Abstract:The high cost of model training makes it increasingly desirable to develop techniques for unlearning. These techniques seek to remove the influence of a training example without having to retrain the model from scratch. Intuitively, once a model has unlearned, an adversary that interacts with the model should no longer be able to tell whether the unlearned example was included in the model's training set or not. In the privacy literature, this is known as membership inference. In this work, we discuss adaptations of Membership Inference Attacks (MIAs) to the setting of unlearning (leading to their "U-MIA" counterparts). We propose a categorization of existing U-MIAs into "population U-MIAs", where the same attacker is instantiated for all examples, and "per-example U-MIAs", where a dedicated attacker is instantiated for each example. We show that the latter category, wherein the attacker tailors its membership prediction to each example under attack, is significantly stronger. Indeed, our results show that the commonly used U-MIAs in the unlearning literature overestimate the privacy protection afforded by existing unlearning techniques on both vision and language models. Our investigation reveals a large variance in the vulnerability of different examples to per-example U-MIAs. In fact, several unlearning algorithms lead to a reduced vulnerability for some, but not all, examples that we wish to unlearn, at the expense of increasing it for other examples. Notably, we find that the privacy protection for the remaining training examples may worsen as a consequence of unlearning. We also discuss the fundamental difficulty of equally protecting all examples using existing unlearning schemes, due to the different rates at which examples are unlearned. We demonstrate that naive attempts at tailoring unlearning stopping criteria to different examples fail to alleviate these issues.

Pseudo Unlearning via Sample Swapping with Hash

Really Unlearned? Verifying Machine Unlearning via Influential Sample Pairs

Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearning

Releasing Malevolence from Benevolence: The Menace of Benign Data on Machine Unlearning

Silver Linings in the Shadows: Harnessing Membership Inference for Machine Unlearning

Proof of Unlearning: Definitions and Instantiation

Adversarial Machine Unlearning

Backdoor Attacks via Machine Unlearning

Pseudo-Probability Unlearning: Towards Efficient and Privacy-Preserving Machine Unlearning

FP 2 -MIA: A Membership Inference Attack Free of Posterior Probability in Machine Unlearning.

Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy

Evaluating of Machine Unlearning: Robustness Verification Without Prior Modifications

Game-Theoretic Machine Unlearning: Mitigating Extra Privacy Leakage

Verification of Machine Unlearning is Fragile

Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy

Efficient Federated Unlearning under Plausible Deniability

Towards Reliable Empirical Machine Unlearning Evaluation: A Game-Theoretic View

Machine Unlearning in Forgettability Sequence

Gone but Not Forgotten: Improved Benchmarks for Machine Unlearning

Towards Understanding the Feasibility of Machine Unlearning

Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System