Courts IT trains helpers on sets that may include sensitive opinion text. Which AI-specific vulnerability class should the threat assessment include?

When courts IT trains helpers on sets that may include sensitive opinion text, the threat assessment should include model inversion and membership-inference risks. Those AI-specific privacy vulnerabilities can reconstruct training content or infer whether a particular record participated in training, threatening sealed or sensitive judicial material even without a classic database breach. Including them works because civic AI threat modeling must cover machine-learning attack classes that conventional IT threat lists omit, especially when training data sensitivity is high.

Focusing only on prompt injection risks that steer helper answers using crafted docket entries or queries fails because those attacks manipulate outputs at inference time rather than exposing training-set content or whether a record participated in training. Focusing only on data poisoning risks that embed backdoors through tainted annotations during retraining cycles fails because that integrity threat manipulates model behavior rather than revealing training-set content or participation. Focusing only on adversarial evasion risks that bypass content filters using paraphrased filing language at inference time fails similarly: inference-time evasion does not address model-memorization or membership inference against sensitive opinion text.

Exam caveat: presence of risk classes on the register does not mean every model is equally vulnerable—smaller, tightly scoped, or retrieval-grounded systems may reduce exposure—but omission of the classes is the assessment failure. Operational check: classify training corpora for sensitivity, apply minimization and access controls, evaluate inversion/membership test feasibility with privacy reviewers, prefer RAG with controlled corpora over fine-tuning on sealed text when possible, and document residual privacy risk for judicial leadership.