Membership inference
A testing technique, and a category of attack when used adversarially, that determines whether a specific data point was part of a model's training set by analyzing the model's behavior or outputs on that data point compared to data it has never seen. Used defensively, it is how an organization tests whether a model has memorized specific individuals' data. (see Topic 5.3)
Defined in 2 GAGE programs, which carry 6 distinct definitions of it. The wording above is taught in Certified AI Data Governance Professional (CADGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A testing technique, and a category of attack when used adversarially, that determines whether a specific data point was part of a model's training set by analyzing the model's behavior or outputs on that data point compared to data it has never seen. Used defensively, it is how an organization tests whether a model has memorized specific individuals' data. (see Topic 5.3)
An attack that infers whether a specific record was present in a model's training data, a privacy risk distinct from a system revealing a live customer's data in conversation.
A related but distinct attack, covered in the next topic, where an adversary determines whether a specific piece of data was part of a model's training set, exploiting model behavior rather than a retrieval corpus. (see Topic 5.3)
A technique, covered in depth at Topic 5.1, by which a trained model can be queried in a way that reveals whether a specific record was part of its training data, one of the mechanisms behind Vector 4 (model memorization and inference).
A technique for testing whether a specific record was part of a model's training data, typically by exploiting the fact that models behave differently, often with higher confidence, on data they were trained on than on unseen data.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Retention versus the model that memorized: deleting data a model already learned from · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- The injectable corpus: documents that attack the AI that reads them · Poison, Leaks, and the Adversary, Certified AI Data Governance Professional (CADGP)
- The exposure report: what your data could give away, written before it does · Poison, Leaks, and the Adversary, Certified AI Data Governance Professional (CADGP)
- The deletion that was not: personal data found in a model trained last year · Data Incidents, Certified AI Data Governance Professional (CADGP)
- Privacy-enhancing technologies as decisions: differential privacy, federated learning, and when your organization actually needs them · The Frontier Discipline, Certified AI Data Governance Professional (CADGP)
- Red-teaming your own system: attacks a motivated user will find · Evaluation and Trust, Certified AI Governance Professional (CAIGP)
Where it shows up at work
A definition is where Membership inference starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Understands prompt injection, data poisoning, model theft, insecure integrations and excessive agent privileges, and the controls that reduce each.
One lesson on this page teach it as a primary outcome.
Reviews purpose, data, affected people, accuracy, bias, security, oversight, vendors and law for a use case, scores likelihood and impact, and documents residual risk.
One lesson on this page teach it as a primary outcome.
Finds unapproved AI use, sets which tools are approved and what may be pasted, and detects leakage without policing every keystroke.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Cybersecurity Risk Analystneeds working knowledge
- Chief Information Security Officer, AI security focusneeds it at depth
- AI Privacy Engineerneeds working knowledge · 6 open postings this week
- AI Vendor Risk Managerneeds working knowledge
- Third-Party Cyber Risk Managerneeds working knowledge
- Third-Party AI Risk Analystneeds working knowledge
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: OWASP Top 10 for LLM Applications; Google SAIF; NIST AI RMF MEASURE 2; NIST AI RMF MAP and MEASURE.
One interview question about it
What are the security failure modes specific to AI systems, and which conventional control covers none of them?
Asked of candidates for ai security fundamentals. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Cybersecurity and IT carries it as a claim to back up: Threat modeling and control design transfer; the AI-specific threats are new.
- A computer science or software engineering degree carries it as a claim to back up: Security fundamentals are a course you took, not yet a control you ran.
- A cybersecurity or information assurance degree carries it as work you can show: Security fundamentals are your coursework and your labs.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.