ORC Seminar: OR with a White Hat: Evidencing Privacy Vulnerabilities in ML Models

Inside the event

Thibaut Vidal Professor École Polytechnique de Montréal Abstract: The deployment of machine learning models in high-risk domains (e.g., finance, medicine) raises questions about the privacy of the data used to train them. In this talk, I will show that operations research methods can provide a rigorous methodological backbone for auditing and mitigating certain privacy risks in ML models. I will first discuss a white-box reconstruction attack that formulates the recovery of a random forest’s training data as a combinatorial problem solved with constraint programming. This approach reconstructs entire datasets with high accuracy, even from forests with only a few trees. Next, we turn to black-box access and explainability-driven interfaces. Counterfactual explanations (increasingly needed and exposed through ML APIs) represent a powerful attack surface. Using tools from online optimization and competitive analysis, we derive tight bounds on the number of counterfactual queries required to extract tree-based models and introduce new algorithms achieving provably perfect fidelity. Finally, we will examine the protection offered by differential privacy. Focusing on ε-DP random forests, we demonstrate that even models satisfying strict DP guarantees can still leak meaningful, dataset-specific information in practice, unless the privacy noise is increased to the point where the model loses most of its predictive value. Overall, the talk highlights critical tensions between predictive performance, explainability, and privacy protection, and showcases OR-based techniques as powerful tools for navigating these trade-offs. Related references : Ferry, J., Fukasawa, R., Pascal, T., & Vidal, T. (2024). Trained random forests completely reveal your dataset. ICML’24 (oral). http://arxiv.org/abs/2402.19232 Khouna, A., Ferry, J., & Vidal, T. (2025). From counterfactuals to trees: Competitive analysis of model extraction attacks. NeurIPS’25 (spotlight). http://arxiv.org/abs/2502.0532