# Optimizing Canaries for Privacy Auditing with Metagradient Descent Source: [Optimizing Canaries for Privacy Auditing with Metagradient Descent]() Collection index: [llms.txt]() Data updated: 2025-10-26T05:14:13.950Z Authors: Matteo Boglioni, Terrance Liu, Andrew Ilyas, Zhiwei Steven Wu Published: 2025-07-21T17:47:33.000Z ## Abstract In this work we study black-box privacy auditing, where the goal is to lower bound the privacy parameter of a differentially private learning algorithm using only the algorithm's outputs (i.e., final trained model). For DP-SGD (the most successful method for training differentially private deep learning models), the canonical approach auditing uses membership inference-an auditor comes with a small set of special "canary" examples, inserts a random subset of them into the training set, and then tries to discern which of their canaries were included in the training set (typically via a membership inference attack). The auditor's success rate then provides a lower bound on the privacy parameters of the learning algorithm. Our main contribution is a method for optimizing the auditor's canary set to improve privacy auditing, leveraging recent work on metagradient optimization. Our empirical evaluation demonstrates that by using such optimized canaries, we can improve empirical lower bounds for differentially private image classification models by over 2x in certain instances. Furthermore, we demonstrate that our method is transferable and efficient: canaries optimized for non-private SGD with a small model architecture remain effective when auditing larger models trained with DP-SGD. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Membership Inference Attack on CIFAR10 (TPR @ 0.05 FPR)](): Membership Inference Attack auditing; CIFAR10; Mean TPR @ 0.05 FPR: 21. - [One-run DP privacy auditing on CIFAR10 (test)](): One-run DP privacy auditing; CIFAR10 (test); Mean Score: 74. - [Privacy Auditing on CIFAR10 (test)](): Privacy Auditing; CIFAR10 (test); Mean: 11. - [One-run privacy auditing on CIFAR10](): One-run privacy auditing; CIFAR10; Mean TPR @ 0.05 FPR: 82. ## Original sources and implementation [Original paper]() [PDF]()