Black-Box FedLLM: Federated Learning for Opaque LLMs

• Black-Box FedLLM is a federated learning paradigm that enables collaborative adaptation of opaque large language models using only query-based interactions.
• It optimizes lightweight control variables such as prompts, adapters, and search distributions instead of full model parameters, ensuring efficient and private tuning.
• Empirical frameworks like FedOne demonstrate that query-efficient prompt tuning can significantly reduce API calls and communication overhead in federated settings.

Searching arXiv for relevant Black-Box FedLLM papers and the core FedOne paper to ground the article. Black-Box FedLLM denotes federated learning for LLMs under an inference-only access regime in which internal parameters, gradients, hidden states, and often even architectural details are inaccessible, while optimization proceeds through forward interactions with a cloud-hosted or otherwise proprietary model. In this regime, clients retain private datasets locally, the base LLM remains frozen and opaque, and collaborative adaptation is shifted to lightweight control variables such as prompts, prompt distributions, adapters, readout layers, mixture weights, or other externally manipulable artifacts. Recent work positions this regime as the “inaccessible model” end of the model-accessibility spectrum and emphasizes that optimization must rely on input-output behavior rather than backpropagation (Guo et al., 22 Aug 2025). Within this landscape, “FedOne: Query-Efficient Federated Learning for Black-box Discrete Prompt Learning” formalizes a particularly strict and practically salient instantiation: federated black-box discrete prompt learning over cloud LLM APIs, where every query is costly and one-client-per-round activation is shown to minimize total query complexity (Wang et al., 17 Jun 2025).

1. Definition and Scope

Black-Box FedLLM arises when a LLM is available only through an API or forward-only interface, so clients cannot access model weights, intermediate activations, or exact gradients, yet still wish to adapt the model collaboratively across decentralized private datasets. A survey formulation defines black-box tuning as a setting in which “the internal structure details of the model are inaccessible, and the optimization process relies solely on input-output pairs to guide the search for the optimal solution without using gradient information” (Guo et al., 22 Aug 2025). This encompasses both inference-only APIs and locally deployed forward-only models.

The setting is attractive because it combines three constraints that are common in production LLM usage. First, the model itself is proprietary or remotely hosted. Second, client data are private and remain local. Third, full-model fine-tuning is impractical because clients are resource-constrained and because transmission of large parameter tensors is expensive or disallowed. The resulting federated objective resembles classical federated learning in its decentralization, but differs fundamentally in its optimization interface: the collaborative object is not the LLM’s full parameter vector but a small, externally trainable control object.

In the most direct prompt-centric formulation, each client optimizes a prompt or prompt distribution that conditions the black-box LLM. FedOne instantiates this with Black-Box Discrete Prompt Learning (BDPL), where the tunable object is a sequence of discrete prompt tokens and losses are obtained by querying the LLM with prompted inputs (Wang et al., 17 Jun 2025). Other work broadens the notion of Black-Box FedLLM beyond prompt tuning. The model-accessibility survey includes zeroth-order tuning of full parameters or PEFT modules, prompt generators, CMA-ES-based prompt search, and discrete local search over prompt tokens as representative black-box techniques (Guo et al., 22 Aug 2025). A distinct line of work treats multiple proprietary agents as black-box encoders coordinated by a central planner, yielding a federated mixture-of-experts view that is structurally relevant to proprietary multi-LLM federation (Yang et al., 30 Apr 2025).

A useful conceptual distinction therefore separates two major Black-Box FedLLM families. One family performs federated adaptation of a single opaque LLM using prompts or other lightweight control parameters. The other family performs federated coordination over multiple opaque models, optimizing mixture weights, readout layers, or controller policies while preserving the proprietary status of each constituent model. This suggests that Black-Box FedLLM is best understood not as a single algorithmic template but as a systems paradigm defined by inaccessible model internals, local data retention, and gradient-free or output-level optimization.

2. Formal Problem Formulations

In the prompt-learning formulation of FedOne, federated black-box tuning is posed over clients $k=1,\dots,K$, each with private dataset $D^k=(\Psi^k,Y^k)$, where $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$. The objective is to find a prompt $\Phi$ minimizing aggregate loss over all clients: $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$ where $M=\sum_k M^k$ and the loss $\ell(\cdot)$ is computed by querying the LLM with prompt $\Phi$ and input $\psi_m^k$ (Wang et al., 17 Jun 2025).

