Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Model

## Abstract

Abstract Machine learning models can be trained with formal privacy guarantees via differentially private optimizers such as DP-SGD. In this work, we focus on a threat model where the adversary has access only to the final model, with no visibility into intermediate updates. In the literature, this “hidden state” threat model exhibits a significant gap between the lower bound from empirical privacy auditing and the theoretical upper bound provided by privacy accounting. To challenge this gap, we propose to audit this threat model with adversaries that craft a gradient sequence designed to maximize the privacy loss of the final model without relying on intermediate updates. Our experiments show that this approach consistently outperforms previous attempts at auditing the hidden state model. Furthermore, our results advance the understanding of achievable privacy guarantees within this threat model. Specifically, when the crafted gradient is inserted at every optimization step, we show that concealing the intermediate model updates in DP-SGD does not amplify privacy. The situation is more complex when the crafted gradient is not inserted at every step: our auditing lower bound matches the privacy upper bound only for an adversarially-chosen loss landscape and a sufficiently large batch size. This suggests that existing privacy upper bounds can be improved in certain regimes.

## 1 Introduction

Machine learning models trained with non-private optimizers such as Stochastic Gradient Descent (SGD) have been shown to leak information about the training data (Shokri et al., ; Yeom et al., ; Balle et al., ; Haim et al., ). To address this issue, Differential Privacy (DP) (Dwork et al., ) has been widely accepted as the standard approach to quantify and mitigate privacy leakage, with DP-SGD (Abadi et al., ) as the defacto algorithm to train machine learning models with DP guarantees.
DP-SGD follows the same steps as standard SGD but clips the gradients’ norm to a threshold before perturbing them with carefully calibrated Gaussian noise, providing differential privacy guarantees for each gradient step.

As the practical importance of differential privacy grew, the need to track the *privacy loss* efficiently across the entire training process (*privacy accounting*) became critical: indeed, optimal utility is obtained by adding the minimum amount of noise required to achieve the desired privacy guarantee. Existing privacy accounting techniques rely on privacy composition (Kairouz et al., ; Abadi et al., ; Gopi et al., ; Doroshenko et al., ) to derive the overall privacy guarantees of a training run of DP-SGD from the guarantees of each gradient step. Privacy amplification techniques (Kasiviswanathan et al., ; Feldman et al., ; Erlingsson et al., ; Cyffers and Bellet, ; Altschuler and Talwar, ) can further decrease the overall privacy loss by exploiting the non-disclosure of certain intermediate computations. For instance, privacy amplification by subsampling relies on the secrecy of the randomness used to select the mini-batches.

Despite recent improvements in privacy accounting, training over-parameterized neural networks from scratch with differential privacy typically results in either weak privacy guarantees or significant utility loss (Tramèr and Boneh, ). While a possible explanation could be that the privacy accounting of DP-SGD based on composition is overly conservative, (Nasr et al., ; ) refuted this hypothesis using *privacy auditing*. Leveraging the fact that differential privacy upper bounds the success rate of any adversary that seeks to infer private information from the output of DP-SGD, they showed that it is possible to instantiate adversaries that achieve the maximal success rate allowed by the privacy accounting upper bound.
This negative result suggests that the only hope to improve the privacy-utility trade-offs of DP-SGD is to *relax the underlying threat model*, i.e., to make additional assumptions limiting the adversary’s capabilities.We focus on one capability granted to the adversary in prior work, namely that all intermediate models (i.e., training checkpoints) are released.

In this work, we consider a natural relaxation where intermediate models are concealed and only the final model is released.
This threat model, often referred to as *hidden state*, is particularly relevant in practice, encompassing scenarios such as open-sourcing a trained model by publishing its weights.
From a theoretical perspective, recent work has demonstrated that the hidden state model can yield significantly improved privacy upper bounds for DP-SGD compared to those derived through standard composition (Ye and Shokri, ; Altschuler and Talwar, ).
This improvement can be attributed to the phenomenon of *privacy amplification by iteration* (Feldman et al., ; Balle et al., ): in a nutshell, the privacy of a data point used at earlier stages of the optimization process improves as subsequent steps are performed. However, these results only hold for convex problems, leaving a pivotal question unanswered: Does the privacy of non-convex machine learning problems improve when intermediate models are withheld?
While empirical lower bounds obtained through privacy auditing (Nasr et al., ; ; Steinke et al., ) suggest that it might be the case, it remains unclear whether the gap with upper bounds is because genuine privacy amplification occurs or because the existing adversaries are suboptimal, leading to loose privacy lower bounds.
This raises another crucial question: How can one design worst-case adversaries when the intermediate models are concealed?

Our contributions. Leveraging the observation that all privacy accounting techniques for DP-SGD protect against worst-case *gradients*, we adapt the idea of gradient-crafting adversaries (Nasr et al., ) to the hidden state model. Instead of crafting a data point (*canary*) that gets added to the training set as in prior attempts to audit the hidden state model (Nasr et al., ; Steinke et al., ), our adversaries craft a *sequence of gradients* prior to the execution of the algorithm (i.e., without knowledge of the intermediate models). The crafted gradients are then added to gradients computed on real training points to yield the highest possible privacy loss for the final model. In other words, our adversaries abstract away the canary and directly decide the gradient it would have produced when inserted at a given step of DP-SGD. But how do we pick the gradient sequence leading to the worst-case leakage?

In the scenario where crafted gradients are inserted at every iteration of DP-SGD, we demonstrate that gradient-crafting adversaries which allocate the maximum magnitude permitted by DP-SGD to a single gradient dimension are optimal: they imply privacy lower bounds that match the known upper bounds given by numerical composition (Gopi et al., ). Therefore, *our results reveal that releasing only the final model does not amplify privacy in this regime*.
In the case of small models, we achieve these tight privacy auditing results by carefully selecting the gradient dimension, whereas for over-parameterized models, the dimension selection can be arbitrary.

When the crafted gradient is *not* inserted at every step, we find that the above adversaries still outperform canary-crafting adversaries by a significant margin but cannot reach the privacy upper bounds. We show that part of the gap can be attributed to the inability of known adversaries to influence the gradients on real training data in steps where the crafted gradient is not inserted. To address this gap, we design an adversary that crafts both the gradient and the loss landscape. Our results uncover two distinct regimes: (i) when the batch size is large compared to the noise variance, our adversary proves to be optimal, yielding a privacy lower bound that matches the known upper bound and thus demonstrating the absence of privacy amplification; and (ii) when the batch is small relative to the noise variance, we show strong evidence of privacy amplification for non-convex problems, although the effect is qualitatively weaker than in the convex case.
Our findings advance the understanding of privacy guarantees in the hidden state model, and lay the groundwork for the design of better privacy accounting techniques for this threat model.

## 2 Background

### 2.1 Differential Privacy and DP-SGD

Differential Privacy (DP) has become the de-facto standard in privacy-preserving machine learning thanks to the robustness of its guarantees, its desirable behaviour under post-processing and composition, and its extensive algorithmic framework. We recall the definition below and refer to Dwork and Roth () for more details.
Here and throughout, we denote by $\mathcal{D}$ the space of datasets.

###### Definition 1 (( $\varepsilon,\delta)$ -Differential Privacy) .

A randomized mechanism $\mathcal{M}$ is $(\varepsilon,\delta)$-DP if for all neighboring datasets $D\in\mathcal{D}$ and $D^{\prime}=D\cup\{x\}\in\mathcal{D}$ and for all events $\mathcal{O}$:

$$ $P[\mathcal{M}(D)\in\mathcal{O}]\leq e^{\varepsilon}P[\mathcal{M}(D^{\prime}) \in\mathcal{O}]+\delta.$ (1) $$

In the above definition, $\delta\in(0,1)$ can be thought of as a very small failure probability, while $\varepsilon>0$ is the privacy loss (the smaller, the stronger the privacy guarantees).

The workhorse of private machine learning is the Differentially Privacy Stochastic Gradient Descent (DP-SGD) algorithm (Song et al., ; Bassily et al., ; Abadi et al., ). Let $D$ be the training dataset, $\theta$ the model parameters and consider the standard empirical risk minimization objective $\min_{\theta}\frac{1}{|D|}\sum_{x\in D}\ell(\theta;x)$ where $\ell$ is a loss function differentiable in its first parameter. DP-SGD follows similar steps as standard (non-private) SGD but ensures differential privacy by (i) bounding the contribution of each data point to the gradient using clipping and (ii) adding Gaussian noise to the clipped gradients.

Formally, starting from some initialization $\theta_{0}$, DP-SGD performs $T$ iterative updates of the form:

$$ $\textstyle\theta_{t+1}=\theta_{t}-\frac{\eta}{|B_{t}|}\big{(}\sum_{x\in B_{t}} \text{clip}({\nabla_{\theta_{t}}}\ell(\theta_{t};x),C)+Z_{t}\big{)},$ (2) $$

where $\eta>0$ is the learning rate, $B_{t}\subseteq D$ is a mini-batch of data points, $\text{clip}(g,C)=g\cdot\min(1,C/\|g\|_{2})$ with $C>0$ the clipping threshold, and $Z_{t}\sim\mathcal{N}(0,\sigma^{2}C^{2}\mathbb{I})$.

