# Privacy Auditing in Differential Private Machine Learning:
## 1 Introduction  
In today's data-driven world, more and more researchers and data scientists are using machine learning to develop better models or more innovative solutions for a better future. These models often tend to use sensitive (e.g., health-related personal data and proprietary data) [1] or private data (e.g., personal identifiable information, such as age, name, and user input data), which can lead to privacy issues [2]. When using data containing sensitive information, the individual's right to privacy must be respected, both from an ethical and legal perspective [3]. The functionality of privacy modeling for the privacy landscape ranges from descriptive queries to training large machine-learning (ML) models with millions of parameters [4]. Moreover, ML subsets of deep-learning algorithms can analyze and process large amounts of data collected from different users or devices to detect unusual patterns [5]. On the other hand, ML systems are exposed to several serious vulnerabilities. This logically leads to the consideration that training ML models are vulnerable to privacy attacks. Therefore, it is crucial for the practical application of ML models and algorithms to protect the privacy of input datasets, training data, or data that must be kept secret during inference. Numerous works have shown that data and parameters of ML models can leak sensitive information about their training, for example, in statistical modeling [6, 7, 8, 9]. There are several causes of data leakage, such as overfitting and influence [10], model architecture [11], or memorization [12]. If your personal or important data are used to trainan ML model, you may want to ensure that an intruder cannot steal your data. To measure and reduce the likelihood of sensitive data leakage, there are various mitigation and protection strategies. A robust framework for protecting sensitive data in statistical databases, especially through mechanisms such as noise addition and gradient clipping, is a proven mathematical framework called _differential privacy (DP)_[2; 13]. The core idea of DP is to add noise to the data or model parameters to obscure an individual's influence on a data release [14], where _the unit of privacy_ characterizes what you are trying to protect. To clarify DP, it must be provably guaranteed that an attacker is not able to reliably predict whether or not a particular individual is included in the dataset. Consequently, such an approach can provide a strong privacy guarantee for individuals. In this context, DP is a powerful privacy-preserving tool to prevent sensitive information about an individual from being revealed in a variety of ML models and to analyze the privacy of/from the training data. The integration of DP methods into ML models makes them more robust to privacy attacks and paves the way for _differential private machine learning (DPML)_[15; 16; 17; 18]. In this regard, ML models using DP algorithms could guarantee that each user's contribution to the dataset does not result in a significantly different model [19]. However, the advantages of ML models' accuracy with DP's strong privacy guarantees and ease of decentralization [20] come with a price [21], especially when aiming for a low-privacy parameter [22]. For example, models trained with the Differentially Private Stochastic Gradient Descent (DP-SGD) privacy algorithm [23] show a significant decrease in accuracy compared to non-DP models [24; 25]. The main reason for this could be that the privacy analysis of existing DPML methods and algorithms (e.g., DP-SGD) is overly cautious in real-world scenarios. Ensuring privacy in DPML raises the following key questions: How can we guarantee the privacy of the model? Does our model reveal private information? What level of differential privacy does an algorithm satisfy? Answering these questions is crucial, because overestimating the privacy guarantee leads to a decrease in the accuracy of the model, while underestimating it leads to a privacy leakage [26].