mlsanityData to 7 Oct 2026

Towards Adversarial Evaluations for Inexact Machine Unlearning

arXiv 2201.06640 ↗First posted 17 Jan 2022cs.LG cs.CVcited by 82

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

Machine Learning models face increased concerns regarding the storage of personal user data and adverse impacts of corrupted data like backdoors or systematic bias. Machine Unlearning can address these by allowing post-hoc deletion of affected training data from a learned model. Achieving this task exactly is computationally expensive; consequently, recent works have proposed inexact unlearning algorithms to solve this approximately as well as evaluation methods to test the effectiveness of these algorithms. In this work, we first outline some necessary criteria for evaluation methods and show no existing evaluation satisfies them all. Then, we design a stronger black-box evaluation method called the Interclass Confusion (IC) test which adversarially manipulates data during training to detect the insufficiency of unlearning procedures. We also propose two analytically motivated baseline methods~(EU-k and CF-k) which outperform several popular inexact unlearning methods. Overall, we demonstrate how adversarial evaluation strategies can help in analyzing various unlearning phenomena which can guide the development of stronger unlearning algorithms.

Key facts. Cited by 82 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 45 of its 85 references that are in the map. First posted on arXiv 17 Jan 2022.

Builds on

45 of 85 references.

Closest ancestors · 5

Same direction, newest first

  1. 2022Zero-Shot Machine Unlearning14 Jan
  2. 2021On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning22 Oct
  3. 2021Unrolling SGD: Understanding Factors Influencing Machine Unlearning27 Sep
  4. 2021Machine Unlearning of Features and Labels26 Aug
  5. 2021DeepObliviate: A Powerful Charm for Erasing Data Residual Memory in Deep Neural Networks13 May

Other references · 40

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2016Equality of Opportunity in Supervised Learningcited by 2,000
  6. 2016Understanding deep learning requires rethinking generalizationcited by 1,657
  7. 2019Machine Unlearningcited by 1,020
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  9. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  10. 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 599
  11. 2019Certified Data Removal from Machine Learning Modelscited by 512
  12. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 492
28 more
  1. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 447
  2. 2020Backdoor Learning: A Surveycited by 412
  3. 2019Confident Learning: Estimating Uncertainty in Dataset Labelscited by 411
  4. 2021Pervasive Label Errors in Test Sets Destabilize Machine Learning Benchmarkscited by 388
  5. 2015Understanding Neural Networks Through Deep Visualizationcited by 332
  6. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  7. 2020Amnesiac Machine Learningcited by 305
  8. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  9. 2020Approximate Data Deletion from Machine Learning Modelscited by 250
  10. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  11. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 219
  12. 2020When Machine Unlearning Jeopardizes Privacycited by 181
  13. 2020Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observationscited by 171
  14. 2020Mixed-Privacy Forgetting in Deep Networkscited by 158
  15. 2020DeltaGrad: Rapid retraining of machine learning modelscited by 143
  16. 2020Machine Unlearning for Random Forestscited by 125
  17. 2021Adversarial Examples Make Strong Poisonscited by 115
  18. 2021Pre-training without Natural Imagescited by 100
  19. 2020InstaHide: Instance-hiding Schemes for Private Distributed Learningcited by 90
  20. 2020Machine Unlearning: Linear Filtration for Logit-based Classifierscited by 89
  21. 2021A Survey on Bias in Visual Datasetscited by 84
  22. 2020Learn to Forget: Machine Unlearning via Neuron Maskingcited by 56
  23. 2017FreezeOut: Accelerate Training by Progressively Freezing Layerscited by 54
  24. 2017Generative Poisoning Attack Method Against Neural Networkscited by 49
  25. 2020Distributional Generalization: A New Kind of Generalizationcited by 41
  26. 2020Coded Machine Unlearningcited by 35
  27. 2021SSSE: Efficiently Erasing Samples from Trained Machine Learning Modelscited by 28
  28. 2021Fairness-Aware PAC Learning from Corrupted Datacited by 18

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 8; 2024: 31; 2025: 26; 2026: 17.

82 papers.

