# Privacy Auditing in Differential Private Machine Learning:
## 2 Preliminaries
### Differential Privacy Fundamentals
If the loss is negative, the attacker chooses dataset \(D^{\prime}\). If the loss magnitude is large, there is a _privacy violation_. **Hypothesis test interpretation of DP**[70]: DP can be interpreted as a hypothesis test with the null hypothesis that \(\mathcal{M}\) was trained on \(D\) and the alternative hypothesis that \(\mathcal{M}\) was trained on \(D^{\prime}\). False-positive result (type-I error) is the probability of rejecting the null hypothesis when it is true, while false-negative result (type-II errors) is the probability of failing to reject the null hypothesis when the alternative hypothesis is true. For example, [PERSON] et al. (2015) characterised \((\epsilon,\delta)\)-DP in terms of the false-positive rate (FPR) and false-negative rate (FNR) that can be achieved by an acceptance region. This characterisation enables the estimation of the privacy parameters as follows:  
\[\frac{TPR-\delta}{FPR}<e^{\epsilon}, \tag{4}\]  
Furthermore, from the hypothesis testing perspective of hypothesis testing [66] ([PERSON] et al., 2020), the attacker can be viewed as performing the following hypothesis testing problem given the output of either \(\mathcal{M}(D)\) or \(\mathcal{M}(D^{\prime})\) :  
\(H_{0}\): The underlying dataset is \(D\). \(H_{0}\): The underlying dataset is \(D^{\prime}\). In other words, for a fixed type I error, \(\alpha\), the attacker tries to find a rejection rule, \(\phi\), that minimises the type II error, \(\beta\). **Private prediction interface**[71]: A prediction interface, \(M\), is \(\epsilon\)-differential private if for any interactive query generating algorithm, \(Q\), the output (\(Q\leftrightarrows M(F)\)) is \(\epsilon\)-differential private with respect to model \(F\), where (\(Q\leftrightarrows M(F)\)) denotes the sequence of queries and responses generated in the interaction of \(Q\) and \(M\) on model \(F\). **Renyi DP (RDP)**[72]: This DP extends the standard concept of DP by allowing for a continuum level based on the Renyi divergence. In RDP a randomized mechanism, \(\mathcal{M}\), satisfies (\(\alpha\), \(\overline{\epsilon}\))-RDP if for all neighbouring datasets, \(D\) and \(D^{\prime}\), the Renyi divergence of order \(\alpha\) between the distribution of the outputs of the algorithm on \(D\) and \(D^{\prime}\) is bounded by \(\epsilon\):  
\[\mathcal{D}_{\alpha}\big{(}\mathcal{M}(D)\big{|}\big{|}\mathcal{M} \big{(}D^{\prime}\big{)}\leq\overline{\epsilon} \tag{5}\]  
**The global sensitivity of a function**[66]: The sensitivity, \(\Delta f\), of a function is the _maximum absolute distance_ between scalar outputs, \(\Delta f(D)\) and \(f(D^{\prime})\), over all possible adjacent datasets, \((D)\) and \((D^{\prime})\):  
\[\Delta f=max_{D,\;D^{\prime}}\big{|}\Delta f(D)-f\big{(}D^{\prime} \big{)}| \tag{6}\]  
If the query dimension of the function \(d=1\), the sensitivity of function \(f\) is the maximum difference between the values that \(f\) may take on a pair of the adjacent datasets. **Differential privacy mechanisms. ** One way to achieve \(\epsilon\)-DP and \((\epsilon,\delta)\)-DP is to add noise sampled from Laplace and Gaussian distributions, respectively, where the noise is proportional to the sensitivity of the mechanism. In general, there are three main mechanisms for adding noise to data used in DP, namely the Laplace mechanism [2; 73; 74], the Gaussian mechanism [66; 75; 76], and the exponential mechanism [13]. It should be noted that the Laplace mechanism provides \(\epsilon\)-DP and focuses on tasks that return numeric results. The mechanism achieves privacy via output perturbation, i.e., modifying the output with Laplace noise. The Laplace distribution has two adjustable parameters, its centre and its width, \(b\). The Gaussian mechanism yields \((\epsilon,\delta)\)-DP. Considering the proximity of the original data, the Laplace mechanism would be a better choice than the Gaussian mechanism, which has a more relaxed definition.