Experimentally validated quantum-secure federated learning over a multi-user quantum network
Pith reviewed 2026-05-23 05:04 UTC · model grok-4.3
The pith
QuNetQFL masks federated model updates with quantum secret keys for information-theoretic security during aggregation on quantum networks.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
QuNetQFL is a quantum federated learning protocol in which local model updates are masked with distributed quantum secret keys generated on a multi-user quantum network, thereby providing information-theoretic security during the aggregation phase; the protocol is experimentally realized on a four-client quantum network and shown to maintain accuracy on both quantum and classical tasks while scaling to hundreds of clients with reduced communication overhead.
What carries the argument
Masking of local model updates with distributed quantum secret keys generated across the multi-user quantum network
If this is right
- Global model accuracy rises when even a single client contributes quantum data on multipartite entangled or non-stabilizer tasks.
- Hybrid classical-quantum language models can be fine-tuned under the same masking scheme on real quantum hardware with performance comparable to classical federated learning.
- Communication volume drops by 75 percent after model compression while convergence remains rapid up to 200 clients.
- The same key-masking step can be applied to any gradient-based federated task that currently relies on classical encryption.
Where Pith is reading between the lines
- Future quantum-internet backbones could host many such masked aggregation servers without requiring trusted classical intermediaries.
- The four-client demonstration supplies a concrete benchmark for testing larger quantum-network testbeds or different key-distribution topologies.
- Model-compression techniques shown here may combine with other quantum-secure primitives such as blind quantum computing for end-to-end private training.
Load-bearing premise
The quantum secret keys stay information-theoretically secure against any adversary throughout the entire aggregation process and the experimental hardware introduces no exploitable side-channel leakage.
What would settle it
Demonstration that an eavesdropper can recover a non-negligible fraction of any client's model update from the masked values sent to the server, either by exploiting the key distribution or by attacking the aggregation step in the four-client setup.
Figures
read the original abstract
Federated learning enables decentralized, privacy-preserving training but remains vulnerable to privacy leakage in the quantum era. Quantum federated learning (QFL) offers a promising path towards enhanced security and efficiency. However, a practical and experimentally validated QFL protocol utilizing near-term quantum techniques to address data privacy has been lacking. Here we present QuNetQFL, a QFL protocol implemented on quantum networks, in which local model updates are masked with distributed quantum secret keys, offering information-theoretic security during aggregation. We experimentally validate the protocol on a four-client quantum network and benchmark its performance using the generated keys on quantum and real-world datasets. Adding a single quantum client significantly improves global accuracy for classifying multipartite entangled and non-stabilizer quantum datasets. For language tasks, we apply QuNetQFL to sentiment analysis by federated fine-tuning of a hybrid classical-quantum language model, achieving comparable and robust performance in simulation and on real quantum hardware. Large-scale simulations further demonstrate scalability to 200 clients for handwritten-digit recognition, with rapid convergence and a $75\%$ reduction in communication cost via model compression. Our work establishes a practical and scalable route to quantum-secure federated learning for the emerging quantum internet.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper presents QuNetQFL, a quantum federated learning protocol implemented on multi-user quantum networks in which local model updates are masked with distributed quantum secret keys to achieve information-theoretic security during aggregation. It reports experimental validation on a four-client quantum network, performance benchmarks on quantum and classical datasets (including multipartite entangled states and sentiment analysis via hybrid models), accuracy improvements from adding quantum clients, and large-scale simulations showing scalability to 200 clients with 75% communication cost reduction via model compression.
Significance. If the experimental security and accuracy claims hold under the deployed hardware, the work would provide a concrete demonstration of combining QKD-derived keys with federated learning on near-term quantum networks, addressing privacy in the quantum era. The four-client experiment and 200-client simulations offer practical benchmarks, though the absence of explicit device characterization limits the strength of the information-theoretic guarantee.
major comments (2)
- [Experimental validation and security analysis sections] The central claim of information-theoretic security (abstract and protocol description) rests on the distributed quantum keys remaining secure against classical and quantum adversaries, but the experimental section provides no device-independent security proof, no quantitative bounds on side-channel leakage from detectors/channels/timing, and no adversarial simulation for the specific 4-client setup; this assumption is load-bearing for the 'quantum-secure' validation.
