UniAud: A Unified Auditing Framework for High Auditing Power and Utility with One Training Run

Li Xiong; Ruixuan Liu

REVIEW 4 major objections 7 minor 41 references

UniAud: A Unified Auditing Framework for High Auditing Power and Utility with One Training Run

T0 review · 4 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a black-box O(1) auditing framework—using one training run instead of one run per audit sample—can match the empirical privacy lower bounds of O(T) auditing with thousands of runs, by replacing real audit data with…

desk verdict UniAud has a genuinely useful conceptual contribution for O(1) DP auditing, but its statistical validity is currently unverifiable because the proof of the key theorem is missing. read the letter →

arxiv 2507.04457 v1 pith:TANPNUCO submitted 2025-07-06 cs.CR

Ruixuan Liu , Li Xiong This is my paper

classification cs.CR

keywords differentialprivacyDPauditingmembershipinferencesyntheticcanariesself-comparisonscoringone-runlowerboundsmulti-tasklearning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that privacy auditing of differentially private models—normally requiring thousands of training runs to get tight estimates—can be done in a single run with the same tightness, even when the auditor only sees model outputs. It identifies two reasons earlier one-run audits were weak: real audit samples correlate with each other, and the common goal of preserving model utility fights against the memorization that auditing needs. UniAud answers the first with synthetic canaries drawn from an uncorrelated input-label space plus a self-comparison scoring rule; UniAud++ answers the second with multi-task training that keeps the utility objective separate from the auditing objective. The paper concludes that an auditor can therefore certify a DP implementation's actual privacy level cheaply and repeatedly, and can even audit a model while training it.

What carries the argument

The load-bearing object is the synthetic canary built from an uncorrelated pair-matching task: features drawn from a high-dimensional Gaussian or orthogonal distribution and labels drawn uniformly from a class space of size $C$, so that member samples have near-zero loss while non-members have loss close to $\log C$. On top of this, the self-comparison score computes, for each audit sample, the difference between its loss under the true paired label and its loss under a fresh label, making each membership decision independent of other samples' hardness. These two pieces let Algorithm 2 inherit the hypothesis-testing bound of the existing one-run auditing framework; the data-dependent extension changes the input space to trigger-tag pairs and optimizes the membership-encoding loss through a separate head, with multi-bit encoding to keep the parameter cost manageable.

What would settle it

Run Algorithm 2 with orthogonal canaries ($d_x=10^3$, $C=10^3$, $m=2000$) against a DP-SGD implementation with analytical $\epsilon=4$ and $\delta=10^{-5}$ at 95% confidence; if the empirical lower bound consistently stays near 1.3 rather than approaching 2.2, the claimed match to O(T) auditing fails. A more direct check is to test Theorem 3 numerically by verifying that the self-comparison scores behave like independent Bernoulli draws under the null hypothesis.

Watch

Extended reading notes

Core claim

On its own terms, the central discovery is that data dependency—not the number of training runs—is what limits the tightness of one-run DP auditing. By drawing audit samples from an uncorrelated synthetic input-label space and scoring every sample against its own freshly sampled label, UniAud removes the ranking-based dependence between audit decisions and makes each observation contribute independently to the privacy lower bound. The paper argues that this carries the original one-run hypothesis-testing bound over to the new scoring rule through Theorem 3, and shows empirically that the resulting black-box lower bound tracks the analytical privacy budget, reaching about $\epsilon_L \approx 2.2$ at analytical $\epsilon=4$ where prior black-box one-run methods plateau near 1.3. For data-dependent auditing, UniAud++ encodes membership through trigger-tag pairs in a separate task head, leaving the main-task objective intact and preserving model utility.

Load-bearing premise

The entire statistical guarantee rests on a claim the paper defers to an appendix that is not present in the manuscript: that comparing each audit sample with its own freshly sampled label satisfies the conditions of the existing one-run auditing bound for every sample independently.

