{"id":"c5c08211-6702-4112-ba83-60c0eb7f7f2c","arxiv_id":"2504.12806","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A finite-difference gradient inversion attack with adaptive low-pass filtering and Kalman acceleration reconstructs training inputs of small variational quantum neural networks from shared gradients when the model is over-parameterized.","lead":"This paper presents a numerical attack that recovers private training data from the gradients shared during training of variational quantum neural networks. It uses finite differences with an adaptive low-pass filter and a Kalman smoother, and shows success in simulations of models with up to six qubits.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 2's proxy gradients (Eq. 6) omit the loss-derivative factor 2(ŷ−y), so the minimized objective mismatches the FL loss gradients in Eq. 1; without labels or a scale factor the reported inversion is unexplained.","rationale":"The reader's weakest_assumption (shot noise) is real but explicitly outside the paper's scope: the conclusion says 'numerically' and experiments are ideal-statevector; the paper itself suggests hardware noise as a privacy mechanism. By contrast, the label/scale mismatch is internal: it concerns what the algorithm actually minimizes versus what federated clients share, and it affects even the noiseless simulation claimed to reach 1e-10. The reader's rationale noted this issue but did not make it the primary condition; I agree with the overall CONDITIONAL verdict but would add this as the first condition to resolve. The proposed test distinguishes the two interpretations and, if Mode B fails, would invalidate the central FL privacy claim as stated.","tokens_in":22157,"tokens_out":8066,"duration_ms":87120,"concrete_test":"Reproduce the VQNN 2-qubit Cosine Complex row of Table II twice. Mode A: shared gradient g = ∂ŷ/∂θ computed by Eq. 6 on the true x (no label). Mode B: shared gradient g = ∇_θ(ŷ(x)−y)² with the true target y, as required by Eq. 1. Run Algorithm 2 exactly as written (proxy gradients via Eq. 6, no y) from identical random x′ and hyperparameters, until the stated ≤250 iterations. If Mode B fails to reach MSE ≤ 0.005 while Mode A succeeds, the experiments use a different gradient than the FL threat model and the label/scale problem is confirmed. Since no code is provided, this reproduction also requires the missing hyperparameters (h, lr, N, threshold, K) to be specified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The attack is defined against gradients shared in federated learning, which per Eq. 1 are loss gradients: g = −γ/B Σ_b ∂Loss(f(X_b,Θ),Y_b)/∂Θ. For the MSE loss used throughout, g = 2(ŷ(x)−y)·∂ŷ/∂θ. Algorithm 2 (lines 9–13) instead computes the proxy g′ as the parameter-shift gradient of the expectation value ŷ(x′) via Eq. 6, with no label y and no chain-rule factor. The objective in Eq. 7, ||g′−g||², is therefore not minimized at x′=x: at the true input the residual is (1−2(ŷ(x)−y))²||∂ŷ/∂θ||², which is nonzero unless 2(ŷ−y)=1, and x′ is generally not a stationary point of L. Assumption E.1 explicitly denies access to y, and the paper never states how the scale factor is handled. If the experiments instead set g=∂ŷ/∂θ, then the paper attacks a label-free model-output gradient, not the loss gradient a client would share, so the central claim about inverting training data in federated VQNN training is not supported by the reported setups. This is an internal inconsistency in the threat model, not a disagreement with prior consensus.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a numerical gradient inversion attack against variational quantum neural networks (VQNNs) in federated learning. The attack optimizes a proxy input x' to match the gradients g' of a VQNN with the shared gradients g, using finite-difference estimates of the inversion-loss gradient, an adaptive moving-average low-pass filter to avoid local minima, and a Kalman filter for faster convergence. Experiments on cosine regression, MNIST classification, and credit-card fraud data with 2- and 6-qubit models, including batch sizes 2 and 3, report successful input recovery with MSE around 1e-5 to 3e-3 in the main tables, while the abstract and conclusion claim errors down to ~1e-10 in appendix runs. The paper argues that trainable VQNNs are not inherently private and provides a benchmark for evaluating privacy versus utility.","tokens_in":22321,"tokens_out":11889,"duration_ms":113279,"significance":"The contribution is potentially significant: if the central claim holds, it is the first practical gradient-inversion algorithm for VQNNs, challenging earlier results that VQNNs provide inherent privacy. The adaptive low-pass filtering and Kalman acceleration are novel and well-motivated by the oscillatory gradient landscape, and the