FedOne parameterizes a discrete prompt sequence

$\Phi^k = \phi_1^k \cdots \phi_n^k$

through per-position categorical probabilities over vocabulary $D^k=(\Psi^k,Y^k)$0. For position $D^k=(\Psi^k,Y^k)$1, client $D^k=(\Psi^k,Y^k)$2 maintains

$D^k=(\Psi^k,Y^k)$3

with token index $D^k=(\Psi^k,Y^k)$4 and $D^k=(\Psi^k,Y^k)$5. Differentiable reparameterization is obtained by Gumbel-softmax: $D^k=(\Psi^k,Y^k)$6 where $D^k=(\Psi^k,Y^k)$7, $D^k=(\Psi^k,Y^k)$8, and $D^k=(\Psi^k,Y^k)$9 is temperature; the shorthand is $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$0 (Wang et al., 17 Jun 2025). The expected loss is then taken over sampled prompt sequences.

A broader black-box federated formulation in the model-accessibility survey writes the client objective over an externally controlled parameter vector $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$1: $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$2 with global objective

$\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$3

Here $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$4 is the inaccessible base model, and $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$5 may represent prompts, adapters, LoRA parameters, or perturbable full parameters optimized using zeroth-order methods, evolutionary strategies, or discrete search (Guo et al., 22 Aug 2025).

A different but complementary formalism appears in proprietary federated mixtures of agents. There, the central planner forms an ensemble

$\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$6

over proprietary models $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$7, each exposing predictions $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$8 but not internal encoder structure. The server solves a regularized constrained least squares problem over weights $\Psi^k=\{\psi_m^k\}_{m=1}^{M^k}$9, while each agent optimizes local decoder parameters $\Phi$0 in a non-cooperative game with a unique feedback Nash equilibrium (Yang et al., 30 Apr 2025). Although this work is framed around time-series black-box encoders rather than prompt tuning, it provides a rigorous formulation of output-level federation among proprietary models and thereby expands the definitional scope of Black-Box FedLLM.

This diversity of formulations indicates that the defining feature of Black-Box FedLLM is not the specific trainable object, but the accessibility constraint. Prompt distributions, search distributions, readout layers, routing weights, or controller policies all satisfy the paradigm so long as the underlying LLM remains opaque and optimization depends only on observable outputs.

3. Optimization Mechanisms in the Black-Box Regime

Black-Box FedLLM replaces gradient-based full-model optimization with methods that estimate useful search directions from outputs alone. In FedOne’s BDPL setting, local optimization uses a policy-gradient estimator over discrete prompt tokens. For client $\Phi$1 and prompt position $\Phi$2, the expected-loss gradient is estimated through a REINFORCE-style identity: $\Phi$3 The per-component derivative has closed form: $\Phi$4 Variance is reduced using MB-SVRP with multiple prompt samples $\Phi$5 and a baseline $\Phi$6 (Wang et al., 17 Jun 2025).

In the more general black-box taxonomy, zeroth-order finite differences are a canonical mechanism: $\Phi$7 for random direction $\Phi$8 and step $\Phi$9. The same survey also identifies evolutionary strategies such as CMA-ES, and discrete local token search, as principal black-box optimizers in federated settings (Guo et al., 22 Aug 2025).

FedBPT is the archetypal CMA-ES-based approach for inference-only APIs. It searches a low-dimensional prompt code $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$0 mapped to full prompt embeddings by a projection matrix $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$1, optimizing

$$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$2

with both local and server-side CMA-ES updates (Sun et al., 2023). It further introduces a perturbation-based local objective that compares losses on original and perturbed inputs: $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$3 to discourage overfitting on non-IID data (Sun et al., 2023).

A further variant replaces prompt tuning by synthetic data or prompt generation. FedZGE trains a server-side conditional generator using zeroth-order gradient estimation against black-box client models. Given a generator loss $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$4, the server estimates

$$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$5

and then backpropagates through the generator to update $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$6 (Ma et al., 8 Mar 2025). This is not prompt tuning, but it demonstrates that black-box federation can operate entirely through outputs without sharing parameters, gradients, or auxiliary real data.

At a still different layer of abstraction, Matryoshka treats the black-box LLM as an environment and a white-box controller LLM as a policy over guidance prompts. The controller is trained with KL-regularized preference optimization: $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$7 with DPO and iterative guidance optimization used to improve multi-turn interaction with the black-box generator (Li et al., 2024). This suggests that controller-based orchestration is another plausible optimization layer within Black-Box FedLLM, particularly when direct prompt search is too restrictive.

