{"id":"b4dc7a7a-ddd8-4462-984e-1e880101ce25","arxiv_id":"2504.14798","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A new adversarial probe, UMA, shows that current machine unlearning methods leave recoverable traces of supposedly forgotten data, even when standard verification metrics pass.","lead":"This paper argues that machine unlearning methods should be judged not only on whether they delete the requested data, but on whether an attacker can recover it by sending carefully altered inputs. The authors introduce a new attack, UMA, and show that popular unlearning algorithms fail this stronger test even when they pass standard checks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"UMA's objective (Eq. 3) is not shown to separate residual knowledge from ordinary generalization: the retrained baseline in Table 2 exhibits the same high UA under attack, so the central claim is unestablished for instance-wise and generative settings.","rationale":"The reader's weakest_assumption identifies exactly the load-bearing point: UMA's objective is a proxy for residual knowledge, and the instance-wise results in Table 2 show that the proxy cannot separate the unlearned model from a retrained oracle. This is not a minor calibration issue; it determines whether the paper's central empirical assertion is true. In the class-wise setting the retrained control works cleanly (UA=0 even after attack), so the paper does demonstrate that some unlearning methods are less robust than retraining in that narrow regime. However, the abstract and conclusion generalize to instance-wise and generative tasks, where the missing control makes the claim of residual knowledge unverifiable. The paper itself notes (Section 3.2) that even retrained models may regenerate forgotten-looking content due to generalization, so the authors are aware of the confound; they just do not apply the necessary control when interpreting Table 2 and Section A.3. The concrete test above would settle the matter directly: if the UA lift over retraining is negligible, the paper's central claim must be narrowed to class-wise unlearning, or the attack objective must be redefined to target the retrained model's output. Since the class-wise results still support a useful, narrower contribution, a conditional decision is appropriate rather than rejection.","tokens_in":15034,"tokens_out":5237,"duration_ms":46060,"concrete_test":"Reanalyze the existing Table 2 data by reporting, for each unlearning baseline, the delta between that baseline's UA after UMA and the retrained model's UA after UMA (with the same perturbation bound), and the analogous delta for MIA. If these deltas are near zero for all baselines, UMA does not separate residual knowledge from ordinary generalization, and the instance-wise claims should be withdrawn or reformulated. This is a pure re-analysis of numbers already in the paper, so it can be done immediately without new compute.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that existing unlearning techniques remain vulnerable because UMA recovers residual knowledge rests on the validity of Eq. (3): minimizing ||fu(δ;θu) - f(x;θ)|| is assumed to indicate that the unlearned model still contains traces of the forgotten sample x. This assumption is not controlled in the instance-wise discriminative experiments. Table 2 shows that the retrained baseline, which never saw the forget instances, already yields UA = 93.78 on CIFAR-10 without any attack and UA = 99.98 after a bounded UMA attack. The attacked unlearned models reach essentially the same numbers (e.g., FT 99.98, IU 99.98, l1-sparse 99.98 at 8/255). Because the retrained model is itself 'vulnerable' to UMA, the attack is detecting behavior that any model with ordinary class-level generalization would exhibit, not memorized residue. The paper acknowledges in Section 3.2 that retraining does not satisfy Robust Unlearning, but then uses the attack to indict unlearning methods without subtracting or matching the retrained baseline. The generative experiments (Section A.3) have the same confound: L1 is computed between the UMA output I3 and the original model's output I1, with no retrained control; a normally trained generator would also reconstruct masked regions from image priors. Thus, the paper's headline finding of residual vulnerability is unsupported in the instance-wise and generative settings, and only the class-wise results (Table 1), where the retrained model has near-zero UA under attack, provide a clean separation.