Differentially private quantum sensor networks Daniel J. Spencer,1, 2, 3, ∗ Kaiyan Shi,1, 4 Emil T. Khabiboulline,1, 2 Gorjan Alagic,1, 4 and Alexey V. Gorshkov1, 2 1
arXiv:2607.06521v1 [quant-ph] 7 Jul 2026
Joint Center for Quantum Information and Computer Science, NIST/University of Maryland, College Park, MD 20742, USA 2 Joint Quantum Institute, NIST/University of Maryland, College Park, MD 20742, USA 3 Department of Physics, University of Maryland, College Park, MD 20742, USA 4 Department of Computer Science, University of Maryland, College Park, MD 20742, USA Quantum sensing is a promising technology capable of demonstrating clear advantage over comparable classical techniques for precise measurement. One application of quantum sensing is in function estimation, which can be done using a network of entangled quantum sensors, allowing for measurements with greater optimal sensitivity than unentangled sensing protocols. In cases where quantum sensor networks will be used to measure data that should remain private (e.g., biomedical data), it is imperative that these protocols include a privacy mechanism to hide sensitive information. In this work, we show that entangled sensor networks are vulnerable to certain privacy-violating attacks. To mitigate these attacks, we introduce secure sensing protocols endowed with differential privacy. We reconcile differential privacy with retaining Heisenberg-limited scaling, and introduce several protocols achieving varying balances between the two. We show that our main protocol, an n-node network sensing protocol that injects noise directly into the sensing Hamiltonian, exhibits a tradeoff between the desirable O 1/n2 Heisenberg scaling of the mean-squared error of the function estimate and the level of privacy attainable. Under assumptions on the network (a common source of randomness and a constant fraction of honest parties), we show that this protocol is locally implementable and achieves (O(1) , δ)-differential privacy for arbitrarily small δ while retaining Heisenberg scaling of the mean-squared error. We prove that our protocols are resilient to attacks by broad classes of classical and quantum adversaries, and find advantages in the privacy-utility tradeoff when using quantum techniques.
I.
INTRODUCTION
Quantum sensing [1] is a promising technology with applications across various disciplines that rely on accurate measurements. It has been shown [2–8] that entanglement provides an advantage over unentangled protocols in networks of quantum sensors for precision measurement. In quantum sensing, a common problem of interest is function estimation, where q(θ) is a function of n parameters θ = (θ1 , . . . , θn ), each coupled to a quantum sensor, which can be a qubit, a boson, or any other multi-level quantum system. The protocols proposed in, for example, Refs. [4, 6–8], solve the function estimation problem using a network of entangled qubit sensors. Physically, this function could be a magnetic or electric field to be interpolated at arbitrary positions in space. Examples of such sensor networks have been proposed for a variety of applications in geophysics [9, 10], biomedical imaging [11–16], dark matter searches [17], and the enhancement of atomic clock stability [18]. Often in sensing, the figure of merit is taken to be the mean-squared error εMSE of the function estimator, in particular how εMSE scales with n, the number of sensors. The above-mentioned entangled sensing protocols achieve the desirable Heisenberg limit on εMSE , which is an improvement over the best achievable bound with any unentangled strategy, called the standard quantum limit. In this work, we restrict ourselves to linear functions of
Pn the form q(θ) = i=1 αi θi . In particular, we consider the average function, that is, we Pntake αi = 1/n for all i = 1, . . . , n such that q(θ) = n1 i=1 θi . In this scenario, the standard quantum limit on εMSE is O(1/n) while the Heisenberg limit, achievable with access to entangled resources, scales as O 1/n2 , a quadratic enhancement [4]. The average of the parameters is a common measure of interest that allows for a clear demonstration of Heisenberg scaling advantage and allows us to focus on the privacy aspect of our protocols. The regimes in which quantum sensor networks could be used include the measurement of sensitive data that clients may wish to keep private. For example, in a network of distributed biomedical quantum sensors that can measure the presence of an infectious disease, it may be desirable to determine the average rate of infection while hiding which specific individuals have it. As another example, consider a network of entangled sensors distributed among sites within a country tasked with measuring geophysical signals that could indicate the presence of a valuable natural resource such as oil or strategic minerals. If each site is owned by a different company, and a client (e.g., the government of the country) wants to determine some function of the estimated amount of the resource at each site, then the network should have a way to estimate the function without leaking information about the amount of the resource at each site, information that could be used for some nefarious financial or military purpose. The security of sensor networks has been studied in several prior works [19–27]. In this work, we focus on a specific type of privacy-breaching attack called a dif-
2 ferencing attack against the network. An example of a differencing attack in the quantum sensing setting involves an adversary running the sensing protocol once to get an estimate of the linear function and then running the protocol again, this time excluding a single parameter (the “target”). Using these two results, the adversary can learn the parameter value of the target node. While more creative and complicated attacks can be conceived of, this simple attack exposes any single node in the network, which is catastrophic for any user that wishes to keep their data private in such a sensing application. To address such attacks, we introduce privacy mechanisms based on differential privacy to hide the parameter values of all nodes in the network at the cost of losing some accuracy in the estimate of our function. Differential privacy is a well-studied mechanism [28, 29] that lends itself naturally to scenarios where privacy may be important in a sensing protocol. Its application is especially important as we approach an era in which quantum sensing is realized commercially. Classically, differential privacy can be combined with additive homomorphic encryption to achieve complementary notions of security in sensor networks [30]. In this work, we augment quantum sensor networks, where entanglement plays a key role in both security and sensing. In particular, we aim to maintain quantum-enhanced scaling in the precision of estimating functions like summations, while direct application of classical techniques on classical data does no better than the standard quantum limit. We introduce several differentially private quantum sensor network protocols that achieve varying levels of optimality, according to a set of three criteria that we define below. We consider two adversarial models, one assuming a trusted central node in the network (the centralized network setting) and one assuming no such trusted party (the decentralized network setting), and we develop differentially private protocols to protect against attacks in each setting. Removing a trusted curator can encourage contributors who do not want to reveal their raw data. We highlight how the level of trust in the network has significant implications for the accuracy of function estimation. It is useful to point out that while there is fundamental measurement noise in the original sensing protocol, it is not sufficient for differential privacy and can average out as the number of rounds of sensing increases. Entanglement bestows anonymity, in that the output of the computation can be revealed while the inputs remain unknown. However, this notion of security does not yield differential privacy, since knowledge about the output itself can reveal whether an input contributed to the computation. As such, to introduce privacy to quantum sensor networks of the type we consider in this paper, we require an explicit mechanism. We find that directly applying the Laplace mechanism, commonly used in classical differential privacy, suffices in the centralized network setting. However, we find that when we consider the decentralized network setting, a quantum mechanism
actually performs better, which we achieve by directly modifying the Hamiltonian. The analysis of our quantum mechanism accounts for both classical and quantum adversaries, and we show that this mechanism is secure against both. Our analysis makes use of quantum information-theoretic tools that prescribe a smaller amount of injected noise, compared to classical results, and thus improved utility for the same privacy level. We show that, under additional assumptions about the network, our local mechanism can become optimal according to the criteria that we define below in Def. 1. We note that our work is distinct from previous literature on quantum differential privacy [31–36], which is concerned with deriving differentially private quantum algorithms to prevent an adversary from learning whether or not a specific quantum state was used as input based on the output of a quantum circuit. In our work, the input to the problem is a set of purely classical parameters in a quantum Hamiltonian that is then coupled to a qubit. Then, the qubits, with the encoded classical data, are unitarily evolved according to the Hamiltonian, after which we measure the final quantum state and are left with classical measurement results and post-measurement quantum states. Thus, our differential privacy analysis requires an interplay between classical and quantum techniques. Furthermore, we consider differential privacy in the distributed setting [35–37]. We note some recent work connecting classical Fisher information [38] and quantum parameter estimation [39] to differential privacy. The rest of the article is organized as follows. In the remainder of this section, we outline our main results and define the criteria that characterize the quality of a differentially private quantum sensing protocol. Then, in Sec. II, we introduce the standard quantum sensing protocol that we follow, motivate why we need privacy, review the relevant theory from classical and quantum differential privacy needed to develop our protocols, and connect differential privacy and sensing in an intuitive way. We then introduce the centralized and decentralized network settings and the corresponding differentially private quantum sensing protocols in Secs. III and IV, respectively, and show their correctness and soundness. Finally, we offer some concluding remarks in Sec. V. We relegate additional analysis of our main protocol to Secs. A and B.
A.
Main result
Our main result is the introduction of several entangled sensor network protocols that achieve different levels of success across several measures; see Tab. I. We consider two different models for the structure of the sensor networks and introduce differentially private quantum sensing protocols for both. While the scaling of the meansquared error εMSE of the function estimate as a function
3
Protocol
Assumptions Noise source
δ
Global or local noise implementation
All criteria of Def. 1?
Θ(1)
0
Global
✗
Scaling of εMSE
ε
Global Laplace mechanism (Sec. III)
Trusted curator
Laplace
O 1/n2
Noisy Hamiltonian protocol (Sec. IV B)
Worst-case: one honest node
Laplace
O(1/nα )
Θ(n(α−1)/2 )
0
Local
✗
Honestfraction noisy Hamiltonian protocol (Sec. IV C)
Honest fraction, CSR, averagetype queries on sufficiently large subset
Gaussian
O 1/n2
Θ(1)
Arbitrarily small
Local
✓
Table I. Summary of the optimality conditions achieved by each of the differentially private quantum sensing protocols we introduce in this work. Here, 1 ≤ α ≤ 2 is a parameter that can be chosen by the user. The only fully optimal protocol (with additional assumptions), by the criteria in Def. 1, is the noisy Hamiltonian protocol where the network has a common source of randomness (CSR) and a constant fraction of the nodes are honest. Green text indicates optimal, red indicates non-optimal, and orange indicates that the user can tune the level of optimality (at the expense of the optimality of another figure of merit).
of the number of nodes in the network is the single figure of merit in the original quantum sensing protocol [4], we define in Def. 1 a set of three criteria that characterize the optimality of a differentially private quantum sensing protocol. Note that we introduce a few variables and terms (e.g., ε, δ) P that we define more precisely later on. n Let q(θ) = n1 i=1 θi be the average of the paramen ters θ ∈ R and let ε ≥ 0 denote the privacy level and 0 ≤ δ ≤ 1 denote the probability of a mechanism failing to achieve an ε-level of privacy; a smaller ε corresponds to higher privacy and δ can be arbitrarily small. Furthermore, denote by Q an estimate of q(θ) and define the mean-squared error as εMSE = E[(Q − q(θ))2 ]. Then, we have the following: Definition 1 (Optimal differentially private quantum sensing conditions). The optimality of an (ε, δ)differentially private quantum sensing protocol M depends on its correctness and its soundness. Correctness quantifies how, in the honest setting, the mean-squared error εMSE scales. If εMSE = O(n−α ), then • α = 1 corresponds to the standard quantum limit, • α = 2 corresponds to the Heisenberg limit, and • 1 < α < 2 is an intermediate regime. The soundness is determined by two criteria: • Locality: Does the protocol require a trusted, central party or can it be implemented locally by each node in the network?
• Privacy: How well does the protocol protect individual nodes’ data, measured by the privacy parameters ε and δ? Here, “honest setting” refers to the setting in which there are no adversarial nodes, and so the sensing protocol M is run, with added noise as prescribed. If, however, there are adversarial nodes that wish to perform some sort of privacy-breaching attack, then the conditions in the soundness criteria become relevant: namely, how much privacy is afforded. An optimal differentially private quantum sensing protocol retains Heisenberg scaling of εMSE in the honest setting, is ε- or (ε, δ)-differentially private for ε = O(1) and small δ, and uses a local mechanism. Using the criteria in Def. 1 as a guideline, we categorize our differentially private quantum sensor network protocols according to the network model assumed. Each protocol has its own set of tradeoffs that are chosen according to the user’s preferences with respect to accuracy and privacy. Here, centralized and decentralized refer to the structure of the network, which effectively comes down to the existence or lack of a trusted central party that administers the network (i.e., creates and distributes entanglement, collects the measurement results, calculates the function estimate, and applies noise). As such, this affects how the noise is added: a centralized network with a trusted central party applies noise globally, giving rise to a global differentially private mechanism, while a decentralized network does not have a central party and so each node in the network must add noise locally, giving rise to a local differentially private mechanism.
4 1. Centralized network : In this setting, we assume that there exists a trusted central party called a curator that administers the network. Here, we allow for both “internal” adversaries (i.e., adversarial nodes) and “external” adversaries, such as a malicious third party delegating a sensing task to the network. To protect a given node in this setting, we use a classical global Laplace mechanism, which we show has a mean-squared error that scales according to the Heisenberg limit and is differentially private with privacy budget ε = O(1) and δ = 0. However, because it requires a trusted curator, it cannot be implemented locally by each node and thus fails the locality condition. 2. Decentralized network : If a trusted central party does not control the network, then the sensing task must be performed among the nodes themselves. To protect a given node in this setting, we introduce two protocols: (a) The noisy Hamiltonian protocol admits a privacy-utility tradeoff between the scaling of εMSE as a function of n and the privacy bud get (ε, δ). Namely, we find εMSE = O 1/n2 + O(1/nα ) and ε = Θ(n(α−1)/2 ), where 1 ≤ α ≤ 2 can be chosen such that i. For α = 1, εMSE = O(1/n) scales according to the standard quantum limit but ε = Θ(1) is a constant, ii. For α = 2, εMSE = O 1/n2 scales according to the Heisenberg limit but ε = √ Θ( n) grows with the number of nodes, and iii. For 1 < α < 2, we get intermediate behavior for both εMSE and ε. We also find conditions under which δ = 0. Note that the locality condition is satisfied by construction, as the protocol does not require a trusted curator. (b) The noisy Hamiltonian protocol with an honest fraction is an (ε, δ)-differentially private, locally implementable protocol that retains Heisenberg scaling in εMSE under certain conditions, but requires additional assumptions and uses a different noise model (the Gaussian mechanism, rather than the Laplace mechanism). The basic noisy Hamiltonian protocol is analyzed in the worst-case adversarial model, where we have a single honest node that is trying to protect its parameter against all other nodes. This yields the strongest privacy model but forces a tradeoff between privacy and Heisenberg scaling. In contrast, the honest-fraction noisy Hamiltonian protocol relaxes this model by assuming a common source of randomness and a constant fraction of honest nodes. Under these additional assumptions
x2
θ2
x1
θ1
S
q(θ)
Curator
Q
θ4
θ3
x4
GHZ
x3
Figure 1. Schematic of the physical setup of the entangled sensor network. The nodes are embedded in some space S and the goal is to estimate a function q(θ), labeled with a star. Here, we show the “centralized setting,” in which a central curator administers the sensing protocol. This involves creating an n-qubit GHZ state and distributing the state to the network. Then, each qubit is coupled to the local parameter θi at each node, evolved according to the Hamiltonian defining the problem, and measured. The measurement results are then sent to the curator, from which the curator calculates an estimate Q for the function q and broadcasts the answer to the client (either a third party or one of the nodes themselves), which may be adversarial.
and a restriction to average-type queries on sufficiently large subsets, the protocol achieves Heisenberg scaling with privacy budget ε = Θ(1) and an arbitrarily small δ, which is considered fully optimal according to our definition in Def. 1. We believe our work to be a novel unification of quantum sensing and differential privacy, and we hope that it will encourage further development of secure sensing protocols.
II.
PRELIMINARIES
In this section, we outline the physical setup of the entangled sensor network in Sec. II A and briefly motivate its vulnerability. To address this vulnerability, we use tools from differential privacy, so we give an overview of the theories of classical and quantum differential privacy in Secs. II B and II C, respectively. We give an interpretation of differential privacy in the context of quantum sensing in Sec. II D.
5 A.
Entangled sensor network
We first describe the entangled quantum sensor network that forms the basis of our differentially private sensing protocols, as sketched in Fig. 1; for an introduction to quantum sensing in general, we refer the reader to Ref. [1]. Let n denote the number of quantum sensors in the network, which we take to be qubits that evolve unitarily under a Hamiltonian
state, and so each node is effectively a single qubit sensor; we mostly refer to the “nodes” of the network, but we may also use the terms “sensor” and “qubit” to refer to the nodes throughout the paper and thus treat all three terms interchangeably. At each node in the network, the qubit is coupled to a parameter θi and then evolved under the Hamiltonian defining the protocol. It is during this time that the function q(θ) is imprinted on the phase of the quantum state. In this work, we only consider the average function, which we define as
n
H(t) = Hc (t) +
1X θi σiz , 2 i=1
(1)
where Hc (t) is a time-dependent control Hamiltonian that is independent of the parameters θ, θi ∈ R is a parameter characterizing a physical quantity (e.g., a local magnetic field), and σiz is a Pauli-Z operator acting on the ith qubit sensor. Our goal is to estimate the value of a linear function q(θ). We do this by making measurements of a final quantum state |ψf ⟩, which we get from unitary evolution of an initial state |ψ0 ⟩. The unitary operator is informed by the parameters θ, namely Z t U (t, θ) = T exp −i dτ H(τ ) , (2)
n
q(θ) =
1X θi . n i=1
(7)
Here, the imprinting of q(θ) onto the phase happens directly as a result of the state evolution without the need for ancilla qubits or a control Hamiltonian. After this evolution, a parity measurement, which we define below, is made across all qubits. Repeating the protocol M times gives us statistics that we then use to estimate the function of interest. We now show in more detail how such a sensor network [4, 5, 8] can be used to estimate q(θ); see Alg. 1. As mentioned above, we take our initial state to be the n-qubit GHZ state:
0
where T is the time-ordering operator. Thus, the final state is given as |ψf ⟩ = U (t, θ) |ψ0 ⟩ .