Editorial extensions

If this is right

One training run can yield empirical privacy lower bounds comparable to thousands of runs, so DP deployments can be audited continuously and cheaply even when only black-box access is available.
Auditing no longer depends on real training data or auxiliary poisoned datasets: the auditor can generate synthetic canaries and designate an architecture, making the audit procedure portable across systems.
The data-dependent variant keeps the utility objective untouched while encoding membership, so an expensive private training run can double as an audit without an extra training run.
The same pair-matching recipe extends to language models using repeated new-token prefixes and suffixes, so auditors can apply it to text APIs as well as image classifiers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A general lesson likely extends beyond this paper: calibrating each score against its own counterfactual removes sample-hardness dependence, a recipe that could sharpen membership-inference attacks outside DP auditing too.
The reported dependence of the lower bound on input dimension and encoding-space size suggests a capacity law: a single run can certify privacy only up to the number of independently encodable audit samples that fit in the model's input-label space.
Standardized synthetic canaries could let regulators compare different DP implementations on a common yardstick, turning one-run audits into reproducible compliance checks rather than dataset-specific numbers.
Applying the recipe to DP generative models or federated learning is a natural next step the paper does not test; the main requirement would be a score function defined on generated outputs or local updates.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things you should know about arXiv:2507.04457. First, the conceptual move is genuinely useful: distinguishing data-independent from data-dependent auditing, and using uncorrelated synthetic canaries so that audit samples behave like independent observations. Second, the load-bearing theorem is stated with proof deferred to an appendix that is not present, and the reduction is not obvious. Until that reduction is written out, the headline empirical lower bounds are not certified.

What the paper does well: it identifies two real obstacles in O(1) auditing—correlation among canaries and the tension between auditing power and model utility—and proposes a concrete fix for both. Synthetic canaries with random features and labels are a sensible way to make each audit sample's encoding independent, and the self-comparison scoring rule (calibrating each sample against a fresh-label counterpart) is a clever way to remove dependence on the relative ranking of scores. The experiments are broad: several architectures, image and language tasks, ablations over m, feature dimension, and encoding space. The reported improvements over prior black-box O(1) baselines are substantial, and the authors are honest that their method works best with a randomly initialized MLP rather than a pretrained model.

Now the soft spots. The big one is Theorem 3. In Algorithm 2, the membership vector S is sampled after training, and the trainer always trains on the full audit set. In the original O(1) framework, S determines which samples are in or out of the training set. Here it only decides, after the fact, which of the two candidates is called the "member" when computing the self-comparison score. That is not, on its face, the same game as inclusion/exclusion, and the event "many correct guesses" may not be bounded by the DP guarantee without a nontrivial reduction. The paper says the proof is in the appendix, but there is no appendix. This is not a cosmetic omission; it is the entire statistical foundation. If the reduction does not hold, the reported lower bounds could reflect memorization rather than a DP violation.

A second soft spot: experimental tables report single runs with no error bars, and the headline claim of matching O(T) auditing is based on comparing to published numbers rather than a controlled re-run with the same setup. The method's sensitivity to hyperparameters (shown in the paper's own figures) makes variance reporting important.

Who is this for? The privacy-auditing subfield will want to read this; it is one of the more interesting new O(1) constructions in a while. But I would not cite the results yet for my own work, because the central theorem is unverified.

My recommendation: this deserves a serious peer review, not a desk reject. The idea is plausible and the empirical pattern is worth explaining, but the reviewers must see the full proof of Theorem 3—and ideally code, seeds, and error bars—before the claims are accepted.

Referee Report

4 major / 7 minor

Summary. The paper proposes UniAud, a black-box O(1) differentially private (DP) auditing framework that constructs synthetic uncorrelated canaries and uses a self-comparison scoring rule to estimate empirical privacy lower bounds from a single training run. It then extends this to UniAud++ for data-dependent auditing by separating the auditing objective from the main-task objective through multi-task learning and a membership-encoding head. The central claim is that UniAud matches the auditing power of state-of-the-art O(T) auditing methods, which require thousands of runs, while preserving O(1) efficiency, and that UniAud++ achieves a better utility-auditing trade-off than prior O(1) baselines. Empirical results are reported on image classification (CIFAR10, CIFAR100, GTSRB) and language modeling (PersonaChat, PubMed) across CNN, ViT, MLP, and GPT-2 architectures.

