Gradient leakage: "sharing gradients, not data" doesn't stop inversion — gradients can be reconstructed into training samples
In one sentence "sharing gradients" ≠ "private"; FL needs secure aggregation + DP for a real guarantee — don't read "didn't send raw data" as privacy.