Towards Reliable Forgetting: A Survey on Machine Unlearning Verification
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
With growing demands for privacy protection, security, and legal compliance (e.g., GDPR), machine unlearning has emerged as a critical technique for ensuring the controllability and regulatory alignment of machine learning models. However, a fundamental challenge in this field lies in effectively verifying whether unlearning operations have been successfully and thoroughly executed. Despite a growing body of work on unlearning techniques, verification methodologies remain comparatively underexplored and often fragmented. Existing approaches lack a unified taxonomy and a systematic framework for evaluation. To bridge this gap, this paper presents the first structured survey of machine unlearning verification methods. We propose a taxonomy that organizes current techniques into two principal categories -- behavioral verification and parametric verification -- based on the type of evidence used to assess unlearning fidelity. We examine representative methods within each category, analyze their underlying assumptions, strengths, and limitations, and identify potential vulnerabilities in practical deployment. In closing, we articulate a set of open problems in current verification research, aiming to provide a foundation for developing more robust, efficient, and theoretically grounded unlearning verification mechanisms.
Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 88 of its 138 references that are in the map. First posted on arXiv 18 Jun 2025.
Builds on
88 of 138 references.
Closest ancestors · 38
Same direction, newest first
- 2025Towards Lifecycle Unlearning Commitment Management: Measuring Sample-level Unlearning Completeness6 Jun
- 2025TAPE: Tailored Posterior Difference for Auditing of Machine Unlearning27 Feb
- 2025Data Duplication: A Novel Multi-Purpose Attack Paradigm in Machine Unlearning28 Jan
- 2024Verifying Machine Unlearning with Explainable AI20 Nov
- 2024Provable unlearning in topic modeling and downstream tasks19 Nov
- 2024A Review on Machine Unlearning18 Nov
- 2024Evaluating of Machine Unlearning: Robustness Verification Without Prior Modifications14 Oct
- 2024Rewind-to-Delete: Certified Machine Unlearning for Nonconvex Functions15 Sep
- 2024TruVRF: Towards Triple-Granularity Verification on Machine Unlearning12 Aug
- 2024Verification of Machine Unlearning is Fragile1 Aug
- 2024Machine Unlearning in Generative AI: A Survey30 Jul
- 2024Revisiting Machine Unlearning with Dimensional Alignment25 Jul
26 more
- 2024Really Unlearned? Verifying Machine Unlearning via Influential Sample Pairs16 Jun
- 2024A Survey on Machine Unlearning: Techniques and New Emerged Privacy Risks10 Jun
- 2024Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable30 May
- 2024An Information Theoretic Evaluation Metric For Strong Unlearning28 May
- 2024Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearning4 Apr
- 2024Machine Unlearning for Traditional Models and Large Language Models: A Short Survey1 Apr
- 2024Threats, Attacks, and Defenses in Machine Unlearning: A Survey20 Mar
- 2024Towards Lifecycle Unlearning Commitment Management: Measuring Sample-level Approximate Unlearning Completeness19 Mar
- 2024Machine Unlearning: Taxonomy, Metrics, Applications, Challenges, and Prospects13 Mar
- 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy2 Mar
- 2024Langevin Unlearning: A New Perspective of Noisy Gradient Descent for Machine Unlearning18 Jan
- 2023Certified Minimax Unlearning with Generalization Rates and Deletion Capacity16 Dec
- 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation19 Oct
- 2023SAFE: Machine Unlearning With Shard Graphs25 Apr
- 2023Boundary Unlearning21 Mar
- 2022Privacy Adhering Machine Un-learning in NLP19 Dec
- 2022Proof of Unlearning: Definitions and Instantiation20 Oct
- 2022Verifiable and Provably Secure Machine Unlearning17 Oct
- 2022A Survey of Machine Unlearning6 Sep
- 2022Evaluating Machine Unlearning via Epistemic Uncertainty23 Aug
- 2022Can Bad Teaching Induce Forgetting? Unlearning in Deep Networks using an Incompetent Teacher17 May
- 2022Deep Unlearning via Randomized Conditionally Independent Hessians15 Apr
- 2022Markov Chain Monte Carlo-Based Machine Unlearning: Unlearning What Needs to be Forgotten28 Feb
- 2022Towards Adversarial Evaluations for Inexact Machine Unlearning17 Jan
- 2021On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning22 Oct
- 2021Remember What You Want to Forget: Algorithms for Machine Unlearning4 Mar
Other references · 50
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
- 2020Knowledge Distillation: A Surveycited by 1,603
- 2019Machine Unlearningcited by 1,061
- 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 618
- 2019Certified Data Removal from Machine Learning Modelscited by 535
- 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
- 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
- 2019Making AI Forget You: Data Deletion in Machine Learningcited by 465
- 2020Amnesiac Machine Learningcited by 319
- 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
- 2020Data Poisoning Attacks Against Federated Learning Systemscited by 275
- 2020Approximate Data Deletion from Machine Learning Modelscited by 255
