Black-Box Auditing

Systematically modifies inputs to observe how outputs change, revealing decision boundaries and sensitivities. This is the foundational technique for probing opaque models.

• Counterfactual Perturbation: Change a single feature (e.g., gender pronoun) while holding all others constant to isolate its causal effect on the output
• Adversarial Perturbation: Apply mathematically optimized noise imperceptible to humans to test model robustness and find failure modes
• Stress Testing: Push inputs to extreme or out-of-distribution values to map the model's safe operating envelope

Example: Changing only the gender pronoun in a resume from 'he' to 'she' and observing if the candidate ranking score shifts significantly.

Verifies that a model's outputs satisfy known mathematical or logical relationships when inputs are transformed in specific ways. This technique is critical when no ground-truth labels exist.

• Symmetry Checks: Flipping an image horizontally should not change the classification of the object within it
• Monotonicity Checks: Increasing a credit applicant's income should never decrease their creditworthiness score
• Invariance Assertions: Adding a neutral sentence to a text should not alter the sentiment classification

Example: A speech-to-text system should produce the same transcription for an audio file and its noise-reduced version, as the linguistic content is invariant.

Determines whether a specific data record was part of the model's training set by analyzing subtle differences in the model's confidence scores. This is the primary technique for auditing training data privacy and detecting unauthorized data usage.

• Shadow Model Training: Train surrogate models on known data to learn the signature of 'memorized' versus 'unseen' records
• Confidence Score Analysis: Overfitted models often exhibit higher confidence on training data members
• Label-Only Attacks: Infer membership even when only the predicted class label is returned, not the probability vector

Example: Auditing a medical diagnosis model to verify that a specific patient's records were not used in training without consent, by observing if the model's prediction confidence is anomalously high for that record.

Reconstructs sensitive training data or steals model functionality through systematic querying. These techniques audit for intellectual property leakage and training data confidentiality.

• Model Extraction: Query the target model with a diverse input set and train a clone model on the input-output pairs to replicate its decision boundary
• Attribute Inference: Statistically infer sensitive attributes of training data subjects (e.g., race, health status) from aggregate model behavior
• Equation Solving: For models exposing confidence scores, treat each query as a constraint in a system of equations to recover internal parameters

Example: Querying a facial recognition API millions of times to reconstruct recognizable images of individuals in the training set, demonstrating a violation of data minimization principles.

Evaluates whether model outputs exhibit systematic disparities across protected groups by analyzing aggregate outcome distributions. This is the core technique for fairness auditing under black-box access.

• Demographic Parity: Measure if the positive outcome rate is equal across groups (e.g., equal loan approval rates)
• Conditional Statistical Parity: Control for legitimate explanatory factors before testing for residual group disparities
• Kolmogorov-Smirnov Test: Statistically compare the full score distributions between groups, not just binary outcomes

Example: Auditing a hiring screen tool by submitting thousands of identical resumes varying only the inferred race of the candidate's name, then testing if callback rate distributions are statistically indistinguishable.

Maps the model's decision surface by densely sampling the input space to identify regions of instability, bias, or unexpected behavior. This technique visualizes the model's logical geography.

• Random Walk Sampling: Generate input sequences by taking small random steps and observing where predictions flip
• Manifold Traversal: Navigate along the data manifold using generative models to produce realistic inputs that probe boundary regions
• Voronoi Approximation: Partition the input space into regions of constant prediction to identify narrow corridors of minority class assignment

Example: Sampling thousands of points along the line segment connecting two loan applicants—one approved and one denied—to find the precise decision threshold and check if it crosses protected attribute boundaries.