# Prospects of Privacy Advantage in Quantum Machine Learning

arXiv: https://arxiv.org/abs/2405.08801 · HTML: https://mlsanity.com/paper/2405.08801/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 30 of its 58 references that are in the map.
- First posted on arXiv 14 May 2024.

## Builds on (most cited first, 30 of 30)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Fourier Features Let Networks Learn High Frequency Functions in Low Dimensional Domains](https://mlsanity.com/paper/2006.10739/) (2020)
- [Deep Leakage from Gradients](https://mlsanity.com/paper/1906.08935/) (2019)
- [Inverting Gradients -- How easy is it to break privacy in federated learning?](https://mlsanity.com/paper/2003.14053/) (2020)
- [Barren plateaus in quantum neural network training landscapes](https://mlsanity.com/paper/1803.11173/) (2018)
- [iDLG: Improved Deep Leakage from Gradients](https://mlsanity.com/paper/2001.02610/) (2020)
- [The effect of data encoding on the expressive power of variational quantum machine learning models](https://mlsanity.com/paper/2008.08605/) (2020)
- [See through Gradients: Image Batch Recovery via GradInversion](https://mlsanity.com/paper/2104.07586/) (2021)
- [How to Escape Saddle Points Efficiently](https://mlsanity.com/paper/1703.00887/) (2017)
- [Evaluating Gradient Inversion Attacks and Defenses in Federated Learning](https://mlsanity.com/paper/2112.00059/) (2021)
- [Barren Plateaus in Variational Quantum Computing](https://mlsanity.com/paper/2405.00781/) (2024)
- [Theory of overparametrization in quantum neural networks](https://mlsanity.com/paper/2109.11676/) (2021)
- [Federated Quantum Machine Learning](https://mlsanity.com/paper/2103.12010/) (2021)
- [Does provable absence of barren plateaus imply classical simulability?](https://mlsanity.com/paper/2312.09121/) (2023)
- [Quantum Federated Learning with Quantum Data](https://mlsanity.com/paper/2106.00005/) (2021)
- [Quantum federated learning through blind quantum computing](https://mlsanity.com/paper/2103.08403/) (2021)
- [Representation Theory for Geometric Quantum Machine Learning](https://mlsanity.com/paper/2210.07980/) (2022)
- [Classical surrogates for quantum learning models](https://mlsanity.com/paper/2206.11740/) (2022)
- [Potential and limitations of random Fourier features for dequantizing quantum machine learning](https://mlsanity.com/paper/2309.11647/) (2023)
- [Efficient and Secure Federated Learning for Financial Applications](https://mlsanity.com/paper/2303.08355/) (2023)
- [Hybrid quantum image classification and federated learning for hepatic steatosis diagnosis](https://mlsanity.com/paper/2311.02402/) (2023)
- [Privacy-preserving quantum federated learning via gradient hiding](https://mlsanity.com/paper/2312.04447/) (2023)
- [Optimizing Quantum Federated Learning Based on Federated Quantum Natural Gradient Descent](https://mlsanity.com/paper/2303.08116/) (2023)
- [Transparency and Privacy: The Role of Explainable AI and Federated Learning in Financial Fraud Detection](https://mlsanity.com/paper/2312.13334/) (2023)
- [Experimental Design for Overparameterized Learning with Application to Single Shot Deep Active Learning](https://mlsanity.com/paper/2009.12820/) (2020)
- [Expressive variational quantum circuits provide inherent privacy in federated learning](https://mlsanity.com/paper/2309.13002/) (2023)
- [Blind quantum machine learning with quantum bipartite correlator](https://mlsanity.com/paper/2310.12893/) (2023)
- [Enhancing Privacy against Inversion Attacks in Federated Learning by using Mixing Gradients Strategies](https://mlsanity.com/paper/2204.12495/) (2022)
- [Decentralized Quantum Federated Learning for Metaverse: Analysis, Design and Implementation](https://mlsanity.com/paper/2306.11297/) (2023)
- [FedGeo: Privacy-Preserving User Next Location Prediction with Federated Learning](https://mlsanity.com/paper/2312.04594/) (2023)

## Built on by (most cited first, 3 of 3)

- [A Numerical Gradient Inversion Attack in Variational Quantum Neural-Networks](https://mlsanity.com/paper/2504.12806/) (2025)
- [Adversarial Robustness in Distributed Quantum Machine Learning](https://mlsanity.com/paper/2508.11848/) (2025)
- [Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security](https://mlsanity.com/paper/2507.08623/) (2025)

## Abstract (arXiv)

Ensuring data privacy in machine learning models is critical, particularly in distributed settings where model gradients are typically shared among multiple parties to allow collaborative learning. Motivated by the increasing success of recovering input data from the gradients of classical models, this study addresses a central question: How hard is it to recover the input data from the gradients of quantum machine learning models? Focusing on variational quantum circuits (VQC) as learning models, we uncover the crucial role played by the dynamical Lie algebra (DLA) of the VQC ansatz in determining privacy vulnerabilities. While the DLA has previously been linked to the classical simulatability and trainability of VQC models, this work, for the first time, establishes its connection to the privacy of VQC models. In particular, we show that properties conducive to the trainability of VQCs, such as a polynomial-sized DLA, also facilitate the extraction of detailed snapshots of the input. We term this a weak privacy breach, as the snapshots enable training VQC models for distinct learning tasks without direct access to the original input. Further, we investigate the conditions for a strong privacy breach where the original input data can be recovered from these snapshots by classical or quantum-assisted polynomial time methods. We establish conditions on the encoding map such as classical simulatability, overlap with DLA basis, and its Fourier frequency characteristics that enable such a privacy breach of VQC models. Our findings thus play a crucial role in detailing the prospects of quantum privacy advantage by guiding the requirements for designing quantum machine learning models that balance trainability with robust privacy protection.