Machine unlearning is motivated by desire for data autonomy: a person can request to have their data's influence removed from deployed models, and those models should be updated as if they were retrained without the person's data. We show that, counter-intuitively, these updates expose individuals to high-accuracy reconstruction attacks which allow the attacker to recover their data in its entirety, even when the original models are so simple that privacy risk might not otherwise have been a concern. We show how to mount a near-perfect attack on the deleted data point from linear regression models. We then generalize our attack to other loss functions and architectures, and empirically demonstrate the effectiveness of our attacks across a wide range of datasets (capturing both tabular and image data). Our work highlights that privacy risk is significant even for extremely simple model classes when individuals can request deletion of their data from the model.

机器遗忘是出于对数据自治的渴望：一个人可以要求使其数据在部署模型中的影响消失，并且这些模型应该更新，就像重新训练而没有该人的数据一样。然而，我们展示出这些更新与个人之间会暴露出高精度的重构攻击，这使得攻击者可以完整地恢复其数据，即使原始模型如此简单，以至于隐私风险可能不会引起担忧。我们展示了如何对线性回归模型中删除的数据点发起近乎完美的攻击。然后，我们将我们的攻击泛化到其他损失函数和架构，并在范围广泛的数据集上实证证明了我们的攻击的有效性（涵盖表格数据和图像数据）。我们的工作强调了即使对于极其简单的模型类别，当个人可以要求在模型中删除他们的数据时，隐私风险仍然是显著的。

机器遗忘的重构攻击：简单模型易受攻击