Abstract: A computer implemented method, computer system and computer program are provided for determining a measure of susceptibility of a machine-learned classification model to model inversion attacks. The method obtains a set of sample data from the classification model, the set of sample data comprising a plurality of samples, each sample comprising a respective classification produced by the classification model for an associated set of input values. The method trains a replica of the classification model using the sample data. The method obtains a set of further sample data from the classification model, the set of further sample data comprising a plurality of further samples, each further sample comprising a respective classification produced by the classification model for an associated set of input values. The method evaluates a property of the replica of the classification model using the further sample data.