We introduce Epsilon*, a new privacy metric for measuring the privacy risk of a single model instance prior to, during, or after deployment of privacy mitigation strategies. The metric requires only black-box access to model predictions, does not require training data re-sampling or model re-training, and can be used to measure the privacy risk of models not trained with differential privacy. Epsilon* is a function of true positive and false positive rates in a hypothesis test used by an adversary in a membership inference attack. We distinguish between quantifying the privacy loss of a trained model instance, which we refer to as empirical privacy, and quantifying the privacy loss of the training mechanism which produces this model instance. Existing approaches in the privacy auditing literature provide lower bounds for the latter, while our metric provides an empirical lower bound for the former by relying on an (${\epsilon}$, ${\delta}$)-type of quantification of the privacy of the trained model instance. We establish a relationship between these lower bounds and show how to implement Epsilon* to avoid numerical and noise amplification instability. We further show in experiments on benchmark public data sets that Epsilon* is sensitive to privacy risk mitigation by training with differential privacy (DP), where the value of Epsilon* is reduced by up to 800% compared to the Epsilon* values of non-DP trained baseline models. This metric allows privacy auditors to be independent of model owners, and enables visualizing the privacy-utility landscape to make informed decisions regarding the trade-offs between model privacy and utility.

翻译：我们提出Epsilon*，这是一种新的隐私度量指标，用于测量单个模型实例在实施隐私缓解策略之前、期间或之后的隐私风险。该指标仅需对模型预测进行黑盒访问，无需重新采样训练数据或重新训练模型，并且可用于测量未采用差分隐私训练的模型的隐私风险。Epsilon*是成员推断攻击中对手所使用假设检验的真阳性率和假阳性率的函数。我们区分了量化训练后模型实例的隐私损失（我们称之为经验隐私）与量化产生该模型实例的训练机制的隐私损失。现有隐私审计文献中的方法为后者提供下界，而我们的指标则通过依赖基于(ϵ, δ)类型的量化方法来衡量训练后模型实例的隐私，从而为其提供经验下界。我们建立了这些下界之间的关系，并展示了如何实现Epsilon*以避免数值和噪声放大不稳定性。我们进一步在基准公共数据集上的实验表明，Epsilon*对通过差分隐私训练进行的隐私风险缓解具有敏感性，与未采用差分隐私训练的基线模型相比，其Epsilon*值降低高达800%。该指标使隐私审计者能够独立于模型所有者，并通过可视化隐私-效用图景来做出关于模型隐私与效用权衡的明智决策。