It has become easy for a non-specialist with sensitive data to build a model: grab code from a hosting platform or let a coding agent assemble it, point it at the clinical records or transaction logs, and train. The data stays on your machine, which feels safe.

Property inference attacks target a subtler leak than the obvious one. They do not try to recover individual records; they try to expose global properties of the training set, facts about the population as a whole. Knowing what fraction of a hospital's patients had a particular condition can be sensitive even when no single patient is identifiable.

The angle here is that the attack can be planted in the code itself. If the training script came from somewhere you did not audit, it is in a position to arrange whatever it likes about the resulting model. The trust you extended was to a convenient snippet, and the thing you were protecting was the data it was about to read.