Significance. If the central claims hold, this would be a meaningful advance: it identifies data dependency and an auditing-utility conflict as key limitations of existing O(1) auditing, proposes a concrete synthetic-canary construction with a label-independence property, and offers a plausible route to practical black-box auditing at O(1) cost. The breadth of the evaluation across architectures and modalities is a strength, as are the ablations that separate the contributions of canary construction and self-comparison. The paper also makes falsifiable empirical claims, such as matching the previously reported O(T) audit lower bound of approximately 1.3 at epsilon=4, which can be independently tested. However, the statistical validity of the entire framework rests on Theorem 3, whose proof is deferred to an absent appendix, and the headline experimental comparisons are based on single-run point estimates rather than controlled repeated audits. These issues currently prevent the paper from establishing its central claims.

major comments (4)

[Section V-B, Theorem 3 and Algorithm 2] The proof of Theorem 3 is deferred to an appendix that is not present in the manuscript, and the claimed reduction is not immediate. In Algorithm 2, the trainer trains on the full audit set Daudit regardless of the membership vector S; S is sampled only after training and merely decides whether Daudit[i] or Dcomp[i] is called the member when forming the self-comparison score. Consequently, the training algorithm's output distribution is independent of S, whereas Theorem 2 of [11] requires S to determine which samples enter the training set. Without a supplied reduction showing that the self-comparison protocol is dominated by the standard inclusion/exclusion auditing game, the reported lower bounds are not certified at the stated 95% confidence level. Please provide the full proof or a precise counterexample.
[Section VIII-B, Table IV and Figure 3] The headline comparison to O(T) auditing results is made against published numbers rather than a controlled re-run under identical conditions. Table IV reports single-run point estimates with no error bars or repeated-audit variance; several entries are non-monotonic (e.g., CIFAR10 ViT-Base In-distribution epsilon=1: 0.067 at m=2e3 versus 0.010 at m=1e4), so the point estimates alone cannot support the claim that UniAud 'matches' state-of-the-art O(T) tightness. Please report means and standard deviations over multiple independent audits, and preferably include a direct comparison where the O(T) baseline is re-run in the same experimental setup.
[Section VIII-B5 and VIII-B6, Figures 6 and 7] The default canary hyperparameters (dx=1e3, C=1e3, dh=1e5, m=2e3) are close to critical points: the paper shows that ϵL first decreases and then increases with dx and C, and the optimal choice depends on m. Because the framework's reported superiority appears sensitive to these choices, the paper needs either a principled method for selecting these parameters in new settings or a more tempered claim of generality. Without such guidance, it is unclear how a practitioner would apply UniAud to a new dataset or model architecture.
[Section VI-B, Multi-Bit Membership Encoding] The parameter-count argument for multi-bit encoding is not convincing as stated. A linear head mapping dh-dimensional features to |E| classes has dh * |E| parameters regardless of whether each sample is assigned one tag or H tags; the number of unique tag combinations C(|E|, H) does not by itself reduce the head size unless the architecture is explicitly changed (e.g., multiple heads or a different output layer). Please clarify the architecture and re-derive the claimed reduction factor, or remove the claim if it is not essential.

minor comments (7)

[Section III-C] The notation [n] is defined as {0,1,...,n-1} in a footnote, but the text and equations elsewhere use [m] with indices starting at 1; this is inconsistent and should be unified.
[Sections V-A2, V-B, and Algorithm 2] The canary function is referred to inconsistently as fCRF, fCNR, and fCRN; please use one name throughout.
[Section II-A] There is a typo: 'providees' should be 'provides'.
[Section VIII-A] The word 'momel' appears in the description of the Poisoned baseline; this should be 'model'.
[Section V-B] The text says 'Bernoulii' instead of 'Bernoulli'.
[Figure 8] The caption says 'Influence of the number of target encoding space C' but the figure appears to compare model architectures; please correct the caption to match the content.
[Section VIII-B] The text says 'we use m=2,000 for ours, and optimize m={500,2,000,5,000} for baselines', but Table IV also reports m=10,000; this inconsistency should be resolved.

