PaperlayerView exact revision on arXiv

Source-linked AI summary

Encryptability As a Coordinate Choice: Depth-One Homomorphic Federated Learning of Quantum Neural Networks

Marcel Mordarski, Nathan Mani, Arshad Patel, William Knottenbelt, Roberto Bondesan

arXiv:2609.30581v1quant-phcs.CRcs.DCcs.LG

TL;DR

Encrypted training for group-valued models is constrained by the cost of representing continuous rotations in conventional coordinates. This paper uses unit-quaternion coordinates to make encrypted federated updates shallow, and reports backend-validated mechanism claims alongside small-scale feasibility evidence.

  • Problem

    Continuous SU(2) rotations in group-valued models do not fit the low-degree update pattern needed for efficient encrypted training, while prior routes impose substantial cryptographic costs and privacy trade-offs.

    Source: §1 · p. 2

  • Method

    The paper represents SU(2) rotations as unit quaternions, uses bilinear composition for encrypted updates, and combines this with federated aggregation and a compatible delegated-execution track.

    Source: §1 · p. 2, §4.1 · p. 4, §4.2 · p. 5

  • Results

    Mechanism-level claims are supported by depth-ledger checks on two backends and exact entangler compilation, while run-level results provide deliberately small-scale feasibility evidence.

    Source: §6 · p. 9

  • Takeaways & Limitations

    For group-valued parameters, the group law can make encryptability a coordinate choice rather than solely an architectural constraint.

    Source: §7 · p. 9

    Reported runs use a reference lattice profile for structural verification and carry no formal security guarantees.

    Source: §6 · p. 9

Abstract

from arXiv · show

Encrypted training relies on keeping server-side updates low-degree. This constraint traditionally excludes models whose weights inhabit a compact Lie group (notably variational quantum circuits, where every trainable weight is an $\mathrm{SU(2)}$ rotation). Expressed in Euler angles or discrete alphabets, these updates appear transcendental, historically demanding prohibitive costs: one client--server round per gate, or upwards of $25{,}000$ operations per weight. This penalty is strictly an artefact of coordinates. In the unit-quaternion (spin) chart, group composition is exactly bilinear (degree two, with coefficients in $\{-1,0,+1\}$). Consequently, encrypted rotation updates cost one multiplicative level and federated averaging costs zero in any levelled homomorphic scheme, completely eliminating bootstrapping. This implementation-independent algebraic property is confirmed across two cryptographic backends, introducing only $0.0$ and $-2.0\times10^{-12}$ rad of aggregation error. Leveraging this reduction yields a non-interactive protocol for encrypted federated training of hybrid quantum--classical networks. It includes correctness proofs for aggregation and sign handling, plus a compilation lemma proving parameterised entanglers add only constant-factor overhead without altering the depth class. Empirically, a paired five-seed study confirms zero measurable utility tax ($\Delta=+9\times10^{-6}$ MSE, $p=0.92$), and a noise-budget ablation falsifies the hypothesis that encryption noise regularises. These convergence trends replicate across datasets and scale to $20$ clients. Finally, hardware validation on a $156$-qubit processor achieves $0.9918$ fidelity against a $0.99957$ unencrypted control.

1 INTRODUCTION

The paper argues that encrypted learning for group-valued parameters depends on coordinate choice: SU(2) rotations become low-degree updates in unit-quaternion coordinates. This yields a shallow encrypted federated-training approach for quantum models, addressing the costs and privacy gaps of prior routes.

