Quantum Local Differential Privacy Overview

• QLDP is a quantum extension of local differential privacy, ensuring that quantum channels and state outputs remain indistinguishable under all allowed measurements using rigorous divergence criteria.
• It introduces various equivalent formulations—from density matrix inequalities to channel-based divergence constraints—thereby generalizing the classical privacy framework to noncommutative settings.
• QLDP demonstrates genuine quantum advantages over classical mechanisms, especially for n-ary data, by optimizing privacy-utility trade-offs with methods like depolarizing noise and isoclinic mechanisms.

Quantum local differential privacy (QLDP) is the quantum analogue of classical local differential privacy, formulated for mechanisms that release quantum states or act as quantum channels and are required to make the released information difficult to distinguish across possible inputs under every allowed measurement. Across the literature, QLDP appears in several closely related forms: as a semidefinite-order condition on families of density operators, as a measurement-based channel inequality over all input pairs, and as an equivalent divergence constraint involving the quantum hockey-stick divergence or smooth max-relative entropy. A recurring theme is that QLDP reduces to classical LDP when the relevant output states commute, while genuinely nonclassical phenomena emerge once the protected alphabet or state family is sufficiently rich (Yoshida, 2020).

1. Formal definitions and equivalent formulations

One early formulation treats local privacy as a property of a family of outputs indexed by a classical input alphabet. For an $n$-tuple of probability vectors $(p_i)_{i=1}^n$, classical $\varepsilon$-DP is the entrywise condition

$$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$

Its classical-quantum extension replaces probability vectors by density matrices $(\rho_i)_{i=1}^n$ and requires

$$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$

equivalently $e^\varepsilon \rho_j-\rho_i \succeq 0$. In this model, the input is classical and the released object is quantum, so privacy is enforced at the level of a classical-to-quantum mechanism (Yoshida, 2020).

A channel-based formulation, used widely in later work, defines a quantum channel $\mathcal N$ to be $(\varepsilon,\delta)$-locally differentially private if for every POVM $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$, every pair of input states $(p_i)_{i=1}^n$0, and every outcome $(p_i)_{i=1}^n$1,

$(p_i)_{i=1}^n$2

The pure case is $(p_i)_{i=1}^n$3. For POVMs themselves, the same condition yields the notion of $(p_i)_{i=1}^n$4-trivial or near-trivial measurements. In this form, QLDP means that no downstream measurement can distinguish inputs beyond the prescribed multiplicative-additive bound (Angrisani et al., 2022).

Several papers replace the universal measurement quantifier by a state-based divergence criterion. Using the quantum hockey-stick divergence

$(p_i)_{i=1}^n$5

one has

$(p_i)_{i=1}^n$6

and equivalently

$(p_i)_{i=1}^n$7

This reformulation makes privacy a property of output states alone, without checking every POVM explicitly. The same framework also yields a quantum analogue of Rényi differential privacy and a hypothesis-testing interpretation of privacy regions (Hirche et al., 2022).

The literature does not use a single neighboring relation. Some works take the supremum over all input-state pairs, which is the direct quantum counterpart of local DP. Others parameterize neighborhood structure more finely. A unifying framework introduces $(p_i)_{i=1}^n$8-neighboring states via equality of suitable marginals together with a trace-distance bound, thereby subsuming both bounded-trace-distance and local-measurement-style notions (Angrisani et al., 2023). This suggests that QLDP is best viewed as a family of closely related local privacy models rather than a single fixed definition.

2. Classical completeness, essential classicality, and genuine quantum separation

A central structural question is whether quantum locally private mechanisms are genuinely more expressive than classical ones, or merely classical mechanisms re-encoded by quantum channels. To formalize this, the set $(p_i)_{i=1}^n$9 of essentially classical mechanisms is defined inside $\varepsilon$0: a CQ-private tuple $\varepsilon$1 is essentially classical if there exist a classical $\varepsilon$2-DP tuple $\varepsilon$3 and a CPTP map $\varepsilon$4 such that

$\varepsilon$5

Equivalently,

$\varepsilon$6

In this characterization, the privacy-relevant structure is already classical, and the quantum layer acts only as a re-encoding map (Yoshida, 2020).

