# Privacy Auditing in Differential Private Machine Learning:
## 4 Privacy Auditing Schemes
### Privacy Audits
#### 4.3.2 Differential Privacy Auditing with Data Poisoning  
**Data-poisoning auditing:** In data poisoning, \"poisoned\" data are introduced into the training dataset to observe whether they influence the model predictions and worsens the data protection guarantees. The auditor simulates various data poisoning scenarios by inserting manipulated samples that distort the data distribution. The main scenarios that have been considered in the data poisoning auditing literature are adversarial injection of data points, _influence function analysis_, manipulation of gradients in DP training, empirical evaluation of privacy loss \(\epsilon\), simulation of worst-case poisoning scenarios, and privacy violations. **Influence function analysis** is a statistical tool that helps to identify whether specific data points have an excessive influence on the model used to measure the effect on model's predictions, indicating possible poisoning. They provide a way to estimate how much specific training samples influence the model's behavior without needing to retrain the model. The seminal work by [PERSON] and [PERSON] [187] provides a robust framework for influence functions to analyze and audit the predictions made by black-box ML models. It introduces techniques for measuring the influence of individual training points on model predictions,setting the stage for analyzing poisoning attacks. The authors utilize first-order Taylor approximations to derive influence functions. This method is particularly useful for diagnosing issues related to model outputs. [PERSON] et al. [61] audit the tightness of DP algorithms using _influence-based poisoning_ to detect privacy violations and understand information leakage. They manipulate the training data to influence the output of the model and thus violate privacy guarantees. Their main goal is to verify the privacy of a known **mechanism** whose inner workings may be hidden. To understand how poisoned gradients can influence privacy guarantees, _the gradient manipulation is used in DP training._ By monitoring gradients, auditors can detect anomalies due to poisoned inputs, as these may cause the differentially private model to exhibit non-robust behavior. [PERSON] et al. [188] investigate the potential for reconstructing training data from gradient leakage analysis during the training of neural networks. The reconstruction problem is formulated as a series of optimization problems that are solved iteratively for each layer of the neural network. An important contribution that this work makes is the proposal of a metric to measure the security level of DL models against gradient-based attacks. The seminal paper [PERSON] et al. [189] investigate the impact of gradient manipulation on both privacy guarantees and model accuracy relevant to DP auditing in federated learning. [PERSON] and [PERSON] [190] focus on the interaction of gradient manipulation with privacy and proposed ways to improve the robustness of the model under these attacks. [PERSON] et al. [54] establish complementary relationships between data poisoning and differential privacy by using _a small-scale and a large-scale data-poisoning attack_ based on the gradient ascend of logistic regression parameters \(\theta\) with respect to \(x\) to reach target \(\theta^{*}\). They evaluate the attack algorithms on two private learners targeting an objective perturbation and an output perturbation. They show that differentially private learners are provably resistant to _data-poisoning attacks_, with the protection deceasing exponentially as the attacker poisons more data. [PERSON] et al. [46] investigate privacy vulnerabilities in DP-SGD, focusing on the question of whether the theoretical privacy guarantees hold under real-world conditions. The DP-SGD algorithm was audited by simulating a model-agnostic clipping-aware _poisoning attack_ (ClipBKD) in black-box settings on logistic regression and fully connected neural network models. The models were initialized, such that the initial parameters were set for the average case.