PaperlayerView exact revision on arXiv

Source-linked AI summary

Quantum Differential Privacy: An Information Theory Perspective

Christoph Hirche, Cambyse Rouzé, Daniel Stilck França

arXiv:2202.10717v3quant-phcs.CRcs.ITcs.LGmath.IT

TL;DR

Quantum computations need privacy guarantees, but existing formulations require reasoning about measurements and the relationship between privacy-inducing noise and computational uselessness is not fully characterized. The paper uses the quantum hockey-stick divergence and contraction coefficients to characterize quantum differential privacy through output states and analyze noisy circuits and quantum machine-learning models. Under global depolarizing noise, the bound gives δ = 0 already for n ≥3 if p = 0.3 and n ≥10 if p = 0.1.

  • Problem

    Quantum computations need privacy guarantees, but existing formulations require reasoning about measurements and the relationship between privacy-inducing noise and computational uselessness is not fully characterized.

    Source: §I · pp. 1–2

  • Method

    The paper uses the quantum hockey-stick divergence and contraction coefficients to characterize quantum differential privacy through output states and analyze noisy circuits and quantum machine-learning models.

    Source: §I · p. 2

  • Results

    Under global depolarizing noise, the bound gives δ = 0 already for n ≥3 if p = 0.3 and n ≥10 if p = 0.1.

    Source: A. Global depolarizing noise · p. 9

  • Takeaways & Limitations

    Quantum differential privacy can be reached at a significantly shorter depth than the depth at which noise becomes computationally prohibitive.

    Source: §I · p. 2, §VI · p. 17

Abstract

from arXiv · show

Differential privacy has been an exceptionally successful concept when it comes to providing provable security guarantees for classical computations. More recently, the concept was generalized to quantum computations. While classical computations are essentially noiseless and differential privacy is often achieved by artificially adding noise, near-term quantum computers are inherently noisy and it was observed that this leads to natural differential privacy as a feature. In this work we discuss quantum differential privacy in an information theoretic framework by casting it as a quantum divergence. A main advantage of this approach is that differential privacy becomes a property solely based on the output states of the computation, without the need to check it for every measurement. This leads to simpler proofs and generalized statements of its properties as well as several new bounds for both, general and specific, noise models. In particular, these include common representations of quantum circuits and quantum machine learning concepts. Here, we focus on the difference in the amount of noise required to achieve certain levels of differential privacy versus the amount that would make any computation useless. Finally, we also generalize the classical concepts of local differential privacy, Renyi differential privacy and the hypothesis testing interpretation to the quantum setting, providing several new properties and insights.

I. INTRODUCTION

The paper frames quantum differential privacy through information theory, replacing measurement-by-measurement checks with properties of output-state divergences. It develops the quantum hockey-stick divergence and applies it to privacy composition, noisy algorithms, and generalized privacy notions.

I. INTRODUCTION

  • Quantum differential privacy protects against distinguishing neighboring input states from algorithm outputs across all measurements.The framework leaves the neighboring-state relation open, including trace-distance closeness or reachability by a local channel.Source: §I · p. 1
  • The paper targets noisy quantum circuits and quantum machine-learning algorithms, comparing privacy depth with the greater depth at which noise makes computation unusable.It argues that differential privacy can arise at significantly shorter depth than computationally prohibitive noise [12].Source: §I · p. 2
  • The paper casts quantum differential privacy in terms of the quantum hockey-stick divergence, enabling divergence-based proofs without explicitly checking every measurement.The approach follows classical divergence and contraction-coefficient techniques [6], [5].Source: §I · p. 2, §II · p. 5

II. THE QUANTUM HOCKEY-STICK DIVERGENCE

  • The quantum hockey-stick divergence section establishes contraction-coefficient results, including an equivalent optimization over orthogonal pure states that reduces computational complexity.This generalizes corresponding trace-distance and classical hockey-stick results, [6, Theorem 3].Source: §I · p. 2, §II · p. 3

I. INTRODUCTION

  • The work also generalizes local differential privacy, Rényi differential privacy, and hypothesis-testing interpretations to quantum settings.These extensions include a trade-off between ϵ and δ from the hypothesis-testing interpretation.Source: §I · p. 2

II. THE QUANTUM HOCKEY-STICK DIVERGENCE

  • The divergence is connected to smooth max-relative entropy and inherits operationally useful properties such as data processing, stability, subadditivity, and measurement characterizations.The smooth max-relative-entropy formulation uses a nonstandard optimization domain and E1 as its distance measure.Source: §II · pp. 5–6

III. QUANTUM DIFFERENTIAL PRIVACY

This section defines quantum differential privacy for quantum channels and shows that it can be characterized directly through output-state divergences. It derives composition rules and exponential privacy improvement with algorithm depth under contracting noise.

