Federated learning architecture, risks, and defenses

WHAT THIS TESTS This checks whether you understand both the architecture of federated learning and the crucial nuance that not sharing raw data is not the same as full privacy, plus the concrete attacks and defenses.

A GOOD ANSWER COVERS Architecture: a coordinating server holds a global model and distributes it to a selection of participating devices each round. Every device trains the model locally on its own private data, then sends back only the resulting model update or gradients, never the raw data. The server aggregates these updates, commonly via federated averaging, to produce an improved global model, and the cycle repeats. This enhances privacy because sensitive data such as keystrokes or photos stays on the device, reducing central data collection and breach exposure. However, vulnerabilities remain because the updates themselves encode information about the training data. In a model inversion attack, an adversary reconstructs representative or even individual training inputs from gradients or the model. In a membership inference attack, an adversary determines whether a specific record was part of a participant's training data. A malicious server or participant can also attempt these or poison the model. Countermeasures include secure aggregation, where the server can only see the combined update and not any individual device's contribution, differential privacy applied to the updates by clipping and adding calibrated noise so no single example dominates, and homomorphic or encrypted computation for stronger guarantees.

COMMON WRONG ANSWERS Claiming federated learning is fully private because data stays local, ignoring gradient leakage. Forgetting that the server or other clients can be adversarial. Naming attacks without any countermeasure, or vice versa.

LIKELY FOLLOW-UPS How does secure aggregation work cryptographically? How does DP trade accuracy for privacy here? How do you defend against model poisoning?

ONE CONCRETE EXAMPLE A mobile keyboard learns next-word predictions via federated learning: phones train on local typing and upload only noised, clipped gradients. Secure aggregation ensures the server sees only the summed update across thousands of phones, so no individual's update is exposed, and per-update differential privacy limits what a membership-inference attacker could learn about any single user's typed phrases.