Encrypted training relies on keeping server-side updates low-degree. This constraint traditionally excludes models whose weights inhabit a compact Lie group (notably variational quantum circuits, where every trainable weight is an SU(2) rotation). Expressed in Euler angles or discrete alphabets, these updates appear transcendental, historically demanding prohibitive costs: one client--server round per gate, or upwards of 25,000 operations per weight. This penalty is strictly an artefact of coordinates. In the unit-quaternion (spin) chart, group composition is exactly bilinear (degree two, with coefficients in {−1,0,+1}). Consequently, encrypted rotation updates cost one multiplicative level and federated averaging costs zero in any levelled homomorphic scheme, completely eliminating bootstrapping. This implementation-independent algebraic property is confirmed across two cryptographic backends, introducing only 0.0 and −2.0×10−12 rad of aggregation error. Leveraging this reduction yields a non-interactive protocol for encrypted federated training of hybrid quantum--classical networks. It includes correctness proofs for aggregation and sign handling, plus a compilation lemma proving parameterised entanglers add only constant-factor overhead without altering the depth class. Empirically, a paired five-seed study confirms zero measurable utility tax (Δ=+9×10−6 MSE, p=0.92), and a noise-budget ablation falsifies the hypothesis that encryption noise regularises. These convergence trends replicate across datasets and scale to 20 clients. Finally, hardware validation on a 156-qubit processor achieves 0.9918 fidelity against a 0.99957 unencrypted control.
Figures & tables
Figure 1
Figure 2: One federated round. Clients train in the clear, encode each trainable angle as a unit quaternion (Eq. 2 ) and encrypt its four components under keys shared among clients. The server applies plaintext rotations at one multiplicative level and the weighted FedAvg sum at zero, never decrypting; clients decrypt, renormalise and recover angles by atan2 . The Pauli-OTP detour is entered only on the delegated execution track (Lemma 2 ).
Table 3
Appendix figures & tables14 assets
Supplementary material from the paper’s appendix.
Appendix
σ (rad)
Exact bias (rad)
Prediction (rad)
Correlation
Encryption floor (rad)
0.05
2.4956×10−6
2.4949×10−6
1.0000
1.1705×10−4
0.20
1.4067×10−4
1.4014×10−4
1.0000
2.0381×10−4
0.50
2.1721×10−3
2.1126×10−3
0.9999
2.1764×10−3
1.00
1.7974×10−2
1.6236×10−2
0.9991
1.7996×10−2
Appendix
Table 3: Aggregation-geometry sweep. The cubic bound tracks the realised bias across two orders of magnitude of client dispersion, and the bias is below the encryption noise floor throughout.
Figure 3: The three load-bearing measurements. (a) With initialisation and batch order held identical, encrypted and plaintext arms are indistinguishable. (b) Weighted FedAvg adds no error beyond per-client encoding on either backend. (c) The realised aggregation bias is predicted by Eq. 3 and sits below the encryption noise floor throughout.
Arm
Final MSE
Paired Δ (95% CI)
Paired t / Wilcoxon
Plaintext
1.3436±0.7228
–
–
Encrypted, 12-bit
1.3436±0.7229
+9.0×10−6[−2.3,+2.5]×10−4
p=0.923 / p=0.625
Encrypted, 8-bit ( 16× noise)
1.3442±0.7230
+6.0×10−4[−2.6,+3.8]×10−3
p=0.636 / p=1.0
Appendix
Table 4: Utility under encryption. Five paired seeds, five federated rounds, three clients; final validation MSE (mean ± s.d.). Pairing verified: maximum round-0 gap =0.00×100 across all seeds. Rows 1–2 isolate the encryption effect; rows 2–3 the noise-budget effect.
Backend
Single client
Post-FedAvg
Aggregation overhead
Fixed-point multi-key (12-bit)
1.5632×10−4
1.5632×10−4
0.0
OpenFHE CKKS (50-bit modulus)
4.7573×10−12
2.7484×10−12
−2.0×10−12
Appendix
Table 5: Depth-0 aggregation is exact on both backends. The difference between the two middle columns is the overhead Proposition 1 (iii) predicts to be zero. Float64 decode, three clients, 36 angles, radians; precision sweep in Table 6 .
