mlsanityData to 7 Oct 2026

Machine Unlearning Fails to Remove Data Poisoning Attacks

arXiv 2406.17216 ↗First posted 25 Jun 2024cs.LG cs.AI cs.CRcited by 35

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

We revisit the efficacy of several practical methods for approximate machine unlearning developed for large-scale deep learning. In addition to complying with data deletion requests, one often-cited potential application for unlearning methods is to remove the effects of poisoned data. We experimentally demonstrate that, while existing unlearning methods have been demonstrated to be effective in a number of settings, they fail to remove the effects of data poisoning across a variety of types of poisoning attacks (indiscriminate, targeted, and a newly-introduced Gaussian poisoning attack) and models (image classifiers and LLMs); even when granted a relatively large compute budget. In order to precisely characterize unlearning efficacy, we introduce new evaluation metrics for unlearning based on data poisoning. Our results suggest that a broader perspective, including a wider variety of evaluations, are required to avoid a false sense of confidence in machine unlearning procedures for deep learning without provable guarantees. Moreover, while unlearning methods show some signs of being useful to efficiently remove poisoned data without having to retrain, our work suggests that these methods are not yet ``ready for prime time,'' and currently provide limited benefit over retraining.

Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 58 of its 74 references that are in the map. First posted on arXiv 25 Jun 2024.

Builds on

58 of 74 references.

Closest ancestors · 16

Same direction, newest first

  1. 2024Machine Unlearning via Null Space Calibration21 Apr
  2. 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy2 Mar
  3. 2024Corrective Machine Unlearning21 Feb
  4. 2024Parameter-tuning-free data entry error unlearning with adaptive selective synaptic dampening6 Feb
  5. 2024Langevin Unlearning: A New Perspective of Noisy Gradient Descent for Machine Unlearning18 Jan
  6. 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation19 Oct
  7. 2023In-Context Unlearning: Language Models as Few Shot Unlearners11 Oct
  8. 2023Tight Bounds for Machine Unlearning via Differential Privacy2 Sep
  9. 2023Fast Machine Unlearning Without Retraining Through Selective Synaptic Dampening15 Aug
  10. 2023KGA: A General Machine Unlearning Framework Based on Knowledge Gap Alignment11 May
  11. 2023Towards Unbounded Machine Unlearning20 Feb
  12. 2022Forget Unlearning: Towards True Data-Deletion in Machine Learning17 Oct
4 more
  1. 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Models4 Oct
  2. 2022Towards Adversarial Evaluations for Inexact Machine Unlearning17 Jan
  3. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearning17 Sep
  4. 2021Remember What You Want to Forget: Algorithms for Machine Unlearning4 Mar

Other references · 42

  1. 2016Deep Learning with Differential Privacycited by 2,682
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2019Machine Unlearningcited by 1,020
  6. 2021Membership Inference Attacks From First Principlescited by 839
  7. 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 599
  8. 2019Certified Data Removal from Machine Learning Modelscited by 512
  9. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  10. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 447
  11. 2020Amnesiac Machine Learningcited by 305
  12. 2020Descent-to-Delete: Gradient-Based Methods for Machine Unlearningcited by 303
30 more
  1. 2017Certified Defenses for Data Poisoning Attackscited by 288
  2. 2023Poisoning Language Models During Instruction Tuningcited by 254
  3. 2023LEACE: Perfect linear concept erasure in closed formcited by 254
  4. 2020Approximate Data Deletion from Machine Learning Modelscited by 250
  5. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  6. 2020When Machine Unlearning Jeopardizes Privacycited by 181
  7. 2020Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observationscited by 171
  8. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  9. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  10. 2020DeltaGrad: Rapid retraining of machine learning modelscited by 143
  11. 2022The Privacy Onion Effect: Memorization is Relativecited by 128
  12. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  13. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  14. 2022Linear Adversarial Concept Erasurecited by 98
  15. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  16. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  17. 2023GIF: A General Graph Unlearning Strategy via Influence Functioncited by 59
  18. 2020Learn to Forget: Machine Unlearning via Neuron Maskingcited by 56
  19. 2022Kernelized Concept Erasurecited by 47
  20. 2020Towards Probabilistic Verification of Machine Unlearningcited by 46
  21. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  22. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 37
  23. 2020Exploring the Vulnerability of Deep Neural Networks: A Study of Parameter Corruptioncited by 26
  24. 2021Rethinking Influence Functions of Neural Networks in the Over-parameterized Regimecited by 26
  25. 2022Indiscriminate Data Poisoning Attacks on Neural Networkscited by 24
  26. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  27. 2022On the Trade-Off between Actionable Explanations and the Right to be Forgottencited by 20
  28. 2023Gaussian Membership Inference Privacycited by 20
  29. 2024Potion: Towards Poison Unlearningcited by 14
  30. 2024Indiscriminate Data Poisoning Attacks on Pre-trained Feature Extractorscited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 10; 2025: 13; 2026: 12.

