Secure multi-party computation is a branch of cryptography in which several parties jointly compute a function over their private inputs without revealing those inputs to one another. In the quantum version of this problem, quantum states and quantum operations supplement or replace classical techniques to provide security guarantees rooted in the laws of physics rather than in assumptions about computational hardness. Multiplication is a particularly important target operation: once parties can multiply their secret values securely, they can build a wide range of more elaborate privacy-preserving applications, from secure auctions and electronic voting to privacy-preserving machine learning and distributed statistical analysis. The new protocol addresses multiplication directly, allowing multiple participants to combine their secret inputs into a shared product while keeping every individual input hidden.

The central technical innovation lies in the protocol’s use of the multiplicative homomorphic property of the RSA encryption algorithm. Homomorphic encryption allows arithmetic to be performed directly on encrypted data: a party can encrypt a value, and the structure of the encryption ensures that combining ciphertexts corresponds to combining the underlying plaintexts. In the multiplicative case, the product of two ciphertexts decrypts to the product of the two plaintexts. This property means participants can contribute encrypted shares of their secrets, the encrypted shares can be multiplied together, and only the final decrypted result reveals anything about the combined product—never the individual contributions. By anchoring the protocol in RSA’s well-understood multiplicative homomorphism, the authors inherit a mature cryptographic foundation while layering quantum techniques on top for input protection and verification.

What distinguishes this work from earlier quantum secure multiplication protocols is its verifiability. In many existing schemes, participants simply have to trust that the final result is correct. If a malicious participant injects a corrupted share, or if noise and error creep into the process, the output may be silently wrong. The new protocol allows every participant to check the integrity of the final computation result and to detect any error affecting correctness, whether that error was introduced intentionally by a cheater or unintentionally by some failure in the process. Verification transforms the protocol from a trust-based arrangement into an auditable one, which is essential for any realistic deployment involving parties who may have conflicting interests.

The dynamic aspect of the protocol is equally significant. Real-world collaborations are rarely static: organizations join consortiums, employees leave companies, and partners withdraw from joint ventures. A secure multi-party protocol that must be restarted from scratch every time the participant list changes would be impractically rigid. The new scheme supports dynamic updates, meaning participants can be added or removed while the computation’s security guarantees are preserved. This flexibility, however, creates a dangerous loophole that the authors explicitly confront: a participant who is being revoked has a clear incentive to cheat during the update process, corrupting the computation on the way out. The protocol’s verification mechanism is specifically designed to detect deceptive behavior by revoked participants during these dynamic updates, closing an attack window that earlier dynamic protocols left open.

The authors describe this threat as a dishonest revocation attack, and their security analysis demonstrates that the protocol resists it alongside a series of other typical external and internal attacks. External attacks, in the quantum setting, include eavesdropping attempts in which an outsider tries to extract information from the quantum states exchanged between honest participants; the protocol’s quantum components are designed so that such interference leaves detectable traces. Internal attacks are subtler and often more damaging, since they come from participants who hold legitimate credentials but choose to deviate from the protocol to learn others’ inputs or to bias the result. By combining homomorphic encryption with verification checks, the protocol ensures that neither class of adversary can compromise either the privacy of the inputs or the correctness of the product without being caught.

Efficiency matters as much as security in this domain, because quantum protocols can impose heavy computational and communication burdens. The authors report that their scheme achieves relatively low computational costs compared with existing multiplication protocols, making it a more practical candidate for real applications. The reliance on classical RSA homomorphic operations for the arithmetic core, rather than on expensive quantum computations for every step, helps keep the overhead manageable, while quantum resources are deployed where they add the most security value. The result, the authors argue, is a protocol that offers enhanced practicality and meaningful security guarantees at a computational price that realistic deployments could afford.

