# Privacy Auditing in Differential Private Machine Learning:
## 5 Discussion and Future Research  
This paper presents the current trends in privacy auditing in DPML using membership inference, data poisoning, model inversion attacks, model extraction attacks, and property inference. We consider the advantages of using membership inference for privacy auditing in DPML models through quantification of privacy risk, empirical evaluation, improved audit performance, and guidance for privacy parameter selection. MIAs can effectively quantify the privacy risk (the amount of private information) that a model leaks about individual data points in its training set. This makes them a valuable tool for auditing the privacy guarantees of DP models [41]. They provide a practical lower bound on inference risk complementing the theoretical upper bound of DP [16]. MIAs enable an empirical evaluation of privacy guarantees in DP models, helping to identify potential privacy leaks and implementation errors [160]. They can be used to calculate empirical identifiability scores that enable a more accurate assessment of privacy risks [34]. Advanced methods that combine MIAs with other techniques, such as influence-based poisoning attacks, have been shown to provide significantly improved audit performance compared to previous approaches [61]. MIAs can help in selecting appropriate privacy parameters (\(\varepsilon\), \(\delta\)) by providing insights into the trade-off between privacy and model utility [11, 163]. These attacks require relatively weak assumptions about the adversary's knowledge, making them applicable in different scenarios. This flexibility allows for broader applicability in real-world settings where attackers may have limited information about the mode [46]. We consider the drawbacks of using membership inference for privacy auditing in DPML models as impacting model utility, parameter selection complexity, and non-uniform risk across classes. Implementing DP to defend against MIAs often leads to a trade-off in which increased privacy leads to lower model accuracy [217]. Excessive addition of noise, which is required for strong privacy guarantees, can significantly degrade the utility of the model, especially in scenarios with imbalanced datasets. Choosing the right privacy parameters is challenging due to the variability of data sensitivity and distribution, making it difficult to effectively balance privacy and utility [35]. Legal and social norms for anonymization are not directly addressed by different privacy parameters, adding to the complexity. Some MIA methods, especially those that require additional model training or complex computations, can entail a significant computational overhead [96]. The development of robust auditing tools that can provide empirical assessments of privacy guarantees in DP models is crucial. These tools should take into account real-world data dependencies and provide practical measures of privacy loss [34]. Future research should focus on adaptive privacy mechanisms that can dynamically adjust privacy parameters based on the specific characteristics of the training data and the desired level of privacy. Using data poisoning to audit privacy in DP provides valuable insight into vulnerabilities and helps quantify privacy guarantees, thus improving the understanding of the robustness of models. Data-poisoning attacks can reveal vulnerabilities in DP models by showing how easily an attacker can manipulate training data to influence model outputs. This helps identify vulnerabilities that are not obvious through standard auditing methods [46]. Data poisoning can help evaluate the robustness of DP mechanisms against attacks by attackers. By understanding how models react to poisoned data, we can improve their design and implementation [61]. By using data-poisoning techniques, auditors can quantitatively measure the privacy guarantees of differentially private algorithms [2]. This empirical approach complements theoretical analyses and provides a clearer understanding of how privacy is maintained in practice [43].