# Privacy Auditing in Differential Private Machine Learning:
## 1 Introduction
**Privacy auditing--**the process of testing privacy guarantees--relies on multiple model training runs in different privacy configurations to effectively detect privacy leakage [39,40]. There are many reasons why one would want to audit the privacy guarantees of a privately differentiated algorithm. First, if we check and the audited value of \(\epsilon\) is greater than the (claimed) upper bound, the privacy proof is false, and there is an error or bug in our algorithm [34,41]. Second, if we audit and the audited value of \(\epsilon\) matches, then we can say that our privacy proof is a tight privacy estimate or tight auditing, and our privacy model does not need to be improved [42]. Tight auditing refers to the process of empirically estimating the privacy level of a DP algorithm in a way that closely matches its theoretical privacy guarantees. The goal is to obtain an accurate estimate of the actual privacy provided by the algorithm when applied to real-world data. Existing auditing scenarios for DP suffer from the limitation that they provide narrow estimates under implausible worst-case assumptions and that they require thousands or millions of training runs to produce non-trivial statistical estimates of privacy leakage [43]. Third, if we are unable to rigorously prove how private our model is, then auditing provides a heuristic measure of how private it is [44]. In practice, the differential privacy audit [45, 46, 47, 48, 49, 50] of ML modeling has been proposed to empirically measure and analyze the privacy leakage through the DPML algorithm. To investigate and audit the privacy of data and models, you must first apply a specific type of attack, called privacy attack, to a DP algorithm and then perform an analysis, for example, a statistical calculation. To evaluate data leakage in ML, we categorize privacy attacks into membership inference attacks [51, 52, 53], data-poisoning attacks [54,55], model extraction attacks [56,57], model inversion attacks [58,59], and property inference attacks [60]. In addition, assumptions must be made about the attacker's knowledge and ability to access the model in either black-box or white-box settings. Finally, the attacker's success is converted into an \(\epsilon\), \(\delta\) estimate using an attack's evaluation procedure. The privacy attack, together with the privacy assessment, forms an auditing scheme. For example, most auditing schemes [46,47,61,62] have been developed for centralized settings. Motivation for the researchThe aim of this review paper is to provide a comprehensive and clear overview of the study of privacy auditing schemes issued in the context of differential private machine learning. The following aspects are considered:  
* The implementation of differential privacy in consumer-use cases makes greater privacy awareness necessary, thus raising both data-related and technical concerns. As a result, privacy auditors are looking for scalable, transparent, and powerful auditing methods that enable accurate privacy assessment under realistic conditions. * Auditing methods and algorithms have been researched and proven effective for DPML models. In general, auditing methods can be categorized according to privacy attacks. However, the implementation of sophisticated privacy auditing requires a comprehensive privacy-auditing methodology. * Existing privacy-auditing techniques are not yet well adapted to specific tasks and models, as there is no clear consensus on the privacy loss parameters to be chosen, such as \(\epsilon\), algorithmic vulnerabilities, and complexity issues. Therefore, there is an urgent need for effective auditing schemes that can provide empirical guarantees for privacy loss. ContributionsThis paper provides a comprehensive summary of privacy attacks and violations with practical auditing procedures for each attack or violation. The main contributions can be summarized as follows:  
* We systematically present types and techniques for privacy attacks in the context of differential privacy machine-learning modeling.