{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T21:10:31Z","timestamp":1791407431811,"version":"4.3.3"},"reference-count":47,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001782","name":"University of Melbourne","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100001782","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Quantum Mach. Intell."],"published-print":{"date-parts":[[2025,12]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Quantum machine learning (QML) is an emerging field of research with potential applications to distributed collaborative learning, such as split learning (SL). SL allows resource-constrained clients to collaboratively train ML models with a server, reduce their computational overhead, and enable data privacy by avoiding raw data sharing. Although QML with SL has been studied, the problem remains open in resource-constrained environments where clients lack quantum computing capabilities. Additionally, data privacy leakage between client and server in SL poses risks of reconstruction attacks on the server side. To address these issues, we propose hybrid quantum split learning (HQSL), an application of hybrid QML in SL. HQSL enables classical clients to train models with a hybrid quantum server and curtails reconstruction attacks. Additionally, we introduce a novel qubit-efficient data-loading technique for designing a quantum layer in HQSL, minimizing both the number of qubits and circuit depth. Evaluations on real hardware demonstrate HQSL\u2019s practicality under realistic quantum noise. Experiments on five datasets demonstrate HQSL\u2019s feasibility and ability to enhance classification performance compared to its classical models. Notably, HQSL achieves mean improvements of over 3% in both accuracy and F1-score for the Fashion-MNIST dataset and over 1.5% in both metrics for the Speech Commands dataset. We expand these studies to include up to 100 clients, confirming HQSL\u2019s scalability. Moreover, we introduce a noise-based defense mechanism to tackle reconstruction attacks on the server side. Overall, HQSL enables classical clients to train collaboratively with a hybrid quantum server, improving model performance and resistance against reconstruction attacks.<\/jats:p>","DOI":"10.1007\/s42484-025-00295-z","type":"journal-article","created":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T13:40:00Z","timestamp":1754055600000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":12,"title":["A hybrid quantum neural network for split learning"],"prefix":"10.1007","volume":"7","author":[{"given":"Hevish","family":"Cowlessur","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chandra","family":"Thapa","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tansu","family":"Alpcan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Seyit","family":"Camtepe","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,8,1]]},"reference":[{"key":"295_CR1","doi-asserted-by":"publisher","unstructured":"Abuadbba S, Kim K, Kim M, Thapa C, Camtepe SA, Gao Y, Kim H, Nepal S (2020) Can we use split learning on 1D CNN models for privacy preserving training? In: Proceedings of the 15th ACM asia conference on computer and communications security. ACM, Taipei Taiwan, pp 305\u2013318. https:\/\/doi.org\/10.1145\/3320269.3384740. https:\/\/dl.acm.org\/doi\/10.1145\/3320269.3384740","DOI":"10.1145\/3320269.3384740"},{"key":"295_CR2","doi-asserted-by":"crossref","unstructured":"Alam M, Kundu S, Topaloglu RO, Ghosh S (2021) Quantum-classical hybrid machine learning for image classification (iccad special session paper). In: 2021 IEEE\/ACM International Conference On Computer Aided Design (ICCAD). IEEE, pp 1\u20137","DOI":"10.1109\/ICCAD51958.2021.9643516"},{"key":"295_CR3","doi-asserted-by":"crossref","unstructured":"Balle B, Cherubin G, Hayes J (2022) Reconstructing training data with informed adversaries. In: 