Black-Box Auditing of Quantum Model: Lifted Differential Privacy with Quantum Canaries

TL;DR

This paper introduces a black-box auditing framework for quantum machine learning models that uses quantum canaries to empirically verify privacy leakage, bridging the gap between theoretical privacy guarantees and practical verification.

Contribution

It presents the first empirical privacy auditing method for QML based on lifted quantum differential privacy and quantum canaries, enabling practical privacy assessment.

Findings

Effective detection of memorization in QML models

Quantification of privacy leakage during training

Validation on simulated and real quantum hardware

Abstract

Quantum machine learning (QML) promises significant computational advantages, yet models trained on sensitive data risk memorizing individual records, creating serious privacy vulnerabilities. While Quantum Differential Privacy (QDP) mechanisms provide theoretical worst-case guarantees, they critically lack empirical verification tools for deployed models. We introduce the first black-box privacy auditing framework for QML based on Lifted Quantum Differential Privacy, leveraging quantum canaries (strategically offset-encoded quantum states) to detect memorization and precisely quantify privacy leakage during training. Our framework establishes a rigorous mathematical connection between canary offset and trace distance bounds, deriving empirical lower bounds on privacy budget consumption that bridge the critical gap between theoretical guarantees and practical privacy verification. Comprehensive evaluations across both simulated and physical quantum hardware demonstrate our framework's effectiveness in measuring actual privacy loss in QML models, enabling robust privacy verification in QML systems.