Trojan Attack on Machine Unlearning: Security Risk of the Right to be Forgotten

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">The Right to be Forgotten</i> and related legislation mandate that every individual has the right to withdraw their consent to the use of their personal data. These laws and regulations led to the development of a new concept – machine unlearning. Recently, various machine unlearning approaches have been proposed to remove the influence of data sample(s) from a trained model. However, alongside all the achievements, there are still loopholes that may cause significant losses for the model owner. We found that it might be dangerous to remove the influence of some “well-designed” data samples from a pre-trained model. An adversary may craft some poisonous data and take advantage of the unlearning request to manipulate an unlearned model. In this paper, we exploit the vulnerabilities of the fast retraining-based unlearning strategy and propose a new data poisoning attack to demonstrate the risks they may bring about. The attack is triggered by submitting an unlearning request on adversarially designed data samples, and it enables an adversary to steer a model to a target location in the parameter space. We provide theoretical analyses to show the feasibility of such an attack regarding the gradient of the poisonous data. Furthermore, the experimental results on real-world datasets demonstrate that the attack strategy is effective.