(3)
The measurements are specified by a positive operatorvalued measure (POVM): Z {Πξ } such that dξ Πξ = 1. (4) We run the experiment M ≥ 1 times and get an estimate Q from the measurement results. Thus, a protocol is the specification of the initial quantum state |ψ0 ⟩, the control Hamiltonian Hc (t), the POVM {Πξ } to estimate q(θ), and the estimator Q. An optimal protocol minimizes the mean-squared error (MSE) εMSE on the function value given a fixed time t: εMSE = E (Q − q(θ))2 (5) 2
= Var[Q] + (E[Q] − q(θ)) ,
(6)
where the first term in Eq. (6) is the variance of the estimator Q and the second term is the bias. If Q is an unbiased estimator, then E[Q] = q(θ) and the second term becomes 0. The specific protocol that we follow in this paper is that proposed in Ref. [4]. The protocol takes the initial quantum state to be a GreenbergerHorne-Zeilinger (GHZ) state, which is either produced by a trusted central party or is created among the nodes in the network according to a pre-specified protocol. Here, each node in the network receives one qubit of the GHZ
1 ⊗n ⊗n |ψ0 ⟩ = √ |0⟩ + |1⟩ . 2
(8)
Since we have the same coefficient (i.e., 1/n) multiplying each parameter, we do not need a control Hamiltonian or any ancilla qubits to dial in different coefficients, as would be needed for a general function with coefficients that are not all equal. Thus, the Hamiltonian describing our problem is H=
n X 1
2 i=1
θi σiz ,
(9)
where we have written H(t) as H because the Hamiltonian is now time-independent. We assume that we evolve the GHZ state for a time t, which yields the following unitary operator describing the evolution: it
U (t) = e− 2
Pn
z i=1 θi σi
.
(10)
Applying U (t) to |ψ0 ⟩, we find the final state to be |ψf ⟩ = U (t) |ψ0 ⟩ int 1 int ⊗n ⊗n = √ e− 2 q |0⟩ + e 2 q |1⟩ , 2
(11) (12)
where q ≡ q(θ). To extract an estimate for q(θ), we make a parity measurement Nn on the final state, where the parity operator is P = i=1 σix . We calculate the expectation value, ⟨P ⟩, as ⟨P ⟩ = ⟨ψf |P |ψf ⟩ = cos(ntq).
(13)
6 Then, to recover a function estimate Q for the true function value q(θ), we find an estimate of the expectation value for P using the measurement results and invert Eq. (13), to get Q=
1 arccos (⟨P ⟩est ), nt
(14)
where M
1 X ⟨P ⟩est = pm . M m=1
(15)
Here, pm =
n Y
(m)
∈ {−1, 1}
xi
(16)
i=1
is the measurement outcome of the parity operator P , (m) where each xi is the σ x measurement result of the ith qubit in round m. As explained in [4, 40], the variance Var[Q] of the function estimate Q is given by Var[P ] Var[Q] = 2 .
(17)
∂⟨P ⟩ ∂q
We calculate Var[P ] as Var[P ] = P 2 − ⟨P ⟩
2
= sin (ntq).
(19)
Likewise, we have ∂ ⟨P ⟩ ∂q
2
=
∂ (cos(ntq)) ∂q
= n2 t2 sin2 (ntq).
2 (20) (21)
Putting everything together, we have Var[Q] =
1 n2 t2
.
a We introduce the notation [M ] = {1, 2, . . . , M } as a convenient
shorthand.
to such an estimate or we need more than just a final bit of precision, we need to make use of the full robust phase estimation or bit-by-bit learning protocol, which is described in Ref. [8, Appendix C] and in greater detail in Ref. [5]. This allows us to estimate the function to K bits of precision without requiring strong prior knowledge of the value of the function. We now describe this protocol. We assume that, after unitary evolution, the state picks up a phase proportional to the function q(θ), namely
(18)
2
Algorithm 1 Standard entangled sensing protocol P z 1 Input: H = n i=1 2 θi σi , θ = (θ1 , . . . , θn ), t, M Output: Q 1: for m ∈ [M ]a do 2: Couple each sensor to local parameter θi 3: Evolve |ψ0 ⟩ under U (t) to get |ψf ⟩ 4: Make parity measurement P of |ψf ⟩ 5: pm ← Parity measurement result 6: end for 7: Estimate parity measurementP expectation from measureM 1 ment outcomes: ⟨P ⟩est ← M m=1 pm 1 8: Q ← nt arccos ⟨P ⟩est 9: return Q
(22)
Note that this is for a single-shot protocol; if we do this M times, then we pick up a factor of M in the denominator. An unentangled strategy (e.g., taking the initial state to be a product state), where each qubit sensor effectively acts independently of the others, yields Var[Q] ∼ nt12 [4] for a single shot, so we see an improvement by a factor of 1/n with entanglement. This is the Heisenberg scaling advantage that forms one of our three optimality conditions in Def. 1. The above protocol comes with an ambiguity as to which π-interval the phase lies in. Thus, with this protocol, there is an assumption of an estimate on the function that puts the function in a specific π interval, where typically we use the entangled sensor network protocol to get a final bit of precision to pinpoint exactly where in this interval the phase lies. However, if we do not have access
1 |ψf ⟩ = √ |0⟩ + einqt |1⟩ ⊗ |0 . . . 0⟩ , 2
(23)
where the phase can be pushed to the first qubit using a set of unentangling gates and where we are ignoring an overall phase. We start by dividing the total experiment time t into K stages, where K is the number of bits of precision we measure the function to, and we divide each stage into 2νj equal pieces. Then, we evolve the system in the j th stage for time tj = Mj δt, where δt is some constant unit of time, Mj = 2j−1 , and where j ∈ [K]. As the sensing time for each stage increases exponentially, we can see that most of the total experiment time is spent estimating the least significant bit of precision, as one would expect when trying to resolve the finer details of the accumulated phase. We assume that we have some (n, t)-independent prior knowledge of the function q(θ), in particular the domain of the parameters θi ∈ [θmin , θmax ] for all i ∈ [n], so we choose δt such that it satisfies nδt(θmax − θmin ) ∈ [0, 2π).
(24)
In the j th stage, we evolve the system as described above for a time Mj δt and repeat, obtaining 2νj independent copies of the state 1 |ψj ⟩ = √ |0⟩ + einqMj δt |1⟩ ⊗ |0 . . . 0⟩ , 2
(25)
7 where νj decreases linearly with j and is taken to be νj = ⌊xj ⌉, where 3 (K − j) + xK xj = log2 C
(26)
for constants C and xK and where ⌊·⌉ denotes rounding to the nearest integer. νj has this specific form to minimize the total time t for a fixed desired precision (i.e., number of bits K), as outlined in Ref. [5]. The total time of this K-stage protocol is given by t=2
K X
νj Mj δt.
(27)
j=1
With the post-evolution states of Eq. (25), we make 2νj single-qubit measurements, whose outcomes allow us to estimate q(θ) bit-by-bit. Specifically, we make two measurements, each νj times for each stage: a σ x measurement and a σ y measurement. Each measurement has an outcome of either +1 or −1, which we map to 0 and 1, respectively, where the outcome probabilities are given by 1 + cos(Mj nqδt) , 2 p(x) (1) = 1 − p(x) (0), 1 + sin(Mj nqδt) p(y) (0) = , 2 p(y) (1) = 1 − p(y) (0). p(x) (0) =
(28) (29) (30) (31)
The two sets of measurements allow us to resolve the twofold degeneracy in the phase nqMj δt in a given [0, 2π) interval that arises from measurement along only one of the axes. As we increase νj , the observed probabilities (x) (y) f0 and f0 for obtaining 0 for σ x and σ y , respectively, converge to their expectation values. In particular, at each stage we get an estimator ϕ̃ for ϕ := Mj nqδt as
B.
Classical differential privacy
With the sensing protocol introduced and a motivation for why we should consider differentially private mechanisms, we now offer a brief introduction to classical differential privacy. Differential privacy was formally introduced in its modern form most notably by Dwork and others in 2006 [28, 29]. It is motivated primarily in the context of honestly published databases compromising privacy, where the output of database queries alone can violate privacy. Techniques like secure multiparty computation generally do not address this type of privacy violation, but they can be combined with differential privacy to give stronger privacy guarantees than either alone [30]. Differential privacy has been used in several industries for various applications. Examples include protecting user privacy for statistical analyses on Google searches during the COVID-19 pandemic [41] and protecting the data of power companies’ customers [42, 43]. For a general introduction to differential privacy, we refer the reader to the work by Dwork et al. [44], and for an introduction with a focus on the complexity of differentially private algorithms, we suggest the work by Vadhan [45]. We also highlight recent NIST guidelines [46] for evaluating differential privacy guarantees, suggesting the maturity and promise of differential privacy as a practical tool. Intuitively, a good differentially private mechanism provides both privacy for individuals in a group and good utility. Stated another way, a differentially private algorithm is one in which a potentially adversarial observer cannot tell whether an individual’s data was used in a computation based on the output of the algorithm. Differential privacy provides a way to hide the data of specific individuals while also keeping the integrity of the conclusions we can draw from the group. In differential privacy, we often work with datasets:
(32)
Definition 2 (Dataset). A dataset D is a collection of (potentially sensitive) information about one or more individuals. If D contains the data of n ≥ 1 individuals, we take the ith row to contain the attributes of the ith individual.
where arctan 2 is the two-argument arc-tangent with range [0, 2π). With the other variables known and the estimate ϕ̃, we have enough information to estimate q(θ), thus concluding the sensing experiment. We use this full bit-by-bit learning protocol in the numerical analysis of the privacy of the noisy Hamiltonian protocol in Sec. B 1. As we discuss in more detail below, these entangled sensor networks are vulnerable to differencing attacks, mentioned briefly in Sec. I. Here, an adversarial party can run the sensing protocol in such a way that they can learn the parameter or parameters of one or more nodes in the network, compromising the privacy of the network. As such, we need a mechanism to protect against such attacks, which is where differential privacy comes into play.
As an intuitive example of a dataset that demonstrates the need for a differentially private mechanism, consider a hospital that stores the medical records of n patients, where each row contains the attributes of each patient such as name, age, sex, address, medical record number, and status for a certain disease (e.g., diabetes, hypertension, etc.). If a research team at the hospital or at an outside academic institution wishes to use this dataset for a study, the patients included in the dataset would likely want their data to remain private and anonymous while the research team would like to access as much of the information as possible to be able to draw meaningful conclusions about their research hypothesis. Thus, we must have a mechanism that allows the hospital or manager of the dataset to release as much information as possible while still retaining sufficient privacy for all pa-
(y) (x) ϕ̃ = arctan 2 2f0 − 1, 2f0 − 1 ∈ [0, 2π),
8 tients included in the dataset. The tools from differential privacy allow us to do exactly this. A differentially private mechanism should protect against certain classes of adversarial attacks. One such attack that we have already mentioned is the differencing attack, where an adversary can make two or more queries and, using the two outputs, learn the data of an individual in the dataset. Another type of attack that differential privacy is designed to protect against is a linkage attack, where an adversary can combine anonymized data from multiple sources to piece together the identity of an individual in a dataset. For example, Latanya Sweeney conducted a famous linkage attack in 1997 to link the then-governor of Massachusetts with his medical records using only publicly available information [47]. Thus, even though direct identifiers (e.g., an individual’s name) may be removed from a dataset, a clever combination of data from several sources is sufficient to reveal an individual’s identity in a dataset. By adding controlled, randomized noise to queries, differential privacy makes it difficult to perform such attacks. With this in mind, we formally define the relevant concepts from classical differential privacy. We start by defining classical global and local differentially private mechanisms, which will be relevant depending on which network setting we are considering later on in the sensing context. We start with global differential privacy, where the adversary can compute functions on datasets D of all individuals [45]. We call the set of possible functions we can compute on the dataset the query space. In the definition, we include a subscript “c” to denote “classical” variables, where later, no subscript indicates “quantum” variables, and we include a superscript “g” to indicate that this is a global mechanism. Definition 3 (Classical global differential privacy). Let X n be the set of all possible datasets of n individuals and let ε ≥ 0. A trusted curator holds a dataset D ∈ X n . Access to the data is provided via a randomized (i.e., probabilistic) mechanism Mgc : X n × Qgc → Ycg , where Qgc is the query space and Ycg is the output space of Mgc . Denote a query as qcg ∈ Qgc . Then, Mgc is ε-globally differentially private if, for every pair of datasets D, D′ ∈ X n that differ by one row and for all A ⊆ Ycg , we have Pr[Mgc (D, qcg ) ∈ A] ≤ eε · Pr[Mgc (D′ , qcg ) ∈ A].
(33)
We interpret this as saying that a global randomized mechanism is differentially private if, given access to two datasets that are close (i.e., they differ by one row), the output of the mechanism, and a desire for high privacy (i.e., a small value for ε), an adversary will have a small probability of being able to tell which dataset was used as the input. While global differential privacy is usually what is meant by “differential privacy” in the classical literature, local differential privacy [48] has in recent years become quite popular, with companies like Apple [49] and Google [50] developing and deploying their own lo-
cal differential privacy mechanisms [45]. Note that the superscript “ℓ” indicates that this is a local mechanism: Definition 4 (Classical local differential privacy). Let X be the set of (potentially sensitive) possible individuals’ data points, ε ≥ 0, and Mℓc : X × Qℓc → Ycℓ be a randomized mechanism, where Qℓc is the query space and Ycℓ is the output space of Mℓc . Denote a query as qcℓ ∈ Qℓc . Then, Mℓc is ε-locally differentially private if, for any pair of neighboring data points x, x′ ∈ X and for all A ⊆ Ycℓ , we have Pr Mℓc (x, qcℓ ) ∈ A ≤ eε · Pr Mℓc (x′ , qcℓ ) ∈ A . (34) That is, given access to the output of a locally differentially private mechanism, there is a small probability of being able to determine if the input to the mechanism was x or x′ , which are neighboring data points. Thus, if an adversary has access to the response of an individual, then the adversary will be unable to precisely learn the individual’s personal data. What is meant by “neighboring” depends on the structure of the data. If the input is continuous, then “neighboring” refers to x and x′ that are close in some distance measure. If the data is discrete, then “neighboring” refers to x and x′ that differ by one entry. For example, if one attribute encoded in each individual’s x is hair color, then x and x′ are neighboring if x and x′ are equal in all attributes except for the value of the hair color (e.g., x has brown hair and x′ has blond hair). We denote x and x′ as neighboring with the notation x ∼ x′ . Note that Defs. 3 and 4 are very similar, with the main difference being that the local mechanism takes as input a single individual’s data x or x′ whereas the global mechanism takes as input all individuals’ data in the form of a dataset D or D′ . As we will see, notions of global differential privacy apply to the centralized network setting (Sec. III) while those of local differential privacy apply to the decentralized setting (Sec. IV). While a differentially private mechanism provides privacy, it should still give accurate answers to our queries. In classical differential privacy, we often consider the additive error, which is how much error the differentially private mechanism introduces. Here, we take the output space Ycℓ to be the set of real numbers: Ycℓ = R. Definition 5 (Additive error with probability 1 − ζ). Given a query qcℓ ∈ Qℓc and a data point x ∈ X , a randomized mechanism Mℓc : X × Qℓc → Ycℓ has additive error at most α(x, qcℓ ) with probability 1 − ζ if Pr Mℓc (x, qcℓ ) − y ≤ α(x, qcℓ ) ≥ 1 − ζ, (35) where y = qcℓ (x) and the probability is over the randomness of the mechanism Mℓc . The definition for a global mechanism is similar. In classical differential privacy, there is often a tradeoff between the scaling of the additive error as a function of n with the mechanism type, where global mechanisms can
9 achieve an additive error scaling as√O(1/n) while local mechanisms can only achieve O(1/ n). In the sensing setting, the analogous quantity to the additive error is the mean-squared error εMSE , and we will see a similar tradeoff between the scaling of εMSE in the centralized versus decentralized network settings. We now introduce several differentially private mechanisms. We start with the randomized response mechanism. Randomized response relies on the notion of a counting query: Definition 6 (Counting query). A counting query C is specified by a predicate on rows: C : X → {0, 1}, and can be extended to a dataset D ∈ X n to give the fraction of rows that satisfy the predicate such that C ′ : X n → [0, 1]: C ′ (D) =
1 X C(x). n
(36)
x∈D
Intuitively, this is simply a query on a given dataset that counts the fraction of individuals that satisfy the criteria of our query (e.g., what fraction of people in our dataset have a disease?). Then, the randomized response mechanism [51] is defined as follows: Definition 7 (Randomized response). Let ε ≥ 0 and : X × Qℓc → Ycℓ be a randomized mechanism. Here, MRR c we take Qℓc : X → {0, 1} to be a counting predicate, and Ycℓ → {0, 1}. Then, for C ∈ Qℓc and x ∈ X , we have ( ε C(x) with probability (eεe+1) RR Mc (x) = (37) ¬C(x) with probability (eε1+1) , where “¬” denotes the bit flip of the output of C. Comparing the definition above with the definition of differential privacy in Def. 4, we can see that randomized response is ε-differentially private. Note that the randomized response mechanism as defined in Def. 7 is a local mechanism. Another commonly used differential privacy mechanism is the Laplace mechanism. In the following, we assume that we are in the global setting; we mention the differences for the local Laplace mechanism afterwards. First, we define the Laplace distribution: Definition 8 (Laplace distribution). The Laplace distribution (or double exponential distribution) is the distribution with probability density function f (x; µ, b) =
1 − |x−µ| e b , 2b
(38)
where x ∈ R, µ is the mean and b > 0 is a scale parameter. We denote the Laplace distribution by Lap (µ, b) or, if we take µ = 0, then by Lap (b). The variance is then σ 2 = 2b2 . We now define the global Laplace mechanism [45]:
Definition 9 (Global Laplace mechanism). For ε > 0, a query qcg : X n → R, datasets D, D′ ∈ X n , and global sensitivity given by GS := max′ |qcg (D) − qcg (D′ )|, D∼D
(39)
where D ∼ D′ denotes that D and D′ differ by one row, n the Laplace mechanism MLap takes c,GS over a domain X n a dataset D ∈ X and outputs g MLap c,GS (D) = qc (D) + Lap (GS/ε) .
