Paper deep dive
Private Anytime Selective-Risk Certification for Federated Retrieval-Augmented Generation: Guarantees and Empirical Limits
Sanjeda Akter, Ibne Farabi Shihab, Anuj Sharma
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/11/2026, 4:23:07 AM
Summary
The paper introduces Fed-SRC, a private, federated, and anytime selective-risk certification framework for Retrieval-Augmented Generation (RAG). It addresses challenges in federated calibration by using Gaussian-perturbed histograms and martingale-based bounds to provide statistical guarantees on error rates while preserving differential privacy. Empirical results show that while the method maintains validity, operational power is limited by privacy constraints and dataset characteristics, with naive privatization failing to maintain bounds.
Entities (7)
Relation Signals (6)
Fed-SRC → provides → Selective-Risk Certification
confidence 95% · Selective-risk certificates promise that accepted outputs meet a declared error target. We develop Fed-SRC...
Fed-SRC → appliesto → RAGTruth
confidence 92% · on RAGTruth the secondary target r*=0.20 never certifies either
Fed-SRC → appliesto → HaluEval
confidence 92% · on HaluEval question answering it certifies in all 200 non-private trials
Fed-SRC → ensures → Differential Privacy
confidence 90% · a score-agnostic certificate for federated, differentially private... generation.
Fed-SRC → uses → Gaussian-perturbed histograms
confidence 90% · Clients release only Gaussian-perturbed score and loss histograms.
Fed-SRC → uses → Martingales
confidence 88% · Record-indexed and noise-variance-indexed martingales jointly bound target-risk contrast
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Selective-risk certificates promise that accepted outputs meet a declared error target. We develop Fed-SRC, a score-agnostic certificate for federated, differentially private, adaptively monitored retrieval-augmented generation. Clients release only Gaussian-perturbed score and loss histograms. Record-indexed and noise-variance-indexed martingales jointly bound target-risk contrast and accepted mass over all registered thresholds and rounds, permitting predictable recruitment, dropout, threshold selection, and optional stopping. A range-one total-variation term transfers the calibration mixture to a declared deployment mixture. The contribution is this private, federated, anytime combination, rather than the contrast statistic or acceptance floor individually. Empirically, no simultaneous-bound violation occurs in any evaluated cell, privacy level, or policy. Operational power depends on the score and population: the primary target r*=0.10 never certifies, and on RAGTruth the secondary target r*=0.20 never certifies either, whereas on HaluEval question answering it certifies in all 200 non-private trials, with held-out risk below the target. Naively privatized non-private certificates violate their bounds in 146 to 198 of 200 trials. As an exploratory comparison, we also evaluate a private betting-capital heuristic for which we do not establish e-process validity. This heuristic stops certifying at epsilon <= 4, where Fed-SRC still certifies. Certification nevertheless consumes roughly 30 times more stream events than unique calibration items.
Tags
Links
- Source: https://arxiv.org/abs/2608.07913v1
- Canonical: https://arxiv.org/abs/2608.07913v1
Trouble viewing inline? Open PDF directly →
Full Text
133,614 characters extracted from source content.
Expand or collapse full text
Private Anytime Selective-Risk Certification for Federated Retrieval-Augmented Generation: Guarantees and Empirical Limits Sanjeda Akter1 Equal contribution. Ibne Farabi Shihab11footnotemark: 11 Corresponding author: ishihab@iastate.edu. Anuj Sharma2 1Department of Computer Science, Iowa State University 2Department of Civil, Construction & Environmental Engineering, Iowa State University ishihab@iastate.edu Abstract Selective-risk certificates promise that accepted outputs meet a declared error target. We develop Fed-SRC, a score-agnostic certificate for federated, differentially private, adaptively monitored retrieval-augmented generation. Clients release only Gaussian-perturbed score and loss histograms. Record-indexed and noise-variance-indexed martingales jointly bound target-risk contrast and accepted mass over all registered thresholds and rounds, permitting predictable recruitment, dropout, threshold selection, and optional stopping. A range-one total-variation term transfers the calibration mixture to a declared deployment mixture. The contribution is this private federated anytime combination, not the contrast statistic or acceptance floor individually. Empirically, no simultaneous-bound violation occurs in any cell, privacy level, or policy. Operational power is score and population dependent: the primary target r⋆=0.10r_ =0.10 never certifies, and on RAGTruth the secondary target r⋆=0.20r_ =0.20 never certifies either, whereas on HaluEval question answering it certifies in all 200 non-private trials with held-out risk below target. Naively privatized non-private certificates violate their bounds in 146 to 198 of 200 trials. A private betting capital heuristic (we do not prove it is an e-process), run as an exploratory comparison without proving its validity, stops certifying at ε≤4 ≤ 4 where Fed-SRC still certifies. Certification still consumes roughly 30 times more stream events than unique calibration items. Private Anytime Selective-Risk Certification for Federated Retrieval-Augmented Generation: Guarantees and Empirical Limits Sanjeda Akter†thanks: Equal contribution.1 and Ibne Farabi Shihab11footnotemark: 1†thanks: Corresponding author: ishihab@iastate.edu.1 and Anuj Sharma2 1Department of Computer Science, Iowa State University 2Department of Civil, Construction & Environmental Engineering, Iowa State University ishihab@iastate.edu 1 Introduction Retrieval augmented language models can produce fluent claims unsupported by their evidence. Scores based on model confidence, sampling consistency, semantic entropy, or external verification can detect such errors, but they do not provide statistical guarantees (Manakul et al., 2023; Farquhar et al., 2024; Min et al., 2023). Deployment instead requires a selective risk certificate: accepted outputs must remain below a declared error target, with abstention when this cannot be established. Because this guarantee depends on the declared loss and target population, our certificate calibrates any bounded score rather than privileging one signal. Information lift motivates this setting by comparing output probabilities with and without retrieved evidence (Akter et al., 2025). Large lift shows that evidence influenced generation, not that the output is correct. Under identical calibration on the same population, information lift never certifies on our benchmark, whereas a cheaper mechanistic detector does (§7). This distinction motivates our focus on the certificate rather than the score. Federated calibration introduces three challenges. Clients cannot pool prompts, outputs, or factuality labels; exact histograms can reveal membership; and continual threshold updates invalidate fixed time confidence intervals. Moreover, per example total variation does not imply a BKBK bound for client blocks, empirical CDFs require explicit discretization and sensitivity, and repeated private releases require a simultaneous count scale noise envelope. Fed-SRC addresses these issues using finite histograms, explicit mixture transfer, and separate time uniform sampling and privacy noise martingales. Stable heterogeneity is absorbed into the realized calibration mixture, only the declared deployment mismatch ηt _t is transferred, and privacy contributes its own count scale width. Contributions. We formulate federated score calibration as selective risk control while separating the bounded ranking score from the declared loss. Two binned histograms, one for all examples and one weighted by loss, have add or remove L2L_2 sensitivity at most 2 2 regardless of the number of thresholds. We prove pathwise event level zCDP that charges each occurrence only for releases containing it. We also derive simultaneous range only and variance adaptive risk bounds with a joint acceptance floor, record indexed validity under predictable recruitment, and a realized noise envelope under dropout. A range one total variation argument transfers validity from the realized client mixture to the declared deployment mixture. Empirically, we separate validity, power, and score quality. Across 500 trials for each core cell, the simultaneous bounds show no violation. The registered target r⋆=0.10r_ =0.10 never certifies, while r⋆=0.20r_ =0.20 certifies HaluEval question answering but not RAGTruth (§5). At r⋆=0.30r_ =0.30, information lift falls from 200/200 certifications without privacy to 2/200 at ε=4 =4, making the result valid but nearly vacuous at common privacy levels. Naive privatization violates validity and serves only as a stress test. On matched RAGTruth populations, information lift never certifies, whereas a mechanistic adaptation does, so a preregistered gate retires the lift centered claim. We therefore contribute and diagnose a private federated certificate without claiming a superior hallucination score or strong private utility on the current data. 2 Closest Work RAG faithfulness and uncertainty scores include SelfCheckGPT, semantic entropy, ReDeEP, FRANQ, ConU, and SConU (Manakul et al., 2023; Farquhar et al., 2024; Sun et al., 2024; Fadeeva et al., 2026; Wang et al., 2024, 2025); information-lift certification and Sequential-EDFL motivate our score but certify neither factual correctness nor federated private deployment risk (Akter et al., 2025, 2026), and C-RAG establishes conformal RAG risk certification (Kang et al., 2024). Every statistical component also has close precedent: CRC/LTT and confidence sequences (Angelopoulos et al., 2024, 2025; Howard et al., 2021); Anytime-Valid CRC, CSA, and the Yu and Liu certificate for growing calibration, the gated contrast, and variance-adaptive risk/acceptance (Hultberg et al., 2026; Khosravi and Huo, 2026; Yu and Liu, 2026); federated conformal prediction, Anytime-FC-RAG, private confidence sequences, and private e-values (Lu et al., 2023; Humbert et al., 2023; Dubey and Huo, 2026; Waudby-Smith et al., 2023; Csillag and Mesquita, 2025). We claim none of these in isolation; the contribution is their event-level-DP federated anytime combination, pathwise accountant, and declared-mixture transfer. The expanded comparison is in the appendix. 3 Problem Setup 3.1 Evidence lift is a score, not a truth label An example is W=(q,z,y,ℓ)W=(q,z,y, ): query q, retrieved evidence z, model output y=(y1,…,yL)y=(y_1,…,y_L), and bounded loss ℓ∈[0,1] ∈[0,1]. For response-level faithfulness, ℓ=1 =1 can denote that at least one atomic claim is unsupported; for a graded endpoint, ℓ may be the fraction of unsupported atomic claims. The theory applies to either choice. It certifies risk relative to this declared annotation rule. Let pθp_θ be a probability-exposed language model and z∅z the same prompt with retrieved evidence removed while all other prompt fields are held fixed. For a clipping level B>0B>0, define normalized evidence lift SB(W)=1LB∑r=1L[logpθ(yr∣y<r,q,z)pθ(yr∣y<r,q,z∅)][0,B],S_B(W)= 1LB _r=1^L [ p_θ(y_r y_<r,q,z)p_θ(y_r y_<r,q,z ) ]_[0,B], (1) which lies in [0,1][0,1]. Here [u][a,b]=minb,maxa,u[u]_[a,b]= \b, \a,u\\. Teacher forcing evaluates both probabilities on the same realized output. Other fixed, bounded transformations of information lift are allowed. The score function, model, prompts, clipping level, and threshold grid must be fixed before using the calibration records, or selected on a separate split. Choose thresholds 0≤λ1<⋯<λm≤10≤ _1<·s< _m≤ 1 and define Aj(W) A_j(W) =SB(W)≥λj, =1\S_B(W)≥ _j\, (2) Zj(W) Z_j(W) =ℓAj(W). = \,A_j(W). (3) For a predeclared target r⋆∈(0,1)r_ ∈(0,1), also define the gated target-risk contrast Dj(W)=Zj(W)−r⋆Aj(W)=Aj(W)(ℓ−r⋆),D_j(W)=Z_j(W)-r_ A_j(W)=A_j(W)( -r_ ), (4) which lies in [−r⋆,1−r⋆][-r_ ,1-r_ ]. For a distribution Q, write aQ,j a_Q,j =Q[Aj(W)], =E_Q[A_j(W)], zQ,j z_Q,j =Q[Zj(W)], =E_Q[Z_j(W)], dQ,j d_Q,j =Q[Dj(W)], =E_Q[D_j(W)], ℛQ,j _Q,j =zQ,jaQ,j, = z_Q,ja_Q,j, (5) the last when aQ,j>0a_Q,j>0. Thus aQ,ja_Q,j is acceptance and ℛQ,jR_Q,j is expected loss conditional on acceptance. If no output is accepted, we make no risk claim and return the always-abstain policy. When aQ,j>0a_Q,j>0, ℛQ,j≤r⋆R_Q,j≤ r_ if and only if dQ,j≤0d_Q,j≤ 0. Operational certification additionally requires a predeclared floor amin>0a_ >0; the contrast inequality alone is not called a certificate. 3.2 Federated calibration and the deployment target There are K clients with calibration laws PkP_k, which may be arbitrarily heterogeneous. Index released calibration records by their order of inclusion i=1,2,…i=1,2,…; before record i is revealed the scheduler picks its client Ci∈[K]C_i∈[K] using only the past, and then Wi∼PCiW_i P_C_i. This record-indexed form is what lets the next client and batch size depend on an earlier private certificate. Round t is the prefix ending at NtN_t, with Nk,t N_k,t =∑i=1NtCi=k, = _i=1^N_t1\C_i=k\, Nt N_t =∑k=1KNk,t, = _k=1^KN_k,t, w¯k,t w_k,t =Nk,t/Nt, =N_k,t/N_t, (6) and we monitor only +=t:Nt≥1T_+=\t:N_t≥ 1\. Client identity, release status, and padded batch capacity are public metadata, and each successful message uses its announced number of contribution slots, so Nk,tN_k,t and NtN_t are unchanged between neighbouring datasets. Our adjacency is the zero-out relation on one stream slot: one event occurrence contributes its histogram vector or zero while message shape remains fixed. Repeated events from the same person or source item are distinct slots and require composition for person- or source-level privacy. Hiding participation counts would need a private denominator and is outside this protocol. The round-t calibration mixture is Q¯t=∑k=1Kw¯k,tPk. Q_t= _k=1^K w_k,tP_k. (7) The intended deployment mixture is Q⋆=∑k=1KwkPk⋆Q = _k=1^Kw_kP_k , where w is a declared vector of nonnegative weights summing to one and Pk⋆P_k is client k’s deployment law. We use the convention TV(P,Q)=supD|P(D)−Q(D)|TV(P,Q)= _D|P(D)-Q(D)|. Suppose an independently justified bound TV(Pk⋆,Pk)≤γkTV(P_k ,P_k)≤ _k is available. Define ηt=12∑k=1K|wk−w¯k,t|+∑k=1Kwkγk. _t= 12 _k=1^K|w_k- w_k,t|+ _k=1^Kw_k _k. (8) The first term is known from participation counts and target weights. The second is a declared sensitivity parameter unless drift is bounded from an independent audit sample. When deployment uses the realized calibration mixture and components are stable, ηt=0 _t=0. 3.3 Desired guarantee Given target risk r⋆∈(0,1)r_ ∈(0,1), the server may inspect every private transcript, choose any threshold at any round, and stop at a data-dependent time. We seek an upper certificate Uj,tU_j,t such that ℙ[∀t∈+,∀j∈[m]:ℛQ⋆,j≤Uj,t]P\! [∀ t _+,\ ∀ j∈[m]:R_Q ,j≤ U_j,t ] (9) is at least 1−αs−αn1- _ s- _ n. Here αs _ s is the sampling-error budget and αn _ n the Gaussian-noise budget. A selected threshold is certified if Uj,t≤r⋆U_j,t≤ r_ . 