SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Lemma 4. If the density of  $\mathcal{Z}$  is additionally symmetric about the location parameter, the simultaneous individual LR tests  $r$  and  $r'$  are equivalent to performing a single test using the magnitude of the observation as a test statistic, i.e. letting  $\| \theta \| \sim \| \mathcal{Z}(\mu ,\xi)\|$  and testing  $\mathcal{H}_0:\| \mu \| = 0$  vs.  $\mathcal{H}_1:\| \mu \| >0$ . The power of this "combined" test is maximised at  $\| \mu \| = \Delta$ .
Lemma 5. For a (not necessarily symmetric)  $\mathcal{Z}$  the Generalised Likelihood Ratio Test (GLRT) using the test statistic  $\log \frac{\mathcal{L}(\theta|\mathcal{Z}(\hat{\mu},\xi))}{\mathcal{L}(\theta|\mathcal{Z}(0,\xi))}$ , where  $\hat{\mu}$  is the maximum likelihood estimate of  $\mu$  is equivalent to simultaneously conducting  $r$  and  $r'$ . The GLRT's power is maximised at  $\hat{\mu} = \Delta$ .
We stress that, while the two tests are UMP level  $\alpha$  and can be "combined" into one test, the combined test is not UMP level  $\alpha$  over the whole range (by Lemma 1). To construct both trade-off functions, the steps above are either repeated for  $\mathcal{H}_1$  vs.  $\mathcal{H}_0$ , or the trade-off function for  $\mathcal{H}_0$  vs.  $\mathcal{H}_1$  is inverted directly, i.e. in closed form or numerically.
$\lambda$ -Detection resilience Next, we introduce a measure for  $\mathcal{A}^{\mathrm{SO}}$ ’s optimal achievable error rates under the RTM, inspired by f-DP: For each mechanism, we create a pair of trade-off functions  $j$  and  $j^{-1}$ . These parameterise the error rates of the UMP level  $\alpha$  tests against the dominating pair distributions of a given mechanism  $\mathcal{M}$  in the RTM. Next, we “unify” the functions by symmetrisation/convexification to obtain a single, symmetric trade-off function  $J:\alpha \mapsto \beta$ , which expresses all optimal error rates of  $\mathcal{A}^{\mathrm{SO}}$  against  $\mathcal{M}$ . Finally, we compare  $J$  to a reference trade-off function  $\lambda$ . If  $J$  lies on or above  $\lambda$ ,  $\mathcal{A}^{\mathrm{SO}}$  cannot achieve lower  $\beta$  for any  $\alpha$  in the task of detecting the presence of  $x^{*}$  in  $D'$  by observing  $\theta$ , and we say that  $\mathcal{M}$  satisfies  $\lambda$ -Detection Resilience ( $\lambda$ -DR).
Definition 3. Let  $r \in \mathcal{R}$  be a test for  $\mathcal{M}(D)$  vs.  $\mathcal{M}(D')$  and  $r' \in \mathcal{R}$  be a test for  $\mathcal{M}(D')$  vs.  $\mathcal{M}(D)$ , where  $\mathcal{R}$  is the set of LR tests which are computable in the RTM. To construct  $J$ , fix a level  $\alpha$ , then obtain  $j = \inf_{r \in \mathcal{R}} \{\beta_r : \alpha_r \leq \alpha\}$  and  $j^{-1} = \inf_{r' \in \mathcal{R}} \{\beta_{r'} : \alpha_{r'} \leq \alpha\}$ . Then compute the symmetrisation/convexification  $J = \mathrm{C}(j, j^{-1})$ . We say that a mechanism  $\mathcal{M}$  satisfies  $\lambda$ -DR, if for some reference function  $\lambda$  and  $\forall D, D' : D \simeq D'$ , it holds that  $J(\alpha) \geq \lambda(\alpha) \forall \alpha \in [0,1]$ .
