{"id":"60a4ce17-b36f-45cf-bbef-7ba4008c3932","arxiv_id":"2507.20573","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"Approximate unlearning leaves loss-landscape residuals that a fine-tuning-based attack can exploit for membership inference, and the proposed OUR method scrubs these residuals.","lead":"This paper shows that approximate machine unlearning leaves hidden traces in a model's loss landscape, and these traces let an attacker infer which data points or classes were forgotten. It also proposes a two-phase unlearning method that scrubs these traces, cutting attack success to near random levels.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Defense objective in Appendix Algorithm 3 contradicts Equation 7: MSE feature preservation instead of orthogonality, undermining OUR's claimed mechanism.","rationale":"The reader's weakest assumption concerned the adversary's practical capability to obtain candidate-class data and fine-tune the victim model. That is a reasonable limitation, but it does not stress the central scientific claim: the existence and exploitability of residual traces is established by the retrained-model control (ReA near 50% on Retrain) and by the strong correlation between representation misalignment and ReA accuracy (Pearson 0.88). A more load-bearing issue is the internal contradiction between the main-text definition of the orthogonal-unlearning loss and the appendix pseudo-code. These two formulations have opposite effects: one removes class-specific feature correlations, the other anchors features to their original pre-unlearning values. If the experiments used the appendix formulation, the paper's explanation of why OUR works is unsupported, and the defense's empirical success may be an artifact of the replay phase rather than of orthogonal scrubbing. This directly affects the validity of a major contribution (the OUR framework) and is easily testable by inspecting the released code. The issue is not fatal to the attack narrative, so the appropriate verdict remains conditional acceptance pending clarification and code verification, matching the reader's overall CONDITIONAL stance.","tokens_in":28611,"tokens_out":16464,"duration_ms":181233,"concrete_test":"Inspect the released repository (github.com/orthogonalunlearning-replay/OUR) and identify the exact loss implemented in Phase 1 (orthogonal unlearning). If the code computes Σ ||F_l(x;θ) − F_l(x;θ0)||^2, the algorithm tested is feature preservation, not orthogonality; re-run the CIFAR20 class-wise OUR experiment with the squared-dot-product loss of Equation 7 and check whether ReA accuracy remains near 50% and ToW is maintained. If the code instead uses the squared dot product, verify that the appendix's Algorithm 3 is corrected to match Equation 7 before trusting the defense's stated mechanism.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central defense claim is that OUR scrubs residual traces by enforcing orthogonality between hidden and original features of unlearned data. Main-text Equation 7 defines this loss as Lorth = Σ [F_l^T(x;θ) F_l(x;θ0)]^2, a squared dot product that penalizes correlation and pushes features toward orthogonality. However, Appendix Algorithm 3, Phase 1, line 2 defines the same loss as Lorth = Σ ||F_l(x;θ) − F_l(x;θ0)||^2_2, an MSE that drives current features toward their pre-unlearning values, which is the opposite of orthogonal scrubbing. If the implementation follows the appendix, the proposed mechanism was not actually tested: the reported privacy improvement (ReA near 50%) could be attributable to the replay phase alone or to ordinary fine-tuning on retained data, rather than to the orthogonal-unlearning principle. This is a load-bearing internal inconsistency because it determines whether OUR's experimental results support the mechanism claimed in the abstract and Section 4. A second, smaller inconsistency exists in Algorithm 1's convergence threshold (0.9 in line 14) versus the 75% stated in Section 5.1 and the 70–80% optimum in Appendix E.4, but the defense-objective contradiction is more serious since it strikes at the proposed mitigation's validity. The attack-side residual phenomenon itself appears well supported by the retrained-model control (ReA ≈ 50%) and the representation-misalignment correlation, so the central attack claim is not the point of failure.