Continual Learning With Participation Privacy: An Auditable Buffering-Aggregation Recipe

Modern federated and streaming learning systems often release intermediate models, so privacy must hold for the full trajectory under adaptive interaction. Motivated by participation privacy, we study single-edit neighboring user streams, where one insertion/deletion shifts all subsequent updates and defeats standard Hamming-neighbor continual-release analyses. We give an auditable modular recipe. A randomized buffering wrapper emits bins of size $[U,2U]$, reducing single-edit streams to a Hamming-style per-bin update stream with explicit backlog/delay guarantees, where $U$ is calibrated by the privacy parameters $(\varepsilon,\delta)$. We then prove a certification theorem for independently decomposable (prefix-causal, fresh-noise) continual mechanisms: any non-adaptive Hamming-neighbor DP proof lifts to adaptive inputs. Together, these ingredients yield trajectory-level $(\varepsilon,\delta)$-DP for single-edit streams using standard primitives (e.g., tree prefix sums), with an explicit privacy--latency link via $U$. Streaming DP-SGD experiments validate the privacy-utility-latency tradeoffs and the induced delay distributions.

Modern learning systems often update and release models many times during training, rather than only releasing one final model. This creates a privacy challenge: an observer may be able to infer not only what data was used, but whether a particular person participated at all. This is especially difficult in streaming settings, because adding or deleting one user's update can shift the timing of all later updates. We propose a privacy-preserving recipe for this setting. The main idea is to place incoming user updates into randomly sized waiting groups before using them for learning. This random buffering hides the exact effect of one user's participation, while still allowing standard private learning tools to process the grouped updates. We also give a simple certification test showing when existing continual privacy mechanisms remain safe even if future data depends on earlier released models. Our approach makes the privacy cost visible as a systems cost: stronger privacy requires more buffering, which can introduce delay. Experiments with streaming private SGD show how this privacy-accuracy-delay tradeoff behaves in practice. This gives practitioners a modular way to protect participation privacy in learning systems that release models over time.