# Privacy Auditing in Differential Private Machine Learning:
## 4 Privacy Auditing Schemes
### Privacy Audits
#### 4.3.4 Differential Privacy Auditing Using Model Extraction  
When auditing DPML models using model extraction attacks, auditors evaluate how resistant a DP-protected model is to extraction attacks, where an attacker attempts to replicate or approximate the model by querying it multiple times and using the outputs to train a surrogate. This form of auditing is essential to verify that DP implementations truly protect against unintentional model replication, which can jeopardize privacy by allowing the attacker to learn sensitive information from the original model. The main scenarios that have been considered in the literature for auditing model extractions are _query analyses_. **Query analyses** measure the extent to which queries can reveal model parameters or behaviors. Auditors simulate extraction attacks by extensively querying the model and analyzing how well they can replicate its outputs or decision boundaries. [PERSON] et al. [101] show that embeddings can reveal private data, advancing research on the robustness of embeddings for DP models. [PERSON] et al. [209] require users to perform computational tasks before accessing model predictions. The proposed calibrated Proof of Work Mechanism (PoW) can deter attackers by increasing the model extraction effort and creating a balance between robustness and utility. Their work contributes to the broader field of privacy auditing by proposing proactive defenses instead of reactive measures in ML applications. [PERSON] et al. [210] investigate a novel personalized local differential mechanism to defend against _the equation-solving attack_ and _query-based attacks_ (solving for model parameters through multiple queries) by querying the model multiple times to solve for the model parameters. The authors concluded that this method is particularly effective against regression models and can be mitigated by adding high-dimensionality Gaussian noise to model coefficients. [PERSON] et al. [146] use the active verification two-stage privacy auditing method to detect suspicious users based on the query patterns and verifying if they are attackers. By analyzing how well the queries cover the feature space of the victim model, it can detect potential model extraction. Once suspicious users are identified, an active verification module is employed to confirm whether these users are indeed attackers. Their proposed method is particularly useful for object detection models through innovative use of feature space analysis and perturbation strategies. [PERSON] et al. [211] propose a novel privacy preserving mechanism, Boundary Differential Privacy (\(\epsilon\)-BDM), which modifies the output layer of the model. BDP is designed to introduce carefully controlled noise around the decision boundary of the model. This method guarantees that an attacker cannot learn the decision boundary of two classes with a certain accuracy, regardless of the number of queries. The special layer, the so-called Boundary DP layer that applies differential privacy principles was implemented in the ML model. By integrating BDP into this layer, the model produces an output that preserves privacy around the boundary and effectively obscures information that could be exploited in extraction attacks. This boundary randomized response algorithm was developed for binary models and can be generalized to multiclass models. The extensive experiments ([PERSON] et al., 2022) [18] have shown that BDP obscures the prediction responses with noise and thus prevents attackers from learning the decision boundary of any two classes, regardless of the number of queries issued. [PERSON] et al. [212] propose an alternative to caching the BDP layer in which privacy loss is adapted accordingly. The authors propose an adaptive query-flooding parameter duplication (QPD) extraction attack that allows the auditor to infer model information with black-box access and without prior knowledge of the model parameters or training data.