###### Definition 1 (( ε , δ ) \varepsilon,\delta) italic_ε , italic_δ ) -Differential Privacy) .

### 2.2 Threat Models for DP-SGD

DP protects against an adversary that observes the output of either $\mathcal{M}(D)$ or $\mathcal{M}(D^{\prime})$ and seeks to predict whether the dataset was $D$ or $D^{\prime}=D\cup\{x\}$, i.e., whether $x$ was included in the input dataset (a.k.a. membership inference). In this context, the threat model specifies which information is observable/known by the adversary. For DP-SGD, in addition to the final model $\theta_{T}$, threat models typically consider that the adversary has access to (and potentially controls) the model architecture, the loss $\ell$, the initialization $\theta_{0}$, the dataset (up to the presence of $x$) and differ in which internal states of DP-SGD are observable by the adversary. Below, we recall the two threat models relevant to our work.

Standard threat model. Standard privacy accounting techniques analyze DP-SGD as a composition of (potentially subsampled) Gaussian mechanisms (Abadi et al., ; Gopi et al., ; Doroshenko et al., ). Composition allows the adversary to *observe all intermediate models* $\theta_{1},...,\theta_{T-1}$ (in addition to $\theta_{0}$ and $\theta_{T}$). Previous work has shown that existing privacy accounting techniques are tight in this threat model (Nasr et al., ; ). However, revealing intermediate models is unnecessary in most realistic deployment settings and may hurt the privacy-utility trade-off, motivating the study of the hidden state threat model.

Hidden state threat model. Our work studies the scenario where intermediate models $\theta_{1},...,\theta_{T-1}$ are concealed from the adversary, who observes only the final model $\theta_{T}$. This threat model has attracted much attention recently, with theoretical work proving better privacy upper bounds than in the standard threat model in some regimes (Feldman et al., ; Balle et al., ; Ye and Shokri, ; Altschuler and Talwar, ).
A fundamental phenomenon underlying these results is “privacy amplification by iteration” (Feldman et al., ), which shows that repeatedly applying noisy contractive iterations enhances the privacy guarantees of data used in earlier steps. Unfortunately, applying this general result to DP-SGD is only possible
for convex problems, ruling out deep neural networks. The existence of privacy amplification for non-convex problems in this threat model is an open problem (Altschuler and Talwar, ) that we study in this work through the lens of privacy auditing.

### 2.3 Auditing Differential Privacy

Privacy accounting only provides upper bounds on the $(\varepsilon,\delta)$-DP parameters, and these bounds are not always tight. Leveraging the relation between DP and the performance of membership inference attacks, privacy auditing aims to produce lower bounds on the DP parameters by instantiating concrete adversaries in various threat models (Jagielski et al., ; Nasr et al., ). When these lower bounds match the upper bounds given by privacy accounting, we can conclude that the privacy analysis is tight; when they do not, it is possible to improve the privacy accounting and/or the attacks.
A privacy auditing pipeline can be broken down into two components: an adversary and an auditing scheme. The high-level process is shown in Algorithm 1.

Adversary. Auditing a mechanism $\mathcal{M}$ first requires the design of an adversary $\mathcal{A}$, which seeks to predict the presence or absence of a *canary* point $x^{*}$ from the information available in the considered threat model. Typically, an adversary $\mathcal{A}$ consists of two subroutines RankSample and RejectionRule.
RankSample gives a confidence score that the observed output was generated by sampling from $\mathcal{M}(D)$ rather than from $\mathcal{M}(D\cup\{x^{*}\})$, which can interpreted as the two hypotheses of a binary test.
RejectionRule applies a threshold to the confidence scores generated across multiple random runs of $\mathcal{M}$ to decide when to reject the first hypothesis. It then compares these decisions to the ground truth to produce binary test statistics: True Negatives (TN), True Positives (TP), False Negatives (FN), and False Positives (FP).

Figure: Algorithm 1 Privacy auditing

Auditing scheme. The auditing scheme takes as input the hypothesis testing statistics of an adversary and a privacy parameter $\delta$, and outputs a high-probability lower bound $\hat{\varepsilon}$ on the privacy loss of the mechanism $\mathcal{M}$. It comprises two subroutines: ConfInterval and ConvertToDP.
ConfInterval converts the adversary statistics to high probability lower bounds for the False Negative Rates ${\alpha}$ and False Positive Rates ${\beta}$. ConvertToDP then converts these lower bounds into $\hat{\varepsilon}$ for the specified $\delta$ by leveraging the fact that DP implies an upper bound on any adversary’s performance. Our experiments will rely on the recently proposed auditing scheme based on Gaussian DP (Nasr et al., ), which we describe for completeness in Appendix A.

To obtain the tightest possible $\hat{\varepsilon}$, one should perform auditing using a worst-case canary $x^{*}$ and a worst-case adversary $\mathcal{A}$. This proves to be especially challenging in the hidden state model as the adversary cannot rely on the knowledge of intermediate models.
In this paper, we will obtain tighter lower bounds $\hat{\varepsilon}$ by abstracting away the canary and using adversaries that directly craft gradients.

## 3 Related Work in Differential Privacy Auditing

The goal of differential privacy auditing is to create worst-case adversaries that maximally exploit the underlying threat model, even if the information used by the adversary might not be available in practical scenarios.(^1^11This is in contrast to membership inference attacks seeking feasibility against real systems (Shokri et al., ; Yeom et al., ; Carlini et al., ; Zarifzadeh et al., ).)
A rich line of work has designed adversaries that can tightly and efficiently audit the privacy of learning algorithms when intermediate models are released (Nasr et al., ; Maddock et al., ; Nasr et al., ; Steinke et al., ).
The first adversarial construction (the malicious dataset attack in Nasr et al. ()) to reach the theoretical upper bound given by privacy accounting for DP-SGD used a restrictive threat model in which the adversary controls the entire learning process, including the dataset, the mini-batch ordering, all hyperparameters and intermediate models. In follow-up work by Nasr et al. (), a nearly matching lower bound was obtained for a gradient-crafting adversary that does not need to control the dataset, the minibatches or the hyperparameters but *still requires access to intermediate models*.

Prior attempts at auditing the hidden state model used adversaries employing a loss-based attack that targets a canary obtained by flipping the label of a genuine data point (Nasr et al., ; ; Steinke et al., ; Annamalai and Cristofaro, ). The idea is to generate an outlier from an in-distribution data point so that the loss of the model on this canary is high when it is not part of the training set but drops significantly when used during training. Auditing the hidden state model with these adversaries yields privacy lower bounds that exhibit a significant gap compared to privacy accounting upper bounds for the standard threat model (Nasr et al., ; ; Steinke et al., ; Annamalai and Cristofaro, ). This gap has two possible explanations: (i) these adversaries are suboptimal and stronger adversaries exist in the hidden state model; and/or (ii) the upper bounds are not tight. Understanding the reasons for this gap, so as to gain better knowledge of the properties of DP-SGD in the hidden state model, is the main motivation for our work. We demonstrate that gradient-crafting adversaries can provide tighter auditing results, thereby proving the validity of hypothesis (i). We show that in certain scenarios, our auditing results match the privacy upper bounds, indicating that releasing intermediate models does not increase the privacy loss. However, we also identify regimes where a gap remains, thus providing compelling evidence in support of hypothesis (ii). Specifically, our findings suggest the presence of a privacy amplification by iteration phenomenon in the non-convex setting, albeit weaker compared to what is theoretically established for the convex case (Feldman et al., ; Balle et al., ), but less restrictive than the results of Asoodeh and Diaz (). The latter require projections onto a convex set of bounded diameter or a strong enough decay term on the parameters, which are unrealistic assumptions in practical scenarios involving non-convex and over-parameterized models like the ones considered in our work.

In Table 1 (Appendix B), we provide a summary of prior auditing results for DP-SGD, highlighting in particular whether the considered adversaries are compatible with the hidden state threat model.

## 4 Gradient-Crafting Adversaries for the Hidden State Model

In all threat models, DP-SGD enjoys a simplified interpretation as a sequence of $T$ sum queries with bounded terms, where the $t$-th query corresponds to summing the clipped gradients over the mini-batch $B_{t}$ in Equation 2. Therefore, privacy accounting techniques for DP-SGD do not have the construct of a fixed set of data points that generate gradients but instead account for any possible gradients with bounded norm $C$.
This highlights a key limitation of adversaries used so far in the hidden state model: due to the non-convexity of the objective function, any sequence of gradients for the canary $x^{*}$ is likely to be possible, but how to craft a worst-case $x^{*}$ is unclear (and in fact out of scope for privacy auditing). Instead, we allow the adversary to directly *craft any gradient sequence*, considering that there could be a data point that would generate that sequence.

