Privacy in Theory, Bugs in Practice: Grey-Box Auditing of Differential Privacy Libraries
Authors: Tudor Cebere (PreMeDICaL team, Inria, Idesp, Inserm, Université de Montpellier), David Erb (Technical University of Munich & Oblivious), Damien Desfontaines (Hiding Nemo), Aurélien Bellet (PreMeDICaL team, Inria, Idesp, Inserm, Université de Montpellier), Jack Fitzsimons (Oblivious)
Volume: 2026
Issue: 3
Pages: 467–483
DOI: https://doi.org/10.56553/popets-2026-0091
Abstract: Differential privacy (DP) implementations are notoriously prone to errors, with subtle bugs frequently invalidating theoretical guarantees. Existing verification methods are often impractical: formal tools are too restrictive, while black-box statistical auditing is intractable for complex pipelines and fails to pinpoint the source of the bug. This paper introduces Re:cord-play, a "gray-box" auditing paradigm that inspects the internal state of DP algorithms. By running an instrumented algorithm on neighboring datasets with identical randomness, Re:cord-play directly checks for data-dependent control flow and provides concrete falsification of sensitivity violations by comparing declared sensitivity against the empirically measured distance between internal inputs. We generalize this to Re:cord-play-sample, a full statistical audit that isolates and tests each component, including untrusted ones. We show that our novel testing approach is both effective and necessary by auditing 12 open-source libraries, including SmartNoise SDK, Opacus, and Diffprivlib, and uncovering 13 privacy violations that impact their theoretical guarantees. We release our framework as an open-source Python package, thereby making it easy for DP developers to integrate effective, computationally inexpensive, and seamless privacy testing as part of their software development lifecycle.
Keywords: differential privacy, privacy auditing, implementation security, testing framework
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