Circularity Check

1 steps flagged · score 1.0 of 10

No construction-level circularity: audit outcomes are measured, bounds rest on external Theorem 2, self-citation is non-load-bearing; flagged: Theorem 3's proof is deferred to a missing appendix (completeness risk, not circularity).

other [Section V-B (Theorem 3 and following sentence); Algorithm 2]
"Theorem 3: Assume training algorithm T satisfies (ϵ, δ)-DP, and fCNR in Section V-A3 is used in auditing Algorithm 2, then the inequality in Theorem 2 hold for (S, Ŝ) ∈ {−1, +1}m × {−1, 0, +1}m in Algorithm 2. ... Thus, we have Theorem 3 with the key prerequisite of Property 1, with proof in Appendix."

Flagged under the completeness rule rather than as construction-level circularity. The certified confidence of every reported ϵL (e.g., Table IV, ϵL = 1.089 for a claimed ε = 1 with δ = 1e−5) depends on Theorem 3, which asserts that the self-comparison protocol of Algorithm 2 obeys the bound of Steinke et al.'s Theorem 2. The proof is deferred to an appendix that is not present in the manuscript. The reduction is non-trivial on its face: in Algorithm 2 (lines 3-6) the trainer trains on the full Daudit and S is sampled only afterwards, whereas in the original O(1) game S determines which audit samples are included in the training set. Without the promised reduction, the inequality in Theorem 2 does not apply verbatim and the reported lower bounds are not certified at 95% confidence.

full rationale

The derivation chain is not circular. (1) The reported ϵL values are measured outcomes of a fixed black-box audit protocol, not parameters fitted to a target; the canary hyperparameters (dx = 10^3, C = 10^3, dh = 10^5, m = 2 × 10^3) are tuned to maximize audit power, which is the declared auditing objective, and the headline claim of matching O(T) auditing is an empirical measurement, not a value forced by construction. (2) The statistical validity rests on Theorem 2 of Steinke et al. [11], an external result whose assumptions do not include the target claim; the paper's own Theorem 3 is the only bridge to the self-comparison protocol, and its missing proof (appendix absent) is a completeness/correctness risk that I flag explicitly but do not count as circularity, since no equation in the manuscript shows the claimed inequality to be definitionally equal to its inputs. (3) The only self-citation, Precurious [22], is used to construct the Poisoned baseline in the preliminary analysis and Table IV; it is not load-bearing for UniAud's method, and no uniqueness theorem from the authors is invoked to forbid alternatives. (4) The canary construction (random x, uniform y, orthogonal variant) is an openly stated design ansatz supported by the toy experiments and external results (Zhang et al. [31]), not a renaming of a known result presented as a derivation. I find no equation-level reduction of a prediction to its inputs, so the score is 1, reflecting only the minor non-circular flag on Theorem 3's omitted proof.

Assumptions & free parameters 7 free parameters · 5 assumptions · 2 invented entities

The method relies on several hand-chosen canary hyperparameters (dx, C, dh, m, σ0, λ, |E|) that materially affect ϵL. The statistical conclusion depends on the external O(1) theorem and on the design assumption that synthetic features and labels are independent. No new physical entities are introduced; the synthetic canary distribution and the membership encoding head are constructs whose effects are only demonstrated in this paper's experiments.

free parameters (7)

Canary feature dimension dx = 10^3 (default)
Controls input-space sparsity and the collision threshold for orthogonal canaries; Figure 6 shows ϵL depends strongly on dx.
Canary output space size C = 10^3 (default)
Controls non-member loss log C and the number of unique input-label encodings; Figure 7 shows optimal C around the audit sample size m.
MLP hidden dimension dh = 10^5 (default)
Provides the capacity to memorize m canaries; the paper attributes stronger MLP auditing to this large hidden state.
Audit sample size m = 2,000 (default); optimal reported 500-2,000
Trades statistical power ϵO against dependency and memorization; Figure 4 shows ϵL varies strongly with m.
Gaussian canary noise scale σ0 = not specified numerically
Controls separation of synthetic samples; in Algorithm 1 σ0 scales Gaussian canary features.
Multi-task coefficient λ = not specified
Balances main-task loss and membership encoding loss in UniAud++ (Eq. 12); a numerical value is not reported in the text.
Tag space size |E| and multi-bit parameter H = |E|=100 in image experiments; H unspecified
Governs collision probability m^2/(2|E|) for independent membership encoding in UniAud++; chosen by hand.

