A Numerical Gradient Inversion Attack in Variational Quantum Neural-Networks
This addresses a security vulnerability in quantum machine learning for practitioners, but it is incremental as it builds on gradient inversion methods from classical networks.
The paper tackles the challenge of recovering input training data from gradients in Variational Quantum Neural Networks (VQNNs), which is harder than in classical networks due to exponential local minima growth with qubits, and presents a numerical scheme that successfully reconstructs real-world data from VQNN gradients, even for batch-trained data when the model is over-parameterized.
The loss landscape of Variational Quantum Neural Networks (VQNNs) is characterized by local minima that grow exponentially with increasing qubits. Because of this, it is more challenging to recover information from model gradients during training compared to classical Neural Networks (NNs). In this paper we present a numerical scheme that successfully reconstructs input training, real-world, practical data from trainable VQNNs' gradients. Our scheme is based on gradient inversion that works by combining gradients estimation with the finite difference method and adaptive low-pass filtering. The scheme is further optimized with Kalman filter to obtain efficient convergence. Our experiments show that our algorithm can invert even batch-trained data, given the VQNN model is sufficiently over-parameterized.