University of Virginia（弗吉尼亚大学）；University of Lausanne（洛桑大学）；CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）；Carnegie Mellon University（卡内基梅隆大学）；Purdue University（普渡大学）
Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, Yang Zhang
The right to be forgotten states that a data owner has the right to erase their data from an entity storing it. In the context of machine learning (ML), the right to be forgotten requires an ML model owner to remove the data owner's data from the training set used to build the ML model, a process known as machine unlearning. While originally designed to protect the privacy of the data owner, we argue that machine unlearning may leave some imprint of the data in the ML model and thus create unintended privacy risks. In this paper, we perform the first study on investigating the unintended information leakage caused by machine unlearning. We propose a novel membership inference attack that leverages the different outputs of an ML model's two versions to infer whether a target sample is part of the training set of the original model but out of the training set of the corresponding unlearned model. Our experiments demonstrate that the proposed membership inference attack achieves strong performance. More importantly, we show that our attack in multiple cases outperforms the classical membership inference attack on the original ML model, which indicates that machine unlearning can have counterproductive effects on privacy. We notice that the privacy degradation is especially significant for well-generalized ML models where classical membership inference does not perform well. We further investigate four mechanisms to mitigate the newly discovered privacy risks and show that releasing the predicted label only, temperature scaling, and differential privacy are effective. We believe that our results can help improve privacy protection in practical implementations of machine unlearning. Our code is available at https://github.com/MinChen00/UnlearningLeaks.
CYBERCAT (Center for Cybersecurity Research of Catalonia)（加泰罗尼亚网络安全研究中心）；ComSCIAM-Center for Computational Science and Applied Mathematics（计算科学与应用数学中心）；Department of Computer Engineering and Mathematics, Universitat Rovira i Virgili（罗维拉-维尔吉利大学计算机工程与数学系）
Zero-shot Class Unlearning via Layer-wise Relevance Analysis and Neuronal Path Perturbation
School of Information Engineering, Zhongnan University of Economics and Law（信息工程学院，中南财经政法大学）；China University of Geosciences, Wuhan（中国地质大学（武汉））；City University of Macau（澳门城市大学）
Langevin Unlearning: A New Perspective of Noisy Gradient Descent for Machine Unlearning
Department of Electrical and Computer Engineering（电气与计算机工程系）；Georgia Institute of Technology（佐治亚理工学院）；Department of Mathematics（数学系）；Massachusetts Institute of Technology（麻省理工学院）
Game-Theoretic Machine Unlearning: Mitigating Extra Privacy Leakage
School of Information Engineering, Zhongnan University of Economics and Law（中南财经政法大学信息工程学院）；Faculty of Data Science, City University of Macau（澳门城市大学数据科学学院）
Breaking the Trilemma of Privacy, Utility, Efficiency via Controllable Machine Unlearning
University of Notre Dame（圣母大学）；University of Pennsylvania（宾夕法尼亚大学）；Dartmouth College（达特茅斯学院）；Georgia Institute of Technology（佐治亚理工学院）；George Mason University（乔治梅森大学）
MPU: Towards Secure and Privacy-Preserving Knowledge Unlearning for Large Language Models
College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；Alibaba-NTU Global e-Sustainability CorpLab (ANGEL)（阿里云-南洋理工大学全球可持续发展科技实验室）；Tongyi Lab, Alibaba Group（通义实验室，阿里巴巴集团）
FRAMU: Attention-based Machine Unlearning using Federated Reinforcement Learning
University of Southern Queensland（南昆士兰大学）；Wuhan University of Technology（武汉理工大学）；Lingnan University（岭南大学）；University of Electronic Science and Technology of China（电子科技大学）；Hong Kong Polytechnic University（香港理工大学）
Recently, the enactment of privacy regulations has promoted the rise of the machine unlearning paradigm. Existing studies of machine unlearning mainly focus on sample-wise unlearning, such that a learnt model will not expose user's privacy at the sample level. Yet we argue that such ability of selective removal should also be presented at the attribute level, especially for the attributes irrelevant to the main task, e.g., whether a person recognized in a face recognition system wears glasses or the age range of that person. Through a comprehensive literature review, it is found that existing …
PrivEraserVerify: Efficient, Private, and Verifiable Federated Unlearning
Department of Electronics and Communication Engineering（电子与通信工程系）；Department of Mathematics and Computer Science（数学与计算机科学系）；Khulna University of Engineering & Technology（库尔纳工程与技术大学）；Hobart and William Smith Colleges（霍巴特和威廉·斯密斯学院）；Department of Electrical and Electronic Engineering（电气与电子工程系）
Textual Unlearning Gives a False Sense of Unlearning
The State Key Laboratory of Blockchain and Data Security, Zhejiang University, P. R. China（区块链与数据安全国家重点实验室，浙江大学，中华人民共和国）；School of Cyber Science and Technology, Zhejiang University, P. R. China（网络安全与技术学院，浙江大学，中华人民共和国）；ETH Zurich, Switzerland（苏黎世联邦理工学院，瑞士）
Machine unlearning through fine-grained model parameters perturbation
College of Computer Science and Electronic Engineering, Hunan University（湖南大学计算机与电子工程学院）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；Shenzhen Research Institute, Hunan University（湖南大学深圳研究院）；Faculty of Computing, Engineering & Media, De Montfort University（德蒙福特大学计算、工程与媒体学院）
