Research map / Federated learning and privacy / Differential privacy

Monitoring Violations of Differential Privacy over Time

NeurIPS 2026 · Federated learning and privacy › Differential privacy · approach: Privacy accounting and mechanisms

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ReTiDP, a weighted-aggregation sequential monitor that combines per-time-step DP auditing statistics over time into a detector with a Brownian-motion-based threshold, controlling false alarms while detecting privacy violations with fewer samples per step.

Problem

Auditing differential privacy is usually a one-time task, but mechanisms evolve during development and deployment; repeatedly running static auditors is sample-inefficient and loses reliability over time, so continuous monitoring for DP violations is needed.

Approach

Treat per-time-step empirical privacy statistics as a sequence and aggregate them with a weighted maximum over trailing windows (weights 1/(l+1)^beta), with a threshold given by the upper quantile of a Brownian-motion-based functional; this gives asymptotic false-alarm control and detection-delay guarantees.

Key results

• Under no violation, the detection proportion stays below the nominal alpha=0.05 before the modification at time 50 across scenarios (a)-(h) with T=100, n=750, 100 runs.
• All harmful modifications (scenarios a-f) are eventually detected in 100% of simulation runs, with SVT 5 detected almost immediately while subtler changes take longer.
• Larger sample size n (200 to 2000) yields faster detection after the change for Laplace (b) and SVT (d) scenarios, consistent with the theoretical delay rate.

Surprising findings

• Harmless changes (exponential noise in RNM, SVT 1) are not flagged, but the paper notes that for multi-event monitoring the event choice matters: the event at a=0 dominates the aggregate detector despite the same theoretical epsilon.

Limitations

• Theoretical guarantees are asymptotic in n (weak convergence), with threshold from Monte Carlo of the Brownian functional.
• Relies on known events and neighboring databases chosen by the analyst; tuple/event selection heuristics matter.
• Only the pure epsilon-DP setting with tuple-based auditing is treated; f-DP, divergence-based and DP-SGD auditors are not covered.

Experimental setup

Benchmarks: simulated DP mechanisms: Laplace mechanism, Report Noisy Max, Sparse Vector Technique variants

Metrics: false alarm rate detection proportion over time detection delay

Baselines: naive repeated static auditor with Bonferroni correction

Builds on: Brownian motion (standard) functional threshold sequential change-point monitoring Clopper-Pearson-style empirical DP auditing (Jagielski-style tuple estimator)

Closest papers by meaning

• Auditing $f$-differential privacy in one run (ICML 2025 · similarity 0.90)
• Sequentially Auditing Differential Privacy (NeurIPS 2025 · similarity 0.89)
• How Well Can Differential Privacy Be Audited in One Run? (NeurIPS 2025 · similarity 0.87)
• Auditing Private Prediction (ICML 2024 · similarity 0.85)
• Setting $\varepsilon$ is not the Issue in Differential Privacy (NeurIPS 2025 · similarity 0.85)
• The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD (ICLR 2025 · similarity 0.85)