{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2609.15950", "title": "Privacy-Aligned Personalized Federated Learning with Compact Adaptation and Variable-Length Gaussian Communication", "summary": "The method replaces repeated high-dimensional differentially private model updates in personalized federated learning with a one-time private client context release followed by repeated adaptation confined to a fixed low-dimensional coefficient space, using variable-length quantization whose error doubles as the Gaussian privacy noise. The cost is implementing the factorized generator, the adaptive optimization geometry, and the variable-length coding scheme, plus accepting that gains depend on the assumption that client variation is genuinely low-dimensional. It can fail when client heterogeneity is high-dimensional, when the one-time context release is compromised or poorly calibrated, or in deployments not bound by record-level privacy accounting, where the added machinery buys nothing.", "rationale": "The technique is only relevant if the reader operates federated learning under record-level differential privacy, a niche constraint, but within that setting the communication and accuracy claims are concrete enough to warrant small-scale validation.", "technique": "Private client context with coefficient-space federated adaptation", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-09-14", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2609.15950", "independent_implementations": 0, "total_implementations": 0, "stars": 0, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "The method replaces repeated high-dimensional differentially private model updates in personalized federated learning with a one-time private client context release followed by repeated adaptation confined to a fixed low-dimensional coefficient space, using variable-length quantization whose error doubles as the Gaussian privacy noise. The cost is implementing the factorized generator, the adaptive optimization geometry, and the variable-length coding scheme, plus accepting that gains depend on the assumption that client variation is genuinely low-dimensional. It can fail when client heterogeneity is high-dimensional, when the one-time context release is compromised or poorly calibrated, or in deployments not bound by record-level privacy accounting, where the added machinery buys nothing.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.15950", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Reduces protected uplink communication by a factor of 2.67 at epsilon=16 on CIFAR-10 with comparable future-client accuracy, while matching or outperforming full-model private adaptation across privacy budgets and client heterogeneity.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.15950", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [ { "anchor": "S2.E7", "label": "(7)", "section": "2 Method", "role": "metric", "latex": "A_{i}=\\frac{\\Delta_{c}^{2}+T_{i}\\Delta_{g}^{2}}{2\\sigma^{2}},\\qquad\\varepsilon_{i}=A_{i}+2\\sqrt{A_{i}\\log(1/\\delta)}.", "mathml": "Ai=Δc2+Ti​Δg22​σ2,εi=Ai+2​Ai​log⁡(1/δ).", "context": "Algorithm 1 summarizes the complete training and deployment procedure. Privacy is accounted for using Rényi differential privacy (RDP) [9]. Let Δc=2/mc and Δg=2​Cg/mg denote the sensitivities of the one-shot context and repeated coefficient releases. We use a common Gaussian standard deviation σc=σg=σ. For a client participating in Ti private update rounds, composition of the one-shot context release and its repeated coefficient-gradient releases gives", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" }, { "anchor": "S2.E6", "label": "(6)", "section": "2 Method", "role": "proposed_method", "latex": "\\omega_{t+1}=\\omega_{t}-\\frac{\\eta}{|\\mathcal{S}_{t}|}\\sum_{i\\in\\mathcal{S}_{t}}J_{i}^{\\top}\\widetilde{g}_{i,t}.", "mathml": "ωt+1=ωt−η|𝒮t|​∑i∈𝒮tJi⊤​g~i,t.", "context": "The fixed denominator and clipping imply replace-one sensitivity at most 2​Cg/mg. Let ω=(W,ψ) denote the trainable generator parameters, and write Ji=∂ai/∂ω for the Jacobian of the generated coefficients with respect to the trainable generator parameters. Let 𝒮t denote the participating clients selected for the server update at round t. With uniform client weighting, the server update is", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" }, { "anchor": "S2.E8", "label": "(8)", "section": "2 Method", "role": "proposed_method", "latex": "\\Delta a_{j}^{(i)}\\approx-\\frac{\\eta}{|\\mathcal{S}_{t}|}K_{ji}\\widetilde{g}_{i,t},\\qquad K_{ji}=J_{j}J_{i}^{\\top}.", "mathml": "Δ​aj(i)≈−η|𝒮t|​Kj​i​g~i,t,Kj​i=Jj​Ji⊤.", "context": "From Eq. (6), client i’s contribution to the server update is Δ​ω(i)=−(η/|𝒮t|)​Ji⊤​g~i,t. Linearizing the coefficients generated for client j gives", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" } ], "equations_status": "selected", "core_kind": "formula", "equations_fetched_at": "2026-10-09", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }