Can AI agents share what they learn without sharing your data?
By Hevolve AI · Updated 2026-07-21
Partly, and the caveats are the interesting part. Sharing derived updates instead of raw data is a genuine privacy improvement, but those updates leak more than people assume, and a shared pool can be poisoned by whoever contributes to it. Both problems have partial defences and neither is solved.
What actually crosses the wire
In a federated setup the thing that leaves your machine is not your data, it is a delta: a summary of how your local model changed after learning from what you did. The raw material stays where it was produced. Many nodes send deltas, something merges them, and everyone receives a model better than the one they had.
In the Hive that merge is deliberately equal-weighted. Contribution is floored with log1p(interactions) rather than scaled by hardware tier, so a Raspberry Pi node and a GPU rack carry the same vote at equal participation. That is a decision about who the network belongs to rather than an optimisation, and it is the kind of claim that is easy to make and easy to check by reading federated_aggregator.py.
The part most explanations skip: deltas leak
The comfortable version of this story stops at 'only gradients are shared'. The research does not stop there. Property inference attacks recover attributes of training data from what a model exposes, and poisoned code contributions can be used to widen that leakage deliberately. Membership information turns out to be measurable in the geometry of learned embeddings, which is a long way from the intuition that an embedding is anonymous.
So 'no raw data leaves the device' is true and insufficient. It is a real reduction in exposure, not a guarantee of privacy. Anyone who tells you federated means private without qualification has either not read this literature or is counting on you not having.
The other direction: what gets into the pool
A shared learner has a second exposure that has nothing to do with privacy. If contributions shape the result, contributions are an attack surface. Pretraining data can be poisoned through what amounts to computational propaganda, and a federation with open membership inherits that problem by construction.
The defences that exist are unglamorous and mostly about admission rather than detection. A peer presents a guardrail hash at handshake and a mismatch refuses the connection, re-verified every 300 seconds. Access to shared learning is gated on verified compute contribution, so participation costs something. A benchmark prover exists so a node cannot federate a score it did not earn. None of that makes poisoning impossible. It makes it expensive and attributable, which is the realistic goal.
What we run, stated plainly
Nodes exchange derived, signed, privacy-scoped learning that a scope guard clears before it leaves the machine. They do not exchange raw data and they do not exchange model weights. Participation is opt-in, cloud egress needs explicit consent, and anything kept local stays local.
One limitation worth stating: the weight-level gradient sync interface exists but is not active. What is live is delta and signal federation, not full gradient sharing. This describes what runs, not the roadmap.
The research this is based on
6 papers, each explained in plain language.
Development and Design of FLKit: A Structured Onboarding Toolkit for Federated Learning in Health and Life Sciences
arXiv (BCI)Code-Poisoning Property Inference Attacks
arXiv (cs.LG)Quantifying Training Membership Information in the Hyperspherical Embedding Geometry of Face Recognition Models
arXiv (cs.CV)Pretraining Data Can Be Poisoned through Computational Propaganda
arXiv (cs.AI)AlphaWiSE: Adaptive Weight Interpolation for Continual Multimodal Representation Learning
arXiv (cs.LG)On-Policy Delta Distillation
arXiv (cs.LG)