4 Fed-SRC: Private Federated Calibration 4.1 A finite sufficient release The thresholds partition [0,1][0,1] into m+1m+1 bins: I0 I_0 =[0,λ1), =[0, _1), (10) Ib I_b =[λb,λb+1)(1≤b<m), =[ _b, _b+1) (1≤ b<m), (11) Im I_m =[λm,1]. =[ _m,1]. (12) Let ℛt⊆[K]R_t [K] be the clients that actually release in round t; a client that drops out before releasing contributes neither a message nor records to NtN_t. For (k,t)(k,t) with k∈ℛtk _t, define score and error histograms Ck,t,b C_k,t,b =∑W∈Dk,tSB(W)∈Ib, = _W∈ D_k,t1\S_B(W)∈ I_b\, (13) Ek,t,b E_k,t,b =∑W∈Dk,tℓ(W) 1SB(W)∈Ib. = _W∈ D_k,t (W)\,1\S_B(W)∈ I_b\. (14) The client releases the 2(m+1)2(m+1)-vector H~k,t=(Ck,t,0:m,Ek,t,0:m)+ξk,t, H_k,t=(C_k,t,0:m,E_k,t,0:m)+ _k,t, (15) with ξk,t∼(0,σk,t2I) _k,t (0, _k,t^2I). No prompt, evidence, output, per-example score, or per-example label is sent. For threshold j, the server obtains noisy cumulative accepted and error counts by summing bins b=j,…,mb=j,…,m, clients, and rounds: A~j,t A_j,t =∑s≤t∑k∈ℛs∑b=jmC~k,s,b, = _s≤ t _k _s _b=j^m C_k,s,b, (16) Z~j,t Z_j,t =∑s≤t∑k∈ℛs∑b=jmE~k,s,b. = _s≤ t _k _s _b=j^m E_k,s,b. (17) Let dj=m−j+1d_j=m-j+1 be the number of suffix bins and Vj,t=dj∑s≤t∑k∈ℛsσk,s2.V_j,t=d_j _s≤ t _k _s _k,s^2. (18) Thus Vj,tV_j,t uses realized releases, not an all-client-per-round idealization. Conditional on the past, each suffix-noise increment is centered Gaussian with its corresponding variance increment. Suffix sums are correlated across thresholds, but the proof never assumes independence across (j,t)(j,t). 4.2 Range-only and variance-adaptive contrast certificates Let πr=6/[π2(r+1)2] _r=6/[π^2(r+1)^2]. For c≥1c≥ 1, n≥1n≥ 1, and v≥0v≥ 0, define Hc(n;α) H_c(n;α) =2⌈log2n⌉2logcmαπ⌈log2n⌉, = 2 _2n 2 cmα _ _2n , (19) Gc(v;α) G_c(v;α) =0,v=0,2uvlogcmαπrv,v>0, = cases0,&v=0,\\ 2u_v cmα _r_v,&v>0, cases (20) where rv=max0,⌈log2(v/v0)⌉r_v= \0, _2(v/v_0) \, uv=v02rvu_v=v_02^r_v, and v0>0v_0>0 is fixed before calibration. The factor c records how many one-sided process families share a probability budget. Write Vj,tA=Vj,tV^A_j,t=V_j,t, Vj,tD=(1+r⋆2)Vj,tAV^D_j,t=(1+r_ ^2)V^A_j,t, and D~j,t=Z~j,t−r⋆A~j,t D_j,t= Z_j,t-r_ A_j,t. The range-only construction is d¯j,tH d H_j,t =min1−r⋆,1Nt(D~j,t+H2(Nt;αs) = \1-r_ ,\ 1N_t ( D_j,t+H_2(N_t; _ s) +G2(Vj,tD;αn))+ηt, +G_2(V^D_j,t; _ n) )+ _t \, (21) a¯j,tH a H_j,t =max0,1Nt(A~j,t−H2(Nt;αs) = \0,\ 1N_t ( A_j,t-H_2(N_t; _ s) −G2(Vj,tA;αn))−ηt. -G_2(V^A_j,t; _ n) )- _t \. (22) It pays one sampling width, one Gaussian width, and one mixture-transfer term for the target-risk decision. The separate risk-ratio certificate is retained as a baseline in Appendix L. For a variance-adaptive alternative, note that Dj(W)2≤Aj(W)D_j(W)^2≤ A_j(W), so the predictable quadratic variation of the contrast martingale is bounded by expected accepted mass. Define q¯j,t q_j,t =minNt,max0,A~j,t+H3(Nt;αs) = \N_t, \0, A_j,t+H_3(N_t; _ s) +G3(Vj,tA;αn), +G_3(V^A_j,t; _ n) \ \, (23) F3(q;α) F_3(q;α) =max0≤r≤Rq2r+1xr+23xr, = _0≤ r≤ R_q \ 2^r+1x_r+ 23x_r \, (24) where Rq=⌈log2maxq,1⌉R_q= _2 \q,1\ and xr=log3m/(απr)x_r= \3m/(α _r)\. Then d¯j,tVA d VA_j,t =min1−r⋆,1Nt(D~j,t+F3(q¯j,t;αs) = \1-r_ ,\ 1N_t ( D_j,t+F_3( q_j,t; _ s) +G3(Vj,tD;αn))+ηt, +G_3(V^D_j,t; _ n) )+ _t \, (25) a¯j,tVA a VA_j,t =max0,1Nt(A~j,t−H3(Nt;αs) = \0,\ 1N_t ( A_j,t-H_3(N_t; _ s) −G3(Vj,tA;αn))−ηt. -G_3(V^A_j,t; _ n) )- _t \. (26) The range-only and variance-adaptive constructions each receive the declared budgets in a separately preregistered run. Selecting the narrower one after seeing the data requires adding the construction index to the simultaneous family or splitting the budgets. Theorem 1 (Private federated anytime target-risk certificate). Suppose client identity, batch size, release decision, threshold family, score, loss, privacy scale, and each monitored prefix are predictable, and fresh records and Gaussian noise follow their declared conditional laws. For either M∈H,VAM∈\ H, VA\, with probability at least 1−αs−αn1- _ s- _ n, dQ⋆,j≤d¯j,tM,aQ⋆,j≥a¯j,tMd_Q ,j≤ d^M_j,t, a_Q ,j≥ a^M_j,t (27) simultaneously for every registered threshold j and monitored round t. Therefore any transcript-measurable threshold and stopping time satisfying d¯j^,t^M≤0,a¯j^,t^M≥amin>0 d^M_ j, t≤ 0, a^M_ j, t≥ a_ >0 (28) obeys ℛQ⋆,j^≤r⋆R_Q , j≤ r_ and aQ⋆,j^≥amina_Q , j≥ a_ on the same event. No additional optional-stopping or post-selection correction is needed. The direct transfer in the proof applies total variation to D=A(ℓ−r⋆)∈[−r⋆,1−r⋆]D=A( -r_ )∈[-r_ ,1-r_ ], whose range length is one. It therefore pays ηt _t, not (1+r⋆)ηt(1+r_ ) _t. We make no universal dominance claim over the ratio rule after clipping and stitching; matched comparisons are empirical. 4.3 Threshold selection At any round, the server forms tM=j∈[m]:d¯j,tM≤0,a¯j,tM≥amin.J^M_t=\j∈[m]: d^M_j,t≤ 0,\ a^M_j,t≥ a_ \. (29) If tM=∅J^M_t= , it returns the always-abstain policy. Otherwise it selects the candidate with the largest conservative acceptance lower bound: j^t∈argmaxj∈tMa¯j,tM. j_t∈ _j ^M_t a^M_j,t. (30) Any other transcript-measurable choice is also valid. Post-processing the private transcript incurs no additional privacy loss. This is not an LTT step: the single simultaneous event in Theorem 1 already covers every registered threshold, so selecting among those bounds is direct post-processing rather than a separate fixed-time familywise test. Protocol summary. 1. Fix the model, lift transformation, loss, threshold grid, privacy level, risk target, deployment weights, and v0v_0 before calibration. 2. Each client bins each new record once and releases the noised pair of histograms in Equation (15). 3. The server aggregates suffix counts, computes either Equations (21) and (22) or Equations (25) and (26) whenever Nt≥1N_t≥ 1, and may inspect them after every round. 4. Deploy the selected threshold only if both inequalities in Equation (28) hold; otherwise abstain. 5 Guarantees Adding one bounded-loss record changes one count coordinate by one and one loss coordinate by at most one, so the released vector has L2L_2 sensitivity at most 2 2. A release with coordinate noise variance σ2σ^2 is 1/σ21/σ^2-zCDP. A deterministic pathwise filter composes only the releases in which a stream occurrence participates and converts the resulting ρ to (ρ+2ρlog(1/δ),δ)(ρ+2 ρ (1/δ),δ)-DP. The complete adaptive composition statement is Theorem 3. Theorem 1 is simultaneous in threshold and round. Its event therefore survives transcript-measurable threshold selection, predictable client recruitment, realized dropout, and optional stopping without another testing correction. Privacy appears through GcG_c in count units; declared mixture mismatch appears through ηt _t in expectation units. Strong privacy, large shift, or small accepted mass can correctly force abstention. Complete privacy, ratio-baseline, and width statements and proofs appear in Appendices B and I. 6 Experimental Design Every response remains attached to its exact generator checkpoint, tokenizer, query/reference group, retrieved context, prompt, and annotation provenance. All outputs sharing a query or reference are assigned together to development, calibration, or evaluation. Development fixes score direction, normalization, clipping, prompts, the comparator-selection rule, and 20 threshold quantiles; calibration alone drives certificates; evaluation remains unopened until all policies and analysis code are frozen. The complete annotated response is scored, never a 400-character prefix paired with a full-response label.The primary loss is binary any-unsupported-content; unsupported span or sentence fraction is secondary. Faithfulness, world factuality, and answer correctness are not pooled. A cell enters the matched-model analysis only when the original output and exact probability-exposed generator revision are recoverable. Cross-model teacher-forced scores are reported separately. Cell Dataset/task Original generator and revision C1 RAGTruth QA Mistral-7B-Instruct-v0.1 C2 RAGTruth Summary Mistral-7B-Instruct-v0.1 C4 RAGTruth Data2txt Mistral-7B-Instruct-v0.1 C3 RAGTruth pooled aggregate Mistral-7B-Instruct-v0.1 Table 1: Three disjoint RAGTruth task cells and their pooled aggregate. C3 is not treated as a fourth independent dataset/model replication. Population sizes and provenance appear in Table 14. The registration fixes r⋆=0.10r_ =0.10 as primary and 0.200.20 as secondary, with amin=0.05a_ =0.05, αs=αn=0.025 _ s= _ n=0.025, and δpriv=10−6 _ priv=10^-6. Neither registered target fires on RAGTruth; r⋆=0.20r_ =0.20 does fire on HaluEval question answering. We therefore report r⋆=0.30r_ =0.30 only as a post-registration feasibility analysis; it is a looser target, not the “tightest preregistered” one. The simultaneous-bound audit uses no DP, ε=4 =4, and ε=1 =1, 500 trials per core cell and policy. The exploratory C1 privacy curve uses ε∈∞,8,4,2,1,0.5 ∈\∞,8,4,2,1,0.5\ and 200 trials per setting. Fixed-final, first-certificate, and predictable recruitment policies are never pooled when their utility differs.For theorem validation, each client is a frozen finite labeled population and PkP_k is its uniform law. Calibration events are drawn independently with replacement, exactly matching the predictable-stream conditions of Theorem 1; selected-policy risk and acceptance under Q⋆Q are computed by exhaustive population enumeration. A draw is the event-level privacy unit. Repeated draws of one RAGTruth support item are therefore repeated event values, not a claim that the original benchmark response receives the stated privacy level. Protecting unique support items or people would compose over all their occurrences. Official held-out performance is separate and receives its own interval. No Monte Carlo estimate is called exact population risk. Baselines separate native non-private references, valid private rules (the stitched ratio, Fed-SRC-C, and Fed-SRC-VA), and deliberately naive-DP stress tests. Seven scores use a common certificate and development-frozen selection. C-RAG delimits scope but is not an executed baseline (Kang et al., 2024). We additionally run a private betting capital heuristic (unproved as an e-process) as an exploratory comparison whose validity we do not prove (§5, Table 5). The complete method list and access contract appear in Appendix O. 7 Results The confirmatory result is near-universal abstention, stated precisely. The primary target r⋆=0.10r_ =0.10 certifies in no cell, privacy level, or policy on either dataset. The secondary target r⋆=0.20r_ =0.20 likewise never certifies on RAGTruth. It does certify on HaluEval question answering without privacy (200 of 200 trials, Table 4) and at ε=8 =8 in 183 of 200 trials, so the registered grid is not uniformly unreachable and we do not claim that it is. We keep the RAGTruth failures primary and label the r⋆=0.30r_ =0.30 C1 analysis exploratory. Table 2 also separates simultaneous-bound validity from operational firing; the former does not imply the latter. Status r⋆r_ ε Fired Mean accept. Bound violations Exploratory C1 0.30 ∞ 200/200 0.266 0/200 Exploratory C1 0.30 8 62/200 0.267 0/200 Exploratory C1 0.30 4 2/200 0.263 0/200 Exploratory C1 0.30 2,1,0.52,1,0.5 0/200 each none 0/200 each Table 2: Exploratory C1 utility; acceptance is conditional on firing. Setting (named in full): information-lift score on the RAGTruth C1 cell at exploratory r⋆=0.30r_ =0.30, 200200 trials, first-fire policy. This is a different score from the ReDeEP-style rows of Tables 8 and 9 (which also differ from each other in threshold protocol and support), so firing rates must not be compared across these tables: the 2/2002/200 at ε=4 =4 here and the 200/200200/200 at ε=4 =4 there are different scores on their own settings, not a contradiction. The registered 0.10/0.20 targets fire in no core cell or policy (0/500 each). Violations audit all thresholds/rounds, not only deployed trials. Feeding the same DP-noised histograms to methods that make no private claim breaks them: those naive adaptations violate their own bounds in 146 to 198 of 200 trials, while the private rules never do. Table 3 reports the full audit. The finite-ε entries for Anytime-Valid CRC, Yu-Liu, CSA, and the exact federated histogram are not competing private certificates: their 146146 to 198198 violations show that post hoc Gaussian perturbation does not preserve their native guarantees, and they establish nothing about superiority over a correctly privatized version, so the table is a failure-mode audit rather than a leaderboard. We do implement a private betting capital heuristic (Table 5, Appendix G), but we do not prove its validity and therefore do not present it as a privacy-valid competitor either. The private ratio, Fed-SRC-C, and Fed-SRC-VA remain valid but mostly abstain. Certificate Accept. ε=∞ =∞ Accept. ε=4 =4 Accept. ε=1 =1 Δ vs. Fed-SRC-C at ε=4 =4 Zero-cert. ε=4 =4 Worst violations/200 Central non-private CRC/LTT 0.323 0.323 0.323 +0.061+0.061 0.000 2 Federated non-private histogram 0.321 0.325 0.365 +0.063+0.063 0.000 190 Private stitched ratio 0.271 abstains abstains none 1.000 0 Fed-SRC-C 0.267 0.262 abstains 0 0.984 (500 tr.) 0 Fed-SRC-VA 0.197 abstains abstains none 1.000 (500 tr.) 0 Anytime-Valid CRC 0.271 0.270 0.350 +0.008+0.008 0.350 (200 tr.) 146 Yu-Liu 0.449 0.435 0.418 +0.173+0.173 0.000 (200 tr.) 198 CSA 0.177 0.189 0.289 −0.073-0.073 0.000 (200 tr.) 193 Table 3: C1 stress test at exploratory r⋆=0.30r_ =0.30. Trial counts differ by row and are stated in the zero-certificate column: the Fed-SRC-C and Fed-SRC-VA rows come from the 500-trial core audit and the remaining rows from 200 paired trials; the two are never pooled. For methods without a private guarantee, finite-ε columns are deliberately naive adaptations that consume the same DP-noised histograms without a noise envelope. Their violations are negative controls, not privacy-valid baseline results. Native assumptions and per-setting violations are in the appendix. At ε=4 =4, the exploratory certificate fires in only 1% of trials; at ε≤2 ≤ 2 it never fires. The nearly constant 0.263 to 0.267 acceptance among firing trials must therefore not be read as population-wide utility. The method is sound in this audit but close to operationally null under finite privacy. 