Dual-View Inference Attack: Machine Unlearning Amplifies Privacy Exposure

TL;DR

This paper reveals that machine unlearning can unintentionally increase privacy risks for retained data by enabling dual-view inference attacks, which leverage queries to both original and unlearned models.

Contribution

It introduces the concept of privacy knowledge gain and proposes DVIA, a novel attack method that exposes privacy vulnerabilities in the dual-view setting.

Findings

DVIA effectively extracts membership information from retained data.

Dual-view setting amplifies privacy leakage compared to single-model queries.

Experiments confirm the vulnerability across various datasets and models.

Abstract

Machine unlearning is a newly popularized technique for removing specific training data from a trained model, enabling it to comply with data deletion requests. While it protects the rights of users requesting unlearning, it also introduces new privacy risks. Prior works have primarily focused on the privacy of data that has been unlearned, while the risks to retained data remain largely unexplored. To address this gap, we focus on the privacy risks of retained data and, for the first time, reveal the vulnerabilities introduced by machine unlearning under the dual-view setting, where an adversary can query both the original and the unlearned models. From an information-theoretic perspective, we introduce the concept of {privacy knowledge gain} and demonstrate that the dual-view setting allows adversaries to obtain more information than querying either model alone, thereby amplifying privacy leakage. To effectively demonstrate this threat, we propose DVIA, a Dual-View Inference Attack, which extracts membership information on retained data using black-box queries to both models. DVIA eliminates the need to train an attack model and employs a lightweight likelihood ratio inference module for efficient inference. Experiments across different datasets and model architectures validate the effectiveness of DVIA and highlight the privacy risks inherent in the dual-view setting.