Auditing Approximate Machine Unlearning for Differentially Private Models

TL;DR

This paper critically examines the privacy guarantees of approximate machine unlearning methods applied to differentially private models, revealing potential privacy risks for retained data and proposing an efficient auditing approach.

Contribution

It introduces a holistic auditing framework for unlearned and retained samples' privacy, including new criteria and an efficient membership inference attack, highlighting privacy risks in existing unlearning methods.

Findings

Existing unlearning algorithms may compromise retained data privacy.

Differential privacy may not hold after approximate unlearning.

Proposed auditing method effectively detects privacy breaches.

Abstract

Approximate machine unlearning aims to remove the effect of specific data from trained models to ensure individuals' privacy. Existing methods focus on the removed records and assume the retained ones are unaffected. However, recent studies on the \emph{privacy onion effect} indicate this assumption might be incorrect. Especially when the model is differentially private, no study has explored whether the retained ones still meet the differential privacy (DP) criterion under existing machine unlearning methods. This paper takes a holistic approach to auditing both unlearned and retained samples' privacy risks after applying approximate unlearning algorithms. We propose the privacy criteria for unlearned and retained samples, respectively, based on the perspectives of DP and membership inference attacks (MIAs). To make the auditing process more practical, we also develop an efficient MIA, A-LiRA, utilizing data augmentation to reduce the cost of shadow model training. Our experimental findings indicate that existing approximate machine unlearning algorithms may inadvertently compromise the privacy of retained samples for differentially private models, and we need differentially private unlearning algorithms. For reproducibility, we have pubished our code: https://anonymous.4open.science/r/Auditing-machine-unlearning-CB10/README.md