7.1 RQ3: Privacy-utility and score diagnostics ε Fired Accept. Risk (cal.) Risk (h-o) H-o acc. n H-o err. H-o risk 95% CP H-o fail 95% CP NtN_t Unique Rounds Violations ∞ 200/200 0.140 0.069 0.105 44.6 4.7 [0.037,0.241][0.037,0.241] [0.000,0.018][0.000,0.018] 19015 480 19.0 0/200 8 183/200 0.125 0.057 0.074 40.1 3.0 [0.016,0.204][0.016,0.204] [0.000,0.020][0.000,0.020] 28513 480 28.5 0/200 4 11/200 0.124 0.057 0.074 39.7 2.9 [0.016,0.204][0.016,0.204] [0.000,0.285][0.000,0.285] 29363 480 29.4 0/200 2 0/200 none none none none none none none none none none 0/200 1 0/200 none none none none none none none none none none 0/200 Table 4: HaluEval question answering with information lift at the registered secondary target r⋆=0.20r_ =0.20. Settings are m=20m=20, K=5K=5, T=30T=30, 200 records per client per round, amin=0.05a_ =0.05, αs=αn=0.025 _ s= _ n=0.025, δpriv=0.000001 _ priv=0.000001, 200 trials per cell, 480 calibration responses, and 320 held out responses. Calibration risk is exact only on the frozen calibration populations and does not establish generalization. Accepted held out counts and errors are means over fired trials. The exact 95% Clopper Pearson risk intervals use the displayed rounded counts; their upper endpoints, 0.2410.241, 0.2040.204, and 0.2040.204, exceed the target, so only the point estimates are below 0.200.20. The failure interval instead bounds the fraction of fired trials whose held out risk exceeded the target. “Unique” counts distinct support items touched relative to NtN_t. Threshold provenance and interval definitions appear in the text. The primary target r⋆=0.10r_ =0.10 never certifies and is omitted. At the exploratory target r⋆=0.30r_ =0.30, all trials certify through ε=4 =4, and 187 of 200 certify at ε=2 =2. (Table 4). HaluEval has no separate development split: the 800800 QA responses are exhausted by the pair-disjoint 60/4060/40 calibration/held-out split, and the m=20m=20 thresholds are the equally spaced quantiles of the calibration-split score distribution, computed once before any release and without touching any correctness label or held-out item. Threshold placement therefore adapts to the calibration score marginal but cannot be test-driven or label-driven; the score transformation is the fixed norm01 map with no tuned parameters. This support-derived construction is not the fixed-in-advance grid the theorem contract states, so we make the salvaging conditioning formal rather than implicit: Proposition 14 (Appendix N) shows that, conditional on the frozen calibration support, the quantile grid is a deterministic label-free function of the conditioning variable, so Theorem 7 applies verbatim with the grid treated as fixed, and the reported HaluEval guarantee is conditional on that frozen public support, the same conditioning the finite-population audit already uses. This differs from the RAGTruth full-support audit (Table 9), which reserves a labeled development split for thresholds. The held-out interval is an exceedance bound over fired trials, not a selective-risk confidence interval; an earlier caption claimed no such interval reaches the target, which is wrong and is withdrawn: at ε=4 =4 only 1111 trials fire, so the bound is [0,0.285][0,0.285] and exceeds r⋆=0.20r_ =0.20 purely through the small fired count. The direct statement at ε=4 =4 is: observed held-out risk 0.0740.074 over a mean of 39.739.7 accepted held-out items and 2.92.9 errors per fired trial, with exact interval [0.016,0.204][0.016,0.204] at those counts (Table 4). Because that upper endpoint exceeds 0.200.20, held-out risk below target is a point-estimate claim, not a certified bound; per-threshold accepted counts, observed losses, and exact intervals are released in the artifact. The information-lift firing-rate curve that an earlier draft foregrounded here (near-vacuous 1%1\% firing at ε=4 =4, 0 at ε≤2 ≤ 2; acceptance 0.2630.263 to 0.2670.267 conditional on firing) is superseded as a headline: the decisive positive results are the registered-target HaluEval curve above and the full-support RAGTruth audit (Table 9), and the near-vacuity numbers remain in Table 2. The score gate also fails its lift-centred hypothesis, but not in the direction a single dataset suggested. On the shared RAGTruth responses lift certifies nothing while a development-frozen Mistral ReDeEP-style adaptation fires in every C1 trial; on HaluEval question answering the ordering reverses, and FRANQ certifies HaluEval summarization where both abstain. Over the six dataset-task cells, lift and the mechanistic score each certify exactly one cell, and not the same one. We therefore claim no ranking among scores: none we tested dominates, so a score-agnostic construction is the right object because the winning score is not knowable in advance. Appendix E gives the full argument. 7.2 RQ4: Reachability, transfer, and a capital-based comparator ε Capital heuristic fired accept. Fed-SRC-C fired accept. ∞ 200/200 0.408 200/200 0.426 88 200/200 0.390 200/200 0.396 44 0/200 abstains 200/200 0.354 22 0/200 abstains 197/200 0.331 11 0/200 abstains 19/200 0.286 Table 5: An exploratory capital heuristic comparator. Every other comparator in Table 3 is a non-private construction, so its finite-ε entry is a naive adaptation; we additionally implement a private betting construction in the spirit of Csillag and Mesquita (2025) and Jacobsen et al. (2026). We do not prove it is an e-process (the truncation step breaks the supermartingale property), so we call it a capital heuristic, and this table is exploratory rather than a privacy-valid comparison; it cannot support any claim of comparative superiority. Both rules read the identical released histograms and share the failure budget; the heuristic is given its own longer horizon (400 rounds versus 30) and its best predictable betting fraction, because capital compounds per round and matching the boundary rule’s horizon would under-power it by construction. Protocol and its unproved step. The null is the composite H0:ℛQ⋆,j>r⋆H_0:R_Q ,j>r_ at a registered threshold, equivalently dQ⋆,j>0d_Q ,j>0. We bet on the per-round increment xtx_t of D~j,t/nt D_j,t/n_t with a fraction κ∈(0,1]κ∈(0,1] declared before the round, forming capital ∏t(1−κxt) _t(1-κ x_t) and rejecting when it exceeds ||/α|K|/α, the Bonferroni threshold over the declared κ grid. Admissibility requires each factor to be nonnegative and [xt∣ℱt−1]≥0E[x_t _t-1]≥ 0 under H0H_0. Neither holds automatically here, and we do not prove them. The increment inherits the unbounded Gaussian release noise, so we truncate xtx_t to [−1,1][-1,1] to keep the factors nonnegative; truncation changes the conditional mean, so the truncated process is not the one whose validity would follow from Ville’s inequality. Csillag and Mesquita (2025) calibrate a specific biased multiplicative mechanism; that result does not transfer to an arbitrary bet on noised histograms. A valid version needs a bounded, mean-controlled increment and an explicit supermartingale proposition, which we leave to future work. We report the comparison because it is informative about where capital-based rules lose power under privacy, not as evidence of relative validity. Setting (named in full): RAGTruth C1 (QA, Mistral-7B), ReDeEP-style score on the full 839839-response cell, exploratory r⋆=0.30r_ =0.30, 200200 trials, first-fire policy, m=20m=20 thresholds at calibration-score quantiles, T=30T=30 rounds for Fed-SRC-C and 400400 for the heuristic (p23_eta_dpe_ragtruth.json). The Fed-SRC-C column differs from Table 9 (1919 versus 5555 of 200200 at ε=1 =1) because Table 9 draws its thresholds from a separate development split under its own audit protocol and seed; the two protocols are named in their captions, are not interchangeable, and are never averaged. The heuristic does certify without privacy and at the loosest budget, so it is a functioning rule rather than a straw man; its capital cannot outrun the per-round privacy charge once the budget tightens. Neither rule violated its bound in these runs, but for the capital heuristic that is an observation, not a guarantee. Repeating the C1 analysis on all 839 matched responses with the ReDeEP-style score changes the picture qualitatively (Table 9): under a three-way development/calibration/held-out split whose thresholds come from development only, certification holds in 200 of 200 trials at ε∈∞,8,4,2 ∈\∞,8,4,2\ and 55 of 200 at ε=1 =1, with no violation at any level and held-out point-estimate risk below target throughout. An earlier draft attributed this change to the larger support and called the near-vacuous 2 of 200 information-lift firing rate at ε=4 =4 a small-support artifact. We withdraw that causal claim: the rerun changes the score and the support simultaneously, and Table 8 already reports the ReDeEP-style score firing in 200 of 200 trials at ε=4 =4 on the same 300-response setting. The evidence therefore identifies score quality as the operative cause; support size is confounded with the score change and is not established as causal by these runs. Support size and event count remain distinct: the schedule fixes the latter, and Table 6 shows a 120-item support still certifies by raising reuse to 78×78×. On HaluEval question answering, whose balanced pairing gives a base rate of 0.50.5, the same certificate certifies the registered secondary target r⋆=0.20r_ =0.20 in all 200 non-private trials and in 183 of 200 at ε=8 =8, falling to 11 of 200 at ε=4 =4 (Table 4). At exploratory r⋆=0.30r_ =0.30 it fires in every trial through ε=4 =4 and in 187 of 200 at ε=2 =2. Held-out point-estimate risk on an item-disjoint deployment split is below target in every firing cell, so this is not an artifact of evaluating on the calibration population; the direct exact intervals at the realized accepted counts have upper endpoints at or above the target (Table 4), so held-out selective risk is not statistically certified below it. No registered target fires anywhere on RAGTruth, so reachability is score and dataset dependent. The cost is unchanged: Table 6 shows certification still consumes 30 to 78 stream events per unique calibration item.Sweeping both routes into ηt _t yields nonzero ηt _t at selection at every declared level, priced in acceptance, with abstention once the transfer exceeds what the margin absorbs and no violation anywhere (Table 10). For the drift route we compute the realized total variation in closed form rather than assuming the perturbation size bounds it. An earlier grid reported ηt=0 _t=0 everywhere only because its single stress level declared ηt=0.40>r⋆ _t=0.40>r_ , which forces abstention before ηt _t is ever observed.We additionally run a private betting capital heuristic on the identical releases under the same budget. It certifies without privacy and at ε=8 =8, then abstains at ε≤4 ≤ 4 where Fed-SRC-C still fires at ε=2 =2. We do not prove this construction valid, so it is a diagnostic rather than a privacy-valid baseline; the protocol, the unproved step, and the table are in Appendix G. 8 Discussion and Conclusion We presented Fed-SRC, an auditable, score agnostic certificate that preserves client event boundaries. Finite histograms of scores and errors provide sensitivity independent of threshold count, while pathwise zCDP accounts for the adaptive transcript. Record indexed and variance indexed martingales permit predictable recruitment, dropout, threshold selection, and optional stopping. A range one total variation term transfers validity from the realized calibration mixture to a declared deployment mixture. The certificate controls expected declared loss among accepted outputs, not the truth of individual responses.The simultaneous bounds remained valid across all tested cells, privacy levels, policies, scores, and transfer settings. Power nevertheless depended strongly on the score and population. The registered target r⋆=0.10r_ =0.10 abstained everywhere. The target r⋆=0.20r_ =0.20 certified HaluEval question answering without privacy but abstained on RAGTruth, while the exploratory target r⋆=0.30r_ =0.30 reached ε=2 =2 on full supports. Naive privatization continued certifying only by violating validity, and the capital heuristic remains unproved. The main limitations are repeated event use, with 30 to 78 stream events per unique item, and abstention at tight targets. Reducing reuse and establishing a competitive private baseline are the clearest priorities.The novelty lies in the private federated combination rather than its individual components. CSA and the Yu and Liu certificate provide closely related nonprivate precedents for anytime selective risk control and joint risk and acceptance guarantees (Khosravi and Huo, 2026; Yu and Liu, 2026). Our contribution is extending this combination to event level privacy, federated releases, adaptive schedules, and mixture transfer. Limitations The guarantee is marginal selective risk under a declared mixture, not input-conditional or subgroup-conditional risk. A subgroup version can be obtained by pre-registering subgroup-specific histograms and allocating the error/privacy budgets, at additional sample and communication cost. The information-lift instantiation requires probability access under both the evidence and evidence-removed prompts; the certificate itself can consume any bounded score. Evidence removal is a modeling intervention: prompt length or format may change behavior for reasons unrelated to factual support. Validity is relative to the declared loss. Human disagreement, weak LLM-as-a-judge labels, or a mismatch between answer correctness and evidence faithfulness can make that loss an imperfect proxy for the intended harm. The evaluation now covers two datasets, but the second is weaker as an endpoint, not merely different: HaluEval’s hallucinated members are ChatGPT-generated and filtered rather than human-adjudicated, and its scores are cross-model. We do not vary the annotation rule within either dataset, so label-noise sensitivity is bounded by construction rather than measured. Operational private utility is limited at the registered targets. The primary target r⋆=0.10r_ =0.10 certifies nowhere. At the secondary target r⋆=0.20r_ =0.20, HaluEval fires in 11 of 200 trials at ε=4 =4 and never at ε≤2 ≤ 2, and RAGTruth abstains at every budget; the strong ε=2 =2 results use the exploratory target r⋆=0.30r_ =0.30. Every positive private cell consumes roughly 20×20× to 78×78× event reuse. The experiments therefore establish occurrence-level private certification, not compelling unique-item, source-level, or contributor-level deployment evidence. The main privacy statement is event-level DP for one stream occurrence. In the finite-population audit, with-replacement occurrences are hypothetical private events drawn from a frozen empirical law; the guarantee is not privacy for the 839 public support responses, nor for their contributors. Table 6 quantifies how binding this is: certification draws 30 to 78 events per unique calibration item, so an item-level or person-level guarantee must compose over all of those occurrences. If one support response, source document, or person contributes repeatedly, all occurrences must be charged together. User- or source-level protection therefore requires bounded contribution and a recalibrated accountant. The mechanism also does not hide public padded participation metadata. The transfer term is now exercised at nonzero ηt _t on both datasets, but only through radii we declare ourselves; no γk _k is justified by an external shift audit and we do not report shifted deployment risk, so the drift route remains a sensitivity analysis. The finite-ε rows of Table 3 remain naive privatizations and establish nothing about ranking. The capital heuristic of Table 5 is not a privacy-valid baseline either: we do not prove its betting factors admissible or its truncated increment a supermartingale, so the paper still contains no proved private competitor. Validity-preserving DP e-value mechanisms and optimal private e-value testing rates now exist (Csillag and Mesquita, 2025; Jacobsen et al., 2026); adapting them to private federated selective risk is nontrivial, but an unproved heuristic cannot fill that comparison slot. Supplying a proved comparator, or proving this construction, is required future work. All comparator scores are our reimplementations rather than released code, and the ReDeEP-style row is a development-frozen Mistral adaptation, so conclusions about those methods as published are correspondingly