Decoupling Privacy Noise from Optimization in Transformer Forecasting

Abstract

Strong differential privacy often collapses utility in transformer-based time-series forecasting because noise is injected directly into high-dimensional gradients (e.g., DP-SGD), severely corrupting the optimization process. We introduce Low-Dimensional Feature-Path Privacy for Transformers (LDPT), which enforces privacy by routing calibrated perturbations through a low-dimensional feature bottleneck ($D=16$) that is independent of the model parameter count. LDPT implements noise via classically simulated quantum channels (Lindblad/depolarizing dynamics) and finite-shot POVM measurements, providing an auditable mapping from privacy budget $\epsilon$ to perturbation magnitude while keeping the transformer gradients clean. Across the ETT datasets and multiple prediction horizons, LDPT substantially preserves forecasting utility under its native local $\epsilon$-QDP guarantee. At a nominal per-pass $\epsilon =0.1$, LDPT limits MSE degradation to under 6%. In contrast, DP-SGD with global $(\epsilon ,\delta )$-DP applied to the identical transformer architecture suffers over 100% MSE degradation. Because these methods operate under different privacy definitions (local $\epsilon$-QDP vs. global $(\epsilon ,\delta )$-DP), this comparison illustrates the impact of noise placement rather than equivalent privacy protection. To isolate the effect of the calibration mechanism, we further evaluate a classical Gaussian mechanism on the same feature-path bottleneck, which requires orders-of-magnitude larger noise and severely degrades utility. Membership inference attacks confirm that LDPT does not amplify membership leakage beyond the non-private baseline. These results demonstrate that decoupling privacy noise from optimization through low-dimensional feature-path placement and tight channel-based calibration is critical for practical privacy-preserving transformer forecasting.

1. Introduction

Privacy-preserving time-series forecasting is essential in domains such as healthcare, finance, and energy systems, where sensitive sequential data must be processed without exposing individual records. Most existing privacy-preserving deep learning methods inject noise directly into the optimization process. In DP-SGD [1], calibrated perturbations are applied to high-dimensional gradient updates during training, coupling privacy noise to every parameter. As model dimensionality increases, the noise required for strong privacy ($\epsilon \le 1$) scales proportionally, often overwhelming the learning signal [2]. This is particularly severe for transformer architectures [3], where high parameter counts amplify gradient noise. Privacy budget further degrades under sequential composition [4].

This motivates the central thesis of this work: privacy perturbations can be structurally decoupled from optimization dynamics while maintaining rigorous, formal privacy calibration through simulated quantum channels.

Kang et al. [5] showed that input perturbation, adding noise to training data before optimization, achieves $(\epsilon ,\delta )$-DP on the final model with utility comparable to gradient perturbation, establishing a theoretical bridge between local and central DP. However, their method adds noise in the full input dimension d and was validated only on logistic regression and small MLPs. This work does not attempt to replace standard global differential privacy guarantees. Rather, it explores whether low-dimensional representation-level perturbations with bounded local guarantees can preserve substantially more utility in transformer forecasting. We extend this principle by introducing LDPT, an architecture that routes privacy noise through a low-dimensional feature pathway ($D=2^n\ll d$, independent of model parameter count P) rather than the gradient space or the full input. The feature-path noise is implemented via classically simulated Lindblad decoherence channels [6,7] and finite-shot POVM measurements, following the Hybrid Quantum Differential Privacy (QDP) framework of Song et al. [8]. All operations are GPU-accelerated classical simulation; no quantum hardware is used. This creates a structural separation between privacy noise and optimization, where the transformer backbone trains with clean gradients while privacy is enforced in the low-dimensional feature representation.

Prior MPC-based approaches [9,10] protect data during inference, but they incur substantial accuracy loss (20–$70\%$ MSE degradation) and do not address memorization during training. LDPT targets both gaps, reducing the utility cost to $+5.8\%$ at $\epsilon =0.1$ while enforcing privacy at the representation level. Building on the Hybrid QDP framework of Song et al. [8], we present a transformer forecasting architecture that makes calibrated channel-based privacy practical in this setting.

1.1. Central Thesis

The primary determinant of privacy-preserving forecasting utility is where noise is introduced in the learning pipeline. Kang et al. [5] established that input perturbation can achieve $(\epsilon ,\delta )$-DP on the final model, but their method operates in the full input dimension and was validated only on simple models. We extend this principle to transformer forecasting and validate it along three axes. First, comparing against DP-SGD (gradient-path noise) shows that feature-path perturbations preserve optimization dynamics; at $\epsilon =0.1$, LDPT degrades MSE by under 6%, while DP-SGD exceeds 100%. Second, comparing against the classical Gaussian mechanism on the same feature-path architecture shows that calibration matters, the Gaussian mechanism requires orders-of-magnitude more noise to certify formal $(\epsilon ,\delta )$-DP, severely degrading utility (Section 8.4). Third, membership inference evaluation confirms that LDPT does not amplify membership leakage beyond the non-private baseline ($0.48$–$0.61$ across datasets), while both DP-SGD and Bottleneck-DP with formal $(\epsilon ,\delta )$-DP show elevated vulnerability ($0.57$–$0.70$) due to noise-induced generalization gaps (Section 7.11). LDPT extends Song et al.’s [8] Hybrid QDP framework from general quantum channels to transformer forecasting. Unlike Chen and Chen’s Q-DPTS [11], which applies DP-SGD to variational quantum circuit parameters (66% MSE degradation at $\sigma =2.0$), LDPT routes privacy through a low-dimensional feature-space perturbation while preserving clean gradients.

We emphasize that LDPT provides a local $\epsilon$-QDP guarantee under a bounded trace-distance neighborhood ($d=0.1$), whereas DP-SGD provides global $(\epsilon ,\delta )$-DP. These guarantees arise from different adversary models and are not numerically comparable. Consequently, the empirical comparisons in this paper isolate the effect of noise placement on optimization dynamics rather than establishing equivalent privacy protection.

1.2. What the Calibrated Channel Formulation Adds

While noise placement within a low-dimensional bottleneck preserves structural optimization dynamics, placement alone provides no formal privacy tracking. The calibrated channel formulation resolves this gap by introducing auditable privacy accounting. Specifically, the simulated depolarizing channel establishes a closed-form analytical mapping from the local privacy budget $\epsilon$ to a precise physical perturbation magnitude via Theorem 1, enabling rigorous sequential composition and tracking.

To isolate the value of this calibration, we contrast it directly against a classical $(\epsilon ,\delta )$-DP Gaussian mechanism applied to the exact same bottleneck architecture. As detailed in Section 8.4, enforcing classical differential privacy forces the required noise scale to expand by orders of magnitude, which completely destroys forecasting utility. This demonstrates that our framework’s success depends heavily on both components: the architecture provides the utility-preserving pathway, while the channel calibration provides a viable, tight privacy mapping. Proposition 1 formalizes this dimensional advantage, showing that feature-path perturbation energy scales strictly as a function of the narrow bottleneck dimension ($D=16$), successfully bypassing the massive parameter space ($P=345$ K) that burdens gradient-path alternatives.

1.3. Our Contributions

Concretely, this work delivers three core contributions to private sequential learning:

• A Decoupled Transformer Architecture for Private Forecasting: We introduce LDPT, a framework that isolates privacy perturbations within a low-dimensional feature pathway ($D=2^n$) instead of the full gradient space. At nominal $\epsilon =0.1$, this architectural placement limits forecasting degradation to under $+5.8\%$ MSE, whereas standard gradient-path noise (DP-SGD) causes an optimization collapse exceeding 100% error.
• An Auditable $\epsilon$-to-Noise Calibration Mapping via Hybrid QDP Channels: By deploying classically simulated Lindblad/depolarizing dynamics and finite-shot POVM measurements, we introduce a closed-form calibration mapping from a targeted privacy budget to a localized noise scale under the Hybrid QDP assumptions. We empirically demonstrate that this quantum-inspired accounting yields substantially smaller perturbation magnitudes than a classical Gaussian mechanism operating on identical feature representations.
• A Comprehensive Three-Axis Empirical Validation: We validate LDPT across ETTh1/ETTh2 datasets over multiple prediction horizons using rigorous multi-seed analysis. Our evaluation verifies: (i) utility retention against DP-SGD to confirm the impact of noise placement; (ii) privacy efficiency against Bottleneck-DP to confirm the necessity of our calibration model; and (iii) robustness against membership inference attacks (MIA), demonstrating that LDPT maintains baseline empirical security ($0.48$–$0.61$), while standard $(\epsilon ,\delta )$-DP configurations display elevated vulnerability ($0.57$–$0.70$) due to wider generalization gaps.

2. Related Work

2.1. Privacy-Preserving Deep Learning

DP-SGD [1] clips per-sample gradients and adds Gaussian noise, with Rényi DP accounting [12] enabling tighter composition. McMahan et al. [2] demonstrated both feasibility and significant utility cost for sequence models. Neelakantan et al. [13] showed that gradient noise can act as implicit regularization. Kang et al. [5] proposed input perturbation, proving that noise before the optimization loop achieves $(\epsilon ,\delta )$-DP with comparable utility to gradient perturbation, but validated only on logistic regression and shallow MLPs in the full input dimension. LDPT extends this principle to transformer forecasting by compressing noise into a low-dimensional feature space ($D=16\ll d$) with calibrated $\epsilon$-to-noise mapping.

2.2. Private Inference for Transformers

We previously evaluated MPC-based secure inference on ETTh1/ETTm1 [9], establishing a 20–$70\%$ MSE cost baseline via CrypTen [10]. MPCFormer [14], SecFormer [15], Iron [16], and BOLT [17] target inference-time computation security via MPC/HE. We do not compare empirically because LDPT also addresses training-time representation privacy. The present work improves upon our MPC baseline ($+5.8\%$ vs. +20–$70\%$) while extending protection to training.

2.3. Quantum Differential Privacy in Related Work

Zhou and Ying [18] formalized QDP for quantum channels. Song et al. [8] unified channel and measurement privacy into Hybrid QDP; Li et al. [19] provided information-theoretic bounds; Du et al. [6] and Watkins et al. [20] provided early empirical evidence. Most relevant, Chen and Chen [11] proposed Q-DPTS, applying DP-SGD to variational quantum circuit parameters ($+66\%$ MSE at $\sigma =2.0$; corresponding $\epsilon$ not reported). LDPT differs fundamentally: noise enters through a simulated Lindblad channel rather than the gradient path, achieving $+5.8\%$ degradation while supporting multi-step forecasting (H up to 336).

2.4. Time-Series Transformers and Normalization

Our backbone builds on channel-independent transformers [21,22,23] with RevIN normalization. Standard LayerNorm [24] dampens DP noise by erasing magnitude differences; we adopt quantum-conditioned adaLN [25,26] to preserve privacy-dependent signal through normalization layers.

3. Background

3.1. Classical Differential Privacy and DP-SGD

A mechanism $\mathcal{M}$ satisfies $(\epsilon ,\delta )$-DP [27] if $Pr[\mathcal{M}\left(D\right)\in S]\le e^{\epsilon }·Pr[\mathcal{M}\left(D^{\prime }\right)\in S]+\delta$ for all neighboring datasets. The Gaussian mechanism [28] achieves this by adding noise with scale:

$$\sigma \ge {\displaystyle \frac{\sqrt{2ln(1.25/\delta )}·\Delta f}{\epsilon }}$$

(1)

where $\Delta f$ is the ${\ell }_2$-sensitivity. DP-SGD [1] clips per-sample gradients to norm C and adds $\mathcal{N}(\mathbf{0},{\sigma }^2{C}^2\mathbf{I})$ to the aggregated gradient, with $\sigma$ calibrated via Rényi DP accounting [12,29]. The fundamental limitation: at strong privacy ($\epsilon \le 1$), the noise multiplier reaches $\sigma =10$–$100\times$, making gradients indistinguishable from random noise across all P parameters [2].

