  We present a practical method to audit the differential privacy (DP)
guarantees of a machine learning model using a small hold-out dataset that is
not exposed to the model during the training. Having a score function such as
the loss function employed during the training, our method estimates the total
variation (TV) distance between scores obtained with a subset of the training
data and the hold-out dataset. With some meta information about the underlying
DP training algorithm, these TV distance values can be converted to
$(\varepsilon,\delta)$-guarantees for any $\delta$. We show that these score
distributions asymptotically give lower bounds for the DP guarantees of the
underlying training algorithm, however, we perform a one-shot estimation for
practicality reasons. We specify conditions that lead to lower bounds for the
DP guarantees with high probability. To estimate the TV distance between the
score distributions, we use a simple density estimation method based on
histograms. We show that the TV distance gives a very close to optimally robust
estimator and has an error rate $\mathcal{O}(k^{-1/3})$, where $k$ is the total
number of samples. Numerical experiments on benchmark datasets illustrate the
effectiveness of our approach and show improvements over baseline methods for
black-box auditing.