weak. The range-only stitched boundary favors proof transparency over tightness. The variance-adaptive alternative can improve sampling width when accepted mass is small, but it can remain loose when its accepted-mass upper bound or the DP noise envelope dominates. Betting confidence sequences may improve acceptance further, but must be integrated with the same joint acceptance/noise event. Adaptive recruitment is covered only when it is predictable: the identity, batch size, and noise scale for the next release must be chosen before seeing that release’s records or Gaussian noise. A service that peeks at an unreleased batch, retains favorable records, or lets dropout depend on current unreported losses violates Assumption 1. Privacy additionally requires the visible schedule to depend only on public information and earlier DP messages; otherwise the schedule itself can leak data. Ethical Considerations Privacy-preserving calibration reduces disclosure from released summaries but does not make the underlying language-model deployment safe. Differential privacy does not prevent model memorization outside this calibration protocol, secure raw-data storage failures, or harms caused by accepted outputs. The selected εpriv _ priv, target risk, loss severity, and subgroup coverage must be justified for the application rather than treated as universal defaults. The certificate can create false reassurance if “supported by retrieved evidence” is presented as “true in the world.” We recommend displaying the declared loss, target distribution, risk level, privacy unit, and time of last calibration with every deployed certificate. High-stakes applications require domain-expert review and a fallback process for abstained or contested outputs. References Y. Abbasi Yadkori, I. Kuzborskij, D. Stutz, A. György, A. Fisch, A. Doucet, I. Beloshapka, W. Weng, Y. Yang, C. Szepesvári, A. T. Cemgil, and N. Tomasev (2024) Mitigating LLM hallucinations via conformal abstention. arXiv preprint arXiv:2405.01563. Cited by: §D.3. S. Akter, I. F. Shihab, and A. Sharma (2025) Selective risk certification for LLM outputs via information-lift statistics: PAC-Bayes, robustness, and skeleton design. arXiv preprint arXiv:2509.12527. Cited by: Appendix A, §1, §2. S. Akter, I. F. Shihab, and A. Sharma (2026) Anytime-valid answer sufficiency certificates for LLM generation via sequential information lift. arXiv preprint arXiv:2510.06478. Note: version 2 Cited by: Appendix A, §2. A. N. Angelopoulos, S. Bates, E. J. Candès, M. I. Jordan, and L. Lei (2025) Learn then test: calibrating predictive algorithms to achieve risk control. The Annals of Applied Statistics 19 (2). Cited by: Appendix A, §2. A. N. Angelopoulos, S. Bates, A. Fisch, L. Lei, and T. Schuster (2024) Conformal risk control. In The Twelfth International Conference on Learning Representations, Cited by: Appendix A, §2. B. Balle and Y. Wang (2018) Improving the Gaussian mechanism for differential privacy: analytical calibration and optimal denoising. In Proceedings of the 35th International Conference on Machine Learning, p. 394–403. Cited by: §B.1. R. F. Barber, E. J. Candès, A. Ramdas, and R. J. Tibshirani (2023) Conformal prediction beyond exchangeability. The Annals of Statistics 51 (2), p. 816–845. Cited by: Appendix A, §N.2. S. Bates, A. Angelopoulos, L. Lei, J. Malik, and M. I. Jordan (2021) Distribution-free, risk-controlling prediction sets. Journal of the ACM 68 (6), p. 1–34. Cited by: Appendix A. K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth (2017) Practical secure aggregation for privacy-preserving machine learning. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, p. 1175–1191. Cited by: Appendix C. M. Bun and T. Steinke (2016) Concentrated differential privacy: simplifications, extensions, and lower bounds. In Theory of Cryptography Conference, p. 635–658. Cited by: §I.2, §I.2. D. Csillag and D. Mesquita (2025) Differentially private e-values. arXiv preprint arXiv:2510.18654. Cited by: Appendix A, §O.4, §2, Table 5, Limitations. P. Dubey and X. Huo (2026) Anytime-valid federated conformal RAG for LLM swarms. arXiv preprint arXiv:2605.29139. Cited by: Appendix A, §2. C. Dwork and A. Roth (2014) The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science 9 (3–4), p. 211–407. Cited by: §B.1. E. Fadeeva, A. Rubashevskii, D. Piatrashyn, R. Vashurin, S. Dhuliawala, A. Shelmanov, T. Baldwin, P. Nakov, M. Sachan, and M. Panov (2026) Faithfulness-aware uncertainty quantification for fact-checking the output of retrieval-augmented generation. In Findings of the Association for Computational Linguistics: ACL 2026, p. 6814–6836. Cited by: Appendix A, §2. S. Farquhar, J. Kossen, L. Kuhn, and Y. Gal (2024) Detecting hallucinations in large language models using semantic entropy. Nature 630 (8017), p. 625–630. Cited by: Appendix A, §1, §2. S. R. Howard, A. Ramdas, J. McAuliffe, and J. Sekhon (2021) Time-uniform, nonparametric, nonasymptotic confidence sequences. The Annals of Statistics 49 (2), p. 1055–1080. Cited by: Appendix A, §2. B. Hultberg, D. Zachariah, and A. H. Ribeiro (2026) Anytime-valid conformal risk control. arXiv preprint arXiv:2602.04364. Cited by: Appendix A, §2. P. Humbert, B. Le Bars, A. Bellet, and S. Arlot (2023) One-shot federated conformal prediction. In Proceedings of the 40th International Conference on Machine Learning, p. 14153–14177. Cited by: Appendix A, 8th item, §2. B. Jacobsen, T. Gonzalez, G. Brown, K. Fawaz, and A. Ramdas (2026) Optimal rates for differentially private hypothesis testing with e-values. arXiv preprint arXiv:2605.28952. Note: version 2 Cited by: Appendix A, Table 5, Limitations. M. Kang, N. M. Gürel, N. Yu, D. Song, and B. Li (2024) C-RAG: certified generation risks for retrieval-augmented language models. In Proceedings of the 41st International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 235, p. 22963–23000. Cited by: Appendix A, §O.4, §2, §6. H. Khosravi and X. Huo (2026) Conformal selective acting: anytime-valid risk control for RLVR-trained LLMs. arXiv preprint arXiv:2605.20270. Cited by: Appendix A, §2, §8. J. Li, X. Cheng, W. X. Zhao, J. Nie, and J. Wen (2023) HaluEval: a large-scale hallucination evaluation benchmark for large language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, p. 6449–6464. Cited by: Table 11. C. Lu, Y. Yu, S. P. Karimireddy, M. I. Jordan, and R. Raskar (2023) Federated conformal predictors for distributed uncertainty quantification. In Proceedings of the 40th International Conference on Machine Learning, p. 22942–22964. Cited by: Appendix A, 8th item, §2. P. Manakul, A. Liusie, and M. Gales (2023) SelfCheckGPT: zero-resource black-box hallucination detection for generative large language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, p. 9004–9017. Cited by: Appendix A, §1, §2. S. Min, K. Krishna, X. Lyu, M. Lewis, W. Yih, P. W. Koh, M. Iyyer, L. Zettlemoyer, and H. Hajishirzi (2023) FActScore: fine-grained atomic evaluation of factual precision in long form text generation. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, p. 12076–12100. Cited by: §1. C. Niu, Y. Wu, J. Zhu, S. Xu, K. Shum, R. Zhong, J. Song, and T. Zhang (2024) RAGTruth: a hallucination corpus for developing trustworthy retrieval-augmented language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, p. 10862–10878. Cited by: Appendix A. V. Plassier, M. Makni, A. Rubashevskii, E. Moulines, and M. Panov (2023) Conformal prediction for federated uncertainty quantification under label shift. In Proceedings of the 40th International Conference on Machine Learning, p. 27907–27947. Cited by: Appendix A. A. Ramdas, P. Grünwald, V. Vovk, and G. Shafer (2023) Game-theoretic statistics and safe anytime-valid inference. Statistical Science 38 (4), p. 576–601. Cited by: Appendix A. Z. Sun, X. Zang, K. Zheng, Y. Song, J. Xu, X. Zhang, W. Yu, Y. Song, and H. Li (2024) ReDeEP: detecting hallucination in retrieval-augmented generation via mechanistic interpretability. arXiv preprint arXiv:2410.11414. Cited by: Appendix A, §O.4, §2. V. Vovk, A. Gammerman, and G. Shafer (2005) Algorithmic learning in a random world. Springer. Cited by: Appendix A. Z. Wang, J. Duan, L. Cheng, Y. Zhang, Q. Wang, X. Shi, K. Xu, H. T. Shen, and X. Zhu (2024) ConU: conformal uncertainty in large language models with correctness coverage guarantees. In Findings of the Association for Computational Linguistics: EMNLP 2024, p. 6886–6898. Cited by: Appendix A, §2. Z. Wang, Q. Wang, Y. Zhang, T. Chen, X. Zhu, X. Shi, and K. Xu (2025) SConU: selective conformal uncertainty in large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, p. 19052–19075. Cited by: Appendix A, §2. I. Waudby-Smith, S. Wu, and A. Ramdas (2023) Nonparametric extensions of randomized response for private confidence sets. In Proceedings of the 40th International Conference on Machine Learning, p. 36748–36789. Cited by: Appendix A, §2. J. Whitehouse, A. Ramdas, R. Rogers, and S. Wu (2023) Fully-adaptive composition in differential privacy. In Proceedings of the 40th International Conference on Machine Learning, p. 36990–37007. Cited by: §I.2. J. Wu, C. Zhang, Z. Cai, J. Kong, B. Jiang, L. Kong, and L. Kong (2026) Differentially private conformal prediction. arXiv preprint arXiv:2604.14621. Cited by: Appendix A. X. Yu and J. Liu (2026) A joint finite-sample certificate for adaptive selective conformal risk control. arXiv preprint arXiv:2606.08517. Cited by: Appendix A, §2, §8. Appendix A Expanded Related Work RAGTruth provides naturally generated RAG responses with response- and span-level human annotations (Niu et al., 2024). SelfCheckGPT detects sampling inconsistency (Manakul et al., 2023), semantic entropy groups generations by meaning before measuring uncertainty (Farquhar et al., 2024), and ReDeEP uses mechanistic signals intended to separate external-context use from parametric knowledge (Sun et al., 2024). FRANQ is especially relevant because it separates faithfulness to retrieved context from world factuality (Fadeeva et al., 2026); ConU and SConU provide conformalized self-consistency for open-ended generation (Wang et al., 2024, 2025). These methods are scores or prediction-set baselines. Our certificate is score-agnostic and never pools faithfulness, factuality, and answer correctness into one loss. Information-lift certification and Sequential-EDFL motivate the score we set out to certify (Akter et al., 2025, 2026). Sequential-EDFL certifies a skeleton-relative generation-time information-lift property, not factual correctness, federated privacy, or deployment selective risk. We do not claim a new lift construction or a new anytime information-lift process. Risk-controlling prediction sets, conformal risk control, and Learn-then-Test give finite-sample calibration under explicit sampling assumptions (Vovk et al., 2005; Bates et al., 2021; Angelopoulos et al., 2024, 2025). C-RAG applies conformal risk analysis directly to RAG generation and distribution shift (Kang et al., 2024); our distinction is the federated private adaptive transcript, not RAG risk certification itself. Confidence sequences make inference uniform over time (Howard et al., 2021; Ramdas et al., 2023). Anytime-Valid CRC extends CRC to a growing calibration sample (Hultberg et al., 2026). Conformal Selective Acting already uses the gated excess-loss contrast for anytime LLM risk (Khosravi and Huo, 2026), and Yu and Liu give a variance-adaptive selective-risk/acceptance certificate (Yu and Liu, 2026). Their methods are direct baselines; neither the contrast statistic nor an acceptance floor is claimed as independently novel here. Federated conformal methods address distributed quantiles, communication, non-IID clients, and label shift (Lu et al., 2023; Humbert et al., 2023; Plassier et al., 2023). Anytime-FC-RAG provides federated anytime coverage while leaving DP outside its first version (Dubey and Huo, 2026). Private confidence sequences and private e-values show that privacy and anytime validity can coexist (Waudby-Smith et al., 2023; Csillag and Mesquita, 2025; Jacobsen et al., 2026); recent private conformal work studies efficient private calibration (Wu et al., 2026). Non-exchangeable conformal work also motivates attaching total-variation terms to observations or expectations, not treating one per-example distance as one block-level penalty (Barber et al., 2023). Accordingly, “anytime,” “selective LLM risk,” “federated,” “private anytime inference,” the gated contrast, and variance-adaptive selective-risk certificates are all prior art. The contribution evaluated here is their joint deployment contract: a finite event-level-DP federated release, a pathwise accountant, validity under certificate-driven recruitment and stopping, and transfer from the adaptively realized client mixture to a declared deployment mixture. Appendix B Full Guarantee Statements Assumption 1 (Calibration stream). Let ℱi−1F_i-1 contain all calibration records and release randomness strictly before record i. The identity CiC_i is ℱi−1F_i-1-measurable and Wi∣ℱi−1∼PCiW_i _i-1 P_C_i. Monitored round endpoints are non-anticipating prefixes. Each realized release set, batch size, and noise scale is fixed before drawing its fresh data and Gaussian noise; each fresh noise vector has the conditional distribution in Equation (15). The score, loss, clipping level, bins, and model are fixed before these records are observed. For the privacy statement, every server-visible scheduling action is a function only of public metadata, external randomness, and previous DP transcript messages. Assumption 1 allows different laws for every client and permits certificate-driven recruitment, escalation, and stopping: the next action may depend on the entire earlier private transcript. It excludes choosing a client or retaining a record after inspecting that same unseen record. It also excludes training the lift score on the certification records; that case requires a separate split or another uniform-validity argument. B.1 Privacy Lemma 2 (Histogram sensitivity). Under add/remove record adjacency and ℓ∈[0,1] ∈[0,1], the concatenated count and error histogram in Equations (13) and (14) has L2L_2 sensitivity at most 2 2. The bound is attained when the added record has ℓ=1 =1. Theorem 3 (Transcript privacy). For each message, Equation (15) is ρk,t _k,t-zCDP with ρk,t=1σk,t2. _k,t= 1 _k,t^2. (31) For any calibration record i and admissible transcript path τ, let ℐτ(i)I_τ(i) be the releases to which that record contributes. If a deterministic privacy filter enforces the pathwise bound ρtr=supτsupi∑(k,t)∈ℐτ(i)1σk,t2 _ tr= _τ _i _(k,t) _τ(i) 1 _k,t^2 (32) then the complete adaptive transcript is ρtr _ tr-zCDP. Consequently, for every δpriv∈(0,1) _ priv∈(0,1), it is (εpriv,δpriv)( _ priv, _ priv)-DP with εpriv=ρtr+2ρtrlog(1/δpriv). _ priv= _ tr+2 _ tr (1/ _ priv). (33) In the disjoint-batch protocol, each record appears in at most one release and ρtr=supτmax(k,t)∈τσk,t−2 _ tr= _τ _(k,t)∈τ _k,t^-2; the number of clients and rounds does not enter that event’s privacy loss. If one person or source record contributes several stream events, all corresponding releases must instead be included in ℐτ(i)I_τ(i). For a fixed nonadaptive schedule, the suprema reduce to the corresponding realized maxima. For a target (εpriv,δpriv)( _ priv, _ priv), define ρ⋆=(log(1/δpriv)+εpriv−log(1/δpriv))2. _ = ( (1/ _ priv)+ _ priv- (1/ _ priv) )^2. (34) Using σk,t≥1/ρ⋆ _k,t≥ 1/ _ for disjoint batches is sufficient. This calibration is valid for all εpriv>0 _ priv>0. By contrast, the classical sufficient calibration σ≥Δ22log(1.25/δ)/εσ≥ _2 2 (1.25/δ)/ is stated for ε∈(0,1) ∈(0,1) (Dwork and Roth, 2014). The analytic Gaussian mechanism can calibrate a single fixed release more tightly (Balle and Wang, 2018); we use zCDP because Equation (32) composes transparently over the adaptive transcript, including the experimental values ε>1 >1. B.2 Anytime-valid selective risk Lemma 4 (Simultaneous clean-count bounds). Under Assumption 1, with probability at least 1−αs1- _ s, simultaneously for every t∈+t _+ and j∈[m]j∈[m], NtzQ¯t,j N_tz_ Q_t,j ≤Zj,t+ht(αs), ≤ Z_j,t+h_t( _ s), (35) NtaQ¯t,j N_ta_ Q_t,j ≥Aj,t−ht(αs), ≥ A_j,t-h_t( _ s), (36) where Aj,tA_j,t and Zj,tZ_j,t are the corresponding unnoised cumulative counts. Lemma 5 (Simultaneous Gaussian envelopes). With probability at least 1−αn1- _ n, simultaneously for every t∈+t _+ and j∈[m]j∈[m], Zj,t Z_j,t ≤Z~j,t+gj,t(αn), ≤ Z_j,t+g_j,t( _ n), (37) Aj,t A_j,t ≥A~j,t−gj,t(αn). ≥ A_j,t-g_j,t( _ n). (38) Lemma 6 (Client-mixture transfer). For Q⋆Q , Q¯t Q_t, and ηt _t defined in Equations (7) and (8), TV(Q⋆,Q¯t)≤ηt.TV(Q , Q_t)≤ _t. (39) Hence for every j, zQ⋆,j z_Q ,j ≤zQ¯t,j+ηt, ≤ z_ Q_t,j+ _t, (40) aQ⋆,j a_Q ,j ≥aQ¯t,j−ηt. ≥ a_ Q_t,j- _t. (41) Theorem 7 (Private federated anytime risk certificate). Under Assumption 1, with probability at least 1−αs−αn1- _ s- _ n over the calibration records and DP noise, ℛQ⋆,j≤Uj,tfor all t∈+ and j∈[m]R_Q ,j≤ U_j,t all t _+ and j∈[m] (42) whenever the denominator in Equation (5) is positive. Therefore, for any stopping time t t and any threshold j j chosen as an arbitrary measurable function of the private transcript up to t t, Uj^,t^≤r⋆⟹ℛQ⋆,j^≤r⋆U_ j, t≤ r_ _Q , j≤ r_ (43) on the same event. No additional multiple-testing or optional-stopping correction is required. Corollary 8 (Width decomposition). Ignoring clipping at 0 and 11, for Vj,t>0V_j,t>0 the error and acceptance mean bounds each contain O(log(m/αs)+loglog(eNt)Nt)⏟sampling O\! ( (m/ _ s)+ (eN_t)N_t )_sampling +O(maxVj,t,v0Ntlog(m/αn)+loglog(e+Vj,tv0))⏟privacynoise. + O\! ( \V_j,t,v_0\N_t (m/ _ n)+ \! (e+ V_j,tv_0 ) )_ subarraycprivacy\\ noise subarray. (44) and the noise term is zero when Vj,t=0V_j,t=0. The risk transfer additionally pays ηt _t in both numerator and denominator. With K equal-noise clients each contributing n records in each of t rounds and v0≤djKtσ2v_0≤ d_jKtσ^2, Nt=KntN_t=Knt and Vj,t=djKtσ2V_j,t=d_jKtσ^2, so the privacy term scales as σnKtO(djlog(m/αn)+loglog(e+djKtσ2/v0)). σn Kt\,O\! ( d_j \ (m/ _ n)+ (e+d_jKtσ^2/v_0) \ ). (45) Interpretation. The theorem separates three distinct issues: • αs+αn _ s+ _ n is the probability that the simultaneous certificate fails. • σ is chosen by the privacy target and widens the certificate. • ηt _t encodes deployment-mixture mismatch and within-client drift. Unlike an additive “α+BK+ρα+BK+ρ” statement, every quantity is either an auditable probability budget or a width/shift term with explicit units and constants. Appendix C Scope and Interpretation Notes What is certified. Fed-SRC certifies the expected declared loss conditional on acceptance for a declared deployment mixture. It does not prove that an individual response is true, that an annotation is infallible, or that retrieval contains all relevant world knowledge. Lift remains a ranking score; statistical calibration creates the risk guarantee. Why arbitrary client heterogeneity is possible. The sampling bound targets the realized mixture Q¯t=∑kw¯k,tPk Q_t= _k w_k,tP_k and does not compare each PkP_k to a fictitious homogeneous law. Heterogeneity matters through score utility and through the distance from w¯t w_t to the desired deployment weights, not through an automatic K multiplier. This is both tighter and more interpretable than a client-wise TV union bound. Failure versus abstention. At strong privacy, small sample sizes, low acceptance, or large shift, the contrast upper bound may remain positive or the acceptance lower bound may fall below amina_ . Abstaining is then the correct behavior. A valid but always-abstaining method is not operationally useful, so all results report acceptance and the zero-certificate rate alongside validity. What adaptivity is covered. An operator may examine the private certificate at round t, decide that it is close to the target, recruit a particular client for round t+1t+1, and later stop when acceptance is adequate. The next choice is predictable, so the record martingale recenters at that chosen client’s law and the Gaussian martingale charges only the realized release variance. The theory does not permit inspecting round-t+1t+1 records before deciding whether they enter the certificate. Trust models. The main protocol protects every client message before it reaches the server. It does not hide public participation metadata: client identity, whether a padded release arrived, its announced slot count, and its noise scale. The zero-out adjacency protects one slot’s histogram contribution conditional on that metadata. Revealing an unpadded data-dependent batch size would invalidate this scope; replacement adjacency or a separately private count would then be required. If secure aggregation is available (Bonawitz et al., 2017), clients can instead jointly realize one aggregate Gaussian perturbation. The statistical theorem is unchanged after replacing Vj,tV_j,t with the actual aggregate-noise variance, but the privacy proof must state the collusion and dropout model. We do not claim secure-aggregation utility unless that protocol is implemented. Appendix D Experimental Protocol Details D.1 Federated partitions For each dataset/model cell, query/reference groups are first assigned to development, calibration, and evaluation. Client construction is applied only within the calibration split, producing frozen client populations. The core uses a preregistered natural domain/task partition plus an IID client baseline. Secondary partitions use Dirichlet label allocation with β∈10,1,0.1β∈\10,1,0.1\ and log-normal client-size imbalance. Examples are never sorted by score and dealt round-robin: that construction approximately balances score ranks and cannot be described as score heterogeneity. Target-mixture experiments alter w while keeping the frozen PkP_k fixed, so ηt=‖w−w¯t‖1/2 _t=\|w- w_t\|_1/2 is known. Stable client-specific slopes or base rates are called heterogeneity, not within-client drift. A nonzero γk _k experiment changes a frozen deployment population and treats γk _k only as a declared sensitivity value unless an independent shift audit justifies it. Dropout is sampled before a requested release at rates 0%, 20%, and 40%; only successful releases enter NtN_t, w¯t w_t, and Vj,tV_j,t. For the theorem audit, PkP_k is the uniform law on the frozen client population and every requested calibration event is sampled independently with replacement. The frozen responses define the support of an empirical law; each occurrence is a distinct event-level privacy unit. The selected threshold is evaluated by enumerating the complete frozen populations. Sampling without replacement and ordinary held-out test risk are reported separately; neither is substituted into the coverage event of Theorem 1. Protecting a unique support item would require composing over every time it is drawn and is not claimed by this audit. D.2 Privacy, monitoring, and repeated trials We report event-level (εpriv,δpriv)( _ priv, _ priv)-DP with δpriv=10−6 _ priv=10^-6. The core uses εpriv∈∞,4,1 _ priv∈\∞,4,1\; values 8,2,0.5\8,2,0.5\ are a registered secondary grid. Noise is calibrated through Equation (34); no privacy value is back-computed from an empirical coverage number. Each stream occurrence enters one histogram release. A support response may be drawn again as another hypothetical event, which preserves the i.i.d. sampling audit but not privacy for that support response. The secondary composition audit includes one event in 1, 2, or 4 separately noised registered transcript queries and charges every such message through Equation (32); it never counts those queries as fresh statistical observations. For positive-noise runs we pre-register v0=min(k,t)admissibleσk,t2v_0= _(k,t)\ admissible _k,t^2; non-private runs have Vj,t=Gc(Vj,t;αn)=0V_j,t=G_c(V_j,t; _ n)=0. We report the choice because v0v_0 affects width even though it does not affect validity. The certificate uses αs=αn=0.025 _ s= _ n=0.025. Each core dataset/model/privacy/policy cell uses 500 independent population-resampling and DP-noise trials; each registered secondary cell uses 200. The client populations, development choices, and evaluation data remain fixed while the trial resampling and noise seeds vary. The server evaluates after every round and uses three policies: (i) fixed final round; (i) first round with a certificate meeting amina_ ; and (i) predictable target-deficit recruitment followed by optional stopping. Theorem 1 covers all three. We additionally evaluate a predictable recruitment controller. After round t, it uses only the released private transcript to decide whether to stop or request another batch and, if continuing, selects a client by a pre-registered target-weight-deficit rule. The decision for round t+1t+1 is made before any record or noise from that round is observed. We log realized ℛtR_t, Nk,tN_k,t, and Vj,tV_j,t so the certificate can be reproduced exactly. D.3 Baselines All score baselines use the same examples, thresholds, loss labels, client partitions, private histogram, and risk target unless the method intrinsically requires different access. • Central non-private: pooled raw records; an unattainable utility reference, not a privacy-preserving competitor. • Federated non-private: exact aggregated histograms; isolates privacy cost. • Local-only: each client calibrates independently; reports both macro- and population-weighted performance. • Private fixed-time: Gaussian-private histograms with a final-round bound but no optional-stopping guarantee. • Schedule-conditioned stitching: the original round-indexed Hoeffding construction that conditions on outcome-independent participation; it is evaluated only as a negative control under adaptive recruitment. • Noise-ignored: applies the clean bound directly to noisy counts; included only as a negative control. • Shift-ignored: sets ηt=0 _t=0 under a shifted deployment mixture; included only as a negative control. • Federated conformal: adapted one-shot and partial- exchangeability baselines (Humbert et al., 2023; Lu et al., 2023); these produce prediction sets, so we report their native coverage/size and do not relabel them as selective-risk methods. For RQ4, we substitute mean token entropy, mean token probability, semantic entropy, SelfCheckGPT, and the self-consistency score used by conformal abstention (Abbasi Yadkori et al., 2024) for SBS_B and apply the identical private certificate. We also report the conformal-abstention method’s native centralized guarantee separately, without presenting it as a federated or private method. This equal-certificate comparison separates the value of information lift from the generic calibration layer and is the main NLP-facing empirical claim. D.4 Metrics and uncertainty The theorem-audit metric is the fraction of repeated trials in which any registered (j,t)(j,t) bound misses its exact frozen-population target. It is unconditional on firing and is compared with αs+αn _ s+ _ n. Selected-policy failure and failure conditional on firing are separate diagnostics with their own denominators and exact Clopper-Pearson intervals. A trial with no certified threshold has undefined conditional failure and zero deployed acceptance. Utility metrics are firing probability, acceptance conditional on firing, certificate width, abstention, rounds to certification, communication bytes, and wall-clock time. Every dataset/model/privacy cell also reports the selected Uj,tU_j,t, ht/Nth_t/N_t, gj,t/Ntg_j,t/N_t, ηt _t, and the zero-certificate rate; otherwise nominal validity could be achieved only through a vacuous bound or universal abstention. Risk estimates on test data are accompanied by exact or bootstrap intervals; paired utility differences use paired bootstrap intervals over the same splits and DP seeds. D.5 Evaluation scope and evidentiary status The executed package uses the three task cells and pooled aggregate in Table 1. It reports simultaneous-bound violations separately from firing, conditional acceptance, and conditional failure. Universal abstention at the registered targets and near-universal abstention at exploratory r⋆=0.30r_ =0.30, ε=4 =4 are results rather than missing cells. The complete records are summarized in Tables 2, 15, and 16; the disabled block above is retained only as a provenance record of a superseded pilot. Appendix E The Score Gate in Full The score gate also fails its lift-centred hypothesis, though not in the direction a single dataset suggested (Tables 8 and 11). On the 300 shared RAGTruth responses per task, lift fires in 0/200 trials in every cell while a development-frozen Mistral ReDeEP-style adaptation fires in 200/200 C1 trials at acceptance 0.343, which in isolation reads as that score dominating lift. The second dataset reverses it: on HaluEval question answering lift fires 200/200 at acceptance 0.134 and the mechanistic score fires 0/200, and FRANQ fires on HaluEval summarization where both of the others abstain. Tallied over the six dataset-task cells we ran, lift and the mechanistic score each certify exactly one cell, and not the same one. We therefore claim no ranking among scores. The defensible conclusion is stronger than “lift is ineffective”: no score we tested dominates, which certificate is worth deploying cannot be decided from the score alone, and a score-agnostic construction is the right object precisely because the winning score is not knowable in advance. The Mistral ReDeEP-style adaptation is neither the released Llama configuration nor evidence about ReDeEP as published. Calib. items Fired Accept. NtN_t at sel. Reuse 120 200/200 0.144 9325 78× 240 200/200 0.112 14905 62× 480 200/200 0.140 14460 30× Table 6: Calibration-size and reuse sweep (HaluEval question answering, ε=4 =4, r⋆=0.30r_ =0.30, 200 trials). Reuse is NtN_t divided by unique calibration items. Firing is preserved as the population shrinks, but reuse rises from 30×30× to 78×78×, so a small calibration set is certified only by drawing each item many times. Because the privacy unit is one stream occurrence, this is precisely the regime in which event-level DP is weakest as a statement about an individual item or contributor. Appendix F Naive-Privatization Stress Test The stress-test table and its discussion now appear in the main results (Table 3); this appendix retains the archived superseded pilot analysis above for auditability. Appendix G The Exploratory Capital-Based Comparator An exploratory capital-based comparator. The naive privatizations in Table 3 are negative controls, so we additionally implement a private betting capital heuristic reading the identical released histograms under the same