What is federated learning? What stays on your phone, and what leaves

The Morse teamPublished November 3, 202610 min read

Federated learning is a way to train an AI model across many phones or computers without collecting their raw data: each device trains on its own data, and only the resulting model update is sent to a server, which combines updates from many devices into one shared model. As of November 2026, Google uses it to train every neural next-word model in its Gboard keyboard, but what it sends still leaves your device, and European and UK regulators say those updates can leak information unless other protections are added.

We read the paper that named the technique, Google's research posts and Gboard and Assistant help pages, Android's Private Compute Services announcement, Apple's machine learning research pages, OpenAI's training help page, and the guidance from the European Data Protection Supervisor and the UK's Information Commissioner's Office, all on November 3, 2026. Google deserves credit here. Its own white paper on Gboard says that federated learning alone wasn't enough, and it publishes the privacy numbers for each model.

Federated learning: key facts

How does federated learning work?

A server sends the current model to many devices, each device improves it on its own data, and the server averages the improvements into a new model. Brendan McMahan and Daniel Ramage of Google described it on April 6, 2017: your phone downloads the current model, "improves it by learning from data on your phone," and summarizes the changes as a small, focused update (Google Research). The same post says "no individual updates are stored in the cloud." The cycle then repeats with the improved model.

The name comes from a 2016 paper by McMahan and four Google colleagues, published at the AISTATS conference in 2017. "We term this decentralized approach Federated Learning," the abstract says, describing a method that "leaves the training data distributed on the mobile devices" (arXiv). Its Federated Averaging algorithm cut the communication rounds needed "by 10-100x as compared to synchronized stochastic gradient descent," which is what made training over phone connections practical.

Phones don't train while you're using them. Google's 2017 post says training "happens only when the device is idle, plugged in, and on a free wireless connection," and Gboard's help page today says the same: charging, on Wi-Fi, and not in use (Gboard Help).

What stays on your device, and what leaves?

Your raw data stays, and what the model learned from it leaves. Gboard's help page puts it in one sentence: "Federated learning doesn't send the text you speak or type to Google, but will send what it learns to Google, where it will be combined with learnings from other users" (Gboard Help).

Google's speech models work the same way. Its Assistant help page says Google trains speech models "without sending your audio data to Google's servers," and that to make this possible, "we save your audio data on your device" (Google Assistant Help). The page sets federated learning beside two other methods, conventional learning on stored recordings and ephemeral learning, in which audio is held in a server's memory "for no more than a few minutes."

Federated learning keeps your data off the server, though it still lives on your device. Gboard's Personalize for you setting says "audio recordings and transcripts of what you say and type will be saved on this device," and Gboard's Delete learned words and data button clears them (Gboard Help).

Can federated learning updates leak your data?

They can, which is why Gboard and other large deployments add more protection. In a 2019 paper titled "Deep Leakage from Gradients," Ligeng Zhu, Zhijian Liu, and Song Han showed "it is possible to obtain the private training data from the publicly shared gradients," with recovery that was "pixel-wise accurate for images and token-wise matching for texts" (arXiv). Gradients are the raw form of the updates that federated learning sends.

The European Data Protection Supervisor's report on federated learning, published with Spain's data protection agency on June 10, 2025, names this as one of the technique's main unsolved problems. "An attacker could infer sensitive information by analysing the gradients or weights shared between devices," it says, which "opens the door to membership inference attacks" that reveal whether your data was in the training set (EDPS). It warns that the updates and the resulting models shouldn't be assumed to be "anonymous data."

The same report keeps the risk in proportion. Reconstructing training data from updates "will not be straightforward and in most cases may not be possible," it says, and federated learning carries "lower risks" than sharing full datasets.

The ICO's Innovation Hub drew the practical conclusion on November 28, 2024. "Federated learning does not prevent personal information from being shared through the output," its post says, and if an impact assessment finds that risk, "you should combine federated learning with other PETs," naming differential privacy, secure multiparty computation, homomorphic encryption, and TLS (ICO, via the UK government's RTA blog). Homomorphic encryption has its own explainer in what is homomorphic encryption.

How do secure aggregation and differential privacy help?

They hide each phone's individual update, and limit what the final model can memorize about any one person. Secure aggregation is the first layer. A 2017 Google paper describes a protocol that lets a server "compute the sum of large, user-held data vectors from mobile devices" while staying secure "even if an arbitrarily chosen subset of users drop out at any time" (IACR ePrint). Google's 2017 post says the server "can only decrypt the average update if 100s or 1000s of users have participated" (Google Research).