(40)
From the definition, we see that the differential privacy mechanism outputs a query with some noise drawn from the Laplace distribution. We refer the reader to Ref. [45] for a detailed analysis of the benefits of using the Laplace distribution for the noise source rather than the Gaussian distribution, though as we will see, in some cases the Gaussian distribution is preferred. Importantly, we have the following result: Theorem 1 (Privacy of Laplace mechanism). The Laplace mechanism is ε-differentially private. See Ref. [45] for a proof of this statement. In the local setting, the domain is X , so the local sensitivity is given by LS = max′ qcℓ (x) − qcℓ (x′ ) , x∼x
(41)
where x, x′ ∈ X and x ∼ x′ means that x and x′ are neighboring, as described above. Correspondingly, this gives the local Laplace mechanism, where noise is added locally to each individual’s data, rather than to queries of the whole database. As we will see, the noisy Hamiltonian protocol that we introduce in Sec. IV B is based on the local Laplace mechanism. We also make use of the Gaussian mechanism [44] in a variant of the noisy Hamiltonian protocol in Sec. IV C: Definition 10 (Gaussian mechanism). Let ε, δ > 0, and let qcg : X n → R be a query. The global sensitivity of qcg is GS := max′ |qcg (D) − qcg (D′ )|, D∼D
(42)
where the maximum is over all neighboring datasets D, D′ ∈ X n that differ in one row. The Gaussian mechanism with global sensitivity GS is the randomized mechn anism MGauss c,GS : X → R defined by g MGauss c,GS (D) = qc (D) + Z,
Z ∼ N (0, σ 2 ),
(43)
where σ= and κ2 > 2 ln(1.25/δ).
κ · GS ε
(44)
10 In contrast to the Laplace mechanism, the Gaussian mechanism achieves (ε, δ)-differential privacy (we denote (ε, 0)-differential privacy by ε-differential privacy, often called perfect differential privacy). As such, (ε, δ)differential privacy is strictly weaker than ε-differential privacy when δ > 0 and is often called approximate differential privacy. In practice, we aim for small values of δ, on the order 10−5 . Informally, we think of δ as the probability of failing to achieve ε-differential privacy. For the Gaussian mechanism, we have the following:
Definition 12 (Quantum global differential privacy). Let X n be a set of possible datasets and Mg be a global quantum mechanism. We consider Mg to be (ε, δ)differentially private if for any POVM {Pi } such that P ′ n that differ by i Pi = 1 and all datasets D, D ∈ X one row (i.e., D ∼ D′ ), we have
Theorem 2 (Privacy of Gaussian mechanism). The Gaussian mechanism is (ε, δ)-differentially private.
We note two things about this definition. First, since we want to protect datasets D, we take D, D′ as input and the quantum state produced by the quantum mechanism Mg as output. Compare this to previous definitions in, for example [33, 52], where the input is a quantum state ρ and “quantum differential privacy” is based on neighboring states ρ ∼ σ, according to an appropriate distance measure. Our definition can also be viewed in this way by first applying some encoding algorithm Aenc A to encode D into the state ρ, that is, D 7−−enc −→ ρ(D). ′ Then, by ρ(D) ∼ ρ(D ), we mean that D ∼ D′ . Second, we interpret Eq. (46) as relating the probabilities that an adversary can distinguish between D and D′ as the inputs to the quantum channel Mg by making a measurement P on the output states. This is analogous to how we interpret the indistinguishability of the output values from two datasets that differ by one row in the classical case. We now move on to the local setting, where the space of operations is restricted.
This statement is proven in Ref. [44]. Finally, we highlight the composition theorem: Theorem 3 (Composition theorem). Let Mg1 , . . . , Mgk be randomized mechanisms, where each Mgj is (εj , δj )differentially private. Then, the mechanism that releases all outputs Mg (D) = (Mg1 (D), . . . , Mgk (D)) is (ε, δ)differentially private, where ε=
k X j=1
εj
and
δ=
k X
δj .
(45)
j=1
We refer the reader to Refs. [28, 44] for proof and more discussion on the composition theorem. As is often the case, if each Mgj is itself (ε0 , δ0 )-differentially private, then the full mechanism is (kε0 , kδ0 )-differentially private. C.
Quantum differential privacy
We now provide some definitions corresponding to quantum differential privacy in analogy with the classical definitions discussed above. We also review some important results from the quantum differential privacy literature. We start with the global setting. Definition 11 (Global quantum mechanism). A global quantum mechanism Mg : X n → Y g for a set of classical datasets X n in which each dataset contains n rows (corresponding to data for n individuals) and a set of output quantum states Y g is a two-step process that 1. Encodes a classical dataset D ∈ X n into a quantum state ρ(D) and 2. Applies a quantum channel (i.e., a completelypositive trace-preserving (CPTP) map) to ρ(D) to output a quantum state. We could also think of steps 1 and 2 as a single step, though we delineate them in the definition for clarity. In the context of quantum sensing, a query is a run of the sensing protocol on a specific function of interest (e.g., the average of the full network). With this in mind, we define our notion of quantum global differential privacy [33]:
Tr[P Mg (D)] ≤ eε Tr[P Mg (D′ )] + δ,
(46)
for POVM element P .
Definition 13 (Local quantum mechanism). A local quantum mechanism Mℓ : X → Y ℓ for a set of possible data points X and a set of output quantum states Y ℓ is a two-step process that 1. Encodes a classical data point x ∈ X into a quantum state ρ(x) and 2. Applies a local quantum channel to ρ(x) to output a quantum state. This leads us to an analogous definition of local differential privacy: Definition 14 (Quantum local differential privacy). Let X be the set of possible individual data points and Mℓ be a local quantum mechanism. Mℓ is (ε, δ)-differentially P private if for any POVM {Pi } such that i Pi = 1 and all possible data points x, x′ ∈ X such that x ∼ x′ , we have Tr P Mℓ (x) ≤ eε Tr P Mℓ (x′ ) + δ, (47) for POVM element P . We conclude this subsection with some useful results that we will use in our privacy proofs. We start by defining the quantum hockey-stick divergence:
11 Definition 15 (Quantum hockey-stick divergence). Given γ ∈ R+ and quantum states ρ and ρ′ , the quantum hockey-stick divergence is defined as Eγ (ρ∥ρ′ ) := Tr[(ρ − γρ′ )+ ],
(48)
where Tr[σ+ ] is the sum of the positive eigenvalues of σ. The hockey-stick divergence is a generalization of statistical distance and is frequently used in both classical and quantum differential privacy; it is a special case of an f -divergence [53]. Using this definition, we have the following: Theorem 4 (Quantum differential privacy equivalence). Let ε > 0, δ ≥ 0, γ = eε , and M be a quantum mechanism (either global or local). Then, the following two statements are equivalent: 1. M is (ε, δ)-differentially private.
whether node j’s parameter was θj or θj′ by more than a likelihood-ratio factor of eε , except with failure probability δ. This includes every possible attack obtained from post-processing the results of running the protocol. We can interpret this statement in terms of the probability for an adversary to successfully distinguish between some θj and θj′ . In particular, the adversary is given the output transcript T from the whole protocol and wants to distinguish between two hypotheses H0 : θj = a,
1 1 P (A0 ) + Q(Ac0 ) 2 2 1 = (1 + P (A0 ) − Q(A0 )). 2
psucc =
where Eγ is the quantum hockey-stick divergence defined in Def. 15 and where we take α = D in the global model and α = x in the local model.
Theorem 5 (Post-processing theorem). Let M be a local quantum mechanism that is (ε, δ)-locally differentially private. Let N be an arbitrary quantum channel. Then N ◦ M is also (ε, δ)-locally differentially private. We again refer the reader to Ref. [33] for a proof of this theorem. D.
Interpretation of differential privacy in sensing
In the protocols that we introduce below, we must interpret the implications of the resulting differential privacy in the context of sensing, so we introduce a general formalism here that can be applied to each protocol. Let T denote the full transcript released by a differentially private sensing protocol. Depending on the protocol, T may contain a single noisy function estimate, k distinct function estimates, classical measurement outcomes, or any other post-processed object released to the adversary. Then, for any two neighboring parameter vectors θ, θ ′ that differ only on the target node j, and for any event A in the transcript space (i.e., the output from the differentially private sensing mechanism), we have Pr[T (θ) ∈ A] ≤ eε Pr T (θ ′ ) ∈ A + δ, (49) where ε and δ are the privacy parameters for the full transcript. By symmetry, the same bound also holds when θ and θ ′ are swapped. This says that the adversary’s entire view of the transcript cannot distinguish
(50)
where a, b ∈ [θmin , θmax ]. We assume that the two hypotheses are equally likely and we denote by P the transcript distribution under H0 and by Q the distribution under H1 . If A0 is the set of transcripts for which the adversary guesses H0 , then the success probability for the adversary to choose the correct hypothesis (and therefore distinguish θj from θj′ ) is
2. δ ≥ supα∼α′ Eγ (M(α)∥M(α′ )),
We refer the reader to Ref. [33] for a proof of this statement. Finally, we will find the following post-processing theorem helpful in our proofs:
H1 : θj′ = b,
(51) (52)
Since we want to bound how well the adversary can successfully discriminate between the two neighboring parameters θj and θj′ , we can view this as bounding how large P (A0 ) − Q(A0 ) can be. From Eq. (49), we find P (A0 ) − Q(A0 ) ≤
eε − 1 + 2δ , eε + 1
(53)
and so psucc ≤
eε + δ . 1 + eε
(54)
Thus, differential privacy bounds the success probability of every adversarial decision rule, including differencing attacks and arbitrary post-processing of the transcript. For pure differential privacy, that is, when δ = 0, this becomes psucc ≤
eε . 1 + eε
(55)
For small ε (i.e., high privacy), we have eε 1 ε ≈ + + O ε3 , ε 1+e 2 4
(56)
so if the two hypotheses induce only a small effective privacy loss, then the adversary can do only slightly better than random guessing. In the analysis of our protocols below, the noise is calibrated to protect a worst-case change over the full parameter range, ∆ = θmax − θmin .
(57)
For the linear sensitivity-calibrated mechanisms considered below, if two hypotheses differ only by d := |b − a| ≤
12
Aha! θ1 = nQ1 − (n − 1)Q2
θ3
θ9
θ4 θ7 Q1 (θ1 , . . . , θn )
θ10
θ6
× θ2
Q2 (θ2 , . . . , θn )
θ8 θ1 θ5
Figure 2. Schematic of the differencing attack, the primary attack considered in this paper. The adversary (either a malicious internal node of the network collaborating with other malicious nodes or a malicious third party delegating a sensing task to the network, where the third party either acts independently or collaborates with malicious nodes) can ask for any linear function estimation task to be run on the network and receive back an estimate Q. If the P adversary asks for the task Q1 (θ1 , . . . , θn ) = Pn n 1 1 i=1 θi including all of the nodes in the network and then Q2 (θ2 , . . . , θn ) = n−1 i=2 θi excluding only θ1 , then the adversary n can effectively learn θ1 as θ1 = nQ1 (θ1 , . . . , θn ) − (n − 1)Q2 (θ2 , . . . , θn ).
∆, then the relevant pairwise sensitivity is reduced by d/∆. As a result, when each query is calibrated to a privacy budget of (ε0 , δ0 ) for the worst-case change ∆, the same release is actually (ε0 d/∆, δ0 )-differentially private for distinguishing two values separated by d. By the composition theorem in Thm. 3, the release of k distinct queries, each with privacy budget (ε0 , δ0 ), has privacy budget ε = kε0
d , ∆
δ = kδ0
(58)
ekε0 d/∆ + kδ0 . 1 + ekε0 d/∆
(59)
and so psucc ≤
Thus, when d ≪ ∆/(kε0 ) (i.e., the hypotheses are very close to each other) and kδ0 is small (as is often the case with the mechanisms we use), then the adversary’s optimal success probability is close to 1/2. When d = ∆, then this reduces to the usual worst-case statement.
III.
CENTRALIZED NETWORK
We now introduce our differentially private quantum sensing protocols. We do so in two different settings, determined by the structure of the network. In the centralized network setting, we assume that the sensor network is administered by a trusted central party. This allows us to implement a secure quantum sensing protocol based on global differential privacy. On the other hand, if the sensor network does not have access to a trusted central party, we consider the decentralized network setting, and
we resort to local differential privacy mechanisms for secure quantum sensing; see Sec. IV. In this section, we consider the centralized network setting, which we define as follows: Definition 16 (Centralized network setting). The centralized network is one where a trusted, central party or curator runs the differentially private quantum sensing protocol. The centralized network is vulnerable to both internal attacks (attacks by nodes in the network) and external attacks (attacks by third parties). Our goal is to calculate an estimate Q of the function q(θ) in such a way that we reveal as little information as possible about each node’s parameter (i.e., their input). However, we allow for the nodes to be adversarial in that they could choose not to follow the protocol or collude in some way to try to learn the parameter of another node in the network. We also allow for a malicious third party that can delegate sensing tasks to the curator in order to try to learn the parameter value of a target node in the network. The primary attack (see Fig. 2) that we consider in this work is a differencing attack, which we have mentioned a few times already. In the context of quantum sensor networks, this attack can be achieved in a few physically different, though mathematically equivalent, ways. One way (considered in Sec. I) is for the external adversary to delegate the estimation of a function involving all of the nodes, then to estimate a function excluding the target node, and finally to calculate the difference between these two function estimates (scaled appropriately, since we are only considering the average function) to get the value of the excluded parameter. For example, assume that we have three parameters such that θ = (θ1 , θ2 , θ3 ), and the
13 x1
Algorithm 2 Global Laplace mechanism Input: Same input as Alg. 1, ε Output: Q̃ = Q + η 1: Q ← function estimate using standard sensing protocol θ −θ 2: b ← maxnε min 3: η ← Lap (b) 4: Q̃ ← Q + η 5: return Q̃
U1 (tj ) x2 U2 (tj ) |GHZ⟩n
.. .
.. .
x
Q̃
xn−1 Un−1 (tj ) xn
adversary wishes to know the value of θ1 . The adversary could first ask for the estimate of the function q1 (θ) = θ1 +θ2 +θ3 3 and then ask for the estimate of q2 (θ) = θ2 +θ 3 2 . Then, given the estimates Q1 and Q2 of q1 (θ) and q2 (θ), respectively, all the adversary needs to do to estimate θ1 is calculate θ1 + θ 2 + θ 3 θ2 + θ 3 3Q1 − 2Q2 ≈ 3 −2 (60) 3 2 = θ1 . (61) An even more straightforward way to achieve this that only requires a single run of the protocol is for the adversary to take the coefficient of the parameter that they wish to know to be 1 and all other coefficients equal to 0 such that the “function” that the network is estimating is actually just the parameter value itself. This is also equivalent to the adversarial nodes not coupling their part of the GHZ state to their parameter. If the trusted node follows the sensing protocol honestly, then it will end up just broadcasting its bare parameter, compromising its privacy. One objection to these attacks is that a mechanism could be put in place to “catch” queries that may be compromising of private information. This is called query auditing, and it is problematic for two reasons [44]. First, the denial of a specific query or set of queries alone may reveal some information. Second, query auditing is in general challenging: the space of possible queries is so vast that trying to handle all of them is often infeasible. We now give the differentially private quantum sensing protocol for the centralized network setting to measure the average function, which is based on a global Laplace mechanism. First, the curator creates a GHZ state and sends one qubit to each of the nodes in the network. Then, each sensor is coupled to a local parameter and evolved unitarily (with no controls), after which a measurement is made at each sensor and the results sent as classical bits to the curator. The curator calculates an estimate Q of the function q according to the standard protocol, applies noise to this function estimate in such a way as to achieve ε-differential privacy, and then broadcasts the noisy result; see Fig. 3 and Alg. 2. Since the curator is assumed to be trusted in this model, we do not worry about the curator running any attacks or compromising the data in any way. The main attacks we are concerned with in this model are those by adversarial
Un (tj ) Repeated M times Figure 3. Centralized entangled sensor network protocol using a global Laplace mechanism. The entangled sensor protocol is run as normal with no privacy mechanism, and the ith node sends its M classical measurement results xi = (M ) (1) (xi , . . . , xi ) to the trusted curator over a secure, classical channel, who then collects all measurement results into a vector x = (x1 , . . . , xn ) and calculates the function estimate Q. Before the curator broadcasts the function estimate, though, it applies noise η drawn from the Laplace distribution to Q and then broadcasts this noisy value, Q̃ = Q + η.
third parties and adversarial nodes within the network. To be more concrete, recall that Pnwe are estimating the average function q(θ) = n1 i=1 θi , where θ = (θ1 , . . . , θn ) are unknown parameters, and we assume that the n nodes each send their σ x measurement results xi to the curator over a secure classical communication channel. Assume also that θi ∈ [θmin , θmax ] for some known θmin and θmax . The curator then uses the measurement results received from the nodes to get an estimate Q of q(θ) to one bit of precision. The remaining bits of precision can be estimated analogously using the bit-by-bit learning protocol outlined in Sec. II A. The curator now has an estimate Q of the true function value q(θ), to which the curator then adds noise η ∼ Lap (b), where the scale parameter is b=
θmax − θmin . nε
(62)
As mentioned in Sec. II, we choose the Laplace distribution because it has been shown [45] that this distribution is able to achieve ε-differential privacy, while a more familiar distribution like the Gaussian distribution is unable to achieve this level of privacy due to its behavior at the tails of the distribution. If the privacy budget is relaxed to (ε, δ)-differential privacy for δ > 0, then Gaussian noise can be used. Either way, the curator broadcasts the noisy function estimate Q̃ = Q + η. Under the no-coupling attack, in which only a single honest node j couples its qubit to its parameter θj , the full network average being estimated is effectively θj /n. The curator
14 thus releases Q̃ = Q + η,
(63)
where η ∼ Lap
∆ nε
Then, we use the fact that η is sampled from a Laplace distribution Lap (b) with mean 0 and scale parameter b = GS/ε, according to Def. 9. For neighboring parameter vectors θ and θ ′ that differ in one coordinate, we have GS = q(θ) − q(θ ′ ) =
.