- [Experimental methods and results] The abstract asserts 'experimentally validate the protocol' and reports performance numbers, yet the methods lack data-exclusion criteria, full hardware characterization (e.g., QKD error rates, key rates), and error-bar reporting on the generated keys used for masking, preventing verification that the measured accuracies and security properties are supported by the raw measurements.
minor comments (2)
- [Scalability simulations] The 75% communication cost reduction in the 200-client simulation should explicitly compare the compression technique against standard classical FL baselines and state the exact compression ratio used.
- [Protocol description] Notation for the hybrid classical-quantum language model and the masking operation with quantum keys could be clarified with an explicit equation in the protocol section.
Simulated Author's Rebuttal
We thank the referee for the constructive comments on the security analysis and experimental reporting. We address each major point below and have revised the manuscript to strengthen the presentation of assumptions and data details.
read point-by-point responses
-
Referee: [Experimental validation and security analysis sections] The central claim of information-theoretic security (abstract and protocol description) rests on the distributed quantum keys remaining secure against classical and quantum adversaries, but the experimental section provides no device-independent security proof, no quantitative bounds on side-channel leakage from detectors/channels/timing, and no adversarial simulation for the specific 4-client setup; this assumption is load-bearing for the 'quantum-secure' validation.
Authors: We agree that the work does not include a device-independent security proof or quantitative side-channel bounds, as the information-theoretic security claim relies on the standard composable security proofs of the underlying QKD protocol (BBM92) implemented in the network. The experimental focus is on protocol integration and performance rather than a new security characterization. We have added an explicit security model subsection referencing the QKD assumptions and noting that side-channel analysis and adversarial simulations for the 4-client setup are outside the current scope. revision: partial
-
Referee: [Experimental methods and results] The abstract asserts 'experimentally validate the protocol' and reports performance numbers, yet the methods lack data-exclusion criteria, full hardware characterization (e.g., QKD error rates, key rates), and error-bar reporting on the generated keys used for masking, preventing verification that the measured accuracies and security properties are supported by the raw measurements.
Authors: We accept this point. The revised manuscript now includes QKD error rates, secure key rates, and error bars on all performance metrics derived from the keys. We have also clarified that no data exclusion criteria were applied because all successfully generated keys from the four-client runs were used for masking. revision: yes
Circularity Check
No circularity: experimental protocol validation with no derivation chain
full rationale
The paper describes an experimental implementation and validation of the QuNetQFL protocol on a four-client quantum network, including benchmarks on quantum and real-world datasets plus large-scale simulations. No equations, predictions, or first-principles derivations are presented that reduce by construction to fitted inputs, self-definitions, or self-citation chains. Security claims rest on standard QKD assumptions rather than any internal mathematical reduction, and the work is framed as a practical demonstration rather than a theoretical derivation. This matches the default expectation of a non-circular experimental paper.
Axiom & Free-Parameter Ledger
Forward citations
Cited by 1 Pith paper
-
AdeptHEQ-FL: Adaptive Homomorphic Encryption for Federated Learning of Hybrid Classical-Quantum Models with Dynamic Layer Sparing
AdeptHEQ-FL integrates hybrid CNN-PQC models, adaptive homomorphic encryption, accuracy-weighted aggregation, and dynamic layer freezing in federated learning to gain accuracy on image datasets while lowering communic...
Reference graph
Works this paper leans on
-
[1]
Select the subset of clients’ indexesS t
-
[2]
For each client i∈St: a) Update the local model and compute the local up- date: ∆ θt i←θt i−θt−1. b) Perform an MDI QKD protocol (see Box 1) with each other connected clients in the S t in the underlying quantum networks, and generate masking vector: mt i← ∑ j∈St,j̸=i (−1)i>j·QKt i,j. c) Compute masked and quantized local update: ∆˜θt i← [ Qq(pt i·∆ θt i)...
-
[3]
Aggregate updates: ∆ θt← [∑ i∈St ∆˜θt i ] mod 2q
-
[4]
end for Output the trained global model parameters θT
Update global model: θt←θt−1 + Dq(∆ θt). end for Output the trained global model parameters θT . communication and quantum secret key costs. We experimentally validated this approach using a five-party quantum network, achieving quantum secret key generation with key rates exceeding 30 kbps in both 3-client and 4-client scenarios, underscoring the feasibi...
