Researchers show an assessor valuation model can leak whether a specific parcel was in the training set. What privacy attack should the city treat as in scope?
Select an answer to reveal the explanation.
Short Explanation
If outsiders can tell that Parcel X was in the training set, that's membership inference—a privacy leak without dumping the whole model. You'll see model extraction that rebuilds weights through repeated queries, property inference about overall training stats, and reconstruction that rebuilds exact records, but they're about stealing behavior, learning aggregate trends, and rebuilding content, not just testing if one parcel participated. Tighten access and consider privacy-preserving training controls.
Full Explanation
Treating evidence that an assessor valuation model can leak whether a specific parcel was in the training set as membership inference in scope is correct because that attack class determines participation of a particular record without necessarily dumping model weights. Municipal assessor data often includes sensitive ownership, valuation, and appeal history; confirming membership can itself be a privacy harm and a precursor to further extraction. Privacy threat modeling for civic ML must include membership inference alongside classic exfiltration.
Model extraction that rebuilds model weights through repeated prediction queries fails because rebuilding weights to clone functionality does not test whether a specific parcel participated in training; labeling a membership test as extraction misidentifies the attack class. Property inference that reveals statistical properties of training data overall fails conceptually because exposing aggregate properties of the training dataset does not test participation of a particular record; labeling an individual membership test as property inference misidentifies the attack class. Training data reconstruction that rebuilds exact training records from model outputs fails because recovering full content of original records goes beyond merely testing membership; labeling a membership test as reconstruction misidentifies the attack class.
Exam caveat: public parcel data already being FOIA-accessible does not automatically make membership inference harmless—training membership can still expose non-public labels, appeal outcomes, or enrichment features joined during model build. Operational check: restrict model query interfaces, apply rate limits and monitoring for probing patterns, prefer privacy-preserving training where feasible, and document in the DPIA/privacy review that membership inference was considered for assessor models before production release.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.