The sharing mechanism
Definitions.
An antivirus client never uploads your files to the vendor. It receives compact signatures of things observed elsewhere and acts on them locally. That is close to how this network moves what it learns — and it is why no raw record has to travel for the learning to reach you.
The lifecycle, and what leaves your walls at each step
| State | What happens | Leaves your environment |
|---|---|---|
| Observed | A member meets a pattern their edit set does not recognise | Nothing |
| Proposed | A candidate is drafted and de-identified inside that member's environment | Nothing |
| Corroborated | Independently observed at a threshold number of separate members | Signature only |
| Published | Reviewed by a curator, versioned and dated | Signature only |
| Deployed | Every member picks it up on the next definition set | Nothing |
| Superseded | Versioned and replaced; never silently edited | Nothing |
Where the analogy breaks — and why the limit exists
Malware is objectively malware. A denial pattern is contested, and the payer would characterise it differently. Definitions are therefore strictly descriptive: what was observed, at what aggregate scale, and what control prevents recurrence.
They never characterise intent, never carry an individual payer's rates or contract terms, and never constitute a coordinated response to a payer. Nothing publishes on a single sighting — the corroboration threshold is both the quality gate and the antitrust safety valve.