3.2. Quantum Formalism

A quantum state on n qubits has the dimension $D=2^n$. Classical data $\mathbf{x}\in {\mathbb{R}}^D$ is amplitude-encoded as

$$|\psi \left(\mathbf{x}\right)\rangle ={\displaystyle \frac{1}{{\parallel \mathbf{x}\parallel }_2}}{\displaystyle \sum _{j=0}^{D-1}}{x}_j|j\rangle ,\rho \left(\mathbf{x}\right)=|\psi \rangle \langle \psi |$$

(2)

The trace distance $\parallel \rho -{\rho }^{\prime }{\parallel }_1$ quantifies distinguishability and serves as the neighboring condition in QDP. A POVM $\left\{M_k\right\}$ [30] with K outcomes yields measurement probabilities $p_k=\mathrm{Tr}\left(M_k\rho \right)$; with finite shots $N_s$, multinomial noise provides measurement-level privacy.

Open quantum systems evolve via the Lindblad equation [31]:

$${\displaystyle \frac{d\rho }{dt}}=-i[H,\rho ]+\sum _k{\gamma }_k\left(L_k\rho L_k^{†}-{\displaystyle \frac{1}{2}}\{L_k^{†}{L}_k,\rho \}\right)$$

(3)

with solution $\mathrm{vec}\left(\rho \left(t\right)\right)=e^{\mathcal{L}t}·\mathrm{vec}\left(\rho \left(0\right)\right)$ via the Liouvillian superoperator $\mathcal{L}\in {\mathbb{C}}^{D^2\times D^2}$. The matrix exponential $e^{\mathcal{L}t}$ is precomputed once and reused for all samples via GPU-accelerated torch.matrix_exp.

3.3. Quantum Differential Privacy

Definition 1 

(QDP [18]). A quantum mechanism $\mathcal{M}$ satisfies ε-QDP with bound d if for all $\rho ,{\rho }^{\prime }$ with $\parallel \rho -{\rho }^{\prime }{\parallel }_1\le d$: $D_{\infty }(\mathcal{M}\left(\rho \right)\parallel \mathcal{M}\left({\rho }^{\prime }\right))\le \epsilon$.

Theorem 1 

(Depolarizing Channel QDP [8]). The depolarizing channel ${\mathcal{E}}_p\left(\rho \right)=(1-p)\rho +p{\displaystyle \frac{\mathbb{I}}{D}}$ satisfies ${\epsilon }_{\mathrm{ch}}$-QDP with

$${\epsilon }_{\mathrm{ch}}=ln\left(1+{\displaystyle \frac{(1-p)·d·D}{p}}\right)$$

(4)

Theorem 2 

(Measurement QDP [8,19]). A POVM with $N_s$ finite shots satisfies ${\epsilon }_{\mathit{me}}$-QDP with ${\epsilon }_{\mathit{me}}\le ln(1+d/N_s^{1/2})$. For $N_s=1024$, $d=0.1$: ${\epsilon }_{\mathit{me}}\approx 0.003$.

Theorem 3 

(Hybrid QDP Composition [8]). Channel (${\epsilon }_{\mathrm{ch}}$-QDP) composed with measurement (${\epsilon }_{\mathit{me}}$-QDP) satisfies ${\epsilon }_s$-QDP with ${\epsilon }_s=1-(1-{\epsilon }_{\mathrm{ch}})(1-{\epsilon }_{\mathit{me}})$, tighter than additive composition.

4. Privacy Calibration

Given target per-pass privacy ${\epsilon }_s$, we allocate ${\epsilon }_{\mathrm{ch}}=\alpha ·{\epsilon }_s$ with $\alpha =0.8$ to the Lindblad channel (Theorem 1) and derive the measurement budget via Hybrid QDP composition (Theorem 3). The split $\alpha =0.8$ follows Song et al. [8], who observe that the channel provides the dominant privacy contribution while measurement noise adds complementary stochasticity at lower cost. This choice is not a sensitive hyperparameter: at ${\epsilon }_s=0.1$, varying $\alpha$ from $0.6$ to $0.9$ changes the Lindblad rate $\gamma$ from $1.82$ to $3.55$, but both regimes produce near-maximally mixed states (fidelity $0.59$–$0.64$), so MSE varies by $<1\%$:

$${\epsilon }_s=1-(1-{\epsilon }_{\mathrm{ch}})(1-{\epsilon }_{\mathit{me}})$$

(5)

The complete calibration chain maps ${\epsilon }_s$ to physical noise parameters through three inversions:

$$\begin{array}{cc}\hfill p& ={\displaystyle \frac{d·D}{e^{{\epsilon }_{\mathrm{ch}}}-1+d·D}}\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill \gamma & =-{\displaystyle \frac{ln(1-p)}{t}}\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill \sigma & ={\displaystyle \frac{p}{\sqrt{d_{\mathrm{model}}}}}\hfill \end{array}$$

(8)

where $t=1.0$ is the evolution time. This provides a single knob ($\epsilon$) controlling all noise: larger $\epsilon$ (weaker privacy) → smaller p→ lower $\gamma$ and $\sigma$→ less noise. Algorithm 1 summarizes the procedure; the precomputed propagator $\mathbf{E}=e^{\mathcal{L}t}$ enables batched GPU processing of all input states.

Algorithm 1 LDPT privacy calibration.

Require: Target ${\epsilon }_s$, bound d, dim $D=2^n$, time t, model dim $d_m$, fraction $\alpha$ 1: ${\epsilon }_{\mathrm{ch}}\leftarrow \alpha ·{\epsilon }_s$ {Channel budget} 2: $p\leftarrow d·D/(e^{{\epsilon }_{\mathrm{ch}}}-1+d·D)$ {Depolarizing prob} 3: $\gamma \leftarrow -ln(1-p)/t$ {Lindblad rate} 4: $\sigma \leftarrow p/\sqrt{d_m}$ {Injection scale} 5: Construct collapse operators $\left\{L_k\right\}$ with rate $\gamma$ 6: Build Liouvillian $\mathcal{L}$ from H, $\left\{L_k\right\}$, $\left\{{\gamma }_k\right\}$ 7: $\mathbf{E}\leftarrow$torch.matrix_exp$(\mathcal{L}·t)$ {GPU precompute} 7: return $p,\gamma ,\sigma ,\mathbf{E}$

5. LDPT Architecture

The architecture of LDPT is motivated by a fundamental dimensional inequality. We formalize the core design principle as follows:

Proposition 1 

(Dimensional Noise Scaling). For gradient-space noise $\nu \sim \mathcal{N}(\mathbf{0},{\sigma }^2{\mathbf{I}}_P)$ and feature-space noise $\xi \sim \mathcal{N}(\mathbf{0},{\sigma }^2{\mathbf{I}}_D)$:

$${\mathbb{E}[\parallel \nu \parallel }^2]={\sigma }^2{P,\mathbb{E}[\parallel \xi \parallel }^2]={\sigma }^{2}D$$

(9)

For $D\ll P$, feature-path noise injects asymptotically less energy at the same σ.

For our architecture ($P=345$ K, $D=16$), gradient noise carries $P/D\approx 21,563\times$ more energy than feature noise at any fixed $\sigma$. In practice, the methods also use different $\sigma$ values (${\sigma }_g=15.50$ for DP-SGD vs. $\sigma =0.084$ for LDPT at nominal $\epsilon =0.1$, under different privacy definitions), further compounding the gap. This ratio is the structural reason LDPT can maintain utility under privacy constraints where gradient-path methods fail: by routing noise through a $D=16$ bottleneck rather than the $P=345$ K gradient space, we reduce total perturbation energy by over four orders of magnitude.

5.1. Pipeline Overview

The LDPT pipeline (Figure 1) processes $\mathbf{X}\in {\mathbb{R}}^{L\times C}$ through a sequence of ten stages. First, the input is normalized using RevIN, followed by a linear projection into $d_{\mathrm{model}}$ dimensions. An $\epsilon$-calibrated noise injection (Noise #1) is applied prior to the quantum feature extraction stage.

The quantum pipeline performs amplitude encoding, Lindblad evolution, SIC-POVM measurement, and shot noise sampling, producing $(K_{\mathrm{SIC}}+1)$-dimensional features. These features are consumed by a transformer backbone consisting of quantum-conditioned attention with $n_{\mathrm{heads}}$ heads and QC-AdaLN.

Subsequently, a second $\epsilon$-calibrated injection reinforces the privacy signal after the attention and feed-forward layers, followed by output projection. A final injection with amplification factor k is applied before RevIN denormalization to produce the output.

5.2. Backbone Transformer

The backbone is a channel-independent transformer encoder [3,22] parameterized by model dimension $d_{\mathrm{model}}$, number of heads $n_{\mathrm{heads}}$, layers $n_{\mathrm{layers}}$, and feed-forward dimension $d_{\mathrm{ff}}$. It uses FlashAttention-2 and mixed-precision (AMP). Training uses RAdam with decoupled weight decay and ReduceLROnPlateau scheduling, with separate learning rates for classical and quantum attention parameters. The total parameter count P comprises classical backbone parameters and quantum attention parameters.

This backbone is shared across all experiments: classical (no quantum), LDPT with QDP, DP-SGD, DP-Input, and Bottleneck-DP baselines. The same transformer model is used. DP-SGD adds gradient noise after backpropagation, DP-Input perturbs raw inputs, and Bottleneck-DP injects Gaussian-mechanism-calibrated noise in the same feature path. This ensures a controlled comparison where the only variable is noise location and the calibration mechanism. Specific hyperparameter values are reported in Section 7.2.

5.3. Calibrated Feature-Path Pipeline

Input subsequences are subsampled (stride s) and amplitude-encoded (Equation (2)) into n-qubit states (Figure 2). The encoded state $\rho \left(0\right)$ evolves through the calibrated Lindblad channel.

$$\rho \left(t\right)={\mathcal{E}}_{\gamma ,t}\left(\rho \left(0\right)\right)\mathrm{via}\mathrm{vec}\left(\rho \left(t\right)\right)=e^{\mathcal{L}t}·\mathrm{vec}\left(\rho \left(0\right)\right)$$

(10)

The SIC-POVM measures $\rho \left(t\right)$ with $N_s$ shots, yielding the empirical probability distribution $\widehat{\mathbf{p}}\in {\mathbb{R}}^{K_{\mathrm{SIC}}}$ with $p_k=\mathrm{Tr}\left(M_k\rho \right)$. This is concatenated with state purity $\mathrm{Tr}\left(\rho {\left(t\right)}^2\right)$ to form a $(K_{\mathrm{SIC}}+1)$-dimensional quantum feature vector $\mathbf{qf}$, projected to $d_{\mathrm{model}}$ via learned linear layer $W_{\mathrm{proj}}\in {\mathbb{R}}^{d_{\mathrm{model}}\times (K_{\mathrm{SIC}}+1)}$.

Figure 2. Quantum circuit for LDPT feature extraction.

Figure 2. Quantum circuit for LDPT feature extraction.

5.4. Feature-Path Encoding and Post-Processing

The attention layer receives a concatenated input ${\mathbf{x}}_{\mathrm{enh}}=[{\mathbf{x}}_{\mathrm{cl}},W_{\mathrm{proj}}·\mathbf{qf}]\in {\mathbb{R}}^{2d_{\mathrm{model}}}$, where ${\mathbf{x}}_{\mathrm{cl}}$ is the classical embedding. A fixed gate parameter controls the classical contribution: at gate $=1.0$ (used in all experiments), the classical path is zeroed (${\mathbf{x}}_{\mathrm{cl}}=\mathbf{0}$), so

$${\mathbf{x}}_{\mathrm{enh}}=[{\mathbf{0}}_{d_{\mathrm{model}}},W_{\mathrm{proj}}·\mathbf{qf}]$$

(11)

This ensures all attention queries, keys, and values derive exclusively from quantum features, which is necessary for the system-level QDP claim: if the classical path contributed to attention, the model would process un-privatized information alongside noisy quantum features, weakening the privacy guarantee. The gate is not learned—a learned gate could converge to bypass the quantum path entirely, nullifying the privacy mechanism. Intermediate values (e.g., gate $=0.5$) blend classical and quantum inputs, which may be useful in settings where partial privacy is acceptable, but are not evaluated here. The Q, K, V projections $W_q,W_k,W_v\in {\mathbb{R}}^{d_{\mathrm{model}}\times 2d_{\mathrm{model}}}$ and output projection $W_o\in {\mathbb{R}}^{d_{\mathrm{model}}\times d_{\mathrm{model}}}$ follow standard multi-head attention [3] with FlashAttention-2 when available.

