Banks, Hospitals Tap Federated LoRA to Train GenAI on Siloed Data

Generative AI for Federated Learning: Improving Privacy & Performance With Oregon State University — Ai4

Ai4

Parameter-efficient adapters combined with differential privacy and secure aggregation now allow regulated enterprises to fine-tune foundation models locally without moving proprietary data.

AI-assisted summary of Generative AI for Federated Learning: Improving Privacy & Performance With Oregon State University — original source. Check the original for full context.

Source published:

Detailed notes

## Background Published on YouTube by Ai4 on August 15, 2026, this presentation features Oregon State University researcher Fiona Victoria addressing how federated learning unlocks generative AI for regulated enterprises whose most valuable data cannot leave the building. The talk outlines how federated tooling has matured beyond academic sandboxes into practical enterprise applications through parameter-efficient fine-tuning, architectural compression, and rigorous mathematical privacy guarantees.

## TL;DR Fiona Victoria examines how federated learning solves the data immobility dilemma across heavily regulated domains like healthcare, banking, and manufacturing by training models directly at the edge instead of pooling raw data centrally. Rather than computationally prohibitive scratch pre-training, modern federated generative workflows rely on parameter-efficient fine-tuning such as Low-Rank Adaptation (LoRA), alongside quantization and pruning, to manage device and network constraints. She emphasizes that federated gradients alone do not ensure absolute confidentiality, requiring dual layers of differential privacy and secure aggregation to prevent reconstruction attacks. The talk concludes with an enterprise adoption framework assessing governance, compliance, and sovereignty, exemplified by an end-to-end multi-hospital clinical architecture.

## Atmosphere & style The session carries an engaging, pragmatic, and academically grounded tone, opening with a lighthearted acknowledgment of the post-lunch slump before methodically dispelling common misconceptions around federated privacy. Victoria communicates with structured clarity, using intuitive metaphors like collective life wisdom versus reading someone's personal diary to make complex cryptographic and architectural concepts digestible. Listening feels like an empowering, reality-checked briefing that strips away GenAI hype to deliver a disciplined, enterprise-ready technical roadmap.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=ZALwExaIVBs&t=4s) Regulated industries face a data mobility bottleneck where the most valuable data—such as patient records, financial transactions, and proprietary designs—cannot leave on-premise environments due to compliance, privacy, and competitive concerns. - [03:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=216s) Federated learning inverts traditional centralized machine learning by keeping raw data on local client devices and transmitting only mathematical model parameter updates to a global coordinator. - [06:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=372s) Federated learning has evolved from an academic research concept pioneered by Google in 2016 into a commercially viable enterprise technology with widespread deployments across healthcare, banking, and aerospace. - [12:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=756s) Operating generative AI in federated settings introduces five fundamental challenges: statistical data heterogeneity (Non-IID data), communication constraints, model heterogeneity, device resource disparities, and gradient privacy risks. - [14:33](https://www.youtube.com/watch?v=ZALwExaIVBs&t=873s) The modern federated learning ecosystem is organized around three pillars of advancement: model-wise efficiency, mathematical privacy protocols, and production-grade orchestration tooling. - [18:35](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1115s) Parameter-Efficient Fine-Tuning (PEFT), particularly Low-Rank Adaptation (LoRA), enables clients to train small low-rank adapter matrices while keeping base model weights frozen, dramatically reducing communication overhead across edge devices. - [19:57](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1197s) Architectural optimizations such as structured pruning, low-bit quantization (down to 8-bit or 4-bit), and knowledge distillation are essential to run and fine-tune large generative architectures on hardware-constrained edge nodes. - [21:56](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1316s) Raw federated learning does not guarantee complete privacy on its own; robust protection requires Differential Privacy to shield individual records and Secure Aggregation to prevent eavesdropping on in-flight client updates. - [25:18](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1518s) Mature open-source frameworks like Flower and NVIDIA FLARE, along with benchmark suites like LEAF, provide the telemetry, monitoring, and orchestration required for enterprise-grade FL deployments. - [26:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1572s) The evolution of federated GenAI spans near-term transitions from pilot fine-tuning pipelines to production, and long-term milestones involving cross-competitor data collaboration and multi-agent systems. - [27:42](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1662s) Enterprises must assess five essential pillars before adopting federated learning: regulatory compliance, data sovereignty, liability and governance, team technical complexity, and consent transparency. - [29:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1776s) An end-to-end privacy-preserving architecture combines local foundation models, LoRA fine-tuning, Differential Privacy, Secure Aggregation, and central orchestration to allow distributed organizations to collaborate without sharing raw data.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=ZALwExaIVBs&t=4s) Introduction & The Data Mobility Dilemma in Regulated Industries

Fiona Victoria, a PhD researcher from Oregon State University, opens her talk acknowledging the post-lunch energy slump before inviting the audience on a journey into generative AI for federated learning (FL)—what is fundamentally known as collaborative learning. The central focus of her research is discovering how to significantly improve the privacy of artificial intelligence and machine learning models without sacrificing overall performance, specifically addressing the deep skepticism held by highly regulated industries.

Enterprises in sectors like healthcare, finance, and advanced manufacturing are eager to harness the transformative capabilities of generative AI, but face an insurmountable bottleneck: their most valuable data simply cannot leave the building. A hospital might want to deploy large language models (LLMs) to analyze complex patient charts and transaction records; a financial institution needs real-time dynamic transaction data to power automated fraud detection; and a manufacturing plant wants to apply GenAI to proprietary design plans and trade secrets. In all these cases, moving raw data to a centralized third-party cloud is an absolute non-starter. As Fiona highlights, "sometimes the most valuable data is often the least mobile one."

```mermaid flowchart TD accTitle: Data Immobility Drivers in Regulated Sectors subgraph Drivers["Barriers to Data Centralization"] R["Regulatory Compliance<br/>(HIPAA, GDPR)"] C["Competitive Advantage<br/>(Semiconductor & Trade Secrets)"] T["User & Patient Trust<br/>(Expectation of Local Storage)"] end subgraph Industries["Immobile Data Domains"] H["Healthcare Records"] F["Financial Transactions"] M["Proprietary Manufacturing Plans"] end Drivers --> Industries ```

- **Regulatory Compliance:** Strict legal frameworks like HIPAA protect confidential protected health information (PHI), while GDPR shields EU citizens, legally restricting cross-geographic or even cross-departmental data movement. - **Competitive Value:** Proprietary trade secrets, such as semiconductor wafer and silicon chip designs, lose their market value the moment they leak. - **Customer and Patient Trust:** Users provide sensitive information under the explicit assumption that it will remain strictly on-premise rather than being transferred to third-party servers.

---

[03:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=216s) Centralized Machine Learning vs. Federated Learning

To illustrate the paradigm shift, Fiona contrasts traditional centralized machine learning with federated learning. In a conventional centralized ML setup, disparate edge devices—laptops, smartphones, tablets, or even connected electric scooters—continuously transmit their raw sensor streams and personal information into a central global repository where a monolithic model trains directly on the pooled data. This design creates severe privacy vulnerabilities and regulatory compliance issues for sensitive sectors.

```mermaid flowchart LR accTitle: Centralized ML vs Federated Learning Comparison subgraph Centralized["Centralized ML Paradigm"] direction TB CD1["Edge Clients"] -->|"Upload Raw Data"| CDS[("Central Data Store")] CDS --> CTM["Centralized ML Model Training"] end subgraph Federated["Federated Learning Paradigm"] direction TB FD1["Client A (Local Data)"] -->|"Send Model Updates Only"| FGS["Global Aggregation Server"] FD2["Client B (Local Data)"] -->|"Send Model Updates Only"| FGS FD3["Client C (Local Data)"] -->|"Send Model Updates Only"| FGS FGS -->|"Broadcast Global Weights"| FD1 FGS -->|"Broadcast Global Weights"| FD2 FGS -->|"Broadcast Global Weights"| FD3 end ```

Federated learning inverts this pipeline entirely. The data stays precisely where it was generated, while the machine learning model travels to the edge. Each client device performs local training on its isolated dataset, computing parameter adjustments and gradient updates. Only these mathematical model updates are transmitted back to the global server for aggregation. Data never leaves the client boundary, yet the global model benefits from the collective patterns of all participating nodes.

Borrowing and adapting a quote from Helen Keller—"Alone we can do so little; together we can do so much"—Fiona shares an intuitive metaphor: reading someone's personal diary is an unacceptable breach of privacy, but learning from their collective stories, wisdom, and life experiences without ever opening the pages of their diary is profoundly valuable. Federated learning achieves this exact balance, delivering performance that matches or occasionally surpasses classical centralized machine learning while maintaining strict data boundaries.

---

[06:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=372s) Evolution and Real-World Adoption of Federated Learning

Federated learning was long considered merely an academic research curiosity, confined to university laboratories from its inception in 2016 until viable enterprise deployments emerged. When asking the audience for a show of hands regarding real-world FL experience, only a sparse few respond, prompting Fiona to walk through the practical timeline and industry applications that have matured the ecosystem.

```mermaid flowchart TD accTitle: Evolution and Applications of Federated Learning subgraph Origins["2016 Genesis"] G["Google coins 'Federated Learning'<br/>Next-Word Prediction on Gboard"] end subgraph Implementations["Enterprise Deployments"] Hosp["Healthcare & Biomedicine<br/>FLock.io & UCL for Eye Disease/Diabetes"] Fin["Banking & Finance<br/>JPMorgan, NVIDIA FLARE, Flower Labs"] Mfg["Additive Manufacturing<br/>Defense, Aerospace, & Industrial Sectors"] end subgraph Market["Market Growth"] Val["Current Market: ~$600M<br/>Projected: >10x expansion over next decade"] end Origins --> Implementations --> Market ```

- **Google (2016):** Coined the term "Federated Learning" and introduced the paradigm for mobile edge devices with Gboard's next-word predictive keyboard, personalizing text suggestions locally based on user typing habits. - **Healthcare & Clinical Research:** Companies like FLock.io collaborated with clinical institutions such as University College London (UCL) to train diagnostic models for diabetic retinopathy and eye disease detection without centralizing sensitive medical images. - **Finance & Banking:** Financial powerhouses such as JPMorgan actively partner with open-source frameworks like NVIDIA FLARE and Flower Labs to build privacy-preserving fraud detection systems across distributed transaction databases. - **Industrial & Additive Manufacturing:** Cross-organizational FL is deployed across aerospace, defense, and industrial tooling to refine manufacturing tolerances without exposing proprietary CAD models. - **Market Projections:** The FL market size stands around $600 million and is projected to expand over tenfold across the next decade across biopharma, defense, automotive, and financial sectors.

---

[08:51](https://www.youtube.com/watch?v=ZALwExaIVBs&t=531s) Generative AI Primer: Architectures, Modalities, and Diffusion Models

Before exploring the intersection of GenAI and federated workflows, Fiona outlines a quick 101 on core generative architectures and their primary output modalities. Practitioners can combine these building blocks across various enterprise use cases:

| Architecture Family | Operational Mechanism | Primary Modalities & Use Cases | |:--- |:--- |:--- | | **Transformers** | Autoregressively predicts sequential tokens one at a time | Conversational text chatbots, code synthesis, automated essay writing, document summarization | | **Diffusion Models** | Rooted in non-equilibrium thermodynamics; iteratively de-noises latent Gaussian noise via U-Net structures | Hyper-realistic image generation, high-fidelity video frame synthesis (e.g., Stability AI, Midjourney) | | **Generative Adversarial Networks (GANs)** | Pits a generator against a discriminator network in an adversarial game | Image synthesis, style transfer, video generation | | **Variational Autoencoders (VAEs)** | Maps inputs into probabilistic latent spaces via encoder-decoder structures | Image variations, audio synthesis, speech modeling (e.g., ElevenLabs voice engines) |

Fiona highlights diffusion models due to her own research background. In unconditional diffusion, generation begins with pure Gaussian noise, and a neural network (typically a U-Net) iteratively estimates and removes noise across 1,000 to 4,000 backward steps. However, unconditional models are constrained strictly to the visual distributions of their training data—a model trained purely on butterflies can only output butterflies. To direct the output, conditional diffusion introduces text prompts or auxiliary embeddings to guide the denoising trajectory toward specific target concepts.

---

[12:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=756s) Fusing Generative AI with Federated Learning & Research Challenges

Fusing generative AI with federated learning involves distributing a global generative model out to multiple edge devices, each equipped with its own local compute and storage. Each client conducts local training passes on private data and transmits its parameter updates back to the global server. The central coordinator aggregates these updates, adjusts the global model, and redistributes the refreshed weights in an iterative loop until global convergence is achieved.