Figure: Figure 1: The gradient norm of the canary varies along the optimization path and for different architectures. We report the mean and $\pm 2$ standard deviations across 30 random runs.
Refer to caption: x1.png

Threat model. As per the hidden state, only the final model $\theta_{T}$ is revealed while the intermediate models $\theta_{1},\dots,\theta_{T-1}$ are kept hidden. We assume that the adversary knows the model architecture, the loss function $\ell$, the initialization $\theta_{0}$, the dataset $D$ and the mini-batches $B_{0},\dots,B_{T-1}$.(^2^22When inserted, the crafted gradient is added to the genuine gradients of the mini-batch.)
Considering the mini-batches to be known, as done for instance in Feldman et al. (), allows to isolate the impact of concealing the intermediate models from other factors (such as privacy amplification by subsampling).
We consider the hyperparameters of DP-SGD ($\eta$, $C$, $\sigma$) to be fixed and identical for all optimization steps to avoid uninteresting edge cases (e.g., setting the learning rate $\eta$ to 0 0 in all optimization steps that do not use the crafted gradients). This requirement can be lifted by switching to Noisy-SGD as in Feldman et al. (); Altschuler and Talwar (), where hyperparameters like the learning rate or the batch size are part of the privacy definition.

Gradient-crafting adversaries. Following the above threat model, we allow the adversary to craft an arbitrary gradient sequence as long as it is not a function of the intermediate models. In other words, the adversary must decide on a sequence of gradients before training starts, in an offline way, to audit a *complete, end-to-end training run of DP-SGD*. We stress that this is in stark contrast to Nasr et al. (), who use gradient-crafting adversaries to audit each step of DP-SGD and then leverage composition to derive a privacy lower bound for the overall training run.
Their approach thus explicitly relies on the adversary having access to all intermediate models, whereas ours does not make this assumption nor use this information in any way.

Our construction helps to understand the hidden state threat model and its properties by decoupling the privacy leakage induced by a worst-case sequence of gradients from the craftability of a canary that could produce that sequence. Allowing the adversary to craft a gradient sequence directly circumvents two issues in prior attempts to audit the hidden state model (Nasr et al., ; Steinke et al., ):

- •
Saturating the gradient norm: The canary point crafted by prior adversaries is not guaranteed to saturate the gradient clipping threshold throughout training. The adversary’s performance becomes architecture-dependent: for example, a small convolutional neural network has a small canary norm at the start of the training compared to a ResNet, as observed in Figure 1. Thus, for a tight audit, one must tune the clipping threshold according to the canary gradient norm, a quantity the adversary cannot access in our threat model.
- •
Hypothesis testing: Prior adversaries need to test the presence of a sequence of gradients they cannot access, so they use the model’s loss as a proxy confidence score (RankSample in Algorithm 1): a lower loss implies a higher confidence that a sample was used during training. By allowing the adversary to pick the sequence of gradients, we can align the choice of confidence score to the way adversarial information is encoded in the gradients (as will be evident in the adversaries we propose below), thereby achieving superior testing performance.

Concrete adversary instantiations.
We propose two concrete instantiations of our gradient-crafting adversaries, which we will use to perform privacy auditing on real datasets in the next section
(see Appendix C for more precise descriptions):

- 1.
Random Biased Dimension ($\mathcal{A}_{GC}$-R): The adversary picks a random dimension and crafts gradients with magnitude $C$ in this dimension. To test whether crafted gradients were inserted (RankSample in Algorithm 1), the adversary uses the difference between $\theta_{T}$ and $\theta_{0}$ in that dimension as the confidence score (RankSample in Algorithm 1).
- 2.
Simulated Biased Dimension ($\mathcal{A}_{GC}$-S): The adversary simulates the training algorithm and picks the least updated dimension. Then, it crafts gradients with magnitude $C$ in that dimension. To test the presence of crafted gradients, the adversary uses the same confidence score as $\mathcal{A}_{GC}$-R.

These two adversaries are designed to be as simple as possible. Other gradient constructions can be used, such as crafting a random gradient following the method proposed by Andrew et al. () (see Figure 8 of the appendix for a comparison with the adversaries we use). However, our choice of adversaries can be further justified by recent findings on privacy backdoors, where the model architecture and parameters are chosen adversarially to leak certain input points. Specifically, Feng and Tramèr () propose a specific construction of architecture and initialization in which a well-chosen input point generates gradients that are nearly concentrated in a single dimension throughout training. This demonstrates that in some cases, our adversaries $\mathcal{A}_{GC}$-R and $\mathcal{A}_{GC}$-S can be instantiated by inserting a canary point.

## 5 Privacy Auditing Results on Real Datasets

### 5.1 Experimental Setup

Training details. We perform auditing on two datasets: we choose CIFAR10 (Krizhevsky, ) as a representative dataset for the state-of-the-art in differentially private training (Tramèr and Boneh, ; De et al., ), and Housing (Pace and Barry, ) to underline the hardness of auditing smaller models in the hidden state. We use predefined hyperparameters for each dataset: on CIFAR10, the batch size is 128, and the learning rate is 0.01, while on Housing, the batch size is 400, and the learning rate is 0.1. Training is done with DP-SGD with no momentum. We use three models: a fully connected neural network (FCNN) for the Housing dataset (Pace and Barry, ), a convolutional neural network (CovNet) (LeCun et al., ) and a residual network (ResNet) (He et al., ) for CIFAR10. A detailed description of the models can be found in Appendix D.

Baseline adversary. As baseline, we adopt an adversary used in prior related research (Nasr et al., ; Steinke et al., ). This adversary selects a point from the training dataset and flips its label to generate an outlier which serves as the canary $x^{*}$. The loss of the model on this canary is used as confidence score to test whether it was inserted or not. We refer to this baseline as the "loss-based adversary", denoted by $\mathcal{A}_{L}$.

Privacy accounting & auditing. We compute privacy upper and lower bounds for the crafted gradient (for $\mathcal{A}_{GC}$) or canary ($\mathcal{A}_{L}$) as follows. The theoretical privacy upper bound is obtained with the numerical accountant proposed by Gopi et al. ().
We audit three scenarios for which the accountant gives equivalent privacy guarantees, inserting the crafted gradient or canary at different periodicity $k\in\{1,5,25\}$ and adjusting the time horizon $T$ accordingly. More precisely, when $k=1$, the model is trained for 250 optimization steps, and the crafted gradient or canary is inserted at every step; when $k=5$, the model is trained for 1250 steps, and insertion occurs every $5$ steps, and similarly for $k=25$. We report both the theoretical and empirical epsilons at a fixed $\delta=1e^{-5}$, but we note that we can generate the complete privacy curve $(\varepsilon,\delta(\varepsilon))$, which we present in Figure 11 of the appendix for completeness.
For auditing, we rely on the recently proposed scheme based on Gaussian DP (described in Appendix A for completeness) as it allows accurate auditing with a small number of auditing runs (Nasr et al., ).
Details on training and auditing parameters can be found in Appendix D.

###### Remark 1 (On the impact of known initialization) .

As explained in our threat model of Section 4, we consider the initialization $\theta_{0}$ known to the adversary. This is a standard assumption made explicitly or implicitly by virtually all privacy accounting techniques, including those tailored to the hidden state (Feldman et al., ). Nevertheless, we show in Figure 13 of the appendix that commonly used random initializations like Kaiming (He et al., ) or Xavier (Glorot and Bengio, ) do not significantly affect our auditing results, as they only add a bit of variance at initialization.

###### Remark 2 (On pre-trained models) .

While we consider here that models are trained from scratch on private data, our techniques and results also apply to the scenario where a model pre-trained on public data defines a new (potentially smaller) model to be fine-tuned on private data. We illustrate this by fine-tuning a pre-trained AlexNet (Krizhevsky et al., ) model by training only the last fully connected layer of the classifier on CIFAR10, see Figure 13 of the appendix.

Figure: (a) Auditing ConvNet
Refer to caption: x2.png

###### Remark 1 (On the impact of known initialization) .

###### Remark 2 (On pre-trained models) .

### 5.2 Auditing results for periodicity k = 1 𝑘 1 k=1 italic_k = 1

Over-parameterized models. The results in Figure 2 show that our adversary $\mathcal{A}_{GC}$-R achieves tight auditing results in the hidden state model when the crafted gradient is inserted at every step, a result that had been achieved until now only when the adversary could pick a worst-case dataset $D=\{\emptyset\}$ (Nasr et al., ) and set the learning rate to 0 0 in steps where the canary is not inserted, or when the adversary had access to the intermediate models (Nasr et al., ).
Note that the baseline loss-based adversary $\mathcal{A}_{L}$ is indeed not tight and even very loose in some regimes.

The fact that a tight audit can be achieved by our simplest adversary $\mathcal{A}_{GC}$-R (random biased dimension) may seem surprising. We provide a high-level explanation of this phenomenon. As we are auditing over-parameterized models, which are highly redundant, we can expect a genuine gradient to assign on average a magnitude of $\mathcal{O}(\frac{C|\text{minibatch}|}{p})$ to each dimension, where $p$ is the number of parameters of the model. As $p$ is typically orders of magnitude larger than the commonly used batch sizes, genuine gradients in a mini-batch contribute a negligible magnitude to any dimension compared to the magnitude of $C$ inserted at a single dimension by $\mathcal{A}_{GC}$-R (or $\mathcal{A}_{GC}$-S). Therefore, genuine gradients do not interfere with the contribution of the adversary, regardless of the selected dimension.
We see below that this no longer holds when auditing low-dimensional models.

