Skip to content

Research log

The organization is not in the update. The content and the codebase are.

Qualified within the hour. This entry reads the classification operating point, where organization is indeed not attributable. A targeted detector, which is what an attacker has, does find it: AUC 0.736 for AOSP within C++, beating random relabelings of the same nine projects at p = 0.012. See "The organization is there, at the operating point an attacker actually has".

Masking an update is a delay, not a defence

datasets/results/defence-curve.json, scripts/defence_curve.py. What a federated deployment would actually do against the aggregate attack: each client masks its update with a Gaussian of a given fraction of the mean update norm, drawn afresh every round. The attacker runs FedAttr's statistic, averaging the aggregates of rounds holding the target, subtracting the average of rounds without, and scoring the difference against its reference direction. Rounds of eight, 300 draws, four reference splits, on the sketched updates.

The altitude below ours has already been shown learnable

Dai et al., "MPCoder: Multi-user Personalized Code Generator with Explicit and Implicit Style Representation Learning" (ACL 2024, arXiv:2406.17255), learn per-user coding style: an explicit residual for syntactic conventions, an implicit representation trained with contrastive learning to separate users, and a Coding Style Score over structure, formatting and naming to say whether the generated code resembles the user it was generated for.

A fingerprint measured in a moving medium

Xu et al., "code_transformed: The Influence of Large Language Models on Code" (arXiv:2506.12014, revised 2026-02), measure style across more than 20,000 GitHub repositories linked to arXiv papers from 2020 to 2025 and report conventions shifting toward what models write: snake_case function names in Python rise from 40.7% in Q1 2023 to 49.8% in Q3 2025. They also measure similarity across projects; whether they claim convergence is not something the abstract settles and the full text has not been read.

What RQ2 is about, in the words of the people proposing it

Federated fine-tuning of code models across organizations is not a hypothetical RQ2 invents. Luo et al., "When Fine-Tuning LLMs Meets Data Privacy: An Empirical Study of Federated Learning in LLM-Based Program Repair" (arXiv:2412.01072, in TOSEM), federate program repair over as many as 100 simulated clients with QLoRA and FedAvg, uploading adapter parameters to a central server. Their motivation is stated plainly: federated learning "facilitates private entities to utilize their data collaboratively, while addressing the concern of data privacy by learning a model without exposing the raw data of each client", and "Data privacy is also protected by not exposing local data to each participating client". They name differential privacy and secure aggregation as possible additions and implement neither, and they state no adversarial threat model. The same setting appears for code translation between proprietary entities (arXiv:2501.05724).

Capacity and placement: where the source signal sits agrees with where adapters store things

Tan, Du and Feng, "How Many Bits Can an Adapter Write?" (arXiv:2607.21351, 2026-07-23), measure how much a LoRA adapter can hold: 1.7 to 2.8 bits a trainable parameter against full fine-tuning's 3.6, with memorization varying nearly twofold by placement, MLP against attention, at matched parameter counts. They measure total information stored, not where it came from, and report that membership inference "did not resolve the difference between these adapters".

The privacy LoRA provides by design is the wrong privacy for an organization

Malekmohammadi and Farnadi, "LoRA Provides Differential Privacy by Design via Random Sketching" (arXiv:2409.17538, revised 2026-02-10), prove that low-rank adaptation is equivalent to training with noisy batch gradients, the noise decreasing in the rank, and derive an inherent differential privacy guarantee when the adaptation matrices A are frozen, with the level set by rank and batch size. They offer it as the reason LoRA-tuned models resist privacy attacks.