failure budget. It certifies in 200 of 200 trials without privacy and at ε=8 =8, then abstains at ε≤4 ≤ 4 while Fed-SRC-C still fires at ε=2 =2 (Table 5). We do not prove this construction valid: its increment carries unbounded Gaussian noise, so the truncation that keeps the betting factors nonnegative also perturbs their conditional mean, and no supermartingale proposition is established. The table is therefore a diagnostic about where capital-based rules lose power under privacy, not a validity comparison, and the paper still lacks a proved privacy-valid baseline. Appendix H Supplementary Result Tables Partition K ηt _t Acceptance Selected risk Contrast bound Failure rate IID 5 0.0000 0.261 0.228 -0.0004 0/200 Natural domain/task 5 0.0000 0.264 0.228 -0.0000 0/200 Dirichlet β=0.1β=0.1 5 0.0000 0.542 0.131 -0.0084 0/200 Target-mixture shift (δ=0.01δ=0.01) 5 0.0100 0.367 0.170 -0.0002 0/200 Within-client stability (γ=0γ=0) 5 0.0000 0.260 0.228 -0.0007 0/200 Table 7: Heterogeneity audit (ε=4 =4, exploratory r⋆=0.30r_ =0.30, 200 trials per row). The first three partitions and the last row hold the declared transfer radius at zero, so ηt=0 _t=0 there by construction rather than by measurement. The target-mixture row moves a declared δ=0.01δ=0.01 of deployment weight off the realized participation, so ηt=0.01 _t=0.01 enters the certificate and is observed at selection; Table 10 sweeps that term over its full range in both routes. No row violates its bound. Score C1 accept. C2 accept. C3 accept. C4 accept. Zero-cert. cells Relative compute Information lift abstains abstains abstains abstains 4 11 Mean token probability abstains abstains abstains abstains 4 0 Semantic entropy abstains abstains abstains abstains 4 NsN_s SelfCheckGPT abstains abstains abstains abstains 4 NsN_s SConU/ConU abstains abstains abstains abstains 4 NsN_s ReDeEP-style (Mistral) 0.343 (200/200) abstains abstains abstains 3 0 FRANQ abstains abstains abstains abstains 4 0 Table 8: Matched score comparison at ε=4 =4, exploratory r⋆=0.30r_ =0.30, and 200 trials per cell. Every score uses the identical Fed-SRC-C certificate and the same 300 responses per task; C3 is the pooled aggregate. Parentheses give firing trials. Relative compute counts extra generation passes beyond the original generation. This table is one dataset and must not be read as a score ranking. The single firing entry here is the Mistral ReDeEP-style adaptation on C1, and on HaluEval that ordering reverses: information lift certifies question answering 200/200 while the mechanistic score abstains, and FRANQ certifies HaluEval summarization (Table 11). Over the six dataset-task cells we ran, lift and the mechanistic score each certify exactly one cell and not the same one, so we claim no ordering among scores, only that the certificate is indifferent to which one it is given. ε Fired Accept. Risk (cal.) Risk (h-o) H-o acc. n Trial-exceed. CP NtN_t Unique Rounds H/NH/N G/NG/N Violations ∞ 200/200 0.447 0.201 0.176 98.7 [0.000,0.018][0.000,0.018] 3400 459 3.4 0.0466 0.0000 0/200 8 200/200 0.322 0.160 0.141 68.8 [0.000,0.018][0.000,0.018] 6450 460 6.5 0.0353 0.0146 0/200 4 200/200 0.272 0.141 0.133 56.2 [0.000,0.018][0.000,0.018] 9135 461 9.1 0.0293 0.0205 0/200 2 200/200 0.265 0.141 0.126 55.1 [0.000,0.018][0.000,0.018] 17135 461 17.1 0.0222 0.0285 0/200 1 55/200 0.259 0.142 0.128 56.0 [0.000,0.065][0.000,0.065] 26581 461 26.6 0.0176 0.0446 0/200 Table 9: Full-support C1 privacy curve for the Mistral ReDeEP-style score, with the operational audit and a held-out split (support 839 responses split 125/461/253 into development, calibration, and held-out; the m=20m=20 thresholds are taken from the development split only, so neither calibration nor held-out data selects them). r⋆=0.30r_ =0.30, 200 trials per cell. “Risk (cal.)” is exact on the frozen calibration populations; “Risk (h-o)” evaluates the selected threshold on the untouched held-out split, and “H-o acc. n” is the mean held-out accepted count behind it. “Trial-exceed. CP” is an exact Clopper-Pearson bound on the frequency of trials whose held-out risk exceeded r⋆r_ ; it is a statement about repeated-trial exceedance on one fixed held-out set, not a confidence interval for the held-out selective risk itself, whose uncertainty is governed by the accepted count (at n≈56n\!≈\!56 accepted items, a single-threshold exact interval around the observed 0.130.13 risk has half-width ≈0.09≈ 0.09, so point estimates here should be read at that resolution). Per-threshold selective-risk intervals with accepted counts and observed losses are released in the artifact (p23_selective_ci.json, computed under an independent rerun seed). NtN_t is stream events consumed at selection and “Unique” the distinct support items touched: the 200/200200/200 result at ε=4 =4 costs about 9,1009,100 events over 461461 unique items, roughly 20×20× reuse, so this is not certification from a handful of fresh observations. H/NH/N and G/NG/N are the sampling and privacy widths at selection; G/NG/N grows monotonically with the budget as Corollary 8 predicts. Route ηt _t ηt _t at sel. Fired Accept. Violations Mixture mismatch (δ of target mass moved off the realized participation) δ=0δ=0 0.0000 0.0000 200/200 0.355 0/200 δ=0.002δ=0.002 0.0020 0.0020 200/200 0.335 0/200 δ=0.01δ=0.01 0.0100 0.0100 200/200 0.360 0/200 δ=0.05δ=0.05 0.0500 none 0/200 abstains 0/200 δ=0.40δ=0.40 0.4000 none 0/200 abstains 0/200 Declared within-client drift (γk _k, deployment population really moves) γ=0γ=0 0.0000 0.0000 200/200 0.347 0/200 γ=0.001γ=0.001 0.0010 0.0010 200/200 0.343 0/200 γ=0.005γ=0.005 0.0050 0.0050 200/200 0.348 0/200 γ=0.02γ=0.02 0.0200 0.0200 132/200 0.365 0/200 Table 10: Mixture-transfer term exercised at nonzero ηt _t (ε=4 =4, r⋆=0.30r_ =0.30). Earlier drafts reported ηt=0 _t=0 in every executed cell, which made this contribution untested; the cause was a single stress level declaring ηt=0.40>r⋆ _t=0.40>r_ , so the acceptance floor could never be met and ηt _t was never observed at selection. Sweeping both routes into ηt _t shows the term is charged as derived, prices transfer in lost acceptance, and locates the level at which the rule correctly abstains. Construction. The mixture route moves a declared fraction δ of target weight onto one client while the frozen PkP_k are untouched, so ηt=δ _t=δ holds by Equation (8) and needs no estimation. The drift route perturbs each client’s conditional loss law under an explicit coupling stated here in full: the perturbed law Pk⋆P_k is constructed from PkP_k by keeping the example features (q,z)(q,z) and the acceptance indicator fixed and resampling only the conditional loss ℓ∣ from Bernoulli(q⋆)Bernoulli(q ) in place of Bernoulli(q)Bernoulli(q), with |q⋆−q|=Δ|q -q|= and losses on non-accepted examples unchanged. Under this coupling the two complete example laws over W=(q,z,y,ℓ)W=(q,z,y, ) differ only in the conditional loss on the accepted event, so TV(Pk⋆,Pk)=ak,j|q⋆−q|≤ΔTV(P_k ,P_k)=a_k,j\,|q -q|≤ , where ak,ja_k,j is the client’s acceptance mass: the declared γk=Δ _k= is an upper bound on the full-law TV that the theorem’s premise requires, conservative by exactly the factor ak,ja_k,j. We emphasize what this does and does not audit: TV between the Bernoulli loss marginals would not by itself bound the full-law TV under arbitrary constructions; the equality above holds for this stated coupling, and the declared radii are ours rather than an external shift audit. The radii are still ones we choose rather than an external shift audit, so the rows remain a sensitivity analysis over verified distances. We also do not report shifted deployment risk under the moved mixture, so this experiment shows the term is charged and priced, not that a real deployment shift was survived. The term is charged exactly as derived: ηt _t appears at selection at every declared level, is paid in acceptance, and the rule abstains once the transfer exceeds what the margin can absorb (here above δ≈0.02δ≈ 0.02). Validity is untouched throughout (0 violations at every level). The same sweep on HaluEval question answering reproduces nonzero-ηt _t certification at 0.0005/0.001/0.002/0.005, so this is not an artefact of one cell. Earlier drafts reported ηt=0 _t=0 everywhere only because the single stress level tested declared ηt=0.40>r⋆ _t=0.40>r_ , which forces abstention before ηt _t can be observed. Cell Score AUC Floor Fired Accept. Violations HaluEval qa lift 0.669 0.000 200/200 0.134 0/200 HaluEval qa best 0.712 (franq) 0.300 0/200 abstains 0/200 HaluEval summarization lift 0.605 0.250 0/200 abstains 0/200 HaluEval summarization best 0.732 (franq) 0.175 3/200 0.231 0/200 HaluEval dialogue lift 0.561 0.188 0/200 abstains 0/200 HaluEval dialogue best 0.656 (franq) 0.125 0/200 abstains 0/200 Table 11: Second dataset and second model family: HaluEval (Li et al., 2023) scored with Qwen2.5-7B-Instruct (2400 responses, ε=4 =4, r⋆=0.30r_ =0.30). HaluEval pairs a faithful and a sampled hallucinated response per item, giving a balanced base rate of 0.50.5 against RAGTruth’s skewed 0.410.41 to 0.930.93. We deliberately do not call this loss error-free: the hallucinated members were generated and filtered with ChatGPT, so the pair label is an artifact of that pipeline rather than a human adjudication, and it is a weaker endpoint than RAGTruth’s span annotations even though it is balanced. Scores here are computed by Qwen2.5-7B on responses it did not generate, so this cell is a cross-model diagnostic, not a second matched-generator replication. “Floor” is the noiseless full-data oracle selective risk, the reachability limit for any certificate on that score. On this dataset information lift certifies qa (200/200) while the mechanistic score does not, the exact reverse of the RAGTruth ordering in Table 8. Counting both datasets, information lift and the mechanistic score each certify exactly one of the six dataset-task cells, and not the same one, so we claim no ranking among scores, only that the certificate is indifferent to which score it is handed. That indifference is the contribution: the score that will certify is not knowable in advance. Control Failure rate Acceptance Fed-SRC-VA full n.i.† (0/200 fired) none Noise ignored 1/189 fired 0.209 Noise variance halved 0/5 fired 0.217 Shift ignored n.i.† (0/200 fired) none Fixed-time after stopping 0/73 fired 0.261 Table 12: Observed invalid-control outcomes (200 trials). Noise ignored breaches once; the other broken controls do not breach at this sample size. These null results do not establish that the corresponding terms are unnecessary or that the ablation has adequate power. Cell/method NtN_t H/NH/N or F/NF/N G/NG/N ηt _t 103d¯10^3 d a¯ a True risk Acceptance Decision C1, Fed-SRC-C near-boundary tuple 28875 0.016240.01624 0.011070.01107 0.0000 6.00 0.262 0.228 0.287 abstain Table 13: Representative non-certifying certificate tuple. The displayed 6.00 is 103d¯10^3 d, i.e., d¯=0.00600>0 d=0.00600>0; it is within the statistic’s range and correctly yields abstention. Selection-dependent tuples are undefined in cells with no firing threshold. Cell Unit Certification loss Deployment endpoint Status C1 response any-unsupported (binary) annotated faithfulness run: N=839N=839, matched C2 response any-unsupported (binary) annotated faithfulness run: N=793N=793, matched C3 response any-unsupported (binary) annotated faithfulness run: N=2515N=2515, matched C4 response any-unsupported (binary) annotated faithfulness run: N=883N=883, matched Table 14: Evaluation cells and declared losses. Faithfulness, factuality, and answer correctness remain separate endpoints. Appendix I Proofs I.1 Proof of Lemma 2 Proof. Under add/remove adjacency, adding one record with score in bin b⋆b and loss ℓ∈[0,1] ∈[0,1] changes exactly two possible coordinates: the score-count coordinate Cb⋆C_b changes by 11, and the error-count coordinate Eb⋆E_b changes by ℓ . All other coordinates are unchanged. Therefore the squared L2L_2 change is 12+ℓ2≤2.1^2+ ^2≤ 2. Taking square roots gives sensitivity at most 2 2. Equality holds for ℓ=1 =1. ∎ Replacement adjacency. If neighboring datasets replace one record by another, the conservative triangle-inequality sensitivity is 222 2. All privacy equations remain valid after replacing 2 2 by 222 2, equivalently multiplying each ρk,t _k,t by four for fixed σk,t _k,t. The paper uses add/remove adjacency throughout. I.2 Proof of Theorem 3 Proof. The Gaussian mechanism with query sensitivity Δ2 _2 and isotropic noise variance σ2σ^2 is Δ22/(2σ2) _2^2/(2σ^2)-zCDP (Bun and Steinke, 2016). Lemma 2 gives Δ22≤2 _2^2≤ 2, so release (k,t)(k,t) is ρk,t≤22σk,t2=1σk,t2 _k,t≤ 22 _k,t^2= 1 _k,t^2 zCDP. Fix neighboring global datasets that differ in one calibration record i. Condition on any common prefix of the adaptive transcript. If the next release does not contain i, its conditional kernel is identical under the two datasets. If it contains i, the conditional kernel is σk,t−2 _k,t^-2-zCDP by the preceding Gaussian-mechanism calculation. The next scheduling action is a function of public information and the previous DP transcript, so it is post-processing and adds no separate privacy loss. For completeness, fix a Rényi order a>1a>1 and let LsL_s be the conditional privacy-loss increment of message s under the first neighboring dataset. Conditional zCDP gives, at every common transcript history Hs−1H_s-1, [e(a−1)Ls∣Hs−1]≤expa(a−1)ρs(Hs−1),E\! [e^(a-1)L_s H_s-1 ]≤ \! \a(a-1) _s(H_s-1) \, where ρs=0 _s=0 if the release omits i and ρs=σk,t−2 _s= _k,t^-2 otherwise. Iterated conditioning and the deterministic pathwise filter imply, for every finite transcript prefix, exp(a−1)∑sLs≤expa(a−1)ρtr.E \! \(a-1) _sL_s \≤ \! \a(a-1) _ tr \. Hence the order-a Rényi divergence is at most aρtra _ tr for every a>1a>1, which is exactly ρtr _ tr-zCDP. This is the fully adaptive composition/filter argument specialized to zCDP (Whitehouse et al., 2023). Equivalently, along transcript path τ the charged parameter is ∑(k,t)∈ℐτ(i)σk,t−2. _(k,t) _τ(i) _k,t^-2. The pathwise privacy filter and the suprema over i and τ give Equation (32). If every record appears in at most one release, only one conditional kernel can differ for a fixed neighboring pair; this is adaptive parallel composition and yields the stated maximum. The pathwise supremum is essential when noise scales or reuse decisions are chosen adaptively: a realized ex-post charge alone is not a privacy guarantee. Finally, every ρ-zCDP mechanism is (ρ+2ρlog(1/δ),δ)(ρ+2 ρ (1/δ),δ)-DP for any δ∈(0,1)δ∈(0,1) (Bun and Steinke, 2016). Substituting ρ=ρtrρ= _ tr gives Equation (33). ∎ Solving for a target privacy budget. Let L=log(1/δpriv)L= (1/ _ priv) and x=ρtrx= _ tr. Equation (33) is εpriv=x2+2xL _ priv=x^2+2x L. Its nonnegative solution is x=L+εpriv−Lx= L+ _ priv- L, which yields Equation (34). I.3 Proof of Lemma 4 Proof. Fix threshold j. Before WiW_i is revealed, define the predictable conditional means μi,jZ μ^Z_i,j =[Zj(Wi)∣ℱi−1]=PCi[Zj(W)], =E\! [Z_j(W_i) _i-1 ]=E_P_C_i\! [Z_j(W) ], μi,jA μ^A_i,j =PCi[Aj(W)]. =E_P_C_i\! [A_j(W) ]. Consider the two martingale-difference sums Mn,jZ M^Z_n,j =∑i=1nμi,jZ−Zj(Wi), = _i=1^n\μ^Z_i,j-Z_j(W_i)\, Mn,jA M^A_n,j =∑i=1nAj(Wi)−μi,jA. = _i=1^n\A_j(W_i)-μ^A_i,j\. Every summand has conditional mean zero and lies in an interval of length