When the model never leaves the phone, the threat model collapses entirely. PrivacyLens is an argument, not just a system.
This essay is being written. The full text will appear here soon. In the meantime, the thesis above is the argument in miniature.
Check back shortly, or follow the work at github.com/Kanishkverse.