Low-dimensional models. Auditing smaller models is more challenging because the ratio between the mini-batch size and the number of parameters is much larger. To evaluate our adversaries in this regime, we switch to the Housing dataset with the FCNN model, which has only 68 parameters.
We report the performance of our two adversaries over five independent runs in Figure 2c. We observe that randomly selecting a dimension ($\mathcal{A}_{GC}$-R) no longer achieves tight results, although it still outperforms the baseline loss-based adversary. Remarkably, our second adversary, which simulates the training algorithm to select an appropriate dimension ($\mathcal{A}_{GC}$-S), recovers nearly tight results with small variance between runs.

To conclude, the tightness of our adversaries implies a novel negative result.

###### Implication 1 .

If a data point is used at every optimization step of DP-SGD, hiding intermediate models does not amplify its privacy guarantees.

Figure: (a) Canary insertion periodicity $k=5$
Refer to caption: x5.png

###### Implication 1 .

### 5.3 Auditing Results at Periodicity k > 1 𝑘 1 k>1 italic_k > 1

We now study how our adversaries perform when the crafted gradient is inserted at a higher periodicity $k\in\{5,25\}$.
We observe in Figure 3 that (i) we still outperform the baseline loss-based adversary $\mathcal{A}_{L}$ by a large margin, but (ii) we no longer match the privacy upper bound, and our adversary becomes weaker as we increase $k$. Intuitively, the latter is due to the accumulation of the noise added on genuine gradients during the $k-1$ iterations between each crafted gradient insertion.
However, privacy accounting (i.e., the upper bound) does not take advantage of this accumulated noise: as *the insertion of a crafted gradient at a given step could bias subsequent genuine gradients* towards a particular direction, the best one can do is to resort to the post-processing property of DP, which ensures that subsequent genuine gradients do not weaken the privacy guarantees.
In the next section, we investigate whether it is possible to match the upper bound given by privacy accounting in this setting, which amounts to designing an adversary capable of crafting gradients that maximally influence subsequent genuine gradients.

###### Remark 3 .

Using auditing via Gaussian DP (Nasr et al., ) for $k>1$ implies approximating the trade-off function of the mechanism with a Gaussian one (see Appendix A for relevant definitions). This approximation can be justified by the Central Limit Theorem (Dong et al., ), and has been used before when auditing the hidden state (Nasr et al., )
We show in Appendix E (Figure 7a) that the approximation error is indeed negligible in our case.

###### Remark 3 .

## 6 Towards a Worst-Case Adversary for the Hidden State

In this section, we investigate whether reducing (and potentially closing) the gap with the theoretical upper bound observed in Section 5.3 is possible. For simplicity, we consider the case where a crafted gradient is inserted *only* in the first optimization step, and then $T-1$ subsequent steps are performed without inserting crafted gradients. This corresponds to the scenario studied by privacy amplification by iteration (Feldman et al., ), but we do not restrict ourselves to convex losses.

We introduce a new class of adversaries $\mathcal{A}_{S}$ that crafts the gradient *and the loss landscape itself*, thereby controlling the distribution of all $T$ updates. Therefore,
$\mathcal{A}_{S}$ can pick a (non-convex) loss landscape such that the crafted gradient inserted at step $T=1$ maximally biases subsequent genuine gradients, thereby yielding the highest possible privacy loss for the final model. Note the underlying principle is the same as in Section 4: instead of requiring the adversary to craft a dataset, model architecture and loss function, we allow the adversary to select the loss landscape directly, considering that there could be a dataset that would generate this landscape. As long as the loss landscape is selected before training starts, this is covered by the hidden state threat model we consider.

We formalize the above using the following pair of one-dimensional stochastic processes:

$$ $\displaystyle\theta_{t+1}=\theta_{t}-\frac{1}{B}\left(g(\theta_{t})+Z_{t+1} \right),\quad\quad\overline{\theta}_{t+1}=\overline{\theta}_{t}-\frac{1}{B} \left(g(\overline{\theta}_{t})+Z_{t+1}\right),$ (3) $$

where the first step of the process is either $\theta_{1}=Z_{1}$ (a process that did not use the crafted gradient) or $\overline{\theta}_{1}=\nabla^{*}+Z_{1}$ (a process that used the crafted gradient $\nabla^{*}$), with $Z_{i}\sim\mathcal{N}(0,C^{2}\sigma^{2})$,
and $g:\mathbb{R}\rightarrow[-BC,BC]$ is a function that abstracts away the sum of gradients of the loss on a batch of size $B$ in the DP-SGD update (Equation 2). The goal of the adversary is to choose the function $g$ and the crafted gradient $\nabla^{*}$, without knowing the intermediate updates, so as to make the distribution of $\theta_{T}$ and $\overline{\theta}_{T}$ as “distinguishable” as possible.

###### Example 1 (Constant $g$ ) .

Consider the simple case where $g$ outputs a constant $c$, independent of the input.
This implies that the Gaussian noise accumulates at every step, and the privacy loss $\varepsilon$ for the last iterate converges to 0 0 as $T\rightarrow\infty$ at a rate of $O(1/\sqrt{T})$.

As illustrated by Example 1, it is easy to design a function $g$ that amplifies privacy over time. However, the converse objective, i.e., designing a function that provides no or minimal privacy amplification for the final step $T$, appears much more challenging.

A worst-case proposal. We propose a concrete adversary $\mathcal{A}^{h^{*}}_{S}$ which selects $\nabla^{*}=C$ and the function $g_{\phi^{*}}(X)=BC\text{ if }\phi^{*}(X)=1\text{ and }g_{\phi^{*}}(X)=-BC$ otherwise, where $\phi^{*}:\mathbb{R}\rightarrow\{0,1\}$ is the linear threshold function that achieves the minimal False Positive Error Rate $\alpha$ + False Negative Error Rate $\beta$ for distinguishing between $\theta_{1}$ and $\overline{\theta}_{1}$ (i.e., testing if the model after $1$ step was generated using the crafted gradient $\nabla^{*}$). More precisely, $\phi^{*}(X)=1\text{ if }X>h^{*}\text{ and }\phi^{*}(X)=0$ otherwise, with $h^{*}=\frac{|\nabla^{*}|}{2}=\frac{C}{2}$ (see Appendix F for a numerical validation).
The resulting non-convex loss landscape adheres to the intuition that the crafted gradient maximally biases subsequent steps (see Appendix F).

Figure: (a) Evolution of the auditing performance across time
Refer to caption: x7.png

Auditing with $\mathcal{A}^{h^{*}}_{S}$. Figure 4a shows the auditing performance of our adversary $\mathcal{A}_{S}^{h^{*}}$ for $T\in\{1,\dots,25\}$ steps, batch sizes $B\in\{1,2,4,8,16\}$ and Gaussian noise variances $\sigma\in\{1,8\}$ (more values are given in Figure 14 of the appendix).(^3^33As in Section 5, we need to approximate the trade-off function of our mechanism with a Gaussian one (see Remark 3). In practice, the approximation error is again negligible (see Figure 7b in Appendix E).) In Figure 4b, we present the ratio between the privacy auditing lower bound $\hat{\varepsilon}_{t=25}$ at the last step and the one obtained after the first step to measure the extent of the privacy amplification phenomenon for various batch sizes $B$ and values of $\sigma$. When this ratio is equal to $1$, there is no amplification and the audit is tight, while values smaller than 1 indicate the existence of a privacy amplification effect (the smaller the value, the stronger the amplification).
The general trend we observe is that (i) the amplification rate increases with $\sigma$, as higher variance helps to forget initial conditions in the pair of stochastic processes (3), and (ii) the amplification rate decreases with $B$, since a larger batch implies that subsequent updates can be larger in magnitude, enabling better propagation of the initial conditions across iterations despite the noise.

The first important takeaway is that *our adversary $\mathcal{A}^{h^{*}}_{S}$ achieves a tight audit when the batch size $B$ is large enough relative to the noise variance $\sigma$*. In this regime, this adversary is thus optimal and there is no privacy amplification.

###### Implication 2 .

For a sufficiently large batch size relative to the noise variance, the privacy accounting of DP-SGD is tight in the hidden state model: hiding intermediate updates does not amplify privacy.

The second key observation is that *privacy amplification seems to occur when the batch size is small enough relative to the noise variance*. As seen from Figure 4a, the privacy loss of $\mathcal{A}^{h^{*}}_{S}$ converges to a constant: this is because the privacy loss distributions become sufficiently far away and stop mixing over time. This constant is smaller than the upper bound provided by privacy accounting, but remains positive, indicating that this potential amplification must be qualitatively weaker than in the convex case.

