Let's Ask Gauss: Improved One-Run Privacy Auditing
For practitioners of differentially private machine learning, it provides a more accurate empirical privacy audit from a single training run.
The paper improves one-run privacy auditing for DP-SGD by modeling canary-aligned signals as asymptotically Gaussian, yielding tighter privacy lower bounds than prior binary-threshold methods.
Privacy auditing provides an important safeguard by estimating the actual information leaked by a model, thus ensuring that theoretical privacy guarantees hold in practice. We study empirical privacy auditing for differentially private (DP) machine learning, focusing on efficient one-run methods for mechanisms such as DP-SGD. Prior one-run approaches threshold training examples or "canaries" into binary membership guesses, which discards useful information. We show that, in the white-box DP-SGD setting, canary-aligned signals naturally form a sequence of random variables whose normalized sum is asymptotically Gaussian. Leveraging this distributional perspective, we develop a DP-auditing framework that leads to tighter privacy lower bounds from a single training run.