Quantum Machine Unlearning

• Quantum Machine Unlearning is the process of removing designated training data influence from a trained quantum or hybrid model without full retraining.
• It applies counterfactual retraining objectives to approximate a retrained baseline using parameter editing, state fidelity, and privacy metrics.
• Recent implementations leverage gradient ascent, Fisher-weighted updates, and state constraints to achieve efficient unlearning and robust privacy protection.

Searching arXiv for papers on quantum machine unlearning to ground the article in current literature. Quantum machine unlearning (QMU) is the process of removing the influence of designated training data from a trained quantum or hybrid quantum-classical model without full retraining. In current formulations, the counterfactual target is the model obtained by retraining on the retained dataset alone, while the operational goal is to produce updated parameters or model states that approximate that retrained baseline more efficiently than reoptimization from scratch. Recent work treats QMU as a problem of parameter editing, distributional alignment, privacy mitigation, and physically valid state transformation under completely positive trace-preserving (CPTP) dynamics, with applications ranging from deletion requests and membership-leakage mitigation to recovery from label noise and poisoning (Su et al., 7 Sep 2025, Crivoi et al., 22 Dec 2025, Malik et al., 7 Jan 2026, Shaik et al., 1 Nov 2025).

1. Formal problem setting

The basic unlearning objective in QML mirrors the classical retrain-oracle formulation. If $D$ is the training dataset and $S \subset D$ is the subset to be forgotten, then retraining on $D \setminus S$ yields a target parameter vector

$$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$

QMU seeks a parameter vector $\theta'$ derived from the original trained model such that $\theta'$ approximates $\theta^*$ while avoiding full retraining. In class-level settings, the same idea is expressed as

$U(D_f, D, A(D)) \approx A(D \setminus D_f),$

where $D_f$ is the forgotten subset and $A(D)$ denotes the original trained model (Su et al., 7 Sep 2025, Malik et al., 7 Jan 2026).

Several success criteria recur across the literature. One is parameter proximity, such as $S \subset D$0. Another is behavioral similarity: predictions of the unlearned model should remain close to the retrained model on retained data while diverging on forgotten data. A third is state-level proximity, expressed through high fidelity or low trace distance between model-induced quantum states. Hybrid-model studies also formulate the task as constrained proximity to the retrain oracle,

$S \subset D$1

where $S \subset D$2 is a quantum distance measure and $S \subset D$3 bounds retained-data degradation (Crivoi et al., 22 Dec 2025).

The scope of forgetting is already differentiated. Current studies cover sample-level deletion, class-level deletion, subset removal, and client-level deletion in federated settings. The empirical literature is dominated by class-wise and subset removal protocols, including deletion of all samples from a target class in MNIST, Iris, Covertype, and Fashion-MNIST, as well as forgetting of corrupted subsets in binary QNNs trained under label noise (Su et al., 7 Sep 2025, Chen et al., 4 Aug 2025, Malik et al., 7 Jan 2026, Crivoi et al., 22 Dec 2025).

2. Physical foundations and operational metrics

A distinct feature of QMU is that forgetting is framed not only algorithmically but physically. One formalization represents a trained quantum model by a state $S \subset D$4 and unlearning by a CPTP map $S \subset D$5 or $S \subset D$6. In this view, forgetting is constrained by contractivity of distinguishability under physical evolution: $S \subset D$7 and

$S \subset D$8

This supplies a quantum-information-theoretic basis for evaluating whether a post-unlearning model has moved closer to the retrained counterfactual under operational distances (Shaik et al., 1 Nov 2025, Malik et al., 7 Jan 2026).

The certification template proposed in foundational work is

$S \subset D$9

where $D \setminus S$0 may be trace distance or infidelity $D \setminus S$1. This connects QMU to verifiable deletion: the unlearned model is acceptable insofar as it is operationally close to the retrained model trained on the retained set alone. At the same time, recent hybrid-model studies stress that empirical “certified unlearning” via noisy fine-tuning is not yet a formal $D \setminus S$2 certificate in non-convex quantum-classical models, and should instead be understood as a robustness-regularization mechanism evaluated through output similarity and privacy metrics (Shaik et al., 1 Nov 2025, Crivoi et al., 22 Dec 2025).

