Property / distribution inference: not stealing one record, but extracting a 'population property' of your training set
In one sentence "what fraction of women / a given ethnicity was this model trained on." Ganju et al. (CCS 2018) did exactly this with a meta-classifier the population makeup of a training set can itself be sensitive (trade secret / group privacy) — don't focus only on protecting a single individual; sometimes the attacker doesn't want any one record at all.