PaperlayerView exact revision on arXiv

Source-linked AI summary

Federated Unlearning of Quantum Data via Classical Shadows

Zihao Ding, Jun Huang, Cong-cong Xing

arXiv:2610.19077v1quant-phcs.DCcs.NI

TL;DR

Quantum federated unlearning must address quantum states that cannot be replayed, while stored updates can remove whole nodes but not subsets of their data. SHADE records classical shadows during training and uses them for a federated Newton correction; with 50 nodes, it matches retraining’s forget accuracy within 0.5 points and corrects the model in under 0.2 s.

  • Problem

    Quantum-model unlearning methods remeasure forget states, while federated unlearning from stored updates removes whole nodes, but quantum states are consumed when measured and cannot be cloned.

    Source: §I · p. 1

  • Method

    SHADE records classical shadows of training states and uses them to estimate forget-data gradients and retained-data curvature for a federated Newton correction without preparing states again.

    Source: §I · p. 1, C. Federated Newton Correction and… · p. 4

  • Results

    With 50 nodes, SHADE matches retraining’s forget accuracy within 0.5 points and corrects the model in under 0.2 s, without replaying states.

    Source: §I · p. 2

  • Takeaways & Limitations

    The shadow snapshots needed for a target unlearning error grow exponentially with backward-light-cone size, not total qubit count.

    Source: §I · p. 1

Abstract

from arXiv · show

Quantum federated learning trains a quantum neural network (QNN) across nodes that hold quantum data, such as the states of quantum sensors. To forget data, unlearning methods for quantum models replay them, and federated unlearning from stored updates removes whole nodes only. Quantum data cannot be replayed, since a state is consumed when measured and cannot be cloned. We propose Shadow-based Data Erasure (SHADE), in which each node records a classical shadow of every training state, a few randomized single-qubit measurements taken at training time. The gradient and curvature of a QNN on a state are expectations of observables, so SHADE estimates them for the forget data from the shadows at any later parameters and removes their effect by a federated Newton correction. Only classical estimates cross the network. We prove that the shadow size needed for a target unlearning error grows exponentially in the size of the backward light cone of the measured observable and not in the number of qubits. In simulation with 50 nodes and on edge boards, SHADE matches the forget accuracy of retraining within 0.5 points, without replay and in under 0.2 s.

I. INTRODUCTION

Quantum unlearning must handle states that cannot be replayed, while stored federated updates cannot isolate subsets of a node’s data. SHADE records classical shadows during training and uses them to estimate forget-data derivatives for a later federated Newton correction.

I. INTRODUCTION

  • Quantum states are consumed by measurement and cannot be cloned, so prior quantum-model unlearning methods that remeasure forget data cannot be used when those states are unavailable,,.Stored-update federated unlearning removes whole nodes, not a time window or subset of samples,.Source: §I · p. 1
  • Classical shadows let nodes estimate forget-data gradients and curvature at later parameters because QNN derivatives are expectation values linear in the state.For local measurements, shallow-circuit observables act only on the measured qubits’ backward light cone, so record size depends on that cone rather than total qubit count.Source: §I · p. 1
  • SHADE records light-cone shadows during training, estimates forget-data gradients and retained-data curvature at the current model, then applies one federated Newton correction.It erases forget-data snapshots afterward; only classical estimates cross the network and no state is prepared again.Source: §I · p. 1
  • The paper formulates forgetting as choosing per-state recorded copies to meet an error target and proves unbiased estimates at any parameters with snapshot needs exponential in light-cone size, not qubit count.It also bounds the parameter distance between the corrected and retrained models.Source: §I · p. 1
  • With 50 nodes, SHADE matches retraining’s forget accuracy within 0.5 points and corrects the model in under 0.2 s, without replaying states.The reported result covers simulation and edge boards.Source: §I · p. 2

II. SYSTEM MODEL AND PROBLEM FORMULATION

The system has a server and quantum nodes that train a shared parameterized circuit using classical links. Each node holds labeled sensor states, spends finite copies on training, and uploads classical gradient estimates for server updates.

A. System Model

  • Each of K nodes holds labeled quantum states produced by its sensor, and the finite copies of each state are split between training and a classical record.The server holds no quantum state; nodes upload P classical numbers per training round.Source: A. System Model · p. 2
  • The shared QNN is an n-qubit circuit U(θ) with P parameters, each setting a Pauli-generated rotation angle.Its output is the expectation of an observable O acting on a few qubits with norm at most 1.Source: A. System Model · p. 2
  • For a selected dataset D′, the paper defines an objective using the loss ℓ and regularization weight μ.Each local objective sums losses over its node’s data with a μ/(2K)‖θ‖² term, and the local objectives sum to the global objective.Source: A. System Model · p. 2
  • Each node estimates its local gradient at the server-broadcast parameters using parameter-shift measurements on fresh copies of its states.The parameter-shift rule evaluates the circuit at θ shifted by ±π/2 along a parameter coordinate.Source: A. System Model · p. 2
  • The server updates the shared parameters using the uploaded gradient estimates and step size η.It receives only classical uploads and holds no quantum state.Source: A. System Model · p. 2
  • Training spends 2P shifted circuits on each state used in a round, so a state’s total training-copy use grows with the number of rounds in which it is used.Source: A. System Model · p. 2

B. Problem Formulation

A deletion request may target a node, a time window, or selected samples, but retraining and remeasurement are unavailable once the finite quantum copies are consumed. The formulation therefore seeks a sufficiently small classical record made before the request is known.

