Novelty check: nobody is evaluating this
# research(2026-09). Searched for a benchmark or evaluation that asks whether the part a
federated adapter scheme transmits identifies the client or organization that produced it. Nothing
matches.
Research log¶
Gap-K% has numbers, and it is the smallest gap of the three
datasets/results/contamination-openstack-6mo-with_context-gapk.json. Closes the open item that
Gap-K% had an implementation and no measurement, the saved results having kept scores rather than
per-token statistics. OpenStack, six months each side, hunks with three context lines, 1,971
eligible post-cutoff examples against 2,502 pre-cutoff.
The whole family, and which rows are measured
# research(2026-09). Every paper below was read from its PDF, not from an abstract. The table
distinguishes what this apparatus has measured from what it has only reasoned about, because the
difference is the whole point of keeping it.
The factor that looks safest is the one that leaks most
The registered prediction, written before the jobs landed, was that A alone would identify the organization well above chance and "not be far below the product's" figure. That was right in direction and too conservative in size. A alone is the most identifying of the three.
Three cuts tested, and what the family has in common
Every personalized federated adapter design in the reading splits the adapter into a transmitted part and a part kept local. They differ only in where the cut falls.
Cutting by module role does not remove the source either
scripts/module_split.py, datasets/results/module-split.json. PFAdapter (Liu, Yang, Wang, Yang,
Hao, Zhang, Liu and Zhou, IEEE TCCN, arXiv:2607.12111, 13 July 2026, read from the PDF) cuts the
adapter by the role of the projection: "query and key projections are assigned to global
synchronization ... while value and output projections remain localized", and transmits only the
global-shared set, halving traffic. The geometry already stores a cosine matrix per adapted module,
and a mean of positive semi-definite matrices is positive semi-definite, so any subset of the 196
modules is scored directly as the Gram matrix of unit vectors.
Registered before the run: what FedSA-LoRA's shared matrix should leak
Jobs 149581 and 149582. FedSA-LoRA (Guo, Zeng, Wang, Fan, Wang and Qu, ICLR 2025, arXiv:2410.01463, read from the PDF) shares only the A matrices with the server and keeps B local, on the finding that "A matrices are responsible for learning general knowledge, while B matrices focus on capturing client-specific knowledge", evidenced by A matrices being "more similar across clients than the B matrices". It is a privacy argument by construction, and the paper is the basis for FedSA-rsLoRA and FedSA-VeRA.
The fingerprint is in the part that gets shared, not the part kept back
scripts/subspace_split.py, datasets/results/subspace-split.json. The defence curve says noise is
the wrong lever. The literature's other lever is structural: SDFLoRA (Shen, Lu, Wan and Chen,
arXiv:2601.11219, verified on its abstract page) decouples each client's adapter into a shared
component that "participates in subspace alignment and aggregation across clients" and a private
one that "remains local and uncommunicated", and puts the DP noise only on the aggregated shared
update, which "avoids perturbations to local directions".
The defence curve was pooled over content, and for Qt that made it meaningless
On the 77-client set, Qt's curve came back below chance at every noise level -- AUC 0.394 at 50 rounds with no mask at all, standard deviation 0.046 over splits. A detector that is reliably worse than a coin is either inverted or measuring something else. Measured directly, with half of Qt's clients as the reference and the other half held out:
The organization is in the code conventions; the words are the codebase's
datasets/results/separability.json, separability-code.json. Prompted by Ghaleb's finding that
for AI coding agents the commit-message conventions carry more than the code changes. For
organizations the answer is the other way round, and it is the sharpest thing the probe has said.
How long each client trains decides which altitude leaks
*-c128.json. The robustness item asked what several local-training lengths do. Doubling the
examples per client from 64 to 128, which repartitions into 51 clients rather than 77 and 34 C++
clients rather than 43:
The permutation test was comparing two different statistics
Correcting the entry above. The project-level permutation read its observed value from the detector run made earlier at eight reference splits and 600 draws, while every relabeling was scored at two splits and 150. The true grouping is one of the 84 arrangements, so under a matched comparison it scores against itself and the p-value cannot fall below 1/84; the mismatch let it score below its own recomputation, and at 128 examples per client the test printed p = 0.000, which an enumeration of 84 arrangements cannot produce. That impossible value is what exposed it.
Two neighbours, checked against the abstracts' own pages
# research(2026-09). Both verified on arxiv.org/abs rather than from recall.
The mask that helps the attacker: a mechanism, not a bug
scripts/masking_mechanism.py, datasets/results/masking-mechanism.json. Closes the open item
"explain the non-monotonicity in noise", which survived the move to the 77-client pool and so was
not the finite-pool artefact I had guessed.
Every leakage number in this study was an average-case metric
# research(2026-09). Carlini et al., "Membership Inference Attacks From First Principles"
(IEEE S&P 2022, arXiv:2112.03570), argue that an AUC averages over the whole ROC curve, including
false-positive rates no attacker would operate at, and that an attack can score well on it while
recovering no member at a usable threshold. Privacy is breached by the confident identifications,
not by the average case. Every RQ2 number in this log was an AUC, so every one of them was open to
that objection.