Towards Unveiling Predictive Uncertainty Vulnerabilities in the Context of the Right to Be Forgotten

Chenxu Zhao; Mengdi Huai; Wei Qian; Wenqian Ye; Yangyi Li

REVIEW 5 major objections 4 minor 73 references

Towards Unveiling Predictive Uncertainty Vulnerabilities in the Context of the Right to Be Forgotten

T0 review · 5 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that crafted machine-unlearning requests can silently corrupt a model's predictive uncertainty while preserving its labels.

desk verdict First attack specifically targeting predictive uncertainty through machine unlearning requests; direct measurements show real effects, but the theory is thin and the defense claims outrun the evidence. read the letter →

arxiv 2508.07458 v1 pith:FFN2LIAV submitted 2025-08-10 cs.LG

Wei Qian , Chenxu Zhao , Yangyi Li , Wenqian Ye , Mengdi Huai This is my paper

classification cs.LG

keywords machineunlearninguncertaintyquantificationmaliciousattackspredictivecalibrationconformalpredictionrighttobeforgottenadversarial

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that machine unlearning—the process that lets users erase their data from a trained model—can be turned into a weapon against a model's predictive uncertainty. An adversary who only requests deletion of carefully chosen training points can make the unlearned model overconfident or underconfident on victim inputs, without changing the predicted labels. The authors introduce a two-part objective: an attack loss that moves confidence in the desired direction, plus a proximity-based regularizer that makes the requested deletion look natural. They solve it by aligning the gradient of the attack loss with the unlearning algorithm's update direction. Experiments across seven uncertainty-quantification methods and six unlearning algorithms report that these attacks beat traditional misclassification-focused attacks and survive existing defenses.

What carries the argument

The load-bearing mechanism is the gradient-alignment attack objective, max_Φ (∇θℓ3(θ*;D_v)ᵀ Ψ(θ*,U))/(‖∇θℓ3(θ*;D_v)‖‖Ψ(θ*,U)‖), where Ψ(θ*,U) is the parameter-update function of the unlearning algorithm and ℓ3 = ℓ1 + λℓ2 is the regularized attack loss. This converts the expensive bi-level optimization into a single inner-product maximization: the adversary chooses forget-set weights so that the unlearning step points in the direction that maximally increases the uncertainty-manipulation loss on victim samples. The companion regularizer, based on the proximity measure GPR(x)=exp(−mean KNN feature distance), is what preserves a natural uncertainty distribution and gives the attack its stealth.

What would settle it

Take a small logistic-regression or two-layer network, run the paper's gradient-alignment attack for the underconfidence objective, and compare it against directly optimizing the exact bi-level objective on the same forget-and-victim split; if the exact objective does not materially outperform the approximation on ECE and Brier score, then the linearization—not the attack concept—is doing the work. A second check: train a detector to flag deletion requests whose target samples' KL divergence from their high-proximity neighbors is anomalous; if such a detector separates attacked from benign req

Watch

Extended reading notes

Core claim

The paper's central discovery is a class of malicious unlearning attacks that target predictive uncertainty rather than label accuracy. The adversary chooses which data points to ask the model owner to forget, encoded as indication weights Φ, and the unlearned model θ_u = U(θ*, D, D_u) is steered so that on victim samples its confidence is inflated (overconfidence), deflated (underconfidence), or both at once. Two losses drive this: ℓ1 is a hinge loss that pushes the top-class probability away from the desired confidence level, and ℓ2 is a KL-divergence regularizer that aligns each victim sample's uncertainty vector with the average uncertainty vector of its high-proximity neighbors, keeping

Load-bearing premise

The entire attack-design pipeline rests on the assumption that the unlearning update is small and the loss landscape is locally linear, so the first-order Taylor expansion of the bi-level objective faithfully represents the attack's true effect; if a target unlearning algorithm makes large or strongly non-linear updates, the crafted requests may not produce the claimed manipulation.

