Pith. sign in

REVIEW 4 major objections 6 minor 91 references

A Numerical Gradient Inversion Attack in Variational Quantum Neural-Networks

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A numerical gradient inversion attack using adaptive low-pass filtering reconstructs private training inputs from variational quantum neural networks down to about $10^{-10}$ error, when the model is trainable and sufficiently…

desk verdict First numerical gradient inversion attack on VQNNs, but it inverts the model-output gradient, not the loss gradient shared in FL, so the central privacy claim doesn't hold as written. read the letter →

arxiv 2504.12806 v2 pith:XBUUH2RC submitted 2025-04-17 cs.LG cs.AIcs.CR

Georgios Papadopoulos , Shaltiel Eloul , Yash Satsangi , Jamie Heredge , Niraj Kumar , Chun-Fu Chen , Marco Pistoia This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords gradientinversionattackvariationalquantumneuralnetworksfederatedlearningmachinefinitedifferencemethodadaptivelow-passfilteringKalmanfilterparameter-shiftrule
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the gradients a variational quantum neural network (VQNN) shares during training are not private: a numerical attack can reconstruct the original input data, even when gradients are aggregated over small batches. The attack combines finite-difference gradient estimation with an adaptive low-pass filter and Kalman-filter updates, so that the optimizer finds the global minimum of the gradient-matching loss instead of getting stuck in the VQNN loss landscape's many local minima. In ideal numerical simulations the reconstruction reaches mean squared error around $10^{-10}$ whenever the model is trainable and sufficiently over-parameterized, across regression tasks and classification tasks including credit-card fraud data. If correct, federated or distributed learning setups that share only VQNN gradients should treat those gradients as revealing, and privacy protection has to come from noise or other mechanisms rather than from the circuit's complexity.

What carries the argument

The load-bearing mechanism is the iterative inversion optimizer of the paper's Algorithm 2. For each input dimension it estimates the derivative of the gradient-matching loss with respect to that component by evaluating the VQNN's parameter-shift gradients at perturbed points, forming a central finite difference, and then averaging these estimates over a moving window of size $N$. The window size is adapted during the attack, so high-frequency oscillations of the loss are filtered out early and the optimizer can resolve the global minimum as the loss approaches zero. A Kalman filter update refines each proxy-input step and substantially improves convergence speed and success rate. The scheme requires the model to be over-parameterized: the number of parameters (equations) must be at least the number of unknown inputs and targets, which the paper takes from classical input-reconstruction analysis.

What would settle it

Run the attack with parameter-shift gradients estimated from a finite number of circuit samples, for example $10^3$ to $10^5$ shots per circuit evaluation, instead of exact numerical expectation values; if reconstruction error then stays above the paper's $0.005$ success threshold instead of falling toward $10^{-10}$, the noiseless gradient oracle is the load-bearing idealization.

Watch

Extended reading notes

Core claim

The central claim is that as long as the model is trainable, an adversary who sees the shared gradient $g$ can recover the private input $x$ by minimizing the squared distance $L_{g',g}$ between gradients of a proxy input $x'$ and the true shared gradient $g$. The paper shows this is possible without knowing target labels, for both untrained and trained models, and for batches of size two and three when the model is over-parameterized, reaching errors down to about $10^{-10}$ in the numerical experiments. The dense set of local minima that makes VQNN optimization hard does not stop the attack: adaptive low-pass filtering lets the optimizer escape those minima and converge to the global one.

Load-bearing premise

The attack assumes an essentially noiseless oracle for the VQNN's parameter-shift gradients: Algorithm 2 divides tiny differences of loss values by a small step $2nh$, and the experiments all use ideal numerical simulation, so if realistic measurement shot noise perturbs the gradient values, the claimed $10^{-10}$ reconstruction is not established.

Editorial extensions

If this is right

  • In federated learning setups where clients share only VQNN gradients, the shared gradients are not safe by themselves; the attack recovers inputs from both untrained and trained models.
  • Batch-size-based defenses are weak: the attack recovers batches of size two and three, and making batches larger degrades model accuracy before it restores privacy.
  • Noise added to shared gradients raises inversion error and can preserve some utility, giving VQNNs a privacy-performance trade-off that can be benchmarked against classical neural networks.
  • Vulnerability tracks over-parameterization, not quantum complexity alone, so privacy risk assessments should compare the number of trainable circuit parameters with the number of unknowns.
  • The algorithm is proposed as a benchmark tool for evaluating VQNN privacy in practical applications, on both benchmark and real-world sensitive data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the attack assumes noiseless exact gradients, so the practical threat depends on hardware; shot noise may prevent the $10^{-10}$ reconstruction, but the paper does not test how the attack degrades as noise increases.
  • Editorial inference: the same adaptive low-pass-filter optimization that escapes local minima could be applied to VQNN training itself, potentially improving convergence on loss landscapes dense with local minima; the paper only hints at this possibility.
  • Editorial inference: a direct testable extension is to add calibrated Gaussian noise of increasing standard deviation to shared gradients and map the smallest noise level that pushes reconstruction above the $0.005$ success threshold, producing a privacy-utility frontier for each architecture.
  • Editorial inference: the saturation of inversion error near $10^{-10}$ suggests the gradient map from inputs to parameters is locally one-to-one in the trainable regime; testing with random weight initializations and different feature maps would show how generally this injectivity holds.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a numerical gradient inversion attack against variational quantum neural networks (VQNNs) in federated learning. The attack optimizes a proxy input x' to match the gradients g' of a VQNN with the shared gradients g, using finite-difference estimates of the inversion-loss gradient, an adaptive moving-average low-pass filter to avoid local minima, and a Kalman filter for faster convergence. Experiments on cosine regression, MNIST classification, and credit-card fraud data with 2- and 6-qubit models, including batch sizes 2 and 3, report successful input recovery with MSE around 1e-5 to 3e-3 in the main tables, while the abstract and conclusion claim errors down to ~1e-10 in appendix runs. The paper argues that trainable VQNNs are not inherently private and provides a benchmark for evaluating privacy versus utility.

