# Privacy Auditing in Differential Private Machine Learning:
## 3 Privacy Attacks
### White-Box vs. Black-Box Attacks  
Depending on the capability and knowledge of the attacker and the analysis of potential information leaks in DPML models, they are generally divided into two main areas: black-box and white-box attacks (also known as settings) [84; 95]. If the attacker has full access to the target model, including its architecture, training algorithm, model parameters, hyperparameters, gradients, and data distribution, as well as outputs and inputs, we speak of white-box attacks. On the other hand, if an attacker evaluates the privacy guarantees of differential private mechanisms without accessing their internal workings and only has access to the output of the model with arbitrary inputs, it is a black-box attack [26; 48]. In this type of attack, the attacker can only query the target model and obtain the outputs, typically confidence scores or class labels.  
**White-box privacy attacks**[96; 97], in the context of DP, involve scenarios where the attacker has full access to the model parameters, architecture, and training data. The attacker can exploit this detailed knowledge to create an attack model that predicts whether specific records were part of the training dataset based on internal model behavior. Usually, the attacker tries to identify the most vulnerable space (e.g., the feature space) of the target model by using the available information and modifying the inputs. They may also analyze gradients, loss values, or intermediate activations to derive insights of information status. [PERSON] et al. [96], for example, focus on implementing a white-box scenario where the attacker has full access to the weights and outputs of the target model. If this is the case, we can speak of the strong capability of the attacker on the model. [PERSON] et al. [48] implement white-box auditing in their auditing framework, where the attacker has access to all intermediate values.  
**Black-box privacy attacks**[84; 95] involve scenarios in which the attacker has limited access to a ML model, typically only being able to observe and retrieve its output for specific inputs. This means that the attacker has no knowledge of the internals of the target model. In this scenario, the vulnerabilities of the model are identified using information about the past input/output pairs. Most black-box attacks require the presence of a predictor [84]. In black-box environments, only the predicted confidence probabilities or hard labels are available [97]. In privacy auditing through black-box access, the attacker only sees the final model weights or can only query the model [96]. Black-box attacks are also used to detect privacy violations that exploit vulnerabilities in differential privacy algorithms and lead to privacy violations [26].  
**Grey-box privacy attacks in DPML** represent a middle ground between white-box and black-box attacks, where the attacker has limited access to the model's internals. This type of attack occurs when an attacker has some knowledge of the model, such as to specific parameters or layers, but not to the complete internal workings.  
Attacks on collaborative learning assume access to the model parameters or the gradients during training or deal with attacks during inference. In cases where the attacker has partial access, these are called _grey-box attacks_ (partial white-box attacks) [98; 99]. We consider attackers to be _active_ if they interfere with the training in any way. On the other hand, if the attackers do not interfere with the training process and try to derive knowledge after the training, they are considered _passive_ attackers. It is important to add here that most work assumes that the expected input is fully known, although some preprocessing may be required.