-
[5]
Randomly choose basis ( X or Y ) and prepare corresponding weak coherent states ⊗n k=1|eiφk√µ⟩, whereµis the pulse inten- sity
-
[6]
Send the states to an untrusted node, Eve, for measurement
-
[7]
Decide whether to flip the bit according to the measurement outcome
-
[8]
Estimate bit error rate by clients’ an- nouncements
-
[9]
Perform postprocessing steps (error cor- rection and privacy amplification) to gener- ate enough final secure keys. end for Note: Secret keys used in QuNetQFL can be generated during training or pre-generated to the overall process time. MDI QKD reduces the quantum resources required for client partici- pation, and QuNetQFL is flexible to emerging QKD tec...
- [10]
-
[11]
L.-P. Cen, J. Ji, J.-W. Lin, S.-T. Ju, H.-J. Lin, T.-P. Li, Y . Wang, J.-F. Yang, Y .-F. Liu, S. Tan,et al., Automatic detection of 39 fundus diseases and conditions in retinal photographs using deep neural networks, Nat. Commun. 12, 4828 (2021)
work page 2021
-
[12]
B. R. Kiran, I. Sobh, V . Talpaert, P. Mannion, A. A. Al Sallab, S. Yogamani, and P. Pérez, Deep reinforcement learning for autonomous driving: A survey, IEEE Trans. Intell. Transp. Syst. 23, 4909 (2021)
work page 2021
- [13]
- [14]
-
[15]
T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Ka- plan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sas- try, A. Askell, S. Agarwal, A. Herbert-V oss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. M. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D....
work page 2020
- [16]
-
[17]
Scaling Laws for Neural Language Models
J. Kaplan, S. McCandlish, T. Henighan, T. B. Brown, B. Chess, R. Child, S. Gray, A. Radford, J. Wu, and D. Amodei, Scaling laws for neural language models 11 (2020), arXiv:2001.08361 [cs.LG]
work page internal anchor Pith review Pith/arXiv arXiv 2020
-
[18]
D. Grishin, K. Obbad, and G. M. Church, Data privacy in the age of personal genomics, Nat. Biotechnol. 37, 1115 (2019)
work page 2019
-
[19]
W. N. Price and I. G. Cohen, Privacy in the age of medical big data, Nat. Med. 25, 37 (2019)
work page 2019
-
[20]
B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, Communication-Efficient Learning of Deep Networks from Decentralized Data, in Proceedings of the 20th International Conference on Artificial Intel- ligence and Statistics , Proceedings of Machine Learning Research, V ol. 54, edited by A. Singh and J. Zhu (PMLR,
-
[21]
Q. Yang, Y . Liu, T. Chen, and Y . Tong, Federated machine learning: Concept and applications, ACM Transactions on Intelligent Systems and Technology (TIST) 10, 1 (2019)
work page 2019
- [22]
-
[23]
Y . Zhao, J. Zhao, M. Yang, T. Wang, N. Wang, L. Lyu, D. Niyato, and K.-Y . Lam, Local differential privacy- based federated learning for internet of things, IEEE In- ternet Things J. 8, 8836 (2020)
work page 2020
-
[24]
L. Yang, B. Tan, V . W. Zheng, K. Chen, and Q. Yang, Federated recommendation systems, Federated Learning: Privacy and Incentive , 225 (2020)
work page 2020
-
[25]
J. Biamonte, P. Wittek, N. Pancotti, P. Rebentrost, N. Wiebe, and S. Lloyd, Quantum machine learning, Na- ture 549, 195 (2017)
work page 2017
- [26]
-
[27]
M.-G. Zhou, Z.-P. Liu, H.-L. Yin, C.-L. Li, T.-K. Xu, and Z.-B. Chen, Quantum neural network for quantum neural computing, Research 6, 0134 (2023)
work page 2023
- [28]
-
[29]
S. Y .-C. Chen and S. Yoo, Federated quantum machine learning, Entropy 23, 460 (2021)
work page 2021
-
[30]