We remark that computing the symmetrisation/convexification  $\mathrm{C}(j,j^{-1})$  is only a convenience measure to circumvent the necessity to work with both  $j$  and  $j^{-1}$  separately. The concrete algorithm for computing  $\mathrm{C}$  for any trade-off function pair can be found in Definition E.1 of the Appendix to [7].
Since  $\mathcal{A}^{\mathrm{SO}}$  is weaker than  $\mathcal{A}^{\mathrm{DP}}$ , we expect the trade-off functions characterising their error rates to lie on or above the trade-off functions for the same mechanism under the DPTM (see Figure 1). However, it is important to remark that  $\lambda$ -DR is not a DP guarantee, although the opposite holds true.
Lemma 6. If a mechanism satisfies  $f$ -DP, it also satisfies  $f'$ -DR, with  $f'(\alpha) \geq f(\alpha) \forall \alpha \in [0,1]$ .
Moreover, since  $\lambda$ -DR is defined conditional on a restriction of  $\mathcal{A}^{\mathrm{SO}}$ 's background knowledge, it is not resilient to post-processing through auxiliary information. However, a weaker condition holds:
Lemma 7. If a mechanism satisfies  $f$ -DP and  $f'$ -DR with  $f' \geq f$ , arbitrary post-processing can only deteriorate privacy up to the  $f$ -DP guarantee.
It follows that  $\lambda$ -DR is not closed under adaptive composition. In fact, no privacy relaxation assuming restricted background knowledge is closed under adaptive composition [26]. However, mechanism-specific guarantees can be given for non-adaptive composition, where the data/mechanism parameters are fixed in advance and all intermediate models/gradients are released to  $\mathcal{A}^{\mathrm{SO}}$ . This covers the standard DP-SGD setting and is studied below.
4 Mechanism-specific analysis
Since precisely quantifying DR for a specific noise mechanism requires knowledge of the RTM trade-off functions, we now provide methods to compute  $j$  and  $j^{-1}$  for various DP mechanisms. The construction of  $J = \mathrm{C}(j,j^{-1})$  is independent of the specific form of  $j,j^{-1}$ . By definition for all  $j,j^{-1}$ :  $j(0) = j^{-1}(0) = 1$ ,  $j(1) = j^{-1}(1) = 0$  and  $\alpha \in [0,1]$ .
Laplace Mechanism The LM with scale  $b$  on a function  $q$  with global  $\ell_1$ -sensitivity  $\Delta_1$  outputs  $q(X) + \mathrm{Lap}(0, b)$ . The LM has a symmetric noise density, thus, the magnitude distributions can be used as test statistics according to Lemma 4. Under  $\mathcal{H}_0$ , the test statistic follows an exponential distribution, while under  $\mathcal{H}_1$ , it follows the (uncommon) folded Laplace distribution [27]. Both distributions admit closed-form expressions for their CDF, SF, iCDF and iSF, thus the trade-off functions can also be characterised in closed form.
Theorem 1. Let  $\mu_{1} = \Delta_{1} / b$ . The LM satisfies  $\mathrm{C}(j_{\mathrm{Lap}}(\alpha), j_{\mathrm{Lap}}^{-1}(\alpha)) - DR$  with:
$$
j _ {\mathrm {L a p}} (\alpha) = \left\{ \begin{array}{l l} - \exp (- \mu_ {1}) \sinh (\log (\alpha)), & \alpha \geq \exp (- \mu_ {1}) \\ 1 - \alpha \cosh (\mu_ {1}), & \text {o t h e r w i s e}, \end{array} \right. \tag {2}
$$
$$
j _ {\text {L a p}} ^ {- 1} (\alpha) = \left\{ \begin{array}{l l} \frac {1}{\alpha \exp \left(\mu_ {1}\right) + \sqrt {\alpha^ {2} \exp \left(2 \mu_ {1}\right) + 1}}, & \alpha <   1 / 2 - 1 / 2 \exp (- \mu_ {1}) \\ - \frac {\alpha - 1}{\cosh \left(\mu_ {1}\right)}, & \text {o t h e r w i s e .} \end{array} \right. \tag {3}
