Revisiting Privacy Leakage in Machine Unlearning: Membership Inference Beyond the Forgotten Set
For practitioners deploying machine unlearning, this work reveals a previously overlooked privacy risk to retained data and provides a practical attack and defense analysis.
This paper extends privacy analysis in machine unlearning to retained data, introducing TC-UMIA, a tri-class membership inference attack that distinguishes forget, retain, and unseen sets. Experiments show unlearning increases privacy risks for retained data, and dropout offers the best privacy-accuracy trade-off among defenses.
Machine unlearning (MU) has emerged as a key mechanism for ensuring data privacy and regulatory compliance by enabling models to forget specific training samples. However, recent studies have shown that the removal of data can inadvertently introduce privacy leakages to the retain set,i.e., data that remain in the model after unlearning. In this paper, we extend the scope of privacy analysis in unlearning to the often-overlooked retained data. We introduce TC-UMIA, the first tri-class unlearning membership inference attack. TC-UMIA is a population-level inference framework that leverages model predictions before and after unlearning to distinguish among the forget, retain, and unseen set. Extensive experiments on five state-of-the-art unlearning algorithms and six real-world datasets demonstrate that: (i) unlearning can introduce additional privacy risks to the retain set, making it more susceptible to membership inference attacks; (ii) TC-UMIA is effective across a wide range of model architectures, datasets, and MU approaches. Beyond launching the attack, we rigorously evaluate three defense mechanisms, namely label-only outputs, dropout, and differential privacy, to mitigate the privacy risks posed by TC- UMIA. Our results reveal a fundamental trade-off between privacy protection and model accuracy, with the dropout approach offering the most favorable balance.