Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Machine Unlearning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Frames machine unlearning as a Stackelberg game between an unlearner and an MIA-based auditor, and solves it with gradient-based unlearning that differentiates through the auditor's linear-SVM attack via implicit differentiation (SG-Unlearn).
Problem
Machine unlearning needs a reliable way to verify that a forget set's influence has been removed, and existing unlearning methods are developed separately from membership inference attacks (MIAs) that could measure residual influence.
Approach
Model unlearning as a Stackelberg game where the unlearner minimizes retain loss plus the auditor's best-response MIA utility; differentiate through the auditor's convex SVM optimization via KKT conditions and implicit function theorem (cvxpylayers) so MIA gradients guide unlearning.
Key results
- On CIFAR-10 random forgetting, SG reduces KS statistic to 0.0482 versus retrain 0.0255 and lowers |Acc_f - Acc_te| to 0.0411 (best among methods), at a test accuracy cost (0.8940 vs 0.9291 for retrain).
- On CIFAR-100 random forgetting, SG achieves MIA accuracy 0.5412 and KS 0.0988 but retain accuracy drops to 0.8993 versus 0.9996 for retrain.
- On class-wise CIFAR-10 forgetting, no method performs well on MIA metrics; SG achieves 0.9814 MIA accuracy versus 0.9935 for retrain, showing the auditor easily distinguishes class-wise forgotten data.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add adversarial MIA modeling to unlearning (ablation) | SG-Unlearn · CIFAR-10 random forgetting | test accuracy | Helped |
| Add adversarial MIA modeling to unlearning (ablation) | SG-Unlearn · CIFAR-100 random forgetting | MIA accuracy | Helped |
| Add adversarial MIA modeling to unlearning (ablation) | SG-Unlearn · CIFAR-100 random forgetting | Wasserstein distance | Helped |
| Add adversarial MIA modeling to unlearning (ablation) | SG-Unlearn · Random forgetting on CIFAR-10 and CIFAR-100 | test accuracy | Mixed |
| Use class-wise rather than random forgetting | SG-Unlearn · CIFAR-10 and SVHN | MIA accuracy | Hurt |
Surprising findings
- Class-wise forgetting leaves all methods, including retraining, highly distinguishable by MIA, indicating MIA-based evaluation is poor for class-level unlearning.
- The adversarial term acts as a regularizer that improves test accuracy of the unlearned model relative to the non-adversarial ablation (SG-0).
Limitations
- Gradient through the auditor's problem requires O(n^3) matrix inversion, limiting scalability.
- Only tested with Fine-Tune as unlearner and a linear SVM attacker; neural-network-based MIAs are not supported.
- SG loses test accuracy on CIFAR-100 (0.6378 vs 0.7035 for retrain) and retain accuracy drops substantially.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 SVHN
Benchmarks: CIFAR-10 CIFAR-100 SVHN
Metrics: retain accuracy test accuracy forget accuracy MIA accuracy MIA AUC MIA F1 KS statistic Wasserstein distance RTE
Baselines: Retrain Fine-Tune Gradient Ascent Influence Unlearning l1-sparse Random Label Boundary Expansion Boundary Shrink SCRUB
Builds on: fine-tuning unlearning membership inference attacks implicit function theorem cvxpylayers
Closest papers by meaning
- A Reliable Cryptographic Framework for Empirical Machine Unlearning Evaluation (NeurIPS 2025 · similarity 0.91)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.91)
- Adversarial Mixup Unlearning (ICLR 2025 · similarity 0.91)
- Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.91)
- Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond (ICML 2025 · similarity 0.91)
- Verification of Machine Unlearning is Fragile (ICML 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.