What are the key takeaways from this Practical AI episode?

Key insights include: **Privacy boundary in Federated Learning:** The core privacy guarantee is that raw data never leaves its source device — no interception, no centralized exposure. The remaining risk is model memorization, addressed through differential privacy techniques. However, these statistical guarantees are case-dependent; some enterprise deployments abandon Federated Learning entirely when the privacy math does not work for their specific setup.; **Agentic trajectories as training data:** Agentic AI systems produce branching, tree-structured trajectories — initial prompt, sub-agent calls, tool outputs, retrieved documents — that compound private user information at every step. These trajectories reveal failure modes invisible in single-model evaluations. Organizations that capture and control these logs can diagnose exactly where agents break and retrain on real usage patterns rather than synthetic data.; **Open-weight models for privacy-sensitive applications:** When building applications that handle sensitive data, open-weight models provide two concrete advantages over closed-source alternatives: a broader set of probing and auditing techniques to detect unwanted memorization, and the ability to directly patch identified vulnerabilities. Closed-source APIs offer no equivalent remediation path if a privacy flaw is discovered post-deployment.

What did Lorenzo Sani discuss on Practical AI?

Lorenzo Sani, research scientist at Flower Labs and Cambridge PhD candidate, explains how Federated Learning enables AI training on private, distributed data without centralizing it, and how this technology applies directly to Agentic AI systems that generate sensitive user trajectories across multi-step, branching workflows. Key topics include: **Privacy boundary in Federated Learning:** The core privacy guarantee is that raw data never leaves its source device — no interception, no centralized exposure. The remaining risk is model memorization, addressed through differential privacy techniques. However, these statistical guarantees are case-dependent; some enterprise deployments abandon Federated Learning entirely when the privacy math does not work for their specific setup.; **Agentic trajectories as training data:** Agentic AI systems produce branching, tree-structured trajectories — initial prompt, sub-agent calls, tool outputs, retrieved documents — that compound private user information at every step. These trajectories reveal failure modes invisible in single-model evaluations. Organizations that capture and control these logs can diagnose exactly where agents break and retrain on real usage patterns rather than synthetic data..

How long is this episode of Practical AI?

This episode is 43 minutes long. SignalCast provides an AI-generated summary so you can get the key insights in about 3 minutes.

Practical AI

Implementing Federated Learning to enhance Agentic AI

November 13, 2026

43 min episode · 2 min read

Lorenzo Sani

Episode

43 min

Read time

2 min

Topics

Remote Work, Investing, Fundraising & VC

AI-Generated Summary

Published Nov 13, 2026

Key Takeaways

✓Privacy boundary in Federated Learning: The core privacy guarantee is that raw data never leaves its source device — no interception, no centralized exposure. The remaining risk is model memorization, addressed through differential privacy techniques. However, these statistical guarantees are case-dependent; some enterprise deployments abandon Federated Learning entirely when the privacy math does not work for their specific setup.
✓Agentic trajectories as training data: Agentic AI systems produce branching, tree-structured trajectories — initial prompt, sub-agent calls, tool outputs, retrieved documents — that compound private user information at every step. These trajectories reveal failure modes invisible in single-model evaluations. Organizations that capture and control these logs can diagnose exactly where agents break and retrain on real usage patterns rather than synthetic data.
✓Open-weight models for privacy-sensitive applications: When building applications that handle sensitive data, open-weight models provide two concrete advantages over closed-source alternatives: a broader set of probing and auditing techniques to detect unwanted memorization, and the ability to directly patch identified vulnerabilities. Closed-source APIs offer no equivalent remediation path if a privacy flaw is discovered post-deployment.
✓Smaller models, bigger deployment scale: Model capability per parameter is rising while cost and size fall, meaning capable models are now deployable on local infrastructure rather than requiring cloud APIs. This shift makes self-hosted Agentic pipelines viable for individuals and enterprises alike, and increases the strategic value of owning trajectory data rather than routing it through third-party providers who do not return full reasoning traces.
✓Collaborative learning for physical AI systems: In domains like surgical robotics, where every patient anatomy differs and simulation cannot fully substitute for real procedures, Federated Learning allows multiple hospitals to jointly train models on procedure trajectories without sharing raw patient data. This cross-silo approach accelerates capability improvement in sensitive physical environments where data volume at any single institution is inherently limited.

What It Covers

Lorenzo Sani, research scientist at Flower Labs and Cambridge PhD candidate, explains how Federated Learning enables AI training on private, distributed data without centralizing it, and how this technology applies directly to Agentic AI systems that generate sensitive user trajectories across multi-step, branching workflows.

