---
title: Quantum Machine Unlearning (QMU)
url: https://www.emergentmind.com/topics/quantum-machine-unlearning-qmu
type: topic
---

# Quantum Machine Unlearning (QMU)

Quantum Machine Unlearning (QMU) is the problem of removing or suppressing the influence of specific training data from a quantum machine learning model without full retraining. In the current literature, QMU is treated as both a practical algorithmic task and a foundational question at the intersection of quantum information theory, privacy-preserving computation, and trustworthy artificial intelligence. The topic spans class-level deletion, subset removal, and client-level deletion; variational quantum classifiers, hybrid quantum-classical neural networks, and kernel methods; and empirical, certified, and differential-privacy-oriented guarantees [2601.04413][2511.00406][2512.19253][2509.06086].

## 1. Definition, scope, and problem setting

In the most direct formulation, QMU seeks an update from an original model to an unlearned model that removes the influence of a designated forget set while preserving performance on retained data. Malik, Khalid, and Faryad formulate this explicitly for class-level unlearning in a trained classifier with parameters \(w_{\mathrm{orig}}\), a forget set \(F\) for a forgotten class \(f\), and an anchor set \(A\) of retained samples whose predictive behaviour should be preserved [2601.04413].

The broader formal framework in the QMU taxonomy distinguishes three scopes: sample-level, class-level, and client-level forgetting. The same taxonomy separates empirical guarantees, certified guarantees, and differential privacy guarantees; identifies mechanisms such as influence- and quantum Fisher information (QFI)-weighted updates, parameter re-initialization, gradient reversal or inversion, kernel alignment, and reservoir readout; and situates QMU in standalone, hybrid, and federated system contexts, with hardware realization ranging from simulators to superconducting and trapped-ion processors [2511.00406].

Empirically, the task has been instantiated in two main deletion regimes. One is subset forgetting, such as removal of a random \(2\%\) of samples. The other is full-class forgetting, which requires a larger representational change because an entire class is deleted [2512.19253]. Class-wise unlearning has also been used to study privacy leakage through Membership Inference Attacks (MIA), where the question is whether a model retains enough signal about training membership for an adversary to distinguish member from non-member data [2509.06086].

## 2. Physical and formal foundations

A distinctive feature of QMU is that forgetting is constrained by quantum mechanics. The formal framework of QMU grounds forgetting in completely positive trace-preserving (CPTP) dynamics and defines it as a contraction of distinguishability between the post-unlearning model and the counterfactual model trained without the removed data [2511.00406]. In that formulation,
\[
\rho' = \mathcal{E}(\rho(\theta))
\]
and the target is
\[
\mathcal{D}(\rho', \rho(\theta^{\setminus D_r})) < \mathcal{D}(\rho(\theta), \rho(\theta^{\setminus D_r})),
\]
where \(\mathcal{D}\) is a measure of quantum distinguishability such as trace distance or infidelity [2511.00406].

This definition is motivated by standard physical constraints. The literature explicitly invokes the no-cloning theorem, the no-deletion theorem, and Landauer’s principle, emphasizing that quantum data removal cannot be treated as unconstrained erasure in the classical sense [2511.00406]. The associated data-processing inequality,
\[
D(\rho\Vert\sigma) \geq D(\mathcal{E}(\rho)\Vert \mathcal{E}(\sigma)),
\]
supports the interpretation that unlearning reduces recoverable information rather than literally deleting it [2511.00406]. A common misconception is therefore that QMU should yield exact physical erasure of the forgotten data; the formal literature instead frames it as controlled reduction of influence under admissible quantum dynamics.

An older antecedent is Daniel K. L. Oi’s analysis of “quantum unlearning,” which studies how information gained by measurement can be probabilistically “unlearned” through subsequent filtering operations [1404.3784]. In that setting, Procrustean filtering and recursive partial filtering restore unitary evolution with success probabilities determined by the minimal singular values of the relevant Kraus operators. This suggests a conceptual precursor to QMU, although the 2014 work addresses measurement reversal rather than machine unlearning in trained quantum models [1404.3784].

## 3. Taxonomy and mechanism families

The five-axis taxonomy introduced for QMU organizes the field around scope, guarantees, mechanisms, system context, and hardware realization [2511.00406].

| Axis | Description | Representative notes |
|---|---|---|
| Scope | What is forgotten | Sample-level, class-level, client-level |
| Guarantees | How forgetting is validated | Empirical, certified, differential privacy |
| Mechanisms | How forgetting is implemented | QFI updates, re-initialization, kernels |
| System context | Where the model operates | Standalone, hybrid, federated |
| Hardware realization | Where QMU runs | Simulators, NISQ processors, annealers |

Within this structure, QFI-weighted updates use the QFI matrix
\[
F_{ij} = \operatorname{Re}\!\left[\langle \partial_i\psi | \partial_j\psi\rangle - \langle \partial_i\psi | \psi\rangle\langle\psi | \partial_j\psi\rangle \right]
\]
to produce geometry-aware parameter updates of the form
\[
\theta \leftarrow \theta - \eta F(\theta)^{-1}\nabla_\theta \mathcal{L}_{\mathcal{S}}(\theta),
\]
with the stated benefit of stable and effective steps on noisy intermediate-scale quantum (NISQ) devices [2511.00406]. Parameter re-initialization and partial retraining reset influential parameters or subspaces and then fine-tune on retained data; kernel alignment edits or downweights entries in a quantum Gram matrix or changes the feature map; and gradient reversal or inversion attempts to suppress the effect of target data via adversarial or comb-based procedures [2511.00406].

