Adversarial Unlearning Approaches

• Adversarial unlearning is a method that integrates adversarial optimization with machine unlearning to selectively erase specific data while maintaining overall model performance.
• It employs techniques such as training-time regularization, adversarial perturbations, and min–max optimization to reduce the influence of a designated forget set.
• Evaluation is enhanced through attacker-centric tests and metrics like membership inference and confusion tests, ensuring that erased information remains unrecoverable.

Adversarial unlearning is a family of methods, threat models, and evaluation protocols that couples machine unlearning with adversarial optimization. In the literature, the term spans at least three closely related uses: training-time regularization that reduces confidence on adversarially chosen inputs; approximate or robust unlearning algorithms that explicitly use adversarial examples, latent perturbations, or strong learned auditors to erase specific information; and attacker-centric analyses showing that apparently forgotten knowledge can be recovered, or that the unlearning interface itself can be exploited to degrade model behavior (Setlur et al., 2022, Di et al., 2024, Yuan et al., 2024). Across these uses, the core objective is consistent: partition data into a forget set and a retain set, reduce the influence of the former, preserve utility on the latter and on the original task, and evaluate success under attacks stronger than conventional post-hoc metrics (Jung et al., 2024, Li et al., 2 Feb 2026).

1. Conceptual scope and terminology

In one line of work, adversarial unlearning denotes a regularization strategy during ordinary supervised training. "Adversarial Unlearning: Reducing Confidence Along Adversarial Directions" defines RCAD as reducing model confidence on self-generated, out-of-distribution inputs lying along directions adversarially chosen to increase training loss, rather than enforcing the original label as in adversarial training (Setlur et al., 2022). Its objective is to maximize predictive entropy on large-step adversarial points, and its theoretical analysis shows that this can provably help the model unlearn spurious features in simplified linear settings (Setlur et al., 2022).

In a second line of work, adversarial unlearning denotes explicit machine-unlearning algorithms that use adversarial mechanisms to decide what to erase. Examples include filter reset driven by adversarial noise in convolutional networks, Stackelberg games against membership-inference auditors, learned attacker–defender min–max training, and latent-space robust optimization in LLMs (Jung et al., 2024, Di et al., 2024, Sharma et al., 2024, Li et al., 2 Feb 2026). These methods treat adversarial signals not as nuisances but as probes of the parameters or representations that still carry forget-set information.

A third usage is explicitly adversarial evaluation. "Towards Adversarial Evaluations for Inexact Machine Unlearning" argues that many existing evaluations do not satisfy necessity for indistinguishability, comparability across training procedures and architectures, and property generalization checking, and introduces the Interclass Confusion test as a stronger black-box evaluation (Goel et al., 2022). More recent work extends this attacker-centric view to adversarial prompts, adversarial relearning, unlearning-induced attacks, and deletion-triggered graph attacks, making robustness itself a primary criterion rather than an afterthought (Yuan et al., 2024, Qian et al., 14 May 2025, Zhang et al., 19 Mar 2026).

A recurrent distinction concerns unlearning versus safety fine-tuning. "An Adversarial Perspective on Machine Unlearning for AI Safety" evaluates unlearning under the criterion that it fails if significant hazardous capability can be recovered either without changing weights at inference time or with weight updates on data that has little or no mutual information with the supposedly forgotten content (Łucki et al., 2024). This criterion reframes unlearning as a claim about inaccessible internal capability, not merely output suppression.

2. Formal objectives, games, and evaluation metrics

Most formulations begin with a trained model $f_\theta$ and a partition of the original data into forget and retain sets. In ARU, the dataset $D$ is split into $F = D_f$ and $R = D_r = D \setminus D_f$, the unlearned model is denoted $\theta^\*$, utility $U$ is classification accuracy on the held-out benchmark test set, and forgetting efficacy is measured by membership-inference indistinguishability between $D_f$ and an unseen set $D_u$ (Jung et al., 2024). ARU defines the forget score as

$F = |M - 0.5|,$

where $M$ is the accuracy of a logistic-regression membership classifier trained on per-example cross-entropy losses, so smaller $D$0 indicates better forgetting. It then combines utility and forgetting via

$D$1

with higher values preferred (Jung et al., 2024).

