Model Extraction and Membership Inference Attacks on Deployed Models

Abstract

A prediction interface gives away more than a prediction. Query it enough times and an attacker can rebuild a working copy of the model, decide whether a particular record was in its training set, or in some settings recover the record itself. This review covers thirty three works and separates two attack families that are often treated as one. Extraction targets the model as intellectual property; inference targets the people whose data trained it. We trace the progression from the first prediction API attack to modern likelihood ratio tests that succeed at low false positive rates, and we explain why average case accuracy is the wrong way to report a membership attack. On the defensive side we group techniques into prevention, obstruction and attribution, and we note that only the first carries a formal guarantee. Two conclusions stand out. Overfitting drives membership leakage but does not fully explain it. And watermarking, the industry favourite for extraction, has weaker guarantees than its adoption would suggest.