Federated Learning with Quantum Computing and Fully Homomorphic Encryption: A Novel Computing Paradigm Shift in Privacy-Preserving ML

Venue: NeurIPS_cc_2024_Workshop_MLNCP
Published: 2024-09-12 12:49:08

Abstract: The widespread deployment of products powered by machine learning models is raising concerns around data privacy and information security worldwide. To address this issue, Federated Learning was first proposed as a privacy-preserving alternative to conventional methods that allow multiple learning clients to share model knowledge without disclosing private data. A complementary approach known as Fully Homomorphic Encryption (FHE) is a quantum-safe cryptographic system that enables operations to be performed on encrypted weights. However, implementing mechanisms such as these in practice often comes with significant computational overhead and can expose potential security threats. Novel computing paradigms, such as analog, quantum, and specialized digital hardware, present opportunities for implementing privacy-preserving machine learning systems while enhancing security and mitigating performance loss. This work instantiates these ideas by applying the FHE scheme to a Federated Learning Neural Network architecture that integrates both classical and quantum layers.

Main paper: 
 introduction: 
 With the widespread deployment of Machine Learning (ML) applications, the level of direct humanmachine interaction has increased rapidly. This surge has raised concerns and increased user awareness about the capabilities and limitations of these technologies. As the impact of Machine Learning (ML)-based gadgets becomes more relevant in the public discourse, governmental agencies begin to develop and implement regulatory policies regarding the fair use and overall protection of user data.For example, the 2016 EU Data Regulation Act [1] and the Brazilian LGPD from 2018 [2] establish guidelines for the processing of personal data, setting the security requirements for safe information storage and delimiting the scope of use of these data.To address this issue, the Federated Learning (FL) framework was proposed [3, 4] as a mechanism for coordinating multiple independent clients that cooperate in a shared learning task by transmitting only the "knowledge" of the trained model to their peers while keeping private data stored locally. In contrast to conventional ML, where data is often centralized in a single server for model training, this distributed approach is suitable for addressing data privacy concerns. Each independent client shares their model updates with a server responsible for combining and broadcasting the aggregated model back to its clients. This allows one to benefit from the insights produced through other clients' data without ever having direct access to it. However, these benefits are not free. The siloing of the data compromises the speed with which "knowledge" diffuses through the network, affecting the efficiency of training in the form of computational overheads and communication inefficiencies [5] .Moreover, exposing model data to potentially vulnerable communication channels between clients and the server could defeat FL's original privacy goal. Even with the distribution of data for each client in an FL framework, the privacy of this data can be threatened by the interception of messages between the clients and the server. Once these messages are intercepted, the original private data can be inferred. To this end, an extra layer of quantum-safe privacy protection is implemented by encrypting the model updates before reaching the central server so that its aggregation operations are performed on this data without decrypting it. This technique is known as Fully Homomorphic Encryption (FHE) [6] . Implementing this technique prevents the server from accessing direct model updates, which prevents any potential intercept of the messages sent by the clients. Clients can then trust that the aggregation technique is performed without exposing their local data or the resulting learning model. Since the encryption occurs before the model updates are communicated, each client's local ML model is not restricted, yet it is protected by FHE. This layer of protection comes at the expense of higher resource consumption to manipulate encrypted model updates [6] .New techniques must be implemented to address all the considerations of data privacy on the scale on which these FL models will be deployed. Tackling this challenge requires improvements in how efficiently each client can learn individually, reducing the number of communication rounds, and in how to encrypt the messages exchanged with a server. We consider that novel computational paradigms can be the answer to these challenges. In particular, we claim that each client can address their learning tasks with enhanced architectures that leverage this hardware. The compositional nature of deep learning models allows some of its layers to be implemented using new computing paradigms such as photonic [7] , neuromorphic [8, 9] or quantum computers [10] . These machines consist of specialized hardware with promising computational speedup capabilities relevant to ML, such as matrix multiplication or calculating gradients.One paradigm that has received particular attention in the context of privacy is Quantum Computing [11] . Quantum computing (QC) is the processing of information using phenomena explained through quantum mechanics. The basic information unit for QC is the quantum bit or qubit, which can be a superposition of the states 0 or 1. Processing over qubits subject to quantum mechanics allows one to accelerate specific computational tasks, even exponentially [10] . Quantum computers, that is, devices capable of implementing quantum computations, are still limited in size and capabilities primarily concerned with handling unintended interactions with their environment [10] , which has the same effect of