ML Security PapersBlack-Box Auditing of Quantum Model: Lifted Differential Privacy with Quantum Canaries
Baobao Song 1, Shiva Raj Pokhrel 2, Athanasios V. Vasilakos 3, Tianqing Zhu 4, Gang Li 2
Published on arXiv
2512.14388
Membership Inference Attack
OWASP ML Top 10 — ML04
Key Finding
The proposed canary-based black-box framework successfully derives empirical lower bounds on privacy budget consumption in QML models, validated on real quantum hardware, bridging the gap between theoretical QDP guarantees and practical privacy verification.
Lifted Quantum Differential Privacy Auditing with Quantum Canaries
Novel technique introduced
Quantum machine learning (QML) promises significant computational advantages, yet models trained on sensitive data risk memorizing individual records, creating serious privacy vulnerabilities. While Quantum Differential Privacy (QDP) mechanisms provide theoretical worst-case guarantees, they critically lack empirical verification tools for deployed models. We introduce the first black-box privacy auditing framework for QML based on Lifted Quantum Differential Privacy, leveraging quantum canaries (strategically offset-encoded quantum states) to detect memorization and precisely quantify privacy leakage during training. Our framework establishes a rigorous mathematical connection between canary offset and trace distance bounds, deriving empirical lower bounds on privacy budget consumption that bridge the critical gap between theoretical guarantees and practical privacy verification. Comprehensive evaluations across both simulated and physical quantum hardware demonstrate our framework's effectiveness in measuring actual privacy loss in QML models, enabling robust privacy verification in QML systems.
Key Contributions
- First black-box privacy auditing framework for QML using Lifted Quantum Differential Privacy and quantum canaries (offset-encoded quantum states) to detect memorization
- Rigorous mathematical connection between canary offset and trace distance bounds, enabling empirical lower bounds on the privacy budget (ε) that bridge theory and practice
- Comprehensive evaluation on both simulated and physical quantum hardware demonstrating the framework's effectiveness at measuring actual privacy loss
🛡️ Threat Analysis
Quantum canaries are strategically inserted training examples used to test whether the QML model memorized them — this is fundamentally a membership inference technique (binary: was this canary in the training set?), used here to derive empirical lower bounds on actual privacy budget consumption and audit DP guarantees in deployed QML models.