Optimizing Canaries for Privacy Auditing with Metagradient Descent
Authors: Matteo Boglioni
Terrance Liu
Andrew Ilyas
Steven Wu
Venue: ICLR 2026 Poster (2026)
Keywords: differential privacy
auditing
metagradient optimization
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: In this work we study black-box privacy auditing, where the goal is to lower bound the privacy parameter of a differentially private learning algorithm using only the algorithm’s outputs (i.e., final trained model). For DP-SGD (the most successful method for training differentially private deep learning models), the canonical auditing approach uses membership inference—an auditor comes with a small set of special “canary” examples, inserts a random subset of them into the training set, and then tries to discern which of their canaries were included in the training set (typically via a membership inference attack). The auditor’s success rate then provides a lower bound on the privacy parameters of the learning algorithm. Our main contribution is a method for optimizing the auditor’s canary set to improve privacy auditing, leveraging recent work on metagradient optimization (Engstrom et al., 2025). Our empirical evaluation demonstrates that in certain instances, using such optimized canaries can improve empirical lower bounds for differentially private image classification models by several times when compared to canaries proposed in prior work. Furthermore, we demonstrate that our method is DP-SGD agnostic and efficient: canaries optimized for non-private SGD with a small model architecture remain effective when auditing larger models trained with DP-SGD.

Published as a conference paper at ICLR 2026
OPTIMIZING CANARIES FOR PRIVACY AUDITING WITH METAGRADIENT DESCENT
Matteo Boglioni"
Terrance Liu" Carnegie Mellon University terrancl cmmu edu
Andrew Ilyas Carnegie Mellon University Stanford Statistics
ETH Zurich
mbogl i onn @ethz.ch
werreewwsstaffoddd edu
Zhiwei Steven Wu Carnegie Mellon University z.s rsstvvnwwue www.:wuweeueeeeemmoooeeeeee.eem edu
ABSTRACT
In this work we study black-box privacy auditing, where the goal is to lower bound the privacy parameter of a differentially private learning algorithm using only the algorithm's 's outputs (i.e.. final trained model). For DP-SGD (the most successful method for training differentially private deep learning models), the canonical au- diting approach uses membership inference an auditor comes with a small set of special "canary" examples, inserts random subset of them into the training set, and then tries to discern which of their canaries were included in the training set (lypically via membership inference attack). The auditor's success rate then provides a lower bound on the privacy parameters of the learning algorithm. Our main contribution is method for optimizing the auditor's canary set to improve privacy auditing, leveraging recent work on metagradient optimization (Engstrom et al., 2025). Our empirical evaluation demonstrates that in certain instances, us- ing such optimized canaries can improve empirical lower bounds for differentially private image classification models by several times when compared to canaries proposed in prior work. Furthermore, we demonstrate that our method is DP-SGD agnostic and efficient: canaries optimized for non-prie non-private SGD with a small model architecture remain effective when auditing larger models trained with DP-SGD.
INTRODUCTION
Differential privacy (DP) (Dwork et al., 2006) offers a rigorous mathematical framework for safe- guarding individual data in machine learning. Within this framework, differentially private stochas- tic gradient descent (DP-SGD) (Abadi et al., 2016) has emerged as the standard for training differen- tially private deep learning models. Although DP-SGD provides theoretical upper bounds on privacy loss based on its hyperparameters, these guarantees are likely conservative, which means they tend to overestimate the privacy leakage in practice (Nasr et al., 2023). In many cases, however, they may not reflect the true privacy leakage that occurs during training. To address this gap, researchers have developed empirical techniques known privacy audits, which aim to establish lower bounds on privacy loss. In addition to quantifying real-world Ieakage, privacy auditing can also help detect bugs unintended behaviors in the implementation of private algorithms (Tramer et al., 2022).
Providing a lower bound on the privacy leakage of an algorithm typically requires the auditor to guess some private information (membership inference) using set of examples (also referred to as canaries). For example, in one-run auditing procedures (Steinke et al., 2023; Mahloujifar et al., 2024) (which discuss further in Section 2.1.2), random subset of these canaries is inserted into the training dataset, and once the model is trained, the auditor guesses which of these samples belong that subset. While recent work has made significant progress in tightening these bounds through privacy auditing, the strongest results typically assume unrealistic levels of access or control of the
"Equal contribution

---

Published as a conference paper at ICLR 2026
private training process (broadly speaking, such settings fall under the term white-box auditing (Nasr et al., 2023)). In contrast, this work focuses on a more practical and restrictive black-box setting. Here, the auditor can only insert subset of carefully crafted examples (called the canaries) into the training set and observe the model's output at the last iterate (without access to intermediate model states gradient computations). In other words, the goal of black-box DP auditing reduces to performing membership inference on the canaries based on the final model output.
In this work, we study how optimize canary samples for the purpose of black-box auditing in differentially private stochastic gradient descent (DP-SGD). Leveraging metagradient descent (En- gstrom et al., 2025), we introduce an approach for crafting canaries specifically tailored for insertion into the training set during DP auditing. Through empirical evaluation on single-run auditing pro- tocols for DP image classification models, we find that our method consistently yields canaries that surpass standard baselines by more than a factor of two in certain regimes. Notably, our algorithm is computationally efficient: although involves running (non-private) SGD on a lightweight ResNet- 9 architecture, the resulting canaries demonstrate strong performance even when deployed in larger models, such as Wide ResNets, trained under DP-SGD, Furthermore, this improvement persists whether DP-SGD is used for end-to-end training or private finetuning pretrained networks.
1.1 RELATED WORK
Early works in DP auditing (Ding et al., 2018; Bichsel et al., 2018) introduce methods that detect violations of formal DP guarantees, relying on a large number of runs to identify deviations from expected behavior. These techniques, however, are not directly applicable to the domain of differ- entially private machine learning, as they were developed for auditing simpler DP mechanisms. To tackle this issue, Jagielski et al. (2020) and Nasr et al. (2021) introduce new approaches based on membership inference attacks (MIA) to empirically determine privacy lower bounds for more com- plex algorithms like DP-SGD Membership inference consists of accurately determining whether specific sample was part of the model's 's training dataset. the guesser (i.e. attacker) can reliably make accurate guesses, it suggests that the model retains information about individual samples ob- served during training, thereby compromising individuals' privacy. Hence, MIA can be used as a practical DP auditing tool in which lower bounds on how much privacy leakage has occurred can be directly estimated from the success rate of the attacker.
One-run auditing. The first auditing methods for DP-SGD relied on many runs of the algorithm, making auditing very expensive and often impractical. To remedy this issue, Steinke et al. (2023); Mahloujifar et al. (2024) reduce the computational cost of auditing by proposing procedures that require only one training run. Kazmi et al. (2024) and Liu et al. (2025) further study how in- corporate stronger MIA methods to empirically improve auditing in this one-run setting. Similarly, Keinan al. (2025) study the theoretical maximum efficacy of one-run auditing.
Last-iterate auditing. Our work builds on the aforementioned one-run auditing methods and fo- cuses specifically on the last-iterate auditing regime, which restricts the auditor's access to just the final model weights after the last iteration of DP-SGD. Related work to this regime from Muthu Selva Annamalai (2024) investigates whether the analysis on the last iteration can be as tight as analysis the sequence of all iterates. Mcanwhile, Nasr et al. (2025) propose a heuristic that pre- dicts empirical lower bounds derived from auditing the last iterate. Other works instead focus on partial relaxations of the problem: Cebere et al. (2025) assume that the auditor can inject crafted- gradients, and Muthu Selva Annamalai & De Cristofaro (2024) audit models that are initialized to worst-case parameters.
Canaries Optimization. Rather than proposing new auditing procedures, our work studies how to make existing ones more effective by focusing on optimizing canary sets for privacy auditing. Similarly, Jagielski et al. (2020) develop method that uses singular value decomposition to obtain canaries more robust to gradient clipping. Nasr et al. (2023) evaluate various procedures to optimize canaries for their white-box auditing experiments. To better audit differentially private federated learning, Maddock et al. (2023) craft an adversarial sample that is added to a client's 's dataset used to send model updates. Finally, in the context of auditing LLMs, Panda et al. (2025) proposes using tokens sequences not present in the training dataset as canaries, while Meeus et al. (2025) create canaries with a low-perplexity, in-distribution prefixes and high-perplexity suffixes.
2

