Federating Quantum and Classical Computing: A Privacy-Preserving Hybrid Approach

# Federating Quantum and Classical Computing: A Privacy-Preserving Hybrid Approach
Source: [https://arxiv.org/html/2609.25082](https://arxiv.org/html/2609.25082)
###### Abstract

Quantum machine learning \(QML\) is increasingly recognized as one of the most promising near\-term applications of quantum computing, viewed as a next\-frontier candidate beyond purely classical approaches\. Hybrid quantum\-classical models operationalize this potential by embedding a parameterized quantum circuit within a model where all other components remain classical—a design already applied to chemistry simulation, financial modeling, and image classification\. However, their deployment in privacy\-sensitive, multi\-party settings is constrained by the need to avoid centralizing raw data and by the requirement that modern quantum circuits remain parameter\-efficient to stay trainable at scale\.

In this paper, we address these constraints by evaluating federated learning \(FL\) as a means of combining a hybrid quantum\-classical active party with a classical passive party, using[Sherpa\.ai](https://www.sherpa.ai/)’s Blind Vertical FL \(SBVFL\) protocol to avoid centralizing raw data, while drastically reducing communication\. We construct the split multiplicative periodic parity \(SMPP\) benchmark, following common QML design practice\. On this task, our simulations show that SBVFL raises accuracy from 0\.7227 to 0\.8757 compared to local training, closely approaching non\-private centralized accuracy, and that the hybrid quantum\-classical model achieves this with substantially fewer trainable parameters than the classical neural networks and random forest alternatives\. These results show that FL enables high\-performing, privacy\-preserving quantum\-classical collaboration without centralizing raw data\.

![Refer to caption](https://arxiv.org/html/2609.25082v1/compare_local_fl_op1.png)Figure 1:Overview of the FL setup showing the single\-party and federated model performance\.## 1Introduction

Quantum machine learning \(QML\) has attracted growing attention as a leading near\-term application of quantum computing, with the potential to extend beyond classical approaches\. Quantum computing exploits superposition, entanglement, and interference to implement computational procedures that can differ fundamentally from those of classical processors\. These resources can provide asymptotic advantages for specific problem classes, but they do not imply a general acceleration of machine\-learning workloads\. Shor’s and Grover’s algorithms illustrate this problem\-specific character\[[17](https://arxiv.org/html/2609.25082#bib.bib14)\], while QML uses quantum states and parameterized circuits to construct model classes with task\-dependent inductive biases\[[5](https://arxiv.org/html/2609.25082#bib.bib15)\]\.

Near\-term quantum computing remains constrained by noise, limited coherence, gate infidelity, restricted device size, and the resulting limitations on circuit depth\[[18](https://arxiv.org/html/2609.25082#bib.bib16)\]\. Hybrid quantum\-classical architectures address these constraints by assigning different stages of the learning pipeline to classical and quantum processors\. In QML, a parameterized quantum circuit can be embedded as a layer within a conventional model, with classical computation handling preprocessing and optimization\[[21](https://arxiv.org/html/2609.25082#bib.bib6)\]\. This hybrid pattern has already been applied across domains, including chemistry simulation\[[6](https://arxiv.org/html/2609.25082#bib.bib22)\], financial modeling\[[19](https://arxiv.org/html/2609.25082#bib.bib23)\], and image classification\[[22](https://arxiv.org/html/2609.25082#bib.bib24)\]\.

A parameterized circuit with angle encoding does not constitute a generic universal approximation mechanism\. Instead, it induces a structured family of trigonometric functions\[[21](https://arxiv.org/html/2609.25082#bib.bib6)\]\. Its usefulness therefore depends on whether the target function contains structure that this family represents efficiently\. This motivates a model\-class comparison in which the target is deliberately matched to the functional form of the quantum readout\.

Federated learning \(FL\) enables multiple parties to train a shared predictive system without centralizing their raw data\[[15](https://arxiv.org/html/2609.25082#bib.bib18)\]\. Quantum FL \(QFL\) combines this distributed setting with quantum or hybrid models \(see Figure[1](https://arxiv.org/html/2609.25082#S0.F1)\)\. Here we consider the heterogeneous case in which only the active party employs a hybrid quantum\-classical model and the passive party remains entirely classical\. The data are vertically partitioned, so the parties hold complementary feature subsets for the same samples; this setting is formalized in Section[2](https://arxiv.org/html/2609.25082#S2)\.

Current quantum hardware also imposes practical restrictions on data preprocessing, circuit size, and repeated execution\. We therefore embed the quantum circuit in a classical model and evaluate it by exact state\-vector simulation\. This removes device noise and queueing effects from the present comparison while retaining an architecture that can in principle be executed on a quantum processor of the corresponding size\.

A further constraint concerns trainability\. With parameter\-shift gradient estimation, each trainable circuit parameter contributes additional circuit evaluations at every optimization step\. Parameter count therefore provides a direct proxy for the number of parameter\-dependent evaluations required for training, and we use the number of trainable parameters required to reach a specified accuracy as the principal complexity measure\. The proxy describes hardware execution with parameter\-shift gradients; the simulations reported here instead differentiate automatically through an exact state vector, so the parameter count is not a measured cost in these experiments\.

### 1\.1Motivation

Vertical FL \(VFL\) is appropriate when parties hold different feature subsets for a common set of samples\. In a hybrid QFL setting, this permits different parties to use different model classes, including a quantum\-enabled model at one party and a classical model at the other\. The methodological question is whether a privacy\-preserving protocol can combine these complementary feature views without exposing raw features or repeatedly transmitting label\-dependent training information\. In standard VFL, the passive party may receive label\-dependent gradients repeatedly\. We instead employ[Sherpa\.ai](https://www.sherpa.ai/)’s Blind VFL \(SBVFL\) paradigm\[[2](https://arxiv.org/html/2609.25082#bib.bib2)\], in which the passive party trains against synthetic targets and does not receive label\-dependent gradients\. This protocol is well suited to a heterogeneous setting because the parties may use different architectures without requiring any exchange or averaging of model weights\.

This combination of a heterogeneous, blind vertical protocol with a compact quantum active party is not addressed by the existing literature\. Vertical QFL work to date is homogeneous, requiring quantum resources at every party\[[3](https://arxiv.org/html/2609.25082#bib.bib8),[12](https://arxiv.org/html/2609.25082#bib.bib10)\], so it does not isolate the parameter efficiency of a quantum model against classical alternatives under an explicit privacy mechanism\. Conversely, hybrid QFL studies that do compare quantum and classical model classes typically operate in a horizontal, non\-private setting\[[9](https://arxiv.org/html/2609.25082#bib.bib4),[10](https://arxiv.org/html/2609.25082#bib.bib5)\], so they leave open whether any measured advantage survives the information restrictions that a blind vertical protocol imposes on the passive party\. It is therefore unclear, from prior work alone, whether a parameter\-efficiency advantage observed for a quantum active party under centralized or local training is preserved, reduced, or eliminated once that party must rely on the passive party’s contribution through SBVFL rather than through direct access to the pooled features\.

Accordingly, the objective of this work is twofold: to characterize a target structure for which a compact quantum model is parameter\-efficient at the active party, and to determine whether that advantage persists under the privacy and information constraints imposed by blind vertical federation\.

