mlsanityData to 7 Oct 2026

Privacy Auditing with One (1) Training Run

arXiv 2305.08846 ↗First posted 15 May 2023cs.LG cs.CR cs.DScited by 119

Not on the map. Why?

Cited by 39 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We propose a scheme for auditing differentially private machine learning systems with a single training run. This exploits the parallelism of being able to add or remove multiple training examples independently. We analyze this using the connection between differential privacy and statistical generalization, which avoids the cost of group privacy. Our auditing scheme requires minimal assumptions about the algorithm and can be applied in the black-box or white-box setting.

Key facts. Cited by 119 papers in the map (data through 7 Oct 2026). Builds on 33 of its 56 references that are in the map. First posted on arXiv 15 May 2023.

Builds on

33 of 56 references.

References · 33

  1. 2016Wide Residual Networkscited by 3,057
  2. 2016Deep Learning with Differential Privacycited by 2,682
  3. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  4. 2021Membership Inference Attacks From First Principlescited by 839
  5. 2017Renyi Differential Privacycited by 643
  6. 2016Concentrated Differential Privacy: Simplifications, Extensions, and Lower Boundscited by 339
  7. 2013The Composition Theorem for Differential Privacycited by 290
  8. 2018Subsampled R'enyi Differential Privacy and Analytical Moments Accountantcited by 234
  9. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 218
  10. 2018Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoisingcited by 216
  11. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 213
  12. 2019R'enyi Differential Privacy of the Sampled Gaussian Mechanismcited by 199
21 more
  1. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  2. 2021Numerical Composition of Differential Privacycited by 174
  3. 2020Reasoning About Generalization via Conditional Mutual Informationcited by 145
  4. 2016Concentrated Differential Privacycited by 139
  5. 2014Preserving Statistical Validity in Adaptive Data Analysiscited by 102
  6. 2015Algorithmic Stability for Adaptive Data Analysiscited by 88
  7. 2021Optimal Accounting of Differential Privacy via Characteristic Functioncited by 83
  8. 2015Generalization in Adaptive Data Analysis and Holdout Reusecited by 76
  9. 2021Antipodes of Label Differential Privacy: PATE and ALIBIcited by 50
  10. 2022Composition of Differential Privacy & Privacy Amplification by Subsamplingcited by 42
  11. 2022Debugging Differential Privacy: A Case Study for Privacy Auditingcited by 39
  12. 2018Detecting Violations of Differential Privacycited by 37
  13. 2019A New Analysis of Differential Privacy's Generalization Guaranteescited by 36
  14. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queriescited by 36
  15. 2023One-shot Empirical Privacy Estimation for Federated Learningcited by 35
  16. 2022Bayesian Estimation of Differential Privacycited by 31
  17. 2017Calibrating Noise to Variance in Adaptive Data Analysiscited by 28
  18. 2017Generalization for Adaptively-chosen Estimators via Stable Mediancited by 26
  19. 2016Max-Information, Differential Privacy, and Post-Selection Hypothesis Testingcited by 25
  20. 2022A General Framework for Auditing Differentially Private Machine Learningcited by 25
  21. 2022CANIFE: Crafting Canaries for Empirical Privacy Measurement in Federated Learningcited by 24

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 10; 2024: 36; 2025: 33; 2026: 40.

119 papers.

Sort:

By area:

  1. 2024TOFU: A Task of Fictitious Unlearning for LLMscited by 507
  2. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  3. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 188
  4. 2024LLM Dataset Inference: Did you train on my dataset?cited by 107
  5. 2024Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Modelscited by 102
  6. 2023Low-Cost High-Power Membership Inference Attackscited by 99
  7. 2024RWKU: Benchmarking Real-World Knowledge Unlearning for Large Language Modelscited by 77
  8. 2024ReCaLL: Membership Inference via Relative Conditional Log-Likelihoodscited by 61
  9. 2024Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Datacited by 49
  10. 2023User Inference Attacks on Large Language Modelscited by 36
  11. 2024Evaluations of Machine Learning Privacy Defenses are Misleadingcited by 35
  12. 2024Fine-Tuning Large Language Models with User-Level Differential Privacycited by 28
38 more
  1. 2024Auditing f-Differential Privacy in One Runcited by 28
  2. 2023Label Poisoning is All You Needcited by 27
  3. 2024Data Contamination Calibration for Black-box LLMscited by 23
  4. 2025Privacy Auditing of Large Language Modelscited by 22
  5. 2023Gaussian Membership Inference Privacycited by 20
  6. 2023Leave-one-out Distinguishability in Machine Learningcited by 20
  7. 2024Privacy Backdoors: Stealing Data with Corrupted Pretrained Modelscited by 20
  8. 2023Unleashing the Power of Randomization in Auditing Differentially Private MLcited by 19
  9. 2024Nearly Tight Black-Box Auditing of Differentially Private Machine Learningcited by 19
  10. 2024PANORAMIA: Privacy Auditing of Machine Learning Models without Retrainingcited by 17
  11. 2024Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Modelcited by 17
  12. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  13. 2024Fine-Tuning Language Models with Differential Privacy through Adaptive Noise Allocationcited by 14
  14. 2024The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscapecited by 13
  15. 2024The Elusive Pursuit of Reproducing PATE-GAN: Benchmarking, Auditing, Debuggingcited by 12
  16. 2025DPImageBench: A Unified Benchmark for Differentially Private Image Synthesiscited by 11
  17. 2024The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGDcited by 10
  18. 2024Underestimated Privacy Risks for Minority Populations in Large Language Model Unlearningcited by 9
  19. 2024Label Smoothing Improves Machine Unlearningcited by 8
  20. 2025Robust Data Watermarking in Language Models by Injecting Fictitious Knowledgecited by 8
  21. 2025How Well Can Differential Privacy Be Audited in One Run?cited by 8
  22. 2025Rectifying Privacy and Efficacy Measurements in Machine Unlearning: A New Inference Attack Perspectivecited by 8
  23. 2024DORY: Deliberative Prompt Recovery for LLMcited by 7
  24. 2025Synthetic Data Privacy Metricscited by 7
  25. 2025The Surprising Effectiveness of Membership Inference with Simple N-Gram Coveragecited by 7
  26. 2023A Note On Interpreting Canary Exposurecited by 6
  27. 2024Auditing Differential Privacy Guarantees Using Density Estimationcited by 6
  28. 2024Free Record-Level Privacy Risk Evaluation Through Artifact-Based Methodscited by 6
  29. 2024To Shuffle or not to Shuffle: Auditing DP-SGD with Shufflingcited by 6
  30. 2025Membership Inference Attacks on Sequence Modelscited by 6
  31. 2025Winter Soldier: Backdooring Language Models at Pre-Training with Indirect Data Poisoningcited by 6
  32. 2025Optimizing Canaries for Privacy Auditing with Metagradient Descentcited by 6
  33. 2025Train Once, Answer All: Many Pretraining Experiments for the Cost of Onecited by 6
  34. 2024Revisiting Differentially Private Hyper-parameter Tuningcited by 5
  35. 2024Synthetic Image Learning: Preserving Performance and Preventing Membership Inference Attackscited by 5
  36. 2025Enhancing One-run Privacy Auditing with Quantile Regression-Based Membership Inferencecited by 4
  37. 2025The Hitchhiker's Guide to Efficient, End-to-End, and Tight DP Auditingcited by 4
  38. 2025RecPS: Privacy Risk Scoring for Recommender Systemscited by 4

50 most cited of 119 All 119 (JSON)