---

Published as a conference paper at ICLR 2026
Metagradient computation. Our work also makes of recent advancements in computing metagradients, gradients of machine learning models' outputs with respect to their hyperparameters other quantities decided on prior to training. Prior work metagradient computation falls under two categories: implicit differentiation (Bengio, 2000; Koh & Liang, 2017; Rajeswaran et al., 2019; Finn al., 2017; Lorraine al., 2020; Chen & Hsieh, 2020; Bae et al., 2022) aims to approximate the metagradient. On one hand, approximating metagradients allows for scalability to large-scale metagradient computation; on the other, this approach loosens correctness guarantees and imposes restrictions what learning algorithms can be used. In contrast, explicir differentiation directly computes metagradients using automatic differentiation. However, these works (Maclaurin al., 2015; Micaelli & Storkey, 2021; Franceschi et al., 2017; Liu et al., 2018) are limited by their scal- ability to larger models and number of hyperparameters and by numerical instability. We leverage recent work by Engstrom et al. (2025), which takes the explicit approach, but addresses the afore- mentioned issues by proposing a scalable and memory-efficient method to compute metagradients.
PRELIMINARIES
Informally, differential privacy provides bounds on the extent to which the output distribution of a randomized algorithm .M can change when data point is removed swapped out.
Definition 2.1 ((Approximate-) Differential Privacy (DP) (Dwork et al., 2006)), A randomized al- gorithm M X² + satisfies (e, -ddiifeerettial privacy for all neighboring datasets D, D' (i.e., all D, D' such that |D' DI 1) and for all outcomes S C R we have
P(M(D) 8) S e P(M(D') E +
In the context of machine learning, M would be a learning algorithm, and this definition requires the model to be insensitive the exclusion of one training data point. In essence, it bounds the change in the output distribution of the model when trained on neighboring datasets. This implies that the model does not overly depend on any single sample observed.
Since the seminal work of Dwork et al. (2006), various relaxations of differential privacy have been proposed. Below, we define d-differential privacy, which we later reference when describing the auditing procedure proposed by Mahloujifar et al. (2024).
Definition 2.2 (f-Differential Privacy (Dong et al., 2022)). A mechanism M is f-DP if for all neighboring datasets S, S' and all measurable sets T with SSS' 1, we have
Pr(M(S) T & J (Pr(M((S) 7T)
Importantly, /-D relates to approximate DP in the following way: Proposition 1. A mechanism is (5, if it is f-DP with respect to f(x) = e + 8, where =12)=1-f(c) f(x).
While wide range of methods for adding differentially private guarantees to machine learning algorithms have been proposed over the years, DP-SGD (Abadi et al., 2016) has been established as one of the de facto algorithms for training deep neural networks with DP. At high-level, DP-SGD makes SGD differentially private by modifying it in the following ways: (1) gradients are clipped some maximum Euclidean norm and (2) random noise is added the clipped gradients prior to each update step. In Algorithm 5, we present DP-SGD in detail.
2.1 AUDITING DIFFERENTALL PRIVACY
Differentially private algorithms are accompanied by analysis upper bounding the DP parameters and 8. Privacy auditing instead provides empirical lower bound these parameters. In this work, we focus on specific formulation of privacy audits: last-iterate, black-box, one-run auditing.
2.1.1 LAST-ITERATE BLACK-BR BOX AUDITING
Our work focuses on last-iterate black-box auditing, where the auditor can only insert samples (i.c., canaries) into the training set and only access the resulting model the final training iteration.
3

---

Published as a conference paper at ICLR 2026
Algorithm 1: Black-box Auditing One Run (Steinke et al., 2023)
Input:
probability threshold т, privacy parameter ö, training algorithm A, dataset D, set m canaries C [ct,..., G.
Requires:
scoring function score
Parameters: number of positive and negative guesses K+ and k_
1 Randomly split canaries into two equally-sized sets CiN and COUT
{-1
i E CIN
2 Let S {s.) where
if CouT
3 Train model f- A(D CIN)
4 Compute vector of scores Y = fscore(w, 4))
5 Sort scores in ascending order Y' t sYrt(Y)
6 Construct vector of guesses T { where f2- =
1
if is among the top k+ scores Y (i.e., Y, 2 Y, - guess a E CNN if Y; is among the bottom k_ scores in Y (i.e., Y, S /// quess E Cour otherwise abstain
7 Compute empirical epsilon É (i.e., find the largest such that S, T, T, and 6 satisfy Theorem 1) Output: E
Algorithm 2: Black-box Auditing One Run (Mahloujifar et al., 2024)
Input: privacy parameter 6, training algorithm A, dataset D, set of m canaries
C= (c1.-.., (om Cm)
Requires: scoring function score
Parameters: number of guesses k
Randomly split canaries C' into two equally-sized sets CIN and Cour
m//2 2 Create disjoint canary sets E = Hm/ by randomly pairing canaries from CIN and Cour such that e; = (Gi,1, G.2) for C1, E CIN and G222 E Cour (each canary E C appears in exactly one set e,)
3 Train model w + A(NUCIN)
4 Compute vector of scores = [[sccre(ww a..)
5 Sort scores in ascending order Y +- sort(Y)
6 Construct vector of guesses T = [4
m/2 where
if Y, is among the top & values in Y (i.c., Y, 2 Y ) and score(w, e,,1) > score(w,,,,)
guess G11 CIN
t4 -1 if Y; is among the top values in (i.c., Y, 2 k
and score(w, cx,1 score(w, score(w,,,.)// guess 42 E CIN otherwise // abstain
7 Let number of correct guesses K' = 1(t >> 1
8 Compute empirical epsilon é (i.e., find the largest whose corresponding f-DP function f passes Algorithm 3 for m, k. k', and 6.) Output: غ
We note that, in contrast, previous works have also studied white-box settings. While the exact assumptions made in this setting can vary (Nasr al., 2021; 2023; Steinke al., 2023; Koskela & Mohammadi, 2025), it can be characterized as having fewer restrictions (e.g., access to intermediate training iterations or the ability to inject and modify gradients). While auditing in white-box settings generally leads to higher lower bound estimates due to the strength of the auditor, its assumptions are often far less realistic than those made black-box auditing.
2.1.2 ONE-RUN AUDITING
Early works (Jagielski et al., 2020; Tramer et al., 2022; Nasr et al., 2023) design privacy auditing "attacks" that align with the definition of DP, which bounds the difference in outputs neighboring
4

---

Published as a conference paper at ICLR 2026
Algorithm& 3: Upper bound probability of making correct guesses (Mahloujifar et al., 2024)
Input: probability threshold т, functions f and f-1, number of guesses k, number of correct guesses k", number of samples m, alphabet size
1 vO < k' set h[( 0, and r[i] =
2 Set r[k]] = T.
3 Set hikk'] = =7. c-c
T2
4 for i E w'-,.... 0 do
5
h[d = =(s 16-1f (rli 1))
6
r|1 = r|i + 11+
(hll
Mi + 1))
7
if r0 + h/0
then Return True (probability of k' correct guesses (out of k)) is less than r)
8
9
else
10
L
Return False (probability of having R' correct guesses (out of k) could be more than r)
datasets that differ by one sample. These audits detect the presence (or absence) of an individual sample over hundreds-if not, thousands-of runs of DP-SGD. The auditing procedure then gives lower bound on e based on the true and false positive rates of the membership inference attacks.
While effective, these multi-run auditing procedures are computational expensive. Consequently, Steinke et al. (2023) propose an alternative procedure that requires only one training run. Their strategy inserts multiple canary examples and obtains a lower bound based on how well an attacker can guess whether some canary was used in training. While one-run auditing can sacrifice bound tightness, its ability to audit without multiple runs of DP-SGD make it much more efficient and therefore, practical for larger models. In our work, we consider two primary auditing procedures:
(1) Steinke et al. (2023) introduce the concept of privacy auditing using one training run. Given some set of canaries C, samples are randomly sampled from C' with probability 2 and inserted into the training set. Once the model is trained, the auditor guesses which samples in C' were or were not included in the training set. The auditor can make any number of guesses or abstain. We present this procedure in Algorithm 1. The final lower bound on e is determined using Theorem 1, which is based on the total number of canaries, the number of guesses, and the number of correct guesses.
Theorem (Analytic result for approximate DP (Steinke al., 2023)). Suppose A {-1, 13 + {-1,0, 0, 1) 1 satisfy (e, 8)- Let 5 E {-1, 1)m be uniformly random and = A(S). Suppose P[[[T]| 1 S r) = 1. Then, for all E R,
f(u f(u- f(u)
(-(1-113 M+M(
Σ max (0, Ti (.-)) 2
f(() + 2md
max ie mm)....,
i
where
f(v) ;= P W. Binomial (r,
W
At a very high level, A DP-SGD, which takes in as input some set of m canaries that are labeled (S 13", as being included or excluded from the training set. The auditor uses the output of DP-SGD to produce a vector of guesses T E {-1. O, 1)th for the m canaries. Theorem I bounds the probability of making at least v correct guesses ( max(0, T, S 2 v. where S if the guess is correct). More informally, this theorem bounds the success rate (number of correct guesses) of the auditor assuming the parameter e. Practically speaking, one runs binary search (Steinke al., 2023, Appendix D) estimate the largest such that Theorem I still holds.
(2) Mahloujifar et al. (2024) propose an alternative auditing procedure that empirically achieves tighter privacy estimates in the white-box setting. In their guessing game, the set of canaries C' is randomly partitioned in disjoint sets. One canary is sampled from each set and inserted into the training set. Again, once the model is trained with DPD,GD, the auditor must make guesses. Unlike in Steinke et al. (2023), however, the auditor must guess which canary out of each set was included in training. Algorithm presents this procedure for canary sets of size 2.
5

