Research map / Adversarial robustness and security / Attacks on text and graphs
Flexible, Efficient, and Stable Adversarial Attacks on Machine Unlearning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DDPA, a target-agnostic data-poisoning attack on machine unlearning that uses convex polyhedral approximation and regular-simplex construction over poisoned group centers so one poisoned set can be steered to arbitrary targets via unlearning requests.
Problem
Adversarial attacks on machine unlearning are inflexible (pre-defined targets), inefficient for multiple attack requests, and unstable due to non-convex losses.
Approach
Builds a poisoned dataset whose group centers are chosen where the loss is approximately convex (convex polyhedral approximation) and mapped to a maximal regular simplex in parameter space, so unlearning subsets of these poisoned points can steer parameters toward any attack target without re-poisoning.
Key results
- On VGG16-CIFAR100, DDPA gets roughly 88-92% unlearning ASR across five unlearning algorithms with 0% ASR before unlearning (stealthy).
- With 20 potential targets, DDPA reaches 88.3% targeted ASR and 91.6% untargeted ASR, while the lowest baseline gets 5.9% and 6.3%.
- DDPA has the lowest running time for multi-request attacks and average ASR gains of 22.74%, 16.07%, and 21.45% over other attacks on VGG16-CIFAR100, ResNet18-TinyImageNet, and LLaMA-3B-SST2 respectively.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use DDPA instead of SSCSF | VGG16 · CIFAR-100, First-Order unlearning, 5% unlearned | ASR: 90.00 -> 92.00 | Helped |
| use DDPA instead of SSCSF | VGG16 · CIFAR-100, Second-Order unlearning, 5% unlearned | ASR: 90.00 -> 91.00 | Helped |
| use DDPA instead of SSCSF | VGG16 · CIFAR-100, Unroll-SGD unlearning, 5% unlearned | ASR: 86.93 -> 88.00 | Helped |
| use DDPA instead of DABF | VGG16 · CIFAR-100, Amnesiac unlearning, 5% unlearned | ASR: 87.11 -> 89.40 | Helped |
| use DDPA instead of RMBMU | VGG16 · CIFAR-100, SISA unlearning, 5% unlearned | ASR: 86.74 -> 89.69 | Helped |
| add the simplex method (ablation) | DDPA · CIFAR-100, First-Order unlearning, 5% unlearned | ASR: 80.00 -> 92.00 | Helped |
| add convex polyhedral approximation (ablation) | DDPA · CIFAR-100, First-Order unlearning, 5% unlearned | ASR: 81.30 -> 92.00 | Helped |
| add the simplex method (ablation) | DDPA · CIFAR-100, Second-Order unlearning, 5% unlearned | ASR: 80.20 -> 91.00 | Helped |
| add convex polyhedral approximation (ablation) | DDPA · CIFAR-100, Second-Order unlearning, 5% unlearned | ASR: 82.30 -> 91.00 | Helped |
| add the simplex method (ablation) | DDPA · CIFAR-100, Unroll-SGD unlearning, 5% unlearned | ASR: 80.40 -> 88.00 | Helped |
| add convex polyhedral approximation (ablation) | DDPA · CIFAR-100, Unroll-SGD unlearning, 5% unlearned | ASR: 81.60 -> 88.00 | Helped |
| add the simplex method (ablation) | DDPA · CIFAR-100, Amnesiac unlearning, 5% unlearned | ASR: 81.20 -> 89.40 | Helped |
Surprising findings
- Reports that DDPA's ASR is 0% before unlearning while test accuracy remains high, indicating a stealthy poisoned set.
Limitations
- Theoretical guarantees rely on Gaussian assumptions validated only by normality tests on two model-dataset pairs.
- Convex approximation is approximate; stability claims are not guaranteed for the true non-convex loss.
- Evaluation limited to three datasets and one attack setting per model.
Experimental setup
Datasets: CIFAR-100 Tiny ImageNet SST-2
Benchmarks: CIFAR-100 Tiny ImageNet SST-2
Metrics: attack success rate test accuracy train accuracy running time anomaly index (NC, PB, AEVA)
Baselines: AwoP MUECPA SSCSF BAU UBA-Inf RMBMU DABF AdvUA EVMUS
Builds on: Carathéodory's theorem John's theorem BAU conjugate algorithm
Closest papers by meaning
- Rethinking Adversarial Robustness in the Context of the Right to be Forgotten (ICML 2024 · similarity 0.90)
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.89)
- Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond (ICML 2025 · similarity 0.89)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.89)
- Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.88)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.