PaperlayerView exact revision on arXiv

Source-linked AI summary

Unit-Aware Differentially Private Quantum Machine Learning for Clinical and Wearable Health Data

Md Khalid Syfullah, Alvi Ataur Khalil

arXiv:2610.28968v1cs.LGcs.AIcs.NE

TL;DR

Privacy-preserving health prediction must balance useful accuracy with protection for small clinical and wearable cohorts, while the utility of quantum models under DP remains uncertain. The paper benchmarks unit-aware private quantum and classical models and tests gradient-bound and hardware behavior. QNNs lead matched MLPs on clinical cohorts but trail on wearable data, with no model difference significant after Holm correction.

  • Problem

    The paper asks whether quantum models retain more utility than classical baselines under DP, where noise burdens small health cohorts and participant-level wearable protection limits the number of privacy units.

    Source: §I · p. 1

  • Method

    The study applies unit-aware DP-SGD to QNN, capacity-matched MLP, and LR models on three clinical datasets and one wearable dataset, and evaluates gradient bounds, ablations, and hardware inference.

    Source: §I · pp. 1–2, C. Unit-Aware Private Optimization · p. 3

  • Results

    QNN exceeds matched MLP by 0.104, 0.056, and 0.070 average AUC across budgets on clinical datasets, trails by 0.162 on WESAD, and no corrected test is significant.

    Source: G. Discussion and Limitations · p. 5

  • Takeaways & Limitations

    The benchmark supports feasible QNN inference on hardware, with private-checkpoint mean absolute probability error of 0.046 against exact simulation.

    Source: §VI · p. 6

    No corrected test is significant, and LR remains competitive, so the clinical QNN–MLP trend does not establish quantum advantage.

    Source: G. Discussion and Limitations · p. 5

Abstract

from arXiv · show

Clinical registries and wearable sensors support early health-risk assessment, yet models trained on these records may leak sensitive information when released. Differential privacy (DP) bounds this leakage by injecting noise whose total magnitude grows with the number of trainable parameters, a cost especially severe for small health cohorts. This motivates parameter efficient models including quantum machine learning (QML), whose variational circuits can represent complex decision boundaries with few trainable parameters. It raises a question: at matched input dimensionality and privacy budget, does a quantum model retain more utility than a classical one? We investigate this question on three clinical cohorts and one wearable cohort, treating each clinical record or participant as a privacy unit. We compare capacity-matched quantum, multilayer perceptron, and logistic regression models across five privacy budgets and five seeds. The quantum model leads on three clinical cohorts by up to 0.104 ROC AUC averaged across budgets; however, trails on the wearable cohort, where the small number of participants requires substantial noise. No difference survives Holm correction across 24 tests, so these results indicate a trend rather than a quantum advantage. An analytic gradient bound shows that lower clipping thresholds can improve utility by reducing noise despite clipping bias. Finally, an experiment on IBM quantum computer (ibm_fez, a 156-qubit superconducting processor) using eight fixed test cases yields mean absolute probability errors of 0.046 (private) and 0.063 (non-private) relative to simulation, supporting the feasibility of inference on noisy intermediate-scale quantum (NISQ) hardware. Code is publicly available at https://github.com/TITANS-Lab-Artifacts/DP-QML-Health.

I. INTRODUCTION

The introduction frames privacy-preserving health prediction as a trade-off: small cohorts face substantial DP noise, while wearable records require participant-level protection. It proposes testing whether QNNs retain utility against matched classical models and outlines gradient, ablation, and hardware studies.

I. INTRODUCTION

  • Small health cohorts require substantial noise at fixed privacy budgets, while heavy clipping can distort gradients; treating wearable windows separately overstates participant-level protection.The paper therefore protects each wearable participant as one privacy unit, accepting fewer units.Source: §I · p. 1
  • Parameterized quantum circuits may represent complex decision boundaries with relatively few parameters, but their predictive utility under privacy constraints remains unclear.Hardware testing is also needed because gate, readout, and finite-shot errors can separate predictions from ideal simulation.Source: §I · p. 1
  • The study compares QNNs with capacity-matched MLP and LR under unit-aware DP-SGD across three clinical and one wearable dataset, privacy budgets, and random seeds.Clinical records and all windows from one wearable participant are treated as single privacy units; Wilcoxon tests with Holm correction assess differences.Source: §I · p. 1
  • The paper derives a QNN gradient bound to identify a threshold that avoids clipping and tests whether lower thresholds improve performance by reducing DP noise.This examines the trade-off between clipping and noise under DP.Source: §I · p. 1
  • Ablations assess how encoding, parameter count, and circuit depth affect QNN performance under DP and identify dataset-specific settings.The paper also runs selected trained QNNs on ibm_fez and compares predictions with exact statevector simulation.Source: §I · p. 2

II. BACKGROUND

The background introduces quantum neural networks as hybrid models built around parameterized circuits. Their measurements produce predictions, and a classical optimizer updates circuit parameters from training loss.

