Source-linked AI summary
Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access
Liou Tang, James Joshi, Ashish Kundu
TL;DR
Existing QML privacy research commonly assumes classical outputs and classical adversaries, leaving quantum-native access regimes less examined. The paper studies membership inference across increasingly quantum-accessible regimes and bounds empirical attack performance under finite resources. It reports a hierarchy of theoretical and empirical advantage, while noting that QML’s probabilistic behavior contributes to a gap between them.
Problem
Prior QML privacy work commonly assumes classical-outcome access, although quantum-native services may let adversaries submit or receive quantum information that measurement alone does not capture.
Source: §I · p. 1Method
The paper analyzes membership inference under classical-outcome, programmable-measurement, and quantum-state access, and bounds empirical attack performance under limited query and surrogate-model budgets.
Source: §I · p. 1, §VI · p. 9Results
The access regimes form an adversarial-advantage hierarchy, and larger measurement budgets increase empirical advantage; quantum access provides theoretical and empirical membership-inference advantage.
Source: B. Results · p. 7Takeaways & Limitations
The paper provides a first characterization of QML privacy under quantum-native access, with attack outcomes jointly shaped by quantum information access and adversary computational resources.
Source: §VI · p. 9The experiments use a small-scale 4-qubit, 24-parameter QNN under noiseless simulation, and broader models and larger-scale noisy experiments remain future work.
Source: §VI · p. 9
Abstract
from arXiv · showhide
Quantum Machine Learning (QML) has shown rapid advances by utilizing quantum computing for machine learning tasks. Meanwhile, the privacy risks accompanying QML is also starting to be studied, which inherit privacy leakage channels from "classical" ML and also quantum-unique risks. Existing work on privacy-preserving QML largely focuses on a QML-as-a-service scenario, which generally assumes that the QML model owner provides only classical bit outputs to queries, while users (and adversaries) have only classical computing abilities. However, this view is increasingly challenged in a quantum-native world of quantum-capable users/adversaries, which may have access to both quantum computing abilities and access to quantum information output from service providers. In this paper, we aim to bridge this gap by examining membership inference attacks against QML models by demonstrating that increasing quantum access and quantum computing abilities provides provable theoretical privacy leakage and empirical adversarial gain. However, the probabilistic nature of QML introduces a gap between theoretical and empirical adversarial advantage. These results show that existing research on privacy leakage in QML models underestimates privacy leakage in emergent quantum-native access regimes, and we hope to establish a first step in examining potential privacy leakages for QML in the quantum-native world.
I. INTRODUCTION
The introduction frames quantum-native access as a gap in QML privacy research and studies how access to quantum information and quantum computing affects membership inference. It also introduces QML models as trainable circuits that encode classical inputs into quantum states and produce measurement-based outputs.
A. Quantum Machine Learning
- QML combines quantum computing with machine-learning tasks to represent complex data in high-dimensional Hilbert space and reduce training complexity.The paper focuses on quantum neural networks for supervised learning.Source: §I · p. 1, A. Quantum Machine Learning · p. 2
I. INTRODUCTION
- Classical-outcome-only access is insufficient to characterize emerging settings where adversaries may submit or receive quantum information, which can expose information discarded by measurement.The introduction poses whether quantum computing ability and quantum-information access strengthen membership inference attacks.Source: §I · p. 1
- The paper studies membership inference under three access regimes: classical outcomes (C), programmable measurements (M), and pre-measurement quantum states (Q).It asks whether quantum computing ability and quantum-information access improve attacks against QML models.Source: §I · p. 1
A. Quantum Machine Learning
- VQCs use parameterized gates and training objectives to learn input-output pairs, with classical data encoded through approaches such as angle or amplitude encoding.The paper states that its results do not depend on a specific encoding scheme.Source: A. Quantum Machine Learning · p. 2
- A VQC measures its output state with an operator such as Pauli-Z, while repeated circuit executions produce a stochastic estimate of the expectation value.Each repeated execution is a shot; finite-shot measurement creates uncertainty in the model output.Source: A. Quantum Machine Learning · p. 2
- A QNN encodes a classical input into an n-qubit state, processes it with a trainable variational circuit, and maps the resulting state to classical outcomes through a measurement.The probability of an outcome is given by the projected trace of the state under the corresponding POVM element.Source: A. Quantum Machine Learning · p. 3
B. Membership Inference Attacks
Membership inference attacks test whether a target sample was included in a model’s training set. The section distinguishes attacks trained across a population from hypothesis tests conducted separately for each target sample.
