Differentially private (DP) training relies on randomly selected variable batch sizes. If an observer sees the batch size, the privacy amplification from this randomness is lost. Truncating batches to a fixed size also breaks the standard privacy calculation.
The authors solve this by adding a random number of dummy points to each batch before its size is counted. This masks the true size. When a batch is truncated, a removed user is replaced by a dummy instead of data from another user, which keeps the algorithm's sensitivity low.
The privacy cost of this masking is typically small. It works with standard accounting tools and achieves a better privacy versus efficiency trade-off than handling truncation directly.