Key Questions Answered

•Privacy boundary in Federated Learning: The core privacy guarantee is that raw data never leaves its source device — no interception, no centralized exposure. The remaining risk is model memorization, addressed through differential privacy techniques. However, these statistical guarantees are case-dependent; some enterprise deployments abandon Federated Learning entirely when the privacy math does not work for their specific setup.
•Agentic trajectories as training data: Agentic AI systems produce branching, tree-structured trajectories — initial prompt, sub-agent calls, tool outputs, retrieved documents — that compound private user information at every step. These trajectories reveal failure modes invisible in single-model evaluations. Organizations that capture and control these logs can diagnose exactly where agents break and retrain on real usage patterns rather than synthetic data.
•Open-weight models for privacy-sensitive applications: When building applications that handle sensitive data, open-weight models provide two concrete advantages over closed-source alternatives: a broader set of probing and auditing techniques to detect unwanted memorization, and the ability to directly patch identified vulnerabilities. Closed-source APIs offer no equivalent remediation path if a privacy flaw is discovered post-deployment.
•Smaller models, bigger deployment scale: Model capability per parameter is rising while cost and size fall, meaning capable models are now deployable on local infrastructure rather than requiring cloud APIs. This shift makes self-hosted Agentic pipelines viable for individuals and enterprises alike, and increases the strategic value of owning trajectory data rather than routing it through third-party providers who do not return full reasoning traces.
•Collaborative learning for physical AI systems: In domains like surgical robotics, where every patient anatomy differs and simulation cannot fully substitute for real procedures, Federated Learning allows multiple hospitals to jointly train models on procedure trajectories without sharing raw patient data. This cross-silo approach accelerates capability improvement in sensitive physical environments where data volume at any single institution is inherently limited.

Notable Moment

Lorenzo described building a Halloween costume-judging platform at home using self-hosted vision-language agents. Guests attempted prompt injection by holding up handwritten signs requesting high scores, and formed group poses to game the scoring system — none of which succeeded, demonstrating real adversarial robustness in a casual consumer setting.

Know someone who'd find this useful?

Episode Transcript

Narrator: Welcome to the Practical AI Podcast, where we break down the real world applications of artificial intelligence and how it's shaping the way we live, work, and create. Our goal is to help make AI technology practical, productive, and accessible to everyone. Whether you're a developer, business leader, or just curious about the tech behind the buzz, you're in the right place. Be sure to connect with us on LinkedIn, X, or Blue Sky to stay up to date with episode drops, behind the scenes content, and AI insights. You can learn more at practicalai.fm. Now onto the show. Chris: Welcome to another episode of the Practical AI Podcast. I am Chris Benson, your cohost. Daniel Whitenack is out on paternity leave right now, so he won't be joining us. We've got a good conversation coming up today, I know, because with us we have Lorenzo Sani, if I got your name correct there. And Lorenzo is a research scientist at Flower Labs. He is also finishing up his PhD at Cambridge in computer science. Welcome to the show. Lorenzo: Hello, Chris. Hello, everybody. Thanks for having me today. Chris: Hey, absolutely. You have a really interesting set of research that you're working on. We're delighted to have you on the show today. I'm looking forward to talking about it. We got a lot of questions about it. But I wanted to actually start off with the fact that a little bit about your background. I know you came from the physics world and moved over, and we've seen that a fair amount in research scientists and AI. Daniel, the cohost, who's not here today, is in the same boat. I'm just kinda curious if you could give us a quick, you know, kinda how you arrived at what you're doing now having started on the physics side of things. Lorenzo: Yeah, of course. You're right. I have a physics background. I've been studying physics for five years after my high school. I was in Bologna, amazing place, amazing people, and very good courses as well. And especially during my last year of Master's, I was looking into topics related to machine learning, and the group there was working on medical applications. We needed a way to kind of preserve privacy and looking into those privacy sensitive scenarios. And back then, Federated Learning was quite new, so I started looking into it. It was very interesting. I loved the motivations behind it and the way to carry along the privacy preserving component to it. And and there's a result. I was one of the very first user of the Flowr framework, and this brought me to meet all the Flowr people as well as the research group in Cambridge that was developing it. And things got along. Luckily enough, the professor, Nick Lane, here was looking for PhD students. I was very excited to to join this line of research and whatever was around it. And and I got …

Get the full transcript (7,103 words) + summary by email — free

One-time email with the complete transcript and AI summary of this episode. No account needed.

One email, no spam. We’ll also show you what SignalCast does.

Browse all Practical AI transcripts →