mlsanityData to 14 Oct 2026

Towards Reliable Forgetting: A Survey on Machine Unlearning Verification

arXiv 2506.15115 ↗First posted 18 Jun 2025cs.LGcited by 8

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

With growing demands for privacy protection, security, and legal compliance (e.g., GDPR), machine unlearning has emerged as a critical technique for ensuring the controllability and regulatory alignment of machine learning models. However, a fundamental challenge in this field lies in effectively verifying whether unlearning operations have been successfully and thoroughly executed. Despite a growing body of work on unlearning techniques, verification methodologies remain comparatively underexplored and often fragmented. Existing approaches lack a unified taxonomy and a systematic framework for evaluation. To bridge this gap, this paper presents the first structured survey of machine unlearning verification methods. We propose a taxonomy that organizes current techniques into two principal categories -- behavioral verification and parametric verification -- based on the type of evidence used to assess unlearning fidelity. We examine representative methods within each category, analyze their underlying assumptions, strengths, and limitations, and identify potential vulnerabilities in practical deployment. In closing, we articulate a set of open problems in current verification research, aiming to provide a foundation for developing more robust, efficient, and theoretically grounded unlearning verification mechanisms.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 88 of its 138 references that are in the map. First posted on arXiv 18 Jun 2025.

Builds on

88 of 138 references.

Closest ancestors · 38

Same direction, newest first

  1. 2025Towards Lifecycle Unlearning Commitment Management: Measuring Sample-level Unlearning Completeness6 Jun
  2. 2025TAPE: Tailored Posterior Difference for Auditing of Machine Unlearning27 Feb
  3. 2025Data Duplication: A Novel Multi-Purpose Attack Paradigm in Machine Unlearning28 Jan
  4. 2024Verifying Machine Unlearning with Explainable AI20 Nov
  5. 2024Provable unlearning in topic modeling and downstream tasks19 Nov
  6. 2024A Review on Machine Unlearning18 Nov
  7. 2024Evaluating of Machine Unlearning: Robustness Verification Without Prior Modifications14 Oct
  8. 2024Rewind-to-Delete: Certified Machine Unlearning for Nonconvex Functions15 Sep
  9. 2024TruVRF: Towards Triple-Granularity Verification on Machine Unlearning12 Aug
  10. 2024Verification of Machine Unlearning is Fragile1 Aug
  11. 2024Machine Unlearning in Generative AI: A Survey30 Jul
  12. 2024Revisiting Machine Unlearning with Dimensional Alignment25 Jul
26 more
  1. 2024Really Unlearned? Verifying Machine Unlearning via Influential Sample Pairs16 Jun
  2. 2024A Survey on Machine Unlearning: Techniques and New Emerged Privacy Risks10 Jun
  3. 2024Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable30 May
  4. 2024An Information Theoretic Evaluation Metric For Strong Unlearning28 May
  5. 2024Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearning4 Apr
  6. 2024Machine Unlearning for Traditional Models and Large Language Models: A Short Survey1 Apr
  7. 2024Threats, Attacks, and Defenses in Machine Unlearning: A Survey20 Mar
  8. 2024Towards Lifecycle Unlearning Commitment Management: Measuring Sample-level Approximate Unlearning Completeness19 Mar
  9. 2024Machine Unlearning: Taxonomy, Metrics, Applications, Challenges, and Prospects13 Mar
  10. 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy2 Mar
  11. 2024Langevin Unlearning: A New Perspective of Noisy Gradient Descent for Machine Unlearning18 Jan
  12. 2023Certified Minimax Unlearning with Generalization Rates and Deletion Capacity16 Dec
  13. 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation19 Oct
  14. 2023SAFE: Machine Unlearning With Shard Graphs25 Apr
  15. 2023Boundary Unlearning21 Mar
  16. 2022Privacy Adhering Machine Un-learning in NLP19 Dec
  17. 2022Proof of Unlearning: Definitions and Instantiation20 Oct
  18. 2022Verifiable and Provably Secure Machine Unlearning17 Oct
  19. 2022A Survey of Machine Unlearning6 Sep
  20. 2022Evaluating Machine Unlearning via Epistemic Uncertainty23 Aug
  21. 2022Can Bad Teaching Induce Forgetting? Unlearning in Deep Networks using an Incompetent Teacher17 May
  22. 2022Deep Unlearning via Randomized Conditionally Independent Hessians15 Apr
  23. 2022Markov Chain Monte Carlo-Based Machine Unlearning: Unlearning What Needs to be Forgotten28 Feb
  24. 2022Towards Adversarial Evaluations for Inexact Machine Unlearning17 Jan
  25. 2021On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning22 Oct
  26. 2021Remember What You Want to Forget: Algorithms for Machine Unlearning4 Mar