Significance. The contribution is potentially significant: if the central claim holds, it is the first practical gradient-inversion algorithm for VQNNs, challenging earlier results that VQNNs provide inherent privacy. The adaptive low-pass filtering and Kalman acceleration are novel and well-motivated by the oscillatory gradient landscape, and the experiments span regression, classification, real-world fraud data, and batch training. The paper also provides a useful privacy-performance comparison with classical NNs under noise. However, the significance is currently conditional because the attack's proxy gradients (Eq. 6) do not match the defined shared loss gradients (Eq. 1), the headline 1e-10 precision is only reached for near-true starting points, and the attack assumes an exact noiseless gradient oracle. The paper reports experiments on statevector simulators but provides no code, so the pseudocode errors further hinder verification.

major comments (4)
  1. [Section IV-A (Eq. 7); Algorithm 2 (lines 9-13); Eq. (1)] The inversion loss in Eq. (7) compares g' with g, but Algorithm 2 computes g' via the parameter-shift rule of Eq. (6), which yields the derivative of the expectation value y-hat with respect to the parameters, not the derivative of the training loss. For the MSE loss used throughout, Eq. (1) defines the shared gradient as g proportional to 2(y-hat - y) times the parameter-shift derivative, so at the true input x the proxy gradient g'(x) differs from g(x) by a label-dependent factor and the learning-rate/batch scaling. Because the true x is therefore not a stationary point of L_{g',g}, the algorithm as described does not minimize the correct objective; this contradicts Assumption V-E.1, which denies access to y. The authors must resolve this mismatch, either by explicitly attacking model-output gradients (partial y-hat / partial theta) and reframing the threat model, or by explaining how the loss-gradient scale is recovered without labels. As written, the experiments do not support the claim that shared FL loss gradients of VQNNs can be inverted.
  2. [Appendix B (Fig. 15); Assumption V-E.3; Conclusion] The abstract and conclusion claim inversion errors down to ~1e-10, but this value is reported in Appendix Fig. 15 for initial vectors x' that are already within approximately 0.005 of the true x (Assumption V-E.3). The main random-start experiments in Table II obtain average MSE values between 2e-5 and 3e-3, with success rates as low as 40% for some 6-qubit models. The '1e-10' is therefore a local refinement result, not a demonstration that the attack converges to the global optimum from an arbitrary starting point in the full domain. The paper should either show 1e-10 precision from random starts or qualify this claim in the abstract and conclusion.
  3. [Section V-A; Section VI-C; Eq. (8)] All attack experiments are performed with exact parameter-shift evaluations on noiseless statevector simulators (Section V-A). On physical quantum hardware, the measurements underlying Eq. (6) are shot-noise limited, and the finite-difference estimate in Eq. (8), which divides by 2nh, would be dominated by that noise for small h. The authors themselves observe in Section VI-C that hardware noise could serve as a privacy mechanism. Without any experiment or analysis with noisy gradients, the practical relevance of the attack to real federated VQNN deployment is not established; the abstract and conclusion should restrict the claim to exact-gradient oracles, or the paper should include noisy-gradient experiments.
  4. [Algorithm 2 (lines 5-21)] The pseudocode in Algorithm 2 does not match Eqs. (8)-(9). Lines 6-17 accumulate loss+ and loss- over n and then compute (loss+ - loss-)/(2nh) at each n using those cumulative sums, rather than evaluating the per-perturbation finite difference [L(x'+n h e_j) - L(x'-n h e_j)]/(2nh). Lines 18-19 do not specify how the average in Eq. (9) is formed, and line 21 writes a sum over '2N' terms although loss+ and loss- already contain N sums each. As written, the algorithm cannot be implemented or reproduced. The authors should provide a corrected pseudocode and, ideally, a reference implementation or code repository.
minor comments (6)
  1. [Assumption V-E.2] Assumption 2 states that inversion success is measured using Eq. (7), but Eq. (7) is the gradient-distance loss, not the MSE between x' and x; the text should refer to the MSE metric used in the tables.
  2. [Table II, Section V-B] The notation 'One Shot Success %' is ambiguous. The table reports the average over 10 attacks with different starting points, yet 'one shot' suggests a single run; clarify the terminology and state explicitly that successes are counted per starting point within the maximum 250 iterations.
  3. [Section V-B; Table II] The hyperparameters of the attack (initial moving-average window N, finite-difference step h, learning rate lr, and the threshold for reducing N) are not reported for the experiments in Table II. Providing these values or a link to code is necessary for reproducibility.
  4. [Eq. (8)] The truncation error in the finite-difference formula (Eq. (8)) is stated as O(nh); for a centered difference the leading error is O((nh)^2), so the order notation should be corrected.
  5. [Section VI-A, Fig. 7] The statement 'often within a single trial (except 6 qubits at 40%)' is imprecise; specify what constitutes a trial and how the success rate in Table II relates to the trajectories shown in Fig. 7.
  6. [Algorithm 2, line 25] The condition for reducing N uses an unexplained 'threshold (gradient change)'; define what quantity is compared and how the threshold is chosen, otherwise the adaptive-filter behavior cannot be reproduced.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular reduction: the inversion optimizes Eq. 7 against gradients computed by Eq. 6 and uses the true x only for evaluation; the authors' self-citations frame the narrative but do not enter the attack equations.