---

Published as a conference paper at ICLR 2026
(x((()))
A
Φ
s(w)
2
W
Training setup
Trained model
Observed behavior
Figure 1: An illustration of the metagradient. We embed the canaries into a continuous metaparame- ter E Rmxx XmxxxxXxx with coordinate per training data pixel. All aspects of the learning process other than z-the base training data, optimizer hyperparameters, etc.-are baked into the learning algorithm A. The metaparameter thus defines a model w A(z), which we use to compute an output metric ( The metagradient Vzz(A(z)) is the gradient of the metric with respect to the metaparameter
Similar to Steinke et al. (2023), the final lower bound e is determined based the total number of canary sets, the number of guesses, and the number of correct guesses. At a high level, Mahlouji- far et al. (2024) first construct each. Using Algorithm 3, they then run hypothesis test, with probability threshold r. for the num- ber of correct guesses (i.e., output of Algorithm 3) occurring given function f. The final empirical lower bound is the maximum among those corresponding to the functions f that pass Algorithm 3.
of candidate values for and corresponding f-DP function for
Scoring function. Finally, to determine membership for either procedure, the auditor must first choose some score function s(-) from the training process. In the black-box setting for image classification models, one natural choice for s(-) is to use negative cross-entropy loss (Steinke et al., 2023). When s(w, x) is large (i.e., cross- entsopy loss is small) for some canary z and model w, the auditor guesses that x was included in training, and vice-versa. In Section 4, we provide more details about how we use the score function for Algorithms and
3 CANARY OPTIMIZATION WITH METAGRADIENT DESCENT
For fixed black-box auditing algorithm BBaudit : (r, 8, D,C) + (e.g. Algorithm or 2), the main degree of freedom available to the auditor is the choice of canary set C. Typically, one chooses C' to be a random subset of the training dataset D, or random set of mislabeled examples (Steinke al., 2023; Mahloujifar et al., 2024). natural question to ask is whether such choices are (hear-)optimal. in other words, can we significantly improve the efficacy of a given auditing algorithm by carefully designing the canary set C?
In this section, we describe an optimization- based approach to choosing the canary set. At a high level, our goal is to solve an optimization problem of the form
max (B,
where BBaudit is the (fixed) differential privacy auditing algorithm. т and are the privacy pa- rameters, AA is the learning algorithm (e.g., DP-SGD), D is the dataset, and C is the set of canary samples. The high-dimensional nature of this problem (e.g.. for 10,AR-10, C E IRx332332x3 makes impossible to exhaustively search over all possible canary sets C.
Instead, the main idea behind our approach is to use gradient descent to optimize the canary set C. To do so, we first design surrogate objective function audit by leveraging the connection between membership inference and differential privacy auditing. We then use recent advances in metagradient computation (Engstrom et al., 2025) optimize this surrogate objective with respect to the canary set C.
Key primitive: metagradient descent. A metagradient is a gradient taken through the process of training machine learning model (Maclaurin al., 2015; Domke, 2012; Bengio, 2000; Baydin

---

Published as a conference paper at ICLR 2026
& Pearlmutter, 2014). Specifically, given learning algorithm A, (continuous) design parameter 2 (e.g.. learning rate, weight decay, data weights, etc.), and a loss function o, the metagradient V V=((A(z)) is the gradient of the final loss & with respect to the design parameter 2 (see Figure I). For very small-scale learning algorithms (e.g., training shallow neural networks), one can compute metagradients by backpropagating through the entire model training process.
While this approach does not scale directly to larger-scale training routines, the recent work of Engstrom et al. (2025) proposes method to compute metagradients efficiently and scale. The method, called REP LAY, enables gradient-based optimization of data importance weights, train- ing hyperparameters, and- most relevant to our setting poisonous training data that hurts overall model accuracy. To tackle the latter setting, Engstrom et al. (2025) show how to compute meta- gradients of model's final test loss with respect to the pixels its training data. Leveraging this method, we will assume that we can efficiently compute metagradients of any differentiable loss function with respect to the pixels of any number of training data points.
Surrogate objective function. Even with the ability to compute metagradients efficiently, the op- timization problem in (2) is still challenging to solve in the black-box setting. First, the objective function BBaudit t. has explicit non-differentiable components (e-g.. thresholding). Second, tak- ing the metagradient requires more fine-grained access to the model training process than simply observing the final model outputs.
To address both these challenges, we design a surrogate objective function that approximates the original objective (2), inspired by the connection between black-box privacy auditing and member- ship inference. In particular, inspecting Algorithms 1 and 2, we observe that in both algorithms,, randomly split the canary set into two sets CiN and COUT: trains a model on D U CIN; and runs a membership inference attack to distinguish between samples in CIN and CoUr. Intuitively, good canary sample 2; should thus satisfy the following properties: (1) memorizability: if 2; E Cin. the model should have low loss on 2; and (2) non-generalizabiitty: if 2, E Cout, the model should have high loss on z₁ These properties motivate the following simple surrogate objective function:
m
(lw) = Σ (1(z E Cin) - [ E Coue)) L(w, 2i); i=1
where L is the training loss (i.e., cross-entropy) and 1(-} is the indicator function.. ! Finally, to optimize this objective in the black-box setting, we consider a "standard" (i.e., not differentially private) training algorithm A, and then transfer the resulting canaries to whatever learning algorithm we are auditing.
Optimizing canaries with (meta-)gradients. Our final optimization process (given in more detail in Algorithm 4) proceeds in T > 1 metasteps. Let D be the set of non-canaries (e.g.. the CIFAR- 10 dataset) and C' be the set of canaries (i.e., metaparameters 2) we are optimizing. During each metastep t, we randomly partition the canaries C' into two sets CIN,: and COUT,,, and randomly sample a model initialization and data ordering which define a learning algorithm A. After training model w A(2), take gradient step minimize the objective (equation 3) with respect to the canary set C. By repeating this process several times (essentially running stochastic gradient descent across random seeds and random data orderings partitionings of the canary set), we obtain a set of canary examples that are robustly memorizable and non non-generallzzabe.
4 EMPIRICAL EVALUATION
4.1 SETUP
Audited models. Following prior work (Nasr et al., 2023; Steinke et al., 2023; Mahloujifar al., 2024), we audit Wide ResNet models (Zagoruyko Komodakis, 2016) trained on CIFAR- 10 (Krizhevsky et al., 2009) with DP-SGD. Like in these works, we specifically use the Wide ResNet
We note that in this case, @ depends on the model weights u but also has a direct dependence on the canary set (i.e.. the metaparameters 2), making Figure I a slight over-simplification. In practice. we can still use the law of total derivative to compute the gradient of with respect z, since V A=0(z,A(z))
Az)(z)+ de 02
7

---

Published as a conference paper at ICLR 2026
Algorithm 4: Metagradient Canary Optimization
Input:
dataset
training algorithm A, loss function & Parameters: number of canaries m, number of meta-iterations N 1 Initialize canaries Co- = (c
Requires:
2
for t 4 to N do
3
Randomly split C₁ into two equally-sized sets: CIN, and COUr,
4
Train model: W/ f- A(D J CIN,t)
5
Compute loss gap ((w;)
L(wr, CIN.t) L(wi; CoUr,e)
6
Compute gradient w.r.t. canaries: Vc, +- REPRREPAA (WM,,
7
Update canaries: C++1 update Vc,)
Output: optimized canaries CN
(WRN) 16-4 architecture proposed by De et al. (2022), which they modify to improve model perfor- mance after DP training. In addition, we expand our evaluation to include CIFAR-100 (Krizhevsky et al., 2009), MNIST (LeCun et al., 2002), Fashion-MNIST (Xiao et al., 2017). For CIFAR-100 100, we use the same WRN-16-4 architecture we use for CIFAR-10. Given the simplicity (i.e., that is greyscale) of MNIST and Fashion-MNISS we use simple CNN with 3 convolutional layers, which still achieves high accuracy at E = 8.
To audit the models, we canary sets of size et al. (2023) and Mahloujifar et al. (2024), where C is sampled from the training set, we have in total 49000 non-canaries training images (n. 49500 total training images) for CIFAR-10 and CIFAR-100, and r = 59000 (n = 59500 total training images) for MNIST and Fashion-MNIS"
1000. To remain consistent with Steinke
Unlike in prior work one-run auditing, which audits DP-SGD applied models initialized from scratch, we also expand our evaluation to DP models that are first pretrained nonprivately (i.e.. DP- finetuning). For DP-finetuning experiments using CIFAR-10 and CIFAR-I00, we take CINIC-10 (Darlow et al., 2018), which combines CIFAR-10 with images from ImageNet (Deng et al., 2009) that correspond to the classes in CIFAR-10. For our pretraining dataset, we remove CIFAR-10 images so that only ImageNet examples remain. For DP-finetuning experiments on MNIST and Meshion-MNIST. we use EMNIST (Cohen al., 2017), which contains handwritten digits, as well as uppercase and lowercase letters. Except for CIFAR-10, which shares the same classes as its pretraining dataset, all pretrained models' classification layers are replaced before DP training.
We present hyperparameters in Tables 4 and 5 of the appendix. We train our models using the JAX PriiPrivccy package (Balle et al., 2025).
Baselines. To evaluate our canaries, we follow the black-box experiments prior work on one-run auditing, comparing against canaries randomly sampled from the training set (Steinke et al., 2023; Mahloujifar et al., 2024), as well as canaries that have been mislabeled (Steinke et al., 2023).
4.2 RESULTS
In Tables and 2, we present our main results for both DP training (i.e., training from scratch) and DP finetuning (i.e., first pretraining non-privately). At higher privacy budgets, our method per- forms better than black-box canaries proposed in prior one-run auditing work (Steinke et al., 2023; Mahloujifar et al., 2024). Under more stringent privacy constraints, in particular for = 1.0 (and in some cases, & 2.0 for Steinke et (2023)'s auditing procedure). the improvements become less consistent. We attribute such variability primarily to the increased noise substantially attenuating memorization signals and thereby limiting the effectiveness of auditing methods overall. Finally, note that our canaries reinforce that Mahloujifar et al. (2024)'s procedure consistently estimates higher privacy lower bounds compared to that of Steinke et al. (2023), an advantage that was less clear when using standard black-box canaries (i.e.. random mislabeled images). Using Mahlou- jifar et al. (2024)'s procedure, we estimate lower bounds that are several times higher compared to prior work, regardless of dataset model initialization.
8

