---
title: Adversarial Machine Unlearning (AMUN)
url: https://www.emergentmind.com/topics/adversarial-machine-unlearning-amun-a5e26565-7f10-4742-ba18-3d666efe98a2
type: topic
---

# Adversarial Machine Unlearning (AMUN)

Adversarial Machine Unlearning (AMUN) is a class of model-scrubbing techniques that leverage adversarial perturbations, game-theoretic optimization, and explicit attack–defense dynamics to induce robust, reliable, and privacy-compliant removal of learned information from machine learning models. The core objective is to edit a model so it mimics the behavior of a retrained model on the retained dataset, while ensuring the erased subset ("forget set") is no longer memorized, inferable, or operationally accessible—even to adaptive, adversarial attacks. The field spans countermeasure design, vulnerability assessment, evaluation on worst-case forget sets, and principled theoretical analysis of privacy, utility, and resistance to inversion or property leakage.

## 1. Core AMUN Framework: Algorithmic Design and Objective

The canonical AMUN protocol targets a pre-trained classifier $F_\theta$ with parameters $\theta$ and proposes to unlearn a subset $D_f$ of the training set $D$. The remaining data is $D_r = D \setminus D_f$. The core AMUN optimization (as described in [2512.06993], [2503.00917]) is:

\[
\min_{\theta} \; \sum_{(x, y) \in D_r} \ell(F_\theta(x), y) + \lambda \sum_{(x_{\mathrm{adv}}, y_{\mathrm{adv}}) \in D_{\mathrm{adv}}} \ell(F_\theta(x_{\mathrm{adv}}), y_{\mathrm{adv}})
\]

where $D_{\mathrm{adv}}$ consists of adversarial examples for each forget set member $(x, y)$, generated to move the model's confidence away from $y$ by applying iterative PGD with constraint $\|x_{\mathrm{adv}} - x\|_2 \leq \epsilon$ and $y_{\mathrm{adv}} = \arg\max_{j \neq y} F_\theta(x_{\mathrm{adv}})_j$. $\lambda$ controls the degree of unlearning; empirically, $\lambda=1$ is effective.

This composite fine-tuning—on both retained data (standard empirical loss) and the adversarially generated forget set points with "wrong" labels—pushes the model toward a retrained solution on $D_r$ while reducing confidence on the unlearned samples. The update localizes around the decision boundary of the erased points, leaving the overall behavior on $D_r$ and test data nearly undisturbed [2512.06993], [2503.00917].

## 2. Adversarial Example Generation and Optimization Procedures

AMUN generates adversarial points for each $x$ in $D_f$ through untargeted iterative PGD:

- Initialize $\epsilon \leftarrow \epsilon_0$.
- Repeat:
    - $x_{\mathrm{adv}} \leftarrow \mathcal{A}_{\text{PGD}}(x, \epsilon)$.
    - If $F_\theta(x_{\mathrm{adv}}) = y$, double $\epsilon$ and re-attack.
- Store $(x_{\mathrm{adv}}, y_{\mathrm{adv}})$ where $y_{\mathrm{adv}} = F_\theta(x_{\mathrm{adv}})$.

Model parameters are then refined by a few epochs of SGD on the union of $D_r$ and $D_{\mathrm{adv}}$ ([2512.06993], [2503.00917]).

Empirically, this approach avoids catastrophic forgetting of retained knowledge and confines decision boundary shifts to small $\epsilon$-balls around the erased samples, explaining strong utility preservation [2503.00917].

## 3. Theoretical Underpinnings: Smoothness, Transferability, and Lipschitz Control

AMUN's efficacy is governed by two main factors: the Lipschitz constant $L$ of $F_\theta$ with respect to input, and the transferability of adversarial examples from $F_\theta$ to a retrained model $F_R$ [2512.06993]. The key theoretical insight is:

\[
\|\theta' - \theta_R\|_2^2 \leq \|\theta - \theta_R\|_2^2 + \frac{2}{\beta} (L \|x - x_{\mathrm{adv}}\|_2 - C)
\]

where $C$ accounts for loss elevation on adversarial samples and "early stopping" regularization. Models with lower $L$ (i.e., controlled per-layer spectral norm) permit tighter alignment between fine-tuned and retrained parameters. 

FastClip, a spectral-norm clipping subroutine, efficiently enforces $L$ constraints via variant PowerQR iterations and simple SGD-compatible gradient updates, supporting smoothness-promoting Lipschitz regularization across all network layers at $O(n^2 k)$ per few hundred steps [2512.06993].

