[v3.3] Private learning and global language release plan #3195

Outcome

Private learning, synthetic data, and global languages: federated and differentially private training, secure aggregation, privacy-safe synthetic corpora, low-resource clinical languages, governance, and reproducible promotion evidence.

This issue is the release-level source of truth. Milestone membership, the workstream inventory below, and existing GitHub sub-issue and dependency relationships define release scope. The coverage-audit additions are independently developable milestone issues; related-work references do not create blocking dependencies. Open work is not silently ignored: it must close or move to a named later milestone with rationale before release.

Entry criteria

• v3.2 is released and its multimodal privacy, provenance, and device evidence contracts are stable.
• The P0 release slice, federated threat model, initial language cohort, and synthetic-data governance boundaries are reviewed and frozen in the release epic.

Workstreams

• Federated execution, differential privacy, secure aggregation, and air-gapped operation: Define a federated client capability envelope #2821, Create immutable federated round manifests #2822, Implement a local-only federated adapter trainer #2823, Enforce a federated update parameter allowlist #2824, Add deterministic client-update clipping #2825, Build a round-aware Renyi privacy accountant #2826, Allocate privacy budgets across participating sites #2827, Implement pairwise masked secure-aggregation shares #2828, Recover secure aggregation from client dropout #2829, Verify commitments for federated aggregates #2830, Score federated contributions without inspecting examples #2831, Add poisoning-resistant adapter aggregation #2832, Simulate non-IID clinical federation partitions #2833, Define transparent site weighting policies #2834, Track federated checkpoint ancestry #2835, Replay federated rounds with synthetic clients #2836, Package federated rounds for air-gapped sites #2837
• Synthetic notes, records, documents, images, waveforms, and release capsules: Create composable clinical note grammars #2838, Generate coherent longitudinal patient trajectories #2839, Generate referentially valid synthetic FHIR records #2840, Build synthetic OMOP cohort tables #2841, Generate synthetic prior-authorization packets #2842, Generate physiologically constrained lab time series #2843, Generate coherent synthetic medication courses #2844, Create rare-case privacy stress generators #2845, Generate code-switched clinical dialogues #2846, Generate synthetic patient-intake conversations #2847, Render synthetic clinical documents with layout truth #2848, Generate synthetic DICOM pixel overlays and metadata #2849, Generate privacy-safe clinical waveform records #2850, Define provenance for synthetic image-text pairs #2851, Score synthetic clinical fidelity without real-record release #2852, Audit generators for memorized clinical fragments #2853, Package synthetic datasets with reproducible release capsules #2854
• Low-resource and code-switched clinical languages: Create a clinical language readiness registry #2855, Audit tokenization quality across clinical scripts #2856, Build provenance-aware clinical transliteration graphs #2857, Mine clinical abbreviations from local unlabeled text #2858, Preserve clinical labels through rich morphology #2859, Project spans across code-switch boundaries #2860, Guard clinical terminology during local translation #2861, Build cross-lingual pseudo-label consensus #2862, Prioritize scarce labels for native review #2863, Export privacy-safe native reviewer packets #2864, Report uncertainty for small language slices #2865, Package low-connectivity clinical language bundles #2866, Add dialect-aware fallback and abstention #2867, Distill language adapters into edge models #2868, Gate multilingual parallel corpora by license and lineage #2869, Gate cross-lingual transfer regressions #2870
• Federation governance, independent evaluation, evidence, drift, and promotion: Validate machine-readable federation charters #2871, Compile private-training data-use policies #2872, Record consent withdrawal across private rounds #2873, Maintain a privacy-safe contribution ledger #2874, Emit signed evidence for private training rounds #2875, Run sealed evaluation at independent clinical sites #2876, Detect private cross-site model drift #2877, Lock reproducible private-training environments #2878, Generate deployment-specific private-learning threat reports #2879, Gate promotion of privately improved models #2880
• Private-learning metadata, preflight, schemas, CLIs, and readiness matrices: Model valid lifecycle transitions for federated training rounds #2958, Render privacy-safe federated round progress summaries #2959, Validate federated round scheduling windows #2981, Compare federated client capabilities with round requirements #2982, Validate content-free metadata for federated model updates #3010, Validate privacy-safe aggregate metric envelopes #3011, Build fail-closed preflight reports for federated rounds #3012, Audit private-training artifacts for forbidden client data #3013, Export JSON Schemas for private-training metadata #3054, Fingerprint federated update schemas without tensor values #3055, Batch-check anonymous federated update metadata #3056, Add an offline self-check for private-learning artifacts #3057, Validate machine-readable differential-privacy budget policies #3096, Summarize privacy-budget consumption without site identifiers #3097, Preflight secure-aggregation quorum and dropout bounds #3098, Validate synthetic-dataset license and lineage manifests #3099, Render a clinical language-pack readiness matrix #3100, Diff clinical language-pack coverage manifests across releases #3101, Generate deterministic synthetic federation metadata fixtures #3102, Add an offline locale-pack conformance CLI #3103, Normalize SPDX license identifiers in synthetic lineage manifests #3120, Export JSON Schema for differential-privacy budget policies #3121, Add golden Markdown fixtures for language readiness matrices #3122, Add forbidden-field fixtures for private-learning metadata #3123
• Release assurance and integration: Publish and review the federated-learning threat model and protocol profile #3209, Implement federated site identity, enrollment, transport, rotation, and revocation #3210, Run a multi-node synthetic federation acceptance and chaos suite #3211, Pre-register a clinical differential-privacy utility study #3212, Define the first low-resource clinical language cohort and graduation contract #3213, Add synthetic-artifact labeling, bias, contamination, and withdrawal controls #3214, Publish the private-learning compatibility and schema-migration matrix #3215