---

Published as a conference paper at ICLR 2026
Table We audit Wide ResNet 16-4 model that has been trained with DP-SGD (e {8.0, 6.0, 4.0, 2.0, 1.0). = 10-9). We present results for models initialized from scratch and trained on private data (DP Training) and pretrained on public data and subsequently privately fine- tuned on the specific dataset (DP Finetuning). We report the average empirical epsilon over 5 runs for auditing procedure introduced by Steinke et al. (2023).
Dataset
Training
Canary Type
E
6
C
Metagradient (ours) Random
0.392
0.271
0.312
0.146
0.098
DP Training
0.285
0.111
0.044
0.083
0.080
Random Mislabeled
0.308
0.150
0.088
0.017
0.018
CIFAR-10
Metagradient (ours)
0.665
0.584
0.315
0.157
0.153
DP Finetuning
Random
0.477
0.322
0.323
0.200
0.065
Random Mislabeled
0.489
0.246
0.251
0.178
0.063
Metagradient (ours)
0.422
0.410
0.141
0.069
0.074
DP Training
Random
0.148
0.134
0.170
0.131
0.075
Random Mislabeled
0.165
0.194
0.140
0.126
0.143
CIFAR-100
Metagradient (ours)
0.770
0.555
0.405
0.171
0.169
DP Finetuning
Random
0.342
0.231
0.100
0.091
0.085
Random Mislabeled
0.175
0,200
0.147
0.150
0.165
Metagradient (ours)
0.392
0.438
0.280
0.147
0.150
DP Training
Random
0.212
0.200
0.195
0,214
0.217
Random Mislabeled
0.222
0.352
0.235
0.222
0.248
MNIST
Metagradient (ours)
0.736
0.601
0.650
0.364
0.142
DP Finetuning
Random
0.254
0.239
0.249
0.230
0.214
Random Mislabeled
0.366
0.319
0.425
0.304
0.227
Metagradient (ours)
0.358
0.419
0.480
0.246
0.085
DP Training
Random
0.124
0.125
0.143
0.149
0.120
Random Mislabeled
0.222
0.177
0.195
0.186
0.240
Pashion-MNIST
Metagradient (ours)
0.817
0.996
0.672
0.390
0.172
DP Finetuning
Random
0,268
0.257
0.266
0.225
0.218
Random Mislabeled
0.124
0.136
0.114
0.129
0.155
4.2.1 COMPARISON AGAINST NEWLY PROPOSED CANARIES SUGGESTED DURING THE REVIEW PERIOD
In this subsection, we address suggestions made by reviewers for comparing against other canaries not found in the single-run auditing literature. We provide more details about the construction of these canaries in Appendix C and the empirical results in Tables and 7.
First, Reviewer Vbyr suggests comparing against ClipBKD (Jagielski et al., 2020), which is de- signed for constructing a single canary example used for multi-run privacy auditing. We find, how- ever, that ClipBKD constructs canaries that are ineffective for single-run auditing, which is unsur- prising given that it was not originally designed for constructing many canaries required for one-run auditing.
Second, Reviewer qvdv suggests a new method (which we denote as Gradient Max), that takes some surrogate model and optimizes images that maximize the gradient norm of the loss with respect to the surrogate. Unlike ClipBKD, we find that this method is highly effective compared to existing canaries. Compared to our metagradient canaries, results are mixed, with outperforming ours on CIFAR-10, 10, performing similarly on CIFAR-100, and performing worse MNIST and Fashion- MNIST. We believe this promising direction and hope to explore in the future how this objective can be improved or whether it should be integrated in some way into metagradient optimization pipeline to further close the gap between thcoretical and empirical privacy bounds for black-bor box auditing.

---

Published as a conference paper at ICLR 2026
Table 2: We audit Wide ResNet 16-4 model that has been trained with DP-SGD (e {8.0, 6.0, 4.0, 2.0, 1.0). = 10-9). We present results for models initialized from scratch and trained on private data (DP Training) and pretrained on public data and subsequently privately fine- tuned on the specific dataset (DP Finetuning). We report the average empirical epsilon over 5 runs for auditing procedure introduced by Mahloujifar et al. (2024).
Dataset
Training
Canary Type
E 6
C
Metagradient (ours) Random
0.732
0.498
0.229
0.049
0,000
DP Training
0.405
0.213
0.077
0.000
0.030
Random Mislabeled
0.225
0.086
0.019
0.025
0.000
CIFAR-10
Metagradient (ours)
1.207
0.978
0.594
0.398
0.118
DP Finetuning
Random
0.687
0.482
0,456
0.091
0.077
Random Mislabeled
0.632
0.618
0.378
0.307
0.016
Metagradient (ours)
0.736
0.573
0.337
0.120
0.083
DP Training
Random
0,209
0.030
0.013
0.064
0,002
Random Mislabeled
0.088
0.097
0.054
0.074
0.029
CIFAR-100
Metagradient (ours) Random
1.286
0.935
0.594
0.370
0.113
DP Finetuning
0.354
0.274
0.065
0.115
0.038
Random Mislabeled
0.187
0.123
0.017
0.085
0.115
Metagradient (ours)
0.669
0.594
0.499
0.144
0.080
DP Training
Random
0.016
0.000
0.000
0.000
0.000
Random Mislabeled
0.070
0.204
0.142
0.039
0.008
MNIST
Metagradient (ours)
1.465
1.366
1.260
0.304
0.117
DP Finetuning
Random
0.321
0.182
0.229
0.098
0.058
Random Mislabeled
0.099
0.011
0.136
0.008
0.112
Metagradient (ours)
0.682
0.632
0.642
0.385
0.102
DP Training
Random
0.022
0.099
0.045
0.009
0.000
Random Mislabeled
0.141
0.085
0.094
0.061
0.136
Aishion-MNIST
Metagradient (ours)
1.483
1.342
1.401
0.517
0.136
DP Finetuning
Random
0.056
0.093
0.058
0.179
0,002
Random Mislabeled
0.398
0.198
0.242
0.062
0.235
CONCLUSION
We propose an efficient method for canary optimization that leverages metagradient descent. Op- timizing for objective tailored towards privacy auditing, our canaries significantly outperform standard canaries, which are sampled from the training dataset. Specifically, we show that despite being optimized for non-private SGD small ResNet model, canaries work better larger Wide ResNets for both DP-training and DP-finetuning. Using our canaries, we significantly tighten privacy bounds. Furthermore, this improvement holds, regardless of whether DP-SGD is run from scratch or after non-private finetuning.
REPRODUCIBILITY STATEMENT
In our paper, we describe in detail the algorithms for both our metagradient optimization procedure (Algorithm 4) and the one-run auditing procedures from Steinke et al. (2023) (Algorithm 1) and Mahloujifar et al. (2024) (Algorithms and 3). Additional implementation details and hyperparam- eters for running these algorithms are described in Appendix B. To ensure reproducibility of our results, we also provide code used for all our experiments in the supplementary materials. There are two main parts: code for metagradient canary optimization and code for training and auditing image classification models with SGDSGD. Instructions for rumning the code are available in an included README file. In the final version of our paper, will include link to public repository.
10