This paper studies the structural conditions under which a compact quantum layer can be parameter\-efficient for the active party of a SBVFL system and quantifies the resulting federated accuracy\.

### 1\.2Contribution

The main contributions are as follows:

- •We evaluate a heterogeneous hybrid quantum\-classical SBVFL scheme, with a hybrid quantum\-classical active party and an entirely classical passive party\. The reported federated configuration reaches 0\.8757 accuracy with 12 trainable parameters, substantially improving on active\-party local training \(0\.7227\) and closely approaching the non\-private centralized reference\.
- •We construct split multiplicative periodic parity \(SMPP\), a benchmark whose vertical partition makes each party’s feature block informative but insufficient on its own, matched to a tensor\-product quantum readout\. On the pooled four\-feature task, a 19\-parameter hybrid model exceeds the tested classical networks and the 300\-tree random forest by margins from0\.0550\.055to0\.1440\.144\.
- •We ablate the passive party’s privacy multiplier and show that increasing privacy does not reduce accuracy, indicating that SBVFL’s accuracy gains hold even under stronger privacy guarantees\.

The remainder of the paper is organized as follows\. Section[2](https://arxiv.org/html/2609.25082#S2)formalizes the hybrid quantum\-classical VFL setting and reviews related work\. Section[3](https://arxiv.org/html/2609.25082#S3)describes the centralized and FL protocols, including SBVFL\. Section[4](https://arxiv.org/html/2609.25082#S4)introduces the SMPP benchmark and its vertical partition\. Section[5](https://arxiv.org/html/2609.25082#S5)specifies the model classes, Section[6](https://arxiv.org/html/2609.25082#S6)gives the experimental protocol, and Section[7](https://arxiv.org/html/2609.25082#S7)presents the results\. Section[8](https://arxiv.org/html/2609.25082#S8)discusses the scope and interpretation of the findings, followed by conclusions in Section[9](https://arxiv.org/html/2609.25082#S9)\.

## 2Problem Formulation

This section formalizes the hybrid quantum\-classical VFL setting by specifying the computational roles of the two parties, reviewing the relevant literature, and defining the learning problem\.

In the hybrid quantum\-classical VFL setting considered here, the parties may employ different computational models\. The active party uses a hybrid model containing a variational quantum circuit, while the passive party uses a classical model\. This heterogeneity allows the two parties to retain architectures appropriate to their available computational resources while participating in the same federated prediction task\.

The practical limitations of current quantum processors motivate the classical preprocessing layer and exact simulation in this study\. The architecture is nevertheless defined so that the quantum layer can be transferred to a device with the required number of qubits and circuit depth\.

### 2\.1Related Work

We review work most closely related to QFL and, in particular, its vertical setting, emphasizing approaches that distribute feature subsets rather than samples across parties\.

Recent surveys characterize QFL from complementary perspectives, including architectural taxonomies, NISQ constraints, privacy mechanisms, and security\[[24](https://arxiv.org/html/2609.25082#bib.bib7),[13](https://arxiv.org/html/2609.25082#bib.bib11),[16](https://arxiv.org/html/2609.25082#bib.bib12),[20](https://arxiv.org/html/2609.25082#bib.bib13),[4](https://arxiv.org/html/2609.25082#bib.bib9)\]\. The present study considers a narrower setting: heterogeneous VFL in which only the active party uses a quantum model, the passive party remains classical, and label blinding is explicit\.

Vertical QFL remains less explored than horizontal QFL\.\[[3](https://arxiv.org/html/2609.25082#bib.bib8)\]describe a fully quantum VFL architecture in which client and server models are variational quantum circuits operating on distributed feature subsets\.\[[12](https://arxiv.org/html/2609.25082#bib.bib10)\]propose eviQVFL, in which quantum clients transmit local states through quantum teleportation and the server performs evidential fusion\.

Table 1:Comparison with the two closest vertical QFL schemes\.Table[1](https://arxiv.org/html/2609.25082#S2.T1)positions the present study relative to these approaches\. The proposed architecture is heterogeneous, with quantum resources required only at the active party and a fully classical passive party, and it uses explicit label blinding with a tunable privacy multiplier\. The inter\-party channel is therefore classical and does not require quantum communication\. The quantum layer is also related in spirit to the federated quantum neural architectures of\[[9](https://arxiv.org/html/2609.25082#bib.bib4),[10](https://arxiv.org/html/2609.25082#bib.bib5)\], although those studies address horizontal federation\. We therefore characterize the present contribution conservatively as a heterogeneous, blind hybrid quantum\-classical VFL scheme and do not claim priority for vertical QFL in general\.

### 2\.2Problem Definition

We consider a dataset𝒟=\(X,Y\)\\mathcal\{D\}=\(X,Y\)withX∈ℝM×dX\\in\\mathbb\{R\}^\{M\\times d\}and binary labelsY∈\{0,1\}MY\\in\\\{0,1\\\}^\{M\}\. The feature matrix is vertically partitioned asX=\[Xa,Xp\]X=\[X\_\{a\},X\_\{p\}\], whereXaX\_\{a\}andXpX\_\{p\}denote the feature blocks held by the active and passive parties, respectively\. Joint training uses only records matched by the Private Set Intersection \(PSI\) protocol\[[23](https://arxiv.org/html/2609.25082#bib.bib3)\]; the common sample count is denoted byM≤min⁡\(Ma,Mp\)M\\leq\\min\(M\_\{a\},M\_\{p\}\)\.

In the present formulation, the active party exclusively holds the labelsYYand produces the final prediction, while the passive party holds features only\. The two roles are therefore:

- •Active party\.HoldsXaX\_\{a\}, the labelsYY, and the hybrid quantum\-classical model𝒬a\\mathcal\{Q\}\_\{a\}parameterized byθa\\theta\_\{a\}\.
- •Passive party\.HoldsXpX\_\{p\}only and trains a local modelModp\\mathrm\{Mod\}\_\{p\}under SBVFL\. In the experiments,Modp\\mathrm\{Mod\}\_\{p\}is an ensemble of classical random forest models, one per synthetic label, withQQthe privacy multiplier\.

The active party’s objective is to minimize the empirical risk over the intersected sample set\. The prediction for sampleiicombines the output of the active\-party model with the contribution returned by the passive party,

y^\(i\)=g⁡\(𝒬a​\(xa\(i\),θa\),op\(i\),W\),ℒ=1M​∑i=1Mℓ⁡\(y^\(i\),y\(i\)\),\\hat\{y\}^\{\(i\)\}=g\\bigl\(\\mathcal\{Q\}\_\{a\}\(x\_\{a\}^\{\(i\)\};\\theta\_\{a\}\),\\;o\_\{p\}^\{\(i\)\};\\,W\\bigr\),\\qquad\\mathcal\{L\}=\\frac\{1\}\{M\}\\sum\_\{i=1\}^\{M\}\\ell\\bigl\(\\hat\{y\}^\{\(i\)\},\\,y^\{\(i\)\}\\bigr\),\(2\.1\)whereℓ\\ellis the classification loss,xa\(i\)x\_\{a\}^\{\(i\)\}is the active\-party feature vector,y\(i\)y^\{\(i\)\}is the corresponding true label,op\(i\)o\_\{p\}^\{\(i\)\}is the contribution returned by the passive party, andggis the aggregation applied at the server, with parametersWW\. Under SBVFL,𝒬a\\mathcal\{Q\}\_\{a\}takesxa\(i\)x\_\{a\}^\{\(i\)\}alone as its input, andθa\\theta\_\{a\}andWWare fitted in separate steps, as set out in Section[3\.2](https://arxiv.org/html/2609.25082#S3.SS2)\.