```mermaid flowchart TD accTitle: Iterative Federated Generative AI Training Loop subgraph Server["Central Aggregation Server"] GM["Global Generative Model"] AGG["FedAvg / Aggregation Protocol"] end subgraph Clients["Heterogeneous Edge Clients"] direction LR C1["Hospital / Node 1<br/>(Local Compute & Storage)"] C2["Bank / Node 2<br/>(Local Compute & Storage)"] C3["Factory / Node 3<br/>(Local Compute & Storage)"] end GM -->|"1. Broadcast Global Weights"| C1 GM -->|"1. Broadcast Global Weights"| C2 GM -->|"1. Broadcast Global Weights"| C3 C1 -->|"2. Local Training Updates"| AGG C2 -->|"2. Local Training Updates"| AGG C3 -->|"2. Local Training Updates"| AGG AGG -->|"3. Update Global Weights"| GM ```

Despite its elegance, operating generative models in a federated architecture introduces five critical research challenges:

- **Statistical Heterogeneity:** Local datasets across clients vary dramatically in quantity, distribution, quality, and labeling schemas (Non-IID data distributions). - **Communication Constraints:** Edge nodes operate across uneven network bandwidths and latencies, spanning high-speed metropolitan data centers to bandwidth-constrained rural connections. - **Model Heterogeneity:** Varying client capacities may require mixing sparse, lightweight sub-networks with dense neural models across the federation. - **Device Heterogeneity:** Hardware configurations vary widely, with vast disparities in onboard memory, GPU acceleration, and persistent storage capacity. - **Privacy Guarantees:** Transmitting raw model gradients does not automatically provide bulletproof privacy; without additional mathematical protections (such as differential privacy or secure aggregation), gradients can leak sensitive training samples.

---

[14:33](https://www.youtube.com/watch?v=ZALwExaIVBs&t=873s) The Evolution of FL Infrastructure & The Three Verticals

Federated learning infrastructure has undergone a massive transformation since Google introduced the foundational Federated Averaging (`FedAvg`) algorithm and TensorFlow Federated (TFF) in 2016. In the years that followed, Oxford's Flower Labs developed the Flower framework, while NVIDIA introduced NVIDIA FLARE (stemming from healthcare and COVID-19 genomics collaborations). OpenMined launched PySyft for privacy-preserving computations, and Intel contributed OpenFL.

The widespread public release and explosion of LLMs in late 2022 served as a massive inflection point. Frameworks rapidly pivoted from small mobile models to orchestrating distributed fine-tuning, agentic workflows, and robust enterprise observability. Fiona categorizes these modern advancements into three distinct verticals:

```mermaid flowchart LR accTitle: Three Verticals of Modern Federated Learning Advancements subgraph V1["Model-Wise Innovations"] M1["Parameter-Efficient Fine-Tuning"] M2["Lightweight Base Architectures"] end subgraph V2["Privacy Protocols"] P1["Secure Multi-Party Aggregation"] P2["Differential Privacy Guarantees"] end subgraph V3["Production Maturity"] PR1["Training Orchestration"] PR2["Telemetry & Observability"] end ```

- **Model-Wise Advancements:** Parameter-efficient fine-tuning (PEFT) methods and lightweight architectures designed to reduce compute, storage, and communication footprints during distributed training. - **Privacy Advancements:** Cryptographic protocols, secure multi-party computation, and differential privacy layers deployed on top of gradient exchanges to block model inversion or reconstruction attacks. - **Production-Grade Tooling:** Industrial-grade infrastructure capable of orchestrating, tracking, monitoring, and debugging complex federated runs across thousands of production nodes.

---

[16:24](https://www.youtube.com/watch?v=ZALwExaIVBs&t=984s) Parameter-Efficient Federated Fine-Tuning and LoRA

Federated fine-tuning has rapidly superseded full-scale pre-training as the industry-standard training strategy for edge environments. Attempting to train a modern large language model from scratch on resource-constrained edge hardware is computationally infeasible and economically inefficient. Fine-tuning occupies the ideal operational sweet spot situated directly between large-scale foundation pre-training and downstream inference.

```mermaid flowchart TD accTitle: Parameter-Efficient Fine-Tuning PEFT Taxonomy PEFT["PEFT Approaches in Federated Learning"] PEFT --> LORA["LoRA (Low-Rank Adaptation)<br/>• Freezes base weights<br/>• Injects low-rank rank-r matrices"] PEFT --> ADAPT["Adapter Modules<br/>• Injects small adapter layers<br/>• Placed inside transformer blocks"] PEFT --> PREFIX["Prefix Tuning<br/>• Prepends learnable token vectors<br/>• Modifies input sequence space"] ```

Within parameter-efficient fine-tuning (PEFT) for federated environments, three core methodologies are commonly utilized: - **Adapter Modules:** Injects small, trainable dense layers directly inside the frozen intermediate transformer layers of the network. - **Prefix Tuning:** Prepends continuous, trainable task-specific prompt vectors directly to the model's input token embeddings without modifying internal network parameters. - **Low-Rank Adaptation (LoRA):** The predominant and most widely supported technique in modern federated frameworks.

LoRA operates through an elegant three-step mechanism: it freezes the original dense base model weights ($W_0$), decomposes the weight update matrix ($\Delta W$) into low-rank intrinsic rank matrices ($A$ and $B$, where $\Delta W = B \times A$), and trains only these lightweight adapter parameters. This drastically cuts the volume of gradients communicated across the network while delivering accuracy that matches full centralized fine-tuning.

[18:35](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1115s) Parameter-Efficient Fine-Tuning with LoRA in Federated Settings

Rather than updating all the parameters in a standard weight matrix $W$ during fine-tuning, Low-Rank Adaptation (LoRA) keeps the original weights frozen and introduces a separate low-rank decomposition represented as $W + B \times A$. In this setup, $W$ comes directly from a large frozen base model—such as a LLaMA model or a state-of-the-art GPT model—and is never modified. Instead, only the much smaller low-rank matrices $B$ and $A$ receive gradient updates. This small adapter footprint provides sufficient capacity to specialize a foundation model for domain-specific tasks without the compute and memory overhead of full-model fine-tuning.

```mermaid flowchart TD accTitle: Federated LoRA Fine-Tuning Workflow accDescr: Diagram illustrating client devices training local LoRA adapters and sending only low-rank gradient updates to a central global server.

subgraph Clients["Edge Clients / Organizations"] C1["Client 1\nFrozen Base Model + LoRA Adapter"] C2["Client 2\nFrozen Base Model + LoRA Adapter"] C3["Client 3\nFrozen Base Model + LoRA Adapter"] end

subgraph Server["Central Aggregation"] GS["Global Server\nAggregate LoRA Gradients"] end

C1 -- "Adapter Gradients (B x A)" --> GS C2 -- "Adapter Gradients (B x A)" --> GS C3 -- "Adapter Gradients (B x A)" --> GS GS -- "Updated Global Adapter" --> C1 GS -- "Updated Global Adapter" --> C2 GS -- "Updated Global Adapter" --> C3 ```

In a federated learning (FL) environment with multiple clients or edge devices, each participant hosts the shared frozen base model and attaches their own local adapter layers. When local training occurs, only the adapter gradients are communicated back to the global server for aggregation. This drastically reduces the volume of data transmitted over the network while allowing organizations to collaboratively train high-performance specialized models.

- **Base Weights:** Kept completely frozen to preserve general capabilities and prevent catastrophic forgetting. - **Trained Parameters:** Restricted strictly to low-rank matrices ($B \times A$). - **Federated Transmission:** Only low-rank adapter gradients are sent back to the central server, sharply reducing communication overhead across edge devices.

---

[19:57](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1197s) Architectural Innovations: Compression, Quantization, and Distillation

Beyond parameter-efficient adapters, several architectural techniques originally established in machine learning have become essential in federated workflows to manage communication bandwidth, storage constraints, and edge device limits.

Model compression primarily takes the form of pruning and quantization. Pruning can be unstructured—removing individual weights within a matrix to create sparse matrices, which typically requires specialized hardware to run efficiently—or structured, where entire non-contributing neurons or channels are removed to directly cut transmission and storage costs. Quantization reduces the precision of model weights; while models historically relied on 32-bit floating point (FP32), doing so for modern large language models is impractical on resource-constrained devices. Modern FL systems instead quantize weights down to 16-bit, 12-bit, 8-bit, or even 4-bit representations. Additionally, knowledge distillation enables clients to transfer domain-specific knowledge from a massive, pre-trained teacher model into a compact student model that mimics or even outperforms the teacher on specific localized tasks.

- **Unstructured Pruning:** Zeroes out specific weights within matrices, creating sparsity that requires specialized hardware accelerators. - **Structured Pruning:** Removes entire neurons that contribute minimally to accuracy, directly lowering model size and transmission costs. - **Quantization:** Compresses heavy FP32 parameters down to 16-bit, 12-bit, 8-bit, or 4-bit representations. - **Knowledge Distillation:** Compresses capabilities from a large teacher model into a lightweight student model tailored to local domain data.

---

[21:56](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1316s) Enhancing Privacy: Differential Privacy and Secure Aggregation

A common misconception is that federated learning is inherently 100% private simply because raw data never leaves the local device. Without explicit safeguards, gradient updates can still leak information through reconstruction attacks. To provide mathematical privacy guarantees, modern FL architectures deploy defense layers such as Differential Privacy (DP) and Secure Aggregation.

```mermaid flowchart LR accTitle: Dual-Layer Privacy Protection in Federated Learning accDescr: Visual mapping showing the roles of Differential Privacy for individual records and Secure Aggregation for global model updates.

subgraph PrivacyLayers["FL Privacy Defense Mechanisms"] direction TB DP["Differential Privacy (DP)\nProtects individual records\nAdds calibrated noise"] SecAgg["Secure Aggregation (SecAgg)\nProtects aggregated model updates\nUses zero-sum pairwise masks"] end

DP --> |"Guarantees record-level plausible deniability"| LocalData["Local Client Records"] SecAgg --> |"Prevents server/man-in-the-middle sniffing"| GlobalTrans["In-Transit Updates"] ```

Differential Privacy protects individual records—such as a single patient's file (e.g., an extra row for "Alice")—by injecting calibrated random noise into model updates. This prevents an adversary from determining whether a specific record was present in the training set. DP can be implemented as Central DP (if the central server is trusted to add noise) or Local DP (where clients add noise locally before transmitting updates, offering stronger trust guarantees at the cost of a slight reduction in model accuracy).

Secure Aggregation operates on a different threat model: it protects the updates themselves during aggregation. Clients (e.g., Alice, Bob, and Carol) add coordinated pairwise masking values to their updates that are mathematically designed to sum to zero and cancel each other out when combined at the server. This ensures the server sees only the combined aggregate value while remaining blind to individual client contributions.

| Privacy Mechanism | Primary Protection Target | Implementation Mechanism | Trade-offs & Properties | |:--- |:--- |:--- |:--- | | **Central Differential Privacy** | Individual data records | Central server injects noise into combined updates | Requires trusting the central aggregator | | **Local Differential Privacy** | Individual data records | Edge clients inject noise locally before transmission | Zero server trust required; slight loss in overall accuracy | | **Secure Aggregation** | Client update vectors in transit | Pairwise strategic masks that cancel out during summation | Server inspects only the final aggregate; masks hide individual updates |

---

[25:18](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1518s) Production Ecosystem, Benchmarking, and Real-World Deployments

The federated learning ecosystem has evolved beyond academic prototypes into enterprise-grade software stacks. Toolkits such as Flower and NVIDIA FLARE lead the space in orchestration, monitoring, observability, deployable infrastructure, and enterprise support. Standardized benchmarking frameworks—such as LEAF from Carnegie Mellon University (CMU), FedML, and Flower—allow engineers and researchers to evaluate model performance and convergence under realistic non-IID conditions.

Real-world production deployments are already active across sensitive domains: - **Healthcare & Life Sciences:** Genomics England and the National Institutes of Health (NIH) leverage FL to train models across distributed patient cohorts without centralizing clinical records. - **Finance & Tech:** Financial institutions such as JPMorgan Chase and technology leaders like Google utilize FL for privacy-preserving collaborative intelligence and on-device machine learning.

