Dynamic Entanglement-Weighted Pruning for Quantum Federated Unlearning in Supply-Chain Risk Prediction

AI summary

Overview

Research area: Quantum machine learning — specifically quantum federated learning (QFL), machine unlearning, variational quantum circuits, quantum Fisher information, and entanglement-aware circuit analysis, applied to a synthetic supply-chain risk prediction task.

Technical level: Advanced. The paper assumes familiarity with parameterised quantum circuits, the parameter-shift rule, FedAvg, the quantum Fisher information matrix, and concurrence as an entanglement measure.

Scope: The paper proposes and empirically benchmarks Entanglement-Weighted Pruning (EWP), a post-hoc unlearning procedure that removes a client's influence from a federated variational quantum classifier by pruning circuit parameters scored jointly by client-specific quantum Fisher sensitivity and a structural entanglement weight.

What This Paper Is About

Federated learning lets organisations train a shared model without pooling raw data, but regulations such as the GDPR give a client the right to demand that its contribution be removed afterwards. Retraining the whole federation from scratch satisfies that request but is expensive, and in a variational quantum circuit it is unclear which rotation angles actually encode a given client's data. The paper's goal is a cheap, interpretable rule for choosing exactly which circuit parameters to edit so that one client's influence is erased while the model's accuracy on the remaining clients is preserved.

Key Contributions

1. A single interpretable unlearning score. EWP scores every trainable parameter as the product of two signals — the diagonal quantum Fisher information entry estimated on the target client's data, and a structural entanglement weight for that parameter's layer — and prunes parameters below a threshold, with an optional short fine-tuning pass on the retained clients.

2. An explicit parameter-shift estimator for the diagonal QFIM. The paper gives the estimator, discusses its shot complexity, and states the assumptions under which the diagonal approximation is used as a proxy for single-parameter memorisation.

3. A complete, released Qiskit pipeline. Federated training, forget request, QFIM and entanglement estimation, pruning, fine-tuning, and evaluation are implemented for a four-qubit data-re-uploading ansatz, and the authors state that the code, supply-chain data generator, and result artefacts are released.

4. A controlled benchmark with paired significance testing. EWP is compared against full retraining, fine-tuning alone, random pruning, Fisher-only pruning, and entanglement-only pruning over three random seeds, with ablations over pruning threshold, client count, and non-IID strength.

Main Findings

• Accuracy matches the retraining oracle. EWP reaches a mean post-unlearning accuracy of 0.837 ± 0.029 and AUROC of 0.907 ± 0.034, statistically indistinguishable from the full-retraining oracle's 0.794 ± 0.031 accuracy (paired t-test p = 0.28).

• Forgetting is better than the oracle's. EWP produces a lower forgetting score than full retraining (0.678 ± 0.130 versus 0.796 ± 0.039) and a more negative membership-advantage gap (−0.322 ± 0.130 versus −0.204 ± 0.039), meaning the forgotten client's records are harder for a membership-inference attacker to identify as training members.

• Roughly 16× cheaper. EWP requires approximately 16× less wall-clock time than full retraining. Analytically, retraining costs O(R·I·P) circuit evaluations, whereas EWP costs O(B·P) for the one-off diagonal QFIM estimate plus O(P) for the entanglement weights, plus a short fine-tuning term with R_ft ≪ R.

• Both signals are necessary. Entanglement-only and Fisher-only pruning each degrade accuracy by more than 35 percentage points relative to EWP (p < 0.05), showing that neither sensitivity nor structural entanglement alone is a sufficient pruning criterion.

• The default operating point is empirically chosen. A 20% prune fraction is used as default, selected from a threshold sweep reported in Section 6.4.

• The entanglement measure is not a fragile choice. Replacing Wootters concurrence with the von Neumann entropy of the single-qubit reduced state is reported in Appendix A; the two definitions are strongly correlated in the experiments (Figure 8) and the choice does not qualitatively change the conclusions.

• Not reported in the provided excerpt: the per-baseline values for retrain distance, membership-inference attack AUC, and the numeric results of the threshold, client-count, and non-IID ablations appear in tables that are truncated in the supplied content, so no values are given here.

Methodology in Plain English

The authors simulate five organisations ("clients"), each holding 180 synthetic supply-chain risk examples with four features, split 75%/25% into train and test. Each client trains a shared four-qubit, three-layer circuit with 24 trainable rotation angles. Every layer re-encodes the input features, applies trainable rotations, then a ring of fixed entangling gates, then more trainable rotations. Training uses standard federated averaging: six rounds, with each client running 16 local L-BFGS-B iterations using exact parameter-shift gradients, and the server averaging the resulting parameters weighted by client sample count. Client data are deliberately made non-IID via a bias-scale parameter of 0.9, and label noise with logistic standard deviation 0.2 is added.

Then client 0 asks to be forgotten. Rather than retraining, the method asks two questions about each of the 24 parameters. First, how strongly does this parameter change the output state when evaluated on the forgotten client's own inputs? That is the diagonal quantum Fisher information, computed cheaply with a shifted-circuit overlap — no extra hardware primitives beyond what gradient estimation already uses, and no ancilla qubits. Second, how much does this parameter's layer contribute to entanglement, measured as the mean pairwise concurrence across that layer's CNOT-coupled qubit pairs? The two numbers are multiplied together into a single score. Parameters scoring below a threshold (the bottom 20% by default) are reset to their reference value, which for rotation gates is equivalent to replacing the rotation with the identity. Optionally, the remaining parameters are fine-tuned for a few iterations on the retained clients only, recovering any accuracy lost to pruning without ever re-exposing the model to the forgotten data.

