Academy module 5 · ISO/IEC 27090 · Lesson 5 of 8
Distinguish AI privacy attack objectives
About 8 minutes · Introductory draft · Checked 2026-10-23
AI-authored and AI editorially reviewed; independent review pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Membership asks whether; reconstruction asks what.
Explore the anchors
Infer whether a record participated in training.
Concept matching activity
Match this task or description to its concept:
Attempt to recover sensitive attributes or content.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What you will learn
- Infer whether a record participated in training.
- Attempt to recover sensitive attributes or content.
- Reduce exposure across training logs and outputs.
Concepts and distinctions
Privacy attacks can seek different kinds of information. Membership inference concerns whether a particular record was part of training. Reconstruction or inversion concerns recovering information about records or attributes. These objectives differ from copying a model’s broader behavior, although attacks and exposures can overlap in practice.
Sensitive training data, over-detailed diagnostic outputs, unrestricted logs and application responses can all create exposure. Removing names does not necessarily make a dataset anonymous. A system can disclose sensitive information through ordinary application access even when no sophisticated model attack occurs. Evaluate the entire data path and the relevant people’s interests rather than treating model privacy as a separate exemption.
Apply the process and collect evidence
Minimize unnecessary data collection and retention, apply appropriate permissions, and evaluate leakage in controlled conditions using authorized data. Some privacy-enhancing techniques introduce utility and implementation tradeoffs that require specialist evaluation. Do not treat a technique name, a redaction rule or a single failed attack demonstration as a guarantee. Record the intended protection and the evidence supporting it.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
A developer removes names from a small training set but publishes detailed outputs that reveal unusual combinations of personal attributes. The release note calls the data anonymous.
Compare your reasoning
Reassess identifiability, necessity, output exposure and the evaluation basis. Removing a direct identifier is not sufficient evidence of anonymity. Restrict unnecessary disclosures and involve privacy and security owners before making broad privacy claims.
Remember
- Membership asks whether; reconstruction asks what.
- Infer whether a record participated in training.
- Reduce exposure across training logs and outputs.
Orientation and further reading
- ISO: ISO/IEC 27090:2026 · Published AI-security guidance
- NIST AI 100-2 E2025: adversarial machine learning
Original examples and explanations. Background references do not establish complete exam coverage.
Try ISO/IEC 27090 practice questions · Report a content correction