mlsanityData to 7 Oct 2026

Threats, Attacks, and Defenses in Machine Unlearning: A Survey

arXiv 2403.13682 ↗First posted 20 Mar 2024cs.CR cs.AIcited by 34

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

Machine Unlearning (MU) has recently gained considerable attention due to its potential to achieve Safe AI by removing the influence of specific data from trained Machine Learning (ML) models. This process, known as knowledge removal, addresses AI governance concerns of training data such as quality, sensitivity, copyright restrictions, and obsolescence. This capability is also crucial for ensuring compliance with privacy regulations such as the Right To Be Forgotten (RTBF). Furthermore, effective knowledge removal mitigates the risk of harmful outcomes, safeguarding against biases, misinformation, and unauthorized data exploitation, thereby enhancing the safe and responsible use of AI systems. Efforts have been made to design efficient unlearning approaches, with MU services being examined for integration with existing machine learning as a service (MLaaS), allowing users to submit requests to remove specific data from the training corpus. However, recent research highlights vulnerabilities in machine unlearning systems, such as information leakage and malicious unlearning, that can lead to significant security and privacy concerns. Moreover, extensive research indicates that unlearning methods and prevalent attacks fulfill diverse roles within MU systems. This underscores the intricate relationship and complex interplay among these mechanisms in maintaining system functionality and safety. This survey aims to fill the gap between the extensive number of studies on threats, attacks, and defenses in machine unlearning and the absence of a comprehensive review that categorizes their taxonomy, methods, and solutions, thus offering valuable insights for future research directions and practical implementations.

Key facts. Cited by 34 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 92 of its 167 references that are in the map. First posted on arXiv 20 Mar 2024.

Builds on

92 of 167 references.

Closest ancestors · 26

Same direction, newest first

  1. 2024Machine Unlearning: Taxonomy, Metrics, Applications, Challenges, and Prospects13 Mar
  2. 2024Guardrail Baselines for Unlearning in LLMs5 Mar
  3. 2024Eight Methods to Evaluate Robust Unlearning in LLMs26 Feb
  4. 2024Corrective Machine Unlearning21 Feb
  5. 2024Towards Safer Large Language Models through Machine Unlearning15 Feb
  6. 2024Rethinking Machine Unlearning for Large Language Models13 Feb
  7. 2024Selective Forgetting: Advancing Machine Unlearning Techniques and Evaluation in Language Models8 Feb
  8. 2024Unlearning Traces the Influential Training Data of Language Models26 Jan
  9. 2023FairSISA: Ensemble Post-Processing to Improve Fairness of Unlearning in LLMs12 Dec
  10. 2023Knowledge Unlearning for LLMs: Tasks, Methods, and Challenges27 Nov
  11. 2023ERASER: Machine Unlearning in MLaaS via an Inference Serving-Aware Approach3 Nov
  12. 2023Breaking the Trilemma of Privacy, Utility, Efficiency via Controllable Machine Unlearning28 Oct
14 more
  1. 2023Large Language Model Unlearning14 Oct
  2. 2023In-Context Unlearning: Language Models as Few Shot Unlearners11 Oct
  3. 2023A Duty to Forget, a Right to be Assured? Exposing Vulnerabilities in Machine Unlearning Services15 Sep
  4. 2023Machine Unlearning: Solutions and Challenges14 Aug
  5. 2023Model Sparsity Can Simplify Machine Unlearning11 Apr
  6. 2022Forget Unlearning: Towards True Data-Deletion in Machine Learning17 Oct
  7. 2022A Survey of Machine Unlearning6 Sep
  8. 2022Quark: Controllable Text Generation with Reinforced Unlearning26 May
  9. 2022Deletion Inference, Reconstruction, and Compliance in Machine (Un)Learning7 Feb
  10. 2022Towards Adversarial Evaluations for Inexact Machine Unlearning17 Jan
  11. 2022Zero-Shot Machine Unlearning14 Jan
  12. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearning17 Sep
  13. 2021Machine Unlearning of Features and Labels26 Aug
  14. 2021Adaptive Machine Unlearning8 Jun

