Detectability in Diversity: Improved Canary Crafting for Privacy Auditing in One Run
For researchers and practitioners auditing differential privacy in ML models, this work improves the efficiency and accuracy of one-run privacy auditing, which is otherwise costly.
This paper addresses the problem of efficiently crafting canaries for one-run privacy auditing in machine learning, proposing a method that optimizes canaries for high detectability and minimal interference. The approach achieves stronger privacy leakage estimates at lower computational cost than existing methods.
Privacy auditing aims to empirically assess privacy leakage in machine learning models using membership inference attacks (MIAs), and to derive lower bounds on differential privacy (DP) parameters. Recent one-run auditing methods address the high cost of standard approaches by relying on a single training run with multiple "canary" points whose inclusion or exclusion must be detected by the auditor. In this work, we study the problem of efficiently crafting canaries for one-run privacy auditing. Motivated by recent theoretical insights suggesting that interference between canaries contributes to weaker leakage estimates compared to multi-run methods, we propose to optimize canaries to be both highly detectable and minimally interfering. Our approach combines a greedy initialization based on influence functions with a bilevel optimization procedure that maximizes distinguishability while promoting diversity in embedding space, enabling the use of computationally efficient bilevel algorithms. Experiments show that our method achieves stronger privacy leakage estimates at a lower computational cost than existing canary crafting approaches.