From Membership-Privacy Leakage to Quantum Machine Unlearning

Abstract

Quantum Machine Learning (QML) has the potential to achieve quantum advantage for specific tasks by combining quantum computation with classical Machine Learning (ML). In classical ML, a significant challenge is membership privacy leakage, whereby an attacker can infer from model outputs whether specific data were used in training. When specific data are required to be withdrawn, removing their influence from the trained model becomes necessary. Machine Unlearning (MU) addresses this issue by enabling the model to forget the withdrawn data, thereby preventing membership privacy leakage. However, this leakage remains underexplored in QML. This raises two research questions: do QML models leak membership privacy about their training data, and can MU methods efficiently mitigate such leakage in QML models? We investigate these questions using two QNN architectures, a basic Quantum Neural Network (basic QNN) and a Hybrid QNN (HQNN), evaluated in noiseless simulations and on quantum hardware. For the first question, we design a Membership Inference Attack (MIA) tailored to QNN in a gray-box setting. Our experiments indicate clear evidence of leakage of membership privacy in both QNNs. For the second question, we propose a Quantum Machine Unlearning (QMU) framework, comprising three MU mechanisms. Experiments on two QNN architectures show that QMU removes the influence of the withdrawn data while preserving accuracy on retained data. A comparative analysis further characterizes the three MU mechanisms with respect to data dependence, computational cost, and robustness. Overall, this work provides a potential path towards privacy-preserving QML.