⚛️ quantum physics

Does the Readout Bypass Leak the Input? A Feature-Visibility Audit of Hybrid Quantum-Classical Models

This paper audits hybrid quantum-classical models with readout-side residuals, demonstrating that while the bypass mechanism allows for near-perfect reconstruction of raw input coordinates via gradient analysis, this leakage is a direct consequence of the classical bypass rather than a failure of the quantum encoding itself, and does not currently translate to effective membership attacks under single-example training.

Original authors: Guilin Zhang (Workday AI Research), Kai Zhao (Workday AI Research), Xiquan Cui (Workday AI Research), Henry Heng (Workday AI Research), Xu Chu (Workday AI Research), Aletta Johanna Blanken (Workday AI

Published 2026-10-01

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Guilin Zhang (Workday AI Research), Kai Zhao (Workday AI Research), Xiquan Cui (Workday AI Research), Henry Heng (Workday AI Research), Xu Chu (Workday AI Research), Aletta Johanna Blanken (Workday AI Research)

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the emerging field of quantum machine learning, researchers are trying to teach computers to find patterns using the strange laws of quantum physics. These systems often take a large amount of ordinary data, squeeze it into a tiny quantum state, and then measure a few results to make a prediction. Because the data is hidden inside a quantum system, some scientists have hoped this process acts as a natural shield, keeping the original information safe from prying eyes. This idea is particularly important for a method called federated learning, where many different computers work together on a shared problem without ever sending their private data to a central server. Instead, they send only small updates about how their models are learning. The hope is that these updates reveal nothing about the specific records the computers started with.

A recent study by researchers at Workday AI Research challenges a specific design meant to improve these quantum systems, showing that it may not offer the privacy protection many assume. The team investigated a hybrid model that tries to get the best of both worlds: it uses a quantum circuit to process some data, but also keeps the original, unprocessed data visible to the system to help with accuracy. This design, known as a readout-side residual hybrid, connects the raw input directly to the final decision-making part of the model. The researchers wanted to know if this shortcut, which helps the model learn better, also accidentally leaks the private data back to the server. They found that in many cases, it does exactly that, allowing the server to reconstruct the original data with startling clarity, even without needing to break the quantum code.

The study focused on a specific type of privacy risk where a server, which is honest but curious, receives the mathematical updates from a client's computer. In a typical scenario, the client sends an update based on a single example of data, such as a record of a wine's chemical composition or a patient's medical history. The researchers simulated this exchange and asked a simple question: if the server sees the update, can it work backward to figure out what the original data was? They tested this on two common datasets, one involving wine characteristics and another involving breast cancer records. They compared models that used only the quantum-processed data against models that included the raw data alongside the quantum results.

The results were stark. For the models that included the raw data, the server was able to reconstruct the original records with extreme precision. In technical terms, the quality of the reconstruction was so high that the difference between the original data and the recovered data was almost invisible, with measurements ranging from 73 to 96 decibels. This level of clarity means the server could see the exact numbers the client started with. The researchers noted that this happened because of a known weakness in how these models are built: the first step of the calculation leaves a direct mathematical trace of the input in the update. The quantum part of the model was not needed to expose this data; the raw data path alone was enough to give it away.

When the researchers looked at the models that used only the quantum-processed data, the picture was more complex but still revealing. On the full set of data features, the reconstruction was poor, suggesting the quantum part did hide some information. However, when they focused only on the six specific features that the quantum system actually processed, the server could reconstruct those specific numbers with very high accuracy, ranging from 54 to 96 decibels. This means that while the quantum system might hide the features it ignores, it does not hide the features it actually uses. The study emphasizes that the quantum encoding did not provide a magical shield for the data it touched; the data was still recoverable through the mathematical updates sent to the server.

A crucial part of the study was correcting a common misunderstanding about how privacy is measured. Previous evaluations of similar systems had relied on a test called a membership inference attack, which asks whether a specific record was used to train the model. In these tests, the results often looked like a coin toss, suggesting the system was private. However, the researchers showed that this test does not measure whether the actual data can be rebuilt. A system can be good at hiding whether a record was used, yet still allow the server to perfectly reconstruct the record itself. The study argues that privacy audits must look at what data is actually visible to the server and measure how well that specific data can be recovered, rather than relying on broader, less precise tests.

The researchers were careful to note the limits of their findings. Their work was a simulation using a small number of data points and a single step of learning, not a test of a large, real-world network with many steps and complex defenses. They did not claim that this leakage happens in every possible quantum learning scenario, nor did they prove that the entire quantum circuit could be reversed to reveal hidden data. However, for the specific architecture they tested, the conclusion was clear: the design choice to include raw data alongside quantum features creates a direct path for data leakage. The study serves as a warning that adding raw data to improve accuracy can undo the privacy benefits of quantum processing, and that future systems must be designed with a clear understanding of exactly which pieces of information are being exposed.

Ultimately, the paper provides a new way to look at privacy in quantum machine learning. It suggests that the presence of a quantum computer does not automatically guarantee privacy, especially when the system is designed to be efficient by using raw data. The researchers call for more careful reporting in the field, urging scientists to specify exactly which parts of the data are visible in the updates and to measure privacy based on the ability to reconstruct those specific parts. By doing so, the field can avoid mistaking a lack of data visibility for actual protection, ensuring that the promise of quantum machine learning is not undermined by simple, avoidable leaks.

