PaperlayerView exact revision on arXiv

Source-linked AI summary

Quantum federated learning through blind quantum computing

Weikang Li, Sirui Lu, Dong-Ling Deng

arXiv:2103.08403v2quant-phcs.CRcs.LG

TL;DR

Private distributed learning seeks to train shared models while protecting participants’ data. This paper uses blind quantum computing for delegated and multiparty learning, and reports numerical performance alongside resistance to a gradient attack after adding differential privacy.

  • Problem

    Private distributed learning addresses how multiple parties can collaboratively train a shared model while preserving the privacy of their data.

    Source: p. 1

  • Method

    The protocol uses UBQC for private single-party delegated classifier training and extends it to multiparty learning with differential privacy.

    Source: p. 2

  • Results

    Training and validation accuracies saturate roughly at 98% for MNIST and 94% for WDBC, while noisy gradients produce recovered digits clearly different from the originals in the gradient-attack test.

    Source: pp. 3, 5

  • Takeaways & Limitations

    The authors conclude that the protocol has potential for large-scale private distributed learning with near-term and future quantum technologies.

    Source: p. 5

    Because the shared model is public, client updates that improve it inevitably leak some information about that client’s data.

    Source: p. 4

Abstract

from arXiv · show

Private distributed learning studies the problem of how multiple distributed entities collaboratively train a shared deep network with their private data unrevealed. With the security provided by the protocols of blind quantum computation, the cooperation between quantum physics and machine learning may lead to unparalleled prospect for solving private distributed learning tasks. In this paper, we introduce a quantum protocol for distributed learning that is able to utilize the computational power of the remote quantum servers while keeping the private data safe. For concreteness, we first introduce a protocol for private single-party delegated training of variational quantum classifiers based on blind quantum computing and then extend this protocol to multiparty private distributed learning incorporated with differential privacy. We carry out extensive numerical simulations with different real-life datasets and encoding strategies to benchmark the effectiveness of our protocol. We find that our protocol is robust to experimental imperfections and is secure under the gradient attack after the incorporation of differential privacy. Our results show the potential for handling computationally expensive distributed learning tasks with privacy guarantees, thus providing a valuable guide for exploring quantum advantages from the security perspective in the field of machine learning with real-life applications.

Supplementary Material: Quantum federated

The supplement reviews UBQC and its adaptation to learning tasks, then details numerical experiments on noise robustness, differential privacy, and alternative data encoding.

Supplementary Material: Quantum federated

  • The supplement’s scope includes reviewing UBQC and adapting learning tasks to it before presenting numerical experiments.Source: Supplementary Material: Quantum… · p. 8
  • The supplement reviews the UBQC protocol and explains how learning tasks are adapted to it.It then gives detailed numerical experiment settings, further differential-privacy simulations, and simulations using a different data-encoding strategy.Source: Supplementary Material: Quantum… · p. 8
  • Additional simulations examine classifier robustness under different noise strengths and differential privacy, alongside an alternative strategy that encodes data in circuit rotation angles.The supplement also discusses this alternative encoding.Source: Supplementary Material: Quantum… · p. 8

I. REVIEW AND USAGE OF THE UNIVERSAL BLIND QUANTUM COMPUTATION

The section describes UBQC as a way for a client to delegate computation while keeping inputs, outputs, and computation details private. It explains the brickwork-state procedure and its use to construct a variational quantum classifier.

I. REVIEW AND USAGE OF THE UNIVERSAL BLIND QUANTUM COMPUTATION

  • UBQC lets Alice delegate computation while keeping inputs, outputs, and computation details private, using only single-qubit preparation on her side.Bob supplies the remaining quantum computational resources.Source: §I · p. 8
  • Alice sends randomly phased single-qubit states; Bob applies controlled-Z gates to connected pairs to form an entangled brickwork state for measurement-based computation.Alice delegates through two-way classical communication.Source: §I · p. 8, Figure S1 · p. 8
  • Alice masks each measurement angle with a random phase and bit, preserving correctness while making Bob’s received information uniformly random.When needed, Alice flips the measurement result to correct for the random bit.Source: §I · p. 8
  • The classifier is built from single-qubit rotations and controlled-NOT gates implemented in the UBQC framework; its rotation parameters are continuous and its controlled-NOT gates fixed.Measurement-outcome corrections are not shown in the construction.Source: §I · p. 8, Figure S2 · p. 8

II. DETAILS OF OUR NUMERICAL EXPERIMENTS

The section describes amplitude encoding and gradient-based optimization for the classifiers, then identifies the numerical settings and framework used in the experiments.