2022 IEEE Symposium on Security and Privacy (SP). IEEE, pp 1138\u20131156","DOI":"10.1109\/SP46214.2022.9833677"},{"issue":"6","key":"295_CR4","doi-asserted-by":"publisher","first-page":"141","DOI":"10.1109\/MSP.2012.2211477","volume":"29","author":"L Deng","year":"2012","unstructured":"Deng L (2012) The MNIST database of handwritten digit images for machine learning research [Best of the Web]. IEEE Signal Process Mag 29(6):141\u2013142. https:\/\/doi.org\/10.1109\/MSP.2012.2211477","journal-title":"IEEE Signal Process Mag"},{"key":"295_CR5","doi-asserted-by":"publisher","unstructured":"Dougherty S, Kumar A, Hou J, Tourani R, Tabakhi AM (2023) A stealthy inference attack on split learning with a split-fuse defensive measure. In: 2023 IEEE Conference on Communications and Network Security (CNS). IEEE, Orlando, FL, USA, pp 1\u20139. https:\/\/doi.org\/10.1109\/CNS59707.2023.10288661. https:\/\/ieeexplore.ieee.org\/document\/10288661\/","DOI":"10.1109\/CNS59707.2023.10288661"},{"key":"295_CR6","doi-asserted-by":"publisher","unstructured":"Erell A, Weintraub M (1990) Estimation using log-spectral-distance criterion for noise-robust speech recognition. In: International conference on acoustics, speech, and signal processing, pp 853\u20138562. https:\/\/doi.org\/10.1109\/ICASSP.1990.115972","DOI":"10.1109\/ICASSP.1990.115972"},{"key":"295_CR7","unstructured":"Gawron G, Stubbings P (2022) Feature space hijacking attacks against differentially private split learning. arXiv. arXiv:2201.04018 [cs]. http:\/\/arxiv.org\/abs\/2201.04018"},{"key":"295_CR8","doi-asserted-by":"publisher","unstructured":"Javadi-Abhari A, Treinish M, Krsulich K, Wood CJ, Lishman J, Gacon J, Martiel S, Nation PD, Bishop LS, Cross AW, Johnson BR, Gambetta JM (2024) Quantum computing with Qiskit. https:\/\/doi.org\/10.48550\/arXiv.2405.08810","DOI":"10.48550\/arXiv.2405.08810"},{"issue":"7\u20138","key":"295_CR9","doi-asserted-by":"publisher","first-page":"1800077","DOI":"10.1002\/qute.201800077","volume":"2","author":"Z-A Jia","year":"2019","unstructured":"Jia Z-A, Yi B, Zhai R, Wu Y-C, Guo G-C, Guo G-P (2019) Quantum neural network states: a brief review of methods and applications. Adv Quantum Technol 2(7\u20138):1800077","journal-title":"Adv Quantum Technol"},{"issue":"4","key":"295_CR10","doi-asserted-by":"publisher","first-page":"60","DOI":"10.3390\/mps5040060","volume":"5","author":"P Joshi","year":"2022","unstructured":"Joshi P, Thapa C, Camtepe S, Hasanuzzaman M, Scully T, Afli H (2022) Performance and information leakage in splitfed learning and multi-head split learning in healthcare data and beyond. Methods Protoc 5(4):60. https:\/\/doi.org\/10.3390\/mps5040060","journal-title":"Methods Protoc"},{"key":"295_CR11","doi-asserted-by":"publisher","unstructured":"Lahitani AR, Permanasari AE, Setiawan NA (2016) Cosine similarity to determine similarity measure: study case in online essay assessment. In: 2016 4th International conference on cyber and IT service management, pp 1\u20136. https:\/\/doi.org\/10.1109\/CITSM.2016.7577578","DOI":"10.1109\/CITSM.2016.7577578"},{"key":"295_CR12","doi-asserted-by":"publisher","first-page":"140504","DOI":"10.1103\/PhysRevLett.114.140504","volume":"114","author":"Z Li","year":"2015","unstructured":"Li Z, Liu X, Xu N, Du J (2015) Experimental realization of a quantum support vector machine. Phys Rev Lett 114:140504. https:\/\/doi.org\/10.1103\/PhysRevLett.114.140504","journal-title":"Phys Rev Lett"},{"key":"295_CR13","doi-asserted-by":"publisher","first-page":"161","DOI":"10.1016\/j.patcog.2018.05.019","volume":"83","author":"F Li","year":"2018","unstructured":"Li F, Qiao H, Zhang B (2018) Discriminatively boosted image clustering with fully convolutional auto-encoders. Pattern Recognit 83:161\u2013173. https:\/\/doi.org\/10.1016\/j.patcog.2018.05.019","journal-title":"Pattern Recognit"},{"key":"295_CR14","unstructured":"Li O, Sun