II. BACKGROUND

  • The section introduces the concepts underlying the work.The supplied background passage does not specify further concepts beyond the quantum neural network description.Source: §II · p. 2

A. Quantum Neural Networks

  • A quantum neural network embeds a parameterized quantum circuit in a hybrid classical-quantum model; measurements map to predictions, and a classical optimizer updates gate parameters from training loss.Deep circuits complicate optimization, and hardware compilation expands them into noisy native operations.Source: A. Quantum Neural Networks · p. 2

B. Differential Privacy

Differential privacy bounds a unit’s influence on released models, so the choice of privacy unit matters especially for wearable data. The literature review identifies a gap in joint privacy, baseline, unit-level, and hardware evaluation.

B. Differential Privacy

  • DP-SGD protects units by clipping each unit’s update contribution, adding calibrated noise, and tracking cumulative privacy loss with a Rényi accountant.The guarantee depends on how the data unit is defined.Source: B. Differential Privacy · p. 2

C. The Choice of Privacy Unit

  • WESAD’s 438 windows are grouped into 15 participant-level privacy units because protecting windows individually can leave participant-specific patterns exposed across other windows.At a fixed privacy budget, participant-level protection requires more noise.Source: C. The Choice of Privacy Unit · p. 2

III. LITERATURE REVIEW

  • Prior QML work has studied DP strategies and clinical tasks, but has not established hardware-validated quantum advantage; a review reports limited hardware validation and insufficient advantage evidence.The cited studies include DP on mostly image, synthetic, or non-clinical benchmarks, as well as clinical quantum models.Source: §III · p. 2
  • The paper identifies a gap in jointly evaluating formal DP with reported expenditure, capacity-matched classical baselines, record- and participant-level health-data protection, and DP-trained hardware inference.Its approach groups results by random seed, corrects multiple comparisons, and compares hardware predictions with statevector simulation.Source: §III · p. 2

IV. METHODOLOGY

The methodology describes the study workflow and its four-component quantum circuit, then defines comparison models with matched input dimensionality. ROC AUC is the primary evaluation metric.

IV. METHODOLOGY

  • The methodology section describes the models, training process, datasets, and evaluation procedure, and notes that Table I summarizes notation.The supplied table passage provides only its notation-summary caption.Source: §IV · p. 2, Table I · p. 3

A. Models Used in This Study

  • The study uses a four-qubit circuit with two trainable layers and eight angles, encoding four input components with RY rotations and ring-connected CNOT gates.Each qubit encodes one transformed feature; each layer applies four trainable RY rotations.Source: A. Models Used in This Study · p. 2
  • Capacity matching uses the same four PCA input components for each model; the MLP has 13 parameters and LR has five.The differentiable LR model provides a linear baseline.Source: A. Models Used in This Study · p. 3
  • ROC AUC is the primary metric, with PR-AUC, accuracy, MSE, and Brier score as additional metrics.The positive-class probability is obtained by rescaling the expectation of Z0.Source: A. Models Used in This Study · p. 3

B. System Overview

The framework combines a six-stage evaluation workflow with unit-aware DP-SGD applied consistently to quantum and classical models. It samples and clips record- or participant-level gradients, then updates parameters using clipped gradients and Gaussian noise.

B. System Overview

  • The workflow covers dataset setup, privacy calibration, private training, paired evaluation, circuit ablations, and quantum hardware inference.Ablations and hardware inference are additional experiments.Source: B. System Overview · p. 3

C. Unit-Aware Private Optimization

  • Clinical losses are computed per record, while WESAD loss averages all windows from one participant.The same unit-aware DP-SGD procedure is applied to QNN, MLP, and LR models.Source: C. Unit-Aware Private Optimization · p. 3
  • Each privacy unit is sampled independently with probability q, and its gradient is clipped so its Euclidean norm does not exceed C.Source: C. Unit-Aware Private Optimization · p. 3
  • The update averages clipped gradients from sampled units with Gaussian noise, whose per-coordinate standard deviation is σC.The noise multiplier σ is selected for the target privacy budget using Rényi accounting; runs use δ = 10^-5, 25 epochs, and an expected batch size capped at 32 units.Source: C. Unit-Aware Private Optimization · p. 3

D. Gradient Sensitivity Certificate

The QNN’s parameter-shift gradient bound provides a clipping threshold that avoids clipping, while lower thresholds trade clipping bias against reduced DP noise.

