Model inversion attack

The model inversion attack rests on two papers by Fredrikson et al. In 2014, at USENIX Security, they queried a warfarin dosing model and recovered a patient's VKORC1 and CYP2C9 genetic markers from the dose and a few demographic attributes. In 2015, at ACM CCS, they went after a facial recognition model and, from a person's name and the API's confidence scores alone, rebuilt an image of the face that volunteers could recognize. The attack differs from membership inference. Membership inference asks whether a specific person was in the training set; model inversion reconstructs generic representations of the private data that shaped the model. On image generators, modern techniques known as GAN-inversion rebuild high-resolution images of faces or medical documents by optimizing an input until it produces the target output. An insurer whose pricing model was trained on confidential medical or behavioral data then faces GDPR compliance questions, particularly under the data minimization principle and Article 25 on data protection by design. The main defense is differential privacy during training, which perturbs gradients to limit memorization at the cost of a small loss in predictive performance. That trade-off between accuracy and privacy has become a central question in AI governance for insurers.