This landscape scopes filings that combine an attack technique — membership inference, model inversion, or training data extraction — with an evaluation or defense mechanism such as memorization measurement, attack success rate scoring, canary insertion, or a formal threat model and auditing procedure. Filings that describe only an attack technique without any evaluation or defense angle fall outside this scope. That combination reflects how the field is actually being claimed: as auditing and defense tooling built around known attack techniques, not the attacks in isolation.

The ranking covers 68 companies across the 83 records in scope, and it is genuinely fragmented: the leading assignee holds only 6 records, fifth place holds 5, and tenth place holds 2. The top five assignees combined account for 31.3% of all records, and the top ten reach 48.2%. There is no single dominant filer, which means freedom-to-operate analysis in this space has to look across a long list of moderate-sized portfolios rather than one gatekeeper.

Yes, sharply. Annual filings rose from 4 in 2021 to 17 in 2024, a 325% increase over that three-year span, tracking the wider push to formally audit machine learning models before deployment. Counts for 2025 and 2026 appear in the data too, but publication typically lags filing by around 18 months, so those most recent years are still incomplete and should not be read as the trend flattening.

The two dominant IPC subclasses are G06F, electric digital data processing, appearing in 66.3% of the 83 records, and G06N, AI-model computing, at 54.2%. H04L, digital transmission, appears in 24.1% of records, capturing attacks framed around network or API access. Domain-specific classes — G10L for speech, G16H for healthcare, G06K for data recognition, and G06V for image and video recognition — each sit at or below 10.8%, indicating that most claims are written as general computing or machine-learning claims rather than tied to a specific application.

The IPC composition points to speech/audio, healthcare informatics, and image/video recognition as branches with comparatively few claims relative to the dominant general-computing classes. A first claim there would tie a specific attack technique, such as membership inference, to a domain-specific data type and an evaluation metric particular to that domain — for example, a canary-insertion auditing method scoped to medical imaging models rather than generic model classes. Reviewing the most-cited records and the representative filing's broad, multi-modality framing is a useful starting point before drafting into a narrower domain.