The physical interpretation is also constrained by quantum no-cloning and no-deletion principles. In the taxonomy-oriented formulation, deletion is not literal annihilation of information but redistribution to an environment $D \setminus S$3 under a unitary dilation; accordingly, QMU is framed as rendering information operationally inaccessible rather than destroying it absolutely. Landauer’s principle is invoked to relate logical erasure to entropy increase in the environment. This perspective distinguishes quantum unlearning from purely Euclidean parameter editing and motivates the use of trace distance, fidelity, relative entropy, and CPTP monotonicity as primary conceptual tools (Shaik et al., 1 Nov 2025).

In practice, evaluation is broader than state metrics alone. Existing studies combine operational distances with task-level utility and privacy indicators: retained-data accuracy, F1, recall, KL and JS divergence to a retrain oracle, prediction agreement, forgetting accuracy on the forget set, and Membership Inference Attack (MIA) success rate. The coexistence of these criteria reflects a central property of QMU: no single observable fully captures forgetting, retention, privacy, and alignment to the retrained counterfactual (Su et al., 7 Sep 2025, Crivoi et al., 22 Dec 2025, Malik et al., 7 Jan 2026).

3. Algorithmic mechanisms

Current QMU methods fall into a small number of mechanism families that have been adapted from classical unlearning or developed specifically for variational and hybrid quantum models.

Mechanism family	Defining idea	Representative sources
Gradient ascent and bidirectional objectives	Ascend forget-set loss, optionally combine with retain-set descent or recovery	(Su et al., 7 Sep 2025, Crivoi et al., 22 Dec 2025)
Fisher- or QFI-weighted updates	Scale or mask updates using empirical Fisher or quantum Fisher information	(Su et al., 7 Sep 2025, Shaik et al., 1 Nov 2025)
Reset and partial retraining	Reinitialize selected layers or parameter subspaces, then fine-tune on retained data	(Crivoi et al., 22 Dec 2025, Shaik et al., 1 Nov 2025)
Distillation and scrubbing	Match a teacher on retained data while diverging on forgotten data	(Chen et al., 4 Aug 2025, Crivoi et al., 22 Dec 2025)
Distribution-guided constrained unlearning	Optimize a fixed forget-target distribution with anchor-based preservation and parameter proximity	(Malik et al., 7 Jan 2026)

The simplest operational family is reverse optimization on the forget set. In gradient-ascent unlearning, parameters are updated by ascending the loss on the data to be forgotten,

$D \setminus S$4

optionally followed by recovery on the retained set. Hybrid variants such as NegGrad+ combine descent on retained data with ascent on forgotten data in one objective. In QML-specific implementations, gradients in the quantum part are evaluated by the parameter-shift rule, while the classical front end uses standard autodiff (Su et al., 7 Sep 2025, Crivoi et al., 22 Dec 2025).

A second family uses parameter sensitivity. The empirical Fisher diagonal underlies Selective Synaptic Dampening (SSD) and Fisher-guided relative gradient ascent; parameters relatively more important to forgotten data are damped or selectively updated. The taxonomy paper generalizes this idea through influence-function approximations and QFI-weighted natural-gradient steps, replacing explicit Hessian inversion by Fisher or block-Fisher preconditioning for hardware compatibility. These methods are motivated by the claim that forgetting should be concentrated in the parameters most responsible for memorizing the deleted subset (Su et al., 7 Sep 2025, Shaik et al., 1 Nov 2025).

Hybrid-model studies add structural and distillation-based mechanisms. EU-k reinitializes the last $D \setminus S$5 layers and fine-tunes on retained data only; SCRUB and SCRUB(+R) use teacher-student KL alignment on retained data combined with a forgetting mechanism on the forget set. Two quantum-tailored methods introduced for hybrid VQCs are Label-Complement Augmentation (LCA), which replaces the target class by the complementary distribution

$D \setminus S$6

and ADV-UNIFORM, which pushes forgotten inputs toward a uniform predictive distribution using adversarially perturbed inputs and a KL objective against $D \setminus S$7. These methods are explicitly motivated by amplitude-based representations, entanglement, and the tendency of low-capacity circuits to favor high-entropy forgetting targets (Crivoi et al., 22 Dec 2025).