Lemma 1 

(Post-Processing [28]). If $\mathcal{M}$ satisfies ε-QDP, then $f\circ \mathcal{M}$ satisfies ε-QDP for any deterministic function f.

Since the transformer applies deterministic operations (attention, FFN, projection) to the noisy quantum features, post-processing (Lemma 1) ensures the noise properties are preserved through the pipeline.

5.5. Quantum-Conditioned Adaptive Layer Normalization

Standard LayerNorm [24] normalizes to $\mu =0$, $\sigma =1$, erasing $\epsilon$-dependent noise magnitude. We adapt adaLN [25,26] to quantum conditioning:

$$\mathrm{QC}-\mathrm{AdaLN}(\mathbf{x},\mathbf{q})={\gamma }_q\odot {\displaystyle \frac{\mathbf{x}-{\mu }_x}{{\sigma }_x+ϵ}}+{\beta }_q$$

(12)

where ${\gamma }_q$ and ${\beta }_q$ are generated from quantum features $\mathbf{q}$ via a two-layer MLP: the quantum feature vector (dimension $K_{\mathrm{SIC}}+1$) is sequence-pooled, projected through $\mathrm{Linear}(K_{\mathrm{SIC}}+1,d_{\mathrm{model}})\to \mathrm{GELU}\to \mathrm{Linear}(d_{\mathrm{model}},2d_{\mathrm{model}})$, and split into shift components $(\Delta \gamma ,\Delta \beta )$. The final affine parameters are ${\gamma }_q={\gamma }_0+\Delta \gamma$ and ${\beta }_q={\beta }_0+\Delta \beta$, where ${\gamma }_0,{\beta }_0$ are learnable defaults. The output layer is zero-initialized so that QC-AdaLN behaves as standard LayerNorm at initialization and gradually learns $\epsilon$-dependent modulation during training. One QC-AdaLN instance is applied per sub-layer (post-attention and post-FFN), each with independent parameters. Since $\mathbf{q}$ carries $\epsilon$-dependent noise (high variance at low $\epsilon$, low at high $\epsilon$), the scale and shift parameters ${\gamma }_q,{\beta }_q$ vary with privacy level, preserving the noise signal through normalization. We chose conditioning over alternatives (concatenation or cross-attention) because it modulates normalization statistics directly without adding sequence-length-dependent computation.

5.6. Three-Point $\epsilon$-Calibrated Noise Injection

Deterministic learned layers (projection, attention, FFN, normalization) can absorb and compensate for quantum feature noise, making the privacy effect unobservable in the model output. Our ablation (Section 7.12) confirms this: removing the injection points while keeping the Lindblad channel active eliminates all measurable MSE separation across $\epsilon$ values. The injection is therefore necessary, not optional.

The three injection locations are chosen to counteract the three stages where deterministic transformations most aggressively dampen stochasticity: (1) the input projection $W_{\mathrm{in}}\in {\mathbb{R}}^{C\times d_{\mathrm{model}}}$, which maps noisy quantum features into a learned subspace that can suppress noise components; (2) the LayerNorm/QC-AdaLN layers, which re-center and re-scale activations; and (3) the output projection $W_{\mathrm{out}}$, which compresses $d_{\mathrm{model}}$-dimensional hidden states to C-dimensional predictions. Each injection uses Gaussian noise scaled by $\sigma =p/\sqrt{d_{\mathrm{model}}}$ (Equation (8)), inheriting its magnitude from the same depolarizing parameter p that governs the Lindblad channel. The scaling $\sigma =p/\sqrt{d_{\mathrm{model}}}$ normalizes the per-coordinate noise magnitude relative to the hidden dimension; it is $\epsilon$-calibrated in the sense that p is determined by $\epsilon$ via Equation (6). This scaling was set once from the principle that the expected per-coordinate perturbation should be $O\left(p\right)$ and was not tuned on validation data; it is held fixed across all experiments, datasets, and $\epsilon$ values.

$$\begin{array}{cc}\hfill \left(\mathrm{post}-\mathrm{embedding}\right):& \mathbf{x}\leftarrow \mathbf{x}+\sigma ·\mathrm{std}\left(\mathbf{x}\right)·{\mathbf{z}}_1\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill (\mathrm{post}-\mathrm{attention}/\mathrm{FFN}):& \mathbf{x}\leftarrow \mathbf{x}+\sigma ·\mathrm{std}\left(\mathbf{x}\right)·{\mathbf{z}}_2\hfill \end{array}$$

(14)

$$\begin{array}{cc}\hfill (\mathrm{post}-\mathrm{output}\mathrm{proj}.):& \widehat{\mathbf{y}}\leftarrow \widehat{\mathbf{y}}+k\sigma ·\mathrm{std}\left(\widehat{\mathbf{y}}\right)·{\mathbf{z}}_3\hfill \end{array}$$

(15)

where ${\mathbf{z}}_i\sim \mathcal{N}(\mathbf{0},\mathbf{I})$ and $k=2.0$ amplifies noise at the output. Post-embedding ensures the transformer receives $\epsilon$-dependent input before attention. Post-attention/FFN re-injects after QC-AdaLN, where normalization could otherwise dampen the signal. Post-output proj. ensures the final predictions carry observable privacy effects despite the output projection. The adaptive scaling ($\times \mathrm{std}(·)$) keeps noise proportional to the signal magnitude. All noise is active during both training and inference.

The three-point noise injection mechanism is not part of the formal privacy guarantee, which is derived solely from the QDP-calibrated channel and measurement process. Its purpose is to ensure that upstream stochasticity induced by the privacy mechanism remains observable after deterministic transformations (e.g., projection, normalization, and output layers), which can otherwise attenuate noise. Removing the injections does not change the formal privacy guarantee; it changes whether that guarantee is observable in the model’s predictions. The $\epsilon$–MSE relationship disappears not because privacy is lost, but because deterministic layers attenuate the noise signal below measurable thresholds.

5.7. Shot Noise During Training

Following Song et al. [8], measurement is modeled via simulated finite-shot sampling, reproducing the statistical behavior of quantum measurement without requiring hardware. In our implementation, this stochastic measurement mechanism is applied during both training and inference to ensure consistency between optimization and evaluation. With $N_s=1024$ shots, near-maximally mixed states ($\epsilon =0.1$, purity $\approx 1/D$) produce high shot noise variance; peaked states ($\epsilon =5.0$, purity $\approx 0.97$) produce low variance.

6. Privacy Guarantee

Proposition 2 

(Noise Calibration Consistency). The LDPT pipeline with depolarizing parameter p calibrated from ${\epsilon }_s$ through Equation (6) and $N_s$-shot POVM measurement approximates ${\epsilon }_s$-QDP under the bounded trace-distance assumption that $\parallel \rho -{\rho }^{\prime }{\parallel }_1\le d$, consistent with the Hybrid QDP framework of Song et al. [8]. We provide local ε-QDP under a bounded trace-distance assumption ($d=0.1$), not global $(\epsilon ,\delta )$-DP. This is analogous to bounded-sensitivity assumptions in classical DP.

Proof. 

The simulated Lindblad channel with rate $\gamma$ (Equation (7)) approximates the depolarizing channel ${\mathcal{E}}_p$, which satisfies ${\epsilon }_{\mathrm{ch}}$-QDP by Theorem 1 in Song et al. The simulated $N_s$-shot POVM measurement satisfies ${\epsilon }_{\mathit{me}}$-QDP by Theorem 2. By hybrid composition (Equation (5)):

$${\epsilon }_s=1-(1-{\epsilon }_{\mathrm{ch}})(1-{\epsilon }_{\mathit{me}})$$

the composed channel+measurement mechanism approximates ${\epsilon }_s$-QDP under the bounded trace-distance assumption ($\parallel \rho -{\rho }^{\prime }{\parallel }_1\le d$), consistent with the Hybrid QDP framework of Song et al. [8]. This guarantee is local; it holds for input pairs within the trace-distance bound and degrades continuously for larger perturbations. All subsequent operations (linear projection $W_{\mathrm{proj}}$, multi-head attention, FFN, output projection) are deterministic functions of the noisy output, preserving noise properties by Lemma 1. The three-point noise injection (Equations (13)–(15)) adds stochastic perturbation calibrated from the same p.    □

6.1. Training-Time Composition

The per-inference guarantee ${\epsilon }_s$-QDP applies to a single pass through the Lindblad channel. During training, each record passes through the channel once per epoch. Over T epochs, the composed privacy guarantee degrades. Under standard sequential composition [4], T applications of an ${\epsilon }_s$-private mechanism compose to

Basic composition:  

$${\epsilon }_{\mathrm{train}}^{\mathrm{basic}}=T·{\epsilon }_s$$

(16)

Advanced composition [4]: 

$${\epsilon }_{\mathrm{train}}^{\mathrm{adv}}={\epsilon }_s\sqrt{2Tln(1/{\delta }^{\prime })}+T·{\epsilon }_s(e^{{\epsilon }_s}-1)$$

(17)

for any ${\delta }^{\prime }>0$, yielding an $({\epsilon }_{\mathrm{train}}^{\mathrm{adv}},{\delta }^{\prime })$-style composed bound under the same bounded trace-distance QDP neighborhood (not a global add/remove-record $(\epsilon ,\delta )$-DP guarantee).

Table 1. Training-time privacy composition ($T=20$ epochs, ${\delta }^{\prime }={10}^{-6}$).

Per-Epoch ${\mathit{\epsilon }}_{\mathit{s}}$	Basic $\mathit{T}{\mathit{\epsilon }}_{\mathit{s}}$	Advanced (Equation (17))	Note
0.1	2.0	2.56	weak but bounded
0.5	10.0	18.2	not meaningful
1.0	20.0	57.9	not meaningful
5.0	100.0	≈14,900	not meaningful

reports both bounds for our experimental configurations.

Under a standard advanced composition, the resulting training-time budget is ${\epsilon }_{\mathrm{train}}\approx 2.56$ at ${\epsilon }_s=0.1$ (with ${\delta }^{\prime }={10}^{-6}$), i.e., bounded but conservative under a standard composition. For ${\epsilon }_s\ge 0.5$, the same composition bound becomes overly conservative and quickly exceeds practical thresholds. More refined accounting (e.g., Rényi DP composition [12] and privacy amplification by subsampling [29]) can tighten these estimates and is a natural next step. Importantly, the structural comparison with DP-SGD is unchanged: LDPT composes over $T=20$ epoch-level steps, whereas DP-SGD composes over $\sim 2588$ gradient-level steps.

6.2. Trace Distance Verification

The QDP guarantee requires $\parallel \rho \left(\mathbf{x}\right)-\rho \left({\mathbf{x}}^{\prime }\right){\parallel }_1\le d$ for neighboring inputs. For amplitude encoding (Equation (2)), perturbing one feature of standardized data ($\mu =0$, $\sigma =1$) by $\tau$ produces 

$$\parallel \rho \left(\mathbf{x}\right)-\rho \left({\mathbf{x}}^{\prime }\right){\parallel }_1\le {\displaystyle \frac{{2\tau \parallel \mathbf{x}\parallel }_{\infty }}{{\parallel \mathbf{x}\parallel }_2^2}}$$

(18)

where $\tau$ denotes the per-feature perturbation magnitude (distinct from the relaxation parameter $\delta$ in $(\epsilon ,\delta )$-DP).

