{"id":"https://openalex.org/W4410609250","doi":"https://doi.org/10.1109/satml64287.2025.00034","title":"Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy","display_name":"Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy","publication_year":2025,"publication_date":"2025-04-09","ids":{"openalex":"https://openalex.org/W4410609250","doi":"https://doi.org/10.1109/satml64287.2025.00034"},"language":"en","primary_location":{"id":"doi:10.1109/satml64287.2025.00034","is_oa":false,"landing_page_url":"https://doi.org/10.1109/satml64287.2025.00034","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5020715720","display_name":"Jamie Hayes","orcid":null},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I4210090411","display_name":"DeepMind (United Kingdom)","ror":"https://ror.org/00971b260","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210090411","https://openalex.org/I4210128969"]}],"countries":["GB","US"],"is_corresponding":true,"raw_author_name":"Jamie Hayes","raw_affiliation_strings":["Google DeepMind"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google DeepMind","institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I4210090411"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069844959","display_name":"Ilia Shumailov","orcid":"https://orcid.org/0000-0003-3100-0727"},"institutions":[{"id":"https://openalex.org/I4210090411","display_name":"DeepMind (United Kingdom)","ror":"https://ror.org/00971b260","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210090411","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["GB","US"],"is_corresponding":false,"raw_author_name":"Ilia Shumailov","raw_affiliation_strings":["Google DeepMind"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google DeepMind","institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I4210090411"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091334872","display_name":"Eleni Triantafillou","orcid":"https://orcid.org/0000-0002-2993-9674"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I4210090411","display_name":"DeepMind (United Kingdom)","ror":"https://ror.org/00971b260","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210090411","https://openalex.org/I4210128969"]}],"countries":["GB","US"],"is_corresponding":false,"raw_author_name":"Eleni Triantafillou","raw_affiliation_strings":["Google DeepMind"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google DeepMind","institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I4210090411"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074965510","display_name":"Amr M. Khalifa","orcid":null},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I4210090411","display_name":"DeepMind (United Kingdom)","ror":"https://ror.org/00971b260","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210090411","https://openalex.org/I4210128969"]}],"countries":["GB","US"],"is_corresponding":false,"raw_author_name":"Amr Khalifa","raw_affiliation_strings":["Google DeepMind"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google DeepMind","institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I4210090411"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5018809423","display_name":"Nicolas Papernot","orcid":"https://orcid.org/0000-0001-5078-7233"},"institutions":[{"id":"https://openalex.org/I4210090411","display_name":"DeepMind (United Kingdom)","ror":"https://ror.org/00971b260","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210090411","https://openalex.org/I4210128969"]},{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["GB","US"],"is_corresponding":false,"raw_author_name":"Nicolas Papernot","raw_affiliation_strings":["Google DeepMind"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Google DeepMind","institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I4210090411"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5020715720"],"corresponding_institution_ids":["https://openalex.org/I1291425158","https://openalex.org/I4210090411"],"apc_list":null,"apc_paid":null,"fwci":20.5325,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.99193664,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"497","last_page":"519"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.7468000054359436,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.7468000054359436,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T13048","display_name":"Patient Dignity and Privacy","score":0.7455000281333923,"subfield":{"id":"https://openalex.org/subfields/2739","display_name":"Public Health, Environmental and Occupational Health"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6857079863548279},{"id":"https://openalex.org/keywords/sense","display_name":"Sense (electronics)","score":0.5582879781723022},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.5330860614776611},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5047723054885864},{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.4408159852027893},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.06855425238609314}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6857079863548279},{"id":"https://openalex.org/C143141573","wikidata":"https://www.wikidata.org/wiki/Q7450971","display_name":"Sense (electronics)","level":2,"score":0.5582879781723022},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.5330860614776611},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5047723054885864},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.4408159852027893},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.06855425238609314},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/satml64287.2025.00034","is_oa":false,"landing_page_url":"https://doi.org/10.1109/satml64287.2025.00034","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.5799999833106995,"id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":36,"referenced_works":["https://openalex.org/W1873763122","https://openalex.org/W2040228409","https://openalex.org/W2535690855","https://openalex.org/W2993330478","https://openalex.org/W3035644192","https://openalex.org/W3095155273","https://openalex.org/W3128806248","https://openalex.org/W3154155772","https://openalex.org/W3174532363","https://openalex.org/W3175430527","https://openalex.org/W3188298126","https://openalex.org/W3202838631","https://openalex.org/W3211753216","https://openalex.org/W4221158899","https://openalex.org/W4288057780","https://openalex.org/W4308410483","https://openalex.org/W4385572399","https://openalex.org/W6765443569","https://openalex.org/W6779605666","https://openalex.org/W6780547051","https://openalex.org/W6785765211","https://openalex.org/W6790532531","https://openalex.org/W6791907524","https://openalex.org/W6793958797","https://openalex.org/W6796843635","https://openalex.org/W6802936884","https://openalex.org/W6809671830","https://openalex.org/W6810569391","https://openalex.org/W6839352123","https://openalex.org/W6839820251","https://openalex.org/W6850390306","https://openalex.org/W6851130207","https://openalex.org/W6852449896","https://openalex.org/W6857841889","https://openalex.org/W6859106116","https://openalex.org/W6859598735"],"related_works":["https://openalex.org/W2584827882","https://openalex.org/W3195097297","https://openalex.org/W4225340788","https://openalex.org/W3038106605","https://openalex.org/W2513267613","https://openalex.org/W3049084372","https://openalex.org/W2528109871","https://openalex.org/W2940702331","https://openalex.org/W2905822832","https://openalex.org/W2240244939"],"abstract_inverted_index":{"The":[0],"high":[1],"cost":[2],"of":[3,22,83,91,102,187,217,240,248],"model":[4,31,37,46],"training":[5,24,63,233],"makes":[6],"it":[7,219],"increasingly":[8],"desirable":[9],"to":[10,18,28,52,88,94,142,190,199,212,258,278,282],"develop":[11],"techniques":[12,16,171],"for":[13,114,126,203,220,230],"unlearning.":[14,241],"These":[15],"seek":[17],"remove":[19],"the":[20,30,45,55,61,68,89,109,132,136,155,160,164,185,215,227,231,245,259],"influence":[21],"a":[23,36,100,121,181,200,238],"example":[25,57,144],"without":[26],"having":[27],"retrain":[29],"from":[32],"scratch.":[33],"Intuitively,":[34],"once":[35],"has":[38],"unlearned,":[39],"an":[40],"adversary":[41],"that":[42,131,154,209,226,270],"interacts":[43],"with":[44],"should":[47],"no":[48],"longer":[49],"be":[50],"able":[51],"tell":[53],"whether":[54],"unlearned":[56],"was":[58],"included":[59],"in":[60,159,184],"model's":[62],"set":[64],"or":[65],"not.":[66],"In":[67,77,193],"privacy":[69,165,228],"literature,":[70],"this":[71,78],"is":[72,112,124,147],"known":[73],"as":[74,237],"membership":[75,140],"inference.":[76],"work,":[79],"we":[80,210,224],"discuss":[81,244],"adaptations":[82],"Membership":[84],"Inference":[85],"Attacks":[86],"(MIAs)":[87],"setting":[90],"unlearning":[92,161,170,196,255,275],"(leading":[93],"their":[95],"\u201cU-MIA\u201d":[96],"counterparts).":[97],"We":[98,129,242,268],"propose":[99],"categorization":[101],"existing":[103,169,254],"U-MIAs":[104,158],"into":[105],"\u201cpopulation":[106],"U-MIAs\u201d,":[107,119],"where":[108,120],"same":[110],"attacker":[111,123,137],"instantiated":[113,125],"all":[115,251],"examples,":[116],"and":[117,175],"\u201cper-example":[118],"dedicated":[122],"each":[127,143],"example.":[128],"show":[130,153],"latter":[133],"category,":[134],"wherein":[135],"tailors":[138],"its":[139],"prediction":[141],"under":[145],"attack,":[146],"significantly":[148],"stronger.":[149],"Indeed,":[150],"our":[151],"results":[152],"commonly":[156],"used":[157],"literature":[162],"overestimate":[163],"protection":[166,229],"afforded":[167],"by":[168],"on":[172],"both":[173],"vision":[174],"language":[176],"models.":[177],"Our":[178],"investigation":[179],"reveals":[180],"large":[182],"variance":[183],"vulnerability":[186,202],"different":[188,260,264,279],"examples":[189,208,234,252,265,280],"per-example":[191],"U-MIAs.":[192],"fact,":[194],"several":[195],"algorithms":[197],"lead":[198],"reduced":[201],"some,":[204],"but":[205],"not":[206],"all,":[207],"wish":[211],"unlearn,":[213],"at":[214,262,273],"expense":[216],"increasing":[218],"other":[221],"examples.":[222],"Notably,":[223],"find":[225],"remaining":[232],"may":[235],"worsen":[236],"consequence":[239],"also":[243],"fundamental":[246],"difficulty":[247],"equally":[249],"protecting":[250],"using":[253],"schemes,":[256],"due":[257],"rates":[261],"which":[263],"are":[266],"unlearned.":[267],"demonstrate":[269],"naive":[271],"attempts":[272],"tailoring":[274],"stopping":[276],"criteria":[277],"fail":[281],"alleviate":[283],"these":[284],"issues.":[285]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":4}],"updated_date":"2026-05-16T08:24:45.110214","created_date":"2025-10-10T00:00:00"}