(64)
θmax − θmin , n
(73)
Thus, we have If the adversary post-processes the release by multiplying by n, then they obtain nQ̃ = θj + η ′ ,
(65)
b=
θmax − θmin , nε
and so
′
where η ∼ Lap (∆/ε), which is the usual Laplace scale to protect a parameter varying over an interval of width ∆. We state the optimality of this protocol in the following theorem: Theorem 6 (Global Laplace mechanism). The global Laplace mechanism, in which a trusted curator releases Q̃ = Q + η with η ∼ Lap (b) with scale parameter b = GS ε , yields a differentially private entangled sensing protocol Pn for estimating the function q(θ) = n1 i=1 θi . The meansquared error achieves Heisenberg scaling and the mechanism is ε-differentially private with ε = Θ(1), but it is a global mechanism that requires the extra assumption of a trusted curator and so fails to be local by construction. Proof. We first determine the mean-squared error, which will allow us to bound the noise we must add to achieve both Heisenberg scaling and ε-differential privacy. We start by finding the expected value of Q̃ over quantum randomness, indicated with the subscript ψ, conditioned on the noise η: Eψ [Q̃ | η] = Eψ [Q + η] = Eψ [Q] + Eψ [η] = q(θ) + η.
(66) (67) (68)
We find the variance, conditioned on the noise added, as 1 Varψ [Q̃ | η] = Varψ [Q] = O 2 2 . (69) n t Here, the noise does not contribute to the variance because we calculate the variance over the quantum noise from the sensing protocol, and so η (which is not resampled) is effectively a constant, where the variance of a constant is zero. Putting this together, the mean-squared error conditioned on the sampled noise is 1 2 Eψ [(Q̃ − q(θ)) | η] = O 2 2 + η 2 . (70) n t
εMSE = Eη [Eψ [(Q̃ − q(θ))2 | η]] 1 = O 2 2 + Eη [η 2 ]. n t
2
2
Eη [η ] = Var[η] = 2b = 2
θmax − θmin nε
(71) (72)
2 .
Putting everything together, we have 2 1 θmax − θmin εMSE = O 2 2 + 2 . n t nε
(75)
(76)
The domain for the parameter values is independent of the number of sensors and the sensing time, so (θmax − θmin ) is a constant, and it suffices to take ε = Θ(1). Thus, εMSE = O 1/n2 and ε = Θ(1), making this an ε-differentially private mechanism by Thm. 1. By the conditions in Def. 1, this protocol is nearly optimal, only failing the locality condition. ■ We note that the above analysis is for a single release of the full network average query. More generally, we can apply the same mechanism to average-type queries of sufficiently large subsets of the network, which we denote as 1 X θi , (77) qS (θ) = |S| i∈S
where the chosen subset S ⊆ [n] is public and fixed before running the protocol. To retain the favorable O 1/n2 Heisenberg scaling in the mean-squared error, we restrict the subsets to be of size |S| ≥ βn,
(78)
for some 0 < β ≤ 1. For such a query, the global sensitivity is GS(qS ) =
∆ , |S|
(79)
where ∆ := θmax − θmin . After running the protocol, the trusted curator releases Q̃S = QS + ηS ,
Now, we average over the Laplace noise, to find
(74)
(80)
where QS is the estimate for the subset average qS (θ) and ∆ ηS ∼ Lap (81) |S|ε0
15 for desired privacy parameter ε0 . The resulting meansquared error scales as ! 2 ∆ 1 + 2 , (82) εMSE = O 2 |S|ε0 |S| t2 which, for |S| ≥ βn and ε0 = Θ(1) gives us εMSE = O 1/n2 . This also protects a single node from the no-coupling attack, where the targeted node’s parameter is isolated. For example, suppose only node j ∈ S couples its qubit to its parameter while all other nodes in S do not couple their qubits, then the effective average being estimated is θj /|S|. The released value is thus Q̃ =
θj + ηS , |S|
(83)
where ηS ∼ Lap
∆ |S|ε0
.
(84)
Even if the adversary post-processes the release by multiplying by |S|, the adversary merely learns |S|Q̃S = θj + ηS′ ,
(85)
where ηS′ ∼ Lap
∆ ε0
,
(86)
which is exactly the scale required to protect a parameter that can vary over an interval of width ∆. An adversary could also ask for several different functions qS1 (θ), qS2 (θ), . . . , qSk (θ) for some constant k and where |Sr | ≥ βn for each r ∈ [k], where the functions are chosen such that they can reveal information about one or more nodes, as illustrated in Fig. 2. Thus, for each distinct1 query qSr (θ) with privacy budget εr and freshly sampled noise ∆ , (87) ηr ∼ Lap |Sr |εr the curator releases an estimate Q̃Sr = QSr + ηr that is εr -differentially private. Therefore, the release of the full transcript, ( Q̃ , Q̃S2 , . . . , Q̃Sk ), is S 1 P k r=1 εr -differentially private by the composition theorem (see Thm. 3). If each query uses the same privacy parameter ε0 , then the k-query transcript is kε0 differentially private. If k = Θ(1) and ε0 = Θ(1), then the release of multiple function estimates remains Θ(1)differentially private.
1 If the same function is asked for again, the same estimate found
before can be released.
The interpretation of differential privacy in the sensing context from Sec. II D bounds the adversary’s ability to discriminate between two possible values for a target node’s parameter θj , separated by d ≤ ∆. Then, for every allowable queried subset S containing j, the sensitivity is d/|S| ≤ ∆/|S|. Thus, with noise calibrated to privacy budget ε0 with worst-case change ∆ gives an effective privacy level of ε0 d/∆. For k distinct queries, this implies psucc ≤
ekε0 d/∆ , 1 + ekε0 d/∆
(88)
where δ = 0 for the Laplace mechanism. When the two candidate parameter values are close together such that d ≪ ∆/(kε0 ), this probability becomes close to 1/2, meaning the adversary has a success probability only slightly better than a coin flip for discriminating between the two parameter values. When d = ∆, this reduces to the worst-case guarantee. While this global mechanism does not meet all of the optimality conditions (it fails the locality condition), it is useful if there is a known trusted curator administering the network. For one, this protocol is easier to implement experimentally since the only modification to the original sensing protocol is that noise sampled from a classical distribution is applied globally to the function estimate at the end of the sensing protocol. A natural setting for this paradigm is in delegated sensing. Here, the client is a third party that instructs the network what function to compute and a trusted server sends back a noisy function estimate that is close to the true function value but hides the network’s parameter values from the client.
IV.
DECENTRALIZED NETWORK
We now drop the assumption that a trusted curator administers the network and consider the decentralized network setting in which the nodes themselves orchestrate the protocol. This setting is more general in the sense that we do not assume the existence of a trusted central party, which may be a strong assumption in many cases. For the basic noisy Hamiltonian protocol in Sec. IV B, we focus on the single-release setting; composition can be applied analogously. For the honest-fraction protocol in Sec. IV C, we discuss the multi-query setting explicitly. We start with a formal definition of the decentralized network setting and then discuss it in more detail below: Definition 17 (Decentralized network setting). The decentralized network setting consists of a network of qubit sensors with no trusted central party. Like the centralized network in Def. 16, the decentralized network is vulnerable to both internal and external attacks. The physical picture is mostly the same as the centralized network in Sec. III, where we have a network of n qubit sensors tasked with estimating a function q(θ)
16 without revealing the individual parameters. The primary difference is that we now lack a trusted curator that can create GHZ states, distribute them throughout the network, and receive each node’s measurement outcomes to calculate the function estimate Q. As such, we need a way for the mutually adversarial nodes to create entanglement among themselves. This can be done, for example, by first establishing a ring of Bell pairs and then performing local operations [54], which involves a series of cnot gates between the pairs in the ring, measurement of the target qubits, and single-qubit rotations. Since the nodes are mutually adversarial, some nodes may claim to be doing the local operations specified in this protocol, when they are actually doing some other operations (or nothing at all). Nonetheless, we can verify the entanglement generation by using a protocol such as that presented in Ref. [55], which assumes a common source of randomness to make it efficient. We treat this GHZ verification step as a black box and leave an explicit protocol tailored to our setting to future work. We introduce a local mechanism that we call the noisy Hamiltonian protocol in Sec. IV B and an extension with the additional assumption of an honest fraction in Sec. IV C.
A.
Failure of classical randomized response
We start by considering one of the most commonly used mechanisms to implement differential privacy: randomized response, which we introduced in Def. 7 in Sec. II B. Here, we map the Pauli-X measurement outcomes +1 and -1 to bits 0 and 1, respectively. A straightforward approach is to apply this mechanism directly before each node broadcasts its bit, that is, each node flips its measured bit with probability eε1+1 . While it has been shown that randomized response has optimal additive error within the local model [45, 56], we demonstrate that this approach results in an exponential decrease in the ability to estimate the underlying function. Though in general we estimate the function to several bits of precision, for ease of calculation we analyze a single bit of precision, which suffices to demonstrate the lack of utility of this protocol. The expected value of the noisy parity bit after applying the randomized response mechanism is given by
bility terms in Eq. (89): n h i X n k n−k Pr B̃ = x = p (1 − p) k
1 ((1 − p + p)n − (1 − p − p)n ) 2 n 1 2 = 1− 1− ε 2 e +1 ε n 1 1 tanh = − . 2 2 2
=
(89)
where P x represents the true parity of the bits such that n x = Each i=1 xi (mod 2) and where x = x ⊕ 1. bit xi ∈ {0, 1} is processed independently by randomized response, producing a noisy bit B̃i ∈ {0, 1}, and Pn B̃ = i=1 B̃i (mod 2) is a random variable that represents the parity of the sum of the output noisy bits after applying randomized response. We define p := eε1+1 as the probability of flipping the bit and expand the proba-
(91) (92) (93)
This gives E[B̃ | x] =
ε n 1 2x − 1 tanh + . 2 2 2
(94)
The bias magnitude is E[B̃ | x] −
2x − 1 1 ε n = tanh 2 2 2 n 1 ε = . tanh 2 2
For any fixed privacy parameter ε > 0, ε 0 < tanh < 1, 2 so ε ε n = exp n ln tanh tanh 2 2 = exp(−cn),
(95) (96)
(97)
(98) (99)
where c := − ln tanh(ε/2) > 0, which is exactly exponential decay in n. Thus, we can see that trivially adding the classical randomized response mechanism to each node’s measurement result strongly dampens the signal, so the reported parity becomes exponentially close to a completely random bit as n grows. This makes sense because the parity function is a sensitivity-1 function, meaning even a single bit flip can drastically change the value of the function. While we could choose ε to be n-dependent in a way that the bias becomes constant, such an ndependent ε would destroy privacy as n increases.
B.
h i h i E[B̃ | x] = x · Pr B̃ = x + x · Pr B̃ = x ,
(90)
k=1, k odd
Noisy Hamiltonian protocol
As a direct application of the randomized response mechanism does not work for our goal of differentially private quantum sensing, we must resort to another mechanism. As discussed in Sec. II B, the Laplace mechanism is another popular and successful mechanism for achieving differential privacy and it is the mechanism we used in Sec. III. However, because we are now in the decentralized network setting, the noise must be applied locally, rather than by a trusted curator. Thus, we instead add noise sampled from the Laplace distribution
17 x1
Algorithm 3 Noisy Hamiltonian protocol
x1
N (U1 (tj ))
Input: Same input as Alg. 1, scale parameter b = b(α), 1 ≤ α≤2 Output: Q̃ 1: for i ∈ [n] do 2: ηi ∼ Lap (b) 3: end forP n z 4: H̃ ← 21 i=1 (θi + ηi )σi 5: Run sensing protocol with H̃ as Hamiltonian 6: Q̃ ← noisy estimate of q̃(θ) 7: return Q̃
x2 x2
N (U2 (tj )) .. .
|ψ0 ⟩
.. . xn−1 xn−1
N (Un−1 (tj )) xn
xn
N (Un (tj )) Repeated M times
Figure 4. Decentralized entangled sensor network protocol using a local differential privacy mechanism. A GHZ state |ψ0 ⟩ is generated by the nodes, where each node holds one qubit of the GHZ state. Each node evolves their qubit under a “noisy” unitary, denoted N (Ui (t)), measures their qubit in the Hadamard basis, and broadcasts the measurement results xi to all nodes in the network, each of which can then calculate the noisy function estimate Q̃.
directly to the Hamiltonian parameter coupled to each node’s qubit, giving us the noisy Hamiltonian protocol, as detailed in Alg. 3 and the schematic in Fig. 4. Starting with the original sensing Hamiltonian from Sec. II A, n
H=
1X θi σiz , 2 i=1
(100)
we introduce random noise ηi to each node to obtain a noisy Hamiltonian H̃. That is, we take θi → θi + ηi for all i ∈ [n], yielding n
H̃ =
1X (θi + ηi ) σiz . 2 i=1
(101)
Experimentally, this can be achieved by having each node adjust their applied signal, determined by the noise term, which is sampled locally (and thus known only to the local node). We again choose the noise to be sampled from a Laplace distribution, that is, ηi ∼ Lap (b), where b is the scale parameter and where we have taken the mean to be 0. We note a general bound on b to achieve ε-differential privacy, which will be useful to determine what the resulting privacy parameter ε will be: Theorem 7 (Generic bound on b). Let ε > 0 and θmin , θmax ∈ R be the minimum and maximum values a parameter can take, respectively. The noisy Hamiltonian protocol is ε-locally differentially private against both classical and quantum adversaries, where noise is sampled from Lap (b) with b≥
θmax − θmin . ε
(102)
min Proof. The choice of b ≥ θmax −θ follows directly ε from the definitions of local differential privacy and the min Laplace mechanism. Then, with b ≥ θmax −θ , the ε sub-algorithm in the sensing protocol, which adds ηi ∼ Lap (b) to θi , is ε-locally differentially private by the Laplace mechanism, as stated in Thm. 1. Since the input parameter θi is not further accessed by the protocol, the complete private sensing protocol remains ε-locally differentially private due to the post-processing property, as stated in Thm. 5. ■
This theorem should be viewed as the most robust privacy guarantee for the basic noisy Hamiltonian protocol. Since the honest node’s raw parameter is replaced locally by a noisy parameter θi + ηi before the rest of the protocol sees it, any subsequent information released about it to the adversary is a post-processing of this local value. This includes product state attacks, adversarially chosen measurements, individual measurement outcomes, postmeasurement quantum systems, and arbitrary classical or quantum side information. The cost of this generality is a more conservative local Laplace calibration. This bound is generic and is not necessarily tight for all of the protocols that we introduce. In particular, for a limited regime where we can find a closed-form expression for ε in the noisy Hamiltonian protocol using the quantum hockey-stick divergence, we find that the resulting bound is notably different from what we get from this generic bound (see Sec. B 1). We also note that because differential privacy is an information-theoretic concept, the privacy guarantee holds against both classical and quantum adversaries (i.e., the computational power of the adversary does not help). With this result in mind, we consider two variations of the noisy Hamiltonian protocol, one in which each node samples their noise anew with each shot of the sensing protocol and one in which each node samples their noise once and keeps it constant for every shot of sensing. Interestingly, as we show in Sec. B, we find that when resampling the noise between each shot of sensing, we end up destroying both the accuracy with which we can estimate the function and the resulting privacy, so our protocol requires that the noise is sampled only once at the start of the experiment. We quantify the performance of
18 the noisy Hamiltonian protocol in the following theorem: Theorem 8 (Performance of the noisy Hamiltonian protocol). Assume that each honest node samples their local i.i.d.
