Challenges: privacy and heterogeneity

• Non-i.i.d. data: each client's data reflects its own user — one person types in Uzbek, another in English. Local models diverge, and the global model may serve no one well. Personalisation (fine-tuning the global model locally) helps.
• System heterogeneity: clients have different hardware, battery and connectivity; many drop out mid-round. Algorithms must tolerate partial participation.
• Communication cost: uploads from phones are slow and expensive; updates are compressed.

Privacy leakage: gradients can reveal training data — gradient inversion attacks can reconstruct images or text from shared updates, and membership inference can tell whether a person's data was used.

Defences: secure aggregation (the server sees only the sum of updates, not individual ones), differential privacy (clip each update and add calibrated noise), and trusted execution environments.