Editorial extensions

If this is right

Any deployed unlearning service that accepts deletion requests opens a new attack surface: the confidence scores of arbitrary victim samples can be manipulated using only the set of data requested for deletion.
The attacks affect a wide range of uncertainty quantification methods, including conformal prediction, meaning calibrated prediction sets can be corrupted, not just raw softmax scores.
Existing defenses that were designed against label-misclassification unlearning attacks—adversarial training and adversarial poisoning—do not stop uncertainty manipulation, so new defenses are needed.
Black-box transferability means an adversary with no access to the target model can craft deletion requests on a surrogate model and successfully attack a target trained with a different architecture or a different unlearning algorithm.
Because the attacks preserve predicted labels, they are stealthier than conventional unlearning attacks and may bypass monitoring that looks for label flips.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An extension the paper leaves implicit: downstream systems that threshold on confidence—such as abstention rules, active-learning selection, or medical triage—could be harmed even more directly than aggregate calibration metrics like ECE suggest, since the attack changes exactly the quantity those systems trust.
A testable extension of the stealthiness claim would be a detection defense that checks whether the uncertainty vectors of deletion-requested samples diverge from their high-proximity neighborhood; the paper does not explore this, but its own regularizer suggests it.
The Taylor-approximation assumption implies the attack's efficiency may degrade for unlearning algorithms with large or strongly non-linear updates; a natural comparison would be exact bi-level optimization on small problems to bound that gap.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is the first paper I know of that attacks predictive uncertainty through machine unlearning, and the core empirical claim holds up: the proposed request-crafting procedure raises ECE/ACE/Brier on the victim samples across several UQ methods, while largely preserving labels. That is a new and useful attack surface for the unlearning-as-a-service setting, and the paper deserves a serious read.

What it does well: the attack objective is simple and sensible—minimize the confidence gap on target samples while using a proximity regularizer to keep the request plausible. The evaluation spans a good range of UQ methods (softmax, ensembles, MC dropout, temperature scaling, isotonic regression, conformal) and several unlearning algorithms, including a black-box transfer study. The transfer result across unlearning methods is the most interesting piece: an attack crafted against a first-order unlearner also hurts SISA and SSD, which suggests the vulnerability is not just an artifact of one update rule. The baseline comparison to the label-misclassification attack [65] is fair as a first contrast, though limited to one prior method.

The soft spots are real but not fatal. The theoretical analysis is mostly decorative. Theorem 1 is stated for a Gaussian binary model and only supports the proximity-confidence heuristic; its proof is deferred, and it says nothing about whether Eq. (6) faithfully represents the bi-level objective. The optimization in Eqs. (5)–(6) is a first-order Taylor approximation with no error bound or curvature condition, and for non-differentiable unlearners like SISA it is only a heuristic via transfer. That approximation being unvalidated matters, but it is not load-bearing for the paper's main message: the attack empirically works, and the paper itself is transparent that the optimization is a proxy. What is more bothersome is the overclaim about defenses. Figure 3b tests two defenses—adversarial training and adversarial poisoning—and the abstract generalizes to 'existing defenses.' That is an overstatement. Also, no code or hyperparameters are provided, so Table 1 is hard to reproduce; λ, K, Ξ, τ, and random-restart settings are all unspecified.

Who it's for: security/privacy researchers working on machine unlearning and UQ. It will be more useful as a pointer to a new threat model than as a definitive treatment. In a revision I'd want the proof or removal of Theorem 1, hyperparameters and code, and a toned-down defense claim. That is standard for a short paper. I'd send it to peer review; it deserves referee time, and the conditional accept is the right stance.

Referee Report

5 major / 4 minor

Summary. The paper introduces a new class of malicious machine-unlearning attacks that target predictive uncertainty rather than label accuracy. The adversary crafts a forget set by optimizing a bi-level objective whose outer loss combines a confidence-margin loss on victim samples with a KL-based proximity regularizer intended to keep uncertainty estimates natural, subject to the inner unlearning update. The authors replace the bi-level objective with a first-order Taylor approximation and reduce it to maximizing the cosine similarity between the loss gradient and the unlearning update. Experiments on CIFAR-10, CIFAR-100, ImageNet-100, and ISIC 2018 with several UQ methods (softmax, deep ensembles, MC dropout, TS, ETS, IR, and conformal prediction) and several unlearning algorithms show larger ECE increases than random deletion and a traditional label-misclassification attack, and demonstrate transferability across architectures and unlearning methods as well as partial robustness to adversarial training and adversarial poisoning.