one. Conditional Hoeffding’s lemma therefore implies, for either process M and every fixed λ>0λ>0, that Ln(λ)=expλMn−λ2n8L_n(λ)= \! \λ M_n- λ^2n8 \ (46) is a nonnegative supermartingale with L0=1L_0=1. For epoch r≥0r≥ 0, set Ur=2r,xr=log2mαsπr,λr=8xrUr,br=Urxr2.U_r=2^r, x_r= 2m _ s _r, _r= 8x_rU_r, b_r= U_rx_r2. If for some n assigned to epoch r=⌈log2n⌉r= _2n we have Mn≥brM_n≥ b_r, then n≤Urn≤ U_r and logLn(λr) L_n( _r) ≥λrbr−λr2Ur8=xr. ≥ _rb_r- _r^2U_r8=x_r. Ville’s inequality applied to Equation (46) gives ℙ[∃n:⌈log2n⌉=r,Mn≥br]≤e−xr=αsπr2m.P\! [∃ n: _2n =r,\ M_n≥ b_r ]≤ e^-x_r= _ s _r2m. Union bounding over the two processes, m thresholds, and all epochs, and using ∑r≥0πr=1 _r≥ 0 _r=1, gives failure probability at most αs _ s. Finally, at any monitored round t, ∑i=1Ntμi,jZ _i=1^N_tμ^Z_i,j =∑kNk,tPkZj=NtzQ¯t,j, = _kN_k,tE_P_kZ_j=N_tz_ Q_t,j, ∑i=1Ntμi,jA _i=1^N_tμ^A_i,j =∑kNk,tPkAj=NtaQ¯t,j. = _kN_k,tE_P_kA_j=N_ta_ Q_t,j. The epoch boundary brtsb_r_t s is exactly ht(αs)h_t( _ s). Thus the two simultaneous martingale inequalities are Equations (35) and (36). No conditioning on a final participation schedule is used. ∎ I.4 Proof of Lemma 5 Proof. For fixed threshold j, let Gj,tZ=Z~j,t−Zj,tG^Z_j,t= Z_j,t-Z_j,t and Gj,tA=A~j,t−Aj,tG^A_j,t= A_j,t-A_j,t. By Assumption 1, each increment of either process, conditional on the past, is centered Gaussian with predictable variance increment ΔVj,t V_j,t. Consequently, for either Hj,t∈−Gj,tZ,Gj,tAH_j,t∈\-G^Z_j,t,G^A_j,t\ and every fixed λ>0λ>0, Lj,t(λ)=expλHj,t−λ2Vj,t2L_j,t(λ)= \! \λ H_j,t- λ^2V_j,t2 \ (47) is a nonnegative martingale with initial value one. For variance epoch r≥0r≥ 0, let Ur U_r =v0 2r, =v_02^r, yr y_r =log(2mαnπr), = \! ( 2m _ n _r ), λr _r =2yrUr, = 2y_rU_r, cr c_r =2Uryr. = 2U_ry_r. Any time assigned to epoch r=max0,⌈log2(Vj,t/v0)⌉r= \0, _2(V_j,t/v_0) \ has 0<Vj,t≤Ur0<V_j,t≤ U_r. If Hj,t≥crH_j,t≥ c_r at such a time, then logLj,t(λr) L_j,t( _r) ≥λrcr−λr2Ur2=yr. ≥ _rc_r- _r^2U_r2=y_r. Ville’s inequality gives probability at most e−yr=αnπr/(2m)e^-y_r= _ n _r/(2m) for a crossing in that epoch. Union bounding over the two required signed processes, all m thresholds, and all epochs gives total failure probability at most αn _ n. Times with Vj,t=0V_j,t=0 have Gj,tZ=Gj,tA=0G^Z_j,t=G^A_j,t=0 deterministically. Since crj,tn=gj,t(αn)c_r_j,t n=g_j,t( _ n), the complementary event is exactly Equations (37) and (38). Correlation between threshold suffix sums is harmless because only a union bound is used. ∎ I.5 Proof of Lemma 6 Proof. Insert the intermediate mixture Qw=∑kwkPkQ_w= _kw_kP_k. By the triangle inequality, TV(Q⋆,Q¯t) (Q , Q_t) ≤TV(∑kwkPk⋆,∑kwkPk) \! ( _kw_kP_k , _kw_kP_k ) +TV(∑kwkPk,∑kw¯k,tPk). +TV\! ( _kw_kP_k, _k w_k,tP_k ). Convexity of total variation gives TV(∑kwkPk⋆,∑kwkPk) \! ( _kw_kP_k , _kw_kP_k ) ≤∑kwkTV(Pk⋆,Pk) ≤ _kw_kTV(P_k ,P_k) ≤∑kwkγk. ≤ _kw_k _k. For the second term, for every measurable event D, |∑k(wk−w¯k,t)Pk(D)|≤12∑k|wk−w¯k,t|. | _k(w_k- w_k,t)P_k(D) |≤ 12 _k|w_k- w_k,t|. The last step follows because the signed coefficients sum to zero: the expression is bounded by the total positive coefficient mass (and, after changing sign, by the total negative mass), each of which is half the L1L_1 norm. Equality need not be attainable because the component laws need not admit a single event with those prescribed probabilities. Taking the supremum over D yields the second term in ηt _t and proves Equation (39). For any measurable f:W↦[0,1]f:W [0,1], |Qf−Q′f|≤TV(Q,Q′)|E_Qf-E_Q f| (Q,Q ). Apply this once to f=Zj=ℓAj∈[0,1]f=Z_j= A_j∈[0,1] and once to f=Aj∈[0,1]f=A_j∈[0,1] to obtain Equations (40) and (41). ∎ I.6 Proof of Theorem 7 Proof. Intersect the simultaneous events of Lemmas 4 and 5. By a union bound, this intersection has probability at least 1−αs−αn1- _ s- _ n. On this event, for every (j,t)(j,t), NtzQ¯t,j N_tz_ Q_t,j ≤Zj,t+ht ≤ Z_j,t+h_t ≤Z~j,t+gj,t+ht, ≤ Z_j,t+g_j,t+h_t, so zQ¯t,j≤Uj,tZz_ Q_t,j≤ U^Z_j,t. Clipping at [0,1][0,1] preserves the inequality because zQ¯t,j∈[0,1]z_ Q_t,j∈[0,1]. Similarly, NtaQ¯t,j N_ta_ Q_t,j ≥Aj,t−ht ≥ A_j,t-h_t ≥A~j,t−gj,t−ht, ≥ A_j,t-g_j,t-h_t, so aQ¯t,j≥Lj,tAa_ Q_t,j≥ L^A_j,t. Lemma 6 then gives zQ⋆,j z_Q ,j ≤Uj,tZ+ηt, ≤ U^Z_j,t+ _t, aQ⋆,j a_Q ,j ≥Lj,tA−ηt. ≥ L^A_j,t- _t. If Lj,tA>ηtL^A_j,t> _t the denominator is positive, so writing qj,t=(Uj,tZ+ηt)/(Lj,tA−ηt)q_j,t=(U^Z_j,t+ _t)/(L^A_j,t- _t) we obtain ℛQ⋆,j=zQ⋆,jaQ⋆,j≤qj,t.R_Q ,j= z_Q ,ja_Q ,j≤ q_j,t. Separately, ℓ∈[0,1] ∈[0,1] gives ℛQ⋆,j≤1R_Q ,j≤ 1 unconditionally. Combining the two bounds, ℛQ⋆,j≤min1,qj,t=Uj,t.R_Q ,j≤ \1,q_j,t\=U_j,t. We state the two inequalities separately because qj,t≤Uj,tq_j,t≤ U_j,t is false when qj,t>1q_j,t>1; the clip at one is justified by the range of ℓ , not by the ratio bound. If Lj,tA≤ηtL^A_j,t≤ _t, Equation (55) returns the trivial valid upper bound one. The event just proved already holds for every threshold and every time. Evaluating it at a random stopping time and a transcript-dependent threshold does not change the event or spend additional probability. This proves Equations (42) and (43). ∎ I.7 Proof of Corollary 8 Proof. Divide Equations (51) and (52) by NtN_t. The record-epoch endpoint satisfies Nt≤uts<2NtN_t≤ u_t s<2N_t, while log(1/πrts)=O(loglog(eNt)). (1/ _r_t s)=O\! ( (eN_t) ). For Vj,t>0V_j,t>0, the variance-epoch endpoint satisfies Vj,t≤uj,tn≤2maxVj,t,v0V_j,t≤ u_j,t n≤ 2 \V_j,t,v_0\ and log(1/πrj,tn)=O(loglog(e+Vj,t/v0)). (1/ _r_j,t n)=O\! ( (e+V_j,t/v_0) ). Substitution gives Equation (44); when Vj,t=0V_j,t=0, the privacy noise term is zero by definition. In the balanced setting, Vj,tNt=djKtσ2Knt=σdjnKt, V_j,tN_t= d_jKtσ^2Knt= σ d_jn Kt, and the variance-epoch logarithm gives Equation (45). ∎ Appendix J Validity and Privacy-Utility Tables Scope Privacy Policy Trials Max simultaneous violations 95% CP Utility source C1 (QA) ∞,4,1∞,4,1 each of final/first/adaptive 500 per setting 0 [0,0.0074][0,0.0074] Table 16 C2 (summary) ∞,4,1∞,4,1 each of final/first/adaptive 500 per setting 0 [0,0.0074][0,0.0074] abstains C4 (data-to-text) ∞,4,1∞,4,1 each of final/first/adaptive 500 per setting 0 [0,0.0074][0,0.0074] abstains C3 (pooled) ∞,4,1∞,4,1 each of final/first/adaptive 500 per setting 0 [0,0.0074][0,0.0074] abstains Table 15: Per-cell simultaneous-event audit at the registered targets. Every row means 500 independent trials for each privacy/policy setting; “0” is the maximum violation count in any constituent setting, not a pooled denominator. Operational firing is reported separately. ε Fired/200 Firing rate Mean acceptance Cond. failure (95% CP) Mean rounds Mean d¯ d ∞ 200 1.000 0.266 0/200[0,0.0183]0/200\ [0,0.0183] 19.16 -0.0006 8 62 0.310 0.267 0/62[0,0.0578]0/62\ [0,0.0578] 29.13 -0.0004 4 2 0.010 0.263 0/2[0,0.8419]0/2\ [0,0.8419] 29.00 -0.0007 2 0 0.000 none undefined none none 1 0 0.000 none undefined none none 0.5 0 0.000 none undefined none none Table 16: Exploratory C1 privacy curve at r⋆=0.30r_ =0.30. Acceptance, rounds, and d¯ d are conditional on firing; conditional failure is undefined when no trial fires. Exact intervals widen sharply as firing becomes rare. Appendix K Stitched Anytime Boundaries Let the summable epoch weights be πr=6π2(r+1)2,∑r=0∞πr=1. _r= 6π^2(r+1)^2, _r=0^∞ _r=1. (48) For t∈+t _+, define the record epoch and its upper endpoint rts=⌈log2Nt⌉,uts=2rts.r_t s= _2N_t , u_t s=2^r_t s. (49) Choose a public variance scale v0>0v_0>0 before calibration. For Vj,t>0V_j,t>0, define rj,tn=max0,⌈log2Vj,tv0⌉,uj,tn=v0 2rj,tn.r_j,t n= \! \0, _2 V_j,tv_0 \, u_j,t n=v_0\,2^r_j,t n. (50) The validity is unaffected by v0v_0; it only changes finite-sample width. Define the sampling and realized-noise boundaries ht(αs) h_t( _ s) =uts2log2mαsπrts, = u_t s2 2m _ s _r_t s, (51) gj,t(αn) g_j,t( _ n) =0,Vj,t=0,2uj,tnlog2mαnπrj,tn,Vj,t>0. = cases0,&V_j,t=0,\\[4.30554pt] 2u_j,t n 2m _ n _r_j,t n,&V_j,t>0. cases (52) These boundaries give the count-scale bounds used by the separate ratio baseline below. Appendix L The Ratio Certificate (superseded) For reference, define Uj,tZ U^Z_j,t =[Z~j,t+ht+gj,tNt][0,1], = [ Z_j,t+h_t+g_j,tN_t ]_[0,1], (53) Lj,tA L^A_j,t =[A~j,t−ht−gj,tNt][0,1]. = [ A_j,t-h_t-g_j,tN_t ]_[0,1]. (54) The original ratio certificate is Uj,t=min1,Uj,tZ+ηtLj,tA−ηt,Lj,tA>ηt,1,Lj,tA≤ηt,U_j,t= cases \! \1, U^Z_j,t+ _tL^A_j,t- _t \,&L^A_j,t> _t,\\[8.61108pt] 1,&L^A_j,t≤ _t, cases (55) and Theorem 7 states its simultaneous validity. Two properties are worth keeping in view. It bounds the risk itself, so it is meaningful without a declared target, whereas the contrast certificate of Theorem 1 answers only the decision problem “is r⋆r_ met?”. And it carries no acceptance requirement, which is why a valid Uj,tU_j,t can sit on a vanishing accepted set; we therefore impose the same floor amina_ on both rules whenever we compare them (Appendix F). The ratio and direct constructions use different simultaneous processes and need not be ordered after clipping or variance stitching. Table 3 therefore requests paired empirical widths rather than asserting universal dominance. Appendix M Proof of the Target-Risk Certificates For threshold j, define the predictable conditional means μi,jD=[Dj(Wi)∣ℱi−1],μi,jA=[Aj(Wi)∣ℱi−1].μ^D_i,j=E[D_j(W_i) _i-1], μ^A_i,j=E[A_j(W_i) _i-1]. Predictability of CiC_i gives ∑i=1Ntμi,jD=NtdQ¯t,j,∑i=1Ntμi,jA=NtaQ¯t,j. _i=1^N_tμ^D_i,j=N_td_ Q_t,j, _i=1^N_tμ^A_i,j=N_ta_ Q_t,j. (56) Lemma 9 (Direct declared-mixture transfer). For every j,tj,t, dQ⋆,j≤dQ¯t,j+ηt,aQ⋆,j≥aQ¯t,j−ηt.d_Q ,j≤ d_ Q_t,j+ _t, a_Q ,j≥ a_ Q_t,j- _t. (57) Proof. The proof of Lemma 6 establishes TV(Q⋆,Q¯t)≤ηtTV(Q , Q_t)≤ _t. For any measurable f whose range lies in an interval of length one, |Qf−Q′f|≤TV(Q,Q′)|E_Qf-E_Q f| (Q,Q ): translate its range to [0,1][0,1] and use the bounded-function characterization of total variation. Apply this first to Dj=Aj(ℓ−r⋆)∈[−r⋆,1−r⋆]D_j=A_j( -r_ )∈[-r_ ,1-r_ ] and then to Aj∈[0,1]A_j∈[0,1]. This proves Equation (57). In particular, the direct contrast pays one ηt _t; combining only the separate Z and A inequalities would give the valid but looser (1+r⋆)ηt(1+r_ ) _t term. ∎ Lemma 10 (Range-only clean-count event). With probability at least 1−αs1- _ s, simultaneously for all j,tj,t, NtdQ¯t,j N_td_ Q_t,j ≤Dj,t+H2(Nt;αs), ≤ D_j,t+H_2(N_t; _ s), (58) NtaQ¯t,j N_ta_ Q_t,j ≥Aj,t−H2(Nt;αs). ≥ A_j,t-H_2(N_t; _ s). (59) Proof. Let Mn,jD=∑i≤n(μi,jD−Dj(Wi))M^D_n,j= _i≤ n(μ^D_i,j-D_j(W_i)) and Mn,jA,−=∑i≤n(Aj(Wi)−μi,jA)M^A,-_n,j= _i≤ n(A_j(W_i)-μ^A_i,j). Every increment has conditional mean zero and lies in an interval of length one. Conditional Hoeffding’s lemma implies that, for either process and fixed λ>0λ>0, Ln(λ)=expλMn−λ2n/8L_n(λ)= \λ M_n-λ^2n/8\ is a nonnegative supermartingale with L0=1L_0=1. For record epoch r, put ur=2ru_r=2^r and xr=log2m/(αsπr)x_r= \2m/( _ s _r)\. Choose λr=8xr/ur _r= 8x_r/u_r and br=urxr/2b_r= u_rx_r/2. At any n with r=⌈log2n⌉r= _2n , n≤urn≤ u_r; if Mn≥brM_n≥ b_r, then logLn(λr)≥xr L_n( _r)≥ x_r. Ville’s inequality bounds a crossing in that epoch by e−xr=αsπr/(2m)e^-x_r= _ s _r/(2m). A union bound over the two process families, m thresholds, and all epochs costs at most αs _ s. Using Equation (56) and br=H2(n;αs)b_r=H_2(n; _ s) gives Equations (58) and (59). ∎ Lemma 11 (Range-only Gaussian event). With probability at least 1−αn1- _ n, simultaneously for all j,tj,t, Dj,t D_j,t ≤D~j,t+G2(Vj,tD;αn), ≤ D_j,t+G_2(V^D_j,t; _ n), (60) Aj,t A_j,t ≥A~j,t−G2(Vj,tA;αn). ≥ A_j,t-G_2(V^A_j,t; _ n). (61) Proof. Write Gj,tA=A~j,t−Aj,tG^A_j,t= A_j,t-A_j,t and Gj,tD=D~j,t−Dj,tG^D_j,t= D_j,t-D_j,t. The first is a Gaussian martingale with predictable variance Vj,tAV^A_j,t. Independence between count and loss coordinates gives Var(Gj,tD∣schedule)=(1+r⋆2)Vj,tA=Vj,tDVar(G^D_j,t )=(1+r_ ^2)V^A_j,t=V^D_j,t. For either required signed process −GD-G^D or GAG^A and fixed λ>0λ>0, expλGt−λ2Vt/2 \λ G_t-λ^2V_t/2\ is a nonnegative martingale. In variance epoch r, take ur=v02ru_r=v_02^r, xr=log2m/(αnπr)x_r= \2m/( _ n _r)\, and λr=2xr/ur _r= 2x_r/u_r. A crossing of 2urxr 2u_rx_r while Vt≤urV_t≤ u_r makes the martingale at least exre^x_r. Ville’s inequality and a union bound over the two process families, thresholds, and epochs cost at most αn _ n. Zero-variance noise is identically zero, proving the claim. ∎ For the variance-adaptive construction, define Mn,jD M^D_n,j =∑i≤n(μi,jD−Dj(Wi)), = _i≤ n(μ^D_i,j-D_j(W_i)), Mn,jA,+ M^A,+_n,j =∑i≤n(μi,jA−Aj(Wi)), = _i≤ n(μ^A_i,j-A_j(W_i)), Mn,jA,− M^A,-_n,j =∑i≤n(Aj(Wi)−μi,jA). = _i≤ n(A_j(W_i)-μ^A_i,j). The predictable quadratic variation of MDM^D satisfies Qn,jD=∑i≤nVar(Dj(Wi)∣ℱi−1)≤∑i≤nμi,jA,Q^D_n,j= _i≤ nVar(D_j(W_i) _i-1)≤ _i≤ nμ^A_i,j, (62) because Dj2≤AjD_j^2≤ A_j. Lemma 12 (Variance-adaptive joint sampling event). With probability at least 1−αs1- _ s, simultaneously for all j,tj,t, NtaQ¯t,j N_ta_ Q_t,j ∈[Aj,t−H3(Nt;αs),Aj,t+H3(Nt;αs)], ∈[A_j,t-H_3(N_t; _ s),A_j,t+H_3(N_t; _ s)], (63) NtdQ¯t,j N_td_ Q_t,j ≤Dj,t+F3(qj,t∘;αs), ≤ D_j,t+F_3(q _j,t; _ s), (64) where qj,t∘=minNt,Aj,t+H3(Nt;αs)q _j,t= \N_t,A_j,t+H_3(N_t; _ s)\. Proof. Apply the record-epoch Hoeffding argument above to MA,+M^A,+ and MA,−M^A,- with xr=log3m/(αsπr)x_r= \3m/( _ s _r)\. Each family costs αs/3 _ s/3, yielding Equation (63) jointly. Each increment of MDM^D has conditional mean zero and is at most one. Freedman’s maximal inequality states that, for deterministic u,s>0u,s>0, ℙ∃n:Mn,jD≥s,Qn,jD≤u≤exp−s22(u+s/3).P\∃ n:M^D_n,j≥ s,\ Q^D_n,j≤ u\≤ \- s^22(u+s/3) \. (65) For variance-count epoch r, take ur=2ru_r=2^r, xr=log3m/(αsπr)x_r= \3m/( _ s _r)\, and sr=2urxr+2xr/3s_r= 2u_rx_r+2x_r/3. Direct expansion gives sr2≥2xr(ur+sr/3)s_r^2≥ 2x_r(u_r+s_r/3), so an epoch crossing costs at most αsπr/(3m) _ s _r/(3m). A union bound over thresholds and epochs costs the remaining αs/3 _ s/3. On the resulting event, Equation (62) and the upper half of Equation (63) give QNt,jD≤qj,t∘Q^D_N_t,j≤ q _j,t. The actual variance-count epoch is among those maximized over in Equation (24), so MNt,jD≤F3(qj,t∘;αs)M^D_N_t,j≤ F_3(q _j,t; _ s), proving Equation (64). ∎ Lemma 13 (Variance-adaptive joint Gaussian event). With probability at least 1−αn1- _ n, simultaneously for all j,tj,t, Dj,t D_j,t ≤D~j,t+G3(Vj,tD;αn), ≤ D_j,t+G_3(V^D_j,t; _ n), (66) |Aj,t−A~j,t| |A_j,t- A_j,t| ≤G3(Vj,tA;αn). ≤ G_3(V^A_j,t; _ n). (67) Proof. Repeat the variance-epoch Gaussian argument for the three signed process families −GD-G^D, GAG^A, and −GA-G^A. With xr=log3m/(αnπr)x_r= \3m/( _ n _r)\, each family costs αn/3 _ n/3. Correlation between GDG^D and GAG^A is irrelevant because the proof uses a union bound. ∎ Proof of Theorem 1. For mode H, intersect Lemmas 10 and 11. On this event, dQ¯t,j d_ Q_t,j ≤D~j,t+H2(Nt;αs)+G2(Vj,tD;αn)Nt, ≤ D_j,t+H_2(N_t; _ s)+G_2(V^D_j,t; _ n)N_t, aQ¯t,j a_ Q_t,j ≥A~j,t−H2(Nt;αs)−G2(Vj,tA;αn)Nt. ≥ A_j,t-H_2(N_t; _ s)-G_2(V^A_j,t; _ n)N_t. Lemma 9 gives the H instance of Equation (27); clipping is harmless because dQ⋆,j≤1−r⋆d_Q ,j≤ 1-r_ and aQ⋆,j≥0a_Q ,j≥ 0. For VA, intersect Lemmas 12 and 13. Equations (62), (63), and (67) imply QNt,jD Q^D_N_t,j ≤NtaQ¯t,j ≤ N_ta_ Q_t,j ≤Aj,t+H3(Nt;αs) ≤ A_j,t+H_3(N_t; _ s) ≤A~j,t+G3(Vj,tA;αn)+H3(Nt;αs) ≤ A_j,t+G_3(V^A_j,t; _ n)+H_3(N_t; _ s) ≤q¯j,t, ≤ q_j,t, where the last step also uses QNt,jD≤NtQ^D_N_t,j≤ N_t. The stitched Freedman and contrast-noise events therefore give Equation (25); the lower halves of the two-sided acceptance events give Equation (26). Applying Lemma 9 