Source-linked AI summary

Quantum Advantage for Two-Party Differential Privacy

Daniel Alabi, Emil T. Khabiboulline

arXiv:2610.02113v1quant-phcs.CRcs.ITmath.IT

TL;DR

Two-party Hamming-distance privacy must protect each participant from the other, unlike a trusted curator’s noisy release. The paper implements distributed noise with a guarded coherent round trip and obtains O(1) quantum error under Klauck’s message-preserving model, where classical information-theoretic protocols face polynomial error lower bounds.

  • Problem

    In two-party computation, privacy must protect each party’s input from the other, while the interaction transcript may reveal information that a trusted curator would not release.

    Source: §I · p. 1
  • Method

    A distributed cyclic-geometric noise mechanism is implemented with a guarded coherent round trip, using equal-Gram rigidity to make retained complementary information input-independent.

    Source: §VII · p. 14
  • Results

    Under Klauck’s model, an O(n)-communication quantum protocol has O(1) expected error for constant privacy parameters, versus classical lower bounds of Ω(√n) for pure privacy and Ω(√n/log n) for strong approximate privacy.

    Source: §VII · p. 14
  • Takeaways & Limitations

    The result identifies exact preservation of non-orthogonal quantum messages as a resource for information-theoretic privacy.

    Source: §VII · p. 14

    The stated O(1) quantum error applies under Klauck’s honest, nonpreemptive, message-preserving model.

    Source: §VII · p. 14

Abstract

from arXiv · show

We introduce information-theoretically private quantum protocols for two-party Hamming distance when both parties must output the same estimate. Classically, for input length $n$, information-theoretic protocols require $\Omega(\sqrt{n})$ error under pure differential privacy and $\Omega(\sqrt{n}/\log n)$ error under strong approximate differential privacy, whereas computational security permits $O(1)$ error. In Klauck's honest, nonpreemptive, message-preserving model, we give an $O(n)$-communication quantum protocol with pure $\varepsilon$ quantum differential privacy (QDP) and expected error at most $\frac{2}{\sinh \varepsilon}+\gamma$, for every $\gamma>0$. For approximate $(\varepsilon, \delta)$ QDP, an exact hockey-stick divergence calculation yields strictly smaller error, while preserving the $O(1)$-versus-$\Omega(\sqrt{n}/\log n)$ separation for $\delta=o(1/n)$. Thus, quantum communication achieves $O(1)$ information-theoretic error, matching the accuracy available classically only under computational assumptions. The main construction uses a guarded coherent round trip and an equal-Gram rigidity principle that prevents an honest player from retaining input-dependent complementary information. We separate this model from weaker prescribed-channel privacy, which already admits an exact classical realization, and from fully retention-robust security, against which measurement-and-abort attacks remain possible. Therefore, we identify preservation of non-orthogonal quantum messages as a resource for privacy.

I. INTRODUCTION

Two-party privacy must protect each participant from the other, but the interaction transcript can reveal information that a trusted curator would not release. The paper gives a quantum protocol that crosses the classical information-theoretic accuracy barrier under Klauck’s honest, nonpreemptive, message-preserving model, while delimiting where that advantage applies.

I. INTRODUCTION

  • Two-party privacy must protect each input from the other participant, since the coordinating transcript may reveal information a trusted curator would not release.For Hamming distance, the trusted-curator setting achieves expected error O(1/ε), independent of input length.Source: §I · p. 1
  • The paper asks whether the classical accuracy loss is inherent to information-theoretic privacy or follows from communication being classically copyable.An O(1)-error information-theoretic quantum protocol would show that computational assumptions are not the only route across the classical accuracy barrier.Source: §I · p. 1

B. Main Results and Implications

  • For constant privacy parameters, quantum communication achieves O(1) expected error, versus classical lower bounds of Ω(√n) under pure privacy and Ω(√n/log n) under strong approximate privacy.The quantum protocol uses O(n) communication in the stated model.Source: §I · p. 2
  • For δ = o(1/n), the quantum protocol retains O(1) error against the classical Ω(√n/log n) lower bound, and approximate privacy yields strictly smaller error than pure privacy.The improvement uses an exact hockey-stick divergence calculation to choose the noise parameter.Source: §I · p. 2

