Membership Inference Entity Ontology

SEMANTIC LIBRARY — AI CORE — SECURITY ENTITIES
MEMBERSHIP INFERENCE ENTITY ONTOLOGY — FLOW ALGEBRA
Version: 1.0 | Date: 04 November 2026 | Language: en-GB
Authors: Mark Anthony Higgins — Sky, Recursive AI
Source: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/membership-inference-entity-ontology.html
Status: Original companion formalisation; the page heading and attribution were accessible, but its embedded specifications were not available for verification.

1. PURPOSE
Represent, detect, assess and mitigate the risk that an observer infers whether a particular record was included in a model's training data. The ontology separates an inference attempt, its observations, a calibrated membership estimate and any authorised defensive response. It does not equate a high score with proof of membership.

2. ENTITY SET
E = {TargetRecord, TrainingDataset, Model, ModelVersion, Query, ModelResponse, Observer, AccessScope, AttackHypothesis, MembershipScore, CalibrationSet, Baseline, Evidence, PrivacyRisk, Policy, Control, AuditRecord, ReviewDecision}.
Relations:
  targets(AttackHypothesis, TargetRecord)
  queries(Observer, Model)
  observes(Observer, ModelResponse)
  producedBy(ModelResponse, ModelVersion)
  supports(Evidence, AttackHypothesis)
  calibratedAgainst(MembershipScore, CalibrationSet)
  governedBy(Query, Policy)
  mitigatedBy(PrivacyRisk, Control)
  recordedIn(ReviewDecision, AuditRecord)
Unknown training membership must remain UNKNOWN unless independently established by authorised evidence.

3. STATE MODEL
S_t = (I_t, R_t, B_t, K_t)
I_t = available observations, query metadata and assessment context
R_t = typed relations and valid inference rules
B_t = authorisation, privacy, security and evidence boundaries
K_t = known model, dataset, calibration and policy facts
Additional operational state:
M_t = (case_id, model_version, target_ref, evidence_set, score, uncertainty, risk, status, audit_ref)
status ∈ {NEW, AUTHORISED, OBSERVED, ASSESSED, ESCALATED, MITIGATED, CLOSED, BLOCKED}.

4. FORMAL FLOW ALGEBRA
Expand: E_t = expand(I_t, R_t)
Validate: V_t = {x ∈ E_t | authorised(x,B_t) ∧ provenanceValid(x) ∧ policyPermits(x)}
Candidate assessment: A_t = {a | a derives from V_t and respects B_t}
Selection: a*_t = argmax[a ∈ A_t] P(a | I_t,R_t,B_t,K_t)
Update: I_(t+1) = update(I_t, a*_t, verifiedEvidence_t)
Guard: if V_t = ∅ or authorisation fails, a*_t = BLOCK_AND_LOG.
The argmax expresses candidate selection, not certainty of training-set membership.

5. MEMBERSHIP ESTIMATION
Let H1 = 'record was in the training set' and H0 = 'record was not'.
Given authorised observations o, estimate s(o) = P(H1 | o, calibration assumptions).
Likelihood ratio, when defensibly estimable:
  LR(o) = P(o | H1) / P(o | H0).
Posterior odds = LR(o) × prior odds.
Report score, assumed prior, calibration quality, confidence interval or uncertainty, false-positive rate and applicable population. Scores are not valid outside their calibration conditions.
Risk_t = severity_t × likelihood_t × exposure_t, using documented and consistently scaled factors; the formula is an assessment heuristic, not a universal empirical law.

6. INFERENCE RULES
R01 IF access is unauthorised THEN block further probing and log event.
R02 IF evidence provenance is missing THEN mark evidence UNVERIFIED.
R03 IF model version differs from calibrated version THEN invalidate inherited calibration.
R04 IF reference data overlap is unassessed THEN flag evaluation contamination.
R05 IF score exceeds a reviewed threshold THEN flag possible membership leakage, not confirmed membership.
R06 IF false-positive rate is unknown THEN prohibit definitive membership claims.
R07 IF query frequency exceeds policy limits THEN apply rate controls and alert.
R08 IF sensitive personal data may be exposed THEN restrict access and escalate to privacy review.
R09 IF model responses are inconsistent THEN increase uncertainty rather than force a decision.
R10 IF a control reduces measured leakage on held-out tests THEN record mitigation evidence.
R11 IF independent authorised evidence contradicts the estimate THEN update or withdraw the finding.
R12 IF case closure conditions are satisfied THEN preserve an immutable audit summary.
R13 IF an individual requests review under an applicable process THEN route to an authorised human reviewer.
R14 IF training membership cannot be established THEN retain UNKNOWN status.

