Apparatus¶

Cutting by module role does not remove the source either

scripts/module_split.py, datasets/results/module-split.json. PFAdapter (Liu, Yang, Wang, Yang, Hao, Zhang, Liu and Zhou, IEEE TCCN, arXiv:2607.12111, 13 July 2026, read from the PDF) cuts the adapter by the role of the projection: "query and key projections are assigned to global synchronization ... while value and output projections remain localized", and transmits only the global-shared set, halving traffic. The geometry already stores a cosine matrix per adapted module, and a mean of positive semi-definite matrices is positive semi-definite, so any subset of the 196 modules is scored directly as the Gram matrix of unit vectors.

The fingerprint is in the part that gets shared, not the part kept back

scripts/subspace_split.py, datasets/results/subspace-split.json. The defence curve says noise is the wrong lever. The literature's other lever is structural: SDFLoRA (Shen, Lu, Wan and Chen, arXiv:2601.11219, verified on its abstract page) decouples each client's adapter into a shared component that "participates in subspace alignment and aggregation across clients" and a private one that "remains local and uncommunicated", and puts the DP noise only on the aggregated shared update, which "avoids perturbations to local directions".

The defence curve was pooled over content, and for Qt that made it meaningless

On the 77-client set, Qt's curve came back below chance at every noise level -- AUC 0.394 at 50 rounds with no mask at all, standard deviation 0.046 over splits. A detector that is reliably worse than a coin is either inverted or measuring something else. Measured directly, with half of Qt's clients as the reference and the other half held out:

The organization is in the code conventions; the words are the codebase's

datasets/results/separability.json, separability-code.json. Prompted by Ghaleb's finding that for AI coding agents the commit-message conventions carry more than the code changes. For organizations the answer is the other way round, and it is the sharpest thing the probe has said.

The permutation test was comparing two different statistics

Correcting the entry above. The project-level permutation read its observed value from the detector run made earlier at eight reference splits and 600 draws, while every relabeling was scored at two splits and 150. The true grouping is one of the 84 arrangements, so under a matched comparison it scores against itself and the p-value cannot fall below 1/84; the mismatch let it score below its own recomputation, and at 128 examples per client the test printed p = 0.000, which an enumeration of 84 arrangements cannot produce. That impossible value is what exposed it.

Two neighbours, checked against the abstracts' own pages

# research(2026-09). Both verified on arxiv.org/abs rather than from recall.

RQ1 under the registered numerics, and two registrations that earned their keep

Superseded on 2026-09-23. With Qt's automated-only examples removed the pooled reading fails (bot audit), and the change-averaged pass rested on the same examples, so "the estimand decided the headline" does not survive the cleaning (audit of this log, 2026-09-30).

The organization is not in the update. The content and the codebase are.

Qualified within the hour. This entry reads the classification operating point, where organization is indeed not attributable. A targeted detector, which is what an attacker has, does find it: AUC 0.736 for AOSP within C++, beating random relabelings of the same nine projects at p = 0.012. See "The organization is there, at the operating point an attacker actually has".

Masking an update is a delay, not a defence

datasets/results/defence-curve.json, scripts/defence_curve.py. What a federated deployment would actually do against the aggregate attack: each client masks its update with a Gaussian of a given fraction of the mean update norm, drawn afresh every round. The attacker runs FedAttr's statistic, averaging the aggregates of rounds holding the target, subtracting the average of rounds without, and scoring the difference against its reference direction. Rounds of eight, 300 draws, four reference splits, on the sketched updates.

The altitude below ours has already been shown learnable

Dai et al., "MPCoder: Multi-user Personalized Code Generator with Explicit and Implicit Style Representation Learning" (ACL 2024, arXiv:2406.17255), learn per-user coding style: an explicit residual for syntactic conventions, an implicit representation trained with contrastive learning to separate users, and a Coding Style Score over structure, formatting and naming to say whether the generated code resembles the user it was generated for.

How much of adaptation is organizational: 7% and 10%

Superseded on 2026-09-23. Qt's 10% includes its lint bot (bot audit); both shares are corpus v1, organization against organization, and are not re-measured on the current design.

The calibration survives the change of numerics

datasets/results/calibration-marker-0.25-fp32.json. The condition that produced the gate's non-monotonicity, rerun under the registered fp32 inference on a different node.

The medium is not visibly moving, at least not the part the probe reads

scripts/separability_over_time.py, datasets/results/style-drift.json. Two readings of whether the corpus drifts under the study, prompted by the naming-convention shift Xu et al. measure.

A fingerprint measured in a moving medium

Xu et al., "code_transformed: The Influence of Large Language Models on Code" (arXiv:2506.12014, revised 2026-02), measure style across more than 20,000 GitHub repositories linked to arXiv papers from 2020 to 2025 and report conventions shifting toward what models write: snake_case function names in Python rise from 40.7% in Q1 2023 to 49.8% in Q3 2025. They also measure similarity across projects; whether they claim convergence is not something the abstract settles and the full text has not been read.

The aggregate betrays the project more clearly than the organization

datasets/results/aggregate-attack-project.json. The same mixed-round detector, with the target a project rather than an organization: rounds drawn from every client, half holding one of the target's clients, scored against the target's other clients, eight reference splits.