mlsanityData to 7 Oct 2026

Auditing Differentially Private Machine Learning: How Private is Private SGD?

arXiv 2006.07709 ↗First posted 13 Jun 2020cs.CR cs.LGcited by 213

Not on the map. Why?

Cited by 47 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We investigate whether Differentially Private SGD offers better privacy in practice than what is guaranteed by its state-of-the-art analysis. We do so via novel data poisoning attacks, which we show correspond to realistic privacy attacks. While previous work (Ma et al., arXiv 2019) proposed this connection between differential privacy and data poisoning as a defense against data poisoning, our use as a tool for understanding the privacy of a specific mechanism is new. More generally, our work takes a quantitative, empirical approach to understanding the privacy afforded by specific implementations of differentially private algorithms that we believe has the potential to complement and influence analytical work on differential privacy.

Key facts. Cited by 213 papers in the map (data through 7 Oct 2026). First posted on arXiv 13 Jun 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 23; 2022: 41; 2023: 36; 2024: 46; 2025: 40; 2026: 27.

213 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks From First Principlescited by 839
  2. 2022Quantifying Memorization Across Neural Language Modelscited by 755
  3. 2023Extracting Training Data from Diffusion Modelscited by 723
  4. 2024TOFU: A Task of Fictitious Unlearning for LLMscited by 507
  5. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  6. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  7. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
  8. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 218
  9. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  10. 2021Practical and Private (Deep) Learning without Sampling or Shufflingcited by 169
  11. 2021Counterfactual Memorization in Neural Language Modelscited by 155
  12. 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 150
38 more
  1. 2022Reconstructing Training Data with Informed Adversariescited by 143
  2. 2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 137
  3. 2022The Privacy Onion Effect: Memorization is Relativecited by 128
  4. 2023Privacy Auditing with One (1) Training Runcited by 119
  5. 2022Measuring Forgetting of Memorized Training Examplescited by 118
  6. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  7. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  8. 2021Trustworthy AI: A Computational Perspectivecited by 93
  9. 2023Machine Unlearning: Solutions and Challengescited by 85
  10. 2023Membership Inference Attacks against Diffusion Modelscited by 84
  11. 2021A Study of Face Obfuscation in ImageNetcited by 83
  12. 2021Differential Privacy Dynamics of Langevin Diffusion and Noisy Gradient Descentcited by 71
  13. 2022Synthetic Data -- what, why and how?cited by 66
  14. 2021Privacy-Preserving Portrait Mattingcited by 60
  15. 2021Privacy-Preserving Machine Learning: Methods, Challenges and Directionscited by 58
  16. 2022AlexaTM 20B: Few-Shot Learning Using a Large-Scale Multilingual Seq2Seq Modelcited by 57
  17. 2021Property Inference From Poisoningcited by 56
  18. 2021Decentralized Federated Learning through Proxy Model Sharingcited by 56
  19. 2022TAPAS: a Toolbox for Adversarial Privacy Auditing of Synthetic Datacited by 56
  20. 2024A Survey of Graph Neural Networks in Real world: Imbalance, Noise, Privacy and OOD Challengescited by 54
  21. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 54
  22. 2022Mixed Differential Privacy in Computer Visioncited by 53
  23. 2021Antipodes of Label Differential Privacy: PATE and ALIBIcited by 50
  24. 2024Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Datacited by 49
  25. 2024Are we making progress in unlearning? Findings from the first NeurIPS unlearning competitioncited by 48
  26. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  27. 2022GAP: Differentially Private Graph Neural Networks with Aggregation Perturbationcited by 46
  28. 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 43
  29. 2021Revisiting Methods for Finding Influential Examplescited by 39
  30. 2022Debugging Differential Privacy: A Case Study for Privacy Auditingcited by 39
  31. 2022Algorithms that Approximate Data Removal: New Results and Limitationscited by 39
  32. 2023User Inference Attacks on Large Language Modelscited by 36
  33. 2023One-shot Empirical Privacy Estimation for Federated Learningcited by 35
  34. 2023PrivLM-Bench: A Multi-level Privacy Evaluation Benchmark for Language Modelscited by 35
  35. 2024Evaluations of Machine Learning Privacy Defenses are Misleadingcited by 35
  36. 2022Bayesian Estimation of Differential Privacycited by 31
  37. 2022Disparate Impact in Differential Privacy from Gradient Misalignmentcited by 31
  38. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29

50 most cited of 213 All 213 (JSON)