Introduction
Benchmark datasets of malware underpin the development and comparison of learning-based detectors, yet they are difficult to share: the samples are harmful programs, and their collection often depends on sources whose terms restrict re-distribution. Synthetic records produced by generative models offer a substitute that research groups could exchange instead of the programs themselves. Diffusion models [1 ] have become the leading generators of such data, from images in latent spaces [2 ] to tabular records [3 ] and embeddings of malware programs [4 ] . However, a synthetic dataset protects its sources only if the generator does not reproduce them. Diffusion models can memorize and regenerate individual training samples [5 ] , and synthetic data in general either fail to prevent inference attacks or lose much of their utility [6 ] . A release of synthetic security data therefore requires evidence on both utility and privacy.
Quantum machine learning (QML) offers a different class of generators, in which parameterized quantum circuits play the role of neural networks [7 ] . In our systematic review of quantum deep learning in the noisy intermediate-scale quantum (NISQ) era [8 ] , we examined how such models have been designed and evaluated under the limited qubit counts and circuit depths of current devices [9 ] . These limits also shape the performance of quantum neural networks (QNNs): in our comparative analysis of three hybrid QNN architectures [10 ] , models that performed well on datasets with few features degraded markedly on high-dimensional data, and their robustness to quantum noise differed considerably between architectures. A quantum generator for
malware records should therefore operate on compact representations, which latent diffusion provides by moving the generative process into the low-dimensional space of a pre-trained autoencoder [2 ] .
Quantum diffusion models can be broadly categorized into two families. In hybrid models, variational circuits replace components of a classical denoiser, such as the layers of a U-Net [11 ] , or a classical network processes the measured state between the steps [12 ] . Since the classical network of such a model can carry most of the generative task, the contribution of its circuits is difficult to isolate. In fully quantum models, the circuit itself maps noisy quantum states onto denoised ones, with ancilla measurements that provide the required non-unitary step [12 , 13 , 14 ] . These models rest on two expectations: since n n n 2 n 2^n 2 n
In this research, we introduce a fully quantum latent diffusion model for malware records and evaluate it against these requirements, which tests the expectations above directly: the circuit performs every denoising step alone, so that its contribution can be measured in isolation, at a known parameter count and a measurable cost of sampling on quantum hardware. A pre-trained convolutional autoencoder maps every opcode sequence onto a latent vector of 32 features, which we store in the amplitudes of five qubits, and a reverse-bottleneck circuit with one ancilla measurement performs every denoising step without any classical neural layer. Our contributions are summarized as follows:
We formulate fully quantum latent diffusion for malware records, with two amplitude codecs, a family-conditioned circuit trained toward the posterior mean of each step, and a decoder that restores the length removed by the encoding, together with a threat model for the release of synthetic security data (§ 3 ). To the best of our knowledge, this is the first application of a quantum diffusion model to security data.
We establish a theorem and two propositions on the training target, on the initialization and the acceptance probability that it implies, and on the lengths of decoded records, complemented by two lemmas on the smoothness of training and the shot complexity of the read-out, and we verify every statement numerically (§ 3.12 and Appendices § 13 and § 14 ).
We identify a privacy leak in the decoder, which reuses the exact lengths of training records and supports a membership test with an area under the receiver operating characteristic curve (AUC) of 0.80, and we close it with a smoothed bootstrap of the lengths that requires no retraining and with a differentially private estimate of the length distribution that gives a formal guarantee (§ 3.3 and § 5.3 ).
We evaluate the quantum denoiser on all 17 families with ten seeds and paired tests, in terms of utility, distribution fidelity, memorization, membership, sampling cost, and hardware noise, against references that share its encoding, its decoder, and its sampling procedure, namely a parameter-matched classical control, the random states from which sampling starts, and the round-trip ceiling of a perfect generator, and we place the complete framework against a classical latent DDPM in the design of Bao et al. [4 ] . We test the explanations of the limited utility with stochastic samplers, a weighting of the records by their acceptance probability, a training objective that penalizes rejection, and diagnostics on the initial states and the gradients (§ 5 and § 6 ).
Our evaluation clarifies what the current design achieves and where it requires further development. The post-selected circuit learns its objective, lowering the infidelity of its denoising steps by 63% relative to the identity map, and it moves the generated states toward the data, which lowers the squared MMD of its records by 20% relative to the random states from which sampling starts. Its records never copy training data, and a smoothed bootstrap of the decoded lengths closes a channel through which the decoder supports a membership test with an AUC of 0.80. However, the class information of its records remains close to that of the random states: classifiers trained on its records and tested on real records reach a macro-F1 score of 0.114, against 0.076 for the random states and a ceiling of 0.605 for a perfect generator, whereas a parameter-matched classical control reaches 0.367 with the sign-split codec and a classical latent DDPM with 11,404 parameters reaches 0.442, and adding the records of the circuit to the real training data lowers the macro-F1 score from 0.635 to 0.593. After training, the probability of accepting a post-selected sample falls to 3.0 × 10 − 7 3.0 \times10^{-7} 3.0 × 1 0 − 7 1.6 × 10 − 7 1.6 \times10^{-7} 1.6 × 1 0 − 7
The remainder of this paper is organized as follows. § 2 reviews related work on synthetic security data, diffusion models, and quantum generative models. § 3 presents the quantum latent diffusion model and its theoretical analysis, and § 4 describes the experimental setup. § 5 reports the results, § 6 discusses their implications and the limitations of our study, and § 7 concludes the paper. Appendix § 13 contains the proofs, and Appendix § 14 contains their numerical verification.
Related work
In this section, we review three lines of work on which our study builds: the generation of synthetic data for security research together with the assessment of its privacy, diffusion models, and quantum generative models, including the quantum diffusion models that Table 1 compares with ours.
Table 1. Quantum diffusion models compared with this work. Quantum part: the component that the circuit implements. Circuit output: the state that the circuit passes to the next step after its measurement, or the expectation values that a classical network receives. Latent: whether the diffusion runs in the latent space of an autoencoder. FID: Fréchet inception distance; WaM: Wasserstein distance between Gaussian mixtures; SSIM and PSNR: structural similarity and peak signal-to-noise ratio; AUC: area under the receiver operating characteristic curve.
Synthetic data for security research
Machine learning for malware analysis depends on large labeled corpora of programs, which are difficult to share, since the programs themselves are harmful and their collection often involves restricted sources. Public benchmarks have therefore released derived representations, such as the static features of 1.1 million Windows executables in EMBER [15 ] , and opcode sequences obtained by disassembling executables have long served as a representation for the detection of unknown malware [16 ] .
Generative models offer a second way to share such data, and work on them has followed two directions. The first direction builds the generators. Generative adversarial networks (GANs) [17 ] have served attackers to craft malware features that evade black-box detectors [18 ] , and conditional GANs [19 ] and diffusion models [3 , 20 ] have become standard generators of synthetic tabular records and network traffic. Generators of malware data have also operated on opcode sequences, for instance through word embeddings of the opcodes and a Wasserstein GAN [21 ] , and diffusion models have recently followed: Bao et al. [4 ] trained a denoising diffusion probabilistic model (DDPM) [1 ] with a one-dimensional U-Net on per-program embeddings of the opcode sequences of 25 malware families and reported that its synthetic embeddings improved the classification of small families more than those of GANs, Camerota et al. [22 ] augmented images of IoT malware traffic with a DDPM, and Paim et al. [23 ] included a latent diffusion model among the generators of tabular Android malware records. These studies evaluate the generated records by their utility for classifiers and do not measure what the records reveal about their training data. The second direction assesses what the generated data reveal. Empirical audits test whether an adversary can decide that a record belonged to the training set [24 ] , measure the distance of synthetic records to their closest training records [25 ] , or extract training samples from the generator [5 ] , whereas differentially private training [26 ] bounds the influence of every record at a cost in utility. Generators of synthetic data have adopted such guarantees, for instance GANs trained with private aggregation of teacher ensembles [27 ] or with differentially private gradients for tabular records [28 ] , and diffusion models trained with differentially private gradients [29 ] , whose sample quality decreases as the privacy budget shrinks. Both directions share a limitation that Stadler et al. [6 ] made explicit: synthetic data either failed to prevent inference attacks or lost much of their utility, so that privacy and utility cannot be assessed separately. These assessments concern the trained generator, while the deterministic processing that maps generated vectors back to records has received less attention. In contrast, we assess utility and privacy jointly (§ 3.10 ), and we analyze the decoder of our model as a privacy channel of its own, which reveals the lengths of training records unless they are smoothed (Proposition 2 ).
Diffusion models
Diffusion models learn to reverse a gradual noising process [30 ] , and DDPMs [1 ] have made this approach practical by training a network to predict the noise of each step with a regression objective. Subsequent work has mainly reduced the cost of sampling and of the denoiser. Implicit samplers [31 ] replace the stochastic chain of about 1,000 steps with a deterministic chain of far fewer steps, and latent diffusion [2 ] moves the process into the low-dimensional space of a pre-trained autoencoder. Nevertheless, classical denoisers typically remain networks with millions of parameters that are evaluated at every step, and they can memorize their training samples [5 ] . In contrast, our denoiser is a circuit of 11,520 angles that operates in a latent space of 32 features and samples with ten deterministic steps, a combination whose consequences for the diversity of the samples we analyze in § 6.1 .
Quantum generative models
Parameterized quantum circuits [7 ] have served as generative models either by sampling from their measurement distribution [32 ] or by playing the generator of an adversarial game [33 , 34 ] , which can also load probability distributions into quantum states [35 ] . These models share a limitation of training: their gradients can vanish exponentially with the number of qubits [36 ] , so that most quantum generators have remained small. Diffusion offers a way around this limitation, since it splits generation into a sequence of short denoising steps, each of which a shallow circuit can learn [13 ] .
Quantum diffusion models differ mainly in where the circuit acts and in how it realizes the non-unitary map that denoising requires, and Table 1 compares them along these axes. In fully quantum models, the circuit acts on quantum states and obtains the non-unitary step from mid-circuit measurements of ancilla qubits, after which the measured state enters the next step. QuDDPM [13 ] and its mixed-state extension [38 ] have generated ensembles of quantum states in this way, Parigi et al. [39 ] proposed to exploit the noise of quantum processors as the diffusion mechanism itself, and the quantum diffusion models of Cacioppo et al. [12 , 14 ] have generated images from amplitude-encoded pixels and from the latent vectors of a classical autoencoder, with sampling executed on an IBM processor. In hybrid models, a classical network processes the outputs of the circuits, for instance when quantum layers form part of a U-Net [11 , 40 ] or denoise the latent features of a classical autoencoder [41 ] ; concurrently with our work, Li et al. [37 ] placed the circuits in a quantum autoencoder and kept a classical denoiser for the generation of high-dimensional quantum states.
These lines share three limitations with respect to the release of security data. First, their evaluations measure the quality of images or the distance between ensembles of quantum states; Cacioppo et al. [14 ] also checked conditional samples with classifiers trained on real images, but no study has trained classifiers on the generated samples or assessed what the samples reveal about their training data. Second, fully quantum models have avoided branch selection on hardware, because the probability of accepting a run decreases exponentially with the number of selected measurements [12 , 14 ] , but the acceptance probability of a trained post-selected circuit along its sampling trajectories has not been reported. Third, in hybrid models the classical network carries the state between steps, so that the contribution of the circuits is difficult to separate from that of the network.
Our model builds on the latent, fully quantum design of Cacioppo et al. [14 ] and differs from it in three respects. First, we train the circuit toward the posterior mean of each step instead of a single draw of the previous state, which removes the variance of the target without changing the optimal denoiser (Theorem 1 ), and we keep the post-selected branch during training and sampling, whose acceptance probability we report (§ 5.1 ). Second, family-specific first blocks condition the circuit on the malware family instead of additional label qubits, and a sign-split codec separates the families in the Hilbert space (§ 3.3 ). Third, we evaluate the generated records with the utility and privacy measures of synthetic security data, against a parameter-matched classical control and the bounds that the encoding sets on any generator, and under hardware noise. Quantum machine learning has also entered security applications, for instance with hybrid and fully quantum networks that classify images of Android applications [42 ] and with a hybrid quantum-classical Wasserstein GAN that detects fraudulent credit card transactions as anomalies [43 ] ; to the best of our knowledge, however, no previous study has applied a quantum diffusion model to security records.
training downstream classifiers, while staying away from the individual training records.
Methodology
In this section, we introduce the quantum latent diffusion model that we employ to generate synthetic security records. Figure 1 illustrates the complete pipeline. A pre-trained encoder maps every record onto a latent vector, which we store in the amplitudes of a quantum state. We corrupt the encoded states with a classical forward diffusion process and train a parameterized quantum circuit to reverse this process one step at a time with an infidelity objective. To generate a record, the trained circuit denoises a random quantum state, and a classical decoder maps the final state back to the latent space. The denoiser is the only quantum component of the pipeline, and it contains no classical neural layer between its noisy input state and its denoised output state. We formulate the problem and describe the latent representation in § 3.1 , state the threat model in § 3.2 , and present the amplitude encoding and the forward process in § 3.3 and § 3.4 . § 3.5 to § 3.7 describe the quantum denoiser, its training, and the sampling procedure. § 3.8 to § 3.11 cover the simulation of hardware noise, the parameter-matched classical control, the evaluation measures, and the implementation. Finally, § 3.12 establishes the theoretical properties of the model, whose proofs are given in Appendix § 13 .
Figure 1. Training and sampling pipeline of the quantum latent diffusion model. Training (top): the encoder E E E r r r z ∈ R 32 z \in\mathbb{R}^{32} z ∈ R 32 z z z ∣ x 0 ⟩ \lvert x_0\rangle ∣ x 0 ⟩ n = 5 n = 5 n = 5 (3) ), and the classical forward process q ( x t ∣ x 0 ) q(x_t \mid x_0) q ( x t ∣ x 0 ) ∣ x t ⟩ \lvert x_t\rangle ∣ x t ⟩ t = 1 , … , T t = 1, \ldots, T t = 1 , … , T (9) ). The quantum denoiser Φ θ ( ⋅ ; t , k ) \Phi_\theta(\cdot;t,k) Φ θ ( ⋅ ; t , k ) Figure 2 maps ∣ x t ⟩ \lvert x_t\rangle ∣ x t ⟩ ∣ ψ o u t ⟩ \lvert\psi_{\mathrm{out}}\rangle ∣ ψ out ⟩ L \mathcal{L} L ∣ μ ~ t ⟩ \lvert\tilde{\mu}_t\rangle ∣ μ ~ t ⟩ (12) and (24)). Sampling (bottom): the trained denoiser is applied for t = T , … , 1 t = T,\ldots,1 t = T , … , 1 ∣ z T ⟩ \lvert z_T\rangle ∣ z T ⟩ ∣ z 0 ⟩ \lvert z_0\rangle ∣ z 0 ⟩ R k \mathcal{R}_k R k k k k z ^ \hat{z} z ^ (5) and (30)). Gray boxes are classical computations, the blue box is the quantum circuit, and the orange box is the training objective.
Problem formulation and latent representation
We consider a labeled security dataset D = { ( r j , k j ) } j = 1 N D = \{(r_j, k_j)\}_{j=1}^{N} D = {( r j , k j ) } j = 1 N r j r_j r j k j ∈ { 1 , … , K } k_j \in\{1, \ldots, K\} k j ∈ { 1 , … , K } D D D D t r D_{\mathrm{tr}} D tr D v a D_{\mathrm{va}} D va D t e D_{\mathrm{te}} D te D t r D_{\mathrm{tr}} D tr D t r D_{\mathrm{tr}} D tr
Instead of modeling the raw records, which are long discrete sequences, we model their latent representations. A pre-trained encoder E E E
z j = E ( r j ) ∈ R d . (1) z_j = E(r_j) \in\mathbb{R}^{d}. \tag*{(1)} z j = E ( r j ) ∈ R d . (1) In this representation, d d d E E E d = 32 d = 32 d = 32 D t r D_{\mathrm{tr}} D tr D v a D_{\mathrm{va}} D va D t e D_{\mathrm{te}} D te
Threat model and release scenarios
We consider a data holder, such as an antivirus vendor, a computer emergency response team, or the security operations team of an organization, that holds a labeled corpus of malware programs and intends to share a benchmark derived from it. Such corpora are often confidential, although the malware itself circulates widely. Samples collected during incident response can embed configuration data, credentials, or host names of the affected organization, samples obtained from commercial feeds or under non-disclosure agreements cannot be redistributed, and the presence of a sample in the corpus of an organization can reveal that the organization was attacked. In our experiments, the programs come from the public repository VirusShare, which allows other researchers to reproduce the study, and we treat D t r \mathcal{D}_{\mathrm{tr}} D tr
The assets to protect are the training records and their membership in D t r \mathcal{D}_{\mathrm{tr}} D tr data-only release , the holder publishes synthetic latent vectors with their class labels, and recipients train or augment classifiers in the latent space; to map their own programs into this space, the recipients need the encoder E E E (1) , which must then be a public component, for instance an encoder trained on public programs. In the release with decoder , the holder also publishes the codec of Section 3.3, that is, the scaling parameters and the length statistics of the decoder, together with the CAE. These artifacts are themselves derived from D t r \mathcal{D}_{\mathrm{tr}} D tr (4) ).
The adversary knows the generative procedure, including the codec and the decoding rule with its parameters, receives the released records, and holds candidate programs whose latent vectors and lengths it can compute. Its goal is either to recover training records from the release or to decide whether a candidate program belongs to D t r \mathcal{D}_{\mathrm{tr}} D tr § 3.10 ). We do not consider adversaries that poison the training data or query the generator adaptively, and we do not evaluate the privacy of the CAE and of the codec parameters that the release with decoder exposes, which § 6.2 discusses.
Amplitude encoding of latent vectors
Amplitude encoding stores a normalized classical vector in the amplitudes of a quantum state, so that a register of n n n 2 n 2^n 2 n [44 ] . Since the latent dimension d = 32 d = 32 d = 32 n = log 2 d = 5 n = \log_2 d = 5 n = log 2 d = 5 § 3.7 recovers the magnitudes of the amplitudes only. We therefore first map every latent vector onto a non-negative vector with a min–max scaling fitted on the training set:
u i ( z ) = max ( 0 , z i − l i h i − l i ) , i = 1 , … , d . (2) u_i(z) = \max\left(0,\frac{z_i-l_i}{h_i-l_i}\right), \qquad i = 1,\ldots,d. \tag*{(2)} u i ( z ) = max ( 0 , h i − l i z i − l i ) , i = 1 , … , d . (2) In this scaling, z i z_i z i i i i l i l_i l i h i h_i h i i i i u ( z ) u(z) u ( z )
∣ ψ ( z ) ⟩ = ∑ i = 0 D − 1 a i ( z ) ∣ i ⟩ , a ( z ) = u ( z ) ∥ u ( z ) ∥ 2 , D = 2 n . (3) \lvert\psi(z)\rangle= \sum_{i=0}^{D-1} a_i(z)\lvert i\rangle,\qquad a(z)=\frac{u(z)}{\lVert u(z)\rVert_2},\qquad D=2^n. \tag*{(3)} ∣ ψ ( z )⟩ = i = 0 ∑ D − 1 a i ( z ) ∣ i ⟩ , a ( z ) = ∥ u ( z ) ∥ 2 u ( z ) , D = 2 n . (3) In this state, ∣ i ⟩ \lvert i\rangle ∣ i ⟩ i i i n n n a i ( z ) ≥ 0 a_i(z) \ge0 a i ( z ) ≥ 0 D D D n n n [45 , 46 ] , which remains affordable for the five-qubit register of this study.
The normalization in Eq. (3) removes the length ρ ( z ) = ∥ u ( z ) ∥ 2 \rho(z)=\lVert u(z)\rVert_2 ρ ( z ) = ∥ u ( z ) ∥ 2 k k k
R k = { ρ ( z j ) : ( z j , k j ) ∈ D t r , k j = k } . (4) \mathcal{R}_k = \left\{\rho(z_j) : (z_j,k_j)\in\mathcal{D}_{\mathrm{tr}},\ k_j=k\right\}. \tag*{(4)} R k = { ρ ( z j ) : ( z j , k j ) ∈ D tr , k j = k } . (4) The decoder uses these lengths of the scaled training vectors of class k k k ∣ α ^ ∣ ∈ R ≥ 0 D \lvert\hat{\alpha}\rvert\in\mathbb{R}_{\ge0}^{D} ∣ α ^ ∣ ∈ R ≥ 0 D k k k
z ^ = l + ( h − l ) ⊙ ( ρ ∣ α ^ ∣ ) , ρ = ρ j e ξ ζ , \hat{z}=l+(h-l)\odot(\rho\lvert\hat{\alpha}\rvert),\qquad\rho=\rho_j e^{\xi\zeta}, z ^ = l + ( h − l ) ⊙ ( ρ ∣ α ^ ∣) , ρ = ρ j e ξ ζ , ρ j ∼ U ( R k ) , ζ ∼ N ( 0 , 1 ) . (5) \rho_j\sim\mathcal{U}(\mathcal{R}_k),\qquad\zeta\sim\mathcal{N}(0,1). \tag*{(5)} ρ j ∼ U ( R k ) , ζ ∼ N ( 0 , 1 ) . (5) In this decoder, ⊙ \odot ⊙ ρ j \rho_j ρ j k k k ζ \zeta ζ ρ j \rho_j ρ j log ρ = log ρ j + τ k ζ \log\rho= \log\rho_j + \tau_k \zeta log ρ = log ρ j + τ k ζ [47 ] from the logarithms of the training lengths of class k k k τ k \tau_k τ k [48 ] ,
τ k = 0.9 min ( s k , IQR k 1.34 ) ∣ R k ∣ − 1 / 5 . (6) \tau_k = 0.9 \min\left(s_k, \frac{\operatorname{IQR}_k}{1.34}\right) \lvert\mathcal{R}_k \rvert^{-1/5}. \tag*{(6)} τ k = 0.9 min ( s k , 1.34 IQR k ) ∣ R k ∣ − 1/5 . (6) Here, s k s_k s k IQR k \operatorname{IQR}_k IQR k { log r : r ∈ R k } \{\log r : r \in\mathcal{R}_k\} { log r : r ∈ R k } ∣ R k ∣ \lvert\mathcal{R}_k \rvert ∣ R k ∣ k k k τ k \tau_k τ k e τ k ζ e^{\tau_k\zeta} e τ k ζ ∣ ζ ∣ ≤ 1 \lvert\zeta\rvert\le1 ∣ ζ ∣ ≤ 1
We draw a random length instead of a fixed one, such as the median length of the class, because identical lengths would allow a classifier trained on synthetic data to use the length as a class label, and this shortcut does not transfer to real data. We perturb the drawn training length as well, because with τ k = 0 \tau_k = 0 τ k = 0 § 3.12 formalizes both properties.