4. Federated Protocols and Aggregation Patterns

Black-Box FedLLM departs from classical FedAvg because the server cannot aggregate full gradients or full model parameters. Aggregation is therefore performed over lightweight artifacts or over outputs. The model-accessibility survey summarizes this shift as a transition from “share gradients and full weights” to sharing prompts, adapters, LoRA parameters tuned via zeroth-order methods, or search distributions such as CMA-ES means and covariances (Guo et al., 22 Aug 2025).

In general federated BDPL, the server broadcasts current prompt parameters $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$8, selected clients perform local prompt updates using black-box losses, and the server aggregates updated prompt parameters by averaging: $$\begin{align} \min_{\Phi} \quad F(\Phi; \Psi) &\triangleq \sum_{k=1}^K \frac{M^k}{M} f^k(\Phi; \Psi^{k}), \ f^k(\Phi; \Psi^{k}) &= \frac{1}{M^k} \sum_{m=1}^{M^k} \ell(\Phi; \psi^{k}_{m}, y_m^k), \end{align}$$9 FedOne is the special case $M=\sum_k M^k$0, so only one client performs local BDPL in each round and the server effectively adopts that client’s updated prompt parameters (Wang et al., 17 Jun 2025). This is “degraded FedAvg” only in the literal sense of client multiplicity; the theoretical point is that under query-cost accounting, the degradation is optimal rather than incidental.

FedBPT shows that naïve FedAvg-style averaging is not always compatible with black-box optimizers. Its baseline “FedAvg-BBT” applies local black-box tuning and then averages CMA-ES parameters, but performs poorly because CMA-ES evolution statistics are not preserved by simple averaging. FedBPT instead performs server-side CMA-ES aggregation over the local optima returned by clients and derives a corrected global step size

$M=\sum_k M^k$1

to maintain the intended distributional semantics of the evolutionary search process (Sun et al., 2023). This is an important caution against assuming that all black-box federated methods can inherit FedAvg unchanged.

Output-level federation yields still different aggregation operators. In FedAL, clients send logits on public inputs, and the server computes average logits

$M=\sum_k M^k$2

which become KD targets during a global transfer phase (Han et al., 2023). In proprietary agent mixtures, the server computes optimal mixture weights $M=\sum_k M^k$3 in closed form under a constrained regularized least-squares objective, rather than averaging model parameters at all (Yang et al., 30 Apr 2025). In controller-generator systems such as Matryoshka, the federated object could instead be the controller policy or its local preference-optimization updates, with black-box models acting as environments rather than as trainable participants (Li et al., 2024).

These variants can be summarized as different aggregation modes rather than different paradigms.

Aggregation object	Representative mechanism	Example paper
Prompt parameters	Averaging or one-client update of $M=\sum_k M^k$4	(Wang et al., 17 Jun 2025)
Search distributions	Server-level CMA-ES over local optima	(Sun et al., 2023)
Outputs / logits	Average logits or discriminator-guided KD targets	(Han et al., 2023)
Mixture weights / decoders	Closed-form server weights and Nash-coordinated local updates	(Yang et al., 30 Apr 2025)

A plausible implication is that “federation” in Black-Box FedLLM should be understood operationally rather than narrowly. When model internals are inaccessible, the federated object may be any low-dimensional or output-level interface through which decentralized knowledge can be aligned.

5. Query Efficiency, Communication, and System Constraints

Query cost is a defining systems constraint in cloud-API Black-Box FedLLM. FedOne is built around the claim that previous federated black-box prompt-tuning work neglected the substantial query cost of cloud-based LLM service usage, and it formalizes total query count as

$M=\sum_k M^k$5

where $M=\sum_k M^k$6 is the number of global rounds, $M=\sum_k M^k$7 is the number of activated clients per round, and each active client issues $M=\sum_k M^k$8 LLM queries per round (Wang et al., 17 Jun 2025). Under its convergence analysis, query complexity behaves as

$M=\sum_k M^k$9

which is minimized over positive integers at $\ell(\cdot)$0 (Wang et al., 17 Jun 2025). The central systems conclusion is that in federated black-box prompt learning, activating fewer clients per round reduces total API calls more than it harms convergence in rounds.

Empirical results reported for FedOne reinforce this point. On GLUE-style experiments, Fed-BDPL required 20,000 LLM queries, 1,000 FL queries, 30.52 MB server communication, and 2,407 seconds of training, whereas FedOne-BDPL required 2,000 LLM queries, 100 FL queries, 3.05 MB communication, and 234.92 seconds (Wang et al., 17 Jun 2025). Similar reductions are reported for Fed-BBT versus FedOne-BBT, and task-specific experiments on SST-2 show query counts increasing from approximately 529 at $\ell(\cdot)$1 to approximately 2,673 at $\ell(\cdot)$2 for Fed-BDPL (Wang et al., 17 Jun 2025). This suggests that Black-Box FedLLM requires explicit query budgeting as a primary optimization criterion, not merely as an implementation detail.