Other references · 50

  1. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  2. 2020Knowledge Distillation: A Surveycited by 1,603
  3. 2019Machine Unlearningcited by 1,061
  4. 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 618
  5. 2019Certified Data Removal from Machine Learning Modelscited by 535
  6. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
  7. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  8. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 465
  9. 2020Amnesiac Machine Learningcited by 319
  10. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
  11. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 275
  12. 2020Approximate Data Deletion from Machine Learning Modelscited by 255
38 more
  1. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Nowcited by 210
  2. 2020When Machine Unlearning Jeopardizes Privacycited by 198
  3. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 197
  4. 2020Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observationscited by 180
  5. 2021Towards Understanding Knowledge Distillationcited by 158
  6. 2020DeltaGrad: Rapid retraining of machine learning modelscited by 149
  7. 2022The Right to be Forgotten in Federated Learning: An Efficient Realization with Rapid Retrainingcited by 118
  8. 2020Variational Bayesian Unlearningcited by 117
  9. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 103
  10. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 95
  11. 2021Proof-of-Learning: Definitions and Practicecited by 84
  12. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 79
  13. 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directionscited by 63
  14. 2020Coded Machine Unlearningcited by 36
  15. 2023Downstream-agnostic Adversarial Examplescited by 32
  16. 2024DarkSAM: Fooling Segment Anything Model to Segment Nothingcited by 32
  17. 2021SSSE: Efficiently Erasing Samples from Trained Machine Learning Modelscited by 28
  18. 2022BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Labelcited by 28
  19. 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 28
  20. 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 27
  21. 2018DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networkscited by 26
  22. 2023Deconstructing Data Reconstruction: Multiclass, Weight Decay and General Lossescited by 26
  23. 2024IDEA: A Flexible Framework of Certified Unlearning for Graph Neural Networkscited by 22
  24. 2020Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Modelscited by 21
  25. 2023Training Data Protection with Compositional Diffusion Modelscited by 17
  26. 2024NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectorscited by 17
  27. 2024Scalable and Certifiable Graph Unlearning: Overcoming the Approximation Error Barriercited by 14
  28. 2024PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentationcited by 14
  29. 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
  30. 2024Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Triggercited by 12
  31. 2020Class Clown: Data Redaction in Machine Unlearning at Enterprise Scalecited by 10
  32. 2025Towards Model Resistant to Transferable Adversarial Examples via Trigger Activationcited by 10
  33. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  34. 2024Box-Free Model Watermarks Are Prone to Black-Box Removal Attackscited by 6
  35. 2024Vertical Federated Unlearning via Backdoor Certificationcited by 6
  36. 2023Forgettable Federated Linear Learning with Certified Data Unlearningcited by 5
  37. 2025Forgetting Any Data at Any Time: A Theoretically Certified Unlearning Framework for Vertical Federated Learningcited by 3
  38. 2024Towards Federated Domain Unlearning: Verification Methodologies and Challengescited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 7.

8 papers.

Similar, not cited

Close in wording, no citation either way

  1. 2023Learn to Unlearn: A Survey on Machine Unlearning
  2. 2026Auditing Machine Unlearning: A Systematic Research on Whether Models Truly Forget
  3. 2023Machine Unlearning: Solutions and Challenges
  4. 2025Unlearning Imperative: Securing Trustworthy and Responsible LLMs through Engineered Forgetting
  5. 2025Are We Truly Forgetting? A Critical Re-examination of Machine Unlearning Evaluation Protocols
  6. 2025Efficient Machine Unlearning by Model Splitting and Core Sample Selection
  7. 2024Machine Unlearning: A Comprehensive Survey
  8. 2026Shadow Unlearning: A Neuro-Semantic Approach to Fidelity-Preserving Faceless Forgetting in LLMs