Hard to Forget: Poisoning Attacks on Certified Machine Unlearning

Abstract

The right to erasure requires removal of a user's information from data held by organizations, with rigorous interpretations extending to downstream products such as learned models. Retraining from scratch with the particular user's data omitted fully removes its influence on the resulting model, but comes with a high computational cost. Machine "unlearning" mitigates the cost incurred by full retraining: instead, models are updated incrementally, possibly only requiring retraining when approximation errors accumulate. Rapid progress has been made towards privacy guarantees on the indistinguishability of unlearned and retrained models, but current formalisms do not place practical bounds on computation. In this paper we demonstrate how an attacker can exploit this oversight, highlighting a novel attack surface introduced by machine unlearning. We consider an attacker aiming to increase the computational cost of data removal. We derive and empirically investigate a poisoning attack on certified machine unlearning where strategically designed training data triggers complete retraining when removed.

Hard to Forget: Poisoning Attacks on Certified Machine Unlearning

“…Specifically, we make the replacement θ = arg max θ R(θ; D cln ) in ( 9) so that θ is constant with respect to D psn . This means evaluating the objective (or its gradient) no longer requires retraining and simplifies gradient computations (see Appendix A of our extended paper Marchant, Rubinstein, and Alfeld 2021). Although this approximation is based on a dubious assumption-the model must be somewhat sensitive to D psn -we find it performs well empirically (see Table 4).…”

“…However as poisoned instances are erased, the defender's model approaches the attacker's model, and the poisoned instances become more effective. Additional results on long-term effectiveness are included in Appendix C of our extended paper (Marchant, Rubinstein, and Alfeld 2021).…”

“…This problem can be solved using projected gradient descent (PGD) as detailed in Appendix A of our extended paper (Marchant, Rubinstein, and Alfeld 2021).…”

“…A more effective attack achieves a smaller retrain interval. Further details about the experiments, including hardware, parameter settings poisoning ratios, and the number of trials in each experiment are provided in Appendix B of our extended paper (Marchant, Rubinstein, and Alfeld 2021).…”