Definition and characterization

  • Quantum differential privacy requires measurement outcomes on neighboring input states to satisfy the privacy bound for every measurement.The definition applies to arbitrary completely positive, trace-preserving algorithms and reduces to classical differential privacy for diagonal states.Source: §III · p. 6
  • The divergence formulation makes quantum differential privacy equivalent to an output-state condition, avoiding explicit optimization over measurements.For commuting output states, the condition becomes equivalent to classical differential privacy.Source: §III · p. 6

Properties and composition

  • Quantum differential privacy is preserved under arbitrary quantum post-processing and supports parallel composition with additive ϵ and bounded δ parameters.For product inputs, the composed mechanism has ϵ1 + ϵ2 and δ̄ = min{δ1 + e^ϵ1δ2, e^ϵ2δ1 + δ2}.Source: §III · p. 7

Layered noisy algorithms

  • For layered noisy algorithms, contraction coefficients bound privacy degradation by repeatedly removing computational layers through data processing.The construction models intended channels followed by intermediate noise channels.Source: §III · p. 7
  • When identical noise has ηe^ϵ(N) < 1, δ decays exponentially with algorithm length and eventually vanishes for sufficiently large depth.The contraction factor depends on the noise channel and ϵ, allowing a privacy trade-off between ϵ and δ.Source: §III · p. 7

Relative-entropy implications

  • The framework implies that ϵ-differential privacy also bounds measured relative entropy for neighboring inputs, while tighter non-measured bounds remain open.The result generalizes related classical differential-privacy relations, with Rényi-relative-entropy relaxations discussed later.Source: §III · p. 8

IV. APPLICATIONS TO SPECIFIC NOISE MODELS

The paper applies its framework to global and local depolarizing noise and to arbitrary local qubit noise.

IV. APPLICATIONS TO SPECIFIC NOISE MODELS

  • The applications section examines global and local depolarizing noise, as well as arbitrary local qubit noise.These models are presented as specific examples of the general quantum differential-privacy framework.Source: §IV · p. 8

A. Global depolarizing noise

Global depolarizing noise yields privacy bounds that can improve substantially over direct contraction estimates, while the same noise eventually makes computation outputs nearly useless.

A. Global depolarizing noise

  • The depolarizing channel admits a simple contraction-coefficient bound obtained from its action on state differences.The analysis uses the channel’s scaling behavior and extends the resulting bounds to layered algorithms.Source: A. Global depolarizing noise · pp. 8–9, B. Local depolarizing noise · p. 11
  • Iterative depolarizing layers provide strong privacy, but contraction-based bounds leave little depth before output states become mostly useless at ϵ = 0.Figure 1 illustrates the contraction coefficient and exponential decay of δ for different ϵ values.Source: A. Global depolarizing noise · p. 8, Figure 1 · p. 9
  • δ = 0 is sufficient for n ≥3 when p = 0.3 and n ≥10 when p = 0.1 under the improved bound.The improvement over the contraction-coefficient bound is significant for ϵ > 0; at ϵ = 0, both bounds coincide.Source: A. Global depolarizing noise · p. 9
  • Global depolarizing noise decreases trace distance by exactly (1 −p) per layer when computational layers are unitary.This yields a provable separation between the depth needed for good privacy and the depth at which algorithm outputs become useless.Source: A. Global depolarizing noise · p. 9
  • The resulting bounds also give a direct trade-off between ϵ and δ for layered depolarizing algorithms and recover prior results when δ = 0.Examples show the decay of ϵ as the number of noisy layers grows.Source: A. Global depolarizing noise · p. 9

B. Local depolarizing noise

Local depolarizing noise produces privacy bounds whose decay depends on locality and circuit structure, while separate lower bounds expose the gap between privacy and computational accuracy.

