aiqbench analysis
This paper proposes a way to measure how much a differentially private model leaks about its training data from a single training run, instead of relying on the coarser binary membership guesses used in earlier one-run audits. Its key claim is that canary signals become asymptotically Gaussian, which yields tighter empirical privacy lower bounds. Practitioners checking whether DP-SGD guarantees hold in deployment should watch whether the method's assumptions, especially the white-box setting, match their threat model.
Let's Ask Gauss: Improved One-Run Privacy Auditing
arXiv:2606.12733v3 Announce Type: replace Abstract: Privacy auditing provides an important safeguard by estimating the actual information leaked by a model, thus ensuring that theoretical privacy guarantees hold in practice. We study empirical privacy auditing for differentially private (DP) machine learning, focusing on efficient one-run methods for mechanisms such as DP-SGD. Prior one-run approaches threshold training examples or "canaries" into binary membership guesses, which discards useful information. We show that, in the white-box DP-SGD setting, canary-aligned signals naturally form a sequence of random variables whose normalized sum is asymptotically Gaussian. We show that this gaussian perspective can also be naturally extended to other composition mechanisms that satisfy a classical, triangular-array, or martingale central limit theorem. Leveraging this distributional perspective, we develop a DP-auditing framework that leads to tighter privacy lower bounds from a single training run.
Abstract:Privacy auditing provides an important safeguard by estimating the actual information leaked by a model, thus ensuring that theoretical privacy guarantees hold in practice. We study empirical privacy auditing for differentially private (DP) machine learning, focusing on efficient one-run methods for mechanisms such as DP-SGD. Prior one-run approaches threshold training examples or "canaries" into binary membership guesses, which discards useful information. We show that, in the white-box DP-SGD setting, canary-aligned signals naturally form a sequence of random variables whose normalized sum is asymptotically Gaussian. We show that this gaussian perspective can also be naturally extended to other composition mechanisms that satisfy a classical, triangular-array, or martingale central limit theorem. Leveraging this distributional perspective, we develop a DP-auditing framework that leads to tighter privacy lower bounds from a single training run.
Machine Learning (cs.LG)
arXiv:2606.12733 [cs.LG]
(or arXiv:2606.12733v3 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2606.12733 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 222 words
Related coverage
Let's Ask Gauss: Improved One-Run Privacy Auditing
arXiv · Jun 15, 2026
Optimizing Canaries for Privacy Auditing with Metagradient Descent
arXiv · Sep 23, 2026
Auditor-in-a-Box: Tools for Third-Party Auditing
LessWrong · Jul 28, 2026
[AINews] not much happened today
Latent Space · Sep 18, 2026