---

Published as a conference paper at ICLR 2026
7 ACKNOWLEDGMENTS
ZSW and TL are supported in part by an NSF CAREER Award, an NSF SaTC grant, and an STTR grant. ZSW and Al are supported by a CyLab Seed Grant.
REFERENCES
Martin Abadi, Andy Chu, lan Goodfellow, Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Juhan Bae, Nathan Ng, Alston Lo, Marzyeh Ghassemi, and Roger B Grosse. If influence functions are the answer, then what is the question? Advances in Neural Information Processing Systems, 35:17953-17967 2022.
Borja Balle, Leonard Berrada, Zachary Charles, Christopher Choquette- Choo, Soham De, Vadym Doroshenko, Dj Dvijotham, Andrew Galen, Arun Ganesh, Sahra Ghalebikesabi, Jamie Hayes, Peter Kairouz, Ryan McKenna, Brendan McMahan, Aneesh Pappu, Natalia Ponomareva, Mikhail Pravilov, Keith Rush, Samuel I. Smith, and Robert Stanforth. JAX-Privacy: Algo- rithms for privacy-preserving machine learning in jax, 2025. URL http:// /ttp//ggithbb/. com/ jax_privacy._....
Atilim Gunes Baydin and Barak A Pearlmutter. Automatic differentiation of algorithms for machine learning, arXiv preprint arXiv:1404.7456, 2014.
Yoshua Bengio. opadiient of hyperparameters. Neural computation, 12(8): 1900, 2000.
Benjamin Bichsel, Timon Gehr, Dana Drachsler-Cohan Petar Tsankov, and Martin Vechev. Dp- finder: Finding differential privacy violations by sampling and optimization. In Proceed- ings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS '18, pp. 508-524, New York, NY, USA, 2018. Association for Computing Machinery. ISBN 9781450356930. doi: 10.114553244374442438866 URL https: httt:s://dci.oog/10000 3243734. 3243863.
Tudor Ioan Cebere, Aurélien Bellet, and Nicolas Papernot. Tighter privacy auditing of DP-SGD in the hidden state threat model. In The Thirteenth International Conference Learning Represen- tations, 2025. URL https: : opp.reviewwwe.ee/////pepe net/ forum? Forum?id-x:2Pns.
Xiangning Chen and Cho-Jui Hsieh. Stabilizing differentiable architecture search via perturbation- based regularization. In International conference on machine learning, pp. 1554-1565. PMLR, 2020.
Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In 2017 international joint conference on neural networks (ICCNN, pp- 2921-2926 IEEE, 2017.
Luke N Darlow, Elliot Crowley, Antreas Antoniou, and Amos Storkey. Cinic-10 10 is not imagenet or cifar-10. arXiv preprint arXiv:1810.0335 2018.
Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlock- ing high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204. 13650, 2022.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scabl scale hi- erarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-255. leee, 2009.
Zeyu Ding, Yuxin Wang, Guanhong Wang, Danfeng Zhang, and Daniel Kifer. Detecting violations of differential privacy. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 475 489, 2018
11

---

Published as a conference paper at ICLR 2026
Justin Domke. Generic methods for optimization-basee modeling. In Artificial Intelligence and Statistics, pp. 318-326, PMLR, 2012.
Jinshuo Dong, Aaron Roth, and Weijie J. Su. Gaussian differential privacy. Journal of the Royal Statistical Society: Series (Statistical Methodology). 84(1):3-37, 2022.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pp. 265-284, Springer, 2006.
Logan Engstrom, Andrew Ilyas, Benjamin Chen, Axel Feldmann, William Moses, and Aleksander Madry. Optimizing ml training with metagradient descent. arXiv preprint arXiv:2503. 13751, 2025.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta meta-learning for fast adaptation of deep networks. In International conference on machine learning, pp. 126-1135, PMLR, 2017.
Luca Franceschi, Michele Donini, Paolo Frasconi, and Massimiliano Pontil. Forward and reverse gradient-bused hyperparameter optimization. In International conference on machine learning, pp. 1165-1173. PMLR, 2017.
Matthew Jagielski, Jonathan Ullman, and Alina Oprea. Auditing differentially private machine learning: How private is private sgd? Advances in Neural Information Processing Systems, 33: 22205-22216, 2020.
Mishaal Kazmi, Hadrien Lautraite, Alireza Akbari, Qiaoyue Tang, Mauricio Soroco, Tao Wang. Sébastien Gambs, and Mathias Lécuyer. Panoramia: Privacy auditing of machine learning models without retraining. Advances in Neurul Information Processing Systems, 37:57222-57300, 2024.
Amit Keinan, Moshe Shenfeld, and Katrina Ligett. How well can differential privacy be audited in one run? arXiv preprint arXiv:2503.07199 2025.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International conference on machine learning, pp. 1885-1894, PMLR, 2017.
Antti Koskela and Jafar Aco Mohammadi. Auditing differential privacy guaranteess using density estimation. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp. 1007-1026. IEEE, 2025.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. University of Toronto, 2009.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):228-23224 2002.
Hanxiao Liu, Karen Simonyan, and Yiming Yang. Darts: Differentiable architecture search. arXiv
preprint 1806: 2018.
Terrance Liu, Matteo Boglioni, Yiwei Fu, Shengyuan Hu, Pratiksha Thaker, and Zhiwei Steven Wu. Enhancing one-run privacy auditing with quantile regression-bast membership inference. arXiv preprint arXiv:2506. 15349, 2025.
Jonathan Lorraine, Paul Vicol, and David Duvenaud. Optimizing millions of hyperparameters by implicit differentiation. In International conference artificial intelligence and statistics, pp. 1550-1552. PMLR, 2020.
Dougal Maclaurin, David Duvenaud, and Ryan Adams. Gradient-basee hyperparameter optimiza- tion through reversible learning. International conference on machine learning, pp. 2113-2122. PMLR, 2015.
Samuel Maddock, Alexandre Sablayrolles, and Pierre Stock. Canife: Crafting canaries for empirical privacy measurement in federated learning. In ICLR, 2023.
Saeed Mahloujifar, Luca Melis, and Kamalika Chaudhuri. Auditing f-differential privacy in one run. arXiv preprint 1rXiv:2410.22255 2024.
12

---

Published as a conference paper at ICLR 2026
Matthieu Meeus, Lukas Wutschitz, Santiago Zanella-Beguelin, Shruti Tople, and Reza Shokri. The canary's 's echo: Auditing privacy risks of iin-generated synthetic text. In Forty-second Interna- tional Conference on Machine Learning, 2025.
Paul Micaelli and Amos Storkey, Gradient-based hyperparameter optimization over long horizons. Advances in Neural Information Processing Systems, 34: 10798-10809,, 2021.
Meenatchi Sundaram Muthu Selva Annamalai. It's our loss: No privacy amplification for hidden state dp-sgd with non-convex loss. In Proceedings of the 2024 Workshop on Artificial Intelligence and Security, AlSec '24, pp. 24-30, New York, NY, USA, 2024. Association for Computing Machinery. ISBN 01998400112288 doi: 10.1145/3689932.944777. URL https://doi. org/10. 1145....../.... /11415/38888 689932..... 3694767.
Meenatchi Sundaram Muthu Selva Annamalai and Emiliano De Cristofaro. Nearly tight black-box auditing of differentially private machine learning. Advances in Neural Information Processing Systems,
2024.
Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlin. Adversary instantiation: Lower bounds for differentially private machine learning. In 2021 IEEE Symposium on security and privacy (SP), pp. 866-882. IEEE, 2021.
Milad Nasr, Jamie Hayes, Thomas Steinke, Borja Balle, Florian Tramèr, Matthew Jagielski, Nicholas Carlini, and Andreas Terzis. Tight auditing of differentially private machine learning. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 1631-1648, 2023.
Milad Nasr, Thomas Steinke, Borja Balle, Christopher A. Choquette-Chow Arun Ganesh, Matthew Jagielski, Jamie Hayes, Abhradeep Guha Thakurta, Adam Smith, and Andreas Terzis. The last iterate advantage: Empirical auditing and principled heuristic analysis of differentially private SGD. In The Thirteenth International Conference on Learning Representations, 2025. URL https:/ /ttp///eeeeeeeeeee//eeeeeeeeeeep net wtwprriiiieeeeeeooounneee. www.moorrdddoo wtwpuummmdddwwoook33o
Ashwinee Panda, Xinyu Tang, Christopher A. Choquette- Chhoo Milad Nasr, and Prateck Mittal. Pri- vacy auditing of large language models. In The Thirteenth International Conference on Learning Representations, 2025. URL https: http///pppeeeeeeeeeeeeeeeeeeeeet
Aravind Rajeswaran, Chelsea Finn, Sham M Kakade, and Sergey Levine. Meta-learning with im- plicit gradients. Advances in neural information processing systems, 32, 2019.
Thomas Steinke, Milad Nasr, and Matthew Jagielski. Privacy auditing with one (1) training run. In Proceedings of the 37th International Conference on Neural Information Processing Systems, pp- 49268 492880, 2023.
Florian Tramer, Andreas Terzis, Thomas Steinke, Shuang Song, Matthew Jagielski, and Nicholas Carlini. Debugging differential privacy: case study for privacy auditing, 2022. URL https: / //arxiv. org.vv.rrr/..oo abs/ 02....222.....22...22...22.222.. 12219.
Kan Wu, Jinnian Zhang, Houwen Peng. Mengehen Liu, Bin Xiao, Jianlong Fu, and Lu Yuan. Tinyvit: Fast pretraining distillation for small vision transformers. In European conference on computer vision, pp. 68 85. Springer, 2022.
Han Xiao, Kashif Rasul, and Roland Vollgraf.
Fashion-mnist: a novel image dataset for benchmark- ing machine learning algorithms. arXiv preprint 1708.0777 2017.
Sergey Zagoruyko and Nikos Komodakis. 1rX1n:1605.07146, 2016.
Wide residual networks.
arXiv preprint
13

