Research map / Adversarial robustness and security / Attacks on text and graphs
Machine Unlearning Fails to Remove Data Poisoning Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that eight approximate machine unlearning methods fail to remove the effects of indiscriminate, targeted, and Gaussian data poisoning on ResNet-18/CIFAR-10 and GPT-2/IMDb, and proposes a Gaussian-noise poisoning metric (GUS) for auditing unlearning.
Problem
Approximate machine unlearning is often evaluated with membership inference attacks, which may miss residual influence; the paper asks whether unlearning methods can remove the effects of data poisoning when given all poison samples as the forget set.
Approach
Use data poisoning as a unlearning audit: poisons that leave detectable traces (targeted, indiscriminate, or Gaussian noise whose dependence is measured via normalized input-gradient inner products) should be fully gone after exact unlearning, so residual effects reveal unlearning failure.
Key results
- On CIFAR-10 with indiscriminate poisoning, GD reaches 87.71% test accuracy at 1.5% poisoning with 10 epochs, versus 89.24% for retraining, while CFk and EUk remain far below retrain accuracy.
- Standard membership inference attacks show most unlearning methods pass at low FPR, yet Gaussian poisoning reveals that none fully remove the poison influence.
- Unlearning with about 10% of the training compute fails to remove targeted and backdoor poisons on ResNet-18 and GPT-2 across all eight evaluated methods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GD to unlearn indiscriminate poisons | ResNet-18 · CIFAR-10, indiscriminate poisoning | test accuracy | Helped |
| Use GD to unlearn targeted or Gaussian poisons | ResNet-18 · CIFAR-10, targeted and Gaussian poisoning | poison mitigation | Hurt |
| Use SCRUB to unlearn Gaussian poisons | GPT-2 · IMDb, Gaussian poisoning | poison mitigation | Helped |
| Use SCRUB to unlearn targeted or indiscriminate poisons | GPT-2 · IMDb, targeted and indiscriminate poisoning | poison mitigation | Hurt |
| Use EUk or NGD to unlearn Gaussian poisons | GPT-2 with classification head · IMDb, Gaussian poisoning | poison mitigation | Helped |
| Use EUk or NGD to unlearn targeted poisons | GPT-2 text decoder · IMDb, targeted poisoning | poison mitigation | Hurt |
| Use GA to unlearn Gaussian and targeted poisons | ResNet-18 · CIFAR-10, Gaussian and targeted poisoning | poison mitigation | Helped |
| Apply GA to GPT-2 rather than ResNet-18 | GPT-2 · IMDb, Gaussian and targeted poisoning | poison mitigation | Hurt |
| Increase NGD update steps (ablation) | NGD · Unlearning experiments | unlearning effectiveness | Helped |
| Increase NGD update steps (ablation) | NGD on language models · Language-model tasks | post-unlearning test accuracy: 10% | Hurt |
| Increase EUk update steps (ablation) | EUk · Unlearning experiments | unlearning effectiveness | No clear effect |
| Vary Gaussian poison fraction among 1.5%, 2%, and 2.5% (ablation) | Gaussian poisoning experiments · CIFAR-10 and IMDb | poisoning/unlearning trends: 1.5%, 2%, and 2.5% | No clear effect |
Surprising findings
- GD successfully mitigates indiscriminate poisoning on vision but fails on targeted and Gaussian poisoning, even while keeping competitive accuracy.
- Standard MIA-based unlearning evaluations appear to show success for most methods, which is misleading relative to the poisoning-based audit.
Limitations
- Evaluation covers only ResNet-18 on CIFAR-10 and GPT-2 on IMDb, limiting generality.
- Unlearning budget capped at 10% of training compute, with results at smaller budgets not fully explored.
- Gaussian poisoning metric relies on the specific gradient-noise correlation and may not capture all forms of residual influence.
Experimental setup
Datasets: CIFAR-10 IMDb
Benchmarks: CIFAR-10 IMDb
Metrics: test accuracy targeted misclassification rate TPR@FPR=0.01 Gaussian Unlearning Score (GUS)
Baselines: GD NGD GA EUk CFk SCRUB NegGrad+ SSD
Builds on: Witch's Brew poisoning instruction poisoning SCRUB SSD
Closest papers by meaning
- Adversarial Mixup Unlearning (ICLR 2025 · similarity 0.91)
- Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond (ICML 2025 · similarity 0.90)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.90)
- From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization (NeurIPS 2025 · similarity 0.90)
- Not All Wrong is Bad: Using Adversarial Examples for Unlearning (ICML 2025 · similarity 0.90)
- The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples (NeurIPS 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.