---

[26:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1572s) The Future of Federated Generative AI: Short-Term vs. Long-Term Horizons

The trajectory of federated learning combined with generative AI can be divided into immediate milestones and longer-term structural shifts.

```mermaid flowchart TD accTitle: Short-Term vs Long-Term Evolution of Federated Generative AI accDescr: Timeline comparing immediate near-term FL milestones with future long-term expansions.

subgraph NearTerm["Short-Term Horizons"] ST1["Federated Fine-Tuning as the Standard (No Full Pre-training)"] ST2["Pilot-to-Production Transitions"] ST3["Agentic Federated Learning Mainstream Adoption"] end

subgraph LongTerm["Long-Term Horizons"] LT1["Cross-Competitor Collaborative Data Pooling"] LT2["Multi-Agent FL Ecosystems"] LT3["Expansion into New Domains (e.g., Oceanography, Environment)"] end

NearTerm --> LongTerm ```

In the short term, federated fine-tuning will replace centralized pre-training from scratch as the dominant paradigm for large language models, while agentic FL transitions from academic research into production deployments. In the long term, scaling will expand beyond single organizations to cross-silo collaborations between competing enterprises that benefit from shared data intelligence. Furthermore, FL will expand into non-traditional domains such as oceanography and environmental sciences as domain experts learn to balance privacy guarantees with system performance.

---

[27:42](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1662s) Adoption Framework for Regulated Industries

Before adopting federated learning, organizations in heavily regulated sectors must evaluate five critical pillars:

1. **Regulatory Compliance and Documentation:** *"Is it even legal?"* Ensuring the FL pipeline satisfies existing legal frameworks, documentation mandates, and audit requirements. 2. **Data Sovereignty:** *"Where can the data legally live?"* Confirming that local data boundaries and jurisdictional restrictions are strictly preserved. 3. **Liability and Governance:** *"If something ever goes wrong... who is responsible and who's going to bear the cost of it?"* Establishing clear operational accountability and risk allocation across participating clients and coordinating entities. 4. **Technical Complexity:** Evaluating whether internal teams have the engineering depth to build, operate, and maintain production FL pipelines over time. While basic simulation environments can be spun up in as little as 30 minutes using modern frameworks, managing real-world heterogeneity and production maintenance requires dedicated technical capability. 5. **Consent and Transparency:** Ensuring that data subjects are fully informed and explicitly consent to their data contributing to federated updates.

---

[29:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1776s) Putting It All Together: End-to-End Secure Healthcare Architecture

To illustrate an end-to-end implementation, consider a consortium of three distinct hospital systems collaborating on a clinical foundation model without sharing confidential patient data:

```mermaid flowchart TD accTitle: End-to-End Privacy-Preserving Healthcare FL Architecture accDescr: Complete end-to-end architecture showing local foundation models with LoRA adapters, local DP, secure aggregation, and final orchestration.

subgraph Hospitals["Distributed Hospital Network"] H1["Hospital A\nLocal Patient Data\n+ Frozen Base Model\n+ LoRA Adapter"] H2["Hospital B\nLocal Patient Data\n+ Frozen Base Model\n+ LoRA Adapter"] H3["Hospital C\nLocal Patient Data\n+ Frozen Base Model\n+ LoRA Adapter"] end

subgraph PrivacyEngine["Privacy & Aggregation Pipeline"] DP_Layer["Differential Privacy Layer\n(Record-level protection)"] SecAgg_Layer["Secure Aggregation Layer\n(Pairwise zero-sum masks)"] end

subgraph CentralPlatform["Cloud Orchestration"] Server["Global Server Aggregation\n& Continuous Monitoring"] end

H1 --> DP_Layer H2 --> DP_Layer H3 --> DP_Layer DP_Layer --> SecAgg_Layer SecAgg_Layer --> Server Server -. "Distribute Updated Global LoRA Adapter".-> Hospitals ```

Each hospital maintains its private patient data locally behind internal firewalls. Foundation models are equipped with local LoRA adapter matrices to train exclusively on domain-specific records. To guarantee record-level protection, Differential Privacy adds noise to the parameter updates, while Secure Aggregation masks the in-flight weights across hospitals before transmission. The central cloud server aggregates the masked updates without ever inspecting individual client updates, while human operators provide continuous orchestration and monitoring across the entire lifecycle.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=ZALwExaIVBs&t=4s) sometimes the most valuable data is often the least mobile one. — Fiona Victoria

> [03:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=216s) Alone we can do so little; together we can do so much — Helen Keller

> [27:42](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1662s) Is it even legal? — Fiona Victoria

> [27:42](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1662s) Where can the data legally live? — Fiona Victoria

> [27:42](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1662s) If something ever goes wrong... who is responsible and who's going to bear the cost of it? — Fiona Victoria

## Mentioned Fiona Victoria, Oregon State University, Google, Gboard, FLock.io, University College London (UCL), JPMorgan Chase, NVIDIA FLARE, Flower Labs, Stability AI, Midjourney, ElevenLabs, OpenMined, PySyft, Intel OpenFL, TensorFlow Federated (TFF), LLaMA, Genomics England, National Institutes of Health (NIH), Carnegie Mellon University (CMU), FedML, LEAF

## Video description Fiona Victoria - Researcher, Oregon State University

Enterprises want what generative AI can offer, but often their most valuable data can't leave the building, whether it be patient records in healthcare, transactions in finance, or proprietary design plans in manufacturing. That friction is what pulled me into federated learning. In this talk, I'll show how FL solves that problem and how the tools have matured well past the sandbox stage. I'll walk through recent advancements that have made FL more practical, including federated fine-tuning, efficient architectures, and stronger privacy guarantees, and cover what regulated industries should weigh before adopting FL. This talk will help you see why FL is no longer just a research curiosity for privacy-sensitive AI.

[Source](https://www.youtube.com/watch?v=ZALwExaIVBs)

中文简报

银行与医院利用联邦LoRA在孤岛数据上训练生成式AI 参数高效适配器结合差分隐私与安全聚合,使受监管企业无需移动专有数据即可在本地微调基础模型。 Fiona Victoria探讨了联邦学习如何通过直接在边缘端训练模型而非集中汇聚原始数据,解决医疗、银行和制造业等强监管领域的数据无法流动的困境。现代联邦生成式工作流摒弃了计算成本过高的从头预训练,转而依赖低秩适应(LoRA)等参数高效微调技术,并结合量化与剪枝来应对设备与网络限制。她强调,仅靠联邦梯度无法确保绝对的机密性,必须借助差分隐私和安全聚合的双重保护来防御重构攻击。最后,讲座提出了一个评估治理、合规性和数据主权的企业落地框架,并以端到端的多医院临床架构进行了实例说明。 受监管行业面临数据流动性瓶颈,出于合规、隐私及竞争考量,最有价值的数据(如病历、金融交易和专有设计)无法离开本地环境。 (0:04) 联邦学习颠覆了传统的集中式机器学习,将原始数据保留在本地客户端设备上,仅向全局协调器传输数学模型参数更新。 (3:36) 联邦学习已从Google于2016年开创的学术研究概念,演进为一项具有商业可行性的企业级技术,并在医疗、银行和航空航天等领域得到广泛部署。 (6:12) 在联邦环境中运行生成式AI面临五大核心挑战:统计数据异构性(Non-IID数据)、通信限制、模型异构性、设备资源差异以及梯度隐私风险。 (12:36) 现代联邦学习生态系统围绕三大支柱构建:模型层面效率、数学隐私协议以及生产级编排工具。 (14:33)

Reading summary

Fiona Victoria, a researcher at Oregon State University, argues that federated learning allows regulated enterprises to deploy generative AI without centralizing proprietary or confidential records. By combining distributed edge computation with parameter-efficient fine-tuning and layered cryptographic defenses, organizations can preserve strict privacy boundaries without sacrificing model performance. Data Immobility and the Federated Learning Paradigm (0:04) Enterprises in healthcare, finance, and advanced manufacturing face a persistent operational bottleneck: their most valuable data cannot leave on-premise infrastructure due to regulatory mandates like HIPAA and GDPR, trade secret protections, and user trust expectations. Traditional centralized machine learning requires pooling raw sensor data or records into a single server, creating substantial security and regulatory exposures. Federated learning inverts this structure by keeping raw data on edge clients and moving the model to the data, transmitting only mathematical parameter updates back to a central coordinator. Parameter-Efficient Fine-Tuning and Model Compression (16:24) Because pre-training foundational generative models on edge hardware is computationally infeasible, federated fine-tuning has become the practical industry standard. Low-Rank Adaptation (LoRA) operates as the primary parameter-efficient method, freezing the underlying foundation weights to avoid catastrophic forgetting while introducing small, trainable low-rank decomposition matrices (B x A). Edge nodes train and transmit only these lightweight adapter updates, drastically lowering network transmission volumes while achieving accuracy comparable to full centralized fine-tuning. To accommodate severe device, memory, and bandwidth heterogeneity across distributed participants, practitioners augment LoRA with compression techniques. These include structured and unstructured pruning to eliminate redundant parameters, weight quantization reducing heavy 32-bit floating-point weights down to 16, 12, 8, or 4 bits, and knowledge distillation to transfer specialized capabilities from massive teacher models into compact edge student models. Dual Privacy Defenses via DP and Secure Aggregation (21:56) Victoria emphasizes that federated learning is not inherently secure on its own, as raw gradient updates can expose sensitive training samples through reconstruction attacks. Production architectures address this vulnerability by layering Differential Privacy (DP) and Secure Aggregation over the training loop. Differential Privacy protects individual records by adding calibrated mathematical noise, implemented either centrally at the server or locally at the client to remove the need for server trust at the expense of slight accuracy reductions. Secure Aggregation addresses in-transit interception by applying strategic pairwise masks to client updates that sum to zero upon aggregation. This mechanism guarantees that the central coordinator inspects only the combined aggregate updates while remaining blind to individual contributions, blocking server-side inspection and man-in-the-middle sniffing. Production Ecosystems and Governance Requirements (27:42) Federated infrastructure has evolved from research experiments into enterprise software frameworks such as Flower and NVIDIA FLARE, with active deployments across organizations like JPMorgan Chase, Genomics England, and the National Institutes of Health. In practical multi-institutional architectures, such as hospital consortia training clinical models, local nodes train LoRA adapters behind firewalls and pass updates through Differential Privacy and Secure Aggregation layers before global aggregation. Victoria outlines five mandatory governance pillars organizations must evaluate before deployment: regulatory compliance, territorial data sovereignty, liability allocation for operational failures, consent transparency for participating users, and technical complexity. While basic federated simulations can be configured rapidly, maintaining robust production pipelines across heterogeneous edge environments demands dedicated engineering resources. Victoria projects that near-term adoption will focus on federated fine-tuning and agentic systems, eventually expanding toward cross-competitor data collaboration and environmental sciences. However, long-term enterprise scalability remains contingent on resolving operational liability and managing persistent system and data heterogeneity across edge networks.

精炼阅读摘要

俄勒冈州立大学博士研究员 Fiona Victoria 指出,受监管行业面临核心数据无法汇聚的瓶颈,而将生成式人工智能与联邦学习相结合,并辅以参数高效微调与密码学隐私防御,能够在不移动原始敏感数据的前提下实现模型的高性能协作训练。 高价值数据受限与联邦学习范式转换 (0:04) 医疗、金融和高端制造等行业迫切需要大语言模型等生成式 AI 技术,但受制于 HIPAA 和 GDPR 等合规监管、半导体芯片等商业机密保护以及用户信任,其高价值数据严禁上传至第三方中心化云端。传统机器学习依赖将各类边缘设备的数据统一汇集到中心服务器,造成严重的合规与安全漏洞。联邦学习则颠覆了这一路径,将“数据汇聚”转变为“模型下发至边缘”,原始数据保留在本地,设备仅上传数学模型参数调整与梯度更新至中央协调器进行聚合,在守护数据边界的同时利用多方模式提升全局表现。 异构生成式模型的挑战与高效微调方案 (12:36) 将 Transformer、扩散模型等生成式架构引入联邦训练时,系统必须应对五大核心挑战:客户端之间非独立同分布(Non-IID)的统计异质性、参差不齐的网络带宽与延迟、轻量与稠密网络混合的模型异质性、边缘硬件算力与内存的设备异质性,以及单纯传输梯度的隐私泄露隐患。由于在边缘节点从零预训练大模型在算力和经济上均不可行,行业已全面转向参数高效微调(PEFT)。其中,低秩适应(LoRA)通过冻结基础模型权重,仅对分解出的低秩矩阵进行训练与跨网络传输,大幅压缩了边缘通信负荷,同时实现了媲美集中式微调的精度;此外,剪枝、权重从 FP32 量化至低比特位(如 16-bit、8-bit 或 4-bit)以及知识蒸馏,也进一步缓解了设备存储与计算瓶颈。 差分隐私与安全聚合的双重数学防御 (21:56) Victoria 强调,联邦学习并非只要原始数据不离开本地就绝对安全,未受保护的梯度更新仍然容易遭受模型重构攻击。现代联邦学习架构因此建立了双层防御机制:差分隐私(DP)针对单条记录层级,通过在更新中注入经过校准的随机噪声,提供即使面对对抗分析也能掩盖特定数据记录是否参与训练的数学证明;安全聚合(SecAgg)则针对传输中的更新向量,借助参与节点之间相互抵消的成对零和掩码,确保中央聚合服务器只能解算并读取全局汇总结果,而完全无法窥探任何单个机构的贡献内容。 基础设施演进、生态落地与行业落地框架 (25:18) 自 2016 年 Google 提出 FedAvg 以来,联邦学习基础设施已演进为以 Flower 和 NVIDIA FLARE 等为代表的企业级工具链,支持编排、可观测性与生产部署,并依托 CMU LEAF 与 FedML 等基准评估非独立同分布条件下的收敛性。该技术已落地于英国基因组学机构(Genomics England)与美国国立卫生研究院(NIH)的临床科研、摩根大通的分布式反欺诈以及增材制造等场景;市场规模目前约为 6 亿美元,预计未来十年将实现十倍以上的增长。受监管行业在采纳该方案时,必须系统化评估法律合规性与审计凭证、数据主权与司法辖区限制、跨实体责任界定与治理架构、生产级技术工程运维复杂度,以及数据主体的透明知情同意机制。 结合 LoRA、差分隐私与安全聚合的联邦生成式 AI 正在由单机构试点走向跨企业协作及智能体系统,但实现长期普及仍依赖于妥善解决异构环境下的工程治理壁垒,并在降低计算与通信复杂度的同时平衡隐私保证与模型表现。

