Utilizing Cryptography to Decrease Privacy and Security Risks in Machine Unlearning

Abstract

Machine Unlearning (MU) aims to remove specific data from trained models without requiring complete retraining, thereby complying with regulations such as the “right to be forgotten.” However, unlearning algorithms alone cannot fully guarantee secure data deletion-even if model performance is restored, information about the deleted objects may still be leaked through avenues such as model differentiation, update artifacts, gradients, or residual traces in the representation space, creating new privacy and security risks. To address this, this paper proposes a cryptographically enhanced machine unlearning framework (Crypto-MU): after the conventional approximate unlearning or hybrid unlearning process, AES-GCM authenticated encryption is employed to encrypt and securely store the artifacts generated during the unlearning process. Additionally, key destruction is implemented to achieve a “computationally irreversible” deletion effect. Experimental results demonstrate that Crypto-MU reduces the leakage risk caused by unlearning artifacts from 0.568 ± 0.031 to 0.183 ± 0.032 (a relative reduction of approximately 67.8%) while maintaining nearly unchanged model accuracy. The encryption process incurs minimal overhead (<0.001 seconds). This study shows that incorporating lightweight cryptographic mechanisms into machine unlearning practices can significantly mitigate the additional privacy risks introduced by the unlearning process, with almost no increase in computational burden.