assumptions (5)

standard math Theorem 2 of Steinke et al. (2023) correctly bounds the sum of correct guesses for any DP training algorithm and any membership inference rule.
The entire fEST conversion from guesses to ϵL, and Theorem 3, depend on this prior O(1) auditing theorem.
domain assumption The synthetic canary data satisfies Property 1 (label independency) and fresh labels are independent of inputs.
Used to justify that self-comparison scores are symmetric and that non-member loss concentrates near log C; Algorithm 1 constructs features and labels independently, but this is a design assumption, not proven in general.
domain assumption DP-SGD with the configured sub-sampling ratio, clipping, and noise satisfies the claimed analytical (ϵ,δ)-DP.
The audit lower bound ϵL is compared against the analytical ϵ; any accounting error would change the conclusions.
standard math A 2-layer ReLU network with 2n+d parameters can represent arbitrary functions on n samples.
Used to justify that the chosen MLP can memorize synthetic canaries (Section V-A4, citing Zhang et al.).
domain assumption The auditor cannot manipulate the training implementation and only has black-box access to the final model.
Threat model in Section III-D; the framework's claims are scoped to this setting.

invented entities (2)

Uncorrelated synthetic canary distribution (X×Y with random features and uniform labels)
purpose: Provide audit samples that are mutually independent and easy to memorize, increasing MIA accuracy and ϵL.
Its audit-tightening effect is demonstrated only in this paper's experiments; no external validation or theory guarantees optimality.
Membership encoding head and tag space (G×E) in UniAud++
purpose: Decouple the membership encoding objective from the main-task objective through a separate linear head and trigger-tag pairs.
The head is a model component introduced by the paper; its utility-auditing trade-off is measured only in this paper.

how reviews work

0 comments

Cite this review

Pith. "Pith review of UniAud: A Unified Auditing Framework for High Auditing Power and Utility with One Training Run." pith.science (2026). https://pith.science/paper/TANPNUCO

@misc{pith2026250704457,
  author       = {Pith},
  title        = {Pith review of: UniAud: A Unified Auditing Framework for High Auditing Power and Utility with One Training Run},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TANPNUCO}},
  note         = {Machine review of arXiv:2507.04457}
}

read the original abstract

Differentially private (DP) optimization has been widely adopted as a standard approach to provide rigorous privacy guarantees for training datasets. DP auditing verifies whether a model trained with DP optimization satisfies its claimed privacy level by estimating empirical privacy lower bounds through hypothesis testing. Recent O(1) frameworks improve auditing efficiency by checking the membership status of multiple audit samples in a single run, rather than checking individual samples across multiple runs. However, we reveal that there is no free lunch for this improved efficiency: data dependency and an implicit conflict between auditing and utility impair the tightness of the auditing results. Addressing these challenges, our key insights include reducing data dependency through uncorrelated data and resolving the auditing-utility conflict by decoupling the criteria for effective auditing and separating objectives for utility and auditing. We first propose a unified framework, UniAud, for data-independent auditing that maximizes auditing power through a novel uncorrelated canary construction and a self-comparison framework. We then extend this framework as UniAud++ for data-dependent auditing, optimizing the auditing and utility trade-off through multi-task learning with separate objectives for auditing and training. Experimental results validate that our black-box O(1) framework matches the state-of-the-art auditing results of O(T) auditing with thousands of runs, demonstrating the best efficiency-auditing trade-off across vision and language tasks. Additionally, our framework provides meaningful auditing with only slight utility degradation compared to standard DP training, showing the optimal utility-auditing trade-off and the benefit of requiring no extra training for auditing.

Figures

Figures reproduced from arXiv: 2507.04457 by the authors.

**Figure 2.** Interplay between sample-specific memorization (less [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** The non-DP training with ϵ = ∞ in the figure acts as an indicator of the capability of fMIA in the auditing algorithm A. Given the optimal estimated risk ϵO calculated when we assume the MIA component fMIA has 100% inference accuracy, thus if an auditing algorithm has ϵL < ϵO for ϵ = ∞, it indicates that the MIA fMIA is weak and impairs the auditing tightness. We use orthogonal canaries with m = 2, 000 for ours, an… view at source ↗

Figures from the paper (8 more)

**Figure 3.** Figure 3: Auditing improvement in Case I of data-independent setting with [PITH_FULL_IMAGE:figures/full_fig_p010_3.png]

