Adversarial Machine Unlearning (AMUN)

• Adversarial Machine Unlearning (AMUN) is a technique that employs adversarial training to effectively remove targeted learned information from models while maintaining overall performance.
• It integrates adversarial example generation through PGD and game-theoretic optimization to adjust decision boundaries and prevent data leakage.
• AMUN’s success is evidenced by robust evaluations using metrics like membership inference accuracy and average-gap, achieving performance close to retrained models.

Adversarial Machine Unlearning (AMUN) is a class of model-scrubbing techniques that leverage adversarial perturbations, game-theoretic optimization, and explicit attack–defense dynamics to induce robust, reliable, and privacy-compliant removal of learned information from machine learning models. The core objective is to edit a model so it mimics the behavior of a retrained model on the retained dataset, while ensuring the erased subset ("forget set") is no longer memorized, inferable, or operationally accessible—even to adaptive, adversarial attacks. The field spans countermeasure design, vulnerability assessment, evaluation on worst-case forget sets, and principled theoretical analysis of privacy, utility, and resistance to inversion or property leakage.

1. Core AMUN Framework: Algorithmic Design and Objective

The canonical AMUN protocol targets a pre-trained classifier $F_\theta$ with parameters $\theta$ and proposes to unlearn a subset $D_f$ of the training set $D$. The remaining data is $D_r = D \setminus D_f$. The core AMUN optimization (as described in (Ebrahimpour-Boroojeny, 7 Dec 2025, Ebrahimpour-Boroojeny et al., 2 Mar 2025)) is:

$$\min_{\theta} \; \sum_{(x, y) \in D_r} \ell(F_\theta(x), y) + \lambda \sum_{(x_{\mathrm{adv}}, y_{\mathrm{adv}}) \in D_{\mathrm{adv}}} \ell(F_\theta(x_{\mathrm{adv}}), y_{\mathrm{adv}})$$

where $D_{\mathrm{adv}}$ consists of adversarial examples for each forget set member $(x, y)$, generated to move the model's confidence away from $y$ by applying iterative PGD with constraint $\|x_{\mathrm{adv}} - x\|_2 \leq \epsilon$ and $$y_{\mathrm{adv}} = \arg\max_{j \neq y} F_\theta(x_{\mathrm{adv}})_j$$. $\lambda$ controls the degree of unlearning; empirically, $\lambda=1$ is effective.

This composite fine-tuning—on both retained data (standard empirical loss) and the adversarially generated forget set points with "wrong" labels—pushes the model toward a retrained solution on $D_r$ while reducing confidence on the unlearned samples. The update localizes around the decision boundary of the erased points, leaving the overall behavior on $D_r$ and test data nearly undisturbed (Ebrahimpour-Boroojeny, 7 Dec 2025, Ebrahimpour-Boroojeny et al., 2 Mar 2025).

2. Adversarial Example Generation and Optimization Procedures

AMUN generates adversarial points for each $x$ in $D_f$ through untargeted iterative PGD:

• Initialize $\epsilon \leftarrow \epsilon_0$.
• Repeat:
  • $$x_{\mathrm{adv}} \leftarrow \mathcal{A}_{\text{PGD}}(x, \epsilon)$$.
  • If $F_\theta(x_{\mathrm{adv}}) = y$, double $\epsilon$ and re-attack.
• Store $(x_{\mathrm{adv}}, y_{\mathrm{adv}})$ where $y_{\mathrm{adv}} = F_\theta(x_{\mathrm{adv}})$.

Model parameters are then refined by a few epochs of SGD on the union of $D_r$ and $D_{\mathrm{adv}}$ (Ebrahimpour-Boroojeny, 7 Dec 2025, Ebrahimpour-Boroojeny et al., 2 Mar 2025).

Empirically, this approach avoids catastrophic forgetting of retained knowledge and confines decision boundary shifts to small $\epsilon$-balls around the erased samples, explaining strong utility preservation (Ebrahimpour-Boroojeny et al., 2 Mar 2025).

3. Theoretical Underpinnings: Smoothness, Transferability, and Lipschitz Control

AMUN's efficacy is governed by two main factors: the Lipschitz constant $L$ of $F_\theta$ with respect to input, and the transferability of adversarial examples from $F_\theta$ to a retrained model $F_R$ (Ebrahimpour-Boroojeny, 7 Dec 2025). The key theoretical insight is:

$$\|\theta' - \theta_R\|_2^2 \leq \|\theta - \theta_R\|_2^2 + \frac{2}{\beta} (L \|x - x_{\mathrm{adv}}\|_2 - C)$$

where $C$ accounts for loss elevation on adversarial samples and "early stopping" regularization. Models with lower $L$ (i.e., controlled per-layer spectral norm) permit tighter alignment between fine-tuned and retrained parameters.

FastClip, a spectral-norm clipping subroutine, efficiently enforces $L$ constraints via variant PowerQR iterations and simple SGD-compatible gradient updates, supporting smoothness-promoting Lipschitz regularization across all network layers at $O(n^2 k)$ per few hundred steps (Ebrahimpour-Boroojeny, 7 Dec 2025).

