# Techniques: A unifying framework for differentially private quantum algorithms

## What the paper contributes (one paragraph)
The paper builds a unified framework for differential privacy on quantum algorithms. It introduces a general definition of neighbouring quantum states that mirrors the underlying classical neighbouring relationship through the quantum encoding, so that a private measurement on the encoded state confers differential privacy on the classical input. Using a new information-theoretic result, the advanced joint convexity of the quantum hockey-stick divergence, it proves tighter privacy bounds for a broad family of noisy channels (including local Pauli and depolarising noise) and for measurements post-processed with classical Laplace or Gaussian noise. It gives a multiple-copy mechanism that privately estimates observable expectation values with privacy loss shrinking as the copy count grows, via concentration of measure. It then applies these tools to variational quantum algorithms and quantum machine learning, certifying adversarial robustness of private quantum classifiers and supporting the analysis with PennyLane simulations.

## Techniques offered
- **quantum differential privacy via noisy channels** - Adds classical and quantum noise (depolarising or local Pauli channels, plus Laplace or Gaussian post-processing) to quantum measurements to make them differentially private, with tighter bounds derived from the advanced joint convexity of the quantum hockey-stick divergence.
  - guarantee: statistical (epsilon, delta)-differential privacy bound on the output distribution of neighbouring inputs
  - quote: "Our first contribution consists of tighter privacy guarantees for a general family of noisy channels, which includes local Pauli noise and particularly as a special case, the depolarising channel."
- **generalised neighbouring relationship** - A (Xi, tau) neighbouring definition over quantum states that recovers prior trace-distance and locality notions as special cases and transfers privacy from the encoded state back to the classical input, including locality-aware private local measurements.
  - guarantee: static proof that a Q-neighbouring-preserving encoding maps an (epsilon, delta)-DP measurement into an (epsilon, delta)-DP algorithm on the classical input
  - quote: "Our second contribution is a generalised neighbouring relationship, that allows us to recover the previous definition as special cases."
- **private estimation of observable expectation values from multiple copies** - Measures an observable across m copies, averages the outcomes, and applies a classical noise channel so that the privacy loss is proportional to the average quantum sensitivity plus a term that decreases with m.
  - guarantee: statistical (epsilon, delta + delta')-differential privacy bound for the averaged-then-perturbed estimator
  - quote: "We provide differentially private mechanisms for estimating the expected values of observables given $m$ copies of a quantum state."
- **certified adversarial robustness via differential privacy** - Turns an (epsilon, delta)-DP classifier into a certified-robustness guarantee, giving a robustness condition and a certified-accuracy estimator for k-class quantum classifiers under bounded input perturbations.
  - guarantee: high-probability (1 - beta) certificate that the predicted label is unchanged for all neighbouring (adversarially perturbed) inputs
  - quote: "We specifically focus on certified adversarial robustness through differential privacy and we perform numerical simulations to assess the robustness to adversarial attacks of private quantum classifiers."

## Where it could apply
- Target primitive(s): VQE, QAOA, variational quantum classifiers, observable expectation-value estimation (sampling)
- Target application group(s): quantum_ml, platforms_tooling
- Code family / hardware assumptions: hardware-agnostic NISQ devices; assumes depolarising or local Pauli noise channels and a quantum encoding subroutine, no error-correcting code assumed

## Caveats
none