Paper proves memorization and extraction diverge under DP, so the usual loss audits can miss both directions of failure.

FISGuard fixes a public-data subspace for federated LLM fine-tuning, cutting gradient leakage beyond the usual ProjRes.