**Figure 4.** Figure 4: Influence of m for image classification (left and middle) and language modeling (right) 0 2 4 6 8 10 0 L Optimal Estimation O (m = 2 × 10 3 ) w/ Self-Compare (m=2000) w/o Self-Compare (m=2000) 0 2 4 6 8 10 0 Optimal Estimation O (m = 1 × 10 4 ) w/ Self-Compare (m=10000…

**Figure 5.** Figure 5: Effectiveness of self-comparison with MLP model [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

**Figure 6.** Figure 6: Influence of feature dimension dx 10 2 10 3 10 4 C 1 2 3 L ( = 4) m=2000 10 2 10 3 10 4 C m=10000 Orthogonal Gaissian [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

**Figure 7.** Figure 7: Influence of the number of target encoding space [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

**Figure 8.** Figure 8: Influence of the number of target encoding space [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

**Figure 9.** Figure 9: Utility and Auditing Trade-off in Case II for Image [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

**Figure 10.** Figure 10: Utility and Auditing Trade-off in Case II for language [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 24 canonical work pages

[11]

Privacy auditing with one (1) training run,

T. Steinke, M. Nasr, and M. Jagielski, “Privacy auditing with one (1) training run,” Advances in Neural Information Processing Systems , vol. 36, pp. 49 268–49 280, 2023

work page 2023
[1]

Deep leakage from gradients,

L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems , vol. 32, 2019

2019
[2]

Membership inference attacks from first principles,

N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1897–1914

work page 2022
[3]

Extracting training data from large language models,

N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson et al., “Extracting training data from large language models,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 2633–2650

2021
[4]

Deep learning with differential privacy,

M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 308–318

work page 2016
[5]

Calibrating noise to sensitivity in private data analysis,

C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” Journal of Privacy and Confiden- tiality, vol. 7, no. 3, pp. 17–51, 2016

2016
[6]

Membership inference attacks against machine learning models,

R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

2017
[7]

Debugging differential privacy: A case study for privacy auditing,

F. Tramer, A. Terzis, T. Steinke, S. Song, M. Jagielski, and N. Carlini, “Debugging differential privacy: A case study for privacy auditing,” arXiv preprint arXiv:2202.12219 , 2022

arXiv 2022

Show all 41 references

[8]

Auditing differentially private machine learning: How private is private sgd?

M. Jagielski, J. Ullman, and A. Oprea, “Auditing differentially private machine learning: How private is private sgd?” Advances in Neural Information Processing Systems , vol. 33, pp. 22 205–22 216, 2020

2020
[9]

Adversary instantiation: Lower bounds for differentially private machine learning,

M. Nasr, S. Songi, A. Thakurta, N. Papernot, and N. Carlin, “Adversary instantiation: Lower bounds for differentially private machine learning,” in 2021 IEEE Symposium on security and privacy (SP) . IEEE, 2021, pp. 866–882

2021
[10]

Tight auditing of differentially private machine learning,

M. Nasr, J. Hayes, T. Steinke, B. Balle, F. Tram `er, M. Jagielski, N. Car- lini, and A. Terzis, “Tight auditing of differentially private machine learning,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 1631–1648

2023
[12]

Privacy audit as bits transmission:(im) possibilities for audit by one run,

Z. Xiang, T. Wang, and D. Wang, “Privacy audit as bits transmission:(im) possibilities for audit by one run,” arXiv preprint arXiv:2501.17750 , 2025

2025 arXiv
[13]

Auditing f-differential privacy in one run,

S. Mahloujifar, L. Melis, and K. Chaudhuri, “Auditing f-differential privacy in one run,” arXiv preprint arXiv:2410.22235 , 2024

2024 arXiv
[14]

Nearly tight black- box auditing of differentially private machine learning,

M. S. Muthu Selva Annamalai and E. De Cristofaro, “Nearly tight black- box auditing of differentially private machine learning,” Advances in Neural Information Processing Systems , vol. 37, pp. 131 482–131 502, 2024

2024
[15]

Differentially private in- context learning,

A. Panda, T. Wu, J. Wang, and P. Mittal, “Differentially private in- context learning,” in The 61st Annual Meeting of the Association for Computational Linguistics, 2023

