AdeptHEQ-FL: Hybrid Fed Learning Framework

• AdeptHEQ-FL is a hybrid federated learning framework that integrates classical CNNs with parameterized quantum circuits using adaptive aggregation, selective homomorphic encryption, and dynamic layer-wise freezing.
• It employs a Laplace-perturbed, accuracy-weighted aggregation mechanism to ensure differential privacy while effectively combining local client updates in non-IID settings.
• Dynamic layer-wise adaptive freezing and selective encryption of the final classification layer reduce communication overhead by up to 40–50% without compromising the expressivity of quantum components.

Searching arXiv for the specified paper to ground the article in the cited source. AdeptHEQ-FL is a federated learning framework for hybrid classical-quantum models that combines a hybrid CNN–PQC architecture, adaptive accuracy-weighted aggregation based on differentially private validation accuracies, selective homomorphic encryption of sensitive model layers, and dynamic layer-wise adaptive freezing. It is introduced for decentralized, non-IID settings in which model performance, privacy preservation, and communication efficiency must be balanced simultaneously. The framework is reported on CIFAR-10, SVHN, and Fashion-MNIST, with formal privacy guarantees, a convergence analysis, and experimental comparisons against Standard-FedQNN and FHE-FedQNN (Jahin et al., 9 Jul 2025).

1. Definition and architectural composition

AdeptHEQ-FL is defined as a unified hybrid classical-quantum federated learning framework whose components are explicitly organized around four mechanisms: a hybrid CNN-PQC model, adaptive accuracy-weighted aggregation, selective homomorphic encryption, and dynamic layer-wise adaptive freezing (Jahin et al., 9 Jul 2025). In the paper’s formulation, the input $x \in \mathbb{R}^{H \times W \times C}$ is first processed by a classical CNN feature extractor $g_C(x; \theta^c)$, producing a flattened representation in $\mathbb{R}^{2^n}$. This representation is then amplitude-embedded into an $n$-qubit quantum state $|\psi_x\rangle$, passed through a parameterized quantum circuit $g_Q(\cdot; \theta^q)$ with 2 strongly-entangling layers, measured to obtain $f_{PQC} \in \mathbb{R}^n$, and finally mapped by a classical fully connected layer $f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$, where $m = \#\text{classes}$, before the softmax or cross-entropy stage (Jahin et al., 9 Jul 2025).

The mathematical form given in the paper specifies

$$g_C(x; \theta^c) = \mathrm{Flatten}(\mathrm{CNN}_{3\text{blocks}}(x; \theta^c)) \in \mathbb{R}^{2^n},$$

$g_C(x; \theta^c)$0

and

$g_C(x; \theta^c)$1

The quantum feature vector is then

$g_C(x; \theta^c)$2

and the final model output is

$g_C(x; \theta^c)$3

Within this design, the PQC is not an auxiliary module but part of the end-to-end prediction pipeline. The explicit exemption of quantum layers from freezing, discussed later, indicates that the framework treats quantum parameters as adaptively important throughout training. A plausible implication is that the method is intended to preserve quantum-side expressivity even when communication constraints require aggressive sparsity or staleness on classical layers.

2. Adaptive accuracy-weighted aggregation

The aggregation mechanism in AdeptHEQ-FL uses local validation accuracy, privatized by a Laplace mechanism, to compute per-client aggregation weights (Jahin et al., 9 Jul 2025). For each client $g_C(x; \theta^c)$4 at round $g_C(x; \theta^c)$5, the local validation accuracy is

$g_C(x; \theta^c)$6

This quantity is privatized as

$g_C(x; \theta^c)$7

The aggregation weights are computed by a temperature-scaled softmax: $g_C(x; \theta^c)$8 with temperature $g_C(x; \theta^c)$9. The global parameter update is then

$\mathbb{R}^{2^n}$0

This weighting scheme differs from uniform or purely sample-size-based federated aggregation because it conditions the aggregation coefficients on validation performance while still imposing differential privacy on the performance signal. The paper presents this as part of the formal privacy-preserving design (Jahin et al., 9 Jul 2025). This suggests that the framework attempts to use client quality information without directly exposing exact validation statistics, a point that is especially relevant in decentralized non-IID regimes where client updates can differ substantially in utility.

A common misconception in federated weighting schemes is that performance-sensitive aggregation necessarily compromises privacy. In AdeptHEQ-FL, that interpretation does not hold in its literal form, because the validation accuracies are perturbed with the Laplace mechanism before being transformed into weights. The remaining issue is not the absence of privacy protection, but rather the trade-off between aggregation fidelity and the noise induced by differential privacy.

