Unit-Aware Differentially Private Quantum Machine Learning for Clinical and Wearable Health Data

Md Khalid Syfullah; Alvi Ataur Khalil

cs.LGOct 20, 2026

Unit-Aware Differentially Private Quantum Machine Learning for Clinical and Wearable Health Data

Authors: Md Khalid Syfullah, Alvi Ataur Khalil

Organizations: Computer Science, Southern Illinois University Carbondale, USA

Abstract

Clinical registries and wearable sensors support early health-risk assessment, yet models trained on these records may leak sensitive information when released. Differential privacy (DP) bounds this leakage by injecting noise whose total magnitude grows with the number of trainable parameters, a cost especially severe for small health cohorts. This motivates parameter efficient models including quantum machine learning (QML), whose variational circuits can represent complex decision boundaries with few trainable parameters. It raises a question: at matched input dimensionality and privacy budget, does a quantum model retain more utility than a classical one? We investigate this question on three clinical cohorts and one wearable cohort, treating each clinical record or participant as a privacy unit. We compare capacity-matched quantum, multilayer perceptron, and logistic regression models across five privacy budgets and five seeds. The quantum model leads on three clinical cohorts by up to 0.104 ROC AUC averaged across budgets; however, trails on the wearable cohort, where the small number of participants requires substantial noise. No difference survives Holm correction across 24 tests, so these results indicate a trend rather than a quantum advantage. An analytic gradient bound shows that lower clipping thresholds can improve utility by reducing noise despite clipping bias. Finally, an experiment on IBM quantum computer (ibm_fez, a 156-qubit superconducting processor) using eight fixed test cases yields mean absolute probability errors of 0.046 (private) and 0.063 (non-private) relative to simulation, supporting the feasibility of inference on noisy intermediate-scale quantum (NISQ) hardware. Code is publicly available at https://github.com/TITANS-Lab-Artifacts/DP-QML-Health.

Figures & tables

Fig. 1: Quantum risk prediction with privacy-preserving training.

Sym.	Meaning	Sym.	Meaning
$u$	Privacy-unit index	$d$	Qubits, components
$n$	Number of private units	$L$	Variational layers
$q$	Poisson sampling rate	$\mathbf{x},y$	Input feature, binary label
$\mathcal{B}_{t}$	Units sampled at $t$	$p_{\boldsymbol{\theta}}$	Positive-class prob.
$\varepsilon,\delta$	Budget, failure prob.	$\ell_{u}$	Loss of unit $u$
$\sigma$	Noise multiplier	$\mathbf{g}_{u},\bar{\mathbf{g}}_{u}$	Raw, clipped gradient

TABLE I: Summary of notation.

Fig. 2: Architecture of the variational quantum classifier.

Fig. 3: Overview of the unit-aware DP-SGD framework, including setup, training, statistical evaluation, circuit ablations, and quantum hardware inference.

Dataset	Samp.	In.	Pos.%	Unit	Units(train/cal./test)	$q$	$\sigma$
Pima Diabetes [ 29 ]	768	8	34.9	record	460/154/154	0.067	5.39
UCI Heart [ 30 ]	303	13	45.9	record	181/61/61	0.167	8.44
Heart Failure [ 31 ]	299	12	32.1	record	179/60/60	0.167	8.44
WESAD [ 16 ]	438	7	35.4	particip.	9/3/3	1.000	20.31