1 INTRODUCTION

  • Prior repairs for continuous rotations require one client–server round per gate or typically more than 25,000 gates per rotation.The first cost comes from measurement-based blind delegation; the second from discrete-alphabet compilation and active key repair.Source: §1 · p. 2
  • Plaintext updates expose training information to gradient-inversion attacks, while interactive delegation does not compose with classical secure aggregation.The introduction also identifies utility and communication trade-offs in differential privacy and multi-party computation.Source: §1 · p. 2
  • In unit-quaternion coordinates, SU(2) composition is bilinear, so encrypted rotation updates cost one multiplicative level and weighted FedAvg costs zero without bootstrapping.The same algebraic bound applies to Spin(n) rotors and is scheme-agnostic; the paper reports verification on two backends.Source: §1 · pp. 2–3
  • The paper presents a practical encrypted federated-training protocol, correctness results for aggregation and sign handling, and a constant-overhead entangler compilation lemma.Its reported evaluation includes multiple datasets and scaling to 20 clients.Source: §1 · p. 3
  • A paired experimental design with a matched unencrypted hardware control demonstrates no measurable utility tax and falsifies confounding regularisation effects that a single-seed run would obscure.Source: §1 · p. 3

2 SETTING: LEAKAGE

The setting has two privacy exposure points in federated quantum training: remote execution can expose circuit angles, and aggregation can expose client updates. The protocol assumes an honest-but-curious server and peers, with confidentiality protections differing between the classical and quantum layers.

2 SETTING: LEAKAGE

  • Hybrid quantum–classical models train quantum parameters as continuous, non-Clifford SU(2) rotation angles, using parameter-shift gradients or simulator backpropagation.Clifford gates are managed by standard quantum encryption, but generic continuous rotations create the algebraic bottleneck addressed by the paper.Source: §2 · p. 3
  • Remote quantum execution exposes rotation angles across the trust boundary, while an aggregation server sees updates that can reveal training data through gradient-inversion attacks.The paper identifies both delegated execution and federated aggregation as exposure points.Source: §2 · p. 3
  • The threat model assumes honest-but-curious parties; classical confidentiality relies on (Ring-)LWE, while the quantum-state guarantee is information-theoretic under the pad key.The protocol does not address silent poisoning, and decryption capability is shared across clients.Source: §2 · p. 3

3 RELATED WORK

Related work develops low-degree encrypted computation through polynomial activations, linear aggregation, and masking, while group-parameterised models are usually motivated by optimisation or inductive bias. Prior quantum homomorphic and federated approaches leave a gap between continuous rotations and a continuous federated training loop.

3 RELATED WORK

  • Classical encrypted-ML techniques lower computational costs through polynomial activations, linear FedAvg, and masking, whereas this paper applies low-degree representation to the parameter group itself.The group law is used directly rather than approximated.Source: §3 · p. 3
  • Group-constrained recurrent, rotation-equivariant, and quaternion networks are presented as encryption-friendly because Spin(n)-parameterised layers inherit the depth-one bound.The cited architectures originally constrain weights for optimisation or inductive-bias reasons.Source: §3 · p. 4
  • Prior quaternion work addressed single-client delegation, while this paper targets the federated training loop with aggregation correctness, entangler compilation, and hardware validation.The related work contrasts this with quantum-FL frameworks that exchange plaintext updates or use interactive delegation.Source: §3 · p. 4

4 ENCRYPTABILITY IS A COORDINATE CHOICE

The paper encodes rotations as unit quaternions so that group composition has degree two, enabling a shallow encrypted update and zero-depth weighted aggregation. It specifies a federated protocol, correctness conditions for aggregation and representatives, and a constant-overhead compilation route for parameterised entanglers.

4.1 THE DEGREE-2 REDUCTION AND THE DEPTH LEDGER

  • In the spin coordinates, SU(2) composition is degree two, so encrypted rotation updates use one multiplicative level and weighted aggregation uses zero, with no bootstrapping.The same ledger applies to Spin(n) rotors; client-side renormalisation occurs after decryption.Source: §4.1 · p. 4

4.2 PROTOCOL

  • Each round has clients train locally, encode and encrypt quaternion components, aggregate without server decryption, then decrypt, renormalise, and recover angles client-side.Exactly one sequential exchange occurs per round, independent of circuit depth, ansatz, or local parameter-shift evaluations.Source: Figure 2 · p. 5, §4.2 · p. 5

