Encrypted training relies on keeping server-side updates low-degree. This constraint traditionally excludes models whose weights inhabit a compact Lie group (notably variational quantum circuits, where every trainable weight is an SU(2) rotation). Expressed in Euler angles or discrete alphabets, these updates appear transcendental, historically demanding prohibitive costs: one client--server round per gate, or upwards of 25,000 operations per weight. This penalty is strictly an artefact of coordinates. In the unit-quaternion (spin) chart, group composition is exactly bilinear (degree two, with coefficients in {−1,0,+1}). Consequently, encrypted rotation updates cost one multiplicative level and federated averaging costs zero in any levelled homomorphic scheme, completely eliminating bootstrapping. This implementation-independent algebraic property is confirmed across two cryptographic backends, introducing only 0.0 and −2.0×10−12 rad of aggregation error. Leveraging this reduction yields a non-interactive protocol for encrypted federated training of hybrid quantum--classical networks. It includes correctness proofs for aggregation and sign handling, plus a compilation lemma proving parameterised entanglers add only constant-factor overhead without altering the depth class. Empirically, a paired five-seed study confirms zero measurable utility tax (Δ=+9×10−6 MSE, p=0.92), and a noise-budget ablation falsifies the hypothesis that encryption noise regularises. These convergence trends replicate across datasets and scale to 20 clients. Finally, hardware validation on a 156-qubit processor achieves 0.9918 fidelity against a 0.99957 unencrypted control.
Figures & tables
Figure 1
Figure 2: One federated round. Clients train in the clear, encode each trainable angle as a unit quaternion (Eq. 2 ) and encrypt its four components under keys shared among clients. The server applies plaintext rotations at one multiplicative level and the weighted FedAvg sum at zero, never decrypting; clients decrypt, renormalise and recover angles by atan2 . The Pauli-OTP detour is entered only on the delegated execution track (Lemma 2 ).
Table 3
Appendix figures & tables14 assets
Supplementary material from the paper’s appendix.
Appendix
σ (rad)
Exact bias (rad)
Prediction (rad)
Correlation
Encryption floor (rad)
0.05
2.4956×10−6
2.4949×10−6
1.0000
1.1705×10−4
0.20
1.4067×10−4
1.4014×10−4
1.0000
2.0381×10−4
0.50
2.1721×10−3
2.1126×10−3
0.9999
2.1764×10−3
1.00
1.7974×10−2
1.6236×10−2
0.9991
1.7996×10−2
Appendix
Table 3: Aggregation-geometry sweep. The cubic bound tracks the realised bias across two orders of magnitude of client dispersion, and the bias is below the encryption noise floor throughout.
Figure 3: The three load-bearing measurements. (a) With initialisation and batch order held identical, encrypted and plaintext arms are indistinguishable. (b) Weighted FedAvg adds no error beyond per-client encoding on either backend. (c) The realised aggregation bias is predicted by Eq. 3 and sits below the encryption noise floor throughout.
Arm
Final MSE
Paired Δ (95% CI)
Paired t / Wilcoxon
Plaintext
1.3436±0.7228
–
–
Encrypted, 12-bit
1.3436±0.7229
+9.0×10−6[−2.3,+2.5]×10−4
p=0.923 / p=0.625
Encrypted, 8-bit ( 16× noise)
1.3442±0.7230
+6.0×10−4[−2.6,+3.8]×10−3
p=0.636 / p=1.0
Appendix
Table 4: Utility under encryption. Five paired seeds, five federated rounds, three clients; final validation MSE (mean ± s.d.). Pairing verified: maximum round-0 gap =0.00×100 across all seeds. Rows 1–2 isolate the encryption effect; rows 2–3 the noise-budget effect.
Backend
Single client
Post-FedAvg
Aggregation overhead
Fixed-point multi-key (12-bit)
1.5632×10−4
1.5632×10−4
0.0
OpenFHE CKKS (50-bit modulus)
4.7573×10−12
2.7484×10−12
−2.0×10−12
Appendix
Table 5: Depth-0 aggregation is exact on both backends. The difference between the two middle columns is the overhead Proposition 1 (iii) predicts to be zero. Float64 decode, three clients, 36 angles, radians; precision sweep in Table 6 .