E. Datasets and Calibration

The study prepares stratified clinical splits and participant-level WESAD splits, then evaluates models across shared seeded splits and privacy budgets.

E. Datasets and Calibration

  • Clinical datasets use stratified 60/20/20 training, calibration, and test splits; WESAD splits 15 participants into nine training, three calibration, and three test participants.WESAD contains 438 one-minute windows in total.Source: E. Datasets and Calibration · p. 3
  • Median imputation and standardization preprocess features, while PCA reduces inputs to four components that are rescaled to [0, π] for circuit encoding.Source: E. Datasets and Calibration · p. 3

F. Evaluation Protocol

  • Four datasets are evaluated over five random seeds using shared splits for paired model comparisons, and results are averaged across five privacy budgets within each seed.WESAD’s seven input features exclude eight-component configurations; three nonprivate QNN runs repeat one configuration as a baseline.Source: F. Evaluation Protocol · p. 3

V. EXPERIMENTAL RESULTS

Across privacy budgets, QNN performance compares favorably with MLP on clinical datasets but not on WESAD, where performance is unstable and often near random. The experiments also compare nonprivate performance and report setup and privacy-budget details.

A. Experimental Setup

  • Reported results are means with sample standard deviations, and actual privacy budgets differ from targets by at most 0.0082.Source: A. Experimental Setup · p. 4

B. Predictive Performance Across Privacy Budgets

  • At C = 1, QNN retains more performance than MLP on clinical datasets, but LR leads on two; WESAD reverses the QNN–MLP pattern, with MLP at 0.568 average AUC versus QNN at 0.406.At ε = 1, WESAD’s noise multiplier is 20.31, versus 5.39 on Pima and 8.44 on the heart datasets; performance is unstable and often near random.Source: Figure 4 · p. 4, B. Predictive Performance Across… · p. 4
  • At C = 1 without DP, QNN and MLP differ by less than 0.010 AUC on the three clinical datasets, while QNN leads by 0.112 AUC on WESAD with less seed variation.Source: B. Predictive Performance Across… · p. 4

C. Statistical Evidence for Model Differences

The QNN leads the MLP across clinical privacy-budget points but trails on most WESAD points, without corrected significance. Clipping-threshold utility varies by dataset, with a noise cost for avoiding clipping.

C. Statistical Evidence for Model Differences

D. Effect of the Clipping Threshold

  • 0.672 is Heart Failure’s highest average AUC across budgets at C=8; Pima instead reaches 0.758 at C=0.5 versus 0.707 at C=8, while WESAD reaches 0.505 at C=8.The threshold sensitivity is shown in Fig. 5.Source: Figure 5 · p. 5, D. Effect of the Clipping Threshold · p. 5
  • 5.66-fold higher noise scale accompanies increasing C from 0.5 to 8 at fixed σ; calibration gradients were measured on public data, not during private training.At C=0.5, the clipped fraction reaches 0.174 on Pima and 0.131 on Heart Failure.Source: D. Effect of the Clipping Threshold · p. 5

E. Effect of Circuit Design

Circuit design choices affect private QNN performance, with preferred settings differing between clinical datasets and WESAD.

E. Effect of Circuit Design

F. Prediction Agreement on IBM Quantum Hardware

Hardware predictions closely match exact simulation on eight selected cases. The paper treats this as evidence of feasible hardware inference, not quantum advantage, and notes limits in cohort size and hardware-evaluation scope.

F. Prediction Agreement on IBM Quantum Hardware

  • 0.046 private and 0.063 nonprivate mean absolute probability errors measure hardware predictions against exact statevector inference.Both checkpoints were tested on eight cases in one ibm_fez job.Source: F. Prediction Agreement on IBM Quantum… · p. 5

G. Discussion and Limitations

  • The wearable cohort is small, and hardware agreement was assessed on only one dataset and eight cases, leaving other settings untested.The authors call for a larger wearable dataset to assess real performance.Source: Figure 7 · p. 6

VI. CONCLUSION

  • Clinical QNN gains do not establish quantum advantage: no model difference survived Holm correction, and logistic regression remained competitive.The QNN exceeded the matched MLP by 0.104, 0.056, and 0.070 average AUC across budgets on clinical datasets, but trailed by 0.162 on WESAD.Source: G. Discussion and Limitations · p. 5, §VI · p. 6
  • Future work should evaluate larger cohorts under preregistered analyses and repeat hardware tests across devices and sessions with physical-qubit layouts recorded.The conclusion also calls for alternative private training mechanisms and tighter sensitivity bounds.Source: §VI · p. 6

Related papers

Loading 2610.28968v1…