Mirror Mirror on the Wall, Have I Forgotten it All? A New Framework for Evaluating Machine Unlearning
Brennon Brimhall, Philip Mathew, Neil Fendley, Yinzhi Cao, Matthew Green
TL;DR
This work introduces computational unlearning, a rigorous indistinguishability framework that measures whether a model unlearned from a forget set is indistinguishable from a mirror model retrained without that data. It defines white-box and black-box security games and develops MIAScore and KLDScore as practical distinguishers, showing that several representative unlearning methods fail to achieve indistinguishability on standard benchmarks. Theoretical results establish that deterministic unlearning cannot exist for entropic learning, and that applying differential privacy to achieve unlearning can cause severe utility collapse, highlighting fundamental limits of current approaches. The framework provides a principled basis to evaluate unlearning methods, with implications for designing high-utility, robust unlearning techniques and guiding future research in both discriminative and generative modeling contexts.
Abstract
Machine unlearning methods take a model trained on a dataset and a forget set, then attempt to produce a model as if it had only been trained on the examples not in the forget set. We empirically show that an adversary is able to distinguish between a mirror model (a control model produced by retraining without the data to forget) and a model produced by an unlearning method across representative unlearning methods from the literature. We build distinguishing algorithms based on evaluation scores in the literature (i.e. membership inference scores) and Kullback-Leibler divergence. We propose a strong formal definition for machine unlearning called computational unlearning. Computational unlearning is defined as the inability for an adversary to distinguish between a mirror model and a model produced by an unlearning method. If the adversary cannot guess better than random (except with negligible probability), then we say that an unlearning method achieves computational unlearning. Our computational unlearning definition provides theoretical structure to prove unlearning feasibility results. For example, our computational unlearning definition immediately implies that there are no deterministic computational unlearning methods for entropic learning algorithms. We also explore the relationship between differential privacy (DP)-based unlearning methods and computational unlearning, showing that DP-based approaches can satisfy computational unlearning at the cost of an extreme utility collapse. These results demonstrate that current methodology in the literature fundamentally falls short of achieving computational unlearning. We conclude by identifying several open questions for future work.