3. Selective homomorphic encryption and secure aggregation

AdeptHEQ-FL applies selective homomorphic encryption rather than encrypting the entire parameter set (Jahin et al., 9 Jul 2025). The paper partitions the parameters into $\mathbb{R}^{2^n}$1, the parameters of the final fully connected layer FC4, and $\mathbb{R}^{2^n}$2, all other layers’ parameters. Only $\mathbb{R}^{2^n}$3 is encrypted, whereas $\mathbb{R}^{2^n}$4 remains in plaintext. The selective aspect is therefore layer-specific and tied directly to the model’s final classical classification stage.

The homomorphic encryption implementation uses CKKS via TenSEAL. The setup includes $\mathbb{R}^{2^n}$5 and Galois keys for rotations. The encrypted pipeline is stated as follows: encode $\mathbb{R}^{2^n}$6 into plaintext polynomials with scale $\mathbb{R}^{2^n}$7, compute $\mathbb{R}^{2^n}$8, aggregate homomorphically using

$\mathbb{R}^{2^n}$9

and recover the aggregated sensitive parameters by

$n$0

The CKKS parameterization reported in the paper is specific: poly-modulus degree 8192; coefficient moduli bit-sizes $n$1 bits; approximately 128-bit security; maximum multiplicative depth approximately 3, described as sufficient for one weighted sum; and bounded noise growth obtained by choosing a large initial scale and moderate depths (Jahin et al., 9 Jul 2025).

The framework’s privacy posture is therefore structurally asymmetric. It does not claim full-model homomorphic protection; instead, it protects the final FC4 layer while leaving all other layers unencrypted. The paper explicitly identifies “Extending HE beyond the final FC4 layer for full-model privacy” as an open challenge (Jahin et al., 9 Jul 2025). This makes clear that AdeptHEQ-FL should not be interpreted as an end-to-end fully encrypted federated learning protocol. Its contribution lies in selective protection calibrated to overhead constraints.

4. Dynamic layer-wise adaptive freezing

Communication reduction in AdeptHEQ-FL is implemented through dynamic layer-wise adaptive freezing (Jahin et al., 9 Jul 2025). The layer importance metric at round $n$2 is

$n$3

together with an exponential moving average

$n$4

A layer $n$5 is frozen when

$n$6

with $n$7, in which case $n$8. Quantum layers are exempt and are never frozen.

The pseudocode reported in the paper is organized per selected client. Each client computes the importance $n$9, updates the EMA $|\psi_x\rangle$0, defines

$|\psi_x\rangle$1

and sends updates only for

$|\psi_x\rangle$2

The communication reduction metric is

$|\psi_x\rangle$3

The paper states that, in practice, this yields approximately $|\psi_x\rangle$4–$|\psi_x\rangle$5 reduction in bytes transmitted per round (Jahin et al., 9 Jul 2025). In the experimental summary, the baseline round-trip is reported as approximately $|\psi_x\rangle$6 per client, and with dynamic freezing approximately $|\psi_x\rangle$7 per client, corresponding to approximately $|\psi_x\rangle$8 reduction (Jahin et al., 9 Jul 2025).

This mechanism is notable for its explicit exclusion of quantum layers from the freezing set. The design choice indicates that the framework treats quantum adaptability as a quantity to preserve even when classical communication is compressed. A plausible implication is that the method assumes representational or optimization sensitivity in the PQC component that would be disproportionately harmed by stale updates.

5. Privacy guarantees and convergence analysis

The paper states a per-round differential privacy guarantee for the Laplace mechanism applied to the local validation accuracy $|\psi_x\rangle$9 (Jahin et al., 9 Jul 2025). Theorem 1 asserts that with sensitivity

$g_Q(\cdot; \theta^q)$0

the mechanism ensures $g_Q(\cdot; \theta^q)$1-DP per round. Under advanced composition over $g_Q(\cdot; \theta^q)$2 rounds,

$g_Q(\cdot; \theta^q)$3

with $g_Q(\cdot; \theta^q)$4 and $g_Q(\cdot; \theta^q)$5, yielding $g_Q(\cdot; \theta^q)$6 (Jahin et al., 9 Jul 2025).