full rationale

The attack's derivation chain is self-contained. Algorithm 2 receives the shared gradient g (Eq. 1), draws a random proxy x' without using x or y, builds g' by perturbing x' and applying the parameter-shift rule (Eq. 6), and updates x' to minimize the gradient distance Lg',g (Eq. 7). The true input x is used only in the external success metric MSE(x',x); it is not part of the optimization objective. Hence the claimed inversion is not defined in terms of the target, and no fitted parameter is relabeled as a prediction. The self-citations [27] and [61] are used to motivate the difficulty of inverting expressive VQNNs and to position the contribution, but they supply no equation used in Algorithm 2, so they are not load-bearing. The over-parameterization criterion is attributed to an external source [85]. A separate internal-consistency issue exists: Eq. 1 defines shared gradients as loss gradients including the 2(y_hat - y) factor, while Algorithm 2 line 9 computes g' directly as the Eq. 6 output derivative, and Assumption E.1 denies access to y. This is a correctness and threat-model concern, not a circular reduction of the derivation to its inputs, so it does not raise the circularity score beyond the low non-load-bearing self-citation level.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The attack's central claim rests on exact VQNN gradient evaluations (parameter-shift in an ideal simulator), the hand-chosen hyperparameters of the optimization loop, and the unformalized over-parameterization counting condition. No new physical entities are introduced; the adaptive low-pass filter and Kalman update are numerical techniques, not new objects of nature.

free parameters (6)
  • Moving-average window size N = 16, 32, 64 (per experiment)
    Controls the low-pass filter; Fig. 9 shows N=16 fails without Kalman and N=64 succeeds. The reduction schedule in Algorithm 2 (lines 25-27) is not specified.
  • Finite-difference step h = not reported
    Step size in Eq. 8 and Algorithm 2; not given, so the numerical gradients cannot be reproduced.
  • Learning rate lr = not reported
    Update rate for x' in Eq. 10 and Algorithm 2 line 22; not specified.
  • N-reduction threshold = not reported
    Condition in Algorithm 2 line 25 for halving N; the numerical value is omitted.
  • Kalman covariances Q, R = all-ones (identity)
    Initialized to identity (Appendix A) but no sensitivity analysis or default values for the process and measurement noise, which govern the gain D_k.
  • Success threshold = 0.005 MSE
    Attack success is defined as MSE(x',x) <= 0.005 (Section V-E 3); since long runs reach 1e-10, this threshold is lenient and makes success rates easier to satisfy.
assumptions (4)
  • standard math Parameter-shift rule for VQNN gradient evaluation (Eq. 6)
    The attack and the client both compute gradients via the parameter-shift rule; this assumes the ansatz rotations are Pauli-generated, which holds for the circuits used (Fig. 6).
  • domain assumption Exact, noiseless gradient oracle in all experiments
    Experiments use Qiskit/Pennylane simulation with exact expectations; finite-shot noise is never modeled (Section V-A), which is essential for the finite-difference estimators (Eq. 8) to resolve small gradients.
  • domain assumption Over-parameterization counting condition
    Section V-E 4 states inversion is possible when the number of model parameters is at least the number of unknowns (x, y), imported from classical inversion literature [85] without a VQNN-specific derivation or explicit parameter counts for the tested circuits.
  • domain assumption Attack runs on untrained models with unit-vector or random weights
    Most results (Table II) are for untrained models; the trained-model case appears only in Fig. 17. The claim about real FL settings assumes the attack transfers to trained models without systematic evidence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Numerical Gradient Inversion Attack in Variational Quantum Neural-Networks." pith.science (2026). https://pith.science/paper/XBUUH2RC

@misc{pith2026250412806,
  author       = {Pith},
  title        = {Pith review of: A Numerical Gradient Inversion Attack in Variational Quantum Neural-Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XBUUH2RC}},
  note         = {Machine review of arXiv:2504.12806}
}
read the original abstract

The loss landscape of Variational Quantum Neural Networks (VQNNs) is characterized by local minima that grow exponentially with increasing qubits. Because of this, it is more challenging to recover information from model gradients during training compared to classical Neural Networks (NNs). In this paper we present a numerical scheme that successfully reconstructs input training, real-world, practical data from trainable VQNNs' gradients. Our scheme is based on gradient inversion that works by combining gradients estimation with the finite difference method and adaptive low-pass filtering. The scheme is further optimized with Kalman filter to obtain efficient convergence. Our experiments show that our algorithm can invert even batch-trained data, given the VQNN model is sufficiently over-parameterized.

Figures

Figures reproduced from arXiv: 2504.12806 by the authors.

Figure 1
Figure 1. Generic architecture of a VQNN. It consists of a quantum feature [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The surface shows the value of the VQNN model loss gradients for [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. In a standard pipeline of a Federated Learning model, clients ( [PITH_FULL_IMAGE:figures/full_fig_p002_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: The plots show the gradient loss landscape (Eq. [PITH_FULL_IMAGE:figures/full_fig_p003_4.png]
Figure 5
Figure 5. Figure 5: Gradient inversion attack profile on two qubits ‘Complex’ VQNN [PITH_FULL_IMAGE:figures/full_fig_p003_5.png]
Figure 6
Figure 6. Figure 6: The model architectures which are used in the experiments. A Simple [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: 6-dimensional Complex VQNN model (Fig [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: The plot shows the number of iterations required for the attack to [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 11
Figure 11. Figure 11: The plot shows the balanced accuracy (LH [PITH_FULL_IMAGE:figures/full_fig_p009_11.png]
Figure 12
Figure 12. Figure 12: These plots feature 2 and 6-dimensional Cosine datasets [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]
Figure 13
Figure 13. Figure 13: These plots feature 2 and 6-dimensional MNIST data. Fig. [PITH_FULL_IMAGE:figures/full_fig_p013_13.png]
Figure 16
Figure 16. Figure 16: We perform 4 attacks by using different initial model weights each [PITH_FULL_IMAGE:figures/full_fig_p013_16.png]
Figure 17
Figure 17. Figure 17: We perform 3 attacks using as a base gradient [PITH_FULL_IMAGE:figures/full_fig_p014_17.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

91 extracted references · 39 canonical work pages

  1. [1]

    The future of quantum computing with superconducting qubits,

    S. Bravyi, O. Dial, J. M. Gambetta, D. Gil, and Z. Nazario, “The future of quantum computing with superconducting qubits,” Journal of Applied Physics , vol. 132, no. 16, 10 2022. [Online]. Available: http://dx.doi.org/10.1063/5.0082975

    doi:10.1063/5.0082975 2022

  2. [2]

    Nisq computing: where are we and where do we go?

