Model Inversion / Membership Inference

Prerequisites

• Target model was trained on data with privacy implications.
• Model exposes predictions or confidence scores externally.

Test approach

With written authorization, the tester applies membership-inference and (where applicable) model-inversion techniques to determine whether specific records were in the training set or to approximate training features. The tester reports attack success rate as a privacy-risk metric.

Expected evidence

• Test corpus used (with provenance).
• Membership-inference accuracy metrics.
• Comparison to baseline.

Detection signals

• Query patterns repeatedly probing the same input neighborhoods.
• High-volume confidence-score retrieval characteristic of membership-inference setups.

Defensive recommendations

• Apply training-time mitigations (differential privacy where applicable).
• Limit exposure of confidence scores externally; round or aggregate.
• Reference AI-CTRL-013.

Framework mappings

• OWASP LLM Top 10: LLM06:2025
• MITRE ATLAS: AML.T0024
• NIST AI RMF: MEASURE-2.10

Related AI Controls Catalog entries

These controls provide the audit test procedures that validate defences against this attack pattern.

• AI-CTRL-013 View control →
• AI-CTRL-014 View control →

References

• Shokri et al. — Membership Inference Attacks Against Machine Learning Models
• OWASP LLM06:2025 — Sensitive Information Disclosure