$$
Gaussian Mechanism The GM with covariance matrix  $\sigma^2\mathbf{I}^d$  on a  $d$ -dimensional function  $q$  with global  $\ell_2$  sensitivity  $\Delta_2$  outputs  $q(\pmb {X}) + \mathcal{N}(0,\sigma^2\mathbf{I}^d)$ . Like the LM, it also has a symmetric noise density, thus the (squared) magnitude distributions can be used as a test statistic. Let  $\chi_d^2 (0,\sigma^2)$  be the chi-squared distribution with  $d$  degrees of freedom, i.e. the distribution of  $\| \mathcal{N}(0,\sigma^2\mathbf{I}^d)\| _2^2$ . Let  $\chi_d^2 (\mu_2^2,\sigma^2)$  be the noncentral chi-squared distribution with  $d$  degrees of freedom and noncentrality parameter  $\mu_2^2 = \Delta_2^2 /\sigma^2$ , i.e. the distribution of  $\| \mathcal{N}(\pmb {\nu},\sigma^2\mathbf{I}^d)\| _2^2$  with  $\| \pmb {\nu}\| _2 = \Delta$ . As in Definition 2,  $\Phi ,\Psi ,\Phi^{-1}$  and  $\Psi^{-1}$  denote the CDF, SF, iCDF and iSF of the subscripted distribution, respectively.
Theorem 2. Let  $\mu_{2} = \Delta_{2} / \sigma$ . The GM satisfies  $\mathrm{C}(j_{\mathrm{GM}}(\alpha), j_{\mathrm{GM}}^{-1}(\alpha)) - DR$  with:
$$
j _ {\mathrm {G M}} (\alpha) = \Phi_ {\chi_ {d} ^ {2} \left(\mu_ {2} ^ {2}, \sigma^ {2}\right)} \left(\Psi_ {\chi_ {d} ^ {2} (0, \sigma^ {2})} ^ {- 1} (\alpha)\right) a n d j _ {\mathrm {G M}} ^ {- 1} (\alpha) = \Psi_ {\chi_ {d} ^ {2} (0, \sigma^ {2})} \left(\Phi_ {\chi_ {d} ^ {2} \left(\mu_ {2} ^ {2}, \sigma^ {2}\right)} ^ {- 1} (\alpha)\right). \quad (4)
$$
These functions have no general analytic representation, but are easy to evaluate numerically. However, an analytic representation is available for  $j(\alpha)$  at  $d = 1$ . We discuss the importance of  $d = 1$  below.
Corollary 1. For  $d = 1$ ,  $j(\alpha)$  admits the following closed-form representation:
$$
j _ {\mathrm {G M}} (\alpha \mid d = 1) = \Phi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha / 2) - \mu_ {2}\right) - \Psi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha / 2) + \mu_ {2}\right). \tag {5}
$$
Next, we study non-adaptive composition, where a database and mechanism parameters are fixed ahead of time, and all intermediate results are released to  $\mathcal{A}^{\mathrm{SO}}$ . This setting is often encountered, e.g. in standard DP-SGD.
Lemma 8. Let  $\mathrm{GM}_a$ ,  $\mathrm{GM}_b$  be GMs with noise variances  $\sigma_a^2\mathbf{I}^d$ ,  $\sigma_b^2\mathbf{I}^d$  on functions with sensitivities  $\Delta_{2a}$ ,  $\Delta_{2b}$ , respectively. Then, the non-adaptively composed mechanism GMC has trade-off functions:
$$
j _ {\mathrm {G M C}} (\alpha) = \Phi_ {\chi_ {d} ^ {2} \left(\kappa_ {c}, \sigma_ {c} ^ {2}\right)} \left(\Psi_ {\chi_ {d} ^ {2} \left(0, \sigma_ {c} ^ {2}\right)} ^ {- 1} (\alpha)\right) a n d j _ {\mathrm {G M C}} ^ {- 1} (\alpha) = \Psi_ {\chi_ {d} ^ {2} \left(0, \sigma_ {c} ^ {2}\right)} \left(\Phi_ {\chi_ {d} ^ {2} \left(\kappa_ {c}, \sigma_ {c} ^ {2}\right)} ^ {- 1} (\alpha)\right). \tag {6}
$$
with  $\kappa_{c} = (\Delta_{2a} + \Delta_{2b})^{2} / \sigma_{a}^{2} + \sigma_{b}^{2}$  and  $\sigma_c^2 = \sigma_a^2 +\sigma_b^2 /4$
The GM moreover exhibits specific asymptotic behaviour when the query dimensionality  $d$  and/or the number of non-adaptive compositions increase.