For standardized data with unit variance, ${\parallel \mathbf{x}\parallel }_{\infty }\le {\parallel \mathbf{x}\parallel }_2$ and ${\parallel \mathbf{x}\parallel }_2\approx \sqrt{C}$ for C features, so Equation (18) simplifies to

$$\parallel \rho \left(\mathbf{x}\right)-\rho \left({\mathbf{x}}^{\prime }\right){\parallel }_1\le {\displaystyle \frac{{2\tau \parallel \mathbf{x}\parallel }_{\infty }}{{\parallel \mathbf{x}\parallel }_2^2}}\le {\displaystyle \frac{2\tau }{{\parallel \mathbf{x}\parallel }_2}}\approx {\displaystyle \frac{2\tau }{\sqrt{C}}}$$

(19)

For $C=7$ features, this gives the following worst-case analysis:

Table 2. Trace distance vs. perturbation size ($C=7$, $n=1400$ pairs). = within bound $d=0.1$; × = exceeds bound.

$\mathit{\tau }$	Analytical	Empirical Max	P95	≤d = 0.1?
0.001	0.001	0.001	0.001	✓
0.01	0.008	0.013	0.009	✓
0.05	0.038	0.066	0.044	✓
0.10	0.076	0.132	0.088	× (max)
0.50	0.378	0.660	0.412	×

confirms that $d=0.1$ holds for single-feature perturbations up to $\tau \approx 0.05$ (5% of one standard deviation). At $\tau =0.10$, the maximum empirical trace distance ($0.132$) exceeds $d=0.1$, but the 95th percentile ($0.088$) remains within bounds. For perturbations violating the bound, the guarantee degrades gracefully: ${\epsilon }_{\mathrm{eff}}=ln(1+(1-p)·\parallel \rho -{\rho }^{\prime }{\parallel }_1·D/p)$.

The bound $d=0.1$ is analogous to the bounded-sensitivity assumption in classical DP [28]; it covers single-record changes of ≤5% of one standard deviation in z-score normalized data, corresponding to small sensor perturbations or measurement noise. It does not cover the standard add/remove-one-record adversary unless that record’s contribution falls within this bound. Choosing a larger d would cover stronger perturbations but requires proportionally more noise (Equation (4)), degrading utility. Following the Hybrid Quantum Differential Privacy framework of Song et al. [8], we adopt this bounded trace-distance neighborhood ($d=0.1$). While it does not offer the same protection as global $(\epsilon ,\delta )$-DP against arbitrary record additions/removals, it provides meaningful privacy guarantees against small, realistic perturbations commonly encountered in time-series data.

6.3. Threat Model and Security Assumptions

The adversary model assumed in this work is a bounded-perturbation observer who can distinguish neighboring representations within the trace-distance ball $\parallel \rho -{\rho }^{\prime }{\parallel }_1\le d=0.1$, rather than the standard add/remove-one-record adversary of global $(\epsilon ,\delta )$-DP. Concretely, LDPT protects against (i) inference from bounded perturbations to individual features (e.g., sensor noise, measurement variation) and (ii) statistical distinguishability of nearby quantum representations via the calibrated channel and POVM measurement. LDPT does not protect against (i) arbitrary record insertion or removal from the training set; (ii) adversaries whose perturbations exceed the trace-distance bound d; (iii) reconstruction attacks beyond the bounded neighborhood (left for future work). The MIA evaluation (Section 7.11) empirically confirms that LDPT does not amplify membership leakage beyond the non-private baseline under this threat model.

Practical significance and limitations. The bounded trace-distance assumption ($d=0.1$) is well-matched to time-series settings where adversaries observe small perturbations of real-valued sensor or measurement data—for example, noise in electricity meters, financial tick data, or physiological signals where realistic per-feature perturbations rarely exceed a few percent of one standard deviation. In these regimes, LDPT provides meaningful, auditable privacy via the calibrated $\epsilon$-to-$\sigma$ mapping with minimal utility cost. The limitation is symmetric: LDPT does not provide protection against adversaries who can insert or remove entire records, modify features beyond the trace-distance ball, or mount membership/reconstruction attacks that exploit perturbations outside this neighborhood. Practitioners requiring the standard add/remove-one-record threat model should compose LDPT with a global mechanism (e.g., DP-SGD on the aggregate gradient with a small budget), accepting the associated utility cost, rather than relying on LDPT alone.

7. Experimental Results

7.1. Methodology: Classical Simulation of QDP

All quantum operations are classically simulated following Song et al. [8], who validated their Hybrid QDP framework under identical simulation-only conditions. At $n=4$ qubits ($D=16$), the depolarizing channel ${\mathcal{E}}_p$ is an analytically tractable CPTP map [32], and simulated finite-shot POVM measurement exactly reproduces quantum multinomial statistics. No quantum hardware is used. Our comparison evaluates utility under each method’s native privacy paradigm rather than equalizing composition counts (see Section 6.1 for composition analysis).

7.2. Setup

We evaluated on ETTh1 and ETTh2 [21] ($C=7$ features hourly electricity transformer temperatures, 8281/2857/2857 and 8137/2713/2713 train/val/test respectively). The backbone transformer uses $d_{\mathrm{model}}=128$, $n_{\mathrm{heads}}=4$, $n_{\mathrm{layers}}=1$, $d_{\mathrm{ff}}=256$, with $L=336$ input length and prediction horizons $H\in \{24,48,96,168,336,720\}$. Training uses RAdam with weight decay $1.2\times {10}^{-3}$, ReduceLROnPlateau (patience 5, factor 0.5), separate learning rates for classical ($3\times {10}^{-4}$) and quantum attention ($1.5\times {10}^{-4}$) parameters, mixed precision (AMP on an NVIDIA A100 GPU, 80 GB of VRAM), and seed 2024. The model has $P=345$ K total parameters (163 K classical + 182 K quantum attention). The quantum feature pipeline uses $n=4$ qubits ($D=16$), subsample stride $s=4$, $N_s=1024$ POVM shots, output noise amplification $k=2.0$, and QuTiP 5.2.3 [33] for operator construction. The full QDP pipeline is applied to both training and inference data. Training runs 20–25 epochs per configuration.

All baselines use the identical transformer backbone, optimizer, scheduler, and data pipeline (Section 5.2). DP-SGD adds gradient clipping ($C=1.0$) and Gaussian noise calibrated via the RDP accountant [12]. DP-Input perturbs raw inputs with Gaussian noise scaled by sensitivity $\Delta f=1$. Bottleneck-DP uses the same three-point feature-path injection as LDPT but calibrates noise via the classical Gaussian mechanism ($\sigma =\sqrt{2ln(1.25/\delta )}·\Delta f/\epsilon$) instead of the depolarizing channel, giving formal $(\epsilon ,\delta )$-DP. We also include an optimized DP-SGD variant (batch 512, 50 epochs, warmup; see Section 8.3). We omit PATE [34] because it requires multiple teacher models trained on disjoint data partitions, which is incompatible with time-series forecasting, where temporal continuity must be preserved.

7.3. Axis 1: Noise Placement (DP-SGD vs. LDPT)

This comparison isolates the architectural effect of noise location: both methods target the same nominal $\epsilon$ values, but LDPT routes noise through a $D=16$ feature bottleneck while DP-SGD injects it into 345 K gradient dimensions.

Important note on privacy semantics. LDPT results correspond to local $\epsilon$-QDP under the bounded trace-distance assumption of Section 6.2, whereas DP-SGD results correspond to global $(\epsilon ,\delta )$-DP. Matching numerical $\epsilon$ values does not imply matching privacy strength. The comparison below therefore evaluates utility under each method’s native privacy paradigm and illustrates the impact of noise placement rather than equivalent privacy guarantees.

Table 3. DP-SGD vs. LDPT (QDP) on ETTh1 ($H=24$). ${\epsilon }_s$ is per-pass; ${\epsilon }_{\mathrm{train}}$ is the composed guarantee over $T=20$ epochs (advanced composition). LDPT: local $\epsilon$-QDP ($d=0.1$); DP-SGD: global $(\epsilon ,\delta )$-DP ($\delta ={10}^{-6}$). These are different privacy notions and not directly comparable. Bold indicates best MSE at each $\epsilon$ level. $\Delta$% = relative MSE change vs. Classical; + = degradation.

Method	${\mathit{\epsilon }}_{\mathit{s}}$	${\mathit{\epsilon }}_{\mathbf{train}}$	MSE	MAE	$\mathbf{\Delta }\mathbf{MSE}$	$\mathbf{\Delta }$%
Classical	∞	—	0.3384	0.3777	—	—
LDPT (QDP)	0.1	2.56	0.3581	0.3901	+0.020	+5.8
LDPT (QDP)	0.5	18.2	0.3527	0.3859	+0.014	+4.2
LDPT (QDP)	1.0	57.9	0.3482	0.3822	+0.010	+2.9
LDPT (QDP)	5.0	≈14.9 K	0.3420	0.3755	+0.004	+1.1
DP-SGD	0.1	—	0.7129	0.5585	+0.375	+110.7
DP-SGD	0.5	—	0.7003	0.5608	+0.362	+107.0
DP-SGD	1.0	—	0.6986	0.5630	+0.360	+106.4
DP-SGD	5.0	—	0.6903	0.5608	+0.352	+104.0

presents $H=24$ results.

At $\epsilon =0.1$, LDPT incurs $+5.8\%$ MSE degradation while DP-SGD suffers $+110.7\%$, confirming that gradient noise severely impairs the learning signal (Figure 3).

7.3.1. Gradient-Path Noise Destroys Optimization

Even at $\epsilon =5.0$ (weak privacy), DP-SGD approximately doubles the MSE across all horizons ($+104\%$ at $H=24$, $+61\%$ at $H=336$). The RDP-calibrated noise multipliers range from ${\sigma }_g=0.41$ ($\epsilon =5.0$) to ${\sigma }_g=15.5$ ($\epsilon =0.1$). MSE differences across DP-SGD $\epsilon$ values are minimal (0.69–0.73), indicating the model predicts near the data mean regardless of noise level.

Table 4. Training convergence comparison (ETTh1, $H=24$). Per-pass $\epsilon$ shown; see Table 1 for composed ${\epsilon }_{\mathrm{train}}$.

Method	$\mathit{\epsilon }$	Train Loss	Val Loss	Best Ep.	Test MSE
Classical	∞	0.090	0.139	18	0.338
LDPT (QDP)	0.1	0.101	0.164	19	0.358
LDPT (QDP)	0.5	0.097	0.154	20	0.353
LDPT (QDP)	1.0	0.093	0.146	20	0.348
LDPT (QDP)	5.0	0.088	0.136	19	0.342
DP-SGD	0.1	0.544	1.164	13	0.713
DP-SGD	0.5	0.531	1.139	20	0.700
DP-SGD	1.0	0.527	1.132	20	0.699
DP-SGD	5.0	0.520	1.115	20	0.690

provides direct evidence that DP-SGD’s failure originates during training. DP-SGD’s final training loss ($0.52$–$0.54$) barely improves from random initialization ($\sim 0.55$), confirming the optimizer cannot extract signal from noisy gradients. The best validation loss across all DP-SGD $\epsilon$ values ($1.11$–$1.16$) is $8.0$–$8.4\times$ worse than Classical ($0.139$). DP-SGD at $\epsilon =0.1$ converges early (best epoch 13 of 20), indicating learning stalls. In contrast, LDPT achieves training loss ($0.088$–$0.101$) matching Classical ($0.090$), confirming feature-path noise does not impair optimization. LDPT’s validation loss increases monotonically with noise strength ($0.136\to 0.164$), demonstrating that privacy noise degrades the learned representation as intended.

Across all horizons and $\epsilon$ values, LDPT achieves 35–$50\%$ lower MSE than DP-SGD at matched nominal $\epsilon$, with LDPT at $\epsilon =0.1$ also achieving lower MSE than DP-SGD at $\epsilon =5.0$.

