From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization

• URL: http://arxiv.org/abs/2505.22310v1
• Date: Wed, 28 May 2025 12:53:08 GMT
• Title: From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization
• Abstract summary: Recent unlearning methods for LLMs are vulnerable to relearning attacks.<n>We make the surprising discovery that forget-set accuracy can recover from around 50% post-unlearning to nearly 100% with fine-tuning on just the retain set.<n>We propose a new class of methods that achieve state-of-the-art resistance to relearning attacks.
• Score: 46.78723722220735
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Recent unlearning methods for LLMs are vulnerable to relearning attacks: knowledge believed-to-be-unlearned re-emerges by fine-tuning on a small set of (even seemingly-unrelated) examples. We study this phenomenon in a controlled setting for example-level unlearning in vision classifiers. We make the surprising discovery that forget-set accuracy can recover from around 50% post-unlearning to nearly 100% with fine-tuning on just the retain set -- i.e., zero examples of the forget set. We observe this effect across a wide variety of unlearning methods, whereas for a model retrained from scratch excluding the forget set (gold standard), the accuracy remains at 50%. We observe that resistance to relearning attacks can be predicted by weight-space properties, specifically, $L_2$-distance and linear mode connectivity between the original and the unlearned model. Leveraging this insight, we propose a new class of methods that achieve state-of-the-art resistance to relearning attacks.