B. Problem Formulation

  • Deletion may target a whole node, a time window, or any subset of samples, and the server must respond before its next update spreads the old model further.The target is the model that minimizing the retained-data objective would have produced without the forget data.Source: B. Problem Formulation · p. 2
  • Training uploads cannot support window or sample deletion because each node’s upload mixes forget and retained states, so subtracting it removes the whole node.Source: B. Problem Formulation · p. 2
  • Since the forget set is unknown during training, every state must be recorded in advance, and the record size is chosen to meet an unlearning-error target εu with failure probability δ.The record also determines how many copies are diverted from training and the storage per node.Source: B. Problem Formulation · p. 2
  • The backward light cone is the set of qubits whose gates reach the measured observable’s support in the layered QNN.Source: Figure 2 · p. 3
  • The parameter-shift rule bounds each output derivative by ‖O‖≤1, and the stated bound applies to forgotten and retained states.Source: B. Problem Formulation · p. 3

III. SHADE: SHADOW-BASED DATA ERASURE

SHADE records shadows at each node during training, then uses them to estimate quantities needed for data removal at later parameters. It stores snapshots only on the measured observable’s backward light cone, with readout calibration required for unbiased estimates when errors are state-independent.

III. SHADE: SHADOW-BASED DATA ERASURE

  • SHADE uses node-held shadows to estimate forget-data gradients and retained-data curvature at the current model, then applies one server-side Newton correction without preparing states again.The nodes erase forget-data snapshots after the request.Source: §III · p. 3

A. Shadow Recording on the Light Cone

  • A classical shadow estimates an observable’s expectation from measurement records, including for an observable chosen after the measurements.The snapshot is unbiased over random rotations and measurement outcomes.Source: A. Shadow Recording on the Light Cone · p. 3
  • Only qubits in the observable’s backward light cone are stored: 3|Λ|S bits per state, or 4.5 kB when |Λ| = 6 and S = 2000.The snapshots remain at the node and are not uploaded.Source: A. Shadow Recording on the Light Cone · p. 3
  • Parameter-shift records apply only to their recorded parameters, whereas shadow records support later-chosen observables.Fig. 3 contrasts these records.Source: Figure 3 · p. 3, §III · p. 3
  • Readout calibration preserves unbiased estimates only when readout errors are state-independent, and the resulting variance increase requires proportionally more snapshots.The variance increase is bounded by the inverse square of the product of shrinkage factors over Λ.Source: A. Shadow Recording on the Light Cone · p. 3

B. Estimation from Shadows

SHADE estimates a state’s output, gradient, and Hessian at the current model from its snapshots. It forms loss derivatives from those estimates and uploads node-level quantities for the server’s correction.

B. Estimation from Shadows

  • Parameter shifts change angles but not gate layout, so the derivative operators still act only on the backward light cone.This keeps the operator evaluations confined to Λ.Source: B. Estimation from Shadows · p. 3
  • At the current model, median-of-means estimates from snapshots provide each state’s output, gradient, and Hessian.The loss gradient and Hessian are formed using the first and second derivatives of the loss with respect to the estimated output.Source: B. Estimation from Shadows · p. 3
  • Each node uploads P gradient values and P(P + 1)/2 curvature values, while snapshot contractions take classical time exponential in |Λ| and require no quantum hardware.For P = 24 and S = 2000, a state requires about 1.25 × 10^6 contractions on six qubits.Source: B. Estimation from Shadows · p. 3

C. Federated Newton Correction and Erasure

The server uses aggregated estimates for a Newton step on the retained-data objective, then broadcasts the corrected model. Nodes erase forget-data snapshots, which otherwise could be used to learn those data again.