Laplace noise ηi ∼ Lap (b) once at the start of the protocol and retains the same noise for all sensing shots. Then, the n-sensor noisy Hamiltonian protocol in Alg. 3 is a local protocol that admits mean-squared error 2b2 1 (103) εMSE = O 2 2 + n t n in the honest setting. For any node i to protect its data against up to n − 1 adversaries, the noisy Hamiltonian protocol is ε-differentially private, where to achieve a mean-squared error scaling as O(n−α ), each honest node takes (104) b = Θ n−(α−1)/2 , which, under the generic bound in Thm. 7, yields ε = Θ n(α−1)/2 . (105)
where we used Eq. (22) to find Varψ [Q|η], the fact that the variance of a constant is 0, and the fact that the noise is constant and hence the covariance term is 0. Conditioned on η, the expected value over the quantum randomness is Eψ [Q̃|η] = q̃(θ) = q(θ) + η. Thus, we now have
H̃ =
2 i=1
(θi + ηi )σiz .
εMSE = E[(Q̃ − q(θ)) ] = O
(107)
We calculate the mean-squared
where we separately take the expectation over the quantum randomness and the randomness from the noise. We can break the inner expectation into the variance part plus the bias part as Eψ [(Q̃ − q(θ))2 | η] = Varψ [Q̃ | η] + (Eψ [Q̃ | η] − q(θ))2 . (109) We calculate Varψ [Q̃ | η] over the quantum noise, thus treating η as a constant, as Varψ [Q̃ | η] = Varψ [Q + η | η] (110) = Varψ [Q | η] + Varψ [η | η] +2 Covψ [Q, η | η] {z } | {z } | 0
0
(111) 1 =O 2 2 n t
,
(114)
1X E[ηi ] = 0, n i=1
(115)
"
n
1X ηi Varη [η] = Var n i=1
# (116)
n
=
1 X Var[ηi ] n2 i=1
(117)
=
2b2 . n
(118)
Thus, we have
εMSE = E[(Q̃ − q(θ))2 ] = Eη [Eψ [(Q̃ − q(θ))2 | η]], (108)
+ Eη [η 2 ],
and
E[η 2 ] = Var[η] =
n
i=1 ηi .
n
Eη [η] =
(106)
1X q̃(θ) = (θi + ηi ) = q(θ) + η, n i=1 Pn
1 n2 t2
so it remains to find Eη [η 2 ]. Averaging over the Laplace noise, where each ηi ∼ Lap (b) with mean 0 and variance 2b2 , and using the fact that each noise term is sampled independently, we have
Thus, the GHZ state is actually exposed to the quantity
where η = n1 error as
2
Proof. Note that, by construction, this protocol is local since each node applies their noise locally and no trusted curator is assumed to exist. To analyze the mean-squared error, we note that by introducing Laplace noise, the Hamiltonian becomes n 1X
(113)
(112)
2b2 . n
Putting everything together, we have 1 2b2 . εMSE = O 2 2 + n t n
(119)
(120)
By Thm. 7, b≥
θmax − θmin . ε
(121)
Thus, θmax − θmin . (122) b We choose b = Θ n−(α−1)/2 to enforce εMSE = O(n−α ), which implies ε = Θ n(α−1)/2 , (123) ε≥
as claimed in the theorem.
■
We note that we restrict our analysis to the GHZ state because, as we show in Sec. A, the GHZ state is among the set of states that is the worst for privacy, while being
19 optimal for sensing. Note also that Thm. 8 implies a tradeoff between the privacy and the utility of the noisy Hamiltonian protocol, which we parameterize by α. We are only interested in the regime 1 ≤ α ≤ 2, where α = 1 gives us the standard quantum limit for the scaling of εMSE , α = 2 gives us Heisenberg scaling, and 1 < α < 2 gives us an intermediate scaling. Analyzing the resulting privacy parameter for each of these in turn, we have 1. Standard quantum limit: Taking α = 1 in the expression for ε, we find ε = Θ(1) ,
(124)
that is, a constant privacy parameter ε is possible, which is desired from the privacy perspective. 2. Heisenberg limit: Taking α = 2 in the expression for ε, we have √ (125) ε=Θ n , that is, the privacy parameter grows with the square root of the number of sensors n. 3. Intermediate regime: Between α = 1 and α = 2, ε scales sub-linearly with n, but slower than the square root of n. Thus, we see that constant-ε local differential privacy is only possible if we accept a mean-squared error that scales according to the standard quantum limit. In this case, there is no benefit to using the entangled protocol and the same levels of privacy and function estimation quality can be achieved using an unentangled protocol with local Laplace noise added by each node. We prove this in Sec. B 3. On the other hand, if we wish to achieve √ Heisenberg-limited scaling in εMSE , then ε = Θ( n), which means that we lose privacy as we try to get a more accurate function estimate. As we often desire small values for ε, taking α = 2 is therefore not desirable. Thus, the advantage of this protocol lies in the intermediate regime, where the user can choose the best value for α that satisfies both their desired privacy and utility. The scaling in Thm. 8 follows from the generic bound that we found in Thm. 7, and so it applies to arbitrary attacks and arbitrary transcripts obtained from the locally randomized parameter by post-processing. However, this is a conservative bound, and in Sec. B 1, we analyze the privacy using the quantum hockey-stick divergence. Using these techniques, we can find smaller values for ε while still achieving Heisenberg scaling for the mean-squared error. In particular, when considering the full bit-by-bit learning protocol and for the special case of a one-sample, one-quadrature version of the K = 1 set ting, we find ε = Θ ln 1 + nα−1 , which is constant for α = 1 and scales as Θ((α − 1) ln n) for 1 < α ≤ 2. This is markedly better than the bound we get using the generic bound on b in Thm. 7. However, for larger values of K, we are unable to find simple, closed-form expressions and instead provide numerical results.
Finally, we clarify the adversarial model assumed in the above analysis. Our statement about the scaling of εMSE applies in the honest setting, that is, where all of the nodes behave honestly (i.e., not adversarially) by sampling their own noise independently and running the sensing protocol correctly: coupling their qubit to their (noisy) parameter, allowing it to evolve for time t, making a measurement, and broadcasting their result. On the other hand, the statements we make about the privacy pertain to the worst-case scenario, where all but one of the nodes are assumed to be adversarial. The connection between these two perspectives is that it tells us how much noise must be added to ensure that, if there is only a single honest node, then that node’s data is protected with privacy budget ε. If, however, we are in the honest setting, the fact that every node samples noise according to what is required in the worst-case scenario gives us the resulting scaling of εMSE in Eq. (103). The key is that any given node does not know which setting they are in, and this gives us the tradeoff in the theorem. We relax this adversarial model in the next subsection, where we show that we can get an improved privacy-utility tradeoff for the noisy Hamiltonian protocol if we allow for an honest fraction of nodes.
C.
Noisy Hamiltonian protocol with an honest fraction
In the previous subsection, we derived a general tradeoff between the achievable level of privacy and the utility of the sensing protocol for the noisy Hamiltonian protocol. While we are able to achieve a more favorable scaling of ε = Θ((α − 1) ln n) for the specific case of K = 1 (see Sec. B 1), our general analysis results in a scaling for ε that is polynomial in n, which is undesirable. Recall that the analysis in the previous subsection was for a single honest node protecting its parameter against all other nodes in the network. In this subsection, we consider a less pessimistic setting, where we assume that the noisy Hamiltonian protocol is implemented where at least a constant fraction of the network is honest. As usual, the correctness and privacy statements that we make below refer to two different scenarios. In the honest setting, all nodes follow the protocol, and we analyze the resulting mean-squared error of the function estimate. In the adversarial setting, malicious nodes can behave arbitrarily and do not necessarily follow the protocol as specified. The privacy guarantee in this subsection is thus an aggregate-output guarantee: the released subset-average estimate is protected by the total Gaussian noise contributed by the honest nodes in the queried subset. When the verified GHZ implementation ensures that the honest parameters enter the adversary’s view only through the aggregate phase, the same guarantee applies to any transcript obtained by post-processing that aggregate information. However, we do not claim that the honest-fraction noise scale protects arbitrary unveri-
20
Algorithm 4 Honest-fraction noisy Hamiltonian protocol Input: Same input as Alg. 3, constants c > 1, β > 1 − 1/c, subset S ⊆ [n] with |S| ≥ βn, privacy parameters ε, δ P Output: Noisy estimate Q̃S of qS (θ) = |S|−1 i∈S θi 1: Choose κ such that κ2 > 2 ln(1.25/δ) 1 √ 2: σℓ ← κ∆ ε (β−1+1/c)n
3: Generate and verify GHZ state on nodes in S 4: if GHZ verification fails then 5: return ⊥ 6: end if 7: for i ∈ S do 8: Honest node i samples noise ηi ∼ N (0, σℓ2 ) 9: end for P z 10: Define noisy Hamiltonian H̃S = 12 i∈S (θi + ηi )σi 11: for m ∈ [M ] do 12: Evolve GHZ state under H̃S for time t 13: Measure parity operator on nodes in S 14: pm ← parity measurement result 15: end for PM 1 16: Estimate noisy parity expectation ⟨PS ⟩est ← M m=1 pm 17: Compute
noisy
subset-average
estimate
Q̃S
←
1 arccos (⟨PS ⟩est ) |S|t
eS 18: return Q
fied transcripts that reveal individual honest nodes’ noisy parameters. We summarize this protocol in Alg. 4. We assume that we are promised that at least a 1/c fraction of the n nodes in the network are honest, where c > 1 is a known constant. If we denote by Shon ⊆ [n] the honest set, then we have n |Shon | ≥ . (126) c We also assume a common source of randomness to verify the GHZ state. We restrict the allowed queries to averages of subsets of the nodes’ parameters of the form 1 X qS (θ) = θi , (127) |S| i∈S
where the queried subset S ⊆ [n] is public and fixed before the execution of the protocol. In particular, the size of the subset satisfies |S| ≥ βn
(128)
for some constant 1 β >1− . c
(129)
This guarantees that every allowable subset contains a linear number of honest nodes. That is, since there are at most (1 − 1/c)n dishonest nodes, any allowable subset S contains at least 1 1 |S ∩ Shon | ≥ |S| − 1 − n≥ β−1+ n (130) c c
honest nodes. In the analysis below, we assume that adversarial nodes do not add noise and do not couple their parameters to their qubits, as each of these things does nothing to help the adversary learn anything about the honest nodes’ parameters. As a result, our privacy analysis finds the minimum amount of noise that honest nodes must add in order to achieve (ε, δ)-differential privacy; any additional noise added by an adversary will simply add more noise than is necessary to achieve the desired level of privacy and can decrease utility. For each distinct allowable query S, we assume that each honest node i ∈ S samples fresh independent Gaussian noise ηi ∼ N (0, σℓ2 ), where σℓ =
κ∆ 1 , ·q ε (β − 1 + 1 )n
(131)
c
where ∆ := θmax − θmin
and
κ2 > 2 ln(1.25/δ),
(132)
in line with the definition of the Gaussian mechanism in Def. 10. We hold the sampled noise fixed for all sensing shots used to answer the query so as to not destroy the sensing advantage (see Sec. B 2), but we stress that the noise is resampled independently for each distinct query; we discuss this more below. If the same query is asked again, the protocol can simply return the same cached function estimate that was released before, rather than rerunning the sensing protocol with the same privacy budget but new noise. Within each query, each honest participating node evolves its qubit under the noisy Hamiltonian 1X H̃S = (θi + ηi )σiz , (133) 2 i∈S
where adversarial nodes behave arbitrarily. With this, we state the main result of this subsection: Theorem 9 (Honest-fraction noisy Hamiltonian protocol for allowed subset averages). Fix constants c > 1, β > 1 − 1c , ε > 0, δ ∈ (0, 1), and κ2 > 2 ln(1.25/δ) and let ∆ and σℓ be as given above in Eqs. (131) and (132), respectively. For every allowed subset S ⊆ [n] satisfying |S| ≥ βn, consider the noisy Hamiltonian protocol, where each honest node i ∈ S applies noise ηi ∼ N (0, σℓ2 ) independently and uses the same, fixed noise for all sensing shots associated with that query. Then, we have the following: 1. Correctness in the honest setting. If all nodes in S are honest and follow the protocol, then the protocol estimates 1 X qS (θ) = θi (134) |S| i∈S
with mean-squared error ! 1 κ2 ∆2 εMSE = O + . 2 ε2 (β − 1 + 1c )n|S| |S| t2
(135)
21 Since |S| ≥ βn, the mean-squared error scales as O 1/n2 for constant c, β, ε, and δ, and thus retains Heisenberg scaling. 2. Privacy in the adversarial setting. Suppose Shon ⊆ [n] is the set of honest nodes, where |Shon | ≥ n/c. For any allowed queried S, if the honest nodes follow the protocol, then the released noisy estimate of the average of the subset’s parameters is (ε, δ)differentially private with respect to changing one honest node’s parameter. Proof. We first prove the correctness in the honest setting. When all nodes in the queried subset S are honest, the protocol estimates the function 1 X q̃S (θ) = (θi + ηi ) = qS (θ) + ZS , (136) |S|
With the lower bound on |S ∩ Shon | from above, we have Var[ZShon ] ≥
(β − 1 + 1c )n 2
|S| 2 2 κ ∆ = 2. ε2 |S|
ZS =
(137)
2
|S|
GS =
Var[ηi ] =
i∈S
σℓ2 . |S|
(138)
as the lower bound on the size of the honest set of nodes included in the query. Since only honest nodes are assumed to add noise, the aggregate noise added is X 1 ZShon = ηi , (141) |S| i∈S∩Shon
so we have 0,
∆ , |S|
|S ∩ Shon |σℓ2 2
|S|
(145)
so by Def. 10, the Gaussian mechanism requires the noise standard deviation to be κGS κ∆ = , ε ε|S|
κ2 ∆2
2.
Using the value for σℓ given in Eq. (131), we have ! 1 κ2 ∆2 . (139) εMSE = O + 2 2 2 ε (β − 1 + 1c )n|S| |S| t Since we have |S| ≥ βn, both terms scale as O 1/n2 for constant c, β, ε, and δ, as claimed in the theorem. We now analyze the adversarial setting. The adversary may behave arbitrarily (e.g., not coupling its parameters to its qubits), and so we make no claim on the resulting function estimate accuracy and instead analyze the privacy of the protocol. With the query set S and the set of honest nodes in the full network denoted by Shon ⊆ [n], where |Shon | ≥ n/c, we have 1 |S ∩ Shon | ≥ β − 1 + n (140) c
ZShon ∼ N
(144)
ε2 |S|
is the aggregate noise contributed by the honest nodes. Conditioned on the sampled noise, the usual entangled 2 sensing analysis gives us a variance of O 1/(|S| t2 ) for εMSE . Averaging over the Gaussian noise, we have 1 X
(143)
(146)
and so the variance is
1 X ηi |S| i∈S
Var[ZS ] =
κ2 ∆2 ε2 (β − 1 + 1c )n
The sensitivity of the subset average function qS (θ) to changing one honest node’s parameter value is
i∈S
where
·
! .
(142)
(147)
As we showed above, the honest aggregate noise has at least this variance, and so the released noisy subset average is (ε, δ)-differentially private by Thm. 2, completing the proof. ■ We highlight that the restriction on the type of queries (i.e., the allowed subsets S) is necessary. If the adversary could query a subset S containing only one honest node j and otherwise dishonest nodes, then the dishonest nodes could choose not to couple their qubits or add noise to their systems. The released value would then be equivalent to q̃S ≈
θj + η j , |S|
(148)
which the adversary could then simply multiply by |S| to get θj + ηj . With the noise used √ in Thm. 9, ηj has a standard deviation scaling as O(1/ n), so this allows the adversary to learn θj with vanishing error as the size of the network, n, grows. The condition |S| ≥ βn with β > 1 − 1/c thus rules out this attack by ensuring that every allowed subset contains at least (β − 1 + 1/c)n honest nodes. We also stress the importance of fresh independent noise being used for each distinct query. If the same ηi were used across distinct subset averages, then an adversary could perform a differencing attack using, for example, two queries, one including the full network and one excluding the target parameter: nq̃[n] − (n − 1)q̃[n]\{j} = θj + ηj . (149) √ Since σℓ = O(1/ n), this vanishes with increasing network size n. Instead, using resampled noise, we have nq̃[n] − (n − 1)q̃[n]\{j} = θj + Wj ,
(150)
22 where (1)
X
Wj =
ηi
i∈Shon
(2)
X
−
ηi ,
(151)
distinguishing advantage is controlled by the effective privacy parameters εeff = kε0 d/∆ and δeff = kδ0 . Thus, we have
i∈Shon \{j}
where the superscript denotes which query the noise is coming from. Since these two queries use fresh independent Gaussian noise, we have Wj ∼ N (0, (2|Shon | − 1)σℓ2 ). Since |Shon | ≥ n/c, we have 2n − 1 σℓ2 . Var[Wj ] ≥ c
(152)
(153)
psucc ≤
ekε0 d/∆ + kδ0 . 1 + ekε0 d/∆
(159)
For small kδ0 and d ≪ ∆/(kε0 ), this is close to 1/2 (i.e., only slightly better than random guessing) and for d = ∆, this reduces to the usual worst-case (kε0 , kδ0 )-differential privacy guarantee. We note that, using the strong composition theorem [57], we can improve the dependence on √ k, giving a k-type scaling rather than k, at the expense of a larger (but still small) value for δ, but for simplicity we only use the basic composition theorem in Thm. 3.