Detailed notes — zh

## Background 本内容由 YouTube 频道 Ai4 于 2026 年 8 月 15 日发布,主讲人为来自俄勒冈州立大学(Oregon State University)的研究员 Fiona Victoria。视频简介指出,企业渴望利用生成式 AI,但医疗病历、金融交易和专有设计图纸等高价值数据往往无法离开本地;本场演讲旨在展示联邦学习(FL)如何走出实验室沙盒阶段,通过联邦微调、高效架构与强隐私保障解决这一痛点,并指导受监管行业如何科学评估和引入该技术。 ## TL;DR 演讲系统性地探讨了生成式 AI 与联邦学习(FL)的深度融合路径,着重破解高监管行业在数据合规与隐私保护下的协作痛点。Fiona 详细剖析了当前联邦微调(如 LoRA)、模型量化剪枝与知识蒸馏等前沿技术,并结合差分隐私(DP)和安全聚合(SecAgg)阐明了超越“数据不出本地”的多层级安全防线。最后,她梳理了从 Flower、NVIDIA FLARE 等工业级编排工具到多智能体联邦学习的演进路线,并为医疗、金融等行业落地提出了涵盖法规、主权与治理的五大决策权衡支柱。 ## Atmosphere & style 整场演讲呈现出严谨扎实且极具亲和力的工业学术风,Fiona 开场以轻松幽默的破冰互动拉近距离,随后迅速切入高监管行业的真实痛点。叙事节奏层层递进、逻辑清晰,既有对底层数学机制与技术架构的细致拆解,也有对企业落地与合规风险的冷静审视。聆听体验如同参与一堂兼具前瞻视野与工程落地指导的高阶研讨课,既打消了对隐私安全的盲目乐观,又展现了分布式协作智能的广阔蓝图。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=ZALwExaIVBs&t=4s) 受监管行业(如医疗、金融、制造)面临“最有价值的数据往往流动性最差”的困境,合规限制、商业机密和用户信任使得核心敏感数据无法上传云端集中训练。 - [03:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=216s) 联邦学习颠覆了传统集中式机器学习范式,实现“数据不动模型动”,客户端仅向全局服务器回传模型梯度或更新,在保护原始数据隐私的同时兼顾模型性能。 - [06:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=372s) 联邦学习已从早期的学术探索与输入法预测应用走向成熟的工业落地,在多中心临床眼疾检测、金融反欺诈和增材制造等高壁垒场景全面开花。 - [08:51](https://www.youtube.com/watch?v=ZALwExaIVBs&t=531s) 生成式 AI 的 Transformer、扩散模型等核心架构虽能赋能多模态任务,但在集中式训练下面临严重隐私暴露,必须与分布式联邦机制深度融合。 - [12:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=756s) 生成式联邦学习面临数据统计异构(Non-IID)、通信延迟不均、模型结构差异及边缘硬件算力受限等多重严峻的研究与工程挑战。 - [14:33](https://www.youtube.com/watch?v=ZALwExaIVBs&t=873s) 联邦学习生态已在模型高效微调、进阶隐私防御协议以及生产级编排与可观测性(如 Flower 与 NVIDIA FLARE)三大维度取得关键突破。 - [16:24](https://www.youtube.com/watch?v=ZALwExaIVBs&t=984s) 联邦微调(特别是 LoRA 低秩自适应)已成为边缘设备训练的新标准,通过冻结大型基座模型并仅训练和同步轻量级低秩矩阵,大幅削减通信与算力开销。 - [19:57](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1197s) 结构化剪枝、低比特量化与知识蒸馏等架构优化能有效适配边缘硬件,但“原始数据不出域”并不等于绝对安全,仍需警惕梯度反演等潜在攻击。 - [22:08](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1328s) 差分隐私(DP)通过添加扰动噪声防止推断单条样本隐私,安全聚合(SecAgg)通过成对掩码相互抵消保护全局更新,二者构筑起纵深防御体系。 - [26:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1572s) 生成式联邦学习短期内将以参数高效微调与多智能体(Agentic FL)协同为重心,长期愿景则在于实现跨组织、甚至竞品企业间的安全聚合与生态共享。 - [27:42](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1662s) 受监管行业在引入联邦学习前必须审慎评估五大核心问题:法律合规性、数据主权归属、权责与治理机制、技术运维复杂度以及用户知情透明度。 - [29:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1776s) 现代生成式联邦学习通过“端侧基座+LoRA微调+差分隐私+安全聚合+全链路编排”的闭环范式,真正实现了数据主权合规与大模型效能的兼得。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=ZALwExaIVBs&t=4s) 联邦学习的引言与高监管行业的痛点 来自俄勒冈州立大学(Oregon State University)的博士研究员 Fiona Victoria 开场幽默地体谅听众,坦言在“刚吃过午饭后的艰难时刻”保持专注确实不容易,并邀请大家在接下来的三十分钟里一同探索生成式 AI(Generative AI)与联邦学习(Federated Learning, FL)——即协作学习(Collaborative Learning)——的交汇领域。她的核心目标是展示如何在不牺牲模型性能的前提下大幅增强隐私保障,同时为那些对新兴技术持审慎态度的高监管行业提供切实的考量依据。 为了说明现实中的严峻挑战,Fiona 列举了三个典型的行业场景:希望利用大语言模型(LLM)更深入理解患者病历与图表的医院、需要针对动态实时交易构建精准欺诈检测系统的银行与金融机构,以及渴望将 GenAI 应用于专有设计图纸与商业机密的先进制造工厂。这些机构的共同痛点在于:它们绝不可能将最敏感的核心数据上传至中心化服务器或第三方云端进行集中存储和共享。这就引出了一个贯穿始终的行业定律:"最有价值的数据往往是最缺乏流动性的"(sometimes the most valuable data is often the least mobile one)。 数据无法离开本地的原因主要源于三大支柱限制: - **法律法规监管**:医疗领域的 HIPAA 法案严格保护患者健康隐私信息;欧盟的 GDPR 严禁敏感数据随意跨境甚至跨部门流动。 - **核心商业竞争力**:以半导体行业为例,晶圆与芯片设计的研发节奏极快,哪怕泄露一丁点设计机密,都可能让企业的市场估值瞬间归零。 - **用户信任基石**:无论是患者还是普通消费者,当向机构交付数据时,普遍默认数据会被妥善留存在本地,绝非被转卖或转移到未知的第三方节点。 --- ### [03:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=216s) 传统集中式机器学习 vs. 联邦学习架构 传统集中式机器学习模式下,笔记本电脑、手机、平板乃至电动滑板车等边缘设备,都会将各自采集的传感器信息与私密数据汇聚到一个中心化的全局数据池中,再在此基础上训练模型。这种将原始数据全盘托出的做法对于受监管行业而言构成了巨大的合规与安全隐患。 联邦学习则彻底颠覆了这一范式。在 FL 框架下,“数据严格留在其诞生的原始设备中”。无论终端是移动设备还是行业内部服务器,模型训练均在本地完成,各客户端向全局服务器回传的仅仅是模型更新(如权重或梯度参数)。中心服务器聚合各方参数后更新全局模型,既没有触碰原始数据,又完整汲取了海量终端的知识。 Fiona 借用了海伦·凯勒(Helen Keller)的名言并做出了精妙的比喻:"单打独斗,我们能做的很少;携手合作,我们能做的很多"(alone we can do so little, together we can do so much)。她形象地解释道,这就像面对他人的私人日记——我们绝不该去翻看别人的日记本,但我们依然渴望汲取对方经历的故事与人生洞见;联邦学习正是这样一种“不翻日记本却能学到全部经验”的技术架构,它既保护了隐私,又能实现媲美甚至超越传统集中式训练的性能。 ```mermaid flowchart TD accTitle: 集中式机器学习与联邦学习对比架构图 subgraph Centralized["传统集中式 ML"] direction TB C_Client1["终端设备 A<br/>(手机/电脑)"] -->|"上传原始数据"| C_Cloud[("中心化云端数据池")] C_Client2["终端设备 B<br/>(工业/医疗设备)"] -->|"上传原始数据"| C_Cloud C_Cloud --> C_Train["中心化全局模型训练"] end subgraph FL["联邦学习(FL)模式"] direction TB F_Server["全局聚合服务器<br/>(分发与聚合模型)"] F_Client1["本地客户端 A<br/>(数据不出本地)"] F_Client2["本地客户端 B<br/>(数据不出本地)"] F_Server -->|"下发全局模型"| F_Client1 F_Server -->|"下发全局模型"| F_Client2 F_Client1 -->|"仅上传模型更新/梯度"| F_Server F_Client2 -->|"仅上传模型更新/梯度"| F_Server end ``` --- ### [06:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=372s) 联邦学习的发展历程与行业落地现状 现场互动中,当 Fiona 询问有多少人真正做过 FL 仿真或实际部署时,举手者寥寥无几,引得现场一阵轻笑。这印证了她的观点:联邦学习自 2016 年诞生以来的很长一段时间里,主要作为学术研究的课题停留在实验室中,直到近几年才全面走向工业落地。 2016 年 Google 首次提出并命名了“联邦学习”(Federated Learning),其最初的应用场景正是大众熟知的 Gboard 移动端键盘输入法中的“下一词预测”(next-word prediction)。系统通过在用户本地设备上学习打字习惯,为每个人提供高度个性化的联想推荐,而无需将用户的每一次击键记录上传回 Google 服务器。 如今,联邦学习已经在多个高壁垒行业落地生根: - **医疗健康**:初创企业 FLock.io 与多家眼科专科医院及伦敦大学学院(UCL)合作,在不集中存储多中心临床数据的前提下,联合训练糖尿病管理与眼疾检测模型。 - **金融风控**:摩根大通(JPMorgan)正积极携手 NVIDIA FLARE 及联邦学习实验室,利用分布式交易数据联合优化反欺诈检测系统。 - **先进制造**:在增材制造(3D 打印)领域,FL 已跨界应用于国防、航空航天和大型工业制造,保护高精尖工艺参数与结构设计。 - **市场规模与前景**:当前联邦学习市场规模约为 6 亿美元,预计在未来十年内将实现超过 10 倍的爆发式增长。 --- ### [08:51](https://www.youtube.com/watch?v=ZALwExaIVBs&t=531s) 生成式 AI 核心架构与多模态应用概览 在深入探讨生成式 AI 如何与联邦学习结合之前,Fiona 先对 GenAI 的四大底层核心架构及其多模态输出能力进行了系统性梳理。不同的技术底座对应了截然不同的数据生成逻辑,理解这些模式是为具体工业场景设计联邦训练方案的前提。 - **Transformer 模型**:当代各类 GPT 模型的支柱,基于自注意力机制,通过逐个预测下一个 Token(词元)来生成高质量文本与逻辑结构。 - **扩散模型(Diffusion Models)**:灵感源自物理学中的非平衡热力学原理。模型通常借助 U-Net 结构,预测图像中混入的噪声,并通过逐步去噪的反向扩散过程,从纯噪声中生成多样化的高质量图像。 - **生成对抗网络(GANs)**:由生成器与判别器两个神经网络相互博弈对抗,在博弈平衡中生成高度逼真的图像、视频或文本。 - **变分自编码器(VAEs)**:传统自编码器(编码器-解码器)的概率延伸架构,能够在连续的潜在空间中采样,从而生成具有丰富变体特征的多媒体内容。 | 输出模态 | 适用核心架构 | 典型工业应用场景 | |:--- |:--- |:--- | | **文本(Text)** | Transformers | 智能对话 Bot、代码审查、自动编写代码、长文摘要提取 | | **图像与视频(Image / Video)** | Diffusion Models, GANs, VAEs | 超写实图像生成、大画幅逼真视频帧合成、设计草图渲染 | | **音频与语音(Audio / Speech)** | Transformers, VAEs, Diffusion | 拟人化语音合成(如 ElevenLabs)、智能音效制作、背景音乐生成 | Fiona 随后指出,鉴于她个人的核心研究方向深耕于扩散模型领域,接下来将重点展开探讨扩散模型的技术细节及其在分布式隐私保护中的融合应用。 ### [11:15](https://www.youtube.com/watch?v=ZALwExaIVBs&t=675s) 生成式 AI 基础:无条件与条件生成的隐私困境 生成式图像模型的运作逻辑主要分为两大流派:无条件生成(Unconditional Generation)与条件生成(Conditional Generation)。在无条件生成的设定中,算法从一张纯高斯噪声图像开始,通过神经网络(通常是 U-Net 架构)在多轮迭代中逐步去噪——这一过程通常需要经历 1,000 到 4,000 个步数,最终还原出具有多样性的图像。然而,这种方式存在一个显著弊端,即模型只能生成与其训练集分布高度一致的内容。如果训练数据集中只有成千上万张蝴蝶照片,模型就只能生成类似蝴蝶的图像,因为它从未见过任何其他物种的数据分布。 为了打破这种局限,条件生成技术应运而生。它引入了文本提示词(Prompt)等引导信号,主动约束并指导模型的生成方向,从而创造出用户预期的特定内容。这项技术构成了当今 Stability AI、Midjourney 等生成式 AI 应用的底层核心。但在传统的集中式机器学习模式下,即便能够生成丰富多彩的内容,用户和企业的数据始终处于未受保护的暴露状态,没有任何真正的隐私可言。 - **无条件生成机制**:以高斯噪声为输入,利用 U-Net 进行 1,000 至 4,000 步的反向去噪迭代,其生成范围严格受限于原始训练数据分布。 - **条件生成机制**:通过外部条件(如 Prompt 提示词)主动引导扩散过程,赋能当下的主流商业生成式模型。 - **集中式训练瓶颈**:在中心化服务器聚合海量数据进行训练,必然导致敏感数据失去隐私保护。 --- ### [12:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=756s) 生成式 AI 与联邦学习融合及其核心研究挑战 将联邦学习(FL)与生成式 AI 模型相结合,能够完美解决数据无法出域的痛点。其协同运作流程十分清晰:中央服务器将全局模型分发给各个客户端或本地边缘设备;各个边缘设备利用自身的算力与存储资源,在本地私有数据上执行训练;训练完成后,客户端仅将模型权重或梯度更新上传回全局服务器进行聚合;这一循环往复进行,直至全局模型完全收敛并掌握所有客户端的数据模式,最终产出可用于生产部署的高性能模型。 ```mermaid flowchart TD accTitle: 联邦学习生成式模型训练流程 subgraph Server["中央全局服务器"] GM["全局模型 (Global Model)"] AGG["权重聚合 (Aggregation)"] end subgraph Clients["本地边缘客户端"] C1["客户端 A (本地训练)"] C2["客户端 B (本地训练)"] C3["客户端 C (本地训练)"] end GM -->|"分发模型"| C1 GM -->|"分发模型"| C2 GM -->|"分发模型"| C3 C1 -->|"上传梯度/权重"| AGG C2 -->|"上传梯度/权重"| AGG C3 -->|"上传梯度/权重"| AGG AGG -->|"更新模型并判定收敛"| GM ``` 尽管融合架构前景广阔,但在实际落地中仍面临多维度的严峻研究挑战: - **统计异构性(Statistical Heterogeneity)**:不同客户端之间的数据规模、数据质量以及标签分布存在巨大差异(非独立同分布 Non-IID)。 - **通信异构性(Communication Heterogeneity)**:边缘设备的网络带宽与延迟参差不齐,有的设备部署在网络受限的偏远农村,有的则位于基础设施完善的近郊。 - **模型异构性(Model Heterogeneity)**:参与协同的本地模型可能既有小型稀疏网络,也有大型深层密集神经网络,导致协同难度陡增。 - **设备异构性(Device Heterogeneity)**:各类硬件的计算能力与存储空间差距悬殊,部分设备计算性能强大,而部分设备算力极度受限。 - **隐私保证(Privacy Guarantees)**:必须清醒认识到,"仅仅采用联邦学习,并不意味着数据就绝对安全",必须在联邦学习之上叠加更深层次的隐私防护机制。 --- ### [14:33](https://www.youtube.com/watch?v=ZALwExaIVBs&t=873s) 联邦学习基础设施的演进历程与三大变革维度 回顾联邦学习的基础设施演进,自 2016 年 Google 正式提出联邦学习概念并发布经典的 FedAvg(联邦平均)聚合算法以来,该领域经历了爆发式的发展。Google 随后推出了首个开源框架 TensorFlow Federated(TFF)。紧接着,源自牛津大学研究实验室的 Flower Labs(Flower 框架)以及在基因组学和 COVID-19 分析项目中诞生的 NVIDIA FLARE 相继问世。随后,OpenMined 推出了 PySyft,Intel 推出了 OpenFL,联邦学习开始在以 NVIDIA FLARE 为代表的推动下进入真实工业场景的试水部署阶段。 2022 年底大语言模型(LLM)的公开发布成为了关键的分水岭。自此之后,Flower 和 NVIDIA FLARE 迅速跟进,全面支持 LoRA 微调以及智能体联邦微调(Agentic FL Fine-Tuning),工业级企业部署框架也走向高度成熟。总结近几年的演进,整个生态在三个维度上取得了实质性突破: - **模型层面的变革(Model-wise)**:涌现出更加高效的参数微调方法以及专门针对边缘适配的模型架构设计。 - **隐私层面的变革(Privacy-wise)**:建立了更严密的安全协议与防御机制,全方位保护联邦模型免受反向推理攻击。 - **生产层面的变革(Production-wise)**:框架成熟度大幅提升,能够稳定支持大规模联邦训练的编排调度(Orchestrating)、实时监控(Monitoring)与可观测性(Observability)。 --- ### [16:24](https://www.youtube.com/watch?v=ZALwExaIVBs&t=984s) 联邦微调技术:LoRA、Adapter 与 Prefix Tuning 在模型层面的突破中,联邦微调(Federated Fine-Tuning)已成为边缘设备训练的绝对标准。"现在已经没有人会想在边缘设备上从头开始训练一个大语言模型了,鉴于边缘受限的算力和存储,这根本毫无意义。"微调技术精准契合在预训练与模型推理之间,既能让模型在特定领域达到甚至超越集中式训练的性能,又具备计算高效、存储友好和通信开销低的天然优势。 在联邦学习环境下,参数高效微调(PEFT)主要有三种实现路径: | 微调方法 | 核心机制 | 介入位置 | |:--- |:--- |:--- | | **LoRA (低秩自适应)** | 冻结预训练基础模型,引入外置低秩分解矩阵并仅对其进行更新 | 权重旁路矩阵 ($B \times A$) | | **Adapter Modules (适配器模块)** | 在现有 Transformer 结构块内部插入小型可训练适配层 | 模型网络层内部 | | **Prefix Tuning (前缀微调)** | 在输入端添加连续的可训练特定任务虚拟 Token 向量 | 模型输入层(不改动模型本身) | 其中 LoRA 已成为绝大多数联邦学习框架的首选方案。LoRA 的核心数学原理在于:假定预训练权重为 $W$,微调过程不直接修改 $W$,而是构造更新项 $W + B \times A$(其中 $B \times A$ 为低秩矩阵)。在微调期间,基础权重 $W$ 完全冻结,梯度反向传播仅计算并更新极小参数量的 $B \times A$ 矩阵。 在联邦学习中应用 LoRA 时,各个客户端设备均加载同一个大型冻结基座模型(如 LLaMA 或主流开源 GPT 架构),仅在本地针对私有业务数据训练极小规模的低秩适配层。