4.3 CORRECTNESS OF THE ENCRYPTED AGGREGATION

  • The server aggregates encrypted unmasked update quaternions with additions and plaintext weightings; quantum-channel masks instead need fresh per-client keys because shared masks preserve pairwise state geometry.Clients decrypt and recover angles, while quaternion one-time-pad keys remain separate from the aggregation keys.Source: §4.3 · p. 6

4.4 WELL-DEFINEDNESS: BRANCH, SIGN, AND WHICH MEAN FEDAVG COMPUTES

  • Quaternion averaging computes a chordal mean rather than standard angle FedAvg, so the protocol wraps angles and selects hemisphere representatives before averaging.The discrepancy can be computed from client disagreement; near-antipodal disagreement is the singular case, and the branch-cut case is excluded by construction.Source: §4.4 · p. 6

4.5 ENTANGLERS COST’S DEPENDENCE ON GATES AND INDEPENDENCE OF DEPTH

  • Parameterized entanglers compile exactly into single-qubit rotations and fixed CNOTs, multiplying gate count by a constant while leaving multiplicative-depth class unchanged.The continuous parameter remains on a single-qubit rotation; the CNOT key update is depth zero.Source: §4.5 · p. 6

5 EXPERIMENTS

Experiments test algebraic exactness, utility, aggregation geometry, entangler compilation, hardware performance, scaling, and communication costs. They distinguish protocol-level properties from feasibility measurements on a small hybrid model.

5.1 SETUP AND CLAIMS’ SCOPE

  • The evaluation uses a six-qubit, six-layer variational circuit with 36 trainable angles, tested on California Housing and Wine Quality.Exact statevector simulation and parameter-shift gradients support feasibility claims; run-level MSE results characterize this small model and one configuration.Source: §5.1 · p. 7

5.2 THE DEPTH LEDGER’S EXACTNESS AND UNIVERSALITY

  • Aggregation overhead was 0.0 rad on the fixed-point multi-key stack and −2.0 × 10−12 rad on OpenFHE CKKS.The measurement used three clients and 36 angles each; the two backends agree on the depth-1 update and depth-0 aggregation properties despite differing encoding error.Source: §5.2 · p. 7, Table 1 · p. 7

5.3 UTILITY AS A FUNCTION OF ENCRYPTION AND NOISE

  • +9 × 10−6 MSE was the mean paired plaintext-versus-encrypted difference across five seeds; plaintext and encrypted losses were 1.3436 ± 0.7228 and 1.3436 ± 0.7229.The 95% CI was [−2.3, +2.5] × 10−4; p = 0.923 for the paired t-test and p = 0.625 for Wilcoxon.Source: §5.3 · p. 7, Table 2 · p. 7

5.4 THE AGGREGATION-GEOMETRY BOUND

  • At the operating dispersion, measured aggregation bias was 2.50 × 10−6 rad, close to the 2.49 × 10−6 rad prediction and 47× below encryption noise.The adversarial double-cover configuration produced 3.1416 rad error for the naive arithmetic mean versus 0.0000 for the exact chordal mean, but does not arise in trained runs.Source: §5.4 · pp. 7–8

5.5 PARAMETERISED ENTANGLERS

  • The encrypted RZZ entangler’s mean recovered-angle error was 8.3 × 10−3 rad, below the 1.25 × 10−2 rad shot-noise floor.Each trial used exactly two CNOTs independently of θ, and the second qubit returned to |0⟩ with probability 1.000.Source: §5.5 · p. 8

5.6 HARDWARE

  • F = 0.9918 on ibm_fez, versus F = 0.99957 for the matched unencrypted control; the fidelity difference is comparable to median readout error.The encryption arithmetic is separately bounded at 1.55 × 10−4 rad; the authors characterize the system as hardware-limited, not encryption-limited.Source: §5.6 · p. 8

5.7 INDEPENDENCE FROM THE DATASET AND CLIENT COUNT

  • Scaling from 3 to 20 clients raised final MSE from 1.3035 to 1.3763 on California Housing and from 1.4214 to 1.5246 on Wine Quality.Training to 50 rounds improved both datasets’ means and narrowed seed spread; Wine Quality reproduced the qualitative trends.Source: §5.7 · p. 8