establishes Equation (27) for VA. Each mode’s sampling/noise intersection has probability at least 1−αs−αn1- _ s- _ n. For either mode, Equation (28) gives aQ⋆,j^≥amin>0a_Q , j≥ a_ >0 and zQ⋆,j^−r⋆aQ⋆,j^≤0z_Q , j-r_ a_Q , j≤ 0. Dividing by positive acceptance yields ℛQ⋆,j^≤r⋆R_Q , j≤ r_ . The event already holds for every registered threshold and round, so evaluating it at a transcript-measurable index and stopping time spends no additional probability. ∎ Appendix N Additional Theoretical Remarks N.1 Conditional validity of support-derived, label-free thresholds Proposition 14 (Conditional validity of support-derived thresholds). Let S denote the frozen calibration-split score multiset used by the finite-population audit, and let the threshold grid τ=g(S)τ=g(S) be a deterministic function of S that consults no correctness label and no held-out item. Condition on S. Then τ is σ(S)σ(S)-measurable and constant given the conditioning, every source of randomness in the audit (the with-replacement occurrence draws from the frozen empirical law, the recruitment and dropout schedule, and the Gaussian release noise) has the same conditional law given S as its unconditional law with a fixed grid, and Theorem 7 applies verbatim with τ treated as a fixed-in-advance grid. The resulting guarantee holds conditionally on S, which is the same conditioning the finite-population audit already imposes by drawing occurrences from the frozen empirical law. Proof. Under the audit protocol the support is frozen before any release, and only then are stream occurrences drawn with replacement from its empirical law; g reads only S, so given S the grid τ=g(S)τ=g(S) is a constant. Theorem 7 places its assumptions on the stream randomness, the predictable schedule, and the DP mechanism, none of which depends on S except through the frozen law itself; conditioning on S therefore leaves each assumption intact with τ deterministic, and the theorem’s conclusion holds under the conditional probability given S. ∎ The HaluEval quantile grid of Table 4 satisfies the hypothesis: the m=20m=20 thresholds are equally spaced quantiles of the calibration-split score distribution, computed once, label-free, and without touching held-out items. The guarantee reported there is accordingly conditional on the frozen public support rather than marginal over its sampling; a genuine development split (as in Table 9) or a fixed public grid would remove even that conditioning. N.2 Why the original BKBK block argument is not valid Suppose TV(Pk,P0)≤BTV(P_k,P_0)≤ B for one observation and client k holds nkn_k independent observations. In general, TV(Pk⊗nk,P0⊗nk)≤nkB,TV(P_k n_k,P_0 n_k)≤ n_kB, not B. Summing across client blocks yields the loose bound ∑knkB _kn_kB, not BKBK. A BKBK statement is valid only if B is explicitly defined as a block-level distance TV(Pk⊗nk,P0⊗nk)TV(P_k n_k,P_0 n_k), which is often near one and is not the assumption in a per-example formulation. Our mixture transfer avoids comparing full sample-path laws: concentration targets the actual non-IID mixture, and TV is used only to transfer one bounded deployment expectation. This distinction is consistent with non-exchangeable conformal bounds, whose weighted TV terms attach to observations rather than automatically collapsing to one term per client (Barber et al., 2023). N.3 Why DP noise belongs in the width Adding Gaussian noise to a clean confidence-sequence center without changing its boundary can invalidate coverage. Conversely, defining an unspecified “coverage inflation” proportional to a noise standard deviation mixes a quantity with score units and a dimensionless probability. Lemma 5 constructs an explicit simultaneous event for the Gaussian transcript. Allocating αn _ n to that event retains a clear probability statement, while the actual noise scale enters gj,tg_j,t in the same count units as the released statistic. N.4 Prefix-time policies The theorem is anytime-valid across calibration rounds. To certify stopping inside autoregressive generation, pre-register a finite family of policies gj,ℓg_j, that uses lift through prefix length ℓ and include (j,ℓ)(j, ) in the candidate grid. The proof then replaces m by the number of registered threshold-prefix pairs. It does not justify inspecting an unregistered continuum of token-dependent policies. N.5 Client dropout Dropout changes Nk,tN_k,t and hence the known realized weights w¯k,t w_k,t, and it changes the Gaussian variance through the realized set ℛtR_t in Equation (18). Predictable dropout based on the earlier private transcript is covered after recomputing both ηt _t and Vj,tV_j,t. Dropout decided after inspecting a current unreported score or loss is not predictable and can change the conditional client law; it requires an explicit missingness model rather than the present theorem. Appendix O Detailed Experimental Protocol O.1 Manifest audit and three-way split Before scoring, the manifest records dataset revision and checksum, example ID, query and reference group, task and domain, retrieved context, original prompt, generator repository and revision, tokenizer revision, decoding parameters, and annotation provenance. A matched-model cell is retained only if the original output and exact probability-exposed generator checkpoint are recoverable. Otherwise it may enter a labeled cross-model diagnostic, never a matched-model claim. All outputs sharing a query or reference are assigned together. Development chooses score transformations, normalization constants, clipping B, score directions, threshold quantiles, prompts, and the non-lift comparator rule. Calibration is not reused for these choices. Evaluation is opened only after all policies and code are frozen. Every score uses the complete annotated response. For each response, the artifact includes evidence-present, evidence-removed, length-matched neutral, within-domain shuffled, and token-length-matched irrelevant-context scores. Human annotations remain the primary endpoint; LLM judges are score baselines or label-sensitivity analyses. O.2 Finite-population theorem audit For each cell, the calibration-side partition creates frozen client populations 1,…,KP_1,…,P_K, and PkP_k is uniform on kP_k. Trial r: 1. draws each requested event independently with replacement from the empirical law supported on kP_k; 2. releases the registered noised histograms and updates only from realized messages; 3. executes the preregistered monitoring/recruitment policy and selects one threshold or always abstains; 4. enumerates every record in every kP_k to calculate exact aQ⋆,j^a_Q , j, dQ⋆,j^d_Q , j, and ℛQ⋆,j^R_Q , j; and 5. records unconditional failure, firing, stopping round, and the complete certificate tuple. Sampling without replacement is not substituted into this audit. Official held-out evaluation is separate and does not define the theorem-coverage event. The privacy neighbor is one draw occurrence. Repeated values from the same support response are separate hypothetical events; this experiment does not claim unique-response privacy for the RAGTruth support. Item Frozen value Confirmatory risk targets primary r⋆=0.10r_ =0.10; secondary 0.200.20 Exploratory feasibility target r⋆=0.30r_ =0.30, introduced only after both confirmatory targets abstained Acceptance floor amin=0.05a_ =0.05 Statistical budgets αs=0.025 _ s=0.025, αn=0.025 _ n=0.025 Privacy δpriv=10−6 _ priv=10^-6; core ε∈∞,4,1 ∈\∞,4,1\; secondary ε∈8,2,0.5 ∈\8,2,0.5\ Thresholds m=20m=20 development-score quantiles; m∈10,20,50m∈\10,20,50\ in the secondary grid Validity-audit trials 500 independent population-resampling and DP-noise trials per dataset/model/privacy/policy cell Core policies fixed final round; first certificate meeting amina_ ; predictable target-deficit recruitment with optional stopping Exploratory trials 200 per C1 privacy, score, heterogeneity, and stress-test setting Privacy unit one stream occurrence under zero-out adjacency Support reuse with-replacement support values may recur; source- or person-level privacy would compose all recurrences and is not claimed Table 17: Authoritative confirmatory registration and explicitly separated post-registration feasibility analysis. The adaptive policy sees only the previous private transcript and public padded participation metadata. If it continues, it requests the client with the largest positive target-weight deficit, breaking ties with a frozen seed; the request precedes current-round records and noise. Fixed and adaptive policies are also compared after matching total records and communication. O.3 Client, shift, and negative-control scenarios The core contains a natural domain/task partition and an IID baseline. Secondary partitions vary Dirichlet concentration, client imbalance, K, dropout, calibration size, threshold count, mixture mismatch, and record reuse. Target-mixture experiments change w while keeping PkP_k fixed. Stable client-specific slopes are heterogeneity, not drift. A nonzero γk _k experiment changes a frozen deployment population and states whether γk _k is externally justified or only a sensitivity value. Dropout is decided before release. Only successful messages enter NtN_t, w¯t w_t, and the realized noise variance. Invalid controls ignore noise, halve its realized variance, set ηt=0 _t=0 under registered shift, or reuse a fixed-time rule after optional stopping. The old all-client-variance control is not a validity ablation: excessive variance is conservative and should only reduce acceptance. O.4 Comparator and score contract Central CRC/LTT receives pooled non-private data and is an oracle-access reference. Federated non-private uses the same exact histograms. The private fixed-time rule is evaluated only at its registered terminal round. Anytime-Valid CRC is run in its native growing-calibration setting. Yu-Liu uses its required i.i.d. split, direct ratio, acceptance floor, and empirical-Bernstein construction. CSA is run only where its predictable stream and gate assumptions can be implemented. Every method receives the same overall failure budget, and native and matched-data diagnostics are reported separately and never pooled. All five comparators were implementable on our cells, so no cell is reported as an assumption mismatch. Because none of them is a private construction, their finite-ε entries are the naive private adaptation, in which the identical rule is fed the same DP-noised histograms with no realized-noise envelope. We report those cells rather than leave them blank precisely because they measure the failure mode the envelope prevents. These entries are invalid negative controls and are excluded from any private-method ranking. C-RAG is a configuration-level RAG risk certificate rather than a drop-in selective stream rule; private e-values use a different valid privatization. We cite both as closest context but do not claim to have executed them (Kang et al., 2024; Csillag and Mesquita, 2025). Only the Mistral-adapted ReDeEP-style score fires. Its C1 development AUC is 0.779 versus 0.631 for lift; the other scores range from 0.49 to 0.62. The adaptation recomputes architecture-specific head and FFN selectors and fits its linear combination on development data only, then freezes both before certificate trials. It is not the released Llama configuration from Sun et al. (2024); the anonymous artifact records the exact Mistral layer, head, FFN, normalization, and coefficient manifest. Full-population C1 certification is now reported in Table 9: scoring all matched C1 responses rather than the 300300 shared with the sampling scores, we trace the score that actually fires across the whole privacy grid, which is the only way to see whether the private regime is reachable by a stronger score. Information lift uses two teacher-forced passes. Token probability and entropy use the evidence-present pass. Semantic entropy, SelfCheckGPT, and conformal self-consistency use both recommended and compute-matched configurations. The row labelled ReDeEP-style is an architecture adaptation: Mistral copying heads, knowledge FFNs, normalization, and regression weights are estimated on development data only and frozen before calibration. It is not presented as the authors’ released Llama configuration; the artifact exposes the exact selectors and coefficients. FRANQ reports faithfulness and factuality separately. Judge confidence uses a development-frozen prompt, revision, decoding rule, and parser. All compatible scores share examples, client populations, privacy messages, and seeds. A comparator is selected only by a frozen development criterion. O.5 Metrics, communication, and artifact The primary validity statistic is unconditional failure among all 500 trials, with an exact two-sided Clopper-Pearson interval. Conditional-on-firing failure is a separate diagnostic whose denominator is the number of firing trials. Utility reports acceptance, zero-certificate rate, stopping round, communication, and (N,H/N or F/N,G/N,η,d¯,a¯,ℛ,a)(N,H/N or F/N,G/N,η, d, a,R,a). Paired differences use identical populations, schedules, and noise seeds with 95% paired bootstrap intervals. Each client message contains 2(m+1)2(m+1) floating-point values. With b-bit encoding, payload through round T is 2(m+1)b∑t=1T|ℛt|2(m+1)b _t=1^T|R_t| bits before transport overhead. The artifact reports payload and end-to-end bytes. Lift scoring uses two teacher-forced passes; histogram and certificate updates are CPU operations. Matched-model teacher-forced scoring of 2,515 RAGTruth responses ran on one ml.g5.8xlarge instance (one A10G, fp16, 1,400-token context cap). Five-sample SelfCheckGPT and semantic-entropy scoring of 900 responses used the same instance type. Histogram release, suffix sums, boundaries, and certificate computation ran on CPU for the 500 validity-audit trials per core setting. The run manifest records batch size, warm-up, timed repetitions, wall time, peak memory, and software revisions; generation-pass counts in Table 8 are not presented as latency. For every response, the artifact contains dataset/example ID, query/reference group, generator/prompt versions, client/domain/split, loss and aggregation rule, every score, and every evidence control. For every trial it contains calibration and DP seeds; realized clients, dropout, and batch counts; every noisy histogram; Nk,tN_k,t, NtN_t, Vj,tAV^A_j,t, Vj,tDV^D_j,t, and ηt _t; accountant output; every threshold certificate; selected threshold and stopping time; exact population risk or held-out interval; acceptance; and failure indicator. The anonymous artifact contains a checksummed manifest, the frozen registration, the three-way split assignments, the per-response score tables, the per-trial records, and a single reconstruction entry point that regenerates every number in the paper. The manifest pins the repository commit, the environment lockfile, the RAGTruth snapshot and its SHA-256 digest, the Mistral-7B-Instruct-v0.1 and Qwen2.5-7B-Instruct revisions, the tokenizer revisions, the score manifests including the Mistral ReDeEP-style selectors, and all seeds. The reconstruction test fails if an abstract number is absent from a main table, trial counts disagree with Table 17, a numeric row lacks a per-trial record, an aggregate fails to reproduce, or a method was selected using evaluation risk.