Can AI agents share lessons without sharing private traces?
FedSkillGit replaced whole-document sharing with filtered rule-level patches and beat independent learning in nine benchmark combinations. Its privacy evidence measured an AI audit, not resistance to extraction attacks.
The short version
3 key points
- 1.Ten simulated clients shared patches, not raw traces, across SearchQA, LiveMath and DocVQA using three model families.
- 2.FedSkillGit beat independent local evolution in all nine model-dataset cells by 1.6 to 10.1 percentage points, with a mean gain of 4.3 points.
- 3.The privacy test asked an AI auditor whether payloads passed after sanitisation; it did not measure memorisation, reconstruction or adversarial leakage.
The shared object was a rule change, not a work transcript
A China-based research team tested a way for agents owned by different organisations to learn from one another without pooling their raw tasks. Each selected client ran a shared natural-language skill document against its local examples, proposed a bounded patch to named rules and summarised what it had learned. A sanitizer replaced client-specific entities, paths and identifiers; a second AI auditor decided whether the edited payload could leave the client.[1]
Who it affects
If the design survives stronger privacy testing, hospitals, public agencies or firms could improve common agent guidance without pooling raw records; if it leaks, the shared patch itself could expose the people or workflows it was meant to protect.[1]
Keep in mind
Unreviewed preprint; simulated ten-client benchmark; three datasets and three model families; AI-defined privacy audit rather than adversarial leakage testing; no real organisational deployment or personalisation layer.
Source analysis · 1 linked source. Original source date: 15 October 2026.
Read more The full report, methods and context
The shared object was a rule change, not a work transcript
A China-based research team tested a way for agents owned by different organisations to learn from one another without pooling their raw tasks. Each selected client ran a shared natural-language skill document against its local examples, proposed a bounded patch to named rules and summarised what it had learned. A sanitizer replaced client-specific entities, paths and identifiers; a second AI auditor decided whether the edited payload could leave the client.
The server deduplicated accepted patches, recorded earlier failures in a global experience document and merged a candidate skill. Clients then scored that candidate on their own validation sets. The new version was published only if its aggregate task-success rate did not fall. This version-control framing is useful because it makes proposed knowledge changes smaller and more traceable than uploading an entire rewritten instruction document.[1]
Nine comparisons improved, but centralisation still set the reference
The experiment simulated ten clients with three participating in each round. It used SearchQA for open-domain questions, LiveMath for research-level multiple-choice mathematics and DocVQA for questions about documents. The executor families were GPT-5.4-mini, Qwen3.5-flash and Gemini3-flash. Against clients evolving skills independently, FedSkillGit improved all nine model-dataset combinations by 1.6 to 10.1 percentage points, averaging 4.3 points.
Results were mixed against pooled training, the stronger reference. The median gap to the centralised method was minus 0.8 points, but FedSkillGit led in only two of nine cells. It also beat a one-shot whole-document merge in every cell. On one ablation—GPT-5.4-mini with SearchQA—removing the accumulated experience from training or merging reduced task success from 78.6% to 76.9% or 77.2%. These are benchmark outcomes, not evidence that a company can safely combine real employees' or customers' work histories.[1]
The distinction that matters
How one shared skill version moved between clients
Raw local tasks stayed put; filtered edits and validation scores crossed the boundary.
Local
Run tasks and draft rule patches
Raw traces stay with the client
Filter
Sanitize and audit each commit
Only accepted patches are shared
Validate
Clients score the merged candidate
Keep or roll back the version
Passing an AI privacy audit is not a privacy guarantee
With the sanitizer enabled, 81% of payloads passed the paper's AI audit on the first attempt, compared with 33% without it. That shows the sanitizer made messages conform more often to the authors' privacy rubric. It does not show that secrets could not be reconstructed, that rare identifiers were removed reliably, or that a malicious client or server could not manipulate the process. The study reports no differential-privacy bound, human red-team evaluation or attack-based leakage rate.
The preprint also evolves one shared document, so it does not personalise rules for clients with genuinely different needs. Automatic task evaluators decide whether a version is accepted, which may be unavailable for open-ended professional work. The authors are at East China Normal University and Shandong University; the accessible manuscript states no funding or competing interests. For organisations, the proposal is a testable architecture, not permission to share sensitive experience. Confidence would require adversarial privacy audits, real multi-owner pilots, human review of patches and comparison with stronger technical privacy controls.[1]
Watch the background, then check the evidence
The Royal Society
YouTube loads only when you choose. Press play in the player to start. If playback is unavailable, use “Watch on YouTube” below.
AI basics · Background explainer
Published 2018-11-28 · 2 min 31 sec
What is artificial intelligence? | The Royal Society
A short introduction to artificial intelligence from the Royal Society. Start here for basic concepts, then use current reporting to explore what has changed.
Evidence check: Published in 2018, before today’s generative AI tools. Useful for basic concepts, rather than an overview of current capabilities.
Source checked 14 October 2026. Check available captions on the publisher’s video page.
Evidence check
Unreviewed preprint; simulated ten-client benchmark; three datasets and three model families; AI-defined privacy audit rather than adversarial leakage testing; no real organisational deployment or personalisation layer.
Reporting basis: Source analysis. Original source date: 15 October 2026.
Explore the full source and evidence record
What this means for people
- If the design survives stronger privacy testing, hospitals, public agencies or firms could improve common agent guidance without pooling raw records; if it leaks, the shared patch itself could expose the people or workflows it was meant to protect.
Global context
The experiments were run by two Chinese universities on widely used English-language benchmarks and global model families. Legal duties, language, task distributions and acceptable information sharing differ across organisations and countries.
What the evidence does not yet show
- Unreviewed preprint; simulated ten-client benchmark; three datasets and three model families; AI-defined privacy audit rather than adversarial leakage testing; no real organisational deployment or personalisation layer.
What to watch next
- Independent reproduction, extraction and membership-inference attacks on patches, human privacy review, multi-language tasks, heterogeneous organisations and comparisons with differential privacy or secure aggregation.
Living evidence record
Impact record IAI-08Z3ZJ6
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
17 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what arXiv published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 17 October 2026
Research question, topics and regions
Whether multiple AI agents can improve a shared natural-language skill document through filtered rule-level patches while keeping raw local task traces with each data owner
Topics: AI agents · Federated learning · Privacy · Skill documents · Benchmarking
Regions: China · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
The Impact Brief · Free
Keep following the stories that matter to you.
Get our weekday briefing on what changed and why it matters. Choose your topics below.
Continue the story
There’s more to this story
Technology
Can sparse federated learning cut IoT communication without losing accuracy?
A peer-reviewed benchmark reports communication reductions of up to 477-fold for a hierarchical federated-learning method while remaining near strong accuracy baselines. The tests used stored sensor datasets and simulated client hierarchies—not a live device fleet or a privacy audit.
3 min · 2 sources
Technology
Why do multi-agent AI systems keep failing?
An unreviewed analysis of 22,848 closed issues across 21 prominent open-source projects identified 944 genuine multi-agent problems. Handoffs, execution control and memory dominated—but repository reports cannot establish failure rates in production systems.
2 min · 3 sources
Technology
Meta’s Muse gains downloads while Amazon challenges its shopping access
A third-party estimate puts the agent at 2.8 million downloads in its first 12 days. Amazon says the service was not authorised to access its store, raising questions about consent and credentials.
2 min · 2 sources
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.