experiments span regression, classification, real-world fraud data, and batch training. The paper also provides a useful privacy-performance comparison with classical NNs under noise. However, the significance is currently conditional because the attack's proxy gradients (Eq. 6) do not match the defined shared loss gradients (Eq. 1), the headline 1e-10 precision is only reached for near-true starting points, and the attack assumes an exact noiseless gradient oracle. The paper reports experiments on statevector simulators but provides no code, so the pseudocode errors further hinder verification.","major_comments":[{"comment":"The inversion loss in Eq. (7) compares g' with g, but Algorithm 2 computes g' via the parameter-shift rule of Eq. (6), which yields the derivative of the expectation value y-hat with respect to the parameters, not the derivative of the training loss. For the MSE loss used throughout, Eq. (1) defines the shared gradient as g proportional to 2(y-hat - y) times the parameter-shift derivative, so at the true input x the proxy gradient g'(x) differs from g(x) by a label-dependent factor and the learning-rate/batch scaling. Because the true x is therefore not a stationary point of L_{g',g}, the algorithm as described does not minimize the correct objective; this contradicts Assumption V-E.1, which denies access to y. The authors must resolve this mismatch, either by explicitly attacking model-output gradients (partial y-hat / partial theta) and reframing the threat model, or by explaining how the loss-gradient scale is recovered without labels. As written, the experiments do not support the claim that shared FL loss gradients of VQNNs can be inverted.","section":"Section IV-A (Eq. 7); Algorithm 2 (lines 9-13); Eq. (1)"},{"comment":"The abstract and conclusion claim inversion errors down to ~1e-10, but this value is reported in Appendix Fig. 15 for initial vectors x' that are already within approximately 0.005 of the true x (Assumption V-E.3). The main random-start experiments in Table II obtain average MSE values between 2e-5 and 3e-3, with success rates as low as 40% for some 6-qubit models. The '1e-10' is therefore a local refinement result, not a demonstration that the attack converges to the global optimum from an arbitrary starting point in the full domain. The paper should either show 1e-10 precision from random starts or qualify this claim in the abstract and conclusion.","section":"Appendix B (Fig. 15); Assumption V-E.3; Conclusion"},{"comment":"All attack experiments are performed with exact parameter-shift evaluations on noiseless statevector simulators (Section V-A). On physical quantum hardware, the measurements underlying Eq. (6) are shot-noise limited, and the finite-difference estimate in Eq. (8), which divides by 2nh, would be dominated by that noise for small h. The authors themselves observe in Section VI-C that hardware noise could serve as a privacy mechanism. Without any experiment or analysis with noisy gradients, the practical relevance of the attack to real federated VQNN deployment is not established; the abstract and conclusion should restrict the claim to exact-gradient oracles, or the paper should include noisy-gradient experiments.","section":"Section V-A; Section VI-C; Eq. (8)"},{"comment":"The pseudocode in Algorithm 2 does not match Eqs. (8)-(9). Lines 6-17 accumulate loss+ and loss- over n and then compute (loss+ - loss-)/(2nh) at each n using those cumulative sums, rather than evaluating the per-perturbation finite difference [L(x'+n h e_j) - L(x'-n h e_j)]/(2nh). Lines 18-19 do not specify how the average in Eq. (9) is formed, and line 21 writes a sum over '2N' terms although loss+ and loss- already contain N sums each. As written, the algorithm cannot be implemented or reproduced. The authors should provide a corrected pseudocode and, ideally, a reference implementation or code repository.","section":"Algorithm 2 (lines 5-21)"}],"minor_comments":[{"comment":"Assumption 2 states that inversion success is measured using Eq. (7), but Eq. (7) is the gradient-distance loss, not the MSE between x' and x; the text should refer to the MSE metric used in the tables.","section":"Assumption V-E.2"},{"comment":"The notation 'One Shot Success %' is ambiguous. The table reports the average over 10 attacks with different starting points, yet 'one shot' suggests a single run; clarify the terminology and state explicitly that successes are counted per starting point within the maximum 250 iterations.","section":"Table II, Section V-B"},{"comment":"The hyperparameters of the attack (initial moving-average window N, finite-difference step h, learning rate lr, and the threshold for reducing N) are not reported for the experiments in Table II. Providing these values or a link to code is necessary for reproducibility.","section":"Section