Gentle Measurement of Quantum States and Differential Privacy * Scott Aaronson (University of Texas at Austin) Guy Rothblum (Weizmann Institute of Science) STOC, Phoenix, AZ, June 24, 2019 * Not a misprint. Talk will actually relate these things

Gentle Measurement Measurements in quantum mechanics are famously destructive But not always! If a qubit is known to be either |0 or |1, checking to see which one doesn’t damage it at all Given a quantum measurement M, let’s call M -gentle on a set of states S if for every state S, and every possible measurement outcome y, Trace distance, standard metric on quantum states Post-measurement state if outcome is y Typical choice for S: Product states 1n

Example: Measuring the total Hamming weight of n unentangled qubits could be extremely destructive (omitting normalization) Safer Approach: Measure the Hamming weight plus deliberately-added noise (of order >>n). E.g., “Laplace noise”

Differential Privacy In One Slide “CS theory applied to the social world—i.e., as far as you could possibly get from the subatomic world” Given an algorithm A that queries a database X=(x1,…,xn), we call A -DP if for every two databases X and X’ that differ in only a single xi, and every possible output y of A, Bad: How many patients have prostate cancer? Better: Return the number of patients with prostate cancer, plus Laplace noise of average magnitude  A simple calculation shows this is 1/-DP

Quantum Differential Privacy “Protecting the Privacy Rights of Quantum States” Given a quantum measurement M on n registers, let’s call M -DP on a set of states S (e.g., product states) if for every ,’S that differ on only 1 register, and every possible outcome y of M, Example: Once again, measuring the total Hamming weight of n unentangled qubits plus a Laplace noise term Hmmmm….

Our Main Result: DPGentleness (1) Any measurement that’s -gentle on product states (for small ) is also O()-DP on product states Aren’t DP and gentleness obviously the same? Have to restrict the set of states for part (2) to be interesting (2) Any measurement that’s -DP on product states, and consists of a classical DP algorithm applied to results of separate measurements on each register, is also O(n)-gentle on product states This restriction might just be an artifact of our proof n factor is tight (the Laplace noise measurement shows this)

Related Work Dwork et al. (2014): Connection between DP and adaptive data analysis We can safely reuse the same dataset for many scientific studies, if we’re careful to query the dataset using DP algorithms only! In our terms: DP  “classical Bayesian gentleness” Of course, “damage” to a probability distribution is purely internal and mental, whereas damage to a quantum state can be noticed by others…

One Slide on Proof Techniques GentlenessDP: Easy, little to do with QM. Consider a “converse” statement: if a measurement accepts  and  with very different probabilities, then by Bayes’ Theorem it will damage (+)/2. Then, given a product state 1n, apply this reasoning to each i separately DPGentleness for Product States: Harder direction. First prove for classical product distributions D1Dn (following Dwork et al). Then “lift” to a measurement that QSamples from the output distribution of a classical DP algorithm, on each component of a superposition |1|n. Use inequalities that relate KL-divergence, Hellinger distance, and trace distance

Application: “Shadow Tomography” Given an unknown D-dimensional quantum state , and known 2-outcome measurements E1,…,EM Estimate Pr[Ei accepts ] to  for all i[M], with high probability, by measuring as few copies of  as possible k=O(D2) copies suffice (do ordinary tomography) k=O(M) suffice (apply each Ei to separate copies) But in many applications, D and M are both enormous! Theorem (A., STOC’2018): Shadow tomography is possible using only this many copies of :

New Shadow Tomography Result We can do shadow tomography in a way that’s also online and gentle. The sample complexity is How it works: we take a known procedure from DP, Private Multiplicative Weights (Hardt-Rothblum 2010). PMW decides whether to update our current hypothesis on each query Ei using a threshold measurement with Laplace noise added We give a quantum analogue, “QPMW” Each iteration of QPMW is DP. Using this fact, our DPgentleness theorem, and a lot more work, we show that we can safely apply all M of the iterations in sequence

Future Directions Remove the restriction to product measurements in our DPgentleness implication? Characterize when DPgentleness preserves computational efficiency? What’s the true sample complexity of shadow tomography? Must it have any log D factor at all? For gentle or online shadow tomography, we can show that the answer is yes, by porting known results from classical DP Composition of quantum DP algorithms? Use quantum to say something new about classical DP?