  Canary exposure, introduced in Carlini et al. is frequently used to
empirically evaluate, or audit, the privacy of machine learning model training.
The goal of this note is to provide some intuition on how to interpret canary
exposure, including by relating it to membership inference attacks and
differential privacy.