Theorem 3 (Blessing of dimensionality in the RTM). Consider a GM on a function with sensitivity  $\Delta_2$  and noise variance  $\sigma^2\mathbf{I}^d$  such that  $\Delta_2 / \sigma \ll 1$ . Let  $\mu_2 = \Delta_2 / \sigma$ . As  $d$  and/or as the number of non-adaptive compositions  $N$  increase,  $j_{\mathrm{GM}}$  and  $j_{\mathrm{GM}}^{-1}$  tend to the common form:
$$
\Phi_ {\mathcal {N} (0, 1)} \left(\frac {\Psi_ {\mathcal {N} (0 , 1)} ^ {- 1} (\alpha)}{\sqrt {\frac {2 N \mu_ {2} ^ {2}}{d} + 1}} - \frac {\sqrt {2} N \mu_ {2} ^ {2}}{2 d \sqrt {\frac {2 N \mu_ {2} ^ {2}}{d} + 1}}\right) \approx \Phi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha) - N \sqrt {\frac {\mu_ {2}}{2 d}}\right). \tag {7}
$$
As  $d$  increases for fixed  $N$ ,  $j_{c}$  and  $j_{c}^{-1}$  become symmetric and eventually both tend to  $\Phi_{\mathcal{N}(0,1)}\left(\Psi_{\mathcal{N}(0,1)}^{-1}(\alpha)\right) = 1 - \alpha$ , i.e. the Type-I and Type-II errors are equal and  $\mathcal{A}^{\mathrm{SO}}$ 's test is no better than random guessing. Intuitively, this can be understood by considering that the magnitude of  $\theta$  (i.e. the test statistic) is influenced less by its individual components as dimensionality increases [28]. Therefore, at  $d > 1$ , the GM provides progressively stronger  $\lambda$ -DR guarantees than for scalar queries. However, as the adversary can leverage their knowledge of the model to design a database which influences only a single coordinate of the weight/gradient vector, we mostly use  $d = 1$  as a worst-case scenario below. In practice, such a worst-case database may be unrealistic, and the aforementioned result can thus be applied to obtain tighter bounds on MI success in specific scenarios. We note that, in the DPTM, the trade-off function of the GM is always independent of  $d$  and has the form  $f_{\mathrm{GM}}^{\otimes N} = \Phi_{\mathcal{N}(0,1)}\left(\Psi_{\mathcal{N}(0,1)}^{-1}(\alpha) - \mu\right)$ ,  $3\mu = \sqrt{N}\Delta_2 / \sigma$ ,  $\otimes N$  denotes  $N$ -fold composition. The similarity between  $f_{\mathrm{GM}}$  and Equation (7) is a consequence of the central limit theorem-like phenomenon [7]. Despite the similarity between the functional forms, we stress that this does not mean that the asymptotic  $\lambda$ -DR guarantee implies a GDP guarantee, although the converse holds.
<sup>3</sup>We say that this mechanism satisfies  $\mu$ -Gaussian DP (GDP).