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes 'Robust Unlearning,' a principle requiring unlearned models to be indistinguishable from retrained counterparts and resistant to adversarial attempts to resurface forgotten information. It introduces the Unlearning Mapping Attack (UMA), which optimizes input perturbations so that an unlearned model's output matches the original model's output on forget-set samples. The authors evaluate UMA on class-wise and instance-wise image classification (CIFAR-10, CIFAR-100, Tiny-ImageNet) and on image-to-image generative unlearning (MAE-based), reporting that existing unlearning methods remain vulnerable under UMA even when they pass standard verification metrics. They also present preliminary defenses based on adversarial unlearning and input purification. The class-wise experiments include a retrained baseline that is robust to UMA, while the instance-wise experiments show that both unlearned and retrained models are highly vulnerable to UMA.","tokens_in":15370,"tokens_out":5323,"duration_ms":47104,"significance":"If the central claim is established, the paper provides a valuable benchmark and a concrete attack for auditing machine unlearning, and its class-wise results with a retrained control are a meaningful empirical contribution. The authors are explicit about releasing code and checkpoints, and the formal definition of Robust Unlearning is a useful conceptual step. However, the broad conclusion that 'existing unlearning techniques remain vulnerable' is currently supported only in the class-wise setting; the instance-wise and generative results are confounded by the fact that retrained models exhibit the same UMA vulnerability. The significance of the work therefore depends on whether the authors can, in revision, separate residual-knowledge effects from ordinary generalization effects.","major_comments":[{"comment":"The instance-wise results do not support the claim that UMA recovers residual forgotten knowledge. The retrained baseline, which never saw the forget-instance training data, already has UA=93.78 on CIFAR-10 without any attack and UA=99.98 under an 8/255 attack; the attacked unlearned models reach essentially identical values (e.g., FT 99.98, IU 99.98, l1-sparse 99.98). Consequently, UMA success on unlearned models is indistinguishable from UMA success on a model that genuinely forgot the data. To support the residual-knowledge interpretation, the paper must report the excess vulnerability relative to the retrained baseline (or otherwise isolate memorization from class-level generalization), for instance by testing whether the found perturbations are specifically aligned with the identity of the forget samples.","section":"Section 5.2, Table 2"},{"comment":"The generative experiments have the same confound as the instance-wise discriminative experiments. The small L1(I3,I1) values after attack (e.g., 48,317 for the I2I forget set, versus 1,140,778 without attack) are not compared against a retrained generator that never saw the forget images. A normally trained image-to-image model can plausibly reconstruct masked regions from image priors, so the small post-attack L1 distance may reflect ordinary reconstruction ability rather than the resurfacing of memory of the specific forget images. A retrained control is necessary before claiming that UMA bypasses unlearning in generative models.","section":"Section A.3, Table 7 and Figures 6-7"},{"comment":"The paper explicitly acknowledges that the retrained baseline does not satisfy the absolute Robust Unlearning criterion, yet the abstract and conclusion present UMA vulnerability as evidence that unlearning methods 'remain vulnerable.' In the instance-wise setting, since the gold-standard retrained model is equally vulnerable, the absolute criterion cannot separate unlearning-specific failures from baseline model behavior. The authors should either redefine Robust Unlearning relative to a retrained model (for example, requiring that the unlearned model be no more vulnerable than retraining) or restrict the residual-knowledge claim to the class-wise setting where the retrained control is robust.","section":"Section 3.2, Definition 4"},{"comment":"The UMA objective minimizes ||fu(δx;θu) - f(x;θ)|| for each forget sample x. Because this objective is minimized to nearly the same degree for a retrained model (as shown in Table 2), the objective itself does not isolate residual knowledge; it measures the ease with which any model can be made to reproduce original-model outputs under bounded perturbations. The paper should characterize what distinguishes residual-knowledge-driven success from generalization-driven success, for example by comparing UMA loss on forget versus retain samples after matching the retrained baseline, or by examining whether the found δx is semantically related to the forgotten instance.","section":"Section 4.1, Eq. (3)"}],"minor_comments":[{"comment":"There is a typo in the contributions list: 'the first empirical metho asses' should be 'the first empirical method to assess.'","section":"Section 1, Contributions"},{"comment":"The step size is denoted η in Algorithm 1 but α in Eq. (5); please unify the notation.","section":"Algorithm 1 and