Scope policy

• P0 is the release-blocking slice and must close before stabilization.
• P1 is targeted scope; unfinished work must move to a named later milestone with rationale before stabilization.
• P2 is enabling or contributor scope and blocks release only through an explicit GitHub dependency.
• Priority or size changes require rationale in this release epic; they must not be used to hide incomplete safety work.

Architecture

• Extend openmed/training/federated, openmed/training/synthetic, openmed/compliance, openmed/clinical, and openmed/eval.
• Public APIs must have compatibility tests, migration guidance, and synchronized platform documentation.
• Core behavior stays offline-friendly, deterministic, permissively licensed, and free of raw PHI in logs or artifacts.

Supported surfaces

• Python library and CLI are the required trainer, client, coordinator, and evaluation surfaces.
• Metadata and evidence schemas must remain interoperable for air-gapped and out-of-process implementations.
• Swift, Android, and REST training surfaces are outside v3.3 unless a dedicated issue adds compatibility, privacy, and release-gate evidence.

Release definition of done

• The approved MVP is complete; non-MVP work is moved to a named later milestone before release.
• The reviewed protocol profile, site lifecycle, multi-node chaos suite, DP utility study, language cohort, and synthetic release controls pass.
• No private-learning model is promoted unless all privacy, leakage, utility, language, drift, lineage, and evidence gates pass separately.
• Release notes, migration guidance, API/protocol diff, security/privacy evidence, and an exact-SHA release-candidate manifest are complete.

Schedule

The target date is intentionally unset until the entry criteria pass. Release order is v3.1, then v3.2, then v3.3.

Release authority

Tagging, publishing, and creating a GitHub release require separate explicit authorization after an exact-SHA release-candidate audit.

Coverage audit — 2026-10-03

The additions connect private-learning contracts to durable execution, model-update privacy mechanisms, accountant persistence, valid secure-aggregation profiles, synthetic dataset builds and offline language-bundle activation.

These are bounded implementation or validation issues with their own acceptance evidence and offline test seams. Track them directly in this milestone. No new umbrella issue, blocker label, blocking dependency, or assignee was introduced by this audit. P1/P2 scheduling follows the existing scope policy; privacy, compatibility and qualification gates remain in force.

Independent additions

• Implement a durable federated round coordinator over the existing contracts #3685 — Implement a durable federated round coordinator over the existing contracts (P1)
• Apply a declared differential-privacy mechanism to federated model updates #3686 — Apply a declared differential-privacy mechanism to federated model updates (P1)
• Checkpoint composed privacy-accountant state without rolling back spent budget #3687 — Checkpoint composed privacy-accountant state without rolling back spent budget (P1)
• Reject incompatible secure-aggregation and robustness mechanism combinations #3688 — Reject incompatible secure-aggregation and robustness mechanism combinations (P1)
• Encode secure-aggregation tensors with bounded fixed-point arithmetic #3689 — Encode secure-aggregation tensors with bounded fixed-point arithmetic (P1)
• Apply accepted federated adapters transactionally to local model generations #3690 — Apply accepted federated adapters transactionally to local model generations (P1)
• Resume local federated training without exporting private optimizer state #3691 — Resume local federated training without exporting private optimizer state (P1)
• Split synthetic datasets by patient trajectory and generator lineage #3692 — Split synthetic datasets by patient trajectory and generator lineage (P1)
• Compose synthetic clinical generators into a reproducible dataset build CLI #3693 — Compose synthetic clinical generators into a reproducible dataset build CLI (P1)
• Validate cross-artifact truth alignment in synthetic clinical datasets #3694 — Validate cross-artifact truth alignment in synthetic clinical datasets (P1)
• Activate qualified offline language bundles through the language-pack registry #3695 — Activate qualified offline language bundles through the language-pack registry (P1)
• Merge native-review language labels through explicit adjudication revisions #3696 — Merge native-review language labels through explicit adjudication revisions (P1)
• Control repeated disclosure of federated evaluation metrics #3697 — Control repeated disclosure of federated evaluation metrics (P1)
• Add local operator commands for federated round lifecycle and evidence #3698 — Add local operator commands for federated round lifecycle and evidence (P1)

This audit creates development work only; it does not certify implementation completeness, qualify a model or authorize tagging, package publication, deployment or a GitHub release.

