I was testing the DT model on Adult and found that the neg samples had exactly the same output on the original model and the unlearning model, which is what caused the difference attack to work so well. But it shouldn't be possible for both models to have exactly the same output for the same sample? Is there some detail I am overlooking please?
This is the posterior difference dataset used for the attack model in the project, and it seems that there are many neg samples where duplicates occur and the posterior is exactly the same.
I was testing the DT model on Adult and found that the neg samples had exactly the same output on the original model and the unlearning model, which is what caused the difference attack to work so well. But it shouldn't be possible for both models to have exactly the same output for the same sample? Is there some detail I am overlooking please?
This is the posterior difference dataset used for the attack model in the project, and it seems that there are many neg samples where duplicates occur and the posterior is exactly the same.