## 3Privacy\-Preserving ML Solution

This section defines the centralized reference and the federated protocols used in the experiments, including standard VFL and SBVFL\.

### 3\.1Classical ML Approach

For the non\-private centralized reference, the two feature blocks are pooled and a single classical modelfθf\_\{\\theta\}is trained onX=\[Xa,Xp\]X=\[X\_\{a\},X\_\{p\}\]:

minθ⁡𝒥⁡\(θ\)=1M​∑i=1Mℓ⁡\(fθ​\(xa\(i\),xp\(i\)\),y\(i\)\)\.\\min\_\{\\theta\}\\;\\mathcal\{J\}\(\\theta\)=\\frac\{1\}\{M\}\\sum\_\{i=1\}^\{M\}\\ell\\bigl\(f\_\{\\theta\}\(x\_\{a\}^\{\(i\)\},x\_\{p\}^\{\(i\)\}\),\\,y^\{\(i\)\}\\bigr\)\.\(3\.1\)
This reference removes the privacy constraints imposed by VFL and is used only to quantify accuracy recovered through collaboration\.

![Refer to caption](https://arxiv.org/html/2609.25082v1/centralized.png)Figure 2:Architecture of the Centralized baseline\.
### 3\.2FL protocols

FL allows multiple parties to train a shared predictive system while retaining their raw data locally\[[15](https://arxiv.org/html/2609.25082#bib.bib18)\]\. Depending on the data partition, a protocol may exchange model updates, intermediate representations, or other training quantities rather than raw features\. In horizontal FL \(HFL\), parties share the same feature space but possess different samples; in VFL, they possess complementary feature subsets for overlapping samples\. We focus on VFL and, specifically, on the SBVFL variant\.

In standard VFL, the passive party computes a local representation

hp\(i\)=fp​\(xp\(i\),ϕ\),h\_\{p\}^\{\(i\)\}=f\_\{p\}\\bigl\(x\_\{p\}^\{\(i\)\};\\phi\\bigr\),\(3\.2\)and transmits it to the active party or a coordinating server\. The active party combines this representation with its own representationha\(i\)=fa​\(xa\(i\),θa\)h\_\{a\}^\{\(i\)\}=f\_\{a\}\(x\_\{a\}^\{\(i\)\};\\theta\_\{a\}\), computes the loss, and can return the gradient with respect tohp\(i\)h\_\{p\}^\{\(i\)\}so that the passive model can be updated\. The parameters of the two local models are not averaged or otherwise merged; each party updates its own parameters\. Standard VFL therefore avoids raw\-feature exchange but requires repeated communication of label\-dependent training quantities\.

![Refer to caption](https://arxiv.org/html/2609.25082v1/bvfl-scheme.png)Figure 3:Scheme for the VFL experiment with the FL Platform\.SBVFL\[[2](https://arxiv.org/html/2609.25082#bib.bib2)\]removes this recurring gradient channel: instead of receiving label\-dependent gradients, the passive party trains on synthetic targets that the active party generates from the true labels and sends once per training sample\. This section states only the steps needed to follow the experiments; the paradigm itself, its communication accounting, and its privacy analysis are given in Acero et al\.\[[2](https://arxiv.org/html/2609.25082#bib.bib2)\]\.

A server, logically embedded within the active party, associatesQQsynthetic labels with each class and retains the inverse mapping\. For each sample it draws one synthetic label of that sample’s class, and the resulting synthetic targetz\(i\)z^\{\(i\)\}is transmitted to the passive party once, before local training\. Following\[[2](https://arxiv.org/html/2609.25082#bib.bib2)\],QQis called the privacy multiplier: the more synthetic labels share a class, the harder the recovery of the real labels from the transmitted targets becomes\.

The passive party trainsModp\\mathrm\{Mod\}\_\{p\}on its own features against the synthetic targets, without access toYYor to the inverse mapping, and returns its trained outputsop\(i\)o\_\{p\}^\{\(i\)\}once\. The server assembles the two parties’ outputs into the input of the aggregationggof Equation \([2\.1](https://arxiv.org/html/2609.25082#S2.E1)\) and trainsggagainst the true labels, which is where the return to the label space takes place\. The active\-party model consumesxa\(i\)x\_\{a\}^\{\(i\)\}alone, and the passive party’s outputs enter only at the aggregation\. In the two\-party setting used here, the passive party is therefore contacted twice, once to receive the synthetic targets and once to return its outputs\.

In the experiments,Modp\\mathrm\{Mod\}\_\{p\}is an ensemble of independent classical random forest models, one per synthetic label, each fitted to the corresponding coordinate of the synthetic target\. IncreasingQQincreases the number of synthetic labels associated with each class; its effect on downstream accuracy is evaluated empirically in Section[7\.2](https://arxiv.org/html/2609.25082#S7.SS2)\. The two parties may therefore use different model families and parameter spaces\. Cross\-party weight averaging is not required, irrespective of whether a local model is classical, quantum, or hybrid\.

## 4The SMPP Benchmark and Its Vertical Partition

This section motivates and defines SMPP and analyzes the vertical partition required for blind training\.

### 4\.1Multiplicative Periodic Structure

Angle encoding induces a structured function class\. A qubit prepared from\|0⟩\\lvert 0\\ranglebyRY​\(ω​x\)R\_\{Y\}\(\\omega x\)has Bloch components\(sin⁡ω​x,0,cos⁡ω​x\)\(\\sin\\omega x,0,\\cos\\omega x\), so a Pauli\-ZZexpectation is sinusoidal in the encoded feature\. For a product state, a tensor\-product observable factorizes into the product of the corresponding single\-qubit expectations:

⟨Zq1⋯Zqk⟩=∏j=1kcqjcos\(ωqjxqj\+φqj\),\|cqj\|≤1\.\\bigl\\langle Z\_\{q\_\{1\}\}\\cdots Z\_\{q\_\{k\}\}\\bigr\\rangle=\\prod\_\{j=1\}^\{k\}c\_\{q\_\{j\}\}\\cos\\bigl\(\\omega\_\{q\_\{j\}\}x\_\{q\_\{j\}\}\+\\varphi\_\{q\_\{j\}\}\\bigr\),\\qquad\\lvert c\_\{q\_\{j\}\}\\rvert\\leq 1\.\(4\.1\)
Constructing a target function whose structure is deliberately matched to a model class’s inductive bias, to isolate a measurable advantage for that class, is an established practice in QML: Heimman et al\.\[[7](https://arxiv.org/html/2609.25082#bib.bib19)\]construct Fourier\-structured regression targets to compare circuit ansätze, while Huang et al\.\[[8](https://arxiv.org/html/2609.25082#bib.bib20)\]and Liu et al\.\[[11](https://arxiv.org/html/2609.25082#bib.bib21)\]construct a discrete\-logarithm\-based learning problem to establish a provable quantum speed\-up over any classical learner\. SMPP follows the same principle, applied to the tensor\-product readout of an angle\-encoded circuit in a vertically partitioned setting\.