    J. W. Z. Lau, K. H. Lim, H. Shrotriya, and L. C. Kwek, “Nisq computing: where are we and where do we go?” AAPPS Bulletin , vol. 32, no. 1, 9 2022. [Online]. Available: http://dx.doi.org/10.1007/ s43673-022-00058-z

    2022

  3. [3]

    Recent advances in quantum computing for drug discovery and development,

    G. Kumar, S. Yadav, A. Mukherjee, V . Hassija, and M. Guizani, “Recent advances in quantum computing for drug discovery and development,” IEEE Access, vol. 12, pp. 64 491–64 509, 2024

    2024

  4. [4]

    Advancements in quantum computing—viewpoint: Building adoption and competency in industry,

    S. M. L. Pfaendler, K. Konson, and F. Greinert, “Advancements in quantum computing—viewpoint: Building adoption and competency in industry,” Datenbank-Spektrum, vol. 24, no. 1, p. 5–20, 3 2024. [Online]. Available: http://dx.doi.org/10.1007/s13222-024-00467-4

    doi:10.1007/s13222-024-00467-4 2024

  5. [5]

    Interferometric single-shot parity measurement in inas–al hybrid devices,

    M. Aghaee, A. Alcaraz Ramirez, Z. Alam, R. Ali, M. Andrzejczuk, A. Antipov, M. Astafev, A. Barzegar, B. Bauer, J. Becker, U. K. Bhaskar, A. Bocharov, S. Boddapati, D. Bohn, J. Bommer, L. Bourdet, A. Bousquet, S. Boutin, L. Casparis, B. J. Chapman, S. Chatoor, A. W. Christensen, C. Chua, P. Codd, W. Cole, P. Cooper, F. Corsetti, A. Cui, P. Dalpasso, J. P. ...

    2025

  6. [6]

    Certified randomness using a trapped-ion quantum processor,

    M. Liu, R. Shaydulin, P. Niroula, M. DeCross, S.-H. Hung, W. Y . Kon, E. Cervero-Mart ´ın, K. Chakraborty, O. Amer, S. Aaronson, A. Acharya, Y . Alexeev, K. J. Berg, S. Chakrabarti, F. J. Curchod, J. M. Dreiling, N. Erickson, C. Foltz, M. Foss-Feig, D. Hayes, T. S. Humble, N. Kumar, J. Larson, D. Lykov, M. Mills, S. A. Moses, B. Neyenhuis, S. Eloul, P. Si...

    2025

  7. [7]

    Quantum support vector machine for big data classification,

    P. Rebentrost, M. Mohseni, and S. Lloyd, “Quantum support vector machine for big data classification,” Phys. Rev. Lett. , vol. 113, p. 130503, 9 2014. [Online]. Available: https://link.aps.org/doi/10.1103/ PhysRevLett.113.130503

    2014

  8. [8]

    Training deep quantum neural networks,

    K. Beer, D. Bondarenko, T. Farrelly, T. J. Osborne, R. Salzmann, D. Scheiermann, and R. Wolf, “Training deep quantum neural networks,” Nature Communications , vol. 11, no. 1, 2 2020. [Online]. Available: http://dx.doi.org/10.1038/s41467-020-14454-2

    doi:10.1038/s41467-020-14454-2 2020

Show all 91 references
  1. [9]

    Experimental quantum speed-up in reinforcement learning agents,

    V . Saggio, B. E. Asenbeck, A. Hamann, T. Str ¨omberg, P. Schiansky, V . Dunjko, N. Friis, N. C. Harris, M. Hochberg, D. Englund, S. W ¨olk, H. J. Briegel, and P. Walther, “Experimental quantum speed-up in reinforcement learning agents,” Nature, vol. 591, no. 7849, p. 229–233,...

    2021

  2. [10]

    Meta-genetic programming for static quantum circuits,

    K. M. Barnes and M. B. Gale, “Meta-genetic programming for static quantum circuits,” in Proceedings of the Genetic and Evolutionary Computation Conference Companion , ser. GECCO ’19. ACM, 7 2019, p. 2016–2019. [Online]. Available: http: //dx.doi.org/10.1145/3319619.3326907

    2019

  3. [11]

    Quantum mixed-state self-attention network,

    F. Chen, Q. Zhao, L. Feng, C. Chen, Y . Lin, and J. Lin, “Quantum mixed-state self-attention network,” 2024. [Online]. Available: https: //arxiv.org/abs/2403.02871

    2024 arXiv

  4. [12]

    Supervised quantum machine learning models are kernel methods,

    M. Schuld, “Supervised quantum machine learning models are kernel methods,” 2021. [Online]. Available: https://arxiv.org/abs/2101.11020

    2021 arXiv

  5. [13]

    Quantum circuit architecture search for variational quantum algorithms,

    Y . Du, T. Huang, S. You, M.-H. Hsieh, and D. Tao, “Quantum circuit architecture search for variational quantum algorithms,” npj Quantum Information , vol. 8, no. 1, 5 2022. [Online]. Available: http://dx.doi.org/10.1038/s41534-022-00570-y

    2022 doi

  6. [14]

    Variational quantum algorithms,

    M. Cerezo, A. Arrasmith, R. Babbush, S. C. Benjamin, S. Endo, K. Fujii, J. R. McClean, K. Mitarai, X. Yuan, L. Cincio, and P. J. Coles, “Variational quantum algorithms,” Nature Reviews Physics, vol. 3, no. 9, p. 625–644, 8 2021. [Online]. Available: http://dx.doi.org/10.1038/s...

