1. Google can never see an individual user's updates. It can only see aggregated updates.

2. Google gets to see intermediate model updates that would have been hidden if the model was trained via MPC.

3. The secure aggregation protocol does not require users to coordinate, and does not require all users to be online at the same time.