Auditing privacy budget of differentially private neural network models

In recent years, neural network models are used in various tasks. To eliminate privacy concern, differential privacy (DP) is introduced to the training phase of neural network models. However, introducing DP into neural network models is very subtle and error-prone, resulting in that some differentially private neural network models may not achieve privacy guarantee claimed. In this paper, we propose a method, which can audit privacy budget of differentially private neural network models. The proposed method is general and can be used to audit some other AI models. We elaborate on how to audit privacy budget of basic DP mechanisms and neural network models by the proposed method first. Then, we run experiments to verify our method. Experiment results indicate that the proposed method is better than the advanced method and the auditing precise is high when the privacy budget is small. In particular, when auditing privacy budget of ResNet-18 over CIFAR-10 protected by the differentially private mechanism with theoretical privacy budget 0.2, the accuracy of our method is about 17 times that of the state-of-the-art method. For the simpler dataset FMNIST, the accuracy of our method is about 32 times that of the state-of-the-art method when theoretical privacy budget is 0.2.