mlsanityData to 7 Oct 2026

Debugging Differential Privacy: A Case Study for Privacy Auditing

arXiv 2202.12219 ↗First posted 24 Feb 2022cs.LGcited by 39

Not on the map. Why?

Abstract (arXiv)

Differential Privacy can provide provable privacy guarantees for training data in machine learning. However, the presence of proofs does not preclude the presence of errors. Inspired by recent advances in auditing which have been used for estimating lower bounds on differentially private algorithms, here we show that auditing can also be used to find flaws in (purportedly) differentially private schemes. In this case study, we audit a recent open source implementation of a differentially private deep learning algorithm and find, with 99.99999999% confidence, that the implementation does not satisfy the claimed differential privacy guarantee.

Key facts. Cited by 39 papers in the map (data through 7 Oct 2026). Builds on 6 of its 9 references that are in the map. First posted on arXiv 24 Feb 2022.

Builds on

6 of 9 references.

References · 6

  1. 2016Deep Learning with Differential Privacycited by 2,682
  2. 2013The Composition Theorem for Differential Privacycited by 290
  3. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 213
  4. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  5. 2016Variational Bayes In Private Settings (VIPS)cited by 9
  6. 2022Backpropagation Clipping for Deep Learning with Differential Privacycited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 12; 2024: 13; 2025: 5; 2026: 6.

39 papers.

Sort:

By area:

  1. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 218
  2. 2023Privacy Auditing with One (1) Training Runcited by 119
  3. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  4. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  5. 2023One-shot Empirical Privacy Estimation for Federated Learningcited by 35
  6. 2024Evaluations of Machine Learning Privacy Defenses are Misleadingcited by 35
  7. 2024Auditing f-Differential Privacy in One Runcited by 28
  8. 2023Selective Pre-training for Private Fine-tuningcited by 22
  9. 2025Privacy Auditing of Large Language Modelscited by 22
  10. 2023Have it your way: Individualized Privacy Assignment for DP-SGDcited by 21
  11. 2023Unleashing the Power of Randomization in Auditing Differentially Private MLcited by 19
  12. 2024Nearly Tight Black-Box Auditing of Differentially Private Machine Learningcited by 19
27 more
  1. 2023Membership Inference Attacks on Diffusion Models via Quantile Regressioncited by 17
  2. 2023Unlocking Accuracy and Fairness in Differentially Private Image Classificationcited by 16
  3. 2023The Inadequacy of Similarity-based Privacy Metrics: Privacy Attacks against "Truly Anonymous" Synthetic Datasetscited by 14
  4. 2023Recent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Surveycited by 12
  5. 2024The Elusive Pursuit of Reproducing PATE-GAN: Benchmarking, Auditing, Debuggingcited by 12
  6. 2024The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGDcited by 10
  7. 2024Auditing Differential Privacy Guarantees Using Density Estimationcited by 6
  8. 2024Free Record-Level Privacy Risk Evaluation Through Artifact-Based Methodscited by 6
  9. 2024To Shuffle or not to Shuffle: Auditing DP-SGD with Shufflingcited by 6
  10. 2025Optimizing Canaries for Privacy Auditing with Metagradient Descentcited by 6
  11. 2022Algorithms with More Granular Differential Privacy Guaranteescited by 4
  12. 2025Enhancing One-run Privacy Auditing with Quantile Regression-Based Membership Inferencecited by 4
  13. 2025The Hitchhiker's Guide to Efficient, End-to-End, and Tight DP Auditingcited by 4
  14. 2025Auditing Approximate Machine Unlearning for Differentially Private Modelscited by 4
  15. 2026DeepWeightFlow: Re-Basined Flow Matching for Generating Neural Network Weightscited by 3
  16. 2023Universal Neural-Cracking-Machines: Self-Configurable Password Models from Auxiliary Datacited by 2
  17. 2023Epsilon*: Privacy Metric for Machine Learning Modelscited by 2
  18. 2024NeurIPS 2023 Competition: Privacy Preserving Federated Learning Document VQAcited by 2
  19. 2026JAX-Privacy: A library for differentially private machine learningcited by 2
  20. 2024On provable privacy vulnerabilities of graph representationscited by 1
  21. 2024On Active Privacy Auditing in Supervised Fine-tuning for White-Box Language Modelscited by 1
  22. 2026Sequential Membership Inference Attackscited by 1
  23. 2024Lost in the Averages: A New Specific Setup to Evaluate Membership Inference Attacks Against Machine Learning Modelscited by 0
  24. 2024Adversarial Sample-Based Approach for Tighter Privacy Auditing in Final Model-Only Scenarioscited by 0
  25. 2026Natural Identifiers for Privacy and Data Audits in Large Language Modelscited by 0
  26. 2026Canaries in the Bank: Auditing User-Level Privacy in Private Evolutioncited by 0
  27. 2026Efficient Provably Private Classification with a Tabular Foundation Modelcited by 0