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper claims that approximate machine unlearning (AMU) methods leave persistent ``implicit residuals'' in the loss landscape that are invisible to output-level unlearning metrics, and that these residuals enable membership inference against unlearned classes and samples. To exploit this, the authors propose the Reminiscence Attack (ReA), which fine-tunes the unlearned model on inferred or pseudo-retained data and measures the speed of convergence (the ``resonance index'') as the membership signal. To mitigate the attack, they propose Orthogonal Unlearning & Replay (OUR), a two-phase method that first is supposed to enforce orthogonality between hidden features before and after unlearning on the forget set, and then replays the retained set with l1 regularization. The evaluation covers 11 unlearning baselines, three classification datasets, two architectures, and a Stable Diffusion concept-unlearning task, reporting that ReA outperforms MIA-LiRA and MIA-UP while OUR reduces adaptive attack accuracy to near random-chance levels.","tokens_in":28932,"tokens_out":3648,"duration_ms":43452,"significance":"If the attack-side claim holds, the paper makes a useful contribution: it demonstrates a version-independent attack surface that goes beyond output-distribution residuals, with the retrained-model control (ReA near 50%), the ROC analyses, and the representation-misalignment correlations in Figure 5 providing meaningful support. The breadth of the evaluation, the ablation studies, and the inclusion of diffusion-model experiments are also strengths, and the authors provide a code link. However, the defense-side evidence is currently not trustworthy because the pseudo-code for OUR contradicts the main-text loss formulation; the reported privacy improvement of OUR cannot be attributed to the claimed orthogonal-scrubbing mechanism until this inconsistency is resolved. The convergence-threshold inconsistency in ReA's pseudo-code similarly affects reproducibility of the attack numbers.","major_comments":[{"comment":"The main text defines the orthogonal-unlearning loss as Lorth = Σ [F_l^T(x;θ) F_l(x;θ0)]^2, which penalizes the squared dot product and therefore drives the current hidden features to be orthogonal to the pre-unlearning features. Appendix A, Algorithm 3, Phase 1, line 2 instead defines Lorth = Σ ||F_l(x;θ) − F_l(x;θ0)||^2_2, a squared Euclidean distance that drives the current features toward the original features, which is the opposite of orthogonal scrubbing. If the implementation follows the appendix, the paper's central defense mechanism was not actually tested, and the reported reduction in ReA accuracy could be caused by the replay phase, the l1 regularization, or ordinary feature-space perturbation rather than by the claimed orthogonality principle. This is a load-bearing internal inconsistency and must be corrected, with the affected experiments rerun or clearly reported under the objective that matches the paper's mechanism.","section":"§4.2, Eq. (7) vs. Appendix A, Algorithm 3"},{"comment":"Algorithm 1, line 14 uses a convergence threshold of 0.9 (90%) on the fine-tuning accuracy, while Section 5.1 states that the convergence threshold is set to 75%, and Appendix E.4 reports that thresholds between 70% and 80% are optimal. Since the resonance index Idxr and hence every class-wise ReA score in Tables 2 and 6 depend directly on this threshold, the reported attack accuracies cannot be reproduced without knowing which threshold was actually used. The paper should state the implemented value explicitly and report whether any of the main-table results change under the stated 75% setting.","section":"§5.1, Appendix A Algorithm 1, Appendix E.4"},{"comment":"The causal claim that representation residuals enable the privacy attack is based on Pearson correlations computed over the finite set of methods evaluated in Figure 5, with no confidence intervals or per-method variability shown. Given that the x-axis quantities and the ReA accuracies are derived from the same models, the correlation is suggestive but not by itself a proof of mechanism; the authors should strengthen this analysis or temper the wording from ``confirming'' to ``consistent with''.","section":"§5.3, Figure 5"}],"minor_comments":[{"comment":"There is a typo: ``yeild'' should be ``yield''.","section":"§2.3"},{"comment":"The heading ``Reminisence Attack'' misspells ``Reminiscence''; the same misspelling appears at the top of Section 3.","section":"§3 title"},{"comment":"The algorithm uses θ0 in the orthogonal loss but never assigns it; it stores θini at the start and then uses θini only for the Δmax check. The notation should be unified, either by setting θ0 ← θini or by using θini consistently in the loss.","section":"Appendix A, Algorithm 3"},{"comment":"The text says the class-wise ReA adversary has access to 3% of unlearned data on CIFAR20 and 20% on CIFAR100, but the threat model in §2.3 does not state what data the adversary is assumed to hold; this assumption should be declared in the threat model before the attack is presented.","section":"§5.1, Privacy Attack Parameters"},{"comment":"The ablation labels ``Orth w/o Replay,'' ``RL w/ Replay,'' and ``FT w/ Sparsity'' are informative, but the text does not say whether the ablated variants use the Algorithm 3 objective or the Eq. (7) objective; resolving the main inconsistency will make these comparisons interpretable.","section":"§5.4, Figure 6"}],"recommendation":"major_revision","confidential_remarks":"The Algorithm 3 contradiction is the deciding issue for me. The attack-side experiments are extensive and internally