Sort:

By area:

  1. 2024TOFU: A Task of Fictitious Unlearning for LLMscited by 507
  2. 2023In-Context Unlearning: Language Models as Few Shot Unlearnerscited by 214
  3. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 158
  4. 2024An Adversarial Perspective on Machine Unlearning for AI Safetycited by 113
  5. 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacycited by 78
  6. 2023Computationally Budgeted Continual Learning: What Does Matter?cited by 61
  7. 2024Scissorhands: Scrub Data Influence via Connection Sensitivity in Networkscited by 50
  8. 2024Are we making progress in unlearning? Findings from the first NeurIPS unlearning competitioncited by 48
  9. 2024Challenging Forgets: Unveiling the Worst-Case Forget Sets in Machine Unlearningcited by 44
  10. 2023GNNDelete: A General Strategy for Unlearning in Graph Neural Networkscited by 43
  11. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 35
  12. 2024Threats, Attacks, and Defenses in Machine Unlearning: A Surveycited by 34
38 more
  1. 2024Erasing Conceptual Knowledge from Language Modelscited by 34
  2. 2024Corrective Machine Unlearningcited by 26
  3. 2023Deep Unlearning: Fast and Efficient Gradient-free Approach to Class Forgettingcited by 21
  4. 2023MultiDelete for Multimodal Machine Unlearningcited by 20
  5. 2024The Utility and Complexity of in- and out-of-Distribution Machine Unlearningcited by 20
  6. 2025Learning to Unlearn while Retaining: Combating Gradient Conflicts in Machine Unlearningcited by 19
  7. 2024Attribute-to-Delete: Machine Unlearning via Datamodel Matchingcited by 18
  8. 2024MUNBa: Machine Unlearning via Nash Bargainingcited by 17
  9. 2024MU-Bench: A Multitask Multimodal Benchmark for Machine Unlearningcited by 16
  10. 2024Targeted Unlearning with Single Layer Unlearning Gradientcited by 16
  11. 2024Remaining-data-free Machine Unlearning by Suppressing Sample Contributioncited by 13
  12. 2025From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularizationcited by 12
  13. 2025Ascent Fails to Forgetcited by 12
  14. 2023Adapt then Unlearn: Exploring Parameter Space Semantics for Unlearning in Generative Adversarial Networkscited by 11
  15. 2024Towards Natural Machine Unlearningcited by 11
  16. 2024Ferrari: Federated Feature Unlearning via Optimizing Feature Sensitivitycited by 11
  17. 2024An Information Theoretic Evaluation Metric For Strong Unlearningcited by 11
  18. 2023Rapid Adaptation in Online Continual Learning: Are We Evaluating It Right?cited by 10
  19. 2024SAP: Corrective Machine Unlearning with Scaled Activation Projection for Label Noise Robustnesscited by 10
  20. 2023Audit to Forget: A Unified Method to Revoke Patients' Private Data in Intelligent Healthcarecited by 9
  21. 2024Underestimated Privacy Risks for Minority Populations in Large Language Model Unlearningcited by 9
  22. 2024Deep Unlearn: Benchmarking Machine Unlearning for Image Classificationcited by 8
  23. 2025Towards Reliable Forgetting: A Survey on Machine Unlearning Verificationcited by 8
  24. 2025Go Beyond Your Means: Unlearning with Per-Sample Gradient Orthogonalizationcited by 7
  25. 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted datacited by 7
  26. 2024Improved Localized Machine Unlearning Through the Lens of Memorizationcited by 6
  27. 2025A Unified Gradient-based Framework for Task-agnostic Continual Learning-Unlearningcited by 6
  28. 2024Attack and Reset for Unlearning: Exploiting Adversarial Noise toward Machine Unlearning through Parameter Re-initializationcited by 5
  29. 2024Data Selection for Transfer Unlearningcited by 5
  30. 2024Towards Privacy-Guaranteed Label Unlearning in Vertical Federated Learning: Few-Shot Forgetting without Disclosurecited by 5
  31. 2025Position: Bridge the Gaps between Machine Unlearning and AI Regulationcited by 5
  32. 2025Certified Data Removal Under High-dimensional Settingscited by 5
  33. 2025SEPS: A Separability Measure for Robust Unlearning in LLMscited by 5
  34. 2025"Alexa, can you forget me?" Machine Unlearning Benchmark in Spoken Language Understandingcited by 5
  35. 2025FROG: Fair Removal on Graphscited by 4
  36. 2025Exploring Nonlinear Pathway in Parameter Space for Machine Unlearningcited by 4
  37. 2025Leveraging Per-Instance Privacy for Machine Unlearningcited by 4
  38. 2025Unlearning Comparator: A Visual Analytics System for Comparative Evaluation of Machine Unlearning Methodscited by 4

50 most cited of 82 All 82 (JSON)