Federated learning trains a shared AI model by letting each phone learn from its own data and send back only a summary of what changed, called a model update. Your raw typing or photos stay on the device. It’s more private than uploading your data, but something does still leave your phone, and that’s the part most explainers skip.
Google’s Gboard keyboard is the best-known example. Here’s how the system works and where its protection ends.
How does federated learning work? #
Google described the process when it introduced federated learning for Gboard in 2017. The cycle looks like this:
- The server sends the current model to many phones.
- Each phone trains it on local data. For Gboard that meant learning from which query suggestions you tapped. Google said phones only train when idle, plugged in and on a free Wi-Fi connection, so you don’t notice.
- The phone sends back an encrypted update. That’s a small set of numeric changes to the model, not your text.
- The server averages updates from many phones. With secure aggregation, the server can only decrypt the average once hundreds or thousands of phones have contributed. It never sees one person’s update on its own.
- The improved model goes out to everyone, and the cycle repeats.
The model travels to the data instead of the data traveling to the model.
What does federated learning protect, and what doesn’t it? #
| Risk | Does federated learning help? |
|---|---|
| Your raw text or photos sitting on a company server | Yes. They aren’t uploaded for training |
| The server inspecting your individual update | Largely, when secure aggregation is used |
| Clever attacks that infer data from updates | Partly. Adding differential privacy (random noise) makes this much harder |
| The final model memorizing a rare phrase you typed | Partly, again with differential privacy |
| The same app collecting data in other ways | No. Analytics, crash reports and cloud features are separate |
| Features that send your request to a server to answer it | No. Federated learning is about training, not answering |
That last row catches people out. A keyboard can train with federated learning and still send a search query to the cloud when you use its search feature. The two are different systems.
Federated learning vs differential privacy #
The two often appear together, which blurs them.
- Federated learning decides where the training happens: on your phone.
- Differential privacy adds carefully calibrated noise so no single person’s contribution can be picked out of the result.
Apple leans on differential privacy for things like learning which new words and emoji are popular without tying them to anyone, and Google has combined both techniques in Gboard. Either one reduces what a company learns about you. Neither means nothing leaves your phone.
Federated learning vs a model that runs entirely on your phone #
It’s easy to assume “on-device AI” and “federated learning” mean the same thing. They don’t.
| Cloud chatbot | Federated learning feature | Local AI model app | |
|---|---|---|---|
| Where your request is answered | Company server | Usually on the phone | On the phone |
| Is your content uploaded? | Yes | No, but model updates are | No |
| Does the model learn from you? | Possibly, depending on settings | Yes, in aggregate | No |
| Gets better over time on its own | Yes | Yes | Only when you download a newer model |
A local model app sits at the far end of that table. Personal LLM runs open models such as Qwen 3.5 and Gemma 4 on your phone’s chip, and it doesn’t train on your chats at all. The model file you download stays exactly as it was, and the app has no server to send updates to. The network is only used to fetch the model file once from Hugging Face and to load ads while you’re online.
The trade-off is that a fixed model won’t improve from your usage. If you want it to know your preferences, you tell it directly with a system prompt, which we walk through in how to personalize an AI chatbot without sharing your data.
Where is federated learning used on phones? #
Public examples are fewer than the hype suggests:
- Keyboard suggestions. Gboard’s next-word and query suggestions are the textbook case.
- Personalization features that adapt to how people use a phone, such as suggestion ranking. Companies rarely document which exact features use it.
- Research and healthcare, where hospitals train shared models without pooling patient records. That’s outside your phone but uses the same idea.
If you want to know whether a specific app sends your data anywhere, the practical tests in how to check if an AI app is really private tell you more than a marketing page.
Should you turn off features that use federated learning? #
For most people, no. Federated learning is one of the more privacy-respecting ways to improve a product, and turning it off mostly means your usage stops contributing to the next version.
If you’d rather opt out anyway, look in the keyboard or system privacy settings for options about sharing usage data or helping improve the product. On an iPhone, the Analytics & Improvements section under Privacy & Security covers Apple’s data sharing, including differential-privacy data.
The bigger privacy win is usually elsewhere: deciding which apps send your actual content to a server. Our explainer on what on-device AI is and why it matters covers that.
Frequently asked questions #
Is federated learning actually private? #
It’s more private than uploading your data, because raw content stays on the phone and only model updates are sent. Updates can still leak some information in theory, which is why well-built systems add secure aggregation and differential privacy. It reduces what the company learns but doesn’t bring it to zero.
Does Gboard send what I type to Google? #
For training its suggestion models, Google says Gboard uses federated learning, which sends model updates rather than your keystrokes. Other Gboard features, like search or cloud voice typing, can send content to Google when you use them. Check Gboard’s privacy settings for the options on your phone.
What’s the difference between federated learning and differential privacy? #
Federated learning keeps training on the device and sends only updates. Differential privacy adds statistical noise so no individual can be identified in the combined result. They solve different problems and are often used together.
Do local AI chat apps use federated learning? #
Apps that run a fixed open model on your phone generally don’t train on your chats at all, federated or otherwise. The model only changes when you download a different one, so your conversations aren’t used to improve anything.