Research map / Federated learning and privacy / Differential privacy
Auditing $f$-differential privacy in one run
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a single-run empirical privacy auditing procedure based on f-DP trade-off curves, with a recursive tail bound on correct guesses in membership-inference and reconstruction guessing games, yielding tighter empirical epsilon than Steinke et al. (2023).
Problem
Single-run empirical privacy auditing of DP mechanisms is suboptimal: existing one-run audits (Steinke et al., 2023) have a large gap to true privacy parameters (e.g., for the Gaussian mechanism), so they underestimate privacy loss.
Approach
Audit the entire f-DP curve rather than a single (epsilon, delta) point; bound the probability of c correct guesses out of c' guesses under f-DP via a conditioning lemma, a shuffling/double-counting argument, and a recursive relation solved numerically (Algorithm 2), with a generalization to k-option reconstruction games.
Key results
- On simple Gaussian mechanisms with up to 10^7 canaries, the f-DP-based auditor gives higher empirical epsilon than Steinke et al. (2023), whose bound degrades as canaries increase while this one keeps improving.
- On CIFAR-10 with DP-SGD at epsilon=8, delta=1e-5 and 5,000 canaries, the method achieves tighter empirical lower bounds than the prior one-run white-box auditor.
- Auditing is a single training run, with empirical epsilon tight for Gaussian mechanisms in the idealized setting (e.g., 10^5 canaries, 1,500 guesses).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use the proposed f-DP evaluation instead of Steinke et al. (2023) | Membership-inference auditing of a Gaussian mechanism · Simple Gaussian Mechanism | empirical ε lower bound | Helped |
| increase the number of canaries | Proposed f-DP audit and Steinke et al. (2023) audit · Simple Gaussian Mechanism | empirical privacy bound | Mixed |
| use the proposed f-DP evaluation instead of Steinke et al. (2023) | White-box membership-inference auditing · CIFAR-10 | empirical privacy lower bound | Helped |
| use a small number of guesses, allowing abstention (ablation) | Proposed audit and Steinke et al. (2023) audit · Idealized setting, m = 10^7 canaries | empirical ε | Helped |
| vary δ and confidence level (ablation) | Proposed f-DP audit · Gaussian mechanism, standard deviation 1.0 | empirical ε lower bound tightness | No clear effect |
Surprising findings
- Both the proposed and Steinke et al. auditors perform best with a small number of guesses, showing the importance of abstention in auditing.
- Naively auditing each (epsilon, delta) point on a privacy curve and rejecting if any fails leads to suboptimal performance and rejects even true DP with probability 1.
Limitations
- Does not give a strict upper bound on privacy guarantees; yields an estimate in practical scenarios.
- A remaining gap between empirical and theoretical privacy in the one-run setting.
- Experiments largely in an idealized setting where the attack success rate is computed analytically rather than measured.
Experimental setup
Datasets: CIFAR-10
Benchmarks: CIFAR-10 white-box DP-SGD auditing idealized Gaussian mechanism auditing
Metrics: empirical epsilon accuracy of audit
Baselines: Steinke et al. 2023
Builds on: Steinke et al. 2023 one-run auditing f-DP (Dong et al.) DP-SGD Nasr et al. 2023 reconstruction
Closest papers by meaning
- How Well Can Differential Privacy Be Audited in One Run? (NeurIPS 2025 · similarity 0.92)
- Auditing Private Prediction (ICML 2024 · similarity 0.91)
- Monitoring Violations of Differential Privacy over Time (NeurIPS 2026 · similarity 0.90)
- One-shot Empirical Privacy Estimation for Federated Learning (ICLR 2024 · similarity 0.90)
- Empirical Privacy Variance (ICML 2025 · similarity 0.89)
- Sequentially Auditing Differential Privacy (NeurIPS 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.