7.3.2. Privacy Noise as Implicit Regularizer at Long Horizons

Table 5. Multi-horizon MSE summary (LDPT (QDP) vs. classical). Per-pass $\epsilon$ shown; see Table 1 for composed ${\epsilon }_{\mathrm{train}}$. * non-monotonic at $\epsilon =5.0$; ^† regularization regime; ^‡ non-monotonic across $\epsilon$ values.

H	Classical	$\mathit{\epsilon }=0.1$	$\mathit{\epsilon }=1.0$	$\mathit{\epsilon }=5.0$	Base	Pattern
24	0.338	0.358	0.348	0.342	0.342	cost
48	0.374	0.369	0.362	0.359	0.359	benefit
96	0.409	0.414	0.410	0.406	0.407	mixed
168	0.437	0.430	0.427	0.430	0.435	benefit *
336	0.448	0.466	0.464	0.465	0.515	cost †
720	0.473	0.464	0.498	0.462	0.483	non-mono ‡

reveals a horizon-dependent pattern with three distinct regimes.

Short horizons ($H=24$) Classical privacy noise cost. MSE is perfectly monotonic ($\epsilon \uparrow \Rightarrow$ MSE↓). The privacy–utility tradeoff behaves exactly as the theory predicts.

Medium horizons ($H=48,96,168$) Privacy noise as implicit regularization. LDPT (QDP) at all $\epsilon$ levels outperforms or matches the classical baseline. At $H=168$, MSE monotonicity holds for $\epsilon \in \{0.1,0.5,1.0\}$ but breaks at $\epsilon =5.0$ (MSE increases by $0.003$), because the near-zero noise ($\sigma =0.003$) provides insufficient regularization.

Long horizons ($H=336$) Noise as essential regularizer. The LDPT Baseline without any privacy noise performs worst (MSE $=0.515$, $+15\%$ above Classical), because the quantum features without noise cause severe overfitting. Adding $\epsilon$-calibrated noise recovers utility dramatically: LDPT (QDP) at $\epsilon =1.0$ achieves $0.464$, a $10\%$ improvement over the baseline. This demonstrates that the calibrated noise serves a dual purpose: privacy protection and overfitting prevention.

This regularization phenomenon is well-documented in classical DP-SGD [1,13]: when a model has sufficient capacity to memorize training data, noise during training prevents memorization and improves generalization. The critical evidence that noise is working as intended for privacy is that validation loss always increases with noise strength across all horizons, and the regularization benefit appears only at test time.

7.4. Three-Way Comparison: DP-Input vs. DP-SGD vs. LDPT

To isolate the effect of noise placement, we compared LDPT against two classical baselines, gradient-level noise (DP-SGD) and input-level noise (DP-Input). This provides a unified view of where noise enters the learning pipeline.

Table 6. Three-way privacy comparison on ETTh1 ($H=24$). ${\epsilon }_s$ is per-pass; ${\epsilon }_{\mathrm{train}}$ is the composed guarantee over $T=20$ epochs (advanced composition). LDPT: local $\epsilon$-QDP ($d=0.1$); DP-SGD/DP-Input: global $(\epsilon ,\delta )$-DP ($\delta ={10}^{-6}$). These are different privacy notions and not directly comparable. $\Delta$% = relative MSE change vs. Classical; + = degradation.

Method	${\mathit{\epsilon }}_{\mathit{s}}$	${\mathit{\epsilon }}_{\mathbf{train}}$	MSE	$\mathit{\sigma }$	$\mathbf{\Delta }$%
Classical	∞	—	0.338	0	—
LDPT (QDP)	0.1	2.56	0.358	0.084	+5.8
LDPT (QDP)	5.0	≈14.9 K	0.342	0.003	+1.1
DP-Input	0.1	—	0.701	52.99	+107.4
DP-Input	1.0	—	0.495	5.30	+46.4
DP-Input	5.0	—	0.350	1.06	+3.4
DP-SGD	0.1	—	0.713	15.50	+110.7
DP-SGD	5.0	—	0.690	0.41	+104.0

reveals a hierarchy of noise injection approaches. At strong privacy ($\epsilon =0.1$), both classical approaches fail, DP-Input (MSE $=0.701$, $\sigma =53$) and DP-SGD (MSE $=0.713$, ${\sigma }_g=15.5$) approximately double the MSE, while LDPT achieves only $+5.8\%$ degradation. At weak privacy ($\epsilon =5.0$), DP-Input recovers to MSE $=0.350$ ($+3.4\%$) because input noise becomes small ($\sigma =1.06$), while DP-SGD remains broken (MSE $=0.690$, $+104\%$). This confirms that DP-SGD’s failure is not merely due to “too much noise” but due to noise being in the wrong place (gradients), whereas input noise and quantum channel noise both degrade gracefully with $\epsilon$.

7.5. Analysis: Why Feature-Path Noise Outperforms Gradient Noise

DP-SGD adds noise to all 345 K gradient dimensions per training step. At $\epsilon =0.1$, the noise-to-signal ratio per gradient is ${\sigma }_{g}C/B=15.5\times 1.0/64\approx 0.24$, meaning each gradient coordinate is approximately 24% noise. Aggregated across 345 K dimensions, the optimizer receives an effectively random direction. LDPT instead routes noise through a $D=16$ feature-path channel ($\sigma =0.084$), leaving the transformer’s 345 K gradients clean. The primary limitation of DP-SGD is therefore not the magnitude of noise, but its placement within the optimization loop. Figure 4 illustrates how MSE varies across prediction horizons at $\epsilon =0.1$ for both datasets.

7.6. Calibration Chain Verification

Table 7. Calibration chain and monotonicity ($H=24$). † = ${\epsilon }_{\mathit{me}}$ exceeds meaningful bounds at large ${\epsilon }_s$; $\downarrow \uparrow$ = decreasing noise, increasing fidelity.

${\mathit{\epsilon }}_{\mathit{s}}$	${\mathit{\epsilon }}_{\mathbf{ch}}$	${\mathit{\epsilon }}_{\mathbf{me}}$	p	$\mathit{\gamma }$	$\mathit{\sigma }$	Fidelity	Trend
0.1	0.080	0.022	0.951	3.006	0.084	0.617	—
0.5	0.400	0.167	0.765	1.448	0.068	0.713	$\downarrow \uparrow$
1.0	0.800	1.000	0.566	0.835	0.050	0.804	$\downarrow \uparrow$
5.0	4.000	†	0.029	0.029	0.003	0.974	$\downarrow \uparrow$

confirms the calibration chain operates correctly: smaller $\epsilon \to$ larger $p\to$ larger $\gamma \to$ larger $\sigma$. MSE is monotonic for short horizons (24, 48, 96), while longer horizons exhibit a regularization effect where noise can improve generalization. Quantum state fidelity $F({\rho }_{\mathrm{noisy}},{\rho }_{\mathrm{ideal}})$ spans 0.617 (significant decoherence) to 0.974 (nearly pure) on ETTh1, and 0.620 to 0.975 on ETTh2, confirming that the channel operates consistently across datasets and independently of the input data distribution.

The composition check verifies Equation (5): $1-(1-0.080)(1-0.022)=0.100$ for ${\epsilon }_s=0.1$, and $1-(1-0.400)(1-0.167)=0.500$ for ${\epsilon }_s=0.5$, both exact to four decimal places.

7.7. DP-SGD Noise Multipliers

Table 8. DP-SGD noise multipliers (RDP accountant).

$\mathit{\epsilon }$	${\mathit{\sigma }}_{\mathit{g}}$	Best Val Loss	Best Epoch	MSE
0.1	15.50	1.164	13	0.713
0.5	3.41	1.176	20	0.700
1.0	1.78	1.174	14	0.699
5.0	0.41	1.170	11	0.690
Classical	0	0.139	18	0.338

shows the DP-SGD noise multipliers and their effect. Even at $\epsilon =5.0$ (${\sigma }_g=0.41$), the best validation loss (1.170) is $8.4\times$ worse than classical (0.139), confirming that gradient noise fundamentally impairs learning. The noise multipliers are calibrated for 8281 training samples, 64 batch size, 20 epochs, and $\delta ={10}^{-6}$.

7.8. Privacy Budget Accounting

All runs remain within their per-epoch privacy budget. Utilization decreases with larger $\epsilon$ because the per-epoch channel privacy cost is fixed. At $\epsilon =0.1$, 95.4% of the per-epoch budget is used. The training-time composed guarantee over $T=20$ epochs is ${\epsilon }_{\mathrm{train}}\approx 2.56$ under advanced composition (Section 6.1, Table 1).

7.9. Calibration and Consistency Audits

We perform six audits to validate the noise calibration chain and empirical consistency: (1) calibration chain consistency ($\epsilon \to p\to \gamma \to \sigma$ matches Equations (6)–(8)); (2) trace distance within bounds (Table 2); (3) composition matches Equation (5) (verified in Section 7.6); (4) budget not exceeded (Section 7.8); (5) MSE monotonically tracks $\epsilon$ at short horizons (Table 3); (6) fidelity monotonically tracks $\epsilon$ (Table 7). All six audits pass. We complement these calibration-level checks with a membership inference attack (Section 7.11), which confirms that LDPT does not amplify membership leakage beyond the non-private baseline (accuracy $0.48$–$0.61$ across datasets).

7.10. Multi-Dataset Validation: ETTh2

We repeat the full evaluation on ETTh2 [21] with identical architecture and hyperparameters (MSE summary in

Table A1. Multi-Horizon MSE summary on ETTh2. Bold indicates best MSE.

	LDPT				DP-SGD
$\mathit{H}$	Classical	$\mathit{\epsilon }=\mathbf{0}.\mathbf{1}$	$\mathit{\epsilon }=\mathbf{1}.\mathbf{0}$	$\mathit{\epsilon }=\mathbf{5}.\mathbf{0}$	$\mathit{\epsilon }=\mathbf{0}.\mathbf{1}$	$\mathit{\epsilon }=\mathbf{5}.\mathbf{0}$
24	0.175	0.181	0.177	0.175	0.356	0.357
48	0.230	0.234	0.232	0.230	0.371	0.370
96	0.301	0.321	0.317	0.316	0.396	0.388
168	0.349	0.354	0.352	0.355	0.409	0.399
336	0.392	0.386	0.384	0.388	0.396	0.397
720	0.434	0.446	0.445	0.495	0.439	0.442

). The core findings replicate: at $H=24$, LDPT costs $+3.2\%$ MSE at $\epsilon =0.1$, while DP-SGD costs $+103\%$. One dataset-specific difference is that DP-Input degrades more severely on ETTh2 ($+300\%$ vs. $+103\%$ for DP-SGD at $\epsilon =0.1$) because ETTh2 has a lower baseline MSE (0.175 vs. 0.338), so the same absolute noise causes proportionally larger degradation; DP-Input uses $\Delta f=1$ for both z-score standardized datasets. At $H=720$ on ETTh2, DP-SGD slightly outperforms LDPT at $\epsilon =0.1$ (MSE $0.439$ vs. $0.446$)—the only such case at strong privacy across all settings. The calibration chain ($\epsilon \to p\to \gamma \to \sigma$) is identical across datasets, confirming data independence of the perturbation mechanism.

7.11. Membership Inference Attack

We conducted a loss-threshold MIA [35] on both datasets at $H=24$ (representative; the attack exploits model-level generalization gaps that are independent of prediction horizon): a logistic regression classifier trained on per-sample MSE losses from 1000 training and 1000 test samples predicts membership. Attack accuracy $\approx 0.50$ indicates no exploitable generalization gap.

LDPT achieves near-random MIA accuracy ($0.48$–$0.52$), matching the Classical baseline. DP-SGD ($0.588$) and Bottleneck-DP ($0.57$–$0.67$) show elevated vulnerability because noise-impaired learning creates large train-test gaps that the attacker exploits. Cross-dataset replication on ETTh2 (

Table A6. Membership inference attack results (ETTh2, $H=24$). ^† = model diverged. Loss Gap = Train MSE − Test MSE.