Game-theoretic formulations make the adversary explicit. "Adversarial Machine Unlearning" models unlearning as a Stackelberg game in which the unlearner minimizes task loss on $D$2 while also minimizing the success of a membership-inference auditor trained on removed versus non-member examples (Di et al., 2024). In its generic form,

$D$3

subject to the follower’s best response

$D$4

The method computes leader gradients through the auditor via implicit differentiation, so the attacker is part of training rather than only evaluation (Di et al., 2024).

In LLMs, the same idea appears as latent robust optimization. AGT$D$5 defines a retain loss, a logistic-transformed forget loss, and an Adaptive Orthogonality regularizer that activates when forget and retain gradients conflict; these are combined in a latent-space min–max objective with Projected Gradient Descent over hidden-state perturbations (Li et al., 2 Feb 2026). LAU likewise treats unlearning as a two-stage min–max problem, but the adversarial object is a bounded perturbation vector injected into the residual stream of a transformer layer, with the outer update hardening the model against perturbation-induced recovery of forgotten knowledge (Yuan et al., 2024).

Evaluation has correspondingly broadened. Besides standard retain and test accuracy, papers in this area use KS-test log p-values on truth-ratio distributions, Fluency scores, Knowledge Unlearning Ratio, Privacy Leakage Ratio, Forget Quality, ROUGE-based memorization metrics, loss-distribution tests such as KS and Wasserstein distance, targeted confusion rates, and increasingly strong membership inference attacks including RMIA, U-LiRA, and MIA-NN (Li et al., 2 Feb 2026, Di et al., 2024, Ebrahimpour-Boroojeny, 7 Dec 2025, Goel et al., 2022). This suggests that adversarial unlearning is less a single algorithmic template than a design principle: optimize and validate forgetting under the strongest accessible recovery channel.

3. Core algorithmic patterns in discriminative models

A prominent pattern is to use adversarial perturbations to identify parameters most biased toward the forget set. ARU performs PGD on forget-set samples, computes per-filter gradient discrepancies between raw and adversarial inputs, selects the 50% of convolutional filters with the smallest discrepancies, resets them to fresh initialization, and then fine-tunes only on retain data (Jung et al., 2024). On MUFAC, ARU reports Utility $D$6, Forget $D$7, and NoMUS $D$8; on MUCAC, it reports Utility $D$9, Forget $F = D_f$0, and NoMUS $F = D_f$1, while being $F = D_f$2 faster than SCRUB in the reported runtime comparison (Jung et al., 2024).

A second pattern is to train against a learned attacker. "Discriminative Adversarial Unlearning" introduces a min–max game between a defender $F = D_f$3 and a learned MIA attacker $F = D_f$4 whose input is the concatenation $F = D_f$5, where $F = D_f$6 averages prediction sensitivity under Gaussian noise (Sharma et al., 2024). The defender minimizes retain classification loss plus the attacker loss and a self-supervised feature-alignment term based on Barlow Twins, while the attacker maximizes membership discrimination between the forget set and a validation set. On CIFAR-10 class-wise forgetting, dense models achieve near-retraining behavior with UA $F = D_f$7, MIA $F = D_f$8, RA $F = D_f$9, TA $R = D_r = D \setminus D_f$0, Avg. disparity $R = D_r = D \setminus D_f$1, and runtime $R = D_r = D \setminus D_f$2 minutes, versus $R = D_r = D \setminus D_f$3 minutes for retraining (Sharma et al., 2024).

A third pattern is to lower confidence on forget samples by fine-tuning on their corresponding adversarial examples. AMUN constructs an adversarial set by running PGD-50 in an $R = D_r = D \setminus D_f$4 ball and increasing $R = D_r = D \setminus D_f$5 until the forget sample is misclassified, then fine-tunes on those adversarial examples, optionally together with retain data (Ebrahimpour-Boroojeny et al., 2 Mar 2025). For random $R = D_r = D \setminus D_f$6 forgetting on CIFAR-10 with access to the retain set, AMUN reports FT AUC $R = D_r = D \setminus D_f$7 and Average Gap $R = D_r = D \setminus D_f$8, which is close to retraining on the reported metrics; a later synthesis links AMUN’s performance to smoothness and studies FastClip for layer-wise spectral-norm clipping, together with the nearest-neighbor membership inference attack for class unlearning and the Tilted ReWeighting distribution for approximating retrained behavior on forgotten classes (Ebrahimpour-Boroojeny, 7 Dec 2025).