The convergence theorem is stated under $g_Q(\cdot; \theta^q)$7-smoothness, bounded gradient variance $g_Q(\cdot; \theta^q)$8, and learning rate

$g_Q(\cdot; \theta^q)$9

The resulting bound is

$f_{PQC} \in \mathbb{R}^n$0

which the paper interprets as sublinear $f_{PQC} \in \mathbb{R}^n$1 convergence plus small biases from differential privacy through the $f_{PQC} \in \mathbb{R}^n$2 term and from freezing perturbations (Jahin et al., 9 Jul 2025).

These formal results delimit the privacy and optimization claims carefully. The privacy theorem applies to the accuracy-sharing mechanism rather than to all data-dependent computations in the training pipeline. Likewise, the convergence claim is asymptotic and assumption-dependent, not a statement of uniform performance dominance across all data regimes. The framework therefore combines theorem-backed components with empirically evaluated systems design choices, rather than reducing all of its properties to a single formal guarantee.

6. Empirical results and computational trade-offs

The experimental summary reports average loss and accuracy over 5 runs on CIFAR-10, SVHN, and Fashion-MNIST (Jahin et al., 9 Jul 2025). The comparative accuracy values are shown below.

Model	CIFAR-10 Acc.	SVHN Acc.	Fashion-MNIST Acc.
Standard-FedQNN	$f_{PQC} \in \mathbb{R}^n$3	$f_{PQC} \in \mathbb{R}^n$4	$f_{PQC} \in \mathbb{R}^n$5
FHE-FedQNN	$f_{PQC} \in \mathbb{R}^n$6	$f_{PQC} \in \mathbb{R}^n$7	$f_{PQC} \in \mathbb{R}^n$8
AdeptHEQ-FL (4,2)	$f_{PQC} \in \mathbb{R}^n$9	$f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$0	$f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$1

On CIFAR-10, the paper reports a $f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$2 relative improvement over Standard-FedQNN and a $f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$3 relative improvement over FHE-FedQNN (Jahin et al., 9 Jul 2025). The hybrid model listed for AdeptHEQ-FL in the summary table is “(4,2),” corresponding to 4 qubits and 2 layers, whereas the baselines are reported with 6 qubits and 6 layers. The data block does not provide an interpretive ablation of this architectural difference, so any causal attribution beyond the reported results would be speculative.

The computational trade-offs are also quantified. CKKS adds approximately $f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$4 server-side compute, and the quantum simulator or training adds approximately $f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$5 wall-clock relative to a purely classical setting; the paper states that selective per-layer encryption limits the homomorphic encryption cost, and freezing reduces rounds’ parameter traffic (Jahin et al., 9 Jul 2025). Adaptive freezing is further said to cut device-to-server bandwidth by approximately $f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$6, thereby mitigating both network and compute load.

These results position AdeptHEQ-FL as a framework that improves measured accuracy while controlling two common systems bottlenecks: encrypted aggregation overhead and federated communication volume. At the same time, the reported gains are tied to the specific datasets, baselines, and design choices in the paper, and the method’s generalization beyond those settings remains an empirical question rather than an established theorem.

7. Scope, limitations, and future directions

The paper identifies several open challenges: extending homomorphic encryption beyond the final FC4 layer for full-model privacy, deployment on actual noisy quantum hardware, scaling to larger datasets and deeper quantum ansätze, and joint tuning of the freezing threshold and the differential privacy budget for optimal trade-off (Jahin et al., 9 Jul 2025). These limitations are structurally informative because they correspond directly to the framework’s current design boundaries.

One possible misconception is to read AdeptHEQ-FL as either a purely privacy-maximal protocol or a purely quantum-centered one. The formulation in the paper does not support either extreme. Privacy is concentrated in the differentially private validation-accuracy mechanism and selective encryption of FC4, while the quantum component is embedded in a broader hybrid classical-quantum architecture rather than treated as the sole source of performance. Similarly, the communication-efficiency claim is not derived from generic compression but from a specific criterion based on the EMA-smoothed $f_{FC4}(f_{PQC}; \theta^{FC4}) \in \mathbb{R}^m$7 change of each layer.

A plausible implication of the framework’s design is that it is best understood as a resource-aware synthesis of multiple constrained objectives: predictive performance, partial cryptographic protection, formal privacy accounting for aggregation signals, and communication reduction through layer sparing. In that sense, AdeptHEQ-FL occupies a specific point in the design space of federated hybrid classical-quantum learning systems, defined not by maximality on any single axis but by the coordinated use of adaptive aggregation, selective HE, and freezing policies within a single end-to-end pipeline (Jahin et al., 9 Jul 2025).