35 papers.

Sort:

By area:

  1. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 158
  2. 2024An Adversarial Perspective on Machine Unlearning for AI Safetycited by 113
  3. 2024The Utility and Complexity of in- and out-of-Distribution Machine Unlearningcited by 20
  4. 2024Attribute-to-Delete: Machine Unlearning via Datamodel Matchingcited by 18
  5. 2025Do LLMs Really Forget? Evaluating Unlearning with Knowledge Correlation and Confidence Awarenesscited by 13
  6. 2025Ascent Fails to Forgetcited by 12
  7. 2024Underestimated Privacy Risks for Minority Populations in Large Language Model Unlearningcited by 9
  8. 2025Train Once, Answer All: Many Pretraining Experiments for the Cost of Onecited by 6
  9. 2025Position: Bridge the Gaps between Machine Unlearning and AI Regulationcited by 5
  10. 2025Erasing Without Remembering: Implicit Knowledge Forgetting in Large Language Modelscited by 5
  11. 2025Certified Data Removal Under High-dimensional Settingscited by 5
  12. 2025Gaussian Certified Unlearning in High Dimensions: A Hypothesis Testing Approachcited by 5
23 more
  1. 2025Leveraging Per-Instance Privacy for Machine Unlearningcited by 4
  2. 2025Machine Unlearning under Overparameterizationcited by 4
  3. 2026The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samplescited by 4
  4. 2025System-Aware Unlearning Algorithms: Use Lesser, Forget Fastercited by 3
  5. 2026Is your algorithm unlearning or untraining?cited by 3
  6. 2026Position: The Term "Machine Unlearning" Is Overused in LLMscited by 3
  7. 2024Data Deletion for Linear Regression with Noisy SGDcited by 2
  8. 2024RESTOR: Knowledge Recovery in Machine Unlearningcited by 2
  9. 2024A Cognac Shot To Forget Bad Memories: Corrective Unlearning for Graph Neural Networkscited by 2
  10. 2026Mitigating Privacy Risk via Forget Set-Free Unlearningcited by 2
  11. 2024Instance-Level Difficulty: A Missing Perspective in Machine Unlearningcited by 1
  12. 2025Backdoor Unlearning by Linear Task Decompositioncited by 1
  13. 2024Trading Devil RL: Backdoor attack via Stock market, Bayesian Optimization and Reinforcement Learningcited by 0
  14. 2025Towards Mitigating Excessive Forgetting in LLM Unlearning via Entanglement-Guidance with Proxy Constraintcited by 0
  15. 2025The Measure of Deception: An Analysis of Data Forging in Machine Unlearningcited by 0
  16. 2026Easy Data Unlearning Benchcited by 0
  17. 2026ROKA: Robust Knowledge Unlearning against Adversariescited by 0
  18. 2026SoK: Unlearnability and Unlearning for Model Dememorizationcited by 0
  19. 2026On the Fragility of Data Attribution When Learning Is Distributedcited by 0
  20. 2026When Stronger Triggers Backfire: A High-Dimensional Theory of Backdoor Attackscited by 0
  21. 2026DG-CoLearn: An Efficient Collaborative Learning Framework for Dynamic Graphscited by 0
  22. 2026Validity Threats for Foundation Model Researchcited by 0
  23. 2026InstantForget: Update-Free Backdoor Unlearning with Inference-Time Feature Resetcited by 0