Using σℓ2 =
κ2 ∆2 , 2 ε0 (β − 1 + 1c )n
V.
where ε0 is the per-query privacy parameter, we have 2 1 κ2 ∆2 Var[Wj ] ≥ − (155) 2 c n ε0 (β − 1 + 1c ) 2 2 κ ∆ =⇒ Wj ∼ N 0, Ω (156) ε20 for constant c and β > 1−1/c. Thus, the adversary learns θj only up to constant-scale Gaussian noise, independent of n, and so the noise does not vanish as we increase n, as it did above where we did not resample the noise. More generally, the adversary may ask for k distinct subset-average queries qS1 , . . . , qSk , where each Sr satisfies |Sr | ≥ βn and each run of the protocol uses fresh independent Gaussian noise allowing for (εr , δr )-differential privacy. By the composition theorem in Thm. 3, the rePk Pk lease of all k queries is ( r=1 εr , r=1 δr )-differentially private. If εr = ε0 and δr = δ0 for all r ∈ [k], then this release is (kε0 , kδ0 )-differentially private. Thus, to achieve a privacy budget of (ε, δ) for k distinct queries, it suffices to take ε0 = ε/k and δ0 = δ/k, with the corresponding increase in the noise parameter σℓ : σℓ =
1 κ′ ∆ ·q , ε/k (β − 1 + 1 )n
(157)
c
where ′ 2
(κ ) > 2 ln
1.25k δ
.
DISCUSSION
(154)
(158)
Thus, for constant k, the mean-squared error in the honest setting still scales as O 1/n2 . As discussed in Sec. II D, this transcript-level guarantee also bounds every post-processing attack on the released estimates. In particular, for two candidate values of the target parameter separated by a distance d ≤ ∆, the adversary’s
In this work, we introduced local and global protocols for differentially private quantum sensing in different network settings, where each protocol comes with a set of tradeoffs that the user can balance based on their needs. To measure the performance of each protocol, we introduced a set of three criteria: one correctness condition (the scaling of the mean-squared error on the function estimate) and two soundness conditions (locality and privacy). To the best of our knowledge, our work is the first use of explicit differentially private mechanisms in the context of entangled quantum sensing, and we hope that this work inspires future research along these lines. The privacy of quantum sensing protocols and clients’ data should be considered an integral part of any application of quantum sensing, especially as we approach an era in which quantum sensors and other quantum technologies can be implemented regularly and reliably in commercial applications. There are a number of potential applications for the differentially private quantum sensor network protocols that we have introduced in this paper. Biomedical data is an obvious domain that would benefit from differentially private sensing, but other applications such as geophysical sensors deployed in financially or militarily strategic settings would also benefit. We hope this work lays the groundwork for other exciting applications of differentially private quantum distributed sensing, such as in more general learning problems. We leave open a number of possible future directions and improvements. One direction is to develop further notions of security, using both differential privacy as we have done in this paper but also invoking cryptographic assumptions (e.g., to simulate a trusted curator). We leave to future work exact mechanisms for realizing correlated noise that can be used by honest nodes to add noise in such a way that Heisenberg scaling is maintained with improved coefficients and milder assumptions while still retaining local privacy. Another approach could be for the network to verify that there is sufficient noise in
23 the GHZ state, before nodes input their data. Furthermore, as mentioned in Sec. IV, we leave to future work the analysis of an explicit GHZ state verification protocol, including errors, that is tailored to the settings we consider in this work. As we show in Sec. A below, there is a notion of optimality from both the sensing and the privacy perspectives. While we only consider the GHZ state in this work, optimizing over states to strike a balance between optimality for sensing versus privacy could be an interesting dimension to add to the analysis of our protocols. In addition, we would like to improve the bound we get for ε in Thm. 8 by analytically bounding the hockeystick divergence, which we were only able to do for the specific case of K = 1. Obtaining a tight analytic result for the full bit-by-bit learning protocol for arbitrary K and ν would be useful. In particular, we expect that we can relax the assumptions to only a common source of randomness if we allow for ε = O(ln n). In this work, we only considered the average function to highlight the privacy aspects of our protocols, but the mechanisms can be adapted to more general linear functions of the form q(θ) = α · θ, though the sensitivity and allowed-query conditions must be revisited. Further extensions to functions beyond linear [58] would also be interesting. Finally, in this work we assumed our sensors were qubits; we leave open the possibility of implementing differentially private quantum sensing protocols using bosons [59–62], which may open new avenues for physically implementing noise to achieve differential privacy. We hope that this work generates interest in the unification of differential privacy and quantum sensing, and
highlights the importance of privacy in practical implementations of quantum sensor networks.
[1] C. Degen, F. Reinhard, and P. Cappellaro, Quantum sensing, Reviews of Modern Physics 89, 035002 (2017). [2] V. Giovannetti, S. Lloyd, and L. Maccone, Quantumenhanced measurements: beating the standard quantum limit, Science 306, 1330 (2004). [3] V. Giovannetti, S. Lloyd, and L. Maccone, Quantum metrology, Physical Review Letters 96, 010401 (2006). [4] Z. Eldredge, M. Foss-Feig, J. A. Gross, S. L. Rolston, and A. V. Gorshkov, Optimal and secure measurement protocols for quantum sensor networks, Physical Review A 97, 042337 (2018). [5] F. Belliardo and V. Giovannetti, Achieving Heisenberg scaling with maximally entangled states: an analytic upper bound for the attainable root mean square error, Physical Review A 102, 042613 (2020). [6] T. Qian, J. Bringewatt, I. Boettcher, P. Bienias, and A. V. Gorshkov, Optimal measurement of field properties with quantum sensor networks, Physical Review A 103, L030601 (2021). [7] J. Bringewatt, I. Boettcher, P. Niroula, P. Bienias, and A. V. Gorshkov, Protocols for estimating multiple functions with quantum sensor networks: geometry and performance, Physical Review Research 3, 033011 (2021). [8] A. Ehrenberg, J. Bringewatt, and A. V. Gorshkov, Min-
imum entanglement protocols for function estimation, Physical Review Research 5, 033228 (2023). [9] M. Nabighian, V. Grauch, R. Hansen, T. LaFehr, Y. Li, J. Peirce, J. Phillips, and M. Ruder, The historical development of the magnetic method in exploration, Geophysics 70, 1ND (2005). [10] T. J. Wright, B. E. Parsons, and Z. Lu, Toward mapping surface deformation in three dimensions using InSAR, Geophysical Research Letters 31, L01607 (2004). [11] N. Aslam, H. Zhou, E. K. Urbach, M. J. Turner, R. L. Walsworth, M. D. Lukin, and H. Park, Quantum sensors for biomedical applications, Nature Reviews Physics 5, 157 (2023). [12] E. Boto, N. Holmes, J. Leggett, G. Roberts, V. Shah, S. S. Meyer, L. D. Muñoz, K. J. Mullinger, T. M. Tierney, S. Bestmann, G. R. Barnes, R. Bowtell, and M. J. Brookes, Moving magnetoencephalography towards realworld applications with a wearable system, Nature 555, 657 (2018). [13] K. Jensen, M. A. Skarsfeldt, H. Stærkind, J. Arnbak, M. V. Balabas, S.-P. Olesen, B. H. Bantzen, and E. S. Polzik, Magnetocardiography on an isolated animal heart with a room-temperature optically pumped magnetometer, Scientific Reports 8, 16218 (2018).
ACKNOWLEDGMENTS
The authors thank Yusuf Alnawakhtha, Jacob Bringewatt, Adam Ehrenberg, Eleanor Rieffel, Yuxin Wang, and Yu Wei for helpful discussions. D.J.S. acknowledges support from a graduate research fellowship from the Joint Quantum Institute (JQI) at the University of Maryland, College Park. K.S. acknowledges support from the U.S. Army Research Office (K.S.) under grant No. W911NF-20-1-0015. E.T.K. acknowledges support from the NRC Research Associateship Program at the National Institute of Standards and Technology (NIST), administered by the Fellowships Office of the National Academies of Sciences, Engineering, and Medicine. D.J.S., K.S., E.T.K., and A.V.G. were supported in part by ONR MURI, AFOSR MURI, the DoE ASCR Quantum Testbed Pathfinder program (award No. DE-SC0024220), NSF QLCI (award No. OMA-2120757), NSF STAQ program, DARPA SAVaNT ADVENT, ARL (W911NF-24-2-0107), and NQVL:QSTD:Pilot:FTL. D.J.S., K.S., E.T.K., and A.V.G. also acknowledge support from the U.S. Department of Energy, Office of Science, National Quantum Information Science Research Centers, Quantum Systems Accelerator (Award No. DE-SCL0000121), and from the U.S. Department of Energy, Office of Science, Accelerated Research in Quantum Computing, Fundamental Algorithmic Research toward Quantum Utility (FAR-Qu).
24 [14] K. Jensen, M. Zugenmaier, J. Arnbak, H. Stærkind, M. V. Balabas, and E. S. Polzik, Detection of lowconductivity objects using eddy current measurements with an optical magnetometer, Physical Review Research 1, 033087 (2019). [15] C. Deans, L. Marmugi, S. Hussain, and F. Renzoni, Electromagnetic induction imaging with a radio-frequency atomic magnetometer, Applied Physics Letters 108, 103503 (2016). [16] S. Xu, V. V. Yashchuk, M. H. Donaldson, and A. Pines, Magnetic resonance imaging with an optical atomic magnetometer, Proceedings of the National Academy of Sciences 103, 12668 (2006). [17] A. J. Brady, C. Gao, R. Harnik, Z. Liu, Z. Zhang, and Q. Zhuang, Entangled sensor-networks for dark-matter searches, PRX Quantum 3, 030333 (2022). [18] X. Guo, C. R. Breum, J. Borregaard, S. Izumi, M. V. Larsen, T. Gehring, M. Christandl, J. S. NeergaardNielsen, and U. L. Andersen, Distributed quantum sensing in a continuous-variable entangled network, Nature Physics 16, 281 (2020). [19] Z. Huang, C. Macchiavello, and L. Maccone, Cryptographic quantum metrology, Physical Review A 99, 022314 (2019). [20] N. Shettell, M. Hassani, and D. Markham, Private network parameter estimation with quantum sensors, arXiv:2207.14450 (2022). [21] H. Kasai, Y. Takeuchi, H. Hakoshima, Y. Matsuzaki, and Y. Tokura, Anonymous quantum sensing, Journal of the Physical Society of Japan 91, 074005 (2022). [22] S. W. Moore and J. A. Dunningham, Secure quantum remote sensing without entanglement, arXiv:2302.03617 (2023). [23] S. W. Moore and J. A. Dunningham, Secure quantumenhanced measurements on a network of sensors, arXiv:2406.19285 (2024). [24] L. Bugalho, M. Hassani, Y. Omar, and D. Markham, Private and robust states for distributed quantum sensing, arXiv:2407.21701 (2024). [25] H. Kasai, Y. Takeuchi, Y. Matsuzaki, and Y. Tokura, Direct moment estimation of intensity distribution of magnetic fields with quantum sensing network, New Journal of Physics 26, 123013 (2024). [26] M. Hassani, S. Scheiner, M. G. Paris, and D. Markham, Privacy in networks of quantum sensors, Physical Review Letters 134, 030802 (2025). [27] F. Farokhi, Precision and privacy in distributed quantum sensing: a quantum Fisher information duality, arXiv:2605.20765 https://doi.org/10.48550/arXiv.2605.20765 (2026). [28] C. Dwork, F. McSherry, K. Nissim, and A. Smith, Calibrating noise to sensitivity in private data analysis, Proceedings of the Third Conference on Theory of Cryptography 3876, 265 (2006). [29] C. Dwork, Differential privacy, Proceedings of the 33rd International Conference on Automata, Languages and Programming—Volume Part II 4052, 1 (2006). [30] E. Shi, T.-H. H. Chan, E. G. Rieffel, R. Chow, and D. Song, Privacy-preserving aggregation of time-series data, Proceedings of the Network and Distributed System Security Symposium, NDSS (2011). [31] L. Zhou and M. Ying, Differential privacy in quantum computation, 2017 IEEE 30th Computer Security Foundations Symposium , 249 (2017).
[32] Y. Yoshida and M. Hayashi, Classical mechanism is optimal in classical-quantum differentially private mechanisms, 2020 IEEE International Symposium on Information Theory , 1973 (2020). [33] C. Hirche, C. Rouzé, and D. S. França, Quantum differential privacy: an information theoretic perspective, IEEE Transactions on Information Theory 69, 5771 (2023). [34] Y. Li, Y. Zhao, X. Zhang, H. Zhong, M. Pan, and C. Zhang, Differential privacy preserving quantum computing via projection operator measurements, arXiv:2312.08210 (2023). [35] J. Guan, Optimal mechanisms for quantum local differential privacy, arXiv:2407.13516 (2024). [36] H. Zhong, K. Ju, J. Shen, X. Zhang, X. Qin, O. Tomoaki, M. Pan, and Z. Han, Differential privacy preserving distributed quantum computing, arXiv:2412.12387 (2024). [37] W. Li, S. Lu, and D.-L. Deng, Quantum federated learning through blind quantum computing, Science China Physics, Mechanics & Astronomy 64, 100312 (2021). [38] L. P. Barnes, W.-N. Chen, and A. Ozgur, Fisher information under local differential privacy, arXiv:2005.10783 (2020). [39] F. Farokhi, Tight sample complexity bounds for parameter estimation under quantum differential privacy for qubits, IEEE Control Systems Letters 9, 240 (2025). [40] D. Wineland, J. Bollinger, W. Itano, and D. Heinzen, Squeezed atomic states and projection noise in spectroscopy, Physical Review A 50, 67 (1994). [41] A. Aktay, S. Bavadekar, G. Cossoul, J. Davis, D. Desfontaines, A. Fabrikant, E. Gabrilovich, K. Gadepalli, B. Gipson, M. Guevara, C. Kamath, M. Kansal, A. Lange, C. Mandayam, A. Oplinger, C. Pluntke, T. Roessler, A. Schlosberg, T. Shekel, S. Vispute, M. Vu, G. Wellenius, B. Williams, and R. J. Wilson, Google COVID-19 Community Mobility Reports: Anonymization Process Description (version 1.1), arXiv:2004.04145 (2020). [42] S. Finster and I. Baumgart, Privacy-aware smart metering: a survey, IEEE Communications Surveys & Tutorials 17, 1088 (2015). [43] M. Paré, M. Teehan, S. Suffian, J. Glass, A. Scheer, M. Young, and M. Golden, Applying energy differential privacy to enable measurement of the OhmConnect Virtual Power Plant (2020), accessed Feb. 20, 2026. [44] C. Dwork, A. Roth, et al., The algorithmic foundations of differential privacy, Foundations and Trends® in Theoretical Computer Science 9, 211 (2014). [45] S. Vadhan, The complexity of differential privacy, Tutorials on the Foundations of Cryptography , 347 (2017). [46] J. P. Near, D. Darais, N. Lefkovitz, and G. S. Howarth, Guidelines for Evaluating Differential Privacy guarantees, Tech. Rep. NIST Special Publication (SP) NIST SP 800-226 (National Institute of Standards and Technology, Gaithersburg, MD, 2025). [47] L. Sweeney, Weaving technology and policy together to maintain confidentiality, Journal of Law, Medicine & Ethics 25, 98 (1997). [48] B. Bebensee, Local differential privacy: a tutorial, arXiv:1907.119008v1 (2019). [49] Apple Inc., Differential Privacy Team, Learning with privacy at scale, Apple Machine Learning Research (2017). [50] U. Erlingsson, V. Pihur, and A. Korolova, Rappor: randomized aggregatable privacy-preserving ordinal re-
25 sponse, Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , 1054 (2014). [51] S. L. Warner, Randomized response: A survey technique for eliminating evasive answer bias, Journal of the American Statistical Association 60, 63 (1965). [52] A. Angrisani, M. Doosti, and E. Kashefi, A unifying framework for differentially private quantum algorithms, arXiv:2307.04733 (2023). [53] A. Rényi, On measures of entropy and information, The 4th Berkeley Symposium on Mathematics, Statistics, and Probability 4.1, 547 (1960). [54] P. Kómár, T. Topcu, E. Kessler, A. Derevianko, V. Vuletić, J. Ye, and M. Lukin, Quantum network of atom clocks: a possible implementation with neutral atoms, Physical Review Letters 117, 060506 (2016). [55] A. Pappa, A. Chailloux, S. Wehner, E. Diamanti, and I. Kerenidis, Multipartite entanglement verification resistant against dishonest parties, Physical Review Letters 108, 260502 (2012). [56] T. Chan, E. Shi, and D. Song, Optimal lower bound for differentially private multi-party aggregation, Algorithms — ESA 2012 7501, ESA 2012 (2012). [57] C. Dwork, G. N. Rothblum, and S. Vadhan, Boosting and differential privacy, IEEE 51st Annual Symposium on Foundations of Computer Science , 51 (2010). [58] K. Qian, Z. Eldredge, W. Ge, G. Pagano, C. Monroe, J. Porto, and A. V. Gorshkov, Heisenberg-scaling measurement protocol for analytic functions with quantum sensor networks, Physical Review A 100, 042304 (2019). [59] E. Polino, M. Valeri, N. Spagnolo, and F. Sciarrino, Photonic quantum metrology, AVS Quantum Science 2, 024703 (2020). [60] Q. Zhuang, Z. Zhang, and J. H. Shapiro, Distributed quantum sensing using continuous-variable multipartite entanglement, Physical Review A 97, 032329 (2018). [61] Y. Xia, Q. Zhuang, W. Clark, and Z. Zhang, Repeater-enhanced distributed quantum sensing based on continuous-variable multipartite entanglement, Physical Review A 99, 012328 (2019). [62] J. Bringewatt, A. Ehrenberg, T. Goel, and A. V. Gorshkov, Optimal function estimation with photonic quantum sensor networks, Physical Review Research 6, 013246 (2024). [63] M. M. Wilde, Quantum Information Theory (Cambridge University Press, 2017).