Eq. (5)"},{"comment":"The phrase 'test-time sample pontification' should be 'test-time sample purification.'","section":"Section 5.3"},{"comment":"The caption uses 'Unbound' for attack strength; please define explicitly that this means the perturbation is not clipped, and state the range used in the experiments.","section":"Table 3 caption"},{"comment":"The appendix reports L1 distances but does not provide the UMA hyperparameters used for generative tasks (number of steps, step size, loss function); please add these for reproducibility.","section":"Appendix A.3"},{"comment":"The statement that 'under ideal conditions (e.g., if the optimization objective is convex), UMA provides a theoretical guarantee of robustness' is vacuous without specifying ε1; please restate as a consistency property with the definition rather than a formal guarantee.","section":"Section 4.1"}],"recommendation":"major_revision","confidential_remarks":"The first reader's stress-test concern is well-founded and should be the central focus of the revision. The paper would be strengthened by presenting the instance-wise and generative results as evidence that robustness verification needs a relative standard against retraining, rather than as evidence that unlearning methods leave residual knowledge. Please also verify that the released code includes the retrained baselines for all settings, since those are essential for the proposed comparison."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know about arXiv:2504.14798. First, it has one genuinely clean empirical result: in class-wise discriminative unlearning, the retrained control stays robust under the UMA attack while fine-tuning, influence-based, and l1-sparse methods collapse to near-100% attack accuracy (Table 1). That suggests some unlearning methods do leave recoverable traces, and the benchmark makes that easy to see. Second, the paper overreaches: the instance-wise discriminative and generative experiments do not separate residual knowledge from ordinary generalization, because the retrained baseline is itself vulnerable under the same attack. The headline claim — existing unlearning techniques remain vulnerable even when passing existing verification metrics — is only half-supported.\n\nWhat is actually new: a formal Robust Unlearning definition, a unified benchmark framework, and UMA, a generic post-unlearning probe that optimizes a perturbation to map unlearned-model outputs back to original-model outputs. UMA itself is a straightforward PGD variant, and the definition is strong enough that even retraining fails it (the authors admit this). But the class-wise result gives the definition teeth: the retrained model does satisfy the robustness criterion there, while most unlearning methods do not. The adversarial-unlearning defense in Table 4 also shows a clear improvement. These are real contributions.\n\nThe soft spots are proportional to how much the paper claims. In Table 2, the retrained baseline already gives UA 93.78 without any attack and 99.98 with an 8/255 attack on CIFAR-10. The attacked unlearning methods land at the same numbers. So UMA is recovering something any model trained on the classes would do — not necessarily the forgotten instances. The paper even says retraining does not satisfy Robust Unlearning, but then uses UMA to indict unlearning methods without subtracting the baseline. The generative experiments (Appendix A.3) have the same gap: no retrained generator control, only L1 between attacked output and original output. And the abstract promises text-to-image synthesis, but the experiments only cover masked image reconstruction. No code or checkpoints are released, despite the abstract saying they will be.\n\nThe stress-test note is right. This is not a manufactured flaw; it is the core of whether the instance-wise claim holds. The class-wise results stand, and they are enough to justify a serious referee. But a revision needs to add retrained controls for instance-wise and generative settings, tone down the text-to-image claim, and ship the code.\n\nRecommendation: send it to peer review. The clean part is valuable, and the confounded part is fixable.","headline":"One clean class-wise unlearning result buried under an overclaimed instance-wise and generative narrative; deserves peer review but needs the confounded parts reworked.","tokens_in":15867,"tokens_out":2878,"would_cite":true,"duration_ms":26280,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Existing machine-unlearning methods can pass standard verification metrics while still allowing an adversary to construct inputs that resurface information the model was supposed to forget.","keywords":["machine unlearning","robust unlearning","residual knowledge","adversarial attack","verification benchmark","membership inference","image-to-image generation","partial forgetting"],"falsifier":"Train a