4. Evaluation: MIAs, Empirical Performance, and Robustness

AMUN is evaluated on a variety of metrics, including:

• Membership Inference Attack (MIA) AUC (ideal: 0.5).
• Average-Gap (absolute difference in accuracy between unlearned and retrained models, over retained/test/forget sets).
• Test and retain accuracy.

On CIFAR-10/ResNet-18 with a random 10% forget set:

• Retrain: FT-AUC $\approx$ 50% (ideal hiding).
• Prior methods: FT-AUC in [51–64%], Average-Gap $\gtrsim$ 1.7%.
• AMUN: FT-AUC $\approx$ 50.18%, Average-Gap $\approx$ 0.62%.
• AMUN+SalUn: FT-AUC $\approx$ 50.72%, Average-Gap $\approx$ 0.68%.

AMUN not only achieves statistically indistinguishable outputs from retrain but also remains robust when retain data is inaccessible—Average-Gap increases to $1.94\%$, still surpassing all baselines (Ebrahimpour-Boroojeny, 7 Dec 2025).

Smoothness, as enforced by FastClip, enhances adversarial transferability across models: lower spectral norms promote consistent decision boundary alignment among model instances, but may reduce ensemble diversity. To counter this, cross-model singular-vector subspace orthogonalization (LOTOS) is proposed (Ebrahimpour-Boroojeny, 7 Dec 2025).

5. Extension to Class Unlearning and Output Distribution Reweighting

AMUN exposes vulnerabilities in prior class unlearning schemes via a nearest-neighbor membership inference attack (MIA-NN) that exploits output probabilities over "neighboring" classes, revealing that most methods fail to match the desired retrained behavior on erased classes (Ebrahimpour-Boroojeny, 7 Dec 2025).

To mitigate this, a Tilted ReWeighting (TRW) output distribution is introduced:

• For forget-class samples, the TRW target approximates the output of a retrained-from-scratch model by estimating inter-class similarity and tilting the class probability vector accordingly.
• Fine-tuning toward the TRW target significantly decreases membership leakage and improves unlearning fidelity, outperforming prior class-unlearning methods across standard benchmarks (Ebrahimpour-Boroojeny, 7 Dec 2025).

6. Strengths, Limitations, and Open Directions

Strengths:

• Ultra-lightweight: only a handful of gradient steps are required (typically $\approx 10$ epochs).
• Effective without retain set $D_r$, though best with $D_r$ present.
• Principled: directly optimizes prediction similarity to retrain, especially in confidence on erased data.
• FastClip enhances robust generalization beyond unlearning.

Limitations:

• Theoretical assumptions (convexity/smoothness) are not satisfied for deep neural nets.
• Adversarial example quality is critical—strong PGD (e.g., PGD-50) attacks are needed.
• Adversarial generation overhead may increase sharply for high-dimensional data (LLMs, long token sequences).

Open Research Directions:

• Extension to generative models (e.g., diffusion): adversarial latent perturbation unlearning.
• Coreset selection for forget set minimization, leveraging path-norm scores.
• Higher-order moment constraints for improved class-unlearning output reweighting.
• Tight non-convex generalization analysis for adversarially fine-tuned unlearning (Ebrahimpour-Boroojeny, 7 Dec 2025).

7. Adversarial Evaluation: Stress Testing, Vulnerabilities, and Secure Protocols

AMUN analysis includes adversarially chosen forget sets ("worst-case evaluation"), revealing that existing (particularly relabeling-based) inexact unlearning procedures can dramatically underperform when erasure is attempted on the most influential samples. Relabeling-free strategies—those based on fine-tuning, sparsification, or direct unlearning via adversarial methods—continue to track retrain behavior even in this regime, while others produce high membership inference and unlearning error (Fan et al., 2024).

Emergent attack surfaces, such as model inversion under white- or black-box access (inversion attacks, label inference), are quantitatively resilient to AMUN's design, but can leak private information unless additional post-processing (parameter obfuscation, model pruning, fine-tuning on auxiliary data) is performed. However, these countermeasures impose clear trade-offs in model utility and privacy guarantees (Hu et al., 2024, Ebrahimpour-Boroojeny, 7 Dec 2025).

• (Ebrahimpour-Boroojeny, 7 Dec 2025) Toward Reliable Machine Unlearning: Theory, Algorithms, and Evaluation
• (Ebrahimpour-Boroojeny et al., 2 Mar 2025) AMUN: Adversarial Machine UNlearning
• (Fan et al., 2024) Challenging Forgets: Unveiling the Worst-Case Forget Sets in Machine Unlearning
• (Hu et al., 2024) Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearning

AMUN marks a unification of fine-tuning with adversarial boundary-localization, theoretical smoothness control, robust membership-inference resistance, and stress-tested performance, representing a significant conceptual and practical advance in the design of reliable, efficient, and privacy-preserving machine unlearning systems.