A healthcare analytics team is training a machine learning model on patient records to predict readmission risk. Compliance requires that the trained model must not allow an attacker with query access to reconstruct or confirm whether any specific patient's record was in the training set, even if the attacker submits crafted queries. The team already signs model artifacts and restricts endpoint access. Which additional control most directly satisfies this requirement?