The paper introduces Fulcrum, a topology‑aware differential privacy scheme for hierarchical federated learning that allocates noise based on the size and exposure of regional aggregation groups. By deriving a closed‑form exposure dispersion metric from region structure and weights, the method optimally balances privacy and utility, achieving up to 14.84% accuracy gains on image tasks and 12.16% on text tasks at ε = 0.99 compared to uniform noise allocation. The approach ensures each participant receives noise commensurate with its actual exposure, eliminating unnecessary privacy overhead.
By Murtaza Rangwala, Richard O. Sinnott, Rajkumar Buyya
The paper investigates the privacy risks inherent in auditing machine unlearning (MU) when the audit relies only on querying the model for behavioral signals. It shows that such generic audit schemes inevitably leak information about the retained data set, providing a geometric transfer theorem that bounds the distinguishability of retained set membership based on audit accuracy. The study also analyzes how the unlearned set, target sample, and query protocol influence the privacy‑audit transfer coefficient, with empirical evidence from both convex and non‑convex models supporting the theoretical findings.
By Liou Tang, James Joshi, Ashish Kundu
arXiv:2606. 14518v1 Announce Type: new Abstract: The removal of learned data from Machine Learning models through Machine Unlearning (MU) has been widely studied; however, there has yet to be an agreed-upon scheme for auditing MU.
By Liou Tang, James Joshi, Ashish Kundu
arXiv:2606. 00414v1 Announce Type: new Abstract: When many reinforcement-learning policies achieve near-optimal return, a post-hoc auditor may have to distinguish among many behaviorally distinct but return-equivalent policies.
By Ibne Farabi Shihab, Sanjeda Akter, Anuj Sharma
The paper introduces PAC‑Private Autoregressive Generation, a method that calibrates noise based on ensemble disagreement across overlapping ‘worlds’ of a private corpus, thereby extending PAC privacy from classification to text generation. By training adapters on a frozen public model and using posterior‑weighted disagreement to add noise only when predictions vary, the approach achieves strong privacy guarantees while preserving most of the fine‑tuning benefit. Experiments on WikiText‑103 with GPT‑2‑small show 74 % of the fine‑tuning gain retained with a per‑token budget of 2⁻³², and membership‑inference success bounded to 51.08 % after one million tokens, outperforming PMixED under matched conditions.
By Mina Mirzadehsarcheshmeh, Amir Keyvan Khandani
arXiv:2605. 27292v2 Announce Type: replace Abstract: Privacy auditing aims to empirically assess privacy leakage in machine learning models using membership inference attacks (MIAs), and to derive lower bounds on differential privacy (DP) parameters.
By Mathieu Dagr\'eou, Aur\'elien Bellet
arXiv:2609.14780v1 Announce Type: cross
Abstract: Multi-tenant tools commonly accept a tenant identifier and validate it against the caller's entitlement. For a large language model (LLM) agent, that...
By Mirza Samad Ahmed Baig, Syeda Anshrah Gillani, Asher Ali, Muhammad Hamzah Siddiqui
arXiv:2608.27782v1 Announce Type: cross
Abstract: Memorization in large language models is measured through a zoo of definitions whose formal relations are unknown, and differential privacy (DP) is t...
By Xujun Che, Depeng Xu, Shuhan Yuan
The paper introduces FGLGuard, a privacy‑preserving federated graph learning framework that trains a graph attention detector on each operator’s own multi‑agent system (MAS) episode graphs, sharing only model updates. By combining a proximal local objective, domain‑balanced aggregation, threshold calibration, and guarded rewrite mechanisms, FGLGuard adapts to non‑IID data across organizations and outperforms centralized and local‑only baselines on Agent‑SafetyBench, R‑Judge, and AgentDojo. The method achieves significant reductions in attack success rates—up to 43% on AgentDojo—without compromising utility, API cost, or model capability.
By Jinxi Yu, Eric Hanchen Jiang, Levina Li, Dong Liu, Zhi Zhang, Wenxiao Zhao, Yanxuan Yu, Kai-Wei Chang, Ying Nian Wu
The paper investigates black-box privacy auditing for differentially private learning algorithms, focusing on DP‑SGD. It introduces a method that optimizes the auditor’s canary set using metagradient descent, improving empirical lower bounds on privacy parameters compared to prior canary designs. The approach is shown to be DP‑SGD agnostic and efficient, with optimized canaries for small models remaining effective for larger DP‑SGD models.
By Matteo Boglioni, Terrance Liu, Andrew Ilyas, Zhiwei Steven Wu
arXiv:2607. 12188v1 Announce Type: new Abstract: Enterprise Retrieval-Augmented Generation (RAG) deployments face a critical governance gap: while LLM generation cost is metered per token, the retrieval layer - vector memory, similarity compute, and embedding API calls - remains an unattributed shared cost, enabling invisible cross-subsidization among tenants.
By Navnit Shukla
The paper introduces a subgroup-targeted membership inference game to audit differentially private synthetic text releases, revealing that existing average-case attacks miss significant leakage to vulnerable subgroups. An extensive audit across 32 proxies, four datasets, three generation methods, and five privacy budgets shows that DP reduces overall leakage but leaves concentrated, uneven residual risk, especially for high-risk records. The study demonstrates that which records leak is determined by the release mechanism rather than the records themselves, challenging record-level risk assessment.
By Yidan Sun, Viktor Schlegel, Srinivasan Nandakumar, Siew Kei Lam, Anil Anthony Bharath