An attacker repeatedly submits carefully chosen inputs to a cloud-hosted fraud detection model and studies its confidence scores to determine whether a specific person's transaction record was part of the training data. What type of attack is this?

Membership inference exploits the tendency of models, especially overfitted ones, to behave differently on records they were trained on, often returning higher confidence scores. By comparing outputs for a target record against what is expected for unseen data, an attacker infers whether that individual's data was used for training. That disclosure can itself be sensitive, for example revealing that a person was a fraud case or a patient. Data poisoning is an integrity attack carried out during data collection or training, where malicious records skew the model; the scenario involves only queries to a deployed model, not changes to its inputs. Model extraction also relies on queries, but its goal is to replicate the model's functionality or parameters, a threat to intellectual property rather than to an individual's privacy. Prompt injection targets applications built on language models by smuggling instructions into input text; a fraud scoring model that returns confidence values has no instructions to override. Exam caveat: membership inference and model inversion are both privacy attacks on the trained model; inversion reconstructs attributes, while membership inference answers a yes-or-no inclusion question. Operational check: test the model with a membership inference evaluation, and reduce leakage through regularization, differential privacy or returning labels instead of raw scores.