Privacy in federated learning

Lens adapted to this topic: Potential benefits and conditions for trustworthy privacy protection

The mainstream technical account treats federated learning as a useful privacy-enhancing architecture because raw data can remain under local control rather than being centrally collected. It does not regard this property as sufficient by itself: meaningful protection requires measures such as secure aggregation, differential privacy, robust threat modeling, and appropriate governance. The evidence base also recognizes that these safeguards involve utility, deployment, and trust trade-offs.

• Keeping data local can reduce exposure associated with centralized collection while enabling collaborative model training.
• Secure aggregation can limit what a coordinating server learns from individual updates, but privacy guarantees depend on the protocol and assumptions.
• Differential privacy and related techniques are important defenses against inference and reconstruction attacks, though they may affect model utility.
• Federated learning should be evaluated using explicit threat models and layered security and privacy protections rather than being assumed private by design.

Lens adapted to this topic: Critical evidence on residual vulnerabilities and weak trust assumptions

A serious critical position argues that federated learning is often marketed too broadly as privacy-preserving. Keeping raw data local does not prevent sensitive information from leaking through updates or trained models, and some proposed protections can fail under realistic adversaries, including a malicious or untrusted server and Sybil participants. This view emphasizes power imbalances, governance, verifiability, and the gap between formal guarantees and practical deployments.

• The label “privacy-preserving” can be misleading when a federated-learning protocol lacks formal privacy guarantees and relies heavily on trust in the coordinating server.
• Model updates can support data reconstruction, model inversion, membership inference, and other privacy attacks despite raw data remaining local.
• A server-assisted attack using Sybil devices has been proposed against federated learning protected by distributed differential privacy and secure aggregation under certain assumptions.
• Federated learning does not resolve broader data-ethics questions, such as governance, consent, fairness, and responsibility for how models are used.
• The effectiveness of protections depends on deployment details, threat models, and whether users can trust or constrain the coordinating server.