Method	$\mathit{\epsilon }$	MIA Acc	AUC	Loss Gap	Train MSE	Test MSE
Classical	∞	0.585	0.670	+0.094	0.177	0.083
LDPT	0.1	0.591	0.678	+0.121	0.204	0.082
LDPT	0.5	0.605	0.662	+0.120	0.201	0.081
DP-SGD	0.1	0.678	0.770	+0.349	0.478	0.130
Bottleneck-DP	0.1	0.676	0.800	≈40 K	—	≈21 K †
Bottleneck-DP	0.5	0.703	0.779	+0.438	0.618	0.181
Bottleneck-DP	1.0	0.684	0.762	+0.364	0.504	0.140
Bottleneck-DP	5.0	0.695	0.798	+0.432	0.615	0.183

, Appendix A) confirms the ordering: LDPT ≤ Classical < DP-SGD < Bottleneck-DP on both datasets.

Table 9. Membership inference attack results (ETTh1, $H=24$). ^† = model diverged. Loss Gap = Train MSE − Test MSE; negative values indicate higher test error (generalization gap exploitable by attacker).

Method	$\mathit{\epsilon }$	MIA Acc	AUC	Loss Gap	Train MSE	Test MSE
Classical	∞	0.492	0.532	−0.001	0.249	0.251
LDPT	0.1	0.518	0.470	+0.001	0.261	0.260
LDPT	0.5	0.480	0.468	+0.001	0.259	0.258
DP-SGD	0.1	0.588	0.606	−0.129	0.562	0.692
Bottleneck-DP	0.1	0.671	0.749	−2798	—	≈18 K †
Bottleneck-DP	0.5	0.575	0.618	−0.135	0.626	0.760
Bottleneck-DP	1.0	0.572	0.600	−0.115	0.579	0.694
Bottleneck-DP	5.0	0.602	0.638	−0.135	0.729	0.863

Table 9. Membership inference attack results (ETTh1, $H=24$). ^† = model diverged. Loss Gap = Train MSE − Test MSE; negative values indicate higher test error (generalization gap exploitable by attacker).

Method	$\mathit{\epsilon }$	MIA Acc	AUC	Loss Gap	Train MSE	Test MSE
Classical	∞	0.492	0.532	−0.001	0.249	0.251
LDPT	0.1	0.518	0.470	+0.001	0.261	0.260
LDPT	0.5	0.480	0.468	+0.001	0.259	0.258
DP-SGD	0.1	0.588	0.606	−0.129	0.562	0.692
Bottleneck-DP	0.1	0.671	0.749	−2798	—	≈18 K †
Bottleneck-DP	0.5	0.575	0.618	−0.135	0.626	0.760
Bottleneck-DP	1.0	0.572	0.600	−0.115	0.579	0.694
Bottleneck-DP	5.0	0.602	0.638	−0.135	0.729	0.863

The LDPT ≈ baseline is the expected outcome when privacy noise is placed outside the optimization loop: generalization is preserved, so the train–test loss gap gives the attacker no signal. Methods that inject noise inside optimization destroy generalization and paradoxically increase empirical attack success despite providing formal guarantees. These empirical observations do not override the formal $(\epsilon ,\delta )$-DP guarantees of DP-SGD. Beyond loss-threshold MIA, future work should evaluate LDPT against stronger attacks, including gradient inversion and attribute inference, though LDPT’s clean-gradient design reduces gradient-based attack surfaces in centralized settings since no privacy-sensitive noise is present in the gradient path. In federated deployments where model updates may be shared with an aggregator, gradient inversion and update reconstruction remain relevant threats and would require additional defenses, such as secure aggregation.

7.12. Ablation and Sensitivity Analysis

We isolate the contribution of each component via targeted ablations on ETTh1 ($H=24$, $\epsilon =0.1$).

Three-point injection removal. Removing the noise injection (Equations (13)–(15)) while keeping the Lindblad channel and shot noise active eliminates all measurable MSE separation across $\epsilon$ values. The MSE becomes nearly identical ($\Delta <0.2\%$) regardless of $\epsilon$, confirming that deterministic transformer layers absorb the upstream quantum noise. The injection is therefore necessary to preserve observable privacy effects.

Lindblad channel removal. Removing the Lindblad decoherence ($\gamma =0$, pure Hamiltonian evolution only) while keeping the three-point injection active reduces the MSE separation between $\epsilon$ values by $\sim 60\%$. The injection alone provides some $\epsilon$-dependent noise (since $\sigma =p/\sqrt{d_{\mathrm{model}}}$ still varies with $\epsilon$), but the quantum features lose their physics-calibrated decoherence signature. This confirms that the Lindblad channel provides the primary noise source while the injection preserves it through the network.

Varying $N_s$ from 256 to 4096 at fixed $\epsilon =0.1$ shows diminishing returns: $N_s=256$ increases MSE by $+1.2\%$ (more measurement noise), while $N_s=4096$ reduces it by $-0.3\%$ (less). The default $N_s=1024$ balances privacy contributions and computational cost.

The factor $k=2.0$ in Noise #3 (Equation (15)) controls output-stage noise. At $k=1.0$, MSE separation between $\epsilon =0.1$ and $\epsilon =5.0$ narrows by $\sim 30\%$; at $k=3.0$, MSE at $\epsilon =0.1$ increases by an additional $+2\%$ with marginal improvement in separation. $k=2.0$ was selected on validation data as the best tradeoff between observable privacy effect and utility cost.

QC-AdaLN vs. standard LayerNorm. Replacing QC-AdaLN with standard LayerNorm reduces MSE separation across $\epsilon$ values by $\sim 40\%$, consistent with LayerNorm erasing $\epsilon$-dependent magnitude information. QC-AdaLN is critical for the privacy signal to propagate through normalization layers.

Table 10. Ablation summary (ETTh1, $H=24$, $\epsilon =0.1$). “–” prefix indicates component removed. $\epsilon$-Separation = ratio of MSE ($\epsilon =0.1$) − MSE ($\epsilon =5.0$) to the full-model separation; values below 100% indicate reduced privacy–utility coupling.

Configuration	MSE	$\mathit{\epsilon }$-Separation
LDPT (full)	0.358	100% (reference)
–Three-point injection	0.340	<2%
–Lindblad channel ($\gamma =0$)	0.349	∼40%
$N_s=256$ (vs. 1024)	0.362	∼110%
$N_s=4096$ (vs. 1024)	0.357	∼95%
$k=1.0$ (vs. 2.0)	0.352	∼70%
$k=3.0$ (vs. 2.0)	0.365	∼105%
QC-AdaLN → LayerNorm	0.348	∼60%

Table 10. Ablation summary (ETTh1, $H=24$, $\epsilon =0.1$). “–” prefix indicates component removed. $\epsilon$-Separation = ratio of MSE ($\epsilon =0.1$) − MSE ($\epsilon =5.0$) to the full-model separation; values below 100% indicate reduced privacy–utility coupling.

Configuration	MSE	$\mathit{\epsilon }$-Separation
LDPT (full)	0.358	100% (reference)
–Three-point injection	0.340	<2%
–Lindblad channel ($\gamma =0$)	0.349	∼40%
$N_s=256$ (vs. 1024)	0.362	∼110%
$N_s=4096$ (vs. 1024)	0.357	∼95%
$k=1.0$ (vs. 2.0)	0.352	∼70%
$k=3.0$ (vs. 2.0)	0.365	∼105%
QC-AdaLN → LayerNorm	0.348	∼60%

7.13. Multi-Seed Stability Validation

To quantify seed-to-seed variance, we repeat the core LDPT and DP-SGD benchmarks on both ETTh1 and ETTh2 with three random seeds (2024, 2025, 2026) at two representative horizons ($H=24$, short-horizon regime; $H=336$, long-horizon regularization regime). All other settings match the single-seed configurations. DP-SGD noise multipliers are recomputed via the RDP accountant (${\sigma }_g=15.50$ at $\epsilon =0.1$, ${\sigma }_g=3.41$ at $\epsilon =0.5$ for ETTh1; ${\sigma }_g=15.65$ at $\epsilon =0.1$, ${\sigma }_g=3.44$ at $\epsilon =0.5$ for ETTh2).

Three observations emerge from

Table 11. Multi-seed results on ETTh1 (seeds: 2024, 2025, 2026).

Method	$\mathit{\epsilon }$	$\mathit{H}=24$ (MSE Mean ± Std)	$\mathit{H}=336$ (MSE Mean ± Std)
Classical	∞	$0.3362\pm 0.0025$	$0.4458\pm 0.0048$
LDPT (QDP)	0.1	$0.3558\pm 0.0024$	$0.4638\pm 0.0040$
LDPT (QDP)	0.5	$0.3505\pm 0.0021$	$0.4625\pm 0.0035$
DP-SGD	0.1	$0.7183\pm 0.0148$	$0.7248\pm 0.0226$
DP-SGD	0.5	$0.7046\pm 0.0062$	$0.7195\pm 0.0131$

.

At $H=24$, LDPT standard deviation across seeds is $0.0021$–$0.0024$, while DP-SGD is $0.0062$–$0.0148$. At $H=336$, the contrast sharpens: LDPT std is $0.0040$ ($\epsilon =0.1$) vs. DP-SGD’s $0.0226$, a $5.7\times$ reduction in seed-to-seed variance. This stability follows from the structural difference in noise placement: feature-path noise perturbs a fixed D-dimensional representation, whereas gradient noise enters every parameter update and compounds across the 345 K-dimensional optimization trajectory.

Single-seed results are consistent with multi-seed means. The $\epsilon =0.1$, $H=24$ multi-seed mean for LDPT is $0.3558\pm 0.0024$ compared to the single-seed value $0.358$ from Table 3, a difference of $0.002$ (<1$\sigma$). The DP-SGD $\epsilon =0.1$, $H=24$ multi-seed mean $0.7183\pm 0.0148$ aligns with the single-seed value $0.7129$ within one standard deviation. At $H=336$, the agreement is similarly tight: single-seed DP-SGD $\epsilon =0.1$ is $0.7203$, multi-seed is $0.7248\pm 0.0226$.

Across all seeds and both horizons, LDPT MSE remains within $5.8\%$ of the Classical baseline, while DP-SGD MSE stays near $0.70$–$0.73$. The LDPT-over-DP-SGD advantage replicates: at $H=24$, $\epsilon =0.1$, the multi-seed LDPT mean ($0.3558$) is $50.5\%$ below the multi-seed DP-SGD mean ($0.7183$), matching the $49.8\%$ advantage reported for teh single seed.

Table 12. Multi-seed results on ETTh2 (seeds: 2024, 2025, 2026).

Method	$\mathit{\epsilon }$	$\mathit{H}=24$ (MSE Mean ± Std)	$\mathit{H}=336$ (MSE Mean ± Std)
Classical	∞	$0.1788\pm 0.0006$	$0.3740\pm 0.0040$
LDPT (QDP)	0.1	$0.1778\pm 0.0010$	$0.3762\pm 0.0033$
LDPT (QDP)	0.5	$0.1765\pm 0.0011$	$0.3718\pm 0.0020$
DP-SGD	0.1	$0.3574\pm 0.0090$	$0.3887\pm 0.0047$
DP-SGD	0.5	$0.3470\pm 0.0055$	$0.3834\pm 0.0037$

confirms the ETTh1 findings generalize to ETTh2. LDPT variance at $H=24$ is 5–$9\times$ lower than DP-SGD ($0.0010$–$0.0011$ vs. $0.0055$–$0.0090$). LDPT at $\epsilon =0.1$ costs only $-0.6\%$ MSE relative to Classical (in fact slightly better), while DP-SGD costs $+99.8\%$. At $H=336$, the same pattern holds: LDPT stays within $0.6\%$ of Classical, while DP-SGD degrades by $2.6$–$3.9\%$—a smaller gap than on ETTh1, consistent with ETTh2 being an easier prediction task where gradient noise is less destructive. We note that with only three seeds, formal statistical tests (e.g., paired t-tests) have limited power; the reported effect sizes (LDPT MSE $\sim 0.36$ vs. DP-SGD MSE $\sim 0.72$ at $H=24$) are sufficiently large that confidence intervals do not overlap, but we defer rigorous statistical testing to an extended, multi-seed evaluation.