controlled, but the paper's contribution is two-sided: ReA plus OUR. If the implementation follows the appendix, the defense is not validated for the mechanism claimed in the abstract, and the authors need to correct the implementation description and rerun the defense experiments (or clearly report which objective was used and reinterpret the results). The convergence-threshold inconsistency in Algorithm 1 is a second reproducibility blocker that should be fixed in the same revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the attack is the real contribution; the defense as written has a contradiction that needs to be resolved before the paper's mitigation claims are taken at face value. ReA is a genuinely new attack class: class-wise membership inference via resonance index, exploiting loss-landscape residuals rather than output distributions. The evaluation is solid for an attack paper: 11 baselines across three datasets, two architectures, plus a diffusion extension, with a retrained-model control sitting near 50% and a Pearson 0.88 correlation between representation misalignment and attack accuracy. The black-box transfer via model extraction is a nice touch. The central claim that approximate unlearning leaves residual traces beyond output metrics is well supported.\n\nThe soft spots are real and mostly concentrated in the defense. The main-text Equation 7 defines Lorth as a sum of squared dot products pushing current features toward orthogonality with pre-unlearning features. Appendix Algorithm 3, Phase 1, defines the same loss as a sum of squared errors pushing current features toward the pre-unlearning values. Those are opposite objectives. If the implementation follows the appendix, the reported privacy gains (ReA near random) could come from the replay phase or ordinary fine-tuning, not from orthogonal scrubbing. That is not a cosmetic typo; it changes what was actually tested. The authors need to either correct the pseudocode or rerun with the stated loss, and then report which version produced the numbers. A smaller inconsistency: Algorithm 1 uses a 0.9 convergence threshold while Section 5.1 says 75% and Appendix E.4 suggests 70–80%. Minor, but needs cleanup. The universality claim (“regardless of model architectures, parameters, and unlearning algorithms”) is stronger than the evidence, which covers a reasonable but finite set of settings. And several hyperparameters are tuned on the same benchmarks, though the ablations at least show sensitivity.\n\nOn the attack side, the retrained-model control, the representation correlation, and the black-box results all point to a real phenomenon. The defense is where the paper currently overclaims. I would send this to peer review: the attack deserves scrutiny and replication, and the defense can be fixed with honest reporting or a rerun. The paper is for privacy and unlearning researchers who care about evaluation methodology, not just attack–defense scorecards. My recommendation: engage, but make the defense mechanism consistent before trusting its numbers.","headline":"The attack is the real contribution; the defense as written has a load-bearing contradiction that must be resolved before the mitigation claims are taken at face value.","tokens_in":29511,"tokens_out":3166,"would_cite":true,"duration_ms":34695,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Approximate machine unlearning methods leave persistent latent residuals in the loss landscape that allow membership inference against unlearned classes and samples, and a two-phase orthogonal unlearning framework can scrub those residuals.","keywords":["machine unlearning","approximate unlearning","membership inference attack","privacy leakage","loss landscape residuals","resonance index","orthogonal unlearning","concept unlearning"],"falsifier":"Take a model unlearned by any approximate unlearning method and measure the resonance index on a held-out set that was never in training, after matching the model's outputs to a retrained model on all legacy metrics. If convergence speed for unlearned candidates is indistinguishable from non-training candidates whenever output distributions match, the central claim of persistent loss-landscape residuals is falsified.","tokens_in":28386,"feed_emoji":"🔍","tokens_out":4857,"duration_ms":49054,"temperature":0.7,"pith_summary":"This paper sets out to show that approximate machine unlearning, though it makes a model's outputs resemble a fully retrained model, leaves latent residuals in the loss landscape that still encode the identity of deleted data. The authors call these implicit residuals and argue they persist across model architectures, training parameters, and unlearning algorithms, forming an attack surface that output-level privacy metrics miss. On that basis they introduce the Reminiscence Attack (ReA), which fine-tunes a model on candidate classes or samples and measures how quickly it 'remembers' them, and they propose Orthogonal Unlearning & Replay (OUR) to scrub the