A. Contributions

  • A guarded coherent round trip implements distributed noise while exact preservation of non-orthogonal messages forces an observer’s retained complementary state to be input-independent.The small, input-independent guard moves approximation into a rare fallback event that affects accuracy rather than privacy.Source: §I · p. 2, B. Main Results and Implications · p. 3
  • The advantage is model-dependent: prescribed-channel privacy has an exact classical realization, while fully retention-robust security remains open despite a measure-and-abort attack.The attack lets a receiver distinguish adjacent inputs by measuring the first message and aborting.Source: §I · p. 2

B. Main Results and Implications

  • Exact hockey-stick divergence calibration uses the δ-budget to select a more concentrated noise distribution and strictly improve approximate-privacy utility.For strong approximate privacy with δ = o(1/n), the quantum error remains O(1), while the classical lower bound is Ω(√n/log n).Source: B. Main Results and Implications · p. 4

C. Main Techniques

The construction combines distributed cyclic-geometric noise, a guarded coherent round trip, equal-Gram rigidity, and exact hockey-stick calibration. The guard preserves exact privacy while placing its utility cost in a rare fallback branch.

C. Main Techniques

  • The paper’s four ingredients are distributed cyclic-geometric noise, coherent guarded communication, equal-Gram rigidity, and exact hockey-stick-divergence calibration.The no-information argument connects preservation of non-orthogonal pure states to the observer’s inability to retain an input-dependent complementary record.Source: C. Main Techniques · p. 5

a) Distributed noise for a common private output

  • The common-output functionality releases Z = HD(x, y) + A + B (mod m), with A unknown to Bob and B unknown to Alice, providing input privacy.Decoding error satisfies |Dec(Z) − d| ≤ d_m(A + B, 0) ≤ d_m(A, 0) + d_m(B, 0).Source: C. Main Techniques · p. 5
  • 2/sinh α bounds the expected error of the ideal common-output mechanism, while exact finite-cycle hockey-stick calibration selects α for approximate privacy.The divergence is continuous and strictly increasing from zero at α = ε to one as α grows, so every 0 < δ < 1 has a unique solution.Source: C. Main Techniques · pp. 5–6

b) A coherent guard that moves approximation into utility

  • The guard adds a common component to encoded states and returns a fixed fallback output on that branch, moving approximation into utility rather than privacy.The fallback error is at most n, and its contribution to expected error is less than γ; any positive guard probability preserves exact privacy.Source: C. Main Techniques · p. 5

c) Equal-Gram rigidity and the no-information principle

  • Equal-Gram rigidity makes an honest observer’s retained complementary state independent of the protected input, so privacy follows from the ideal functionality by data processing.The guarded input and returned state families have the same Gram matrix; an honest player who returns the prescribed pure state cannot retain information about Alice’s (x, a).Source: C. Main Techniques · p. 5

d) Exact calibration for approximate privacy

  • For approximate privacy, the calibrated α*_n(ε, δ) exceeds ε, giving a more concentrated noise distribution and strictly improved utility without spending additional δ-budget.The equal-Gram argument does not depend on α, so the ideal improvement lifts to the quantum protocol.Source: C. Main Techniques · p. 6

D. Comparison to Previous Lower Bounds

Classical lower bounds rely on copyable transcripts, rectangles, and retained randomness, structures that do not directly carry over to coherent quantum communication. The paper’s quantum separation depends on exact message-preserving honesty and does not establish security against retention-capable adversaries.