A fourth pattern uses an adversarial generator to synthesize intermediate samples on which catastrophic unlearning is likely. MixUnlearn trains a generator–unlearner pair in which the generator adversarially constructs mixup samples between $R = D_r = D \setminus D_f$9 and $\theta^\*$0, while the unlearner is optimized with contrastive objectives on both synthetic and real samples (Peng et al., 14 Feb 2025). In class-level CIFAR-10 unlearning, MixUnlearn reports Test$\theta^\*$1, ASR $\theta^\*$2, and Test$\theta^\*$3, closely matching retraining on the reported class-level criteria (Peng et al., 14 Feb 2025).

These methods share a technical motif: adversarial signals are used as selectors of what to erase, not merely as attacks to defend against. This suggests that local instability around forget data can be turned into an informative statistic for approximate unlearning, although none of these methods claims exact retraining equivalence in the strongest formal sense.

4. LLMs and generative models

In LLMs, adversarial unlearning has been driven by the problem of recovery under prompt attacks, quantization, and relearning. AGT$\theta^\*$4 combines Adversarial Gating Training with Adaptive Orthogonality, treating unlearning as latent-space robust optimization with curriculum-based gating and geometry-aware conflict regularization (Li et al., 2 Feb 2026). On TOFU with LLaMA2-7B-chat, it reports KUR $\theta^\*$5, Model Utility $\theta^\*$6, Fluency $\theta^\*$7, PLR $\theta^\*$8, and Forget Quality $\theta^\*$9; on WMDP-Cyber with Zephyr-7B-beta, it reports hazard score $U$0 and MMLU $U$1 with MMLU College CS $U$2 and MMLU Cybersec $U$3 (Li et al., 2 Feb 2026). The same paper attributes the stability gain to AO and the depth of erasure to AGT.

A complementary line emphasizes attack-driven evaluation. DUA automatically optimizes adversarial suffixes to recover forgotten knowledge, and LAU responds by injecting bounded perturbation vectors into latent states during unlearning, yielding AdvGA and AdvNPO (Yuan et al., 2024). The paper reports that unlearned knowledge can be recovered in $U$4 of the questions, even without revealing the unlearned model’s parameters, and that LAU improves the unlearning effectiveness by over $U$5, causes only less than a $U$6 reduction in neighboring knowledge, and has almost no impact on the model’s general capabilities (Yuan et al., 2024).

Diffusion-model concept erasure has produced an analogous adversarial training framework. AdvUnlearn casts robust concept erasure as bilevel optimization over adversarial prompts and diffusion-model parameters, adds a utility-retaining regularization on an LLM-filtered retain set, and finds the text encoder to be the more suitable module for robustification than the UNet (Zhang et al., 2024). On style unlearning for “Van Gogh,” AdvUnlearn reports ASR $U$7, FID $U$8, and CLIP $U$9; on object unlearning for Church, it matches ScissorHands at ASR $D_f$0 while retaining much better FID, $D_f$1 versus $D_f$2 (Zhang et al., 2024).

Other generative settings generalize the adversarial idea in different ways. "Generative Adversarial Networks Unlearning" exploits the GAN game itself, using a substitution mechanism for generator continuity and a fake label for discriminator forgetting, then alternating unlearning and learning phases in a cascaded schedule (Sun et al., 2023). On MNIST item unlearning with 64 items, few-shot cascaded unlearning changes AUC$D_f$3 from $D_f$4 to $D_f$5 in $D_f$6 seconds, while retraining takes $D_f$7 seconds, a reported $D_f$8 speedup (Sun et al., 2023). In backdoor removal, BI-BAU formulates complete backdoor unlearning through catastrophic forgetting conditions and solves a blind inversion problem by integrating adversarial training into an EM algorithm; on CIFAR-10 ResNet-18 it reports average CA $D_f$9 and ASR $D_u$0 across eight attacks, with low post-purification reactivation rates (Zhu et al., 12 Jun 2026).

Across these model classes, a common shift is visible: unlearning is evaluated not only by whether the forbidden content disappears on standard prompts, but by whether the content remains unrecoverable under optimized inputs or latent perturbations. This suggests a convergence between robust optimization and machine unlearning in foundation-model settings.

5. Adversarial evaluation, recovery, and attack surfaces

Adversarial unlearning has also become an evaluation problem. The Interclass Confusion test creates forget sets by swapping labels within a targeted class pair and then measures targeted error on both manipulated training data and unseen test samples from those classes (Goel et al., 2022). The paper argues that residual targeted confusion is incompatible with model indistinguishability under any retraining procedure, and it uses this criterion to show that final-layer-only unlearning is insufficient. Its analytically motivated EU-k and CF-k baselines outperform several earlier inexact methods on the proposed test (Goel et al., 2022).

