Let's Ask Gauss: Improved One-Run Privacy Auditing

Abstract: Privacy auditing provides an important safeguard by estimating the actual information leaked by a model, thus ensuring that theoretical privacy guarantees hold in practice. We study empirical privacy auditing for differentially private (DP) machine learning, focusing on efficient one-run methods for mechanisms such as DP-SGD. Prior one-run approaches threshold training examples or "canaries" into binary membership guesses, which discards useful information. We show that, in the white-box DP-SGD setting, canary-aligned signals naturally form a sequence of random variables whose normalized sum is asymptotically Gaussian. Leveraging this distributional perspective, we develop a DP-auditing framework that leads to tighter privacy lower bounds from a single training run.

• The paper proposes a Gaussian modeling framework for one-run differential privacy auditing that minimizes information loss compared to binary canary inference.
• It introduces a methodology fitting Gaussian distributions to canary scores, yielding provable privacy lower bounds with convergence rates of O(T^{-1/2}) or O(T^{-1}).
• Empirical evaluations on DP-SGD and DP-FTRL demonstrate improved privacy estimates, achieving up to 84% of the analytical privacy guarantee with far fewer canaries.

Improved One-Run Differential Privacy Auditing via Gaussian Modeling

Problem Context and Motivation

Formal privacy auditing is essential to ensure real-world machine learning implementations adhere to their intended differential privacy (DP) guarantees. Prevailing empirical auditing techniques for mechanisms like DP-SGD typically rely on multiple runs and/or reduce each inserted "canary" example to a binary membership inference statistic, losing significant information in the process. One-run approaches leverage multiple canaries in a single training run but until now, have relied on aggressive thresholding, discarding the full distributional profile of canary-aligned statistics intrinsic to DP-SGD's iterative structure. This work challenges the necessity of this information loss by establishing a tight, parametric framework for one-run empirical privacy auditing based on the asymptotic Gaussianity of canary scores.

Distributional Foundations and Methodology

The fundamental insight is that the canary-aligned sequential observations in DP-SGD—the projections of privatized gradients onto canary directions—form normalized sums of independent (but non-identically distributed) random variables. Under mild regularity and via application of the Central Limit Theorem, these normalized sums are shown to converge rapidly to a Gaussian distribution, with tractable mean and variance derived from DP-SGD hyperparameters.

Specifically, for each canary, two distributions are considered:

• Absent-Canary (out): No signal, only DP noise—exactly one-dimensional Gaussian.
• Present-Canary (in): Bernoulli-signal plus DP noise—approximated as Gaussian for moderate $T$.

By directly modeling the (in, out) canary scores as a pair of Gaussian distributions, the authors show that the exact hockey-stick divergence between these Gaussians yields a provable lower bound on $\varepsilon$ for a target $\delta$. The methodology encompasses:

1. Single-run, white-box execution of DP-SGD with many independent canaries.
2. Aggregation of the sequentially projected gradients for each canary into a scalar (normalized) score.
3. Fitting a Gaussian pair to the collective (out, in) canary score samples.
4. Computing the empirical DP lower bound via the hockey-stick divergence using the closed-form relation for pairs of Gaussians.

Theoretical analysis provides sharp rates for the convergence of canary-score distributions to their Gaussian proxies, with $O(T^{-1/2})$ in general and $O(T^{-1})$ in DP-SGD's typical small-subsample regime.

Strong Empirical Results

A comprehensive evaluation validates the proposed auditor across DP-SGD and DP-FTRL. On CIFAR-10 with DP-SGD at $\varepsilon=8$, the empirical privacy lower bound attains approximately $6.7$—about $84\%$ of the analytical upper bound, which constitutes a significant improvement relative to previous one-run methods (which yield only $\approx 63\%$ or less of the upper bound).

Figure 1: A comparison of auditing lower bounds for DP-SGD on CIFAR-10, showing stronger performance from the Gaussian auditor relative to threshold-based baselines.

The sample efficiency is also improved: this method achieves tighter bounds with as few as 100 canaries than previous baselines need with more than 2000 canaries. For DP-FTRL, where the canary sum is exactly Gaussian (by the nature of tree-structured noise addition), the framework recovers sharp privacy bounds without loss, outperforming baseline estimators that operate on more limited per-step statistics.

Figure 2: Auditing results for DP-FTRL, illustrating tighter empirical privacy estimates from Gaussian modeling in comparison to maximum-statistic estimators.

Ablations demonstrate rapid Gaussian convergence and confirm the independence and orthogonality assumptions used for canary directions:

Figure 3: Gram matrix of canary directions, with off-diagonal near-zero concentration confirming approximate orthogonality of randomly sampled canary vectors in gradient space.

Figure 4: Histogram of canary-absent scores matching the theoretical baseline Gaussian, supporting the modeling assumption.

Theoretical Implications

This work clarifies the cause of success for prior canary-based one-run audits, tying their effective privacy lower bounds to an underlying—previously implicit—Gaussianity. It advances the field by:

• Providing closed-form, confidence-region-based estimators for the privacy lower bound.
• Quantitatively characterizing the rate and quality of Gaussian approximation in privacy audits, providing confidence that practical auditing does not incur excess error due to non-Gaussianity for real-world $T$ and $\varepsilon$0.
• Offering parameter estimation constructions (Bonferroni rectangle vs. bootstrap ellipsoid) to bound error due to finite canary samples, for both conservative and efficiency-optimized auditing.

  Figure 5: Direct comparison of confidence region strategies, showing tighter lower bounds recovered by the bootstrap ellipsoid across sample sizes.

Practical and Theoretical Implications for AI

The Gaussian-based one-run audit provides a practically feasible and statistically powerful tool for certifying privacy loss empirically in complex, large-scale, and distributed ML pipelines—particularly crucial for the deployment of DP mechanisms in trustworthy real-world settings. These advances reduce the gap between theoretical and effective privacy guarantees, making private ML more robust to implementation error, optimization instability, and adversarial scrutiny.

Theoretically, the parametric distributional modeling approach may inform future auditing designs for non-Gaussian DP mechanisms by inspiring similar characterizations (e.g., via higher-dimensional or mixture-model approaches) and closing the loop between private mechanism analysis and empirical attestation.

Limitations and Future Directions

Despite empirical tightness, the methodology rests on several structural assumptions: (i) independence among canary directions, (ii) dominance of per-canary contributions by self-alignment, (iii) asymptotic normality, which may not generalize outside the DP-SGD regime (e.g., for unusual sampling strategies, strong data correlations, or non-Euclidean geometry).

Further theoretical investigation into optimal confidence region constructions for small-sample auditing and extending this framework to adversarial or adaptive canary constructions in federated and black-box settings remains an open and promising direction.

Conclusion

"Let's Ask Gauss: Improved One-Run Privacy Auditing" (2606.12733) establishes a rigorous and statistically sound framework for single-run empirical DP auditing. By exploiting the precise distributional properties of canary scores under DP-SGD, the methodology yields significantly tighter privacy lower bounds than prior thresholding or black-box approaches. The framework is extensible to other mechanisms (e.g., DP-FTRL), provides robust error control via confidence regions, and marks a substantial improvement in the empirical verification toolkit for differential privacy in machine learning.