    2021 doi

  7. [15]

    Eval- uating analytic gradients on quantum hardware,

    M. Schuld, V . Bergholm, C. Gogolin, J. Izaac, and N. Killoran, “Eval- uating analytic gradients on quantum hardware,” Phys. Rev. A (Coll. Park.), vol. 99, no. 3, 3 2019

    2019

  8. [16]

    Hybrid quantum neural networks show strongly reduced need for free parameters in entity matching,

    L. Bischof, S. Teodoropol, R. M. Fuchslin, and K. Stockinger, “Hybrid quantum neural networks show strongly reduced need for free parameters in entity matching,” Sci Rep , vol. 15, no. 4318, 2025. [Online]. Available: https://doi.org/10.1038/s41598-025-88177-z

    2025 doi

  9. [17]

    Challenges and opportunities in quantum machine learning,

    M. Cerezo, G. Verdon, H.-Y . Huang, L. Cincio, and P. J. Coles, “Challenges and opportunities in quantum machine learning,” Nature Computational Science , vol. 2, no. 9, p. 567–576, 9 2022. [Online]. Available: http://dx.doi.org/10.1038/s43588-022-00311-3

    2022 doi

  10. [18]

    Quantum machine learning in high energy physics,

    W. Guan, G. Perdue, A. Pesah, M. Schuld, K. Terashi, S. Vallecorsa, and J.-R. Vlimant, “Quantum machine learning in high energy physics,” Machine Learning: Science and Technology , vol. 2, no. 1, p. 011003, 3

  11. [19]

    Practical application of quantum neural network to materials informatics,

    H. Hirai, “Practical application of quantum neural network to materials informatics,” Scientific Reports , vol. 14, no. 1, 4 2024. [Online]. Available: http://dx.doi.org/10.1038/s41598-024-59276-0

    2024 doi

  12. [20]

    Quantum machine learning for chemistry and physics,

    M. Sajjan, J. Li, R. Selvarajan, S. H. Sureshbabu, S. S. Kale, R. Gupta, V . Singh, and S. Kais, “Quantum machine learning for chemistry and physics,” Chem. Soc. Rev. , vol. 51, pp. 6475–6573, 2022. [Online]. Available: http://dx.doi.org/10.1039/D2CS00203E

    2022 doi

  13. [21]

    Barren plateaus in quantum neural network training landscapes,

    J. R. McClean, S. Boixo, V . N. Smelyanskiy, R. Babbush, and H. Neven, “Barren plateaus in quantum neural network training landscapes,” Nature Communications, vol. 9, no. 1, 11 2018. [Online]. Available: http://dx.doi.org/10.1038/s41467-018-07090-4

    2018 doi

  14. [22]

    Barren plateaus in variational quantum computing,

    M. Larocca, S. Thanasilp, S. Wang, K. Sharma, J. Biamonte, P. J. Coles, L. Cincio, J. R. McClean, Z. Holmes, and M. Cerezo, “Barren plateaus in variational quantum computing,” Nature Reviews Physics , 3 2025. [Online]. Available: http://dx.doi.org/10.1038/s42254-025-00813-9

    2025 doi

  15. [23]

    Avoiding local minima in variational quantum eigensolvers with the natural gradient optimizer,

    D. Wierichs, C. Gogolin, and M. Kastoryano, “Avoiding local minima in variational quantum eigensolvers with the natural gradient optimizer,” Phys. Rev. Res. , vol. 2, p. 043246, 11 2020. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevResearch.2.043246

    2020 doi

  16. [24]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,”

  17. [25]

    On the limited memory bfgs method for large scale optimization,

    D. C. Liu and J. Nocedal, “On the limited memory bfgs method for large scale optimization,” Math. Program., vol. 45, no. 1–3, p. 503–528, 8 1989

    1989

  18. [26]

    Natural gradient works efficiently in learning,

    S.-i. Amari, “Natural gradient works efficiently in learning,” Neural Computation, vol. 10, no. 2, pp. 251–276, 1998

    1998

  19. [27]

    Expressive variational quantum circuits provide inherent privacy in federated learning,

    N. Kumar, J. Heredge, C. Li, S. Eloul, S. H. Sureshbabu, and M. Pistoia, “Expressive variational quantum circuits provide inherent privacy in federated learning,” 2023. [Online]. Available: https://arxiv.org/abs/2309.13002

    2023 arXiv

  20. [28]

    Enhancing quantum adversarial robustness by randomized encodings,

    W. Gong, D. Yuan, W. Li, and D.-L. Deng, “Enhancing quantum adversarial robustness by randomized encodings,” Phys. Rev. Res. , vol. 6, p. 023020, 4 2024. [Online]. Available: https://link.aps.org/doi/ 10.1103/PhysRevResearch.6.023020

    2024 doi

  21. [29]

    Bridging quantum computing and differential privacy: Insights into quantum computing privacy,

    Y . Zhao, H. Zhong, X. Zhang, Y . Li, C. Zhang, and M. Pan, “Bridging quantum computing and differential privacy: Insights into quantum computing privacy,” in2024 IEEE International Conference on Quantum Computing and Engineering (QCE) , vol. 01, 2024, pp. 13–24

    2024

  22. [30]

    Communication-Efficient Learning of Deep Networks from Decentralized Data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, “Communication-Efficient Learning of Deep Networks from Decentralized Data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics , ser. Proceedings of Machine Learning Re...

    2017

  23. [31]

    Training classical neural networks by quantum machine learning,

    C.-Y . Liu, E.-J. Kuo, C.-H. A. Lin, S. Chen, J. G. Young, Y .-J. Chang, and M.-H. Hsieh, “Training classical neural networks by quantum machine learning,” 2024. [Online]. Available: https: //arxiv.org/abs/2402.16465

    2024 arXiv

  24. [32]

    Generating quantum feature maps for svm classifier,

    B.-S. Chen and J.-L. Chern, “Generating quantum feature maps for svm classifier,” 2022. [Online]. Available: https://arxiv.org/abs/2207.11449

    2022 arXiv

  25. [33]

    Benchmarking quantum machine learning kernel training for classification tasks,

    D. Alvarez-Estevez, “Benchmarking quantum machine learning kernel training for classification tasks,” 2024. [Online]. Available: https: //arxiv.org/abs/2408.10274

    2024 arXiv

  26. [34]

    Oppor- tunities of federated learning in connected, cooperative, and automated industrial systems,

