Several methods for auditing privacy in embedding spaces report a number called "epsilon." The common name is misleading: one number may be a heuristic score, another may come from a valid population inequality but ignore sampling uncertainty, and a third may be a confidence bound. This paper asks when such a number is evidence about differential privacy. We study four approaches based on Gaussian calibration, marginal kernel-density ratios, maximum mean discrepancy (MMD), and classifier hypothesis tests. The first two are modeling diagnostics. The MMD and classifier approaches use valid population lower bounds, but only the classifier approach is given a separate test set and a finite-sample confidence calculation. To see how these distinctions matter, we build a synthetic benchmark in which the true privacy value is known. It includes pure-DP Laplace mechanisms, approximate-DP Gaussian mechanisms, an exact privacy null, two identity geometries, and three sample sizes. At the null, the Gaussian and kernel-density diagnostics remain large. A direct conversion of an empirical ROC curve often returns infinity even though the AUC is near chance and no threshold separates the samples perfectly. The MMD value increases as the distributions become easier to distinguish, but the sample estimate is small relative to the known reference and is not a lower confidence bound. By contrast, a classifier chosen on development data and evaluated on untouched test data gives simultaneous lower confidence bounds under the stated iid model. We also apply the methods to FaceFusion and InstantID. That case study shows how the methods behave on face data but does not calibrate them because the generators have no known privacy value. The main lesson is that an epsilon-like number is meaningful only together with its assumptions and its finite-sample interpretation.
Figures & tables
Method
What it measures
Assumption or requirement
Relation to DP
Finite-sample confidence bound?
GaussMech
mean-shift/residual score
additive isotropic Gaussian model
only with known sensitivity/noise
No
KDE-LR
sum of marginal log ratios
product/conditional factorization
not for the joint release here
No
MMD-TV
MMD-to-TV pure-DP value
pure DP; k(x,x)≤1
valid population lower-bound formula
No
ROC-HT (OOF)
empirical ROC/AUC
learned cross-validated test
valid for a fixed population test
No
ROC-HT (reserved test)
confidence-adjusted ROC bound
fixed test; iid untouched data
valid hypothesis-testing route
Yes
Table 1. What each method reports. A “No” in the last column means that the reported sample value is not a confidence bound on ε . The reserved-test result is a confidence bound only under the iid model stated in Section 3 .
Figure 1. The four audit routes use the same identity pairs but have different formal status. GaussMech and KDE-LR are diagnostics. MMD-TV inserts an uncertified sample estimate into a valid population bound, and out-of-fold ROC-HT is descriptive. Only the separate ROC test, chosen on development data and evaluated on reserved data, is a finite-sample certificate. A two-panel overview. The left panel shows the audit setup: a synthetic known-epsilon benchmark, a face-generator experiment with stated assumptions, and a shared audit protocol with fixed pairs and seeds. The right panel lists the four audit routes and states what conclusion each result supports: GaussMech and KDE-LR are diagnostic scores, MMD-TV is an uncertified population route, and only the ROC-HT test on unused data gives a finite-sample certificate. DP-Sniper appears as a separate comparison.
Encoder
Dataset
Gen.
GaussMech diagnostic
KDE-LR diagnostic α=0
KDE-LR diagnostic α=10−2
MMD-TV sample est.
ROC-HT OOF ε=+∞
ROC AUC
ArcFace
VGGFace2
FF
93.1
10,447
1,657
0.475
100/100
1.000
ArcFace
VGGFace2
ID
46.1
8,560
1,334
0.236
100/100
0.982
ArcFace
CelebA
FF
81.6
8,271
1,689
0.388
100/100
1.000
ArcFace
CelebA
ID
58.7
7,249
1,523
0.257
100/100
0.978
FaceNet
VGGFace2
FF
91.8
9,976
1,652
0.459
100/100
0.999
FaceNet
VGGFace2
ID
44.2
7,872
1,278
0.217
100/100
0.937
Table 2. Results on L2-normalized face embeddings. Finite values are medians over the same 100 identity pairs. The ROC-HT column counts empirical out-of-fold estimates equal to +∞ because of a zero denominator; it does not claim that the population value is infinite. Each method uses the δ stated in Section 4 . † A separate fixed-donor control on original VGGFace2 images, without face restoration, whose generation settings were recorded. It uses its own identity-pair list and is included only as a diagnostic condition.
Condition
n /class
AUC
Pos.
