Three cuts tested, and what the family has in common¶
Every personalized federated adapter design in the reading splits the adapter into a transmitted part and a part kept local. They differ only in where the cut falls.
| design | cuts by | transmitted | does the transmitted part still identify the organization? |
|---|---|---|---|
| SDFLoRA (arXiv:2601.11219) | subspace | the aligned shared subspace | depends on the rank; not established. See the corrections entry |
| PFAdapter (IEEE TCCN) | module role | q and k projections | yes: AOSP 0.702 against 0.735 for everything |
| FedSA-LoRA (ICLR 2025) | LoRA factor | A only | jobs 149581 and 149582 |
| SecureGate (ACL 2026) | sanitization | the "secure" adapter | not measured here |
| FedDPA (NeurIPS 2024), FDLoRA | adapter instance | the global adapter | not measured here |
Two of the three cuts tested leave the source where the server can read it, and one of them hands the server a cleaner copy than the raw update. The reason is the same in both cases: the organizational signal is not a localized idiosyncrasy that a partition can quarantine, it is diffuse and redundant, present in every module role and concentrated in the very directions that alignment identifies as common.
This is the gap the study can speak to, and it is not a seventh splitting scheme. None of these papers measures whether its transmitted part identifies its source; PFAdapter says so in its own words -- "FL keeps raw samples on device, but it does not by itself guarantee resistance to update inversion, gradient leakage, or membership inference. The privacy scope of PFAdapter is therefore limited to decentralized training without centralized raw-data pooling". What is missing from the field is not another cut but an evaluation that tells a deployment whether the cut it chose defends against source attribution. That evaluation is what this apparatus is.