traces. A sympathetic reader would care because, if the claim holds, current approximate unlearning methods can be compliant-looking while still leaking membership privacy, and the paper's defense offers a way to close that gap at a fraction of retraining cost.","feed_headline":"Approximate unlearning leaves traces that betray deleted data","feed_subtitle":"Even when outputs match retraining, hidden residuals leak deleted classes and samples; a replay-based method removes them.","key_machinery":"The paper's central object is the residual $R(D_u)$, defined as the expected behavioral discrepancy between unlearned data and their non-training counterparts. The attack mechanism is the resonance index $\\mathrm{Idx}_r$, the fine-tuning iterations a model needs to reach a convergence threshold on a candidate class or sample set; faster convergence means the candidate is likely unlearned, because the model still sits near a minimum for that data. The defense mechanism is the orthogonal unlearning loss $L_{\\mathrm{orth}} = \\sum_{(x,y)\\in D_u}\\sum_{l\\in\\{l\\}_k}[F_l^T(x;\\theta)F_l(x;\\theta_0)]^2$, which pushes hidden representations of unlearned samples toward orthogonality with their original states, followed by a replay phase that fine-tunes on retained data to restore utility and genuine convergence. The two-phase structure is what separates scrubbing from merely masking outputs.","core_discovery":"Approximate unlearning methods that satisfy legacy accuracy-based unlearning metrics still leave measurable residuals: deep-layer hidden representations retain high intra-class correlation for unlearned classes, and unlearned models sit in 'pseudo-converged' states whose outputs mimic retrained models while preserving latent information. ReA exploits this by guided fine-tuning; its resonance index, the number of iterations needed to reach a convergence threshold on a candidate set, separates unlearned from non-training data because unlearned data converge markedly faster. The paper reports ReA reaching up to 1.90x and 1.12x the accuracy of prior output-based attacks (MIA-LiRA and MIA-UP) for class- and sample-wise membership inference, including over 90% attack accuracy for several class-wise unlearning methods. The companion claim is that residuals are scrubbable: OUR enforces orthogonality between hidden features of unlearned data and their pre-unlearning values, then replays the retained set to restore convergence, reducing ReA accuracy to near random guess while keeping unlearning efficacy comparable to retraining at 2-12% of retraining cost.","pith_inferences":["One extension the paper leaves implicit: the resonance-index signal is a generic convergence-speed probe, so similar fine-tuning-based membership tests could be run against large language models or federated clients where unlearning is performed by local fine-tuning rather than full retraining.","The measured correlation between representation misalignment and ReA accuracy suggests a cheap audit: inspecting intra-class variance, silhouette score, and overlap in hidden representations could flag which unlearned models are still leaky before an attack is run.","A testable boundary case: if an approximate unlearning method ever produces parameters genuinely identical to retrained parameters (not just similar outputs), resonance should vanish; ReA therefore doubles as a measure of how far an unlearning method is from exact unlearning."],"forward_implications":["Unlearning efficacy measured by test, unlearning, and retaining accuracy is insufficient: a model can pass those metrics while remaining susceptible to membership inference against deleted data.","Class membership, not just sample membership, is a practical privacy target: ReA infers whether an entire class or concept was unlearned, with over 90% attack accuracy on several approximate unlearning methods.","The residual signal transfers: class-wise ReA remains effective in black-box settings using a substitute model obtained by model extraction, so API-only access does not fully neutralize the attack.","OUR offers a concrete privacy-preserving alternative that approaches retrained-model privacy (ReA accuracy near random guess) at 2-12% of full-retraining cost, for both classification and image-generation concept unlearning.","Residual leakage is algorithm-independent in tendency: the paper finds vulnerabilities across fine-tuning, gradient ascent, random label, influence-based, boundary-based, SCRUB, l1-sparse, SalUn, SFRon, and RUM benchmarks."],"supporting_citations":[{"why":"Provides the MIA-UP baseline, the output-residual attack that ReA improves upon, and the SCRUB unlearning benchmark.","marker":"[27]"},{"why":"Supplies the MIA-LiRA membership inference method and the ROC/TPR-at-fixed-FPR evaluation standard used throughout.","marker":"[7]"},{"why":"Provides the l1-sparsity and influence-based unlearning baselines and the legacy unlearning metrics that the paper argues are insufficient.","marker":"[24]"},{"why":"Supplies