{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/nearly-tight-black-box-auditing-of","title":"Nearly Tight Black-Box Auditing of Differentially Private Machine Learning","arxiv_id":"2405.14106","date":"2024-05-23","proceeding":null,"authors":["Meenatchi Sundaram Muthu Selva Annamalai","Emiliano De Cristofaro"],"abstract":"This paper presents an auditing procedure for the Differentially Private Stochastic Gradient Descent (DP-SGD) algorithm in the black-box threat model that is substantially tighter than prior work. The main intuition is to craft worst-case initial model parameters, as DP-SGD's privacy analysis is agnostic to the choice of the initial model parameters. For models trained on MNIST and CIFAR-10 at theoretical $\\varepsilon=10.0$, our auditing procedure yields empirical estimates of $\\varepsilon_{emp} = 7.21$ and $6.95$, respectively, on a 1,000-record sample and $\\varepsilon_{emp}= 6.48$ and $4.96$ on the full datasets. By contrast, previous audits were only (relatively) tight in stronger white-box models, where the adversary can access the model's inner parameters and insert arbitrary gradients. Overall, our auditing procedure can offer valuable insight into how the privacy analysis of DP-SGD could be improved and detect bugs and DP violations in real-world implementations. The source code needed to reproduce our experiments is available at https://github.com/spalabucr/bb-audit-dpsgd.","url_abs":"https://arxiv.org/abs/2405.14106v4","url_pdf":"https://arxiv.org/pdf/2405.14106v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"nearly-tight-black-box-auditing-of","repo_url":"https://github.com/spalabucr/bb-audit-dpsgd","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2405.14106","atlas_url":"https://app.syntology.ai/?focus=2405.14106","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2405.14106"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/spalabucr/bb-audit-dpsgd","reach":{"status":"ok"}}],"summary":{"ran":8,"unverified":1},"by_repo_kind":{"official":{"samples":9,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":9,"samples":[{"code_sha256_prefix":"fde4ee312d068f1d","entry":"choose_worstcase_label","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"utils/clipbkd.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/utils/clipbkd.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fde4ee312d068f1d"}},{"code_sha256_prefix":"2341fce42f1ae76d","entry":"clip_per_sample_grads","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"utils/dpsgd.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/utils/dpsgd.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2341fce42f1ae76d"}},{"code_sha256_prefix":"f0e3cf84bbcb497f","entry":"compute_eps_lower_gdp","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"utils/audit.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/utils/audit.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f0e3cf84bbcb497f"}},{"code_sha256_prefix":"824b0c69d6c12132","entry":"craft_clipbkd","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"utils/clipbkd.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/utils/clipbkd.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"824b0c69d6c12132"}},{"code_sha256_prefix":"ff684b4e4a211f91","entry":"get_per_sample_grad_norms","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"utils/dpsgd.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/utils/dpsgd.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ff684b4e4a211f91"}},{"code_sha256_prefix":"dd283c6d1dc3f36d","entry":"get_per_sample_grads","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"utils/dpsgd.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/utils/dpsgd.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"dd283c6d1dc3f36d"}},{"code_sha256_prefix":"bbfe4f4c1a9dc5d6","entry":"load_data","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"utils/data.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/utils/data.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bbfe4f4c1a9dc5d6"}},{"code_sha256_prefix":"4463a86d730ba758","entry":"test_model","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"audit_model.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/audit_model.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4463a86d730ba758"}},{"code_sha256_prefix":"ee3921b078050fcc","entry":"resume_checkpoint","repo":"spalabucr/bb-audit-dpsgd","repo_kind":"official","path":"audit_model.py","file_url":"https://github.com/spalabucr/bb-audit-dpsgd/blob/HEAD/audit_model.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ee3921b078050fcc"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}