# Privacy Auditing in Differential Private Machine Learning:
## 5 Discussion and Future Research
This may not reflect real-world scenarios where attackers have limited access, which can lead to an overestimation of privacy risks. Practical implementations of algorithms with varying levels of privacy often contain subtle vulnerabilities, making it difficult to audit at scale, especially in federated environments [118]. The results of model inversion audits can be complex and may require expert interpretation to fully understand their implications. This complexity can hinder the effective communication of results to stakeholders who may not have a technical background [48]. While model inversion attacks are effective in detecting certain vulnerabilities, they may not cover all aspects of privacy auditing. While DP is an effective means of protecting the confidentiality of data, it has problems preventing model inversion attacks in regression models [136]. Other types of privacy violations may not be captured by this method, resulting in an incomplete overview of the overall security of a model. Future research could investigate the implementation of DP at the class and subclass level to strengthen defenses against model inversion attacks. These approaches could enable more granular privacy guarantees that protect sensitive attributes related to specific data classes while enabling useful model outputs [58]. The use of the stochastic gradient descent (SGD) algorithm as a strategic approach to address the challenge of selecting an appropriate value for the privacy budget shows a possible future application of model inversion to optimize privacy budget selection. There may be a trend towards dynamic privacy budgeting, where the privacy budget is adjusted in real time based on the context and sensitivity of the data being processed. This could help to better balance the trade-off between privacy and utility, especially in scenarios that are prone to model inversion attacks [136]. Model extraction attacks pose a significant privacy risk, even when DP mechanisms are used [101]. These attacks aim to replicate the functionality of a target model by querying it and using the answers to infer its parameters or training data. Model extraction attacks can derive the parameters of a machine-learning model through public queries [209]. Even with DP, which adds noise to the model outputs to protect privacy, these attacks can still be effective. For example, the adaptive query-flooding parameter duplication (QPD) attack can infer model information with black-box access and without prior knowledge of the model parameters or training data [212]. Current trends in privacy auditing in the context of DPML show that the focus is on developing efficient, effective frameworks and methods for evaluating privacy guarantees. As the field continues to advance, ongoing research is critical to refine these auditing techniques and schemes, address the challenges related to the privacy-utility trade-off, and improve the practical applicability of DPML systems in real-world settings. We hope that this article provides insight into privacy auditing in both local and global DP. Conceptualization, I.N., K.S. and K.O. ; methodology, I.N. ; formal analysis, I.N. ; investigation, I.N. ; resources, I.N. ; writing--original draft preparation, I.N. ; writing--review and editing, K.S., A.N. and K.O. ; project administration, K.O. ; funding acquisition, K.O. All authors have read and agreed to the published version of the manuscript. This work is the result of activities within the \"Digitalization of Power Electronic Applications within Key Technology Value Chains\" (PowerizeD) project, which has received funding from the Chips Joint Undertaking under grant agreement No. 101096387. The Chips-JU is supported by the European Union's Horizon Europe Research and Innovation Programme, as well as by Austria, Belgium, Czech Republic, Finland, Germany, Greece, Hungary, Italy, Latvia, Netherlands, Spain, Sweden, and Romania. Not applicable. The authors declare no conflicts of interest.