# Advancing the State-of-the-Art in Empirical Privacy Auditing Source: [Advancing the State-of-the-Art in Empirical Privacy Auditing]() Collection index: [llms.txt]() Data updated: 2026-06-11T05:00:05.513Z Authors: Nicole Mitchell, Galen Andrew, Arun Ganesh, Brendan McMahan, Peter Kairouz Published: 2026-06-09T06:50:49.000Z ## Abstract Parameter-efficient fine-tuning of large language models (LLMs) can exhibit problematic memorization of individual training examples. Empirical privacy auditing (EPA) quantifies this risk by measuring realistic data leakage on membership inference (MI) or reconstruction attacks. A key challenge in EPA is designing \`\`canary'' examples that are mixed with the privacy-sensitive training data. We propose generating synthetic canaries via high-temperature sampling ($T \\geq 0.8$) from LLMs, using prompts tailored to the privacy-sensitive training data. These canaries act as high-influence outliers, ensuring high identifiability and hence strong audits. Further, since the canaries are themselves non-private, they are inspectable and can be inserted with repetition without jeopardizing the privacy of the real data. An important use of models fine-tuned on privacy-sensitive data is the generation of synthetic data. This also comes with privacy risk. We introduce a powerful synthetic data audit based on fine-tuning an auxiliary model on the synthetic data. Auditing the auxiliary model for the original canaries then provides a strong estimate of the privacy leakage through the synthetic data. Finally, leveraging our strong auditing methodologies, we perform a systematic investigation into the interacting effects of model capacity and canary entropy on memorization. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Membership Inference on Enron (canary-audit)](): Membership Inference; Enron (canary-audit); Mu: 2.519. ## Original sources and implementation [Original paper]() [PDF]()