A readout of this form represents a product of periodic factors with a parameter count that grows linearly with the number of encoded features\. A piecewise\-linear classical network instead represents the corresponding alternating decision regions through its linear regions\. SMPP exposes this difference in inductive bias\.

The construction isolates a target family on which the circuit’s inductive bias matches the target\. All circuits used here are small enough to be simulated exactly by a classical processor, and the primary comparison is the trainable parameter count required to attain a specified accuracy\.

### 4\.2Task Definition

Letd=4d=4andx∼Uniform⁡\(\[−π,π\]4\)x\\sim\\mathrm\{Uniform\}\\bigl\(\[\-\\pi,\\pi\]^\{4\}\\bigr\)\. Define the two*half\-signals*

A⁡\(x\)=sin⁡\(ω​x1\)​sin⁡\(ω​x2\),B⁡\(x\)=sin⁡\(ω​x3\)​sin⁡\(ω​x4\),A\(x\)=\\sin\(\\omega x\_\{1\}\)\\,\\sin\(\\omega x\_\{2\}\),\\qquad B\(x\)=\\sin\(\\omega x\_\{3\}\)\\,\\sin\(\\omega x\_\{4\}\),\(4\.2\)and the label

y=𝟙\[A\(x\)\+B\(x\)\>0\],y=\\mathds\{1\}\\bigl\[A\(x\)\+B\(x\)\>0\\bigr\],\(4\.3\)
A fractionη\\etaof labels is then flipped independently, which caps the attainable test accuracy at1−η1\-\\eta\. We useω=1\\omega=1andη=0\.05\\eta=0\.05, so the cap is0\.950\.95\. We refer to the resulting benchmark as SMPP: each half is a two\-feature multiplicative periodic signal, while the label is determined by the additive combination of the two halves\. Each half\-signal is a sign\-alternating checkerboard over its own two features, so neither half is linearly separable, while the label is the sign of their sum\. Figure[4](https://arxiv.org/html/2609.25082#S4.F4)shows the two half\-signals in its left and center panels and the label in its right panel\.

Figure 4:The SMPP task: the two half\-signals and the label\.The construction has three properties that are central to the federated experiment\.

1. \(P1\)*Affine models are uninformative\.*The periodic sign structure is symmetric under coordinate reflections, giving class\-conditional marginals with matching first and second moments, so no affine rule separates the classes at better than chance\. The benchmark therefore isolates the role of nonlinear structure\.
2. \(P2\)*Each half is marginally informative\.*Because the label combines the two halves additively, conditioning on the sign of either half shifts the label distribution; in the noiseless construction,ℙ⁡\(y=1∣A\>0\)=3/4\\mathbb\{P\}\(y=1\\mid A\>0\)=3/4\. This property is required for passive\-party learning from synthetic targets under SBVFL\.
3. \(P3\)*Neither half is sufficient\.*A rule based onAAalone reaches only3/43/4accuracy on noiseless labels, whereas access to both halves permits perfect classification\. Thus the partition creates a nonzero and quantifiable collaboration gap\.

### 4\.3Vertical Partition and Additive Label Structure

The active party receives\(x1,x2\)\(x\_\{1\},x\_\{2\}\)and the passive party receives\(x3,x4\)\(x\_\{3\},x\_\{4\}\), so each party owns one complete half\-signal\. Each local view is therefore itself a two\-feature multiplicative periodic task, matched to a two\-qubit tensor\-product readout\.

The additive label rule in Equation \([4\.3](https://arxiv.org/html/2609.25082#S4.E3)\) is essential to the blind protocol\. Under SBVFL, the passive party trains only from its own features and the synthetic targets, so its feature block must retain marginal information about the true label\. By contrast, for the multiplicative alternativey=𝟙\[AB\>0\]y=\\mathds\{1\}\[AB\>0\],

ℙ⁡\(y=1∣A\>0\)=ℙ⁡\(y=1∣A<0\)=12,\\mathbb\{P\}\(y=1\\mid A\>0\)=\\mathbb\{P\}\(y=1\\mid A<0\)=\\tfrac\{1\}\{2\},\(4\.4\)so each party’s feature block is marginally independent of the label\. The passive model could then learn no label information from its synthetic targets\. SMPP therefore places the multiplicative structure within each party’s feature block and combines the two blocks additively\. This partition design is a general consideration when constructing blind vertical benchmarks\.

## 5Models

All models use the same preprocessing and are trained under the common procedure described in Section[6](https://arxiv.org/html/2609.25082#S6)\.

### 5\.1Hybrid Quantum\-Classical Model

The active party uses a variational quantum circuit followed by a trainable classical linear head\. The circuit returns a small vector of Pauli\-ZZcorrelators, which the classical head maps to a class probability\. This is the standard pattern of a quantum layer embedded within a classical network; the specific ansatz is shown in Figure[5](https://arxiv.org/html/2609.25082#S5.F5)\. Each qubit encodes one feature throughRY​\(xq\)R\_\{Y\}\(x\_\{q\}\)and carries two layers of trainableRY​RZR\_\{Y\}R\_\{Z\}rotations, and a CNOT couples the two qubits of each pair, so the entangling pattern stays inside a party’s feature block \(Section[4\.3](https://arxiv.org/html/2609.25082#S4.SS3)\)\. The readout is the pair of correlators⟨Z1​Z2⟩\\langle Z\_\{1\}Z\_\{2\}\\rangleand⟨Z3​Z4⟩\\langle Z\_\{3\}Z\_\{4\}\\rangle\.

\|0⟩\\lvert 0\\rangleRY​\(x1\)R\_\{Y\}\(x\_\{1\}\)RY​\(θ1,1\)R\_\{Y\}\(\\theta\_\{1,1\}\)RZ​\(θ1,2\)R\_\{Z\}\(\\theta\_\{1,2\}\)RY​\(θ1,3\)R\_\{Y\}\(\\theta\_\{1,3\}\)RZ​\(θ1,4\)R\_\{Z\}\(\\theta\_\{1,4\}\)\|0⟩\\lvert 0\\rangleRY​\(x2\)R\_\{Y\}\(x\_\{2\}\)RY​\(θ2,1\)R\_\{Y\}\(\\theta\_\{2,1\}\)RZ​\(θ2,2\)R\_\{Z\}\(\\theta\_\{2,2\}\)RY​\(θ2,3\)R\_\{Y\}\(\\theta\_\{2,3\}\)RZ​\(θ2,4\)R\_\{Z\}\(\\theta\_\{2,4\}\)\|0⟩\\lvert 0\\rangleRY​\(x3\)R\_\{Y\}\(x\_\{3\}\)RY​\(θ3,1\)R\_\{Y\}\(\\theta\_\{3,1\}\)RZ​\(θ3,2\)R\_\{Z\}\(\\theta\_\{3,2\}\)RY​\(θ3,3\)R\_\{Y\}\(\\theta\_\{3,3\}\)RZ​\(θ3,4\)R\_\{Z\}\(\\theta\_\{3,4\}\)\|0⟩\\lvert 0\\rangleRY​\(x4\)R\_\{Y\}\(x\_\{4\}\)RY​\(θ4,1\)R\_\{Y\}\(\\theta\_\{4,1\}\)RZ​\(θ4,2\)R\_\{Z\}\(\\theta\_\{4,2\}\)RY​\(θ4,3\)R\_\{Y\}\(\\theta\_\{4,3\}\)RZ​\(θ4,4\)R\_\{Z\}\(\\theta\_\{4,4\}\)Figure 5:The quantum layer of the centralized model\.Formally, withn=dn=dqubits,LLlayers and observables𝒪=\{Z1​Z2,Z3​Z4\}\\mathcal\{O\}=\\\{Z\_\{1\}Z\_\{2\},\\,Z\_\{3\}Z\_\{4\}\\\}, the model computes