>1
εLB(0)
AF/VGG/FF
30
1.000 – 1.000
5/5
5/5
1.192 – 1.277
AF/VGG/ID
29 – 30
0.986 – 1.000
5/5
5/5
1.151 – 1.277
AF/CB/FF
9 – 10
1.000 – 1.000
0/5
0/5
0
AF/CB/ID
9
1.000 – 1.000
0/5
0/5
0
FN/VGG/FF
30
0.997 – 1.000
5/5
5/5
1.192 – 1.277
FN/VGG/ID
29 – 30
0.970 – 0.999
5/5
0/5
0.685 – 0.925
Table 3. Results from unused test data for five selected identity pairs per condition. Under the iid row model, all 40 bounds hold together with at least 95% confidence. The saved generation records cannot verify that model; see Appendix A . “Pos.” and “ >1 ” count bounds above zero and above one.
n
AUC
Div.
MMD-TV
GaussMech
KDE-LR
α=.01
30
.490
29.3
.003
28.60
1526
100
.499
24.7
.003
15.51
1210
300
.502
20.8
.001
8.96
962
Table 4. Results when the true pairwise ε is zero. For each setting, we take the median over 40 pairs, or count the infinite ROC conversions, and then average over both prototype sets, the applicable noise mechanisms, and three repetitions. MMD-TV is shown only for the pure-DP Laplace mechanism. “Div.” is the mean number of infinite ROC conversions among 40 pairs.
Figure 2. Method outputs versus the known median pairwise ε at n=100 . Lines show means; bands include both prototype sets and all repetitions. The two diagnostic scores remain large when the true value is zero. MMD-TV and the tighter earlier Hockey-Stick formula are shown only for the pure-DP mechanism; both use sample estimates rather than confidence bounds. ROC-HT is compared with the best possible Gaussian AUC and a Monte Carlo approximation based on 20,000 draws per class for product Laplace noise. Four line-chart panels, one per audit method: GaussMech diagnostic, KDE-LR diagnostic, MMD-TV sample value, and ROC-HT out-of-fold AUC. Each plots its output against exact median pairwise epsilon at sample size 100, with the Gaussian and Laplace mechanisms drawn as separate colored lines within each panel; the ROC panel also shows population-optimal references.
Figure 3. How often the test gives a lower bound above zero for the dispersed prototype set. Solid lines use logistic regression; dashed lines use the exact likelihood-ratio score with a threshold selected on development data. More samples increase both the fraction of positive bounds and their largest possible value. A two-by-two grid of line charts. Columns separate the Gaussian and Laplace mechanisms. The top row plots the fraction of pairs with a positive lower bound, and the bottom row plots the median lower bound on epsilon, both against the exact median pairwise reference epsilon on a logarithmic axis. The three sample sizes are distinguished by line color rather than by panel; learned logistic tests are solid and exact likelihood-ratio tests are dashed.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
requested ε
0.5
2
8
32
product-Laplace bound
−0.03
0.12
0.75
2.63
ratio to exact reference
−0.05
0.06
0.09
0.08
K -ary RR bound
0.12
0.93
4.47
4.60
ratio to realized reference
0.23
0.46
0.56
0.14
Appendix
Table 5. DP-Sniper results using 6.5×106 mechanism calls per row. The full experiment has 81 rows at this budget and 243 rows at the matched 2n budget, for 526,569,660 calls. Entries are median 95% lower bounds over three fixed pairs and three repetitions. Ratios compare each bound with the exact pairwise value, using unrounded numbers. Each result applies to one fixed pair and direction and to pure DP. None of the 324 bounds exceeds its exact reference.
requested global ε
test, n
0
0.5
2
8
16
32
exact, 30
0.00
0.00
0.00
0.01
0.29
0.85
exact, 100
0.00
0.00
0.00
0.64
0.88
0.88
exact, 300
0.00
0.00
0.04
0.88
0.90
0.98
learned, 30
0.00
0.00
0.00
0.00
0.00
0.00
learned, 100
0.00
0.00
0.00
0.00
0.00
0.02
Appendix
Table 6. Fraction of the 40 anisotropic-Gaussian pairs with a lower bound above zero, averaged over both prototype sets and three repetitions. The exact test uses the mechanism’s whitening direction and serves as an upper reference; the learned test uses logistic regression fitted on development data.
