# Privacy Auditing in Differential Private Machine Learning:
## 4 Privacy Auditing Schemes
### Privacy Audits
#### 4.3.5 Differential Privacy Auditing Using Property Inference  
Auditing DP with property inference attacks typically focuses on extracting global features or statistical properties of a dataset used to train ML model, such as average age, frequency of diseases, or frequency of geographic locations, rather than specific data records to reveal sensitive information. The goal is to ensure that the DP mechanisms effectively prevent attackers from inferring sensitive characteristics even if they have access to the model outputs. The auditor checks whether the model reveals statistical properties of the training data that could violate privacy. The literature review on the property inference for differential privacy auditing presents different scenarios, such as evaluating property sensitivity with model outputs and attribute-based simulated worst-case scenarios. **Evaluating property sensitivity with model outputs** test how well the DP obscures statistical dataset properties. Auditors analyze the extent to which an attacker could infer information at the aggregate or property level by examining model outputs across multiple queries. For example, changes in the distribution of outputs when querying specific demographics can reveal hidden patterns. **An attribute-based simulation of a worst-case scenario** is a case in which an attacker has partial information on certain attributes of the dataset. Auditors test the DP model by combining partially known data (e.g., location or age) with the model's predictions to see if the model can reveal other attributes. This type of adversarial testing helps validate DP protections against more informed attacks. [PERSON] et al. [213] introduce the concept of distribution inference attacks in both white-box and black-box models, which motivated later DP studies to counteract these vulnerabilities. This type of inference attack aims to uncover sensitive properties of the underlying training data distribution, potentially exposing private information about individuals or groups within the dataset. The authors discuss auditing information disclosure at three granularity levels: distribution, user, and record level. This multifaceted approach allows for a comprehensive evaluation of privacy risks associated with ML models. [PERSON] et al. [214] show how property inference attacks on attributes can reveal the characteristics of datasets even when neural networks use DP. The authors introduce an approach for inferring properties that a model inadvertently memorizes, using both synthetic and real-world datasets. [PERSON] et al. [215] focus on collaborative learning using property inference in the context of shared model updates, focusing in particular on how _unintended feature leakage_ can jeopardize privacy. By analyzing the model's outputs, the author identify which features can leak information and which features contribute to the privacy risks. They introduce a method for inferring sensitive attributes that may only apply to subgroups, thereby revealing potential privacy vulnerabilities. Property inference attacks, in this case, rely on the detection of sensitive features in the training data. Attackers can exploit the linear property of queries to obtain multiple responses from DP mechanisms, leading to unexpected information leakage [215]. [PERSON] and [PERSON] [215] address critical concerns about the limits of differential privacy (DP), especially in the context of linear queries. They show how the inherent linear properties of certain queries can lead to unexpected information leaks that undermine the privacy guarantees that DP is supposed to provide. [PERSON] et al. [216] investigate how the implementation of differential privacy can reduce the likelihood of successful property inference attacks by obscuring the relationships between the model parameters and the underlying data properties. [PERSON] et al. [217] provide a comprehensive evaluation of privacy attacks on ML models, including property inference attacks.