CLASSIFICATION MODEL EVALUATION

A computer implemented method, computer system and computer program are provided for determining a measure of susceptibility of a machine-learned classification model to model inversion attacks. The method obtains a set of sample data from the classification model, the set of sample data comprising a plurality of samples, each sample comprising a respective classification produced by the classification model for an associated set of input values. The method trains a replica of the classification model using the sample data. The method obtains a set of further sample data from the classification model, the set of further sample data comprising a plurality of further samples, each further sample comprising a respective classification produced by the classification model for an associated set of input values. The method evaluates a property of the replica of the classification model using the further sample data. The method provides a measure of the level of susceptibility of the classification model to model inversion attacks based on the number of samples in the sample data used to train the replica of the classification model and the property of the replica of the classification model.