Pass
Median εLB
Range
Positive
>1
Censored
1
2.290
1.683 – 2.338
50/50
50/50
9/50
2
2.076
1.367 – 2.338
50/50
50/50
4/50
3
1.890
1.085 – 2.338
50/50
50/50
2/50
4
1.784
1.025 – 2.338
50/50
50/50
2/50
5
1.701
0.671 – 2.312
50/50
46/50
0/50
Appendix
Table 7. Lower confidence bounds for 50 difficult, non-overlapping identity pairs selected on development data. They are not an estimate of how common leakage is. At δ=10−5 , the 250 pair-pass bounds use 500 one-sided error bounds with α=0.05/500=10−4 . Under the stated iid model, all results hold together with at least 95% confidence. “Censored” counts pairs with no errors in either direction. For those pairs, the finite sample size limits the reported bound to 2.338. Because these are lower bounds and some hit that limit, they cannot measure the true change in ε across passes.
Pass
GaussMech
KDE α=0
KDE α=10−2
MMD-TV
OOF AUC
Exact corner
Raw +∞
MMD reject
1
39.5
5,408
1,083
0.181
1.000
79/200
200/200
100/100
2
34.3
5,211
1,051
0.153
0.999
43/200
200/200
100/100
3
32.1
5,166
1,039
0.141
0.997
25/200
200/200
100/100
4
30.5
5,080
1,028
0.131
0.994
6/200
200/200
100/100
5
29.3
5,034
1,025
0.124
0.991
4/200
200/200
100/100
Appendix
Table 8. Descriptive results on the development data after each FaceFusion pass. The first five numeric columns are pairwise medians; the last three are counts. GaussMech and MMD-TV use 500 pairs, KDE-LR uses 100, and the out-of-fold ROC uses 200. These differ from the 50 pairs in Table 7 . MMD permutation tests use the first 100 pairs at each pass. Every p -value is 1/10001 , which remains significant at 0.05/500 . These descriptive calculations omit rows where face detection failed. None is a finite-sample confidence bound on ε .
Figure 4. Q-Q plots for the four least-Gaussian ArcFace dimensions under VGGFace2+InstantID. Each panel uses the same 5,000-row subsample drawn from approximately 40,000 pooled within-identity residuals. Four quantile-quantile plots compare pooled residual coordinates with Gaussian reference lines and show systematic departures in the selected least-Gaussian ArcFace dimensions.
Figure 5. Left : real same-identity split-half and inter-identity MMDu2 values. Right : one representative median-AUC out-of-fold ROC per condition. Exact corner counts are reported in the artifact. The left panel compares empirical same-identity and inter-identity squared MMD distributions. The right panel overlays one representative out-of-fold ROC curve for each encoder, dataset, and generator condition.
State-of-the-art Differentially Private (DP) synthetic data generators such as MST and AIM are widely used, yet tightly auditing their privacy guarantees remains challenging. We introduce a Gaussian Differential Privacy (GDP)-based auditing framework that measures privacy via the full false-positive/false-negative tradeoff. Applied to MST and AIM under worst-case settings, our method provides the first tight audits in the strong-privacy regime. For (ε,δ)=(1,10−2), we obtain μemp≈0.43 vs. implied μ=0.45, showing a small theory-practice gap. Our code is publicly available: https://github.com/sassoftware/dpmm.
Georgi Ganev, Meenatchi Sundaram Muthu Selva Annamalai, Bogdan Kulynych
Privacy auditing provides an important safeguard by estimating the actual information leaked by a model, thus ensuring that theoretical privacy guarantees hold in practice. We study empirical privacy auditing for differentially private (DP) machine learning, focusing on efficient one-run methods for mechanisms such as DP-SGD. Prior one-run approaches threshold training examples or "canaries" into binary membership guesses, which discards useful information. We show that, in the white-box DP-SGD setting, canary-aligned signals naturally form a sequence of random variables whose normalized sum is asymptotically Gaussian. We show that this gaussian perspective can also be naturally extended to other composition mechanisms that satisfy a classical, triangular-array, or martingale central limit theorem. Leveraging this distributional perspective, we develop a DP-auditing framework that leads to tighter privacy lower bounds from a single training run.
Adya Agrawal, Yu Wei, Jaspal Singh +2
Georgia Institute of Technology · Purdue University · Rensselaer Polytechnic Institute
Recent work argues for using Gaussian differential privacy (GDP) to report the privacy guarantees in privacy-preserving machine learning. We provide principled mappings from pure-DP ε to GDP μ by matching the worst-case success of a strong-adversary membership inference attack in terms of three metrics: multiplicative advantage at fixed FPR, precision at fixed recall, and the standard privacy profile. We tabulate μ values across a useful range of parameters and recommend μ≈ε/5 as a conservative general-purpose conversion.
Bogdan Kulynych, Antti Honkela
Biomedical Data Science Center, Lausanne University Hospital · University of Helsinki