Research map / Adversarial robustness and security / Certified and empirical robustness
Not All Wrong is Bad: Using Adversarial Examples for Unlearning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AMUN, an approximate machine unlearning method that fine-tunes a trained image classifier on minimal-norm adversarial examples of forget samples carrying their wrong adversarial labels, lowering forget-set confidence while preserving test accuracy.
Problem
Approximate machine unlearning for image classifiers fails to match retrained models in forget-set accuracy and confidence, and existing fine-tuning-based methods suffer catastrophic forgetting and need access to the remain set.
Approach
Fine-tune the trained model on the closest adversarial examples of forget samples labeled with their adversarial (wrong) labels; these examples lie on the model's own learned distribution, so they lower forget-sample confidence, localize decision-boundary changes, and avoid catastrophic forgetting.
Key results
- On CIFAR-10 with 10% random forget set and access to the remain set, AMUN reaches average gap 0.62 vs 1.44 for SalUn and 2.06 for FT (retrain reference).
- Without access to the remain set on CIFAR-10 (10% forget), AMUN achieves average gap 1.94 vs 4.11 for SalUn and 4.31 for RL.
- On adversarially robust (1-Lipschitz) ResNet-18, RMIA FT AUC is 49.55 for AMUN vs 49.95 for retrain at 10% forget, i.e. near random guessing.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AMUN instead of SalUn | ResNet-18 unlearning on CIFAR-10 with access to DR · CIFAR-10 random forget 10% | Avg. Gap: 1.44 ±0.12 -> 0.62 ±0.05 | Helped |
| Use AMUN instead of SalUn | ResNet-18 unlearning on CIFAR-10 with access to DR · CIFAR-10 random forget 50% | Avg. Gap: 1.36 ±0.04 -> 0.33 ±0.03 | Helped |
| Add SalUn parameter masking to AMUN (ablation) | AMUN on CIFAR-10 with access to DF only · CIFAR-10 random forget 10% | Avg. Gap: 1.94 ±0.13 -> 1.77 ±0.06 | Helped |
| Add SalUn parameter masking to AMUN (ablation) | AMUN on CIFAR-10 with access to DF only · CIFAR-10 random forget 50% | Avg. Gap: 2.51 ±0.09 -> 2.00 ±0.17 | Helped |
| Replace adversarial examples with wrong labels on forget samples (ablation) | AMUN fine-tuning on CIFAR-10 · CIFAR-10 test set | test accuracy | Hurt |
| Replace adversarial examples with random samples at the same distance and their adversarial labels (ablation) | AMUN fine-tuning on CIFAR-10 · CIFAR-10 test set | test accuracy | Hurt |
| Replace adversarial examples with samples carrying different wrong labels (ablation) | AMUN fine-tuning on CIFAR-10 · CIFAR-10 test set | test accuracy | Hurt |
| Use weaker FGSM attacks to generate adversarial examples (ablation) | AMUN · CIFAR-10 unlearning | unlearning effectiveness | Hurt |
| Use AMUN on adversarially robust models (ablation) | Lipschitz-clipped ResNet-18 · CIFAR-10 random forget 10% and 50%, access to DR | FT AUC: 49.12 ±0.19; 49.41 ±0.25 | No clear effect |
Surprising findings
- Fine-tuning on only adversarial examples with their wrong labels causes little loss of test accuracy, unlike fine-tuning on random or adversarial-label-only datasets.
- Without access to the remain set on Tiny ImageNet VGG19, AMUN's unlearn accuracy drops to 58.54 while test accuracy falls to 43.22, showing degradation in that setting.
Limitations
- Evaluated only on image classification with ResNet-18 and VGG19 on CIFAR-10 and Tiny ImageNet.
- No theoretical guarantees; the bound in Theorem 4.1 relies on strong assumptions (convexity, near-zero loss, smoothness).
- Without access to the remaining data, accuracy degradation is larger on Tiny ImageNet, and transferred adversarial examples perform worse.
Experimental setup
Datasets: CIFAR-10 Tiny ImageNet
Benchmarks: CIFAR-10 Tiny ImageNet
Metrics: unlearn accuracy retain accuracy test accuracy FT AUC (RMIA) MIS average gap
Baselines: FT RL GA BS l1-Sparse SalUn
Builds on: SalUn Random Labels unlearning PGD adversarial attack RMIA
Closest papers by meaning
- Learning to Unlearn: Instance-Wise Unlearning for Pre-trained Classifiers (AAAI 2024 · similarity 0.92)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.92)
- The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples (NeurIPS 2025 · similarity 0.91)
- Machine Unlearning for Image-to-Image Generative Models (ICLR 2024 · similarity 0.91)
- Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models (NeurIPS 2024 · similarity 0.90)
- From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization (NeurIPS 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.