b) Why these arguments do not directly extend to quantum protocols

  • Non-orthogonal quantum messages can be preserved without leaving an input-dependent complementary record, unlike classical messages that can be copied unchanged.The guarded message family has the same Gram matrix before and after the prescribed operation, enabling the equal-Gram no-information argument.Source: D. Comparison to Previous Lower Bounds · p. 6

c) What the classical lower bounds still imply

  • Classical KHNP observers can copy messages and retain randomness, so the classical lower-bound argument still yields Ω(√n / log n) error under strong approximate privacy.When honest executions produce a common output, it is a function of the classical transcript on its support.Source: D. Comparison to Previous Lower Bounds · p. 7
  • Quantum communication achieves O(1) expected error for constant ε without computational assumptions, while the classical lower bounds do not extend unchanged to quantum protocols.The classical proofs use transcript structure that coherent quantum communication does not have.Source: D. Comparison to Previous Lower Bounds · p. 7

d) Dependence on the adversarial model

  • The advantage is specific to KHNP’s exact message-preserving condition; a retention-capable receiver can measure the first message and abort to distinguish adjacent inputs.Whether a classical-style accuracy lower bound holds against fully retention-capable quantum adversaries remains open.Source: D. Comparison to Previous Lower Bounds · p. 7

E. Organization of the Paper

The paper develops an ideal common-output mechanism, places its quantum advantage against classical limits, and distinguishes the privacy models in which its claims hold. It then organizes the mechanism’s analysis and protocol realizations across the paper’s sections.

E. Organization of the Paper

  • The paper’s sections move from related work and privacy models to the ideal common-output functionality, then to classical and guarded quantum realizations and their guarantees.Later sections discuss model interpretation, pure versus approximate privacy, verification, and the conclusion.Source: E. Organization of the Paper · p. 7
  • The ideal functionality uses distributed cyclic-geometric noise, proves pure privacy and accuracy, and derives exact finite-cycle hockey-stick divergence for approximate privacy.The two noise shares yield an expected error bound of 2/sinh α, and exact calibration gives a unique parameter for each 0 < δ < 1.Source: E. Organization of the Paper · p. 7, §IV · pp. 9–10

A. Differential privacy in two-party computation

  • Classical two-party Hamming-distance protocols face Ω(√n) pure-privacy and Ω(√n / log n) strong-approximate-privacy error bounds, while the quantum protocol achieves O(1) error for constant ε.The quantum result uses no computational assumption, trusted setup, prior entanglement, bounded-storage assumption, or secure-erasure assumption.Source: A. Differential privacy in two-party… · pp. 7–8

B. Quantum privacy models

  • Quantum privacy depends on whether inputs are classical, coherent, or externally purified; this paper assumes classical inputs but allows quantum communication.Its discussion distinguishes honest message-preserving privacy from stronger adversarial notions and notes that message-preserving honesty alone does not imply malicious or simulation-based security.Source: B. Quantum privacy models · p. 8

III. MODELS AND QDP PRELIMINARIES

  • The paper distinguishes fixed prescribed-channel views from KHNP views, where an observer may retain private systems but must send the prescribed messages and complete every round.The model preliminaries also define quantum differential privacy through bounds on the relevant hockey-stick divergences.Source: §III · p. 8

V. EXACT PC AND GUARDED KHNP REALIZATIONS

The fixed prescribed-channel view admits an exact classical reversible realization of the ideal private functionality, so it cannot by itself demonstrate a quantum improvement.

V. EXACT PC AND GUARDED KHNP REALIZATIONS

  • An exact classical reversible protocol with O(n) communication matches the ideal functionality’s common output and views, achieving pure ε-QDP and expected error at most 2/sinh ε.Both parties apply the same decoder to the shared output.Source: §V · p. 10
  • The protocol computes HD(x, y) + a + b modulo m, copies the result to both output registers, then reverses the computation to clear message history and work registers.The resulting terminal views are exactly (x, A, Z) and (y, B, Z).Source: §V · p. 10
  • Because the PC model already permits this exact classical pure-DP realization, PC security alone cannot demonstrate a quantum improvement.The paper then proceeds to its KHNP construction.Source: §V · p. 10

A. Guarded coherent round trip

The guarded coherent round trip implements a common Hamming-distance estimate while protecting each party’s input in the complete terminal view of every Klauck-honest nonpreemptive observer. Its equal-Gram construction prevents observers who return the prescribed pure message from retaining input-dependent complementary information.