5.8 MEMORY COST

  • At 50 ms round-trip latency, interactive baselines require a 1.9–3.7 s per-round latency floor, while this protocol’s 45.3 MB takes 0.36 s at 1 Gbps.The crossover is near 100 Mbps at wide-area latency: above it the protocol is beneficial, while below it or on low-latency metro links the interactive baselines outweigh the benefit.Source: §5.8 · pp. 8–9

6 DISCUSSION AND LIMITATIONS

The authors separate algebraic and protocol guarantees from small-scale feasibility evidence, and identify bandwidth, implementation cost, and security assumptions as constraints.

Evidence scope

  • Mechanism-level claims rely on proofs and configuration-insensitive measurements, while run-level claims are feasibility evidence from a deliberately small-scale evaluation.The depth ledger holds on two backends, the aggregation bound spans two orders of magnitude of dispersion, and entangler compilation is exact.Source: §6 · p. 9

Practical constraints

  • The protocol favors wide-area links above roughly 100 Mbps, but its bandwidth profile disadvantages low-connectivity participants.The current reference implementation also costs about 1.5 h per encrypted CNOT gate, bounding delegated encrypted execution.Source: §6 · p. 9

Security and scope

  • The reported reference lattice profile has no formal security guarantees, and the honest-but-curious model leaves silent poisoning unaddressed.Decryption is shared across clients; larger client populations, additional datasets, and alternative ansatz families remain future work.Source: §6 · p. 9

7 CONCLUSION

The conclusion frames encrypted training for group-valued parameters as a coordinate problem: in the spin chart, composition is bilinear, making rotation updates depth one and federated averaging depth zero. The supplied appendix and preliminaries passages also outline the paper’s proofs and background concepts.

7 CONCLUSION

  • In the spin chart, SU(2) and Spin(n) composition is bilinear, so encrypted rotation updates cost one multiplicative level and federated averaging costs zero, without bootstrapping.The conclusion states that the group law dictates encryption feasibility when parameters reside on a group.Source: §7 · p. 9

APPENDIX OVERVIEW

  • The appendix overview maps proofs of the depth ledger, aggregation correctness, entangler compilation, and geometry bound to Appendices B–D.It also lists protocol construction, experimental specifications, cost models, scale tests, security profiles, limitations, and broader impact.Source: APPENDIX OVERVIEW · p. 14

A QUANTUM AND FEDERATED-LEARNING PRELIMINARIES

  • The preliminaries direct readers fluent in federated learning to skip §A.1 and readers new to quantum gates to read §A.2.They cite Nielsen & Chuang (2010) for quantum material and Kairouz et al. (2021) for federated learning.Source: A QUANTUM AND FEDERATED-LEARNING… · p. 14

A.1 FEDERATED LEARNING

  • Federated learning has clients train locally and send updates for server-side weighted aggregation; homomorphic aggregation lets the server compute the sum on ciphertexts.The motivation is that transmitted updates can reveal training examples through gradient-inversion attacks.Source: §A.1 · p. 14

A.2 QUANTUM PRELIMINARIES

  • A qubit is represented as a unit vector in C2, and gates are unitary; generic trainable single-qubit rotations are non-Clifford.Variational circuits alternate rotation layers with a fixed entangling pattern and can use parameter-shift gradients; the supplied passage links barren plateaus to underperformance of purely quantum configurations.Source: §A.2 · p. 14

B THE DEPTH LEDGER: PROOFS

The proofs establish that quaternion composition is degree two, yielding one multiplicative level for encrypted updates and zero for aggregation. They extend the depth result to Spin(n) and contrast the coordinate choice with more expensive Euler-angle and discrete-alphabet routes.