The work builds on a substantial body of prior research in quantum secure multi-party computation. Earlier protocols have addressed secure summation using single photons, quantum Fourier transforms, Grover’s search algorithm and mutually unbiased bases, and secure multiplication has been explored through secret sharing and hybrid quantum-classical approaches. Previous work by members of the same team introduced a (k, n)-threshold dynamic quantum secure multiparty multiplication protocol and a verifiable threshold quantum secure multiparty summation protocol, and the present study extends that lineage by adding verifiable result integrity to the dynamic multiplication setting through homomorphic encryption. The broader field also draws on foundational results in quantum state determination, secret sharing with d-level systems, and analyses of practical attacks such as Trojan-horse attacks on quantum communication systems, all of which inform the threat model the new protocol is designed to survive.

The implications extend beyond the immediate technical contribution. As quantum computers edge closer to threatening classical public-key cryptography, and as organizations increasingly need to compute jointly over sensitive data—financial positions, medical records, proprietary models—protocols that combine quantum security with classical efficiency are likely to attract growing attention. A verifiable, dynamic multiplication protocol offers a building block for such systems: it demonstrates that participant churn need not be a security liability, and that even a departing adversary with every reason to cheat can be prevented from corrupting a shared computation. The research was supported by the National Natural Science Foundation of China, and the authors declare no conflict of interest. While laboratory-scale quantum networks and practical homomorphic quantum deployments remain works in progress, this protocol represents a concrete step toward secure multi-party computation that is simultaneously quantum-resistant in its guarantees, flexible in its membership, and honest in its arithmetic.

Subject of Research: A verifiable dynamic quantum secure multi-party multiplication protocol based on RSA homomorphic encryption that resists cheating by revoked participants.

Article Title: Verifiable dynamic quantum secure multi-party multiplication protocol based on homomorphic encryption

Article References: Li, F., Li, R., Sun, Y., & Zhu, S. (2026). Verifiable dynamic quantum secure multi-party multiplication protocol based on homomorphic encryption. Quantum Information Processing, 25(10), Article 317. https://doi.org/10.1007/s11128-026-05347-2

Image Credits: AI Generated

DOI: 10.1007/s11128-026-05347-2

Keywords: quantum cryptography, secure multi-party computation, homomorphic encryption, RSA, verifiability, dynamic protocols, multiplication protocol, dishonest revocation attack, quantum information, privacy-preserving computation, Quantum Information Processing, Hefei University of Technology

Using a PRISMA-style systematic review methodology, the researchers analyzed papers from the last five years of literature, the period in which privacy attacks against machine learning evolved from academic curiosities into practical threats. Their contribution is not a single new technique but a map of the entire battlefield: a unified taxonomy of attack families, a parallel taxonomy of defenses, recommended evaluation metrics for each attack type, and a reproducibility checklist alongside an attack-by-defense protection matrix that distills the qualitative findings of hundreds of studies into a single comparative view.

The taxonomy of attacks is sobering in its breadth. Membership inference attacks ask a deceptively simple question of a model: was this specific person’s record part of your training data? First demonstrated systematically by Shokri and colleagues in 2017 and refined since through approaches that exploit overfitting, prediction sensitivity, and quantile regression, these attacks now extend even to large language models, recommender systems, graph neural networks, and diffusion models. Model inversion attacks go further, reconstructing representative images or attributes of training classes from a model’s outputs, exploiting the confidence information that models emit so freely. Model extraction attacks steal entire architectures and weights through prediction APIs, converting years of training investment into a target for intellectual property theft as well as privacy abuse.

Perhaps most alarming for the federated learning era is gradient leakage. In collaborative training settings where participants share gradient updates instead of raw data, researchers showed as early as 2019 with the Deep Leakage from Gradients work that those updates can be inverted to reconstruct training inputs almost pixel-perfectly. The survey also covers property and attribute inference, in which adversaries deduce sensitive characteristics of training populations, alongside poisoning and backdoor attacks that corrupt models from within, side-channel attacks that exploit hardware implementations, and a rapidly growing family of large language model specific leakage, including verbatim training data extraction from production models and membership inference against in-context learning.

Against this arsenal, the survey organizes defenses into coherent families. Differential privacy, introduced by Cynthia Dwork in 2006, remains the workhorse: by injecting carefully calibrated noise into gradients during training, typically through the DP-SGD algorithm of Abadi and colleagues, it provides a mathematically provable bound on how much any single individual’s data can influence the model. The literature has spawned refinements including Rényi and Gaussian differential privacy, concentrated variants, adaptive gradient clipping, and privacy accounting improvements, along with integration into generative adversarial networks, Bayesian neural networks, and stochastic gradient Langevin dynamics.

