Keep client sampling, contribution bounds and dropout in one mechanism

A client update can summarize several local optimization steps over many examples. Clipping that complete vector to C can bound one client’s add/remove contribution under the intended aggregation contract. Clipping individual local records instead is not automatically the same guarantee. If one person has multiple clients, a client-level claim also needs an identity or contribution-cap argument before it becomes user-level. Weighting updates by private record counts can change sensitivity; bound the weighted contribution and declare the public normalization rather than assuming an unweighted clipping proof still applies.

Selection probabilities must refer to the same protected unit. Uniform independent client selection is different from selecting available devices based on private behavior or favoring clients with large updates. The server can observe invitations, participation and dropout in some threat models; a hidden-sampling amplification theorem must not be applied to a transcript that reveals additional membership information without an analysis covering it. The original user-level language-model work and ordinary federated averaging address related training architectures, but their privacy claims and mechanisms are not interchangeable.

If survival is independent and data-independent, thinning can produce the displayed contribution probability. If poor connectivity, update magnitude or sensitive client behavior affects survival, the resulting participant set can be biased and the simpler privacy model may fail. Avoid replacing the configured sampling rate by an observed surviving fraction without proving that replacement valid. A public fixed divisor avoids some normalization ambiguity, but it does not fix an incorrect selection analysis or eliminate information in abort decisions.

When clients collectively generate Gaussian noise, the privacy-relevant variance is the part still unknown to the adversary. Noise from colluding clients that reveal their randomness cannot be counted as secret protection. Independent honest shares add variances, and dropout can reduce the number of remaining shares. A design can calibrate against a proven minimum of honest secret contributors and refuse or otherwise handle rounds outside that premise. Secure aggregation does not by itself enforce clipping, honest randomness or the lower bound on unknown noise.

Log privacy-safe round metadata identifying the selection rule, clipping unit, public divisor, noise construction, permitted collusion, dropout policy and accountant step. The ledger must cover the observable abort and retry behavior, not merely completed model updates. Repeatedly asking the same small cohort for overlapping exact aggregates can expose differences even when each transport protocol hides individual messages. A statistical privacy analysis of released noisy outputs remains separate from cryptographic confidentiality of the aggregation process.

For a conditional survival-count analogy, Reset the probability lab and set both p=0.75 and n=20. Predict fifteen survivors on average and variance 3.75, conditional on twenty already-selected clients with independent survival. Play highlights exact binomial outcomes rather than contacting devices. This is not the unconditional selection-and-dropout distribution in the worked example, and it contains no user records, secret noise shares or privacy accountant. The distinction between conditioning on selected count and modeling the full round is the point of the activity.