# Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access

arXiv: https://arxiv.org/abs/2609.05702 · HTML: https://mlsanity.com/paper/2609.05702/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 25 of its 56 references that are in the map.
- First posted on arXiv 4 Sep 2026.

## Builds on (most cited first, 25 of 25)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Machine Unlearning](https://mlsanity.com/paper/1912.03817/) (2019)
- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [Variational Quantum Algorithms](https://mlsanity.com/paper/2012.09265/) (2020)
- [Supervised learning with quantum enhanced feature spaces](https://mlsanity.com/paper/1804.11326/) (2018)
- [Parameterized quantum circuits as machine learning models](https://mlsanity.com/paper/1906.07682/) (2019)
- [A Survey of Machine Unlearning](https://mlsanity.com/paper/2209.02299/) (2022)
- [Challenges and Opportunities in Quantum Machine Learning](https://mlsanity.com/paper/2303.09491/) (2023)
- [The Privacy Onion Effect: Memorization is Relative](https://mlsanity.com/paper/2206.10469/) (2022)
- [Transfer learning in hybrid classical-quantum neural networks](https://mlsanity.com/paper/1912.08278/) (2019)
- [Quantum noise protects quantum classifiers against adversaries](https://mlsanity.com/paper/2003.09416/) (2020)
- [Quantum machine learning with differential privacy](https://mlsanity.com/paper/2103.06232/) (2021)
- [Benchmarking Adversarially Robust Quantum Machine Learning at Scale](https://mlsanity.com/paper/2211.12681/) (2022)
- [Quantum Differentially Private Sparse Regression Learning](https://mlsanity.com/paper/2007.11921/) (2020)
- [Distributional property testing in a quantum world](https://mlsanity.com/paper/1902.00814/) (2019)
- [IBM Quantum Computers: Evolution, Performance, and Future Directions](https://mlsanity.com/paper/2410.00916/) (2024)
- [Distributed Quantum Computing: a Survey](https://mlsanity.com/paper/2212.10609/) (2022)
- [Expressive variational quantum circuits provide inherent privacy in federated learning](https://mlsanity.com/paper/2309.13002/) (2023)
- [QuantumLeak: Stealing Quantum Neural Networks from Cloud-based NISQ Machines](https://mlsanity.com/paper/2403.10790/) (2024)
- [Evaluating Efficacy of Model Stealing Attacks and Defenses on Quantum Neural Networks](https://mlsanity.com/paper/2402.11687/) (2024)
- [Quantum Machine Unlearning: Foundations, Mechanisms, and Taxonomy](https://mlsanity.com/paper/2511.00406/) (2025)
- [Harnessing Inherent Noises for Privacy Preservation in Quantum Machine Learning](https://mlsanity.com/paper/2312.11126/) (2023)
- [SoK: Critical Evaluation of Quantum Machine Learning for Adversarial Robustness](https://mlsanity.com/paper/2511.14989/) (2025)
- [Machine Unlearning in the Era of Quantum Machine Learning: An Empirical Study](https://mlsanity.com/paper/2512.19253/) (2025)

## Abstract (arXiv)

Quantum Machine Learning (QML) has shown rapid advances by utilizing quantum computing for machine learning tasks. Meanwhile, the privacy risks accompanying QML is also starting to be studied, which inherit privacy leakage channels from "classical" ML and also quantum-unique risks. Existing work on privacy-preserving QML largely focuses on a QML-as-a-service scenario, which generally assumes that the QML model owner provides only classical bit outputs to queries, while users (and adversaries) have only classical computing abilities. However, this view is increasingly challenged in a quantum-native world of quantum-capable users/adversaries, which may have access to both quantum computing abilities and access to quantum information output from service providers. In this paper, we aim to bridge this gap by examining membership inference attacks against QML models by demonstrating that increasing quantum access and quantum computing abilities provides provable theoretical privacy leakage and empirical adversarial gain. However, the probabilistic nature of QML introduces a gap between theoretical and empirical adversarial advantage. These results show that existing research on privacy leakage in QML models underestimates privacy leakage in emergent quantum-native access regimes, and we hope to establish a first step in examining potential privacy leakages for QML in the quantum-native world.