Research map / Label-efficient and robust learning / Recognition and long-tail
The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that approximately unlearned models can still recognize perturbed forget samples that a re-trained model misses ("residual knowledge"), proves disagreement under perturbation is inevitable in high dimensions, and proposes RURK, a fine-tuning regularizer penalizing re-recognition of perturbed forget samples.
Problem
Certified approximate unlearning guarantees (statistical indistinguishability from re-training) do not extend to model outputs on adversarially perturbed forget samples, leaving a residual privacy risk where unlearned models still correctly classify perturbed forget samples that re-trained models mi
Approach
Defines residual knowledge as the ratio of the unlearned model's probability of correctly classifying perturbed forget samples to the re-trained model's, proves disagreement under perturbation is inevitable via isoperimetric inequality, and mitigates it with RURK, a fine-tuning loss that adds a term penalizing low loss (correct classification) on perturbed forget samples while preserving retain-se
Key results
- On full CIFAR-10 with ResNet-18, RURK achieves the smallest average gap to Re-train (2.65) versus 2.71 for NegGrad+ and 8.22 for GD, with test accuracy 92.60% vs 93.30% for Re-train.
- RURK keeps residual knowledge near 1 for small perturbations (tau < 0.01) and suppresses it at larger tau, whereas Original and GD retain residual knowledge above 1.
- On small CIFAR-5, RURK obtains average gap 2.60 compared to 3.23 for NTK and 9.49 for Fisher, with re-learn time of 2 epochs.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add RURK's perturbed-forget-sample regularization | RURK versus NTK · Small CIFAR-5 | Avg. Gap: 3.23 -> 2.60 | Helped |
| Add RURK's perturbed-forget-sample regularization | RURK versus NegGrad+ · CIFAR-10 | Avg. Gap: 2.71 -> 2.65 | Helped |
| Use RURK's vulnerable-perturbation regularization instead of GD's retain-set-only fine-tuning | CIFAR-10 unlearning · CIFAR-10 perturbed forget samples | Residual knowledge | Helped |
| Use RURK's vulnerable-perturbation regularization instead of NegGrad+'s unlearning objective | CIFAR-10 unlearning · CIFAR-10 perturbed forget samples | Residual knowledge | Helped |
| Increase the perturbation radius τ in the residual-knowledge penalty | RURK · CIFAR-10 | Model distinguishability | Hurt |
Surprising findings
- Residual knowledge persists even under certified-style methods such as NTK, whose residual knowledge stays above 1 despite a competitive average gap.
- GA and SSD yield residual knowledge below 1 even at tau=0, indicating over-unlearning rather than residual retention.
Limitations
- Controlling adversarial disagreement across the full perturbation ball is computationally infeasible, comparable to achieving perfect adversarial robustness.
- Since the re-trained model is unavailable during unlearning, only one side of residual knowledge (r ≤ 1) can be bounded.
- Experiments use only vision benchmarks with a single perturbation setting (v=1 Gaussian sampling) in the main results.
Experimental setup
Datasets: CIFAR-10 ImageNet-100
Benchmarks: CIFAR-10 ImageNet-100
Metrics: retain accuracy unlearn accuracy test accuracy MIA accuracy re-learn time average gap residual knowledge
Baselines: Certified Removal (CR) Fisher unlearning NTK unlearning GD NGD GA NegGrad+ EU-k CF-k SCRUB SSD
Builds on: certified removal noisy gradient descent SCRUB SSD NegGrad+
Closest papers by meaning
- Not All Wrong is Bad: Using Adversarial Examples for Unlearning (ICML 2025 · similarity 0.91)
- From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization (NeurIPS 2025 · similarity 0.91)
- Certified Unlearning for Neural Networks (ICML 2025 · similarity 0.91)
- Learning to Unlearn: Instance-Wise Unlearning for Pre-trained Classifiers (AAAI 2024 · similarity 0.90)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.90)
- Adversarial Mixup Unlearning (ICLR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.