Private training in quantum machine learning

Quantum machine learning models face the same privacy risks as classical ML models when trained on sensitive data, meaning that quantum computing does not inherently solve data privacy concerns—deliberate privacy protections must be built in.

Quantum noise alone cannot replace the calibrated noise required by differential privacy (DP-SGD), a standard privacy-protection technique. The paper demonstrates that relying on natural quantum system noise is insufficient for ensuring formal privacy guarantees, requiring explicit privacy mechanisms instead.

Quantum models may maintain better accuracy than classical models under privacy constraints. When both quantum and classical models operate under the same privacy budget and clipping threshold, quantum models showed potential to retain higher accuracy, suggesting a possible advantage in privacy-utility tradeoffs.

Gradient clipping—a key component of private training—introduces accuracy loss that can be better controlled in quantum models. The researchers found that deterministic bounds on gradient norms in quantum models allow for more explicit control over the "clipping bias" that degrades model performance, potentially mitigating a major cost of privacy protection.

Hybrid quantum-classical systems require classical privacy protections to ensure formal guarantees. Since these systems have classical inputs and outputs, privacy safeguards must be applied at the classical level, meaning quantum advantages in privacy cannot replace the need for rigorous classical privacy engineering.