Significance. This is among the first systematic studies of uncertainty-targeted malicious unlearning, and the threat model is plausible and distinct from label-misclassification attacks. The direct empirical evidence in Table 1 and Figure 2 that unlearning requests can substantially inflate calibration error while preserving labels is a useful contribution, and the black-box transfer experiments are a strength. At the same time, the paper claims more than it demonstrates: the optimization surrogate in Eq. (6) is unvalidated, the formal framework does not cover set-valued conformal prediction, the stealthiness property is not quantitatively measured, and the theoretical support is deferred. The large ECE increase is partly by construction, since the attack explicitly minimizes confidence margins; the nontrivial parts are the transferability, the defense evasion, and the preservation of labels, all of which are empirical. If the gaps below are addressed, the paper would be a solid contribution; in its current form the broad claims rest on several unverified assumptions.

major comments (5)

[§2, Eqs. (5)-(6)] The central optimization claim is the reduction of the bi-level problem (4) to the gradient-alignment problem (6). This requires ℓ3(θ_u) ≈ ℓ3(θ*) + ∇ℓ3(θ*)^T(θ_u − θ*), with θ_u − θ* = −τΨ(θ*,U). No error bound, smoothness/curvature condition, or validation against the exact objective is provided. For unlearning methods whose update is not small (SISA, retraining-based methods, multi-step unrolling SGD), the approximation can be poor; for non-differentiable U, the gradient of Ψ with respect to the relaxed weights Φ is not defined. The paper's own transfer experiments (Fig. 4b) use a first-order surrogate for SISA rather than solving (6) for SISA, so the claim of effectiveness 'across unlearning methods' is not directly supported. Additionally, passing from the last expression in Eq. (5) to the cosine objective in Eq. (6) discards the scale of Ψ; for fixed τ the actual loss change scales
[§2 and Figure 2] The framework assumes E(x;θ) is a probability distribution over labels, but conformal prediction methods (HPS, APS, RAPS) output prediction sets rather than class-probability distributions. Equations (1)-(3), the margin loss, and the KL regularizer do not directly apply to set-valued predictors. Figure 2 reports attack performance on conformal prediction, but the paper never defines E, the underconfidence objective, or the evaluation metric for set-valued output. This is load-bearing for the claim that the attack works 'across various UQ methods'. Please specify the uncertainty representation and attack objective for conformal prediction, or remove conformal methods from the claims.
[§3.2 and Eq. (3)] The regularizer ℓ2 is introduced to achieve 'natural uncertainty distributions' and stealthiness, but no quantitative stealthiness or detectability metric is reported. The only evidence is the qualitative visualization in Fig. 2b; there is no ablation comparing ℓ1-only with ℓ1+λℓ2 in terms of both attack success and distributional distance to benign data, and no detector (e.g., density estimation or statistical tests on uncertainty vectors) is evaluated. The statement that existing defenses are ineffective is also limited to adversarial training and adversarial poisoning, which are not detectors of unnatural uncertainties. Please add a quantitative stealthiness evaluation and an ablation, or temper the stealthiness claims.
[§2, Theorem 1] Theorem 1 is advertised as theoretical support for the empirical proximity-confidence observation, but its proof is deferred to the full version, the statement is ambiguous (Δcal_p → G_{p,κ} = G_p·κ + o(κ) with 'small enough κ'), and the theorem is never used in deriving the attack. The paper's promise of 'rigorous theoretical analysis' is therefore not met in the submitted text. Either include a proof or proof sketch with a precise statement, or remove the theorem and present the proximity-confidence relation as an empirical observation.
[§3.1, Table 1] Several implementation details needed to reproduce the central results are missing: how the continuous relaxation of Φ is mapped back to a discrete forget set, what the 'closed-form updates' promised in the Introduction are, and the values or sensitivity of λ, K, Ξ, τ, the number of random restarts, the forget-set size, and the number of target samples. Table 1 reports only ECE although ACE and BS are named as evaluation metrics, and no code is provided. These omissions make it difficult to verify Table 1 and to determine whether hyperparameters are tuned per dataset and UQ method.

minor comments (4)