    S. Savazzi, M. Nicoli, M. Bennis, S. Kianoush, and L. Barbieri, “Oppor- tunities of federated learning in connected, cooperative, and automated industrial systems,” IEEE Communications Magazine, vol. 59, no. 2, pp. 16–21, 2021

    2021

  27. [35]

    Real-time end-to-end federated learning: An automotive case study,

    H. Zhang, J. Bosch, and H. H. Olsson, “Real-time end-to-end federated learning: An automotive case study,” in 2021 IEEE 45th Annual Com- puters, Software, and Applications Conference (COMPSAC) , 2021, pp. 459–468

    2021

  28. [36]

    A profit-maximizing data marketplace with differentially private federated learning under price competition,

    P. Sun, L. Wu, Z. Wang, J. Liu, J. Luo, and W. Jin, “A profit-maximizing data marketplace with differentially private federated learning under price competition,” Proc. ACM Manag. Data , vol. 2, no. 4, 9 2024. [Online]. Available: https://doi.org/10.1145/3677127

    2024 doi

  29. [37]

    Alphafold is running out of data - so drug firms are building their own version,

    E. Callaway, “Alphafold is running out of data - so drug firms are building their own version,” 3 2025. [Online]. Available: https: //www.nature.com/articles/d41586-025-00868-9?secureweb=Teams

    2025

  30. [38]

    A survey on federated learning systems: Vision, hype and reality for data privacy and protection,

    Q. Li, Z. Wen, Z. Wu, S. Hu, N. Wang, Y . Li, X. Liu, and B. He, “A survey on federated learning systems: Vision, hype and reality for data privacy and protection,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 4, pp. 3347–3366, 2023

    2023

  31. [39]

    Model aggregation techniques in federated learning: A comprehensive survey,

    P. Qi, D. Chiaro, A. Guzzo, M. Ianni, G. Fortino, and F. Piccialli, “Model aggregation techniques in federated learning: A comprehensive survey,” Future Generation Computer Systems , vol. 150, pp. 272– 293, 2024. [Online]. Available: https://www.sciencedirect.com/science/ arti...

    2024

  32. [40]

    Threats to federated learning: A survey,

    L. Lyu, H. Yu, and Q. Yang, “Threats to federated learning: A survey,”

  33. [41]

    Federated learning with differential privacy: Algorithms and performance analysis,

    K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. S. Quek, and H. Vincent Poor, “Federated learning with differential privacy: Algorithms and performance analysis,” IEEE Transactions on Information Forensics and Security , vol. 15, pp. 3454–3469, 2020

    2020

  34. [42]

    A survey on security and privacy of federated learning,

    V . Mothukuri, R. M. Parizi, S. Pouriyeh, Y . Huang, A. Dehghantanha, and G. Srivastava, “A survey on security and privacy of federated learning,” Future Generation Computer Systems , vol. 115, pp. 619– 640, 2021. [Online]. Available: https://www.sciencedirect.com/science/ art...

    2021

  35. [43]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” 2019. [Online]. Available: https://arxiv.org/abs/1906.08935

    2019 arXiv

  36. [44]

    Inverting gradients - how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients - how easy is it to break privacy in federated learning?” ArXiv, vol. abs/2003.14053, 2020. [Online]. Available: https://api. semanticscholar.org/CorpusID:214728347

    2003 arXiv

  37. [45]

    Mixing gradients in neural networks as a strategy to enhance privacy in federated learning,

    S. Eloul, F. Silavong, S. Kamthe, A. Georgiadis, and S. J. Moran, “Mixing gradients in neural networks as a strategy to enhance privacy in federated learning,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV) , 1 2024, pp. 3956–3965

    2024

  38. [46]

    Inverting gradients - how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients - how easy is it to break privacy in federated learning?” in Proceedings of the 34th International Conference on Neural Information Processing Systems , ser. NIPS ’20. Red Hook, NY , USA: Curran Asso...

    2020

  39. [47]

    See through gradients: Image batch recovery via gradinversion,

    H. Yin, A. Mallya, A. Vahdat, J. M. ´Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pp. 16 332–16 341, 2021. [Online]. Available: https://api.sem...

    2021

  40. [48]

    The secret revealer: Generative model-inversion attacks against deep neural networks,

    Y . Zhang, R. Jia, H. Pei, W. Wang, B. Li, and D. Song, “The secret revealer: Generative model-inversion attacks against deep neural networks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 6 2020

    2020

  41. [49]

    An analysis of the vulnerability of two common deep learning- based medical image segmentation techniques to model inversion attacks,

    N. Subbanna, M. Wilms, A. Tuladhar, and N. D. Forkert, “An analysis of the vulnerability of two common deep learning- based medical image segmentation techniques to model inversion attacks,” Sensors, vol. 21, no. 11, 2021. [Online]. Available: https://www.mdpi.com/1424-8220/21/11/3874

    2021

  42. [50]

    Model inversion attacks against graph neural networks,

    Z. Zhang, Q. Liu, Z. Huang, H. Wang, C.-K. Lee, and E. Chen, “Model inversion attacks against graph neural networks,” IEEE Transactions on Knowledge and Data Engineering , vol. 35, no. 9, pp. 8729–8741, 2023

    2023

  43. [51]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’15. New York, NY , USA: Association for Compu...

    2015

  44. [52]

    BatchCrypt: Efficient homomorphic encryption for Cross-Silo federated learning,

    C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y . Liu, “BatchCrypt: Efficient homomorphic encryption for Cross-Silo federated learning,” in 2020 USENIX Annual Technical Conference (USENIX ATC 20) . USENIX Association, 7 2020, pp. 493–506. [Online]. Available: https://www.useni...

