Silent Neighbors, Loud Secrets: Privacy Leakage from Nearby Classes in Unlearned Models

Ali Ebrahimpour-Boroojeny, Yian Wang, Hari Sundaram

Keywords: machine unlearning, Selective Forgetting, class unlearning, membership inference attack

TL;DR: We introduce a nearest-neighbor membership inference attack to expose privacy leakage in class unlearning, and propose an output reweighting method that defends against it while matching retraining performance.

Abstract:

In this paper, we reveal a significant shortcoming in class unlearning evaluations: overlooking the underlying class geometry can cause privacy leakage. We further propose a simple yet effective solution to mitigate this issue.
We introduce a membership-inference attack via nearest neighbors (MIA-NN) that uses the probabilities the model assigns to neighboring classes to detect unlearned samples. Our experiments show that existing unlearning methods are vulnerable to MIA-NN across multiple datasets. We then propose a new fine-tuning objective that mitigates this privacy leakage by approximating, for forget-class inputs, the distribution over the remaining classes that a retrained-from-scratch model would produce. To construct this approximation, we estimate inter-class similarity and tilt the target model’s distribution accordingly. The resulting Tilted ReWeighting (TRW) distribution serves as the desired distribution during fine-tuning. We also show that across multiple benchmarks, TRW matches or surpasses existing unlearning methods on prior unlearning metrics. More specifically, on CIFAR-10, it reduces the gap with retrained models by $19\%$ and $46\%$ for U-LiRA and MIA-NN scores, accordingly, compared to the SOTA method for each category.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 13610