Research map / Large language models / Language, safety and interpretability
Verification of Machine Unlearning is Fragile
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that current machine unlearning verification (backdoor and proof-of-retraining based) can be circumvented by two adversarial unlearning methods that retain unlearned data's influence, one retraining-based with nearest-neighbor batch substitution and one forging-based that edits the original training trajectory.
Problem
Machine unlearning verification assumes model providers honestly unlearn; the paper asks whether providers can pass backdoor and reproducing verification while still retaining information from supposedly unlearned data (focused on exact unlearning).
Approach
Replace unlearned samples in mini-batches with their class-wise nearest retained neighbors (or forge the original training trajectory via single-step SGD updates) so the proof of retraining verifies exactly/approximately while the model still reflects the unlearned data's gradient influence; backdoor data is also neutralized by substitution.
Key results
- Forging-based method keeps per-step verification error mostly below 1e-3 on MNIST, CIFAR-10 and SVHN models.
- Backdoor verification: Adv-F yields type II error ~1e-34 to 1e-16 (like original training), while Retrain and Adv-R yield ~0.997-0.999, meaning the backdoor is not triggered and the forged unlearning passes as genuine under Athena-style detection.
- In class-imbalanced settings, retraining-based adversarial unlearning improves retained-set F1 over naive retraining (e.g., MLP on MNIST D\Du 99.71 vs 95.86), and forging gives utility close to original training.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use retraining-based adversarial unlearning instead of original training | MNIST backdoor verification · MNIST | type II error (β): $2.61\times10^{-42}$ -> 0.997 | Helped |
| Use retraining-based adversarial unlearning instead of original training | CIFAR-10 backdoor verification · CIFAR-10 | type II error (β): $5.14\times10^{-20}$ -> 0.997 | Helped |
| Use retraining-based adversarial unlearning instead of original training | SVHN backdoor verification · SVHN | type II error (β): $1.11\times10^{-28}$ -> 0.999 | Helped |
| Use forging-based adversarial unlearning instead of naive retraining | backdoor verification · MNIST, CIFAR-10, and SVHN | type II error (β): 0.998 -> $5.46\times10^{-34}$; 0.998 -> $2.78\times10^{-16}$; 0.999 -> $2.08\times10^{-26}$ | Hurt |
| Use retraining-based adversarial unlearning instead of naive retraining | class-imbalanced unlearning · CIFAR-10 test set | macro F1-score: 65.22 ± 5.94 -> 76.51 ± 4.32 | Helped |
| Use forging-based adversarial unlearning instead of naive retraining | class-imbalanced unlearning · MNIST test set | macro F1-score: 89.92 ± 5.70 -> 96.81 ± 0.04 | Helped |
| Use nearest-neighbor batch selection instead of random sampling (ablation) | Adv-R · MNIST, CIFAR-10, and SVHN test sets | macro F1-score: 96.78 { $\pm$ 0.13} -> 96.60 { $\pm$ 0.14}; 83.08 { $\pm$ 0.34} -> 82.71 { $\pm$ 0.33}; 94.54 { $\pm$ 0.09} -> 94.75 { $ | Mixed |
| Use nearest-neighbor batch selection instead of random sampling (ablation) | Adv-R · MNIST batch selection | selection time | Helped |
| Use nearest-neighbor batch selection instead of random sampling (ablation) | Adv-R · MNIST, CIFAR-10, and SVHN | model training performance | No clear effect |
| Use forging-based adversarial unlearning instead of retraining-based adversarial unlearning | unlearning execution · MNIST, CIFAR-10, and SVHN | execution time | Helped |
Surprising findings
- Backdoor verification, which is a hypothesis test, judges the retraining-based adversarial unlearning as genuine (type II error near 1), meaning the adversarial model passes as properly unlearned.
- Adversarial retraining can match or improve model utility over naive retraining, so dishonest providers benefit rather than lose.
Limitations
- Focuses only on verification of exact unlearning, not approximate unlearning.
- Forging-based method only satisfies an epsilon-threshold reproducing verification and fails backdoor verification.
- Experiments limited to small image classification benchmarks (MNIST, CIFAR-10, SVHN) with MLP, CNN, ResNet.
Experimental setup
Datasets: MNIST CIFAR-10 SVHN
Benchmarks: MNIST CIFAR-10 SVHN
Metrics: verification error type II error (beta) macro F1-score execution time
Baselines: Retrain Original training Adv-R (random sampling S_r) Adv-R (nearest neighbor S_n)
Builds on: proof of learning Athena backdoor verification certified unlearning
Closest papers by meaning
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.90)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.89)
- Certified Unlearning for Neural Networks (ICML 2025 · similarity 0.89)
- Adversarial Mixup Unlearning (ICLR 2025 · similarity 0.89)
- Unlearned but Not Forgotten: Data Extraction after Exact Unlearning in LLM (NeurIPS 2025 · similarity 0.89)
- Rethinking Adversarial Robustness in the Context of the Right to be Forgotten (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.