---

Published as a conference paper at ICLR 2026
A
ADDITIONAL METHODOLOGY DETAILS
Differentially Private SGD.
For completeness, we describe DP-SGD in Algorithm 5.
Algorithm 5: Differentially Private Stochastic Gradient Descent (DP-SGD)
Input: x E Xm
Requires: Loss function f R -
Parameters: Number of iterations f, learning rate n, clipping threshold e >> 0, noise multiplier
O, sampling probability g E (0.
1 Initialize wo E Rdd
2 / 1,...
3
Sample 5* _ [n]] where each i [xx] is included independently with probability q;
4 Compute of V w f(w mr)) Rdd for all i S*;
Clip / min 1, Tolll c j of Rd for all i St
Sample 5º Te. from (2))))
7
Sum g' = + Eies' of E Rd:
8
Update w¹ = w n g' E Rd
Output: w", w ,..., w
Additional auditing procedure details. As implemented in Mahloujifar al. (2024), we align Algorithms and by fixing the canary set size to 2 so that half of C' is included in training for both auditing setups. When running Algorithm probability half) so that the set of r non-auditing examples are the same for both auditing procedures. In addition, we use negative cross-entrone cros--enrrppy loss the scoring function s(-) for both algorithms. In more detail.
split C' randomly
half (instead of sampling with
[Steinke et al. (2023), Algorithm 1] We sort the canaries x E C' by s(x) and take the top k canaries in the sorted list as positive guesses and bottom k_ as negative guesses.
|Mahloujifar et al. (2024), Algorithm 2] We score canaries in each pair and predict the one with the higher score have been included in training. We then score each pairing by taking the absolute difference scores s(-) between the canaries in each set and ranking the pairs by the as our guesses.
difference. We take the top
For both procedures, we follow prior work (Steinke et al., 2023; Mahloujifar al., 2024), varying the number of guesses from 10 up to m, in increments 10, and reporting the max empirical e.
14

---

Published as a conference paper at ICLR 2026
B ADDITIONAL EXPERIMENTAL DETAILS
Metagradient canary optimization. Following Engstrom et al. (2025), we optimize the canary samples by training ResNet-9 model (i.e., w Algorithm 4), allowing ciently. For step of Algorithm 4, we initialize Co to m samples randomly sampled from D (i.e., CIFAR-10). We optimize for 500 metagradient steps. As demonstrated Section 4.2, despite using relatively compact model, our metagradient canaries are effective for much larger model architec- tures (i.e., Wide ResNets). In Table 3, we list the hyperparameters used train the proxy ResNet-9 model at each metagradient step. While our metagradient optimization approach introduces non- trivial computational overhead, we note that this expense is very practical when considering it only needs to be performed once per dataset. In fact, once optimized for specific dataset, these canaries can reused across various model architectures, different privacy budgets (e), and diverse train- ing procedures (e.g., training from scratch versus DP-finetuning), effectively amortizing the initial optimization cost. Specifically, optimizing a full set of m 1000 canaries requires approximately 96-120 hours single NVIDIA A100 GPU.
optimize C effi-
Table 3: ResNet-9 Training Hyperparameters
Hyperparameter
Value
Learning rate
0.2
B1
0.85
Weight Decay
1 x 10
Batch size
250
Epochs
18
Optimizer
SGD
Nesterov
True
Momentum
False
DP-SGD Hyperparameters. We list the hyperparameters used for DP-SGD Tables and 5. CIFAR-10 (training from scratch) hyperparameters were directly taken from De et al. (2022). We chose the remaining hyperparameters based on light gridsearch that gave the best test accuracy at each privacy budget.
Table 4: Hyperparameters used for DP training (from scratch).
Hyperparameter
8.0
6.0
4.0
2.0
1.0
Batch size
4096
4096
4096
4096
4096
Clipping norm
1.0
1.0
1.0
1.0
1.0
CIFAR-10
# steps
2500
2000
1500
1250
1000
Learning rate
4.0
4.0
2.0
2.0
2.0
Batch size
4096
4096
4096
4096
4096
Clipping norm
1.0
1.0
1.0
1.0
1.0
CIFAR-100
steps
2500
2000
1500
1250
1000
Learning rate
4.0
4.0
2.0
2.0
2.0
Batch size
4096
4096
4096
4096
4096
Clipping norm
1.0
1.0
1.0
1.0
1.0
MNIST
# steps Learning rate
1000
1000
1000
1000
1000
4.0
4.0
4.0
4.0
4.0
Batch size
4096
4096
4096
4096
4096
Clipping norm
1.0
1.0
1.0
1.0
1.0
PaSHion-MNIST
# steps
1000
1000
1000
1000
1000
Learning rate
4.0
4.0
4.0
4.0
4.0
15

---

Published as a conference paper at ICLR 2026
Table 5: Hyperparameters used for DP finetuning.
Hyperparameter
8.0
6.0
E 4.0
2.0
Batch size
4096
4096
4096
4096
4096
Clipping norm
1.0
1.0
1.0
1.0
1.0
CIFAR-10
# steps
1000
1000
740
500
250
Learning rate
4.0
4.0
4.0
4.0
4.0
Batch size
4096
4096
4096
4096
4096
Clipping norm
1.0
1.0
1.0
1.0
CIFAR-100
# steps
2500
2000
1500
1250
1000
Learning rate
4.0
4.0
2.0
2.0
2.0
Batch size
4096
4096
4096
4096
4096
Clipping norm
1.0
1.0
1.0
1.0
1.0
MNIST
# steps Learning rate
1000
1000
1000
1000
1000
4.0
4.0
4.0
4.0
4.0
Batch size Clipping norm
4096
4096
4096
4096
4096
1.0
1.0
1.0
1.0
1.0
Fashion-MNIST
steps
1000
1000
1000
1000
1000
Learning rate
4.0
4.0
4.0
4.0
4.0
16

---

Published as a conference paper at ICLR 2026
C COMPARING AGAINST NEWLY PROPOSED CANARIES
ClipBKD (Jagielski et al., 2020). ClipBKD (Jagielski et al., 2020) is a method for generating canaries that was originally designed for multi-run DP auditing and subsequently used audit worst- cast privacy leakage (Muthu Selva Annamalai & De Cristofaro, 2024). The method requires taking the top singular principal component of the dataset, and so to modify it for the one-run setting, we instead take the top m components to generate m canaries. Given that for MNIST and Fashion- MNIST, the dimension-sin of the images is 784 CIFAR-10 and CIFAR-101 only.
1000, we evaluate ClipBKD on
Gradient Maximization (proposed by Reviewer qvdv). Reviewer qvdv suggested trying a sim- ple baseline of maximizing the gradient norm of the loss for some surrogate model trained non- privately on the dataset. We refer to this method as Gradient Max. To the best of our knowledge, no previous work has adopted such canary optimization method in the context of DP auditing. To make this baseline comparable to our metagradient optimization procedure, we also choose ResNet- 9 the surrogate model that we pretrain non-privately on each target dataset. We then randomly sample 1000 holdout samples from these datasets' test sets and optimize the images using gradient descent to maximize the gradient norm of cross-entropy loss.
Table 6: We present the results of a comparison between our method and the baseline proposed by the reviewers, as discussed in Appendix C. We audit Wide ResNet 16-4 model that has been trained with DP-SGD (e = {8.0, 6.0, 4.0, 2.0, 1.0), 6 10-5). We present results for models initialized from scratch and trained on private data (DP Training) and pretrained public data and subsequently privately finetuned on the specific dataset (DP Finetuning). We report the average empirical epsilon over 5 runs for auditing procedure introduced by Steinke al. (2023)
Dataset
Training
Canary Type
=
6
4
2
Metagradient (ours) ClipBKD Gradient Max
0.392
0.271
0.312
0.146
0.098
DP Training
0.129
0.162
0.116
0.134
0.094
0.589
0.499
0.262
0.046
0.237
CIFAR- 10
Metagradient (ours) ClipBKD Gradient Max
0.665
0.584
0.315
0.157
0.153
DP Finetuning
0.487
0.282
0.160
0.151
0.041
0.909
0.738
0.186
0.411
0.111
Metagradient (ours)
0.422
0.410
0.141
0.069
0.074
DP Training
ClipBKD
0.219
0.220
0.087
0.226
0.066
Gradient Max
0.378
0.303
0.280
0.125
0.074
CIFAR-100
Metagradient (ours)
0.770
0.555
0.405
0.171
0.169
DP Finetuning
ClipBKD Gradient Max
0.213
0.174
0.200
0.192
0.129
0.623
0.579
0.321
0.258
0.265
Metagradient (ours)
0.392
0.438
0.280
0.147
0.150
DP Training
Gradient Max
0.442
0.272
0.249
0.151
0.108
MNIST
Metagradient (ours)
0.736
0.601
0.650
0.364
0.142
DP Finetuning
Gradient Max
0.539
0.454
0.568
0.260
0.170
Metagradient (ours)
0.358
0.419
0.480
0.246
0.085
DP Training
Gradient Max
0.277
0.272
0.202
0.230
0.061
Fashion-M -NNIT
Metagradient (ours)
0.817
0.996
0.672
0.390
0.172
DP Finetuning
Gradient Max
0.289
0.158
0.123
0.202
0.102
17