B. Local depolarizing noise

  • The local depolarizing model applies noise independently across qubits, and its trace-distance lower bound follows by iterating a single-qubit inversion argument.The construction uses the relation between noisy and noiseless trace distances across all affected qubits.Source: B. Local depolarizing noise · pp. 10–11
  • The local-noise analysis provides only an upper bound on the contraction coefficient, so its exact value remains open.The bound is developed for local depolarizing channels and generalized to layered algorithms.Source: B. Local depolarizing noise · p. 11
  • For fixed total layer dimension, the bounds guarantee much faster decay of δ for global than for local depolarizing noise.For ϵ > 0, δ eventually reaches 0; for ϵ = 0, it decays exponentially but remains strictly positive.Source: B. Local depolarizing noise · p. 11, Figure 4 · p. 12
  • A lower bound on trace distance separates the depth required for differential privacy from worst-case computational decay, although it is useful mainly for small k.The comparison is made against the preceding upper bounds for local noise.Source: B. Local depolarizing noise · p. 11, Figure 5 · p. 12
  • Local depolarizing noise can make trace distance, and therefore hockey-stick divergence, converge exponentially with depth once 2|I|(1 −p) < 1.Under this condition, the trace distance between output states vanishes in logarithmic depth.Source: B. Local depolarizing noise · p. 12
  • The local-noise bound depends on circuit light-cones and recovers (1 −p)^n scaling when p is large enough to overpower computational layers’ error-correcting properties.The dependence on k is weaker than in the earlier results for global depolarizing noise.Source: B. Local depolarizing noise · pp. 12–13

C. Arbitrary local qubit noise channels

The paper bounds contraction for arbitrary local qubit channels and shows that non-unital local noise eventually yields strong differential privacy.

C. Arbitrary local qubit noise channels

  • Non-unital local qubit noise leads to good differential privacy eventually through a contraction bound generalized from earlier work.The bound combines a generalized Fuchs–van de Graaf inequality with a fidelity bound.Source: C. Arbitrary local qubit noise channels · p. 13
  • For T = N ⊗k, the contraction bound depends on the smallest eigenvalue of the Choi matrix of N†◦N.The channel is written as a tensor power of a qubit channel, with λmin(C_N†◦N) controlling the bound.Source: C. Arbitrary local qubit noise channels · p. 13
  • The resulting privacy guarantee applies to layered algorithms with identical local noise channels and neighboring inputs satisfying the stated κ condition.The differential-privacy parameters are obtained by applying the contraction bound to the channel form in Equation (III.6).Source: C. Arbitrary local qubit noise channels · p. 13
  • For λ > 0, good differential privacy is eventually reached as the number of layers n grows, while larger ϵ produces smaller δ.The paper illustrates these bounds numerically in Figure 6.Source: C. Arbitrary local qubit noise channels · p. 13

A. Local quantum differential privacy

The paper extends local differential privacy to quantum channels and shows that requiring privacy over broad state sets can strongly restrict output distinguishability and usefulness.

A. Local quantum differential privacy

  • Quantum local differential privacy can be required with respect to state sets broader than neighboring inputs, including sets containing all orthogonal pure states.The condition is therefore stronger than ordinary quantum differential privacy.Source: A. Local quantum differential privacy · p. 13
  • Requiring (ϵ, δ)-LDP can make output states indistinguishable under iteration, limiting their usefulness for further computations.The paper connects this consequence to Proposition III.4.Source: A. Local quantum differential privacy · p. 14
  • LDP with respect to all states is equivalent to LDP with respect to all pure states.The equivalence holds for the stated quantum definition.Source: A. Local quantum differential privacy · p. 14
  • For state sets containing all orthogonal pure states, the local-privacy condition implies a bound on the trace-distance contraction coefficient.This generalizes a classical result [5].Source: A. Local quantum differential privacy · pp. 13–14
  • The same corollary applies to any state set containing all orthogonal pure states, and for the minimal such set LDP is equivalent to ηeϵ(A) ≤δ [5].This links the quantum condition to the classical observation [5].Source: A. Local quantum differential privacy · p. 14

B. R´enyi quantum differential privacy

The paper defines quantum Rényi differential privacy using general quantum Rényi relative entropies, avoiding measurement-based definitions and establishing privacy-preserving composition properties.