Poisson-Subsampled Gaussian Mechanism (SGM) The SGM is relevant in private deep learning [15]. On a  $d$ -dimensional function  $q$  with global  $\ell_2$ -sensitivity  $\Delta_2$ , the SGM with diagonal covariance matrix  $\sigma^2\mathbf{I}^d$  samples a mask  $S \sim \mathrm{Ber}(p)^d$ , where  $S \in \{0,1\}^d$  and  $\mathrm{Ber}(p)$  denotes a Bernoulli distribution with probability  $p$  and outputs  $q(\boldsymbol{X}) + \boldsymbol{S} \odot \boldsymbol{Z}, \boldsymbol{Z} \sim \mathcal{N}(0,\sigma^2\mathbf{I}^d)$ , where  $\odot$  is the Hadamard product. The dominating pairs are  $(\mathcal{N}(0,\sigma^2),(1 - p)\mathcal{N}(0,\sigma^2) + p\mathcal{N}(\Delta_2,\sigma^2))$  and  $((1 - p)\mathcal{N}(\Delta_2,\sigma^2) + p\mathcal{N}(0,\sigma^2),\mathcal{N}(\Delta_2,\sigma^2))$  [22]. Although we have shown in Lemma 3 that the SGM satisfies the MLRP, the test statistic distributions under  $\mathcal{H}_0$  and  $\mathcal{H}_1$  do not have a tractable form. We thus proceed numerically: First, we instantiate  $j_{\mathrm{GM}}$  and  $j_{\mathrm{GM}}^{-1}$  for the standard GM as shown above, then use the following general result to amplify the trade-off functions directly.
Lemma 9. Let  $T(A, B)(\alpha)$  be a trade-off function between two general distributions  $A, B$  representing mechanism outputs. The trade-off functions for the sub-sampled mechanisms are given by  $T(A, (1 - p)A + pB)(\alpha) = pT(A, B)(\alpha) + (1 - p)(1 - \alpha)$  and by its inverse.
We thus obtain the amplified functions  $j_{p}$  and  $j_{p}^{-1}$  from which we compute  $J_{\mathrm{SGM}} = \mathrm{C}(j_p,j_p^{-1})$ . It follows that the SGM satisfies  $J_{\mathrm{SGM}}$ -DR. This subsampling technique can also be applied to other mechanisms [22, 23]. An example for the LM is shown in the Appendix. Composition of mechanisms other than the GM is also handled numerically through direct composition of the test statistics as described in [7], Definition 3.1. ff.
RTM/DPTM trade-off function comparisons Figure 1 shows trade-off functions for the LM, GM and SGM in low privacy (low noise) and high privacy (high noise) settings to compare the error rates in the RTM to the DPTM. The pair of asymmetric DPTM trade-off functions  $j, j^{-1}$ , is combined into a single symmetric function  $J = \mathrm{C}(j, j^{-1})$  (symmetrisation/convexification). We also plot the (symmetrified) trade-off function  $f$  for the same mechanism under the DPTM for reference. All RTM curves  $(j, j^{-1}, J)$  are closer to the off-diagonal than  $f$ , indicating that  $A^{\mathrm{SO}}$  has lower MI attack success than  $A^{\mathrm{DP}}$ . The "blessing of dimensionality" is shown in subfigure (f): at  $d = 30$ , stronger  $\lambda$ -DR is preserved compared to  $d = 1$ . In the DPTM, the GM enjoys no such privacy amplification.
(a) LM, high privacy.
(b) LM, low privacy
(c) GM, high privacy
(d) GM, low privacy
(e) SGM
(f) GM, high-dimensional
Figure 1: Exemplary trade-off functions for various mechanisms: (a) and (b): LM at  $\Delta_1 / b = 0.6$  and  $\Delta_1 / b = 1.5$ , respectively. (c) and (d): GM at  $\Delta_2 / \sigma = 0.6$ ,  $d = 1$  and  $\Delta_2 / \sigma = 1.5$ ,  $d = 1$ , respectively, (e): SGM at  $\Delta_2 / \sigma = 0.2$ ,  $d = 1$ ,  $N = 30$ ,  $p = 0.4$ , (f): GM at  $\Delta_2 / \sigma = 1$  at  $d = 1$  vs.  $d = 30$ .
