Cross-platform federated learning SDK

Veil

Personalization without collecting user data. Ranking models train and run on the user's device; only noised, masked updates leave it, and each brand has a hard privacy budget.

  • TypeScript
  • Swift
  • Kotlin
  • Fastify
Code on GitHub (opens in a new tab)

Key numbers

  • 0

    raw training examples leave the device

  • ε ≤ 10

    privacy budget per brand and model

How it works

  1. Local contextconsented categories only
  2. On-device rankingpicks what to show
  3. Local learningopt-in, clipped
  4. Noise, then maskthe only thing sent
  5. Threshold aggregationminimum participants
  6. Brand dashboardaggregates only
On the device, only the context categories a person agreed to feed a local ranking model, which picks what to show. If they opt in to private learning, the device computes an update, clips it, adds noise and a mask, and sends only that. The server combines updates once enough people have taken part, and the brand sees aggregates.

Decisions that matter

  • The device does the work

    Ranking runs on the phone or in the browser. Turning consent off really changes what feeds the model, and private learning stays off until the person opts in.

  • A budget that closes

    Every training round spends privacy budget, tracked per brand and per model. A round that would push it past ε = 10 is refused, not logged and allowed.

  • Three platforms, one answer

    Shared golden vectors check that the web, iOS and Android feature encoders turn the same input into the exact same numbers, so the three SDKs train one model.

Results

More noise buys more training rounds before the budget closes.
  • Standard noise (σ = 4)1,846 rounds
  • Low noise (σ = 1)115 rounds

Rounds the accountant allows before ε reaches 10, for the two noise settings in the code, assuming each round needs 10 participants. Computed with the project's own accounting formula; log scale.

Limits. A working demo, not a deployed product, with synthetic data. Masks come from the server rather than being agreed between devices, and a round cannot survive dropouts; the project documents both.

Next projectGridiron Oracle