Separate secure-sum confidentiality from statistical privacy

In a simple all-participants-present construction, each pair of clients shares a mask. One endpoint adds it and the other subtracts it in a finite additive group, so the masks cancel in the total. Individual masked messages can look unrelated to inputs while their modular sum equals the modular input sum. Correct decoding to an ordinary real or signed sum needs an encoding and range bound that avoids unintended wraparound. Fixed-point rounding also changes the numerical mechanism and should be included in its sensitivity and noise analysis.

Dropout breaks the naive cancellation story because a missing participant’s pair masks may remain. Practical secure aggregation, including Bonawitz and colleagues’ protocol, uses additional mechanisms for recovery and explicit security assumptions. Authentication, consistency of participant views, allowed collusion and the chosen protocol variant matter. A three-number mask example does not implement those protections. Nor does encryption of each client’s connection stop a server from reading a plaintext update after decrypting it; the protected visibility boundary must be specified.

If the server learns an exact sum and knows all but one contribution, subtraction determines the remaining value. That information is permitted by an ideal secure-sum functionality because it follows from the aggregate itself. Repeated overlapping cohort sums can likewise reveal differences. DP instead constrains the distribution of the released output under a neighboring contribution change. Adding appropriate statistical noise can complement secure aggregation, but a noisy protocol still needs the correct sensitivity, noise-distribution and composition analysis.

A release threshold can require enough surviving inputs, but it is not a universal majority rule. Its security interpretation depends on the protocol’s collusion and dropout theorems, which can require more than half or other conditions. The number of honest unknown inputs can be smaller than the total number of survivors. Treat a policy such as “at least four survivors” as a policy example until its relationship to a specific protocol proof is established. A successful threshold check does not enforce honest client clipping or prevent malicious model updates.

Document who sees individual messages, participant identities, aggregate values and intermediate failures. State whether the server is honest-but-curious or actively malicious, how clients authenticate each other and how dropout recovery is authorized. Input confidentiality does not guarantee integrity of a malicious client’s contribution or availability of the service. If a trusted server adds central DP noise only after learning an exact secure sum, that central-DP release analysis protects the published output; it does not automatically hide the exact sum from that server.

The reliability lab counts availability rather than cryptographic security. Reset and set both n=5 and unavailable k=1; predict four available and majority threshold three. Separately Reset and set both n=5 and k=2; predict three available, still meeting the majority. A separate illustrative release policy requiring four survivors passes only the first case. The instrument cannot prove a secure-aggregation threshold, model collusion or calculate privacy. Its purpose is to expose why the word quorum alone does not identify the protocol’s required condition.