pith. sign in

arxiv: 2509.06086 · v3 · submitted 2025-09-07 · 🪐 quant-ph

From Membership-Privacy Leakage to Quantum Machine Unlearning

Junjian Su , Runze He , Guanghui Li , Sujuan Qin , Zhimin He , Haozhen Situ , Fei Gao This is my paper

Pith reviewed 2026-05-18 18:03 UTC · model grok-4.3

classification 🪐 quant-ph
keywords quantum machine learningmembership inference attackmachine unlearningquantum neural networksprivacy leakagequantum machine unlearningmembership privacy
0
0 comments X

The pith

Quantum neural networks leak membership information about their training data, and quantum machine unlearning can remove that influence while preserving accuracy on retained data.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper examines whether quantum machine learning models suffer from membership-privacy leakage, where attackers can tell if particular data points were part of the training set. It designs a membership inference attack suited to quantum neural network outputs and finds clear evidence of such leakage in both basic and hybrid QNN architectures. To counter this, the authors develop a quantum machine unlearning approach with three different mechanisms that erase the effect of withdrawn data. Tests in noiseless simulations and on actual cloud quantum devices show these mechanisms work without harming performance on data that should stay.

Core claim

Quantum neural networks exhibit membership-privacy leakage under a gray-box threat model, and the proposed quantum machine unlearning framework successfully mitigates this leakage by removing the influence of specific withdrawn data points while preserving model accuracy on retained data.

What carries the argument

The gray-box membership inference attack tailored to QNN outputs together with the quantum machine unlearning (QMU) framework and its three unlearning mechanisms.

If this is right

  • QML models require privacy protections comparable to those developed for classical machine learning.
  • Quantum machine unlearning supplies concrete mechanisms to honor data-withdrawal requests in quantum settings.
  • The three mechanisms differ in data dependence, computational cost, and robustness to different attack scenarios.
  • The approach remains effective when moving from noiseless simulation to execution on cloud quantum hardware.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Widespread use of QML may require unlearning to become a standard step before deployment on shared hardware.
  • Similar leakage could appear in other QML architectures that rely on variational quantum circuits.
  • Testing the same attack and unlearning pipeline on noisy intermediate-scale quantum devices would reveal how decoherence interacts with membership signals.

Load-bearing premise

The gray-box threat model accurately reflects what realistic attackers can access when targeting quantum neural network outputs.

What would settle it

An experiment in which the tailored membership inference attack fails to distinguish training from non-training data, or in which any of the three QMU mechanisms either fails to reduce leakage or reduces accuracy on retained data.

Figures

Figures reproduced from arXiv: 2509.06086 by Fei Gao, Guanghui Li, Haozhen Situ, Junjian Su, Runze He, Sujuan Qin, Zhimin He.

Figure 1
Figure 1. Figure 1: Membership Inference Attack Workflow on QML Models. (Stage 1) the initial [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Architecture and data flow of the QNN model. The model consists of a quantum [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Attack and Unlearning Workflow for QML. (1) Training: the original QML [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Performance Comparison of QMU. This figure presents the performance com [PITH_FULL_IMAGE:figures/full_fig_p019_4.png] view at source ↗
read the original abstract

Quantum machine learning (QML) has the potential to achieve quantum advantage for specific tasks by combining quantum computation with classical machine learning (ML). In classical ML, a significant challenge is membership-privacy leakage, whereby an attacker can infer from model outputs whether specific data were used in training. When specific data are required to be withdrawn, removing their influence from the trained model becomes necessary. Machine unlearning (MU) addresses this issue by enabling the model to forget the withdrawn data, thereby preventing membership-privacy leakage. However, this leakage remains underexplored in QML. This raises two research questions: do QML models leak membership privacy about their training data, and can MU methods efficiently mitigate such leakage in QML models? We investigate these questions using two quantum neural network (QNN) architectures, a basic QNN and a hybrid QNN, evaluated in noiseless simulations and cloud quantum device demonstrations. To answer the first question, we analyze how quantum constraints shape membership-privacy leakage in QML and then formalize a realistic gray-box threat model accordingly. Based on this, we design a membership inference attack (MIA) tailored to QNN outputs, and our results provide clear evidence of membership leakage in both QNNs. To answer the second question, we propose a quantum machine unlearning (QMU) framework, comprising three MU mechanisms. Evaluations on two QNN architectures show that QMU removes the influence of the withdrawn data while preserving accuracy for retained data. A comparative analysis further characterizes the three MU mechanisms with respect to data dependence, computational cost, and robustness.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The manuscript examines membership-privacy leakage in quantum neural networks (QNNs) by formalizing a gray-box threat model and designing a tailored membership inference attack (MIA). It reports evidence of leakage from evaluations on basic and hybrid QNN architectures in both noiseless simulations and cloud quantum device demonstrations. The work then proposes a quantum machine unlearning (QMU) framework consisting of three mechanisms and shows that these remove the influence of withdrawn data while preserving accuracy on retained data.