Related papers

• Test-Time Unlearning via Sparse Autoencoder [55.4290003355764]
  We propose ARIA, a test-time unlearning method that leaves model weights intact and gates access to unwanted knowledge only when generation enters a forget-related state.<n>ARIA improves the forget-retain trade-off over weight-based baselines across both a thinking model and an instruction model.
  arXiv  Detail & Related papers  (2026-09-14T18:58:09Z)
• Teleportation-Based Defenses for Privacy in Approximate Machine Unlearning [8.735490611482364]
  Approximate machine unlearning aims to efficiently remove the influence of specific data points from a trained model.<n>An adversary with access to pre- and post-unlearning models can exploit their differences for membership inference or data reconstruction.<n>We show these vulnerabilities arise from two factors: large gradient norms of forget-set samples and the close proximity of unlearned parameters to the original model.
  arXiv  Detail & Related papers  (2025-11-29T01:50:33Z)
• Reminiscence Attack on Residuals: Exploiting Approximate Machine Unlearning for Privacy [18.219835803238837]
  We show that approximate unlearning algorithms fail to adequately protect the privacy of unlearned data.<n>We propose the Reminiscence Attack (ReA), which amplifies the correlation between residuals and membership privacy.<n>We develop a dual-phase approximate unlearning framework that first eliminates deep-layer unlearned data traces and then enforces convergence stability.
  arXiv  Detail & Related papers  (2025-07-28T07:12:12Z)
• On the Necessity of Output Distribution Reweighting for Effective Class Unlearning [4.516437962353726]
  Forgetting specific classes from trained models is essential for enforcing user deletion rights and mitigating harmful or biased predictions.<n>Forgetting specific classes from trained models is essential for enforcing user deletion rights and mitigating harmful or biased predictions.<n>We show that our approach matches the results of full retraining in both metrics used for evaluation by prior work and the new metric we propose in this work.
  arXiv  Detail & Related papers  (2025-06-25T23:53:56Z)
• Robust Anti-Backdoor Instruction Tuning in LVLMs [53.766434746801366]
  We introduce a lightweight, certified-agnostic defense framework for large visual language models (LVLMs)<n>Our framework finetunes only adapter modules and text embedding layers under instruction tuning.<n>Experiments against seven attacks on Flickr30k and MSCOCO demonstrate that ours reduces their attack success rate to nearly zero.
  arXiv  Detail & Related papers  (2025-06-04T01:23:35Z)
• Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack [4.888434990566421]
  Machine unlearning aims to expunge a designated forget set from a trained model without costly retraining.<n>"Over-unlearning" that deteriorates retained data near the forget set, and post-hoc "relearning" attacks that aim to resurrect the forgotten knowledge.<n>We introduce Spotter, a plug-and-play objective that combines (i) a masked knowledge-distillation penalty on the nearby region of forget set to suppress OU@epsilon, and (ii) an intra-class dispersion loss that scatters forget-class embeddings.
  arXiv  Detail & Related papers  (2025-06-02T05:01:30Z)
• Improving LLM Unlearning Robustness via Random Perturbations [9.075604660200053]
  We show that current state-of-the-art LLM unlearning methods inherently reduce models' robustness.<n>We propose a novel theoretical framework that reframes the unlearning process as backdoor attacks and defenses.
  arXiv  Detail & Related papers  (2025-01-31T15:12:20Z)
• UnStar: Unlearning with Self-Taught Anti-Sample Reasoning for LLMs [10.335361310419826]
  We introduce UnSTAR: Unlearning with Self-Taught Anti-Sample Reasoning for large language models (LLMs) Our contributions are threefold; first, we propose a novel concept of anti-sample-induced unlearning; second, we generate anti-samples by leveraging misleading rationales, which help reverse learned associations and accelerate the unlearning process. Results demonstrate that anti-samples offer an efficient, targeted unlearning strategy for LLMs, opening new avenues for privacy-preserving machine learning and model modification.
  arXiv  Detail & Related papers  (2024-10-22T14:30:03Z)
• Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning [37.061187080745654]
  We show that existing approaches for unlearning in LLMs are surprisingly susceptible to a simple set of $textitbenign relearning attacks.<n>With access to only a small and potentially loosely related set of data, we find that we can ''jog'' the memory of unlearned models to reverse the effects of unlearning.
  arXiv  Detail & Related papers  (2024-06-19T09:03:21Z)
• Enhancing Consistency and Mitigating Bias: A Data Replay Approach for Incremental Learning [93.90047628101155]
  Deep learning systems are prone to catastrophic forgetting when learning from a sequence of tasks.<n>To address this, some methods propose replaying data from previous tasks during new task learning.<n>However, it is not expected in practice due to memory constraints and data privacy issues.
  arXiv  Detail & Related papers  (2024-01-12T12:51:12Z)
• Learn to Unlearn for Deep Neural Networks: Minimizing Unlearning Interference with Gradient Projection [56.292071534857946]
  Recent data-privacy laws have sparked interest in machine unlearning. Challenge is to discard information about the forget'' data without altering knowledge about remaining dataset. We adopt a projected-gradient based learning method, named as Projected-Gradient Unlearning (PGU) We provide empirically evidence to demonstrate that our unlearning method can produce models that behave similar to models retrained from scratch across various metrics even when the training dataset is no longer accessible.
  arXiv  Detail & Related papers  (2023-12-07T07:17:24Z)
• Learning to Unlearn: Instance-wise Unlearning for Pre-trained Classifiers [71.70205894168039]
  We consider instance-wise unlearning, of which the goal is to delete information on a set of instances from a pre-trained model. We propose two methods that reduce forgetting on the remaining data: 1) utilizing adversarial examples to overcome forgetting at the representation-level and 2) leveraging weight importance metrics to pinpoint network parameters guilty of propagating unwanted information.
  arXiv  Detail & Related papers  (2023-01-27T07:53:50Z)
• Deep Regression Unlearning [6.884272840652062]
  We introduce deep regression unlearning methods that generalize well and are robust to privacy attacks. We conduct regression unlearning experiments for computer vision, natural language processing and forecasting applications.
  arXiv  Detail & Related papers  (2022-10-15T05:00:20Z)
• Self-Damaging Contrastive Learning [92.34124578823977]
  Unlabeled data in reality is commonly imbalanced and shows a long-tail distribution. This paper proposes a principled framework called Self-Damaging Contrastive Learning to automatically balance the representation learning without knowing the classes. Our experiments show that SDCLR significantly improves not only overall accuracies but also balancedness.
  arXiv  Detail & Related papers  (2021-06-06T00:04:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.