y^​\(x\)=σ⁡\(w⊤​\[⟨Z1​Z2⟩ψ⁡\(x,θ\),⟨Z3​Z4⟩ψ⁡\(x,θ\)\]\+b\),\\hat\{y\}\(x\)=\\sigma\\Bigl\(w^\{\\top\}\\bigl\[\\langle Z\_\{1\}Z\_\{2\}\\rangle\_\{\\psi\(x;\\theta\)\},\\;\\langle Z\_\{3\}Z\_\{4\}\\rangle\_\{\\psi\(x;\\theta\)\}\\bigr\]\+b\\Bigr\),\(5\.1\)whereψ⁡\(x,θ\)\\psi\(x;\\theta\)is the state prepared by the circuit of Figure[5](https://arxiv.org/html/2609.25082#S5.F5),σ\\sigmais the logistic function, and\(w,b\)\(w,b\)are the head parameters\. With one qubit per input feature, the circuit consumes the features directly, so the parameter count comprises the circuit rotations and the classical head\.

The count is therefore fixed by the number of encoded features and by the output convention of the training loop\. Withnnencoded features the circuit carries4​n4nangles, two rotations per qubit in each of theL=2L=2layers, and the head carries one weight per readout correlator for each output, plus one bias per output\. The centralized model encodes four features and reads two correlators, giving16\+3=1916\+3=19trainable parameters\. A single party’s two\-feature view uses a two\-qubit circuit with the single correlator⟨Z1​Z2⟩\\langle Z\_\{1\}Z\_\{2\}\\rangle, giving8\+2=108\+2=10\. The federated active party uses that same two\-qubit circuit, but the federated training loop scores classes with a logit vector, so its head maps the correlator to two logits and the count is8\+4=128\+4=12\. The two additional parameters express the same decision function redundantly: the decision depends on the difference of the two logits, which is again an affine function of the correlator\.

Expectation values are evaluated by exact state\-vector simulation\. For four qubits, the state contains 16 amplitudes, and gradients are obtained by automatic differentiation through the state vector\.

### 5\.2Classical Baselines

We use two classical baselines\. A fully connected network with one hidden ReLU layer is evaluated at the hidden widthsh∈\{10,50,200\}h\\in\\\{10,50,200\\\}in every scenario\. The trainable\-parameter count of a given width depends on the input dimension and on the output convention: 41, 201 and 801 on a party’s two\-feature view, 61, 301 and 1201 on the pooled four features, and 52, 252 and 1002 for the federated active party, whose head emits two logits\. The sweep therefore provides a capacity range rather than a single classical reference\.

An ensemble of 300 random forest trees is included as a nonlinear tree\-based baseline\. Its size is reported as the total number of tree nodes rather than as a trainable parameter count and is therefore kept separate from the neural\-network and circuit parameter counts\.

## 6Experimental Protocol

We now describe the experimental protocol underlying the results of Section[7](https://arxiv.org/html/2609.25082#S7), comprising the three training scenarios evaluated for each model family and the training, preprocessing, and evaluation procedure common to all of them\.

### 6\.1Training Scenarios

The protocol evaluates three scenarios, listed here in the order in which Section[7\.1](https://arxiv.org/html/2609.25082#S7.SS1)reports them\. The underlying data, splits, optimization procedure, and hyperparameter selection are held fixed; the scenarios differ in the feature columns available to the model and in whether the two parties collaborate\.

1. 1\.Local active\-party\.The active party trains using\(x1,x2\)\(x\_\{1\},x\_\{2\}\)only, providing the non\-collaborative reference for the active side\.
2. 2\.SBVFL\.The labels are encoded at multiplierQQ, the passive party fits its random forest ensemble on\(x3,x4\)\(x\_\{3\},x\_\{4\}\)and returns its outputs once, the active\-party model consumes\(x1,x2\)\(x\_\{1\},x\_\{2\}\)alone, and the server’s aggregation combines the two parties’ outputs into the prediction\.
3. 3\.Centralized\.The four features\(x1,x2,x3,x4\)\(x\_\{1\},x\_\{2\},x\_\{3\},x\_\{4\}\)are pooled and a single model is trained on the combined data\. This is the non\-private reference\.

For a local party view, the hybrid component is reduced to a two\-qubit circuit with one readout correlator⟨Z1​Z2⟩\\langle Z\_\{1\}Z\_\{2\}\\rangleand 10 trainable parameters, and in the federated scenario that same circuit carries the two\-logit head required by the federated training loop, giving 12; the classical baselines are reduced to the corresponding input dimension in both cases\. Otherwise, the model specification is unchanged\. Within a scenario, all models receive the same feature columns and are therefore compared on identical inputs; across scenarios the input dimension differs, so the centralized experiment selects the model family used by the active party rather than a fixed parameter count\.

Federated experiments are executed on[Sherpa\.ai](https://www.sherpa.ai/)’s platform through its blind vertical training interface\. The platform supplies the PSI step, label encoding, passive\-party fitting, and blind aggregation; this work specifies the dataset and the active\-party model\. The intersection is partitioned so that the federated training fold contains the same 2000 rows used by the centralized and local experiments, enabling direct comparison of test accuracies\.

### 6\.2Protocol

One SMPP instance with 2000 training rows and 20,000 test rows is drawn once and reused by every experiment, so the centralized comparison, the local baseline, and the federated runs are evaluated on the same rows, with each party’s local view given by the corresponding column block of the pooled view\. Each configuration is then evaluated over 10 training seeds, which determine the model initialization and batch order only\. The large test set keeps test\-sampling uncertainty below the seed\-to\-seed variation of interest\.

All model families use the same rows, split, and preprocessing\. We report the mean test accuracy across the 10 training seeds with its standard deviation, and compare models by the difference in their means\. The standard deviation measures variation over training seeds at a fixed benchmark instance; it does not cover variation across independently drawn benchmark instances\.

All gradient\-trained models use binary cross\-entropy loss, AdamW, batch size 128, a 300\-epoch cap, and the same early\-stopping rule\. Training monitors a stratified 20% inner\-validation holdout, uses a patience of 30 epochs, and restores the best validation state\.