V-B; Table II"},{"comment":"The truncation error in the finite-difference formula (Eq. (8)) is stated as O(nh); for a centered difference the leading error is O((nh)^2), so the order notation should be corrected.","section":"Eq. (8)"},{"comment":"The statement 'often within a single trial (except 6 qubits at 40%)' is imprecise; specify what constitutes a trial and how the success rate in Table II relates to the trajectories shown in Fig. 7.","section":"Section VI-A, Fig. 7"},{"comment":"The condition for reducing N uses an unexplained 'threshold (gradient change)'; define what quantity is compared and how the threshold is chosen, otherwise the adaptive-filter behavior cannot be reproduced.","section":"Algorithm 2, line 25"}],"recommendation":"major_revision","confidential_remarks":"This manuscript has an internally inconsistent threat model: the proxy gradients in Algorithm 2 are parameter-shift gradients of the model output, while Eq. (1) defines the shared gradients as loss gradients. If the authors cannot reconcile these, the paper's main claim about FL privacy does not hold. I also note that the paper relies heavily on the authors' own prior works ([27], [61], [84]) for the privacy claims and the evaluation metric; the novelty is in the optimization scheme, not in the threat model. The lack of code and the pseudocode errors further hinder verification. With a careful revision that addresses these points, the paper could be acceptable as a numerical study of gradient inversion on VQNNs under an exact-gradient oracle."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper attacks a question worth answering: prior work claimed expressive VQNNs are inherently private against gradient inversion, and this is the first numerical counter-demonstration. The adaptive low-pass filtering over finite-difference step sizes is a plausible heuristic, and the Kalman extension visibly improves convergence in the plots. The comparison with classical DLG and the DP-noise experiments give the paper practical scope, and the writing is clear about the threat model's ambitions.\n\nBut there is a load-bearing mismatch between the threat model and the algorithm. The paper defines the shared gradient g as the loss gradient (Eq. 1), which for MSE is 2(ŷ−y)·∂ŷ/∂θ. Algorithm 2 computes g′ via the parameter-shift rule on the expectation value (Eq. 6), which is ∂ŷ/∂θ, with no label and no chain-rule factor. The inversion objective therefore is not minimized at x′=x when g is a true loss gradient; the residual is (1−2(ŷ−y))²‖∂ŷ/∂θ‖², which is generically nonzero. Appendix Algorithm 1 shows the same inconsistency: it \"computes gradients g = Eq. 6\" and then updates parameters with that, which is not gradient descent on the MSE loss. So either the experiments attack a different quantity than what clients actually share in federated learning, and the central claim about inverting training data is unsupported, or the paper needs to explain how the adversary handles the label-dependent scale factor. This is not a minor gap; it is the core of the paper.\n\nThere are softer issues too. The strong conclusion \"as long as the model is trainable\" overreaches the data: success rates are 40–100%, experiments are on 2–6 qubits, and all results come from noiseless statevector simulation. The 1e−10 error appears only for long runs and specific starting conditions. No code or hyperparameters (h, lr, N, Q, R, threshold) are provided, which makes replication genuinely difficult.\n\nThat said, the core idea—multi-scale finite differences plus low-pass filtering to escape a highly oscillatory landscape—is plausible and is supported by the convergence plots. If the authors redefine the attack target as the output gradient, or properly handle labels in the proxy gradient, the method could become a useful benchmark. The empirical counterexample to their own prior privacy claims is important even in a negative-reading sense. I would send this to peer review, but with a strong request to fix the gradient definition, add finite-shot noise experiments, and release code. The current version should not be accepted as-is.","headline":"First numerical gradient inversion attack on VQNNs, but it inverts the model-output gradient, not the loss gradient shared in FL, so the central privacy claim doesn't hold as written.","tokens_in":23023,"tokens_out":3807,"would_cite":false,"duration_ms":39755,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A numerical gradient inversion attack using adaptive low-pass filtering reconstructs private training inputs from variational quantum neural networks down to about $10^{-10}$ error, when the model is trainable and sufficiently…","keywords":["gradient inversion attack","variational quantum neural networks","federated learning","quantum machine learning","finite difference