Communication pressure is the other dominant resource. FedBPT reports that, for RoBERTa, FedBPT reduces communication cost of one device in one round from 120MB to 4KB compared with FedP-Tuning, and its trainable parameter count remains 500 for both RoBERTa and LLaMA 2–7B (Sun et al., 2023). On RoBERTa SST-2, its client memory footprint is 1.8 GB, compared with 7.2 GB for FedAvg, 6.1 GB for FedP-tuning, and 5.8 GB for FedPrompt (Sun et al., 2023). The model-accessibility survey generalizes this observation: black-box FedLLM commonly aggregates prompts, adapters, LoRA modules, or search distributions precisely because these are lightweight and compatible with inaccessible base models (Guo et al., 22 Aug 2025).

System constraints are not limited to communication volume. The survey explicitly highlights rate limits, per-query cost, and latency for LMaaS deployments, noting that evolutionary loops and zeroth-order methods must be query-efficient and resilient to heterogeneous devices and network delays (Guo et al., 22 Aug 2025). FedBPT similarly assumes only forward inference, which lowers compute requirements because clients avoid backpropagation over the large model (Sun et al., 2023). SflLLM, although not an inference-only black-box method in the strict survey taxonomy, shows that when different system parties see only slices of the model or only intermediate activations, split placement, LoRA rank, subchannel allocation, and power control become central determinants of training latency (Zhao et al., 20 Apr 2025). This suggests that accessibility constraints and resource-allocation constraints are tightly coupled in practical deployments.

The cumulative picture is that Black-Box FedLLM is shaped at least as much by economic and systems variables as by statistical ones. Query efficiency, bandwidth, latency, and client memory footprints are not secondary concerns; in several of the cited frameworks they are the principal justification for black-box design choices.

6. Variants, Representative Systems, and Empirical Evidence

A concise view of the current landscape can be organized by what is federated and how the opaque model is used.

Method family	Core idea	Black-box interface
Federated black-box prompt tuning	Optimize prompts only via CMA-ES, policy gradients, or discrete search	API outputs or losses
Zeroth-order PEFT or full-parameter tuning	Perturb trainable control parameters without backprop	Forward-only model behavior
Output-level federated KD	Share logits or probabilities on public or synthetic data	Model outputs only
Proprietary-agent federation	Coordinate multiple opaque models via mixture weights or readout layers	Predictions and possibly features
Controller-driven black-box orchestration	Train a white-box controller to guide opaque LLMs	Text-in / text-out interaction

Within prompt tuning, FedBPT is an early federated black-box prompt tuning framework that uses low-dimensional continuous prompts and CMA-ES, showing competitive performance with drastically reduced communication and memory costs (Sun et al., 2023). FedOne targets discrete prompts and query efficiency, providing both convergence analysis and empirical reductions in LLM queries, communication, and wall-clock training time while maintaining competitive accuracy (Wang et al., 17 Jun 2025). The survey identifies related black-box prompt methods such as FedDTPT, Fed-BBPT, and personalized gradient-free prompt tuning as further representatives of the same region of the taxonomy (Guo et al., 22 Aug 2025).

Within output-level federation, FedAL demonstrates that knowledge distillation with public unlabeled data can remain black-box and architecture-agnostic while using adversarial alignment and less-forgetting regularization to address non-IID data (Han et al., 2023). FedZGE removes the need for an auxiliary public dataset by training a generator with zeroth-order gradients against black-box clients, thereby combining data-free FL with black-box FL and supporting model heterogeneity without parameter sharing (Ma et al., 8 Mar 2025). These methods are not prompt-tuning systems, but they are directly relevant whenever Black-Box FedLLM is interpreted more broadly as federation over inaccessible model interfaces.

Within proprietary multi-model federation, the framework of online federation for mixtures of proprietary agents derives a unique feedback Nash equilibrium for locally optimized readout parameters and closed-form optimal mixture weights. Its encoder classes include transformers, random feature models, and echo-state networks, and experiments report mean-MSE improvements that are often by an order of magnitude when Nash synchronization is used (Yang et al., 30 Apr 2025). The paper explicitly frames this as “proprietary federated learning” and its details suggest a route to Black-Box FedLLM systems that combine different vendors’ models without exposing internal structures.

