Infer Training Data Membership
This technique is theoretically possible but has not been publicly demonstrated.
Adversaries may infer the membership of a data sample or global characteristics of the data in its training set, which raises privacy concerns. Some strategies make use of a shadow model that could be obtained via [Train Proxy via Replication](/techniques/AML.T0005.001), others use statistics of model prediction scores.
This can cause the victim model to leak private information, such as PII of those in the training set or other forms of protected IP.