Learning rates are selected separately for each model family from\{0\.3,0\.1,0\.03,0\.01,0\.003\}\\\{0\.3,0\.1,0\.03,0\.01,0\.003\\\}using inner validation and tuning seeds that are disjoint from the reporting seeds\. The selected rates are then fixed for all reported experiments\.

All models use the same preprocessing rule: each feature is mapped to\[−π,π\]\[\-\\pi,\\pi\]using the minimum and maximum of the training fold\. This scaling is required by the angle encoding and is applied identically to the classical baselines\.

Test accuracy is the primary metric, with AUC reported as a secondary metric\. Parameter counts are obtained programmatically from the model definitions\. In the federated scenario they cover the active party’s own model; the server’s aggregation is supplied by the platform and is identical for every active\-party model compared, since all of them emit two class scores\.

The simulations use PyTorch2\.122\.12with float64/complex128 arithmetic, NumPy2\.4\.62\.4\.6, scikit\-learn1\.9\.01\.9\.0, and Python3\.123\.12\. The quantum circuits use Qiskit1\.4\.41\.4\.4\. Experiments are executed on a single CPU core per configuration\.

## 7Results

In this section we report the effect of collaboration on classification accuracy across the three training scenarios, followed by an ablation of the passive party’s privacy multiplier\.

### 7\.1The Three Training Scenarios

Table[2](https://arxiv.org/html/2609.25082#S7.T2)and Figure[6](https://arxiv.org/html/2609.25082#S7.F6)report the three scenarios of Section[6\.1](https://arxiv.org/html/2609.25082#S6.SS1)for each model family\. Every entry is the mean test accuracy over the 10 training seeds with its standard deviation in parentheses, measured on the single benchmark instance of Section[6\.2](https://arxiv.org/html/2609.25082#S6.SS2)\. The classical network is the best width of the sweep in each scenario\. In the local and federated scenarios the hybrid model is the two\-qubit circuit with one readout correlator; in the centralized scenario, it is the four\-qubit model of Figure[5](https://arxiv.org/html/2609.25082#S5.F5)\. The Parameters row reports the number of trainable parameters for the hybrid and classical\-network families, obtained programmatically from the model definitions \(Section[6](https://arxiv.org/html/2609.25082#S6)\), and the total number of tree nodes for the random forest \(average over the ten seeds\)\.

Table 2:Test accuracy \(mean, with standard deviation in parentheses\) and trainable\-parameter count in the three training scenarios\. The random forest’s size is reported as its total number of tree nodes rather than a trainable\-parameter count, since it has no trainable parameters in the usual sense\.Under the active party’s feature view, the hybrid model reaches0\.72270\.7227with 10 trainable parameters, the best classical network reaches0\.72230\.7223with 41, and the random forest reaches0\.68950\.6895with 207,736 tree nodes\. The two parametric families agree to within0\.0010\.001, although their trainable\-parameter counts differ by a factor of four\. Widening the network does not improve its local accuracy: it reaches0\.72230\.7223,0\.71870\.7187, and0\.71830\.7183at hidden widths1010,5050, and200200, respectively, corresponding to 41, 201, and 801 trainable parameters\. The local accuracy is therefore limited primarily by the information contained in the feature block, as property \(P3\) of Section[4](https://arxiv.org/html/2609.25082#S4)anticipates\. The partition is symmetric by construction, with Equation \([4\.2](https://arxiv.org/html/2609.25082#S4.E2)\) assigning each party a half\-signal of the same form, so neither party holds a privileged feature block\.

Figure 6:Mean test accuracy of the three model families in the three scenarios\.With the four features pooled, the hybrid model reaches0\.92160\.9216with 19 trainable parameters, within0\.0280\.028of the0\.950\.95cap imposed by the label noise\. The best classical network reaches0\.86630\.8663with 1201 parameters, and the 300\-tree forest reaches0\.84620\.8462with 140,741 nodes\. The margin over the network,\+0\.0554\+0\.0554, is about eight times the larger of the two standard deviations,0\.00560\.0056and0\.00680\.0068, while the margin over the forest is\+0\.0755\+0\.0755\. This comparison motivates the selection of the hybrid model as the active party in the federated experiment\.

The hybrid model improves from 0\.7227 in the local scenario to 0\.9216 in the centralized one\. SBVFL reaches 0\.8757 with 12 trainable parameters in the active\-party network, comprising eight circuit rotations and a four\-parameter head \(Section[5\.1](https://arxiv.org/html/2609.25082#S5.SS1)\), substantially improving on the local baseline and closely approaching the centralized reference\. The hybrid model is also the most accurate active party tested, with margins of\+0\.0134\+0\.0134over the best classical network at 1002 parameters \(h=200h=200\),\+0\.0191\+0\.0191overh=50h=50,\+0\.0496\+0\.0496overh=10h=10, and\+0\.0692\+0\.0692over the forest \(0\.8065, 673,276 nodes\)\. Each margin exceeds the seed\-to\-seed standard deviation of the corresponding comparison\. The SBVFL forest is markedly larger than the forests trained on the same two\-feature view in the local scenario \(207,736 nodes\) or on the pooled four\-feature view in the centralized scenario \(140,741 nodes\), which we attribute to the platform’s training loop rather than to the two\-feature input itself, as discussed below\. The ordering of the model families is the same as in the centralized scenario\. The passive party observes neither the true labels nor label\-dependent gradients and is contacted twice during the protocol\.

The local baseline and the federated configuration differ in more than the passive party’s contribution: the passive features enter throughop\(i\)o\_\{p\}^\{\(i\)\}, the server fits its aggregation against the true labels, and the active\-party model is trained through the platform’s loop rather than through the local harness\. The experiments vary these factors together and do not separate them, so interpreting the gain as the value of the passive party’s information is a property of the experimental design rather than a measured decomposition\. An aggregation applied to the active party’s output alone is a function of that output, so any gain from that source is bounded by the accuracy attainable from the active model’s own score\.

### 7\.2Ablation: The Passive Party’s Privacy Multiplier

The privacy multiplierQQcontrols the number of synthetic labels associated with each class\. Figure[7](https://arxiv.org/html/2609.25082#S7.F7)variesQQwhile keeping the remaining protocol fixed; every setting is measured on the same benchmark instance and the same ten training seeds, and every entry is the mean test accuracy with its standard deviation\. The quantity varied is the platform’s privacy\-multiplier setting\. No privacy guarantee and no privacy loss is quantified in this work, so these measurements describe accuracy againstQQand not a privacy\-utility curve\. In this sweep the synthetic\-label draw follows the training seed, so each mean averages over ten label\-encoding realizations, whereas the federated scenario of Section[7\.1](https://arxiv.org/html/2609.25082#S7.SS1)fixes one realization together with the benchmark instance\. The two settings therefore measure different quantities at the same multiplier,0\.86530\.8653here against0\.87570\.8757in Table[2](https://arxiv.org/html/2609.25082#S7.T2), and the sweep is to be read within itself\.