    2020

  45. [53]

    Ho- momorphic encryption-based privacy-preserving federated learning in iot-enabled healthcare system,

    L. Zhang, J. Xu, P. Vijayakumar, P. K. Sharma, and U. Ghosh, “Ho- momorphic encryption-based privacy-preserving federated learning in iot-enabled healthcare system,” IEEE Transactions on Network Science and Engineering, vol. 10, no. 5, pp. 2864–2880, 2023

    2023

  46. [54]

    Privacy-preserving federated learning based on multi-key homomorphic encryption,

    J. Ma, S.-A. Naas, S. Sigg, and X. Lyu, “Privacy-preserving federated learning based on multi-key homomorphic encryption,” International Journal of Intelligent Systems , vol. 37, no. 9, pp. 5880–5901, 2022. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/i...

    2022 doi

  47. [55]

    Privacy- preserving quantum federated learning via gradient hiding,

    C. Li, N. Kumar, Z. Song, S. Chakrabarti, and M. Pistoia, “Privacy- preserving quantum federated learning via gradient hiding,” Quantum Science and Technology , vol. 9, no. 3, p. 035028, 5 2024. [Online]. Available: https://dx.doi.org/10.1088/2058-9565/ad40cc

    2024 doi

  48. [56]

    Quantum federated learning with decen- tralized data,

    R. Huang, X. Tan, and Q. Xu, “Quantum federated learning with decen- tralized data,” IEEE Journal of Selected Topics in Quantum Electronics , vol. 28, no. 4: Mach. Learn. in Photon. Commun. and Meas. Syst., pp. 1–10, 2022

    2022

  49. [57]

    Federated quantum machine learning,

    S. Y .-C. Chen and S. Yoo, “Federated quantum machine learning,” Entropy, vol. 23, no. 4, 2021. [Online]. Available: https://www.mdpi. com/1099-4300/23/4/460

    2021

  50. [58]

    Gradient-based learning applied to document recognition,

    Y . Lecun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  51. [59]

    Credit card fraud detection,

    M. L. G. ULB, “Credit card fraud detection,” 3 2018. [Online]. Available: https://www.kaggle.com/datasets/mlg-ulb/creditcardfraud

    2018

  52. [60]

    Quantum federated learning through blind quantum computing,

    W. Li, S. Lu, and D.-L. Deng, “Quantum federated learning through blind quantum computing,” Science China Physics, Mechanics &amp; Astronomy , vol. 64, no. 10, 9 2021. [Online]. Available: http://dx.doi.org/10.1007/s11433-021-1753-3

    2021 doi

  53. [61]

    Prospects of privacy advantage in quantum machine learning,

    J. Heredge, N. Kumar, D. Herman, S. Chakrabarti, R. Yalovetzky, S. H. Sureshbabu, C. Li, and M. Pistoia, “Prospects of privacy advantage in quantum machine learning,” 2024. [Online]. Available: https://arxiv.org/abs/2405.08801

    2024 arXiv

  54. [62]

    Decentralizing feature extraction with quantum convolutional neural network for automatic speech recognition,

    C.-H. H. Yang, J. Qi, S. Y .-C. Chen, P.-Y . Chen, S. M. Siniscalchi, X. Ma, and C.-H. Lee, “Decentralizing feature extraction with quantum convolutional neural network for automatic speech recognition,” in ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech ...

    2021

  55. [63]

    Quantum machine learning with differential privacy,

    W. M. Watkins, S. Y .-C. Chen, and S. Yoo, “Quantum machine learning with differential privacy,” Scientific Reports , vol. 13, no. 1, 2 2023. [Online]. Available: http://dx.doi.org/10.1038/s41598-022-24082-z

    2023 doi

  56. [64]

    Quantum differential privacy: An information theory perspective,

    C. Hirche, C. Rouz ´e, and D. S. Franc ¸a, “Quantum differential privacy: An information theory perspective,” IEEE Transactions on Information Theory, vol. 69, no. 9, pp. 5771–5787, 2023

    2023

  57. [65]

    Federated quantum machine learning with differential privacy,

    R. Rofougaran, S. Yoo, H.-H. Tseng, and S. Y .-C. Chen, “Federated quantum machine learning with differential privacy,” in ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 4 2024. [Online]. Available: http://dx.doi.or...

    2024

  58. [66]

    Quantum federated learning for image classification,

    L. S ¨unkel, P. Altmann, M. K ¨olle, and T. Gabor, “Quantum federated learning for image classification,” in Proceedings of the 16th Inter- national Conference on Agents and Artificial Intelligence - Volume 3: ICAART, INSTICC. SciTePress, 2024, pp. 936–942

    2024

  59. [67]

    Predominant aspects on security for quantum machine learning: Literature review,

    N. Franco, A. Sakhnenko, L. Stolpmann, D. Thuerck, F. Petsch, A. R ¨ull, and J. M. Lorenz, “Predominant aspects on security for quantum machine learning: Literature review,” 2024. [Online]. Available: https://arxiv.org/abs/2401.07774

    2024

  60. [68]

    Biggio, I

    B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. ˇSrndi´c, P. Laskov, G. Giacinto, and F. Roli, Evasion Attacks against Machine Learning at Test Time. Springer Berlin Heidelberg, 2013, p. 387–402. [Online]. Available: http://dx.doi.org/10.1007/978-3-642-40994-3 25

    2013 doi

  61. [69]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” 2016. [Online]. Available: https://arxiv.org/abs/1608.04644

    2016 arXiv

  62. [70]

    Robust in practice: Adversarial attacks on quantum machine learning,

    H. Liao, I. Convy, W. J. Huggins, and K. B. Whaley, “Robust in practice: Adversarial attacks on quantum machine learning,” 12 Physical Review A , vol. 103, no. 4, 4 2021. [Online]. Available: http://dx.doi.org/10.1103/PhysRevA.103.042427

    2021 doi

  63. [71]

    Optimal provable robustness of quantum classification via quantum hypothesis testing,

    M. Weber, N. Liu, B. Li, C. Zhang, and Z. Zhao, “Optimal provable robustness of quantum classification via quantum hypothesis testing,” npj Quantum Information , vol. 7, no. 1, 5 2021. [Online]. Available: http://dx.doi.org/10.1038/s41534-021-00410-5

    2021 doi

  64. [72]