The most explicit constrained formulation so far is the distribution-guided class-level framework for variational quantum classifiers. For a forgotten class $D \setminus S$8, it constructs a target distribution $D \setminus S$9 with $$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$0 and

$$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$1

where $$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$2 is a calibration subset of the forget set and $$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$3 controls target sharpness. The unlearning objective is

$$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$4

with $$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$5 the forget-set objective, $$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$6 an anchor-preservation term using cached soft labels on a retained anchor set $$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$7, $$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$8 the preservation weight, and $$\theta^* = \arg\min_\theta L(\theta; D\setminus S).$$9 the parameter-proximity weight. Theorem 1 interprets this as a Lagrangian relaxation of KL-preservation and parameter-proximity constraints. In the reported implementation, the VQC uses 6 qubits, a reuploaded feature map, a ring-entanglement ansatz with 3 repetitions, 72 trainable parameters, Pauli-$\theta'$0 readout on qubits 3, 4, and 5, parameter-shift gradients, Adam, and an optional cosine learning-rate schedule (Malik et al., 7 Jan 2026).

4. Empirical findings across model classes

The empirical record is heterogeneous because datasets, circuit classes, and deletion regimes differ substantially.

Study	Setup	Selected outcomes
(Malik et al., 7 Jan 2026)	6-qubit VQCs on Iris and Covertype; forget class $\theta'$1	Mean forgotten-class probability drops from $\theta'$2 on Covertype and $\theta'$3 on Iris; Covertype retained-label mean KL to gold retraining is $\theta'$4
(Su et al., 7 Sep 2025)	10-qubit QNN/HQNN on MNIST; simulation and Tianyan-504 hardware	Average MIA success rate falls from $\theta'$5 to $\theta'$6 in simulation and from $\theta'$7 to $\theta'$8 on hardware
(Chen et al., 4 Aug 2025)	QNN vs MLP under label flipping on MNIST 1 vs 9 and XXZ ground states	QNN shows a robust plateau for $\theta'$9, a collapse near $\theta'$0, and $\theta'$1, while MLP has $\theta'$2
(Crivoi et al., 22 Dec 2025)	Hybrid VQCs on Iris, MNIST, Fashion-MNIST; subset removal and full-class deletion	EU-k, LCA, and Certified often give the best trade-off; on Fashion-MNIST subset forgetting, LCA reports UQI $\theta'$3 and MIA $\theta'$4

The distribution-guided constrained VQC study shows that target design materially affects forgetting behavior. On Covertype, class-wise recall changes from $\theta'$5 for class 0, $\theta'$6 for class 1, and $\theta'$7 for forgotten class 2. On Iris, recall changes from $\theta'$8 for class 0, $\theta'$9 for class 1, and $\theta^*$0 for forgotten class 2. The appendix comparison with uniform redistribution is unfavorable: on Covertype, mean forgotten-class probability decreases only from $\theta^*$1, with overall accuracy $\theta^*$2, which the paper interprets as incomplete forgetting with diffuse confusion rather than redistribution toward a semantically proximate retained class (Malik et al., 7 Jan 2026).

The privacy-oriented MNIST study is the main source of hardware evidence. Before unlearning, MIA is strong under black-box access to logits, softmax values, loss, and measurement outputs. After unlearning, GA and Fisher-guided methods drive leakage close to zero while largely preserving retained accuracy, and SSD is particularly efficient for the higher-capacity HQNN. For example, on simulation HQNN, SSD(10,0.1) attains Acc$\theta^*$3, Acc$\theta^*$4, MIA $\theta^*$5, and complexity $\theta^*$6s; on hardware HQNN, FG-U(2)R(1) gives Acc$\theta^*$7, Acc$\theta^*$8, MIA $\theta^*$9, and complexity $U(D_f, D, A(D)) \approx A(D \setminus D_f),$0s. The same study also shows that low-capacity QNNs are more sensitive: SSD variants can fail to preserve utility when Fisher estimates are noisy (Su et al., 7 Sep 2025).