Together with the MIA results in Table 9 and the ablation summary in Table 10, these multi-seed results confirm that LDPT’s utility advantage is robust across seeds, datasets, and horizons.

8. Discussion

8.1. Feature-Path vs. Gradient-Path Privacy

Privacy perturbations are substantially less destructive when separated from the optimization gradients and confined to a low-dimensional feature representation. For larger models, this dimensional separation grows: doubling P doubles DP-SGD’s noise burden but has zero effect on feature-path noise. Under feature perturbation $\mathbf{z}\to \mathbf{z}+\xi$, the induced gradient perturbation is

$$\tilde{\mathbf{g}}\approx \mathbf{g}+J_z\xi ,\mathrm{where}{J}_z={\displaystyle \frac{\partial \mathbf{g}}{\partial \mathbf{z}}}$$

(20)

The expected gradient error is then bounded by

$$\mathbb{E}[\parallel \tilde{\mathbf{g}}{-\mathbf{g}\parallel }^2]\le \parallel J_z{\parallel }^2·{\sigma }^{2}D$$

(21)

which depends on D, not P. In contrast, DP-SGD’s gradient perturbation satisfies ${\mathbb{E}[\parallel \nu \parallel }^2]={\sigma }^{2}P$ (Proposition 1). This explains the training convergence data in Table 4: LDPT’s training loss ($0.090$) matches Classical because the optimizer receives near-clean gradients, while DP-SGD’s training loss ($0.544$) stalls near random initialization because each update is dominated by noise.

Over T training steps, the cumulative noise variance is $O\left(T{\sigma }^{2}P\right)$ for DP-SGD versus $O(T\parallel J_z{\parallel }^2{\sigma }^{2}D)$ for LDPT. Since $D/P\approx 5\times {10}^{-5}$, the per-step noise is orders of magnitude smaller for feature-path injection even before accounting for the Jacobian attenuation. This is consistent with the 3–$6\times$ lower seed-to-seed variance observed in Table 11: gradient noise compounds stochastically across the full 345 K-dimensional optimization trajectory, while feature noise perturbs only the 16-dimensional representation.

The generalization implications follow directly. Under standard noise-stability arguments [2], the generalization gap scales with the noise injection dimension:

$$\begin{array}{cc}\hfill \mathbb{E}[\ell \left(\theta \right)]-\widehat{\ell }\left(\theta \right)& \le 𝒪\left({\displaystyle \frac{\sigma \sqrt{D}}{\sqrt{N}}}\right)(\mathrm{feature}\mathrm{noise})\hfill \\ \hfill \mathbb{E}[\ell \left(\theta \right)]-\widehat{\ell }\left(\theta \right)& \le 𝒪\left({\displaystyle \frac{\sigma \sqrt{P}}{\sqrt{N}}}\right)(\mathrm{gradient}\mathrm{noise})\hfill \end{array}$$

(22)

For $D=16$, $P=345$ K, and $N=8281$, the feature-path bound is $\sqrt{P/D}\approx 147\times$ tighter. This is consistent with the empirical observation that LDPT maintains near-baseline test MSE ($+5.8\%$), while DP-SGD’s test MSE doubles ($+111\%$), and explains why the MIA evaluation (Section 7.11) shows near-zero generalization gap for LDPT ($0.001$) versus large gaps for DP-SGD ($-0.129$) and Bottleneck-DP ($-0.115$ to $-2798$).

8.2. Relation to MPC and Q-DPTS

In prior work [9], we evaluated MPC-based secure inference on overlapping ETT datasets (ETTh1 and ETTm1) and measured 20–$70\%$ MSE degradation from CrypTen’s cryptographic overhead. MPC protects data during inference (inputs and weights are encrypted) but does not address what the model learns during training: the model trains on plaintext and can memorize individual records. LDPT addresses both limitations—representation-level privacy during training and inference—at $+5.8\%$ MSE degradation, an order-of-magnitude improvement over MPC. The two approaches are complementary: MPC prevents data exposure at the inference endpoint, while LDPT constrains what the model learns in the first place.

Chen and Chen’s Q-DPTS [11] applies DP-SGD to variational quantum circuit parameters, suffering $+66\%$ MSE degradation at $\sigma =2.0$. LDPT avoids gradient noise entirely by routing privacy through the feature path, achieving $+5.8\%$ degradation—the difference between tolerating gradient noise (Q-DPTS) and avoiding it (LDPT).

8.3. Comparison Methodology and Tuned DP-SGD

All methods share an identical backbone, optimizer, scheduler, and mixed precision (Section 7.2). The three mechanisms differ only in where noise enters: gradients (DP-SGD, ${\sigma }_g$ via RDP [12]), raw inputs (DP-Input, Gaussian mechanism [28] with $\Delta f=1$), or the calibrated feature path (LDPT, Algorithm 1). Table 8 reports exact ${\sigma }_g$ values. More advanced methods exist (DP-Adam [2], adaptive clipping [36], PATE [34]); PATE requires a different threat model and is not directly comparable.

To test whether tuning closes the gap, we re-ran DP-SGD with a batch size of 512, 50 epochs, and a warmup.

Table 13. Tuned DP-SGD (batch size of 512, with 50 epochs and warmup) on ETTh1, $H=24$.

$\mathit{\epsilon }$	Original	Tuned	LDPT	Classical
0.1	0.713	0.699	0.358	0.338
0.5	0.700	0.658	0.353	0.338
1.0	0.699	0.474	0.348	0.338
5.0	0.690	0.371	0.342	0.338

shows that tuning narrows the gap at weak privacy ($\epsilon =5.0$: $0.690\to 0.371$) but provides minimal improvement at strong privacy ($\epsilon =0.1$: $0.713\to 0.699$), consistent with the structural limitation of gradient-path noise.

8.4. Classical Bottleneck Ablation: Separating Architecture from Calibration

Two ablation experiments disentangle the architectural and calibration contributions.

Table 14. Classical Bottleneck vs. LDPT (QDP) on ETTh1. Bottleneck $\epsilon$ labels index matched noise scale only (Privacy = none). LDPT: $\epsilon$-QDP; DP-SGD: $(\epsilon ,\delta )$-DP. Bold indicates best MSE at each horizon.

Method	$\mathit{\epsilon }$	$\mathit{H}=24$	$\mathit{H}=48$	$\mathit{H}=96$	Privacy
Classical	∞	0.338	0.374	0.409	none
Bottleneck	0.1	0.334	0.364	0.388	none
Bottleneck	0.5	0.332	0.362	0.392	none
Bottleneck	1.0	0.330	0.360	0.391	none
Bottleneck	5.0	0.328	0.358	0.392	none
LDPT (QDP)	0.1	0.358	0.369	0.414	$\epsilon$-QDP
LDPT (QDP)	0.5	0.353	0.365	0.412	$\epsilon$-QDP
LDPT (QDP)	1.0	0.348	0.362	0.410	$\epsilon$-QDP
LDPT (QDP)	5.0	0.342	0.359	0.406	$\epsilon$-QDP
DP-SGD	0.1	0.713	0.710	0.730	$(\epsilon ,\delta )$-DP

isolates noise placement by matching LDPT’s $\sigma$ without any privacy guarantee.

Table 15. Classical Bottleneck with formal $(\epsilon ,\delta )$-DP (Gaussian mechanism) on ETTh1. ^† = model diverged. Bold indicates best MSE at each $\epsilon$ level.

Method	$\mathit{\epsilon }$	$\mathit{\sigma }$	$\mathit{H}=24$	$\mathit{H}=48$	$\mathit{H}=96$	Privacy
Classical	∞	0	0.338	0.374	0.409	none
Bottleneck-DP	0.1	52.99	≈18 K †	934	255	$(\epsilon ,\delta )$-DP
Bottleneck-DP	0.5	10.60	0.789	0.751	0.744	$(\epsilon ,\delta )$-DP
Bottleneck-DP	1.0	5.30	0.722	0.710	0.723	$(\epsilon ,\delta )$-DP
Bottleneck-DP	5.0	1.06	0.924	0.843	0.928	$(\epsilon ,\delta )$-DP
LDPT (QDP)	0.1	0.084	0.358	0.369	0.414	$\epsilon$-QDP
LDPT (QDP)	0.5	0.068	0.353	0.365	0.412	$\epsilon$-QDP
LDPT (QDP)	1.0	0.050	0.348	0.362	0.410	$\epsilon$-QDP
LDPT (QDP)	5.0	0.003	0.342	0.359	0.406	$\epsilon$-QDP

tests whether classical $(\epsilon ,\delta )$-DP calibration can replace the QDP calibration at the same privacy level. Together, they show that noise placement determines utility, while the calibration mechanism determines the achievable privacy–noise tradeoff.

For Table 14, we run the identical transformer backbone with use_quantum=False (no Lindblad channel, no POVM, no quantum features), but with the three-point noise injection active at the same $\sigma =p/\sqrt{d_{\mathrm{model}}}$ magnitudes as LDPT. Table 14 is a diagnostic, not a head-to-head comparison: the bottleneck rows use LDPT’s noise scale $\sigma$ but carry no privacy guarantee (Privacy column = “none”).

Within this controlled setting, the classical bottleneck matches or slightly outperforms LDPT’s MSE at every horizon and $\epsilon$ value, isolating noise placement as the architectural factor responsible for utility preservation. The bottleneck even outperforms the no-noise baseline, indicating that low-dimensional noise also acts as a regularizer. The small ETTh1 gap between Bottleneck (e.g., $0.334$ at $\epsilon =0.1$, $H=24$) and LDPT ($0.358$) is the utility cost LDPT pays for carrying a formal $\epsilon$-QDP guarantee, while the Bottleneck has none; this gap shrinks to zero on ETTh2 (

Table A5. Classical Bottleneck vs. LDPT (QDP) on ETTh2. Bold indicates best result.

Method	$\mathit{\epsilon }$	$\mathit{H}=24$	$\mathit{H}=48$	$\mathit{H}=96$	Privacy
Classical	∞	0.175	0.230	0.301	none
Bottleneck	0.1	0.181	0.235	0.298	none
Bottleneck	0.5	0.180	0.235	0.297	none
Bottleneck	1.0	0.179	0.234	0.297	none
Bottleneck	5.0	0.178	0.233	0.297	none
LDPT (QDP)	0.1	0.181	0.234	0.321	$\epsilon$-QDP
LDPT (QDP)	0.5	0.178	0.232	0.318	$\epsilon$-QDP
LDPT (QDP)	1.0	0.177	0.232	0.317	$\epsilon$-QDP
LDPT (QDP)	5.0	0.175	0.230	0.316	$\epsilon$-QDP

). Crucially, Table 14 does not imply that the calibration is unnecessary—it only shows that utility is determined by placement, not by the noise source. The calibration question is answered by Table 15.

However, utility alone is not sufficient for privacy-preserving systems. The classical bottleneck as implemented provides no mechanism-specific mapping between noise magnitude and a privacy parameter $\epsilon$; one cannot compute what privacy level the noise scale $\sigma =0.084$ provides without a bound analogous to Theorem 1. It therefore cannot support formal privacy guarantees, compositional privacy accounting, or auditable privacy budgets. In contrast, the quantum-inspired framework provides a principled calibration mechanism where $\epsilon$ directly determines all noise parameters via the QDP bounds (Theorems 1–3), enabling formal $\epsilon$-level guarantees and verifiable budget tracking.

These results demonstrate that effective privacy-preserving learning requires both components:

• Architectural placement of noise in a low-dimensional feature path to preserve utility, confirmed by the bottleneck achieving near-baseline MSE.
• Mechanism-specific calibration to provide formal privacy guarantees—provided by the Lindblad/POVM framework via Theorems 1–3.

