Private Batches Hide Their Size With Dummy Points

Privacy amplification for DP-SGD often assumes that random batch sizes stay secret. In distributed systems, an aggregator or traffic observer may see those counts, while memory limits may force oversized batches to be truncated—both conditions can weaken the guarantee. The proposed mechanism adds a random number of dummy points so the visible count is privatized while the real batch can still be truncated. The analysis covers Poisson sampling and random allocation and uses subsampling to reduce the expected dummy overhead below direct non-negative-noise protection of sensitivity-one counts. For truncated Poisson batches, the authors report a better privacy-efficiency tradeoff than recent direct accounting. The result is a mechanism and analysis, not an audit of a deployed DP system.