The smoothed bootstrap protects the lengths empirically. For a formal guarantee, we also evaluate a decoder whose length distribution satisfies ϵ \epsilon ϵ [49 ] . For every class k k k B B B [ 0 , D ] [0,\sqrt{D}] [ 0 , D ]
c ~ k , b = max ( 0 , c k , b + η k , b ) , b = 1 , … , B , \widetilde{c}_{k,b} = \max(0,c_{k,b}+\eta_{k,b}), \qquad b=1,\ldots,B, c k , b = max ( 0 , c k , b + η k , b ) , b = 1 , … , B , η k , b ∼ Laplace ( 1 / ϵ ) . (7) \eta_{k,b} \sim\operatorname{Laplace}(1/\epsilon). \tag*{(7)} η k , b ∼ Laplace ( 1/ ϵ ) . (7) Here, c k , b c_{k,b} c k , b k k k b b b ϵ \epsilon ϵ c ~ k , b / ∑ b ′ c ~ k , b ′ \widetilde{c}_{k,b}/\sum_{b'}\widetilde{c}_{k,b'} c k , b / ∑ b ′ c k , b ′ ϵ \epsilon ϵ ϵ \epsilon ϵ [49 ] .
With the min–max codec, the encoded states of different classes are nearly parallel, since all their amplitudes are non-negative and most features lie in the middle of their range. We therefore also evaluate a sign-split codec, which standardizes every feature and separates its positive and negative parts:
s = z − μ σ , u ( z ) = [ max ( 0 , s ) ; max ( 0 , − s ) ] ∈ R ≥ 0 2 d . (8) s = \frac{z-\mu}{\sigma}, \qquad u(z) = [\max(0,s)\,;\,\max(0,-s)] \in\mathbb{R}_{\ge0}^{2d}. \tag*{(8)} s = σ z − μ , u ( z ) = [ max ( 0 , s ) ; max ( 0 , − s )] ∈ R ≥ 0 2 d . (8) The feature-wise mean μ \mu μ σ \sigma σ [ ⋅ ; ⋅ ] [\,\cdot\,;\,\cdot\,] [ ⋅ ; ⋅ ] 2 d = 64 2d=64 2 d = 64 n = 6 n=6 n = 6 z ^ = μ + σ ⊙ ρ ( ∣ a ^ 1 : d ∣ − ∣ a ^ d + 1 : 2 d ∣ ) \hat{z}=\mu+\sigma\odot\rho(\lvert\hat{a}_{1:d}\rvert-\lvert\hat{a}_{d+1:2d}\rvert) z ^ = μ + σ ⊙ ρ (∣ a ^ 1 : d ∣ − ∣ a ^ d + 1 : 2 d ∣) ρ \rho ρ (5) , with the training lengths of Eq. (4) and the bandwidth of Eq. (6) computed from the sign-split vectors.
Every codec limits the quality that a generator operating on encoded states can reach. We define the round trip rt ( z ) = Dec ( Enc ( z ) ) \operatorname{rt}(z)=\operatorname{Dec}(\operatorname{Enc}(z)) rt ( z ) = Dec ( Enc ( z )) (3) and decodes it with Eq. (5) , and we evaluate the classification measures of § 3.10 (Aug, TSTR, and TRTS) on round trips of real records, averaged over eight draws of the decoded lengths. In other words, the round trip yields the score of a perfect generator under each codec, and we report this ceiling next to every result.
Forward diffusion process
Diffusion models learn to reverse a Markov chain that gradually corrupts the data with Gaussian noise [1 , 30 ] . Following Cacioppo et al. [14 ] , we run the forward chain on classical vectors and employ complex Gaussian noise, since the states produced by the quantum denoiser have complex amplitudes. Let x 0 = a ( z ) ∈ R D x_0=a(z)\in\mathbb{R}^{D} x 0 = a ( z ) ∈ R D { β t } t = 1 T \{\beta_t\}_{t=1}^{T} { β t } t = 1 T t t t
x t = α ˉ t x 0 + 1 − α ˉ t ϵ , x_t=\sqrt{\bar{\alpha}_t}\,x_0+\sqrt{1-\bar{\alpha}_t}\,\epsilon, x t = α ˉ t x 0 + 1 − α ˉ t ϵ , ϵ = ϵ r + i ϵ i , ϵ r , ϵ i ∼ N ( 0 , I D ) . (9) \epsilon=\epsilon_r+i\epsilon_i,\qquad\epsilon_r,\epsilon_i\sim\mathcal{N}(0,I_D). \tag*{(9)} ϵ = ϵ r + i ϵ i , ϵ r , ϵ i ∼ N ( 0 , I D ) . (9) In this process, α t = 1 − β t \alpha_t=1-\beta_t α t = 1 − β t α ˉ t = ∏ s = 1 t α s \bar{\alpha}_t=\prod_{s=1}^{t}\alpha_s α ˉ t = ∏ s = 1 t α s t t t α ˉ 1 = 1 \bar{\alpha}_1=1 α ˉ 1 = 1 ϵ ∼ C N ( 0 , 2 I D ) \epsilon\sim\mathcal{CN}(0,2I_D) ϵ ∼ C N ( 0 , 2 I D ) ∣ x t ⟩ = x t / ∥ x t ∥ 2 \lvert x_t\rangle=x_t/\lVert x_t\rVert_2 ∣ x t ⟩ = x t / ∥ x t ∥ 2
β t = β min + t − 1 T ( β max − β min ) , t = 1 , … , T . (10) \beta_t=\beta_{\min}+\frac{t-1}{T}\left(\beta_{\max}-\beta_{\min}\right),\qquad t=1,\ldots,T. \tag*{(10)} β t = β m i n + T t − 1 ( β m a x − β m i n ) , t = 1 , … , T . (10) Here, β min \beta_{\min} β m i n β max \beta_{\max} β m a x T T T
The appropriate variances depend on the dimension D D D x 0 x_0 x 0 E ∥ ϵ ∥ 2 2 = 2 D \mathbb{E}\lVert\epsilon\rVert_2^2=2D E ∥ ϵ ∥ 2 2 = 2 D (9) is approximately
κ t = 2 D ( 1 − α ˉ t ) α ˉ t . (11) \kappa_t=\sqrt{\frac{2D(1-\bar{\alpha}_t)}{\bar{\alpha}_t}}. \tag*{(11)} κ t = α ˉ t 2 D ( 1 − α ˉ t ) . (11) Because this noise-to-signal ratio grows with D \sqrt{D} D D = 32 D=32 D = 32 D = 256 D=256 D = 256 16 × 16 16\times16 16 × 16 [14 ] , and we therefore employ larger variances. With β min = 0.02 \beta_{\min}=0.02 β m i n = 0.02 β max = 0.10 \beta_{\max}=0.10 β m a x = 0.10 T = 10 T=10 T = 10 β 1 = 0.020 \beta_1=0.020 β 1 = 0.020 β 10 = 0.092 \beta_{10}=0.092 β 10 = 0.092 α ˉ 10 = 0.56 \bar{\alpha}_{10}=0.56 α ˉ 10 = 0.56 κ 1 = 1.1 \kappa_1=1.1 κ 1 = 1.1 κ 10 = 7.1 \kappa_{10}=7.1 κ 10 = 7.1
For the training target, we employ the mean of the posterior of the forward process [1 ] ,
μ ~ t ( x t , x 0 ) = α ˉ t − 1 β t 1 − α ˉ t x 0 + α t ( 1 − α ˉ t − 1 ) 1 − α ˉ t x t , \widetilde{\mu}_t(x_t,x_0)=\frac{\sqrt{\bar{\alpha}_{t-1}}\beta_t}{1-\bar{\alpha}_t}x_0+\frac{\sqrt{\alpha_t}(1-\bar{\alpha}_{t-1})}{1-\bar{\alpha}_t}x_t, μ t ( x t , x 0 ) = 1 − α ˉ t α ˉ t − 1 β t x 0 + 1 − α ˉ t α t ( 1 − α ˉ t − 1 ) x t , ∣ μ ~ t ∣ = μ ~ t ∥ μ ~ t ∥ 2 . (12) \lvert\widetilde{\mu}_t\rvert=\frac{\widetilde{\mu}_t}{\lVert\widetilde{\mu}_t\rVert_2}. \tag*{(12)} ∣ μ t ∣ = ∥ μ t ∥ 2 μ t . (12) In this target, μ ~ t \widetilde{\mu}_t μ t x t − 1 x_{t-1} x t − 1 x t x_t x t x 0 x_0 x 0 x t x_t x t (9) .
At t = 1 t = 1 t = 1 ∣ x 0 ⟩ \lvert x_0\rangle ∣ x 0 ⟩ α ˉ 0 = 1 \bar{\alpha}_0 = 1 α ˉ 0 = 1 1 − α ˉ 1 = β 1 1 - \bar{\alpha}_1 = \beta_1 1 − α ˉ 1 = β 1 [12 ] instead targets a single draw of x t − 1 x_{t-1} x t − 1 Theorem 1 in § 3.12 establishes that both targets lead to the same optimal output.
Quantum denoiser
A parameterized quantum circuit (PQC) applies a sequence of gates, some of which depend on trainable parameters, to a quantum state, and it is commonly regarded as the quantum counterpart of a neural network [7 ] . Following the reverse-bottleneck architecture of Cacioppo et al. [14 ] , we implement the denoiser of step t t t k k k Φ θ ( ⋅ ; t , k ) \Phi_\theta(\cdot;t,k) Φ θ ( ⋅ ; t , k ) n n n Figure 2 ). The denoiser maps the state ∣ x t ⟩ \lvert x_t\rangle ∣ x t ⟩ ∣ μ ~ t ⟩ \lvert\tilde{\mu}_t\rangle ∣ μ ~ t ⟩
Figure 2. Quantum denoiser of one reverse step, after the reverse-bottleneck architecture of Cacioppo et al. [14 ] . (a) For step t t t k k k U 1 ( k , t ) U_{1}^{(k,t)} U 1 ( k , t ) n = 5 n=5 n = 5 ∣ x t ⟩ \lvert x_t\rangle ∣ x t ⟩ U 2 ( t ) U_{2}^{(t)} U 2 ( t ) ∣ 0 ⟩ a \lvert0\rangle_a ∣ 0 ⟩ a b ∈ { 0 , 1 } b \in\{0,1\} b ∈ { 0 , 1 } U 3 ( t ) U_{3}^{(t)} U 3 ( t ) ∣ ψ o u t ( b ) ⟩ \lvert\psi_{\mathrm{out}}^{(b)}\rangle ∣ ψ out ( b ) ⟩ (16) and (17) ). With post-selection, the denoiser keeps b = 0 b=0 b = 0 (18) ); without branch selection, it outputs the mixture of Eq. (19) . The angles θ 1 [ k , t ] \theta_1[k,t] θ 1 [ k , t ] θ 2 [ t ] \theta_2[t] θ 2 [ t ] θ 3 [ t ] \theta_3[t] θ 3 [ t ] L 1 = L 2 = L 3 = 4 L_1=L_2=L_3=4 L 1 = L 2 = L 3 = 4 (15) ), drawn for m = 5 m=5 m = 5 q 0 , … , q 4 q_0,\ldots,q_4 q 0 , … , q 4 R 3 = R Z ( ω ) R Y ( ϑ ) R Z ( φ ) R_3=R_Z(\omega)R_Y(\vartheta)R_Z(\varphi) R 3 = R Z ( ω ) R Y ( ϑ ) R Z ( φ ) E 2 j = C E_{2j}=C E 2 j = C E 2 j + 1 = C † E_{2j+1}=C^\dagger E 2 j + 1 = C † L / 2 L/2 L /2 U 2 ( t ) U_2^{(t)} U 2 ( t ) m = 6 m=6 m = 6 q 0 q_0 q 0
Strongly entangling block Each unitary block of the denoiser is a strongly entangling circuit (SEC) [50 ] on m m m L L L
R 3 ( ω , ϑ , φ ) = R Z ( ω ) R Y ( ϑ ) R Z ( φ ) = ( e − i ( φ + ω ) / 2 cos ϑ 2 e i ( φ − ω ) / 2 sin ϑ 2 − e − i ( φ − ω ) / 2 sin ϑ 2 e i ( φ + ω ) / 2 cos ϑ 2 ) . (13) R_3(\omega,\vartheta,\varphi) = R_Z(\omega)R_Y(\vartheta)R_Z(\varphi)
= \begin{pmatrix}
e^{-i(\varphi+\omega)/2}\cos\frac{\vartheta}{2} & e^{i(\varphi-\omega)/2}\sin\frac{\vartheta}{2} \\
-e^{-i(\varphi-\omega)/2}\sin\frac{\vartheta}{2} & e^{i(\varphi+\omega)/2}\cos\frac{\vartheta}{2}
\end{pmatrix}. \tag*{(13)} R 3 ( ω , ϑ , φ ) = R Z ( ω ) R Y ( ϑ ) R Z ( φ ) = ( e − i ( φ + ω ) /2 cos 2 ϑ − e − i ( φ − ω ) /2 sin 2 ϑ e i ( φ − ω ) /2 sin 2 ϑ e i ( φ + ω ) /2 cos 2 ϑ ) . (13) The three angles ω \omega ω ϑ \vartheta ϑ φ \varphi φ R Y R_Y R Y R Z R_Z R Z y y y z z z
C = CNOT 0 , 1 CNOT 1 , 2 ⋯ CNOT m − 2 , m − 1 . (14) C = \operatorname{CNOT}_{0,1}\operatorname{CNOT}_{1,2}\cdots\operatorname{CNOT}_{m-2,m-1}. \tag*{(14)} C = CNOT 0 , 1 CNOT 1 , 2 ⋯ CNOT m − 2 , m − 1 . (14) Each gate CNOT q , q + 1 \operatorname{CNOT}_{q,q+1} CNOT q , q + 1 q q q q + 1 q+1 q + 1 Θ l \Theta_l Θ l l l l
U ( Θ ) = E L − 1 R ( Θ L − 1 ) ⋯ E 1 R ( Θ 1 ) E 0 R ( Θ 0 ) , R ( Θ l ) = ⨂ q = 0 m − 1 R 3 ( ω l , q , ϑ l , q , φ l , q ) , E l = { C , l even , C † , l odd . (15) \begin{aligned}
U(\Theta) &= E_{L-1}R(\Theta_{L-1})\cdots E_1R(\Theta_1)E_0R(\Theta_0),\\
R(\Theta_l) &= \bigotimes_{q=0}^{m-1}R_3(\omega_{l,q},\vartheta_{l,q},\varphi_{l,q}),\\
E_l &=
\begin{cases}
C, & l\ \text{even},\\
C^\dagger, & l\ \text{odd}.
\end{cases} \tag*{(15)}
\end{aligned} U ( Θ ) R ( Θ l ) E l = E L − 1 R ( Θ L − 1 ) ⋯ E 1 R ( Θ 1 ) E 0 R ( Θ 0 ) , = q = 0 ⨂ m − 1 R 3 ( ω l , q , ϑ l , q , φ l , q ) , = { C , C † , l even , l odd . (15) The block thus alternates the rotations of every layer l l l E l E_l E l [12 ] , we alternate the chain C C C C † C^\dagger C † R 3 ( 0 , 0 , 0 ) = I R_3(0,0,0)=I R 3 ( 0 , 0 , 0 ) = I C † C = I C^\dagger C=I C † C = I N ( 0 , 0.1 2 ) \mathcal{N}(0,0.1^2) N ( 0 , 0. 1 2 ) 0.7 0.7 0.7 Proposition 1 ). This initialization suits the task, since each reverse step maps a state onto a nearby state.
Reverse-bottleneck denoiser The denoiser composes three SEC blocks. The first block U 1 ( k , t ) U_1^{(k,t)} U 1 ( k , t ) U 2 ( t ) U_2^{(t)} U 2 ( t ) ∣ 0 ⟩ a \lvert0\rangle_a ∣ 0 ⟩ a U 3 ( t ) U_3^{(t)} U 3 ( t )
∣ Ψ t ⟩ = U 2 ( t ) ( ∣ 0 ⟩ a ⊗ U 1 ( k , t ) ∣ x t ⟩ ) = p 0 ∣ 0 ⟩ a ⊗ ∣ ϕ 0 ⟩ + p 1 ∣ 1 ⟩ a ⊗ ∣ ϕ 1 ⟩ . (16) \lvert\Psi_t\rangle= U_2^{(t)}\left(\lvert0\rangle_a\otimes U_1^{(k,t)}\lvert x_t\rangle\right)
= \sqrt{p_0}\lvert0\rangle_a\otimes\lvert\phi_0\rangle+\sqrt{p_1}\lvert1\rangle_a\otimes\lvert\phi_1\rangle. \tag*{(16)} ∣ Ψ t ⟩ = U 2 ( t ) ( ∣ 0 ⟩ a ⊗ U 1 ( k , t ) ∣ x t ⟩ ) = p 0 ∣ 0 ⟩ a ⊗ ∣ ϕ 0 ⟩ + p 1 ∣ 1 ⟩ a ⊗ ∣ ϕ 1 ⟩ . (16) In this state, p b = ∥ ( ⟨ b ∣ a ⊗ I ) ∣ Ψ t ⟩ ∥ 2 2 p_b=\left\|\left(\langle b\rvert_a\otimes I\right)\lvert\Psi_t\rangle\right\|_2^2 p b = ∥ ( ⟨ b ∣ a ⊗ I ) ∣ Ψ t ⟩ ∥ 2 2 ∣ b ⟩ \lvert b\rangle ∣ b ⟩ b ∈ { 0 , 1 } b\in\{0,1\} b ∈ { 0 , 1 } ∣ ϕ b ⟩ = ( ⟨ b ∣ a ⊗ I ) ∣ Ψ t ⟩ / p b \lvert\phi_b\rangle=\left(\langle b\rvert_a\otimes I\right)\lvert\Psi_t\rangle/\sqrt{p_b} ∣ ϕ b ⟩ = ( ⟨ b ∣ a ⊗ I ) ∣ Ψ t ⟩ / p b
∣ ψ o u t ( b ) ⟩ = U 3 ( t ) ∣ ϕ b ⟩ , b ∈ { 0 , 1 } . (17) \lvert\psi_{\mathrm{out}}^{(b)}\rangle=U_3^{(t)}\lvert\phi_b\rangle,\qquad b\in\{0,1\}. \tag*{(17)} ∣ ψ out ( b ) ⟩ = U 3 ( t ) ∣ ϕ b ⟩ , b ∈ { 0 , 1 } . (17) We consider two ways of handling the ancilla. With post-selection, also called branch selection, the denoiser keeps the outcome b = 0 b=0 b = 0 [12 ] :
Φ θ ( ∣ x t ⟩ ; t , k ) = ∣ ψ o u t ( 0 ) ⟩ = U 3 ( t ) ( ∣ 0 ⟩ a ⊗ I ) U 2 ( t ) ( ∣ 0 ⟩ a ⊗ U 1 ( k , t ) ∣ x t ⟩ ) p 0 . (18) \Phi_\theta(\lvert x_t\rangle;t,k)=\lvert\psi_{\mathrm{out}}^{(0)}\rangle
=\frac{U_3^{(t)}\left(\lvert0\rangle_a\otimes I\right)U_2^{(t)}\left(\lvert0\rangle_a\otimes U_1^{(k,t)}\lvert x_t\rangle\right)}{\sqrt{p_0}}. \tag*{(18)} Φ θ (∣ x t ⟩ ; t , k ) = ∣ ψ out ( 0 ) ⟩ = p 0 U 3 ( t ) ( ∣ 0 ⟩ a ⊗ I ) U 2 ( t ) ( ∣ 0 ⟩ a ⊗ U 1 ( k , t ) ∣ x t ⟩ ) . (18) In this map, the division by p 0 \sqrt{p_0} p 0 ∣ x t ⟩ \lvert x_t\rangle ∣ x t ⟩ [14 ] . Without branch selection, the denoiser outputs the mixture
ρ o u t = ∑ b ∈ { 0 , 1 } p b ∣ ψ o u t ( b ) ⟩ ⟨ ψ o u t ( b ) ∣ . (19) \rho_{\mathrm{out}}=\sum_{b\in\{0,1\}}p_b\lvert\psi_{\mathrm{out}}^{(b)}\rangle\langle\psi_{\mathrm{out}}^{(b)}\rvert. \tag*{(19)} ρ out = b ∈ { 0 , 1 } ∑ p b ∣ ψ out ( b ) ⟩ ⟨ ψ out ( b ) ∣ . (19) This mixture is the density matrix of the data register after the ancilla is traced out. The variant without branch selection is therefore a quantum channel, which acts linearly on the input density matrix and avoids the cost of post-selection on hardware discussed in § 3.7 . By default, the public implementation additionally applies a complex leaky rectified linear unit to the amplitudes between the measurement and U 3 ( t ) U_3^{(t)} U 3 ( t )
Conditioning on the step and the class The denoiser contains no classical layer, so we condition it through the choice of its angles. Following the public implementation of Cacioppo et al. [12 ] , every step t t t [14 ] report that a single set of angles shared by all steps reduces the performance only slightly. For the class, we give every class k k k
θ = { θ 1 [ k , t ] , θ 2 [ t ] , θ 3 [ t ] : k = 1 , … , K , t = 1 , … , T } . (20) \theta=\left\{\theta_1[k,t],\theta_2[t],\theta_3[t]\ :\ k=1,\ldots,K,\ t=1,\ldots,T\right\}. \tag*{(20)} θ = { θ 1 [ k , t ] , θ 2 [ t ] , θ 3 [ t ] : k = 1 , … , K , t = 1 , … , T } . (20) In this parameterization, θ 1 [ k , t ] \theta_1[k,t] θ 1 [ k , t ] θ 2 [ t ] \theta_2[t] θ 2 [ t ] θ 3 [ t ] \theta_3[t] θ 3 [ t ] U 1 ( k , t ) U_1^{(k,t)} U 1 ( k , t ) U 2 ( t ) U_2^{(t)} U 2 ( t ) U 3 ( t ) U_3^{(t)} U 3 ( t ) [14 ] condition their model on the class with additional label qubits, using the input ∣ k ⟩ ⊗ ∣ x t ⟩ \lvert k\rangle\otimes\lvert x_t\rangle ∣ k ⟩ ⊗ ∣ x t ⟩ n + 1 n+1 n + 1
P = 3 T ( K n L 1 + ( n + 1 ) L 2 + n L 3 ) . (21) P = 3T\left(KnL_1+(n+1)L_2+nL_3\right). \tag*{(21)} P = 3 T ( K n L 1 + ( n + 1 ) L 2 + n L 3 ) . (21) In this count, L 1 L_1 L 1 L 2 L_2 L 2 L 3 L_3 L 3 n = 5 n=5 n = 5 K = 17 K=17 K = 17 T = 10 T=10 T = 10 L 1 = L 2 = L 3 = 4 L_1=L_2=L_3=4 L 1 = L 2 = L 3 = 4 P = 11,520 P=11{,}520 P = 11 , 520 Table 2 ).
