Research map / Learning theory and algorithms / Prediction and decision losses

A Reliable Cryptographic Framework for Empirical Machine Unlearning Evaluation

NeurIPS 2025 · Learning theory and algorithms › Prediction and decision losses · approach: Active learning and subset selection · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a cryptographic-game framework (unlearning sample inference game) that defines an advantage-based Unlearning Quality metric for MIA-based unlearning evaluation, plus a two-split SWAP test approximation, validated on CIFAR-10 ResNet.

Problem

MIA-based evaluation of machine unlearning is unreliable: MIA accuracy/AUC is not calibrated, retraining is not guaranteed to score best, and results depend on the MIA and data composition.

Approach

Model unlearning evaluation as a cryptographic indistinguishability game between the unlearning challenger and an MIA adversary, measuring advantage averaged over all forget/test splits so that retraining has zero advantage by symmetry; approximate this with a SWAP test that uses a split and its forget-test swap.

Key results

• Retrain achieves Unlearning Quality of about 0.993-0.999 across dataset sizes, consistent with zero grounding.
• Under DP budgets, Unlearning Quality decreases as epsilon grows (e.g., None: 0.972 at eps=50 vs 0.587 at eps=infinity), matching the certified-removal bound trend, whereas IC score and MIA AUC are not monotone.
• SSD gives the highest Unlearning Quality among evaluated methods (0.975 at dataset size 0.1, 0.928 at 1.0).

Measured effects reported in the paper

Surprising findings

• The IC test and MIA AUC fail to give negatively correlated, consistent rankings with the DP budget, unlike the proposed metric.
• Even the no-unlearning baseline at epsilon=infinity has relatively high Unlearning Quality (0.587), attributed to weak current MIAs.

Limitations

• Exact metric requires enumerating all dataset splits, which is computationally infeasible; SWAP test and weak-adversary approximations are needed.
• Supremum over adversaries is only approximated using current weak black-box MIAs, so the metric may be loose (e.g., None still scores 0.587).
• Lower-bound validation is limited to DP-trained models since certified removal algorithms are not known beyond convex models.

Experimental setup

Datasets: CIFAR-10

Benchmarks: CIFAR-10

Metrics: Unlearning Quality advantage MIA AUC IC score MIA score

Baselines: Retrain Fisher forgetting fine-tuning final layer retrain final layer negative gradient SalUN SSD MIA AUC Interclass Confusion test

Builds on: certified removal shadow model membership inference Interclass Confusion test selective synaptic dampening

Closest papers by meaning

• Adversarial Machine Unlearning (ICLR 2025 · similarity 0.91)
• Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.89)
• Layer Attack Unlearning: Fast and Accurate Machine Unlearning via Layer Level Attack and Knowledge Distillation (AAAI 2024 · similarity 0.87)
• Textual Unlearning Gives a False Sense of Unlearning (ICML 2025 · similarity 0.87)
• Verification of Machine Unlearning is Fragile (ICML 2024 · similarity 0.87)
• Causal Evaluation of Membership Inference Attacks (NeurIPS 2026 · similarity 0.87)