Can AI agents share lessons without sharing private traces?
FedSkillGit replaced whole-document sharing with filtered rule-level patches and beat independent learning in nine benchmark combinations. Its privacy evidence measured an AI audit, not resistance to extraction attacks.
The short version
- What happened
- Ten simulated clients shared patches, not raw traces, across SearchQA, LiveMath and DocVQA using three model families.
- Who it affects
- If the design survives stronger privacy testing, hospitals, public agencies or firms could improve common agent guidance without pooling raw records; if it leaks, the shared patch itself could expose the people or workflows it was meant to protect.
- What remains unproven
- Unreviewed preprint; simulated ten-client benchmark; three datasets and three model families; AI-defined privacy audit rather than adversarial leakage testing; no real organisational deployment or personalisation layer.
Keep in mind
Unreviewed preprint; simulated ten-client benchmark; three datasets and three model families; AI-defined privacy audit rather than adversarial leakage testing; no real organisational deployment or personalisation layer.
Source analysis · 1 linked source. Primary analysed source date: 15 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The shared object was a rule change, not a work transcript
A China-based research team tested a way for agents owned by different organisations to learn from one another without pooling their raw tasks. Each selected client ran a shared natural-language skill document against its local examples, proposed a bounded patch to named rules and summarised what it had learned. A sanitizer replaced client-specific entities, paths and identifiers; a second AI auditor decided whether the edited payload could leave the client.
The server deduplicated accepted patches, recorded earlier failures in a global experience document and merged a candidate skill. Clients then scored that candidate on their own validation sets. The new version was published only if its aggregate task-success rate did not fall. This version-control framing is useful because it makes proposed knowledge changes smaller and more traceable than uploading an entire rewritten instruction document.[1]
Nine comparisons improved, but centralisation still set the reference
The experiment simulated ten clients with three participating in each round. It used SearchQA for open-domain questions, LiveMath for research-level multiple-choice mathematics and DocVQA for questions about documents. The executor families were GPT-5.4-mini, Qwen3.5-flash and Gemini3-flash. Against clients evolving skills independently, FedSkillGit improved all nine model-dataset combinations by 1.6 to 10.1 percentage points, averaging 4.3 points.
Results were mixed against pooled training, the stronger reference. The median gap to the centralised method was minus 0.8 points, but FedSkillGit led in only two of nine cells. It also beat a one-shot whole-document merge in every cell. On one ablation—GPT-5.4-mini with SearchQA—removing the accumulated experience from training or merging reduced task success from 78.6% to 76.9% or 77.2%. These are benchmark outcomes, not evidence that a company can safely combine real employees' or customers' work histories.[1]
The distinction that matters
How one shared skill version moved between clients
Raw local tasks stayed put; filtered edits and validation scores crossed the boundary.
Local
Run tasks and draft rule patches
Raw traces stay with the client
Filter
Sanitize and audit each commit
Only accepted patches are shared
Validate
Clients score the merged candidate
Keep or roll back the version
Passing an AI privacy audit is not a privacy guarantee
With the sanitizer enabled, 81% of payloads passed the paper's AI audit on the first attempt, compared with 33% without it. That shows the sanitizer made messages conform more often to the authors' privacy rubric. It does not show that secrets could not be reconstructed, that rare identifiers were removed reliably, or that a malicious client or server could not manipulate the process. The study reports no differential-privacy bound, human red-team evaluation or attack-based leakage rate.
The preprint also evolves one shared document, so it does not personalise rules for clients with genuinely different needs. Automatic task evaluators decide whether a version is accepted, which may be unavailable for open-ended professional work. The authors are at East China Normal University and Shandong University; the accessible manuscript states no funding or competing interests. For organisations, the proposal is a testable architecture, not permission to share sensitive experience. Confidence would require adversarial privacy audits, real multi-owner pilots, human review of patches and comparison with stronger technical privacy controls.[1]