# Techniques: Differential Privacy Amplification in Quantum and Quantum-inspired Algorithms

## What the paper contributes (one paragraph)
The paper provides the first systematic study of differential privacy (DP) amplification for quantum and quantum-inspired algorithms, proving bounds in three settings. It shows that encoding a classical dataset into a quantum state through a data-encoding feature map (basis or amplitude encoding) inherently yields approximate classical DP, with the amplification governed by the minimum adjacent quantum kernel, and that composing this encoding with Laplace or Gaussian noise mechanisms gives pure or approximate DP with high probability. It shows that quantum-inspired classical sampling (an l2-norm sampling oracle, generalising uniform subsampling) amplifies DP, deriving explicit epsilon and delta bounds. Finally, for quantum differential privacy (QDP), it proves that post-processing a QDP channel by a contractive (Dobrushin or Doeblin) quantum operation amplifies privacy, with explicit bounds for the depolarising and amplitude/phase damping channels, and shows Dobrushin plus unitality gives pure QDP.

## Techniques offered
- **Differential privacy amplification by quantum encoding** - shows a quantum data-encoding feature map (basis or amplitude encoding) supplies approximate classical DP to any algorithm reading only the encoded state, and that composing the encoding with the Laplace or Gaussian noise mechanism supplies amplified pure or approximate DP.
  - guarantee: statistical DP bound; an algorithm reading only rho(x) is (0, sqrt(1 - kappa_hat))-DP, and the composed Laplace/Gaussian mechanism is (epsilon, delta)-DP with probability exponentially high in t and m
  - quote: "Informally, we first show that quantum encoding of classical datasets leads to approximate classical differential privacy."
- **Differential privacy amplification by quantum-inspired sampling** - shows that l2-norm sampling of the amplitude-encoded state (quantum-inspired subsampling, generalising uniform subsampling) supplies amplified DP to a downstream classical algorithm, with explicit privacy parameters.
  - guarantee: statistical DP bound; an (epsilon, delta)-DP algorithm composed with the sampling mechanism is (epsilon', delta')-DP with epsilon' = log(1 + (e^epsilon - 1) Gamma(x) m) and delta' = delta Gamma(x) m
  - quote: "We show that differential privacy, both in the exact and approximate setting, is amplified via quantum-inspired subsampling, establishing the concrete amplification bounds."
- **Quantum differential privacy amplification by channel contraction** - shows that post-processing a QDP quantum channel by a contractive operation satisfying a quantum Dobrushin or Doeblin mixing condition supplies amplified QDP, with explicit bounds for the depolarising and phase/amplitude damping channels.
  - guarantee: statistical QDP bound; if E is gamma-Dobrushin and S is (tau, epsilon(tau), 0)-QDP then S composed with E is (tau, epsilon(gamma tau), 0)-QDP, and Dobrushin plus unitality yields pure (delta = 0) QDP
  - quote: "Thus, we show that a post-processed quantum channel $\mathcal{S}\circ \mathcal{E}$ amplifies quantum differential privacy, provided that $T$ is $\gamma$-Dobrushin."

## Where it could apply
- Target primitive(s): quantum feature maps / quantum kernels, quantum-inspired (l2-norm) sampling, noisy quantum channels (depolarising, generalised amplitude damping, phase damping)
- Target application group(s): quantum_ml, platforms_tooling

## Caveats
Theory only; the paper proves amplification bounds and provides no experimental implementation (the authors flag NISQ implementation as future work). The amplification is an analytical property of the encoding, sampling, or channel rather than a runnable tool, and key bounds depend on data-dependent quantities (the minimum adjacent kernel kappa_hat, Gamma(x), and the channel contraction coefficient gamma); the rotation encoding gives no amplification (kappa_hat = 0). What is suppliable to an external vendor or application result is the privacy guarantee attached to a feature map, a quantum-inspired sampler, or a noisy channel, not a standalone algorithm.