Information-Theoretic Admissibility (ITA)

• ITA is a framework that characterizes the maximal extractable quantum information under physical constraints and differential privacy requirements.
• It specifies that no strictly more informative algorithm exists for a given data ensemble, employing quantum channel post-processing criteria.
• ITA supports tight generalization bounds by leveraging the Holevo quantity and variational principles to limit mutual information leakage.

Information-Theoretic Admissibility (ITA) delineates a fundamental notion in information-theoretic analysis of quantum learning systems, characterizing the maximal extractable information from data by a quantum learning algorithm under given physical constraints. As instantiated in the context of differentially private quantum learning, ITA formalizes the admissibility of quantum channels in the sense that no strictly more informative algorithm exists for the prescribed data ensemble. This concept is central when the data-processor—responsible for running the learning algorithm—remains untrusted and the learning map itself must be dataset-oblivious, sharply demarcating the ultimate privacy and generalization guarantees available in such scenarios (Dasgupta et al., 1 Feb 2026).

1. Notation, Definitions, and Formal Framework

Let $\mathcal{D}(\mathcal{H})$ denote the set of density operators on a finite-dimensional Hilbert space $\mathcal{H}$, and let a learning algorithm in the untrusted setting be formalized as a completely positive, trace-preserving (CP-TP) map,

$$\mathcal{N}: \mathcal{D}(\mathcal{H}_{\text{in}}) \longrightarrow \mathcal{D}(\mathcal{H}_B),$$

which can be decomposed into an instrument $\{\mathcal{N}_w\}_{w\in\mathcal{W}}$ with each $\mathcal{N}_w$ CP trace-nonincreasing and $\sum_w \mathcal{N}_w = \mathcal{N}$.

Two classical datasets $s, s'$ are 1-neighbors ($s \sim_1 s'$) if they differ in the frequency of precisely one data point. Given an ensemble $\{\rho_s\}_s$ of input states, the information ordering of algorithms $\mathcal{N}$ and $\mathcal{N}'$ is established: $\mathcal{N}'$ is at least as informative as $\mathcal{N}$ on $\{\rho_s\}_s$ if there exists a post-processing CP-TP map $\Gamma$ such that for all $s, w$,

$$\mathcal{N}_w(\rho_s) = \Gamma \circ \mathcal{N}'_w(\rho_s).$$

$\mathcal{N}'$ is strictly more informative if this holds but not conversely.

Information-Theoretic Admissibility (ITA) holds for $\mathcal{N}$ on $\{\rho_s\}_s$ if no strictly more informative algorithm $\mathcal{N}'$ exists for this input ensemble. ITA guarantees extractability: the prescribed learning algorithm yields the maximal allowable information about $s$ permitted by quantum mechanics (Dasgupta et al., 1 Feb 2026).

2. Differential Privacy in the Untrusted Quantum Setting

In quantum learning under untrusted data processors, differential privacy is imposed not just as an output constraint but as a property of the entire learning map. Specifically, a learning algorithm $\mathcal{N}$ is said to be $1$-neighbor $(\varepsilon, \delta)$-differentially private (DP) and support-consistent if:

• Permutation Invariance: For any $s, s'$ with the same empirical type $T_s = T_{s'}$, $\mathcal{N}(\rho_s) = \mathcal{N}(\rho_{s'})$.
• Quantum DP Indistinguishability: For every pair $s \sim_1 s'$ and every quantum measurement $0 \preceq \Lambda \preceq I$,

$$\mathrm{tr}\,[\Lambda\,\mathcal{N}(\rho_s)] \leq e^{\varepsilon} \mathrm{tr}\,[\Lambda\,\mathcal{N}(\rho_{s'})] + \delta,$$

and symmetrically for $s \leftrightarrow s'$.

• Support Consistency: The supports of $\mathcal{N}(\rho_s)$ and $\mathcal{N}(\rho_{s'})$ agree whenever $s \sim_1 s'$ (Dasgupta et al., 1 Feb 2026).

These conditions formalize quantum DP in situations where the processor must not tailor the learning procedure to the dataset, but still must enforce indistinguishability and regularity in outputs.

3. Classical Impossibility Versus Quantum Admissibility

ITA contradicts privacy in classical or commutative systems: if all $\{\rho_s\}_s$ commute, i.e., correspond to classical distributions, and no perfect reconstruction is possible from the output, then ITA cannot hold. Formally, in the classical scenario, if there does not exist a CP-TP $\Gamma$ such that $\Gamma \circ \mathcal{N}(\rho_s) = \rho_s$ for all $s$, then $\mathcal{N}$ fails to be ITA (Lemma 7).

