Class-Level Quantum Machine Unlearning

• Class-level quantum machine unlearning is the process of eliminating all training data from a specified class in a quantum model, ensuring its output closely matches a model retrained without that class.
• Algorithmic strategies employ methods like gradient-based updates, Fisher-information masking, and noise-injection to balance class forgetting with retained data utility.
• Empirical benchmarks in variational circuits and hybrid models validate that these methods achieve privacy guarantees and performance alignment with retrained baselines.

Class-level quantum machine unlearning is the process of removing the influence of all training examples of a specified class or label from a quantum machine learning (QML) model, such that the resulting model matches—within operational or statistical indistinguishability—the output distribution of a counterfactual model retrained without that class. This process is motivated by regulatory, privacy, and reliability requirements and is fundamentally distinct from both instance-level data removal and classical unlearning due to the geometric and physical constraints of quantum models. Recent research rigorously formulates the problem, introduces algorithmic strategies grounded in quantum information geometry, and provides empirical benchmarks and theoretical guarantees in variational quantum circuits, hybrid quantum-classical networks, and quantum kernel methods.

1. Formal Problem Setting and Operational Definitions

Let $D = \{(x_i, y_i)\}_{i=1}^n$ be a supervised training dataset, and let $c$ be the class to be forgotten. Define the forget set $F = \{(x, y) \in D : y = c\}$ and retained set $R = D \setminus F$. Given an original model $A_o$ trained on $D$ with parameters $w_{\rm orig}$, class-level unlearning produces a modified model $A_u$ with parameters $w$ such that

$$A_u \approx A^{(-F)} \equiv \text{model retrained on } R.$$

Rigorous formulations use the following criteria:

• Output Approximation: $U(D, F, A_o) \approx A^{(-F)}$.
• Indistinguishability: For any input $x$, the conditional distributions $p_{w}(\cdot|x)$ and $p_{w_{\rm retrain}}(\cdot|x)$ are close (KL-divergence, trace distance).
• Privacy: Membership inference advantage for class $c$ is minimized, i.e., post-unlearning models are resistant to adversarial attacks exploiting training-data membership (Su et al., 7 Sep 2025).
• Contraction Principle: The quantum CPTP (completely positive trace-preserving) channel describing unlearning must contract the distinguishability (trace distance) between the pre- and post-unlearning model and the retrained baseline (Shaik et al., 1 Nov 2025).

2. Algorithmic Mechanisms for Class-Level Quantum Unlearning

Various algorithmic approaches address the class-level quantum unlearning problem. The primary categories are:

Mechanism	Essential Operation	Typical Implementation Context
Distribution-Guided, Constraint-Based	Constrained optimization suppressing class-c confidence	VQC classifiers (Malik et al., 7 Jan 2026)
Gradient-Based (Exact/Adversarial)	Ascend on class-c loss; descend on retained data	QNNs, hybrid NNs (Su et al., 7 Sep 2025)
Fisher-Information-Guided Updates	Dampening or masking class-influential parameters	VQCs, HQNNs (Su et al., 7 Sep 2025, Shaik et al., 1 Nov 2025)
Parameter Reinitialization + Fine-Tune	Reset class-heavy subcircuits, retrain on retain set	VQCs, hybrid NNs (Crivoi et al., 22 Dec 2025, Shaik et al., 1 Nov 2025)
Label Complement Regularization (LCA)	Force forgotten-class outputs to complementary/uniform distribution	HQNNs (Crivoi et al., 22 Dec 2025)
Certified Unlearning (DP/Noise Injection)	Add noise during updates to guarantee ($\varepsilon,\delta$)-privacy	VQCs, hybrid NNs (Crivoi et al., 22 Dec 2025, Shaik et al., 1 Nov 2025)
Kernel/Feature-Space Alignment	Remove class-c blocks or realign kernel matrices	Quantum kernel classifiers (Shaik et al., 1 Nov 2025)

Distribution-Guided and Constrained Unlearning: Formulated as a constrained optimization problem:

$$\max_{w}\;\mathcal{L}_F(w) \quad \text{s.t.}\quad \frac{1}{|A|}\sum_{x\in A} \mathrm{KL}(p_{\rm ref}(\cdot|x)\|p_w(\cdot|x)) \leq \varepsilon, \quad \|w-w_{\rm orig}\|_2^2 \leq \rho,$$

where the forget objective

$$\mathcal{L}_F(w) = \frac{1}{|F|}\sum_{x\in F}\sum_{k\neq c} q_k \log p_w(k|x)$$

drives the output for class $c$ toward a target distribution $q$, derived from similarity statistics or uniform (Malik et al., 7 Jan 2026). The anchor set $A$ and KL-constraint explicitly preserve predictions on select retained examples, balancing unlearning and retention.

Gradient/Fisher Methods: Gradient ascent on class-c loss (reverse training), optionally restricted by a Fisher-information mask to update only parameters most "important" to the forgotten class (Su et al., 7 Sep 2025, Shaik et al., 1 Nov 2025). Selective synaptic dampening leverages empirical Fisher matrices to reduce the parameter influence spectrum.

Parameter Reinitialization/Certified Methods: Segment parameters by Fisher information, reinitialize class-associated subcircuits, and perform fine-tuning on retained data, optionally employing DP-style noise-injection to provide trace distance or $(\varepsilon, \delta)$-unlearning guarantees (Crivoi et al., 22 Dec 2025, Shaik et al., 1 Nov 2025).

