Federated training
The hardest constraint in a regulated or sovereign estate is not compute. It is that the data cannot be pooled, which is exactly what conventional training requires.
Federated training inverts it: the model travels, the data does not.
How a round works
*Figure: each participating cell fits on the shard it already holds and ships a cell-signed parameter update. A control-owner cell aggregates them on a sample-weighted quorum, so a cell holding more data counts for more, and a round needs enough participants before it completes. No training rows cross a cell boundary.
Table equivalent
| Stage | What moves | What does not |
|---|---|---|
| Local fit | Nothing leaves | The training rows stay on the cell that holds them |
| Update | A cell-signed parameter update | Not the data it was derived from |
| Aggregate | The control-owner cell combines updates | It never sees a source row |
| Quorum | Sample-weighted, so contribution scales with data held | A round without quorum does not silently complete on partial input |
The machinery behind it: a round coordinator, a controller, a parameter codec, a quorum evaluator, an update manifest, and a worker pipeline and trainer on the participating side.
Updates are signed by the contributing cell. That is what makes aggregation safe to automate: the aggregator is not trusting an anonymous gradient, it is accepting a signed contribution from a cell whose identity it can verify.
What this is good for
- Residency. Data that may not leave a jurisdiction can still contribute to a model.
- Classification. A cell holding material above the clearance of the aggregator can still participate.
- Scale without pooling. Training across an estate without building the central data lake a residency regime forbids.
- The edge. The same shape reaches devices that will never ship their raw capture anywhere.
This is the one place in the ML story where the honest answer is a limitation, and it is worth stating precisely because the temptation is to imply otherwise.
Federated training is real. The trainer fits locally and signs its update, and the aggregation path runs.
A privacy layer also exists as production code with tests: a secure aggregator, gradient privacy, and a membership-inference guard.
They are not connected. The trainer that actually runs references those components zero times. So the platform does federated training, and it does not currently enforce privacy-preserving federated training.
Federated training should not be treated as a guarantee that a training set cannot leak. An unenforced guarantee reads as protection, which is the worst shape of claim: a reader who believes it changes their threat model on the strength of something nothing implements. The correct statement today is "training across data that never moves, with cell-signed updates and quorum aggregation", and nothing about gradient privacy or membership inference.
Related
- Training and experiments, the single-cell training path.
- Model operations, the SQL surface over the ML lifecycle.
- Data residency, the constraint this exists to satisfy.
- Platform replication, what else crosses a cell boundary and how.