A. S. Bhatia, S. Kais, and M. A. Alam, Federated quan- volutional neural network: a new paradigm for collabora- tive quantum learning, Quantum Sci. Technol. 8, 045032 (2023)
work page 2023
-
[31]
Zhao, Non-iid quantum federated learning with one- shot communication complexity, Quantum Mach
H. Zhao, Non-iid quantum federated learning with one- shot communication complexity, Quantum Mach. Intell. 5, 3 (2023)
work page 2023
- [32]
-
[33]
Preskill, Quantum computing in the nisq era and be- yond, Quantum 2, 79 (2018)
J. Preskill, Quantum computing in the nisq era and be- yond, Quantum 2, 79 (2018)
work page 2018
-
[34]
V . Mothukuri, R. M. Parizi, S. Pouriyeh, Y . Huang, A. De- hghantanha, and G. Srivastava, A survey on security and privacy of federated learning, Future Gener. Comput. Syst. 115, 619 (2021)
work page 2021
- [35]
-
[36]
C. Li, N. Kumar, Z. Song, S. Chakrabarti, and M. Pistoia, Privacy-preserving quantum federated learning via gradi- ent hiding, Quantum Sci. Technol. 9, 035028 (2024)
work page 2024
-
[37]
W. Li and D.-L. Deng, Quantum delegated and federated learning via quantum homomorphic encryption (2024), arXiv:2409.19359 [quant-ph]
-
[38]
C. Li, B. Li, O. Amer, R. Shaydulin, S. Chakrabarti, G. Wang, H. Xu, H. Tang, I. Schoch, N. Kumar, et al., Blind quantum machine learning with quantum bipartite correlator, Phys. Rev. Lett.133, 120602 (2024)
work page 2024
-
[39]
W. Li, S. Lu, and D.-L. Deng, Quantum federated learn- ing through blind quantum computing, Sci. China Phys., Mech. Astron. 64, 100312 (2021)
work page 2021
- [40]
-
[41]
H.-L. Yin, Y . Fu, C.-L. Li, C.-X. Weng, B.-H. Li, J. Gu, Y .-S. Lu, S. Huang, and Z.-B. Chen, Experimental quan- tum secure network with digital signatures and encryp- tion, Natl. Sci. Rev. 10, nwac228 (2023)
work page 2023
- [42]
-
[43]
S. Hermans, M. Pompili, H. Beukers, S. Baier, J. Borre- gaard, and R. Hanson, Qubit teleportation between non- neighbouring nodes in a quantum network, Nature 605, 663 (2022)
work page 2022
-
[44]
X. Jing, C. Qian, C.-X. Weng, B.-H. Li, Z. Chen, C.- Q. Wang, J. Tang, X.-W. Gu, Y .-C. Kong, T.-S. Chen, et al., Experimental quantum byzantine agreement on a three-user quantum network with integrated photonics, Sci. Adv. 10, eadp2877 (2024)
work page 2024
-
[45]
P. Schiansky, J. Kalb, E. Sztatecsny, M.-C. Roehsner, T. Guggemos, A. Trenti, M. Bozzio, and P. Walther, Demonstration of quantum-digital payments, Nat. Com- mun. 14, 3849 (2023)
work page 2023
- [46]
- [47]
-
[48]
H.-K. Lo, M. Curty, and B. Qi, Measurement-device- independent quantum key distribution, Phys. Rev. Lett. 108, 130503 (2012)
work page 2012
-
[49]
M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate–distance limit of quantum key dis- tribution without quantum repeaters, Nature 557, 400 (2018)
work page 2018
-
[50]
Y .-M. Xie, Y .-S. Lu, C.-X. Weng, X.-Y . Cao, Z.-Y . Jia, Y . Bao, Y . Wang, Y . Fu, H.-L. Yin, and Z.-B. Chen, Break- ing the rate-loss bound of quantum key distribution with asynchronous two-photon interference, PRX Quantum 3, 020315 (2022)
work page 2022
-
[51]
S. Wang, Z.-Q. Yin, D.-Y . He, W. Chen, R.-Q. Wang, P. Ye, Y . Zhou, G.-J. Fan-Yuan, F.-X. Wang, W. Chen, et al., Twin-field quantum key distribution over 830-km fibre, Nat. Photonics 16, 154 (2022)
work page 2022
- [52]
-
[53]
L. Zhou, J. Lin, Y .-M. Xie, Y .-S. Lu, Y . Jing, H.-L. Yin, and Z. Yuan, Experimental quantum communication over- comes the rate-loss limit without global phase tracking, Phys. Rev. Lett. 130, 250801 (2023)
work page 2023
- [54]
-
[55]