The first comprehensive empirical study of machine unlearning in hybrid quantum-classical neural networks adapts gradient-based, distillation-based, regularization-based, and certified techniques to models with variational quantum circuits (VQCs), and introduces two quantum-tailored strategies: Label-Complement Augmentation (LCA) and ADV-UNIFORM [2512.19253]. LCA replaces a forgotten sample’s true one-hot label by the complement distribution
\[
\tilde{y}_i = \frac{\mathbf{1} - y_i}{K-1},
\]
and optimizes a KL-based loss that enforces high-entropy output on forgotten samples [2512.19253]. ADV-UNIFORM constructs adversarial inputs that amplify divergence from the uniform distribution and then pushes outputs toward the uniform class distribution [2512.19253]. In these hybrid settings, gradients are computed with the parameter-shift rule rather than direct access to cloned quantum states, consistent with the no-cloning constraint [2512.19253].

## 4. Distribution-guided and constrained class-level QMU

A prominent recent formulation casts class-level QMU as a constrained optimization problem with an explicit trade-off between forgetting and preservation [2601.04413]. The constrained maximization is written as
\[
\max_w \ \mathcal{L}_F(w)
\]
subject to an average KL-divergence constraint on anchors and an \(L_2\) constraint on parameter drift from \(w_{\mathrm{orig}}\) [2601.04413]. In Lagrangian form,
\[
J(w) = \mathcal{L}_F(w) + \alpha \mathcal{L}_A(w) - \lambda \|w - w_{\mathrm{orig}}\|_2^2,
\]
where \(\mathcal{L}_F\) is the forget term and \(\mathcal{L}_A\) preserves the cached reference outputs on the anchor set [2601.04413].

The distinctive element is the tunable, distribution-guided forget target. Instead of redistributing forgotten-class probability mass uniformly across retained classes, the method uses model-derived semantic similarity. For a forget class \(f\), a calibration subset \(S \subseteq F\) is selected, and the target for \(k \neq f\) is constructed as
\[
q_k \propto \left(\mathbb{E}_{x \in S}[p_{w_{\mathrm{orig}}}(k \mid x)]\right)^{\beta},
\]
then normalized with \(q_f = 0\). The exponent \(\beta > 0\) tunes the sharpness of the redistribution [2601.04413]. The stated interpretation is that if the original model already confuses the forgotten class with a particular retained class, most probability is reassigned there, producing semantically meaningful unlearning [2601.04413].

The preservation side is anchor-based. At the start of unlearning, the model caches the softmax output distribution \(p_{w_{\mathrm{orig}}}(\cdot \mid x)\) for each anchor, and then regularizes subsequent predictions to remain close to these references through
\[
\mathcal{L}_A(w) = \frac{1}{|A|}\sum_{x \in A}\sum_{k=1}^K p_{w_{\mathrm{orig}}}(k \mid x)\log p_w(k \mid x).
\]
This is explicitly intended to avoid catastrophic forgetting of retained classes and to induce a controlled unlearning trajectory [2601.04413].

The implementation studied in that work uses a six-qubit variational quantum classifier with data reuploading and hardware-efficient ansatz, with class logits derived from Pauli-\(Z\) expectation on three readout qubits. Optimization proceeds by gradient ascent, with gradients computed through the parameter-shift rule,
\[
\frac{\partial L(w)}{\partial w_i} =
\frac{L\!\left(w+\frac{\pi}{2}e_i\right)-L\!\left(w-\frac{\pi}{2}e_i\right)}{2},
\]
using minibatches from forget and anchor sets. The \(L_2\) term prevents drastic parameter drift, and the reported typical hyperparameters are \(\alpha = 1\) and \(\lambda = 0.01\) [2601.04413].

## 5. Empirical findings, benchmarks, and observed trade-offs

Current empirical evidence presents QMU as feasible, but strongly dependent on architecture, depth, entanglement structure, task complexity, and the deletion scenario.