2023
[16]

Evaluating differentially private machine learning in practice,

B. Jayaraman and D. Evans, “Evaluating differentially private machine learning in practice,” in 28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 1895–1912

2019
[17]

Canife: Crafting canaries for empirical privacy measurement in federated learning,

S. Maddock, A. Sablayrolles, and P. Stock, “Canife: Crafting canaries for empirical privacy measurement in federated learning,” arXiv preprint arXiv:2210.02912, 2022

2022 arXiv
[18]

A general framework for auditing differentially private machine learning,

F. Lu, J. Munoz, M. Fuchs, T. LeBlond, E. Zaresky-Williams, E. Raff, F. Ferraro, and B. Testa, “A general framework for auditing differentially private machine learning,” Advances in Neural Information Processing Systems, vol. 35, pp. 4165–4176, 2022

2022
[19]

Bayesian estimation of differential privacy,

S. Zanella-B ´eguelin, L. Wutschitz, S. Tople, A. Salem, V . R ¨uhle, A. Paverd, M. Naseri, B. K ¨opf, and D. Jones, “Bayesian estimation of differential privacy,” in International Conference on Machine Learning . PMLR, 2023, pp. 40 624–40 636

2023
[20]

One-shot empirical privacy estimation for federated learning,

G. Andrew, P. Kairouz, S. Oh, A. Oprea, H. B. McMahan, and V . M. Suriyakumar, “One-shot empirical privacy estimation for federated learning,” arXiv preprint arXiv:2302.03098 , 2023

2023 arXiv
[21]

Unleashing the power of randomization in auditing differentially private ml,

K. Pillutla, G. Andrew, P. Kairouz, H. B. McMahan, A. Oprea, and S. Oh, “Unleashing the power of randomization in auditing differentially private ml,”Advances in Neural Information Processing Systems, vol. 36, pp. 66 201–66 238, 2023

2023
[22]

Precurious: How innocent pre-trained language models turn into privacy traps,

R. Liu, T. Wang, Y . Cao, and L. Xiong, “Precurious: How innocent pre-trained language models turn into privacy traps,” in Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security, 2024

2024
[23]

Privacy backdoors: Enhancing membership inference through poisoning pre-trained models,

Y . Wen, L. Marchyok, S. Hong, J. Geiping, T. Goldstein, and N. Carlini, “Privacy backdoors: Enhancing membership inference through poisoning pre-trained models,” arXiv preprint arXiv:2404.01231 , 2024

2024 arXiv
[24]

A general framework for data-use auditing of ml models,

Z. Huang, N. Z. Gong, and M. K. Reiter, “A general framework for data-use auditing of ml models,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 1300–1314

2024
[25]

How much of my dataset did you use? quantitative data usage inference in machine learning,

Y . Tong, J. Ye, S. Zarifzadeh, and R. Shokri, “How much of my dataset did you use? quantitative data usage inference in machine learning,” in The Thirteenth International Conference on Learning Representations
[26]

Membership encoding for deep learning,

C. Song and R. Shokri, “Membership encoding for deep learning,” in Proceedings of the 15th ACM Asia Conference on Computer and Communications Security, 2020, pp. 344–356

2020
[27]

A method to facilitate membership infer- ence attacks in deep learning models,

Z. Chen and K. Pattabiraman, “A method to facilitate membership infer- ence attacks in deep learning models,” arXiv preprint arXiv:2407.01919, 2024

2024 arXiv
[28]

The composition theorem for differential privacy,

P. Kairouz, S. Oh, and P. Viswanath, “The composition theorem for differential privacy,” in International conference on machine learning . PMLR, 2015, pp. 1376–1385

2015
[29]

Privacy auditing of large language models,

A. Panda, X. Tang, M. Nasr, C. A. Choquette-Choo, and P. Mit- tal, “Privacy auditing of large language models,” arXiv preprint arXiv:2503.06808, 2025

2025 arXiv
[30]

On the generalization effects of linear transformations in data augmentation,

S. Wu, H. Zhang, G. Valiant, and C. R ´e, “On the generalization effects of linear transformations in data augmentation,” in International conference on machine learning . PMLR, 2020, pp. 10 410–10 420

2020
[31]

