Detectability without Interference: Efficient Canary Design for Privacy Auditing in One Run
Abstract
Privacy auditing aims to empirically assess privacy leakage in machine learning models using membership inference attacks (MIAs), and to derive lower bounds on differential privacy (DP) parameters. Standard privacy auditing inserts a sensitive sample (a canary) into many (≫ 100) randomized training runs, requiring the auditor to detect whether it was included in each run. In one-run auditing, many canaries are included in a single training run, avoiding the high computational cost of multi-run approaches. However, recent theory shows that canaries can interfere with one another, reducing per-canary MIA scores and thereby weakening the audit power. We propose IBIS, a framework that optimizes canaries to maximize their own score while minimizing their impact on others. IBIS combines influence-based greedy initialization with bilevel optimization, introducing a novel regularization term that encourages canaries to be orthogonal in embedding space as a proxy for reducing interference. We propose an efficient bilevel algorithm that incrementally updates a single model at each canary update, avoiding the need to retrain the model from scratch after every update. Experiments show that IBIS offers a better performance-cost trade-off than existing canary crafting approaches, improving MIA metrics while reducing computational cost by up to two orders of magnitude.
Related
- Phantoms and Disclosures: A Statistical Framework for Auditing Privacy in Synthetic Data
- Efficient Active Auditing of Multi-Group Fairness with Bias Probes
- Privacy for Free in Efficient Agnostic Halfspace Learning
- Not All Mislabels Are Equal: Efficient Task-Aware Auditing with Confidence Sequences
- Efficient Agnostic Learning of Univariate Densities Under Local Differential Privacy
BibTeX
@misc{dagreou2026detectability,
title = {{Detectability without Interference: Efficient Canary Design for Privacy Auditing in One Run}},
author = {Mathieu Dagréou and Valentin Dorseuil and Mohammad Yaghini and Nicolas Papernot and Aurélien Bellet},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2605.27292},
eprint = {2605.27292},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2605.27292},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Detectability without Interference: Efficient Canary Design for Privacy Auditing in One Run
AU - Mathieu Dagréou
AU - Valentin Dorseuil
AU - Mohammad Yaghini
AU - Nicolas Papernot
AU - Aurélien Bellet
PY - 2026
DA - 2026/10/15
PB - arXiv
DO - 10.48550/arxiv.2605.27292
UR - https://arxiv.org/abs/2605.27292
AB - Privacy auditing aims to empirically assess privacy leakage in machine learning models using membership inference attacks (MIAs), and to derive lower bounds on differential privacy (DP) parameters. Standard privacy auditing inserts a sensitive sample (a canary) into many (≫ 100) randomized training runs, requiring the auditor to detect whether it was included in each run. In one-run auditing, many canaries are included in a single training run, avoiding the high computational cost of multi-run approaches. However, recent theory shows that canaries can interfere with one another, reducing per-canary MIA scores and thereby weakening the audit power. We propose IBIS, a framework that optimizes canaries to maximize their own score while minimizing their impact on others. IBIS combines influence-based greedy initialization with bilevel optimization, introducing a novel regularization term that encourages canaries to be orthogonal in embedding space as a proxy for reducing interference. We propose an efficient bilevel algorithm that incrementally updates a single model at each canary update, avoiding the need to retrain the model from scratch after every update. Experiments show that IBIS offers a better performance-cost trade-off than existing canary crafting approaches, improving MIA metrics while reducing computational cost by up to two orders of magnitude.
ER -