mlsanityData to 14 Oct 2026

The Hitchhiker's Guide to Efficient, End-to-End, and Tight DP Auditing

arXiv 2506.16666 ↗First posted 20 Jun 2025cs.CR cs.LGcited by 5

Not on the map. Why?

Abstract (arXiv)

In this paper, we systematize research on auditing Differential Privacy (DP) techniques, aiming to identify key insights and open challenges. First, we introduce a comprehensive framework for reviewing work in the field and establish three cross-contextual desiderata that DP audits should target -- namely, efficiency, end-to-end-ness, and tightness. Then, we systematize the modes of operation of state-of-the-art DP auditing techniques, including threat models, attacks, and evaluation functions. This allows us to highlight key details overlooked by prior work, analyze the limiting factors to achieving the three desiderata, and identify open research problems. Overall, our work provides a reusable and systematic methodology geared to assess progress in the field and identify friction points and future directions for our community to focus on.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 74 of its 128 references that are in the map. First posted on arXiv 20 Jun 2025.

Builds on

74 of 128 references.

References · 74

  1. 2016Deep Learning with Differential Privacycited by 2,728
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  3. 2017Renyi Differential Privacycited by 650
  4. 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 348
  5. 2013The Composition Theorem for Differential Privacycited by 297
  6. 2014RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Responsecited by 272
  7. 2018Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergencescited by 242
  8. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 218
  9. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 199
  10. 2021Practical and Private (Deep) Learning without Sampling or Shufflingcited by 170
  11. 2023Privacy Auditing with One (1) Training Runcited by 123
  12. 2021Deep Learning with Label Differential Privacycited by 117
38 more
  1. 2023Low-Cost High-Power Membership Inference Attackscited by 107
  2. 2018Privacy Amplification by Iterationcited by 100
  3. 2021Optimal Accounting of Differential Privacy via Characteristic Functioncited by 86
  4. 2021Differential Privacy Dynamics of Langevin Diffusion and Noisy Gradient Descentcited by 73
  5. 2017Knock Knock, Who's There? Membership Inference on Aggregate Location Datacited by 70
  6. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 59
  7. 2022TAPAS: a Toolbox for Adversarial Privacy Auditing of Synthetic Datacited by 57
  8. 2021Antipodes of Label Differential Privacy: PATE and ALIBIcited by 52
  9. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 51
  10. 2022Differentially Private Learning Needs Hidden State (Or Much Faster Convergence)cited by 48
  11. 2023Bounding Training Data Reconstruction in DP-SGDcited by 46
  12. 2022Geographic Spines in the 2020 Census Disclosure Avoidance Systemcited by 44
  13. 2024Private Fine-tuning of Large Language Models with Zeroth-order Optimizationcited by 41
  14. 2022Debugging Differential Privacy: A Case Study for Privacy Auditingcited by 40
  15. 2022Canary in a Coalmine: Better Membership Inference with Ensembled Adversarial Queriescited by 40
  16. 2023Privacy Side Channels in Machine Learning Systemscited by 40
  17. 2018Detecting Violations of Differential Privacycited by 39
  18. 2023One-shot Empirical Privacy Estimation for Federated Learningcited by 36
  19. 2024Evaluations of Machine Learning Privacy Defenses are Misleadingcited by 36
  20. 2019SoK: Differential Privaciescited by 34
  21. 2022Bayesian Estimation of Differential Privacycited by 33
  22. 2024Auditing f-Differential Privacy in One Runcited by 30
  23. 2016Understanding the Sparse Vector Technique for Differential Privacycited by 27
  24. 2022A General Framework for Auditing Differentially Private Machine Learningcited by 25
  25. 2022CANIFE: Crafting Canaries for Empirical Privacy Measurement in Federated Learningcited by 24
  26. 2025Privacy Auditing of Large Language Modelscited by 23
  27. 2016PrivTree: A Differentially Private Algorithm for Hierarchical Decompositionscited by 22
  28. 2024How Private are DP-SGD Implementations?cited by 22
  29. 2024Privacy Backdoors: Stealing Data with Corrupted Pretrained Modelscited by 22
  30. 2024"What do you want from theory alone?" Experimenting with Tight Auditing of Differentially Private Synthetic Data Generationcited by 21
  31. 2024Nearly Tight Black-Box Auditing of Differentially Private Machine Learningcited by 21
  32. 2023Unleashing the Power of Randomization in Auditing Differentially Private MLcited by 20
  33. 2024Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Modelcited by 18
  34. 2024Near Exact Privacy Amplification for Matrix Mechanismscited by 18
  35. 2024Scalable DP-SGD: Shuffling vs. Poisson Subsamplingcited by 16
  36. 2024SoK: Dataset Copyright Auditing in Machine Learning Systemscited by 15
  37. 2024Balls-and-Bins Sampling for DP-SGDcited by 14
  38. 2024Avoiding Pitfalls for Privacy Accounting of Subsampled Mechanisms under Compositioncited by 13

50 most cited of 74 All 74 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 5.

5 papers.

  1. 2026Tight Auditing of Differential Privacy in MST and AIMcited by 1
  2. 2026Optimization Risk Bounds for Kolmogorov-Arnold Networks Trained by DP-SGD with Correlated Noisecited by 1
  3. 2026On Reliability of Membership Inference Vulnerability Evaluationcited by 1
  4. 2026DPrivBench: Benchmarking LLMs' Reasoning for Differential Privacycited by 0
  5. 2026Certification of Machine Learning Models via Directional Sharpnesscited by 0