Significance. If the empirical results hold under realistic constraints, the paper would make a meaningful contribution by extending classical membership-privacy concerns to QML and by providing concrete unlearning methods suitable for quantum models. The combination of simulation and cloud-device experiments is a positive feature, as is the comparative analysis of the three QMU mechanisms along axes of data dependence, cost, and robustness.

major comments (2)
  1. [Abstract] Abstract: the claim that 'our results provide clear evidence of membership leakage in both QNNs' and that 'QMU removes the influence of the withdrawn data while preserving accuracy' is presented without any quantitative metrics (attack success rates, accuracy deltas, confidence intervals, or statistical tests). This absence prevents assessment of whether the reported outcomes actually support the central claims.
  2. [Threat Model and Experimental Setup] Threat-model section (and cloud-device experiments): the gray-box model grants the attacker knowledge of circuit structure, trainable parameters, and exact output distributions. Real cloud quantum hardware, however, introduces shot noise and finite-shot sampling; the manuscript does not show that the observed MIA advantage or the subsequent QMU effectiveness survive under these stricter, more realistic constraints. This assumption is load-bearing for both the leakage evidence and the unlearning claims.
minor comments (2)
  1. [Abstract] Abstract: consider inserting one or two concrete numerical results (e.g., 'MIA AUC of 0.XX before and 0.YY after QMU') or explicit references to the relevant figures/tables so readers can immediately gauge effect sizes.
  2. [Notation and Definitions] Notation: ensure consistent use of symbols for expectation values versus probability distributions across the threat-model and attack sections; minor inconsistencies can confuse readers unfamiliar with QNN output conventions.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their constructive and detailed feedback. We address each major comment point by point below, indicating where revisions will be made to improve clarity and rigor.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the claim that 'our results provide clear evidence of membership leakage in both QNNs' and that 'QMU removes the influence of the withdrawn data while preserving accuracy' is presented without any quantitative metrics (attack success rates, accuracy deltas, confidence intervals, or statistical tests). This absence prevents assessment of whether the reported outcomes actually support the central claims.

    Authors: We agree that the abstract would benefit from explicit quantitative support for the central claims. In the revised manuscript we will incorporate specific metrics, including the membership inference attack success rates achieved on the basic and hybrid QNNs, the accuracy retention figures after each QMU mechanism, and any available confidence intervals or statistical test results from the simulation and cloud-device evaluations. revision: yes

  2. Referee: [Threat Model and Experimental Setup] Threat-model section (and cloud-device experiments): the gray-box model grants the attacker knowledge of circuit structure, trainable parameters, and exact output distributions. Real cloud quantum hardware, however, introduces shot noise and finite-shot sampling; the manuscript does not show that the observed MIA advantage or the subsequent QMU effectiveness survive under these stricter, more realistic constraints. This assumption is load-bearing for both the leakage evidence and the unlearning claims.

    Authors: We thank the referee for underscoring the importance of finite-shot realism. The cloud-device experiments reported in the manuscript were executed on actual quantum hardware with a finite number of shots per circuit evaluation, so the output distributions used for both the MIA and the subsequent QMU evaluations already reflect shot noise and sampling. To make this explicit and to quantify robustness, we will add a dedicated paragraph in the experimental-setup section that states the shot counts employed, reports MIA performance as a function of shot number, and includes a brief sensitivity analysis of QMU effectiveness under reduced shot budgets. These additions will directly address whether the observed advantages persist under the stricter constraints. revision: partial

Circularity Check

0 steps flagged

Empirical evaluation of MIA and QMU in QNNs is self-contained with no circular reductions

full rationale

The paper is structured as an empirical study: it analyzes quantum constraints to formalize a gray-box threat model, designs an MIA based on QNN outputs, evaluates leakage on two architectures in simulation and cloud hardware, then proposes and tests three QMU mechanisms for their ability to reduce leakage while preserving accuracy. All reported outcomes (attack success rates, accuracy retention, comparative metrics) derive from direct experimental measurements rather than from any equation that reduces a prediction to a fitted parameter or self-referential definition. No load-bearing claim relies on a self-citation chain, uniqueness theorem imported from prior author work, or ansatz smuggled via citation. The work therefore remains self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract provides no explicit free parameters, axioms, or invented entities; the work appears to rely on standard quantum circuit assumptions and classical unlearning concepts without introducing new postulates.