###### Implication 3 .

In the non-convex regime, for a sufficiently small batch size relative to the noise variance, hiding intermediate updates may amplify the privacy guarantees of DP-SGD. However, the privacy loss of a sample does not go to 0 0 as subsequent steps are performed, in contrast to the convex case where the privacy loss decreases in $O(1/\sqrt{T})$ (Feldman et al., ).

###### Remark 4 (Comparison to parallel work) .

Implication 2 was independently established in a recent concurrent work by Annamalai (). Their worst-case construction differs from ours, and in particular implicitly assumes that the batch size is large relative to the noise variance. As a consequence, their results overlook the fact that privacy amplification can occur under small batch sizes, which is a practically important regime where stronger privacy guarantees may be achievable.

###### Example 1 (Constant g 𝑔 g italic_g ) .

###### Implication 2 .

###### Implication 3 .

###### Remark 4 (Comparison to parallel work) .

## 7 Discussion and Future Work

Our work allows tighter auditing of DP-SGD in the hidden state model, and our results yield several important implications that advance the understanding of this threat model. For instance, Implication 3 means that the property of converging privacy loss of DP-SGD as $T\rightarrow+\infty$ recently established by Altschuler and Talwar () in the convex case cannot hold for non-convex models in the general case without additional constraints. Beyond this negative result, our work suggests that a (weaker) form of privacy amplification does occur for non-convex problems in the hidden state model when the batch size is small relative to the noise variance.

Beyond differential privacy, our results have consequences for machine unlearning (Bourtoule et al., ), which aims to remove a specific data point from a trained model as if the data had never been used for training. A recent approach to unlearning relies on noisy training and privacy amplification by iteration (Chien et al., ). Implication 3 shows that this approach cannot provide *complete* data point deletion when considering non-convex models like neural networks.

An intriguing open question arises from the gap between our empirical results on real datasets (Section 5) and the adversary crafting the loss landscape (Section 6) when the canary is not inserted at every step. While recent work on privacy backdoors shows that certain architectures can be manipulated to make a specific data point produce the desired gradient sequence throughout training (Feng and Tramèr, ), it seems unlikely that this point could also maximally bias subsequent gradients of genuine training points in the same way as our worst-case adversary $\mathcal{A}^{h^{*}}_{S}$. Investigating the extent to which this is feasible in commonly used architectures would enhance our understanding of privacy leakage in deep learning, and could ultimately lead to better privacy accounting for the hidden state model.

## Acknowledgements

We thank Pierre Stock and Alexandre Sablayrolles for numerous helpful discussions and feedback in the early stages of this project and Santiago Zanella-Béguelin for observing the need to fix the hyperparameters for DP-SGD in our threat model. We want to thank members of the CleverHans Lab for their feedback.

The work of Tudor Cebere and Aurélien Bellet is supported by grant ANR-20-CE23-0015 (Project PRIDE) and the ANR 22-PECY-0002 IPOP (Interdisciplinary Project on Privacy) project of the Cybersecurity PEPR. This work was performed using HPC resources from GENCI–IDRIS (Grant 2023-AD011014018R1).

The work of Nicolas Papernot and Tudor Cebere (while visiting the University of Toronto and Vector Institute) is supported by Amazon, Apple, CIFAR through the Canada CIFAR AI Chair, DARPA through the GARD project,
Intel, Meta, NSERC through the Discovery Grant, the Ontario Early Researcher Award, and the Sloan
Foundation.

## Appendix A Details on Auditing via Gaussian DP

For completeness, in this section we present the privacy auditing approach proposed by Nasr et al. [], which we use in our experiments. We start by introducing some necessary concepts on $f$-DP and Gaussian DP in Section A.1. Then, in Section A.2, we present an overview of how auditing is performed and how all the elements of the general auditing pipeline (Algorithm 1) are implemented.

### A.1 f 𝑓 f italic_f -Differential Privacy and Gaussian Differential Privacy

$f$-DP and Gaussian DP [Dong et al., ] are based on a characterization of DP as binary hypothesis testing. We recall the main concepts below.

###### Definition 2 (Error rates) .

Let $P$ and $Q$ be two arbitrary distributions and $O$ a sample drawn from either $P$ or $Q$. Let a binary hypothesis test be defined by the following two hypotheses: $H_{0}:$ “the output $O$ is drawn from $P$” or “$H_{1}$: the output $O$ is drawn from $Q$”. Consider a rejection rule $\phi:\mathcal{R}^{d}\rightarrow[0,1]$ that outputs the probability that we should reject $H_{0}$. We define the Type I (or false positive) error rate of this rejection rule $\phi$ as $\alpha_{\phi}\overset{\Delta}{=}\underset{P}{\mathbb{E}}[\phi]$ and the Type II (or false negative) error rate as $\beta_{\phi}\overset{\Delta}{=}1-\underset{Q}{\mathbb{E}}[\phi].$

###### Definition 3 (Trade-off functions) .

Let $P$ and $Q$ be two arbitrary distributions. We define the trade-off function between $P$ and $Q$ as:

$$ $T(P,Q)(\alpha)=\underset{\phi}{\inf}\{\beta_{\phi}:\alpha_{\phi}\leq\alpha\}.$ (4) $$

We can now introduce $f$-DP.

###### Definition 4 ( $f$ -Differential Privacy) .

Let $f$ be a trade-off function. Then a mechanism $M$ is $f$-Differentially Private ($f$-DP) if for all neighbouring datasets $D$ and $D^{\prime}$:

$$ $T(M(D),M(D^{\prime}))\geq f.$ (5) $$

Trade-off functions describe the lowest Type II error rate achievable by any adversary at any Type I error rate . We say that a mechanism $M_{1}$ is strictly less private than $M_{2}$ if $T(M_{1}(D),M_{1}(D^{\prime}))(\alpha)\leq T(M_{2}(D),M_{2}(D^{\prime}))(\alpha)$ for all $\alpha\in[0,1]$. Dong et al. [] show $(\varepsilon,\delta)$-DP can be formulated as $f$-DP as follows:

$$ $f_{\varepsilon,\delta}(\alpha)=\max\{0,1-\delta e^{\varepsilon},e^{- \varepsilon}(1-\delta)\}$ (6) $$

Gaussian Differential Privacy (GDP) is a specialized formulation of $f$-DP where $f$ is the trade-off function of two Gaussian distributions.

###### Definition 5 (Gaussian Differential Privacy) .

Let $\Phi$ be the cumulative distribution function (CDF) of $\mathcal{N}(0,1)$ and $\Phi^{-1}$ its associated quantile function. A mechanism $M$ is $\mu$-GDP if it is $G_{\mu}$-DP, where

$$ $G_{\mu}(\alpha)\overset{\Delta}{=}T(M(D),M(D^{\prime}))(\alpha)=\Phi(\Phi^{-1} (1-\alpha)-\mu).$ (7) $$

The following result is crucial for auditing: it shows that the error rates of an adversary give a lower bound on the GDP guarantees.

###### Lemma 1 (Relating error rates to GDP) .

Assume that an adversary has error rates $\alpha_{M}$, $\beta_{M}$ in the binary test defined by $P=M(D)$ and $Q=M(D^{\prime})$ where $M$ is a mechanism and $D$ and $D^{\prime}$ are two neighboring datasets. Then, if $M$ satisfies $\mu$-GDP, then

$$ $\mu\geq\Phi^{-1}(1-\alpha)-\Phi^{-1}(\beta).$ (8) $$

Finally, we can convert $\mu$-GDP to $(\varepsilon,\delta)$-DP.

###### Corollary 1 (From $\mu$ -GDP to $(\varepsilon,\delta)$ -Differential Privacy.) .

If a mechanism $M$ is $\mu$-GDP then it satisfies $(\varepsilon,\delta)$-DP, where:

$$ $\delta(\varepsilon)=\Phi(-\frac{\varepsilon}{\mu}+\frac{\mu}{2})-e^{ \varepsilon}\Phi(-\frac{\varepsilon}{\mu}-\frac{\mu}{2}).$ (9) $$

###### Definition 2 (Error rates) .

###### Definition 3 (Trade-off functions) .

###### Definition 4 ( f 𝑓 f italic_f -Differential Privacy) .

###### Definition 5 (Gaussian Differential Privacy) .

###### Lemma 1 (Relating error rates to GDP) .

###### Corollary 1 (From μ 𝜇 \mu italic_μ -GDP to ( ε , δ ) 𝜀 𝛿 (\varepsilon,\delta) ( italic_ε , italic_δ ) -Differential Privacy.) .

