Keeping Training Data on Site Does Not Settle a Federated Model's Privacy Claim

Two organizations want to train a shared prediction model without pooling their original records. Federated learning changes where training occurs and what moves between participants. The next question is what the shared information might reveal, to whom, and under which protections.

On 29 October 2026, NIST's National Cybersecurity Center of Excellence released a privacy-preserving federated-learning testbed and a curated soybean genomic dataset. The release provides an experimental setting for comparing training configurations, including differential privacy. It is a research resource, rather than certification that an organization's own collaboration is private or compliant.

This guide develops an original evaluation worksheet around that distinction. It does not report a testbed run, a measured attack result or a recommended privacy setting. The aim is to make a proposed collaboration's privacy claim specific enough to investigate.

Start with the observer, not the reassuring label

“The data never leaves the hospital” is incomplete if the training procedure sends information derived from those data to another party. Begin with an inventory: raw records, intermediate updates, aggregate updates, model checkpoints, logs and the final prediction interface.

For each artifact, name who can see it. A coordinating server, another participant, a model user and an administrator with access to retained logs can have different views. Also state whether the observer follows the protocol or may deliberately manipulate it.

Interpret the new testbed within its documented scope

The NIST-maintained repository documents centralized and federated experiments, configuration controls, result outputs and separate holdout data. Its current README identifies privacy-evaluation tools as future work. That matters: a useful model-performance comparison should not be described as an automatically completed leakage assessment.

The release's soybean benchmark also has a specific role. Plant data can provide a shared experimental task without making it a validation study on human patient records. Model behavior on that task does not establish the acceptability of deploying a medical collaboration with different data, participants and consequences.

Record the repository version, data preparation and configuration before comparing outputs. This article reviewed documentation, not implementation security.

Shared updates are evidence-bearing artifacts

The primary Deep Leakage from Gradients paper, published at NeurIPS 2019, demonstrates reconstruction of training data from shared gradients in the authors' evaluated settings. Its abstract discusses computer-vision and language tasks.

That result challenges the blanket assumption that replacing raw records with gradients makes sharing harmless. It does not establish that every update from every federated system enables exact reconstruction, nor does it estimate the risk of the newly released NIST testbed.

For an evaluation plan, specify the update type and visibility rather than importing the paper's outcome wholesale. Batch construction, model structure, protocol, auxiliary knowledge and access conditions can change what an observer receives. A claim about a particular deployment needs evidence about those conditions.

Keep aggregation protection and output protection separate

The authors' 2016 secure-aggregation manuscript describes a protocol that computes a sum without revealing each participant's individual input, under the protocol's stated conditions. That is a different objective from limiting what a resulting model reveals about an individual training record.

NIST's announcement describes differential privacy as adding calibrated noise during training to limit record-level disclosure, with a model-performance trade-off. The appropriate claim depends on the actual mechanism and its configuration; the presence of an option labeled “DP” is not the complete evidence.

Do not infer that secure aggregation is implemented merely because it appears in a general federated-learning discussion. For the selected software version, verify which protections are present, where they operate and which party must be trusted. A requirement can remain unmet even when another, useful control is working.

Build an experiment matrix with comparable conditions

An original first-stage comparison might use the following configurations. The table proposes questions; it contains no measured results.

Keep the task, held-out population and scoring method consistent where the comparison requires it. Record changes that cannot be held constant. A lower score after several simultaneous configuration changes does not isolate the effect of noise.

For a privacy result, retain the mechanism, protected unit, accounting method, reported parameters and assumptions. A generic noise magnitude without that context cannot support the same conclusion as a complete, correctly applied privacy analysis.

Report site results as well as an aggregate

Consider an original hypothetical held-out evaluation. Site A contributes 60 records, of which 54 are classified correctly. Site B contributes 40, of which 24 are correct. The pooled accuracy is (54 + 24) / 100 = 78%, while site accuracies are 90% and 60%.

The unweighted average of the two site accuracies is 75%, a different summary with a different weighting rule. Neither calculation is a privacy score. Both can be useful for describing this fictional evaluation, provided the denominators remain visible.

An acceptable pooled metric can conceal an important site difference. Preserve subgroup and site results where collection and reporting are permitted, and investigate whether data quality, population differences or the chosen training configuration explains the gap. Do not convert an unexplained gap into a causal finding about federated learning.

Keep model utility, privacy and governance on distinct records

A performance report describes how a model behaved on an evaluation task. A privacy analysis describes a specific disclosure property under assumptions. A governance decision addresses whether an organization may conduct the collaboration and accept its remaining risks.

Keep three linked records: an experiment manifest, a privacy/threat-model assessment and an accountable deployment decision. Assign unresolved questions to an owner.

For example, a successful synthetic-data trial does not authorize moving a production dataset into a new tool. Likewise, an approved collaboration agreement does not establish that a particular implementation enforces the promised technical boundary. Each record should point to the evidence for the claim it actually makes.

Use the release to sharpen the next question

A sensible next step is a reproducible trial on approved non-sensitive data, followed by review of the specific privacy properties required for the real setting. Archive the configuration and results so another reviewer can tell what changed between runs.

For a broader discussion of privacy and statistical usefulness, see differential privacy and census trade-offs. Here the narrower task is to evaluate a federated training arrangement without treating local storage as the end of the privacy analysis.

Sources and scope

• NIST PPFL testbed announcement, 29 October 2026; official release and benchmark context reviewed.
• NIST PETs_ppfl repository, documentation checked 31 October 2026; configuration, holdout and stated capability limits reviewed. No testbed training run or full code audit was performed.
• Zhu, Liu and Han, Deep Leakage from Gradients, NeurIPS 2019; primary abstract reviewed, not the complete experiment or supplementary data.
• Bonawitz and colleagues, Practical Secure Aggregation for Federated Learning on User-Held Data, November 2016 author manuscript; primary abstract reviewed. Its protocol claims are not attributed to the NIST implementation.

The experiment matrix, numerical site example and review package are original teaching proposals. No measured leakage rate, privacy guarantee, regulatory conclusion or clinical performance claim follows from them.