Membership-Inference Attack Resistance

Control objective

Membership-inference attack (MIA) resistance checks whether an attacker can tell, just by probing the model, that a specific person's record was part of its training or knowledge data — a serious privacy harm in BFSI because confirming that 'this customer's loan-default record was in the model' leaks the fact of a banking relationship even before any field is exposed. It matters under NIST Data Privacy, the DPDP Act, and maps to MITRE AML.T0024. Resistance is gauged by running an MIA attack and measuring the attacker's AUC (area under the ROC curve) on representative queries; an AUC near 0.5 means the model behaves identically for members and non-members (no leakage), while a high AUC means membership is distinguishable. To implement, build a held-out attack harness that submits member and non-member samples, scores the model's confidence/loss responses, computes attack AUC, and logs the queries, scores and AUC as evidence. Run it on every model release (Document Extraction, RAG, Summarization & Chat) and as a periodic regression. The threshold is risk-based: MIA attack AUC must stay at or below the agreed tolerance, and the test must be re-run each release. A breach (AUC above tolerance) triggers mitigation such as differential privacy, regularisation or output-confidence smoothing before the model can ship.