Figure 7:Mean test accuracy as a function of the privacy multiplierQQ, with error bars denoting standard deviation across seeds\.AtQ=1Q=1, the active\-party accuracy exceeds that at the reference settingQ=7Q=7by0\.01700\.0170, against standard deviations of0\.00440\.0044and0\.00890\.0089\. ForQ=5,10,15Q=5,10,15, the differences fromQ=7Q=7are\+0\.0035\+0\.0035,−0\.0011\-0\.0011, and−0\.0019\-0\.0019, respectively, each smaller than the corresponding seed\-to\-seed standard deviations\. TheQ=3Q=3setting is lower by0\.01180\.0118, so accuracy is not monotone inQQover the tested values\.

For the tested settings above the weakest multiplier, accuracy is approximately flat inQQ\. The strongest multiplier tested is at least as accurate as the weakest:Q=15Q=15exceedsQ=3Q=3by0\.00990\.0099in the mean\. Among the tested settings, onlyQ=1Q=1differs from the default by an amount larger than the corresponding seed\-to\-seed variation\.

## 8Discussion

The main result of the manuscript is the accuracy recovered under blind federated training\. SBVFL substantially improves on active\-party local training and closely approaches the non\-private centralized reference, while preserving the ordering of the active\-party model classes observed in the centralized experiment\. The privacy ablation further indicates that, over the tested settings, increasing the multiplier fromQ=3Q=3toQ=15Q=15does not reduce accuracy; the mean increases by0\.00990\.0099across the ten seeds\.

The partition analysis shows that local accuracy is determined by the information available in each feature block\. On the active party’s view the model families plateau together, at0\.72270\.7227and0\.72230\.7223for the circuit and the classical network, and added capacity does not move them, while the pooled hybrid model reaches0\.92160\.9216, yielding a collaboration gap of0\.19890\.1989\. This interpretation depends on using a task for which the local view is itself close to saturation\.

The partition analysis also yields a general benchmark\-design principle\. The multiplicative structure exploited by the tensor\-product readout must be contained within each party’s feature block rather than introduced only through an interaction across parties\. A multiplicative combination across the partition would make each local feature view marginally independent of the label and would therefore be incompatible with the passive\-party learning step of SBVFL\. SMPP separates these roles by using multiplicative structure within each block and additive composition across blocks\.

The active\-party model choice follows from this structural match rather than from a general advantage of quantum models\. When the target contains products of periodic functions of distinct features, the tensor\-product readout represents that form directly with a compact parameterization, whereas a piecewise\-linear network approximates the same structure through a collection of linear regions\. On SMPP, this produces a0\.0550\.055accuracy margin over the 1201\-parameter classical network and a0\.0750\.075margin over the 300\-tree forest, both at least eight times the larger of the two standard deviations in the corresponding comparison\.

Parameter efficiency is relevant operationally because gradient\-based training on hardware requires repeated circuit evaluations for the trainable parameters\. Reducing the model from 1201 to 19 trainable parameters therefore reduces the number of parameter\-dependent evaluations required for optimization, although this study does not measure hardware wall\-clock performance\. The accounting is the parameter\-shift one, in which each trainable circuit parameter contributes evaluations at every optimization step while the classical head is differentiated analytically\. The comparison is between trainable\-parameter counts; the random forest has none and is sized by its tree nodes, so it enters as an accuracy reference rather than as a point on the parameter axis\. The reported circuit uses four qubits and a shallow architecture, but all numerical results here are obtained with exact classical simulation\.

These results have some limitations\. First, SMPP’s measured parameter efficiency reflects targets whose structure matches this multiplicative periodic form; a second benchmark instance kept the ordering of model families unchanged, with accuracy shifting by at most0\.01230\.0123\. Second, the comparison concerns a four\-qubit circuit that is exactly classically simulable, and the federated experiments run all parties within a single process without network transport, so the reported results reflect predictive behavior rather than distributed runtime\. Third, validating these findings on additional, real\-world datasets remains necessary to establish the broader effectiveness of this approach\. Finally, the results assume complete sample overlap and consider onlyω=1\\omega=1with a single label\-noise level; larger circuits can also suffer from gradient concentration\[[14](https://arxiv.org/html/2609.25082#bib.bib17)\], and how parameter efficiency behaves at larger register sizes or depths remains to be established\[[1](https://arxiv.org/html/2609.25082#bib.bib1)\]\.

## 9Conclusion

We have evaluated a hybrid quantum\-classical model as the active party in a two\-party SBVFL protocol on the SMPP benchmark\. Our experiments show that SBVFL improves accuracy from 0\.7227 \(local baseline\) to 0\.8757, closely approaching non\-private centralized training, with the hybrid quantum\-classical model reaching this accuracy using only 12 trainable parameters versus 1002 \(classical network\) and 673,276 nodes \(random forest\)\. A privacy\-multiplier ablation further shows that accuracy does not systematically degrade asQQ\(the number of synthetic labels per class\) increases\.

These findings confirm that FL enables privacy\-preserving collaboration between a hybrid quantum\-classical active party and a classical passive party without centralizing raw data, while the quantum model retains its accuracy advantage under this protocol\. This makes parameter\-efficient quantum models combined with blind vertical federation a promising direction for multi\-party ML in settings such as chemistry simulation, financial modeling, and image classification tasks, where modern quantum hardware and strict data\-sharing constraints coexist\.

## Contributions and Acknowledgments

Carlos Cano

Daniel M\. Jimenez\-Gutierrez

Diego Sal

Georgios Kellaris

Joaquin del Rio

Oleksii Sliusarenko

Xabi Uribe\-Etxebarria

The authors are presented in alphabetical order by first name\.

