Gentle measurement of quantum states and differential privacy

Abstract

In differential privacy (DP), we want to query a database about n users, in a way that "leaks at most ε about any individual user," even conditioned on any outcome of the query. Meanwhile, in gentle measurement, we want to measure n quantum states, in a way that "damages the states by at most α," even conditioned on any outcome of the measurement. In both cases, we can achieve the goal by techniques like deliberately adding noise to the outcome before returning it. This paper proves a new and general connection between the two subjects. Specifically, we show that on products of n quantum states, any measurement that is α-gentle for small α is also O (α)-DP, and any product measurement that is ε-DP is also O (ε √ n)-gentle. Illustrating the power of this connection, we apply it to the recently studied problem of shadow tomography. Given an unknown d-dimensional quantum state ρ, as well as known twooutcome measurements E 1 , . . . , E m , shadow tomography asks us to estimate Pr [E i accepts ρ], for every i ∈ [m], by measuring few copies of ρ. Using our connection theorem, together with a quantum analog of the so-called private multiplicative weights algorithm of Hardt and Rothblum, we give a protocol to solve this problem using O (log m) 2 (log d) 2 copies of ρ, compared to Aaronson's previous bound of O (log m) 4 (log d) . Our protocol has the advantages of being online (that is, the E i 's are processed one at a time), gentle, and conceptually simple. Other applications of our connection include new lower bounds for shadow tomography from lower bounds on DP, and a result on the safe use of estimation algorithms as subroutines inside larger quantum algorithms.The question is, how should we design the queries to balance these two apparently conflicting demands?More formally, call two databases X, X ′ neighbors if they differ only in a single entry x i . Then here is the key definition:Definition 2 (Differential Privacy [20]) Given a randomized algorithm A that queries a database X, as well as a parameter ε ≥ 0, we define A to be ε-DP if for all databases X, X ′ that are neighbors, and all possible outputs y of A, we have Pr [A (X) = y] ≤ e ε Pr A X ′ = y .Here the probabilities are over the internal randomness used by A.6 While there are other ways to prove that Lσ is O ( √ n/σ)-gentle, the nicest proof we know will deduce it as an immediate corollary of this paper's main results.

Information-Theoretic Bounds on Quantum Advantage in Machine Learning

“…E 2 [39]. The sample complexity stated in Theorem 2 improves upon previously known shadow tomography protocols [29,[44][45][46] for the special case of predicting Pauli observables; see Supplemental Material, App. A [39].…”

Quantum advantage in learning from experiments

“…We will prove that even predicting the absolute value of just a single observable requires exponentially many copies in the conventional scenario. In contrast, an algorithm with quantum memory can predict the expectation values for 𝑀 arbitrary observables from only 𝒪(𝑛 log(𝑀 )/𝜖 4 ) copies of 𝜌 through the procedure known as shadow tomography [45][46][47]. Hence, even if we would like to predict an exponential number of observables, an algorithm with quantum memory only needs a polynomial number of copies.…”

On the Hardness of PAC-learning Stabilizer States with Noise

“…Note that these notions are different from those of [5], which defined differential privacy for quantum measurements. Here two n-qubit states are considered neighbors if it is possible to reach one from the other by a quantum operation (sometimes called a superoperator) on a single qubit.…”

“…In particular, two product states ρ = ⊗ i ρ i and σ = ⊗ i σ i are neighbors if ρ i = σ i for all i but one. Definition 6.4 (Quantum differential privacy for measurements, [5]). A measurement M is said to be α-DP if for any n-qubit neighbor states ρ, σ, and any outcome y, P[M (ρ) = y] ≤ e α P[M (σ) = y].…”