A. Guarded coherent round trip

B. Privacy

  • Every Klauck-honest nonpreemptive terminal view satisfies pure ε-QDP, and the honest parties produce a common output.The privacy argument applies to arbitrary observing strategies in the model.Source: B. Privacy · pp. 10–11
  • The expected error is at most 2/sinh ε + γ, with an input-independent guard branch contributing at most γ.On the real branch, the error is at most 2/sinh ε; the guard branch has probability κ and error at most n.Source: B. Privacy · p. 11
  • Equal-Gram rigidity makes an observer’s retained complementary state independent of the protected input when the prescribed pure message is returned.The principle follows from preservation of inner products for pure-state families with equal nonzero Gram matrices.Source: B. Privacy · pp. 10–11

C. Variations

The variations retain the guarded protocol’s privacy argument while adjusting implementation or noise calibration. Approximate privacy uses an exact hockey-stick divergence calculation to obtain strictly sharper accuracy.

Discrete implementation

  • A discrete variant uses a power-of-two K and has fallback probability 1/K and utility penalty at most n/K ≤ γ.Its communication cost is O(n + log(1/γ)).Source: C. Variations · p. 11

Noise-calibrated approximate QDP

  • Approximate privacy permits strictly sharper calibration, with the error bounded by the noise-calibrated expression plus γ.The calibration uses the δ-budget through an exact finite-cycle hockey-stick divergence calculation.Source: C. Variations · pp. 11–12
  • The noise-calibrated guarded protocol gives both parties a common output satisfying (ε, δ)-QDP with O(n) qubit communication.Its communication calculation is unchanged from the pure-QDP construction.Source: C. Variations · p. 12

D. Advantage

The paper establishes an information-theoretic quantum accuracy advantage for Hamming distance in the exact message-preserving KHNP model, while distinguishing that model from prescribed-channel and retention-robust security. It also discusses verification as a possible way to detect deviations from the prescribed quantum return.

D. Advantage

  • For fixed parameters, quantum error is O(1) versus classical Ω(√n) under pure privacy and Ω(√n/log n) when δ=o(1/n).The comparison is for common-output Hamming distance in the KHNP model.Source: D. Advantage · p. 12

A. Interpreting the Three View Models

  • Prescribed-channel privacy admits an exact classical realization, KHNP requires exact prescribed messages and completion, and retention-robust security permits arbitrary deviations.The guarded protocol is not secure against retention-robust measure-and-abort strategies.Source: A. Interpreting the Three View Models · pp. 12–13

B. From KHNP Honesty to Verifiable Message Preservation

  • A verification test accepts an honest return with probability one and detects with high probability deviations that significantly reduce returned-state fidelity.The equal-Gram principle links an exact return to a retained complementary state independent of the protected input.Source: B. From KHNP Honesty to Verifiable… · p. 13

VII. CONCLUSION

  • The conclusion identifies model dependence: arbitrary retention-capable strategies remain outside the protocol’s security, and quantum improvement in that stronger model remains open.The appendix provides a classical randomized-response baseline for the retention-robust model.Source: §VII · p. 14

APPENDIX

The appendix expands the ideal common-output functionality and its implementations, including approximate-QDP calibration and a retention-robust classical baseline. The ideal functionality distributes noise between the parties so neither can remove all of it from the shared release.

