AID-H-005: AI Privacy & Privacy-Preserving ML (PPML) Controls
Apply privacy controls across AI training, fine-tuning, inference, retrieval, and embedding storage so sensitive records and derived representations are not exposed through membership inference, model inversion, memorization, vector reconstruction, or sensitive attribute leakage. This family includes cryptographic, statistical, data-centric, and storage-layer controls; it keeps the familiar PPML label while covering the broader privacy engineering surface that modern AI systems actually operate.
Scope boundary
Owns privacy engineering across training, fine-tuning, inference, retrieval, embeddings, and vector storage through statistical, cryptographic, data-centric, and storage-layer controls against memorization, inversion, membership inference, reconstruction, and sensitive-data exposure.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0024 Exfiltration via AI Inference API
- AML.T0024.000 Exfiltration via AI Inference API: Infer Training Data Membership
- AML.T0024.001 Exfiltration via AI Inference API: Invert AI Model
- AML.T0025 Exfiltration via Cyber Means
- AML.T0057 LLM Data Leakage
MAESTRO
- Membership Inference Attacks (L1)
- Data Exfiltration (L2)
- Data Leakage through Observability (L5)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM02:2026 Sensitive Information Disclosure
- LLM09:2026 Vector and Embedding Weaknesses
OWASP ML Top 10 2023
- ML03:2023 Model Inversion Attack
- ML04:2023 Membership Inference Attack
OWASP Top 10 for Agentic Applications 2026
- N/A
NIST Adversarial Machine Learning 2025
- NISTAML.032 Reconstruction
- NISTAML.033 Membership Inference
- NISTAML.034 Property Inference
- NISTAML.038 Data Extraction
Cisco Integrated AI Security and Safety Framework
- AITech-8.1 Membership Inference
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-10.2 Model Inversion
- AISubtech-8.1.1 Presence Detection
- AISubtech-8.2.1 Training Data Exposure
- AISubtech-8.2.2 LLM Data Leakage
- AISubtech-8.3.3 Personally Identifiable Information Exposure
- AISubtech-10.1.3 Sensitive Data Reconstruction
- AISubtech-10.2.1 Model Inversion
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- SDD: Sensitive Data Disclosure
- ISD: Inferred Sensitive Data
Databricks AI Security Framework 3.0
- Raw Data 1.3: Poor data quality
- Raw Data 1.4: Ineffective storage and encryption
- Datasets 3.2: Ineffective storage and encryption
- Model Management 8.4: Model inversion
- Model Serving - Inference requests 9.2: Model inversion
- Model Serving - Inference requests 9.5: Infer training data membership
- Model Serving - Inference response 10.6: Sensitive data output from a model