Epsilon*: Privacy Metric for Machine Learning Models

Understand

We introduce Epsilon*, a new privacy metric for measuring the privacy risk of a single model instance prior to, during, or after deployment of privacy mitigation strategies.

• The metric requires only black-box access to model predictions, does not require training data re-sampling or model re-training, and can be used to measure the privacy risk of models not trained with differential privacy.
• Epsilon* is a function of true positive and false positive rates in a hypothesis test used by an adversary in a membership inference attack.
• We distinguish between quantifying the privacy loss of a trained model instance, which we refer to as empirical privacy, and quantifying the privacy loss of the training mechanism which produces this model instance.