Asymptotic behaviour and power function of the GM Figure 2a shows the asymptotic behaviour of a GM with  $\Delta_2 / \sigma = 1 / 5, d = 300$  and  $N = 150$ . The computed trade-off functions become symmetric, approach the off-diagonal and match the plot of the analytic form in Equation (7) exactly, even at a modest number of compositions. Figure 2b plots the power  $1 - \beta$  of an MI adversary vs. the  $\Delta_2 / \sigma$ -ratio at a fixed  $\alpha = 10^{-3}$  for the GM and Figure 2c for the SGM assuming the worst case of a one-dimensional learning task and a sampling rate of 0.3. The curve for the DPTM in 2c was created using the formula from [29]. As anticipated, the adversary has lower power throughout in the RTM compared to the DPTM, and the loss of power is amplified through subsampling.
(a) GM: Asymptotic behaviour
(b) GM: Power vs.  $\Delta_2 / \sigma$
(c) SGM: Power vs.  $\Delta_2 / \sigma$
Figure 2: Asymptotic behaviour of the GM and power analyses of the GM/SGM.
MI attacks on DP ML models To test the tightness of our theoretical bounds, we now perform an empirical audit using state-of-the-art offline MI attacks on ML models trained with DP. Recall that, despite the nominal difference in the threat model, the offline MI adversary and the RTM adversary compute the same tests and thus have the same capabilities. Each auditing run produces a pair of empirical trade-off functions shown in green and blue. These are compared to the theoretical bound, shown in orange. If the empirical curves crossed below the theoretical one, this would indicate a lack of tightness in our theoretical bounds. All results are shown as averages with standard deviation across 1024 runs for a single step of a one-dimensional synthetic binary classification task, since we are interested in the worst-case scenario under the RTM. Figure 3a shows the results of the LiRa offline MI attack introduced in [12], where  $\mathcal{A}^{\mathrm{SO}}$  trains shadow models on  $D$  and fits a Gaussian likelihood to their confidence scores. At  $\Delta_2 / \sigma = 1$ , this logit space auditing technique already nearly perfectly matches the theoretical bound. A further improvement is achieved by implementing the very recent auditing technique presented in [11], also at  $\Delta_2 / \sigma = 1$ . Here, a worst-case gradient with magnitude  $\Delta$  ("Dirac canary") is inserted and the hypothesis test takes place in gradient space instead of logit space. As seen in Figure 3b, the theoretical curve is matched exactly by the empirical one.
So far, we have assumed that  $\mathcal{A}^{\mathrm{SO}}$  can leverage their knowledge of the model to design a worst-case database which influences only a single coordinate of the gradient. This is useful for auditing purposes, but does not necessarily mirror real-life training. We therefore also repeat the gradient space attack against a linear neural network with a 50-dimensional latent space trained on the diabetes dataset [30]. Figure 3c shows that, when the adversary cannot reduce the effective dimensionality of the gradient, the hypothesis test loses substantial power compared to  $d = 1$  (dashed line) at  $\Delta_2 / \sigma = 2$  and the trade-off functions become symmetric, exactly verifying Theorem 3.
Additional results for auditing the LM and SGM are shown in the Appendix.
Benefits for ML model training We next demonstrate that the tighter privacy bounds of the RTM translate to tangible improvements in terms of accuracy/privacy trade-offs in deep learning applications. We performed experiments on three classification tasks: CIFAR-10 using ResNet-9, ImageNet using ResNet-18, and Stanford SNLI using a BERT transformer. In each case, we fixed a final privacy guarantee (in terms of  $(\varepsilon, \delta(\varepsilon))$  or equivalently  $(\alpha, \beta(\alpha))$ ) for the DPTM and then trained a set of models up to this privacy guarantee. We then computed the DP-SGD noise scale corresponding to the same hypothesis testing privacy guarantee for the RTM, and re-trained the models for the same number of steps. For all datasets, the enhanced privacy guarantees of the RTM allowed us to obtain models with higher out-of-sample accuracy (e.g. up to  $14\%$  higher on CIFAR-10 at  $\varepsilon \approx 1$ ) for the nominally same membership inference guarantee by lowering the DP-SGD noise scale. These results are illustrated in Figure 4 and experimental details can be found in the Appendix.
