A regulator asks whether your clinic's deployed model discloses who attends — what can you honestly claim?

## Why this question is hard in a way the technical ones are not The person asking can compel an answer, will read it literally, and will hold the organisation to it later. So the task is not to characterise the attack; it is to decide which sentences the organisation is prepared to defend for years. Most of the damage in this situation is done by an overclaim written by someone technical who meant something narrower than what they wrote. ## The three tiers of claim, and which you can actually make **Tier 1 — an empirical negative.** "An evaluation using an adversary with query access and a candidate record, receiving a risk band only, achieved no better than chance across a sample of *n* member and non-member records." This is defensible and weak on purpose. It bounds *the attack that was run, under the access it was granted, on the records that were sampled.* It says nothing about a better attack, a more informative output, or the atypical records the sample missed. Write it with those qualifiers or it will be read as tier 2. **Tier 2 — a general negative.** "The model does not disclose membership." Nothing you can measure supports this. Evaluations are lower bounds on adversary capability; the space of attacks is not enumerable. Do not sign it. **Tier 3 — a bounded claim about attacks you did not run.** Only available when the model was trained under a formal privacy mechanism, and only when quoted properly: the privacy parameter *with* its delta and the accounting method used, since a parameter alone is not comparable to any other parameter and a delta that is not far below one over the dataset size makes the bound vacuous. Two further honesty requirements a regulator's technical advisor will know: the standard bound is stated over one neighbouring record, so a person contributing many records is covered only by a group bound that degrades with their count; and the budget composes across everything released from that data, not per model. ## What the regulator is actually asking about Strip the machine-learning vocabulary and the question is: *can an outsider establish that a named person attends this clinic?* Three facts answer it, and only one is about the attack. 1. **What the corpus's definition asserts.** If the training set is "our attending patients", membership is a health fact about a named individual, full stop. Say this first, because it is the reason the question is being asked and pretending otherwise reads as evasion. 2. **Who can query the deployment with inputs of their choosing.** This is the exposure surface and it is usually the most changeable thing in the whole picture. An endpoint reachable by any authenticated clinician is a different world from one reachable by the public, and the difference is an access decision, not a modelling one. 3. **What a measured attack achieved**, with its access assumption, its query cost per record, and its behaviour on atypical records rather than only its average. ## The decisions that are yours to own **Should this model be queryable at all by anyone outside a small, named, audited audience?** When a training set is a roster, the model is a membership oracle for that roster to whoever can call it. That is an architectural fact, not a bug to be patched at the output layer, and the honest options are to restrict callers, to accept the residual explicitly, or to train differently. **Who absorbs the cost of a formal guarantee?** A training-time privacy mechanism is the only thing that yields a tier-3 claim, and it is paid for in accuracy. Crucially, that cost is not spread evenly: it falls hardest on rare classes and small subgroups, which in a clinical corpus are the unusual presentations, that is, the patients for whom the model's output matters most and who are also the ones most exposed by membership attacks in the first place. Deciding to pay that bill, and deciding who it is paid by, is a leadership call and must be recorded as one. **What do you say about deletion?** If someone asks whether a specific record is gone, the truthful answer separates the store from the model: the row can be removed from the database immediately, and the weights fitted on it are unchanged until the model is retrained without it. Promising more than that in writing is the classic irreversible mistake here. **What do you not say?** Do not offer output coarsening as though it settled the question; it raises the adversary's price and does not touch an adversary who cares about one named person. Do not quote an attack's low average accuracy as reassurance without the operating point on unusual records. Do not quote a privacy parameter without its delta and accounting. ## The shape of a defensible written answer Name the fact at risk. Name who can query. State what you measured and its qualifiers. State which stronger claim you are *not* making and why. State the decision you took about access, the residual you accepted, and who accepted it. That answer survives being read back to you, which is the only property that matters here.