reference model from scratch on the retain set only, with no exposure to forget-set samples, and run UMA with the paper's own bounds and hyperparameters. The paper's Table 2 already reports 99.98 percent unlearning accuracy under an 8/255 attack for a retrained CIFAR-10 baseline; if a model that never saw the forget samples produces the same attack success as unlearned models, then UMA success is not sufficient evidence of residual knowledge, and the benchmark would need a control group.","tokens_in":14805,"feed_emoji":"🔍","tokens_out":11995,"duration_ms":96979,"temperature":0.7,"pith_summary":"The paper seeks to establish that machine-unlearning verification is currently measuring only whether the unlearning procedure was executed, not whether the forgotten information is actually gone. It introduces Robust Unlearning as a formal standard, and a benchmark (RUB) built around the Unlearning Mapping Attack (UMA), an adversarial probe that optimizes small input perturbations so that an unlearned model reproduces the original model's outputs for forget-set samples. Across classification and image generation, the authors report that existing unlearning methods—several of them passing standard unlearning-accuracy and membership-inference checks—remain vulnerable to UMA, sometimes reverting to near-original behavior under image perturbations of 8/255. If the finding is right, current practice for certifying privacy and content removal in deep learning is weaker than assumed.","feed_headline":"Adversarial inputs resurrect 'forgotten' data in unlearned models","feed_subtitle":"New benchmark UMA shows standard verification metrics cannot certify that sensitive information is actually gone.","key_machinery":"The load-bearing object is the Unlearning Mapping Attack (UMA): an optimization problem that maps the original model's forgotten outputs back into inputs. For each forget-set sample x with original output f(x;θ), UMA minimizes a loss L(f_u(δ;θ_u), f(x;θ)) over perturbations δ starting from random noise, using projected gradient descent with sign-gradient updates and bounded perturbation strength for discriminative tasks (8/255 or 16/255) and unbounded for generation. The work this does is twofold: it turns the paper's Robust Unlearning criterion—output distance greater than a threshold ε1 for every forget input and every allowed δ—into a concrete, optimizable verification target, and it doubles as a training signal, since adding a maximization step over such perturbations to the unlearning loss makes the model empirically more robust. UMA is also the piece that makes the paper's negative result: because the attack does not touch the unlearning procedure or the model parameters, it is invisible to process-based verification.","core_discovery":"The paper's central claim is that verification metrics currently used to certify machine unlearning—unlearning accuracy and membership-inference score—do not measure whether forgotten information is actually gone. It introduces the Unlearning Mapping Attack (UMA), which, for each forget-set sample x, searches for a perturbation δx such that the unlearned model's output on δx matches the original model's output on x. On class-wise unlearning the attack succeeds mainly on methods that stray from the retrained baseline; on instance-wise unlearning it succeeds against every baseline tested, including retraining from scratch, at perturbation bounds of 8/255 and 16/255. In generative experiments, UMA restores masked-region reconstructions that the unlearned model had stopped producing, with per-pixel L1 distances to the original model's output dropping to under two intensity levels. The authors conclude that unlearned models retain residual knowledge that standard checks miss.","pith_inferences":["If a retrained model that never saw the forget samples also succeeds under UMA—which the paper's Table 2 already shows for instance-level CIFAR-10—then attack success alone does not prove memory; this is an inference because the paper still reads UMA success as residual knowledge.","The mapping objective is continuous and pixel-based, so adapting it to discrete tokens or prompts would be a natural extension for language models, where the same residual-knowledge question is open.","UMA's projected-gradient-descent solver is local, so the paper's unbounded generative attacks give no certified failure cases; pairing the benchmark with certified robustness bounds, such as Lipschitz guarantees on the unlearned model, would make the Robust Unlearning standard testable in both directions."],"forward_implications":["Unlearning accuracy and membership-inference scores should not be treated as certificates of forgetting; a model can score near-perfectly on both and still be defeated by bounded perturbed inputs.","Instance-level unlearning is a harder regime than class-level unlearning: UMA succeeds against