Depth ledger proof

  • Each component of quaternion composition is a sum of degree-two terms with coefficients in {−1, 0, +1}, so substituting a plaintext rotation leaves a linear form in encrypted coordinates.The update therefore consumes one multiplicative level, while weighted aggregation is an R-linear combination of ciphertexts at depth zero; plaintext renormalisation occurs outside the homomorphic layer.Source: B THE DEPTH LEDGER: PROOFS · p. 14

Unbounded round count

  • A scheme supporting multiplicative depth of at least one allows an unbounded number of federated rounds without bootstrapping, provided clients re-encrypt between rounds.Each round uses one server-side plaintext rotation per encrypted key followed by weighted aggregation.Source: B THE DEPTH LEDGER: PROOFS · pp. 14–15

Spin(n) generalisation

  • Spin(n) rotors compose bilinearly with fixed structure constants in {−1, 0, +1}, so the quaternion depth argument applies to the larger index set.For n = 3, the even subalgebra is H and the result reduces to the quaternion case.Source: B THE DEPTH LEDGER: PROOFS · p. 15

Why not Euler angles

  • Euler-angle composition uses inverse trigonometric and trigonometric operations, while discrete-alphabet composition typically requires above 25,000 gates per rotation.The Euler route relies on polynomial approximation whose depth grows with accuracy and typically forces bootstrapping; discrete non-Clifford elements require active key repair.Source: B THE DEPTH LEDGER: PROOFS · p. 15

C.1 WHAT THE SERVER COMPUTES, AND WHY IT IS CORRECT

The server aggregates encrypted client updates using additions and plaintext-integer weighting, leaving the homomorphic level budget untouched. The proofs distinguish aggregation masks from delegation masks and show that parameterised entanglers preserve the rotation-depth class.

C.1 WHAT THE SERVER COMPUTES, AND WHY IT IS CORRECT

  • The server computes weighted encrypted sums using ciphertext addition and plaintext-integer weighting, with no ciphertext–ciphertext multiplication or level consumption.The server uses an evaluation-only context and cannot decrypt; clients divide, renormalise, and recover the angle after decryption.Source: §C.1 · p. 15

C.2 PROOF OF THE MASK LEMMA

  • A common aggregation mask survives quaternion averaging and can be removed after decryption, but delegation masks must be fresh and per-client to hide pairwise state overlaps.The protocol’s aggregated update quaternion is unmasked; delegation masking protects states crossing the hardware trust boundary.Source: §C.2 · p. 15

C.3 PROOF OF THE ENTA NGLER COMPILATION LEMMA

  • Exact entangler decompositions place each continuous parameter on one single-qubit rotation, so Clifford key relabelling adds only constant overhead without changing rotation depth.Exact decompositions preserve expressivity, and the depth class depends on sequential rotations rather than entangler count.Source: §C.3 · p. 16

D AGGREGATION GEOMETRY

This block develops the geometry and implementation of encrypted quaternion aggregation, then tests correctness, utility, scaling, and hardware behavior. It reports negligible aggregation bias in the operating regime, parity with plaintext training, and successful entangler and hardware demonstrations, with a branch-cut boundary for the geometry result.

E.1 PAULI ONE-TIME PAD; E.2 QUATERNION TRACK; F.3 ENTANGLING GATES

  • Quaternion coordinates make SU(2) composition bilinear, enabling degree-two encrypted updates; the Pauli track handles Clifford structure and connects to the quaternion track through constant-count frame conversions.The update is encoded as a constrained real four-vector; entangling gates use frame switching, whose conversion cost is bit-serial and amortised across rotation layers.Source: §E.1.2 · p. 17, §E.2 · p. 18, §F.3 · p. 18

G.1 E1: PAIRED-SEED PARITY

  • +9.0×10^-6 MSE was the mean paired difference between encrypted and plaintext final validation loss, with t-test p = 0.923 across five seeds.The paired arms shared initialization and data order; between-seed final-MSE spread was approximately 0.72.Source: §G.1 · p. 19

G.2 E2: BACKEND CROSS-CHECK AND THE NOISE BUDGET

  • 0.0 rad on the secure stack and −2.0089×10^-12 rad on CKKS were the measured weighted-FedAvg aggregation overheads.The comparison used three clients and 36 angles with float64 decoding on two cryptographic backends.Source: §G.2 · p. 20, Table 5 · p. 20

