Registered before the run: what FedSA-LoRA's shared matrix should leak¶

Jobs 149581 and 149582. FedSA-LoRA (Guo, Zeng, Wang, Fan, Wang and Qu, ICLR 2025, arXiv:2410.01463, read from the PDF) shares only the A matrices with the server and keeps B local, on the finding that "A matrices are responsible for learning general knowledge, while B matrices focus on capturing client-specific knowledge", evidenced by A matrices being "more similar across clients than the B matrices". It is a privacy argument by construction, and the paper is the basis for FedSA-rsLoRA and FedSA-VeRA.

"More similar on average" is not "carries no identity", and the gap between those two is the shape of everything this study has found today: organization was invisible to a classifier and visible to a targeted detector, and the signal sat in the shared subspace rather than the idiosyncratic residual. So the prediction, written before the jobs land:

A alone will identify the organization at well above chance, and the A-only figure will not be far below the product's. If instead A is at chance and B carries it, FedSA-LoRA's rationale holds and the study has found the defence it was missing. Either answer is worth the queue time; saying which was expected beforehand is what makes it worth anything.

Each factor is compared as the movement from what the server broadcast: B starts at zero, so B is its own movement, and A starts at a shared random initialization, so the A geometry subtracts it. Both are therefore "how far this client moved the matrix the server sent it", which is what an honest-but-curious server observes.