to provide better privacy. Additionally, sending an N-dimensional data vector through a quantum channel requires sending logN entangled qubits, which can potentially provide efficiency if the data vector is utilized as quantum states. In this paper, we propose a quantum federated learning model in which fixed design quantum chips are operated based on the quantum states sent by a centralized server. Based on the incoming superposition states, the clients compute and then send their local gradients as quantum states to the server, where they are aggregated to update parameters. Since the server does not send model parameters, but instead sends the operator as a quantum state, the clients are not required to share the model. This allows for the creation of asynchronous learning models. In addition, the model is fed into client-side chips directly as a quantum state; therefore, it does not require measurements on the incoming quantum state to obtain model parameters in order to compute gradients. This can provide efficiency over models where the parameter vector is sent via classical or quantum channels and local gradients are obtained through the obtained values these parameters.
Federated Learning (FL) enables collaborative model training without sharing raw data. However, shared local model updates remain vulnerable to inference and poisoning attacks. Secure aggregation schemes have been proposed to mitigate these attacks. In this work, we aim to understand how these techniques are implemented in quantum-assisted FL. Quantum Secure Aggregation (QSA) has been proposed, offering information-theoretic privacy by encoding client updates into the global phase of multipartite entangled states. Existing QSA protocols, however, rely on a single global Greenberger-Horne-Zeilinger (GHZ) state shared among all participating clients. This design poses fundamental challenges: fidelity of large-scale GHZ states deteriorates rapidly with the increasing number of clients; and (ii) the global aggregation prevents the detection of Byzantine clients. We propose Clustered Quantum Secure Aggregation (CQSA), a modular aggregation framework that reconciles the physical constraints of near-term quantum hardware along with the need for Byzantine-robustness in FL. CQSA randomly partitions the clients into small clusters, each performing local quantum aggregation using high-fidelity, low-qubit GHZ states. The server analyzes statistical relationships between cluster-level aggregates employing common statistical measures such as cosine similarity and Euclidean distance to identify malicious contributions. Through theoretical analysis and simulations under depolarizing noise, we demonstrate that CQSA ensures stable model convergence, achieves superior state fidelity over global QSA.
Abstract Distributed quantum computing, particularly distributed quantum machine learning, has gained substantial prominence for its capacity to harness the collective power of distributed quantum resources, transcending the limitations of individual quantum nodes. Meanwhile, the critical concern of privacy within distributed computing protocols remains a significant challenge, particularly in standard classical federated learning (FL) scenarios where data of participating clients is susceptible to leakage via gradient inversion attacks by the server. This paper presents innovative quantum protocols with quantum communication designed to address the FL problem, strengthen privacy measures, and optimize communication efficiency. In contrast to previous works that leverage expressive variational quantum circuits or differential privacy techniques, we consider gradient information concealment using quantum states and propose two distinct FL protocols, one based on private inner-product estimation and the other on incremental learning. These protocols offer substantial advancements in privacy preservation with low communication resources, forging a path toward efficient quantum communication-assisted FL protocols and contributing to the development of secure distributed quantum machine learning, thus addressing critical privacy concerns in the quantum computing era.
In recent years, the growing demand for secure, efficient, and scalable machine learning has highlighted significant challenges in traditional Federated Learning (FL) systems. These challenges include computational inefficiencies in handling large-scale, high-dimensional data, privacy concerns, and the limitations of classical hardware in solving complex optimization problems. Additionally, the increasing complexity of data and the need for more robust privacy-preserving methods have pushed the boundaries of classical FL. To address these issues, this paper presents a detailed framework for Quantum Federated Learning (QFL), where quantum computing and FL converge to enable distributed quantum model training with enhanced privacy preservation. The system is modeled using local quantum models on clients and a global aggregation strategy at the server. We develop quantum gradient-based optimization with quantum cross-entropy loss, privacy preservation through encryption, and robustness to quantum noise. A set of theorems is provided to prove the correctness and efficiency of the model, supported by rigorous mathematical formulations. We used IBM Qiskit for the simulation and compared our proposed QFL with classical FL. The results demonstrate that our QFL outperformed classical FL in terms of accuracy, precision, recall, and F1 score.
Federated Learning (FL) enables collaborative model training without sharing raw data. However, shared local model updates remain vulnerable to inference and poisoning attacks. Secure aggregation schemes have been proposed to mitigate these attacks. In this work, we aim to understand how these techniques are implemented in quantum-assisted FL. Quantum Secure Aggregation (QSA) has been proposed, offering information-theoretic privacy by encoding client updates into the global phase of multipartite entangled states. Existing QSA protocols, however, rely on a single global Greenberger–Horne–Zeilinger (GHZ) state shared among all participating clients. This design poses fundamental challenges: fidelity of large-scale GHZ states deteriorates rapidly with the increasing number of clients; and (ii) the global aggregation prevents the detection of Byzantine clients. We propose Clustered Quantum Secure Aggregation (CQSA), a modular aggregation framework that reconciles the physical constraints of near-term quantum hardware along with the need for Byzantine-robustness in FL. CQSA randomly partitions the clients into small clusters, each performing local quantum aggregation using high-fidelity, low-qubit GHZ states. The server analyzes statistical relationships between cluster-level aggregates employing common statistical measures such as cosine similarity and Euclidean distance to identify malicious contributions. Through theoretical analysis and simulations under depolarizing noise, we demonstrate that CQSA ensures stable model convergence, achieves superior state fidelity over global QSA.
Federated learning is a privacy-preserving machine learning paradigm consisting of local model training, global model aggregation, and global model distribution. Recent research found that model aggregation can reveal the participants’ privacy. To preserve the participants’ privacy, multi-party computation-based secure aggregation is used in federated learning with mobile device participants. The character of the mobile device requires that secure aggregation can be efficient in computation and robust to the dropout. However, prior works need multi rounds, increase computation cost related to the dropped participants, and fails to resist quantum attacks. To solve these issues, we propose a 3-round post-quantum secure protocol for federated learning. In the proposed protocol, single-masking generated by homomorphic Pseudorandom Generator based on learning with round encrypts single user's model. After all the encrypted models are aggregated fast, additively homomorphic decryption based on Shamir secret share guarantee the robustness and performance induced by the dropped participants. All message exchange is based on a post-quantum secure channel constructed with the first post-quantum cryptography standard, Kyber KEM. In post-quantum security, security analysis demonstrates that the proposed protocol can preserve privacy under the sem-honest adversaries setting, and the experimental results show higher running time efficiency.