Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack
This addresses security and performance issues in machine unlearning for AI systems, offering a practical remedy, though it is incremental as it builds on existing unlearning techniques.
The paper tackles two critical blind spots in machine unlearning: over-unlearning that damages retained data near the forget set, and prototypical relearning attacks that can resurrect forgotten knowledge. It introduces Spotter, a plug-and-play objective that reduces over-unlearning by 95% compared to baselines, drives forget accuracy to 0%, and keeps retain set accuracy within 1% of the original while denying attacks.
Machine unlearning (MU) aims to expunge a designated forget set from a trained model without costly retraining, yet the existing techniques overlook two critical blind spots: "over-unlearning" that deteriorates retained data near the forget set, and post-hoc "relearning" attacks that aim to resurrect the forgotten knowledge. We first derive the over-unlearning metric OU@ε, which represents the collateral damage to the nearby region of the forget set, where the over-unlearning mainly appears. Next, we expose an unforeseen relearning threat on MU, i.e., the Prototypical Relearning Attack, which exploits the per-class prototype of the forget class with just a few samples, and easily restores the pre-unlearning performance. To counter both blind spots, we introduce Spotter, a plug-and-play objective that combines (i) a masked knowledge-distillation penalty on the nearby region of forget set to suppress OU@ε, and (ii) an intra-class dispersion loss that scatters forget-class embeddings, neutralizing prototypical relearning attacks. On CIFAR-10, as one of validations, Spotter reduces OU@εby below the 0.05X of the baseline, drives forget accuracy to 0%, preserves accuracy of the retain set within 1% of difference with the original, and denies the prototype-attack by keeping the forget set accuracy within <1%, without accessing retained data. It confirms that Spotter is a practical remedy of the unlearning's blind spots.