pith-pipeline@v0.9.0 · 5833 in / 1053 out tokens · 32881 ms · 2026-05-18T18:03:59.458583+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

What do these tags mean?
matches
The paper's claim is directly supported by a theorem in the formal canon.
supports
The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends
The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses
The paper appears to rely on the theorem as machinery.
contradicts
The paper's claim conflicts with a theorem or certificate in the canon.
unclear
Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

53 extracted references · 53 canonical work pages · 3 internal anchors

  1. [1]

    John Preskill,Quantum computing in the NISQ era and beyond, Quan- tum, 2018, 2: 79. 24

    work page 2018

  2. [2]

    Frank Arute, Kunal Arya, Ryan Babbush, et al.,Quantum supremacy using a programmable superconducting processor,Nature, 2019, 574(7779): 505-510

    work page 2019

  3. [3]

    Jason Biamonte, Patrick Wittek, Nicola Pancotti, et al.,Quantum ma- chine learning,Nature, 2017, 549(7671): 195-202

    work page 2017

  4. [4]

    Phys., 2015, 56(2): 172-185

    Maria Schuld, Ioan Sinayskiy, Francesco Petruccione,An introduction to quantum machine learning,Contemp. Phys., 2015, 56(2): 172-185

    work page 2015

  5. [5]

    Commun., 2014, 5(1): 4213

    Andrea Peruzzo, Justin McClean, Peter Shadbolt, et al.,A variational eigenvalue solver on a photonic quantum processor,Nat. Commun., 2014, 5(1): 4213

    work page 2014

  6. [6]

    Cristian Cirstoiu, Zachary Holmes, Joseph Iosue, et al.,Variational fast forwarding for quantum simulation beyond the coherence time,npj Quan- tum Inf., 2020, 6(1): 82

    work page 2020

  7. [7]

    X. H. Ni, B. B. Cai, H. L. Liu, et al.,Multilevel leapfrogging initial- ization strategy for quantum approximate optimization algorithm,Adv. Quantum Technol., 2024, 7(5): 2300419

    work page 2024

  8. [8]

    A Quantum Approximate Optimization Algorithm

    E. Farhi, J. Goldstone, S. Gutmann,A quantum approximate optimiza- tion algorithm,arXiv preprint arXiv:1411.4028, 2014

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  9. [9]

    X. Zhao, Y. Li, J. Li, et al.,Near-term quantum algorithm for solving the MaxCut problem with fewer quantum resources,Physica A: Stat. Mech. Appl., 2024, 648: 129951

    work page 2024

  10. [10]

    G. Li, S. Wang, X. Zhao, et al.,Quantum alternating operator ansatz for solving the minimum dominating set problem on sparse graphs with a specific structure: G. Li et al,Quantum Inf. Process., 2025, 24(6): 166

    work page 2025

  11. [11]

    24th Int

    Elham Aïmeur, Gilles Brassard, Serge Gambs,Quantum clustering al- gorithms,Proc. 24th Int. Conf. Mach. Learn., 2007: 1-8

    work page 2007

  12. [12]

    Edward Farhi, Harish Neven,Classification with quantum neural net- works on near term processors,arXiv preprint arXiv:1802.06002, 2018

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  13. [13]

    Patrick Rebentrost, Mohammad Mohseni, Seth Lloyd,Quantum sup- port vector machine for big data classification,Phys. Rev. Lett., 2014, 113(13): 130503. 25

    work page 2014

  14. [14]

    Sivak, Andrew Eickbusch, Benjamin Royer, et al.,Real-time quantum error correction beyond break-even,Nature, 2023, 616(7955): 50-55

    Vladimir V. Sivak, Andrew Eickbusch, Benjamin Royer, et al.,Real-time quantum error correction beyond break-even,Nature, 2023, 616(7955): 50-55

    work page 2023

  15. [15]

    Nautrup, Nicolas Delfosse, Vedran Dunjko, et al.,Optimizing quantum error correction codes with reinforcement learning,Quantum, 2019, 3: 215

    Hannes P. Nautrup, Nicolas Delfosse, Vedran Dunjko, et al.,Optimizing quantum error correction codes with reinforcement learning,Quantum, 2019, 3: 215

    work page 2019

  16. [16]