[§3.2 / Table 1] ACE and BS are listed as evaluation metrics in the text but only ECE appears in Table 1. Please report the other metrics or clarify where they are presented.
[Figure 3a] The comparison with the traditional attack [65] reports 'error increment ratios on label-preserved data' without defining this subset or giving error bars or significance tests. Please clarify the selection protocol and add variability estimates.
[Figure 4b] Caption typo: 'Arcoss' should be 'Across'.
[§1 and §2] The phrase 'closed-form updates' is used in the Introduction and Conclusion but no closed form is provided in Section 2. Please either supply the closed-form expression or replace the phrase with a more accurate description.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack objective explicitly targets confidence, and the reported ECE increases are the intended effect, not a hidden reduction.

full rationale

The paper's central claim is that its proposed unlearning requests can manipulate predictive uncertainty. That claim is supported by an explicit attack objective, Eq. (4), which minimizes a confidence-margin loss plus a proximity regularizer; the experimental metric ECE is a direct measure of the resulting miscalibration. Reporting increased ECE on the same target samples is a standard attack evaluation, not a prediction derived from a fitted parameter. The optimization in Eqs. (5)-(6) is a first-order Taylor approximation to a bi-level problem; whether that approximation is faithful is a validity/robustness concern, but it is not circular because the approximation is not an input reused as an output. The comparison against traditional attacks and defenses is empirical, and the cited prior unlearning attacks are independently published baselines, so the self-citations are not load-bearing. Theorem 1's proof is deferred to the full version, which is a completeness limitation, but the theorem is not used as evidence that reduces to the attack's own definition. No circular step can be identified from the supplied text.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The paper's central mechanism rests on a first-order linearization of the unlearning update, a proximity-based stealthiness assumption, and several unreported hyperparameters. No new physical or mechanistic entities are introduced.

free parameters (6)

lambda (λ) = not reported
Trade-off weight between the attack loss ℓ1 and the proximity regularizer ℓ2 in Eq. (4); chosen by hand, not reported.
K (number of nearest neighbors) = not reported
Used in the proximity measure GPR in Eq. (2); no value or sensitivity analysis is provided.
threshold Xi (Ξ) = not reported
Approximate threshold defining the set of high-proximity samples D_v^p in Eq. (3); how it is set is not described.
tau (τ) = not reported
Step size of the unlearning update appearing in the first-order approximation in Eq. (5); the method assumes it is small but does not control it.
number of random restarts = not reported
The optimization uses random restarts to select the best indication weights, but the number of restarts is not specified.
forget set size / number of target samples = not reported
The size of D_t and D_v affects attack effectiveness, but these are not reported in the paper.

assumptions (4)

domain assumption In the limit n,d→∞ with d/n→κ, for Gaussian X and logistic Y|X, calibration error grows linearly with κ for p∈(0.5,1) (Theorem 1).
Used to justify that high-proximity samples tend to be underconfident, motivating the regularizer; the proof is deferred to the full version.
ad hoc to paper The unlearning update Ψ(θ*, U) is small and the loss ℓ3 is locally linear, so the first-order Taylor approximation in Eq. (5) is accurate.
This approximation is the basis of the gradient-alignment optimization; no error bound or validation is provided.
domain assumption The adversary has access to a training subset D_t and can freely choose which samples to request for deletion, with the unlearning algorithm U treating them as normal deletion requests.
Threat model in Section 2: adversary pretends to be a normal data provider.
ad hoc to paper Matching uncertainty vectors of target samples to high-proximity samples (via KL divergence on E) makes the attack stealthy and undetectable by defenses.
Stealthiness claim is not evaluated against a detection method; no detection-avoidance experiments are reported.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Towards Unveiling Predictive Uncertainty Vulnerabilities in the Context of the Right to Be Forgotten." pith.science (2026). https://pith.science/paper/FFN2LIAV

@misc{pith2026250807458,
  author       = {Pith},
  title        = {Pith review of: Towards Unveiling Predictive Uncertainty Vulnerabilities in the Context of the Right to Be Forgotten},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FFN2LIAV}},
  note         = {Machine review of arXiv:2508.07458}
}

read the original abstract

Currently, various uncertainty quantification methods have been proposed to provide certainty and probability estimates for deep learning models' label predictions. Meanwhile, with the growing demand for the right to be forgotten, machine unlearning has been extensively studied as a means to remove the impact of requested sensitive data from a pre-trained model without retraining the model from scratch. However, the vulnerabilities of such generated predictive uncertainties with regard to dedicated malicious unlearning attacks remain unexplored. To bridge this gap, for the first time, we propose a new class of malicious unlearning attacks against predictive uncertainties, where the adversary aims to cause the desired manipulations of specific predictive uncertainty results. We also design novel optimization frameworks for our attacks and conduct extensive experiments, including black-box scenarios. Notably, our extensive experiments show that our attacks are more effective in manipulating predictive uncertainties than traditional attacks that focus on label misclassifications, and existing defenses against conventional attacks are ineffective against our attacks.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

