PaperlayerView exact revision on arXiv

Source-linked AI summary

Verifiable Sampling for Delegated Generative Quantum Machine Learning

Matteo Inajetovic, Anna Pappa, Petros Wallden

arXiv:2610.13211v1quant-phcs.LG

TL;DR

Secure delegation of quantum generative models has received comparatively little attention. This paper proposes blind, verifiable sampling for inference and extends verifiable delegated training to QGMs. The sampling protocol bounds output error and failure probability, and estimates the corrupted-sample ratio even against a malicious server.

  • Problem

    Securely delegating quantum generative models to a remote quantum server remains comparatively underexplored, while existing DVQA requirements do not directly fit general QGM losses and gradient methods.

    Source: §I · p. 1, B. Delegated End-to-End Generative QML · p. 4

  • Method

    The paper proposes blind, verifiable delegated sampling for inference and generalizes verifiable delegated training to QGMs beyond expectation-value losses and Parameter-Shift-Rule gradients.

    Source: §II · p. 2, B. Delegated End-to-End Generative QML · p. 4

  • Results

    The sampling protocol bounds absolute error by εth with failure probability decreasing exponentially in the number of rounds, and simulations found its estimator recovers the true corruption rate.

    Source: A. Delegated Sampling · p. 3, §IV · p. 5

  • Takeaways & Limitations

    Trap detection rates provide an operational proxy for output quality and an estimate of corrupted samples without noise-model assumptions, even when the target distribution is classically inaccessible.

    Source: A. Delegated Sampling · p. 3, §V · p. 6

    End-to-end verifiable training requires all circuit evaluations within a gradient step to share the same MBQC graph.

    Source: §V · p. 6

Abstract

from arXiv · show

Generative machine learning has shown remarkable results across a wide range of interdisciplinary tasks, motivating significant efforts toward Quantum Generative Models as a path to beyond-classical performance, given their capability of generating classically intractable distributions. However, comparatively little attention has been paid to securely delegating such computations to a powerful remote quantum server. In this work, we propose a blind and verifiable protocol for sampling that can be used for the inference phase of such quantum models. Such a protocol inherits blindness from Universal Blind Quantum Computing and achieves verifiability by exploiting known approaches based on trapification schemes. Alongside, to delegate the training phase, we discuss an extension of the previously proposed verifiable end-to-end Delegated Variational Quantum Algorithms (Inajetovic et al., Phys. Rev. Research, 2026). Beyond the usual Accept/Abort outcome characterizing verification protocols, the sampling protocol for inference also provides, even against a malicious server, an estimation of the amount of corrupted generated samples, i.e., a fine-grained feature describing the quality of the outcome connecting verification protocols and application-level benchmarking.

I. INTRODUCTION

Quantum generative models (QGMs) have been proposed for learning classical and quantum target distributions, but secure delegation of these models has received less attention. This work proposes verifiable delegated sampling for inference and a broader approach to secure QGM training.

I. INTRODUCTION

  • Securely delegating QGMs to a remote quantum server has received less attention than QGM development, despite progress in generative modeling and quantum advantages.Earlier train-classical, deploy-quantum strategies can produce discrepancies in certain scenarios.Source: §I · p. 1
  • The proposed blind, verifiable delegated sampling protocol targets QGM inference, while a generalized framework addresses secure training beyond standard DVQA requirements.The paper also reports numerical simulations using Veriphix.Source: §I · p. 1
  • Chung et al.’s blind, verifiable sampling protocol relies on computational assumptions and is more complicated to run on near-term devices.Accreditation protocols, assume an honest device with noise satisfying suitable modelling assumptions, unlike this work’s adversarial-server setting.Source: §I · p. 1

II. BACKGROUND

Delegated quantum computation aims to let a weak client use a more powerful server while preserving properties such as blindness and verifiability. Building on the verifiable DVQA framework, this work adapts delegation to generative-model training and sampling.

II. BACKGROUND

  • Blindness hides inputs, intermediate angles, and outputs from the server, while verifiability checks that a potentially malicious server performed the computation correctly.The DVQA framework inherits blindness from UBQC [15] and uses step-level gradient verification plus convergence guarantees for end-to-end verification.Source: §II · pp. 1–2
  • DVQA step verification bounds corrupted-round effects on gradient estimates and uses interleaved computation and test rounds to detect adversarial behavior.The failure probability decreases exponentially with the number of rounds; appropriate learning rates and error thresholds support geometric convergence and full-algorithm verifiability.Source: §II · p. 2
  • The work extends delegated variational quantum algorithms to QGMs by using output probability distributions for gradient approximation and extending verification to circuit sampling outputs.These adaptations address both training and inference.Source: §II · p. 2

A. Delegated Sampling

The protocol delegates circuit sampling through randomly assigned computation and trap-test rounds, accepting only when the estimated output error is below a chosen threshold. It bounds sampling error from corrupted rounds and uses trap detections to estimate corruption, with failure probability decreasing exponentially in the number of rounds.