训练结束时,边缘节点只需将低秩矩阵的梯度更新上传至全局服务器进行聚合。这不仅极大地缩减了网络通信量,还使基座模型能够快速适配特定垂直领域的复杂任务。 --- ### [19:57](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1197s) 模型架构优化与隐私局限性认知 除了微调技术,模型架构层面的经典优化方案在联邦学习中也得到了深度应用,主要涵盖模型压缩与知识蒸馏两大方向。模型压缩主要包含剪枝(Pruning)与量化(Quantization): - **非结构化剪枝 vs. 结构化剪枝**:非结构化剪枝仅剔除权重矩阵内部的部分权重参数,导致网络稀疏化,通常依赖专用硬件加速;而结构化剪枝则直接剔除对模型准确率贡献较低的整组神经元或通道,能直接在通用硬件上削减传输开销与本地存储占用。 - **模型量化**:传统模型参数大多采用 FP32(32位浮点数)表示,在卷积神经网络时代其体积就已经相当可观,在动辄数十亿参数的 LLM 时代更是无法直接传输。目前行业已广泛采用低比特量化技术,将权重压缩至 16-bit、12-bit、8-bit 乃至 4-bit。 - **知识蒸馏(Knowledge Distillation)**:利用庞大的预训练教师模型(Teacher Model),结合本地特定数据源提取知识,蒸馏并指导轻量化的学生模型(Student Model)训练,使其在体积极小的情况下复刻甚至超越大模型在特定垂直领域的表现。 在探讨完架构性能优化后,一个关键的认知误区被郑重指出:许多人普遍假设"由于原始数据从未离开过本地设备,联邦学习就一定是绝对私密的"。然而事实并非如此单纯——虽然原始数据得到了保留,但上传的梯度与权重仍有可能遭受模型反演等攻击,当前的联邦系统依然无法做到 100% 绝对安全,必须在此基础之上构建更严密的防御护栏与隐私增强保护层。 ### [22:08](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1328s) 隐私层面的进阶技术:差分隐私与安全聚合 在联邦学习的架构中,为了防范更深层次的推断攻击和数据泄露,研究人员引入了更严密的隐私增强技术,其中最具代表性的是差分隐私(Differential Privacy, DP)与安全聚合(Secure Aggregation, SecAgg)。差分隐私可以被视为构建在联邦学习之上的额外防护层,其核心目标是保护每一个独立个体的数据记录。以一个具体的场景为例:假设存在分别来自客户端 A 和客户端 B 的两组数据集,这两份数据之间唯一的区别仅仅在于多了一条属于“爱丽丝(Alice)”的记录。如果这些更新在传输中意外泄露,攻击者很容易通过比对差异反向推导出属于 Alice 的全部隐私数据。为了消除这种风险,差分隐私会在梯度更新中注入经过精心调配的随机噪声;如此一来,即便模型更新被截获,攻击者也绝对无法将其反向定位到任何特定的单条数据或患者病历上。 实现差分隐私主要有两种路径:中心化差分隐私(Central DP)与本地差分隐私(Local DP)。如果参与方完全信任中央全局服务器,便可采用中心化 DP,由服务器在聚合时统一添加噪声并实施保护;但如果参与节点对中央服务器存有顾虑,则可以在各自的客户端设备上独立完成加噪过程,在梯度更新离开本地设备之前就筑起安全防线,不过本地 DP 的代价是会带来轻微的模型精度损失。与此同时,安全聚合则从另一个维度提供保护——差分隐私保护的是底层的具体数据记录,而安全聚合保护的则是全局更新本身。假设 Alice、Bob 和 Carol 三位参与者向系统贡献模型更新,为了防止泄露各自的具体数值,系统会在每对客户端之间战略性地添加成对的掩码(Mask)。这些掩码在两两节点间互为相反数,当所有客户端的更新在服务器端汇聚求和时,掩码会彼此相互抵消并归零,最终服务器只能解出纯净的聚合结果,而中途截获的任何单节点更新都只是一堆毫无意义的乱码。 - **差分隐私(DP)定位**:针对单条数据记录的保护机制,防止攻击者通过单行样本差异推断个体身份。 - **中心化 DP vs. 本地 DP**:中心化方案依赖可信服务器集中加噪;本地方案在客户端离机前加噪,安全性更高但伴随微小的精度损耗(Loss in Accuracy)。 - **安全聚合(SecAgg)机制**:在配对客户端间嵌入特定掩码,使得参数在中央服务器求和时自动抵消掩码,只保留真实的聚合权重,彻底杜绝中间人对单点梯度的逆向攻击。 --- ### [25:18](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1518s) 生产级落地生态与基准测试工具 联邦学习已经彻底告别了纯理论探讨和玩具实验阶段,在底层工程部署、工作流编排以及企业级运维监控方面涌现出了一批成熟的工业级框架。当前在该领域的生态前沿,开源框架 Flower 以及由 NVIDIA 主导的 NVIDIA FLARE 扮演着中流砥柱的角色,为大规模可部署基础设施、端到端编排管理以及全链路可观测性提供了强有力的企业级支持。对于想要评估联邦模型表现的工程师而言,业界也建立起了标准化的基准测试生态,例如卡内基梅隆大学(CMU)实验室推出的 LEAF 基准库、一站式联邦学习平台 FedML 等,它们为衡量分布式模型的性能边界与收敛效率提供了严谨的量化工具。 在真实商业与科研场景中,跨机构的联邦学习部署早已在多国落地生根。在高度敏感的医疗与基因组学领域,英国基因组学计划(Genomics England)与美国国家卫生研究院(NIH)均已开展了扎实的临床级应用探索;在对合规与风控要求严苛的金融行业,摩根大通(J.P. Morgan)等顶级投行正在积极利用联邦学习打破机构内的数据孤岛;科技巨头 Google 亦在持续引领大规模终端设备的联邦学习实践。这些来自医疗、金融和前沿科研的真实案例,充分印证了联邦学习已经成为保护数据主权与释放数据价值的核心基础设施。 - **企业级编排与监控框架**:Flower、NVIDIA FLARE。 - **标准化基准测试套件**:CMU LEAF、FedML 等。 - **代表性落地机构**:Genomics England、美国国家卫生研究院(NIH)、摩根大通(J.P. Morgan)、Google。 --- ### [26:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1572s) 生成式联邦学习的演进路线:短期目标与长期展望 站在生成式人工智能(GenAI)与联邦学习交汇的十字路口,未来的技术演进可以清晰地划分为短期趋势与长期蓝图两个阶段。在短期演进方面,随着大语言模型(LLM)的全面普及,**联邦微调(Federated Fine-Tuning)将迅速成为行业新常态**。在海量算力与数据壁垒下,几乎没有机构会再从零开始进行分布式预训练,基于大底座的参数高效微调将占据绝对主导地位。同时,越来越多的试点项目(Pilot Projects)正在加速跨越 PoC 验证期,直接迈入严苛的生产环境;此外,智能体联邦学习(Agentic FL)的热度正在急剧升温,多智能体协同与联邦训练的结合正从学术前沿大步迈向现实世界的落地部署。 从长远发展来看,联邦学习将迎来超大规模的横向拓展。未来的连接网络不仅覆盖单一组织内部的边缘设备,更将促成竞争对手企业之间的跨机构数据协作——即便彼此存在商业竞争,各方也能在严格保护自身专有数据的前提下,通过联合建模实现互利共赢。与此同时,多智能体联邦系统将走向成熟,并进一步将联邦学习的技术红利带入此前相对保守的冷门垂直领域,例如海洋学、气象监测与生态环境科学等。这些行业过去往往因对数据隐私与性能损耗的担忧而犹豫不决,随着合规与效能路径的明晰,其蕴藏的巨大数据潜能也将被彻底释放。 ```mermaid flowchart TD accTitle: Generative AI and Federated Learning Roadmap accDescr: Short-term and long-term evolutionary trends in federated learning and generative AI. subgraph ShortTerm["短期演进趋势 (Short-Term Goals)"] A["联邦微调 (Federated Fine-Tuning)<br/>成为行业新基准,告别从零预训练"] B["试点加速落地 (Pilot to Production)<br/>跨越PoC阶段,进入严苛生产环境"] C["智能体联邦学习 (Agentic FL)<br/>结合多智能体系统,探索自主协作"] end subgraph LongTerm["长期发展蓝图 (Long-Term Vision)"] D["大规模跨机构互联 (Massive Scaling)<br/>甚至促进竞品企业间安全聚合知识"] E["多智能体生态普及 (Multi-Agent Systems)"] F["拓展新兴行业 (Newer Domains)<br/>赋能海洋学、生态环保等垂直领域"] end ShortTerm --> LongTerm ``` --- ### [27:42](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1662s) 受监管行业落地联邦学习必须权衡的五大核心问题 对于金融、医疗、政务等受到严密法律法规监管的行业而言,引入联邦学习绝非单纯的技术改造,而是必须在启动前严肃权衡五大核心支柱问题: ``` ┌───────────────────────────────────────────────────────────┐ │ 受监管行业引入联邦学习的核心决策框架 (5 Core Pillars) │ └─────────────────────────────┬─────────────────────────────┘ │ ┌───────────────────────────┼───────────────────────────┐ ▼ ▼ ▼ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ │ 1. 合规与文档 │ │ 2. 数据主权 │ │ 3. 责任与治理 │ │ Is it legal? │ │Where does data│ │Who bears cost │ │ 方案是否合规?│ │ legally live? │ │ if it fails? │ └───────┬───────┘ └───────┬───────┘ └───────┬───────┘ │ │ │ └───────────────────────────┼───────────────────────────┘ │ ┌───────────┴───────────┐ ▼ ▼ ┌───────────────┐ ┌───────────────┐ │ 4. 技术复杂度 │ │ 5. 知情与透明 │ │Can team build │ │Do owners know │ │ & maintain? │ │ and consent? │ └───────────────┘ └───────────────┘ ``` 1. **法规合规与文档记录(Regulatory Compliance and Documentation)**:回答“这样做是否合法合规?”在立项初期就必须厘清跨节点数据协作是否符合当地及行业的法律框架。 2. **数据主权(Data Sovereignty)**:明确“数据在法律上允许留存在何处?”确保底层敏感资产在物理上与逻辑上均未发生违规跨境或跨域转移。 3. **法律责任与治理机制(Liability and Governance)**:厘清“一旦系统出错或遭遇攻击,谁来承担责任与经济损失?”需要建立清晰的多方权利与权责分配契约。 4. **技术复杂度与运维能力(Technical Complexity)**:评估“团队是否具备构建、维护和全生命周期编排该系统的技术能力?”虽然借助当下的现代框架,只需 30 分钟就能快速搭建起一套联邦学习模拟环境,但随着业务逻辑和问题复杂度的指数级上升,团队能否在生产环境中长期稳定地监控与维护整个管线才是真正的分水岭。 5. **用户知情与透明度(Consent and Transparency)**:确认“数据被纳入联邦计算的终端用户是否充分知情并给予了明确授权?”确保数据主体的知情权与同意权得到严格落实。 --- ### [29:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1776s) 架构总览:从端侧微调到云端聚合的完整落地范式 在演讲的尾声,各个孤立的技术模块被串联成一个高度协同的端到端联邦微调闭环。以三家互不共享原始病历的独立医院为例:每家医院将各自高价值、受严格保护的患者数据保留在本地私有存储(Data Silo)中,绝对不发生任何跨机构流动。在本地计算节点上,各方基于统一的基座大模型(Foundation Model)挂载 LoRA 低秩适配器进行参数高效微调,仅针对微小的低秩矩阵进行梯度更新计算。 为了构筑全方位的防护屏障,各节点在生成梯度更新后,除了可在本地施加差分隐私(DP)噪声以保护具体病患记录外,还会联合运行安全聚合(Secure Aggregation)协议,对所有发送至服务端的模型权重实施配对掩码加密。最终,中央云端服务器在无法刺探任何单体节点隐私的前提下,完成全局 LoRA 参数的无损聚合,并将更新后的全局权重回传给各参与方。在整个生命周期中,工程师团队通过专业框架持续进行编排与可观测性监控,真正实现了“数据不动模型动、隐私合规兼效能”的现代生成式联邦学习落地范式。 ```mermaid flowchart TD accTitle: End-to-End Privacy-Preserving Federated LLM Fine-Tuning accDescr: End-to-end federated fine-tuning architecture across three hospitals using LoRA, Differential Privacy, Secure Aggregation, and a central orchestration server. subgraph Clients["本地数据与微调层 (Hospital Nodes)"] direction TB subgraph H1["医院 A (Hospital A)"] D1["本地私有病历数据"] --> M1["基座模型 + LoRA 适配器训练"] M1 --> DP1["本地差分隐私 (DP 加噪)"] end subgraph H2["医院 B (Hospital B)"] D2["本地私有病历数据"] --> M2["基座模型 + LoRA 适配器训练"] M2 --> DP2["本地差分隐私 (DP 加噪)"] end subgraph H3["医院 C (Hospital C)"] D3["本地私有病历数据"] --> M3["基座模型 + LoRA 适配器训练"] M3 --> DP3["本地差分隐私 (DP 加噪)"] end end subgraph SecurityLayer["安全传输与聚合协议"] SA["安全聚合 (Secure Aggregation)<br/>节点间掩码对冲抵消"] end subgraph CloudLayer["中央聚合与编排服务 (Cloud Server)"] Server["中央服务器聚合全局 LoRA 权重"] Monitor["工程团队持续监控与全链路编排"] end DP1 --> SA DP2 --> SA DP3 --> SA SA --> Server Server -.->|分发全局更新| M1 Server -.->|分发全局更新| M2 Server -.->|分发全局更新| M3 Monitor --- Server ``` ## Notable quotes > [00:04](https://www.youtube.com/watch?v=ZALwExaIVBs&t=4s) sometimes the most valuable data is often the least mobile one — Fiona Victoria > [03:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=216s) alone we can do so little, together we can do so much — Helen Keller > [03:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=216s) 数据严格留在其诞生的原始设备中 — Fiona Victoria > [12:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=756s) 仅仅采用联邦学习,并不意味着数据就绝对安全 — Fiona Victoria > [16:24](https://www.youtube.com/watch?v=ZALwExaIVBs&t=984s) 现在已经没有人会想在边缘设备上从头开始训练一个大语言模型了,鉴于边缘受限的算力和存储,这根本毫无意义。 — Fiona Victoria > [19:57](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1197s) 由于原始数据从未离开过本地设备,联邦学习就一定是绝对私密的 — Fiona Victoria > [26:12](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1572s) 联邦微调(Federated Fine-Tuning)将迅速成为行业新常态 — Fiona Victoria > [27:42](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1662s) 团队是否具备构建、维护和全生命周期编排该系统的技术能力? — Fiona Victoria > [29:36](https://www.youtube.com/watch?v=ZALwExaIVBs&t=1776s) 数据不动模型动、隐私合规兼效能 — Fiona Victoria ## Mentioned Fiona Victoria, Helen Keller, 俄勒冈州立大学 (Oregon State University), Google, FLock.io, 伦敦大学学院 (UCL), 摩根大通 (JPMorgan / J.P. Morgan), NVIDIA, Intel, OpenMined, 牛津大学 (University of Oxford), 卡内基梅隆大学 (CMU), 英国基因组学计划 (Genomics England), 美国国家卫生研究院 (NIH), Stability AI, Midjourney, ElevenLabs, 联邦学习 (Federated Learning), Gboard, FedAvg, TensorFlow Federated (TFF), Flower (Flower Labs), NVIDIA FLARE, PySyft, OpenFL, LEAF, FedML, LLaMA, LoRA (低秩自适应), 差分隐私 (Differential Privacy), 安全聚合 (Secure Aggregation), HIPAA, GDPR ## Video description Fiona Victoria - Researcher, Oregon State University Enterprises want what generative AI can offer, but often their most valuable data can't leave the building, whether it be patient records in healthcare, transactions in finance, or proprietary design plans in manufacturing. That friction is what pulled me into federated learning. In this talk, I'll show how FL solves that problem and how the tools have matured well past the sandbox stage. I'll walk through recent advancements that have made FL more practical, including federated fine-tuning, efficient architectures, and stronger privacy guarantees, and cover what regulated industries should weigh before adopting FL. This talk will help you see why FL is no longer just a research curiosity for privacy-sensitive AI. [Source](https://www.youtube.com/watch?v=ZALwExaIVBs)

