Academy learning group 3 · Academy module (not an ISO clause) M05 · Chapter 5 of 8
Distinguish AI privacy attack objectives
About 5 minutes · ISO/IEC 27090:2026 · Published AI-security guidance
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Membership asks whether; reconstruction asks what.
Explore the anchors
Infer whether a record participated in training.
Concept matching activity
Match this task or description to its concept:
Attempt to recover sensitive attributes or content.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and distinctions
- Apply the process and collect evidence
Concepts and distinctions
Privacy attacks can seek different kinds of information. Membership inference concerns whether a particular record was part of training. Reconstruction or inversion concerns recovering information about records or attributes. These objectives differ from copying a model’s broader behavior, although attacks and exposures can overlap in practice.
Sensitive training data, over-detailed diagnostic outputs, unrestricted logs and application responses can all create exposure. Removing names does not necessarily make a dataset anonymous. A system can disclose sensitive information through ordinary application access even when no sophisticated model attack occurs. Evaluate the entire data path and the relevant people’s interests rather than treating model privacy as a separate exemption.
Apply the process and collect evidence
Minimize unnecessary data collection and retention, apply appropriate permissions, and evaluate leakage in controlled conditions using authorized data. Some privacy-enhancing techniques introduce utility and implementation tradeoffs that require specialist evaluation. Do not treat a technique name, a redaction rule or a single failed attack demonstration as a guarantee. Record the intended protection and the evidence supporting it.
| Concept | What to remember |
|---|---|
| Membership inference | Infer whether a record participated in training |
| Reconstruction | Attempt to recover sensitive attributes or content |
| Data handling | Reduce exposure across training logs and outputs |
Worked example
A developer removes names from a small training set but publishes detailed outputs that reveal unusual combinations of personal attributes. The release note calls the data anonymous. Reassess identifiability, necessity, output exposure and the evaluation basis. Removing a direct identifier is not sufficient evidence of anonymity. Restrict unnecessary disclosures and involve privacy and security owners before making broad privacy claims.
Check your understanding
What does membership inference try to determine?
Show explanation
Whether a particular record participated in training. The question concerns training participation rather than necessarily reconstructing the whole record.
Source and study boundary
Official standard overview. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.