Distributed Quantum Learning over Near-term Devices: Convergence Analysis and Security Design
Authors: Atit Pokharel, Shaba Shaon, Thomas Morris, Dinh C. Nguyen
Abstract
Distributed quantum learning (DQL) has emerged as a promising paradigm to scale quantum-enhanced machine learning by interconnecting multiple quantum devices. However, for efficient real-world deployment, it is essential to characterize how DQL converges under practical scenarios while simultaneously safeguarding multi-device quantum infrastructures from evolving security threats. Addressing these aspects in an integrated manner is key to ensuring both performance and resilience in large-scale DQL systems. Therefore, this paper presents a new DQL study where our innovation lies in: (i) conducting a holistic convergence analysis for DQL under practical settings, i.e., partial device participation, non-convex loss functions, and heterogeneous data distributions, (ii) developing a novel multi-layered post-quantum cryptographic architecture with a quantum neural network-powered adaptive mechanism that monitors conditions, evaluates threats, and adjusts parameters across three National Institute of Standards and Technology (NIST)-compliant levels. Our theoretical framework and empirical validation reveal two key insights: (i) the derived convergence bound uncovers a fundamental trade-off between convergence rate, measurement shots, and the size of the participating device subset; and (ii) findings from our evaluations on a physical testbed modeling quantum control architectures expose the performance limitations of static post-quantum security, while confirming that our adaptive framework effectively mitigates these overheads to preserve overall system efficiency. Specifically, the hardware experiments demonstrate that our dynamic security mechanism reduces total security execution time by approximately 49% relative to static high-security baselines, while maintaining a threat detection accuracy of over 91%. Furthermore, extensive simulations validate our theoretical analysis.....
Machine learning models have scaled to unprecedented sizes, making training across distributed devices the de facto standard in the field. In this work, we explore how quantum communications can make distributed training both more communication-efficient and information-theoretically private, for both classical and quantum learning models. Ring all-reduce is the foundational communication primitive for large-scale distributed training. We present a quantum version that reduces per-link online communication by a provably optimal factor of two using pre-shared entanglement and superdense coding, without requiring the learning model or gradient computation to change. Beyond bandwidth, the primitive enables privacy guarantees that are information-theoretically impossible for any classical protocol, achieving composable ε-secure aggregation, via verified entanglement, at a 2x overhead in GHZ copies. Our hybrid quantum-classical communication architecture yields simultaneous communication and security advantages for large scale distributed training, regardless of whether the learning itself is quantum or classical. Finally, we characterise quantum advantages in gradient conflict detection for server-to-client communication under bandwidth constraints, a setting that arises after ring all-reduce is completed, when full gradient broadcast to external clients is infeasible. Two variants of the problem admit different separations. For margin-based alignment testing (\textsc{GapIP}_τ), the quantum advantage is quadratic in the margin parameter: \widetilde{O}(τ^{-1}\log P) qubits versus \widetilde{O}(\min(\τ^{-2},P)) bits. For sign-consistency auditing against a private parameter matching (\textsc{TieAudit}_ε), the advantage represents an exponential separation in communication complexity: Ω(\sqrt{P}) bits whereas O(ε^{-2}\log P) qubits suffice.
The potential capabilities of quantum computers motivated the development of cryptographic protocols suitable for securing communication against adversaries with access to large fault-tolerant quantum computers. However, even though current quantum computers are limited in terms of size and precision, they can still be useful for finding loopholes and weaknesses in the post-quantum cryptographic protocols. In this work, we present an attempt to utilize the capabilities of Quantum Generative Adversarial Networks (QGANs), one of the promising architectures used in quantum machine learning, for this purpose. We describe an example application of QGAN architecture for the purpose of loading the probability distribution of the hash-based digital signatures into the memory of a quantum computer. Our results confirm that near-term hybrid quantum-classical methods possess capabilities required for this purpose. The presented approach can be used as a first step in the workflow, enabling the utilization of quantum computing for attacking post-quantum cryptographic primitives.
Quantum Federated Learning (QFL) inherits the core vulnerability of federated optimization to malicious clients, while also introducing an attack surface from variational circuit training and measurement-driven gradients. This work proposes a novel CircUit-Level backdoor Threat (CULT) model that formalizes four stealthy attacks by exploiting quantum-aware mechanisms, including Grover, Pauli, Bit-flip, and Sign-flip. By enabling malicious clients on both in-training and post-training surfaces, these attacks can critically undermine the learning process. We establish a rigorous theoretical foundation to demonstrate attack stealthiness under standard smoothness assumptions. Experiments on the MNIST and CIFAR-10 datasets with non-IID splits and varying fractions of malicious clients show that even a single malicious client can induce severe accuracy degradation under FedAvg aggregation. While popular defenses, including Krum, Multi-Krum, FoolsGold, FLGuardian, and Mud-HoG, reduce degradation in many regimes, they fail to eliminate worst-case failure cases, where accuracy drops up to 50%. The experimental analysis further reveals that under the CULT model, malicious updates effectively mask their presence by staying close to benign norms, thereby helping attackers evade detection.