Within controller-based black-box orchestration, Matryoshka trains a lightweight white-box controller to guide a black-box LLM generator through intermediate guidance. It reports improvements on personalization, reasoning, and planning tasks, including 91.1% on GSM8K with GPT-3.5 versus 86.4% for the best baseline, and 95.52% overall success on ALFWorld with GPT-3.5 versus 88.06% for AdaPlanner (Li et al., 2024). These are not federated results in the narrow FL sense, but the paper explicitly discusses how a controller could be trained in a federated or multi-LLM setting, which makes it relevant to the broader Black-Box FedLLM concept.

A notable empirical result specific to real cloud LLMs is FedOne’s GPT-3.5 Turbo study. On GLUE datasets with actual OpenAI API access, “No Prompt” yields an average of 59.64, “Prompt w/o Training” yields 54.41, FedOne-BDPL yields 61.67, and FedOne-GS-BDPL yields 64.28 (Wang et al., 17 Jun 2025). This is one of the clearest demonstrations that federated black-box prompt learning can improve a production API model using few-shot local data without any access to internal parameters.

7. Limitations, Misconceptions, and Open Directions

A common misconception is that Black-Box FedLLM is simply “using APIs.” The surveyed literature indicates a more specific meaning: inaccessible model internals combined with federated post-training or coordination mechanisms that rely on prompts, perturbation-based PEFT, search distributions, KD targets, synthetic data, or other output-level control variables (Guo et al., 22 Aug 2025). API access is one deployment mode, but locally deployed forward-only models also qualify.

Another misconception is that standard FedAvg remains a sensible default once prompts replace full parameters. FedOne’s theory and experiments argue the opposite for cloud-query-limited discrete prompt learning: standard multi-client-per-round activation is query-inefficient, and one-client-per-round activation minimizes the number of LLM queries needed to reach a target accuracy (Wang et al., 17 Jun 2025). FedBPT adds a related caution: even when local updates are black-box, naïvely averaging optimizer states can break the intended search geometry of CMA-ES (Sun et al., 2023). These results suggest that federated black-box optimization often requires algorithm-specific aggregation rules rather than direct reuse of white-box FL templates.

The limitations repeatedly noted across the cited works are substantial. FedOne’s convergence theory assumes bounded client heterogeneity via gradient diversity, bounded loss, and smoothness, and its experiments focus on text classification and few-shot settings rather than complex generative tasks (Wang et al., 17 Jun 2025). FedBPT does not provide formal privacy guarantees despite its architectural privacy advantages (Sun et al., 2023). FedAL relies on a public dataset $\ell(\cdot)$3, whose representativeness materially affects performance (Han et al., 2023). FedZGE avoids such a dataset but pays for that flexibility with zeroth-order query overhead and the difficulty of high-dimensional black-box generator optimization (Ma et al., 8 Mar 2025). Proprietary-agent federation assumes linear readout control and a sequential setting that would require nontrivial reinterpretation for general LLM tasks (Yang et al., 30 Apr 2025).

Several open directions are explicit in the survey and the underlying methods. The survey identifies federated value alignment in black-box mode, including FedDPO, FedRLHF, and FedRLAIF analogues, as a major frontier because preference-based optimization is significantly harder when log-likelihoods and gradients are not directly accessible (Guo et al., 22 Aug 2025). FedOne itself points toward smarter client selection, adaptive $\ell(\cdot)$4, privacy-enhancing technologies such as secure aggregation and DP, and more advanced black-box optimizers such as Bayesian optimization and bandit algorithms (Wang et al., 17 Jun 2025). FedAL suggests that adversarial output alignment and less-forgetting regularization may remain important when black-box federation moves from classification to heterogeneous language tasks (Han et al., 2023). Matryoshka suggests that controller-based orchestration may be a practical way to coordinate multiple black-box LLMs or black-box client environments without touching their parameters (Li et al., 2024).

A plausible implication is that the field is converging on a layered architecture for Black-Box FedLLM. One layer handles low-level adaptation of prompts or PEFT artifacts under query budgets. Another handles output-level consensus, personalization, or mixture weighting across heterogeneous clients. A third may handle orchestration or planning over multiple proprietary models. Whether these layers will remain separate research tracks or become components of a unified system remains unresolved, but the literature already supports the view that black-box accessibility is not a marginal constraint. It is an organizing principle for a distinct branch of federated LLM research (Guo et al., 22 Aug 2025).