A. Delegated Sampling

  • With corrupted-shot fraction γ, the observed distribution is ˆp = (1 −γ)p + γq, where q describes corrupted-shot outcomes.For MMD with a bounded kernel, the absolute loss difference is bounded as a function of the corrupted-shot fraction.Source: A. Delegated Sampling · p. 2
  • TVD obeys TVD(p, ˆp) = γ TVD(p, q) ≤ γ, while KL divergence obeys DKL(p, ˆp) ≤ −log(1 −γ).For MMD, TVD, and KL, the corresponding error bound hL(γ) tends to zero as γ tends to zero.Source: A. Delegated Sampling · pp. 2–3
  • The analysis treats the shot-noise contribution to distance estimates as negligible relative to εth when d is sufficiently large.A complete treatment would absorb the additional finite-shot variance into the bound.Source: A. Delegated Sampling · p. 3
  • Randomly assigned computation and test rounds let the client accept when |L(ˆp, p)| < εth or abort after trap failures.Trap rounds use traps and dummy qubits; computation rounds carry the circuit qubits.Source: A. Delegated Sampling · p. 3
  • The protocol samples within absolute error εth = hL(γmax), with failure probability decreasing exponentially as the number of rounds n grows.Here γmax is the maximum tolerable ratio of corrupted shots.Source: A. Delegated Sampling · p. 3
  • Trap detections provide a confidence interval for the corrupted-computation-round rate, enabling an outcome-quality estimate beyond Accept/Abort.The interval contains the true rate with probability at least 1 − α; blindness spreads attacks across test and computation rounds, with test-round detection probability γ/c.Source: A. Delegated Sampling · p. 3

B. Delegated End-to-End Generative QML

The paper generalizes verifiable delegated optimization to generative models by relaxing DVQAs’ structural requirements and gives examples for QCBM and MBQC-based models. Its approach bounds corruption-induced gradient error and uses trapification to verify delegated gradient steps.

B. Delegated End-to-End Generative QML

  • The framework defines P(L, C, θ) as a gradient-estimation method and applies when its error can be bounded and its evaluations share the same graph.Trapification then bounds the probability of accepting a wrong estimate, while convergence conditions set the error threshold for iterative optimization.Source: B. Delegated End-to-End Generative QML · p. 4
  • The generalized framework requires a corruption-dependent loss-error bound and a shared MBQC graph across all circuit evaluations in a gradient step.These conditions connect corrupted rounds to output quality and allow test and computation rounds to remain indistinguishable; heterogeneous circuits fall outside the shared-trap protocol.Source: B. Delegated End-to-End Generative QML · p. 4
  • For QCBM with MMD loss, training follows DVQAs because the gradient can be expressed as expectation values, while inference uses Protocol 2.The MMD gradient uses the Parameter-Shift Rule with fixed circuit structure.Source: B. Delegated End-to-End Generative QML · p. 4
  • For the MBQC-based model, MMD gradients are estimated directly from samples, requiring a new verifiable step rather than direct end-to-end DVQAs training.The gradient uses shifted loss evaluations; its relative-error bound is hP(γ) = √KNP γ/ϵ0, given ∥g∥2 ≥ ϵ0 > 0.Source: B. Delegated End-to-End Generative QML · p. 4
  • With εth = hP(γmax), trapified gradient estimation yields a verifiable step that supports end-to-end training through Protocol 1.The error threshold is set by the maximum tolerable corrupted-shot ratio.Source: B. Delegated End-to-End Generative QML · p. 4

IV. NUMERICAL SIMULATIONS

The simulations apply verifiable sampling to a 2 × 2 Bars&Stripes instance and examine attacks simulated by per-round dephasing on one output qubit. The reported results show that trap detections track wrong samples and the corruption-rate estimator recovers the attack rate, with lower standard deviation for more test rounds.

IV. NUMERICAL SIMULATIONS

  • The demonstration uses a 2 × 2 Bars&Stripes instance with a 4-qubit IQP Born Machine and models attacks as per-round dephasing on one output qubit.The authors state that the theoretical work is robust to any server-side attack model; this simple noise model serves as a demonstration.Source: §IV · p. 5
  • The estimator c Xt/t recovers the true corruption rate p, and its standard deviation decreases as the number of test rounds grows.The reported experiments use d = 500, t ∈ {100, 500}, and 100 repetitions.Source: Table I · p. 5, §IV · p. 5
  • Trap detections correlate with wrong samples, supporting trap-detection counts as an output-quality estimator during deployment.The simulations also report that trap detection enables aborting inference when wrong bitstrings are sampled.Source: §IV · p. 5

V. CONCLUSION

The paper proposes blind, verifiable delegated sampling and extends DVQAs to generative-model training under information-theoretic security assumptions. Sampling also estimates the corrupted-sample ratio, while the training framework is limited to shared-graph gradient evaluations.

V. CONCLUSION

  • The work proposes blind, verifiable quantum circuit sampling and extends DVQAs to cover generative-model training and inference under information-theoretic security assumptions.Source: §V · pp. 5–6
  • Beyond Accept/Abort, sampling estimates the corrupted-sample ratio without relying on noise-model assumptions, linking verification with application-level benchmarking.Trap-detection rate serves as an operational proxy for output quality even when the target distribution is classically inaccessible.Source: §V · p. 6
  • End-to-end verifiable training requires all circuit evaluations within a gradient step to share an MBQC graph, excluding QGMs with heterogeneous-circuit gradient estimation from this assumption.The authors identify this limitation as a subject for future work.Source: §V · p. 6
Loading 2610.13211v1…