Certifying the quantum local differential privacy ofan untrusted mechanism: a no-go theorem and acomposable trusted-probe protocol

Abstract Quantum local differential privacy (QLDP) bounds how much any measurement can distinguish the outputs of a mechanism on neighboring inputs, but existing theory quantifies privacy under the assumption that the mechanism is trusted and characterized. We ask whether the QLDP parameter of an untrusted quantum mechanism can be certified from observed statistics, and we answer in two parts. First, we prove a no-go theorem: under full device independence, where the measurement is also untrusted, no protocol can certify any finite bound on the privacy parameter, because the privacy action of a channel can be absorbed into the untrusted measurement without changing the observed statistics. Second, we identify the minimal trusted-probe model that escapes this obstruction: the verifier prepares informationally complete test states, applies a characterized informationally complete measurement to the output, and reports the worst-case privacy parameter over all mechanisms consistent with the data. The resulting certificate is a sound upper bound on the true leakage, admits a closed form on the optimal mechanism family used for private inference, and remains valid under finite statistics against adaptive, memoryful adversarial strategies through a martingale concentration bound. The certified mechanism retains the known quantum utility advantage for non-binary data up to a quantified noise threshold, and the certificate is composably secure in the abstract-cryptography framework, yielding a certified-private-aggregation resource for federated settings. The results connect quantum differential privacy with quantum certification by treating privacy leakage itself as the operational quantity to be certified.