    West, Saeed M

    Matthew T. West, Saeed M. Erfani, Christopher Leckie, et al.,Bench- marking adversarially robust quantum machine learning at scale,Phys. Rev. Res., 2023, 5(2): 023186

    work page 2023

  17. [17]

    Huggins, et al.,Robust in prac- tice: Adversarial attacks on quantum machine learning,Phys

    Haoyang Liao, Isaac Convy, William J. Huggins, et al.,Robust in prac- tice: Adversarial attacks on quantum machine learning,Phys. Rev. A, 2021, 103(4): 042427

    work page 2021

  18. [18]

    Shreya Kundu, Soumen Ghosh,Adversarial poisoning attack on quan- tum machine learning models,arXiv preprint arXiv:2411.14412, 2024

    work page arXiv 2024

  19. [19]

    Zurek,Decoherence, einselection, and the quantum origins of the classical,Rev

    Wojciech H. Zurek,Decoherence, einselection, and the quantum origins of the classical,Rev. Mod. Phys., 2003, 75(3): 715

    work page 2003

  20. [20]

    Nico Franco, Alexander Sakhnenko, Lukas Stolpmann, et al.,Predom- inant aspects on security for quantum machine learning: Literature re- view, 2024 IEEE International Conference on Quantum Computing and Engineering (QCE), IEEE, 2024, 1: 1467-1477

    work page 2024

  21. [21]

    Wei Gong, Dong Yuan, Wei Li, et al.,Enhancing quantum adversar- ial robustness by randomized encodings,Phys. Rev. Res., 2024, 6(2): 023020

    work page 2024

  22. [22]

    H. H. Alhashim,Quantum Dot-Enabled Quantum Key Distribution for Secure Communication Channels,Quantum Inf. Process., 2025, 24(4): 1-25

    work page 2025

  23. [23]

    Shokri, M

    R. Shokri, M. Stronati, C. Song, et al.,Membership inference attacks against machine learning models, 2017 IEEE Symposium on Security and Privacy (SP), IEEE, 2017: 3-18

    work page 2017

  24. [24]

    Zhang, Z

    M. Zhang, Z. Ren, Z. Wang, et al.,Membership inference attacks against recommender systems,Proc. 2021 ACM SIGSAC Conf. Comput. Com- mun. Secur., 2021: 864-879. 26

    work page 2021

  25. [25]

    Calzada,Citizens’ data privacy in China: The state of the art of the Personal Information Protection Law (PIPL),Smart Cities, 2022, 5(3): 1129-1150

    I. Calzada,Citizens’ data privacy in China: The state of the art of the Personal Information Protection Law (PIPL),Smart Cities, 2022, 5(3): 1129-1150

    work page 2022

  26. [26]

    Regulation (EU) 2016/679 (General Data Protection Regu- lation), Official Journal of the European Union, 2016 from https://data.stats.gov.cn]

    work page 2016

  27. [27]

    Government of Canada, Digital Charter Implementation Act, 2022 (Bill C-27): Consumer Privacy Protection Act, 2022 from https://blog.didomi.io/enus/canada-data-privacy-law]

    work page 2022

  28. [28]

    L.Bourtoule, V.Chandrasekaran, C.A.Choquette-Choo, etal.,Machine unlearning, 2021 IEEE Symposium on Security and Privacy (SP), IEEE, 2021: 141-159

    work page 2021

  29. [29]

    Zagardo,A More Practical Approach to Machine Unlearning,arXiv preprint arXiv:2406.09391, 2024

    D. Zagardo,A More Practical Approach to Machine Unlearning,arXiv preprint arXiv:2406.09391, 2024

    work page arXiv 2024

  30. [30]

    Trippa, C

    D. Trippa, C. Campagnano, M.S. Bucarelli, et al.,∇τ: Gradient-based and Task-Agnostic machine Unlearning,CoRR, 2024

    work page 2024

  31. [31]

    Scaling Laws for Neural Language Models

    J. Kaplan, S. McCandlish, T. Henighan, et al.,Scaling laws for neural language models,arXiv preprint arXiv:2001.08361, 2020

    work page internal anchor Pith review Pith/arXiv arXiv 2001

  32. [32]

    Thompson, K

    N.C. Thompson, K. Greenewald, K. Lee, et al.,The computational limits of deep learning,arXiv preprint arXiv:2007.05558, 2020, 10

    work page arXiv 2007

  33. [33]

    J. Fan, F. Han, H. Liu,Challenges of big data analysis,Nat. Sci. Rev., 2014, 1(2): 293-314

    work page 2014

  34. [34]