projecting the quantum states onto a classical one, known as measurement. However, they are steadily gaining traction, with the potential expectation that in the future they can surpass classical machines [12, 13] in tasks related to combinatorial optimization [14] and cryptography [15] . This opens the doors for hybrid ML algorithms that, acknowledging and accounting for the limitations of each computational paradigm, take advantage of the classical and quantum layers [16, 17] .Moreover, in addition to aiding in challenging computational challenges, quantum technologies have promising potential to improve communication protocols. An example is Quantum Key Distribution (QKD) [18] , which is a secure communication method that uses the principles of quantum mechanics, particularly entanglement and the no-cloning theorem, to allow two parties to generate a shared encryption key, which can detect eavesdropping attempts and ensure confidentiality [19] . As an example of implementing new computing paradigms for ML, we use neural networks with classical and quantum layers that are trained in a federated setting with FHE, highlighting the plausibility and potential of integrating quantum computing in a practical ML setting. 
related work: 
 Since its inception, FL has focused on communication-efficient learning with applications to data privacy [3] . Subsequent research has expanded on this foundation, with different applications [4, 20, 21] and addressing challenges arising from practice such as training over non-IID data [22] .FL combined with FHE has gained prominence as a privacy-preserving approach to ML [23] . In particular, there has been an increase in applications in healthcare [24, 25] , where preserving privacy is crucial when working with data from medical diagnosis and imaging [26] [27] [28] . Recent work has focused on tackling the computational inefficiencies inherent in FHE [29, 30] .Another prominent area consists of adding quantum computing layers to the distributed clients' architecture, giving rise to an extension of Quantum Machine Learning (QML) [31, 32] known as Quantum Federated Learning (QFL) [16, 33] . Special attention has been paid to QFL on quantum [34] or decentralized data [35] . Extensions of QFL considering other classical ML architectures, such as convolutional networks [36, 37] , have been proposed. Applications of QFL in healthcare have been explored using existing quantum hardware [38] or classical simulations of quantum computers [25] .Other applications in finance [39] and Internet-of-Things (IoT) security [17] have been explored.There are also previous developments for integrating it with encrypted weights [40] . Finally, as a novel technology, it faces implementation and resource allocation challenges [19, 41] . 
problem description and methodology: 
 Despite its applications in distributed ML, classical FL still faces challenges. Among these are communication bottlenecks across large networks [42] , privacy concerns during model updates [43] ,especially sensitive data such as those found in healthcare applications [25] , and computational inefficiencies due to training large datasets on devices with limited resources [44] .QFL is a distributed learning paradigm capable of tackling some of these challenges. It consists of clients capable of accessing quantum computers that collaboratively train a global model while communicating with a centralized classical server. Since the local computations found in FL tend to be smaller than centralized ML datasets, it becomes a great use case for the still resource-constrained quantum devices available today [10, 45] . Furthermore, QFL is capable of using quantum-enhanced communication protocols that offer inherent privacy advantages over the classical ones [15] .In a standard neural network, the weights are iteratively updated by gradient descent. The weightupdate at time step t + 1 is W t+1 i = W t i -η∇L(W t i ), where W t i denotes the weight at time t for client i, η is the learning rate, and ∇L(W t i ) is the loss function gradient with respect to the weight. This update minimizes the loss by adjusting the weights accordingly. However, in a scenario using FHE, the process changes since weights are encrypted on each client. FHE allows performing the same calculations on the encrypted weights E(W t i ), generating new encrypted weights as QFL with FHE works by training and encrypting the models for all clients in parallel. At the same time, a centralized server receives models, aggregates them, and redistributes the new model to all clients according to the procedure just described. This process repeats until convergence or meeting any other stopping criterion. Algorithm 1 gives a pseudocode description of the procedure, and Fig. 1 shows a high-level visualization.E(W t+1 i ) = E(W t i ) -η∇L(E(W t i )),The Quantum Neural Network (QNN) is initialized by constructing a variational Parameterized Quantum Circuit (PQC) with a specified depth D and a set of quantum gates G. An example of this PQC that we used in our illustrative test cases is given in Fig. 2 . This variational PQC, which will be trained on quantum data, uses parameters such as quantum gate angles and biases that can either be initialized randomly or based on pre-trained values. After initialization, each client prepares its quantum dataset D k , which could be based on local quantum measurements or preexisting datasets.Using this data, the client trains its local QNN through variational quantum algorithms. Once training is complete, the model weights are quantized to a fixed precision format to reduce the size of the encrypted parameters before encrypting the weights for secure transmission to the central server.On the server, encrypted QNN weights from all clients are aggregated using a weighted summation method, where each client's contribution is proportional to the size of their data set. This ensures that the global model reflects each client's training effort. Further optimizations to the PQC, such as modifying the depth D or adjusting the gate set G, may be performed to enhance model performance.After these updates, the global model is distributed back to the clients, and this iterative process continues until convergence, ultimately resulting in a privacy-preserving QNN model.  