3. Theoretical Guarantees and Privacy Foundations

Quantum class-level unlearning admits several theoretical guarantees, each corresponding to aspects of quantum information geometry and privacy:

• CPTP Contraction: Unlearning is modeled as a CPTP map $\mathcal{E}$ contracting trace distance to the retrain baseline $\rho(\theta^{\setminus c})$:

$$D_{\rm tr}(\mathcal{E}(\rho(\theta)),\rho(\theta^{\setminus c})) \leq D_{\rm tr}(\rho(\theta),\rho(\theta^{\setminus c}))$$

(Shaik et al., 1 Nov 2025).

• Approximate Forgetting: For Fisher-preconditioned updates,

$$\|\theta' - \theta^{\setminus c}\|_2 \leq \|H^{-1}\|_2 \cdot \|\nabla_\theta \mathcal{L}_c(\theta)\|_2$$

provides a quantitative bound, supporting the notion of $\epsilon$-approximate forgetting.

• Differential Privacy: By injecting calibrated Gaussian noise into unlearning updates, one may achieve $(\varepsilon, \delta)$-guarantees, with the privacy budget scaling sublinearly with the number of classes: $\varepsilon_{\text{total}}=O(\sqrt{C}\varepsilon)$ (Shaik et al., 1 Nov 2025, Crivoi et al., 22 Dec 2025). This connects certified unlearning to privacy-preserving machine learning.
• Membership Inference Security: Effective unlearning suppresses the membership inference advantage for class $c$, reducing adversarial attack success from >90% to 0–5% in practice (Su et al., 7 Sep 2025).

4. Experimental Methodologies and Benchmarks

Empirical evaluation of class-level quantum unlearning spans variational quantum classifiers, hybrid quantum-classical models, and kernel-based approaches. Key elements include:

• Model architectures: Angle-encoded features, layered variational circuits, hybrid classical-quantum pipelines, up to 10–12 qubits (Malik et al., 7 Jan 2026, Su et al., 7 Sep 2025, Crivoi et al., 22 Dec 2025).
• Datasets: Iris, Covertype (PCA-reduced), MNIST, Fashion-MNIST, with focus on multiclass classification and full-class deletion (Malik et al., 7 Jan 2026, Crivoi et al., 22 Dec 2025).
• Metrics:
  • Utility (retained accuracy): $$\Delta_{\rm acc} = \mathrm{Acc}(f_{\theta^\star};R) - \mathrm{Acc}(f_{\theta'};R)$$
  • Forgetting strength: accuracy on forgotten class, mean predicted confidence $p(c|x)$ for $x\in F$.
  • Retrain-oracle alignment: KL divergence and Unlearning Quality Index (UQI, related to trace distance) between unlearned and retrained models.
  • Privacy: Membership Inference Attack (MIA) success.

Summarized results:

• Distribution-guided methods outperform uniform-target unlearning, providing sharper forgotten-class suppression and minimal performance drop on retained classes; KL alignment with retrain oracles is closer (Malik et al., 7 Jan 2026).
• EU-k and Certified approaches best balance utility, forgetting, and retrain alignment on Iris, MNIST, and Fashion-MNIST; performance degrades gracefully with circuit depth (Crivoi et al., 22 Dec 2025).
• Phase-transition resilience in QNNs: unlike classical models, QNNs maintain performance under significant label noise and recover rapidly via unlearning algorithms (Chen et al., 4 Aug 2025).

5. Impact of Circuit Depth, Architecture, and Task Complexity

Intrinsic properties of quantum models and chosen architecture strongly affect unlearning efficacy:

• Circuit depth and entanglement: Shallow variational quantum circuits display high stability with limited memorization—unlearning is efficient and preserves utility. Increased depth and all-to-all entanglement raise memorization capacity but require more aggressive reinitialization or regularization for effective forgetting (Crivoi et al., 22 Dec 2025).
• Task complexity: As the number of classes or intra-class variability increases (e.g., transitioning from Iris to Fashion-MNIST), uniform unlearning targets become less effective; similarity-guided targets or complementary label augmentation improve performance (Malik et al., 7 Jan 2026, Crivoi et al., 22 Dec 2025).
• Layerwise sensitivity: Fisher information profiling during training identifies circuit sections responsible for class encoding, informing selective reinitialization/fine-tuning—componentwise unlearning efficiency improves (Crivoi et al., 22 Dec 2025, Shaik et al., 1 Nov 2025).

6. Open Directions and Future Challenges

Multiple research avenues are highlighted:

• Quantum-Native Unlearning Objectives: Design loss functions explicitly grounded in quantum information criteria (trace distance, fidelity) to guide forgetting (Crivoi et al., 22 Dec 2025).
• Scalable Privacy Proofs: Develop quantum differential privacy and certified unlearning guarantees compatible with realistic hardware and federated QML (Shaik et al., 1 Nov 2025).
• Instance-Level Unlearning: Extend from class-level to fine-grained (sample or client-level) forgetting in the quantum setting, including streaming or continual learning protocols (Shaik et al., 1 Nov 2025).
• Hardware Robustness: Systematic experiments on NISQ devices to quantify decoherence effects on forgetting strength and oracle alignment (Crivoi et al., 22 Dec 2025).
• Information-Theoretic Limits: Establish quantum no-deleting, decoupling theorems, and diamond-norm metrics certifying entanglement decoupling post-unlearning (Crivoi et al., 22 Dec 2025).

Empirical evidence confirms that class-level quantum unlearning is feasible and efficient for variational quantum circuits and hybrid architectures, but optimal strategies depend on model geometry, circuit topology, and task structure. Progressive developments in geometry-aware updates, certified protocols, and theoretical analyses are expected to enhance both practical and foundational aspects of privacy-preserving quantum machine learning.