Federated learning is a distributed training method where each client or tenant keeps raw data on its own device or in its own environment, and only model updates are sent to a central coordinator for aggregation. This approach is useful when data is sensitive, regulated, or spread across many organizations, because it reduces the need to move records into one shared training store.
In cyber security, federated learning matters because it changes the attack surface rather than removing it. Attackers may try to infer private data from gradients or updates, poison local training to influence the global model, or exploit weak participant selection and small cohorts in multi-tenant systems. Defenders use secure aggregation, update clipping, noise injection, and audit controls to limit exposure and track what was actually trained. Federated learning is privacy-preserving only when the whole pipeline, including membership, aggregation, and release, is controlled and verifiable.