GDPR and CCPA give users the right to request deletion of their data from trained models. Machine unlearning methods approximate this deletion without retraining from scratch. The approximation is the attack surface.
The attack: inject nodes into a graph neural network's training data. The model trains normally and performs well. Then request deletion of the injected nodes — a request that cannot legally be refused. The approximate unlearning step introduces subtle degradation that the attacker has engineered in advance. Accuracy collapses, but only after the deletion.
The model worked during training. The model worked during evaluation. The destruction is triggered by the legal mechanism designed to protect users. The privacy right becomes the weapon.
The structural finding is that approximate unlearning methods — which avoid the expense of full retraining — create a gap between what the model should be (fully retrained without the data) and what it is (approximately adjusted). Attackers can engineer data whose removal maximally exploits this gap. The approximation error is not random noise; it has structure that can be amplified.
The defense would be exact unlearning (full retraining), which is computationally impractical for large models. Every shortcut in the unlearning process is a potential attack vector. The legal requirement to delete creates a mathematical requirement to be vulnerable.