B. Membership Inference Attacks
- Membership inference attacks aim to determine whether a data sample was present in a model’s training set.The attack is framed as a privacy inference task against machine-learning models.Source: B. Membership Inference Attacks · p. 3
- Population-level attacks train an attack model on surrogate models built from data sampled from the target distribution, using target-model behavior as input.Confidence can serve as an attack feature because greater confidence may indicate membership associated with overfitting.Source: B. Membership Inference Attacks · p. 3
- Instance-level attacks test each target sample independently by comparing its target-model behavior with distributions fitted from shadow models trained in member and non-member worlds.LiRA uses output probabilities at the target label; a related approach uses confidence on the sample and label.Source: B. Membership Inference Attacks · p. 3
C. Privacy Inference Attacks Against QML
Earlier QML privacy studies considered attacks based on measured classical outcomes, while quantum-native access can expose quantum states to alternative measurements. This paper examines the stronger access regimes and their implications for membership inference.
C. Privacy Inference Attacks Against QML
- Prior QML privacy work includes quantum differential privacy defenses and studies of privacy leakage through reconstruction and measured outcomes.Quantum differential privacy bounds the membership leakage of training data in hybrid quantum-classical models.Source: C. Privacy Inference Attacks Against QML · p. 3
- Existing QML membership inference attacks use measured classical outcomes and do not examine adversaries with access to quantum states.Alternative measurements may extract information discarded by a fixed readout.Source: C. Privacy Inference Attacks Against QML · pp. 3–4
- The paper presents an explicit examination of stronger quantum-native access regimes and their implications for QML membership inference.The section positions this as the paper’s first examination of those regimes in this context.Source: C. Privacy Inference Attacks Against QML · p. 4
A. Threat Model
The paper models membership inference by quantum-capable adversaries against QNNs and compares classical-outcome, programmable-measurement, and quantum-state access. Its analysis establishes an access hierarchy and shows that additional measurement shots can strengthen attacks.
A. Threat Model
- The adversary seeks to infer whether a target sample was in the QNN's training set, using quantum circuit abilities and surrogate data from the target distribution.The paper considers adversaries who can train, execute, and measure circuits and VQCs.Source: A. Threat Model · p. 4
B. Membership Inference Advantages under Different Access Regimes
- Quantum-state access provides strictly more membership-inference advantage than programmable-measurement access, which in turn exceeds classical outcome-only access.Under classical outcome-only access, a quantum-capable adversary has the same optimal advantage as a classical adversary.Source: B. Membership Inference Advantages… · pp. 4–5
- More measurement shots provide more information and can enable stronger membership-inference attacks within the same access regime.The analysis states that adversarial gains are non-decreasing in the measurement budget k.Source: B. Membership Inference Advantages… · p. 5
C. Membership Inference Advantages in Practice
The paper studies how finite query and surrogate-model budgets affect empirical membership-inference attacks relative to the information-theoretic optimum. It finds an unavoidable gap whose expected size depends on the resources used to estimate membership-conditioned outcomes.
C. Membership Inference Advantages in Practice
- The analysis considers empirical attacks under finite budgets of K surrogate-model pairs and k-shot observations.The empirical advantage is based on observations from the trained surrogate models.Source: C. Membership Inference Advantages in… · p. 5
- Finite-resource empirical membership-inference advantage can fall short of the theoretical optimum, with the gap bounded by how well surrogate pairs represent the population of trained models.The theoretical optimum assumes knowledge of the full membership-conditioned outcome distributions.Source: C. Membership Inference Advantages in… · pp. 5–6
- More surrogate-model pairs K can narrow the gap by better approximating the overall membership-conditioned state distribution.The paper frames this gap as a limitation on learning the theoretical advantage, not as a direct measure of empirical attack performance.Source: C. Membership Inference Advantages in… · p. 6
- Increasing observation shots k raises the expected theoretical-to-empirical gap, even though more shots increase attack advantage under any access regime.The gap bound concerns learnability of the theoretical advantage rather than empirical attack performance.Source: C. Membership Inference Advantages in… · p. 6
A. Experimental Setup
The experiments use two binary MNIST tasks and a small variational quantum neural network, then compare membership inference under different access regimes. Surrogate models and attack procedures are tailored to the available quantum access.
