**Model inversion and membership inference.** Given an output of a model, _model inversion_ aims to construct an input that produces that output. This problem was investigated for simple regression classifiers in (Fredrikson et al., 2014, 2015) and extended to neural face-recognition classifiers in (Zhang et al., 2020). In some cases, model inversion can help recover training data. For example, in face-recognition classifiers each class corresponds to a single person, thus any image recovered by model inversion is visually similar to the training images for the same class label. (Zhang et al., 2022) used model inversion techniques to recover memorized training data from pretrained language models. A related problem is _membership inference_: given a data point, determine whether it was part of the model's training data or not (Shokri et al., 2017). Duan et al. (2023) demonstrated membership inference for in-context learning.