Table 2. Trainable angles of the quantum denoiser with n = 5 n=5 n = 5 K = 17 K=17 K = 17 T = 10 T=10 T = 10 L 1 = L 2 = L 3 = 4 L_1=L_2=L_3=4 L 1 = L 2 = L 3 = 4 n = 6 n=6 n = 6
Training objective
We train the denoiser to map every noisy state onto the corresponding target state. Since both are quantum states, we employ the infidelity loss of Cacioppo et al. [14 ] , which can be estimated on quantum hardware with a swap test [51 , 52 ] . For the post-selected denoiser, the loss of a single sample is
ℓ p s ( θ ; x 0 , k , t , ϵ ) = 1 − ∣ ⟨ μ ~ t ∣ ψ o u t ( 0 ) ⟩ ∣ 2 , (22) \ell_{\mathrm{ps}}(\theta;x_0,k,t,\epsilon)=1-\left|\langle\tilde{\mu}_t|\psi_{\mathrm{out}}^{(0)}\rangle\right|^2, \tag*{(22)} ℓ ps ( θ ; x 0 , k , t , ϵ ) = 1 − ⟨ μ ~ t ∣ ψ out ( 0 ) ⟩ 2 , (22) and for the denoiser without branch selection,
ℓ t r ( θ ; x 0 , k , t , ϵ ) = 1 − ∑ b ∈ { 0 , 1 } p b ∣ ⟨ μ ~ t ∣ ψ o u t ( b ) ⟩ ∣ 2 . (23) \ell_{\mathrm{tr}}(\theta;x_0,k,t,\epsilon)=1-\sum_{b\in\{0,1\}}p_b\left|\langle\tilde{\mu}_t|\psi_{\mathrm{out}}^{(b)}\rangle\right|^2. \tag*{(23)} ℓ tr ( θ ; x 0 , k , t , ϵ ) = 1 − b ∈ { 0 , 1 } ∑ p b ⟨ μ ~ t ∣ ψ out ( b ) ⟩ 2 . (23) In these losses, ∣ ⟨ μ ~ t ∣ ψ ⟩ ∣ 2 \lvert\langle\tilde{\mu}_t|\psi\rangle\rvert^2 ∣⟨ μ ~ t ∣ ψ ⟩ ∣ 2 (23) stems from the linearity of the fidelity with a pure state in the density matrix. The training objective averages the loss over the training records, the diffusion steps, and the noise:
L ( θ ) = E ( z , k ) ∼ D t r [ 1 T ∑ t = 1 T E ϵ ∼ N ( 0 , 2 I D ) [ ℓ ( θ ; a ( z , k , t , ϵ ) ) ] ] . (24) \mathcal{L}(\theta)=\mathbb{E}_{(z,k)\sim\mathcal{D}_{\mathrm{tr}}}\left[\frac{1}{T}\sum_{t=1}^{T}\mathbb{E}_{\epsilon\sim\mathcal{N}(0,2I_D)}\left[\ell\left(\theta;a(z,k,t,\epsilon)\right)\right]\right]. \tag*{(24)} L ( θ ) = E ( z , k ) ∼ D tr [ T 1 t = 1 ∑ T E ϵ ∼ N ( 0 , 2 I D ) [ ℓ ( θ ; a ( z , k , t , ϵ ) ) ] ] . (24) In this objective, ℓ \ell ℓ ℓ p s \ell_{\mathrm{ps}} ℓ ps ℓ t r \ell_{\mathrm{tr}} ℓ tr t = 1 , … , T t=1,\ldots,T t = 1 , … , T [1 ] .
We minimize Eq. (24) with the Adam optimizer [53 ] in exact state-vector simulation, since the estimation of gradients on current noisy hardware remains impractical [12 ] . Lemma A.1 in Appendix A bounds the smoothness of the objective and the convergence rate of this procedure. The parameter-shift rule [54 , 55 ] would allow the same gradients to be estimated on a quantum device. We select the model with an early-stopping rule on the validation set. Every five epochs, we evaluate the loss on all validation records at all steps with a fixed noise realization, and we stop the training when the validation loss has not improved by at least 0.1% during eight consecutive evaluations. As a reference, we also compute the loss of the identity map, which returns its input unchanged:
L i d = E [ 1 − ∣ ⟨ μ ~ t ∣ x t ⟩ ∣ 2 ] . (25) \mathcal{L}_{\mathrm{id}}=\mathbb{E}\left[1-\left|\langle\tilde{\mu}_t|x_t\rangle\right|^2\right]. \tag*{(25)} L id = E [ 1 − ∣ ⟨ μ ~ t ∣ x t ⟩ ∣ 2 ] . (25) Algorithm 1 Training of the quantum denoiser
Input: encoded training set { ( x 0 ( j ) , k j ) } \{(x_0^{(j)}, k_j)\} {( x 0 ( j ) , k j )} { β t } t = 1 T \{\beta_t\}_{t=1}^{T} { β t } t = 1 T θ ∼ N ( 0 , 0.1 2 ) \theta\sim\mathcal{N}(0, 0.1^2) θ ∼ N ( 0 , 0. 1 2 )
repeat
Draw a mini-batch B \mathcal{B} B
for all ( x 0 , k ) ∈ B (x_0, k) \in\mathcal{B} ( x 0 , k ) ∈ B t = 1 , … , T t = 1,\ldots,T t = 1 , … , T do
ϵ ← ϵ r + i ϵ i \epsilon\leftarrow\epsilon_r + i\epsilon_i ϵ ← ϵ r + i ϵ i ϵ r , ϵ i ∼ N ( 0 , I D ) \epsilon_r,\epsilon_i \sim\mathcal{N}(0,I_D) ϵ r , ϵ i ∼ N ( 0 , I D )
x t ← α ˉ t x 0 + 1 − α ˉ t ϵ x_t \leftarrow\sqrt{\bar{\alpha}_t}x_0 + \sqrt{1-\bar{\alpha}_t}\epsilon x t ← α ˉ t x 0 + 1 − α ˉ t ϵ ∣ x t ⟩ ← x t / ∥ x t ∥ 2 |x_t\rangle\leftarrow x_t/\|x_t\|_2 ∣ x t ⟩ ← x t /∥ x t ∥ 2
∣ μ ~ t ⟩ ← |\tilde{\mu}_t\rangle\leftarrow ∣ μ ~ t ⟩ ← (12)
Evaluate Φ θ ( ∣ x t ⟩ ; t , k ) \Phi_\theta(|x_t\rangle;t,k) Φ θ ( ∣ x t ⟩ ; t , k ) (22) or Eq. (23)
end for
Update θ \theta θ B \mathcal{B} B
Every five epochs, evaluate the validation loss and keep the best angles
until the validation loss stops improving
Output: trained angles θ \theta θ
The identity map approximates our denoiser at initialization. A trained denoiser therefore contributes to the generation only when its validation loss falls below L i d \mathcal{L}_{\mathrm{id}} L id
Post-selected sampling on hardware pays for every rejected run (§ 3.7 ). To examine whether training can exchange denoising accuracy for a higher acceptance probability, we also train the post-selected denoiser with the penalized objective
L λ ( θ ) = L ( θ ) + λ E ( z , k ) ∼ D t r [ 1 T ∑ t = 1 T E ϵ [ − log p 0 ( θ ; a ( z ) , k , t , ϵ ) ] ] . (26) \mathcal{L}_{\lambda}(\theta)=\mathcal{L}(\theta)+\lambda\mathbb{E}_{(z,k)\sim\mathcal{D}_{\mathrm{tr}}}\left[\frac{1}{T}\sum_{t=1}^{T}\mathbb{E}_{\epsilon}\left[-\log p_0(\theta;a(z),k,t,\epsilon)\right]\right]. \tag*{(26)} L λ ( θ ) = L ( θ ) + λ E ( z , k ) ∼ D tr [ T 1 t = 1 ∑ T E ϵ [ − log p 0 ( θ ; a ( z ) , k , t , ϵ ) ] ] . (26) The weight λ ≥ 0 \lambda\ge0 λ ≥ 0 p 0 ( θ ; a ( z ) , k , t , ϵ ) p_0(\theta;a(z),k,t,\epsilon) p 0 ( θ ; a ( z ) , k , t , ϵ ) − log p 0 -\log p_0 − log p 0 T T T − log P a c c -\log P_{\mathrm{acc}} − log P acc (29) . With λ > 0 \lambda>0 λ > 0 L λ \mathcal{L}_{\lambda} L λ
Sampling and decoding
To generate a record of class k k k
∣ z T ⟩ = ξ ∥ ξ ∥ 2 , ξ ∼ C N ( 0 , 2 I D ) , |z_T\rangle=\frac{\xi}{\|\xi\|_2},\qquad\xi\sim\mathcal{CN}(0,2I_D), ∣ z T ⟩ = ∥ ξ ∥ 2 ξ , ξ ∼ C N ( 0 , 2 I D ) , ∣ z t − 1 ⟩ = Φ θ ( ∣ z t ⟩ ; t , k ) , t = T , … , 1. (27) |z_{t-1}\rangle=\Phi_\theta(|z_t\rangle;t,k),\qquad t=T,\ldots,1. \tag*{(27)} ∣ z t − 1 ⟩ = Φ θ ( ∣ z t ⟩ ; t , k ) , t = T , … , 1. (27) In this chain, ∣ z T ⟩ |z_T\rangle ∣ z T ⟩ ∣ z 0 ⟩ |z_0\rangle ∣ z 0 ⟩ [1 ] , the chain adds no noise between the steps. With post-selection, the generated state is therefore a deterministic function of ∣ z T ⟩ |z_T\rangle ∣ z T ⟩ b t b_t b t t t t p b t p_{b_t} p b t ∣ ψ o u t ( b t ) ⟩ |\psi_{\mathrm{out}}^{(b_t)}\rangle ∣ ψ out ( b t ) ⟩
Since every step maps its input onto an estimate of a posterior mean, the deterministic chain may contract the samples toward the mean of their class. To test this effect, we also evaluate two samplers of classical diffusion models, adapted to the normalized states of our model. The denoiser returns a direction only, so we restore the expected norms of the unnormalized chain, n t = ( α ˉ t + 2 D ( 1 − α ˉ t ) ) 1 / 2 n_t=(\bar{\alpha}_t+2D(1-\bar{\alpha}_t))^{1/2} n t = ( α ˉ t + 2 D ( 1 − α ˉ t ) ) 1/2 x t x_t x t r t = ( ( c 1 , t + c 2 , t α ˉ t ) 2 + 2 D c 2 , t 2 ( 1 − α ˉ t ) ) 1 / 2 r_t=((c_{1,t}+c_{2,t}\sqrt{\bar{\alpha}_t})^2+2Dc_{2,t}^2(1-\bar{\alpha}_t))^{1/2} r t = (( c 1 , t + c 2 , t α ˉ t ) 2 + 2 D c 2 , t 2 ( 1 − α ˉ t ) ) 1/2 μ ~ t \tilde{\mu}_t μ ~ t (9) and (12) , with c 1 , t c_{1,t} c 1 , t c 2 , t c_{2,t} c 2 , t x 0 x_0 x 0 x t x_t x t (12) . With ∣ ϕ t ⟩ = Φ θ ( ∣ z t ⟩ ; t , k ) |\phi_t\rangle=\Phi_\theta(|z_t\rangle;t,k) ∣ ϕ t ⟩ = Φ θ ( ∣ z t ⟩ ; t , k ) t ≥ 2 t\ge2 t ≥ 2
Ancestral:
∣ z t − 1 ⟩ ∝ r t ∣ ϕ t ⟩ + β ~ t ξ t , |z_{t-1}\rangle\propto r_t|\phi_t\rangle+\sqrt{\tilde{\beta}_t}\,\xi_t, ∣ z t − 1 ⟩ ∝ r t ∣ ϕ t ⟩ + β ~ t ξ t , DDIM:
∣ z t − 1 ⟩ ∝ α ˉ t − 1 x ^ 0 + 1 − α ˉ t − 1 n t ∣ z t ⟩ − α ˉ t x ^ 0 1 − α ˉ t . (28) |z_{t-1}\rangle\propto\sqrt{\bar{\alpha}_{t-1}}\hat{x}_0+\sqrt{1-\bar{\alpha}_{t-1}}\,\frac{n_t|z_t\rangle-\sqrt{\bar{\alpha}_t}\hat{x}_0}{\sqrt{1-\bar{\alpha}_t}}. \tag*{(28)} ∣ z t − 1 ⟩ ∝ α ˉ t − 1 x ^ 0 + 1 − α ˉ t − 1 1 − α ˉ t n t ∣ z t ⟩ − α ˉ t x ^ 0 . (28) Here, β ~ t = ( 1 − α ˉ t − 1 ) β t / ( 1 − α ˉ t ) \tilde{\beta}_t=(1-\bar{\alpha}_{t-1})\beta_t/(1-\bar{\alpha}_t) β ~ t = ( 1 − α ˉ t − 1 ) β t / ( 1 − α ˉ t ) ξ t ∼ C N ( 0 , 2 I D ) \xi_t\sim\mathcal{CN}(0,2I_D) ξ t ∼ C N ( 0 , 2 I D ) x ^ 0 = ( r t ∣ ϕ t ⟩ − c 2 , t n t ∣ z t ⟩ ) / c 1 , t \hat{x}_0=(r_t|\phi_t\rangle-c_{2,t}n_t|z_t\rangle)/c_{1,t} x ^ 0 = ( r t ∣ ϕ t ⟩ − c 2 , t n t ∣ z t ⟩) / c 1 , t ∣ ϕ t ⟩ |\phi_t\rangle ∣ ϕ t ⟩ ∣ z t ⟩ |z_t\rangle ∣ z t ⟩ [1 ] , and the second follows the deterministic sampler of Song et al. [31 ] ; both return the output of the last step unchanged. Adding Gaussian noise to the amplitudes and renormalizing is not a quantum operation, so that the ancestral sampler would require, on hardware, a quantum channel with comparable effect or a measurement and a new preparation of the state after every step; we therefore employ both samplers to test the role of the sampler in simulation.
On hardware, post-selection discards every run in which at least one ancilla returns 1. The probability that a run is accepted and the expected number of runs per accepted sample are
P a c c = ∏ t = 1 T p 0 ( t ) , E [ N r u n s ] = 1 P a c c . (29) P_{\mathrm{acc}}=\prod_{t=1}^{T}p_0^{(t)},\qquad\mathbb{E}[N_{\mathrm{runs}}]=\frac{1}{P_{\mathrm{acc}}}. \tag*{(29)} P acc = t = 1 ∏ T p 0 ( t ) , E [ N runs ] = P acc 1 . (29) In these expressions, p 0 ( t ) p_0^{(t)} p 0 ( t ) t t t P a c c P_{\mathrm{acc}} P acc T T T p 0 ( t ) p_0^{(t)} p 0 ( t ) 1 / E [ P a c c ] 1/\mathbb{E}[P_{\mathrm{acc}}] 1/ E [ P acc ]
Post-selection also changes the distribution of the released records. On hardware, only accepted runs release a record, so that the initial states of the released records follow the Haar distribution weighted by P a c c ( ∣ z T ⟩ ) P_{\mathrm{acc}}(|z_T\rangle) P acc ( ∣ z T ⟩) w i = P a c c ( ∣ z T ( i ) ⟩ ) w_i=P_{\mathrm{acc}}(|z_T^{(i)}\rangle) w i = P acc ( ∣ z T ( i ) ⟩) n s n_s n s E S S = ( ∑ i w i ) 2 / ∑ i w i 2 \mathrm{ESS}=(\sum_i w_i)^2/\sum_i w_i^2 ESS = ( ∑ i w i ) 2 / ∑ i w i 2 n s n_s n s w i / ∑ j w j w_i/\sum_j w_j w i / ∑ j w j
Algorithm 2 Sampling with the quantum denoiser
Input: trained angles θ \theta θ k k k R k \mathcal{R}_k R k τ k \tau_k τ k
ξ ← ξ r + i ξ i \xi\leftarrow\xi_r + i\xi_i ξ ← ξ r + i ξ i ξ r , ξ i ∼ N ( 0 , I D ) \xi_r,\xi_i \sim\mathcal{N}(0,I_D) ξ r , ξ i ∼ N ( 0 , I D ) ∣ z T ⟩ ← ξ / ∥ ξ ∥ 2 \lvert z_T\rangle\leftarrow\xi/\lVert\xi\rVert_2 ∣ z T ⟩ ← ξ / ∥ ξ ∥ 2
for t = T t = T t = T to 1 1 1 do
Apply U 1 ( k , t ) U_1^{(k,t)} U 1 ( k , t ) ∣ 0 ⟩ a \lvert0\rangle_a ∣ 0 ⟩ a U 2 ( t ) U_2^{(t)} U 2 ( t )
Measure the ancilla: keep b t = 0 b_t = 0 b t = 0 b t b_t b t p b t p_{b_t} p b t
∣ z t − 1 ⟩ ← U 3 ( t ) ∣ ϕ b t ⟩ \lvert z_{t-1}\rangle\leftarrow U_3^{(t)}\lvert\phi_{b_t}\rangle ∣ z t − 1 ⟩ ← U 3 ( t ) ∣ ϕ b t ⟩
end for
Read out ∣ α ^ ∣ \lvert\hat{\alpha}\rvert ∣ α ^ ∣ ∣ z 0 ⟩ \lvert z_0\rangle ∣ z 0 ⟩ (30)
Draw ρ j ∼ U ( R k ) \rho_j \sim\mathcal{U}(\mathcal{R}_k) ρ j ∼ U ( R k ) ζ ∼ N ( 0 , 1 ) \zeta\sim\mathcal{N}(0,1) ζ ∼ N ( 0 , 1 ) z ^ ← l + ( h − l ) ⊙ ( ρ j e τ k ζ ∣ α ^ ∣ ) \hat{z} \leftarrow l + (h-l)\odot(\rho_j e^{\tau_k\zeta}\lvert\hat{\alpha}\rvert) z ^ ← l + ( h − l ) ⊙ ( ρ j e τ k ζ ∣ α ^ ∣)
Output: synthetic latent vector z ^ \hat{z} z ^
Finally, we read out the generated state in the computational basis. On hardware, measuring S S S ∣ z 0 ⟩ \lvert z_0\rangle ∣ z 0 ⟩ c i c_i c i
∣ α ^ i ∣ = c i / S , i = 0 , … , D − 1. (30) \lvert\hat{\alpha}_i\rvert= \sqrt{c_i/S}, \qquad i = 0,\ldots,D-1. \tag*{(30)} ∣ α ^ i ∣ = c i / S , i = 0 , … , D − 1. (30) This estimate converges to the exact magnitude ∣ ⟨ i ∣ z 0 ⟩ ∣ \lvert\langle i\lvert z_0\rangle\rvert ∣⟨ i ∣ z 0 ⟩∣ S S S [14 ] , we discard the phases of the amplitudes, since the encoded data are non-negative. The decoder of Eq. (5) then maps ∣ α ^ ∣ \lvert\hat{\alpha}\rvert ∣ α ^ ∣ z ^ ∈ R d \hat{z}\in\mathbb{R}^d z ^ ∈ R d § 13 bounds the number of shots that this read-out requires.
