Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack

• URL: http://arxiv.org/abs/2506.01318v2
• Date: Tue, 03 Jun 2025 07:41:52 GMT
• Title: Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack
• Abstract summary: Machine unlearning aims to expunge a designated forget set from a trained model without costly retraining.<n>"Over-unlearning" that deteriorates retained data near the forget set, and post-hoc "relearning" attacks that aim to resurrect the forgotten knowledge.<n>We introduce Spotter, a plug-and-play objective that combines (i) a masked knowledge-distillation penalty on the nearby region of forget set to suppress OU@epsilon, and (ii) an intra-class dispersion loss that scatters forget-class embeddings.
• Score: 4.888434990566421
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Machine unlearning (MU) aims to expunge a designated forget set from a trained model without costly retraining, yet the existing techniques overlook two critical blind spots: "over-unlearning" that deteriorates retained data near the forget set, and post-hoc "relearning" attacks that aim to resurrect the forgotten knowledge. We first derive the over-unlearning metric OU@{\epsilon}, which represents the collateral damage to the nearby region of the forget set, where the over-unlearning mainly appears. Next, we expose an unforeseen relearning threat on MU, i.e., the Prototypical Relearning Attack, which exploits the per-class prototype of the forget class with just a few samples, and easily restores the pre-unlearning performance. To counter both blind spots, we introduce Spotter, a plug-and-play objective that combines (i) a masked knowledge-distillation penalty on the nearby region of forget set to suppress OU@{\epsilon}, and (ii) an intra-class dispersion loss that scatters forget-class embeddings, neutralizing prototypical relearning attacks. On CIFAR-10, as one of validations, Spotter reduces OU@{\epsilon}by below the 0.05X of the baseline, drives forget accuracy to 0%, preserves accuracy of the retain set within 1% of difference with the original, and denies the prototype-attack by keeping the forget set accuracy within <1%, without accessing retained data. It confirms that Spotter is a practical remedy of the unlearning's blind spots.

