Federating Quantum and Classical Computing: A Privacy-Preserving Hybrid Approach

Carlos Cano; Daniel M. Jimenez-Gutierrez; Diego Sal; Georgios Kellaris; Joaquin del Rio; Oleksii Sliusarenko; Xabi Uribe-Etxebarria

cs.LGSep 18, 2026

Federating Quantum and Classical Computing: A Privacy-Preserving Hybrid Approach

Authors: Carlos Cano, Daniel M. Jimenez-Gutierrez, Diego Sal, Georgios Kellaris, Joaquin del Rio, Oleksii Sliusarenko, Xabi Uribe-Etxebarria

Abstract

Quantum machine learning (QML) is increasingly recognized as one of the most promising near-term applications of quantum computing, viewed as a next-frontier candidate beyond purely classical approaches. Hybrid quantum-classical models operationalize this potential by embedding a parameterized quantum circuit within a model where all other components remain classical-a design already applied to chemistry simulation, financial modeling, and image classification. However, their deployment in privacy-sensitive, multi-party settings is constrained by the need to avoid centralizing raw data and by the requirement that modern quantum circuits remain parameter-efficient to stay trainable at scale. In this paper, we address these constraints by evaluating federated learning (FL) as a means of combining a hybrid quantum-classical active party with a classical passive party, using Sherpa.ai's Blind Vertical FL (SBVFL) protocol to avoid centralizing raw data, while drastically reducing communication. We construct the split multiplicative periodic parity (SMPP) benchmark, following common QML design practice. On this task, our simulations show that SBVFL raises accuracy from 0.7227 to 0.8757 compared to local training, closely approaching non-private centralized accuracy, and that the hybrid quantum-classical model achieves this with substantially fewer trainable parameters than the classical neural networks and random forest alternatives. These results show that FL enables high-performing, privacy-preserving quantum-classical collaboration without centralizing raw data.

Figures & tables

Figure 1: Overview of the FL setup showing the single-party and federated model performance.

Dimension	This work (SBVFL)	[ 3 ]	[ 12 ]
Party capability	Heterogeneous (1 hybrid quantum-classical, 1 classical)	Homogeneous (all quantum)	Homogeneous (all quantum)
Inter-party channel	Classical (encoded outputs)	Classical (intermediate outputs)	Quantum (teleportation)
Explicit privacy mechanism	Label blinding + privacy multiplier	Structural (private local models)	Evidential fusion
Hardware requirement	Simulator; compatible with a corresponding real QPU	Simulator (NISQ-oriented design)	Requires quantum teleportation channel
Validation domain	SMPP, a tabular benchmark with multiplicative periodic structure	Handwritten-digit image classification	Image classification

Table 1: Comparison with the two closest vertical QFL schemes.

Figure 2: Architecture of the Centralized baseline.

Figure 3: Scheme for the VFL experiment with the FL Platform.

Figure 4: The SMPP task: the two half-signals and the label.

Panel of Figure 5 — Figure 5: The quantum layer of the centralized model.

Scenario	Metric	Hybrid quantum-classical	Classical network	Random forest
Local baseline, active party ( $x_{1},x_{2}$ )	Accuracy	0.7227 (0.0021)	0.7223 (0.0016)	0.6895 (0.0011)
Local baseline, active party ( $x_{1},x_{2}$ )	Parameters	10	41	207,736 nodes
SBVFL	Accuracy	0.8757 (0.0001)	0.8623 (0.0017)	0.8065 (0.0009)
SBVFL	Parameters	12	1002	673,276 nodes
Centralized, both parties ( $x_{1},\dots,x_{4}$ )	Accuracy	0.9216 (0.0056)	0.8663 (0.0068)	0.8462 (0.0011)
Centralized, both parties ( $x_{1},\dots,x_{4}$ )	Parameters	19	1201	140,741 nodes

Table 2: Test accuracy (mean, with standard deviation in parentheses) and trainable-parameter count in the three training scenarios. The random forest’s size is reported as its total number of tree nodes rather than a trainable-parameter count, since it has no trainable parameters in the usual sense.

Figure 6: Mean test accuracy of the three model families in the three scenarios.

Figure 7: Mean test accuracy as a function of the privacy multiplier

Q

, with error bars denoting standard deviation across seeds.

Explore similar work

Encryptability As a Coordinate Choice: Depth-One Homomorphic Federated Learning of Quantum Neural Networks
Sep 24, 2026Marcel Mordarski, Nathan Mani, Arshad Patel +2Privacy-Preserving ML Federated Learning
Department of Computing, Imperial College London London SW7 2AZ, United Kingdom
Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access
Sep 4, 2026Liou Tang, James Joshi, Ashish KunduMembership Inference Attacks Quantum Machine Learning
University of Pittsburgh, Pittsburgh, PA, USA · Cisco Research, San Jose, CA, USA
QFedAgent: Quantum-Enhanced Personalized Federated Learning for Multi-Agent Activity Recognition
Jul 2, 2026Quoc Bao Phan, Tuy Tan NguyenMultimodal Federated Learning Human Activity Recognition
Department of Electrical and Computer Engineering FAMU-FSU College of Engineering, Florida State University Tallahassee, FL 32310, USA

Sep 24, 2026, quant-phJ/K move · Enter open · S save

Encryptability As a Coordinate Choice: Depth-One Homomorphic Federated Learning of Quantum Neural Networks

Marcel Mordarski, Nathan Mani, Arshad Patel, William Knottenbelt+1

Department of Computing, Imperial College London London SW7 2AZ, United Kingdom

Privacy-Preserving ML Federated Learning Homomorphic Encryption Quantum Neural Networks Hybrid Quantum-Classical ML

Open paper AskPDF arXiv

Encrypted training relies on keeping server-side updates low-degree. This constraint traditionally excludes models whose weights inhabit a compact Lie group (notably variational quantum circuits, where every trainable weight is an

\mathrm{SU(2)}

rotation). Expressed in Euler angles or discrete alphabets, these updates appear transcendental, historically demanding prohibitive costs: one client--server round per gate, or upwards of

25{,}000

operations per weight. This penalty is strictly an artefact of coordinates. In the unit-quaternion (spin) chart, group composition is exactly bilinear (degree two, with coefficients in

\{-1,0,+1\}

). Consequently, encrypted rotation updates cost one multiplicative level and federated averaging costs zero in any levelled homomorphic scheme, completely eliminating bootstrapping. This implementation-independent algebraic property is confirmed across two cryptographic backends, introducing only

0.0

and

-2.0\times10^{-12}

rad of aggregation error. Leveraging this reduction yields a non-interactive protocol for encrypted federated training of hybrid quantum--classical networks. It includes correctness proofs for aggregation and sign handling, plus a compilation lemma proving parameterised entanglers add only constant-factor overhead without altering the depth class. Empirically, a paired five-seed study confirms zero measurable utility tax (

Δ=+9\times10^{-6}

MSE,

p=0.92

), and a noise-budget ablation falsifies the hypothesis that encryption noise regularises. These convergence trends replicate across datasets and scale to

20

clients. Finally, hardware validation on a

156

-qubit processor achieves

0.9918

fidelity against a

0.99957

unencrypted control.

Abstract

Explore similar work

Encryptability As a Coordinate Choice: Depth-One Homomorphic Federated Learning of Quantum Neural Networks

Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access

QFedAgent: Quantum-Enhanced Personalized Federated Learning for Multi-Agent Activity Recognition