method","adaptive low-pass filtering","Kalman filter","parameter-shift rule"],"falsifier":"Run the attack with parameter-shift gradients estimated from a finite number of circuit samples, for example $10^3$ to $10^5$ shots per circuit evaluation, instead of exact numerical expectation values; if reconstruction error then stays above the paper's $0.005$ success threshold instead of falling toward $10^{-10}$, the noiseless gradient oracle is the load-bearing idealization.","tokens_in":21820,"feed_emoji":"🔓","tokens_out":9807,"duration_ms":95185,"temperature":0.7,"pith_summary":"The paper claims that the gradients a variational quantum neural network (VQNN) shares during training are not private: a numerical attack can reconstruct the original input data, even when gradients are aggregated over small batches. The attack combines finite-difference gradient estimation with an adaptive low-pass filter and Kalman-filter updates, so that the optimizer finds the global minimum of the gradient-matching loss instead of getting stuck in the VQNN loss landscape's many local minima. In ideal numerical simulations the reconstruction reaches mean squared error around $10^{-10}$ whenever the model is trainable and sufficiently over-parameterized, across regression tasks and classification tasks including credit-card fraud data. If correct, federated or distributed learning setups that share only VQNN gradients should treat those gradients as revealing, and privacy protection has to come from noise or other mechanisms rather than from the circuit's complexity.","feed_headline":"Gradient attack exposes private VQNN training data down to 1e-10","feed_subtitle":"A finite-difference attack with adaptive filtering reconstructs private inputs from trainable quantum neural networks.","key_machinery":"The load-bearing mechanism is the iterative inversion optimizer of the paper's Algorithm 2. For each input dimension it estimates the derivative of the gradient-matching loss with respect to that component by evaluating the VQNN's parameter-shift gradients at perturbed points, forming a central finite difference, and then averaging these estimates over a moving window of size $N$. The window size is adapted during the attack, so high-frequency oscillations of the loss are filtered out early and the optimizer can resolve the global minimum as the loss approaches zero. A Kalman filter update refines each proxy-input step and substantially improves convergence speed and success rate. The scheme requires the model to be over-parameterized: the number of parameters (equations) must be at least the number of unknown inputs and targets, which the paper takes from classical input-reconstruction analysis.","core_discovery":"The central claim is that as long as the model is trainable, an adversary who sees the shared gradient $g$ can recover the private input $x$ by minimizing the squared distance $L_{g',g}$ between gradients of a proxy input $x'$ and the true shared gradient $g$. The paper shows this is possible without knowing target labels, for both untrained and trained models, and for batches of size two and three when the model is over-parameterized, reaching errors down to about $10^{-10}$ in the numerical experiments. The dense set of local minima that makes VQNN optimization hard does not stop the attack: adaptive low-pass filtering lets the optimizer escape those minima and converge to the global one.","pith_inferences":["Editorial inference: the attack assumes noiseless exact gradients, so the practical threat depends on hardware; shot noise may prevent the $10^{-10}$ reconstruction, but the paper does not test how the attack degrades as noise increases.","Editorial inference: the same adaptive low-pass-filter optimization that escapes local minima could be applied to VQNN training itself, potentially improving convergence on loss landscapes dense with local minima; the paper only hints at this possibility.","Editorial inference: a direct testable extension is to add calibrated Gaussian noise of increasing standard deviation to shared gradients and map the smallest noise level that pushes reconstruction above the $0.005$ success threshold, producing a privacy-utility frontier for each architecture.","Editorial inference: the saturation of inversion error near $10^{-10}$ suggests the gradient map from inputs to parameters is locally one-to-one in the trainable regime; testing with random weight initializations and different feature maps would show how generally this injectivity holds."],"forward_implications":["In federated learning setups where clients share only VQNN gradients, the shared gradients are not safe by themselves; the attack recovers inputs from both untrained and trained models.","Batch-size-based defenses are weak: the attack recovers batches of size two and three, and