Source quotes

[0:04] Fiona Victoria: sometimes the most valuable data is often the least mobile one [3:36] Helen Keller: alone we can do so little, together we can do so much [3:36] Fiona Victoria: 数据严格留在其诞生的原始设备中 [12:36] Fiona Victoria: 仅仅采用联邦学习,并不意味着数据就绝对安全 [16:24] Fiona Victoria: 现在已经没有人会想在边缘设备上从头开始训练一个大语言模型了,鉴于边缘受限的算力和存储,这根本毫无意义。 [19:57] Fiona Victoria: 由于原始数据从未离开过本地设备,联邦学习就一定是绝对私密的 [26:12] Fiona Victoria: 联邦微调(Federated Fine-Tuning)将迅速成为行业新常态 [27:42] Fiona Victoria: 团队是否具备构建、维护和全生命周期编排该系统的技术能力? [29:36] Fiona Victoria: 数据不动模型动、隐私合规兼效能

Source quotes

[0:04] Fiona Victoria: sometimes the most valuable data is often the least mobile one. [3:36] Helen Keller: Alone we can do so little; together we can do so much [27:42] Fiona Victoria: Is it even legal? [27:42] Fiona Victoria: Where can the data legally live? [27:42] Fiona Victoria: If something ever goes wrong... who is responsible and who's going to bear the cost of it?

