How long each client trains decides which altitude leaks¶
*-c128.json. The robustness item asked what several local-training lengths do. Doubling the
examples per client from 64 to 128, which repartitions into 51 clients rather than 77 and 34 C++
clients rather than 43:
| within C++ | 64 per client | 128 per client |
|---|---|---|
| organization, nearest class | 0.395 | 0.765 (majority 0.735) |
| organization, beyond project | 0.395, p 0.75 | 0.676, p 0.19 |
| project | 0.442 | 0.373 |
| content | 0.909 | 0.784 |
| AOSP detector, rounds of 16, two clients | AUC 0.858, TPR 0.364 | AUC 0.940, TPR 0.588 |
| Qt detector, rounds of 8, two clients | AUC 0.859, TPR 0.456 | AUC 0.980, TPR 0.910 |
| AOSP project-level permutation | p 0.012 | p 0.012 |
| Qt project-level permutation | p 0.238 | p 0.018 (median of 4 seeds; 0.012 to 0.036) |
Organization rises at every altitude and by every instrument; project and content fall. Qt, which was unremarkable among relabelings at 64, is at or within two of the most extreme of all 84 arrangements at 128 depending on the round-draw seed, where AOSP is the most extreme at every seed. The detector's low-false-positive numbers move furthest: at one false alarm in a hundred, a round holding two Qt clients goes from 46% caught to 91%.
What this is and is not. The nearest-class figure of 0.765 against a 0.735 majority is one client's difference on 34 and carries nothing by itself; the beyond-project test that controls for the codebase is 0.676 at p 0.19, still not significant. The classifier has not become able to name an owner. What moved decisively is the detector, at the operating point an attacker occupies, and the permutation over groupings. The two sets also differ in size and composition, so this is not a controlled doubling -- it is two points, consistent across six measurements.
The reading that fits all of it: more local training moves a client's update further from the shared start and further toward its own data's particulars, and organization-level habits are a slower, finer signal than the language a client writes. Leakage is therefore not a fixed property of the corpus. It is a function of a knob the deployment sets, and a deployment that trains longer locally, which is what one does to get more out of federated fine-tuning, leaks more about who its participants are. That is a sharper claim than RQ2 was framed to make, and it is the one worth registering.
The obvious next question is whether it keeps rising, which needs a third length.