Coverage audit — 2026-10-03 (round 2)

The private-learning additions cover a site-side round runner, low-rank LoRA aggregation, secret Poisson participant sampling, patient-level DP-SGD, tensor digest binding, label-coverage masking, committed holdouts, update purging, quantized recall gates, a signed private-learning gate and federated documentation and tooling. The language and synthetic-data additions cover locale medical-record labels, non-Gregorian calendar detection and shifting, native digit systems in surrogates, source-script surrogates and honorifics, a live surrogate-quality gate, Zawgyi and Sinhala routes, synthetic HL7 v2, C-CDA and locale generators, glyph-coverage checks and contributor fixtures.

These are bounded implementation or validation issues with their own acceptance evidence and offline test seams. Track them directly in this milestone. No new umbrella issue, blocker label, blocking dependency, or assignee was introduced by this audit. P1/P2 scheduling follows the existing scope policy; privacy, compatibility and qualification gates remain in force.

Independent additions

• Implement a fail-closed federated client round runner over the existing contracts #3846 — Implement a fail-closed federated client round runner over the existing contracts (P1)
• Aggregate federated LoRA updates in the low-rank product space #3847 — Aggregate federated LoRA updates in the low-rank product space (P1)
• Select round participants by secret Poisson sampling before claiming amplification #3848 — Select round participants by secret Poisson sampling before claiming amplification (P1)
• Add patient-level DP-SGD for single-site adapter fine-tuning #3849 — Add patient-level DP-SGD for single-site adapter fine-tuning (P1)
• Bind declared federated update digests to canonical tensor payload bytes #3850 — Bind declared federated update digests to canonical tensor payload bytes (P1)
• Declare per-site label coverage and mask unannotated labels in federated training #3851 — Declare per-site label coverage and mask unannotated labels in federated training (P1)
• Evaluate the v3.3 private-learning release gate into a signed evidence packet #3852 — Evaluate the v3.3 private-learning release gate into a signed evidence packet (P1)
• Charge privacy budget for private hyperparameter and checkpoint selection #3853 — Charge privacy budget for private hyperparameter and checkpoint selection (P1)
• Verify a consistent signed round roster before releasing secure-aggregation shares #3854 — Verify a consistent signed round roster before releasing secure-aggregation shares (P1)
• Reject site weighting that breaks the declared DP sensitivity bound #3855 — Reject site weighting that breaks the declared DP sensitivity bound (P1)
• Pool federated evaluation counts without revealing per-site metrics #3856 — Pool federated evaluation counts without revealing per-site metrics (P1)
• Commit patient-level site holdout splits before federated training starts #3857 — Commit patient-level site holdout splits before federated training starts (P1)
• Purge per-client update payloads and local training caches after round commitment #3858 — Purge per-client update payloads and local training caches after round commitment (P1)
• Gate private-model candidates on quantized-deployment recall deltas #3859 — Gate private-model candidates on quantized-deployment recall deltas (P1)
• Calibrate distributed client noise to the secure-aggregation dropout bound #3860 — Calibrate distributed client noise to the secure-aggregation dropout bound (P1)
• Hold checkpoints derived from updates signed by a compromised site key #3861 — Hold checkpoints derived from updates signed by a compromised site key (P1)
• Recognize localized medical-record-number labels in deterministic detection #3862 — Recognize localized medical-record-number labels in deterministic detection (P1)
• Generate Arabic and Amharic surrogates in their source script and locale #3863 — Generate Arabic and Amharic surrogates in their source script and locale (P1)
• Add deterministic Nepali identifier, phone and date patterns for the ne route #3864 — Add deterministic Nepali identifier, phone and date patterns for the ne route (P1)
• Detect Hausa, Yoruba, Igbo and Kinyarwanda month-name dates #3865 — Detect Hausa, Yoruba, Igbo and Kinyarwanda month-name dates (P1)
• Detect Hijri, Ethiopian, Bikram Sambat and Hebrew-calendar month-name dates #3866 — Detect Hijri, Ethiopian, Bikram Sambat and Hebrew-calendar month-name dates (P1)
• Shift Solar Hijri, Ethiopian and Thai Buddhist-era dates within their own calendar #3867 — Shift Solar Hijri, Ethiopian and Thai Buddhist-era dates within their own calendar (P1)
• Fail burned-in synthetic renders that lack glyph coverage or script shaping #3868 — Fail burned-in synthetic renders that lack glyph coverage or script shaping (P1)
