  A new measure of information leakage for quantum encoding of classical data
is defined. An adversary can access a single copy of the state of a quantum
system that encodes some classical data and is interested in correctly guessing
a general randomized or deterministic function of the data (e.g., a specific
feature or attribute of the data in quantum machine learning) that is unknown
to the security analyst. The resulting measure of information leakage, referred
to as maximal quantum leakage, is the multiplicative increase of the
probability of correctly guessing any function of the classical data upon
observing measurements of the quantum state. Maximal quantum leakage is shown
to satisfy post-processing inequality (i.e., applying a quantum channel reduces
information leakage) and independence property (i.e., leakage is zero if the
quantum state is independent of the classical data), which are fundamental
properties required for privacy and security analysis. It also bounds
accessible information. Effects of global and local depolarizing noise models
on the maximal quantum leakage are established.