Multi-key, precision bits
8
10
12
14
Angle MAE (rad)
2.31×10−3
6.11×10−4
1.52×10−4
3.91×10−5
CKKS, scaling modulus
30
40
50
–
Angle MAE (rad)
3.39×10−6
5.27×10−9
4.58×10−12
–
Appendix
Table 6: Encryption noise budget as a function of the precision knob, float64 decode, 50 repetitions per point. Angle MAE in radians.
Figure 4: E4: recovered versus true θ for RZZ(θ) through the encrypted pipeline, with the shot-noise band. The encrypted entangler adds no angle error resolvable at 4096 shots.
Figure 5: E5: 8 -bit versus 12 -bit encrypted arms, paired by seed. A 16× increase in quantisation noise produces no detectable change in final loss.
Clients K
Rounds
Dataset
3
5
10
20
20
35
50
California Housing
1.3035
1.3166
1.3583
1.3763
1.2285
1.1395
1.0831
±0.614
±0.633
±0.659
±0.670
±0.541
±0.444
±0.374
Wine Quality
1.4214
1.4641
1.5034
1.5246
1.3148
1.1963
1.1275
±0.242
±0.249
±0.254
±0.255
±0.205
±0.141
±0.095
Appendix
Table 7: Cross-dataset scale study, final validation MSE (mean ± s.d. over five seeds), secure stack at 12 -bit precision. Client scaling at 10 federated rounds; horizon sweep at three clients.
Precision bits
8
10
12
14
Ciphertext size
100.0 KB
125.0 KB
150.0 KB
175.0 KB
Angle MAE (rad)
2.600×10−3
6.585×10−4
1.676×10−4
4.051×10−5
Total traffic
4,375 MB
5,430 MB
6,485 MB
7,539 MB
Appendix
Table 8: Precision, ciphertext size, reconstruction error and total protocol traffic over a 50 -round, three-client schedule. Traffic and ciphertext size are dataset-independent by construction and reproduce identically on both datasets. Angle MAE here is measured on 256 probe angles; the independent float64 measurement of Table 2 gives 1.52×10−4 at 12 bits, consistent within the probe-set difference.
Figure 6: E6: client scaling replicates on an unrelated dataset, with no aggregation blow-up at 20 clients.
Figure 14
Link
This protocol (payload time)
Interactive baselines (latency floor)
1 Gbps, 50 ms RTT
0.36 s
1.9 – 3.7 s
100 Mbps, 50 ms RTT
3.6 s
1.9 – 3.7 s
10 Mbps, 50 ms RTT
36 s
1.9 – 3.7 s
any link, 1 ms RTT
as above
0.04 – 0.07 s
Appendix
Table 9: Where non-interactivity pays. Left: time to move this protocol’s 45.3 MB per federated round. Right: the latency floor of interactive baselines at 37 – 73 sequential exchanges, before any payload moves.
Party
Observes
Does not obtain
Cloud QPU
Quaternion-masked states
The underlying state. Masking is information-theoretic with per-client, per-use keys removed by their owner.
Aggregation server
Ciphertexts, message sizes, client weights nk/n
Any plaintext. Decryption raises an error by construction.
Peer client
The decrypted global aggregate
Nothing further by protocol ; under the shared-key model a peer holding another’s ciphertext could decrypt it, the standard shared-key FHE-FedAvg assumption.
Network adversary
Authenticated ciphertext traffic
Plaintexts; undetected tampering.
Appendix
Table 10: Threat model. Decryption capability is shared across clients and withheld from the server (the aggregation object exposes only add, scale and serialise). Threshold key generation is the drop-in hardening for the peer row; see Appendix J .
Figure 9: End-to-end implementation flow for the quaternion track.