The poisoning-and-noise study emphasizes a different empirical axis: amenability to unlearning. Under label flipping, the QNN does not merely degrade more slowly than the MLP; it exhibits a phase transition-like response with a robust plateau for $U(D_f, D, A(D)) \approx A(D \setminus D_f),$1 and sharp collapse near $U(D_f, D, A(D)) \approx A(D \setminus D_f),$2. The proposed mechanistic explanation is loss-landscape geometry: the Landscape Roughening Ratio remains near unity for QNNs but becomes $U(D_f, D, A(D)) \approx A(D \setminus D_f),$3 for MLPs. Within equal training-time windows, approximate unlearning methods such as Finetune, Scrub, and Gradient Ascent often recover QNN validation performance to, and in many runs beyond, retraining-from-scratch levels after a transient dip, while approximate unlearning remains consistently inferior to retraining in the MLP (Chen et al., 4 Aug 2025).

The broad hybrid empirical study identifies a depth- and task-dependent regime change. On shallow Iris VQCs, many unlearning methods produce only minor representational shifts, and subset forgetting leaves utility largely intact. On deeper MNIST and Fashion-MNIST hybrids, structured interventions dominate unconstrained gradient baselines. EU-k often aligns most closely with the retrain oracle by KL and JS divergence, LCA is notable for strong UQI and low MIA, and noisy fine-tuning under the Certified protocol gives robust test accuracy and alignment without formal certificates. A stated conclusion is that shallow VQCs display high intrinsic stability with minimal memorization, whereas deeper hybrid models exhibit stronger trade-offs between utility, forgetting strength, and retrain-oracle alignment (Crivoi et al., 22 Dec 2025).

5. Privacy, robustness, and system context

Privacy is one of the principal motivations for QMU. The clearest empirical evidence comes from the MNIST hardware study, which reports average MIA success rates of $U(D_f, D, A(D)) \approx A(D \setminus D_f),$4 in noiseless simulations and $U(D_f, D, A(D)) \approx A(D \setminus D_f),$5 on quantum hardware before unlearning. Post-unlearning leakage drops to $U(D_f, D, A(D)) \approx A(D \setminus D_f),$6 in simulation and $U(D_f, D, A(D)) \approx A(D \setminus D_f),$7 on hardware on average across settings. These results establish that membership leakage is not merely a classical concern transplanted to QML by analogy; it is directly measurable under black-box query access to quantum-model outputs and cloud-returned measurements (Su et al., 7 Sep 2025).

A second context is robustness to corrupted training data. In the poisoning study, QNNs are described as more resilient to label noise and more amenable to approximate forgetting than MLPs. The proposed explanation is not only statistical but geometric: noisy labels roughen the classical landscape sharply, while the QNN loss landscape remains structurally stable and therefore more plastic under forgetting updates. This suggests that QMU is not restricted to deletion compliance; it is also a remediation mechanism for poisoned or polluted training regimes (Chen et al., 4 Aug 2025).

The field has also been systematized into a five-axis taxonomy: scope, guarantees, mechanisms, system context, and hardware realization. Scope covers sample-level, class-level, and client-level deletion. Guarantees range from empirical forgetting curves to certified bounds and differential privacy or quantum differential privacy (QDP). Mechanisms include influence and QFI-weighted updates, reset plus partial retraining, gradient reversal or inversion, and kernel-alignment methods. System context spans pure variational QML, kernel methods, generative models, federated quantum learning, and hybrid classical-quantum pipelines. Hardware realization includes simulators, superconducting QPUs, trapped ions, and annealers, with noise sometimes treated as privacy-randomization and error mitigation used to restore utility (Shaik et al., 1 Nov 2025).

