Use sampling amplification only for the sampler actually implemented

Poisson subsampling independently includes each eligible contribution with probability q. Conditional on a public population of N eligible units, the count is binomial with mean Nq and variance Nq(1−q). In contrast, choosing exactly b units without replacement has deterministic size b and dependent inclusion indicators. Both can have the same marginal inclusion rate b/N, but their joint distributions differ. Sampling an entire shuffled epoch introduces another dependence pattern across updates that cannot be silently replaced by independent Poisson draws.

For add/remove record protection, the sampler operates on records; for user-level protection, it must select the user contribution or use a different proven analysis. Repeated records from one person do not become independent protected users merely because they are independently sampled. Keep population size, eligibility filtering and participation observations in the threat model. Publishing selected identities, private counts or data-dependent eligibility can change the transcript beyond what a hidden-subsample theorem covers.

For an add/remove (epsilon₀,delta₀)-DP base mechanism, applying it to an independently Poisson-sampled input with inclusion q gives the displayed valid amplified parameters when the released output is covered by that subsampling theorem. The formula bounds a privacy guarantee; it does not assert that every mechanism’s smallest epsilon equals it. The base mechanism must also be defined for possible empty samples. Fixed-size sampling has its own matching theorems and adjacency conditions, rather than inheriting this result from an equal expected batch size.

Sampled-Gaussian RDP accounting can be much tighter than repeatedly converting a base mechanism to an epsilon-delta pair and applying this elementary theorem. Those calculations depend on Gaussian noise, sensitivity convention, sampling law and numerical domains. Do not substitute a small-q asymptotic expression as an exact finite-parameter accountant. Opacus v1.5.4 exposes Poisson sampling and an accounting hook with a sample rate; disabling its sampler does not prove that an unchanged accountant matches a replacement loader.

Record q, the eligibility universe, replacement policy and every logical noised update. Empty samples, dropped batches, adaptive stopping and retries can change the schedule or expose additional information. A data-dependent decision to skip a difficult batch is not equivalent to independent sampling. Parameters chosen adaptively from already private outputs can be handled by appropriate composition, but private raw-data decisions require their own treatment. Keep sampler configuration and accountant state together in checkpoints so a resumed job does not silently restart its privacy history.

Reset the probability lab and set both p=0.1 and n=20. Predict count mean two, variance 1.8 and zero-count probability 0.9²⁰≈0.1216. Play highlights exact binomial outcomes rather than sampling a private batch. This matches the count law of twenty independent inclusion opportunities only. It contains no base DP mechanism, Gaussian noise or accountant and cannot compute amplification for an application. Compare that variable count with a hypothetical fixed batch of two, whose count variance would be zero.