Quantum machine learning (QML) is increasingly recognized as one of the most promising near-term applications of quantum computing, viewed as a next-frontier candidate beyond purely classical approaches. Hybrid quantum-classical models operationalize this potential by embedding a parameterized quantum circuit within a model where all other components remain classical-a design already applied to chemistry simulation, financial modeling, and image classification. However, their deployment in privacy-sensitive, multi-party settings is constrained by the need to avoid centralizing raw data and by the requirement that modern quantum circuits remain parameter-efficient to stay trainable at scale. In this paper, we address these constraints by evaluating federated learning (FL) as a means of combining a hybrid quantum-classical active party with a classical passive party, using Sherpa.ai's Blind Vertical FL (SBVFL) protocol to avoid centralizing raw data, while drastically reducing communication. We construct the split multiplicative periodic parity (SMPP) benchmark, following common QML design practice. On this task, our simulations show that SBVFL raises accuracy from 0.7227 to 0.8757 compared to local training, closely approaching non-private centralized accuracy, and that the hybrid quantum-classical model achieves this with substantially fewer trainable parameters than the classical neural networks and random forest alternatives. These results show that FL enables high-performing, privacy-preserving quantum-classical collaboration without centralizing raw data.
Carlos Cano, Daniel M. Jimenez-Gutierrez, Diego Sal +4
Quantum Federated Learning (QFL) offers a promising framework to train quantum models across distributed clients while keeping data strictly local. Due to its simplicity and low communication overhead, Federated Averaging (FedAvg) is the standard aggregation choice in QFL literature. However, deploying QFL on practical hardware exposes a severe double-drift phenomenon: the global model is simultaneously derailed by client drift from non-IID data and hardware bias from noisy quantum gradient estimates. In this work, we first analyze the convergence of FedAvg under these realistic conditions, mathematically demonstrating that quantum hardware bias creates a persistent error floor that standard averaging cannot correct. To overcome this limitation, we propose Q-ANCHOR, a quantum-aware federated aggregation architecture that anchors server updates with zero-noise extrapolation while applying stateful client correction to suppress both client drift and hardware-induced bias. Our convergence theory proves that Q-ANCHOR successfully mitigates classical client drift while actively reducing the hardware-bias floor. Experimental results demonstrate that Q-ANCHOR achieves significantly more stable training than conventional FL baselines.
Hoang M. Ngo, Quan Nguyen, Wanli Xing +1
Department of Computer & Information Science & Engineering University of Florida · Frost Institute for Data Science and Computing University of Miami
Federated Learning (FL) trains a global model across decentralized clients while preserving data privacy, but at scale it is vulnerable to malicious updates. Byzantine-resilient aggregation methods such as MultiKrum score gradients against their nearest neighbors and can miss malicious updates that preserve the statistical properties of honest ones. We propose a quantum annealing approach that reformulates client selection as a Quadratic Unconstrained Binary Optimization (QUBO) problem, encoding pairwise distances into a cost function solved by quantum annealers (QA). Unlike MultiKrum's greedy per-client scoring, the QUBO formulation jointly optimizes over all subsets to find the mutually closest group of m clients. At small scale (15 clients), QUBO outperforms MultiKrum on the most challenging Byzantine attacks: e.g., Advanced LIE is detected with 95.11% accuracy versus 81.33% on MNIST and 97.78% versus 75.56% on CIFAR-10. QUBO fares poorly on simpler attacks where MultiKrum excels, so the two methods are complementary. QUBO quality also degrades as the number of clients grows. To address this, we introduce a MultiSignal ensemble that uses a dual-feature routing gate based on Euclidean and cosine Krum score gaps to classify attacks into four regimes and routes evasion attacks to a suspicion-penalized QUBO with agreement voting. At 100 clients on MNIST, MultiSignal achieves 95.3% average detection accuracy versus 91.8% for classical MultiKrum, with the largest gains on Sparse Lie (72.0% to 95.2%, +23.2 points) and Advanced Lie (80.4% to 85.2%, +4.8 points). These results show that QUBO-based quantum annealing with MultiSignal is a principled and scalable defense against the most challenging Byzantine strategies in federated learning.
Andras Ferenczi, Sutapa Samanta, Dagen Wang +1
American Express Co · American Express Co. · Columbia University