73 extracted references · 59 canonical work pages

[65]

Chenxu Zhao, Wei Qian, Rex Ying, and Mengdi Huai. 2024. Static and sequential malicious attacks in the context of selective forgetting. Advances in Neural Information Processing Systems 36 (2024)

work page 2024
[1]

Anastasios Angelopoulos, Stephen Bates, Jitendra Malik, and Michael I Jordan

work page
[2]

Tanya Boone-Sifuentes, Asef Nazari, Imran Razzak, Mohamed Reda Bouadjenek, Antonio Robles-Kelly, Daniel Ierodiaconou, and Elizabeth S Oh. 2022. Marine-tree: A large-scale marine organisms dataset for hierarchical image classification. In Proceedings of the 31st ACM International Conference on Information & Knowledge Management. 3838–3842

work page 2022
[3]

Lucas Bourtoule, Varun Chandrasekaran, Christopher Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine Unlearning. In Proceedings of the 42nd IEEE Symposium on Security and Privacy

work page 2021
[4]

Glenn W Brier. 1950. Verification of forecasts expressed in terms of probability. Monthly weather review 78, 1 (1950), 1–3

work page 1950
[5]

Aobo Chen, Yangyi Li, Wei Qian, Kathryn Morse, Chenglin Miao, and Mengdi Huai. 2024. Modeling and Understanding Uncertainty in Medical Image Classifi- cation. In International Conference on Medical Image Computing and Computer- Assisted Intervention. Springer, 557–567

work page 2024
[6]

Aobo Chen, Yangyi Li, Chenxu Zhao, and Mengdi Huai. 2025. A survey of security and privacy issues of machine unlearning

2025
[7]

Jinghui Chen, Dongruo Zhou, Jinfeng Yi, and Quanquan Gu. 2020. A frank-wolfe framework for efficient and effective adversarial attacks. In Proceedings of the AAAI conference on artificial intelligence , Vol. 34. 3486–3494

work page 2020

Show all 73 references

[8]

Noel Codella, Veronica Rotemberg, Philipp Tschandl, M Emre Celebi, Stephen Dusza, David Gutman, Brian Helba, Aadi Kalloo, Konstantinos Liopyris, Michael Marchetti, et al. 2019. Skin lesion analysis toward melanoma detection 2018: A challenge hosted by the international skin im...

2019 arXiv
[9]

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition . Ieee, 248–255

2009
[10]

Jack Foster, Stefan Schoepf, and Alexandra Brintrup. 2024. Fast machine unlearn- ing without retraining through selective synaptic dampening. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 38. 12043–12051

2024
[11]

Yarin Gal and Zoubin Ghahramani. 2016. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In international conference on machine learning. PMLR, 1050–1059

2016
[12]

Jakob Gawlikowski, Cedrique Rovile Njieutcheu Tassi, Mohsin Ali, Jongseok Lee, Matthias Humt, Jianxiang Feng, Anna Kruspe, Rudolph Triebel, Peter Jung, Ribana Roscher, et al. 2023. A survey of uncertainty in deep neural networks. Artificial Intelligence Review (2023)

2023
[13]

Jonas Geiping, Liam Fowl, Gowthami Somepalli, Micah Goldblum, Michael Moeller, and Tom Goldstein. 2021. What Doesn’t Kill You Makes You Robust (er): How to Adversarially Train against Data Poisoning. ICLR workshop (2021)

2021
[14]

Aditya Golatkar, Alessandro Achille, and Stefano Soatto. 2020. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 9304–9312

2020
[15]

Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. 2017. On calibration of modern neural networks. In International conference on machine learning . PMLR, 1321–1330

2017
[16]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition . 770–778

2016
[17]

Hongsheng Hu, Shuo Wang, Jiamin Chang, Haonan Zhong, Ruoxi Sun, Shuang Hao, Haojin Zhu, and Minhui Xue. 2024. A duty to forget, a right to be assured? exposing vulnerabilities in machine unlearning services. Network and Distributed System Security (NDSS) Symposium (2024)