Removing either component leads to failure: calibration without architectural decoupling (DP-SGD) yields $+111\%$ MSE degradation; architecture without calibration (bottleneck) yields noise of unknown privacy strength. LDPT combines both, achieving $+5.8\%$ MSE with formal $\epsilon =0.1$ QDP.

To verify that the QDP calibration is not merely decorative, we ran a second bottleneck experiment, the same classical architecture, but with noise calibrated via the standard Gaussian mechanism ($\sigma =\sqrt{2ln(1.25/\delta )}·\Delta f/\epsilon$, sensitivity $\Delta f=1$, $\delta ={10}^{-6}$). This gives the bottleneck formal $(\epsilon ,\delta )$-DP, a direct comparison with LDPT on privacy, not just noise scale.

Table 15 reveals why the calibrated channel formulation is not decorative. The Gaussian mechanism requires $\sigma =52.99$ to achieve $(\epsilon =0.1,\delta ={10}^{-6})$-DP, producing catastrophic MSE ($\approx 18$ K—the model diverges to degenerate predictions). LDPT achieves $\epsilon =0.1$-QDP with $\sigma =0.084$—substantially smaller perturbation magnitudes—because the depolarizing channel bound (Theorem 1) provides a tighter $\epsilon$-to-$\sigma$ mapping than the classical Gaussian mechanism for this architecture. Even at $\epsilon =1.0$, the Gaussian-mechanism bottleneck ($\sigma =5.30$, MSE $\approx 0.72$) substantially underperforms LDPT ($\sigma =0.050$, MSE $\approx 0.35$). The two calibration mechanisms converge only at weak privacy ($\epsilon =5.0$), where both require little noise. This gap is not dataset-specific: on ETTh2, Bottleneck-DP at $\epsilon =0.1$ produces MSE $\approx 45$ K, while LDPT achieves $0.181$ (

Table A3. Classical Bottleneck with formal $(\epsilon ,\delta )$-DP (Gaussian mechanism) on ETTh2. ^† = model diverged. Bold indicates best MSE.

Method	$\mathit{\epsilon }$	$\mathit{\sigma }$	$\mathit{H}=24$	$\mathit{H}=48$	$\mathit{H}=96$	Privacy
Classical	∞	0	0.175	0.230	0.301	none
Bottleneck-DP	0.1	52.99	≈45 K †	≈5 K †	728	$(\epsilon ,\delta )$-DP
Bottleneck-DP	0.5	10.60	0.459	0.431	0.420	$(\epsilon ,\delta )$-DP
Bottleneck-DP	1.0	5.30	0.372	0.373	0.398	$(\epsilon ,\delta )$-DP
Bottleneck-DP	5.0	1.06	0.464	0.439	0.453	$(\epsilon ,\delta )$-DP
LDPT (QDP)	0.1	0.084	0.181	0.234	0.321	$\epsilon$-QDP
LDPT (QDP)	0.5	0.068	0.178	0.232	0.318	$\epsilon$-QDP
LDPT (QDP)	1.0	0.050	0.177	0.232	0.317	$\epsilon$-QDP
LDPT (QDP)	5.0	0.003	0.175	0.230	0.316	$\epsilon$-QDP

and

Table A4. Bottleneck-DP at $\epsilon =0.1$ ($\sigma =52.99$)—extended horizons. ^† = model diverged.

Method/Dataset	$\mathit{H}=24$	$\mathit{H}=48$	$\mathit{H}=96$	$\mathit{H}=168$	$\mathit{H}=336$	$\mathit{H}=720$
Bottleneck-DP/ETTh1	≈18 K †	934	255	100	34	17
Bottleneck-DP/ETTh2	≈45 K †	≈5 K †	728	219	64	17
LDPT (QDP)/ETTh1	0.358	0.369	0.414	0.440	0.464	0.556
LDPT (QDP)/ETTh2	0.181	0.234	0.321	0.354	0.386	0.446

, Appendix A).

The ratio of required noise scales ($\sigma =52.99$ vs. $\sigma =0.084$) reflects incompatible sensitivity assumptions and should not be interpreted as a direct quantitative comparison. The Gaussian mechanism uses worst-case ${\ell }_2$-sensitivity $\Delta f=1$, while QDP assumes trace-distance bound $d=0.1$ in a different metric space. Nevertheless, an approximate decomposition is informative. The Gaussian mechanism in Table 15 uses worst-case sensitivity $\Delta f=1$, while QDP assumes trace-distance bound $d=0.1$. These quantities live in different spaces (${\ell }_2$ on classical features vs. $L_1$ on density matrices), so a direct rescaling is not rigorous; however, as an indicative comparison, if the Gaussian mechanism were applied with sensitivity reduced to the bounded-perturbation regime ($\Delta f\approx 0.1$), its required noise would drop from $\sigma =52.99$ to $\sigma \approx 5.30$—accounting for roughly $10\times$ of the gap. The remaining $\sim 63\times$ ($\sigma =5.30$ vs. $\sigma =0.084$) is consistent with a tighter geometric calibration of the depolarizing channel on low-dimensional bounded-purity states under the bounded trace-distance assumptions (Theorem 1): even under this non-rigorous decomposition, the Gaussian mechanism requires approximately $63\times$ more noise than the depolarizing-channel calibration. A formal decomposition would require deriving the induced ${\ell }_2$-sensitivity of the amplitude encoding under the trace-distance constraint, which we leave to future work. The Bottleneck-DP row at $\epsilon =5.0$ exhibits non-monotonic MSE relative to $\epsilon =1.0$, consistent with seed-level variance in a regime where $\sigma$ is small relative to natural data variance; this does not affect the central $\epsilon =0.1$ finding.

Table 16. Computational cost comparison ($H=24$, A100 GPU).

Method	Epoch Time	Overhead	Privacy Dim.
Classical	42 s	$1.0\times$	—
DP-Input	42 s	$1.0\times$	$C=7$
DP-SGD	47 s	$1.1\times$	$P=345$ K
LDPT (QDP)	58 s	$1.4\times$	$D=16$

compares the per-epoch training cost. LDPT’s overhead comes from the quantum feature pipeline: Lindblad propagation ($D^2\times D^2$ matrix-vector multiply per sample), SIC-POVM measurement ($K=256$ inner products), and shot noise sampling. The Liouvillian $e^{\mathcal{L}t}$ is precomputed once ($O\left(D^6\right)$ for matrix exponential) and reused across all samples and epochs, amortizing to negligible per-sample cost. In practice, the quantum path adds $\sim 1.4\times$ wall-clock overhead versus the Classical baseline on A100, while DP-SGD adds $\sim 1.1\times$ (gradient clipping + noise). DP-Input has no overhead beyond a single randn_like per batch.

8.5. Extension to Federated Learning

LDPT’s architectural decoupling of privacy noise from gradients is naturally compatible with federated learning (FL), where multiple clients train on private local data. Because LDPT keeps gradients clean, federated aggregation (e.g., FedAvg) operates on unperturbed model updates while privacy is enforced locally at the feature path. This avoids the compounding noise problem that makes DP-SGD particularly challenging in FL settings, where gradient noise from each client accumulates during aggregation. Recent federated approaches addressing data heterogeneity and privacy [37,38,39] provide promising directions for integrating representation-level privacy into distributed forecasting systems. Extending LDPT to federated time-series forecasting with heterogeneous client data distributions is a natural direction for future work.

8.6. Limitations

While LDPT demonstrates strong empirical results on the ETT datasets, several limitations should be noted.

Experiments were conducted exclusively on ETTh1 and ETTh2 (electricity transformer data, $C=7$, hourly frequency). These datasets are relatively low-dimensional and stationary, and the calibration chain assumes z-score normalized features with bounded trace distance. Performance on higher-dimensional or highly non-stationary datasets—e.g., MIMIC-III clinical vitals, intraday financial returns, or weather data with abrupt regime shifts—may differ, particularly because non-stationary distributions can produce per-feature perturbations exceeding the $d=0.1$ trace-distance bound (Section 6.2). Whether LDPT’s calibration degrades gracefully or requires recalibration to a larger d in such regimes is an empirical question we plan to address in future work, alongside ETTm1, weather, and clinical benchmarks.

The current implementation uses $n=4$ qubits ($D=16$), resulting in a manageable $256\times 256$ Liouvillian matrix. Scaling to $n=8$ ($D=256$) produces a $65,536\times 65,536$ matrix, which requires $\sim 34$ GB of FP64 memory for the Liouvillian matrix exponential alone and dominates the per-experiment cost. Approximate techniques (feature subsampling within the bottleneck, parallel small circuits, or Trotterized propagation) will be required for $n\ge 8$.

LDPT provides local $\epsilon$-QDP under a bounded trace-distance assumption ($d=0.1$). This bound holds reliably for small perturbations ($\tau \le 0.05$ standard deviations per feature; see Table 2) but does not cover arbitrary record additions, removals, or large changes, as in the standard global $(\epsilon ,\delta )$-DP adversary model used by DP-SGD. The guarantee degrades gracefully for pairs exceeding the trace-distance bound. Consequently, direct comparisons of privacy strength with global DP mechanisms should be made with caution. We primarily use the DP-SGD baseline to highlight the impact of noise placement, not to assert strictly superior privacy.

All experiments were performed on a single A100 GPU with a limited compute budget. This restricted us to two datasets, three random seeds, and focused multi-seed validation on two horizons. While results at $H=24$ for MIA are representative (as the attack relies on model-level generalization gaps), broader validation would increase confidence.

Predictions are stochastic at inference time due to ongoing noise injection and finite-shot measurement. Additional comparisons with other feature-level or representation-level privacy methods (e.g., DP-FTRL, locally private representations) would be valuable. A finer-grained residual analysis comparing LDPT, DP-SGD, and Classical predictions across horizons—characterizing residual bias, variance scaling with forecast step, and lag-k autocorrelation—would clarify whether feature-path and gradient-path noise produce structurally different error distributions. We leave this characterization to future work.

9. Conclusions

We demonstrated that privacy-preserving transformer forecasting depends on two separable design choices. For utility, what matters is where noise is introduced, routing perturbations through a low-dimensional feature pathway ($D=16$) rather than the 345 K-parameter gradient path, reducing MSE degradation from over 100% (DP-SGD) and 20–$70\%$ (MPC-based inference [9]) to under 6%. For privacy, placement alone is insufficient: a calibrated mechanism is required to map $\epsilon$ to noise magnitude, and the choice of mechanism determines whether that mapping is tight enough to preserve utility. LDPT combines both feature-path placement for utility and Hybrid QDP calibration for an auditable $\epsilon$-to-$\sigma$ map.

Three complementary evaluations validate these components. First, comparison with DP-SGD confirms that noise placement, not noise magnitude, determines utility; feature-path noise preserves optimization dynamics, while gradient-path noise destroys them. Second, the Bottleneck-DP experiment shows that applying formal $(\epsilon ,\delta )$-DP via the classical Gaussian mechanism to the same feature-path architecture requires orders of magnitude more noise and severely degrades utility, confirming that the calibrated channel provides a tighter $\epsilon$-to-$\sigma$ mapping than classical alternatives. Third, membership inference evaluation reveals that LDPT does not amplify membership leakage beyond the non-private baseline ($0.48$–$0.61$ across datasets), while both DP-SGD and Bottleneck-DP with formal guarantees show elevated vulnerability ($0.57$–$0.70$) due to noise-induced generalization gaps.

All findings are validated on two datasets (ETTh1, ETTh2) across six prediction horizons, with multi-seed stability analysis, cross-dataset replication of the bottleneck and Bottleneck-DP ablations, and MIA evaluation on both datasets. The resulting guarantees are local $\epsilon$-QDP under a bounded trace-distance assumption; extensions to global DP settings, tighter composition bounds, broader datasets, and NISQ hardware deployment remain future work.

Reproducibility. Source code is available upon reasonable request.