26 Appendix A: The GHZ state is in the family of states that leak the most information
In this appendix, we prove the claim made in Sec. IV B that the GHZ state is among the set of worst states to use from the privacy perspective. We consider the GHZ state because it has been proven before [4] that it is among the set of best states to use from the sensing perspective. We first characterize the least private pure states for a single honest qubit. Then, we extend the result to an honest qubit entangled with an arbitrary adversarial register. This shows that the GHZ state is among the family of least-private states. We quantify privacy leakage using the quantum hockey-stick divergence Eγ , where γ = eε , as defined in Def. 15. For a fixed pair of candidate parameter values θ and θ′ , we define the unitary evolution operators z
Uθ = e−iθtσ /2 ,
′
z
Uθ′ = e−iθ tσ /2 .
(A1)
The quantum hockey-stick divergence quantity that measures the distinguishability of states is Eγ (ρθ ||ρθ′ ), where ρθ and ρθ′ are the post-evolution states we obtain after applying Uθ or Uθ′ to the honest qubit’s initial state. We define the quantity δθ := t(θ − θ′ ) for convenience. If δθ ≡ 0 (mod 2π), then the two evolutions are identical up to a global phase, and so no state leaks any information about which parameter was used. Thus, in our analysis below, we restrict to cases where δθ ̸≡ 0 (mod 2π). Lemma 1 (Least private single-qubit pure state). For a single qubit, among all pure input states, the states that maximize Eγ (ρθ ||ρθ′ ) are states of the form 1 |+ϕ ⟩ = √ |0⟩ + eiϕ |1⟩ , 2
(A2)
where ϕ ∈ [0, 2π). Proof. Write an arbitrary initial single-qubit pure state as |ψ0 ⟩ =
√
p |0⟩ + eiϕ
p 1 − p |1⟩ ,
(A3)
where p ∈ [0, 1]. After applying the two possible evolution operators Uθ or Uθ′ , the possible post-evolution states are |ψθ ⟩ = Uθ |ψ0 ⟩ ,
|ψθ′ ⟩ = Uθ′ |ψ0 ⟩ .
(A4)
The overlap between these states is then f := ⟨ψθ |ψθ′ ⟩ = peiδθ /2 + (1 − p)e−iδθ /2 .
(A5)
Taking the modulus squared, we have 2
|f | = 1 − 4p(1 − p) sin
2
δθ . 2
(A6)
For two pure states ρθ = |ψθ ⟩⟨ψθ | and ρθ′ = |ψθ′ ⟩⟨ψθ′ |, the only possible positive eigenvalue of the quantity ρθ − γρθ′ is q 1−γ 1 2 λ+ = + (1 − γ)2 + 4γ(1 − |f | ). (A7) 2 2 2
Thus, Eγ (ρθ ||ρθ′ ) = λ+ , and so maximizing the hockey-stick divergence is equivalent to minimizing |f | in Eq. (A6), which in turn is equivalent to maximizing δθ 2 4p(1 − p) sin . (A8) 2 Since δθ is fixed, this quantity is clearly maximized when p = 1/2. The phase ϕ does not affect the overlap, so substituting this value for p into Eq. (A3), we see that the least private pure states are exactly of the form 1 |+ϕ ⟩ = √ |0⟩ + eiϕ |1⟩ , 2 as claimed in the statement of the lemma.
(A9) ■
27 Note that Lemma 1 applies to pure states. It turns out that mixed single-qubit states cannot leak more information. In particular, we have: Corollary 1 (Mixed single-qubit states cannot leak more information). No mixed single-qubit input state yields a larger hockey-stick divergence than the pure states of the form given by Eq. (A2). Proof. Let ρ0 =
X
pi |ψi ⟩⟨ψi |
(A10)
i
be an arbitrary mixed input state. Then, the two possible post-evolution states under parameters θ and θ′ are ρθ =
X
pi Uθ |ψi ⟩⟨ψi | Uθ† ,
pi Uθ′ |ψi ⟩⟨ψi | Uθ†′ .
(A11)
pi Eγ Uθ |ψi ⟩⟨ψi | Uθ† ||Uθ′ |ψi ⟩⟨ψi | Uθ†′ .
(A12)
ρθ′ =
X
i
i
Using the convexity of the hockey-stick divergence [33], we have Eγ (ρθ ||ρθ′ ) ≤
X i
Then, because each pure-state term is bounded above by the value we obtained in the proof of Lemma 1, the mixture is bounded above by this value. ■ We now consider the multi-qubit case, where the first qubit is given to the honest party and the remaining qubits are given to the adversary. We find that the GHZ state is among the set of least private states, though it is not the only one. As we show below, the other states in this family of states give the same hockey-stick divergence, so it suffices to consider the GHZ state used in the sensing protocol as providing the least privacy. Lemma 2 (Least private pure states with an adversarial system). Let H denote the honest qubit and A denote an arbitrary adversarial system. Suppose only the honest qubit undergoes the parameter-dependent evolution such that |Ψθ ⟩ = (Uθ ⊗ IA ) |Ψ0 ⟩ ,
|Ψθ′ ⟩ = (Uθ′ ⊗ IA ) |Ψ0 ⟩ .
(A13)
Among all pure states |Ψ0 ⟩ ∈ HH ⊗ HA , the states that maximize the hockey-stick divergence Eγ (|Ψθ ⟩⟨Ψθ | || |Ψθ′ ⟩⟨Ψθ′ |) are of the form 1 |Ψ0 ⟩ = √ (|0⟩H |u⟩A + |1⟩H |v⟩A ) , 2
(A14)
where |u⟩A and |v⟩A are arbitrary normalized states of the adversarial system. Proof. We start by writing an arbitrary pure state as |Ψ0 ⟩ = |0⟩H |a⟩A + |1⟩H |b⟩A ,
(A15)
where |a⟩A and |b⟩A are arbitrary (potentially unnormalized) states in the adversary’s register and where ⟨a|a⟩ + ⟨b|b⟩ = 1.
(A16)
If we denote by p0 = ⟨a|a⟩ ,
p1 = ⟨b|b⟩ = 1 − p0 ,
(A17)
then the overlap between the post-evolution states is given by f = ⟨Ψθ |Ψθ′ ⟩ = p0 eiδθ /2 + p1 e−iδθ /2 .
(A18)
Taking the modulus squared, we find 2
2
|f | = 1 − 4p0 p1 sin
δθ . 2
(A19)
28 2
Just as we saw in the proof for Lemma 1, the hockey-stick divergence is maximized when |f | is minimized, which happens when p0 = p1 = 1/2. Thus, we take 1 |a⟩A = √ |u⟩A , 2
1 |b⟩A = √ |v⟩A , 2
(A20)
where |u⟩A and |v⟩A are now normalized states. Thus, the least private pure states are exactly 1 |Ψ0 ⟩ = √ (|0⟩H |u⟩A + |1⟩H |v⟩A ) , 2
(A21)
as claimed in the statement of the lemma. ⊗(n−1)
If we take |u⟩A = |0⟩
■ iϕ
⊗(n−1)
and |v⟩A = e |1⟩
, then the initial state becomes 1 ⊗n ⊗n |Ψ0 ⟩ = √ |0⟩ + eiϕ |1⟩ . 2
(A22)
For arbitrary ϕ ∈ [0, 2π), this is exactly the family of GHZ states, up to a relative phase; taking ϕ = 0 gives the usual GHZ state. Thus, this GHZ family is least private under the no-coupling attack, but note that this set of states is not unique. Taking |u⟩A = |v⟩A = |χ⟩A , we have the product state 1 |Ψ0 ⟩ = √ |0⟩H + eiϕ |1⟩H ⊗ |χ⟩A , 2
(A23)
which leaks the same amount of information about the honest party’s parameter as the family of entangled states. More generally, for any adversarial mixed state σA , the mixed state |+ϕ ⟩⟨+ϕ |H ⊗ σA
(A24)
achieves the same maximal leakage of information. Thus, we have shown that the GHZ state is among the set of states that is worst for privacy. The same property that makes it optimal for sensing, namely that it has maximal coherence between the extremal eigenspaces of the generator of field evolution, also makes it the least private. We also showed that the set of states that are worst for privacy is larger than the set of states that are optimal for sensing, as evidenced by the inclusion of both entangled and product states. Finally, we show that, for the average function and Hamiltonian considered in this work, the set of pure states that ⊗n ⊗n are optimal for sensing are of the form √12 (|0⟩ + eiϕ |1⟩ ), and thus are contained in the family of least private states characterized above. This result is a consequence of the work done in Ref. [4], but we include it here for completeness. Pn Lemma 3 (Set of optimal states for sensing average function). Consider the n-qubit Hamiltonian H = 12 i=1 θi σiz P n and the average function q(θ) = n1 i=1 θi . Among all pure n-qubit states, those that maximize the quantum Fisher information for estimating q(θ), and thus are optimal for sensing, are of the form 1 ⊗n ⊗n |ψ0 ⟩ = √ |0⟩ + eiϕ |1⟩ , ϕ ∈ [0, 2π). (A25) 2 Pn Proof. Given the average function q(θ) = n1 i=1 θi , the associated generator is n
G :=
1X z σ . 2 i=1 i
(A26)
To maximize the sensitivity to q, we consider the family of states |ψq ⟩ = e−itqG |ψ0 ⟩ ,
(A27)
where the quantum Fisher information can be calculated as 2 FQ = 4 ⟨∂q ψq |∂q ψq ⟩ − |⟨ψq |∂q ψq ⟩| 2
2
2
= 4 t ⟨ψq |G |ψq ⟩ − t ( ⟨ψq |G|ψq ⟩) = 4t2 ⟨G2 ⟩ψq − ⟨G⟩2ψq = 4t2 Varψq [G].
(A28) 2
(A29) (A30) (A31)
29 G commutes with the evolution operator e−itqG and so its variance is independent of q, so we can write FQ = 4t2 Varψ0 [G].
(A32)
As such, maximizing the quantum Fisher information comes down to maximizing the variance of G with respect to the input state |ψ0 ⟩. G has eigenvalues − n2 , − n2 + 1, . . . , n2 − 1, n2 , and so the maximum and minimum eigenvalues ⊗n ⊗n are λmax = n2 associated with eigenvector |0⟩ and λmin = − n2 associated with eigenvector |1⟩ , respectively. The variance of G, a Hermitian operator, is bounded by Var[G] ≤
(λmax − λmin )2 n2 = . 4 4
(A33)
This bound is saturated (i.e., we achieve the equality) only if the state has equally-weighted support on the maximumand minimum-eigenspaces of G, which is achieved with pure states of the form 1 ⊗n ⊗n , |ψ0 ⟩ = √ |0⟩ + eiϕ |1⟩ 2
(A34)
where we allow for a relative phase ϕ ∈ [0, 2π). Thus, we have Varψ0 [G] =
n2 4
(A35)
and therefore FQ = 4t2 Varψ0 [G] = n2 t2 .
(A36)
Using the single-shot quantum Cramér-Rao bound, we have Var[Q] ≥
1 1 = 2 2. FQ n t
(A37)
For M shots, we pick up a factor of M in the denominator. Thus, the relative-phase GHZ states are exactly the pure states that maximize the quantum Fisher information and are thus optimal for sensing the average function under this Hamiltonian, as claimed in the lemma. ■ Appendix B: Further analysis of noisy Hamiltonian protocol
In this appendix, we provide further analysis of the noisy Hamiltonian protocol, which we presented in Sec. IV B. We start by analyzing the privacy of the protocol using the quantum hockey-stick divergence in Sec. B 1. Then, in Sec. B 2, we show why we cannot have each node resample their noise with each shot of the sensing protocol. Finally, in Sec. B 3, we show that if we choose α = 1 for the noisy Hamiltonian protocol, which drops the scaling of the mean-squared error down to the standard quantum limit, there is no privacy advantage in using entanglement, and so an unentangled protocol may as well be used.
1.
Privacy analysis via the quantum hockey-stick divergence
Recall from the statement of Thm. 8 that the noisy Hamiltonian protocol is ε-differentially private, that is, δ = 0. In this subsection, we analyze privacy using the quantum hockey-stick divergence defined in Def. 15. This allows us to tightly characterize the amount of noise required to achieve privacy, including in the pure case δ = 0. The analysis in this subsection should be distinguished from the analysis that we did in Sec. IV B, which gives us a generic local differential privacy guarantee that protects the honest party’s information against arbitrary state preparation attacks. Here, instead, we condition on the sensing protocol being run using the GHZ state as specified by the protocol; that is, we assume that the GHZ state verification step has succeeded. Given that local differential privacy protects individual data at the point of local output, in scenarios involving multiple parties, it suffices to consider the worst-case scenario in which we have a single honest node and n − 1 adversarial nodes. The strongest attack consists of all of the adversarial nodes colluding to try to learn the honest node’s parameter, so, without loss of generality, we combine all of the adversarial nodes into one adversary. We label
30 the honest node as node 1 (i.e., θ1 is being measured by the honest node). In this worst-case adversarial setting, where adversarial nodes neither couple their sensors to their parameters nor do they apply any noise, the adversarial sensors are granted maximum access to the honest node’s parameter. We then compute the distinguishability of the adversary’s conditional quantum information as the honest parameter is changed from θ1 to θ1′ , which gives us a sharper privacy bound than we were able to achieve in our generic analysis in Sec. IV B, but it does not apply to arbitrary malicious input states such as product states and is thus more limited in scope. We consider (ε, δ)-differential privacy and show how to achieve δ = 0 to yield perfect ε-differential privacy. In the setting of the strongest attack, where the adversarial nodes do not couple their sensors to their parameters but the honest party does couple, the quantum state only encodes information about the honest party’s parameter. As such, after the honest party couples their sensor to their noisy field parameter and evolves their part of the shared quantum state while the adversaries’ qubits are idle, we have the following final state, where we include the full, bit-by-bit learning protocol detailed in Sec. II A: K E O E Ψ̃f (t)|X1 = θ1 , Y1 = η1 = ψ̃f (tj )|X1 = θ1 , Y1 = η1 .
