Federated learning

In plain English

Instead of bringing every student to one school, you send the teacher to each home. The teacher learns from every household and brings back only lesson notes, never the family photos.

Federated learning works in rounds:

1. A coordinator sends the current model to each participant.
2. Each participant trains it on local data.
3. Participants send back only the model updates.
4. The coordinator combines the updates into an improved shared model, and the cycle repeats.

The term comes from a 2016 paper by McMahan and colleagues at Google, which trained models across mobile devices without collecting the data. The same idea now links hospitals, banks and countries.

Example

Three fictional regional hospitals, Northmere, Eastvale and Southbridge, want a shared sepsis early-warning model. Each hospital's rules forbid patient records leaving its systems.

They choose federated learning, with these controls:

• Leak protection. Updates are combined through secure aggregation, with differential privacy noise added.
• Poisoning defense. The coordinator screens for unusual updates and can exclude a participant.
• Agreements. A data-sharing agreement sets each party's role, and each hospital runs its own DPIA.
• Per-site testing. The model is tested on each hospital's population, not just on average.
• Documentation. The model card lists the participating sites and their patient mix.

Why it matters

Privacy. Keeping raw data in place supports data minimization (GDPR Art. 5(1)(c)) and data protection by design (Art. 25). It does not take local processing outside the GDPR.

Security. NIST AI 100-2 notes that most model poisoning attacks have been designed for the federated setting. Compromised participants send malicious updates to corrupt the shared model. Defenses try to identify and exclude those updates during aggregation. See data poisoning.

Localization. Where data-sovereignty laws keep data in each country, federated learning still allows one shared model (lesson IV.C.7).

EU AI Act. For high-risk systems, training data must be relevant, sufficiently representative and, as far as possible, free of errors and complete (Art. 10(3)). Federated training does not remove that duty, and it makes checking harder.

How the AIGP exam tests it

Privacy-enhancing techniques are matched to their jobs in lesson III.B.5.

Common traps:

• Technique swaps. Data stays home: federated learning. Calibrated noise: differential privacy. New artificial records: synthetic data. Identifiers swapped for a key: pseudonymization.
• "It's anonymous." Updates can leak, so it is not anonymization.
• Pooling pseudonymized records. That still moves the data, which a no-sharing rule forbids.
• Federated governance. A hybrid "federated" governance model (central policy, local assessment) is an org design, not federated learning.

The tell: if raw data must stay with each holder but everyone wants one model, the answer is federated learning. Pair it with synthetic data when rare cases are missing.