the random-label and fine-tuning unlearning baselines whose residual behavior ReA exploits.","marker":"[17]"},{"why":"Provides the RUM benchmark and the Tug-of-War unlearning efficacy metric used to compare OUR against baselines.","marker":"[47]"},{"why":"Supplies the SalUn unlearning baseline and the parameter-freezing strategy integrated into OUR for generation tasks.","marker":"[13]"},{"why":"Provides the Meta-Un concept unlearning baseline designed to prevent relearning of forgotten concepts, which OUR is compared against.","marker":"[14]"},{"why":"Supplies the DiffAtk baseline for reviving forgotten concepts in diffusion models, used as a comparison in concept-unlearning privacy attacks.","marker":"[46]"},{"why":"Supplies the data-free model extraction method that enables black-box ReA in the paper's transferability experiments.","marker":"[40]"},{"why":"Provides the SFRon gradient-based unlearning benchmark evaluated in classification and concept-unlearning experiments.","marker":"[23]"}],"fun_headline_variants":["Hidden residuals betray data deleted by approximate unlearning","Approximate unlearning leaves traces that expose deleted data","Unlearned data leaks via model residuals: new attack ReA","Replay-based defense curbs residual leaks from unlearning","ReA attack exploits unlearning residuals to recover deleted data"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"ReA's success assumes the adversary can obtain a subset of the candidate class or sample data and can fine-tune the victim model, or a high-fidelity substitute, on that data; without this capability the attack's effectiveness is not established.","fun_headline_variants_meta":{"raw":{"variants":["Hidden residuals betray data deleted by approximate unlearning","Approximate unlearning leaves traces that expose deleted data","Unlearned data leaks via model residuals: new attack ReA","Replay-based defense curbs residual leaks from unlearning","ReA attack exploits unlearning residuals to recover deleted data"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000456,"raw_usage":{"total_tokens":2330,"prompt_tokens":1027,"completion_tokens":1303,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":643,"completion_tokens_details":{"reasoning_tokens":1223}},"tokens_in":643,"tokens_out":1303,"duration_ms":10407,"temperature":1.0,"reasoning_tokens":1223,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:40:50.212964+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a model unlearned by any approximate unlearning method and measure the resonance index on a held-out set that was never in training, after matching the model's outputs to a retrained model on all legacy metrics. If convergence speed for unlearned candidates is indistinguishable from non-training candidates whenever output distributions match, the central claim of persistent loss-landscape residuals is falsified.","supporting_citations":[{"cited_title":"Towards unbounded machine unlearning","cited_arxiv_id":null,"evidence_quote":"Provides the MIA-UP baseline, the output-residual attack that ReA improves upon, and the SCRUB unlearning benchmark."},{"cited_title":"Member- ship inference attacks from first principles","cited_arxiv_id":null,"evidence_quote":"Supplies the MIA-LiRA membership inference method and the ROC/TPR-at-fixed-FPR evaluation standard used throughout."},{"cited_title":"Model sparsity can simplify machine unlearning","cited_arxiv_id":null,"evidence_quote":"Provides the l1-sparsity and influence-based unlearning baselines and the legacy unlearning metrics that the paper argues are insufficient."},{"cited_title":"Amnesiac machine learning","cited_arxiv_id":null,"evidence_quote":"Supplies the random-label and fine-tuning unlearning baselines whose residual behavior ReA exploits."},{"cited_title":"unlearning-by-disobedience","cited_arxiv_id":null,"evidence_quote":"Provides the RUM benchmark and the Tug-of-War unlearning efficacy metric used to compare OUR against baselines."},{"cited_title":"Salun: Empow- ering machine unlearning via gradient-based weight saliency in both image classification and generation","cited_arxiv_id":null,"evidence_quote":"Supplies the SalUn unlearning baseline and the parameter-freezing strategy integrated into OUR for generation tasks."},{"cited_title":"To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe im- ages","cited_arxiv_id":null,"evidence_quote":"Supplies the DiffAtk baseline for reviving forgotten concepts in diffusion models, used as a comparison in concept-unlearning privacy attacks."},{"cited_title":"Data-free model extraction","cited_arxiv_id":null,"evidence_quote":"Supplies the data-free model extraction method that enables black-box ReA in the paper's transferability experiments."},{"cited_title":"Unified gradient-based machine unlearning with re- main geometry enhancement","cited_arxiv_id":null,"evidence_quote":"Provides the SFRon gradient-based unlearning benchmark evaluated in classification and concept-unlearning experiments."}],"review_version":2}