---

Published as a conference paper at ICLR 2026
Table 7: We present the results of a comparison between our method and the baseline proposed by the reviewers, as discussed in Appendix C. We audit Wide ResNet 16-4 model that has been trained with DP-SGD (e {8.0, 6.0, 4.0, 2.0, 1.0), initialized from scratch and trained on private data (DP Training) and pretrained on public data and subsequently privately finetuned on the specific dataset (DP Finetuning). We report the average empirical epsilon over 5 runs for auditing procedure introduced by Mahloujifar et al. (2024).
10-5). We present results for models
Dataset
Training
Canary Type
8
6
= 4
= 2
Metagradient (ours)
0.732
0.498
0.229
0.049
0.000
DP Training
ClipBKD
0.270
0.243
0.193
0.112
0.165
Gradient Max
0.970
0.595
0.272
0.070
0.263
CIFAR-10
Metagradient (ours)
1.207
0.978
0.594
0.398
0.118
DP Finetuning
CD Gradient Max
0.841
0.344
0.184
0.187
0.030
1.793
1.249
0.403
0.409
0.368
Metagradient (ours)
0.736
0.573
0.337
0.120
0.083
DP Training
ClipBKD
0.248
0.243
0.150
0.077
0.025
Gradient Max
0.757
0.509
0.414
0.102
0.099
CIFAR-100
Metagradient (ours)
1.286
0.935
0.594
0.370
0.113
DP Finetuning
ClipBKD Gradient Max
0.238
0.371
0.206
0.126
0.177
1.303
1.053
0.658
0.538
0.103
Metagradient (ours)
0.669
0.594
0.499
0.144
0.080
DP Training
Gradient Max
0.485
0.403
0.339
0.089
0.083
MNIST
Metagradient (ours)
1.465
1.366
1.260
0.304
0.117
DP Finetuning
Gradient Max
0.924
0.884
0.823
0.451
0.147
Metagradient (ours)
0.682
0.632
0.642
0.385
0.102
DP Training
Gradient Max
0.453
0.451
0.320
0.297
0.026
Aishion-MNIST
Metagradient (ours)
1.483
1.342
1.401
0.517
0.136
DP Finetuning
Gradient Max
0.227
0.256
0.227
0.329
0.064
18

---

Published as a conference paper at ICLR 2026
D ADDITIONAL ANALYSIS USING CIFAR-10
Auditing non-private SGD. We evaluate our metagradient canaries when auditing models trained with non-private SGD. Figure 2, we plot the empirical epsilon estimated by the auditing proce- dures introduced in Steinke et al. (2023) and Mahloujifar et al. (2024) against the number of steps that the Wide ResNet 16-4 model is trained for. We observe that even when applied on different model architectures (i.e., transferring from ResNet-9 to WRN 16-4), our metagradient canaries per- form strongly. Using the auditing procedure of Mahloujifar al. (2024), for example, our canaries outperform the two baselines across any number of training steps.
Metagradient
Random
Random imisiabeled]
Metagradintt
Random
Random Imislabeled)
Tra Eror
Tra Error
Emplincal Epalion
Entor on Tain
2000
8000
10000
2000
4000
6000
8000
10000
Training Steps
Training
(a) Steinke (2023)
(b) Mahloujifar (2024)
Figure 2: We evaluate the effectiveness of our metagradient canaries for the purpose of auditing non-private SGD. We train Wide ResNet 16-4 model on CIFAR-10 for 10k steps with each canary type, plotting the empirical epsilon when auditing the model every 100 steps with the auditing procedures introduced by (a) Steinke et al. (2023) and (b) Mahloujifar et al. (2024). We take an average over runs and plot error band denote +1 standard deviation. For reference, plot the training error the model trained on our metagradient canaries (note that the training accuracy approximately the same, regardless of choice of canary).
Canaries visualization. To provide insights into the effectiveness of the optimized canary sets, include visualizations of the generated images by our procedure. To the human eye, the optimized canaries appear as diverse, random shapes and patterns. This suggests that our metagradient opti- mization identifies specific features that might be susceptible to memorization by the model, even those features have no semantic meaning to a human observer.
deer
ship
bird
frog
dog
truck
horse
cat
airplane
automobile
Figure 3: CIFAR10 Metagradient Canaries Generated using Algorithm 4
Evaluation vision transformers. In Tables 8 and 9, present auditing results for vision transformer models (i.e., TiT (Wu et al., 2022)) trained with DP-SGD at = 8.0 using the au- diting procedures of Steinke et al. (2023) and Mahloujifar et al. (2024) respectively. In these tables, we also compared the ClipBKD and Gradient Max canaries that were described in Appendix C.
19

---

Published as a conference paper at ICLR 2026
Table Using the procedure presented in Steinke et al. (2023), we audit ViT-Tiny model that has been trained with DP-SGD (s = 8.0, ò = 10-9) on CIFAR-I0 and CIFAR-100. We present results for models initialized from scratch and pretrained on CINIC-10 (with CIFAR-10 images removed). We report the average empirical epsilon and standard error over 5 runs.
Dataset
Training
Canary Type
E
Metagradient (ours)
0.420
Random
0,088
DP Training
Random Mislabeled
0.255
ClipBKD
0.192
Gradient Max
0.392
CIFAR-10
Metagradient (ours)
0.943
Random
0.164
DP Finetuning
Random Mislabeled
0.271
ClipBKD
0.114
Gradient Max
0.146
Metagradient (ours)
0.560
Random
0.167
DP Training
Random Mislabeled
0.020
ClipBKD Gradient Max
0.433
0.667
CIFAR-100
Metagradient (ours)
1.210
Random
0.279
DP Finetuning
Random Mislabeled
0.147
ClipBKD Gradient Max
0.248
0.540
Table Using the procedure presented in Mahloujifar al. (2024), audit ViT-Tiny model that
has been trained with DP-SGD (e 8.0, 8 10-5) on CIFAR-10 and CIFAR-100. We present results for models initialized from scratch and pretrained on CINIC-10 (with CIFAR-10 images removed), We report the average empirical epsilon and standard error over 5 runs.
Dataset
Training
Canary Type
é
Metagradient (ours)
0.712
Random
0.093
DP Training
Random Mislabeled
0.176
ClipBKD
0,069
Gradient Max
0.502
CIFAR-10
Metagradient (ours)
1.742
Random
0.288
DP Finetuning
Random Mislabeled
0.419
ClipBKD
0.214
Gradient Max
0.205
Metagradient (ours)
0.868
Random
0.173
DP Training
Random Mislabeled
0,064
ClipBKD
0.235
Gradient Max
0.932
CIFAR-100
Metagradient (ours)
1.954
Random
0.397
DP Finetuning
Random Mislabeled
0.091
ClipBKD
0.344
Gradient Max
1.081
20