Technical Summary: "Does the Readout Bypass Leak the Input?"

Problem Statement
Readout-side residual hybrid models in Quantum Machine Learning (QML) concatenate raw classical inputs ( $x$ ) with measured quantum features ( $Q(x)$ ) to improve downstream accuracy without increasing quantum circuit depth. While prior evaluations of this architecture claimed privacy benefits based on Membership Inference Attacks (MIA) yielding near-random AUC scores (~0.5), these tests did not assess whether a server could reconstruct the specific client record from the shared model updates (gradients). This paper investigates whether the "bypass" mechanism, which feeds raw inputs directly into the classifier, exposes the input data to known gradient leakage vulnerabilities, specifically under single-example gradient sharing conditions.

Methodology
The authors conduct a feature-visibility audit using two tabular datasets (Wine and Breast Cancer) and four distinct architectures:

Pure Quantum: Uses only $Q(x)$ .
Q(x)-only MLP: Uses only $Q(x)$ but with MLP widths matched to the residual model.
Input-only: Uses only raw $x$ .
Residual Bypass: Concatenates $z = [x \parallel Q(x)]$ .

Key Experimental Controls:

Visibility Conditioning: The quantum path encodes only the first six features of the input, while the bypass path receives all $d$ features. To avoid conflating privacy with feature visibility, the authors report reconstruction metrics (PSNR, MSE, Cosine Similarity) on both the full record and the shared six coordinates visible to all quantum models.
Adversary Model: An "honest-but-curious" server observes the gradients of a single training example (one-step SGD) with known learning rate. The server knows the trained weights and receives all parameter gradients, including the first affine layer's weight and bias gradients.
Attack Vector: The study utilizes two leakage mechanisms:
1. Analytic Recovery: Exploiting the standard leakage of biased linear layers where $g_W = \delta z^\top$ and $g_b = \delta$ . If a bias gradient is non-zero, the input $z$ can be analytically recovered as $z = g_W / g_b$ .
2. Iterative Gradient Matching: Using cosine gradient matching (similar to iDLG) to minimize the difference between the observed gradient and a reconstructed input gradient.

Key Results

Analytic Vulnerability: The residual bypass exposes raw coordinates directly. For the residual and input-only heads, the analytic leakage allows for standard recovery of the input.
Reconstruction Quality (PSNR):
- Residual & Input-only: Achieved median full-record PSNR of 73–96 dB, indicating near-exact reconstruction of the raw input.
- Quantum-only Heads: Achieved low full-record PSNR (8–11 dB) because the model does not process the omitted coordinates. However, on the shared six coordinates actually encoded by the quantum circuit, these models achieved 54–96 dB PSNR, indicating that the encoded features are also reconstructable.
Membership Inference: Despite the high reconstruction accuracy, MIA AUC scores remained near the random baseline (0.477–0.540). This confirms that membership inference and record reconstruction measure fundamentally different properties; a model can be vulnerable to reconstruction even if it resists membership inference.
Optimization Variance: The iterative attack showed variability (e.g., 200-step matching sometimes failed to exploit the analytically vulnerable layer), but the analytic baseline guarantees recovery whenever the bias gradient is non-zero.

Key Contributions

Visibility-Conditioned Audit: The paper introduces a critical distinction in privacy evaluation: metrics must be conditioned on which input coordinates actually affect the transmitted update. A full-vector error score is misleading if architectures observe different subsets of features.
Clarification of "Privacy" Claims: The authors demonstrate that the bypass exposes raw features to known affine-layer leakage. The quantum interaction is unnecessary for this exposure; the raw path alone suffices.
Decoupling Reconstruction from Membership: The study highlights that near-random MIA scores do not imply protection against gradient inversion. The lack of a "privacy certificate" in the original work is attributed to the conflation of these distinct attack vectors.
Limitations of Quantum Privacy Intuition: The results caution against transferring the intuition of "state collapse" (often cited for quantum privacy) to differentiable training gradients. In this specific setup, the quantum encoding does not prevent the reconstruction of the features it actually processes.

Significance and Claims
The paper does not claim to establish a new general gradient-inversion attack or prove leakage under aggregation or multi-step training (e.g., FedAvg). Instead, its significance lies in:

Correcting Evaluation Standards: It argues that privacy tables must explicitly state which input coordinates influence the update and that "omitted coordinates" should not be credited as privacy protection supplied by quantum processing.
Interpreting Metrics: It asserts that near-exact PSNR differences between architectures (e.g., 73 dB vs. 96 dB) reflect optimization residuals and numerical precision rather than meaningful privacy rankings.
Scope of Findings: The findings are specific to individual gradients in single-example updates. The authors explicitly state that their results do not establish leakage under aggregated updates or multiple local training steps, nor do they prove the invertibility of compressive quantum encodings in general, only for the tested six-input, six-observable circuits.

In conclusion, the readout bypass in hybrid QML models exposes raw features to standard gradient leakage, and the privacy of such systems cannot be inferred solely from membership inference metrics or the presence of a quantum component.

Technical Summary: "Does the Readout Bypass Leak the Input?"

More like this