M. Chehimi, S. Y .-C. Chen, W. Saad, D. Towsley, and M. Debbah, Foundations of quantum federated learn- ing over classical and quantum networks, IEEE Network (2023)
work page 2023
- [56]
-
[57]
Y . Aono, T. Hayashi, L. Wang, S. Moriai, et al., Privacy- preserving deep learning via additively homomorphic en- cryption, IEEE Trans. Inf. Forensics Secur. 13, 1333 (2017)
work page 2017
- [58]
- [59]
-
[60]
Practical Secure Aggregation for Federated Learning on User-Held Data
K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, Practical secure aggregation for federated learning on user-held data (2016), arXiv:1611.04482 [cs.CR]
work page internal anchor Pith review Pith/arXiv arXiv 2016
- [61]
-
[62]
K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, Practical secure aggregation for privacy-preserving ma- chine learning, in proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (2017) pp. 1175–1191
work page 2017
- [63]
-
[64]
J.-H. Cao, F. Chen, Q. Liu, T.-W. Mao, W.-X. Xu, L.-N. Wu, and L. You, Detection of entangled states supported by reinforcement learning, Phys. Rev. Lett. 131, 073201 (2023)
work page 2023
-
[65]
C. Zhu, Z. Liu, C. Zhu, and X. Wang, Limitations of classically simulable measurements for quantum state dis- crimination, Phys. Rev. Lett. 133 (2024)
work page 2024
- [66]
-
[67]
A. Kandala, A. Mezzacapo, K. Temme, M. Takita, M. Brink, J. M. Chow, and J. M. Gambetta, Hardware- efficient variational quantum eigensolver for small molecules and quantum magnets, Nature549, 242 (2017)
work page 2017
- [68]
-
[69]
PennyLane: Automatic differentiation of hybrid quantum-classical computations
V . Bergholm, J. Izaac, M. Schuld, C. Gogolin, S. Ahmed, V . Ajith, M. S. Alam, G. Alonso-Linaje, B. Akash- Narayanan, A. Asadi, J. M. Arrazola, U. Azad, S. Ban- ning, C. Blank, T. R. Bromley, B. A. Cordier, J. Ceroni, A. Delgado, O. D. Matteo, A. Dusko, T. Garg, D. Guala, A. Hayes, R. Hill, A. Ijaz, T. Isacsson, D. Ittah, S. Ja- hangiri, P. Jain, E. Jian...
work page internal anchor Pith review Pith/arXiv arXiv 2022
- [70]
-
[71]
J. Liu, M. Liu, J.-P. Liu, Z. Ye, Y . Wang, Y . Alexeev, J. Eisert, and L. Jiang, Towards provably efficient quan- tum algorithms for large-scale machine-learning models, Nat. Commun. 15, 434 (2024)
work page 2024
- [72]
-
[73]
Kato, Concentration inequality using unconfirmed knowledge, arXiv preprint arXiv:2002.04357 (2020)
G. Kato, Concentration inequality using unconfirmed knowledge, arXiv preprint arXiv:2002.04357 (2020)
-
[74]
J. Martinez-Mateo, D. Elkouss, and V . Martin, Key recon- ciliation for high performance quantum key distribution, Sci. Rep. 3, 1576 (2013)
work page 2013
-
[75]
C. Ye, S. Mathur, A. Reznik, Y . Shah, W. Trappe, and N. B. Mandayam, Information-theoretically secret key generation for fading wireless channels, IEEE Trans. Inf. Forensics Secur. 5, 240 (2010)
work page 2010
- [76]
- [77]
-
[78]
L. Schatzki, A. Arrasmith, P. J. Coles, and M. Cerezo, Entangled datasets for quantum machine learning (2021), arXiv:2109.03400 [quant-ph]
-
[79]
Application of a resource theory for magic states to fault-tolerant quantum computing
M. Howard and E. Campbell, Application of a Resource Theory for Magic States to Fault-Tolerant Quantum Com- puting, Phys. Rev. Lett. 118 (2017), 1609.07488
work page internal anchor Pith review Pith/arXiv arXiv 2017
-
[80]
X. Wang, M. M. Wilde, and Y . Su, Quantifying the magic of quantum channels, New J. Phys. 21, 103002 (2019)
work page 2019
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.