Simulation of hardware noise
Algorithms 1 and 2 operate on exact state vectors. To estimate how the trained denoiser behaves on NISQ devices [9 ] , we additionally sample with density matrices. After every layer of every block, we apply a single-qubit depolarizing channel to each qubit [56 ] ,
E p ( ϱ ) = ( 1 − p ) ϱ + p 3 ( X ϱ X + Y ϱ Y + Z ϱ Z ) . (31) \mathcal{E}_p(\varrho) = (1-p)\varrho+ \frac{p}{3}(X\varrho X + Y\varrho Y + Z\varrho Z). \tag*{(31)} E p ( ϱ ) = ( 1 − p ) ϱ + 3 p ( X ϱX + Y ϱ Y + Z ϱZ ) . (31) Here, p p p X X X Y Y Y Z Z Z ϱ j o i n t \varrho_{\mathrm{joint}} ϱ joint 0 0 0
ϱ ↦ ( ⟨ 0 ∣ a ⊗ I ) ϱ j o i n t ( ∣ 0 ⟩ a ⊗ I ) Tr [ ( ⟨ 0 ∣ a ⊗ I ) ϱ j o i n t ( ∣ 0 ⟩ a ⊗ I ) ] . (32) \varrho\mapsto\frac{(\langle0\rvert_a\otimes I)\varrho_{\mathrm{joint}}(\lvert0\rangle_a\otimes I)}{\operatorname{Tr}\left[(\langle0\rvert_a\otimes I)\varrho_{\mathrm{joint}}(\lvert0\rangle_a\otimes I)\right]}. \tag*{(32)} ϱ ↦ Tr [ (⟨ 0 ∣ a ⊗ I ) ϱ joint (∣ 0 ⟩ a ⊗ I ) ] (⟨ 0 ∣ a ⊗ I ) ϱ joint (∣ 0 ⟩ a ⊗ I ) . (32) The trace in the denominator is the probability p 0 ( t ) p_0^{(t)} p 0 ( t ) P a c c P_{\mathrm{acc}} P acc (29) . The variant without branch selection traces the ancilla out, ϱ ↦ Tr a ϱ j o i n t \varrho\mapsto\operatorname{Tr}_a\varrho_{\mathrm{joint}} ϱ ↦ Tr a ϱ joint T T T T T T S S S (30) , with counts drawn from the multinomial distribution defined by the diagonal of the final density matrix.
Parameter-matched classical control
To separate the contribution of the quantum circuit from that of its parameter budget, we compare the denoiser with a classical denoiser of the same size, trained on the same task. The control is a residual multilayer perceptron (MLP) that predicts a correction of the noisy state:
x ^ = x t + g ϕ ( f t ) ∥ x t + g ϕ ( f t ) ∥ 2 , f t = [ Re x t ; Im x t ; e t ; e k ] . (33) \hat{x} = \frac{x_t + g_{\phi}(f_t)}{\lVert x_t + g_{\phi}(f_t)\rVert_2}, \qquad f_t = [\operatorname{Re}x_t;\operatorname{Im}x_t;e_t;e_k]. \tag*{(33)} x ^ = ∥ x t + g ϕ ( f t ) ∥ 2 x t + g ϕ ( f t ) , f t = [ Re x t ; Im x t ; e t ; e k ] . (33) In this control, g ϕ g_{\phi} g ϕ h h h [57 ] , whose 2 D 2D 2 D e t ∈ { 0 , 1 } T e_t\in\{0,1\}^T e t ∈ { 0 , 1 } T e k ∈ { 0 , 1 } K e_k\in\{0,1\}^K e k ∈ { 0 , 1 } K h h h
h 2 + ( d i n + d o u t + 2 ) h + d o u t = P , (34) h^2 + (d_{\mathrm{in}} + d_{\mathrm{out}} + 2)h + d_{\mathrm{out}} = P, \tag*{(34)} h 2 + ( d in + d out + 2 ) h + d out = P , (34) rounded to the nearest integer. The left-hand side counts the weights and biases of an MLP with the input and output sizes d i n = 2 D + T + K d_{\mathrm{in}}=2D+T+K d in = 2 D + T + K d o u t = 2 D d_{\mathrm{out}}=2D d out = 2 D P P P (21) . For P = 11,520 P=11{,}520 P = 11 , 520 h = 54 h=54 h = 54 g ϕ g_{\phi} g ϕ (22) and the same optimization procedure.
Utility, fidelity, and privacy measures
We evaluate the generated latent vectors with a fixed protocol, which we apply to every generator compared in this work, on all K K K X t r = D t r ∪ D v a \mathcal{X}_{\mathrm{tr}}=D_{\mathrm{tr}}\cup D_{\mathrm{va}} X tr = D tr ∪ D va X t e = D t e \mathcal{X}_{\mathrm{te}}=D_{\mathrm{te}} X te = D te S S S [58 ] , a support vector machine (SVM) with a radial basis function kernel [59 ] , and an MLP, with scikit-learn [60 ] , and we report their mean macro-F1 score in three settings:
Augmentation (Aug): train on X t r ∪ S \mathcal{X}_{\mathrm{tr}}\cup S X tr ∪ S X t e \mathcal{X}_{\mathrm{te}} X te
Train on synthetic, test on real (TSTR) [61 ] : train on S S S X t e \mathcal{X}_{\mathrm{te}} X te
Train on real, test on synthetic (TRTS): train on X t r \mathcal{X}_{\mathrm{tr}} X tr S S S
Aug measures whether the synthetic records add useful information to the real training data. TSTR and TRTS approach the same question from opposite directions, since both test whether the synthetic records carry the information that separates the classes in the real data. Every setting tests on records that no generator observed during training, so that a generator cannot raise its scores by reproducing its training records.
To measure the fidelity of the generated distribution, we compute for every class the squared maximum mean discrepancy (MMD) [62 ] between the real records X = { x i } i = 1 n X X=\{x_i\}_{i=1}^{n_X} X = { x i } i = 1 n X Y = { y j } j = 1 n Y Y = \{y_j\}_{j=1}^{n_Y} Y = { y j } j = 1 n Y
MMD 2 ( X , Y ) = ∑ σ ∈ Σ [ 1 n X 2 ∑ i , i ′ κ σ ( x i , x i ′ ) + 1 n Y 2 ∑ j , j ′ κ σ ( y j , y j ′ ) − 2 n X n Y ∑ i , j κ σ ( x i , y j ) ] . (35) \operatorname{MMD}^{2}(X,Y)=\sum_{\sigma\in\Sigma}\left[\frac{1}{n_X^2}\sum_{i,i'}\kappa_{\sigma}(x_i,x_{i'})+\frac{1}{n_Y^2}\sum_{j,j'}\kappa_{\sigma}(y_j,y_{j'})-\frac{2}{n_Xn_Y}\sum_{i,j}\kappa_{\sigma}(x_i,y_j)\right]. \tag*{(35)} MMD 2 ( X , Y ) = σ ∈ Σ ∑ n X 2 1 i , i ′ ∑ κ σ ( x i , x i ′ ) + n Y 2 1 j , j ′ ∑ κ σ ( y j , y j ′ ) − n X n Y 2 i , j ∑ κ σ ( x i , y j ) . (35) In this estimator, κ σ ( u , v ) = exp ( − ∥ u − v ∥ 2 / ( 2 σ 2 ) ) \kappa_{\sigma}(u,v)=\exp\left(-\lVert u-v\rVert^2/(2\sigma^2)\right) κ σ ( u , v ) = exp ( − ∥ u − v ∥ 2 / ( 2 σ 2 ) ) σ \sigma σ Σ = { 0.25 , 0.5 , 1 , 2 , 4 } ⋅ σ m e d \Sigma=\{0.25,0.5,1,2,4\}\cdot\sigma_{\mathrm{med}} Σ = { 0.25 , 0.5 , 1 , 2 , 4 } ⋅ σ med σ m e d \sigma_{\mathrm{med}} σ med
To quantify memorization, which is the main privacy risk of releasing synthetic records, we compare the distance from each synthetic record to its nearest training record with the same distance for unseen real records. For every class, we compute
d g e n ( y ) = min x ∈ X t r ∥ y − x ∥ 2 , y ∈ S , d r e f ( x ′ ) = min x ∈ X t r ∥ x ′ − x ∥ 2 , x ′ ∈ X t e . (36) \begin{aligned}
d_{\mathrm{gen}}(y)&=\min_{x\in\mathcal{X}_{\mathrm{tr}}}\lVert y-x\rVert_2,\qquad y\in\mathcal{S},\\
d_{\mathrm{ref}}(x')&=\min_{x\in\mathcal{X}_{\mathrm{tr}}}\lVert x'-x\rVert_2,\qquad x'\in\mathcal{X}_{\mathrm{te}}. \tag*{(36)}
\end{aligned} d gen ( y ) d ref ( x ′ ) = x ∈ X tr min ∥ y − x ∥ 2 , y ∈ S , = x ∈ X tr min ∥ x ′ − x ∥ 2 , x ′ ∈ X te . (36) In these distances, d g e n d_{\mathrm{gen}} d gen [25 ] , and d r e f d_{\mathrm{ref}} d ref
r m e m = median y ∈ S d g e n ( y ) median x ′ ∈ X t e d r e f ( x ′ ) , q 10 = 1 ∣ S ∣ ∑ y ∈ S 1 [ d g e n ( y ) < Q 0.1 ( d r e f ) ] . (37) \begin{aligned}
r_{\mathrm{mem}}&=\frac{\operatorname{median}_{y\in\mathcal{S}}d_{\mathrm{gen}}(y)}{\operatorname{median}_{x'\in\mathcal{X}_{\mathrm{te}}}d_{\mathrm{ref}}(x')},\\
q_{10}&=\frac{1}{|\mathcal{S}|}\sum_{y\in\mathcal{S}}\mathbf{1}\left[d_{\mathrm{gen}}(y)<Q_{0.1}(d_{\mathrm{ref}})\right]. \tag*{(37)}
\end{aligned} r mem q 10 = median x ′ ∈ X te d ref ( x ′ ) median y ∈ S d gen ( y ) , = ∣ S ∣ 1 y ∈ S ∑ 1 [ d gen ( y ) < Q 0.1 ( d ref ) ] . (37) Here, Q 0.1 ( d r e f ) Q_{0.1}(d_{\mathrm{ref}}) Q 0.1 ( d ref ) 1 [ ⋅ ] \mathbf{1}[\cdot] 1 [ ⋅ ] r m e m < 1 r_{\mathrm{mem}}<1 r mem < 1 q 10 q_{10} q 10 q 10 t e q_{10}^{\mathrm{te}} q 10 te d g e n d_{\mathrm{gen}} d gen q 10 q_{10} q 10 q 10 t e q_{10}^{\mathrm{te}} q 10 te X t r \mathcal{X}_{\mathrm{tr}} X tr
Since the decoder of Eq. (5) draws the length of every synthetic record around the lengths of the training records, we also test whether the released lengths reveal which records belong to D t r D_{\mathrm{tr}} D tr ρ ( x ) \rho(x) ρ ( x ) x x x k k k
s ( x ) = − min y ∈ S k ∣ log ρ ( x ) − log ρ ( y ) ∣ , (38) s(x)=-\min_{y\in\mathcal{S}_k}\left|\log\rho(x)-\log\rho(y)\right|, \tag*{(38)} s ( x ) = − y ∈ S k min ∣ log ρ ( x ) − log ρ ( y ) ∣ , (38) AUC l e n = Pr ( s ( x ) > s ( x ′ ) ) + 1 2 Pr ( s ( x ) = s ( x ′ ) ) . \operatorname{AUC}_{\mathrm{len}}=\Pr\left(s(x)>s(x')\right)+\frac{1}{2}\Pr\left(s(x)=s(x')\right). AUC len = Pr ( s ( x ) > s ( x ′ ) ) + 2 1 Pr ( s ( x ) = s ( x ′ ) ) . In this test, S k \mathcal{S}_k S k k k k x x x k k k x ′ x' x ′
The area under the receiver operating characteristic curve AUC l e n \operatorname{AUC}_{\mathrm{len}} AUC len (38) describes an adversary that looks for the nearest released length. A stronger adversary also knows the bandwidth τ k \tau_k τ k
s L R ( x ) = log ∑ y ∈ S k exp ( − Δ ( x , y ) 2 2 τ k 2 ) , s_{\mathrm{LR}}(x)=\log\sum_{y\in\mathcal{S}_k}\exp\left(-\frac{\Delta(x,y)^2}{2\tau_k^2}\right), s LR ( x ) = log y ∈ S k ∑ exp ( − 2 τ k 2 Δ ( x , y ) 2 ) , Δ ( x , y ) = log ρ ( x ) − log ρ ( y ) , (39) \Delta(x,y)=\log\rho(x)-\log\rho(y), \tag*{(39)} Δ ( x , y ) = log ρ ( x ) − log ρ ( y ) , (39) which approximates the likelihood-ratio test under the smoothed bootstrap, since the log-length of every training record is a center of the mixture from which the released log-lengths are drawn (Proposition 2 ). We report both adversaries, with bootstrap intervals of the AUC over the candidates.
For an adversary that also obtains the trained generator, we evaluate a loss-based membership test [63 ] , which exploits a lower training loss on members. The score of a record x x x k k k T T T R R R
s l o s s ( x ) = − 1 T R ∑ t = 1 T ∑ r = 1 R ℓ ( θ ; a ( x ) , k , t , ϵ r ) . (40) s_{\mathrm{loss}}(x)=-\frac{1}{TR}\sum_{t=1}^{T}\sum_{r=1}^{R}\ell(\theta;a(x),k,t,\epsilon_r). \tag*{(40)} s loss ( x ) = − T R 1 t = 1 ∑ T r = 1 ∑ R ℓ ( θ ; a ( x ) , k , t , ϵ r ) . (40) The loss ℓ \ell ℓ ℓ P S \ell_{\mathrm{PS}} ℓ PS ℓ t r \ell_{\mathrm{tr}} ℓ tr § 3.9 and 4.4. The members are a fixed random subset of D t r D_{\mathrm{tr}} D tr D t e D_{\mathrm{te}} D te D t e D_{\mathrm{te}} D te § 3.3 .
Implementation
We implement the denoiser twice. The first implementation, written in PyTorch [64 ] , builds the unitary matrix of every block explicitly and applies it to a whole batch of states; we employ it for training and for state-vector sampling. The second implementation applies the same gates one by one in PennyLane [65 ] ; we use it to verify the first implementation and to run the density-matrix sampling of § 3.8 . Both implementations share the same parameters, and their output states agree to within 5 × 10 − 7 5\times10^{-7} 5 × 1 0 − 7 § 4.6 describes how we executed the reported runs.
Theoretical analysis
In this subsection, we establish a theorem and two propositions that support the design choices of § 3.3 to § 3.7 : the training target, the initialization together with the acceptance probability that it implies, and the lengths of the decoded records, which underlie the privacy analysis of Section 5.3. The results hold exactly for the circuits of § 3.5 , since every angle θ \theta θ e − i θ Q / 2 e^{-i\theta Q/2} e − i θ Q /2 Q Q Q § 13 . Appendix § 13 contains all proofs, and Appendix § 14 verifies every statement numerically with our implementation (Table B.1).
Optimal training target The first result compares our posterior-mean target with a single draw of x t − 1 x_{t-1} x t − 1 [12 ] .
Theorem 1 (Optimal target). Let x t − 1 x_{t-1} x t − 1 q ( x t − 1 ∣ x t , x 0 ) q(x_{t-1}\mid x_t,x_0) q ( x t − 1 ∣ x t , x 0 ) (9) , and let ∣ x ^ t − 1 ⟩ = x t − 1 / ∥ x t − 1 ∥ 2 \lvert\hat{x}_{t-1}\rangle=x_{t-1}/\lVert x_{t-1}\rVert_2 ∣ x ^ t − 1 ⟩ = x t − 1 / ∥ x t − 1 ∥ 2 λ 1 > λ 2 ≥ 0 \lambda_1>\lambda_2\geq0 λ 1 > λ 2 ≥ 0 λ 1 + ( D − 1 ) λ 2 = 1 \lambda_1+(D-1)\lambda_2=1 λ 1 + ( D − 1 ) λ 2 = 1 x t x_t x t x 0 x_0 x 0 ϱ \varrho ϱ
E [ 1 − ⟨ x ^ t − 1 ∣ ϱ ∣ x ^ t − 1 ⟩ ∣ x t , x 0 ] = ( 1 − λ 1 ) + ( λ 1 − λ 2 ) ( 1 − ⟨ μ ~ t ∣ ϱ ∣ μ ~ t ⟩ ) . (41) \mathbb{E}\left[1-\langle\hat{x}_{t-1}\rvert\varrho\lvert\hat{x}_{t-1}\rangle\mid x_t,x_0\right]
=(1-\lambda_1)+(\lambda_1-\lambda_2)\left(1-\langle\tilde{\mu}_t\rvert\varrho\lvert\tilde{\mu}_t\rangle\right). \tag*{(41)} E [ 1 − ⟨ x ^ t − 1 ∣ ϱ ∣ x ^ t − 1 ⟩ ∣ x t , x 0 ] = ( 1 − λ 1 ) + ( λ 1 − λ 2 ) ( 1 − ⟨ μ ~ t ∣ ϱ ∣ μ ~ t ⟩ ) . (41) In this identity, the left-hand side represents the expected infidelity of an output ϱ \varrho ϱ (22) or Eq. (23) with the posterior-mean target. Since λ 1 − λ 2 > 0 \lambda_1-\lambda_2>0 λ 1 − λ 2 > 0 ϱ = ∣ μ ~ t ⟩ ⟨ μ ~ t ∣ \varrho=\lvert\tilde{\mu}_t\rangle\langle\tilde{\mu}_t\rvert ϱ = ∣ μ ~ t ⟩ ⟨ μ ~ t ∣ ( x t , x 0 ) (x_t,x_0) ( x t , x 0 ) λ 1 − λ 2 \lambda_1-\lambda_2 λ 1 − λ 2 λ 1 ≈ 0.7 \lambda_1\approx0.7 λ 1 ≈ 0.7 ∣ μ ~ t ⟩ \lvert\tilde{\mu}_t\rangle ∣ μ ~ t ⟩ § 14 ).
Identity initialization The second result quantifies how close the denoiser is to the identity map at initialization.
Proposition 1 (Identity initialization). Let the N = 3 m L N=3mL N = 3 m L L L L m m m N ( 0 , σ 2 ) \mathcal{N}(0,\sigma^2) N ( 0 , σ 2 ) U ( 0 ) = I U(0)=I U ( 0 ) = I ∣ v ⟩ \lvert v\rangle ∣ v ⟩
E [ U ( Θ ) ] = e − N σ 2 / 8 I , \mathbb{E}[U(\Theta)]=e^{-N\sigma^2/8}I, E [ U ( Θ )] = e − N σ 2 /8 I , E [ ∥ U ( Θ ) ∣ v ⟩ − ∣ v ⟩ ∥ 2 2 ] = 2 ( 1 − e − N σ 2 / 8 ) . (42) \mathbb{E}\left[\left\lVert U(\Theta)\lvert v\rangle-\lvert v\rangle\right\rVert_2^2\right]=2\left(1-e^{-N\sigma^2/8}\right). \tag*{(42)} E [ ∥ U ( Θ ) ∣ v ⟩ − ∣ v ⟩ ∥ 2 2 ] = 2 ( 1 − e − N σ 2 /8 ) . (42) With N 2 = 3 ( n + 1 ) L 2 N_2=3(n+1)L_2 N 2 = 3 ( n + 1 ) L 2 U ( t ) U^{(t)} U ( t ) E [ p 1 ∣ ∣ x t ⟩ ] ≤ 2 ( 1 − e − N 2 σ 2 / 8 ) \mathbb{E}[p_1\mid\lvert x_t\rangle]\leq2(1-e^{-N_2\sigma^2/8}) E [ p 1 ∣ ∣ x t ⟩] ≤ 2 ( 1 − e − N 2 σ 2 /8 ) (29) satisfies E [ P a c c ] ≥ ( 2 e − N 2 σ 2 / 8 − 1 ) T \mathbb{E}[P_{\mathrm{acc}}]\geq(2e^{-N_2\sigma^2/8}-1)^T E [ P acc ] ≥ ( 2 e − N 2 σ 2 /8 − 1 ) T
In this proposition, N σ 2 N\sigma^2 N σ 2 σ = 0.1 \sigma=0.1 σ = 0.1 N = 60 N=60 N = 60 N = 72 N=72 N = 72 0.93 I 0.93I 0.93 I 0.91 I 0.91I 0.91 I 0.15 0.15 0.15 T = 10 T=10 T = 10 0.91 I 0.91I 0.91 I § 14 ). With the standard deviation of 0.7 0.7 0.7 0.03 I 0.03I 0.03 I 0.01 I 0.01I 0.01 I P a c c P_{\mathrm{acc}} P acc
Lengths of decoded records The third result characterizes the lengths that the decoder of Eq. (5) gives to the synthetic records.
