When Does Quantum Differential Privacy Compose?

2026-01-01

AI Summary

This work addresses the lack of effective composition theorems in quantum differential privacy (QDP), which hinders end-to-end privacy guarantees. For the first time, it explicitly identifies structural conditions under which QDP operates with tensor-product channels and product-adjacent inputs. Under this setting, the paper introduces an operator-valued privacy loss and a quantum moment accounting framework that leverages matrix moment-generating functions and measured Rényi divergence to derive provable composition bounds. The resulting analysis recovers advanced composition bounds whose leading-order terms match those of classical differential privacy, thereby establishing a rigorous theoretical foundation for privacy analysis of quantum algorithms.

Technology Category

• Machine Learning: Quantum Machine Learning
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty
• Constraint Satisfaction and Optimization: Distributed CSP/Optimization

Application Category

• Security and Privacy: Data transparency and provenance
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for incomplete, noisy, or partially observed Web-related graphs
• Economics, Online Markets and Human Computation: Data quality aspects of human-annotated datasets

Abstract

Composition is a cornerstone of classical differential privacy, enabling strong end-to-end guarantees for complex algorithms through composition theorems (e.g., basic and advanced). In the quantum setting, however, privacy is defined operationally against arbitrary measurements, and classical composition arguments based on scalar privacy-loss random variables no longer apply. As a result, it has remained unclear when meaningful composition guarantees can be obtained for quantum differential privacy (QDP). In this work, we clarify both the limitations and possibilities of composition in the quantum setting. We first show that classical-style composition fails in full generality for POVM-based approximate QDP: even quantum channels that are individually perfectly private can completely lose privacy when combined through correlated joint implementations. We then identify a setting in which clean composition guarantees can be restored. For tensor-product channels acting on product neighboring inputs, we introduce a quantum moments accountant based on an operator-valued notion of privacy loss and a matrix moment-generating function. Although the resulting R\'enyi-type divergence does not satisfy a data-processing inequality, we prove that controlling its moments suffices to bound measured R\'enyi divergence, yielding operational privacy guarantees against arbitrary measurements. This leads to advanced-composition-style bounds with the same leading-order behavior as in the classical theory. Our results demonstrate that meaningful composition theorems for quantum differential privacy require carefully articulated structural assumptions on channels, inputs, and adversarial measurements, and provide a principled framework for understanding which classical ideas do and do not extend to the quantum setting.

Problem

• quantum differential privacy
• composition
• privacy guarantees
• quantum channels
• POVM

Innovation

• quantum differential privacy
• composition theorems
• quantum moments accountant
• operator-valued privacy loss
• measured Rényi divergence