every tested instance-wise unlearning method, including retraining, while class-wise retraining resists it.","In generative unlearning, the attack restores visual content that unlearning had suppressed; the paper's L1 measurements put the attacked outputs within roughly a third of an intensity level per pixel of the original model's reconstruction for the I2I method.","Two defenses show initial promise within the paper's framework: adversarial training that adds a UMA loss term, and test-time purification with a variational autoencoder, both reducing attack success at some cost in clean accuracy or compute.","Because UMA is computed from the pre- and post-unlearning models directly, it provides a unified robustness check across classification, image-to-image reconstruction, and text-to-image synthesis, rather than a method-specific test."],"supporting_citations":[{"why":"Gives the definition of machine unlearning as matching a retrained model, which the paper extends into Robust Unlearning.","marker":"(Cao & Yang, 2015)"},{"why":"Supplies the empirical divergence conditions in Eqs. (1)-(2) and the fine-tuning (FT) unlearning baseline.","marker":"(Warnecke et al., 2021)"},{"why":"Provides the selective-forgetting (RL) baseline and the backbone for the adversarial-unlearning experiment.","marker":"(Golatkar et al., 2020)"},{"why":"Provides the projected gradient descent optimizer used to solve the UMA optimization problem.","marker":"(Madry et al., 2017)"},{"why":"Supplies the SalUn unlearning baseline used in both classification and generation experiments.","marker":"(Fan et al., 2024)"},{"why":"Provides the influence-function-based approximate instance-unlearning (IU) baseline.","marker":"(Koh & Liang, 2017; Izzo et al., 2021)"},{"why":"Supplies the membership-inference attack used as a standard verification metric in the tables.","marker":"(Shokri et al., 2017)"},{"why":"Makes the point that unlearning is not sufficient for content regulation because retrained models can still generate the information, motivating the robustness standard.","marker":"(Shumailov et al., 2024)"},{"why":"Defines the image-to-image generative unlearning setting and the I2I baseline.","marker":"(Li et al., 2024)"},{"why":"Argues that verification of machine unlearning is fragile, motivating the need for attack-based probing.","marker":"(Zhang et al., 2024)"}],"fun_headline_variants":["UMA attack resurrects 'forgotten' data even after unlearning","Standard unlearning checks miss residual knowledge recoverable by UMA","Unlearned models stay vulnerable: adversarial perturbations expose data","Robust unlearning is a mirage: UMA recovers erased info","Unlearning verification fails to prove data removal under attack"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Minimizing the distance between the unlearned model's output on a perturbed input and the original model's output is treated as evidence that the model still remembers the forgotten sample, yet a model retrained without that sample can show the same small distance.","fun_headline_variants_meta":{"raw":{"variants":["UMA attack resurrects 'forgotten' data even after unlearning","Standard unlearning checks miss residual knowledge recoverable by UMA","Unlearned models stay vulnerable: adversarial perturbations expose data","Robust unlearning is a mirage: UMA recovers erased info","Unlearning verification fails to prove data removal under attack"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000838,"raw_usage":{"total_tokens":3664,"prompt_tokens":964,"completion_tokens":2700,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":580,"completion_tokens_details":{"reasoning_tokens":2611}},"tokens_in":580,"tokens_out":2700,"duration_ms":17892,"temperature":1.0,"reasoning_tokens":2611,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:40:39.609714+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a reference model from scratch on the retain set only, with no exposure to forget-set samples, and run UMA with the paper's own bounds and hyperparameters. The paper's Table 2 already reports 99.98 percent unlearning accuracy under an 8/255 attack for a retrained CIFAR-10 baseline; if a model that never saw the forget samples produces the same attack success as unlearned models, then UMA success is not sufficient evidence of residual knowledge, and the benchmark would need a control group.","supporting_citations":[{"cited_title":"Eternal sunshine of the spotless net: Selective forgetting in deep networks","cited_arxiv_id":null,"evidence_quote":"Provides the selective-forgetting (RL) baseline and the backbone for the adversarial-unlearning experiment."},{"cited_title":"Verification of machine unlearning is fragile","cited_arxiv_id":null,"evidence_quote":"Argues that verification of machine unlearning is fragile, motivating the need for attack-based probing."}],"review_version":1}