Measurement¶

The subspace split, redone: it depends on the rank and on the instrument

scripts/subspace_split.py, rewritten after the review. Every attribution cell now carries its exact project-level p over the 84 groupings, accuracy is reported beside balanced accuracy, the basis for each scored client is refitted without its whole project (the stricter refit the review proposed), the degenerate rank-1 shared cell is not scored, and the best cell over ranks is judged against the null's best over the same ranks.

The attack results regenerated, with every seed's p

The four committed aggregate-attack results were rerun from a clean tree with the permutation now in aggregate.project_permutation: distinct groupings, the truth checked to reproduce itself, four round-draw seeds each. Provenance now names the commit that produced them and would list any uncommitted code; these list none.

RQ1's contrast is still unclaimed by its nearest neighbours

# research(2026-09). Checked on their abstract pages: Kumar, Lones, Maarek and Zantout, "Fine-Tuning Models for Automated Code Review Feedback" (arXiv:2605.12610, May 2026), fine-tune Code Llama on feedback distilled from a proprietary model, for student Java code. Begolli, Aksoy and Neider, "Fine-Tuning Multilingual Language Models for Code Review: An Empirical Study on Industrial C# Projects" (arXiv:2507.19271), pool public benchmarks with industrial repositories into one training corpus. Neither trains per project or per organization, and neither evaluates an adapter on another organization's data. The matched-against-mismatched contrast RQ1 registers, which asks whether an adaptation is specific to the organization it came from rather than to the task, does not appear in either.

The factor that looks safest is the one that leaks most

The registered prediction, written before the jobs landed, was that A alone would identify the organization well above chance and "not be far below the product's" figure. That was right in direction and too conservative in size. A alone is the most identifying of the three.

Registered before the run: what FedSA-LoRA's shared matrix should leak

Jobs 149581 and 149582. FedSA-LoRA (Guo, Zeng, Wang, Fan, Wang and Qu, ICLR 2025, arXiv:2410.01463, read from the PDF) shares only the A matrices with the server and keeps B local, on the finding that "A matrices are responsible for learning general knowledge, while B matrices focus on capturing client-specific knowledge", evidenced by A matrices being "more similar across clients than the B matrices". It is a privacy argument by construction, and the paper is the basis for FedSA-rsLoRA and FedSA-VeRA.

How long each client trains decides which altitude leaks

*-c128.json. The robustness item asked what several local-training lengths do. Doubling the examples per client from 64 to 128, which repartitions into 51 clients rather than 77 and 34 C++ clients rather than 43:

The mask that helps the attacker: a mechanism, not a bug

scripts/masking_mechanism.py, datasets/results/masking-mechanism.json. Closes the open item "explain the non-monotonicity in noise", which survived the move to the 77-client pool and so was not the finite-pool artefact I had guessed.

Every leakage number in this study was an average-case metric

# research(2026-09). Carlini et al., "Membership Inference Attacks From First Principles" (IEEE S&P 2022, arXiv:2112.03570), argue that an AUC averages over the whole ROC curve, including false-positive rates no attacker would operate at, and that an attack can score well on it while recovering no member at a usable threshold. Privacy is breached by the confident identifications, not by the average case. Every RQ2 number in this log was an AUC, so every one of them was open to that objection.

The organization is there, at the operating point an attacker actually has

datasets/results/aggregate-attack-cpp-beyond-project.json. Qualifies the entry above, which read the classification result alone.

Capacity and placement: where the source signal sits agrees with where adapters store things

Tan, Du and Feng, "How Many Bits Can an Adapter Write?" (arXiv:2607.21351, 2026-07-23), measure how much a LoRA adapter can hold: 1.7 to 2.8 bits a trainable parameter against full fine-tuning's 3.6, with memorization varying nearly twofold by placement, MLP against attention, at matched parameter counts. They measure total information stored, not where it came from, and report that membership inference "did not resolve the difference between these adapters".

What the design can detect: a sensitivity analysis, replacing power at an observed effect

Superseded. These sizes and bounds belong to the retired organization-against-organization gate on corpus v1; the current bounds are the fixed-K simulation's (2026-09-30), and its test size is re-projected over twelve months (audit, 2026-09-30).

Mixed rounds, and a detector that was reading its own reference

Extends the entry above to the deployment question: not "was this named client in the round" with the other participants drawn from other organizations, but "did this organization take part" with the round drawn from every client. The organization's clients are split once into the attacker's reference and the participants it may contribute, so no round is scored against itself.

RQ1 at three seeds, and the seed effect in the setting that counts

datasets/results/rq1-qtfull-seeds.json, seed-effect-qtfull.json. The windowed RQ1 run repeated at seeds 2 and 3, same corpora, split and held-out examples, read by crossed_reread.

Review of the RQ2 and power code: one packing flaw, four small ones

Commits 38936f3 to 405462b reviewed, every finding reproduced and fixed. The one that touches a result: clients.partition could get stuck behind a client no remaining change completed, losing every client after it, so client counts depended on the shuffle. The executed run (148513) was affected in count only, its clients disjoint and exactly sized: starlingx/docs gave 4 where 5 are possible. The packer is now first-fit decreasing over open clients, which reaches the maximum for every corpus but starlingx/docs (5 of 6, where very large changes cannot pack exactly). The next client run, with AOSP added, uses it. The others: a skipped micro-batch now stops a client as a skipped step does, since it leaves the client short; conjunctive_power refuses a seed effect with one seed instead of recording one it did not simulate; seed_effect no longer crashes on a pair with no noise; adapter geometry skips the zero-norm initial state.

The seed main effect, measured: about 0.013, and it is what limits power

Narrowed later on 2026-09-18. "What limits power" held for the null at this size only; see "RQ1 at three seeds, and the seed effect in the setting that counts" below.