## References

- \[1\]A\. Abbas, D\. Sutter, C\. Zoufal, A\. Lucchi, A\. Figalli, and S\. Woerner\(2021\)The power of quantum neural networks\.Nature Computational Science1\(6\),pp\. 403–409\.External Links:[Document](https://dx.doi.org/10.1038/s43588-021-00084-1)Cited by:[§8](https://arxiv.org/html/2609.25082#S8.p6.1)\.
- \[2\]A\. Acero, D\. M\. Jimenez\-Gutierrez, D\. Pighin, E\. Zuazua, J\. Del Rio, and X\. Uribe\-Etxebarria\(2025\)The Sherpa\.ai blind vertical federated learning paradigm to minimize the number of communications\.External Links:2510\.17901Cited by:[§1\.1](https://arxiv.org/html/2609.25082#S1.SS1.p1.1),[§3\.2](https://arxiv.org/html/2609.25082#S3.SS2.p3.1),[§3\.2](https://arxiv.org/html/2609.25082#S3.SS2.p4.1)\.
- \[3\]R\. Ballester, C\. Blum, J\. Cerquides, and L\. Artiles\(2025\)Vertical quantum federated learning\.InProceedings of the 2025 International Conference on Intelligent Computing and Its Emerging Applications \(ICEA 2025\),Melbourne, VIC, Australia,pp\. 66–71\.External Links:[Document](https://dx.doi.org/10.1145/3803817.3803821)Cited by:[§1\.1](https://arxiv.org/html/2609.25082#S1.SS1.p2.1),[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p3.1),[Table 1](https://arxiv.org/html/2609.25082#S2.T1.2.1.3.1.1)\.
- \[4\]R\. Ballester, J\. Cerquides, and L\. Artiles\(2025\)Quantum federated learning: a comprehensive literature review of foundations, challenges, and future directions\.Quantum Machine Intelligence7\(2\),pp\. 73\.External Links:[Document](https://dx.doi.org/10.1007/s42484-025-00292-2)Cited by:[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p2.1)\.
- \[5\]J\. Biamonte, P\. Wittek, N\. Pancotti, P\. Rebentrost, N\. Wiebe, and S\. Lloyd\(2017\)Quantum machine learning\.Nature549\(7671\),pp\. 195–202\.External Links:[Document](https://dx.doi.org/10.1038/nature23474)Cited by:[§1](https://arxiv.org/html/2609.25082#S1.p1.1)\.
- \[6\]A\. Gircha, A\. S\. Boev, K\. Avchaciov, P\. Fedichev, and A\. Fedorov\(2023\)Hybrid quantum\-classical machine learning for generative chemistry and drug design\.Scientific Reports13\(1\),pp\. 8250\.Cited by:[§1](https://arxiv.org/html/2609.25082#S1.p2.1)\.
- \[7\]D\. Heimann, H\. Hohenfeld, G\. Schönhoff, E\. Mounzer, and F\. Kirchner\(2025\)Learning fourier series with parametrized quantum circuits\.Physical Review Research7\(2\),pp\. 023151\.Cited by:[§4\.1](https://arxiv.org/html/2609.25082#S4.SS1.p3.1)\.
- \[8\]H\. Huang, M\. Broughton, M\. Mohseni, R\. Babbush, S\. Boixo, H\. Neven, and J\. R\. McClean\(2021\)Power of data in quantum machine learning\.Nature communications12\(1\),pp\. 2631\.Cited by:[§4\.1](https://arxiv.org/html/2609.25082#S4.SS1.p3.1)\.
- \[9\]N\. Innan, M\. A\. Khan, A\. Marchisio, M\. Shafique, and M\. Bennai\(2024\)FedQNN: federated learning using quantum neural networks\.In2024 International Joint Conference on Neural Networks \(IJCNN\),pp\. 1–9\.External Links:[Document](https://dx.doi.org/10.1109/IJCNN60899.2024.10650730),2403\.10861Cited by:[§1\.1](https://arxiv.org/html/2609.25082#S1.SS1.p2.1),[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p4.1)\.
- \[10\]N\. Innan, A\. Marchisio, M\. Bennai, and M\. Shafique\(2024\)QFNN\-FFD: quantum federated neural network for financial fraud detection\.External Links:2404\.02595Cited by:[§1\.1](https://arxiv.org/html/2609.25082#S1.SS1.p2.1),[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p4.1)\.
- \[11\]Y\. Liu, S\. Arunachalam, and K\. Temme\(2021\)A rigorous and robust quantum speed\-up in supervised machine learning\.Nature physics17\(9\),pp\. 1013–1017\.Cited by:[§4\.1](https://arxiv.org/html/2609.25082#S4.SS1.p3.1)\.
- \[12\]H\. Luo, Z\. Zhai, Q\. Zhou, J\. Qi, Y\. Deng, and X\. Wang\(2026\)Evidential quantum vertical federated learning\.Note:Verify final venue/publication status before submission\.External Links:2603\.21102Cited by:[§1\.1](https://arxiv.org/html/2609.25082#S1.SS1.p2.1),[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p3.1),[Table 1](https://arxiv.org/html/2609.25082#S2.T1.2.1.4.1.1)\.
- \[13\]A\. Mathur, A\. Gupta, and S\. K\. Das\(2025\)When federated learning meets quantum computing: survey and research opportunities\.External Links:2504\.08814Cited by:[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p2.1)\.
- \[14\]J\. R\. McClean, S\. Boixo, V\. N\. Smelyanskiy, R\. Babbush, and H\. Neven\(2018\)Barren plateaus in quantum neural network training landscapes\.Nature Communications9\(1\),pp\. 4812\.External Links:[Document](https://dx.doi.org/10.1038/s41467-018-07090-4)Cited by:[§8](https://arxiv.org/html/2609.25082#S8.p6.1)\.
- \[15\]H\. B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. Agüera y Arcas\(2017\)Communication\-efficient learning of deep networks from decentralized data\.Proceedings of Machine Learning Research \(AISTATS\)\.External Links:1602\.05629Cited by:[§1](https://arxiv.org/html/2609.25082#S1.p4.1),[§3\.2](https://arxiv.org/html/2609.25082#S3.SS2.p1.1)\.
- \[16\]D\. C\. Nguyen, M\. R\. Uddin, S\. Shaon, R\. Rahman, O\. Dobre, and D\. Niyato\(2025\)Quantum federated learning: a comprehensive survey\.External Links:2508\.15998Cited by:[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p2.1)\.
- \[17\]M\. A\. Nielsen and I\. L\. Chuang\(2010\)Quantum computation and quantum information\.Cambridge University Press\.Cited by:[§1](https://arxiv.org/html/2609.25082#S1.p1.1)\.
- \[18\]J\. Preskill\(2018\)Quantum computing in the NISQ era and beyond\.Quantum2,pp\. 79\.External Links:[Document](https://dx.doi.org/10.22331/q-2018-08-06-79)Cited by:[§1](https://arxiv.org/html/2609.25082#S1.p2.1)\.
- \[19\]S\. Raj, I\. Kerenidis, A\. Shekhar, B\. Wood, J\. Dee, S\. Chakrabarti, R\. Chen, D\. Herman, S\. Hu, P\. Minssen,et al\.\(2023\)Quantum deep hedging\.Quantum7,pp\. 1191\.Cited by:[§1](https://arxiv.org/html/2609.25082#S1.p2.1)\.
- \[20\]S\. Sai, A\. Sawaika, P\. Singh, and R\. Buyya\(2025\)Quantum federated learning: architectural elements and future directions\.External Links:2510\.17642Cited by:[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p2.1)\.
- \[21\]M\. Schuld, R\. Sweke, and J\. J\. Meyer\(2021\)Effect of data encoding on the expressive power of variational quantum\-machine\-learning models\.Physical Review A103\(3\),pp\. 032430\.External Links:[Document](https://dx.doi.org/10.1103/PhysRevA.103.032430)Cited by:[§1](https://arxiv.org/html/2609.25082#S1.p2.1),[§1](https://arxiv.org/html/2609.25082#S1.p3.1)\.
- \[22\]A\. Senokosov, A\. Sedykh, A\. Sagingalieva, B\. Kyriacou, and A\. Melnikov\(2024\)Quantum machine learning for image classification\.Machine Learning: Science and Technology5\(1\),pp\. 015040\.Cited by:[§1](https://arxiv.org/html/2609.25082#S1.p2.1)\.
- \[23\]Sherpa\.ai Research Team\(2023\)Privacy preserving AI: private set intersection \(PSI\)\.Technical reportTechnical ReportAI\-IRR\-157,Sherpa\.ai\.Cited by:[§2\.2](https://arxiv.org/html/2609.25082#S2.SS2.p1.1)\.
- \[24\]K\. Zaman, A\. Marchisio, M\. A\. Hanif, and M\. Shafique\(2025\)A survey on quantum machine learning: current trends, challenges, opportunities, and the road ahead\.External Links:2310\.10315Cited by:[§2\.1](https://arxiv.org/html/2609.25082#S2.SS1.p2.1)\.