J, Yang X, Gao W, Zhang H, Xie J, Smith V, Wang C (2022) Label leakage and protection in two-party split learning"},{"key":"295_CR15","doi-asserted-by":"publisher","first-page":"133","DOI":"10.1016\/j.neunet.2021.05.028","volume":"143","author":"Y Liang","year":"2021","unstructured":"Liang Y, Peng W, Zheng Z-J, Silv\u00e9n O, Zhao G (2021) A hybrid quantum-classical neural network with deep residual learning. Neural Netw 143:133\u2013147","journal-title":"Neural Netw"},{"key":"295_CR16","unstructured":"Liu W, Wu Q, Zha Y (2023) A block-ring connected topology of parameterized quantum circuits"},{"key":"295_CR17","doi-asserted-by":"publisher","unstructured":"Liu W, Zhang Y, Deng Z, Zhao J, Tong L (2021a) A hybrid quantum-classical conditional generative adversarial network algorithm for human-centered paradigm in cloud. EURASIP J Wirel Commun Netw 2021(1):37. https:\/\/doi.org\/10.1186\/s13638-021-01898-3. Accessed 06 Feb 2025","DOI":"10.1186\/s13638-021-01898-3"},{"issue":"9","key":"295_CR18","doi-asserted-by":"publisher","first-page":"290311","DOI":"10.1007\/s11433-021-1734-3","volume":"64","author":"J Liu","year":"2021","unstructured":"Liu J, Lim KH, Wood KL, Huang W, Guo C, Huang H-L (2021b) Hybrid quantum-classical convolutional neural networks. Sci China Phys Mech Astron 64(9):290311","journal-title":"Sci China Phys Mech Astron"},{"issue":"9","key":"295_CR19","doi-asserted-by":"publisher","first-page":"631","DOI":"10.1038\/nphys3029","volume":"10","author":"S Lloyd","year":"2014","unstructured":"Lloyd S, Mohseni M, Rebentrost P (2014) Quantum principal component analysis. Nat Phys 10(9):631\u2013633","journal-title":"Nat Phys"},{"issue":"1","key":"295_CR20","doi-asserted-by":"publisher","first-page":"4812","DOI":"10.1038\/s41467-018-07090-4","volume":"9","author":"JR McClean","year":"2018","unstructured":"McClean JR, Boixo S, Smelyanskiy VN, Babbush R, Neven H (2018) Barren plateaus in quantum neural network training landscapes. Nat Commun 9(1):4812","journal-title":"Nat Commun"},{"key":"295_CR21","doi-asserted-by":"publisher","unstructured":"Mireshghallah F, Taram M, Ramrakhyani P, Jalali A, Tullsen D, Esmaeilzadeh H (2020) Shredder: learning noise distributions to protect inference privacy. In: Proceedings of the twenty-fifth international conference on architectural support for programming languages and operating systems. ACM, Lausanne Switzerland, pp 3\u201318. https:\/\/doi.org\/10.1145\/3373376.3378522. https:\/\/dl.acm.org\/doi\/10.1145\/3373376.3378522","DOI":"10.1145\/3373376.3378522"},{"key":"295_CR22","doi-asserted-by":"publisher","first-page":"107","DOI":"10.1007\/978-981-99-8024-6_9","volume-title":"Information security applications","author":"H Na","year":"2024","unstructured":"Na H, Oh Y, Lee W, Choi D (2024) Systematic evaluation of robustness against model inversion attacks on split learning. In: Kim H, Youn J (eds) Information security applications. Springer, Singapore, pp 107\u2013118"},{"key":"295_CR23","doi-asserted-by":"publisher","first-page":"709","DOI":"10.1007\/978-3-642-19309-5_55","volume-title":"Computer Vision - ACCV 2010","author":"HV Nguyen","year":"2011","unstructured":"Nguyen HV, Bai L (2011) Cosine similarity metric learning for face verification. In: Kimmel R, Klette R, Sugimoto A (eds) Computer Vision - ACCV 2010. Springer, Berlin, Heidelberg, pp 709\u2013720"},{"key":"295_CR24","doi-asserted-by":"publisher","unstructured":"Nielsen MA, Chuang IL (2010) Quantum computation and quantum information: 10th Anniversary Edition. Cambridge University Press, Cambridge, UK. https:\/\/doi.org\/10.1017\/CBO9780511976667","DOI":"10.1017\/CBO9780511976667"},{"key":"295_CR25","doi-asserted-by":"publisher","first-page":"1104","DOI":"10.1109\/TASLP.2020.2979603","volume":"28","author":"AA Nugraha","year":"2020","unstructured":"Nugraha AA, Sekiguchi K, Yoshii K (2020) A flow-based deep latent variable model for speech