II. DETAILS OF OUR NUMERICAL EXPERIMENTS

  • Amplitude encoding represents N = 2^n dimensional classical data with n qubits, using UBQC as a subroutine to construct the required states.Nonadjacent controlled-NOT gates can be implemented using SWAP gates, each constructed from three controlled-NOT gates.Source: §II · p. 9
  • The classifiers minimize cross-entropy loss, with circuit-parameter gradients computed through expectation-value derivatives and the parameter shift rule.The shifted expectation values use parameter settings θ ± π/2.Source: §II · p. 9
  • Tables S1 and S2 list parameter settings for single-party and multiparty experiments, which were run using the Yao.jl framework.Source: §II · p. 9, Table S1 · p. 9, Table S2 · p. 9

III. ROBUSTNESS TEST FOR THE VARIATIONAL QUANTUM CLASSIFIERS

The robustness tests model noise in the input data and parameterized circuit. Both datasets show resilience at low noise strengths, while greater noise reduces accuracy and slows convergence.

III. ROBUSTNESS TEST FOR THE VARIATIONAL QUANTUM CLASSIFIERS

  • The tests evaluate classifier performance under random noise because qubit transmission and computation may deviate from the noiseless situation.Source: §III · p. 9
  • The simulations add normally distributed noise to each input-vector element and independent noise with standard deviation 0.001 to each gradient element during training.Source: §III · p. 9
  • Below noise strength 0.02, both MNIST and Wisconsin Diagnostic Breast Cancer classifiers show good resilience; greater noise lowers accuracy and lengthens convergence.The figures show zero noise and input noise strengths of 0.02, 0.05, and 0.1 for the two datasets.Source: §III · p. 10, Figure S3 · p. 10, Figure S4 · p. 10

IV. DIFFERENTIAL PRIVACY WITH DIFFERENT NOISE STRENGTHS

Differential-privacy noise trades training accuracy and convergence speed for privacy, while the protocol remains robust when clients have different noise levels.

IV. DIFFERENTIAL PRIVACY WITH DIFFERENT NOISE STRENGTHS

  • Privacy-protecting differential-privacy noise is distinguished from robustness-test noise, which may harm training.The passage describes the privacy noise as beneficial for privacy, unlike noise considered in the robustness test.Source: §IV · p. 10
  • More noise lowers training accuracy, slows convergence, and can make training very slow or tend to fail on both datasets.The reported strongest-noise settings are µ = 0.05 for MNIST and µ = 0.1 for Wisconsin Diagnostic Breast Cancer.Source: Figure S5 · p. 10, Figure S6 · p. 10, §IV · pp. 10–11
  • The simulations compare four privacy-noise strengths per dataset, with µ = +∞ representing no noise.The MNIST curves use µ = +∞, 1, 0.1, and 0.05; the breast-cancer curves use µ = +∞, 1, 0.2, and 0.1.Source: §IV · p. 10, Figure S5 · p. 10, Figure S6 · p. 10
  • The protocol remains robust when ten clients have different noise strengths, ranging from µ = 1 to µ = 0.55.In this test, µ represents the combination of intrinsic quantum noise and artificially added noise.Source: §IV · p. 11, Figure S7 · p. 11

V. ENCODING STRATEGY WITH ROTATION ANGLES

Encoding MNIST features into circuit parameters is more efficient than amplitude encoding but reaches lower accuracy; the comparison also points to limits in the variational model's expressive power.

V. ENCODING STRATEGY WITH ROTATION ANGLES

  • Circuit-parameter encoding reaches about 90% accuracy, below amplitude encoding, while avoiding its inefficient preparation of highly entangled states.The paper presents amplitude encoding as better-performing but inefficient for delegated tasks.Source: §V · p. 11
  • The MNIST setup uses an 8-qubit, depth-11 circuit with 272 parameters, placing 256 input features in its first 256 parameters.The parameters are initially set to zero.Source: §V · p. 11
  • A two-layer classical network performs decently on the encoded outputs, indicating that the outputs are separable and that the variational model may lack expressive power for more complex tasks.The paper calls for more expressive variational quantum learning models for such tasks.Source: §V · p. 11
Loading 2103.08403v2…