2024
[18]

Zirui Huang, Yunlong Mao, and Sheng Zhong. 2024. {UBA-Inf}: Unlearning Activated Backdoor Attack with{Influence-Driven} Camouflage. In 33rd USENIX Security Symposium (USENIX Security 24) . 4211–4228

2024
[19]

Kaixiang Ji, Feng Chen, Xin Guo, Yadong Xu, Jian Wang, and Jingdong Chen. 2023. Uncertainty-guided learning for improving image manipulation detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 22456– 22465

2023
[20]

Renhe Jiang, Du Yin, Zhaonan Wang, Yizhuo Wang, Jiewen Deng, Hangchen Liu, Zekun Cai, Jinliang Deng, Xuan Song, and Ryosuke Shibasaki. 2021. Dl-traff: Survey and benchmark of deep learning models for urban traffic prediction. In Proceedings of the 30th ACM international confer...

2021
[21]

Aditya Prakash, and Chao Zhang

Lingkai Kong, Harshavardhan Kamarthi, Peng Chen, B. Aditya Prakash, and Chao Zhang. 2023. Uncertainty Quantification in Deep Learning. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 5809–5810

2023
[22]

Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. 2009. CIFAR-10 (Canadian Institute for Advanced Research). (2009). http://www.cs.toronto.edu/~kriz/cifar. html

2009
[23]

Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. 2017. Simple and scalable predictive uncertainty estimation using deep ensembles. Advances in neural information processing systems 30 (2017)

2017
[24]

Jing Lei, James Robins, and Larry Wasserman. 2013. Distribution-free prediction sets. J. Amer. Statist. Assoc. 108, 501 (2013), 278–287

2013
[25]

Yangyi Li, Aobo Chen, Wei Qian, Chenxu Zhao, Divya Lidder, and Mengdi Huai
[26]

Divya Lidder, Kathryn Morse, Bridget Sullivan, Wei Qian, Chenglin Miao, and Mengdi Huai. 2025. Neuron Explanations for Conformal Prediction (Student Abstract). In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 39. 29412–29414

2025
[27]

Zihao Liu, Tianhao Wang, Mengdi Huai, and Chenglin Miao. 2024. Backdoor attacks via machine unlearning. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 14115–14123

2024
[28]

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. ICLR (2018)

2018
[29]

Mahdi Pakdaman Naeini, Gregory Cooper, and Milos Hauskrecht. 2015. Obtaining well calibrated probabilities using bayesian binning. In Proceedings of the AAAI conference on artificial intelligence , Vol. 29

2015
[30]

Paarth Neekhara, Brian Dolhansky, Joanna Bitton, and Cristian Canton Ferrer
[31]

Jeremy Nixon, Michael W Dusenberry, Linchuan Zhang, Ghassen Jerfel, and Dustin Tran. 2019. Measuring Calibration in Deep Learning.. In CVPR workshops, Vol. 2

2019
[32]

Stephen Obadinma, Xiaodan Zhu, and Hongyu Guo. 2024. Calibration Attack: A Framework For Adversarial Attacks Targeting Calibration. arXiv preprint arXiv:2401.02718 (2024)

2024 arXiv
[33]

In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

Adversarial threats to deepfake detection: A practical perspective. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 923–932
[34]

Wei Qian, Chenxu Zhao, Wei Le, Meiyi Ma, and Mengdi Huai. 2023. Towards understanding and enhancing robustness of deep learning models against mali- cious unlearning attacks. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 1932–1942

2023
[35]

Wei Qian, Chenxu Zhao, Yangyi Li, Fenglong Ma, Chao Zhang, and Mengdi Huai. 2024. Towards modeling uncertainties of self-explaining neural networks via conformal prediction. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 14651–14659

2024
[36]

Stuart L Pardau. 2018. The california consumer privacy act: Towards a european- style privacy regime in the united states. J. Tech. L. & Pol’y 23 (2018), 68

2018
[37]

Fengchun Qiao and Xi Peng. 2021. Uncertainty-guided model generalization to unseen domains. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6790–6800

2021
[38]

Jiezhong Qiu, Jian Tang, Hao Ma, Yuxiao Dong, Kuansan Wang, and Jie Tang
[39]