## 4. Evaluation: MIAs, Empirical Performance, and Robustness

AMUN is evaluated on a variety of metrics, including:
- **Membership Inference Attack (MIA) AUC** (ideal: 0.5).
- **Average-Gap** (absolute difference in accuracy between unlearned and retrained models, over retained/test/forget sets).
- **Test and retain accuracy**.

On CIFAR-10/ResNet-18 with a random 10% forget set:
- Retrain: FT-AUC $\approx$ 50% (ideal hiding).
- Prior methods: FT-AUC in [51–64%], Average-Gap $\gtrsim$ 1.7%.
- AMUN: FT-AUC $\approx$ 50.18%, Average-Gap $\approx$ 0.62%.
- AMUN+SalUn: FT-AUC $\approx$ 50.72%, Average-Gap $\approx$ 0.68%.

AMUN not only achieves statistically indistinguishable outputs from retrain but also remains robust when retain data is inaccessible—Average-Gap increases to $1.94\%$, still surpassing all baselines ([2512.06993]).

Smoothness, as enforced by FastClip, enhances adversarial transferability across models: lower spectral norms promote consistent decision boundary alignment among model instances, but may reduce ensemble diversity. To counter this, cross-model singular-vector subspace orthogonalization (LOTOS) is proposed [2512.06993].

## 5. Extension to Class Unlearning and Output Distribution Reweighting

AMUN exposes vulnerabilities in prior class unlearning schemes via a nearest-neighbor membership inference attack (MIA-NN) that exploits output probabilities over "neighboring" classes, revealing that most methods fail to match the desired retrained behavior on erased classes ([2512.06993]).

To mitigate this, a Tilted ReWeighting (TRW) output distribution is introduced:
- For forget-class samples, the TRW target approximates the output of a retrained-from-scratch model by estimating inter-class similarity and tilting the class probability vector accordingly.
- Fine-tuning toward the TRW target significantly decreases membership leakage and improves unlearning fidelity, outperforming prior class-unlearning methods across standard benchmarks ([2512.06993]).

## 6. Strengths, Limitations, and Open Directions

**Strengths:**
- Ultra-lightweight: only a handful of gradient steps are required (typically $\approx 10$ epochs).
- Effective without retain set $D_r$, though best with $D_r$ present.
- Principled: directly optimizes prediction similarity to retrain, especially in confidence on erased data.
- FastClip enhances robust generalization beyond unlearning.

**Limitations:**
- Theoretical assumptions (convexity/smoothness) are not satisfied for deep neural nets.
- Adversarial example quality is critical—strong PGD (e.g., PGD-50) attacks are needed.
- Adversarial generation overhead may increase sharply for high-dimensional data (LLMs, long token sequences).

**Open Research Directions:**
- Extension to generative models (e.g., diffusion): adversarial latent perturbation unlearning.
- Coreset selection for forget set minimization, leveraging path-norm scores.
- Higher-order moment constraints for improved class-unlearning output reweighting.
- Tight non-convex generalization analysis for adversarially fine-tuned unlearning [2512.06993].

## 7. Adversarial Evaluation: Stress Testing, Vulnerabilities, and Secure Protocols

AMUN analysis includes adversarially chosen forget sets ("worst-case evaluation"), revealing that existing (particularly relabeling-based) inexact unlearning procedures can dramatically underperform when erasure is attempted on the most influential samples. Relabeling-free strategies—those based on fine-tuning, sparsification, or direct unlearning via adversarial methods—continue to track retrain behavior even in this regime, while others produce high membership inference and unlearning error ([2403.07362]).

Emergent attack surfaces, such as model inversion under white- or black-box access (inversion attacks, label inference), are quantitatively resilient to AMUN's design, but can leak private information unless additional post-processing (parameter obfuscation, model pruning, fine-tuning on auxiliary data) is performed. However, these countermeasures impose clear trade-offs in model utility and privacy guarantees ([2404.03233], [2512.06993]).

## References

- [2512.06993] Toward Reliable Machine Unlearning: Theory, Algorithms, and Evaluation
- [2503.00917] AMUN: Adversarial Machine UNlearning
- [2403.07362] Challenging Forgets: Unveiling the Worst-Case Forget Sets in Machine Unlearning
- [2404.03233] Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearning

AMUN marks a unification of fine-tuning with adversarial boundary-localization, theoretical smoothness control, robust membership-inference resistance, and stress-tested performance, representing a significant conceptual and practical advance in the design of reliable, efficient, and privacy-preserving machine unlearning systems.

Source: https://www.emergentmind.com/topics/adversarial-machine-unlearning-amun-a5e26565-7f10-4742-ba18-3d666efe98a2