B. Rényi quantum differential privacy

  • Quantum (ϵ, α)-Rényi differential privacy replaces max-relative entropy with a general α-Rényi relative entropy.The definition is introduced for quantum channels and arbitrary admissible Rényi-divergence families.Source: B. R´enyi quantum differential privacy · pp. 14–15
  • The measured Rényi definition has no known closed measurement-independent formula for finite α and lacks general subadditivity, so composition can fail in the expected form.In particular, privacy of A1 and A2 need not imply (2ϵ, α)-privacy for A1 ⊗ A2.Source: B. R´enyi quantum differential privacy · p. 14
  • The framework allows multiple Rényi divergences, including Petz, sandwiched, and geometric Rényi divergences where their required properties hold.The admissible properties include data-processing, additivity, and unitary invariance.Source: B. R´enyi quantum differential privacy · p. 15
  • If a channel is ϵ-differentially private, it is also (ϵ, α)-Rényi differentially private.The result is stated as Lemma V.4.Source: B. R´enyi quantum differential privacy · p. 15
  • Quantum Rényi differential privacy implies an (ϵ + g(δ), α)-style approximate privacy guarantee, extending the classical relationship with (ϵ, δ)-privacy.The paper presents this implication as Lemma V.5 and notes its connection to [26, Proposition 3].Source: B. R´enyi quantum differential privacy · p. 15
  • The definition satisfies post-processing and parallel composition, with product-state composition adding the privacy parameters.For A1 and A2, the composed channel is (ϵ1 + ϵ2, α)-private on the specified product states.Source: B. R´enyi quantum differential privacy · p. 15
  • The sandwiched Rényi divergence is favored because it obeys data-processing for α ≥ 1/2, equals Dmax as α →∞, and is minimal among the admissible choices.Its minimality makes the resulting privacy condition least restrictive for fixed α.Source: B. R´enyi quantum differential privacy · p. 15

C. Hypothesis testing

The paper recasts quantum differential privacy through hypothesis-testing risk regions, yielding geometric interpretations, composition properties, and an explicit trade-off between ϵ and δ.

C. Hypothesis testing

  • Quantum differential privacy is characterized by the risk region of Type I and Type II errors for discriminating A(ρ) from A(σ).The region is defined over measurements and neighboring input states, and privacy holds exactly when it lies within the corresponding privacy region.Source: C. Hypothesis testing · p. 16
  • The privacy-region characterization is an if-and-only-if condition for a quantum channel to be (ϵ, δ)-differentially private.This provides a graphical representation of the privacy constraint.Source: C. Hypothesis testing · p. 16
  • Risk regions obey concatenation and are symmetric about the line α + β = 1.These properties follow from the adjoint channel and the defining error-region equations.Source: C. Hypothesis testing · p. 16
  • For the depolarizing example, p = 0.72 places all simulated measurement-error pairs inside R(0.2, 0.01), whereas smaller p values provide insufficient noise.The simulation samples random POVMs for two neighboring qubit states.Source: C. Hypothesis testing · pp. 16–17
  • Increasing δ permits a better ϵ value, demonstrating a direct privacy-parameter trade-off illustrated in Figure 7.Lemma V.9 formalizes the conversion between the two parameter pairs.Source: C. Hypothesis testing · p. 17

VI. CONCLUSIONS

The paper develops an information-theoretic framework for quantum differential privacy and argues that it simplifies analysis while supporting bounds for practical noise models. It also identifies open problems involving fully quantum information quantities.

VI. CONCLUSIONS

  • The quantum hockey-stick divergence provides a framework for bounding privacy parameters in quantum circuits and quantum neural networks, including comparisons of local and global depolarizing noise.The framework also contrasts achieving differential privacy with undesirable decay in trace distance.Source: §VI · p. 17
  • The approach is presented as simpler and more powerful than previous methods, with expected importance for future differential-privacy research.Source: §VI · p. 17
  • Fully quantum bounds for quantities such as quantum relative entropy and quantum mutual information remain open problems.Such bounds could connect quantum differential privacy to the quantum privacy funnel [10] and classical work.Source: §VI · p. 17

APPENDIX

The appendix develops technical properties, lemmas, and definitions supporting the paper’s quantum divergence and Rényi differential-privacy framework. It specifies structural requirements for quantum Rényi divergences and relates auxiliary bounds to established results.

Technical lemmas

  • The appendix extracts channel and distance-comparison lemmas from prior results to support generalized bounds, including tensor-power channels, non-unital channels, and smooth max-relative entropy.These steps invoke prior results on channel contraction, generalized Fuchs-van-de-Graaf inequalities, and the standard smooth max-relative entropy.Source: APPENDIX · p. 19

Rényi quantum differential privacy

  • The appendix introduces a general framework for Rényi quantum differential privacy based on Rényi relative entropies satisfying specified structural properties.Source: APPENDIX · p. 20
  • Quantum Rényi divergences are required to satisfy continuity, unitary invariance, normalization, order, additivity, a general-mean property, positive definiteness, data processing, convexity or concavity, and dominance.Source: APPENDIX · p. 20
  • Unlike the classical case, the first six properties do not uniquely determine quantum Rényi relative entropies, so operationally motivated properties are additionally required.Source: APPENDIX · p. 20
  • A family of quantum Rényi relative entropies is parameterized by α and must be monotonically increasing in α on an open interval containing 1.Source: APPENDIX · p. 20

Related papers

Loading 2202.10717v3…