The QDP formulation extends QMU into distributed and privacy-aware settings. For neighboring datasets $U(D_f, D, A(D)) \approx A(D \setminus D_f),$8, a mechanism $U(D_f, D, A(D)) \approx A(D \setminus D_f),$9 satisfies

$D_f$0

In the proposed federated workflows, clients perform local unlearning through CPTP maps or Fisher-weighted updates, aggregators apply secure aggregation and QDP accounting, and provenance logs or verifiable delegation support audits. A plausible implication is that future QMU systems will be evaluated not only by forgetting quality but also by their compatibility with cryptographic transport, privacy composition, and distributed deletion requests (Shaik et al., 1 Nov 2025).

6. Limitations, unresolved questions, and research directions

Despite rapid conceptual elaboration, current QMU evidence remains narrow in several respects. Many results are simulator-based. The distribution-guided constrained VQC study uses a noiseless statevector simulator with exact Pauli-$D_f$1 expectation values and does not assess hardware noise, deeper circuits, or larger datasets. The hybrid empirical study also uses simulators only and does not model gate fidelity, topology constraints, decoherence, or sampling noise. The privacy-oriented MNIST study includes Tianyan-504 hardware experiments, but Fisher computations are performed in simulation when direct hardware evaluation is infeasible, and shots, transpilation, and error-mitigation details are not reported (Malik et al., 7 Jan 2026, Crivoi et al., 22 Dec 2025, Su et al., 7 Sep 2025).

Formal guarantees are similarly limited. The constrained VQC paper proves a Lagrangian equivalence for its objective but does not prove convergence of gradient ascent or formal satisfaction of the constraints under optimizer settings. The hardware MIA study provides empirical privacy reduction but no certified privacy guarantee. The hybrid benchmark explicitly notes that its “Certified Unlearning” protocol is empirical rather than a formal $D_f$2 certificate for non-convex hybrid models. The poisoning study proposes state-distance and distributional criteria for future certification, but its guarantees remain qualitative or empirical (Malik et al., 7 Jan 2026, Su et al., 7 Sep 2025, Crivoi et al., 22 Dec 2025, Chen et al., 4 Aug 2025).

There are also scope limitations. Existing demonstrations focus on class-wise deletion, binary classification, mild subset removal such as $D_f$3 random deletion, or 3-class problems. Instance-level unlearning, multi-class forgetting beyond simple class removal, generative models, reinforcement learning, and stronger white-box adversaries are largely identified as future directions rather than solved settings. Several works also report qualitative hyperparameter guidance without systematic ablations for quantities such as $D_f$4, $D_f$5, $D_f$6, anchor selection, or anchor count (Malik et al., 7 Jan 2026, Su et al., 7 Sep 2025, Crivoi et al., 22 Dec 2025).

Across the literature, three open problems recur. The first is provable forgetting: machine-checkable certificates in operational metrics such as trace distance or infidelity to the retrained counterfactual. The second is scalable, hardware-realistic optimization: shot-efficient Fisher estimation, noise-aware QFI approximations, and robust protocols for deeper circuits and larger datasets. The third is governance and auditability: standardized reporting of privacy budgets, hardware conditions, calibration, provenance, and post-unlearning interpretability. Foundational taxonomic work explicitly connects these to ethical governance, verifiable delegation, and backend-agnostic audits, indicating that QMU is developing not only as an algorithmic topic but as an infrastructure problem for trustworthy quantum intelligence (Shaik et al., 1 Nov 2025).

In its present state, QMU is best understood as an emerging discipline with three complementary cores: a retrain-oracle objective inherited from machine unlearning, a physical interpretation grounded in CPTP contraction and operational distinguishability, and a practical algorithmic toolbox for PQCs, VQCs, and hybrid quantum-classical networks. The empirical record already supports several stable conclusions: QML models can leak membership information, shallow VQCs often exhibit low memorization, deeper hybrids require structured unlearning interventions, and target design plus explicit preservation constraints can materially improve class-level forgetting. What remains unsettled is the extent to which these observations can be elevated from benchmark-dependent empirical regularities to formal, scalable, and auditable guarantees (Su et al., 7 Sep 2025, Chen et al., 4 Aug 2025, Crivoi et al., 22 Dec 2025, Malik et al., 7 Jan 2026, Shaik et al., 1 Nov 2025).