The paper addresses a flaw in differential privacy audits where selection bias in Membership Inference Attacks leads to overestimated lower bounds on privacy leakage. By applying statistical correction methods, the authors demonstrate that uncorrected audits can violate theoretical privacy guarantees up to four times more often than claimed, while corrected audits maintain valid bounds at the nominal confidence level.
By Valentin Dorseuil (DI-ENS), Meenatchi Sundaram Muthu Selva Annamalai (UCL), Jamal Atif (CMAP), Olivier Capp\'e (DI-ENS), Nicolas Papernot (Inria)
arXiv:2605. 07674v2 Announce Type: replace-cross Abstract: Regulatory audits of AI systems increasingly rely on differential privacy (DP) to protect training data and model internals.
By Florian A. D. Burnat
arXiv:2608.28934v1 Announce Type: new
Abstract: Differential privacy (DP) has traditionally been used to provide theoretical upper bounds on an algorithm's stability to changing its training data. In...
By Saloni Modi, Srivi Balaji, Yusong Zhu, Gautam Kamath, Kevin Tian
arXiv:2606. 12733v2 Announce Type: replace Abstract: Privacy auditing provides an important safeguard by estimating the actual information leaked by a model, thus ensuring that theoretical privacy guarantees hold in practice.
By Adya Agrawal, Yu Wei, Jaspal Singh, Malik Magdon-Ismail, Vassilis Zikas
arXiv:2606. 14518v1 Announce Type: new Abstract: The removal of learned data from Machine Learning models through Machine Unlearning (MU) has been widely studied; however, there has yet to be an agreed-upon scheme for auditing MU.
By Liou Tang, James Joshi, Ashish Kundu
The paper introduces DISCERN, a two-tier protocol for certifying that updates to production models do not increase risk. It first uses unlabeled data to detect benign updates based on disagreement rates, then selectively labels only disagreements through an anytime-valid confidence sequence. The method achieves finite-sample validity with label-complexity bounds of order ρ²/ε², demonstrating significant label savings and strong empirical performance across 14,000+ audit streams.
By Vishnu Bindu Balachandran
arXiv:2610. 37055v1 Announce Type: cross Abstract: Audit-based certification bounds the violation rate of an LLM agent by auditing a random fraction $\varepsilon$ of actions and reweighting the audited labels; its validity is meant to rest only on the defender's audit coin.
By Wei Zhu, Meiyun Zuo, Huiping Sun
arXiv:2605. 06340v2 Announce Type: replace-cross Abstract: Continuous post-deployment compliance audits, mandated by emerging regulations such as the EU AI Act and Digital Services Act, create a class of strategic gaming distinct from the one-shot input/output gaming studied in prior work.
By Florian A. D. Burnat, Brittany I. Davidson
arXiv:2609.13499v1 Announce Type: cross
Abstract: Private Evolution (PE) generates high-fidelity synthetic data in federated settings without exposing users' raw data. It aggregates clipped user vote...
By Sai Aparna Aketi, Enayat Ullah, Shripad Gade
arXiv:2610.10199v1 Announce Type: new
Abstract: Emerging legislation requires large language models (LLMs) to be audited for compliance with regulatory standards, particularly fairness. Such black-bo...
By Sayan Biswas, Jade Garcia Bourr\'ee, Anne-Marie Kermarrec, Palak, Martijn de Vos
Emerging legislation requires large language models (LLMs) to be audited for compliance with regulatory standards, particularly fairness. Such black-box audits typically assume a single auditor with a...
The paper introduces PAC‑Private Autoregressive Generation, a method that calibrates noise based on ensemble disagreement across overlapping ‘worlds’ of a private corpus, thereby extending PAC privacy from classification to text generation. By training adapters on a frozen public model and using posterior‑weighted disagreement to add noise only when predictions vary, the approach achieves strong privacy guarantees while preserving most of the fine‑tuning benefit. Experiments on WikiText‑103 with GPT‑2‑small show 74 % of the fine‑tuning gain retained with a per‑token budget of 2⁻³², and membership‑inference success bounded to 51.08 % after one million tokens, outperforming PMixED under matched conditions.
By Mina Mirzadehsarcheshmeh, Amir Keyvan Khandani