• Generate locale PHI synthetic notes for national-ID-only and user-model languages #3869 — Generate locale PHI synthetic notes for national-ID-only and user-model languages (P1)
• Score live surrogate quality for every registered language pack #3870 — Score live surrogate quality for every registered language pack (P1)
• Render surrogates and shifted dates in the source span's digit system #3871 — Render surrogates and shifted dates in the source span's digit system (P1)
• Render differential-privacy and federation disclosures in model cards #3872 — Render differential-privacy and federation disclosures in model cards (P2)
• Refuse federated updates from sites below minimum local example and step floors #3873 — Refuse federated updates from sites below minimum local example and step floors (P2)
• Require site approval of a value-free egress report before submitting an update #3874 — Require site approval of a value-free egress report before submitting an update (P2)
• Harden aggregate DP noise sampling against floating-point attacks #3875 — Harden aggregate DP noise sampling against floating-point attacks (P2)
• Apply aggregated adapter deltas through a declared server optimizer #3876 — Apply aggregated adapter deltas through a declared server optimizer (P2)
• Add an optional Flower strategy bridge behind the federated update contracts #3877 — Add an optional Flower strategy bridge behind the federated update contracts (P2)
• Tolerate bounded clock skew between federated sites and the coordinator #3878 — Tolerate bounded clock skew between federated sites and the coordinator (P2)
• Expose sealed private-model evaluation through a local CLI command #3879 — Expose sealed private-model evaluation through a local CLI command (P2)
• Fuzz private-learning metadata parsers in the property-based suite #3880 — Fuzz private-learning metadata parsers in the property-based suite (P2)
• Group private-learning docs under one navigation section with an overview #3881 — Group private-learning docs under one navigation section with an overview (P2)
• Add an offline walkthrough of a metadata-only federated round #3882 — Add an offline walkthrough of a metadata-only federated round (P2)
• Record value-free telemetry for federated round phases #3883 — Record value-free telemetry for federated round phases (P2)
• Generate synthetic HL7 v2 messages with field-level PHI truth #3884 — Generate synthetic HL7 v2 messages with field-level PHI truth (P2)
• Generate synthetic C-CDA documents with element-level PHI truth #3885 — Generate synthetic C-CDA documents with element-level PHI truth (P2)
• Add native-digit and native-calendar date variants to locale PHI generation #3886 — Add native-digit and native-calendar date variants to locale PHI generation (P2)
• Preserve honorifics, gender cues and name order in non-CJK person surrogates #3887 — Preserve honorifics, gender cues and name order in non-CJK person surrogates (P2)
• Shift Hijri and Bikram Sambat dates through bounded calendar tables #3888 — Shift Hijri and Bikram Sambat dates through bounded calendar tables (P2)
• Detect and convert Zawgyi-encoded Burmese text before script routing #3889 — Detect and convert Zawgyi-encoded Burmese text before script routing (P2)
• Add a user-supplied-model Sinhala route with Sri Lanka NIC detection #3890 — Add a user-supplied-model Sinhala route with Sri Lanka NIC detection (P2)
• Use local address conventions in African language-pack surrogates #3891 — Use local address conventions in African language-pack surrogates (P2)
• Generate pronounceable aksara-based Devanagari and Telugu name surrogates #3892 — Generate pronounceable aksara-based Devanagari and Telugu name surrogates (P2)
• Record surrogate-provider versions and detect drift in seeded synthetic corpora #3893 — Record surrogate-provider versions and detect drift in seeded synthetic corpora (P2)
• Extend per-language date and ID trap fixtures to low-resource language packs #3894 — Extend per-language date and ID trap fixtures to low-resource language packs (P2)
• Export JSON Schemas for synthetic training-data records #3895 — Export JSON Schemas for synthetic training-data records (P2)
• Document the synthetic training-data generators already on master #3896 — Document the synthetic training-data generators already on master (P2)

This audit creates development work only; it does not certify implementation completeness, qualify a model or authorize tagging, package publication, deployment or a GitHub release.

Milestone adjustment — 2026-10-04

#2848, #2849 and #2850 moved to v3.2 (#3194), whose OpenPHI-Vision, validation-pack and ECG gates need those synthetic generators first. They remain part of the synthetic-data workstream; scope and acceptance criteria are unchanged.