Proposition 2 (Lengths of decoded records). With the min–max codec, every decoded record z ^ \hat{z} z ^ k k k ρ ( z ^ ) = ρ \rho(\hat{z})=\rho ρ ( z ^ ) = ρ ρ = ρ j e τ k ξ \rho=\rho_j e^{\tau_k \xi} ρ = ρ j e τ k ξ (5) , whatever the generated state. Consequently, the following statements hold for the lengths of the synthetic records of class k k k τ k > 0 \tau_k>0 τ k > 0 log ρ ( z ^ ) \log\rho(\hat{z}) log ρ ( z ^ )
f ^ k ( v ) = 1 ∣ R k ∣ ∑ r ∈ R k 1 2 π τ k exp ( − ( v − log r ) 2 2 τ k 2 ) , (43) \hat{f}_k(v)=\frac{1}{\lvert R_k\rvert}\sum_{r\in R_k}\frac{1}{\sqrt{2\pi}\tau_k}\exp\left(-\frac{(v-\log r)^2}{2\tau_k^2}\right), \tag*{(43)} f ^ k ( v ) = ∣ R k ∣ 1 r ∈ R k ∑ 2 π τ k 1 exp ( − 2 τ k 2 ( v − log r ) 2 ) , (43) whose mean equals the mean $\bar{v}_k$ of $\{\log r:r\in R_k\}$ and whose variance equals $(1-1/\lvert R_k\rvert)s_k^2+\tau_k^2$. (ii) If $\tau_k>0$, then $\Pr(\rho(\hat{z})=r)=0$ for any $r>0$, so that no synthetic record reproduces the exact length of a training record. (iii) If $\tau_k=0$, the lengths follow the empirical distribution of $R_k$, and a training length that occurs once in $R_k$ appears among the lengths of $n_s$ synthetic records of class $k$ with probability $1-(1-1/\lvert R_k\rvert)^{n_s}$.
In this proposition, f ^ k \hat{f}_k f ^ k τ k \tau_k τ k R k R_k R k s k s_k s k (6) . Part (i) indicates that the synthetic lengths keep the distribution of the training lengths up to a smoothing of width τ k \tau_k τ k (6) and the min–max codec, this smoothing increases the standard deviation of the logarithms by 0.9 % 0.9\% 0.9% 4.9 % 4.9\% 4.9% § 5.3 therefore measures this risk with two adversaries, also for the lengths drawn from the differentially private histogram of Eq. (7) . With τ k = 0 \tau_k=0 τ k = 0 (38) reaches an AUC of 0.998 for Startpage. With the bandwidth of Eq. (6) , no length is reproduced, and the AUC drops to 0.55, close to the value 0.5 of a random guess (Appendix § 14 ). Since the decoder is applied after sampling, the choice of τ k \tau_k τ k ρ \rho ρ ρ \rho ρ ∣ α ^ ∣ |\hat{\alpha}| ∣ α ^ ∣
Experimental setup
In this section, we describe the data, the configurations of the trained models, the reference points of the evaluation, the classical diffusion baseline, the evaluation protocol, and the computing environment of our experiments.
Dataset
We employ a corpus of malware executables of 20 families from the public repository VirusShare [66 ] , which was collected and preprocessed in the same way as the corpus of Bao et al. [4 ] . The corpus contains the 17 most common families of the collection together with three of its rarest families, so that it reflects the class imbalance of real collections and contains families with few samples. The samples were collected in August 2023, and every sample keeps the malware-family label provided with it by VirusShare, without modification. Unlike the corpus of Bao et al. [4 ] , which combines samples of 25 families from the Malicia dataset [67 ] and from VirusShare, our corpus draws every family from VirusShare. We disassembled every executable with objdump from the GNU Binutils [68 ] and the pipeline of Bao et al. [4 ] , which keeps the lines of the disassembly that contain an instruction, extracts the instruction field, and removes its operands, so that the output lists the opcode mnemonics of the program in their order, one per line. Executables whose disassembly does not produce a usable instruction stream, for instance because of packing or anti-disassembly protections, are excluded without any attempt at repair, and exact duplicates are removed, which leaves 21,522 programs. Since the CAE of § 3.1 reads the first 7,000 opcodes of a program, we further keep one program of every group whose first 7,000 opcodes coincide, which leaves 19,843 programs; 83% of them contain more than 7,000 opcodes, with a median of 28,711. We discard the three families with fewer than 30 programs (Diplugem, Lamechi.B, and Systex.A), which leaves K = 17 K = 17 K = 17
We fix this split before training any model, the CAE included. The vocabulary of the CAE consists of the 1,185 opcodes that occur in the truncated training records, together with a padding token and an unknown token, which replaces the 138 opcode occurrences of validation and test records outside the vocabulary. We train the CAE on the training records for 120 epochs with Adam at a learning rate of 10 − 5 10^{-5} 1 0 − 5
Configurations of the quantum denoiser
We train the quantum denoiser with the linear schedule of § 3.4 over T = 10 T = 10 T = 10 β \beta β L 1 = L 2 = L 3 = 4 L_1 = L_2 = L_3 = 4 L 1 = L 2 = L 3 = 4 Table 2 for the min–max codec and 13,800 angles for the sign-split codec. We draw the initial angles from N ( 0 , 0.1 2 ) \mathcal{N}(0,0.1^2) N ( 0 , 0. 1 2 ) Proposition 1 ). We optimize Eq. (24) with Adam at a learning rate of 0.01 and a weight decay of 10 − 5 10^{-5} 1 0 − 5 T T T ( x t , μ ~ t ) (x_t,\tilde{\mu}_t) ( x t , μ ~ t )
We train six configurations: the denoiser with post-selection, the denoiser without branch selection, and the classical control of § 3.9 , each with the min–max and the sign-split codec. Every configuration runs with the ten seeds 0 to 7, 13, and 42, which set the initial parameters, the order of the mini-batches, the noise of the forward process, and the initial states of sampling. After training, every run generates 512 records per family with Algorithm 2, that is, 8,704 records per run. We train the four configurations of the circuit with both implementations of § 3.11 , the PennyLane implementation with the seeds 42, 7, and 13 for verification, and report the PyTorch runs, which gives 60 PyTorch runs and 12 PennyLane runs in total. For the simulation of hardware noise (§ 3.8 ), we sample the 20 post-selected circuits for all families with p ∈ { 0 , 0.001 , 0.01 } p \in\{0,0.001,0.01\} p ∈ { 0 , 0.001 , 0.01 } S = 1 , 000 S = 1,000 S = 1 , 000 (28) , and we train the post-selected circuit with the penalized objective of Eq. (26) for λ ∈ { 0.001 , 0.01 , 0.1 } \lambda\in\{0.001,0.01,0.1\} λ ∈ { 0.001 , 0.01 , 0.1 }
Reference points
We interpret the scores of the quantum denoiser against reference points that share its latent vectors, its amplitude encoding, its decoder, and its evaluation protocol, so that a difference in scores can be attributed to the denoiser. Generators of other designs, such as classical or hybrid diffusion models with 1,000 stochastic steps on unnormalized latent vectors, differ from our model in several of these components at once, and a comparison with them would therefore confound the contribution of the circuit with that of the representation and of the sampling procedure. We therefore employ such a generator only to place the complete framework (§ 4.4 ). We do not include hybrid quantum diffusion models, such as the quantum latent diffusion model of De Falco et al. [41 ] , in which a classical network carries the state between the steps, since their scores would not isolate the contribution of a circuit (§ 2.3 ). We isolate the denoiser with five reference points:
Random states: the magnitudes of the initial states ∣ z T ⟩ \lvert z_T\rangle ∣ z T ⟩ (5) without any denoising step. These are the records that the identity map would release, and they mark the scores of a generator that has learned nothing. For every seed, we decode the 512 initial states per family from which the trained denoisers of that seed start, so that every comparison between a denoiser and the random states is paired.
Real records: the classifiers trained on X t r \mathcal{X}_{\mathrm{tr}} X tr (37) , and the encoded test records for the class information of § 5.4 .
Parameter-matched classical control: the classical denoiser of § 3.9 , which replaces the circuit with an MLP of the same size and keeps every other component, so that it separates the contribution of the circuit from that of the formulation of the generative task.
The random states and the round-trip ceiling bound the scores that a denoiser of this framework can attain, so that the position of a configuration between them indicates how much of the attainable class information its denoiser has learned. The classical control then indicates how much of the remaining gap a classical map of the same size closes under the same formulation.
Classical diffusion baseline
To place the fully quantum framework as a whole, including its encoding, its ten deterministic steps, and its decoder, we compare it with a classical latent DDPM in the design that Bao et al. [4 ] employed for embeddings of malware opcode sequences. The DDPM follows Ho et al. [1 ] with T = 1,000 T = 1{,}000 T = 1 , 000 β t \beta_t β t 10 − 4 10^{-4} 1 0 − 4 0.02 0.02 0.02 [ − 1 , 1 ] [-1,1] [ − 1 , 1 ] 10 − 3 10^{-3} 1 0 − 3 [1 ] , which starts from Gaussian noise. Bao et al. [4 ] instead started the reverse process from training records noised to step T / 2 T/2 T /2 § 3.10 detect such a dependence.
Evaluation protocol
We evaluate every run with the measures of § 3.10 on its 512 records per family. The random forest uses 100 trees, the SVM uses a radial basis function kernel with C = 1 C = 1 C = 1 (5) is random. We compare paired configurations, such as the circuit and its classical control or the circuit and the random states of its codec, seed by seed with the two-sided Wilcoxon signed-rank test [69 ] ; with ten seeds, its smallest attainable p p p R = 4 R = 4 R = 4 (7) , we employ B = 64 B = 64 B = 64 ϵ ∈ { 0.1 , 0.3 , 1 , 3 , 10 } \epsilon\in\{0.1, 0.3, 1, 3, 10\} ϵ ∈ { 0.1 , 0.3 , 1 , 3 , 10 }
Computing environment
We carried out all experiments on classical hardware running quantum simulators, since fault-tolerant quantum processors that could train the denoiser are not yet available in the present NISQ era [9 ] . We performed all runs on the REmotely-managed Power Aware Computing Systems and Services (REPACSS) supercomputer at Texas Tech University [70 ] , whose CPU nodes each provide two AMD EPYC 9754 processors with 256 cores and whose GPU nodes each provide two Intel Xeon Gold 6448Y processors and four NVIDIA H100 NVL accelerators. We employed the CPU nodes for every training and sampling run of the diffusion models, because the largest matrices of the denoiser have 128 × 128 128 \times128 128 × 128 § 14 ran on the processors of a GPU node.
We submitted the runs with the SLURM workload manager and executed them with MPI (Open MPI 4.1.8 with mpi4py 4.1.2). Every training run of the quantum denoiser and of the classical control was assigned to a group of four processes with two CPU threads each, which split every mini-batch and averaged their gradients, and the runs of one job trained concurrently. The 18 PyTorch runs of the seeds 42, 7, and 13 completed within 1.0 h on one CPU node, the 42 PyTorch runs of the seeds 0 to 6 within 2.3 h on two nodes, and the 12 PennyLane runs within 1.1 h on one node. A post-selected run took 41 min on average with the min–max codec and 79 min with the sign-split codec, against about 2 min for the classical control. The 120 sampling configurations with hardware noise ran on 512 processes of four CPU nodes, with a group of four or five processes per configuration that split its samples, and took 1.1 h. The 20 DDPM runs ran concurrently within one job on one CPU node, with 16 threads for every full U-Net and four threads for every small one. Training took 101 to 215 min for the full U-Net and 40 to 65 min for the small U-Net, and the 1,000 steps of the ancestral sampler generated the 8,704 records of a run in 6.6 to 8.3 min and in 1.6 to 2.0 min, respectively. We implemented every model in Python 3.12 with PyTorch 2.5.1 [64 ] , PennyLane 0.42.3 [65 ] , and scikit-learn 1.7.2 [60 ] .
Results
In this section, we evaluate the quantum denoiser with both codecs and both measurement rules against the reference points of § 4.3 and the classical diffusion baseline of § 4.4 . Unless stated otherwise, every value is the mean and the standard deviation over the ten seeds, the scores cover all 17 families, the records come from the PyTorch implementation, and the decoder draws the smoothed lengths of Eq. (5) . § 5.1 describes the training of the denoisers, § 5.2 and § 5.3 evaluate the generated records, § 5.4 examines the generated states, § 5.5 varies the sampler, the weighting of the released records, and the training objective, and § 5.6 reports the behavior of post-selected sampling under hardware noise.
Training of the denoisers
Figure 3 illustrates the validation infidelity during training, and Table 3 summarizes the trained denoisers. With post-selection, the validation infidelity of the circuit exhibits a steep decline during the first 20 epochs, followed by a gradual decline until early stopping ends the run, after 125 to 390 epochs with the min–max codec and after 105 to 300 epochs with the sign-split codec. On the test pairs, the circuit reaches an infidelity of 0.0315 ± 0.0040 with the min–max codec and 0.0721 ± 0.0009 with the sign-split codec, which lie 62.6% and 22.4% below the infidelity of the identity map, the map that returns the noisy input state unchanged. The spread with the min–max codec stems from the seed 13, whose run stops at 0.0426, whereas the other nine seeds reach 0.0295 to 0.0312, that is, 63% to 65% below the identity map. With a patience of 16 instead of eight evaluations, the run of the seed 13 continues to the limit of 400 epochs and reaches 0.0424, so that this seed converges to a worse solution and early stopping does not explain its higher infidelity. By contrast, the circuit without branch selection remains at the level of the identity map: its best validation infidelity occurs after 5 to 40 epochs, early stopping ends every run after 45 to 80 epochs, and the ancilla returns the outcome 0 with probability 1.000. The circuit therefore stays at the initialization of Proposition 1, which suggests that, without selection, the measurement only mixes the two output branches and that no mixture of them brings the output closer to the target than the unchanged input. The parameter-matched classical control, with 11,458 parameters against the 11,520 angles of the circuit, reaches 0.00225 ± 0.00002 and 0.0219 ± 0.0004, which are lower than the infidelities of the post-selected circuit by factors of 14 and 3.3, and it trains in about 2 min, against 41 and 79 min for the circuit (§ 4.6 ).
Figure 3. Validation infidelity during training for the min–max codec (a) and the sign-split codec (b), with one line for each of the ten seeds. Blue solid lines: circuit with post-selection; orange dashed lines: circuit without branch selection; green dotted lines: parameter-matched classical control; gray dash-dotted line: identity map, which returns the noisy input state unchanged. Markers indicate the best epoch of each run. The models are evaluated every five epochs on fixed validation pairs of all steps t = 1 , … , 10 t = 1, \ldots, 10 t = 1 , … , 10 T = 10 T = 10 T = 10
Table 3. Trained denoisers with the two codecs, mean and standard deviation over the ten seeds. Best epoch: epoch of the lowest validation infidelity; reduction: decrease of the test infidelity relative to the identity map; p ˉ 0 \bar{p}_0 p ˉ 0 P a c c P_{\mathrm{acc}} P acc (29) along the sampling trajectories, averaged over the 512 initial states of every family and over the 17 families and the seeds. Without branch selection, no sample is rejected, so that P a c c = 1 P_{\mathrm{acc}} = 1 P acc = 1
The PennyLane implementation reproduces these runs. Over the 12 runs that both implementations trained, the test infidelities differ by at most 8.1 × 10 − 8 8.1 \times10^{-8} 8.1 × 1 0 − 8 § 5.2 for the PennyLane runs agree with those of the PyTorch runs of the same seeds, with a mean TSTR difference of −0.002 ± 0.009 for the post-selected circuit with the min–max codec. Since both implementations ran with the same groups of processes and the same seeds, they also drew the same noise during training.
The mean probability p ˉ 0 \bar{p}_0 p ˉ 0 p ˉ 0 ( t ) \bar{p}_0^{(t)} p ˉ 0 ( t ) t = 10 t = 10 t = 10 t = 4 t = 4 t = 4 (29) drops from 0.91 at initialization (Appendix § 14 ) to 3.0 × 10 − 7 3.0 \times10^{-7} 3.0 × 1 0 − 7 9.8 × 10 − 5 9.8 \times10^{-5} 9.8 × 1 0 − 5 3.4 × 10 6 3.4 \times10^6 3.4 × 1 0 6 1.0 × 10 4 1.0 \times10^4 1.0 × 1 0 4
Utility of the synthetic records
Table 4 places the classification utility of the generated records between the two bounds of § 4.3 , the decoded random states reach TSTR scores of 0.076 ± 0.014 and 0.039 ± \pm ± Proposition 2 ) and therefore carry a small amount of class information. Their TRTS scores of 0.020 ± \pm ± ± \pm ±
Table 4. Classification utility (macro-F1, mean of the random forest, the SVM, and the MLP) of the synthetic records of all 17 families, mean and standard deviation over the ten seeds. The classifiers trained on the real records alone reach 0.635. The round-trip ceilings of § 3.3 are averaged over eight length draws. Random states: the initial states of sampling, decoded without any denoising step (§ 4.3 ). Classical latent DDPM: the baseline of § 4.4 , which generates the latent vectors directly and samples from Gaussian noise or, with the sampler of Bao et al. [4 ] , from training records noised to step T / 2 T/2 T /2
Within this range, the records of the post-selected circuit remain close to the random states. With the min–max codec, TSTR reaches 0.114 ± \pm ± ± \pm ± p = 0.002 p = 0.002 p = 0.002 ± \pm ± ± \pm ± ± \pm ± p = 0.38 p = 0.38 p = 0.38 ± \pm ± p = 0.28 p = 0.28 p = 0.28 ± \pm ± p ≥ 0.10 p \ge0.10 p ≥ 0.10
No generator of this study raises the Aug score above the real-only score of 0.635. With the min–max codec, the records of the post-selected circuit lower it to 0.593, which is less than the drop to 0.581 caused by the random states, by 0.012 ± \pm ±
The classical control indicates how much of this range a classical map of the same size covers under the same formulation, since it shares the loss, the ten steps, the initial states, and the decoder of the circuit. With the min–max codec, the control reaches TSTR and TRTS scores of 0.218 ± \pm ± ± \pm ± ± \pm ± ± \pm ± ± \pm ± ± \pm ±
0.138 ± 0.015 and 0.276 ± 0.016. Hence, the min–max codec restricts both denoisers, whereas with the sign-split codec a classical map of the same size recovers a large part of the class information that remains out of reach of the circuit.
The classical latent DDPM indicates the utility that a generator of the same latent vectors attains without the amplitude encoding and the ten deterministic steps. The full U-Net reaches TSTR and TRTS scores of 0.531 ± 0.006 and 0.529 ± 0.009, and the small U-Net, whose 11,404 parameters are comparable to the 11,520 angles of the circuit, reaches 0.442 ± 0.007 and 0.381 ± 0.010. The small U-Net exceeds the post-selected circuit with the min–max codec in every seed, by 0.328 ± 0.017 in TSTR and 0.353 ± 0.011 in TRTS, and it also exceeds the classical control with the sign-split codec in every seed, by 0.075 ± 0.011 and 0.064 ± 0.019. With the sign-split codec, the classical control therefore comes within 0.08 of the small U-Net in TSTR, whereas the post-selected circuit remains 0.41 below it, so that most of the gap between the circuit and the classical diffusion model lies between the circuit and a classical map under the same formulation. Adding the DDPM records to the real training data lowers the macro-F1 score slightly, to 0.631 and 0.620. The sampler of Bao et al. [4 ] , which starts from training records noised to step T / 2 T/2 T /2 p = 0.85 p = 0.85 p = 0.85
The ceilings themselves depend on how much family information the latent vectors retain. To place them, we trained the classifiers of § 3.10 on opcode frequencies of the same programs, with the same split and the 1,217 opcodes that occur in at least ten training programs. The relative opcode frequencies of the first 7,000 opcodes, the part of a program the CAE reads, reach a macro-F1 score of 0.682, those of the whole program 0.696, and these frequencies together with those of the 1,000 most frequent opcode bigrams 0.749, against 0.635 for the 32 latent features. The CAE therefore retains most of the family information of the opcode frequencies that it reads, and the remaining gap to richer representations of the programs bounds every generator of these latent vectors from above, the classical DDPM included.
Distribution fidelity, memorization, and membership
Table 5 reports the fidelity and memorization measures of § 3.10 . The post-selected circuit moves its records toward the real distribution: with the min–max codec, it lowers the squared MMD from 2.237 for the random states to 1.787, that is, by 20% and in every seed (p = 0.002 p = 0.002 p = 0.002 q 10 = 0 q_{10} = 0 q 10 = 0 q 10 = 0 q_{10} = 0 q 10 = 0 q 10 ≤ 1.4 % q_{10} \le1.4\% q 10 ≤ 1.4% q 10 t e ≤ 1.1 % q_{10}^{\mathrm{te}} \le1.1\% q 10 te ≤ 1.1% q 10 = 10.5 % q_{10} = 10.5\% q 10 = 10.5% q 10 t e = 14.1 % q_{10}^{\mathrm{te}} = 14.1\% q 10 te = 14.1%
The classical DDPM generates records that lie much closer to the real distribution, with a squared MMD
0.032 ± 0.003 for the full U-Net and 0.089 ± 0.006 for the small U-Net, and these records still lie 2.3 and 3.3 times farther from their nearest training record than unseen real records do, with q 10 q_{10} q 10 T / 2 T/2 T /2 α ˉ T / 2 = 0.28 \sqrt{\bar{\alpha}_{T/2}} = 0.28 α ˉ T /2 = 0.28
Table 6 reports the membership tests. The loss-based test, which requires the trained generator, reaches AUCs between 0.48 and 0.50 for every generator, so that no generator gives this adversary an advantage, whether it learns little, as the post-selected circuit, or approaches the real distribution, as the full DDPM. The values below 0.5, whose intervals exclude 0.5 for several generators, indicate that the training records have a slightly higher loss than the test records under every generator, which suggests a property of the latent vectors rather than of a generator; an adversary that reverses the score would reach at most 0.52.
Table 6. Membership tests (AUC; 0.5 corresponds to a random guess), mean over the ten seeds. Loss: the loss-based test of Eq. (40) against the trained generator, with members drawn from D t r \mathcal{D}_{\mathrm{tr}} D tr ± 0.013 \pm0.013 ± 0.013 (38) (nearest) and (39) (likelihood) on the released lengths, averaged over the 17 families, with the lengths drawn without the perturbation (τ k = 0 \tau_k = 0 τ k = 0 (6) (smoothed). The DDPM has no decoder that draws lengths, so that its length test uses the lengths of its records under the min–max codec.
