arXiv subjects

Liou Tang

Publications and source records attributed to Liou Tang.

4 recordsLinked to original sources

arXiv2026

Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access

Quantum Machine Learning (QML) has shown rapid advances by utilizing quantum computing for machine learning tasks. Meanwhile, the privacy risks accompanying QML is also starting to be studied, which inherit privacy leakage channels from "classical" ML and also quantum-unique risks. Existing work on privacy-preserving QML largely focuses on a QML-as-a-service scenario, which generally assumes that the QML model owner provides only classical bit outputs to queries, while users (and adversaries) have only classical computing abilities. However, this view is increasingly challenged in a quantum-native world of quantum-capable users/adversaries, which may have access to both quantum computing abilities and access to quantum information output from service providers. In this paper, we aim to bridge this gap by examining membership inference attacks against QML models by demonstrating that increasing quantum access and quantum computing abilities provides provable theoretical privacy leakage and empirical adversarial gain. However, the probabilistic nature of QML introduces a gap between theoretical and empirical adversarial advantage. These results show that existing research on privacy leakage in QML models underestimates privacy leakage in emergent quantum-native access regimes, and we hope to establish a first step in examining potential privacy leakages for QML in the quantum-native world.

quant-ph↗

arXiv2026

Characterizing Privacy-Audit Alignment in Behavioral Audit of Machine Unlearning

The removal of learned data from Machine Learning models through Machine Unlearning (MU) has been widely studied; however, there is no agreed-upon scheme for auditing MU. Existing work shows that a dishonest model owner can falsify evidence to avoid executing MU, while curious auditors (and adversaries) can infer privacy-sensitive properties of the model and its training data even with limited access. Yet auditing of MU under mutual distrust between the model owner and the auditor remains unexplored. In this paper, we characterize how much a generic audit scheme that relies solely on querying the model for behavioral signals inevitably results in privacy leakage related to the retained set by providing a geometric transfer theorem that establishes a lower bound on retained set membership distinguishability based on the audit accuracy. In addition, we study how the unlearned set, target sample, and query protocol jointly determine the privacy-audit transfer coefficient through local and global model-parameter-space geometry. Our empirical experiments on both convex and non-convex models strongly support these results. Our results call for more careful consideration of the privacy-audit tension under a realistic auditor model and serve as a foundation for greater scrutiny of privacy-preserving audit scheme designs for the MU pipeline.

cs.LG↗

arXiv2026

Conformal-DP: A Density-Aware Mechanism for Differential Privacy over Riemannian Manifolds via Conformal Transformation

Differential Privacy (DP) is being increasingly adopted for non-Euclidean data that lie on complex, high-dimensional manifolds. Existing DP mechanisms for manifold data consider geometric properties when calibrating privacy perturbations, but they largely fail to capture variations in data density within datasets, leading to biased perturbations and suboptimal privacy-utility trade-offs due to heterogeneous data distributions. In this paper, we propose a novel density-aware differential privacy mechanism on Riemannian manifolds, referred to as Conformal-DP, that leverages conformal transformations to calibrate perturbations based on local densities and to induce a density-balanced geometry. We prove that our mechanism satisfies $ε$-differential privacy on any complete Riemannian manifold under mild regularity assumptions. In addition, we derive a closed-form expected geodesic error bound that depends only on the underlying data density ratio and is independent of global curvature. Our empirical results on synthetic and real-world datasets demonstrate that the proposed Conformal-DP mechanism substantially improves the privacy-utility trade-off in heterogeneous data distribution settings, with worst-case performance comparable to state-of-the-art manifold DP mechanisms that assume uniformly distributed data.

cs.CR↗

arXiv2025

Apollo: A Posteriori Label-Only Membership Inference Attack Towards Machine Unlearning

Machine Unlearning (MU) aims to update Machine Learning (ML) models following requests to remove training samples and their influences on a trained model efficiently without retraining the original ML model from scratch. While MU itself has been employed to provide privacy protection and regulatory compliance, it can also increase the attack surface of the model. Existing privacy inference attacks towards MU that aim to infer properties of the unlearned set rely on the weaker threat model that assumes the attacker has access to both the unlearned model and the original model, limiting their feasibility toward real-life scenarios. We propose a novel privacy attack, A Posteriori Label-Only Membership Inference Attack towards MU, Apollo, that infers whether a data sample has been unlearned, following a strict threat model where an adversary has access to the label-output of the unlearned model only. We demonstrate that our proposed attack, while requiring less access to the target model compared to previous attacks, can achieve relatively high precision on the membership status of the unlearned samples.

cs.LG↗