Privacy Starts Before the First Gradient
TL;DR for operators Federated fine-tuning keeps raw examples on the client, but that does not mean the client begins from a neutral model state. A malicious coordinating server can send an adapter deliberately structured so that private examples produce recoverable traces during training. Privacy risk can therefore enter through what the client downloads, not only through what it later uploads. ...