spectrogram modeling and enhancement. IEEE\/ACM Trans Audio Speech Lang Process 28:1104\u20131117. https:\/\/doi.org\/10.1109\/TASLP.2020.2979603","journal-title":"IEEE\/ACM Trans Audio Speech Lang Process"},{"key":"295_CR26","doi-asserted-by":"publisher","unstructured":"Park S, Baek H, Kim J (2023) Quantum split learning for privacy-preserving information management. In: Proceedings of the 32nd ACM International conference on information and knowledge management. CIKM \u201923. Association for Computing Machinery, New York, NY, USA, pp 4239\u20134243. https:\/\/doi.org\/10.1145\/3583780.3615144","DOI":"10.1145\/3583780.3615144"},{"key":"295_CR27","doi-asserted-by":"publisher","unstructured":"Pasquini D, Ateniese G, Bernaschi M (2021) Unleashing the tiger: inference attacks on split learning. In: Proceedings of the 2021 ACM SIGSAC conference on computer and communications security. ACM, Virtual Event Republic of Korea, pp 2113\u20132129. https:\/\/doi.org\/10.1145\/3460120.3485259. https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3485259","DOI":"10.1145\/3460120.3485259"},{"key":"295_CR28","doi-asserted-by":"publisher","unstructured":"P\u00e9rez-Salinas A, Cervera-Lierta A, Gil-Fuster E, Latorre JI (2020) Data re-uploading for a universal quantum classifier. Quantum 4:226. https:\/\/doi.org\/10.22331\/q-2020-02-06-226. arXiv:1907.02085 [quant-ph]","DOI":"10.22331\/q-2020-02-06-226"},{"key":"295_CR29","doi-asserted-by":"publisher","first-page":"79","DOI":"10.22331\/q-2018-08-06-79","volume":"2","author":"J Preskill","year":"2018","unstructured":"Preskill J (2018) Quantum computing in the NISQ era and beyond. Quantum 2:79. https:\/\/doi.org\/10.22331\/q-2018-08-06-79","journal-title":"Quantum"},{"issue":"1","key":"295_CR30","first-page":"1","volume":"4","author":"R Sarathy","year":"2011","unstructured":"Sarathy R, Muralidhar K (2011) Evaluating Laplace noise addition to satisfy differential privacy for numeric data. Trans Data Privacy 4(1):1\u201317","journal-title":"Trans Data Privacy"},{"issue":"1","key":"295_CR31","doi-asserted-by":"publisher","first-page":"11927","DOI":"10.1038\/s41598-022-14876-6","volume":"12","author":"N Schetakis","year":"2022","unstructured":"Schetakis N, Aghamalyan D, Griffin P, Boguslavsky M (2022) Review of some existing QML frameworks and novel hybrid classical-quantum neural networks realising binary classification for the noisy datasets. Sci Rep 12(1):11927","journal-title":"Sci Rep"},{"key":"295_CR32","doi-asserted-by":"publisher","unstructured":"Schuld M, Bergholm V, Gogolin C, Izaac J, Killoran N (2019) Evaluating analytic gradients on quantum hardware. Phys Rev A 99(3):032331. arXiv:1811.11184 [quant-ph]. https:\/\/doi.org\/10.1103\/PhysRevA.99.032331","DOI":"10.1103\/PhysRevA.99.032331"},{"key":"295_CR33","doi-asserted-by":"publisher","unstructured":"Shokri R, Shmatikov V (2015) Privacy-preserving deep learning. In: Proceedings of the 22nd ACM SIGSAC conference on computer and communications security. ACM, Denver Colorado USA, pp 1310\u20131321. https:\/\/doi.org\/10.1145\/2810103.2813687. https:\/\/dl.acm.org\/doi\/10.1145\/2810103.2813687","DOI":"10.1145\/2810103.2813687"},{"key":"295_CR34","doi-asserted-by":"publisher","unstructured":"Shokri R, Stronati M, Song C, Shmatikov V (2017) Membership inference attacks against machine learning models. In: 2017 IEEE Symposium on Security and Privacy (SP). IEEE, San Jose, CA, USA, pp 3\u201318. https:\/\/doi.org\/10.1109\/SP.2017.41. http:\/\/ieeexplore.ieee.org\/document\/7958568\/","DOI":"10.1109\/SP.2017.41"},{"key":"295_CR35","unstructured":"Suryotrisongko H (2022a) Botnet DGA Detection. https:\/\/doi.org\/10.24433\/CO.4005597.v2"},{"key":"295_CR36","unstructured":"Suryotrisongko H (2022b) Botnet DGA Detection. https:\/\/ieee-dataport.org\/open-access\/botnet-dga-dataset"},{"key":"295_CR37","doi-asserted-by":"publisher","unstructured":"Thapa C, Mahawaga