Understand- ing deep learning requires rethinking generalization,

C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals, “Understand- ing deep learning requires rethinking generalization,” arXiv preprint arXiv:1611.03530, 2016

2016 arXiv
[32]

Introduction to modern cryptography,

M. Bellare and P. Rogaway, “Introduction to modern cryptography,” Lecture Notes, 2001

2001
[33]

A new linear scaling rule for private adaptive hyperparameter optimization,

A. Panda, X. Tang, S. Mahloujifar, V . Sehwag, and P. Mittal, “A new linear scaling rule for private adaptive hyperparameter optimization,” in International Conference on Machine Learning . PMLR, 2024, pp. 39 364–39 399

2024
[34]

Tem- pered sigmoid activations for deep learning with differential privacy,

N. Papernot, A. Thakurta, S. Song, S. Chien, and ´U. Erlingsson, “Tem- pered sigmoid activations for deep learning with differential privacy,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 35, no. 10, 2021, pp. 9312–9321

2021
[35]

Not all noise is accounted equally: How differentially private learning benefits from large sampling rates,

F. D ¨ormann, O. Frisk, L. N. Andersen, and C. F. Pedersen, “Not all noise is accounted equally: How differentially private learning benefits from large sampling rates,” in 2021 IEEE 31st International Workshop on Machine Learning for Signal Processing (MLSP) . IEEE, 2021, pp. 1–6

2021
[36]

Automatic clipping: Differentially private deep learning made easier and stronger,

Z. Bu, Y .-X. Wang, S. Zha, and G. Karypis, “Automatic clipping: Differentially private deep learning made easier and stronger,” Advances in Neural Information Processing Systems , vol. 36, 2023

2023
[37]

Unlocking high-accuracy differentially private image classification through scale,

S. De, L. Berrada, J. Hayes, S. L. Smith, and B. Balle, “Unlocking high-accuracy differentially private image classification through scale,” arXiv preprint arXiv:2204.13650 , 2022

2022 arXiv
[38]

An image is worth 16x16 words: Transformers for image recognition at scale,

A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929 , 2020

2010 arXiv
[39]

Large language models can be strong differentially private learners,

X. Li, F. Tramer, P. Liang, and T. Hashimoto, “Large language models can be strong differentially private learners,” arXiv preprint arXiv:2110.05679, 2021

2021 arXiv
[40]

Differentially private fine- tuning of language models,

D. Yu, S. Naik, A. Backurs, S. Gopi, H. A. Inan, G. Kamath, J. Kulkarni, Y . T. Lee, A. Manoel, L. Wutschitz et al. , “Differentially private fine- tuning of language models,” arXiv preprint arXiv:2110.06500 , 2021

2021 arXiv
[41]

Meddialog: Large-scale medical dialogue datasets,

G. Zeng, W. Yang, Z. Ju, Y . Yang, S. Wang, R. Zhang, M. Zhou, J. Zeng, X. Dong, R. Zhang et al. , “Meddialog: Large-scale medical dialogue datasets,” in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) , 2020

2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [11]

Privacy auditing with one (1) training run,

T. Steinke, M. Nasr, and M. Jagielski, “Privacy auditing with one (1) training run,” Advances in Neural Information Processing Systems , vol. 36, pp. 49 268–49 280, 2023

work page 2023

[2] [1]

Deep leakage from gradients,

L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems , vol. 32, 2019

2019

[3] [2]

Membership inference attacks from first principles,

N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1897–1914

work page 2022

[4] [3]

Extracting training data from large language models,

N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson et al., “Extracting training data from large language models,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 2633–2650

2021

[5] [4]

Deep learning with differential privacy,

M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 308–318

work page 2016

[6] [5]

Calibrating noise to sensitivity in private data analysis,

C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” Journal of Privacy and Confiden- tiality, vol. 7, no. 3, pp. 17–51, 2016

2016

[7] [6]

Membership inference attacks against machine learning models,

R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

2017

[8] [7]

Debugging differential privacy: A case study for privacy auditing,

F. Tramer, A. Terzis, T. Steinke, S. Song, M. Jagielski, and N. Carlini, “Debugging differential privacy: A case study for privacy auditing,” arXiv preprint arXiv:2202.12219 , 2022

arXiv 2022