# Privacy Auditing in Differential Private Machine Learning:
## 4 Privacy Auditing Schemes
### Privacy Auditing in Differential Privacy  
Testing and evaluating DPML models are important to ensure that they effectively protect privacy while retaining their utility. Since differential privacy is always a trade-off between privacy and utility, evaluating the privacy of the model helps in choosing an appropriate privacy budget. A privacy budget that is high enough to ensure sufficient accuracy and a budget that is low enough to ensure acceptable privacy. Which level of accuracy and/or privacy is sufficient depends on the application of the model [130]. To address the security-critical privacy issues [156] and detect potential privacy violations and biases, the privacy auditing procedures can be implemented to empirically evaluate DPML.  
Privacy auditing is a set of techniques for empirically verifying _the privacy leakage of an algorithm_ to ensure that it fulfils the defined privacy guarantees and standards. Privacy auditing of DP models [45; 46; 47; 157; 158] aims to ensure that privacy-preserving mechanisms are effective, reliable and provide _the privacy guarantees_ of DPML models and algorithms. For example, one approach is to use a probabilistic automation model to track privacy leakage bounds [159]; and another uses canaries to audit ML algorithms [160], efficiently detects \((\epsilon,\delta)\)-violations [48], estimates privacy loss during a single training run [118], or transforms \((\epsilon,\delta)\) into Bayesian posterior belief bounds [34]. To ensure robust privacy auditing in differential privacy (DP), it is important to follow the key steps that rigorously attack the machine-learning model and verify privacy guarantees:  
**Define the scope of the privacy audit:** Establish the objectives and purposes of the audit. This includes determining which specific mechanisms or algorithms are to be evaluated and determining the privacy guarantees \((\epsilon,\delta)\) that are relevant for the audit.  
Clear delineation of the privacy guarantees expected by the DP model (differential privacy mechanisms), the definition of data protection requirements that are tailored to the sensitivity of the data, compliance with standards, and the justification of the privacy parameters, \(\epsilon,\delta\) (upper bound), are required. For example, the authors of [161] describe a privacy auditing pipeline that is divided into two components: the attacker scheme and the auditing scheme.  
**Perform privacy attacks and vulnerability implementation**: Implement privacy attacks (e.g., membership inference, model extraction, and model inversion) to evaluate the robustness of the DP mechanism or DPML algorithm. It means to providing robust privacy guarantees for a DP mechanism that effectively limit the amount of information that can be inferred about individual data points, regardless of a potential attacker's strategy or the configuration of the dataset. For example, simulate black-box or white-box membership inference [162; 163] to assess the impact of model access on privacy leakage. This gives us the opportunity to test the resilience of the model and measure the success/failure rates of these attacks.  
**Analyze and interpret the audit results:** The final step is to empirically estimate the privacy leakage from a DPML model, denoted as \(\epsilon_{emp}\), and compare it with the theoretical privacy budget, \(\epsilon\)[81]. An important goal of this process is the assessment of the tightness of the privacy budget. The audit is considered tight if the privacy parameter is \(\epsilon_{emp}\approx\epsilon\). Such an approach can be used to effectively validate DP implementations in the model or to detect DP violations in case of \(\epsilon_{emp}>\epsilon\)[164; 165; 166].