(a) Logit space attack
(b) Gradient space attack
(c) High-dimensional latent space
Figure 3: Auditing our theoretical bounds using offline MI attacks.
(b) Stanford SNLI
(c) ImageNet
Figure 4: Deep learning with DP-SGD. Calibrating the noise scale to the RTM privacy guarantee results in substantially improved Top-1 validation set accuracy compared to calibrating to the DPTM guarantee. (a) CIFAR-10:  $0.81 \pm 0.01$  vs.  $0.67 \pm 0.01$  at  $(1, 10^{-5})$ -DP, (b) SNLI:  $0.80 \pm 0.005$  vs.  $0.78 \pm 0.005$  at  $(1, 1.8 \cdot 10^{-6})$ -DP, (c) ImageNet:  $0.48$  vs.  $0.46$  at  $(10, 10^{-6})$ -DP. Error bars denote standard deviation across 5 runs.
Improved bounds on data reconstruction attacks As discussed above, successfully defending against MI attacks implies that all weaker attacks such as data reconstruction will also be unsuccessful. In the Appendix, we demonstrate that, in the RTM, data reconstruction adversaries also suffer a diminished success rate compared to the DPTM, as measured in terms of Reconstruction Robustness [31, 32], which can be bounded directly through its relationship to hypothesis testing [33].
In this work, we consider a threat model relaxation of high practical relevance, where the adversary does not have access to the candidate record in question when performing an MI attack. Our results provide a complete characterisation of the adversary's optimal error rates under the restrictions of the RTM, including at a fixed low Type-I error rate which is particularly meaningful for privacy-sensitive applications such as medical or financial data [12]. Moreover, they allow for a fair and direct comparison between the privacy properties of noise mechanisms under different threat models. Our results can thus guide individuals who train ML systems on sensitive data in the selection of the appropriate noise magnitude to better balance model accuracy vs. privacy protection.
We acknowledge the following limitations. We focused on additive noise mechanisms and the global model of DP in this work. An extension of our results to local DP, mechanisms, mechanisms with discrete outputs and private selection mechanisms is a natural next step. Moreover, our analysis considers the case of non-adaptive composition, which applies to some, but not all, relevant ML tasks. An investigation of adaptive composition scenarios (considering potential correlations between mechanism outputs) would be of interest to expand the scope of our guarantees. Last but not least, we regard the analysis of adversaries who are even more limited in their background knowledge (e.g. no knowledge of the sensitivity, noise magnitude or noise type) as a promising avenue for future work.
This work was supported by a Helmholtz Junior Research Group grant to GK. This work has been funded by the German Federal Ministry of Education and Research and the Bavarian State Ministry for Science and the Arts through the Munich Centre for Machine Learning (MCML). The authors of this work take full responsibility for its content. This research was supported by the German Ministry of Education and Research (BMBF) under Grant Number 01ZZ2316C (PrivateAIM). This research was supported by the Konrad Zuse School of Excellence in Reliable AI (RelAI).
7.1 Additional results
Subsampling and auditing the Laplace Mechanism As mentioned in the section on the SGM, numerical subsampling can also be applied to mechanisms other than the GM. Figure 5a shows the trade-off function curves for the LM without subsampling in orange and the subsampled curve for  $\Delta_1 / b = 1, p = 0.3$  in blue. Similar to the GM, the MI error rates in the RTM (and thus the privacy guarantees) are amplified with sub-sampling.
Figure 5b complements the results on empirical privacy auditing for the LM from the main manuscript. The gradient space auditing technique [11] is again applied to a one-dimensional learning task as described in the main manuscript, however the LM is used instead of the GM. Once more, the empirical privacy audit (green and blue curves) exactly matches the theoretical bounds (shown in orange). As in the main manuscript, curves are averages and standard deviations of 1024 repetitions.
(a) Subsampled LM (SLM)
Figure 5: Subsampled Laplace Mechanism and auditing results.
(b) LM: Empirical auditing