Table 6.
The smoothed lengths remove the leak that Proposition 2 identifies. Since the decoded lengths of the min–max codec do not depend on the generated states, the three min–max denoisers and the random states release lengths with the same distribution. With τ k = 0 \tau_k = 0 τ k = 0 (6) , the two rates become 2.3% and 2.3%, and the AUC drops to 0.51 for the nearest adversary and to 0.52 for the adversary that knows τ k \tau_k τ k
The lengths of the sign-split records reveal little about membership even with τ k = 0 \tau_k = 0 τ k = 0 ρ \rho ρ Proposition 2 ). The records of the classical DDPM, which generates every length together with the rest of the latent vector, reach an AUC of 0.51 under the min–max codec, so that the smoothed bootstrap brings the quantum denoiser to the level of a generator without this channel.
Table 7 reports the lengths drawn from the differentially private histogram of (7) . For every privacy budget from ε = 10 \varepsilon= 10 ε = 10 ε = 0.1 \varepsilon= 0.1 ε = 0.1 ε ≥ 1 \varepsilon\ge1 ε ≥ 1 ε = 0.1 \varepsilon= 0.1 ε = 0.1
Table 7. Lengths drawn from the ε \varepsilon ε (7) (min–max codec, B = 64 B = 64 B = 64 (5) . AUC: length membership tests of Eqs. (38) and (39) , averaged over the 17 families (512 released lengths per family; for the histogram, one draw with the seed 42). Aug, TSTR, and TRTS: round-trip ceiling with the lengths of each rule, averaged over three draws for the histogram and eight draws for the other rules.
Table 7.
Class information in the generated states
To locate the source of the limited utility, we compare the generated magnitudes with the mean encoded state of each class. For a vector y ∈ R ≥ 0 D \boldsymbol{y} \in\mathbb{R}_{\geq0}^{D} y ∈ R ≥ 0 D k k k
F o w n ( y ) = ( m k T y ) 2 , k ^ ( y ) = arg max c ( m c T y ) 2 , F_{\mathrm{own}}(\boldsymbol{y}) = (\boldsymbol{m}_{k}^{\mathsf{T}}\boldsymbol{y})^{2}, \qquad\hat{k}(\boldsymbol{y}) = \underset{c}{\operatorname{arg\,max}}\;(\boldsymbol{m}_{c}^{\mathsf{T}}\boldsymbol{y})^{2}, F own ( y ) = ( m k T y ) 2 , k ^ ( y ) = c arg max ( m c T y ) 2 , m c = ∑ j : k j = c a ( z j ) ∥ ∑ j : k j = c a ( z j ) ∥ 2 . (44) \boldsymbol{m}_{c} = \frac{\sum_{j:k_{j}=c} \boldsymbol{a}(\boldsymbol{z}_{j})}{\left\lVert\sum_{j:k_{j}=c}\boldsymbol{a}(\boldsymbol{z}_{j})\right\rVert_{2}}. \tag*{(44)} m c = ∑ j : k j = c a ( z j ) 2 ∑ j : k j = c a ( z j ) . (44) In these quantities, m c \boldsymbol{m}_{c} m c c c c F o w n F_{\mathrm{own}} F own y \boldsymbol{y} y k ^ ( y ) \hat{k}(\boldsymbol{y}) k ^ ( y ) F o w n F_{\mathrm{own}} F own k ^ ( y ) = k \hat{k}(y) = k k ^ ( y ) = k K = 17 K = 17 K = 17
Table 8 indicates that the post-selected circuit moves the random initial states toward the data without giving them the identity of their class. With the min–max codec, the magnitudes of random states have F o w n = 0.681 F_{\mathrm{own}} = 0.681 F own = 0.681
Table 8. Class information in the generated magnitudes, pooled over the ten seeds and the 17 classes (512 records per class and seed), measured with Eq. (44) against the mean encoded states of the training records. The magnitudes of random states are those of the initial states ∣ z T ⟩ |z_T\rangle ∣ z T ⟩ 1 / 17 = 0.059 1/17 = 0.059 1/17 = 0.059
Table 8.
The geometry of the encoded states offers one explanation. With the min–max codec, two training records of different classes have a mean fidelity of 0.944, even slightly higher than two records of the same class (0.938), so that the infidelity loss rewards a class-specific output only through small differences between nearly parallel states. With the sign-split codec, the classes separate, with a mean fidelity of 0.923 between classes against 0.449 within a class, but the post-selected circuit removes only 22% of the infidelity of the identity map, which leaves the generated states close to random states.
Two further diagnostics exclude other explanations of the limited utility. First, sampling starts from Haar-random states, whereas training presents the circuit at step T T T t = T t = T t = T Table 8 . The initial states of sampling therefore match the distribution on which the circuit is trained. Second, the gradients of the post-selected loss could vanish with the number of qubits [36 ] . Over 20 random initializations with our standard deviation of 0.1, the mean variance of the partial derivatives of the shared blocks U ( t ) U^{(t)} U ( t ) U 3 ( t ) U_3^{(t)} U 3 ( t ) 6.8 × 10 − 5 6.8 \times10^{-5} 6.8 × 1 0 − 5 8.2 × 10 − 5 8.2 \times10^{-5} 8.2 × 1 0 − 5 6.0 × 10 − 5 6.0 \times10^{-5} 6.0 × 1 0 − 5 7.0 × 10 − 5 7.0 \times10^{-5} 7.0 × 1 0 − 5 π \pi π
Samplers, weighting of the released records, and acceptance penalty
Table 9 tests whether the deterministic chain of Algorithm 2 limits the utility of the records. With the classical control, both samplers of Eq. (28) raise the TSTR score in every seed (p = 0.002 p = 0.002 p = 0.002 0.016 ± 0.010 0.016 \pm0.010 0.016 ± 0.010 0.026 ± 0.019 0.026 \pm0.019 0.026 ± 0.019 0.017 ± 0.007 0.017 \pm0.007 0.017 ± 0.007 0.014 ± 0.006 0.014 \pm0.006 0.014 ± 0.006 0.017 ± 0.019 0.017 \pm0.019 0.017 ± 0.019 0.021 ± 0.019 0.021 \pm0.019 0.021 ± 0.019 p = 0.010 p = 0.010 p = 0.010
Table 9. Samplers of Eq. (28) and weighting of the released records, mean and standard deviation over the ten seeds (all 17 families). Deterministic: the chain of Algorithm 2. Weighted: the records of the deterministic chain drawn with replacement with probabilities proportional to P a c c P_{\mathrm{acc}} P acc P a c c P_{\mathrm{acc}} P acc
Table 9.
Post-selection on hardware releases a record only for the accepted runs, which weights the initial states with their acceptance probability (Section 3.7). Over the 512 initial states of a family, the logarithm log 10 P a c c \log_{10} P_{\mathrm{acc}} log 10 P acc − 0.002 ± 0.015 -0.002 \pm0.015 − 0.002 ± 0.015 p = 0.63 p = 0.63 p = 0.63 0.003 ± 0.006 0.003 \pm0.006 0.003 ± 0.006 p = 0.28 p = 0.28 p = 0.28
Table 10 reports the penalized objective of Eq. (26) . With the min–max codec, the weights λ = 0.001 \lambda= 0.001 λ = 0.001 1.6 × 10 − 7 1.6 \times10^{-7} 1.6 × 1 0 − 7 2.9 × 10 − 4 2.9 \times10^{-4} 2.9 × 1 0 − 4 1.7 × 10 − 2 1.7 \times10^{-2} 1.7 × 1 0 − 2 6.3 × 10 6 6.3 \times10^{6} 6.3 × 1 0 6 3.5 × 10 3 3.5 \times10^{3} 3.5 × 1 0 3 λ = 0.001 \lambda= 0.001 λ = 0.001 1.3 × 10 − 4 1.3 \times10^{-4} 1.3 × 1 0 − 4 1.8 × 10 − 3 1.8 \times10^{-3} 1.8 × 1 0 − 3 4.4 × 10 − 2 4.4 \times10^{-2} 4.4 × 1 0 − 2 λ = 0.1 \lambda= 0.1 λ = 0.1
Table 10. Post-selected circuits trained with the penalized objective of Eq. (26) , mean and standard deviation over the seeds 42, 7, and 13 (all 17 families); λ = 0 \lambda= 0 λ = 0 Table 3 with the same seeds. Runs per record: the expected number of runs per accepted record, 1 / E [ P a c c ] 1/\mathbb{E}[P_{\mathrm{acc}}] 1/ E [ P acc ] P a c c P_{\mathrm{acc}} P acc
Table 10.
Sampling under hardware noise
Table 11 reports the density-matrix sampling of § 3.8 for the post-selected circuits. At p = 0 p = 0 p = 0 Table 3 and 4. Depolarizing noise increases the acceptance probability, at p = 0.01 p = 0.01 p = 0.01 3.0 × 10 − 7 3.0 \times10^{-7} 3.0 × 1 0 − 7 2.6 × 10 − 5 2.6 \times10^{-5} 2.6 × 1 0 − 5 9.9 × 10 − 5 9.9 \times10^{-5} 9.9 × 1 0 − 5 1.3 × 10 − 3 1.3 \times10^{-3} 1.3 × 1 0 − 3 1 / 2 1/2 1/2 p = 0.01 p = 0.01 p = 0.01 q 10 q_{10} q 10 p = 0 p = 0 p = 0 p = 0.01 p = 0.01 p = 0.01 3.9 × 10 4 3.9 \times10^{4} 3.9 × 1 0 4 7.9 × 10 2 7.9 \times10^{2} 7.9 × 1 0 2
Table 11. Density-matrix sampling of the post-selected circuits for all 17 families, with depolarizing noise of probability p p p S = ∞ S = \infty S = ∞ S = 1,000 S = 1{,}000 S = 1 , 000 P a c c P_{\mathrm{acc}} P acc p = 0 p = 0 p = 0 Table 3 and Table 4 , because the initial states and the decoded lengths are drawn separately.
the distance between whole states, while the classification depends on the small part of each state that differs between families.
Discussion
In this section, we interpret the results of § 5 , discuss what they imply for the release of synthetic security data and for the execution of the denoiser on quantum hardware, and state the limitations of our study.
From the training objective to class information
The central observation of our experiments is that the post-selected circuit learns its training objective, while the class information of its records remains close to that of the random states from which sampling starts. The circuit lowers the test infidelity by 62.6% and 22.4% relative to the identity map (Table 3 ), the PennyLane runs reproduce this result to within 8.1 × 10 − 8 8.1 \times10^{-8} 8.1 × 1 0 − 8 Table 5 ). Nevertheless, its records cover 7% of the TSTR range between the random states and the round-trip ceiling with the min–max codec and none of it with the sign-split codec, whereas a classical latent DDPM of comparable size reaches a TSTR score of 0.442 on the same latent vectors (Table 4 ). These observations are compatible, since the infidelity measures
Table 5. Distribution fidelity and memorization of the synthetic records of all 17 families, mean and standard deviation over the ten seeds. MMD2 ^{2} 2 r m e m r_{\mathrm{mem}} r mem q 10 q_{10} q 10 (37) ), and q 10 t e q^{\mathrm{te}}_{10} q 10 te
Table 5.
We attribute this gap to three properties of the model. First, the min–max encoding hides the family in small differences between nearly parallel states: two records of different families have a slightly higher mean fidelity than two records of the same family (0.944 against 0.938). A denoiser can therefore reach a low infidelity by moving every state toward the common region of the data, which the post-selected circuit does (F o w n F_{\mathrm{own}} F own § 5.4 ).
Second, the formulation of sampling constrains every denoiser of this framework, including the classical control. The control reaches an infidelity 14 and 3.3 times lower than the circuit, yet its TSTR scores of 0.218 and 0.367 remain below the ceilings of 0.605 and 0.593. Its states lie closer to the mean states of their families than real records do (F o w n F_{\mathrm{own}} F own Table 9 confirm part of this explanation: the noise that they add between the steps raises the TSTR score of the control in every seed and lowers its squared MMD, but with the best sampler the control still remains at 0.243 and 0.384, and neither sampler raises the scores of the circuit. The remaining gap between the control and the small U-Net, 0.075 in TSTR with the sign-split codec, therefore stems from the other differences between them, such as the normalization of the states, the ten steps instead of 1,000, and the infidelity loss, which our experiments do not separate.
Third, the non-unitary step of the circuit relies on post-selection. Without branch selection, the circuit remains at the level of the identity map, which agrees with the argument of Zhang et al. [13 ] that a denoising map must be contractive and that a unitary circuit cannot provide this contraction. With post-selection, the circuit learns, but it concentrates its denoising in the last steps, through ancilla outcomes whose probability falls to 0.006 (§ 5.1 ). The penalized objective indicates that this concentration is not an accident of the optimization (Table 10 ): when training rewards acceptance, the acceptance probability rises by up to six orders of magnitude, but the reduction of the infidelity and the TSTR score fall toward those of the random states, and the strongest penalty returns the sign-split circuit to the identity map. In this design, the denoising and the acceptance of the circuit therefore compete for the same ancilla outcomes.
Privacy of the released records
The privacy measures of the quantum denoiser appear favorable at first sight: no synthetic record lies closer to the training data than 90% of the real test records (q 10 = 0 q_{10} = 0 q 10 = 0 Table 5 and Table 6 ). However, the decoded random states, which contain no information learned from the data, reach the same distance values, so that the distance to the training records reflects the distance of the records to the real distribution as a whole. The classical control and the classical DDPM, whose records carry far more class information, also avoid copying, even with the sampler that starts from noised training records, and their loss-based AUCs equal about 0.48. At the scale of our data, neither the distance measures nor the loss-based test separates the generators. The favorable privacy measures of the quantum denoiser should therefore be read together with its utility, as Stadler et al. [6 ] recommend for synthetic data in general, and the trade-off between privacy and utility of the fully quantum design can be assessed once its records approach the round-trip ceiling. Moreover, the loss-based test is a weak adversary, and attacks that calibrate the loss of every record with shadow models trained on similar data [24 ] may detect membership that it misses.
The analysis of the decoder carries a lesson that extends beyond our model. Every amplitude encoding removes the length of the encoded vector, so that any generator that operates on encoded states requires a classical component that restores it. This component derives from the training data, whether it stores the training lengths as our decoder does or learns a separate model of the lengths, and in both cases it forms a channel that bypasses the quantum circuit. Storing the length in an additional amplitude would move this channel into the circuit, where it would face the same memorization risks as the rest of the record. With exact training lengths, our decoder reveals 59.5% of the training lengths of a family and supports a membership test with an AUC of 0.80 on average over the families, whatever the quality of the generated states (Proposition 2 ). The smoothed bootstrap of Eq. (5) closes this channel without retraining and without a measurable cost in utility, and it lowers the AUC to 0.51 for the nearest adversary and to 0.52 for the adversary that knows the bandwidth, close to the 0.51 of the classical DDPM, which has no such decoder. The smallest family, Startpage, remains the most exposed, with an AUC of 0.61 for the second adversary, so that the empirical protection weakens where the training records of a family are few. The differentially private histogram of Eq. (7) turns this protection into a formal guarantee: for every budget from ϵ = 10 \epsilon= 10 ϵ = 10 ϵ = 0.1 \epsilon= 0.1 ϵ = 0.1 ε ≥ 1 \varepsilon\ge1 ε ≥ 1 Table 7 ). This guarantee covers the lengths only. A release with decoder also exposes the scaling parameters of the codec and the CAE, which derive from D t r D_{\mathrm{tr}} D tr
Feasibility on quantum hardware
The two expectations behind fully quantum denoisers (§ 1 ) can now be examined directly. The first concerns the parameter budget: the denoiser employs 11,520 angles and acts on six qubits with the min–max codec, yet the classical control, with 11,458 parameters and the same formulation, reaches a test infidelity 14 times lower and trains in about 2 minutes against 41 minutes for the circuit (Table 3 ). A classical latent DDPM with 11,404 parameters reaches a TSTR score of 0.442 against 0.114 for the circuit (Table 4 ). At this scale, classical models of the same size therefore make better use of the budget than the circuit. The second expectation concerns the execution on a quantum device, where the cost of post-selection dominates. After training, the mean acceptance probability equals 3.0 × 10 − 7 3.0 \times10^{-7} 3.0 × 1 0 − 7 3.4 × 10 6 3.4 \times10^{6} 3.4 × 1 0 6 Table 9 ). A penalty on low acceptance probabilities lowers the cost to 7.4 runs per record, but only by removing most of the denoising (Table 10 ), and depolarizing noise raises the acceptance probability by mixing the ancilla while it degrades the records (Table 11 ). The read-out with 1,000 shots costs little in comparison, in agreement with Lemma A.2. Training on a quantum device would add the cost of estimating every term of the loss with swap tests (Lemma A.2), on top of the state preparation of Eq. (3) , whose gate count grows exponentially with the number of qubits. At the scale of this study, our design therefore does not indicate a quantum advantage for the generation of malware records, and the competition between denoising and acceptance identifies post-selection as the first challenge for an execution on quantum hardware.
Ethical and dual-use considerations
The generation of malware data raises the question of dual use. Our generators produce latent vectors of 32 features, which contain no executable code, and the decoder of the CAE would map them onto sequences of opcode mnemonics without operands, addresses, or data, from which no executable program can be assembled directly. In this study, the executables were processed only statically, by disassembly, and were not executed. The released artifacts therefore do not extend the capabilities of an attacker beyond those of the public repositories from which the samples come, whereas the privacy analysis addresses the main risk of a release, the disclosure of information about the training records of the data holder.
Limitations and future work
One of the primary limitations of this study is the scope of its evidence. We evaluate a single corpus of 17 families from one repository, with ten seeds, so that the results describe this corpus and its latent representation. The differences that support our conclusions, such as the TSTR differences of 0.49 and 0.56 between the post-selected circuit and the round-trip ceilings, of 0.33 between the circuit and its classical control with the sign-split codec, or of 0.33 between the circuit and the small DDPM, exceed the spread between seeds many times, and the paired differences among them hold in every seed, whereas an evaluation on further corpora would test whether they generalize. The comparison is also limited in its generators: the only generator of another design is the classical latent DDPM. Other classical generators, such as tabular diffusion models [3 ] or conditional GANs [19 ] , and hybrid quantum diffusion models would widen the range against which the fully quantum design is placed, although the scores of the latter would not isolate the contribution of a circuit (§ 4.3 ).
A second limitation concerns the design space of the denoiser. We keep the ten steps, the depth of the blocks, and the family-specific first blocks fixed, and we do not separate the design choices in which our model differs from that of Calioppo et al. [14 ] , such as the posterior-mean target, the narrow initialization, and the conditioning on the family. In particular, 88.5% of the angles lie in the family-specific blocks, whereas every parameter of the classical control serves all families, so that the two denoisers match in their number of parameters but not in their allocation. A third limitation concerns the execution of the circuits, which we simulate with exact state vectors and with a depolarizing channel of uniform strength. Real devices add readout errors, crosstalk, and drift, which our noise model does not capture.
A fourth limitation lies in the representation and in the privacy evaluation. We evaluate the generated records in the latent space of the CAE and do not decode them into opcode sequences, so that we cannot judge whether the decoded sequences resemble executable programs. The CAE reads only the first 7,000 opcodes, which cover the whole program for 17% of the records, and its latent vectors reach a macro-F1 score of 0.635 against 0.749 for opcode unigram and bigram frequencies of the whole program (§ 5.2 ), so that they summarize a program coarsely. On the privacy side, our membership tests employ the generator and the re-leased lengths, but not shadow models, and the differentially private lengths leave the CAE and the scaling parameters of the codec unprotected (§ 6.2 ).
Based on the results, we propose several directions to improve the fully quantum denoiser. First, since denoising and acceptance compete for the same ancillary outcomes in our design, amplitude amplification of the accepted branch, or circuits whose non-unitary step does not rely on rare outcomes, may raise the acceptance probability without removing the denoising. Second, encodings that separate the families, totogether with a conditioning of every block on the family, may give the loss a stronger signal about the family, and a larger number of steps may reduce the contraction of the samples toward the family means. Third, an encoder trained on public programs and scaling parameters estimated with a privacy guarantee would extend the guarantee of the lengths to the complete release with decoder. Since the decoder runs after sampling, each of these changes keeps the length protection of Proposition 2 intact.
Conclusion
In this research, we presented a fully quantum latent diffusion model for malware records, in which a reverse-bottleneck circuit with one ancilla measurement denoised amplitude-encoded latent vectors of opcode sequences without any classical neural layer, and we examined whether such a model can generate useful and private security records at a sampling cost that quantum hardware can afford.
The circuit learned its objective: with post-selection, it lowered the infidelity of its denoising steps by 63% relative to the identity map and moved its samples toward the data distribution, the theorem, the propositions, and the lemmas that we established on its target, initialization, training, read-out, and decoder held in every numerical test, and an independent PennyLane implementation reproduced every run to within 8.1 × 10 − 8 8.1 \times10^{-8} 8.1 × 1 0 − 8 1.6 × 10 − 7 1.6 \times10^{-7} 1.6 × 1 0 − 7 ε ≥ 1 \varepsilon\ge1 ε ≥ 1
These results suggest that a low training loss and a small parameter budget form a necessary first step toward a quantum generator of sensitive data, and that the utility and the privacy of its samples, measured together with the cost of sampling them, determine whether such a generator can serve as a source of shareable data. Moreover, the privacy analysis must include the classical encoding and decoding around the circuit, where our decoder initially exposed membership information that the circuit itself never processed.