D AGGREGATION GEOMETRY

  • 3.1416 rad arithmetic-mean error versus 0.0000 rad chordal-mean error occurred in the constructed near-antipodal case; the geometry bound requires representatives in a common hemisphere.At operating dispersion, the chordal-versus-arithmetic difference is 2.50 × 10^-6 rad, 47× below the encryption noise floor.Source: D AGGREGATION GEOMETRY · pp. 16–17, Table 3 · p. 17, §G.3 · p. 20

G.4 E4: PARAMETERISED ENTANGLER THROUGH THE ENCRYPTED PIPELINE

  • 8.33×10^-3 rad mean recovered-angle error for encrypted RZZ was below the 1.25 × 10^-2 rad expected sampling-noise MAE, with exactly two CNOTs per trial.The entangler test covered 20 angles at 4096 shots; its worst trial was 1.3 standard deviations from the expected value.Source: §G.4 · pp. 20–21, Figure 4 · p. 21

G.5 E5: NOISE-BUDGET FALSIFICATION

  • A 16× larger quantisation step yielded no detectable utility improvement: the paired 8-bit versus 12-bit difference was +0.0006 MSE, p = 0.636.This result does not support the proposed beneficial-regularisation account of encryption noise.Source: §G.5 · p. 21, Figure 5 · p. 21

G.6 E6: CROSS-DATASET SCALE STUDY

  • Client-count growth was mild and monotone across datasets, while longer horizons improved mean loss and seed spread; the precision–bandwidth relation was identical across datasets.The scale study tested up to 20 clients on California Housing and Wine Quality.Source: §G.6 · pp. 21–22, Table 7 · p. 22, Table 8 · p. 22

G.7 HARDWARE EXPERIMENTS

  • Encrypted hardware round trips achieved F = 0.9918 on ibm_fez versus F = 0.99957 for the matched unencrypted control; the 0.0078 difference was comparable to 0.0083 median readout error.The homomorphic-layer-only angle MAE was 1.55×10^-4 rad; the Z-basis estimator is a lower bound on state agreement.Source: §G.7 · pp. 22–23, Figure 7 · p. 23

G.8 SUPPORTING ABLATIONS

The supporting ablations test utility, drift, precision, refresh frequency, and runtime, while later sections extend the evaluation to hardware profiles, communication, gate-count comparisons, and a pure-quantum diagnostic. The reported evidence supports the hybrid setting and single-pass aggregation in the tested implementation, while marking some comparisons as descriptive or model-based.

G.8 SUPPORTING ABLATIONS

  • Repeated round trips showed no observable angle drift, while encryption took approximately 167 s per round versus approximately 76 s for local training.Other supporting ablations report unchanged single-client validation MSE and a sharp error-versus-precision trade-off with runtime increasing at higher precision.Source: §G.8 · p. 23
  • 1.24 × 10^-4 rad MAE with no refresh beat 2.7–4.3 rad for periodic refresh cadences in the current implementation.The sweep tested refresh intervals k ∈ {1, 2, 5, 10}; the authors limit this finding to the present secure-runtime implementation.Source: §G.8 · p. 23

H.2 INTERACTION VERSUS BANDWIDTH

  • 50 rounds and three clients required 50 sequential exchanges for this protocol versus 1,850 for Pauli-OTP and 3,650 for blind delegation, with 6.33 GB total traffic.The totals assume fixed ciphertext size and message accounting, rather than network traces.Source: §H.2 · p. 24, Table 9 · p. 24

H.3 SOLOVAY–KITAEV COMPARISON

  • 10×, 20×, and 30× per-rotation compute reductions against Solovay–Kitaev were estimated at target precisions ϵ = 10^-2, 10^-4, and 10^-6, respectively.These are gate-count accounting estimates, not end-to-end wall-clock measurements.Source: §H.3 · p. 24