In privacy-oriented experiments on MNIST, class-wise unlearning was evaluated in noiseless PennyLane simulations and on the Tianyan-504 superconducting quantum computer. Before unlearning, MIA success rates averaged \(90.2\%\) in noiseless simulations and \(75.3\%\) on quantum hardware. After applying QMU algorithms, the average MIA success rate was reduced to \(0\%\) in simulations and \(3.7\%\) on hardware while preserving accuracy on retained data [2509.06086]. The same study implemented gradient ascent unlearning, Fisher-Based Unlearning, and Fisher-Guided Relative Gradient Ascent, and reported that Fisher-based and Fisher-guided methods better preserved retained-data accuracy than naïve gradient ascent [2509.06086].

In the broad empirical study of hybrid models, Iris used a 4-qubit VQC, MNIST a 6-qubit VQC within a moderate hybrid pipeline, and Fashion-MNIST a 10-qubit, deeper VQC with a 2-layer MLP head. Across subset removal and full-class deletion, shallow VQCs exhibited high intrinsic stability with minimal memorization, whereas deeper hybrid models showed stronger trade-offs between utility, forgetting strength, and alignment with a retrain oracle. The methods identified as consistently providing the best balance across metrics were EU-\(k\), LCA, and Certified Unlearning [2512.19253]. On Fashion-MNIST in particular, EU-\(k\), Certified, LCA, and ADV-UNIF best preserved utility and retrain similarity, while simple gradient methods severely underperformed in both accuracy and forgetting on deeper circuits [2512.19253].

The distribution-guided constrained approach was evaluated on Iris and Covertype with comparison to uniform-target unlearning and gold retraining. On Iris, forgotten-class recall dropped from \(1.0 \rightarrow 0.0\), retained-class recalls remained at \(1.0\) or decreased only modestly to \(0.8\), and mean forgotten-class probability dropped from \(0.42 \rightarrow 0.21\). On Covertype, forgotten-class recall changed from \(0.63 \rightarrow 0.07\), retained-class recalls were unaffected, mean forgotten-class confidence changed from \(0.41 \rightarrow 0.27\), and uniform redistribution achieved only weak suppression to \(0.37\) mean probability. On Covertype retained-class samples, the mean KL divergence to the gold retrained model was \(0.047\) with median \(0.034\) [2601.04413]. The reported qualitative effect is that post-unlearning errors are primarily reassigned to the most similar retained class rather than distributed arbitrarily [2601.04413].

A separate line of experiments compares classical neural networks and quantum neural networks under label flipping and feature randomization. There, QNNs are reported to maintain high validation accuracy up to a critical corruption ratio \(\alpha_c \approx 0.5\), beyond which performance collapses sharply, while classical models degrade continuously [2508.02422]. The same work defines the Landscape Roughening Ratio,
\[
\mathrm{LRR} = \frac{\mathrm{Tr}(\mathbf{H}_{\text{noisy}})}{\mathrm{Tr}(\mathbf{H}_{\text{clean}})},
\]
and reports \(\mathrm{LRR} \sim 10^2\) or more for classical MLPs versus \(\mathrm{LRR} \approx 1\) for QNNs [2508.02422]. Approximate unlearning methods such as finetuning, gradient ascent, and scrub reportedly perform well on QNNs but fall short on classical models, which the paper interprets as evidence of quantum-model plasticity and amenability to efficient forgetting [2508.02422].

## 6. Interpretation, limitations, and research directions

Several limitations recur across the literature. First, QMU is not yet synonymous with certified deletion. The taxonomy distinguishes empirical demonstrations from certified and differential-privacy guarantees, and explicitly calls for machine-checkable and hardware-calibrated proofs of forgetting, including bounds on trace distance or fidelity to counterfactual retraining [2511.00406]. Second, strong empirical performance in shallow circuits does not remove the need for quantum-aware algorithms in deeper and more entangled models, where naïve methods degrade utility or fail to match retraining behavior [2512.19253].

Privacy-aware and distributed extensions are already part of the formal agenda. The literature proposes Quantum Differential Privacy with guarantees of the form
\[
\Pr[\mathcal{M}(D) \in S] \le e^{\varepsilon}\Pr[\mathcal{M}(D') \in S] + \delta,
\]
along with secure aggregation, homomorphic encryption, and verifiable delegation for federated or outsourced quantum systems [2511.00406]. Ethical and governance-oriented work further argues that privacy guarantees and deletion proofs should become first-class audit artifacts, including \((\varepsilon,\delta)\), trace distances to counterfactual retraining, calibration transparency across devices, and backend-agnostic reporting [2511.00406].

Interpretability is also treated as an open problem. The research roadmap explicitly includes post-unlearning interpretability and fairness, including the use of explainability tools such as Shapley values and feature attributions, and attention to hardware fairness because different devices and noise levels may affect unlearning reliability [2511.00406]. In the class-level constrained framework, the use of similarity-guided targets and anchor constraints is presented as improving interpretability by making error redistribution structured rather than arbitrary [2601.04413]. This suggests that future QMU systems may be judged not only by forgetting strength and retained utility, but also by whether their post-unlearning behaviour is physically consistent, auditable, and semantically coherent.

Source: https://www.emergentmind.com/topics/quantum-machine-unlearning-qmu