Multi-key, precision bits
8
10
12
14
Angle MAE (rad)
2.31×10−3
6.11×10−4
1.52×10−4
3.91×10−5
CKKS, scaling modulus
30
40
50
–
Angle MAE (rad)
3.39×10−6
5.27×10−9
4.58×10−12
–
Appendix
Table 6: Encryption noise budget as a function of the precision knob, float64 decode, 50 repetitions per point. Angle MAE in radians.
Figure 4: E4: recovered versus true θ for RZZ(θ) through the encrypted pipeline, with the shot-noise band. The encrypted entangler adds no angle error resolvable at 4096 shots.
Figure 5: E5: 8 -bit versus 12 -bit encrypted arms, paired by seed. A 16× increase in quantisation noise produces no detectable change in final loss.
Clients K
Rounds
Dataset
3
5
10
20
20
35
50
California Housing
1.3035
1.3166
1.3583
1.3763
1.2285
1.1395
1.0831
±0.614
±0.633
±0.659
±0.670
±0.541
±0.444
±0.374
Wine Quality
1.4214
1.4641
1.5034
1.5246
1.3148
1.1963
1.1275
±0.242
±0.249
±0.254
±0.255
±0.205
±0.141
±0.095
Appendix
Table 7: Cross-dataset scale study, final validation MSE (mean ± s.d. over five seeds), secure stack at 12 -bit precision. Client scaling at 10 federated rounds; horizon sweep at three clients.
Precision bits
8
10
12
14
Ciphertext size
100.0 KB
125.0 KB
150.0 KB
175.0 KB
Angle MAE (rad)
2.600×10−3
6.585×10−4
1.676×10−4
4.051×10−5
Total traffic
4,375 MB
5,430 MB
6,485 MB
7,539 MB
Appendix
Table 8: Precision, ciphertext size, reconstruction error and total protocol traffic over a 50 -round, three-client schedule. Traffic and ciphertext size are dataset-independent by construction and reproduce identically on both datasets. Angle MAE here is measured on 256 probe angles; the independent float64 measurement of Table 2 gives 1.52×10−4 at 12 bits, consistent within the probe-set difference.
Figure 6: E6: client scaling replicates on an unrelated dataset, with no aggregation blow-up at 20 clients.
Figure 14
Link
This protocol (payload time)
Interactive baselines (latency floor)
1 Gbps, 50 ms RTT
0.36 s
1.9 – 3.7 s
100 Mbps, 50 ms RTT
3.6 s
1.9 – 3.7 s
10 Mbps, 50 ms RTT
36 s
1.9 – 3.7 s
any link, 1 ms RTT
as above
0.04 – 0.07 s
Appendix
Table 9: Where non-interactivity pays. Left: time to move this protocol’s 45.3 MB per federated round. Right: the latency floor of interactive baselines at 37 – 73 sequential exchanges, before any payload moves.
Party
Observes
Does not obtain
Cloud QPU
Quaternion-masked states
The underlying state. Masking is information-theoretic with per-client, per-use keys removed by their owner.
Aggregation server
Ciphertexts, message sizes, client weights nk/n
Any plaintext. Decryption raises an error by construction.
Peer client
The decrypted global aggregate
Nothing further by protocol ; under the shared-key model a peer holding another’s ciphertext could decrypt it, the standard shared-key FHE-FedAvg assumption.
Network adversary
Authenticated ciphertext traffic
Plaintexts; undetected tampering.
Appendix
Table 10: Threat model. Decryption capability is shared across clients and withheld from the server (the aggregation object exposes only add, scale and serialise). Threshold key generation is the drop-in hardening for the peer row; see Appendix J .
Figure 9: End-to-end implementation flow for the quaternion track.