### A.2 Auditing via GDP

Auditing a mechanism $M$ via GDP follows the general approach outlined in Algorithm 1, and amounts to instantiating its different primitives:

- 1.
RankSample: We first generate $R$ outputs of $M$, half of them sampled from $M(D)$, the rest from $M(D^{\prime})$, where $D^{\prime}=D\cup\{x^{*}\}$. For each output $i\in\{1,\dots,R\}$, a score $S_{i}$ is computed to the adversary’s confidence that either $D$ or $D^{\prime}$ were used as input for $M$. The precise computation of this confidence score depends on the considered adversary and is abstracted by the RankSample method in Algorithm 1. We refer to Sections 4-5 for details about the RankSample method used by the adversaries we consider.
- 2.
RejectionRule: Each $S_{i}$ is then augmented with its associated ground truth label $b_{i}$, reflecting if a particular sample has been generated from $D$ or $D^{\prime}$. The adversary selects a classifier (RejectionRule in Algorithm 1) that receives the set $S$ as input and needs to classify it against the ground truth label $b$. We stress that DP holds against *any choice* of such a classifier. Commonly used ones are linear threshold classifiers [Nasr et al., ]. Once a threshold classifier has been selected, we evaluate the error rates of the classifier using $S$ and $b$ as the ground truth labels, evaluating the False Negative (FN), False Positive (FP), True Negative (TN), and True Positive (TP) of the classifier.
- 3.
ConfInterval: Using these statistics, we employ the Clopper Pearson [Clopper and Pearson, ] confidence intervals over binomial distributions to get a high-probability lower bound on the Type I error rate ($\alpha)$ and Type II error rate ($\beta$) for the adversary’s performance. We note that other techniques exist to compute such confidence intervals [Zanella-Béguelin et al., , Lu et al., ]; however, the benefits we observed practically were negligible in our case.
- 4.
ConvertToDP: Finally, given access to the lower bounds on the error rates of the adversary, we can compute the lower bound on the privacy loss of a mechanism $M$ in GDP by using Lemma 1, and translate the result to $(\varepsilon,\delta)$-DP using Corollary 1.

We stress that this technique offers a lower bound on the privacy loss, while techniques like privacy accounting [Abadi et al., , Gopi et al., , Doroshenko et al., ] or composition [Dwork et al., , Kairouz et al., , Dong et al., ] offer upper bounds on the privacy loss. We call a mechanism *tight* if a lower bound offered by auditing match the upper bound

## Appendix B Summary of Prior Work on Privacy Auditing of DP-SGD

We provide in Table 1 a list of adversaries used in prior work on privacy auditing of DP-SGD along with their key properties: whether they are compatible with the hidden state, whether they achieved a tight audit, and the type of canary they used.

**Table 1: Summary of adversaries used in prior privacy auditing of DP-SGD. We report whether the adversary is compatible with the hidden state (HS), if the adversary achieves tight audit in the threat model it operates (TA) and the type of canary (CT) used by the adversary (gradient canaries or sample space canaries).**
| Paper | Adversary | HS | TA | CT |
| --- | --- | --- | --- | --- |
| Jagielski et al. [] | Poisoned Backdoor | ✓ | ✗ | Sample |
| Nasr et al. [] | API Access | ✓ | ✗ | Sample |
| Static Adversary | ✓ | ✗ | Sample |  |
| Intermediate Poison Attack | ✓ | ✗ | Sample |  |
| Adaptive Poisoning Attack | ✗ | ✗ | Sample |  |
| Gradient Attack | ✗ | ✗ | Gradient |  |
| Malicious Datasets | ✗ | ✓ | Gradient |  |
| Zanella-Béguelin et al. [] | Experiment 1 | ✓ | ✗ | Sample |
| Experiment 2 | ✓ | ✗ | Sample |  |
| Maddock et al. [] | Algorithm 1 | ✗ | ✗ | Gradient |
| Nasr et al. [] | Algorithm 1 | ✓ | ✗ | Sample |
| Algorithm 2 | ✗ | ✓ | Gradient |  |
| Andrew et al. [] | Algorithm 2 | ✓ | ✗ | Sample or Gradient |
| Algorithm 3 | ✗ | ✗ | Gradient |  |
| Steinke et al. [] | audit-type=whitebox | ✗ | ✗ | Sample or Gradient |
| audit-type=blackbox | ✓ | ✗ | Sample |  |
| Ours | $\mathcal{A}_{GC}$-R, $k=1$ | ✓ | ✓ | Gradient |
| $\mathcal{A}_{GC}$-R, $k>1$ | ✓ | ✗ | Gradient |  |

## Appendix C Details about our Adversaries 𝒜 G ⁢ C subscript 𝒜 𝐺 𝐶 \mathcal{A}_{GC} caligraphic_A start_POSTSUBSCRIPT italic_G italic_C end_POSTSUBSCRIPT

The algorithmic description of our adversaries $\mathcal{A}_{GC}$-R and $\mathcal{A}_{GC}$-S are given in Algorithms 2-3.

We discuss different strategies to select the biased dimension for our adversary $\mathcal{A}_{GC}$-S. The general idea is to explore how the different dimensions are updated by simulating the training process, as all the required knowledge is available to the adversary. We have considered two types of simulations: (i) Noisy simulation, in which we use the same noise variance as the simulated process, and (ii) Noiseless simulation, in which we run the training algorithm without noise or clipping. Note that for the noiseless simulation, the training algorithm is deterministic, as the initialization and the batches are fixed and known to the adversary, while in the noisy simulation, the stochasticity of DP-SGD is concealed for the adversary. We use four simulations of the training process. We then proceed to choose how to rank the most suitable dimension to bias, for which we have explored two options: (i) Per Step (PS): selecting the dimension that has the lowest gradient norm accumulated over all the training runs or (ii) Final Model (FM): selecting the dimension that is the closest to initialization at the end of the training run. We experiment with these design choices, resulting in 4 dimension selection strategies. The results in Figure 6 show that the Noiseless-PS strategy performs best.

In Figure 6, we show that $\mathcal{A}_{GC}$-S using the best strategy is equivalent with $\mathcal{A}_{GC}$-R on our studied over-parameterized models.

Figure: Algorithm 2 Gradient Generation for $\mathcal{A}_{GC}$-R (Random Biased Dimension)

Figure: Algorithm 3 Noisy gradient generation for $\mathcal{A}_{GC}$-S (Simulated Biased Dimension)

Figure: Figure 5: Auditing results of $\mathcal{A}_{L}$, $\mathcal{A}_{GC}$-R and $\mathcal{A}_{GC}$-S on the Housing dataset. We consider 4 variants of $\mathcal{A}_{GC}$-S, depending on whether the noisy or noiseless simulation is used and whether we rank dimensions based on accumulating per-step updates (PS) or on the final model norm difference (FM).
Refer to caption: x9.png

## Appendix D Experimental Details on Training & Auditing

In our experimental section, we audit three neural network architectures, a ConvNet and a ResNet on the CIFAR10 dataset and a Fully-Connected Neural Network on the Housing dataset. These models were implemented using PyTorch [Paszke et al., ], and the DP-SGD optimizer was Opacus [Yousefpour et al., ]. The hyperparameters for training, privacy guarantees, and privacy auditing parameters for each audited machine learning model are meticulously outlined in Table 2. The ConvNet and ResNet have been audited when trained for 250, 1250, and 6250 optimization steps, totalling approximately 3500 GPU hours.

For each experiment, we audit $R=5000$ machine learning models using GDP auditing (see Appendix A). For the Clopper Pearson confidence intervals, we use a confidence of $95\%$ (consistent with prior work [Jagielski et al., , Nasr et al., ]) to get a lower bound on the Type I error rate ($\alpha)$ and Type II error rate ($\beta$) for the adversary’s performance. RejectionRule is computed by selecting the best linear threshold classifier on $S$. While, in practice, the adversary should pick the classifier on a set of held-out scores $S$, we select the classifier directly on $S$ to save the computational resources required to compute the held-out set $S$. We stress that it is not an issue, as differential privacy guarantees hold against any choice of classifier.

**Table 2: Hyperparameters used per model**
| Hyperparameter | Fully-Connected NN | ConvNet | ResNet18 |  |
| --- | --- | --- | --- | --- |
| Learning rate ($\eta$) | $10^{-2}$ | $10^{-2}$ | $10^{-2}$ |  |
| Batch size | 400 | 128 | 128 |  |
| Trainable params | 68 | 62006 | 11173962 |  |
| Loss Function | Binary Cross Entropy | Cross Entropy | Cross Entropy |  |
| Clipping norm $C$ | 1.0 | { 1.0, 2.0, 4.0 } | {1.0, 2.0, 4.0 } |  |
| Noise variance $\sigma$ | 4 | 4 | 4 |  |
| Failure probability $\delta$ | $10^{-5}$ | $10^{-5}$ | $10^{-5}$ |  |
| Auditing runs | 5000 | 5000 | 5000 |  |
| Confidence Interval | 0.95 | 0.95 | 0.95 |  |

## Appendix E Approximation Errors for GDP Auditing

Figure: (a) The approximation error of approximating the tradeoff function of the observations via GDP for $\mathcal{A}_{GC}$-R when auditing a ConvNet on CIFAR10 when $k=5$ at step 1250.
Refer to caption: x11.png

As explained in Remark 3, using auditing via Gaussian DP [Nasr et al., ] (see Appendix A) implies approximating the trade-off function of our mechanism with a Gaussian one [Dong et al., ].
In this section, we present some samples of the privacy trade-off curves that we observe when auditing both $\mathcal{A}_{GC}$ in Figure 7a and $\mathcal{A}^{h^{*}}_{S}$ in Figure 7b. For $\mathcal{A}_{GC}$, we show the case where $T=1250$ when auditing a ConvNet at canary gradient insertion periodicity $k=5$ on CIFAR10, while for $\mathcal{A}^{h^{*}}_{S}$ we present the approximation when $T=25$. We see that the approximation errors are negligible, and the approximation technique is representative.