    Differential privacy in quantum computation,

    L. Zhou and M. Ying, “Differential privacy in quantum computation,” in 2017 IEEE 30th Computer Security Foundations Symposium (CSF) . IEEE, 8 2017. [Online]. Available: http://dx.doi.org/10.1109/CSF.2017. 23

    2017 doi

  65. [73]

    Quantum noise protects quantum classifiers against adversaries,

    Y . Du, M.-H. Hsieh, T. Liu, D. Tao, and N. Liu, “Quantum noise protects quantum classifiers against adversaries,” Phys. Rev. Res., vol. 3, p. 023153, 5 2021. [Online]. Available: https: //link.aps.org/doi/10.1103/PhysRevResearch.3.023153

    2021 doi

  66. [74]

    Variational quantum neural networks (vqnns) in image classification,

    M. Das and T. Bolisetti, “Variational quantum neural networks (vqnns) in image classification,” 2023. [Online]. Available: https: //arxiv.org/abs/2303.05860

    2023 arXiv

  67. [75]

    Hybrid quantum-classical approach to quantum optimal control,

    J. Li, X. Yang, X. Peng, and C.-P. Sun, “Hybrid quantum-classical approach to quantum optimal control,” Phys. Rev. Lett., vol. 118, no. 15, 4 2017

    2017

  68. [76]

    Quantum circuit learning,

    K. Mitarai, M. Negoro, M. Kitagawa, and K. Fujii, “Quantum circuit learning,” Phys. Rev. A (Coll. Park.) , vol. 98, no. 3, 9 2018

    2018

  69. [77]

    General parameter- shift rules for quantum gradients,

    D. Wierichs, J. Izaac, C. Wang, and C. Y .-Y . Lin, “General parameter- shift rules for quantum gradients,” Quantum, vol. 6, no. 677, p. 677, 3 2022

    2022

  70. [78]

    Instahide: Instance-hiding schemes for private distributed learning,

    Y . Huang, Z. Song, K. Li, and S. Arora, “Instahide: Instance-hiding schemes for private distributed learning,” ArXiv, vol. abs/2010.02772,

    2010 arXiv

  71. [79]

    An introduction to the kalman filter,

    G. Welch and G. Bishop, “An introduction to the kalman filter,” University of North Carolina at Chapel Hill, USA, Tech. Rep., 1995

    1995

  72. [80]

    Quantum computing with Qiskit,

    A. Javadi-Abhari, M. Treinish, K. Krsulich, C. J. Wood, J. Lishman, J. Gacon, S. Martiel, P. D. Nation, L. S. Bishop, A. W. Cross, B. R. Johnson, and J. M. Gambetta, “Quantum computing with Qiskit,” 2024

    2024

  73. [81]

    Pennylane: Automatic differentiation of hybrid quantum-classical computations,

    V . Bergholm, J. Izaac, M. Schuld, C. Gogolin, S. Ahmed, V . Ajith, M. S. Alam, G. Alonso-Linaje, B. AkashNarayanan, A. Asadi, J. M. Arrazola, U. Azad, S. Banning, C. Blank, T. R. Bromley, B. A. Cordier, J. Ceroni, A. Delgado, O. D. Matteo, A. Dusko, T. Garg, D. Guala, A. Haye...

    2022 arXiv

  74. [82]

    Available: https://api.semanticscholar.org/CorpusID: 221081368

    [Online]. Available: https://api.semanticscholar.org/CorpusID: 221081368

  75. [83]

    Medical imaging deep learning with differential privacy,

    A. Ziller, D. Usynin, R. Braren, M. Makowski, D. Rueckert, and G. Kaissis, “Medical imaging deep learning with differential privacy,” Scientific Reports , vol. 11, no. 1, 6 2021. [Online]. Available: http://dx.doi.org/10.1038/s41598-021-93030-0

    2021 doi

  76. [84]

    Absolute variation distance: An inversion attack evaluation metric for federated learning,

    G. Papadopoulos, Y . Satsangi, S. Eloul, and M. Pistoia, “Absolute variation distance: An inversion attack evaluation metric for federated learning,” in Advances in Information Retrieval , N. Goharian, N. Tonel- lotto, Y . He, A. Lipani, G. McDonald, C. Macdonald, and I. Ounis...

    2024

  77. [85]

    Minimal model structure analysis for input reconstruction in federated learning,

    J. Qian, H. Nassar, and L. K. Hansen, “Minimal model structure analysis for input reconstruction in federated learning,” 2021. [Online]. Available: https://arxiv.org/abs/2010.15718

    2021 arXiv

  78. [86]

    Bagdasaryan, O

    E. Bagdasaryan, O. Poursaeed, and V . Shmatikov, Differential privacy has disparate impact on model accuracy. Red Hook, NY , USA: Curran Associates Inc., 2019

    2019

  79. [87]

    A kalman filtering tutorial for undergraduate students,

    M. B. Rhudy, R. A. Salguero, and K. Holappa, “A kalman filtering tutorial for undergraduate students,” International Journal of Computer Science & Engineering Survey , vol. 8, no. 1, pp. 1–9, 2017. APPENDIX A KALMAN FILTER The Kalman model’s matrices and vectors, as specified ...

    2017

  80. [90]

    Reduction of finite sampling noise in quantum neural networks,

    D. A. Kreplin and M. Roth, “Reduction of finite sampling noise in quantum neural networks,” Quantum, vol. 8, p. 1385, 6 2024. [Online]. Available: https://doi.org/10.22331/q-2024-06-25-1385

    2024 doi

  81. [2017]

    Available: https://arxiv.org/abs/1412.6980

    [Online]. Available: https://arxiv.org/abs/1412.6980

    arXiv

  82. [2020]

    Available: https://arxiv.org/abs/2003.02133

    [Online]. Available: https://arxiv.org/abs/2003.02133

    2003 arXiv

  83. [2021]

    Available: https://dx.doi.org/10.1088/2632-2153/abc17d

    [Online]. Available: https://dx.doi.org/10.1088/2632-2153/abc17d

    doi

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.