computational results: 
 Training times for FHE-FedQNN models are notably extended due to the combined computational demands of quantum simulation and FHE. This increased duration is particularly evident with datasets like CIFAR-10, where the use of 6 qubits to represent 10 classes adds to the computational burden. Send global model w g to client k 33: end for 34: Repeat from step 11 until convergence 35: return w g Concerning Table 1 , although the introduction of FHE results in computational overhead, the impact on test accuracy for FHE-FedQNN models is minimal. The difference compared to standard FedQNN models is around 1-2%, suggesting that the benefits of enhanced data security and quantum processing can outweigh this slight accuracy trade-off. Upon evaluating the FHE-FedQNN model, it was observed that there was improved performance in the PCOS dataset, resulting in a 4% gain in classification accuracy. This progress suggests that the FHE scheme could potentially assist the model in managing the noise introduced by encryption, thereby improving its generalization capabilities.Despite the increased test loss in the FHE-FedQNN model, which is likely due to noise amplification from FHE, the quantum model demonstrates superior generalizability. All models achieved nearoptimal training accuracies, a typical outcome in FL settings since each client trains on a subset of data. However, test accuracy, which is measured on a separate set of test images, more accurately reflects the performance of the aggregated federated model. 
discussion: 
 In the end, the more complicated architecture of FL with FHE induces a trade-off from speed to privacy. We have shown that new computing paradigms, and in particular a quantum computer, can be used in these ML models as a tool to accelerate local computations. The small-scale clients' models in FL are more amenable to the limits encountered on current quantum devices. However, considering the current quantum hardware scale, this approach still has limitations. These can be mitigated in some cases by classical simulation of quantum systems via tensor networks [25, 49] , although only practical until a certain scale. In the future, advances in quantum hardware, qubit error correction, and encryption techniques are expected to make QFL practical for real-world applications.  
perspectives: 
 FL has emerged as a viable technology for machine learning in domains where data privacy is important. Challenges related to training efficiency and vulnerability to eavesdropping have spurred a number of developments, including FHE. Leveraging the composability of current deep learning methods, some proposals have integrated classical and novel computational paradigms to satisfy the ever-growing requirements of FL applications. In particular, quantum computing has been successfully integrated with FL in this work and others [19, 25, 33, 36] . Our contribution was to show the potential of combining FHE with quantum FL and provide an implementation of these methods that is replicable on classical computers through efficient simulation of quantum circuits. The results obtained suggest that incorporating both quantum layers and FHE does not significantly increase the training time, and in some cases, it even improves the learning metrics. More importantly, it shows how new computing paradigms can already aid in relevant ML tasks.These novel computational paradigms still have significant untapped potential. We highlight that FL can be the meeting point of two branches of quantum information sciences: quantum computing and quantum communication. To achieve exponential speedups using QML, it has been shown that one can operate directly over quantum data, without the need for encoding [35, 50] . At the same time, the advantages of quantum communication arise only when transmitting qubits. Exploring the simultaneous usage of both technologies presents a fascinating application of this technology, with federated and machine learning being the use case that requires them together. 
 
 Appendix:  



Reviews: review: title: title: Review for Federated Learning with Quantum Computing and Fully Homomorphic Encryption: A Novel Computing Paradigm Shift in Privacy-Preserving ML
main_review: main_review: This paper presents a methodology that combines fully homomorphic encryption and quantum federated learning. Both of these techniques can improve privacy preservation for federated learning. Fully homomorphic encryption enables clients to securely inform server updates to encrypted model weights. These updated encrypted weights at the server can be sent back to the clients to update the client models. This process of operating directly on encrypted weights enables clients to cooperatively train models with a centralized server without exposing any local data. Quantum federated learning enhances typical federated learning approaches with the benefits of quantum computing. This can provide improved computational efficiency for some types of problems and additional privacy improvements.

This paper does show that federated networks can effectively be trained with and without quantum neural networks and with and without FHE, but it is not clear to me how the benefits of quantum neural networks and FHE work together. The paper seems to suggest additional privacy benefits may be produced by this combination, but does not provide sufficient analysis of this. As training networks with this combination is the key contribution of this paper, it seems necessary that the benefits of this combination is assessed/discussed in detail.