Reviews:
[{"review_id": "T4iDtYNqyR", "reviewer": "Reviewer_mkZ7", "summary": "This paper addresses the crucial problem of deriving tighter empirical lower bounds for the privacy parameter (ε) in black-box privacy auditing of differentially private learning algorithms. The authors propose a novel method to optimize canary examples using metagradient descent. This optimization is achieved by iteratively updating the canaries using a surrogate model trained on the CIFAR-10 dataset to minimize a surrogate objective function. This function is defined as the loss gap between canaries included in the training set and those held out. The optimized canaries are then deployed to solve the problem of underestimating privacy loss with standard auditing techniques. Through experiments, the authors demonstrate that their method yields higher and more accurate empirical ε values compared to baseline canaries, particularly in the challenging DP finetuning scenario.", "questions": "Overall, this paper is well-structured. I have the following concerns:\n1. While the paper compares against random and mislabeled canaries, are there other canary optimization techniques that could serve as stronger baselines for comparison? (e.g., the briefly mentioned Jagielski et al. and Nasr et al. in the related work)\n\n2. This paper states that initial canaries are sampled from CIFAR-10. Could the authors elaborate on the impact of this initial sampling? How would initializing the canaries with entirely random noise affect the optimization process and their final effectiveness?\n\n3. This paper uses a fixed canary set size of m=1000. While effective for the tested scenarios, the scalability of the metagradient optimization to a significantly larger number of canaries remains unexplored. It would be beneficial to understand if there is a practical limit to the number of canaries that can be effectively optimized.\n\n4. This paper mainly presents quantitative results. A deeper analysis or visualization of the optimized canaries would provide mechanistic insights into why they are so effective. For example, showing how their appearance or features differ from regular canaries.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "S1. This paper proposes a novel and effective approach to improve privacy auditing by actively optimizing canary examples. This significantly advances the SOTA in auditing effectiveness, enabling auditors to uncover more accurate privacy leakage estimates.\n\nS2. The optimized canaries prove effective for auditing models trained both from scratch and via DP-finetuning, which establishes the method's utility in different practical settings of differentially private model deployment.\n\nS3. This paper includes detailed algorithms for both the metagradient optimization and the auditing procedures, which ensures the reproducibility of the proposed method.", "weaknesses": "W1. The metagradient optimization process involves training a surrogate model multiple times within each meta-iteration. This paper does not discuss the computational overhead of this optimization phase, which could be a practical barrier for scenario with limited resources.\n\nW2. The empirical evaluation is exclusively confined to image classification tasks using CIFAR-10. The generalizability of this canary optimization approach to other data modalities or different machine learning tasks remain unexplored. And this paper lacks discussion or an ablation study on the sensitivity of the results to different surrogate model architectures for the canaries optimization.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "N3AceF7BRS", "reviewer": "Reviewer_qvdv", "summary": "The paper describes a method to discover a strong set of canary examples to use for empirical privacy auditing, via optimizing (with metagradient descent) a function that approximates the distinguishability of canaries *included* or *excluded* from training. Experiments demonstrate that these canaries are significantly strong (produce higher empirical epsilons) than random canaries. Each step of metagradient descent requires a model training run, so the technique would be infeasible on a large architecture, but they show that canaries optimized using a smaller architecture are also strong when ported to a larger architecture.", "questions": "Do you have more evidence that it works to optimize canaries on one model and port them to another?\n\nCould you compare to simply maximizing the norm of the canary gradient, or do you have a convincing argument why this will not work?\n\nCould you add a topline to figure 2, showing the maximum possible empirical epsilons producible by that auditing method with that number of canaries? It would be interesting to see if you are hitting that max.\n\nNote: there's some ambiguity in the literature about what constitutes a \"black box\" audit. For some, that would imply only allowing the adversary API access, not giving it even the final model checkpoint, or ability to compute a loss. In reality there is a spectrum of auditing scenarios depending on the threat model, so it may be best to retire the \"black\" vs \"white\" distinction.\n\nTypo: $i$ vs $t$ in Alg 5", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 4, "contribution": 3, "strengths": "The core idea is original and promising. Although the method is too expensive to use on large architectures, the experiments show that it is sufficient to optimize the canary set with a small architecture and port them over. The writing is very clear and precise.", "weaknesses": "I have two main concerns regarding soundness and contribution.\n\nFirst, the claim that the method can be used on a small architecture and generalized to a larger one is critical for the method to be of real utility, and therefore it needs more evidence. Could you experiment with more model sizes, or generalizing to a completely different architecture like ViT? Maybe at least one other data modality, like audio?\n\nSecond, I think a simple baseline that is important to compare to would be maximizing the gradient norm of the canary (on the initial model parameters, or perhaps after some training on real data). This would be computationally much lighter than metagradient optimization through the entire training run, and might produce a set of canaries that are nearly as strong as the ones you find.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "sOMIaMHRzd", "reviewer": "Reviewer_tQae", "summary": "This paper studies black-box auditing of DP-SGD and proposes a canary-generation method based on metagradient optimization to strengthen empirical privacy lower bounds. The approach uses a proxy (non-private) model to optimize canaries and then applies these optimized canaries to audit models trained via DP-SGD following existing one-run procedures (Steinke et al. 2023 and Mahloujifar et al. 2024). They empirically show on CIFAR10 that metagradient optimized canaries result in stronger attacks than random canaries under a fixed privacy budget.", "questions": "1. The main contribution of the paper does not seem to be the optimized canary approach since this has been used before in prior work [1,2] but in adapting this to a black-box setting via a separate surrogate model/loss. However, there does not seem to be much explanation or detail as to why and when this proxy model approach would be effective vs. using random canaries.\n2. It is not clear how the proxy model is trained and how much of an effect this has on the DP-SGD auditing process. Could you give more information on the precise training setup that is being used in your experiments? \n3. One of the contributions is leveraging REPLAY to provide efficient metagradient computations. However, there are no results that highlight the overhead of crafting these optimized canaries. The tradeoffs between this and random canaries is not made clear i.e., why bother with optimized canaries when random canaries could be good enough for the amount of compute needed? How practical is the suggested attack?\n4. There are no results on differing privacy budgets or different datasets which limits how strong a conclusion to takeaway on the current set of results. Does your approach work well for auditing other datasets and model architectures?\n5. How do the learned canaries look? Are they diverse or do they collapse to similar patterns as random noise? How are canaries initialized?\n6. The paper dedicates a substantial portion of space to reviewing prior work and setup (~6 pages), leaving only a little room for the proposed method and the experimental results. It would be beneficial to provide more space for the technical details and additional experiments.\n\n[1] Nasr, Milad, et al. \"Tight auditing of differentially private machine learning.\" 32nd USENIX Security Symposium (USENIX Security 23). 2023.\n\n[2] Maddock, Samuel, Alexandre Sablayrolles, and Pierre Stock. \"Canife: Crafting canaries for empirical privacy measurement in federated learning.\" arXiv preprint arXiv:2210.02912 (2022).", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper is well-presented and clearly situates itself within the literature of DP (black-box) auditing and canary-based attacks.\n- The explicit focus on last-iterate black-box auditing is an important and practically relevant problem and the idea of using optimized canaries to audit in this setting is an open problem.", "weaknesses": "- Empirical results are limited as only a single dataset (CIFAR10) is used alongside one non-DP experiment and one DP setting (with epsilon=8). It remains unclear how these gains using optimized canaries generalize to other datasets or differing privacy budgets, particularly high-privacy regimes.\n- The paper claims efficiency of the canary optimization approach (using REPLAY) but does not quantify these overheads empirically or otherwise.\n- This idea of using optimized canaries seems a straightforward extension of attacks in alternative settings (white-box auditing).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LGk8HqskEY", "reviewer": "Reviewer_Vbyr", "summary": "Differential privacy (DP) is a privacy measure of a mechanism - a randomized function from a set of data points to some output. Its privacy is measured by the ability of an adversary to distinguish between two possible input datasets differing in a single element (referred to as neighbors), based on a single output of the mechanism. The better the privacy, the close is the success rate of the most sophisticated analyst to a random guess.\nThis framing as an hypothesis testing naturally lends itself to an empirical lower bound scheme; select two neighboring datasets, repeatedly run the mechanism on one one of the two datasets selected at random, and guess the identity of the used dataset based on the mechanism's output. The more accurate the guesser, the lower the privacy. Recently, a more efficient method has emerged, where rather than repeating many time the experiment to determine a change in a single element, the mechanism is called once and the auditing attempts to identify the participation of many elements, but the general idea remains.\n\nNaturally, such auditing can only provide a lower bound, since DP is a worst-case property, bounding the privacy loss of *any* neighboring datasets against *any* guesser. As a result, a tight lower bounds requires selecting \"easy to distinguish\" elements (referred to as canaries), which increase the success rate of the guesser. This work considers a new method for curating such canaries using meta-gradient optimization, where a hyper parameter of the optimization process (e.g., learning rate) is optimized via GD, by propagating the gradient through the entire learning process. The authors propose a somewhat simplified attack which is differentiable, and show that using it top curate gradients improves the auditing results.", "questions": "Can the authors address my main concern, lack of comparison to other canary curation methods discussed in the literature, such as the ones mentioned by the authors and in [1] (the black-box case)?\n\n[1] Nasr, Milad, et al. \"Adversary instantiation: Lower bounds for differentially private machine learning.\" 2021 IEEE Symposium on security and privacy (SP). IEEE, 2021.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "* This work addresses a known challenge, achieving a tighter lower bound in DP auditing by optimizing the choice of canary(es).\n* It achieves this goal using the natural and novel (in this context, to the best of my knowledge) method of meta-gradients.\n* The authors empirically back their idea by several experiments.\n* The presentation is clear and detailed.", "weaknesses": "While the idea of using meta-gradients for canaries optimization seems promising, the implementation considered in this work seems over simplified, and the empirical comparison does not support the claims of meaningful improvement. Concretely, the Surrogate objective function (Eq. 3) captures a naive auditing method which relies only of the change in loss, which is one of the weakest auditing techniques even in the context of black-box auditing. Furthermore, the authors only compare their results to two of the weakest methods for canaries curation - random choice or elements from the underlying distribution or random elements with random labels. The existing literature contains many advanced canary curation methods, some of which were mentioned in the related work section, and without proper comparison it is impossible to asses the contribution of this work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)