AI explanation interfaces, built to make models trustworthy, turn out to be a useful attack surface for stealing information about training data.
A new paper introduces TIER, short for Trajectory-Invariant Explanation Regularization, a defense built into the model training process itself. The attack it counters works by feeding carefully chosen inputs to an AI model and watching how its confidence score drops across a sequence of steps - a pattern that leaks whether a specific data point was in the training set. Existing defenses largely target simpler membership-inference methods and miss this trajectory-based variant entirely. TIER fights back by penalizing erratic confidence-drop patterns during training and using a statistical technique called KL-divergence to keep the distribution of those drops similar between training members and non-members.
The stakes here are higher than they look. Membership-inference attacks are a known compliance risk under privacy regulations, and the irony is that explanation APIs - the features companies add to satisfy transparency demands - are the lever being pulled. A defense that works at training time rather than patching the API layer is a meaningful architectural shift.
The researchers report that TIER preserves both model accuracy and explanation quality, though independent replication on production-scale models would be the real test of that claim.