Membership inference
Membership inference is an attack that determines whether a particular record was part of a model’s training set, by observing how the model responds to it. It is the question a data protection officer asks when a model has been trained on customer data, because a positive answer is a disclosure about an identifiable person.
The signal it exploits is confidence. A model tends to respond to data it has seen during training with higher certainty than to data it has not, and that difference is measurable from the outside. The more a model has overfitted its training set, the wider the gap and the more reliable the inference, which is why this is one of the few privacy risks that shrinks as a model generalises better.
Why it is a disclosure depends entirely on what membership means. Knowing a record was in a general product catalogue is uninteresting. Knowing a record was in the training set of a model built from clinical histories, credit defaults or fraud cases reveals a fact about that person, and it does so without the attacker ever seeing the record itself.
The mitigations are decided before training rather than after: not training on personal data where a derived or aggregated set would serve, limiting overfitting, adding calibrated noise where the privacy requirement justifies the accuracy cost, and returning labels instead of confidence values at the interface. The practical output for a client is usually a paragraph in a data protection impact assessment stating whether this risk and model inversion were tested and what was found, and producing that is part of the AI assessment that answers what a trained model discloses about its training set.