Differential privacy is the second layer, adding noise so the trained model can't reveal any one person's data. Google said on February 21, 2024 that "all NWP neural network LMs in Gboard are trained with FL with formal DP guarantees," and that secure aggregation was also used for its Spanish model in Spain and English model in the US (Google Research).

Gboard's 2023 white paper describes the goal as typing data that is "processed locally on device, to be aggregated as early as possible, and to have strong anonymization and differential privacy where possible," and looks ahead to trusted execution environments for the server side (arXiv). Apple's researchers describe the same pairing. At Apple's 2024 privacy workshop, they said "training data remains private on user devices" in private federated learning, while secure aggregation methods "prevent any server from seeing individual contributions" (Apple Machine Learning Research).

Where is federated learning used today?

Mostly inside phone features you may not know are learning from you. The table sets out what each company's own pages say, as read on November 3, 2026.

Google's September 9, 2021 announcement says Android "prevents any feature inside the Private Compute Core from having direct access to the network," and that features talk instead to Private Compute Services, "which strips out identifying information" and uses federated learning, federated analytics, and private information retrieval (Google Security Blog). Google said it would publish the services' source code for outside review.

Apple's best-known system for learning from keyboard and emoji data, described in a December 2017 research article, uses local differential privacy instead, under which "the server never sees or receives raw data," and never mentions federated learning (Apple Machine Learning Research).

The technique has moved well past keyboards. A 2024 paper by six Google researchers says "production systems from organizations like Google, Apple, and Meta" use it at the scale of "millions of devices," and proposes trusted execution environments to make its guarantees checkable (arXiv). We explain those enclaves in what is a trusted execution environment.

How do you turn off federated learning in Gboard?

On an Android phone, open Settings, tap System, then Language & input, then On-screen keyboard, then Gboard, then Privacy (Gboard Help). Google's help page lists the federated learning settings there and says you can turn it off "at any time." Improve for everyone is the setting that uses your typing and voice to improve recognition for all users, and Personalize for you improves it only for you.

Audio donations are a separate switch. Gboard may ask to send snippets of your dictation, up to 15 seconds each, to Google, which keeps them up to 18 months and lets "human reviewers" listen to some. Turn off Audio donations under Voice on the same Privacy screen. The help page adds that even if you don't donate snippets, "Google may still learn from your on-device data through federated learning."

Does ChatGPT use federated learning?

No. ChatGPT runs on OpenAI's servers, so your conversations are already there, and that's where training happens. OpenAI's help center says that on Free, Plus, and Pro, "we may use your content to train our models," unless you turn off Improve the model for everyone under Settings > Data controls (OpenAI). Even after you opt out, rating a reply with a thumbs up or down lets OpenAI use "the entire conversation associated with that feedback."

None of the OpenAI pages we read mention federated learning. Chatbots work the way Google's conventional learning does, on data held by the company, and every app's training switch is listed in which AI companies train on your data. Apple takes a different line for its own models. Its research page, updated September 9, 2026, says your private data and interactions are "never used to train our foundation models unless you explicitly choose to help improve them" (Apple Machine Learning Research).

Opting out later doesn't pull your words back out of a trained model, as what is machine unlearning explains.

How Morse keeps your chats out of AI training

Federated learning protects the training step, but a chatbot's problem starts earlier. To answer you, your words go to a server, and the company that holds them can train on them. Morse removes that second part. It doesn't train AI on your content, sell your data, or show ads (privacy policy), so there's no training switch to find.

Your history stays on your side too. Morse stores your chat history in your browser, encrypted, not on Morse's servers, which don't keep messages or log message content. Clearing your browser deletes your chats for good, and Morse can't recover them either, so keep a copy of anything you need.

What the model sees depends on the privacy mode you pick for each chat:

• E2EE, for words that only a verified enclave should read. Your browser checks the enclave's hardware attestation itself, then encrypts the message so only that enclave can read it, and Morse's servers relay ciphertext they can't read. It runs open-weight models like GLM, Kimi, and DeepSeek, and rests on the enclave hardware and attestation working as designed.
• Private, the default, for open-weight models and Grok on hosts that keep nothing. Morse has zero data retention agreements with its inference, search, and other providers. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• Anonymous, for GPT, Claude, and Gemini without the provider knowing it's you. Morse's proxy removes your account, email, and IP address before the message goes out under Morse's own account. The provider sees the text and may keep it for a limited time to check for abuse, under its own policy, so leave out details that identify you.

You can try a chat from the Morse home page without an account, or start free with no card. End-to-end encrypted chats come with Pro, at $19 a month.