The sharp separation result is dimension-free in the input alphabet size. For binary private data,

$\varepsilon$7

so every CQ-private binary mechanism is essentially classical. For every $\varepsilon$8,

$\varepsilon$9

showing that genuinely quantum locally private mechanisms exist as soon as the input alphabet has size at least three. The same work gives an operational witness of this strict inclusion using the objective

$$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$0

where $$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$1 is the RLD Fisher information for the pair $$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$2, and proves

$$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$3

Thus, the gap is not only representational but also utility-relevant (Yoshida, 2020).

This binary-versus-$$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$4-ary dichotomy has become a recurrent organizing principle in QLDP. A plausible implication is that commutative structure is effectively exhaustive only in the smallest alphabet case, while noncommutativity becomes operationally visible once the local mechanism must protect three or more alternatives.

3. Optimal mechanisms and privacy-utility trade-offs

A substantial algorithmic line of work asks, for a fixed quantum mechanism $$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$5, what is the smallest privacy budget it satisfies. One formulation defines the optimal QLDP value by

$$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$6

with a reduction to pure states,

$$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$7

If $$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$8 for some $$p_i \le e^\varepsilon p_j \qquad \text{for all } i,j=1,\dots,n.$$9, then $(\rho_i)_{i=1}^n$0. Finite QLDP is characterized by strict positivity of the Choi matrix of the dual map or, equivalently, by the linear span of the adjoint Kraus operators covering the full matrix space (Guan, 2024).

Within the class of unital mechanisms, quantum depolarizing noise plays the role classically occupied by randomized response. For $(\rho_i)_{i=1}^n$1 qubits,

$(\rho_i)_{i=1}^n$2

It is identified as the optimal unital privatization mechanism, simultaneously optimizing fidelity utility and anti-trace-distance utility under a fixed QLDP level: $(\rho_i)_{i=1}^n$3 with equality achieved by a depolarizing-like family. The same work proves an additive composition theorem: $(\rho_i)_{i=1}^n$4 and more generally $(\rho_i)_{i=1}^n$5 is $(\rho_i)_{i=1}^n$6-QLDP, including distributed systems with entangled states (Guan, 2024).

In the high-privacy regime $(\rho_i)_{i=1}^n$7, the optimization theory becomes asymptotic and strikingly universal. For a broad class of utilities whose quantum second-order expansion is governed by a normalized Petz monotone metric, the classical and quantum optima satisfy

$(\rho_i)_{i=1}^n$8

$(\rho_i)_{i=1}^n$9

Hence,

$$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$0

The classical optimum is achieved asymptotically by the binary mechanism, whereas the quantum optimum is achieved by an isoclinic mechanism built from an equi-isoclinic tight fusion frame. This same ratio appears for Holevo information, symmetric hypothesis-testing exponents, and asymmetric hypothesis-testing exponents (Yoshida, 26 May 2026).

Taken together, these results establish two complementary facts. First, depolarization is a canonical and often optimal privatization primitive in the unital setting. Second, in the high-privacy regime, optimal quantum mechanisms can outperform classical ones by a universal factor that depends only on the input alphabet size.

4. Contraction of distinguishability and private hypothesis testing

QLDP can be interpreted as a contraction principle: privacy forces channels to suppress distinguishability. One strong data-processing line proves that if $$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$1 is $$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$2-LDP, then

$$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$3

and, for $$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$4-LDP POVMs,

$$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$5

The same framework derives private analogues of Stein-type bounds for asymmetric hypothesis testing under restricted measurements, making the type-II error exponent explicitly privacy-limited (Angrisani et al., 2022).