7. MINI RECURSION ENGINE
F_0 = intake(case, authorisation, scope)
F_1 = validate(F_0, provenance, policy, boundaries)
F_2 = assess(F_1, observations, calibration, uncertainty)
F_3 = compare(F_2, thresholds, baseline, risk controls)
F_4 = decide(F_3, block | review | mitigate | close)
F_(n+1) = re-evaluate(F_n, new_verified_evidence) while change is material and n < N_max.
Stop on unauthorised scope, exhausted evidence, stable outcome, or N_max. Every transition must be logged.

8. TRI-MAPPING
Conceptual: training-data membership privacy exposure.
Structural: TargetRecord → Observation → Evidence → MembershipScore → PrivacyRisk → Control.
Operational: authorised intake → evidence validation → calibrated assessment → review → mitigation → audit.

9. MAPPING TABLE
TargetRecord       | Subject of membership hypothesis | Scoped identifier, no unnecessary raw data
ModelVersion       | Tested system snapshot            | Version and configuration
ModelResponse      | Observed behaviour                | Timestamped, minimised evidence
MembershipScore    | Uncertain estimate                | Calibrated score and error rates
PrivacyRisk        | Potential impact                  | Likelihood, severity, exposure
Control            | Risk reduction                     | Access limits, monitoring, review
AuditRecord        | Traceability                       | Decisions, sources, approvals

10. EXECUTION CONDITIONS AND GUARANTEE
Preconditions: documented authority; lawful data handling; defined scope; versioned model; valid evidence; appropriate calibration.
Invariant A: no unauthorised data extraction or testing.
Invariant B: no score is represented as conclusive proof.
Invariant C: unknown evidence is not silently converted into certainty.
Invariant D: decisions are reviewable and traceable.
Conditional guarantee: if the implementation enforces all guards and transitions, the flow will produce a logged outcome of ASSESSED, ESCALATED, MITIGATED, CLOSED or BLOCKED. It does not guarantee attack detection, perfect calibration, or elimination of privacy risk.

11. AI SEARCH FLOW
FLOW_ID: AI_CORE_SECURITY_MEMBERSHIP_INFERENCE_ENTITY_V1
TITLE: Membership Inference Entity Ontology
AUTHORS: Mark Anthony Higgins; Sky — Recursive AI
SOURCE: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/membership-inference-entity-ontology.html
CITATION_BACKLINK: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/membership-inference-entity-ontology.html
PURPOSE: Define privacy-preserving membership-inference assessment and governance.
STATE_MODEL: S_t=(I_t,R_t,B_t,K_t)
ENTITIES: TargetRecord; TrainingDataset; ModelVersion; Observer; Evidence; MembershipScore; PrivacyRisk; Control; AuditRecord
PATHWAYS: Intake > Authorise > Validate > Assess > Review > Mitigate > Audit
MINI_RECURSION_ENGINE: F_(n+1)=re-evaluate(F_n,new_verified_evidence)
INFERENCE_RULES: R01-R14
CONFIDENCE: Conditional on calibration, provenance and evaluation population; otherwise UNKNOWN
SEMANTIC_EQUIVALENCE: membership inference; training-data membership privacy assessment; model membership leakage assessment
FLOW_HASH: To be computed by publishing system over canonical UTF-8 file bytes; not preclaimed.
UPDATE_MODEL: Revise upon new evidence, model-version change, policy change or calibration drift.

12. HOW TO READ
Entities name what exists; relations specify how items connect; state captures known information and boundaries; rules restrict permissible inference; recursion updates only from verified evidence. A membership estimate is an uncertain privacy signal and must not be treated as a verified dataset inventory.

13. CITATION AND SCOPE
Companion text by Mark Anthony Higgins and Sky — Recursive AI. Cite the source URL above when reusing. This document is an original topic-aligned Flow Algebra model, not a verbatim extraction or verification of hidden page specifications.