This good behaviour is due to the Central Limit Theorem for $f$-DP composition [Dong et al., ], which, in a nutshell, states that while individual mechanisms are not well approximated by a Gaussian Mechanism, their composition has a decaying error in the number of compositions performed when approximated via a Gaussian Mechanism.

## Appendix F Details on our adversary 𝒜 h ∗ subscript superscript 𝒜 ℎ \mathcal{A}^{*}_{h} caligraphic_A start_POSTSUPERSCRIPT ∗ end_POSTSUPERSCRIPT start_POSTSUBSCRIPT italic_h end_POSTSUBSCRIPT

Visualization of the loss landscape.
Figure 11 shows the loss landscape corresponding to our adversary $\mathcal{A}^{*}_{h}$ defined in Section 6. One can see how the crafted gradient can bias subsequent steps. Note that the discontinuity is not essential and can be removed by appropriate scaling.

Numerical validation of optimality of $h^{*}$. In this section, we numerically validate that the choice of threshold $h^{*}$ in $\mathcal{A}^{h^{*}}_{S}$ is indeed optimal for $T=2$ by comparing it with all possible threshold functions.
To search for these functions, we discretize the Type I error rate $\alpha\in[0,1]$ into $\{\alpha_{1}\dots\alpha_{d}\}$, and each $\alpha_{i}$ we look for the rejection rule $\phi_{i}$ that achieves the lowest Type II error rate $\beta_{i}$. Given that, in this case, our function $g$ distinguishes between two Gaussian distributions via Neyman-Pearson [Neyman et al., ], it is well known that the optimal classifier with a fixed type I error rate is achieved by its associated threshold classifier $h_{i}=\Phi(1-\alpha_{i})$, where $\Phi$ is the CDF of $\mathcal{N}(0,\sigma^{2})$. With $\{h_{1}\dots h_{d}\}$ at hand, we can define multiple $g_{\phi_{i}}$, and implicitly multiple adversaries $\mathcal{A}^{h_{i}}_{S}$ that use $g_{\phi_{i}}$ as a candidate for $g$ in Eq. 3 which we use to audit, resulting in $\{\hat{\varepsilon}_{1}\dots\hat{\varepsilon}_{d}\}$, out of which we pick the maximum. A detailed description is provided in Algorithm 5.

The results shown in Figure 7 confirm that $\mathcal{A}^{h^{*}}_{S}$ employs the optimal threshold classifier to distinguish the input distributions.

Figure: Algorithm 4
Refer to caption: x13.png

## Appendix G Additional Experimental Results

In this section, we present additional experimental results mentioned in various parts of the main text.

Figure: Figure 8: Comparison of privacy auditing performance for $\mathcal{A}_{GC}$-R (ours), $\mathcal{A}_{L}$ and $\mathcal{A}_{CotS}$ [Andrew et al., ] when auditing a FCNN model on the Housing dataset.
Refer to caption: x14.png

Alternative gradient-crafting strategy. The adversaries that we propose in Section 4 and use in Section 5 construct a gradient biased in a single dimension chosen by the adversary. We investigate here an alternative approach inspired by the auditing method of Andrew et al. []. In their approach, the crafted gradient is randomly sampled from the unit sphere and then scaled by the sensitivity $C$. For the confidence score (RankSample in Algorithm 1), the adversary computes the cosine similarity between the canary gradient and the change in model parameters $\theta_{T}-\theta_{0}$, which is compatible with the hidden state model.
For completeness, Algorithms 6-7 formally show how the generation of the gradient and the computation of the confidence score is performed.
We denote this adversary by $\mathcal{A}_{CotS}$.

We observe experimentally that $\mathcal{A}_{GC}$ outperform $\mathcal{A}_{CotS}$, and that both approaches outperform the loss based adversary $\mathcal{A}_{L}$, see the results in Figure 8.

Figure: Algorithm 6 RankSample for $\mathcal{A}_{\text{CotS}}$

Experiments on auditing with unknown initialization.
As common in differential privacy, we consider throughout the paper that the initialization $\theta_{0}$. We discuss here the impact of considering the initialization to be unknown.
First, we note that standard initialization techniques like Glorot [Glorot and Bengio, ] or Xavier [He et al., ], which are commonly used to stabilize the training process by preventing the vanishing or exploding gradients phenomena, sample random parameters from a uniform or normal distribution with a small variance. Therefore, such initializations only add a bit of variance. Figure 13 shows the results of using $\mathcal{A}_{GC}$-R to audit a CNN model on CIFAR-10 with unknown initialization from Xavier. We observe no quantitative difference in the performance of $\mathcal{A}_{GC}$-R compared to the case where the initialization is fixed and known.

Experiments on auditing pre-trained models. In Figure 13 we present the results of $\mathcal{A}_{GC}$-R to audit pretrained models. We audit an AlexNet model [Krizhevsky et al., ], a model pre-trained on ImageNet (treated as public data) and fine-tuned on CIFAR-10 (treated as private data), compared to a CNN trained from scratch directly on CIFAR-10 with no frozen parameters. We see that $\mathcal{A}_{GC}$-R performs tight auditing for $k=1$ in this scenario as well.

Privacy profiles. While in all of our experiments, we report both the theoretical epsilon provided by the privacy accounting and the empirical epsilon at a fixed $\delta=1e^{-5}$, we can generate the entire privacy profile curve $\varepsilon\mapsto\delta(\varepsilon)$ and thus produce auditing results at an arbitrary $\delta$. Indeed, our auditing technique computes a lower bound on the $\mu$-GDP parameter (see Section A for more details). Using the lower bound on $\mu$ in Corollary 1, we can compute any $\delta(\varepsilon)$. To compute $\varepsilon$ at a fixed $\delta$, we use a line-search algorithm like the bisection method, as the function $\delta(\varepsilon)$ is monotonically increasing in $\varepsilon$. In Figure 11, we present three privacy profile curves $\varepsilon\mapsto\delta(\varepsilon)$ corresponding to the performance of $\mathcal{A}_{GC}$-R when auditing a CNN with $k\in\{1,5,25\}$. This confirms that for the case $k=1$, we are indeed tight in all privacy regimes, while for $k>1$ $\mathcal{A}_{GC}$-R is not tight for all $\varepsilon\geq 0$, as discussed in Section 5.

Detailed results for $\mathcal{A}^{h^{*}}_{S}$. In Figure 14 we present all the training curves that generated the heatmap in Figure 4b by computing the empirical privacy loss generated by $\mathcal{A}^{h^{*}}_{S}$ for all $\sigma\in\{1,\dots,8\}$ and $B\in\{1,2,4,8,16\}$. As a reference, we display the theoretical epsilon provided by privacy accounting at each $\sigma$. In all plots we observe that the regime $B=16$ yields tight auditing, and this is also the case for larger batch sizes (not shown to avoid clutter).

Figure: Figure 10: Visualization of the loss landscape corresponding to $A^{h^{*}}_{S}$ for $C=1$.
Refer to caption: x15.png

Figure: Figure 12: Auditing results for $\mathcal{A}_{GC}$ on CNN trained on CIFAR10 when the initialisation of the neural network is unknown to the adversary, compared to the case of known initialisation.
Refer to caption: x17.png

Figure: Figure 14: Auditing performance of $\mathcal{A}^{h^{*}}_{S}$ over time $T=25$ for various batch sizes $B\in\{1,2,4,8,16\}$ and noise levels $\sigma\in\{1\cdots 8\}$, used to generate Figure 4b.
Refer to caption: x19.png

## Peer Reviews

confidence: 2
contribution: 3
initial_rating: 5
presentation: 3
questions: * There might not exist a worst-case datapoint that can saturate the gradient clipping threshold at every iteration. Would it be possible to discuss what it means to breach the privacy of a datapoint that does not exist and may in fact be unrealizable?
* It seems like an adversary who could control the sequence of gradients would also be able to infer from that something about the intermediate models. Is this OK for the hidden state threat model?
* Is there any intuition behind privacy amplification only seems to occur for smaller batch sizes?
* Does Implication 1 say anything beyond what Implication 2 says? If the batch size is as large as possible (the entire dataset), then every datapoint will be included in every optimization step of DP-SGD?
soundness: 3
strengths: * The problem setting and results are really interesting and open up new avenues for future work. Identifying different regimes where the gap (between the new auditing lower bounds and the theoretical upper bounds) vanishes and where the gap remains is a nice contribution.
* The paper flows nicely and is and enjoyable to read.
* Simplicity is a virtue and I think the design of the gradient-crafting adversaries for privacy auditing is clever yet also intuitive.
summary: In the "hidden state" threat model for DP-SGD, an adversary does not have access to intermediate updates and can see only the final model. This paper proposes to audit the hidden state threat model for DP-SGD by introducing adversaries who select a gradient sequence offline (i.e., ahead of when training starts) in order to maximize the privacy loss of the final model even without access to the intermediate models.
weaknesses: * The paper uncovers some interesting empirical results but doesn’t offer up much explanation for them. E.g. for regimes where there is a gap, we don’t really get an explanation as to why this gap exists. I do feel that this work falls short of its goal to “enhance our understanding of privacy leakage” (line 537) by reporting the results without interpretation. I think that including more discussions like the “high-level explanation” starting at line 373 would help round out the paper and provide more concrete directions for future work.
* Considering this is one of its main contributions, I found that the description of the adversaries and the privacy auditing scheme in the main paper is vague and not presented with full details.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 4
questions: My question is about the $f$-DP part. In Remark 3, the authors claim that the approximation error from using the central limit theorem (CLT) can be ignored. However, the CLT may underestimate privacy when mixture distributions arise due to shuffling or sub-sampling [A]. For this reason, Nasr et al. (2023) adopt numerical methods, such as FFT, to calculate the privacy profile. For the hidden state model, an 
$f$-DP guarantee is provided by [B] without relying on the CLT.

