VisiContract: Tracing Utility and Identity Through Federated Semantic Cards

A client round in our federated personal-media protocol emits two representations along different trust paths: a clipped update is combined inside secure aggregation, while a typed card containing coarse time, tags, aliases, and modality confidence is read in plaintext by ingestion, storage, and card-learning components. When enabled, update differential privacy characterizes the released aggregate, not this second object. VisiContract turns that mismatch into an object–observer trace: it pairs channel removal with the original run, checks mechanism coverage for every realized reader and coalition, and tests attacks available from the corresponding view before comparing same-byte interfaces. In a controlled proxy built from COCO-Captions, VGGSound, and LibriSpeech-960h, blocking card consumption and its dependent objective across 1,000 non-IID clients lowers Recall@10 from 0.589 to 0.567, a paired effect of 0.022 (95% CI [0.015, 0.028]); against the strongest evaluated endpoint without a semantic uplink, FedRep, the card-enabled endpoint is higher by 0.007 [0.002, 0.012]. The useful path also retains source identity after its transport envelope is removed: alias-chain linkage assigns 0.44 of held-out cards among 100 clients, compared with 0.19 after alias removal, while mean Recall@10 changes from 0.589 to 0.585 at the matched cumulative 3.6 MB budget. Aggregate noise lowers attacks on the aggregate but cannot transform a card already visible in plaintext. VisiContract therefore identifies both the protocol object that warrants protection and the field-level intervention that directly attenuates its strongest measured identity mechanism.