Can training data be extracted or recovered from random forest models? I'm currently working on a random forest classifier which is trained on sensitive data. I haven't been able to find specific answers to the following questions:


*

*Can someone with access to the machine learning model extract individual sample data points from it? In particular I'm using the R package ranger. 

*In case the raw data is not accessible, can the training data points be recovered from the decision trees, and if, with how high accuracy?


To elaborate, the adversary would have access to the entire model, not just the API and predictions. 
 A: Decision tree is effectively a kind of lossy encoder (like hashmaps) meaning it is not possible to figure out exact inputs based on a model. I can imagine having a tree that is able to contain most or the whole knowledge about input data (extreme overfitting), but I guess it is not your case.
Also, training parameters come into play that adversaries may not know even if they have a model.
Having said that, the whole purpose of decision trees is to model training data and it all boils down to what is sensitive in your dataset. If this is distributions, trees very much pass this information on. If this is individual record attributes like ids, names, etc. this won't be retained. If this is relationships between features - one can use trees to reverse engineer that too.
Please keep in mind one has control over how precise a decision tree is and what data is being used to train it. This may be everything you need to keep it safe. Maybe some sensitive features are just not needed?
Please take a look at the concept of "decision tree autonecoders" this may shed some more light on the problem for you.
A: Potentially yes, the adversary that has access to the entire model can learn pretty much about your data.
Recall what random forests are: ensembles of decision trees trained on random subsets of data (usually both: subsets of rows and columns). Using the example from this tutorial, decision tree splits the data into branches, conditionally on the training data. The example below shows like the data is split based on the sex, age and the number of siblings & spouses abord, using the Titanic dataset. First split is based on sex and we learn from it that 36% of the dataset are females who survived the Titanic disaster. Next split shows that there is 61% of males older then 9.5 years who died during the disaster etc. 

You can clearly see that the decision tree has memorized many of the characteristics of the dataset. The information is partial because we calculate only some conditionals (e.g. from the tree above we learned nothing about age of the males) and with continuous predictors we bin them into two categories at each split. Moreover, since while constructing random forest you took random samples from the data, the numbers won't be exact (the error depends on the fraction you subsample).
On another hand, since you usually use large number of such trees, taken together they give you more precise picture. As the trees were trained on random subsets, each tree can use different variables and different splits, together giving you more detailed view on the underlying data (single tree can make a split on age > 9.5, but multiple trees could make many different splits etc.). If you have many trees and many splits, then also the contentious variables will eventually get spitted into many different bins.
The answer on if data aggregated in such shattered was as it is done by random forest can be used to de-anonymize the underlying data, would depend on many things. First, it would depend on the data used for training the model: are the variables detailed enough to recognize the individual participants? If you recorded only some very broad demographic details, then possibly this may not be the case, but combinations of those features, or features with very skewed distributions (rare features) could be used for de-anonymization. Second, this would depend to great extent on the characteristics of the model: how big were the subsampling fractions?; how many trees did you use?; did you enforce the minimum number of cases per branch to be a relatively large value?; did you use any pruning? etc. Basically, the mode "tuned" the trees would be, the more noise you introduce and the more anonymized your data will be (but I guess, this would be very hard to measure and quantify!). If you use large fractions of the data for splits, many trees, allow for small branches and use no pruning, then the random forest may memorize quite detailed picture of your training data. 
A: Do you mean from inside the R environment? It would be hard for someone to accomplish this, however they could go through the whole forest (if it's available at your_model_name$forest) and create some sort of summary / boundary for all the used variables and their respective values.