Evaluation compares the unlearned circuit to a from-scratch retrained model on four fronts: accuracy and AUROC on retained-client test data, a forgetting score measuring output-distribution divergence from the oracle on the forgotten client's data, a shadow-model membership-inference attack expressed as membership advantage (2 × (attack accuracy − 0.5)), and the Euclidean distance between the unlearned and oracle parameter vectors. All numbers are means and standard deviations over seeds 0, 1, and 2, with paired t-tests against each baseline. The main experiments use exact, noiseless simulation; a noisy-simulation robustness check is deferred to Appendix E. Data are generated from a fixed seed offset of 1000 plus the run seed, so every experiment is exactly reproducible.

Why This Matters

Impact on research. The paper makes a conceptual connection that has not been made before: entanglement structure, previously used to reason about expressivity and trainability, is repurposed as a per-gate importance weight inside a pruning rule for unlearning. The negative ablation result is the load-bearing finding — sensitivity alone and entanglement alone each fail badly, which argues that information-geometric and structural information are complementary rather than redundant in quantum models. The paper also contributes a membership-inference-based evaluation protocol to a field where verification of forgetting is largely unsettled.

Real-world applications.

• Multi-party supply-chain risk forecasting: logistics operators, carriers, and manufacturers sharing a risk model over delay history, financial indicators, and route disruption records they cannot legally pool.
• Regulated federated deployments: any setting where Article 17 erasure requests must be honoured without rebuilding the model, such as finance or healthcare consortia running federated classifiers.
• Multi-tenant quantum machine-learning services: a cloud provider hosting one variational model across several customers, where one customer withdraws and its contribution must be scrubbed from the hosted parameters.
• Audit and compliance workflows: the forgetting score and membership advantage give compliance teams quantitative evidence that a removal request was meaningfully acted upon, rather than merely asserted.

Industry relevance. The roughly 16× wall-clock saving matters because circuit evaluation and parameter-shift gradient estimation are the expensive operations in variational training, particularly on real hardware or simulators. A pruning rule that touches only a small fraction of parameters, requires no new hardware primitives, and reuses the same overlap circuits already needed for gradients is directly deployable on existing quantum-classical infrastructure. The authors are careful to frame the supply-chain domain as motivation rather than empirical validation, since the data are synthetic.

Future Directions

• Beyond the diagonal. The method discards the off-diagonal entries of the quantum Fisher information matrix, which encode cross-parameter correlations. Whether the full quantum geometric tensor improves pruning selection — at what computational cost — is left open and explicitly flagged as a limitation.

• Hardware and noise validation. The main results use exact, noiseless parameter-shift gradients with no shot noise. Extending the evaluation from the Appendix E noisy-simulation check to real device noise, finite shot budgets, and hardware-native connectivity is the natural next step.

• Scale-out. The study uses four qubits, 24 parameters, five clients, and six federated rounds. How the score behaves for deeper circuits, more qubits and parameters, and larger client populations — and whether the reported scaling of circuit evaluation cost with qubit count persists — is untested.

• Certification and exactness. The authors state explicitly that EWP is approximate and does not provide cryptographic or information-theoretic unlearning guarantees. Connecting the pruning rule to formal removal bounds, or to verification protocols for quantum unlearning, is an open question the paper raises but does not answer.

Target Audience

Researchers and practitioners working at the intersection of quantum machine learning and privacy-preserving learning: QFL and variational-circuit researchers, and those studying machine unlearning who want to know how the problem changes when the model is an entangled parameterised circuit rather than a weight tensor. It is also relevant to applied scientists evaluating whether quantum federated models are deployable under data-protection regimes, and to readers interested in entanglement measures as practical diagnostic tools for circuit structure rather than as theoretical quantities. The paper is not beginner-friendly: it assumes comfort with parameter-shift gradients, FedAvg, and quantum Fisher information.

Authors’ abstract

Federated deployments of variational quantum classifiers are attractive for cross-organisation risk prediction in supply chains, because raw data never leaves the client, yet data-protection regulations such as the GDPR grant clients a right to request that their contribution be removed from a trained model after the fact. Retraining a federated model from scratch to honour such a request is correct but wasteful, and it is not obvious which quantum circuit parameters actually carry a given client's influence. We introduce Entanglement-Weighted Pruning (EWP), an unlearning procedure for quantum federated learning that scores every trainable circuit parameter with the product of two signals: the diagonal entry of the quantum Fisher information matrix estimated on the target client's data via the parameter-shift rule, and a structural entanglement weight associated with the parameter's gate. Parameters with the lowest scores are pruned, optionally followed by a short fine-tuning pass on the retained clients. We implement the full pipeline in Qiskit for a four-qubit data-re-uploading ansatz trained with FedAvg across five simulated supply-chain-risk clients, and benchmark EWP against full retraining, fine-tuning alone, random pruning, Fisher-only pruning, and entanglement-only pruning, over three random seeds. EWP attains a mean post-unlearning accuracy statistically indistinguishable from the full-retraining oracle, while producing a lower forgetting score and requiring roughly 16 times less wall-clock time. Ablations over pruning threshold, client count, and non-IID strength show that combining the two signals is necessary, as entanglement-only and Fisher-only pruning each substantially degrade accuracy relative to EWP.