C. Federated Newton Correction and Erasure

  • One Newton step on the retained-data objective uses its curvature to undo the forget data’s gradient pull at the current model.The server sums node uploads, symmetrizes the retained Hessian estimate, and raises eigenvalues below µ to µ.Source: C. Federated Newton Correction and… · p. 4
  • After broadcasting the corrected model, nodes erase forget-data snapshots because shadows can still serve to learn those data again.Training resumes on new states.Source: C. Federated Newton Correction and… · p. 4
  • SHADE serves requests arriving in the same round together; later requests use fresh snapshot groups because earlier corrections break the required independence.Each state’s record is split into equal groups, one per request.Source: C. Federated Newton Correction and… · p. 4
  • The correction costs one upload round and one P × P solve, and uses no copy of any state..Source: C. Federated Newton Correction and… · p. 4

IV. THEORETICAL ANALYSIS

The analysis establishes unbiased shadow estimates for QNN outputs and derivatives, with a snapshot requirement independent of total qubit count. It also bounds the corrected model’s distance from retraining and identifies the error and locality conditions that govern the correction.

IV. THEORETICAL ANALYSIS

  • Theorem 1 gives estimates of outputs and first and second derivatives within ε across the dataset, with a snapshot requirement that does not depend on n.The observables act only on the backward light cone Λ.Source: §IV · p. 4
  • Each brickwork layer adds at most two qubits to Λ and multiplies the required snapshot count by at most 16.The record therefore scales with circuit depth through the light cone, rather than with circuit width.Source: §IV · p. 4
  • Under strong convexity and a Lipschitz-Hessian condition, Proposition 2 bounds corrected-to-retrained parameter distance using Newton-step error and gradient and curvature estimation errors.The exact Newton step on the retained-data loss is one component of the bound.Source: §IV · p. 4
  • For squared loss and ε ≤ 1, εg ≤ 4P|Df|ε and εH ≤ 7P|Dr|ε.These bounds translate the output-estimation event into gradient and Hessian error bounds.Source: §IV · p. 4
  • The Newton-step error does not shrink with S, while the estimation terms are linear in ε; a negative unlearning gap requires further training on new states.Increasing the snapshot count reduces estimation error but does not remove the one-step Newton error.Source: §IV · p. 4

A. Experimental Setup

The evaluation uses a 50-node PennyLane simulation and an edge-board testbed under device noise, with spin-chain data and several request types. It compares forgetting, utility, privacy, and resource costs across SHADE and baseline methods.

A. Experimental Setup

  • The simulation uses K = 50 nodes and n = 8 qubits, with spin-chain states and a QNN trained for 60 rounds.Each node holds eight states of one coupling range; the reported setup uses 20 shots per shifted circuit.Source: A. Experimental Setup · pp. 4–5
  • The edge-board testbed has three Jetson AGX Thor and two Jetson AGX Orin nodes, connected to a desktop server over Wi-Fi and run under IBM Fez device noise.Each board simulates its node’s states, training shots, and snapshots in Qiskit Aer.Source: A. Experimental Setup · pp. 5–6, Figure 5 · p. 5
  • Evaluation covers forget, retained, and held-out accuracy, distances to Retrain, membership-inference success, and post-request resource costs across deletion types and baselines.FedRecovery removes whole nodes; QMU, SCRUB, and CR receive fresh forget-state copies, while Retrain uses fresh retained-state copies.Source: A. Experimental Setup · pp. 5–6, Table I · p. 5

B. Experimental Results

SHADE matches Retrain closely across request types while avoiding replay and reducing correction time; its distance also improves with more snapshots for granular deletions.

B. Experimental Results

  • SHADE keeps forget accuracy within 0.5 points of Retrain across request types and corrects in under 0.2 s, versus 3226 s for CR.Its distance to Retrain is second only to CR, which uses exact derivatives from fresh copies.Source: B. Experimental Results · p. 6
  • For window and sample deletion, FedRecovery’s distance is at least seven times SHADE’s; QMU, SCRUB, and CR leave sample-deletion forget accuracy near 52%, versus 29.6% for Retrain.Attack success stays near 50% for every method; SHADE’s uplink equals CR’s, with a classical record of 72 kB per state at each node.Source: B. Experimental Results · p. 6
  • As S grows, distance under window and sample deletion falls six- to sevenfold, while node-deletion distance stays near 10^-2.Snapshot needs are of the same order at n = 8 and n = 12.Source: B. Experimental Results · p. 6
  • Test accuracy stays above 95.7% for recorded shares up to 90%, while node and window deletion need at most 4.9 × 10^3 snapshots up to 20 qubits.As the forget set grows, SHADE’s distance stays within about twice CR’s; uplink grows by 1.23 kB per node, and correction takes about 0.2 s at any node count versus up to 6452 s for CR.Source: B. Experimental Results · p. 6

VI. CONCLUSION

SHADE records classical shadows on measured-observable light cones during training, then estimates a federated Newton correction to remove unmeasurable quantum data without preparing states again.

VI. CONCLUSION

  • With 50 nodes, SHADE matches retraining in forget accuracy within 0.5 points and corrects the model in under 0.2 s in simulation and on edge boards.The method records classical shadows on the measured-observable light cone during training and uses them for a federated Newton correction, without preparing a state again.Source: §VI · p. 6
Loading 2610.19077v1…