# Adversarial Machine Unlearning arXiv: https://arxiv.org/abs/2406.07687 ยท HTML: https://mlsanity.com/paper/2406.07687/ ## Key facts - Cited by 16 papers in the map (data through 14 Oct 2026). - Placed in Machine unlearning, one of 12 directions in LLM safety and security. - Builds on 33 of its 43 references that are in the map. - First posted on arXiv 11 Jun 2024. ## Placed in - LLM safety and security / [Machine unlearning](https://mlsanity.com/safety/machine-unlearning/) ## Builds on (most cited first, 30 of 33) - [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015) - [Convex optimization](https://mlsanity.com/paper/2106.01946/) (2021) - [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016) - [Understanding Black-box Predictions via Influence Functions](https://mlsanity.com/paper/1703.04730/) (2017) - [Machine Unlearning](https://mlsanity.com/paper/1912.03817/) (2019) - [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021) - [CVXPY: A Python-Embedded Modeling Language for Convex Optimization](https://mlsanity.com/paper/1603.00943/) (2016) - [Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks](https://mlsanity.com/paper/1911.04933/) (2019) - [OptNet: Differentiable Optimization as a Layer in Neural Networks](https://mlsanity.com/paper/1703.00443/) (2017) - [Certified Data Removal from Machine Learning Models](https://mlsanity.com/paper/1911.03030/) (2019) - [Differentiable Convex Optimization Layers](https://mlsanity.com/paper/1910.12430/) (2019) - [Amnesiac Machine Learning](https://mlsanity.com/paper/2010.10981/) (2020) - [A Survey of Machine Unlearning](https://mlsanity.com/paper/2209.02299/) (2022) - [Systematic Evaluation of Privacy Risks of Machine Learning Models](https://mlsanity.com/paper/2003.10595/) (2020) - [Unrolling SGD: Understanding Factors Influencing Machine Unlearning](https://mlsanity.com/paper/2109.13398/) (2021) - [Towards Unbounded Machine Unlearning](https://mlsanity.com/paper/2302.09880/) (2023) - [Approximate Data Deletion from Machine Learning Models](https://mlsanity.com/paper/2002.10077/) (2020) - [Enhanced Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/2111.09679/) (2021) - [Machine Unlearning of Features and Labels](https://mlsanity.com/paper/2108.11577/) (2021) - [When Machine Unlearning Jeopardizes Privacy](https://mlsanity.com/paper/2005.02205/) (2020) - [Can Bad Teaching Induce Forgetting? Unlearning in Deep Networks using an Incompetent Teacher](https://mlsanity.com/paper/2205.08096/) (2022) - [Machine Learning with Membership Privacy using Adversarial Regularization](https://mlsanity.com/paper/1807.05852/) (2018) - [On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning](https://mlsanity.com/paper/2110.11891/) (2021) - [Graph Unlearning](https://mlsanity.com/paper/2103.14991/) (2021) - [Boundary Unlearning](https://mlsanity.com/paper/2303.11570/) (2023) - [Measuring Forgetting of Memorized Training Examples](https://mlsanity.com/paper/2207.00099/) (2022) - [On Differentiating Parameterized Argmin and Argmax Problems with Application to Bi-level Optimization](https://mlsanity.com/paper/1607.05447/) (2016) - [Machine Unlearning: Linear Filtration for Logit-based Classifiers](https://mlsanity.com/paper/2002.02730/) (2020) - [ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learning](https://mlsanity.com/paper/2007.09339/) (2020) - [Scalable Membership Inference Attacks via Quantile Regression](https://mlsanity.com/paper/2307.03694/) (2023) ## Built on by (most cited first, 16 of 16) - [Learning to Unlearn for Robust Machine Unlearning](https://mlsanity.com/paper/2407.10494/) (2024) - [GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detection](https://mlsanity.com/paper/2505.13312/) (2025) - [Machine Unlearning under Retain-Forget Entanglement](https://mlsanity.com/paper/2603.26569/) (2026) - [Erase or Hide? Suppressing Spurious Unlearning Neurons for Robust Unlearning](https://mlsanity.com/paper/2509.22263/) (2025) - [Label Smoothing Improves Gradient Ascent in LLM Unlearning](https://mlsanity.com/paper/2510.22376/) (2025) - [Models Designed to Forget: Machine Unlearning via Key Deletion](https://mlsanity.com/paper/2603.15033/) (2026) - [AMUN: Adversarial Machine UNlearning](https://mlsanity.com/paper/2503.00917/) (2025) - [AUVIC: Adversarial Unlearning of Visual Concepts for Multi-modal Large Language Models](https://mlsanity.com/paper/2511.11299/) (2025) - [Certified Unlearning in Decentralized Federated Learning](https://mlsanity.com/paper/2601.06436/) (2026) - [Representation Unlearning: Forgetting through Information Compression](https://mlsanity.com/paper/2601.21564/) (2026) - [Game-Theoretic Machine Unlearning: Mitigating Extra Privacy Leakage](https://mlsanity.com/paper/2411.03914/) (2024) - [How to Protect Models against Adversarial Unlearning?](https://mlsanity.com/paper/2507.10886/) (2025) - [Privacy Risks in Time Series Forecasting: User- and Record-Level Membership Inference](https://mlsanity.com/paper/2509.04169/) (2025) - [Controllable Machine Unlearning via Gradient Pivoting](https://mlsanity.com/paper/2510.19226/) (2025) - [Replay What Matters: Off-Policy Replay for Efficient LLM Reinforcement Unlearning](https://mlsanity.com/paper/2606.15333/) (2026) - [CUNO: Curriculum and Preference Optimization for Stable Graph Unlearning under Mass Deletion](https://mlsanity.com/paper/2609.08244/) (2026) ## Abstract (arXiv) This paper focuses on the challenge of machine unlearning, aiming to remove the influence of specific training data on machine learning models. Traditionally, the development of unlearning algorithms runs parallel with that of membership inference attacks (MIA), a type of privacy threat to determine whether a data instance was used for training. However, the two strands are intimately connected: one can view machine unlearning through the lens of MIA success with respect to removed data. Recognizing this connection, we propose a game-theoretic framework that integrates MIAs into the design of unlearning algorithms. Specifically, we model the unlearning problem as a Stackelberg game in which an unlearner strives to unlearn specific training data from a model, while an auditor employs MIAs to detect the traces of the ostensibly removed data. Adopting this adversarial perspective allows the utilization of new attack advancements, facilitating the design of unlearning algorithms. Our framework stands out in two ways. First, it takes an adversarial approach and proactively incorporates the attacks into the design of unlearning algorithms. Secondly, it uses implicit differentiation to obtain the gradients that limit the attacker's success, thus benefiting the process of unlearning. We present empirical results to demonstrate the effectiveness of the proposed approach for machine unlearning.