Research map / Adversarial robustness and security / Attacks on text and graphs
Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that retraining-based machine unlearning exposes deleted training points to near-perfect reconstruction from the before/after model parameters, even for linear and simple models, via a Sherman-Morrison-based differencing attack using public data.
Problem
Machine unlearning (deleting a data point and retraining) gives an adversary two models differing by one sample, which may allow reconstruction of the deleted record even when simple models are assumed low-risk.
Approach
Model the parameter difference between models with and without a sample as proportional to that sample's features (via closed-form linear regression updates, or a Newton/Hessian approximation for general losses), estimate the covariance/Hessian from public data, and reconstruct the deleted point from the scaled difference, with label inference for multiclass models.
Key results
- On linear regression over ACS Income, the HRec attack reconstructs deleted samples almost perfectly, per the paper's claim of near-perfect reconstruction.
- On CIFAR10 with cross-entropy over 4096 random Fourier features, HRec yields higher cosine similarity than Avg and MaxDiff across settings, with the gap most apparent on CIFAR10.
- Membership inference (LiRA) against ridge regression on ACS Income performs close to random guessing, while reconstruction after deletion succeeds.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use HRec instead of Avg or MaxDiff for reconstruction | HRec reconstruction attack on linear cross-entropy, RBF ridge, and RBF cross-entropy models · MNIST, Fashion MNIST, and CIFAR10 | cosine similarity | Helped |
| Use HRec instead of the public-data baselines | HRec on ACS Income ridge regression · ACS Income from NY, CA, and TX; original and random Fourier features | cosine similarity | Helped |
| Use HRec instead of the public-data baselines | HRec on logistic regression and SVM · ACS Income Level Prediction | cosine similarity | Helped |
| Use HRec instead of baselines | HRec on random-feature binary classification models · ACS Income binary classification | cosine similarity | Mixed |
| Use HRec to attack fully retrained models before and after deletion | HRec reconstruction attack · Tabular and image datasets | cosine similarity | Helped |
| Use LiRA membership inference on linear models | LiRA · ACS tabular tasks | membership inference performance | No clear effect |
Surprising findings
- Linear models that resist membership inference are nonetheless almost perfectly reconstructable after a single deletion request.
Limitations
- Attack assumes access to model parameters before and after deletion and public samples from the same distribution.
- Approximation errors (covariance estimated from public data, lambda=0 assumption, Newton approximation) make reconstruction imperfect for non-linear-loss models such as logistic regression and SVM.
- Comparison with Updates-Leak is not apples-to-apples because the threat models and attacked model pairs differ.
Experimental setup
Datasets: ACS Income (NY, CA, TX) MNIST Fashion MNIST CIFAR10
Benchmarks: ACS Income MNIST Fashion MNIST CIFAR10
Metrics: cosine similarity CDF between deleted and reconstructed samp r2 F1 out-of-sample accuracy
Baselines: Avg MaxDiff Updates-Leak LiRA
Builds on: Sherman-Morrison formula influence functions Updates-Leak random Fourier features LiRA
Closest papers by meaning
- Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.89)
- Unlearned but Not Forgotten: Data Extraction after Exact Unlearning in LLM (NeurIPS 2025 · similarity 0.89)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.89)
- Forget to Flourish: Leveraging Machine-Unlearning on Pretrained Language Models for Privacy Leakage (AAAI 2025 · similarity 0.88)
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.88)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.