Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoor Attacks via Machine Unlearning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes backdoor attacks that inject a trigger into an unlearned image classifier by submitting malicious unlearning requests, either with no poisoning or with clean-label frequency-domain poisoning followed by unlearning.
Problem
Backdoor attacks have not been explored via machine unlearning; a malicious data contributor could use unlearning requests to make an unlearned model misclassify triggered inputs while remaining stealthy.
Approach
Formulates an optimization over which of the attacker's own training instances to request for unlearning (and the trigger), relaxing the discrete selection with a sigmoid so it can be solved by gradient methods; a second variant poisons clean-label samples with a frequency-domain trigger and then activates it via unlearning.
Key results
- Attack without poisoning on CIFAR-10 with ResNet-18 (first-order unlearning, 10-50% attacker data) reaches ASRs up to roughly 92% at 50% data, versus about 2% for random baseline, with benign accuracy largely preserved.
- With clean-label poisoning at 0.5-1% rate and unlearning, the attack achieves ASRs of about 45-86% on CIFAR-10 while random baseline stays at 15-31%.
- Attack remains effective when 60% of unlearning requests come from benign users (ASR about 75%) and is robust to ABL and BDU backdoor detection.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Optimize the unlearning subset and trigger instead of selecting them randomly | AwoP, first-order · CIFAR-10 | ASR: 72.3 vs 1.8 | Helped |
| Optimize the unlearning subset and trigger instead of selecting them randomly | AwoP, first-order · TinyImageNet | ASR: 54.5 vs 0.3 | Helped |
| Use second-order rather than first-order unlearning | Attack without poisoning · CIFAR-10 and TinyImageNet | ASR | Hurt |
| Use second-order rather than first-order unlearning | Attack without poisoning · CIFAR-10 and TinyImageNet | BA | Helped |
| Increase trigger magnitude constraint ϵ (ablation) | Attack without poisoning · CIFAR-10 | ASR | Helped |
| Increase trigger magnitude constraint ϵ (ablation) | Attack without poisoning · CIFAR-10 | BA | Helped |
| Increase unlearning degree µ (ablation) | Attack without poisoning · CIFAR-10 | ASR | Helped |
| Increase unlearning degree µ (ablation) | Attack without poisoning · CIFAR-10 | BA | Hurt |
| Increase γ to place more weight on attack stealthiness (ablation) | Attack without poisoning · CIFAR-10 | ASR | Hurt |
| Add benign users' unlearning requests (ablation) | Attack without poisoning · CIFAR-10 | ASR | Hurt |
| Use a shadow model with a different architecture from the model owner's (ablation) | Black-box attack without poisoning · CIFAR-10 | ASR | Hurt |
| Apply backdoor detection with ABL or BDU before unlearning (ablation) | Attack with poisoning · CIFAR-10 | ASR | No clear effect |
Surprising findings
- The attack without poisoning achieves high ASR by unlearning only a small subset of the attacker's own clean training data.
- Attacks transfer across unlearning algorithms, and the black-box transfer from MobileNetV2 to ResNet-18 is limited (ASR 22.3%).
Limitations
- Evaluated only on image classification with ResNet-18, VGG-16 and MobileNetV2 on CIFAR-10 and TinyImageNet subset.
- Black-box attack success is inconsistent across shadow and victim architectures.
- Assumes the attacker knows the unlearning algorithm in the main settings and holds a sizable fraction (10-50%) of training data.
Experimental setup
Datasets: CIFAR-10 TinyImageNet
Benchmarks: CIFAR-10 TinyImageNet
Metrics: attack success rate benign accuracy unlearning percentage
Baselines: Rand (random unlearning instances and trigger)
Builds on: FTrojan first-order and second-order unlearning (Warnecke et al. 2021) UnrollSGD SISA knowledge distillation
Closest papers by meaning
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.91)
- A Reliable Cryptographic Framework for Empirical Machine Unlearning Evaluation (NeurIPS 2025 · similarity 0.89)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.89)
- Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.89)
- Rethinking Adversarial Robustness in the Context of the Right to be Forgotten (ICML 2024 · similarity 0.89)
- Forget to Flourish: Leveraging Machine-Unlearning on Pretrained Language Models for Privacy Leakage (AAAI 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.