TABLE II: Datasets and privacy settings at target

\varepsilon=1

Category	Settings	Configurations
Private training	Five privacy budgets: $\varepsilon\in\{0.5,1,2,4,8\}$ . Six model–clipping combinations: QNN $C\in\{0.5,1,\sqrt{8}\}$ ; MLP $C\in\{0.5,1\}$ ; LR $C=1$ .	6 model–clipping combinations $\times$ 5 budgets $\times$ 4 datasets $\times$ 5 seeds. Total: 600 runs
Nonprivate training	Three QNN runs for the columns labeled $C=0.5$ , $1$ , and $\sqrt{8}$ ; one MLP and one LR.	5 runs $\times$ 4 datasets $\times$ 5 seeds. Total: 100 runs
Circuit ablations	Privacy budget: $\varepsilon=1$ ; Clipping threshold: $C=1$ ; Encoding gates: $R_{X}$ , $R_{Y}$ ; PCA components: 4, 6, 8; Trainable layers: 1, 2, 3; Circuit Settings=2x3x3 =18	18 circuit settings $\times$ 4 datasets $\times$ 5 seeds (excluding 30 WESAD runs requiring 8 components). Total: 330 runs
Statistical evaluation	QNN–MLP results at $C=1$ , paired by seed. Two-sided Wilcoxon signed-rank tests. Descriptive 95% intervals from 10,000 paired bootstrap resamples.	20 per-budget comparisons and 4 comparisons across budgets. Total: 24 tests , with Holm correction [ 12 ] .
Total training runs: $600+100+330=1{,}030$

TABLE III: Training and statistical evaluation setup.

$\varepsilon$	QNN $.5$	QNN $1$	QNN $\sqrt{8}$	MLP $.5$	MLP $1$	LR $1$
$\infty$	.903 (.033)	.903 (.033)	.903 (.033)	.909 (.022)	.909 (.022)	.900 (.012)
.5	.818 (.046)	.749 (.113)	.809 (.078)	.797 (.097)	.631 (.129)	.832 (.053)
1	.832 (.101)	.839 (.061)	.712 (.225)	.711 (.138)	.764 (.110)	.808 (.106)
2	.839 (.081)	.834 (.103)	.849 (.048)	.762 (.113)	.799 (.088)	.852 (.033)
4	.826 (.113)	.824 (.112)	.812 (.135)	.786 (.111)	.804 (.094)	.857 (.034)
8	.824 (.113)	.824 (.107)	.838 (.087)	.782 (.102)	.794 (.090)	.858 (.047)

TABLE IV: Private utility across models, clipping thresholds, and privacy budgets: Private test ROC AUC (standard deviation) versus target budget

\varepsilon

; column labels give the clipping threshold

C

Fig. 4: ROC AUC performance across privacy budgets at

C=1

. Bands show one standard deviation; dashed and dotted lines indicate the nonprivate QNN and random baseline, respectively.

Dataset	$0.5$	$1$	$2$	$4$	$8$	$\Delta$	95% interval	$p$
	Difference at budget $\varepsilon$					Curve average by seed
Pima	$+.112$	$+.176$	$+.078$	$+.082$	$+.070$	$\mathbf{+.104}$	$[+.032,+.175]$	.125
UCI Heart	$+.118$	$+.075$	$+.036$	$+.020$	$+.030$	$\mathbf{+.056}$	$[+.000,+.111]$	.313
Heart Fail.	$+.090$	$+.057$	$+.079$	$+.072$	$+.052$	$\mathbf{+.070}$	$[-.033,+.188]$	.813
WESAD	$+.013$	$-.254$	$-.295$	$-.185$	$-.087$	$\mathbf{-.162}$	$[-.234,-.075]$	.125

TABLE V: Paired QNN-minus-MLP ROC AUC differences at

C=1

(

p

: uncorrected Wilcoxon; Holm-adjusted

p=1.000

throughout).

Fig. 5: QNN sensitivity to the clipping threshold

C

Fig. 6: Private QNN circuit ablation at

\varepsilon=1

and

C=1

Fig. 7: Hardware (QPU) versus statevector predictions.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 430 papers

Sep 4, 2026

Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access

Quantum Machine Learning (QML) has shown rapid advances by utilizing quantum computing for machine learning tasks. Meanwhile, the privacy risks accompanying QML is also starting to be studied, which inherit privacy leakage channels from "classical" ML and also quantum-unique risks. Existing work on privacy-preserving QML largely focuses on a QML-as-a-service scenario, which generally assumes that the QML model owner provides only classical bit outputs to queries, while users (and adversaries) have only classical computing abilities. However, this view is increasingly challenged in a quantum-native world of quantum-capable users/adversaries, which may have access to both quantum computing abilities and access to quantum information output from service providers. In this paper, we aim to bridge this gap by examining membership inference attacks against QML models by demonstrating that increasing quantum access and quantum computing abilities provides provable theoretical privacy leakage and empirical adversarial gain. However, the probabilistic nature of QML introduces a gap between theoretical and empirical adversarial advantage. These results show that existing research on privacy leakage in QML models underestimates privacy leakage in emergent quantum-native access regimes, and we hope to establish a first step in examining potential privacy leakages for QML in the quantum-native world.