Wei Qian, Chenxu Zhao, Huajie Shao, Minghan Chen, Fei Wang, and Mengdi Huai. 2022. Patient similarity learning with selective forgetting. In 2022 IEEE International Conference on Bioinformatics and Biomedicine (BIBM) . IEEE, 529– 534

2022
[40]

Yaniv Romano, Matteo Sesia, and Emmanuel Candes. 2020. Classification with valid and adaptive coverage. Advances in Neural Information Processing Systems 33 (2020), 3581–3591

2020
[41]

Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang- Chieh Chen. 2018. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition . 4510–4520

2018
[42]

Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. 2021. Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks. In International Conference on Machine Learning. PMLR, 9389–9398

2021
[43]

Protection Regulation. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council. Regulation (eu) 679 (2016), 2016

2016
[44]

Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014). CIKM ’25, November 10–14, 2025, Seoul, Republic of Korea. Wei Qian, Chenxu Zhao, Yangyi Li, Wenqian Ye, and Mengdi Huai

2014 arXiv
[45]

Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. 2022. Unrolling sgd: Understanding factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) . IEEE, 303–319

2022
[46]

Dustin Tran, Mike Dusenberry, Mark Van Der Wilk, and Danijar Hafner. 2019. Bayesian layers: A module for neural network uncertainty. Advances in neural information processing systems 32 (2019)

2019
[47]

Lianghe Shi and Weiwei Liu. 2024. Adversarial self-training improves robustness and generalization for gradual domain adaptation.Advances in Neural Information Processing Systems 36 (2024)

2024
[48]

Wentao Wang, Harry Shomer, Yuxuan Wan, Yaxin Li, Jiangtao Huang, and Hui Liu. 2023. A Mix-up Strategy to Enhance Adversarial Training with Imbalanced Data. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management. 2637–2645

2023
[49]

Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. 2021. Admix: En- hancing the transferability of adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 16158–16167

2021
[50]

Ximei Wang, Ying Jin, Mingsheng Long, Jianmin Wang, and Michael I Jordan
[51]

Ruofan Wang, Prakruthi Prabhakar, Gaurav Srivastava, Tianqi Wang, Zeinab S Jalali, Varun Bharill, Yunbo Ouyang, Aastha Nigam, Divya Venugopalan, Aman Gupta, et al. 2024. Limaml: Personalization of deep recommender models via meta learning. In Proceedings of the 30th ACM SIGKDD...

2024
[52]

Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck
[53]

Jiawen Wei, Ziwen Ye, Chuan Yang, Chen Chen, and Guangrui Ma. 2024. Process- Informed Deep Learning for Enhanced Order Fulfillment Cycle Time Prediction in On-Demand Grocery Retailing. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Managem...

2024
[54]

Miao Xiong, Ailin Deng, Pang Wei W Koh, Jiaying Wu, Shen Li, Jianqing Xu, and Bryan Hooi. 2023. Proximity-informed calibration for deep neural networks. Advances in Neural Information Processing Systems 36 (2023), 68511–68538

2023
[55]

Han Xu, Yaxin Li, Xiaorui Liu, Wentao Wang, and Jiliang Tang. 2021. Adversarial Robustness in Deep Learning: From Practices to Theories. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. 4086–4087

2021
[56]

Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan
[57]

Xulei Yang, Zeng Zeng, Sin G Teo, Li Wang, Vijay Chandrasekhar, and Steven Hoi. 2018. Deep learning for practical image recognition: Case study on kaggle competitions. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining . 923–931

2018
[58]

Changchang Yin, Pin-Yu Chen, Bingsheng Yao, Dakuo Wang, Jeffrey Caterino, and Ping Zhang. 2024. Sepsislab: Early sepsis prediction with uncertainty quan- tification and active sensing. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 6158–6168

2024
[59]

Network and Distributed System Security Symposium (2023)

Machine Unlearning of Features and Labels. Network and Distributed System Security Symposium (2023)

2023
[60]

Bianca Zadrozny and Charles Elkan. 2002. Transforming classifier scores into ac- curate multiclass probability estimates. In Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining . 694–699

2002
[61]

Huimin Zeng, Zhenrui Yue, Yang Zhang, Ziyi Kou, Lanyu Shang, and Dong Wang
[62]

Huimin Zeng, Zhenrui Yue, Yang Zhang, Lanyu Shang, and Dong Wang. 2023. Manipulating out-domain uncertainty estimation in deep neural networks via targeted clean-label poisoning. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management . ...