Two limitations of our study deserve attention. First, our evidence comes from a single corpus of 17 families, evaluated in the latent space of an encoder that reads only the first 7,000 opcodes of a program and retains less family information than opcode frequencies. Second, we simulated the circuits with exact state vectors and a uniform depolarizing channel, so that the behavior on real devices with readout errors and drift remains untested.
We plan to improve the utility first, since it precedes any hardware study. Since denoising and acceptance compete for the same ancilla outcomes in the current design, we will examine non-unitary steps that do not rely on rare outcomes, such as amplitude amplification of the accepted branch, together with encodings that separate the families and a conditioning of every block on the family. We will also train the encoder and the scaling parameters of the codec on public programs, so that the guarantee of the lengths extends to a release with decoder, and assess the decoded opcode sequences of further malware corpora.
As quantum processors gain qubits and reliable mid-circuit measurements, a joint evaluation of utility and privacy that accounts for the cost of sampling can determine when a quantum generator becomes a credible source of shareable security data.
Declaration of generative AI use
During the preparation of this work, the authors used Claude (Anthropic) to assist with language editing, code documentation, and the drafting of parts of the manuscript. After using this tool, the authors reviewed and edited the content as needed and take full responsibility for the content of the published article.
Author contributions
Ban Q. Tran: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Data curation, Visualization, Writing – original draft. Quang Duy Tran: Data curation, Validation, Writing – review & editing. Anh H. Nguyen: Software, Validation, Writing – review & editing. Ziwen Pan: Methodology, Writing – review & editing. Tommy Dang: Resources, Writing – review & editing. Susan Mengel: Conceptualization, Supervision, Resources, Writing – review & editing.
Declaration of competing interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.
Acknowledgements
We thank Texas Tech University and its REMotely-managed Power Aware Computing Systems and Services (REPACSS) for providing the high-performance computing servers on which we ran the experiments of this study. This research was partially funded by FPT University.
Data availability
The malware samples are available from the public repository VirusShare. The hashes and family labels of the samples and the source code of this study are available from the authors upon request.
Proofs and supplementary results
Proof of Theorem 1
Proof. Posterior. With ϵ ∼ C N ( 0 , 2 I D ) \epsilon\sim\mathcal{CN}(0,2I_D) ϵ ∼ C N ( 0 , 2 I D ) β t \beta_t β t [1 ] :
q ( x t − 1 ∣ x t , x 0 ) = C N ( μ ~ t , 2 β ~ t I D ) , β ~ t = 1 − α ˉ t − 1 1 − α ˉ t β t . (45) q(x_{t-1} \mid x_t,x_0)=\mathcal{CN}\left(\tilde{\mu}_t,2\tilde{\beta}_t I_D\right),\qquad\tilde{\beta}_t=\frac{1-\bar{\alpha}_{t-1}}{1-\bar{\alpha}_t}\beta_t. \tag*{(45)} q ( x t − 1 ∣ x t , x 0 ) = C N ( μ ~ t , 2 β ~ t I D ) , β ~ t = 1 − α ˉ t 1 − α ˉ t − 1 β t . (45) In this posterior, β ~ t \tilde{\beta}_t β ~ t t = 1 t=1 t = 1 β ~ 1 = 0 \tilde{\beta}_1=0 β ~ 1 = 0 x 0 = μ ~ 1 x_0=\tilde{\mu}_1 x 0 = μ ~ 1 (41) holds with λ 1 = 1 \lambda_1=1 λ 1 = 1 λ 2 = 0 \lambda_2=0 λ 2 = 0 t ≥ 2 t\geq2 t ≥ 2 β ~ t > 0 \tilde{\beta}_t>0 β ~ t > 0 x t − 1 = μ ~ t + β ~ t ξ x_{t-1}=\tilde{\mu}_t+\sqrt{\tilde{\beta}_t}\,\xi x t − 1 = μ ~ t + β ~ t ξ ξ ∼ C N ( 0 , 2 I D ) \xi\sim\mathcal{CN}(0,2I_D) ξ ∼ C N ( 0 , 2 I D ) μ ~ t ≠ 0 \tilde{\mu}_t\neq0 μ ~ t = 0 μ ^ = μ ~ t / ∥ μ ~ t ∥ 2 \hat{\mu}=\tilde{\mu}_t/\|\tilde{\mu}_t\|_2 μ ^ = μ ~ t /∥ μ ~ t ∥ 2 ∣ μ ^ ⟩ = ∣ μ ~ t ⟩ |\hat{\mu}\rangle=|\tilde{\mu}_t\rangle ∣ μ ^ ⟩ = ∣ μ ~ t ⟩
Second-moment operator. Conditional on ( x t , x 0 ) (x_t,x_0) ( x t , x 0 ) (41) equals 1 − Tr ( M ϱ ) 1-\operatorname{Tr}(M\varrho) 1 − Tr ( M ϱ ) M = E [ ∣ x ^ t − 1 ⟩ ⟨ x ^ t − 1 ∣ ] M=\mathbb{E}[|\hat{x}_{t-1}\rangle\langle\hat{x}_{t-1}|] M = E [ ∣ x ^ t − 1 ⟩ ⟨ x ^ t − 1 ∣ ] V V V V μ ^ = μ ^ V\hat{\mu}=\hat{\mu} V μ ^ = μ ^ ξ \xi ξ V x t − 1 = μ ~ t + β ~ t V ξ Vx_{t-1}=\tilde{\mu}_t+\sqrt{\tilde{\beta}_t}V\xi V x t − 1 = μ ~ t + β ~ t V ξ x t − 1 x_{t-1} x t − 1 V M V † = M VMV^\dagger=M V M V † = M V = ∣ μ ^ ⟩ ⟨ μ ^ ∣ − ( I − ∣ μ ^ ⟩ ⟨ μ ^ ∣ ) V=|\hat{\mu}\rangle\langle\hat{\mu}|-(I-|\hat{\mu}\rangle\langle\hat{\mu}|) V = ∣ μ ^ ⟩ ⟨ μ ^ ∣ − ( I − ∣ μ ^ ⟩ ⟨ μ ^ ∣ ) M M M span { μ ^ } \operatorname{span}\{\hat{\mu}\} span { μ ^ } μ ^ ⊥ \hat{\mu}^{\perp} μ ^ ⊥ V = ∣ μ ^ ⟩ ⟨ μ ^ ∣ + W V=|\hat{\mu}\rangle\langle\hat{\mu}|+W V = ∣ μ ^ ⟩ ⟨ μ ^ ∣ + W W W W μ ^ ⊥ \hat{\mu}^{\perp} μ ^ ⊥ M M M μ ^ ⊥ \hat{\mu}^{\perp} μ ^ ⊥ μ ^ ⊥ \hat{\mu}^{\perp} μ ^ ⊥
M = λ 1 ∣ μ ^ ⟩ ⟨ μ ^ ∣ + λ 2 ( I − ∣ μ ^ ⟩ ⟨ μ ^ ∣ ) , M=\lambda_1|\hat{\mu}\rangle\langle\hat{\mu}|+\lambda_2\left(I-|\hat{\mu}\rangle\langle\hat{\mu}|\right), M = λ 1 ∣ μ ^ ⟩ ⟨ μ ^ ∣ + λ 2 ( I − ∣ μ ^ ⟩ ⟨ μ ^ ∣ ) , λ 1 + ( D − 1 ) λ 2 = Tr M = 1. (46) \lambda_1+(D-1)\lambda_2=\operatorname{Tr}M=1. \tag*{(46)} λ 1 + ( D − 1 ) λ 2 = Tr M = 1. (46) In this decomposition, λ 1 = E ∣ ⟨ μ ^ ∣ x ^ t − 1 ⟩ ∣ 2 \lambda_1=\mathbb{E}|\langle\hat{\mu}|\hat{x}_{t-1}\rangle|^2 λ 1 = E ∣ ⟨ μ ^ ∣ x ^ t − 1 ⟩ ∣ 2 λ 2 = E ∣ ⟨ e ∣ x ^ t − 1 ⟩ ∣ 2 \lambda_2=\mathbb{E}|\langle e|\hat{x}_{t-1}\rangle|^2 λ 2 = E ∣ ⟨ e ∣ x ^ t − 1 ⟩ ∣ 2 e ⊥ μ ^ e\perp\hat{\mu} e ⊥ μ ^ M M M Tr ( M ϱ ) = λ 2 + ( λ 1 − λ 2 ) ⟨ μ ^ ∣ ϱ ∣ μ ^ ⟩ \operatorname{Tr}(M\varrho)=\lambda_2+(\lambda_1-\lambda_2)\langle\hat{\mu}|\varrho|\hat{\mu}\rangle Tr ( M ϱ ) = λ 2 + ( λ 1 − λ 2 ) ⟨ μ ^ ∣ ϱ ∣ μ ^ ⟩ (41) .
Ordering of the constants. Let e 1 = μ ^ , e 2 , … , e D e_1=\hat{\mu},e_2,\ldots,e_D e 1 = μ ^ , e 2 , … , e D y j = ⟨ e j ∣ x t − 1 ⟩ y_j=\langle e_j|x_{t-1}\rangle y j = ⟨ e j ∣ x t − 1 ⟩ y j y_j y j y 1 = m + β ~ t ξ 1 y_1=m+\sqrt{\tilde{\beta}_t}\,\xi_1 y 1 = m + β ~ t ξ 1 m = ∥ μ ~ t ∥ 2 > 0 m=\|\tilde{\mu}_t\|_2>0 m = ∥ μ ~ t ∥ 2 > 0 y j = β ~ t ξ j y_j=\sqrt{\tilde{\beta}_t}\,\xi_j y j = β ~ t ξ j j ≥ 2 j\geq2 j ≥ 2 ξ j = ⟨ e j ∣ ξ ⟩ \xi_j=\langle e_j|\xi\rangle ξ j = ⟨ e j ∣ ξ ⟩ A = ∣ y 1 ∣ 2 A=|y_1|^2 A = ∣ y 1 ∣ 2 B = ∣ y 2 ∣ 2 B=|y_2|^2 B = ∣ y 2 ∣ 2 W = ∑ j ≥ 3 ∣ y j ∣ 2 W=\sum_{j\geq3}|y_j|^2 W = ∑ j ≥ 3 ∣ y j ∣ 2
λ 1 − λ 2 = E [ g ( A ) ] , g ( a ) = a − B a + B + W . (47) \lambda_1-\lambda_2=\mathbb{E}[g(A)],\qquad g(a)=\frac{a-B}{a+B+W}. \tag*{(47)} λ 1 − λ 2 = E [ g ( A )] , g ( a ) = a + B + W a − B . (47) In this expression, g g g a a a B + W > 0 B+W>0 B + W > 0 A ′ = β ~ t ∣ ξ 1 ∣ 2 A'=\tilde{\beta}_t|\xi_1|^2 A ′ = β ~ t ∣ ξ 1 ∣ 2 A A A m = 0 m=0 m = 0 A ′ A' A ′ B B B W W W E [ g ( A ′ ) ] = 0 \mathbb{E}[g(A')]=0 E [ g ( A ′ )] = 0 ξ 1 = u + i v \xi_1=u+iv ξ 1 = u + i v u , v ∼ N ( 0 , 1 ) u,v\sim\mathcal{N}(0,1) u , v ∼ N ( 0 , 1 ) δ = m / β ~ t > 0 \delta=m/\sqrt{\tilde{\beta}_t}>0 δ = m / β ~ t > 0 s > 0 s>0 s > 0 δ ↦ Pr ( ∣ u + δ ∣ ≤ s ) = Φ ( s − δ ) − Φ ( − s − δ ) \delta\mapsto\Pr(|u+\delta|\leq s)=\Phi(s-\delta)-\Phi(-s-\delta) δ ↦ Pr ( ∣ u + δ ∣ ≤ s ) = Φ ( s − δ ) − Φ ( − s − δ ) φ ( s + δ ) − φ ( s − δ ) < 0 \varphi(s+\delta)-\varphi(s-\delta)<0 φ ( s + δ ) − φ ( s − δ ) < 0 δ > 0 \delta>0 δ > 0 Φ \Phi Φ φ \varphi φ v v v Pr ( A ≤ c ∣ v ) < Pr ( A ′ ≤ c ∣ v ) \Pr(A\leq c\mid v)<\Pr(A'\leq c\mid v) Pr ( A ≤ c ∣ v ) < Pr ( A ′ ≤ c ∣ v ) c > β ~ t v 2 c>\tilde{\beta}_t v^2 c > β ~ t v 2 Pr ( A ≤ c ) < Pr ( A ′ ≤ c ) \Pr(A\leq c)<\Pr(A'\leq c) Pr ( A ≤ c ) < Pr ( A ′ ≤ c ) c > 0 c>0 c > 0 A A A A ′ A' A ′ ( B , W ) (B,W) ( B , W ) A , A ′ A,A' A , A ′ E [ g ( A ) ] − E [ g ( A ′ ) ] = E ∫ 0 ∞ g ′ ( a ) ( Pr ( A ′ ≤ a ) − Pr ( A ≤ a ) ) d a > 0 \mathbb{E}[g(A)]-\mathbb{E}[g(A')]=\mathbb{E}\int_0^\infty g'(a)\bigl(\Pr(A'\leq a)-\Pr(A\leq a)\bigr)\,da>0 E [ g ( A )] − E [ g ( A ′ )] = E ∫ 0 ∞ g ′ ( a ) ( Pr ( A ′ ≤ a ) − Pr ( A ≤ a ) ) d a > 0 λ 1 > λ 2 \lambda_1>\lambda_2 λ 1 > λ 2
Proof of Proposition 1
Proof. Every angle θ \theta θ e − i θ Q / 2 = cos ( θ / 2 ) I − i sin ( θ / 2 ) Q e^{-i\theta Q/2}=\cos(\theta/2)I-i\sin(\theta/2)Q e − i θ Q /2 = cos ( θ /2 ) I − i sin ( θ /2 ) Q Q Q Q θ ∼ N ( 0 , σ 2 ) \theta\sim\mathcal{N}(0,\sigma^2) θ ∼ N ( 0 , σ 2 ) E cos ( θ / 2 ) = e − σ 2 / 8 \mathbb{E}\cos(\theta/2)=e^{-\sigma^2/8} E cos ( θ /2 ) = e − σ 2 /8 E sin ( θ / 2 ) = 0 \mathbb{E}\sin(\theta/2)=0 E sin ( θ /2 ) = 0 E [ e − i θ Q / 2 ] = e − σ 2 / 8 I \mathbb{E}[e^{-i\theta Q/2}]=e^{-\sigma^2/8}I E [ e − i θ Q /2 ] = e − σ 2 /8 I R ( Θ l ) R(\Theta_l) R ( Θ l ) 3 m 3m 3 m e − 3 m σ 2 / 8 I e^{-3m\sigma^2/8}I e − 3 m σ 2 /8 I (15) equals e − N σ 2 / 8 E 0 ⋯ E L − 1 = e − N σ 2 / 8 I e^{-N\sigma^2/8}E_0\cdots E_{L-1}=e^{-N\sigma^2/8}I e − N σ 2 /8 E 0 ⋯ E L − 1 = e − N σ 2 /8 I C − 1 C = I C^{-1}C=I C − 1 C = I L L L Θ = 0 \Theta=0 Θ = 0 U ( 0 ) = I U(0)=I U ( 0 ) = I ∣ v ⟩ |v\rangle ∣ v ⟩ ∥ U ∣ v ⟩ − ∣ v ⟩ ∥ 2 2 = 2 − 2 Re ⟨ v ∣ U ∣ v ⟩ \|U|v\rangle-|v\rangle\|_2^2=2-2\operatorname{Re}\langle v|U|v\rangle ∥ U ∣ v ⟩ − ∣ v ⟩ ∥ 2 2 = 2 − 2 Re ⟨ v ∣ U ∣ v ⟩ 2 ( 1 − e − N σ 2 / 8 ) 2(1-e^{-N\sigma^2/8}) 2 ( 1 − e − N σ 2 /8 )
For the ancilla, ( ⟨ 1 ∣ a ⊗ I ) ( ∣ 0 ⟩ a ⊗ ∣ v ⟩ ) = 0 (\langle1|_a\otimes I)(|0\rangle_a\otimes|v\rangle)=0 (⟨ 1 ∣ a ⊗ I ) ( ∣0 ⟩ a ⊗ ∣ v ⟩) = 0 ∣ v ⟩ |v\rangle ∣ v ⟩ ∣ v ⟩ = U 1 ( k , t ) ∣ x t ⟩ |v\rangle=U_1^{(k,t)}|x_t\rangle ∣ v ⟩ = U 1 ( k , t ) ∣ x t ⟩
p 1 = ∥ ( ⟨ 1 ∣ a ⊗ I ) ( U 2 ( t ) − I ) ( ∣ 0 ⟩ a ⊗ ∣ v ⟩ ) ∥ 2 2 ≤ ∥ ( U 2 ( t ) − I ) ( ∣ 0 ⟩ a ⊗ ∣ v ⟩ ) ∥ 2 2 . (48) p_1=\left\|(\langle1|_a\otimes I)(U_2^{(t)}-I)(|0\rangle_a\otimes|v\rangle)\right\|_2^2
\leq\left\|(U_2^{(t)}-I)(|0\rangle_a\otimes|v\rangle)\right\|_2^2. \tag*{(48)} p 1 = (⟨ 1 ∣ a ⊗ I ) ( U 2 ( t ) − I ) ( ∣0 ⟩ a ⊗ ∣ v ⟩) 2 2 ≤ ( U 2 ( t ) − I ) ( ∣0 ⟩ a ⊗ ∣ v ⟩) 2 2 . (48) In this bound, the right-hand side has the expectation 2 ( 1 − e − N σ 2 / 8 ) 2(1-e^{-N\sigma^2/8}) 2 ( 1 − e − N σ 2 /8 ) U 2 ( t ) U_2^{(t)} U 2 ( t ) ∣ v ⟩ |v\rangle ∣ v ⟩ E [ p 0 ∣ ∣ x t ⟩ , ∣ y ⟩ ] ≥ c : = 2 e − N σ 2 / 8 − 1 \mathbb{E}[p_0\mid|x_t\rangle,|y\rangle]\geq c:=2e^{-N\sigma^2/8}-1 E [ p 0 ∣ ∣ x t ⟩ , ∣ y ⟩] ≥ c := 2 e − N σ 2 /8 − 1 t t t U 1 ( k , t ) U_1^{(k,t)} U 1 ( k , t ) θ 2 [ t ] \theta_2[t] θ 2 [ t ] t = 1 , 2 , … , T t=1,2,\ldots,T t = 1 , 2 , … , T E [ P a c c ] = E [ ∏ t p 0 ( t ) ] ≥ c T \mathbb{E}[P_{\mathrm{acc}}]=\mathbb{E}\left[\prod_t p_0^{(t)}\right]\geq c^T E [ P acc ] = E [ ∏ t p 0 ( t ) ] ≥ c T c ≥ 0 c\geq0 c ≥ 0
Smoothness and convergence of training
The first supplementary result bounds the derivatives of the losses and the resulting convergence of gradient-based training. Convergence analyses of neural networks often assume a convex or strongly convex objective, which deep models do not satisfy; the bounds below follow from the circuit itself.
