# Privacy Auditing in Differential Private Machine Learning:
## 1 Introduction
To prevent privacy leakage from ML models, we use a DP framework that adds a calculated amount of noise or randomness to hide each individual's contribution to the data, thus reducing the risk of privacy leakage from small changes in a dataset [27]. A common approach is to add noise to the data during the training process [28]. The process of determining how to add noise is called mechanism in the context of DP and can be influenced by several factors, including the specific noise distribution (e.g., Laplacian and Gaussian mechanisms), the desired level of the privacy, and the type of query. DP can also facilitate effective data-partitioning strategies when sensitive information is distributed across multiple datasets or partitions. By ensuring that each portion adheres to DP standards, organizations can analyze aggregated data without compromising individual privacy. These strategies are used, for example, when data cannot be centralized due to privacy concerns (e.g., federated learning) [29]. There are other approaches where noise is added to the inputs, outputs, ground truth labels, or even to the whole model [30]. As a result, the algorithm can still learn from the data and make accurate predictions about decisions. Adding noise provides a strong _worst-case privacy guarantee_ for ML algorithms [31]. Moreover, there is a crucial technique in the DP context--gradient clipping, which is used in training ML models. It helps to ensure that the contribution of individual data points to the model's gradients remains bounded, improving privacy guarantees while preserving the performance of the model. The purpose of gradient clipping is twofold. First, bounding the gradients reduces the sensitivity of the model output to individual training examples, as doing so is essential for ensuring DP. Second, gradient clipping helps prevent overfitting by avoiding extreme updates that could lead to the memorization of specific data points. Although DP is a formalization stating that a query should not reveal that an individual is present in a trained dataset. It should be noted that there are recent approaches in which ML models are trained non-privately and their predictions are de-noised before being released to satisfy DP [32]. This means that DP gives the user a quantitative guarantee of how distinguishable an individual's information can be to _a potential attacker_. Differential privacy [2,33] ensures that running the algorithm on two adjacent datasets, \(D\) and \(D^{\prime}\), results in two approximately equal distributions that differ in one data point, and that the two distributions are approximately equal. The privacy level is often characterized by the privacy parameters (also known as privacy risk): \(\epsilon\), i.e., the privacy loss; and \(\delta\), i.e., the probability of deviation from the privacy guarantee. Together, these parameters form a mathematical framework for quantifying privacy and allow the fine-tuning the privacy level to balance data utility and privacy concerns. Choosing appropriate privacy parameters is challenging but crucial, as weak parameters can lead to excessive privacy leakage, while strong parameters can compromise the utility of the model utility [34]. A small \(\epsilon\) ensures that an attacker cannot reliably distinguish whether the algorithm has processed \(D\) or \(D^{\prime}\); that is, it provides strong privacy but less accuracy. Meanwhile, a large \(\epsilon\) provides weaker privacy guarantees [35,36]. This parameter controls the trade-off between privacy and utility. Since there are no guidelines on how to set the right amount of \(\epsilon\) and \(\delta\) in practice, this can be a challenging process. Even when implemented correctly, there are several known cases where published DP algorithms with miscalculated privacy guarantees incorrectly report a higher level of privacy [37,38]. In order to provide the expected privacy guarantees for the DPML model, the privacy auditing must be used.