2023
[63]

Danek, and Jimeng Sun

Chaoqi Yang, Zhenbang Wu, Patrick Jiang, Zhen Lin, Junyi Gao, Benjamin P. Danek, and Jimeng Sun. 2023. PyHealth: A Deep Learning Toolkit for Healthcare Applications. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 5788–5789

2023
[64]

Chenxu Zhao, Wei Qian, Yangyi Li, Aobo Chen, and Mengdi Huai. 2024. Re- thinking Adversarial Robustness in the Context of the Right to be Forgotten. In Proceedings of the 41st International Conference on Machine Learning , Vol. 235. PMLR, 60927–60939

2024
[66]

Yaodong Yu, Stephen Bates, Yi Ma, and Michael Jordan. 2022. Robust calibra- tion with multi-domain temperature scaling. Advances in Neural Information Processing Systems 35 (2022), 27510–27523

2022
[71]

Jize Zhang, Bhavya Kailkhura, and T Yong-Jin Han. 2020. Mix-n-match: Ensem- ble and compositional methods for uncertainty calibration in deep learning. In International conference on machine learning . PMLR, 11117–11128

2020
[2018]

In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining

Deepinf: Social influence prediction with deep learning. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining. 2110–2119
[2019]

Advances in neural information processing systems 32 (2019)

Transferable normalization: Towards improving transferability of deep neural networks. Advances in neural information processing systems 32 (2019)

2019
[2021]

Interna- tional Conference on Learning Representations (2021)

Uncertainty sets for image classifiers using conformal prediction. Interna- tional Conference on Learning Representations (2021)

2021
[2022]

IJCAI International Joint Conference on Artificial Intelligence (2022)

On attacking out-domain uncertainty estimation in deep neural networks. IJCAI International Joint Conference on Artificial Intelligence (2022)

2022
[2023]

InInternational Conference on Machine Learning

Better diffusion models further improve adversarial training. InInternational Conference on Machine Learning . PMLR, 36246–36263
[2024]

In International Conference on Machine Learning

Data Poisoning Attacks against Conformal Prediction. In International Conference on Machine Learning . PMLR, 27563–27574

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [65]

Chenxu Zhao, Wei Qian, Rex Ying, and Mengdi Huai. 2024. Static and sequential malicious attacks in the context of selective forgetting. Advances in Neural Information Processing Systems 36 (2024)

work page 2024

[2] [1]

Anastasios Angelopoulos, Stephen Bates, Jitendra Malik, and Michael I Jordan

work page

[3] [2]

Tanya Boone-Sifuentes, Asef Nazari, Imran Razzak, Mohamed Reda Bouadjenek, Antonio Robles-Kelly, Daniel Ierodiaconou, and Elizabeth S Oh. 2022. Marine-tree: A large-scale marine organisms dataset for hierarchical image classification. In Proceedings of the 31st ACM International Conference on Information & Knowledge Management. 3838–3842

work page 2022

[4] [3]

Lucas Bourtoule, Varun Chandrasekaran, Christopher Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine Unlearning. In Proceedings of the 42nd IEEE Symposium on Security and Privacy

work page 2021

[5] [4]

Glenn W Brier. 1950. Verification of forecasts expressed in terms of probability. Monthly weather review 78, 1 (1950), 1–3

work page 1950

[6] [5]

Aobo Chen, Yangyi Li, Wei Qian, Kathryn Morse, Chenglin Miao, and Mengdi Huai. 2024. Modeling and Understanding Uncertainty in Medical Image Classifi- cation. In International Conference on Medical Image Computing and Computer- Assisted Intervention. Springer, 557–567

work page 2024

[7] [6]

Aobo Chen, Yangyi Li, Chenxu Zhao, and Mengdi Huai. 2025. A survey of security and privacy issues of machine unlearning

2025

[8] [7]

Jinghui Chen, Dongruo Zhou, Jinfeng Yi, and Quanquan Gu. 2020. A frank-wolfe framework for efficient and effective adversarial attacks. In Proceedings of the AAAI conference on artificial intelligence , Vol. 34. 3486–3494

work page 2020