    Bühlmann, S

    P. Bühlmann, S. Van De Geer,Statistics for high-dimensional data: methods, theory and applications, Springer Science & Business Media, 2011

    work page 2011

  35. [35]

    C. Chen, Q. Zhao, M.C. Zhou, et al.,Overcoming Dimensional Fac- torization Limits in Discrete Diffusion Models through Quantum Joint Distribution Learning,arXiv preprint arXiv:2505.05151, 2025

    work page arXiv 2025

  36. [36]

    L. Li, J. Li, Y. Song, et al.,An efficient quantum proactive incremental learning algorithm,Sci. China Phys. Mech. Astron., 2025, 68(3): 210313. 27

    work page 2025

  37. [37]

    Lloyd, M

    S. Lloyd, M. Mohseni, P. Rebentrost,Quantum principal component analysis,Nat. Phys., 2014, 10(9): 631-633

    work page 2014

  38. [38]

    Benedetti, E

    M. Benedetti, E. Lloyd, S. Sack, et al.,Parameterized quantum circuits as machine learning models,Quantum Sci. Technol., 2019, 4(4): 043001

    work page 2019

  39. [39]

    J. Su, J. Fan, S. Wu, et al.,Topology-driven quantum architecture search framework,Sci. China Inf. Sci., 2025, https://doi.org/10.1007/s11432- 024-4486-x

    work page doi:10.1007/s11432- 2025

  40. [40]

    Z. He, M. Deng, S. Zheng, et al.,Training-free quantum architecture search,Proc. AAAI Conf. Artif. Intell., 2024, 38(11): 12430-12438

    work page 2024

  41. [41]

    S. Li, D. Tsukayama, J. Shirakashi, et al.,Quantum architecture search with neural predictor based on ZX-calculus,EPJ Quantum Technol., 2025, 12(1): 106

    work page 2025

  42. [42]

    arXiv preprint arXiv:2101.11020 , year=

    M. Schuld,Supervised quantum machine learning models are kernel methods,arXiv preprint arXiv:2101.11020, 2021

    work page arXiv 2021

  43. [43]

    W. Li, D.L. Deng,Recent advances for quantum classifiers,Sci. China Phys. Mech. Astron., 2022, 65(2): 220301

    work page 2022

  44. [44]

    Mitarai, M

    K. Mitarai, M. Negoro, M. Kitagawa, et al.,Quantum circuit learning, Phys. Rev. A, 2018, 98(3): 032309

    work page 2018

  45. [45]

    Tang, V.O

    H.L. Tang, V.O. Shkolnikov, G.S. Barron, et al.,Qubit-adapt-VQE: An adaptive algorithm for constructing hardware-efficient ansätze on a quantum processor,PRX Quantum, 2021, 2(2): 020310

    work page 2021

  46. [46]

    H. Situ, Z. He, S. Zheng, et al.,Distributed quantum architecture search, Phys. Rev. A, 2024, 110(2): 022403

    work page 2024

  47. [47]

    Z. He, J. Su, C. Chen, et al.,Search space pruning for quantum archi- tecture search,Eur. Phys. J. Plus, 2022, 137(4): 491

    work page 2022

  48. [48]

    Zhang, C.Y

    S.X. Zhang, C.Y. Hsieh, S. Zhang, et al.,Differentiable quantum archi- tecture search,Quantum Sci. Technol., 2022, 7(4): 045023

    work page 2022

  49. [49]

    Anagolum, N

    S. Anagolum, N. Alavisamani, P. Das, et al.,Élivágar: Efficient quan- tum circuit search for classification,Proc. 29th ACM Int. Conf. Archit. Support Prog. Lang. Oper. Syst., Volume 2, 2024: 336-353. 28

    work page 2024

  50. [50]

    Y. Du, T. Huang, S. You, et al.,Quantum circuit architecture search for variational quantum algorithms,npj Quantum Inf., 2022, 8(1): 62

    work page 2022

  51. [51]

    Z. He, H. Chen, Y. Zhou, et al.,Self-supervised representation learning for Bayesian quantum architecture search,Phys. Rev. A, 2025, 111(3): 032403

    work page 2025

  52. [52]

    Foster, S

    J. Foster, S. Schoepf, A. Brintrup,Fast machine unlearning without re- training through selective synaptic dampening,Proc. AAAI Conf. Artif. Intell., 2024, 38(11): 12043-12051

    work page 2024

  53. [53]

    Chen, S.X

    Y.Q. Chen, S.X. Zhang,Superior resilience to poisoning and amenabil- ity to unlearning in quantum machine learning,arXiv preprint arXiv:2508.02422, 2025. 29

    work page arXiv 2025