H.4 PURE-QUANTUM DIAGNOSTIC

  • A four-qubit data-reuploading circuit failed to converge under the same encrypted federated pipeline, with validation MSE rising from 1.24 to 1.56 across five rounds.The authors connect this result and the refresh ablation to the tested need for hybrid components and single-pass aggregation.Source: §G.8 · p. 23, §H.4 · p. 24

I SCALE TESTS

  • Five-seed client scaling showed tail standard deviation falling from 0.0178 to 0.0061 as client count increased, while final MSE grew mildly and monotonically.The extended study reached 20 clients on two datasets; the original single-dataset sweep is superseded by the broader scale suite.Source: I SCALE TESTS · p. 24

J IMPLEMENTATION AND SECURITY PROFILES

The implemented protocol’s main operational cost is bandwidth, while its security claims depend on the cryptographic layer and verification profile. The paper also identifies limits in robustness and production integration.

J IMPLEMENTATION AND SECURITY PROFILES

  • The fixed-point stack is LWE-based and the OpenFHE CKKS cross-check is RLWE-based; encrypted rotation also uses a levelled circuit with a 3kL + 1 level budget.At the default k = 12 and L = 1, the budget is 37 levels; the Boolean sub-layer accounts for about 1.5 hours per encrypted CNOT.Source: J IMPLEMENTATION AND SECURITY PROFILES · pp. 24–25
  • The reported default profile establishes protocol structure, exactness, and depth, but makes no security claim; production profiles are available.The default is chosen for auditability rather than security level.Source: J IMPLEMENTATION AND SECURITY PROFILES · p. 25

K.1 BANDWIDTH IS THE NEW BOTTLENECK

  • 6.33 GB over 50 rounds is driven by 22.67 MB ciphertexts per client per round; the trade pays above roughly 100 Mbps on wide-area links, not below that threshold or on low-latency links.Precision recovers about a third of traffic at no measured utility cost.Source: §K.1 · pp. 26–27

K.2 SECURITY, IN TWO LAYERS

  • Quantum-state security is information-theoretic, while classical-layer security rests on (Ring-)LWE; shared client decryption capability can be hardened with threshold key generation.The system guarantee is bounded by the weaker link.Source: §K.2 · p. 27

K.3 ROBUSTNESS AGAINST MALICIOUS CLIENTS

  • A blind server cannot detect poisoned updates, so the protocol is presently suited to institutionally vetted federations with verified client identities.Homomorphic-compatible robust aggregation is identified as a needed next component.Source: §K.3 · p. 27

K.4 IMPLEMENTATION SCOPE

  • Full production-stack integration and several planned cost-model studies remain incomplete, while quantum-cloud budgets constrain multi-seed hardware validation.The omitted studies included evaluation time versus CNOT fraction, depth scaling, and gate ordering.Source: §K.4 · p. 27

L BROADER IMPACT

The broader-impact discussion weighs confidentiality against limits on auditability, robustness, and access. It also discloses AI assistance in development and empirical-evaluation materials.

L BROADER IMPACT

  • The protocol’s blindness may conflict with jurisdictions requiring model inspection or data-access rights, and selective disclosure remains a proposed direction.The paper also advises assessing whether residual lattice-based classical-layer security matches an organization’s threat model.Source: L BROADER IMPACT · p. 27
  • Under the honest-but-curious model, a minority of malicious clients could degrade the global model without an audit signal; deployment in adversarial settings should wait for robust aggregation.Source: L BROADER IMPACT · p. 27
  • Quantum-cloud and HPC access requirements, together with bandwidth costs, may disadvantage community clinics, mobile devices, and low-connectivity nodes.The paper identifies ciphertext compression and lightweight backends as equity concerns.Source: L BROADER IMPACT · p. 27

M USE OF LARGE LANGUAGE MODELS

  • The authors report using AI tools for code development, figure generation, manuscript polishing, literature discovery, and synthetic datasets, while retaining responsibility for experimental design, analysis, and claims.Source: M USE OF LARGE LANGUAGE MODELS · p. 28

Related papers

Loading 2609.30581v1…