Auditing Private Prediction

Differential privacy (DP) offers a theoretical upper bound on the potential privacy leakage of an algorithm, while empirical auditing establishes a practical lower bound. Auditing techniques exist for DP training algorithms. However machine learning can also be made private at inference. We propose the first framework for auditing private prediction where we instantiate adversaries with varying poisoning and query capabilities. This enables us to study the privacy leakage of four private prediction algorithms: PATE [Papernot et al., 2016] , CaPC [Choquette-Choo et al., 2020] , PromptPATE [Duan et al., 2023], and Private-kNN [Zhu et al., 2020] . To conduct our audit, we introduce novel techniques to empirically evaluate privacy leakage in terms of Renyi DP. Our experiments show that (i) the privacy analysis of private prediction can be improved, (ii) algorithms which are easier to poison lead to much higher privacy leakage, and (iii) the privacy leakage is significantly lower for adversaries without query control than those with full control. * Part of this work was done during a Google DeepMind internship. 1 An arbitrary function can be applied to the outputs of a DP algorithm with no consequences to privacy.