PaperlayerView exact revision on arXiv

Source-linked AI summary

Does the Readout Bypass Leak the Input? A Feature-Visibility Audit of Hybrid Quantum-Classical Models

Guilin Zhang, Kai Zhao, Xiquan Cui, Henry Heng, Xu Chu, Aletta Johanna Blanken

arXiv:2609.38720v1quant-phcs.CR

TL;DR

Membership-inference results do not establish whether a server can reconstruct a record from a shared training update. This paper audits a readout-side bypass with visibility-conditioned reconstruction comparisons, finding strong recovery for raw-input paths and substantially different quantum-only scores depending on which coordinates are scored.

  • Problem

    Membership inference does not answer whether a server can reconstruct a record from its training update, a distinct privacy question for shared gradients.

    Source: §1 · p. 1, §3 · p. 3

  • Method

    The audit connects biased-layer analytic leakage to residual hybrids and compares iterative gradient reconstruction with metrics over full records and shared visible coordinates.

    Source: §1 · p. 2, §3 · pp. 2–3

  • Results

    73–96 dB full-vector median PSNR for residual and input-only heads contrasts with quantum-only results of 8–11 dB full-vector and 54–96 dB on shared coordinates.

    Source: §4 · p. 3

  • Takeaways & Limitations

    Privacy evaluations should condition reconstruction metrics on input visibility and keep reconstruction distinct from membership inference.

    Source: §5 · p. 4, §6 · p. 4

    Evidence covers two small datasets, one split, 15 record-seed attacks per architecture, and noiseless simulation, leaving broader settings untested.

    Source: §5 · p. 4

Abstract

from arXiv · show

Readout-side residual hybrids concatenate raw inputs with measured quantum features. Under single-example gradient sharing, a biased first linear layer admits standard analytic recovery of its input, so the bypass exposes raw coordinates without requiring inversion of the quantum circuit. We audit this mechanism using two tabular datasets, four architectures, and metrics conditioned on feature visibility. Iterative gradient matching gives median full-record PSNR of 73-96 dB for residual and input-only heads. Quantum-only heads score 8-11 dB on the full record but 54-96 dB on the six input coordinates they actually encode. These are reconstruction results for the tested six-input, six-observable circuits, not a general statement about quantum encodings. A loss-threshold membership attack remains near chance. The contribution is a visibility-conditioned privacy audit: omitted coordinates must not be credited as protection supplied by quantum processing, and near-exact PSNR differences must not be interpreted as meaningful privacy rankings. Our findings concern individual gradients and do not establish leakage under aggregation or multiple local training steps.

1 Introduction

Readout-side residual hybrids append raw inputs to measured quantum features, bypassing the measurement bottleneck. This audit distinguishes gradient reconstruction from membership inference and conditions comparisons on which input coordinates each head receives.

1 Introduction

  • The residual head concatenates raw input x with measured Q(x), adding a bypass that can improve accuracy without increasing quantum depth.This is attractive for federated learning on resource-constrained clients.Source: §1 · p. 1
  • The originating membership-inference result near the 0.5 random baseline does not test whether a server can reconstruct a record from its training update.The audit therefore examines the gradient observed by the server.Source: §1 · p. 1
  • The audit compares full-record and shared-coordinate reconstruction because quantum-only heads receive six features while residual and input-only heads receive every feature.The evaluation distinction, rather than a new gradient-inversion attack, is the contribution.Source: §1 · p. 1, Figure 1 · p. 2
  • The paper connects biased-linear-layer analytic leakage to this architecture and separates direct gradient identifiability from statistical imputation of unseen features.The work is presented at the NeurIPS 2026 SaTQuML workshop.Source: §1 · pp. 1–2

2 Related work

Prior work studies federated quantum learning and privacy risks in shared updates, but update privacy and record reconstruction are distinct concerns.

2 Related work

  • Federated QML exchanges hybrid-model updates while raw data remain at clients, and some protocols add blind computing or differential privacy.The audit focuses on a readout-side residual architecture.Source: §2 · p. 2
  • Shared FL updates can expose membership or unintended features, while gradient reconstruction targets the record itself;.Malicious servers can amplify leakage even for large batches.Source: §2 · p. 2
  • Secure aggregation hides individual updates from honest aggregators, but repeated observations or inconsistent models can weaken that guarantee.This study isolates one unaggregated, single-example update received by an honest-but-curious server.Source: §2 · p. 2

3 Audit methodology

The audit implements a six-input quantum map with several heads, then evaluates analytic and iterative gradient reconstruction using visibility-conditioned metrics. It models a server receiving a single-record gradient and treats membership inference separately.