A later treatment sharpens this contraction picture by characterizing the exact privatized contraction coefficient for trace distance. For $$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$6-QLDP channels,

$$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$7

and for $$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$8-QLDP,

$$\rho_i \le e^\varepsilon \rho_j \qquad \text{for all } i,j=1,\dots,n,$$9

Using the hockey-stick divergence machinery, the same work obtains

$e^\varepsilon \rho_j-\rho_i \succeq 0$0

and

$e^\varepsilon \rho_j-\rho_i \succeq 0$1

These bounds lead directly to sample-complexity estimates for private quantum hypothesis testing and show that, for orthogonal states in the high-privacy regime, private sample complexity scales as

$e^\varepsilon \rho_j-\rho_i \succeq 0$2

The same analysis also yields fairness bounds and a Holevo-information stability guarantee for learning systems driven by private quantum channels (Nuradha et al., 2024).

This body of work places QLDP in the same conceptual family as channel contraction, SDPI, and testing under restricted measurements. Privacy is not merely an additive perturbation constraint; it is an explicit upper bound on how much any admissible channel can preserve operational distinguishability.

5. Learning-theoretic consequences and the quantum statistical query model

QLDP has a direct learning-theoretic interpretation through the quantum statistical query (QSQ) model. A QSQ oracle $e^\varepsilon \rho_j-\rho_i \succeq 0$3 receives an operator $e^\varepsilon \rho_j-\rho_i \succeq 0$4 with $e^\varepsilon \rho_j-\rho_i \succeq 0$5 and tolerance $e^\varepsilon \rho_j-\rho_i \succeq 0$6, and returns a value in

$e^\varepsilon \rho_j-\rho_i \succeq 0$7

A central equivalence theorem shows that learning with QLDP measurements and learning with QSQ access simulate one another up to parameter transformations. In one direction, any QSQ query can be simulated using Laplace-noised local measurements with

$e^\varepsilon \rho_j-\rho_i \succeq 0$8

copies while each measurement remains $e^\varepsilon \rho_j-\rho_i \succeq 0$9-LDP. In the reverse direction, any $\mathcal N$0-LDP measurement can be simulated using the QSQ oracle with expected query complexity $\mathcal N$1, accuracy $\mathcal N$2, and total variation error at most $\mathcal N$3. This is the quantum extension of the classical equivalence between LDP learning and SQ learning (Angrisani et al., 2022).

The same work uses QLDP to show that privacy constraints do not eliminate all quantum speedups. In a multi-party setting with quantum examples of a parity function

$\mathcal N$4

each party applies an $\mathcal N$5-LDP measurement and communicates classically. Because there exists an efficiently implementable quantum measurement $\mathcal N$6 satisfying

$\mathcal N$7

the support of the hidden parity string can be recovered from private measurements. The result states that with

$\mathcal N$8

parties or copies, there is an efficient algorithm that learns $\mathcal N$9 with probability at least $(\varepsilon,\delta)$0, using only $(\varepsilon,\delta)$1-LDP measurements, classical communication, and classical post-processing. The corresponding classical local-DP task requires exponentially many samples (Angrisani et al., 2022).

This learning perspective shows that QLDP is not only a privacy notion for state release. It is also a structural constraint on admissible observation models, with direct implications for sample complexity, oracle access, and separations between classical and quantum learnability.

6. Locality, amplification, and entanglement geometry

A generalized privacy framework for quantum algorithms introduces $(\varepsilon,\delta)$2-neighboring states: $(\varepsilon,\delta)$3 This formalism captures both bounded-trace-distance and local-measurement-inspired neighbor relations. For local noisy channels of the form

$(\varepsilon,\delta)$4

applied productwise, privacy bounds depend on

$(\varepsilon,\delta)$5

rather than the full system size $(\varepsilon,\delta)$6, yielding exponentially tighter guarantees when $(\varepsilon,\delta)$7. The same framework also handles multi-copy private estimation by combining concentration of measure with classical noise addition and proves an advanced joint convexity property of the quantum hockey-stick divergence (Angrisani et al., 2023).