Arachchige PC, Camtepe S, Sun L (2022) SplitFed: when federated learning meets split learning. Proc AAAI Conf Artif Intell 36(8):8485\u20138493. https:\/\/doi.org\/10.1609\/aaai.v36i8.20825. Accessed 02 Aug 2024","DOI":"10.1609\/aaai.v36i8.20825"},{"key":"295_CR38","unstructured":"Titcombe T, Hall AJ, Papadopoulos P, Romanini D (2021) Practical defences against model inversion attacks for split neural networks. arXiv. arXiv:2104.05743 [cs]. http:\/\/arxiv.org\/abs\/2104.05743"},{"key":"295_CR39","doi-asserted-by":"publisher","unstructured":"Tsang SL, West MT, Erfani SM, Usman M (2023) Hybrid quantum-classical generative adversarial network for high resolution image generation. IEEE Trans Quantum Eng 4:1\u201319. https:\/\/doi.org\/10.1109\/TQE.2023.3319319. arXiv:2212.11614 [quant-ph]. Accessed 07 Feb 2025","DOI":"10.1109\/TQE.2023.3319319"},{"key":"295_CR40","unstructured":"Vepakomma P, Gupta O, Swedish T, Raskar R (2018) Split learning for health: distributed deep learning without sharing raw patient data. arXiv. arXiv:1812.00564 [cs, stat]. http:\/\/arxiv.org\/abs\/1812.00564"},{"key":"295_CR41","doi-asserted-by":"crossref","unstructured":"Vepakomma P, Singh A, Gupta O, Raskar R (2020) NoPeek: information leakage reduction to share activations in distributed deep learning. arXiv. arXiv:2008.09161 [cs, stat]. http:\/\/arxiv.org\/abs\/2008.09161","DOI":"10.1109\/ICDMW51313.2020.00134"},{"issue":"4","key":"295_CR42","doi-asserted-by":"publisher","first-page":"600","DOI":"10.1109\/TIP.2003.819861","volume":"13","author":"Z Wang","year":"2004","unstructured":"Wang Z (2004) Image quality assessment: from error visibility to structural similarity. IEEE Trans Image Process 13(4):600\u2013612","journal-title":"IEEE Trans Image Process"},{"key":"295_CR43","unstructured":"Warden P (2018) Speech commands: a dataset for limited-vocabulary speech recognition"},{"key":"295_CR44","doi-asserted-by":"publisher","unstructured":"Wu Q, Liu W, Huang Y, Liu H, Xiao H, Li Z (2024) A degressive quantum convolutional neural network for quantum state classification and code recognition. iScience 27(4):109394. https:\/\/doi.org\/10.1016\/j.isci.2024.109394. Accessed 06 Feb 2025","DOI":"10.1016\/j.isci.2024.109394"},{"key":"295_CR45","unstructured":"Xiao H, Rasul K, Vollgraf R (2017) Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms"},{"key":"295_CR46","doi-asserted-by":"publisher","unstructured":"Zargar ST, Joshi J, Tipper D (2013) A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks. IEEE Commun Surv Tutor 15(4):2046\u20132069. https:\/\/doi.org\/10.1109\/SURV.2013.031413.00127","DOI":"10.1109\/SURV.2013.031413.00127"},{"key":"295_CR47","doi-asserted-by":"publisher","unstructured":"Zwitter M, Soklic M (1988) Breast cancer. UCI Machine Learning Repository. https:\/\/doi.org\/10.24432\/C51P4M","DOI":"10.24432\/C51P4M"}],"container-title":["Quantum Machine Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s42484-025-00295-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s42484-025-00295-z","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s42484-025-00295-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,29]],"date-time":"2026-01-29T09:37:28Z","timestamp":1769679448000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s42484-025-00295-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,1]]},"references-count":47,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2025,12]]}},"alternative-id":["295"],"URL":"https:\/\/doi.org\/10.1007\/s42484-025-00295-z","relation":{},"ISSN":["2524-4906","2524-4914"],"issn-type":[{"value":"2524-4906","type":"print"},{"value":"2524-4914","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,8,1]]},"assertion":[{"value":"8 August 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"30 June 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 August 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"76"}}