3 Audit methodology

  • The residual maps the first six features to six Pauli-Z expectations, concatenates x and Q(x), and applies a biased projection plus MLP.The pure-quantum and Q(x)-only heads use quantum features; the first-six selection is an implementation choice, not a claim about the original pipeline.Source: §3 · p. 2
  • The server is modeled as knowing trained weights and receiving every parameter gradient for one record; a plain SGD step with known learning rate also reveals the gradient.The attack uses a separate single-record diagnostic gradient, not an actual multi-step FedAvg update.Source: §3 · p. 2
  • For a biased first affine layer, the standard leakage mechanism recovers the layer input when a bias-gradient row is nonzero; raw-input heads expose x, while quantum-only heads expose Q(x).Recovering Q(x) alone does not invert the circuit.Source: §3 · p. 2
  • Iterative reconstruction matches model gradients, infers the label from the final bias gradient, constrains inputs to [0,1], and omits total variation for tabular features.Metrics are computed both over all coordinates and over the six shared coordinates; the latter does not make architectures visibility-matched.Source: §3 · p. 3
  • Membership AUC near 0.5 does not measure reconstruction from a training update, and the original evaluation reported no PSNR result despite naming gradient inversion and PSNR.The audit retains a loss-threshold MIA as a diagnostic comparison.Source: §3 · p. 3

4 Experiments

Across two tabular datasets, iterative matching reconstructs full records well for residual and input-only heads, while quantum-only results depend strongly on whether scoring is limited to visible coordinates.

4 Experiments

  • The experiments use Wine and Breast Cancer, a fixed stratified 75/25 split, four architectures, and a six-qubit map encoding the first six features.Three seeds and five records per seed yield 15 attacked records per dataset and architecture; attacks report medians and IQRs across full and shared-six coordinates.Source: §4 · p. 3
  • 73–96 dB full-vector median PSNR for residual and input-only heads contrasts with 8–11 dB for quantum-only heads, whose shared-six median PSNR is 54–96 dB.All attacks infer the label correctly; omitted coordinates are not directly identifiable from these gradients, though correlated features could support untested imputation.Source: §4 · p. 3
  • MIA AUC remains .477–.540 despite reconstruction, illustrating that membership inference and reconstruction measure different properties.Near-exact PSNR differences reflect optimization and numerical residuals, not meaningful privacy rankings.Source: §4 · p. 3
  • The raw-feature path suffices for exposure through the analytic leakage mechanism, while quantum interaction is unnecessary; 200-step matching can still fail to exploit the vulnerable layer.Input-only accuracy matches or exceeds residual accuracy on these datasets.Source: §4 · p. 3

5 Discussion

The bypass expands the coordinates exposed to affine-layer gradient leakage, while quantum-only recovery of encoded inputs in this experiment does not establish invertibility of compressive encodings. Membership evidence and reconstruction measure different properties, and visibility-matched reporting is needed to avoid treating omitted coordinates as privacy protection.

5 Discussion

  • A readout bypass exposes raw features to affine-layer gradient leakage, while quantum-only gradients have no direct dependence on omitted coordinates.Correlated visible features could still support statistical inference about omitted coordinates.Source: §5 · p. 3
  • Recovery of six inputs from six observables in this experiment does not establish invertibility of compressive quantum encodings.The audit also leaves compressive or all-feature encodings unevaluated.Source: §5 · p. 4
  • MIA AUC near 0.5 indicates weak membership evidence under a particular attack, not whether a specific input is recoverable from a shared gradient.AUC is an average-case summary, not a privacy certificate.Source: §5 · p. 4
  • The evidence covers two small datasets, one split, 15 record-seed attacks per architecture, and noiseless simulation.The study did not evaluate larger batches, multiple local steps, imputation, or withholding first-layer gradients.Source: §5 · p. 4
  • A defensible privacy table should report which coordinates affect each transmitted update, what aggregation precedes server access, and full-record alongside shared-coordinate metrics when visibility differs.MIA should remain separate and go beyond aggregate AUC when central to a claim.Source: §5 · p. 4

6 Conclusion

A readout bypass exposes raw features to known affine-layer gradient leakage under the stated conditions; iterative matching also reconstructs visible features in the tested six-input circuits. The conclusion is to specify the server's observable, condition metrics on input visibility, and distinguish reconstruction from membership inference.