Privacy amplification also appears in a channel-contraction language. For a classical dataset encoded into quantum states $(\varepsilon,\delta)$8, the minimum adjacent kernel

$(\varepsilon,\delta)$9

controls privacy amplification from quantum encoding. Quantum-inspired subsampling yields

$\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$0

For channels, if $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$1 is $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$2-Dobrushin and $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$3 is QDP at trace-distance scale $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$4, then $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$5 is QDP at the reduced scale $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$6. This provides a direct quantum-channel analogue of privacy amplification by mixing or diffusion (Angrisani et al., 2022).

Entanglement introduces a further geometric layer. In a bipartite system with product mechanism $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$7 and local measurements $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$8, one can restrict attention to pure input states with entanglement entropy at least $\mathcal M=\{\mathcal M_x\}_{x\in\mathcal X}$9: $(p_i)_{i=1}^n$00 The corresponding entanglement-constrained local-measurement notion, ECLM-$(p_i)_{i=1}^n$01-QLDP, leads to an optimal leakage level

$(p_i)_{i=1}^n$02

There is a sharp phase transition: if $(p_i)_{i=1}^n$03, then the maximal privacy energy remains the unconstrained spectral maximum; if $(p_i)_{i=1}^n$04, the optimizer acquires Gibbs-form Schmidt weights and the maximal privacy energy decreases strictly with $(p_i)_{i=1}^n$05. For sufficiently large $(p_i)_{i=1}^n$06, the leakage satisfies

$(p_i)_{i=1}^n$07

and some mechanisms with $(p_i)_{i=1}^n$08 become private once entanglement is large enough. The analysis is formulated as smooth optimization on a product manifold and attributes the phase transition to the non-convex geometry of the entanglement-constrained state set (Wang et al., 27 Jan 2026).

These results show that locality in QLDP is multifaceted: it can refer to user-side privatization, neighborhood structure, product measurements, contraction under local channels, or geometric restrictions on admissible entangled inputs.

7. Measurement-induced privacy and adjacent application domains

Some application-oriented work studies privacy mechanisms that resemble QLDP without always adopting the formal channel-based definition. One example analyzes projection-valued measurements with finite shot counts. If a circuit is measured $(p_i)_{i=1}^n$09 times under a projector $(p_i)_{i=1}^n$10, then the empirical outcomes are approximated by Gaussians

$(p_i)_{i=1}^n$11

with $(p_i)_{i=1}^n$12 and $(p_i)_{i=1}^n$13. In that framework, shot noise itself acts as a privacy source, and depolarizing noise

$(p_i)_{i=1}^n$14

further reduces distinguishability through bounds such as

$(p_i)_{i=1}^n$15

This is best characterized as measurement-level or per-query quantum privacy rather than standard distributed local randomization (Li et al., 2023).

A separate federated-learning line applies client-side Gaussian perturbation to updates of local quantum models. Its privacy guarantee is explicitly classical $(p_i)_{i=1}^n$16-DP, with client-level protection for the entire local dataset of a participant, and the local noise variance is calibrated by

$(p_i)_{i=1}^n$17

An adaptive schedule

$(p_i)_{i=1}^n$18

is used to balance privacy with barren-plateau mitigation and convergence. The source explicitly states that this is not formal quantum DP in the channel/output-state sense, but a local DP-style mechanism applied to quantum clients. It is therefore adjacent to QLDP rather than an instance of the core formalism (Phan et al., 4 Sep 2025).

These neighboring literatures underscore a broader point. QLDP, strictly construed, is a measurement-universal privacy property of quantum mechanisms or channels. Around that core notion lies a growing ecosystem of measurement-induced, encoding-based, and client-side perturbative methods that borrow its local-privacy logic while adapting to specific quantum computing and quantum learning architectures.