Training data and privacy

This paper examines whether existing machine unlearning methods truly remove the influence of target training samples when the training dataset contains many similar samples. Experiments on four constructed datasets for image and language models show a notable gap between expected and actual performance for most existing methods, including the retraining-from-scratch baseline. The authors also explore potential solutions to improve current unlearning approaches.

The paper proposes MU-MIA, a membership inference attack that uses machine unlearning to gradually reduce a model's memorization of specific samples and records a forgetting trajectory for each one. A BiLSTM-based binary classifier with attention then separates member from non-member samples using these trajectories. The unlearning step runs in a zero-shot setting that needs no real data, and the authors report that the method outperforms existing baseline attacks across different datasets and model architectures.

This research paper proposes a privacy-preserving machine unlearning mechanism for large language models. The method uses information retrieval to remove high-risk semantic meanings from model output and adds differentially-private randomization so unlearned information is statistically indiscernible. It requires neither parametric fine-tuning nor in-context prompt calibration, and the authors report theoretical privacy and unlearning guarantees plus experiments on real-world datasets.

This research paper introduces DAAS (Defense via Auto-Augmentation Search) against Model Inversion Attacks, which can recover private training data from model weights or outputs. The authors note that existing defenses offer incomplete protection and that input-level defenses have been limited to simple transformations. DAAS automatically identifies augmentation candidates with strong privacy-utility trade-offs from a large pool, and the authors report superior defense performance across models, datasets and attacks.

This paper presents FUIA, a federated unlearning inversion attack that exposes privacy leakage in federated unlearning (FU), the method used to remove specific data's influence from federated learning models. The first systematic study of FU privacy vulnerabilities, it applies to sample, client and class unlearning. An honest-but-curious server records parameter changes during unlearning, infers gradients of forgotten data, and reconstructs its features or labels across multiple benchmark datasets and FU methods.

BlindU is a machine unlearning method for federated learning that removes a user's data contribution without uploading the erasing data to the server. The user locally produces compressed, privacy-preserving representations through an information bottleneck encoder, and the server unlearns using only those representations and their labels. The authors add a noise-free differential privacy masking step before compression and report better privacy protection and unlearning effectiveness than the best existing privacy-preserving benchmarks.

MaxDiv is a zero-shot machine unlearning method that erases knowledge from a model without access to its original training data. It generates erasing samples by negating the distributions of the data to be forgotten, and adds knowledge distillation to prevent catastrophic forgetting of retained information. Evaluations on MNIST, SVHN, CIFAR-10, CIFAR-100 and TinyImageNet reportedly show superior performance over current state-of-the-art methods.

IndirectVerify is a formal scheme for verifying whether machine unlearning requests have actually been executed, addressing a gap where existing verification relies on backdoor or membership inference attacks that a model provider can bypass through rapid fine-tuning. The authors generate influential sample pairs, trigger samples and reaction samples, using a perturbation-based method that alters only a small fraction of training samples so that reaction samples are misclassified. The paper claims this indirect influence provides greater robustness against bypassing than schemes that reuse the same samples throughout.

The paper proposes Self-supervised Model Seeding (SMS), a scheme for verifying that a model has unlearned genuine user samples rather than only backdoored ones. SMS links user-specific seeds, original samples and the model through a self-supervised seeding task trained jointly with the primary service task. The authors report effectiveness across three datasets, several model architectures, and exact and approximate unlearning benchmarks.