(B1)
j=1
Here, we make explicit the coupling of the state to the honest node’s parameter (denoted by X1 ) and the honest node’s sampled noise (denoted by Y1 ). Within the tensor product on the right-hand side of Eq. (B1), the state for each stage (i.e., each level of precision) is given as E ⊗2νj ψ̃f (tj )|X1 = θ1 , Y1 = η1 = Ũ (tj ) ⊗ I ⊗(n−1) |ψ0 ⟩ ⊗2νj itj 1 − itj (θ1 +η1 ) ⊗(n−1) ⊗(n−1) (θ1 +η1 ) 2 2 |0⟩ ⊗ |0⟩ +e |1⟩ ⊗ |1⟩ = √ e 2 itj 1 1 itj ⊗(n−1) ⊗(n−1) = √ |+⟩ ⊗ √ e− 2 (θ1 +η1 ) |0⟩ + e 2 (θ1 +η1 ) |1⟩ 2 2 ⊗2νj itj 1 1 itj ⊗(n−1) ⊗(n−1) + √ |−⟩ ⊗ √ e− 2 (θ1 +η1 ) |0⟩ − e 2 (θ1 +η1 ) |1⟩ . 2 2
(B2) (B3)
(B4)
Here, recall from Sec. II A, at each stage j to learn the j th bit of precision of the function, we assume 2νj copies of the state, where νj = ⌊xj ⌉, where xj is given in Refs. [5, 8] by xj =
3 (K − j) + xK , ∀j ∈ [K]. log2 C
(B5)
The constants C and xK are taken as C = 24.26π and xK = 1, which is also shown in Ref. [5]. It is important to note that this is a worst-case analysis. In other words, the scenario in which all other sensors act adversarially and attempt to extract information after the honest sensor broadcasts its output is the most challenging situation the honest sensor may encounter. This is because the only way other sensors can extract information from a quantum state is by a POVM. According to the data processing inequality [63], the information content cannot be increased through any local physical operation. Consequently, it suffices to bound the distinguishability of the adversary’s complete quantum information, as any later measurement is post-processing. We analyze the information about θ1 that could be leaked from the post-measurement state that the adversary holds. After the honest party samples and applies its noise η1 , and then measures its qubit, the state of the system collapses to a conditional state based on the outcome, that is, |+⟩ or |−⟩: itj 1 itj ⊗(n−1) ⊗(n−1) |ϕ+ (tj )|θ1 , η1 ⟩ = |+⟩ ⊗ √ e− 2 (θ1 +η1 ) |0⟩ + e 2 (θ1 +η1 ) |1⟩ 2 itj 1 − itj (θ1 +η1 ) ⊗(n−1) ⊗(n−1) |ϕ− (tj )|θ1 , η1 ⟩ = |−⟩ ⊗ √ e 2 |0⟩ − e 2 (θ1 +η1 ) |1⟩ 2
(B6) (B7)
Repeating this process 2νj times on independent copies of the GHZ state yields the following state held by the dishonest parties: ⊗(2νj −a)
ρθ1 ,η1 (tj ) = (|ϕ+ (tj )|θ1 , η1 ⟩ ⟨ϕ+ (tj )|θ1 , η1 |)
⊗(2νj −a)
= (|ϕ+ (tj )|θ1 , η1 ⟩ ⟨ϕ+ (tj )|θ1 , η1 |)
⊗a
⊗ (|ϕ− (tj )|θ1 , η1 ⟩ ⟨ϕ− (tj )|θ1 , η1 |)
⊗ [Z1 |ϕ+ (tj )|θ1 , η1 ⟩ ⟨ϕ+ (tj )|θ1 , η1 | Z1 ]
(B8) ⊗a
,
(B9)
31 where 2νj − a is the number of copies in the state |ϕ+ (tj )|θ1 , η1 ⟩, and a is the number of copies in the state |ϕ− (tj )|θ1 , η1 ⟩. Moreover, Z1 := Z ⊗ I ⊗(n−1) . Here, we highlight the η1 dependence explicitly. After the honest party broadcasts its measurement result, all other sensors update their view of the system accordingly, where the new state can be found by integrating over η1 : ρθ1 (t) =
Z ∞O K
ρθ1 ,η1 (tj ) Pr[Y1 = η1 ] dη1
(B10)
−∞ j=1
=
" Z ∞O K
⊗(2νj −a)
(|ϕ+ (tj )|θ1 , η1 ⟩ ⟨ϕ+ (tj )|θ1 , η1 |)
−∞ j=1
# ⊗ [Z1 |ϕ+ (tj )|θ1 , η1 ⟩ ⟨ϕ+ (tj )|θ1 , η1 | Z1 ]
⊗a
|η1 | 1 exp − dη1 , 2b b
(B11)
where θ1 represents the honest party’s parameter, incorporated into the state shared by all adversaries. By Thm. 4, finding δ of this algorithm reduces to computing Tr (ρθ1 − γρθ1′ )+ , that is, the sum of the positive eigenvalues of ρθ1 − γρθ1′ . As the quantity in Eq. (B10) is rather complicated, we are only able to get a simple, analytic result for the case where K = 1 and ν = 1. For K > 1 and ν > 1, we make use of numerical techniques. We start by analyzing the K = 1, ν = 1 case. Recall from Sec. II A that the full bit-by-bit learning protocol uses 2νj samples at stage j, with νj samples measured in the X basis and νj samples measured in the Y basis as both quadratures are needed to resolve the phase in the full interval [0, 2π). However, for analytical convenience, we consider a single X-basis measurement, which is enough to produce one bit of information about the phase in units of π, rather than 2π. This is sufficient for the privacy analysis in this subsection. Our goal is to determine δ and then which value of ε we need to choose to achieve δ = 0. To do so, we consider Z ∞ ρθ1 (t) − γρθ1′ (t) = Z1a [|ϕ+ (t)|θ1 , η1 ⟩ ⟨ϕ+ (t)|θ1 , η1 | −∞ |η1 | ′ ′ a 1 dη1 . (B12) −γ |ϕ+ (t)|θ1 , η1 ⟩ ⟨ϕ+ (t)|θ1 , η1 |] Z1 exp − 2b b where a ∈ {0, 1}. This equation further simplifies to 1h ⊗(n−1) ⊗(n−1) ρθ1 (t) − γρθ1′ (t) = |χa ⟩ ⟨χa | ⊗ (1 − γ) |0⟩⟨0| + |1⟩⟨1| 2 1 ⊗(n−1) −itθ1 −itθ1′ + e − γe |0⟩⟨1| 1 + b2 t2 i 1 ⊗(n−1) itθ1 itθ1′ + e − γe |1⟩⟨0| , 1 + b 2 t2 where |χa ⟩ := Z a |+⟩. We find the eigenvalues of this state to be q 1−γ 1 1 2 − 2γ cos (t(θ − θ ′ )) 0, . . . , 0, ± 1 + γ . 1 1 | {z } 2 2 1 + b 2 t2
(B13)
(B14)
2n −2
We note that the parameter a does not affect the final result: different values for a (i.e., the single-qubit outcome being |+⟩ and |−⟩) only involve additional unitary Z1 gates. As these are unitary changes of basis, they do not change the eigenvalues. The only potentially positive eigenvalue is thus q 1−γ 1 1 λ+ = + 1 + γ 2 − 2γ cos (t(θ1 − θ1′ )) (B15) 2 2 1 + b 2 t2 p 1−γ 1 1 ≤ + 1 + γ 2 + 2γ (B16) 2 2 2 21+b t 1 1+γ = (1 − γ) + (B17) 2 1 + b 2 t2 2 + (1 − eε )b2 t2 = . (B18) 2(1 + b2 t2 )
32 This quantity is less than or equal to 0 when 2 ε ≥ ln 1 + 2 2 , b t
(B19)
or, equivalently, when 1 b≥ t
r
2 . eε − 1
(B20)
This is the condition for which δ = 0. Since in this setting we are resolving the final bit up to precision 1/t, our sensing time is in the range t ∈ [2K−1 , 2K ], where K is the total number of bits of precision. As such, we map the time t to the sensitivity with which we can 1 . This gives estimate the parameters: t → θmax −θ min r b ≥ (θmax − θmin )
2 , eε − 1
(B21)
which is in terms of the input parameters that the user knows at the start of the protocol. For small ε ≪ 1 (i.e., high privacy), we can Taylor expand Eq. (B21) to get r b∝
2 ≤ ε e −1
r
2 . ε
(B22)
Recall, from Thm. 7, we take the scale parameter as b = ∆/ε, so using the hockey-stick analysis, we find a square-root improvement on the dependence of ε. In summary, the noisy Hamiltonian protocol achieves differential privacy with smaller noise injected than the direct application of the classical Laplace mechanism, thereby offering improved utility under the same privacy requirements. Recalling the constraint on b from the mean-squared error, b = O n−(α−1)/2 , which we write as b = cn−(α−1)/2 for some constant c, to have δ = 0, we must have 2 ε ≥ ln 1 + 2 2 nα−1 = Θ((α − 1) ln n) . (B23) c t Thus, we see that for this special case of K = 1, analyzing the privacy using the quantum hockey-stick divergence, we can actually achieve ε scaling logarithmically in n for 1 < α ≤ 2 and constant for α = 1. Compare this to the Θ n(α−1)/2 scaling that we arrived at using the generic classical bound in Thm. 7. Thus, for a fixed scale parameter b, which is given by the desired mean-squared error, the quantum hockey-stick analysis improves our bound on ε by a substantial amount. We expect the O(ln n) scaling to hold for arbitrary constant K, since K is independent of n. If we take K > 1 and/or νj > 1, we cannot obtain a simple, closed-form result as we did above. In this case, we resort to numerical analysis for small values of K and νj . We do this by analyzing the right-hand side of δ ≥ Eγ (ρθ1 (t)||ρθ1′ (t)) = Tr (ρθ1 (t) − γρθ1′ (t))+ (B24) numerically. In the no-coupling attack, the adversarial register relevant to the honest phase is supported on the two⊗(n−1) ⊗(n−1) dimensional subspace spanned by |0⟩ and |1⟩ , so for this calculation, the number of adversarial sensors does not change the nonzero spectrum, and it suffices to represent the adversarial register as an effective qubit, which we do by taking n = 2. We choose specific values of θ1 and θ1′ to represent worst-case scenarios in our numerical experiments, that is, the values that are easiest to distinguish. We set t = 1 and take tj = 2j−1 δt, for some unit step of time δt, following Refs. [5, 8]. We calculate the corresponding privacy parameter δ (not to be confused with the time step δt) for scale parameter values b = 0.2, 0.5, 1.0, 2.0 and present the results in Fig. 5. These results indicate an intuitive trend: as K increases (i.e., we seek more bits of precision), the adversary has more samples from which to obtain information, and so the probability of failure to achieve ε-differential privacy increases. At the same time, as we inject more noise into the system (i.e., we increase b), we can achieve a better level of privacy with a lower probability of failure. In real-world applications, we aim to minimize the failure probability, ideally achieving δ = 0. As shown in Fig. 5, the corresponding ε value required to attain δ = 0 increases with the number of bits of precision K for a fixed noise parameter b. This is also intuitive: with a more precise function estimate and a fixed noise injection, the level of privacy decreases, resulting in a larger ε.
33 b=0.2
b=0.5
δ 1.0
δ 1.0
0.8
0.8
0.6
0.6
0.4
0.4
0.2
0.2
0.0 0
2
4
6
8
10
12
14
0.0 0
ϵ
1
2
(a)
b=1
0.4
0.20
0.3
0.15
0.2
0.10
0.1
0.05
1.0
5
0.6
0.8
ϵ 1.0
b=2 δ 0.25
0.5
4
(b)
δ 0.5
0.0 0.0
ϵ
3
0.00 0.0
ϵ 2.0
1.5
0.2
(c)
0.4
(d)
Figure 5. Probability of failure to achieve ε-differential privacy, δ, as a function of privacy level ε, for varying values of bits of precision K = 1 (blue), K = 2 (green) and noise level b = 0.2, 0.5, 1.0, 2.0.
2.
Resampled noise ruins the sensing advantage
In this subsection, we show that the protocol in which each node resamples their noise for every shot in the sensing protocol results in a variance for the function estimate that blows up with time t and the number of parties n. To show this, we will need two probability distributions: the exponential distribution and the gamma distribution. We also make use of the Laplace distribution, which we already defined in Def. 8. We start by defining the exponential distribution: Definition 18 (Exponential distribution). The exponential distribution is the distribution with probability density function ( 1 −x/b e x ≥ 0, f (x; b) = b (B25) 0 x < 0, where b > 0 is the scale parameter. The gamma distribution is defined as: Definition 19 (Gamma distribution). The gamma distribution is the distribution with probability density function ( α−1 −x/b x e x > 0, bα Γ(α) f (x; α, b) = (B26) 0 x ≤ 0, where α > 0 is the shape parameter, b > 0 is the scale parameter, and Γ(α) is the gamma function evaluated at α: Z ∞ Γ(α) = tα−1 e−t dt. (B27) 0
34 With these distributions, we state and prove the following result, showing that the noise cannot be resampled in our protocol: Theorem 10 (The noisy Hamiltonian protocol with resampled noise ruins the entanglement advantage). The variance of the function estimate using the noisy Hamiltonian protocol, with noise resampled between successive shots of sensing, scales as Var[Q] =
(1 + b2 t2 )2n − cos2 (nqt) . n2 t2 sin2 (nqt)
(B28)
Proof. We start by evolving the initial n-qubit GHZ state under the noisy Hamiltonian H̃ = 21 time t and where ηi is the noise that each node samples: E ψ̃f = Ũ (t) |ψ0 ⟩ ,
Pn
z i=1 (θi + ηi )σi for
(B29)
where it
Ũ (t) = e− 2
Pn
z i=1 (θi +ηi )σi
,
(B30)
E
and where we write the final state ψ̃f with a tilde to indicate that it is a state obtained under this “noisy” evolution. Thus, the only quantity that we have access to is n
q̃ = q + η =
1X (θi + ηi ), n i=1
(B31)
Pn Pn ⊗n ⊗n where q = n1 i=1 θi and η = n1 i=1 ηi . Evolving |ψ0 ⟩ = √12 |0⟩ + |1⟩ under this operator, we get the following final state with noise injected: E ψ̃f = Ũ (t) |ψ0 ⟩ (B32) int int 1 ⊗n ⊗n = √ e− 2 (q+η) |0⟩ + e 2 (q+η) |1⟩ (B33) 2 intq itS 1 intq itS ⊗n ⊗n = √ e− 2 − 2 |0⟩ + e 2 + 2 |1⟩ , (B34) 2 where we introduced a new variable S := nη. In this case, the noise is sampled anew with every shot, so we cannot just assume a static noise term η in our function estimate and instead have to average over all possible values for the noise. We write the final state as a density matrix: Z ∞ ED ρf = f (S) ψ̃f ψ̃f dS, (B35) −∞
where f (S) is the probability density function (p.d.f.) of the noise term S. S is defined as the sum of individual nodes’ Laplace-distributed noise ηi , but we cannot take S to follow a Laplace distribution because the sum of Laplacedistributed random variables is not itself a Laplace-distributed random variable. This is in contrast to, for example, the sum of independently-sampled Gaussian-distributed random variables, which is a Gaussian-distributed random variable. To find the distribution, we use a known relation between a Laplace-distributed random variable and exponentially distributed random variables: if Xi1 , Xi2 ∼ Exp (b), where Exp (b) is the exponential distribution, then Xi1 − Xi2 ∼ Lap (b). Thus, Si ∼ Lap (b) can be written as Si ∼ Xi1 − Xi2 ,
(B36)
where Xi1 , Xi2 ∼ Exp (b). A sum of such variables is then S∼
n X i=1
Si ∼
n X
(Xi1 − Xi2 ) ∼
i=1
n X i=1
Xi1 −
n X
Xi2 .
(B37)
i=1
We then use the fact that the sum of n exponential-distributed random variables is a gamma-distributed random variable Gi ∼ Gamma(n, b). Thus, we have S ∼ G1 − G 2 ,
(B38)
35 where G1 ∼ Gamma(n, b) and G2 ∼ Gamma(n, b) are gamma-distributed random variables. Thus, we now have a random variable equal to the difference of two other random variables, for which we can find the p.d.f. using convolution: Z ∞ f (S) = fG1 (g)fG2 (g − S) dg. (B39) −∞
As mentioned in Def. 19, the gamma distribution is nonzero for g > 0 and g − S > 0, so we take g > S. Using this and the p.d.f. for the gamma distribution Gamma(n, b), the integral becomes Z ∞ eS/b f (S) = g n−1 (g − S)n−1 e−2g/b dg. (B40) Γ(n)2 b2n max(0,S) We evaluate this integral separately for S ≤ 0 and S > 0 and find Kn−1/2 |S| b q , πb n (2b) Γ(n) 2
n−1/2
|S| f (S) =
(B41)
where Kν (z) is the modified Bessel function of the second kind. With this p.d.f., we can now calculate the density matrix in Eq. (B35). We calculate the expectation value of the parity operator with respect to this final state as ⟨P ⟩ = Tr[P ρf ] (B42) # "Z n ∞ O intq intq intq itS itS itS itS 1 ⊗n ⊗n ⊗n ⊗n x − ) + ) + ) − − ) − intq 2 2 2 2 σi e 2 |0⟩ + e 2 |1⟩ e 2 ⟨0| + e 2 ⟨1| dS f (S) = Tr −∞ 2 i=1 (B43) Z ∞ = cos(ntq + tS)f (S) dS. (B44) −∞
Evaluating for f (S), we find ⟨P ⟩ =
cos(nqt) . (1 + b2 t2 )n
(B45)
Using this, we calculate Var[P ]: cos2 (nqt) . (b2 t2 + 1)2n
(B46)
n2 t2 sin2 (nqt) . (1 + b2 t2 )2n
(B47)
Var[P ] = 1 − We also find
∂ ⟨P ⟩ ∂q
2 =
Putting everything together, we have Var[P ] Var[Q] = 2
(B48)
∂⟨P ⟩ ∂q
= as claimed in the theorem.
(1 + b2 t2 )2n − cos2 (nqt) , n2 t2 sin2 (nqt)
(B49) ■
We can see that this expression quickly blows up both for fixed n and t → ∞ and for fixed t and n → ∞. Furthermore, for fixed b > 0, Eq. (B49) grows exponentially in n and therefore destroys even standard quantum limit scaling. As (1 + b2 t2 )2n ≈ exp 2nb2 t2 , preserving Heisenberg scaling under resampling would require nb2 t2 = O(1), √ √ that is, b = O(1/(t n)). Under the generic Laplace calibration, this translates to having ε = Ω(t∆ n), where, recall, ∆ = θmax − θmin . However, a privacy level that diminishes with the size of the network is undesirable. Thus, resampling is incompatible with simultaneously achieving constant local differential privacy and Heisenberg scaling.
36 3.
Entanglement offers no privacy advantage when α = 1
Recall from the main text that when we take α = 1 in the noisy Hamiltonian protocol (see Sec. IV B), we drop the scaling of εMSE down to the standard quantum limit. As such, there is no benefit in using the entangled protocol, and instead we can just use an unentangled protocol while achieving the same level of privacy: Theorem 11 (Unentangled strategy). Consider the noisy Hamiltonian protocol from Sec. IV B and the result in Thm. 8. In particular, take α = 1 such that εMSE = O(1/n), which scales according to the standard quantum limit, and ε = Θ(1). An unentangled protocol, where each node independently estimates their parameter and applies local Laplace noise, yields the same scaling for εMSE and ε. Thus, there is no scaling advantage to using an entangled protocol when α = 1. Proof. If each node adds to their parameter noise sampled from a Laplace distribution with scale parameter b, then by the properties of the Laplace mechanism, we have b≥
θmax − θmin , ε
as we have seen before. The mean-squared error of the unentangled protocol is given by 1 2b2 unent . εMSE = O + n n Choosing a constant privacy budget ε = Θ(1), from Eq. (B50), this gives b = Θ(1). Thus, we have 1 unent εMSE = O . n
(B50)
(B51)
(B52)
In the entangled protocol, we have εent MSE = O
1 n2
2b2 1 + =O n n
(B53)
for the same choice of b = Θ(1). Thus, although the entangled protocol has a smaller intrinsic sensing term (i.e., O 1/n2 versus O(1/n)), the privacy-noise contribution scales as 1/n and determines the overall n-scaling. Thus, once we choose α = 1, an unentangled protocol achieves the same asymptotic scaling in n in both mean-squared error and privacy. ■