[Paper Review] Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable

Martín Bertrán, Shuai Tang+4 more|arXiv (Cornell University)|May 30, 2024

Robotic Process Automation Applications4 citations

TL;DR

This paper demonstrates that machine unlearning in simple models—particularly linear regression and linear models with embeddings—renders data vulnerable to near-perfect reconstruction attacks. By exploiting the difference between pre- and post-deletion model parameters, the authors show that attackers can recover deleted data points with high fidelity, even when models are inherently low-risk for privacy leaks.

ABSTRACT

Machine unlearning is motivated by desire for data autonomy: a person can request to have their data's influence removed from deployed models, and those models should be updated as if they were retrained without the person's data. We show that, counter-intuitively, these updates expose individuals to high-accuracy reconstruction attacks which allow the attacker to recover their data in its entirety, even when the original models are so simple that privacy risk might not otherwise have been a concern. We show how to mount a near-perfect attack on the deleted data point from linear regression models. We then generalize our attack to other loss functions and architectures, and empirically demonstrate the effectiveness of our attacks across a wide range of datasets (capturing both tabular and image data). Our work highlights that privacy risk is significant even for extremely simple model classes when individuals can request deletion of their data from the model.

Motivation & Objective

• To investigate whether machine unlearning in simple models introduces new privacy risks not present in standard training.
• To analyze whether the act of deleting data from a model can inadvertently leak information about the deleted data point.
• To develop a practical reconstruction attack that leverages model parameter differences before and after deletion.
• To extend the attack to models with fixed embeddings and non-linear objectives using second-order approximations.
• To demonstrate that even low-complexity models like ridge regression are vulnerable to high-accuracy reconstruction when unlearning is applied.

Proposed method

• Leverages closed-form single-sample update rules in linear regression to compute the difference between pre- and post-deletion model parameters.
• Estimates the covariance matrix of the training data from a public, disjoint dataset drawn from the same distribution.
• Applies an intercept normalization technique to improve reconstruction accuracy in linear models.
• Extends the attack to models with fixed embeddings by reconstructing the embedding of the deleted sample and solving an inverse problem to recover the original input.
• Uses Newton’s method to approximate the gradient of the deleted sample with respect to model parameters, enabling application to generic loss functions.
• Employs a perturbation baseline (MaxDiff) to compare reconstruction quality, validating the superiority of the proposed method (HRec).

Figure 1 : We conduct membership inference attacks on a ridge regression on ACS Income task; the attack performance is poor (close to random guessing).

Experimental results

Research questions

• RQ1 Can an attacker reconstruct a deleted data point with high accuracy using only the model parameters before and after deletion?
• RQ2 Does the vulnerability to reconstruction attacks persist in simple models like linear regression, where privacy risks are traditionally considered low?
• RQ3 To what extent can the attack be generalized to models with fixed embeddings or non-linear objectives?
• RQ4 How effective is the attack when the true covariance matrix and regularization parameter are unknown and must be estimated?
• RQ5 Can second-order unlearning approximations enable reconstruction in models without analytical single-sample updates?

Key findings

• The proposed attack achieves near-perfect reconstruction of deleted samples in linear regression models when the true covariance matrix and regularization parameter are known.
• Even with estimated covariance matrices and $λ = 0$, the attack achieves near-perfect reconstruction accuracy on the ACS Income dataset using original features.
• For ridge regression with random Fourier features, the attack reconstructs the original data point with high fidelity, significantly outperforming baselines.
• On binary classification tasks using logistic regression and SVMs, the attack achieves high similarity scores between reconstructed and original samples, despite the absence of analytical single-sample updates.
• The method remains effective when using Newton’s method to approximate gradients, enabling reconstruction in models with complex loss functions.
• Visual and quantitative comparisons show that HRec produces reconstructions highly similar to the original deleted images (e.g., in CIFAR-10), while MaxDiff performs significantly worse.