Other references · 66

  1. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2019Machine Unlearningcited by 1,020
  6. 2019Deep Leakage from Gradientscited by 1,004
  7. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  8. 2023Unifying Large Language Models and Knowledge Graphs: A Roadmapcited by 663
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  10. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 488
  11. 2020Backdoor Learning: A Surveycited by 412
  12. 2018Adversarial Attacks and Defences: A Surveycited by 259
38 more
  1. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Nowcited by 204
  2. 2020When Machine Unlearning Jeopardizes Privacycited by 181
  3. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbotscited by 172
  4. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  5. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  6. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  7. 2022The Right to be Forgotten in Federated Learning: An Efficient Realization with Rapid Retrainingcited by 109
  8. 2021Federated Unlearning via Class-Discriminative Pruningcited by 108
  9. 2022Federated Unlearning: How to Efficiently Erase a Client in FL?cited by 90
  10. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 88
  11. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  12. 2022Federated Unlearning with Knowledge Distillationcited by 70
  13. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  14. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  15. 2022Backdoor Defense with Machine Unlearningcited by 61
  16. 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directionscited by 58
  17. 2020Learn to Forget: Machine Unlearning via Neuron Maskingcited by 56
  18. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 53
  19. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  20. 2020Towards Probabilistic Verification of Machine Unlearningcited by 46
  21. 2023GNNDelete: A General Strategy for Unlearning in Graph Neural Networkscited by 43
  22. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  23. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  24. 2017Model Extraction Warning in MLaaS Paradigmcited by 39
  25. 2021Your fairness may vary: Pretrained language model fairness in toxic text classificationcited by 38
  26. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 37
  27. 2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
  28. 2019PPGAN: Privacy-preserving Generative Adversarial Networkcited by 34
  29. 2023Dipping PLMs Sauce: Bridging Structure and Text for Effective Knowledge Graph Completion via Conditional Soft Promptingcited by 33
  30. 2022Knowledge Is Flat: A Seq2Seq Generative Framework for Various Knowledge Graph Completioncited by 32
  31. 2022Privacy-Preserving Aggregation in Federated Learning: A Surveycited by 25
  32. 2024Federated Unlearning: A Survey on Methods, Design Guidelines, and Evaluation Metricscited by 25
  33. 2024Digger: Detecting Copyright Content Mis-usage in Large Language Model Trainingcited by 24
  34. 2022StyleFool: Fooling Video Classification Systems via Style Transfercited by 18
  35. 2022Efficient Dropout-resilient Aggregation for Privacy-preserving Machine Learningcited by 18
  36. 2020MLModelCI: An Automatic Cloud Platform for Efficient MLaaScited by 16
  37. 2023Making Users Indistinguishable: Attribute-wise Unlearning in Recommender Systemscited by 15
  38. 2023Backdooring Textual Inversion for Concept Censorshipcited by 14

50 most cited of 66 All 66 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 11; 2025: 18; 2026: 5.

34 papers.

Sort:

By area:

  1. 2024RWKU: Benchmarking Real-World Knowledge Unlearning for Large Language Modelscited by 77
  2. 2024Knowledge Mechanisms in Large Language Models: A Survey and Perspectivecited by 50
  3. 2024Machine Unlearning in Generative AI: A Surveycited by 49
  4. 2025Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilitiescited by 36
  5. 2024Machine Unlearning: A Comprehensive Surveycited by 33
  6. 2024Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillationcited by 21
  7. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
  8. 2025NoT: Federated Unlearning via Weight Negationcited by 15
  9. 2025Precise In-Parameter Concept Erasure in Large Language Modelscited by 11
  10. 2025CRISP: Persistent Concept Unlearning via Sparse Autoencoderscited by 9
  11. 2025LLM Security: Vulnerabilities, Attacks, Defenses, and Countermeasurescited by 8
  12. 2025Towards Reliable Forgetting: A Survey on Machine Unlearning Verificationcited by 8
22 more
  1. 2024A Survey on Recommendation Unlearning: Fundamentals, Taxonomy, Evaluation, and Open Questionscited by 7
  2. 2025Go Beyond Your Means: Unlearning with Per-Sample Gradient Orthogonalizationcited by 7
  3. 2024Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retrainingcited by 5
  4. 2025A Survey on Unlearnable Datacited by 5
  5. 2025Leveraging Per-Instance Privacy for Machine Unlearningcited by 4
  6. 2025Forgetting to Forget: Attention Sink as A Gateway for Backdooring LLM Unlearningcited by 4
  7. 2024Exploring Fairness in Educational Data Mining in the Context of the Right to be Forgottencited by 3
  8. 2024FedUHB: Accelerating Federated Unlearning via Polyak Heavy Ball Methodcited by 3
  9. 2025Exploring Incremental Unlearning: Techniques, Challenges, and Future Directionscited by 2
  10. 2024Survey of Security and Data Attacks on Machine Unlearning In Financial and E-Commercecited by 1
  11. 2025Federated Unlearning Made Practical: Seamless Integration via Negated Pseudo-Gradientscited by 1
  12. 2025Efficient Machine Unlearning by Model Splitting and Core Sample Selectioncited by 1
  13. 2025Apollo: A Posteriori Label-Only Membership Inference Attack Towards Machine Unlearningcited by 1
  14. 2025ZIUM: Zero-Shot Intent-Aware Adversarial Attack on Unlearned Modelscited by 1
  15. 2025A Validation Strategy for Deep Learning Models: Evaluating and Enhancing Robustnesscited by 1
  16. 2025FROC: A Unified Framework with Risk-Optimized Control for Machine Unlearning in LLMscited by 1
  17. 2025Learning to Fast Unrank in Collaborative Filtering Recommendationcited by 0
  18. 2026Shadow Unlearning: A Neuro-Semantic Approach to Fidelity-Preserving Faceless Forgetting in LLMscited by 0
  19. 2026Attribution Techniques for Mitigating Hallucinated Information in RAG Systems: A Surveycited by 0
  20. 2026Form and Function: Machine Unlearning as a Problem of Misaligned Statescited by 0
  21. 2026AI Security Research Should Better Incentivize Defense Researchcited by 0
  22. 2026Physics-Aware Machine Unlearning for Cyber-Physical Systemscited by 0