Federated learning itself constitutes a second defense pillar, allowing organizations such as hospitals to train shared models without centralizing patient records, a principle already demonstrated in real multicenter studies for glaucoma detection, skin cancer diagnosis, and medical image analysis. Yet the survey is clear that federated learning alone is not privacy protection: gradient reconstruction, membership inference, and property inference all remain viable against naive federated systems, which is why the pairing with robust and privacy-preserving aggregation rules, secure aggregation protocols, and blockchain-based verification has become an active research frontier.

At the strongest end of the guarantee spectrum sit cryptographic approaches: homomorphic encryption, which permits computation directly on encrypted data, and secure multi-party computation, which distributes computation so no party sees another’s inputs. These techniques offer mathematically rigorous confidentiality, and standardized frameworks from IEEE and ITU now exist to guide their deployment. But the survey’s comparative analysis is unambiguous about the price: cryptographic stacks impose computational and communication overheads that can be orders of magnitude higher than plaintext training, making them practical today mainly for inference workloads, smaller models, or high-stakes domains such as healthcare and finance where the value of the data justifies the cost. Hybrid architectures, such as federated learning combined with homomorphic encryption or differential privacy layered over secure aggregation, attempt to balance these trade-offs.

The authors sharpen their analysis with three case studies covering centralized image classification, federated learning, and large language models. The verdict on the current landscape is nuanced. Noise-based methods such as differential privacy remain the practical baseline, deployable at scale and increasingly efficient, but they offer only partial protection, and their privacy-utility trade-off still forces difficult choices in accuracy-sensitive applications. Cryptographic methods deliver the strongest theoretical guarantees at substantially higher cost. Most urgently, the survey identifies large language model and multimodal leakage as an under-benchmarked gap: while training data extraction and membership inference against language models have been repeatedly demonstrated, standardized evaluation of defenses in this space lags far behind the pace of model deployment.

What makes this survey particularly valuable for practitioners is its insistence on evaluation discipline. For each attack family, the authors recommend specific metrics, recognizing, for example, that membership inference success should be measured against realistic background-knowledge assumptions rather than favorable shadow-model setups, and that privacy claims must be tested against adaptive attackers rather than fixed benchmarks. The reproducibility checklist addresses a chronic weakness of the field, where attack papers and defense papers often use incompatible threat models, making headline claims difficult to compare. The attack-by-defense protection matrix gives system designers a direct way to reason about which combination of techniques addresses which threats, and where residual risk remains.

The stakes of getting this right are rising alongside regulation. Data protection laws around the world increasingly impose concrete obligations on organizations whose models memorize personal information, and the survey situates the technical landscape within this regulatory context, noting that healthcare, finance, and government deployments face the tightest constraints. For the field as a whole, the message is one of guarded optimism paired with urgency. The defensive toolkit is now rich, mathematically grounded, and increasingly practical, and surveys like this one provide the coordination infrastructure the field has lacked. But as models grow larger, more multimodal, and more deeply embedded in everyday services, the attack surface grows with them, and the gap between what can be attacked and what has been rigorously defended remains widest precisely where the data is most personal. Closing that gap, the authors suggest, will require the same systematic, benchmark-driven rigor that this survey brings to mapping the problem.

Subject of Research: Privacy-preserving methodologies and privacy attacks in deep learning

Article Title: Privacy-preserving methodologies against privacy attacks on deep learning: a survey

Article References: Ghosh, S., & Mandal, A. K. (2026). Privacy-preserving methodologies against privacy attacks on deep learning: a survey. Knowledge and Information Systems, 68(1), Article 255. https://doi.org/10.1007/s10115-026-02865-4

Image Credits: AI Generated

DOI: 10.1007/s10115-026-02865-4

Keywords: deep learning, privacy attacks, differential privacy, federated learning, homomorphic encryption, membership inference, model inversion, gradient leakage, large language models, secure multi-party computation, data privacy, machine learning security