Hard to Forget: Poisoning Attacks on Certified Machine Unlearning

The right to erasure requires removal of a user's information from data held by organizations, with rigorous interpretations extending downstream products such as learned models. Retraining scratch the particular omitted fully removes its influence on resulting model, but comes high computational cost. Machine "unlearning" mitigates cost incurred full retraining: instead, models are updated incrementally, possibly only requiring retraining when approximation errors accumulate. Rapid progress has been made towards privacy guarantees indistinguishability unlearned and retrained models, current formalisms do not place practical bounds computation. In this paper we demonstrate how an attacker can exploit oversight, highlighting novel attack surface introduced machine unlearning. We consider aiming increase removal. derive empirically investigate poisoning certified unlearning where strategically designed training triggers complete removed.