Sequentially Auditing Differential Privacy

2025/09/08 by González, Tomás, Mateo Dulce-Rubio, Dulce-Rubio, Mateo +4
Computer Science · Social Sciences · #Cryptography and Data Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Methodology (stat.ME) #Privacy, Security, and Data Protection #Privacy-Preserving Technologies in Data

paper · pdf · doi:10.48550/arxiv.2509.07055

openalex publication_date 2025/09/08 · openalex created_date 2025/10/11 · openalex updated_date 2026/07/28

Abstract

We propose a practical sequential test for auditing differential privacy guarantees of black-box mechanisms. The test processes streams of mechanisms' outputs providing anytime-valid inference while controlling Type I error, overcoming the fixed sample size limitation of previous batch auditing methods. Experiments show this test detects violations with sample sizes that are orders of magnitude smaller than existing methods, reducing this number from 50K to a few hundred examples, across diverse realistic mechanisms. Notably, it identifies DP-SGD privacy violations in under one training run, unlike prior methods needing full model training.

Citations

• Universal Log-Optimality for General Classes of e-processes and Sequential Hypothesis Tests
• Hypothesis Testing with E-values
• Auditing f-Differential Privacy in One Run
• An Auditing Test To Detect Behavioral Shift in Language Models
• DP-Auditorium: a Large Scale Library for Auditing Differential Privacy
• Auditing Fairness by Betting
• Risk-limiting Financial Audits via Weighted Sampling without Replacement
• One-shot Empirical Privacy Estimation for Federated Learning
• Connect the Dots: Tighter Discrete Approximations of Privacy Loss Distributions
• Auditing Differential Privacy in High Dimensions with the Kernel Quantum Rényi Divergence
• Bounding Training Data Reconstruction in Private (Deep) Learning
• Reconstructing Training Data with Informed Adversaries
• Nonparametric Two-Sample Testing by Betting
• There are natural scores: Full comment on Shafer, "Testing by betting: A strategy for statistical and scientific communication"
• Estimating means of bounded random variables by betting
• Admissible anytime-valid sequential inference must rely on nonnegative martingales
• Variational Representations and Neural Network Estimation of Rényi Divergences
• Auditing Differentially Private Machine Learning: How Private is Private SGD?
• Online Learning: A Modern Introduction Using Convex Optimization
• Property Testing for Differential Privacy
• Understanding the Sparse Vector Technique for Differential Privacy
• The Composition Theorem for Differential Privacy

Related

• Auditing Differential Privacy in the Black-Box Setting
• Auditing f-Differential Privacy in One Run
• General-Purpose f-DP Estimation and Auditing in a Black-Box Setting
• Monitoring Violations of Differential Privacy over Time
• Privacy Audit as Bits Transmission: (Im)possibilities for Audit by One Run