论文证明行为审计会泄露隐私，给审计方案敲警钟
该论文针对机器遗忘（Machine Unlearning）的审计问题，给出信息论证明：对于凸ML模型，任何仅依赖行为信号（如模型输出）的审计方案，都无法在不泄露保留集成员信息的情况下识别未经充分遗忘的模型。实验在凸模型上强有力地支持该结论，并在非凸模型上也观察到类似的隐私-审计权衡。研究结果呼吁在现实审计者威胁模型下更谨慎地考虑隐私与审计的冲突，并为设计隐私保护的审计方案提供基础。代码已开源。
Behavioral Audit of Machine Unlearning Has a Privacy Cost
The removal of learned data from Machine Learning models through Machine Unlearning (MU) has been widely studied; however, there has yet to be an agreed-upon scheme for auditing MU. Existing work has shown that a dishonest model owner can falsify evidence to avoid executing MU, while curious auditors (and adversaries) can infer the privacy-sensitive properties of the model and its training data even with limited access. Yet auditing of MU under mutual distrust between the model owner and the auditor remains unexplored. We provide an information-theoretic proof for this scenario: for convex ML models, a generic audit scheme that relies solely on querying the model for \textit{behavioral} signals cannot identify insufficiently unlearned models without revealing membership information of the retained set. Therefore, auditing MU under the assumption of a dishonest model owner and an honest-but-curious auditor faces an inherent privacy-audit tradeoff. Our empirical results on convex models strongly supports this result, while further experiments demonstrate that this privacy-audit tension persists in non-convex models. Our results call for a more careful consideration of the privacy-audit tension under a realistic auditor threat model, and serve as a foundation for more scrutiny of designs of privacy-preserving audit schemes for the MU pipeline. We also release our code implementation at https://github.com/LiouTang/Behavioral-Unlearn-Audit.