Liou Tang, James Joshi, Ashish Kundu

University of Pittsburgh, Pittsburgh, PA, USA · Cisco Research, San Jose, CA, USA

Membership Inference Attacks Quantum Machine Learning

Ask PDF

Jul 9, 2026

Equivariant Quantum Clustering with Differential Privacy: Parameter-Efficient Privacy-Preserving Analysis Across Heterogeneous Sensitive Datasets

Privacy-preserving clustering is critical for analyzing sensitive data in healthcare, cybersecurity, and enterprise applications, where maintaining data confidentiality must be balanced with analytical performance. This paper presents Equivariant Quantum Clustering (EQC), a parameter-efficient framework that integrates symmetry-aware quantum circuits with differential privacy to improve the privacy-utility tradeoff. EQC employs p4m equivariant parameter sharing to reduce circuit complexity while preserving informative feature representations. The framework is evaluated on three privacy-sensitive datasets: NSL-KDD, CERT Insider Threat v6.2, and a synthetic MIMIC-III clinical dataset. On the NSL-KDD benchmark, EQC achieves 79.3% clustering accuracy while reducing membership inference attack success to 38.3% under a privacy budget of ε = 1.0 and δ = 10^-5, outperforming representative classical and quantum baselines. Ablation studies indicate that the performance gains primarily arise from parameter-efficient circuit design combined with differential privacy. The results demonstrate that EQC provides a practical quantum-ready framework for secure and privacy-preserving clustering across heterogeneous sensitive datasets.

B. M. Taslimul Haq, Md Arifur Rahman, Tawfiq Al Islam Foysal +2

Department of Information Systems, Central Michigan University, Mount Pleasant, MI, USA. · Department of Computer and Information Sciences, Trine University, Angola, IN, USA. · Department of Computer Science and Engineering, American International University–Bangladesh (AIUB), Dhaka, Bangladesh. +2

Clustering Quantum Machine Learning Privacy-Preserving ML Differential Privacy

Ask PDF

Sep 18, 2026

Federating Quantum and Classical Computing: A Privacy-Preserving Hybrid Approach

Quantum machine learning (QML) is increasingly recognized as one of the most promising near-term applications of quantum computing, viewed as a next-frontier candidate beyond purely classical approaches. Hybrid quantum-classical models operationalize this potential by embedding a parameterized quantum circuit within a model where all other components remain classical-a design already applied to chemistry simulation, financial modeling, and image classification. However, their deployment in privacy-sensitive, multi-party settings is constrained by the need to avoid centralizing raw data and by the requirement that modern quantum circuits remain parameter-efficient to stay trainable at scale. In this paper, we address these constraints by evaluating federated learning (FL) as a means of combining a hybrid quantum-classical active party with a classical passive party, using Sherpa.ai's Blind Vertical FL (SBVFL) protocol to avoid centralizing raw data, while drastically reducing communication. We construct the split multiplicative periodic parity (SMPP) benchmark, following common QML design practice. On this task, our simulations show that SBVFL raises accuracy from 0.7227 to 0.8757 compared to local training, closely approaching non-private centralized accuracy, and that the hybrid quantum-classical model achieves this with substantially fewer trainable parameters than the classical neural networks and random forest alternatives. These results show that FL enables high-performing, privacy-preserving quantum-classical collaboration without centralizing raw data.

Carlos Cano, Daniel M. Jimenez-Gutierrez, Diego Sal +4

Privacy-Preserving Federated Learning Quantum Federated Learning Quantum Machine Learning Hybrid Quantum-Classical ML Federated Learning

Ask PDF

Abstract

Privacy-Preserving ML

Explore similar work

Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access

Equivariant Quantum Clustering with Differential Privacy: Parameter-Efficient Privacy-Preserving Analysis Across Heterogeneous Sensitive Datasets

Federating Quantum and Classical Computing: A Privacy-Preserving Hybrid Approach