Original transcript

[0:04] So, hi everyone. I'm Fiona. Uh, like he  introduced, I'm a PhD researcher from Oregon State [0:09] University. Um, I know it's a tough time to be  here right after lunch, but bear with me for just [0:16] another 30 minutes while I take you on a little  journey uh kind of introducing you into nuances of [0:22] generative AI for federated learning, particularly  what we call as collaborative learning. And [0:28] I'll also walk you into ways we can think about  improving privacy of these a IML models uh without [0:33] letting it affect performance. And I also want to  kind of touch a bit about things that regulated [0:39] industries should weigh in before they adopt FL  or federated learning because I know that that's [0:45] a set of audience that's quite skeptical about  this for good purpose obviously. So let's assume [0:54] like these three scenarios, right? So the reason  I put up these three examples are these are some [0:59] of the most regulated industries that you think of  before they think of ever adopting FL. So consider [1:05] a hospital that wants to adopt uh LLM models  for improving their understanding of patient [1:11] transaction data or charts or think about banks or  financial institutions who want to also use some [1:18] kind of fraud detection systems and leverage  that for their real dynamic transaction data. [1:24] Think about another scenario where you have  factories or manufacturing industries that [1:29] want to leverage Genai for their proprietary  designs and trade secrets. The issue is that [1:36] none of these industries will ever be willing to  give some of their most confidential data to be [1:41] stored in a or stored or shared in a centralized  way especially in a third party cloud. So it's [1:49] always the same story in every industry. And  the most important takeaway from this is that [1:57] sometimes the most valuable data is often the  least mobile one. And I think that's very true [2:04] especially for regulated industries. So that  made me think and a lot of I think researchers [2:09] are thinking in the same way. So what can we do  about this? But before we go on to what can we do, [2:15] we need to understand a bit more about why can  the data ever leave these different data sources. [2:21] So there's obviously regulatory laws in place.  You have HIPPA rules that kind of protect these [2:27] patient records, especially their confidential  health information. Then you have GDPR laws that [2:34] protect the EU citizens, especially from all of  the sensitive records. And both of these laws [2:39] protect the patients and a lot of customers  like us from ever pulling these data sources [2:45] or movement of these sources across geographic  regions or sometimes even within a company itself. [2:51] Then obviously you have competitiveness. Some  of those most proprietary design secrets or [2:56] trade secrets will momentally lose their value  the moment they accidentally even shared. I can [3:02] think about semiconductor being one of them. You  know the pace at which each of these semiconductor [3:06] wafers or silicon chips are being designed. And  if you can even think about one small design idea [3:12] being accidentally leaked there goes their whole  market value. Then there's trust. Customers like [3:19] us, our patients often assume that when we sign  or give our data to someone, we assume that it's [3:26] just going to remain there, not going to  actually get moved to another, you know, [3:29] third party location. So there's also a moment  of trust that we need to think about. So there [3:36] enters federated learning. So the image on the  left is what is a scenario for a centralized ML. [3:42] You have different you know edge devices that I  would call like you could be your laptops, phones, [3:49] iPads or even an electric scooter. All of these  actively share their sensor data or any any kind [3:55] of private information. And in a centralized ML  all of this data gets stored into one global data [4:01] source and you have a centralized ML model running  on top of it. And that's not really good for us, [4:06] right? So in case of regulated industries, you  would think about keeping the data exactly where [4:13] it lives. So if you think about your mobile  phones or electric scooters or any of these [4:19] regulated industries having the data sources,  the data would sit exactly where it resides and [4:24] only a local training happens in all of these  edge devices thereby sending the model updates [4:29] alone to the global server. So by doing so your  data never leaves the machine but just all the [4:35] learnings from all these different client devices  enter the global server and therefore the global [4:41] model itself. So this is just a little code.  It's not exactly um maybe not super applicable [4:48] but I just found it a little fascinating because  I see its relevance to FL itself like especially [4:54] collaborative learning alone we can do so little  but together we can do so much. And by this I mean [4:59] that by using FL we can just harness the power  of all of these millions of edge devices that [5:04] come together rather than just understand how  it works if you were to pull them all together [5:09] into one data source. And this is just a little  bit of a twist that I completed from what Helen [5:15] Keller wrote many years ago. So together we  can do so much. It's just like kind of you [5:21] know reading anybody's diary. You don't want to  read anyone's diary right? Those are personal. But [5:25] instead what we want to do, we want to know those  experiences, those stories, the things that they [5:30] want to tell you and that you can learn without  ever turning any of those pages of a diary. And [5:35] I think that's what I think of FL when anybody  talks to me about uh collaborative learning or [5:40] FL itself. So this is just a quick overview of  comparing both classical machine learning and [5:46] federated learning. Like I said, the data um never  leaves the device. Only the model updates are ever [5:52] sent to the server. And this is a great fit for  regulated industries be it finance, healthcare [5:58] or any of those manufacturing industries that  I just talked about. And another point is that [6:03] there is comparable or even sometimes improved  performance or of using federated learning. [6:12] FL was just a research curiosity for a lot of  these years. you know, it kind of started back in [6:17] 2016 and it was just something sitting in research  labs in laboratories and never really hit real [6:23] world deployments until quite recently. For a lot  of people who are familiar with FL before I even, [6:30] you know, go a little bit more about this, just  a show of hands, who here has worked in some [6:35] way or fashion with like FL simulation or some  kind of real world deployment? Anybody? Okay, [6:42] so that's not a lot of [laughter] us. So I think  cure is a good way for you guys to understand [6:46] ways to leverage federated learning itself. So  back in 2016 is when Google first came up with [6:53] federated learning. They coined the term federated  learning. And the reason they introduced this was [6:58] for next word prediction that we all used in  our Google keyboards. So when you type a word, [7:02] it actively knows what next word you are going  to type based on its understanding of you itself. [7:08] So my next word prediction is going to  be vastly different than something you [7:12] might get or another person might get. We all  will get different recommendation based on our [7:16] usage with that chatbot or those keyboards.  And after that there's been a lot of active [7:24] development of FL in healthcare. So there's  a company called Flock.io and they actually [7:30] collaborated with certain eye hospitals and ulc  uh for you know diabetes management or even for [7:36] eye disease protection. So they've actually used  FL while pulling uh data from all those different [7:41] clinical data sources rather than having them be  stored in one central location. Another example [7:48] is JB Morgan. So they are also actively partnering  with Nvidia Flare and even FL labs for improving [7:55] their fraud detection systems. Another example  is in the use of manufacturing. So in terms of [8:03] additive manufacturing, FL is also being used  across different sectors like defense, aerospace [8:09] and industrial manufacturing. And this kind of  shows you the potential market size for federated [8:17] learning. So right now the market size is about  say $600 million and it's projected to grow over [8:23] 10x over the next decade and I think that's a  huge amount to capitalize on or you know just [8:28] take advantage or leverage. What are some of the  industries that actively use real world deployment [8:34] already? Like I said, we have a ton in bio or  biioarma companies or healthcare industries. [8:41] We also see them across defense. We see them in  automotive industries. We see them in banking and [8:46] financial institutions. And we also see a little  bit in research labs because obviously that's [8:51] where it all started from. So before we go a  little deeper into how um JAI kind of you know can [9:00] be used in FL I wanted to just do a quick 101 on  what are some of the different core architectures [9:05] Janai has to offer and what are the different  output modalities you can think about and then [9:10] you and then from all of this you can think about  all the different combinations of models and come [9:14] up with all the different solutions as per your  use case. So the main I guess four architectures [9:19] in jai models are transformers and that obviously  you know is something that powers all of these GPD [9:26] models that you see today which is essentially  predicting one token at a time and then you have [9:31] diffusion models. So those were actually kind  of derived from physics where you have a unit [9:37] model trying to predict the amount of noise that  is embedded in each of the images and it tries [9:43] to actively unlearn that noise thereby getting  variations of images and I'll go a little bit more [9:48] deeper into diffusion models in just a minute.  Then we have GAN models. So these are essentially [9:54] two neural networks which kind of pit against  each other in order to create different types of [9:58] images, videos or text. Then you have VAS. VS are  kind of like an extension of um just your simple [10:06] autoenccoder or like you know encoder decoder  model but this can also give you variations of [10:10] images and with these different architectures you  can work with different kinds of modalities you [10:16] could think about creating text and that's like  you know those different chatbots that we work on [10:21] today you can think about it for code reviews or  writing code essays summarizing any of that and [10:27] then you can think about using diffusion models  GAN and BAS for image and audio. So those could [10:33] be for generating large realistic video frames or  those hyper realistic images that you see today. [10:40] And for audio and speech, you can think about  that being like all of those uh products like say [10:45] companies like Leven Labs that do audio effects,  music or humanlike voice. So all of those are you [10:51] know kind of they like behind the scenes they are  powered by transformers, VAEs or diffusion models. [11:00] So like I mentioned I just want to touch a little  bit about diffusion models. Um I wouldn't go too [11:04] much into the others but this was just something  that I wanted to touch given that some of my [11:09] research focus has been within the domain of  diffusion models itself. Uh so for diffusion [11:15] models uh they are there are two ways to think  about it. There's usually an unconditional way of [11:21] generating images and there's an conditional one.  In case of unconditional generation, um it starts [11:27] with a raw gshian noisy image and then you have a  neural network typically a unit that in every pass [11:34] tries to den noiseise that image in say thousand  steps or 4,000 steps thereby getting you different [11:40] variations of images. But the sad part about it  is that it kind of only creates images based on [11:46] your training set. So if your training set was  say thousands and thousands of butterflies, [11:52] your generation would only be able to generate  you know something that looks like a butterfly [11:56] because it hasn't seen a distribution of any other  kind of species itself. So in order to solve that [12:03] we have conditional generation where you have a  prompt that kind of you know actively conditions [12:08] or guides it towards creating what you wanted  to create. So this is what powers all of the [12:13] you know different models that we see today from  stability AI image journey and all of that. And [12:19] the thing about using this in a centralized way  is that you could generate many different types [12:24] of images but none of them are ever private  or protected if you were to think about just [12:29] putting them into a centralized ML manner. So now  that we know how FL works and genai models work, [12:36] let's just fuse them together. Right? So the way  it works is you would like I said distribute the [12:42] model to the different client devices. Each  of those client devices or local edge devices [12:47] would do their own local training. So they would  have its own compute and storage capacity. They [12:53] would do their own local training and they would  aggregate all of these model weights or updates [12:58] send them back to the global server and the  process repeats all over again till the final [13:04] global model reaches convergence. So when you feel  like the model has learned enough to kind of give [13:10] a good you know if it has learned the patterns of  all of these different clients the training kind [13:14] of stops and then you have your final you know  model ready to be deployed. So I want to touch a [13:21] little bit about some of the research challenges  with this uh just going over the list of them. [13:26] We have statistical research challenges which is  that across all the clients each of those clients [13:32] could have you know different quantities of data  different qualities of data different labels that [13:37] they offer. So that's one research challenge.  Then we also have communication. Each of these [13:42] edge devices could have different bandwidths  latency some could be deployed in rural areas [13:48] and some in kind could be in suburbs. So based  on that that's another challenge in terms of [13:53] model hetrogenity. Some of those models could be  you know very small sparse networks and some of [13:58] those could be dense or deep neural networks  and that can also affect the way it all works [14:02] together. Then we have device heterogenity. Some  of the device could be heavily compute efficient [14:08] and some could just have very low compute  capability. There's also different types of [14:12] storage requirements for different devices that  we use. Then there's also privacy guarantees and [14:18] that is to make sure you all understand that  just because something is in FL doesn't mean [14:23] you can actively you know just assume that it's  going to be fully private. There's additional [14:26] layers of privacy that we need to work on top  of FL too. So just want to touch a little bit [14:33] on what does in FL infrastructure look like since  the start of it in 2016 versus where it is today. [14:40] So back in 2016 is when Google first came up  with um FL and also came up with their first [14:47] aggregation algorithm called fed average. Later  on they developed the first framework called [14:52] TensorFlow federated. Later on FL labs which is  a research lab from Oxford and Nvidia Flare which [14:59] came out of a project from genomics and COVID 19  analysis came up with their first uh FL frameworks [15:05] too. Then we see Openmind and Intel coming up  with their own variants of FL frameworks called [15:11] PI Swift and OpenFL. And then there was some there  was starting to be some kind of real world use [15:17] case deployments made via Nvidia Flare. Then we  all know the end of 2022 the pivotal moment where [15:25] we had public availability of LLMs. Since then,  we've had a ton of support for Lara fine-tuning, [15:32] a ton of support for agentic FL finetuning from  both FL and Nvidia, and there's also been active [15:39] development for enterprise deployment especially.  