making batches larger degrades model accuracy before it restores privacy.","Noise added to shared gradients raises inversion error and can preserve some utility, giving VQNNs a privacy-performance trade-off that can be benchmarked against classical neural networks.","Vulnerability tracks over-parameterization, not quantum complexity alone, so privacy risk assessments should compare the number of trainable circuit parameters with the number of unknowns.","The algorithm is proposed as a benchmark tool for evaluating VQNN privacy in practical applications, on both benchmark and real-world sensitive data."],"supporting_citations":[{"why":"Defines the deep-leakage-from-gradients inversion attack for classical networks that the paper adapts to VQNNs.","marker":"[43]"},{"why":"Prior work arguing expressive variational circuits give inherent privacy; the target claim the paper's numerical attack overcomes.","marker":"[27]"},{"why":"Provides the gradient-matching and noise behavior used for comparing NN and VQNN privacy under noisy gradients.","marker":"[45]"},{"why":"Supplies the over-parameterization condition that the number of equations from parameters must match the number of unknowns for input reconstruction.","marker":"[85]"},{"why":"Parameter-shift rule used to evaluate all VQNN gradients, at the core of the gradient-matching loss and its finite differences.","marker":"[15]"},{"why":"Kalman filter equations used for the update step that improves attack convergence.","marker":"[79]"},{"why":"MNIST benchmark dataset used in the classification attack experiments.","marker":"[58]"},{"why":"Real-world credit-card fraud dataset used for the sensitive-data inversion experiments.","marker":"[59]"},{"why":"EfficientSU2 ansatz used in the complex model architecture for the fraud experiments.","marker":"[31]"}],"fun_headline_variants":["VQNN gradient attack reconstructs private training data","Gradient inversion cracks quantum NN data down to 1e-10","Finite-difference attack steals VQNN inputs from gradients","Batch-trained quantum data exposed by gradient inversion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes an essentially noiseless oracle for the VQNN's parameter-shift gradients: Algorithm 2 divides tiny differences of loss values by a small step $2nh$, and the experiments all use ideal numerical simulation, so if realistic measurement shot noise perturbs the gradient values, the claimed $10^{-10}$ reconstruction is not established.","fun_headline_variants_meta":{"raw":{"variants":["VQNN gradient attack reconstructs private training data","Gradient inversion cracks quantum NN data down to 1e-10","Finite-difference attack steals VQNN inputs from gradients","Batch-trained quantum data exposed by gradient inversion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000208,"raw_usage":{"total_tokens":1335,"prompt_tokens":810,"completion_tokens":525,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":426,"completion_tokens_details":{"reasoning_tokens":458}},"tokens_in":426,"tokens_out":525,"duration_ms":6149,"temperature":1.0,"reasoning_tokens":458,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:23:04.602534+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the attack with parameter-shift gradients estimated from a finite number of circuit samples, for example $10^3$ to $10^5$ shots per circuit evaluation, instead of exact numerical expectation values; if reconstruction error then stays above the paper's $0.005$ success threshold instead of falling toward $10^{-10}$, the noiseless gradient oracle is the load-bearing idealization.","supporting_citations":[{"cited_title":"Expressive variational quantum circuits provide inherent privacy in federated learning","cited_arxiv_id":"2309.13002","evidence_quote":"Prior work arguing expressive variational circuits give inherent privacy; the target claim the paper's numerical attack overcomes."},{"cited_title":"Mixing gradients in neural networks as a strategy to enhance privacy in federated learning,","cited_arxiv_id":null,"evidence_quote":"Provides the gradient-matching and noise behavior used for comparing NN and VQNN privacy under noisy gradients."},{"cited_title":"Minimal Model Structure Analysis for Input Reconstruction in Federated Learning","cited_arxiv_id":"2010.15718","evidence_quote":"Supplies the over-parameterization condition that the number of equations from parameters must match the number of unknowns for input reconstruction."},{"cited_title":"An introduction to the kalman filter,","cited_arxiv_id":null,"evidence_quote":"Kalman filter equations used for the update step that improves attack convergence."},{"cited_title":"Credit card fraud detection,","cited_arxiv_id":null,"evidence_quote":"Real-world credit-card fraud dataset used for the sensitive-data inversion experiments."}],"review_version":1}