Lemma A.1 (Smoothness and convergence). Let ℓ ( θ ) \ell(\theta) ℓ ( θ ) ( x 0 , x t , ϵ ) (x_0,x_t,\epsilon) ( x 0 , x t , ϵ ) P P P ∂ i \partial_i ∂ i i i i ∣ ∂ i ℓ t r ∣ ≤ 1 2 |\partial_i\ell_{\mathrm{tr}}|\leq\frac{1}{2} ∣ ∂ i ℓ tr ∣ ≤ 2 1 ∣ ∂ i ∂ j ℓ t r ∣ ≤ 1 2 |\partial_i\partial_j\ell_{\mathrm{tr}}|\leq\frac{1}{2} ∣ ∂ i ∂ j ℓ tr ∣ ≤ 2 1 i , j i,j i , j ∥ ∇ ℓ t r ∥ 2 ≤ G = P / 2 \|\nabla\ell_{\mathrm{tr}}\|_2\leq G=\sqrt{P/2} ∥∇ ℓ tr ∥ 2 ≤ G = P /2 ∇ ℓ t r \nabla\ell_{\mathrm{tr}} ∇ ℓ tr Λ \Lambda Λ Λ = P / 2 \Lambda=P/2 Λ = P /2 p 0 ≥ p min > 0 p_0\geq p_{\min}>0 p 0 ≥ p m i n > 0 ∣ ∂ i ℓ p s ∣ ≤ 1 / p min |\partial_i\ell_{\mathrm{ps}}|\leq1/p_{\min} ∣ ∂ i ℓ ps ∣ ≤ 1/ p m i n ∣ ∂ i ∂ j ℓ p s ∣ ≤ 2 / p min 2 |\partial_i\partial_j\ell_{\mathrm{ps}}|\leq2/p_{\min}^2 ∣ ∂ i ∂ j ℓ ps ∣ ≤ 2/ p m i n 2 G = P / p min G=\sqrt{P}/p_{\min} G = P / p m i n Λ = 2 P / p min 2 \Lambda=2P/p_{\min}^2 Λ = 2 P / p m i n 2 L \mathcal{L} L (24) with mini-batches of B B B η ≤ 1 / Λ \eta\le1/\Lambda η ≤ 1/Λ p 0 ≥ p min p_0 \ge p_{\min} p 0 ≥ p m i n J J J
1 J ∑ j = 0 J − 1 E ∥ ∇ L ( θ j ) ∥ 2 2 ≤ 2 η J + η Λ G 2 B . (49) \frac{1}{J}\sum_{j=0}^{J-1}\mathbb{E}\left\|\nabla\mathcal{L}(\theta_j)\right\|_2^2 \le\frac{2}{\eta J}+\frac{\eta\Lambda G^2}{B}. \tag*{(49)} J 1 j = 0 ∑ J − 1 E ∥ ∇ L ( θ j ) ∥ 2 2 ≤ η J 2 + B η Λ G 2 . (49) In this bound, the first term represents the decrease of the gradient norm with the number of steps, and the second term denotes the floor caused by the variance of the stochastic gradients. With η = min { 1 / Λ , 2 B / ( Λ G 2 J ) } \eta=\min\{1/\Lambda,\sqrt{2B/(\Lambda G^2J)}\} η = min { 1/Λ , 2 B / ( Λ G 2 J ) } O ( 1 / J ) O(1/\sqrt{J}) O ( 1/ J ) Λ \Lambda Λ G G G [54 , 55 ] makes every loss a trigonometric polynomial of degree one in each angle, and the loss lies in [ 0 , 1 ] [0,1] [ 0 , 1 ] p 0 p_0 p 0 [71 ] . Since the constants hold for the worst case, the step size that part (iii) requires for the post-selected circuit, η ≤ 1 / Λ ≤ 1.7 × 10 − 4 \eta\le1/\Lambda\le1.7\times10^{-4} η ≤ 1/Λ ≤ 1.7 × 1 0 − 4 0.01 0.01 0.01
Proof. Structure of the losses. Without branch selection,
1 − ℓ t r = Tr [ ( I a ⊗ U 3 ( t ) † ) ∣ μ ~ t ⟩ ⟨ μ ~ t ∣ ( I a ⊗ U 3 ( t ) ) ( ∣ 0 ⟩ ⟨ 0 ∣ a ⊗ U 2 ( t ) ( ∣ x t ⟩ ⟨ x t ∣ ) U 2 ( t ) † ) ] . (50) 1-\ell_{\mathrm{tr}}=\operatorname{Tr}\left[\left(I_a\otimes U_3^{(t)\dagger}\right)|\widetilde{\mu}_t\rangle\langle\widetilde{\mu}_t|\left(I_a\otimes U_3^{(t)}\right)\left(|0\rangle\langle0|_a\otimes U_2^{(t)}\left(|x_t\rangle\langle x_t|\right)U_2^{(t)\dagger}\right)\right]. \tag*{(50)} 1 − ℓ tr = Tr [ ( I a ⊗ U 3 ( t ) † ) ∣ μ t ⟩ ⟨ μ t ∣ ( I a ⊗ U 3 ( t ) ) ( ∣0 ⟩ ⟨ 0 ∣ a ⊗ U 2 ( t ) ( ∣ x t ⟩ ⟨ x t ∣ ) U 2 ( t ) † ) ] . (50) In this expression, the trace is the probability of an outcome of a measurement, so ℓ t r ∈ [ 0 , 1 ] \ell_{\mathrm{tr}}\in[0,1] ℓ tr ∈ [ 0 , 1 ] cos ( θ i / 2 ) I − i sin ( θ i / 2 ) Q \cos(\theta_i/2)I-i\sin(\theta_i/2)Q cos ( θ i /2 ) I − i sin ( θ i /2 ) Q 1 − ℓ t r 1-\ell_{\mathrm{tr}} 1 − ℓ tr ( cos θ i , sin θ i ) (\cos\theta_i,\sin\theta_i) ( cos θ i , sin θ i ) θ i \theta_i θ i ℓ p s = 1 − g / p 0 \ell_{\mathrm{ps}}=1-g/p_0 ℓ ps = 1 − g / p 0 g = ∣ ⟨ μ ~ t ∣ U 3 ( t ) ( ⟨ 0 ∣ a ⊗ I ) U 2 ( t ) ( ∣ 0 ⟩ a ⊗ U 1 ( k , t ) ∣ x t ⟩ ) ∣ 2 g=\left|\langle\widetilde{\mu}_t|U_3^{(t)}(\langle0|_a\otimes I)U_2^{(t)}(|0\rangle_a\otimes U_1^{(k,t)}|x_t\rangle)\right|^2 g = ⟨ μ t ∣ U 3 ( t ) (⟨ 0 ∣ a ⊗ I ) U 2 ( t ) ( ∣0 ⟩ a ⊗ U 1 ( k , t ) ∣ x t ⟩) 2 p 0 p_0 p 0 0 ≤ g ≤ p 0 ≤ 1 0\le g\le p_0\le1 0 ≤ g ≤ p 0 ≤ 1
Derivative bounds. Let f ∈ [ 0 , 1 ] f\in[0,1] f ∈ [ 0 , 1 ] e i e_i e i i i i s = π / 2 s=\pi/2 s = π /2 [54 , 55 ] gives, for i ≠ j i\ne j i = j
∂ i f = 1 2 [ f ( θ + s e i ) − f ( θ − s e i ) ] , \partial_i f=\frac{1}{2}\left[f(\theta+se_i)-f(\theta-se_i)\right], ∂ i f = 2 1 [ f ( θ + s e i ) − f ( θ − s e i ) ] , ∂ i ∂ j f = 1 4 [ f + + − f + − − f − + + f − − ] , \partial_i\partial_j f=\frac{1}{4}\left[f_{++}-f_{+-}-f_{-+}+f_{--}\right], ∂ i ∂ j f = 4 1 [ f ++ − f +− − f −+ + f −− ] , ∂ i 2 f = − ( f − a i ) . (51) \partial_i^2 f=-(f-a_i). \tag*{(51)} ∂ i 2 f = − ( f − a i ) . (51) In these identities, f ± ± f_{\pm\pm} f ±± f f f θ ± s e i ± s e j \theta\pm se_i\pm se_j θ ± s e i ± s e j a i a_i a i f f f θ i \theta_i θ i f ∈ [ 0 , 1 ] f\in[0,1] f ∈ [ 0 , 1 ] [ − 1 / 2 , 1 / 2 ] [-1/2,1/2] [ − 1/2 , 1/2 ] ∣ f − a i ∣ ≤ 1 2 ( max θ i f − min θ i f ) ≤ 1 2 |f-a_i|\le\frac{1}{2}(\max_{\theta_i}f-\min_{\theta_i}f)\le\frac{1}{2} ∣ f − a i ∣ ≤ 2 1 ( max θ i f − min θ i f ) ≤ 2 1 f = 1 − ℓ t r f=1-\ell_{\mathrm{tr}} f = 1 − ℓ tr ∥ ∇ ℓ t r ∥ 2 ≤ P / 2 \|\nabla\ell_{\mathrm{tr}}\|_2\le\sqrt{P}/2 ∥∇ ℓ tr ∥ 2 ≤ P /2 ∥ ∇ 2 ℓ t r ∥ 2 ≤ ∥ ∇ 2 ℓ t r ∥ F ≤ P / 2 \|\nabla^2\ell_{\mathrm{tr}}\|_2\le\|\nabla^2\ell_{\mathrm{tr}}\|_F\le P/2 ∥ ∇ 2 ℓ tr ∥ 2 ≤ ∥ ∇ 2 ℓ tr ∥ F ≤ P /2 g g g p 0 p_0 p 0 g ≤ p 0 g\le p_0 g ≤ p 0
∣ ∂ i g p 0 ∣ ≤ ∣ ∂ i g ∣ p 0 + g ∣ ∂ i p 0 ∣ p 0 2 ≤ 1 p 0 , \left|\partial_i\frac{g}{p_0}\right|\le\frac{|\partial_i g|}{p_0}+\frac{g|\partial_i p_0|}{p_0^2}\le\frac{1}{p_0}, ∂ i p 0 g ≤ p 0 ∣ ∂ i g ∣ + p 0 2 g ∣ ∂ i p 0 ∣ ≤ p 0 1 , ∣ ∂ i ∂ j g p 0 ∣ ≤ 1 p 0 + 1 p 0 2 ≤ 2 p 0 2 . (52) \left|\partial_i\partial_j\frac{g}{p_0}\right|\le\frac{1}{p_0}+\frac{1}{p_0^2}\le\frac{2}{p_0^2}. \tag*{(52)} ∂ i ∂ j p 0 g ≤ p 0 1 + p 0 2 1 ≤ p 0 2 2 . (52) In these bounds, the second inequality expands the second derivative of the quotient into four terms, which are bounded by 1 2 p 0 \frac{1}{2p_0} 2 p 0 1 1 2 p 0 2 \frac{1}{2p_0^2} 2 p 0 2 1 1 p 0 \frac{1}{p_0} p 0 1 1 2 p 0 2 \frac{1}{2p_0^2} 2 p 0 2 1
Convergence. The objective L \mathcal{L} L Λ \Lambda Λ g ^ j \hat{g}_j g ^ j B B B E [ g ^ j ] = ∇ L ( θ j ) \mathbb{E}[\hat{g}_j]=\nabla\mathcal{L}(\theta_j) E [ g ^ j ] = ∇ L ( θ j ) E ∥ g ^ j − ∇ L ( θ j ) ∥ 2 2 ≤ G 2 / B \mathbb{E}\|\hat{g}_j-\nabla\mathcal{L}(\theta_j)\|_2^2\le G^2/B E ∥ g ^ j − ∇ L ( θ j ) ∥ 2 2 ≤ G 2 / B Λ \Lambda Λ η ≤ 1 / Λ \eta\le1/\Lambda η ≤ 1/Λ
E L ( θ j + 1 ) ≤ E L ( θ j ) − η 2 E ∥ ∇ L ( θ j ) ∥ 2 2 + Λ η 2 G 2 2 B . (53) \mathbb{E}\,\mathcal{L}(\theta_{j+1})\le\mathbb{E}\,\mathcal{L}(\theta_j)-\frac{\eta}{2}\mathbb{E}\left\|\nabla\mathcal{L}(\theta_j)\right\|_2^2+\frac{\Lambda\eta^2G^2}{2B}. \tag*{(53)} E L ( θ j + 1 ) ≤ E L ( θ j ) − 2 η E ∥ ∇ L ( θ j ) ∥ 2 2 + 2 B Λ η 2 G 2 . (53) In this recursion, summing over j = 0 , … , J − 1 j=0,\ldots,J-1 j = 0 , … , J − 1 L ( θ 0 ) − L ( θ J ) ≤ 1 \mathcal{L}(\theta_0)-\mathcal{L}(\theta_J)\le1 L ( θ 0 ) − L ( θ J ) ≤ 1 L ∈ [ 0 , 1 ] \mathcal{L}\in[0,1] L ∈ [ 0 , 1 ] η J / 2 \eta J/2 η J /2 [72 ] .
Shot complexity
The second supplementary result bounds the number of measurements required on hardware for the read-out and for the training loss.
Lemma A.2 (Shot complexity). (i) Let p i = ⟨ i ∣ z 0 ⟩ 2 p_i=\langle i|z_0\rangle^2 p i = ⟨ i ∣ z 0 ⟩ 2 S S S ∣ z 0 ⟩ |z_0\rangle ∣ z 0 ⟩ p i p_i p i (30) satisfies
E ∑ i = 0 D − 1 ( ∣ α ^ i ∣ − p i ) 2 ≤ D − 1 S . (54) \mathbb{E}\sum_{i=0}^{D-1}\left(\left|\hat{\alpha}_i\right|-\sqrt{p_i}\right)^2\le\frac{D-1}{S}. \tag*{(54)} E i = 0 ∑ D − 1 ( ∣ α ^ i ∣ − p i ) 2 ≤ S D − 1 . (54) and, for the same drawn length ρ \rho ρ (5) satisfy E ∥ z ^ S − z ∞ ∥ 2 2 ≤ ρ 2 Δ 2 ( D − 1 ) / S \mathbb{E}\|\hat{z}_S-z_\infty\|_2^2\le\rho^2\Delta^2(D-1)/S E ∥ z ^ S − z ∞ ∥ 2 2 ≤ ρ 2 Δ 2 ( D − 1 ) / S Δ = max i ( h i − l i ) \Delta=\max_i(h_i-l_i) Δ = max i ( h i − l i ) F = ⟨ μ ~ t ∣ ρ o u t ∣ μ ~ t ⟩ F=\langle\widetilde{\mu}_t|\rho_{\mathrm{out}}|\widetilde{\mu}_t\rangle F = ⟨ μ t ∣ ρ out ∣ μ t ⟩ S S S F ^ = 2 P ^ 0 − 1 \hat{F}=2\hat{P}_0-1 F ^ = 2 P ^ 0 − 1 P ^ 0 \hat{P}_0 P ^ 0 Pr ( ∣ F ^ − F ∣ ≥ ε ) ≤ 2 e − S ε 2 / 2 \Pr(|\hat{F}-F|\ge\varepsilon)\le2e^{-S\varepsilon^2/2} Pr ( ∣ F ^ − F ∣ ≥ ε ) ≤ 2 e − S ε 2 /2
In this lemma, z ^ S \hat{z}_S z ^ S z ∞ z_\infty z ∞ S S S ( D − 1 ) / S (D-1)/S ( D − 1 ) / S D = 32 D=32 D = 32 S = 1,000 S=1{,}000 S = 1 , 000 0.031 0.031 0.031 S ≥ 2 ln ( 2 / δ ) / ε 2 S\ge2\ln(2/\delta)/\varepsilon^2 S ≥ 2 ln ( 2/ δ ) / ε 2 ε \varepsilon ε 1 − δ 1-\delta 1 − δ [73 ] , which quantifies the cost of evaluating the training objective on a quantum device.
Proof. (i) If p i = 0 p_i=0 p i = 0 c i = 0 c_i=0 c i = 0 p i > 0 p_i>0 p i > 0 p ^ i = c i / S \hat{p}_i=c_i/S p ^ i = c i / S
( p ^ i − p i ) 2 = ( p ^ i − p i ) 2 ( p ^ i + p i ) 2 ≤ ( p ^ i − p i ) 2 p i , \left(\sqrt{\hat{p}_i}-\sqrt{p_i}\right)^2=\frac{(\hat{p}_i-p_i)^2}{\left(\sqrt{\hat{p}_i}+\sqrt{p_i}\right)^2}\le\frac{(\hat{p}_i-p_i)^2}{p_i}, ( p ^ i − p i ) 2 = ( p ^ i + p i ) 2 ( p ^ i − p i ) 2 ≤ p i ( p ^ i − p i ) 2 , E ( p ^ i − p i ) 2 = p i ( 1 − p i ) S . (55) \mathbb{E}(\hat{p}_i-p_i)^2=\frac{p_i(1-p_i)}{S}. \tag*{(55)} E ( p ^ i − p i ) 2 = S p i ( 1 − p i ) . (55) raw: (A.11) (visible equation only; main bibliography omitted) In these relations, the variance stems from the binomial marginal distribution of c i c_i c i ∑ i : p i > 0 ( 1 − p i ) / S ≤ ( D − 1 ) / S \sum_{i:p_i>0}(1-p_i)/S \le(D-1)/S ∑ i : p i > 0 ( 1 − p i ) / S ≤ ( D − 1 ) / S ∣ α ^ i ∣ = p ^ i |\hat{\alpha}_i|=\sqrt{\hat{p}_i} ∣ α ^ i ∣ = p ^ i (5) is affine in the magnitudes, z ^ S − z ^ ∞ = ρ ( h − l ) ⊙ ( ∣ α ^ ∣ − p ) \hat{z}_S-\hat{z}_\infty=\rho(h-l)\odot(|\hat{\alpha}|-\sqrt{p}) z ^ S − z ^ ∞ = ρ ( h − l ) ⊙ ( ∣ α ^ ∣ − p ) P 0 = ( 1 + F ) / 2 P_0=(1+F)/2 P 0 = ( 1 + F ) /2 [52 ] , by linearity also for the mixed state ϱ o u t \varrho_{\mathrm{out}} ϱ out F ^ \hat{F} F ^ [73 ] gives Pr ( ∣ P ^ 0 − P 0 ∣ ≥ ε / 2 ) ≤ 2 e − S ε 2 / 2 \Pr(|\hat{P}_0-P_0|\ge\varepsilon/2)\le2e^{-S\varepsilon^2/2} Pr ( ∣ P ^ 0 − P 0 ∣ ≥ ε /2 ) ≤ 2 e − S ε 2 /2
Proof of Proposition 2
Proof. By Eq. (5) , ( z ^ i − l i ) / ( h i − l i ) = ρ ∣ α ^ i ∣ ≥ 0 (\hat{z}_i-l_i)/(h_i-l_i)=\rho|\hat{\alpha}_i|\ge0 ( z ^ i − l i ) / ( h i − l i ) = ρ ∣ α ^ i ∣ ≥ 0 (2) is inactive and u ( z ^ ) = ρ ∣ α ^ ∣ u(\hat{z})=\rho|\hat{\alpha}| u ( z ^ ) = ρ ∣ α ^ ∣ (30) have unit norm, the latter because ∑ i c i = S \sum_i c_i=S ∑ i c i = S ρ ( z ^ ) = ∥ u ( z ^ ) ∥ 2 = ρ \rho(\hat{z})=\lVert u(\hat{z})\rVert_2=\rho ρ ( z ^ ) = ∥ u ( z ^ ) ∥ 2 = ρ ρ j \rho_j ρ j ζ \zeta ζ z ^ \hat{z} z ^ log ρ = log ρ j + τ k ζ \log\rho=\log\rho_j+\tau_k\zeta log ρ = log ρ j + τ k ζ { log r : r ∈ R k } \{\log r:r\in\mathcal{R}_k\} { log r : r ∈ R k } N ( 0 , τ k 2 ) \mathcal{N}(0,\tau_k^2) N ( 0 , τ k 2 ) (43) . The law of total expectation gives E [ log ρ ] = E [ log ρ j ] = v ˉ k \mathbb{E}[\log\rho]=\mathbb{E}[\log\rho_j]=\bar{v}_k E [ log ρ ] = E [ log ρ j ] = v ˉ k Var [ log ρ ] = Var [ log ρ j ] + τ k 2 \operatorname{Var}[\log\rho]=\operatorname{Var}[\log\rho_j]+\tau_k^2 Var [ log ρ ] = Var [ log ρ j ] + τ k 2 Var [ log ρ j ] = ( 1 − 1 / ∣ R k ∣ ) s k 2 \operatorname{Var}[\log\rho_j]=(1-1/|\mathcal{R}_k|)s_k^2 Var [ log ρ j ] = ( 1 − 1/∣ R k ∣ ) s k 2 τ k > 0 \tau_k>0 τ k > 0 log ρ \log\rho log ρ (43) and therefore assigns probability zero to every single value, so that Pr ( ρ = r ) = Pr ( log ρ = log r ) = 0 \Pr(\rho=r)=\Pr(\log\rho=\log r)=0 Pr ( ρ = r ) = Pr ( log ρ = log r ) = 0 r > 0 r>0 r > 0 τ k = 0 \tau_k=0 τ k = 0 ρ = ρ j \rho=\rho_j ρ = ρ j R k \mathcal{R}_k R k n s n_s n s U ( R k ) \mathcal{U}(\mathcal{R}_k) U ( R k ) R k \mathcal{R}_k R k ( 1 − 1 / ∣ R k ∣ ) n s (1-1/|\mathcal{R}_k|)^{n_s} ( 1 − 1/∣ R k ∣ ) n s u ( z ^ ) = ρ [ max ( 0 , a + − a − ) ; max ( 0 , a − − a + ) ] u(\hat{z})=\rho\left[\max(0,a^+-a^-);\max(0,a^--a^+)\right] u ( z ^ ) = ρ [ max ( 0 , a + − a − ) ; max ( 0 , a − − a + ) ] a ± a^\pm a ± ∣ α ^ ∣ |\hat{\alpha}| ∣ α ^ ∣ ρ \rho ρ
Numerical verification
We verify every statement of Section 3.12 with the PyTorch implementation of Section 3.11 and its default configuration (n = 5 n=5 n = 5 K = 17 K=17 K = 17 T = 10 T=10 T = 10 L 1 = L 2 = L 3 = 4 L_1=L_2=L_3=4 L 1 = L 2 = L 3 = 4 σ = 0.1 \sigma=0.1 σ = 0.1 M M M 10 5 10^5 1 0 5 t ∈ { 2 , 5 , 10 } t\in\{2,5,10\} t ∈ { 2 , 5 , 10 } ( x t , x 0 ) (x_t,x_0) ( x t , x 0 ) (41) for 20 random pure outputs per pair; the leading eigenvalue λ 1 \lambda_1 λ 1 U ( Θ ) U(\Theta) U ( Θ ) ( k , t ) (k,t) ( k , t ) π \pi π D = 32 D=32 D = 32 10 5 10^5 1 0 5 (5) with part (i) for every family, and draw 512 lengths 200 times for three families of different sizes (Startpage, Expiro.BK, and FakeRean, with 97, 184, and 691 training records), with τ k = 0 \tau_k=0 τ k = 0 (6) . On the raw data, the membership test of Eq. (38) , with the validation and test records of each family as non-members, reaches a mean AUC of 0.998, 0.968, and 0.767 for these families with τ k = 0 \tau_k=0 τ k = 0 (6) .
Table B.1. Numerical verification of Theorem 1 , Propositions 1 and 2 , and Lemmas A.1 and A.2 with the implementation of § 3.11 (n = 5 n=5 n = 5 K = 17 K=17 K = 17 T = 10 T=10 T = 10 L 1 = L 2 = L 3 = 4 L_1=L_2=L_3=4 L 1 = L 2 = L 3 = 4 σ = 0.1 \sigma=0.1 σ = 0.1 U U U p 1 p_1 p 1 P a c c P_{\mathrm{acc}} P acc
