# Privacy Auditing in Differential Private Machine Learning:
## 4 Privacy Auditing Schemes
### Privacy Audits
#### 4.3.3 Differential Privacy Auditing with Model Inversion  
This is a DPML model evaluation scheme that examines how much information about individual data records can be inferred from the outputs of the trained model (usually confidence score values or gradients) to understand the level of privacy leakage. The model is inverted to extract information. The auditing might be a white-box with access to gradients or internal layers or a black-box that only accesses the output labels. The main challenge in detecting model inversion attacks in differential privacy auditing is the need to prevent the inference of sensitive attributes of individuals from the shared model, especially in the context of black-box scenarios. The main scenarios that have been considered in the literature for model inversion auditing are _sensitivity analyses_, _gradient and weight analyses_, empirical privacy loss, and embedding and reconstruction tests. **Sensitivity analyses** quantify how much private information is embedded in the model's outputs that could potentially be reversed. Auditors evaluate gradients or outputs to determine how well they reflect the characteristics of the data. This analysis often involves running a series of model inversions to assess how DP mechanisms (e.g., DP-SGD) protect against the disclosure of sensitive attributes. [PERSON] et al. [100] present a seminal paper that introduces model inversion attacks that use _confidence scores_ from model predictions to reconstruct sensitive input data. It explores how certain types of models, even when protected with DP, can be vulnerable to model inversion attacks by revealing certain features. [PERSON] et al. [136]_analyze the vulnerability of existing DP mechanisms_. They use a functional mechanism method that perturbs the coefficients of the polynomial representations of the objective function balancing the privacy budget between sensitive and non-sensitive attributes to mitigate model inversion attacks. [PERSON] et al. [197] focuses primarily on collaborative learning settings, which is relevant to DP as it shows how generative adversarial networks (GANs) can be used for model inversion to reconstruct sensitive information, providing insights into potential vulnerabilities in DP-protected models. [PERSON] et al. [198] discuss how machine-learning models can memorize training data in a way that allows attackers to perform inversion attacks. The authors analyze scenarios in which DP cannot completely prevent leakage of private data features through inversion techniques. [PERSON] et al. [135] examine the vulnerability of existing DP mechanisms using a functional mechanism method. They propose a differential privacy allocation model. They optimize the regression model by adjusting the allocation of the privacy budget allocation within the objective function. [PERSON] et al. [199] introduce an individual _sensitivity metric_ technique like smooth sensitivity and sensitivity preprocessing to improve the accuracy of private data by reducing sensitivity, which is crucial for mitigating model inversion risk. **Gradient and weight analyses** show whether and how gradients expose sensitive attributes. By auditing gradients and weights, privacy auditors can check whether protected data attributes can be inferred directly or indirectly. Since model inversion often leverages gradients for black-box attacks, gradient clipping in DP-SGD helps mitigate exposure. Works such as that of [PERSON] et al. [200] investigate how model inversion can circumvent the standard DP defense by exploiting subtle dependencies in the model parameters. There are works that use _gradient-inversion attacks_. [PERSON] et al. [201] show that gradient information, i.e., minimizing the difference between the observed gradients and those that would be expected from the true input data commonly used in DP or federated learning, can reveal sensitive training data by inversion. It is shown how even with DP mechanisms, gradient-based inversion attacks can reconstruct data and thus pose a privacy risk.