Related papers

• Test-Time Unlearning via Sparse Autoencoder [55.4290003355764]
  We propose ARIA, a test-time unlearning method that leaves model weights intact and gates access to unwanted knowledge only when generation enters a forget-related state.<n>ARIA improves the forget-retain trade-off over weight-based baselines across both a thinking model and an instruction model.
  arXiv  Detail & Related papers  (2026-09-14T18:58:09Z)
• SHRED: Retain-Set-Free Unlearning via Self-Distillation with Logit Demotion [39.17638540496959]
  SHRED (Self-distillation via High-surprisal-only Retain-set-free Entropy Demotion) is a retain-set-free unlearning method built on a key insight.<n>High-information tokens concentrate the model's memorized knowledge, while low-information tokens reflect general language competence.<n> SHRED is robust against relearning attacks and membership-inference attacks, and it maintains stable utility even after many sequential unlearning runs.
  arXiv  Detail & Related papers  (2026-05-08T09:25:18Z)
• UnlearnShield: Shielding Forgotten Privacy against Unlearning Inversion [46.86245039541715]
  Unlearning aims to remove the influence of specific data from trained models, thereby enhancing privacy protection.<n>Recent research has uncovered critical privacy vulnerabilities, showing that adversaries can exploit unlearning inversion to reconstruct data that was intended to be erased.<n>We propose UnlearnShield, the first defense specifically tailored to counter unlearning inversion.
  arXiv  Detail & Related papers  (2026-01-28T07:42:51Z)
• Teleportation-Based Defenses for Privacy in Approximate Machine Unlearning [8.735490611482364]
  Approximate machine unlearning aims to efficiently remove the influence of specific data points from a trained model.<n>An adversary with access to pre- and post-unlearning models can exploit their differences for membership inference or data reconstruction.<n>We show these vulnerabilities arise from two factors: large gradient norms of forget-set samples and the close proximity of unlearned parameters to the original model.
  arXiv  Detail & Related papers  (2025-11-29T01:50:33Z)
• Reminiscence Attack on Residuals: Exploiting Approximate Machine Unlearning for Privacy [18.219835803238837]
  We show that approximate unlearning algorithms fail to adequately protect the privacy of unlearned data.<n>We propose the Reminiscence Attack (ReA), which amplifies the correlation between residuals and membership privacy.<n>We develop a dual-phase approximate unlearning framework that first eliminates deep-layer unlearned data traces and then enforces convergence stability.
  arXiv  Detail & Related papers  (2025-07-28T07:12:12Z)
• When Forgetting Triggers Backdoors: A Clean Unlearning Attack [1.8434042562191815]
  We propose a novel em clean backdoor attack that exploits both the model learning phase and the subsequent unlearning requests.<n>This strategy results in a powerful and stealthy novel attack that is hard to detect or mitigate.
  arXiv  Detail & Related papers  (2025-06-14T14:31:51Z)
• Robust Anti-Backdoor Instruction Tuning in LVLMs [53.766434746801366]
  We introduce a lightweight, certified-agnostic defense framework for large visual language models (LVLMs)<n>Our framework finetunes only adapter modules and text embedding layers under instruction tuning.<n>Experiments against seven attacks on Flickr30k and MSCOCO demonstrate that ours reduces their attack success rate to nearly zero.
  arXiv  Detail & Related papers  (2025-06-04T01:23:35Z)
• From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization [46.78723722220735]
  Recent unlearning methods for LLMs are vulnerable to relearning attacks.<n>We make the surprising discovery that forget-set accuracy can recover from around 50% post-unlearning to nearly 100% with fine-tuning on just the retain set.<n>We propose a new class of methods that achieve state-of-the-art resistance to relearning attacks.
  arXiv  Detail & Related papers  (2025-05-28T12:53:08Z)
• Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning [37.061187080745654]
  We show that existing approaches for unlearning in LLMs are surprisingly susceptible to a simple set of $textitbenign relearning attacks.<n>With access to only a small and potentially loosely related set of data, we find that we can ''jog'' the memory of unlearned models to reverse the effects of unlearning.
  arXiv  Detail & Related papers  (2024-06-19T09:03:21Z)
• CovarNav: Machine Unlearning via Model Inversion and Covariance Navigation [11.222501077070765]
  Machine unlearning has emerged as an essential technique to selectively remove the influence of specific training data points on trained models. We introduce a three-step process, named CovarNav, to facilitate this forgetting. We rigorously evaluate CovarNav on the CIFAR-10 and Vggface2 datasets.
  arXiv  Detail & Related papers  (2023-11-21T21:19:59Z)
• Learning to Unlearn: Instance-wise Unlearning for Pre-trained Classifiers [71.70205894168039]
  We consider instance-wise unlearning, of which the goal is to delete information on a set of instances from a pre-trained model. We propose two methods that reduce forgetting on the remaining data: 1) utilizing adversarial examples to overcome forgetting at the representation-level and 2) leveraging weight importance metrics to pinpoint network parameters guilty of propagating unwanted information.
  arXiv  Detail & Related papers  (2023-01-27T07:53:50Z)
• Federated Zero-Shot Learning for Visual Recognition [55.65879596326147]
  We propose a novel Federated Zero-Shot Learning FedZSL framework. FedZSL learns a central model from the decentralized data residing on edge devices. The effectiveness and robustness of FedZSL are demonstrated by extensive experiments conducted on three zero-shot benchmark datasets.
  arXiv  Detail & Related papers  (2022-09-05T14:49:34Z)
• RelaxLoss: Defending Membership Inference Attacks without Losing Utility [68.48117818874155]
  We propose a novel training framework based on a relaxed loss with a more achievable learning target. RelaxLoss is applicable to any classification model with added benefits of easy implementation and negligible overhead. Our approach consistently outperforms state-of-the-art defense mechanisms in terms of resilience against MIAs.
  arXiv  Detail & Related papers  (2022-07-12T19:34:47Z)
• AGKD-BML: Defense Against Adversarial Attack by Attention Guided Knowledge Distillation and Bi-directional Metric Learning [61.8003954296545]
  We propose a novel adversarial training-based model by Attention Guided Knowledge Distillation and Bi-directional Metric Learning (AGKD-BML) Our proposed AGKD-BML model consistently outperforms the state-of-the-art approaches.
  arXiv  Detail & Related papers  (2021-08-13T01:25:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.