Threats, Attacks, and Defenses in Machine Unlearning: A Survey

2024-03-20

arXiv.org

AI Summary

This paper addresses security and privacy threats—such as information leakage and adversarial unlearning—in machine unlearning (MU), systematically surveying attack paradigms and defense mechanisms to fill the gap in unified threat modeling and comprehensive surveys. We propose the first four-dimensional taxonomy for MU security, categorizing attacks by target, adversary capability, operational scenario, and impact, thereby clarifying the dynamic attack-defense interplay. Our analysis integrates security assessment, privacy quantification, model inversion, and robustness evaluation, covering mainstream techniques including data removal, gradient masking, and influence function approximation. Furthermore, we introduce a verifiable threat atlas and a defense efficacy evaluation framework. The work provides theoretical foundations and practical guidelines for realizing the GDPR’s “right to be forgotten” and for delivering auditable, verifiable unlearning services in ML-as-a-Service (MLaaS) platforms.

Technology Category

• Machine Learning: Privacy
• Game Theory and Economic Paradigms: Adversarial Learning
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Security and Privacy: Security and privacy of machine learning and AI applications
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Machine Unlearning (MU) has recently gained considerable attention due to its potential to achieve Safe AI by removing the influence of specific data from trained Machine Learning (ML) models. This process, known as knowledge removal, addresses AI governance concerns of training data such as quality, sensitivity, copyright restrictions, and obsolescence. This capability is also crucial for ensuring compliance with privacy regulations such as the Right To Be Forgotten (RTBF). Furthermore, effective knowledge removal mitigates the risk of harmful outcomes, safeguarding against biases, misinformation, and unauthorized data exploitation, thereby enhancing the safe and responsible use of AI systems. Efforts have been made to design efficient unlearning approaches, with MU services being examined for integration with existing machine learning as a service (MLaaS), allowing users to submit requests to remove specific data from the training corpus. However, recent research highlights vulnerabilities in machine unlearning systems, such as information leakage and malicious unlearning, that can lead to significant security and privacy concerns. Moreover, extensive research indicates that unlearning methods and prevalent attacks fulfill diverse roles within MU systems. This underscores the intricate relationship and complex interplay among these mechanisms in maintaining system functionality and safety. This survey aims to fill the gap between the extensive number of studies on threats, attacks, and defenses in machine unlearning and the absence of a comprehensive review that categorizes their taxonomy, methods, and solutions, thus offering valuable insights for future research directions and practical implementations.

Problem

• Examines threats and defenses in Machine Unlearning.
• Addresses data removal for AI safety and privacy.
• Surveys vulnerabilities and solutions in unlearning systems.

Innovation

• Machine Unlearning for Safe AI
• Knowledge removal in ML models
• Integration with MLaaS services