So, what has changed over the last few years? So, [15:46] I would kind of put them across three different  verticles. One of it being modelwise changes. Uh, [15:51] then we have privacy wise changes and  production wise. When I say model wise, [15:56] those could be the more efficient fine-tuning  methods or architectural design changes that have [16:00] happened over the last few years. And when I talk  about privacy changes, I'm talking more about the [16:05] kind of secure protocols that have come in place  to protect these FL models. And when I talk about [16:11] production, it's referring to how mature some  of these frameworks have become, especially for [16:16] orchestrating, monitoring, observing all of these  different trainings. So to go a little bit more [16:24] detail into model wise um there's actually two  different topics within model wise advancements [16:30] that I want to talk about. First being  federated fine-tuning and the second being model [16:34] architecture itself. So federated fine-tuning has  now become like the standard version of doing any [16:42] kind of training in edge devices. Nobody wants  to train an LLM from scratch anymore. it doesn't [16:47] really make sense especially for edge device  given its low comput and storage capability and [16:52] um so there's been a ton of advancements in how  efficiently to fine-tune these uh models in local [16:59] edge devices and the best part about is that you  actually get comparable or better performance than [17:04] some of the centralized models and we end up also  having them be compute efficient storage efficient [17:10] and even communication efficient and we know  where fine tuning sits right it's kind of right in [17:15] between pre-training and inference. So, it's like  the perfect spot for us to figure out a best way [17:20] to make it more efficient. And when we go a little  bit more detailed into what are the different [17:26] ways to do parameter efficient fine-tuning in a  federated learning setting, there's usually three [17:31] different things that come to mind. One is called  Laura, which is low rank adaptation. Then we have [17:36] adapter modules. And the third one is prefix  tuming. Uh the first one Laura is essentially [17:43] you can think about it doing it via three steps.  It freezes the base model. It adds some kind of [17:48] low rank adapter matrices and it then uh trains  all the models efficiently. In case of adapter [17:54] modules, it um injects some kind of small adapter  layers within these already existing transformer [18:01] blocks that you have in your neural network.  And for prefix uh tuning, you can think about it [18:06] being adding small extra trainable token vectors  into the model's input and not the model itself. [18:14] Um I have edited Laura because I wanted to just  go a little bit more detail given that's what's [18:19] being supported by a lot of FL frameworks today.  So like I said, it's just a three-step process. [18:25] You freeze the model, you add these matrices, and  then you have the final train model efficiently. [18:30] Uh so how does it work? So when you think about  any weights or bias in a model, you can usually [18:35] denote it as W. Right? So for Laura, rather  than the model touching W during fine-tuning, [18:41] it adds another element called W plus B cross A.  And the B cross A is your small low rank matrix. [18:48] And during fine-tuning, the gradients are actually  being updated only based on B cross A and not the [18:53] W. So the W is from the frozen base model. So that  never gets touched. So this small low rank matrix [19:00] which is usually all that is enough for finetuning  is the only one that gets updated. So because of [19:06] this you have the model that is really good for  domain specific tasks. So you take a large frozen [19:13] base model which is a big you know think about say  like a llama model or one of the state-of-the-art [19:18] GPT models out there. You just freeze the model,  you add your domain specific data to it and then [19:24] you do a Laura fine-tuning and then it is very  good at that specific task itself. So in FL how [19:32] does it work? So consider you have three different  clients or edge devices you would keep the [19:36] frozen base model as such but would just add the  additional neurals which are the red you know the [19:43] red ones that you see here only those get updated.  So only the gradients from the three red neural [19:49] networks get updated back to the global server and  then the training kind of goes on from there. Uh [19:57] the second one is about model architecture. So  what are some architectural changes that have [20:02] happened in the last few years and obviously some  of them have existed for couple of decades already [20:08] but they are now being rapidly used in the realm  of federated learning itself. So the first is [20:13] model compression. Like many of you know there's  couple of ways to do model compression. You can [20:18] think about doing it via pruning or quantization.  So for pruning what you do is you can either do [20:24] like unstructured pruning where you eliminate  some of those weights within a matrix not the [20:30] whole neuron itself but just the weights within a  matrix. So you end up having like sparse matrices [20:35] throughout the neural network and you need to have  some kind of specialized hardware to deal with it. [20:40] On the other hand, if you do something like this,  which is a structured pruning, you can eliminate [20:44] the neurons that don't really contribute much  to the model's accuracy and just take those out [20:50] of the neural network. And by doing so, you can  reduce the transmission cost and the storage cost. [20:56] Second is model quantization. So effectively most  of the model weights that you see are, you know, [21:02] they represented by floating bits, usually  FP32, and those are pretty large in size. [21:08] they were already kind of large when we were in  the era of you know convolutional neural networks [21:12] and things like that and now moving on to LMS  it's just not making sense anymore to keep them [21:16] as FP32 so there's a lot of efficient ways to  quantize these weights uh into say four bits 8 [21:22] bits 12 or even 16 bits the second is knowledge  distillation effectively this is a um this is a [21:30] topic that's been there in the world of AI for  quite some time now but for FL this is quite [21:35] useful because you could take a large teacher  model, a pre-trained model and then just distill [21:40] the knowledge from that based on your particular  data source and then feed that and make it a small [21:44] student model. So the student model would mimic  the behavior and sometimes even be better because [21:49] it is designed for your domain specific task. So a  common assumption like I mentioned is that in FL I [21:56] said the raw data never leaves the device, right?  So we're probably private. Not really. So we are [22:03] still not 100% secure. we need to still build  a lot of guard rails and privacy layers on top [22:08] of this. So that's why I want to go a little bit  more into what are some privacy wise advancements [22:13] that have have happened in FL. So the first is  differential privacy and the second would be [22:20] um sorry the first is differential privacy and the  next is secure aggregation. So for differential [22:25] privacy you can think about it being an additional  layer that is on top of FL. So essentially what [22:31] it does it it tries to protect every individual  data's record. So consider this example you have [22:38] two different data sources. Those could have been  from two different clients say A and B. The only [22:43] thing different between the two different data  sources is an extra Alice record. So there's an [22:48] extra row of record that came from a person called  Alice. You don't want any way that if this data [22:53] got accidentally leaked it coming back to being  like okay the only thing I see different is Alice. [22:59] So I can probably take all of Alice's data, right?  And that's a very sensitive place to be in. So DP [23:04] protects this. What it does is it adds a lot of  random noise to all of these gradient updates so [23:10] that even if these updates were ever accidentally  leaked, you could never pinpoint it to which [23:14] individual data point it came from. So in a way it  protects the you know whole patient record or any [23:20] of those individual data records. There's a couple  of ways to think about DP. um one would be doing a [23:28] central differential privacy and another would  be doing them locally. If you trust the global [23:34] server, you can go with doing a central DP because  this means that you are expecting the global [23:39] server to take care of doing differential privacy  on behalf of you. So they would actually add those [23:44] random app um random noise to those updates and  then try to protect the individual data records. [23:50] But if you don't kind of you know uh trust those  global service to do DP, you could do it yourself. [23:55] You could have an excellent of protection of DP in  each of these client devices before ever sending [24:00] those gradient updates back to the server. But  a small drawback is that it comes with a little [24:06] bit of loss and accuracy. Another way to think  about privacy wise advancements over the last [24:14] couple of years is secure aggregation. Uh when I  mentioned DP, I said that it protects every data [24:19] record. On the other hand, secure aggregation  protects all the global updates itself. [24:25] So for this uh you can think about uh three  different like this scenario. Let's say we have [24:31] Alice, Bob and Carol who are three different  participants or three different edge devices [24:35] who gave their data away right now. Uh we don't  want any of these data to ever come back to them [24:41] and we don't want to accidentally figure out whose  data is who, right? So that's what we're trying to [24:45] protect all over here. So in order to protect  their data records, what we do is we add an [24:50] additional mask to each of the pairs of clients.  So that when they get summed together they kind [24:56] of cancel each other out. So those mass values  are strategically placed in a way when you put [25:00] them together they cancel each other out. So in  the end you only get those good values. Uh but if [25:06] you ever were to do some kind of attack on of the  all of these models those updates would tell you [25:11] nothing. So this is one smart way to also protect  these model updates before they go to the server. [25:18] Um the third layer that I want to talk was  obviously the production wise uh you know [25:23] developments and advancements. There's been a  lot of um leaders at the forefront of this uh [25:29] for deployable infrastructure and orchestration  and for monitoring and observability and for [25:34] enterprise support. Flower and Nvidia Flare has  kind of been leading most of these years uh for [25:41] standard benchmarking. So you would wonder if I  do FL are there actually benchmarking tools that [25:46] tell me is my model good enough? Good news there  is there is actually leaf from CMU labs there's [25:52] also fed ML and there's also FL who do active  benchmarking and lastly we also have a lot of [25:58] real world deployments done actually by genomics  England we have national institute of health we [26:04] also have a lot of banks like JP Morgan and even  Google leading the efforts in advancements of FL [26:12] So I guess we're kind of coming towards the end.  So I wanted to go a little bit on given all that [26:17] we know now where are we actually headed in  case of you know jai with FL. So I would kind [26:22] of broadly categorize them into short-term goals  versus long-term goals that I see happening. [26:27] In case of short-term goals I think federated  finetuning will become the new normal. Nobody's [26:33] ever going to do going to do pre-training  especially with the advent of large language [26:37] models. And second, I think we are going to see a  lot more projects going from pilot to production [26:42] stage. And I think third, agentic FL is just going  to become mainstream. There's already a lot of [26:47] chatter about it. There's a lot of research going  on. But I think more of these projects are going [26:52] to come into real world deployment for long term.  What do I see? So obviously the first is that [26:57] massive scaling. I'm going to I think I envision  seeing more and more devices connecting and coming [27:02] together not just within an organization but even  between competitive organizations because they [27:08] have a lot to learn from each other by pooling in  their data and I think we also can see the advent [27:13] of multi- aents within federated learning and most  importantly I think this advancement is also going [27:20] to unlock newer industries to want to adopt FL  for instance it could be oceanography or something [27:25] related environment these are domains where they  are quite hesitant about FL in general but I think [27:32] uh kind of you know educating them under helping  them understand the ways to navigate through [27:36] privacy and performance would be a great way for  them to also unlock the potential of FL. So what [27:42] are some regulated industries that they know  the things that they should weigh before even [27:47] adopting FL? So I kind of just put them as five  different you know ways of thinking about it. [27:53] The first is regulatory uh compliance  and documentation and then we have data [27:58] sovereignity. We have liability and governance and  then we have technical complexity. So the fourth [28:04] point is the most that I covered today and the  last obviously being consent and transparency. So [28:09] what do each of these aim to answer? So the first  one helps answer is it even legal? So that's the [28:16] first question we should all be asking before  we adopt FL like is it the right thing to do? [28:21] Second, where can the data legally live?  If we are able to answer this question, [28:25] I think we're in a good spot to start thinking  about how we can adopt FL into our works or you [28:30] know pipelines. Third, if something ever  goes wrong in these kind of FL settings, [28:35] who is responsible and who's going to bear the  cost of it? Fourth, do we have those kind of labs [28:42] or teams or people who are you know good enough  to understand how these systems are? Can they [28:47] build them? Can they maintain them? and can they  orchestrate the whole process seamlessly? There's [28:52] been a lot of development with these frameworks  to how easy it is to just spin up a simulation of [28:57] FL by yourself. You could just think about doing  it even today in just a matter of 30 minutes. So [29:03] that's how easy it has become. But the question  is like can they actually go through it with the [29:08] technical complexity as their problem statement  grows and can they also be there to maintain the [29:13] whole work till it gets deployed. And the last  is uh obviously about consent and transparency. [29:20] Do the people whose data gets involved into  the FL process actually know their data is [29:25] going in and do they consent to it? So I think  these are the five main questions um we should [29:31] think about before we ever think about adopting  FL. Um I guess I just want to end it by saying [29:36] by putting it all together. So these are all  the technical concepts that I covered today. [29:41] Uh for example um this is a scenario of hospitals  say three different hospital organization they [29:47] have their own local data and this data is  usually protected right it's within them it's [29:54] not cross silo or anything so it's within them  so it's going to be protected and so we want to [29:58] do like a foundation model Laura adapter training  on top of it in order to do federated fine-tuning [30:05] so for that we also can think about doing like  those kind of low rank adapter matrices that I [30:10] just talked out and then an additional layer is  by doing secure aggregation because we don't want [30:14] to just stop with DP. We also want to make sure  that all these gradient weights are also equally [30:20] protected so we can think about doing a secure  aggregation and finally we can all hand it the [30:25] final model over to the cloud server and the good  part is one of us is always going to be there to [30:30] orchestrate and monitor it. So thank you everyone  and I hope you all learned something today. Fates.