Given these considerations, the authors' assertion that the CLT approximation error can be ignored may not be universally applicable, especially in scenarios involving mixture distributions in (shuffled) DP-SGD. A simple explanation in the main part might be beneficial to the readers.

[A] Unified Enhancement of Privacy Bounds for Mixture Mechanisms via f-Differential Privacy. Wang et al., NeurIPS, 2023.

[B] Shifted Interpolation for Differential Privacy. Bok et al., ICML, 2024.
soundness: 4
strengths: This paper applies GC models to audit various regimes, including both small and over-parameterized models. Additionally, different deep learning architectures (CNN, ResNet, FCNN) are evaluated in the experiments. Overall, the empirical results are convincing.
summary: This paper proposes a tighter privacy auditing bound by extending gradient-crafting (GC) models to the hidden state regime, where only the last iteration is released. By combining the GC technique with advanced privacy auditing methods, such as privacy auditing using 
$f$-DP, the authors achieve a refined privacy auditing bound for the hidden state model.
weaknesses: The main weakness of this paper is that it does not introduce a new privacy auditing method; rather, it extends the existing gradient-crafting method to the hidden state regime. The primary technical contribution appears to be constructing a sequence of gradients without requiring knowledge of the intermediate gradients at each iteration.

---

confidence: 4
contribution: 3
initial_rating: 8
presentation: 3
questions: - It seems that the privacy accounting upper bounds remain the same for various k (Figures 2 and 3). Now, is this because you have actually accounted only the 250 iterations the canary was inserted? Or do you display the auditing results only up to $T=250$ iteration?
- I don't think there is any reason to use PRV as there is no subsampling. You could just use analytical Gaussian and obtain tight privacy bounds (instead of the upper and lower bounds you get from PRV).
- Caption of Fig4: "Figure 4a gives the ...", I guess you mean 4b?
soundness: 3
strengths: Auditing DP algorithms is an interesting and important line of work. Previous work, both in auditing and privacy accounting, have suggested that hiding the intermediate iterations of DP-SGD can be beneficial for the privacy guarantees. In this work, authors improve the privacy auditing of non-convex loss functions, by carefully selecting gradient canaries that get inserted for to the DP-SGD gradient sum. The proposed method significantly improves the existing methods, suggesting that the previous methods have not optimally used the threat model allowed by the hidden state setting.

Authors also study the amplification by iteration effect, by proposing a novel technique that introduces a crafted gradient only for the first step of DP-SGD. The empirical results for this study suggest that there might not be any amplification by iteration for certain non-convex losses, and that only the noise introduced by subsampling the data makes distinguishing the crafted gradient more difficult.
summary: This paper studies the auditing of last iterate privacy guarantees of DP-SGD for non-convex loss functions. Authors propose an auditing method where a canary gradient is introduced to the DP-SGD steps. Two methods for crafting this "worst-case" canary gradients is proposed: 1. a random direction in the parameter space is selected and a gradient of norm C is inserted to the mnibatch of gradients and 2. the adversary simulates the DP-SGD run and picks as the canary gradient the least updated dimension, again with norm C. Authors demonstrate empirically that if the canary is inserted at every iteration, the auditing bounds correspond to the DP accounting upper bounds, suggesting that the hidden state model does not necessarily provide additional privacy protection. When the canary is inserted less frequently, the adversaries power decreases. Finally, authors propose an auditing setting where the adversary inserts the crafted gradient only in the first iteration and controls the loss landscape. In this setting the auditing bounds match closely the DP bounds when minibatch used in DP-SGD is sufficiently large.
weaknesses: In general the paper is very well written and the arguments are easy to follow. However, I get a bit confused on the discussion regarding accounting in the section 5.1. Since the threat model studied does not benefit from the subsampling amplification, I don't see any reason of using PRV accounting. When there is no subsampling, the privacy analysis could be performed tightly with Gaussian DP or Analytical Gaussian accounting (Balle et al 2018).

The proposed method assumes that the crafted gradient is possible under the particular loss function. While I do believe that this might be the case for highly over-parametrized models, it would be great if authors could discuss this further in the paper. Would it be possible to somehow trace back the worst-case sample from the worst-case crafted gradient? Similarly the assumption that the adversary can craft the loss landscape to make the crafted gradient the most distinguishable could warrant further discussion.

---

confidence: 3
contribution: 2
initial_rating: 5
presentation: 3
questions: The simulated biased dimension method appears quite similar to gradient crafting at each step in terms of implementation [Nasr et al., 2023]. What are the specific differences between these two methods?
soundness: 2
strengths: 1. The paper is clearly written and easy to follow.
2. The proposed method is simple yet empirically effective.
3. The empirical results provide insights into the settings (batch size and $\epsilon$) where DP-SGD may exhibit privacy amplification by iteration for non-convex problems.
summary: This paper proposes a privacy auditing method for DP-SGD under a hidden state threat model. Assuming an arbitrary non-convex loss function, the authors abstract away the specific design of neighboring datasets and directly construct gradient sequences for auditing. Their main difference from previous work, which audits DP-SGD with gradient-crafting adversaries at each step, is that they ensures that the gradient sequence is predetermined and not influenced by intermediate outputs, i.e., the sequence is decided offline before training.

The authors considers two types of gradient-crafting:

1. **Random-biased dimension:** randomly selects a dimension and crafts the gradient with the largest possible magnitude in that dimension.
    
2. **Simulated-biased dimension:** simulates the training algorithm, identifies the least updated dimension, and crafts gradients with the largest possible magnitude there.
    

Experimentally, they demonstrate that when a canary gradient is inserted at each step, their empirical privacy estimates are tight for common model architectures, including ConvNet, ResNet, and FCNN. The auditing also remains tight when the canary is periodically added with a periodicity of 5. However, at a periodicity of 25, the auditing for some settings may not be tight, suggesting possible privacy amplification by iteration. To investigate this, the authors conducted experiments, showing that their auditing is tight when the batch size and $\epsilon$ are large. This supports prior findings which shows DP-SGD on non-convex problems does not exhibit privacy amplification by iteration. Thus, relaxing the threat model to a hidden state model does not offer better privacy guarantees for certain non-convex problems.
weaknesses: Firstly, the conclusion of this work is not new: the main takeaway—that for some non-convex problems, the hidden state threat model does not lead to better privacy analysis for DP-SGD (i.e., no privacy amplification by iteration)—is the same as the conclusion in previous work [Annamalai, 2024]. However, the methodologies differ: [Annamalai, 2024] constructs a worst-case non-convex loss function for DP-SGD where information from all previous iterates is encoded in the final iterates, while this work directly constructs gradient sequences.

My other concern with this work is that its methodology is also quite limited, though it may be slightly more general than previous approaches (e.g. [Annamalai, 2024]). This work abstracts away the specifics of the loss function and model architecture, focusing directly on gradient crafting. While this simplification aids in designing canary gradients, it resembles a worst-case analysis across all non-convex problems. From a specific gradient sequence, it is not possible to deduce the corresponding loss function and model architecture on which DP-SGD is performed. As a result, the findings do not clarify which specific architectures and loss functions (i.e., types of non-convex problems) may or may not exhibit privacy amplification by iteration.

Meta-review: The paper examines the extent to which not revealing the intermediate states provides additional privacy for training ML models. Prior work has shown "privacy amplification via iteration" when intermediate states are not revealed, for convex objectives. The paper shows that when an adversarially crafted gradient is inserted at every step there is not additional privacy in only releasing the final model. If a crafted gradient is not inserted at every step and the batch size is small then privacy amplification seems possible. The paper suggests several questions for future work, and I encourage the authors to try and distill down some of these questions and potential explanations in the final version of the paper (as they started to do during the author response).

Decision: Accept (Poster)