A. Experimental Setup
- The study uses MNIST “0” vs “1” and “3” vs “8” classification, with images reduced to four PCA features after normalization.Images are normalized to 28 × 28 pixels with values in [−1, 1].Source: A. Experimental Setup · p. 6
- The target and surrogate are 4-qubit QNNs with three RY/RZ variational layers, ring CNOTs, and 24 trainable angles.Inputs are encoded with RY(πxi), and prediction uses the expectation of Z0, represented as ZIII.Source: A. Experimental Setup · p. 6
- Models train for 80 epochs with Adam, binary cross-entropy, learning rate 5 × 10−2, and initialization scale 0.2.Source: A. Experimental Setup · pp. 6–7
- For each surrogate model, 256 samples are drawn from a 512-point population, and experiments use 8, 16, 32, or 64 surrogate pairs.The population is sampled uniformly from the two MNIST task classes.Source: A. Experimental Setup · p. 7
- Attacks fit optimal ZIII counts under Ck, search 255 Pauli-string bases under Mk, and evaluate an empirical Helstrom measurement under Qk.Source: A. Experimental Setup · p. 7
B. Results
Membership inference advantage follows a hierarchy across access regimes and rises with measurement budget. The choice and complexity of measurements also matter, while finite resources and surrogate training budgets shape the gap between theoretical leakage and empirical attacks.
B. Results
- The experiments confirm a strict access-regime hierarchy in membership inference advantage, and larger measurement budgets increase empirical advantage when surrogate budgets match.Source: B. Results · p. 7
- More complex Mk measurements preserve more information in ρθ(x) and yield stronger inference; at Pauli weight ≤4, Mk significantly outperforms Ck.The authors frame Mk as a plausible near-future regime and this as evidence of potential QML privacy leakage.Source: B. Results · p. 7
- A larger surrogate-pair budget K pushes the theoretical-empirical leakage gap toward zero, while larger k provides more information about ρθ(x).Source: B. Results · p. 7
- The Corollary III.4 bound is not tight: its K−1/2 decay is slower than observed, and gap decay rates differ by regime.The gap decays exponentially for Qk and super-exponentially for Ck and Mk; tighter bounds are left for future work.Source: B. Results · p. 7
V. DISCUSSION AND FUTURE WORK
The three access regimes are abstractions of increasingly quantum-native service interfaces, not claims about every realized service. They range from classical outcomes to user-controlled measurements and direct quantum-state access.
A. How Realistic are Quantum-Access Regimes?
- Ck models QML-as-a-service that returns only classical measurement outcomes to users.Source: A. How Realistic are Quantum-Access… · p. 7
- Mk is a plausible near-term regime: providers retain the quantum computer but let users control measurements and return classical bits.Remote programmable circuits have been discussed for cloud quantum-computing platforms and used in recent devices.Source: A. How Realistic are Quantum-Access… · p. 7
- Qk is more distant and motivated by quantum networking and distributed computing, where remote processors exchange quantum resources and users receive states.The paper leaves detailed analysis of membership inference over the quantum internet for future work.Source: A. How Realistic are Quantum-Access… · p. 7
B. Quantum Defenses in Quantum-Access Regimes
The discussion considers access restrictions and quantum differential privacy as defenses, while the conclusion characterizes membership inference across increasingly quantum-native access. The authors caution that their experiments cover a small, noiselessly simulated model.
B. Quantum Defenses in Quantum-Access Regimes
- Classical outcome-only access Ck limits adversary information and is a stronger defense than Mk or Qk, but this defense carries a privacy-utility trade-off.Restricting measurements or the measurement budget can approach a bound on membership leakage; model performance may be impacted.Source: B. Quantum Defenses in Quantum-Access… · p. 8
- Quantum differential privacy bounds each training example’s information contribution to θ, so exposed states, measurements, and subsequent attacks remain post-processing of a differentially private model.The authors call for formal leakage bounds for differentially private QNNs under Ck, Mk, and Qk.Source: B. Quantum Defenses in Quantum-Access… · p. 8
VI. CONCLUSION
- The paper establishes the hierarchy C ⪯ M ⪯ Q and a bound on empirical attack performance under limited query and surrogate-training budgets.Experiments confirm the theory and show that quantum-information access and adversary resources jointly determine outcomes.Source: §VI · pp. 8–9
- The experiments cover a 4-qubit, 24-parameter QNN under noiseless simulation, and the authors note that susceptibility depends on the target instance and model.They call for broader model families and larger-scale, noisy experiments.Source: §VI · p. 9