CMIRA: Class Membership Inducing Recovery Attacks Against Machine Unlearning Models
Keywords: Computer Vision (CV) -> CV: Adversarial Attacks & Robustness, Computer Vision (CV) -> CV: Ethics -- Bias, Fairness, Transparency & Privacy, Machine Learning (ML) -> ML:
TL;DR: This paper reformulates a new study of recovery attanks against SOTA machine unlearning models without needing access to the originally learned model.
Abstract: The implementation of data privacy regulations such as GDPR and CCPA has advanced machine learning (MU) technology, which is designed to facilitate the removal of specific sensitive data points from trained models upon request. Despite rapid advancements in MU technology, its vulnerabilities are still underexplored, posing potential risks of privacy breaches by recovering unlearned sensitive information. Existing research on MU vulnerabilities often requires access to the original models, which violates with the core objective of MU. To address this gap, we initiate the first study on recovery attacks against MU models without requiring access to the original model. Our approach, known as Class Membership Inducing Recovery Attack (CMIRA), effectively recovers forgotten data by exploiting a probing dataset. Specifically, we implement the CMIRA scheme regarding mutual knowledge distillation between MU and attack models. Extensive experiments across multiple datasets and MU methods demonstrate that CMIRA exhibits high efficacy in both theoretical analysis and practical applications. Our study highlights the critical imperative for establishing robust MU systems and sets a benchmark for future research into MU vulnerabilities.
Supplementary Material: zip
Primary Area: alignment, fairness, safety, privacy, and societal considerations
Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
Reciprocal Reviewing: I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.
Submission Number: 19
Loading