# Label Leakage Attacks in Machine Unlearning: A Parameter and Inversion-Based Approach

Source: [Label Leakage Attacks in Machine Unlearning: A Parameter and Inversion-Based Approach](<https://www.sota2.com/research/paper/69d884117d0172140ec779fc>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-04-11T05:00:04.810Z

Authors: Weidong Zheng, Kongyang Chen, Yao Huang, Yuanwei Guo, Yatie Xiao

Published: 2026-04-08T03:57:48.000Z

## Abstract

With the widespread application of artificial intelligence technologies in face recognition and other fields, data privacy security issues have received extensive attention, especially the \\textit{right to be forgotten} emphasized by numerous privacy protection laws. Existing technologies have proposed various unlearning methods, but they may inadvertently leak the categories of unlearned data. This paper focuses on the category unlearning scenario, analyzes the potential problems of category leakage of unlearned data in multiple scenarios, and proposes four attack methods from the perspectives of model parameters and model inversion based on attackers with different knowledge backgrounds. At the level of model parameters, we construct discriminative features by computing either dot products or vector differences between the parameters of the target model and those of auxiliary models trained on subsets of retained data and unrelated data, respectively. These features are then processed via k-means clustering, Youden's Index, and decision tree algorithms to achieve accurate identification of the forgotten class. In the model inversion domain, we design a gradient optimization-based white-box attack and a genetic algorithm-based black-box attack to reconstruct class-prototypical samples. The prediction profiles of these synthesized samples are subsequently analyzed using a threshold criterion and an information entropy criterion to infer the forgotten class. We evaluate the proposed attacks on four standard datasets against five state-of-the-art unlearning algorithms, providing a detailed analysis of the strengths and limitations of each method. Experimental results demonstrate that our approach can effectively infer the classes forgotten by the target model.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Machine Unlearning Attack on MNIST, Fashion-MNIST, SVHN, and CIFAR10 Aggregated Average](<https://www.sota2.com/research/sota/machine-unlearning-attack-on-mnist-fashion-mnist-svhn-and-cifar10-aggregated-average.md>): Machine Unlearning Attack; MNIST, Fashion-MNIST, SVHN, and CIFAR10 Aggregated Average; ASR (NG): 92.62.

- [Unlearning Attack Success on MNIST, Fashion-MNIST, SVHN, and CIFAR-10 Average (test)](<https://www.sota2.com/research/sota/unlearning-attack-success-on-mnist-fashion-mnist-svhn-and-cifar-10-average-test.md>): Unlearning Attack Success; MNIST, Fashion-MNIST, SVHN, and CIFAR-10 Average (test); NG Success Rate: 90.31.

- [Unlearning Membership Inference on MNIST, Fashion-MNIST, SVHN, and CIFAR-10 (test)](<https://www.sota2.com/research/sota/unlearning-membership-inference-on-mnist-fashion-mnist-svhn-and-cifar-10-test.md>): Unlearning Membership Inference; MNIST, Fashion-MNIST, SVHN, and CIFAR-10 Multi-Class (test); NG Score: 95.93.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2604.07386>)

[PDF](<https://arxiv.org/pdf/2604.07386.pdf>)