38 more
- 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Nowcited by 210
- 2020When Machine Unlearning Jeopardizes Privacycited by 198
- 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 197
- 2020Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observationscited by 180
- 2021Towards Understanding Knowledge Distillationcited by 158
- 2020DeltaGrad: Rapid retraining of machine learning modelscited by 149
- 2022The Right to be Forgotten in Federated Learning: An Efficient Realization with Rapid Retrainingcited by 118
- 2020Variational Bayesian Unlearningcited by 117
- 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 103
- 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 95
- 2021Proof-of-Learning: Definitions and Practicecited by 84
- 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 79
- 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directionscited by 63
- 2020Coded Machine Unlearningcited by 36
- 2023Downstream-agnostic Adversarial Examplescited by 32
- 2024DarkSAM: Fooling Segment Anything Model to Segment Nothingcited by 32
- 2021SSSE: Efficiently Erasing Samples from Trained Machine Learning Modelscited by 28
- 2022BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Labelcited by 28
- 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 28
- 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 27
- 2018DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networkscited by 26
- 2023Deconstructing Data Reconstruction: Multiclass, Weight Decay and General Lossescited by 26
- 2024IDEA: A Flexible Framework of Certified Unlearning for Graph Neural Networkscited by 22
- 2020Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Modelscited by 21
- 2023Training Data Protection with Compositional Diffusion Modelscited by 17
- 2024NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectorscited by 17
- 2024Scalable and Certifiable Graph Unlearning: Overcoming the Approximation Error Barriercited by 14
- 2024PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentationcited by 14
- 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
- 2024Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Triggercited by 12
- 2020Class Clown: Data Redaction in Machine Unlearning at Enterprise Scalecited by 10
- 2025Towards Model Resistant to Transferable Adversarial Examples via Trigger Activationcited by 10
- 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
- 2024Box-Free Model Watermarks Are Prone to Black-Box Removal Attackscited by 6
- 2024Vertical Federated Unlearning via Backdoor Certificationcited by 6
- 2023Forgettable Federated Linear Learning with Certified Data Unlearningcited by 5
- 2025Forgetting Any Data at Any Time: A Theoretically Certified Unlearning Framework for Vertical Federated Learningcited by 3
- 2024Towards Federated Domain Unlearning: Verification Methodologies and Challengescited by 2
Built on by
Citing papers per year: 2025: 1; 2026: 7.
8 papers.
- 2025The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigationcited by 10
- 2026Transferable Physical-World Adversarial Patches Against Pedestrian Detection Modelscited by 2
- 2026Governing AI Forgetting: Auditing for Machine Unlearning Compliancecited by 1
- 2026Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Drivingcited by 1
- 2026GDGU: A Gradient Difference-based Graph Unlearning Method for Cyberattack Localization in Electric Vehicle Charging Networkscited by 1
- 2026VFACamou: View-Fused Adversarial Camouflage for Environment-Adaptive Physical Evasioncited by 0
- 2026The More Popular, The Harder to Forget: Adaptive Popularity for LLM Unlearningcited by 0
- 2026Dynamic Entanglement-Weighted Pruning for Quantum Federated Unlearning in Supply-Chain Risk Predictioncited by 0
- 2026Dynamic Entanglement-Weighted Pruning for Quantum Federated Unlearning in Supply-Chain Risk Prediction17 Aug 2026
- 2026The More Popular, The Harder to Forget: Adaptive Popularity for LLM Unlearning14 Aug 2026
- 2026VFACamou: View-Fused Adversarial Camouflage for Environment-Adaptive Physical Evasion18 Jun 2026
- 2026GDGU: A Gradient Difference-based Graph Unlearning Method for Cyberattack Localization in Electric Vehicle Charging Networks17 Jun 2026
- 2026Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Driving25 Apr 2026
- 2026Transferable Physical-World Adversarial Patches Against Pedestrian Detection Models24 Apr 2026
- 2026Governing AI Forgetting: Auditing for Machine Unlearning Compliance16 Feb 2026
- 2025The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigation8 Jul 2025
Similar, not cited
Close in wording, no citation either way
- 2023Learn to Unlearn: A Survey on Machine Unlearning
- 2026Auditing Machine Unlearning: A Systematic Research on Whether Models Truly Forget
- 2023Machine Unlearning: Solutions and Challenges
- 2025Unlearning Imperative: Securing Trustworthy and Responsible LLMs through Engineered Forgetting
- 2025Are We Truly Forgetting? A Critical Re-examination of Machine Unlearning Evaluation Protocols
- 2025Efficient Machine Unlearning by Model Splitting and Core Sample Selection
- 2024Machine Unlearning: A Comprehensive Survey
- 2026Shadow Unlearning: A Neuro-Semantic Approach to Fidelity-Preserving Faceless Forgetting in LLMs