Enhancing AI safety of machine unlearning for ensembled models

Abstract

Recently, machine unlearning (MU) has received significant attention for its ability to remove specific undesired knowledge from a trained model, thereby ensuring AI safety. Furthermore, efforts have been made to integrate MU into existing Machine Learning as a Service (MLaaS), allowing users to raise requests to remove the influence of their data used in the training phase, after which the server conducts MU to remove its influence based on the unlearning requests. However, previous research reveals that malicious users may manipulate the requests so that the model utility may be significantly compromised after unlearning, which is known as malicious unlearning. In addition, privacy leakage may be exploited by malicious users by analyzing inference results obtained from the original model and the unlearned model. In this connection, we investigate these potential risks, specifically in ensemble models, which are widely adopted in MU because of their efficiency in unlearning and robustness in learning. However, despite these advantages, their vulnerabilities to malicious unlearning and privacy leakage remain largely unexplored. Our work explores malicious unlearning and malicious inference in ensemble settings. We propose a method in which malicious unlearning requests can trigger hidden poisons in ensembles, causing target images to be misclassified as intended by adversaries. Additionally, we introduce a privacy leakage attack where adversaries with black-box access to voting outputs can infer the unlearned label by analyzing the differences between the original and unlearned ensemble outputs. Experimental results demonstrate that these attacks can be highly stealthy and achieve a high success rate. Furthermore, comparative experiments reveal that these attacks present slightly lower stealthiness in ensemble settings compared to single-model scenarios, suggesting that ensemble models have advantages in detecting such malicious activities. These findings reveal that ensemble models are vulnerable to malicious unlearning and privacy leakage and highlight the urgent need for more robust MU designs to ensure AI safety.