6 Conclusion

  • A readout bypass exposes raw features to known affine-layer gradient leakage under the stated conditions.The tested six-input circuits also yielded iterative reconstruction of visible features.Source: §6 · p. 4
  • The observed iterative recovery applies to visible features in the tested six-input circuits.Source: §6 · p. 4
  • Audits should specify the server's observable, condition metrics on input visibility, and distinguish reconstruction from membership inference.Source: §6 · p. 4

A Reproducibility details

The reproducibility setup uses one shared stratified split for two tabular datasets, four model architectures, and repeated record-level gradient attacks. Model training and attack procedures are specified separately, with Table 2 covering capacity, held-out accuracy, and loss-threshold MIA AUC.

A Reproducibility details

  • Wine has 178 examples, 13 features, and 3 classes; Breast Cancer has 569 examples, 30 features, and 2 classes, using one stratified 75/25 split with seed 42.All model seeds reuse that split, and Breast Cancer uses all 30 raw features rather than the originating paper's PCA-reduced representation.Source: A Reproducibility details · p. 7
  • The quantum map encodes the first six coordinates and measures six Pauli-Z expectations, while the projection head uses biased linear layers.Models train for 30 epochs with Adam, learning rate .01, cross-entropy, and minibatches of 8 in a noiseless simulator.Source: A Reproducibility details · p. 7
  • Each seed attacks five records with two random restarts and 200 Adam steps, retaining the best cosine-gradient objective and reporting medians and IQRs across 15 records per dataset and architecture.Labels are inferred from the final bias gradient and were correct in all 120 attacks.Source: A Reproducibility details · p. 7
  • Table 2 reports capacity, held-out accuracy, and loss-threshold MIA AUC as means ± standard deviation over three seeds.Source: Table 2 · p. 7

B Complete reconstruction results

The complete reconstruction results separate full-vector scores from shared-six scores, because the former include omitted coordinates that the iterative attack leaves unconstrained. Very high PSNR indicates near-exact reconstruction, not a calibrated privacy ranking, while IQRs expose record-to-record variability hidden by medians.

B Complete reconstruction results

C Analytic leakage and numerical recovery criteria

For a single example, gradients of a biased first affine layer expose its input when a backpropagated signal is nonzero. This recovers raw coordinates directly from residual and input-only heads, but quantum-only heads yield measured features rather than the original input.

C Analytic leakage and numerical recovery criteria

  • For one example, gW = δz^T and gb = δ, so a row with nonzero δ_j recovers the first-layer input z.The row with the largest |(gb)_j| avoids dividing by an unnecessarily small signal.Source: C Analytic leakage and numerical… · p. 9
  • The recovery formula does not require the example’s class label.These are applications of established gradient leakage, not new attacks.Source: C Analytic leakage and numerical… · p. 9
  • For residual and input-only heads, recovered z contains raw input coordinates; for quantum-only heads, z = Q(x) and recovering x still requires circuit inversion or additional information.Six measured expectations need not define an injective map, even with six inputs; results establish recovery only for the tested records and parameters.Source: C Analytic leakage and numerical… · p. 9
  • The identity assumes individual weight and bias gradients and a nonzero backpropagated signal; zero signals, missing bias gradients, perturbation, or aggregation remove the same recovery guarantee.For batches, row ratios are generally weighted mixtures rather than any one record, and multi-step Adam or FedAvg deltas are not the single gradient analyzed.Source: C Analytic leakage and numerical… · p. 9
  • The analytic result is exact under its algebraic assumptions, but no separate empirical gradient-ratio evaluation on saved checkpoints was run.Finite attack budget can leave avoidable iterative residual error; lower quartiles do not establish protection against the analytic attack.Source: C Analytic leakage and numerical… · p. 9

C.1 Thresholded recovery from saved iterative attacks

Table 6 reports iterative recovery counts at explicit MSE tolerances using 15 record-seed pairs. The thresholds quantify the existing iterative attack, not an unmeasured analytic baseline, and are not claims of bitwise-exact recovery.

C.1 Thresholded recovery from saved iterative attacks

  • MSE thresholds 10^-6 and 10^-8 define numerical recovery tolerances, not bitwise-exact recovery.For features scaled to [0, 1], the corresponding RMSE tolerances are 10^-3 and 10^-4.Source: §C.1 · p. 9
  • The threshold counts quantify the existing iterative attack, not the unmeasured analytic baseline.PSNR computation floors MSE at 10^-12, imposing a 120 dB ceiling.Source: §C.1 · p. 9
  • Each Table 6 recovery rate uses the same 15 record-seed pairs as the PSNR summaries.The table summarizes iterative recovery counts recomputed from saved per-target results.Source: Table 6 · p. 9, §C.1 · p. 9

Related papers

Loading 2609.38720v1…