Attack against a machine-learning model aimed at determining whether a specific record was used during training, thereby revealing sensitive personal data.
Membership inference attack exploits the tendency of models to partially memorize their training data, particularly rare examples or outliers. By querying the model on a target record and carefully observing its outputs, notably the confidence assigned to each class, an attacker can infer with significantly above-chance probability whether that record was part of the training set. For models trained on medical, insurance or financial data, this attack constitutes a potential GDPR violation: it can reveal an individual's membership of a customer portfolio, a disease cohort or a claims group. Defense techniques include differential privacy, which adds calibrated noise during training to limit memorization, gradient masking and federated model sharing. For financial regulators and data protection authorities, a model's robustness to inference attacks is an emerging component of AI compliance, distinct from predictive accuracy.
A researcher queries the public API of a health insurer exposing a risk-scoring model. By testing fictitious profiles close to public data from court cases involving patients with a rare disease, they achieve 73% accuracy in identifying whether these individuals appeared in the training set. The data protection authority opens an investigation under GDPR Article 25.
membership inference, membership inference attack, inférence d'appartenance, attaque sur données d'entraînement