APPENDIX

  • The appendix presents the noise-calibrated approximate protocol and a classical retention-robust protocol with expected error O(√n) for constant privacy parameters.It also gives numerical examples of the utility improvement over pure-QDP calibration.Source: APPENDIX · p. 16

A. Implementing the Ideal Functionality

  • Two independent cyclic-geometric noise shares protect both inputs in the common release, giving pure ε-DP and expected error at most 2/sinh ε.The factor of two reflects the common-output requirement: both shares appear in the same released value.Source: A. Implementing the Ideal Functionality · pp. 16–17

B. Exact Classical Reversible Protocol

The prescribed-channel protocol classically realizes the ideal common-output noisy Hamming-distance functionality through reversible computation. Its exact guarantee depends on evaluating only designated terminal views, unlike the stronger Klauck honesty model, where a classical player can retain the transcript.

B. Exact Classical Reversible Protocol

  • Alice and Bob compute Z = HD(x, y) + A + B (mod m), copy the residue into permanent output registers, and both decode the same result.The noise shares A and B are sampled independently, and the distributed computation exactly realizes the ideal functionality.Source: B. Exact Classical Reversible Protocol · p. 17
  • Reversible uncomputation clears temporary messages and workspaces while leaving the parties’ output registers intact.At termination, Alice’s view is (x, A, Z) and Bob’s is (y, B, Z), matching the ideal views.Source: B. Exact Classical Reversible Protocol · p. 17
  • The protocol inherits the ideal functionality’s pure ε-DP and 2/sinh ε error guarantees because its terminal views match the ideal views.Intermediate messages may reveal information while present; reversibility does not make them private.Source: B. Exact Classical Reversible Protocol · p. 17
  • The prescribed-channel model scores designated terminal registers, so classical lower bounds based on transcript-and-coins views do not apply directly.In Klauck’s honesty model, a classical player may retain message copies while sending prescribed messages, so the distinction between honest-view definitions matters.Source: B. Exact Classical Reversible Protocol · p. 17

C. Noise-Calibrated Guarded Protocol for Approximate QDP

The approximate-QDP protocol keeps the guarded coherent communication structure and calibrates its cyclic-geometric noise using an exact hockey-stick divergence calculation. This calibration permits strictly lower expected error than the pure-QDP bound while retaining O(n) communication; for δ=o(1/n), the quantum-versus-classical error separation remains.

C. Noise-Calibrated Guarded Protocol for Approximate QDP

  • An exact finite-cycle hockey-stick divergence calculation selects a larger cyclic-geometric parameter α⋆, allowing more concentrated noise under the target (ε, δ)-privacy level.The guarded quantum realization is unchanged, and the equal-Gram argument does not depend on the noise parameter.Source: C. Noise-Calibrated Guarded Protocol… · p. 18
  • The calibrated approximate-QDP error bound is strictly smaller than the pure-QDP bound, apart from the arbitrarily small guard penalty γ.The explicit bound is 2 sinh(α⋆_n(ε, δ)) + γ < 2 sinh ε + γ, as stated in the supplied passage.Source: C. Noise-Calibrated Guarded Protocol… · p. 18
  • The approximate protocol retains O(n) communication and the exact message-preserving privacy argument of the pure-QDP construction.It uses the same guarded coherent encoding and return structure, with the noise distribution recalibrated.Source: C. Noise-Calibrated Guarded Protocol… · p. 18
  • For constant ε, in the strong approximate-privacy regime δ = o(1/n), both quantum bounds remain O(1), and the numerical saving from approximate privacy is lower order.Source: C. Noise-Calibrated Guarded Protocol… · p. 19

D. A Common-Output Retention-Robust Baseline

This section gives a common-output randomized-response protocol for the stronger retention-robust model, where a party may retain auxiliary systems, alter messages, or abort. It achieves pure ε privacy in both directions but has leading error O(√n) for constant ε.

D. A Common-Output Retention-Robust Baseline

E. Statement on AI Use

The authors report using GPT 5.6 Sol to optimize the approximate-DP noise mechanism and generate figures; they independently checked the mathematical expressions and figures.

E. Statement on AI Use

  • GPT 5.6 Sol was used to optimize the approximate-DP noise mechanism and generate figures, which the authors independently checked.The authors state that they generated the main ideas, algorithms, and protocols.Source: E. Statement on AI Use · p. 22
Loading 2610.02113v1…