Membership inference
Also called Membership Inference Attack
Figuring out whether a specific record was in the training set just by poking at the finished model.
Think of it like
Guessing whether a chef ever cooked a dish before by how confidently and smoothly they plate it.
Example
A researcher shows a model responds with unusual certainty to one patient’s exact record, hinting that record was in the private training data.
How it actually works
Models tend to be more confident on examples they memorized, so an attacker compares the model’s behavior on candidate records to expected behavior on unseen ones. It matters because a successful attack turns an anonymized dataset into a privacy leak. Differential privacy and reducing overfitting are the standard defenses.
For product teams
It is the reason "we trained on anonymized data" is not automatically a privacy guarantee.
For engineers
Attackers exploit the confidence gap between train and test examples; mitigate with DP-SGD, regularization, and limiting memorization.
Related
- A stronger defense against it is differential privacy.
- Model inversion — Both exploit what a model memorized about its training data.
Read anything AI without the jargon
Look up any term in plain English, or save terms as you read with the free Chrome extension.
Open DecoderAdd to Chrome