Proof sketch: Introduce an augmented instrument $$\mathcal{N}'_w(|x\rangle\langle x|) = |x\rangle\langle x| \otimes \mathcal{N}_w(|x\rangle\langle x|)$$; discarding the $|x\rangle$ register simulates $\mathcal{N}$, but $\mathcal{N}'$ is strictly more informative, violating ITA.

In contrast, quantum non-commutativity enables privacy-preserving ITA algorithms. For example, encoding data as tensor products of non-orthogonal single-qubit states $$|\phi_z\rangle = \sqrt{1-p}|0\rangle + (-1)^z\sqrt{p}|1\rangle$$ (with $p \neq 1/2$), and measuring only the Hamming-weight subspaces using projectors $\{P_k\}_k$ produces a learning map that is provably ITA: the Hamming weight is a sufficient quantum statistic, and non-orthogonality (via the Helstrom bound) limits extractable information about individual bits, enforcing privacy even under ITA (Dasgupta et al., 1 Feb 2026).

4. ITA and Information-Theoretic Generalization Bounds

When a quantum learning algorithm is both $1$-neighbor $(\varepsilon, \delta)$-DP and ITA, information-theoretic machinery provides upper bounds on mutual information between dataset $S$ and quantum output $B$, captured via the Holevo quantity:

$$I(S; B)_\sigma \leq (|\mathcal{Z}| - 1)\log(ne) + h_{\mathcal{Z}}(\varepsilon, \delta),$$

where $$h_{\mathcal{Z}}(\varepsilon,\delta) = \log\left[1/(1-g_{n(|\mathcal{Z}|-1)}(\varepsilon,\delta))\right] + \frac{2}{m}g_{n(|\mathcal{Z}|-1)}(\varepsilon,\delta)$$, $$g_k(\varepsilon,\delta) = \frac{e^{k\varepsilon}-1}{e^\varepsilon-1}\delta$$, and $m$ is a smoothing parameter. The proof utilizes a grid covering of the empirical type space and bounds the max-divergence via the DP guarantee.

This mutual-information bound, in conjunction with a c-q sub-Gaussian assumption on the loss operators (with parameter $\alpha$), translates into a bound for expected generalization error:

$$\operatorname{gen}(\mathcal{N}) \leq \sqrt{2\alpha^2 I(S;B)}.$$

A corollary yields, for any $1$-neighbor $(\varepsilon, \delta)$-DP ITA map $\mathcal{N}$,

$$\operatorname{gen}(\mathcal{N}) \leq \sqrt{2\alpha^2 \left[(|\mathcal{Z}|-1)\log(ne) + h_{\mathcal{Z}}(\varepsilon,\delta)\right]}$$

(Dasgupta et al., 1 Feb 2026).

5. Minimax (Variational) Characterization of ITA

The Holevo information has the variational (minimax) form:

$$I(S; B)_\sigma = \min_{\omega^B \in \mathcal{D}(\mathcal{H}_B)} D(\sigma^{SB} \parallel \sigma^S \otimes \omega^B),$$

where $D$ denotes quantum relative entropy. This characterization anchors ITA: no other post-processing quantum channel could concentrate more information about $s$ in $B$ than $\mathcal{N}$ does on $\{\rho_s\}$. Thus, ITA fixes the "best" marginal output $\omega^B$ possible, preventing leakage or retention of information outside the channel $\mathcal{N}$ itself.

6. Consequences, Limitations, and Quantum Advantage

ITA, by forbidding any strictly more informative quantum channel for the input ensemble, sharply contrasts quantum learning from its classical counterpart. In classical commutative models, ITA forces perfect reconstruction (destroying privacy), whereas quantum non-orthogonality enables concurrent privacy and maximal informativeness.

Under ITA, imposing untrusted $(\varepsilon, \delta)$-DP on the CP-TP map $\mathcal{N}$ yields precise "grid-cover" Holevo bounds, thereby constraining generalization error sharply as a function of privacy parameterization and dataset structure. This construction demarcates the boundary of privacy and statistical utility for quantum learning protocols in adversarial or untrusted computational regimes (Dasgupta et al., 1 Feb 2026).

7. Summary Table: Classical vs. Quantum ITA

Setting	ITA + Privacy Possible?	Mechanism
Classical	No	Forces data reconstruction
Quantum	Yes	Non-orthogonality enables privacy under ITA

ITA fully determines when a quantum learning protocol operating in an adversarial environment can achieve both strong generalization and differential privacy. This delineates the fundamental information-theoretic limits for quantum learning algorithms under strict admissibility requirements.