In LLMs, adversarial recovery has targeted both weights and activations. "An Adversarial Perspective on Machine Unlearning for AI Safety" shows that existing jailbreak methods can be successful when applied carefully and that adaptive methods such as activation-space projection and tiny finetuning can recover most supposedly unlearned capabilities (Łucki et al., 2024). For models edited with RMU, finetuning on 10 unrelated examples or removing specific directions in the activation space recovers most hazardous capabilities; on WMDP-Bio, activation orthogonalization restores RMU to $D_u$1, exceeding the original $D_u$2, while MMLU remains $D_u$3 (Łucki et al., 2024). This directly challenges the claim that current unlearning methods are categorically different from safety post-training under an adversarial threat model.

Adversarial relearning has produced a related critique. Layered Unlearning partitions the forget set into folds and unlearns progressively larger unions while retaining the remaining folds, with the explicit aim of creating distinct inhibitory mechanisms that are harder to remove by later fine-tuning (Qian et al., 14 May 2025). In synthetic 2D classification, standard unlearning allows A to rebound to $D_u$4 when relearning B, whereas LU reduces that rebound to $D_u$5; in bigram modeling, average transfer under relearning shrinks from approximately $D_u$6 to approximately $D_u$7 (Qian et al., 14 May 2025). The paper interprets this as evidence against a single shared inhibitor model of post-training updates.

A further development is the attack surface created by the unlearning interface itself. "How to Protect Models against Adversarial Unlearning?" studies malicious unlearning requests designed to maximally deteriorate model performance and proposes Healing, a post-unlearning fine-tuning step on retained data and similarity-selected surrogate twins (Jasiorski et al., 15 Jul 2025). ROKA formalizes an indirect unlearning attack in which the attacker requests unlearning of one class to degrade performance on another security-critical class without poisoning or duplicating training data, then proposes Neural Healing and contribution re-allocation to counter knowledge contamination (Shin et al., 28 Feb 2026). In graphs, unlearning corruption attacks inject nodes into the training graph and later request their deletion; on PubMed with GIF, the attack changes unlearned accuracy from approximately $D_u$8 to approximately $D_u$9, a reported $F = |M - 0.5|,$0, while pre-unlearning utility remains near the unattacked model (Zhang et al., 19 Mar 2026).

Domain adaptation adds a distinct leakage channel. SCADA-UL shows that source-free domain adaptation methods can retain zero-shot performance on source-exclusive classes in the target domain, then introduces adversarially generated forget-class samples and a rescaled labeling strategy to erase that leakage during adaptation (Devalapally et al., 9 Apr 2026). On OfficeHome in the multi-class setting, the proposed method reports $F = |M - 0.5|,$1, $F = |M - 0.5|,$2, and Unlearn Score $F = |M - 0.5|,$3, close to retraining at $F = |M - 0.5|,$4 (Devalapally et al., 9 Apr 2026).

These results have made adversarial evaluation central to the field. A plausible implication is that approximate unlearning cannot be assessed solely by low forget-set accuracy or a single membership-inference score; its security meaning depends on whether the erased information remains recoverable through optimized prompts, latent edits, benign-looking relearning data, or legally mandated deletions.

6. Defensive strategies and open directions

Defensive work has increasingly shifted from purely destructive updates to explicit preservation mechanisms. Healing fine-tunes on retained data and on selected twins from a spare set or a pre-associated “Twins Strategy,” with Adam at learning rate $F = |M - 0.5|,$5 for either 1 epoch or $F = |M - 0.5|,$6 epochs (Jasiorski et al., 15 Jul 2025). In targeted deletions of 25 images from one class, CIFAR-10 ResNet-50 healing reaches $F = |M - 0.5|,$7 with raw-$F = |M - 0.5|,$8 twins after $F = |M - 0.5|,$9 epochs, compared with Gold at $M$0, while AFHQ EfficientNet-B0 reaches $M$1 versus Gold at $M$2 (Jasiorski et al., 15 Jul 2025). The paper presents this as a pragmatic performance-protection layer rather than a certified defense.

ROKA takes a more structural approach by modeling networks as Neural Knowledge Systems and defining Knowledge Contamination through a leverage-weighted destruction threshold on shared parameters (Shin et al., 28 Feb 2026). Its practical objective is

$M$3

with sibling identification implemented through $M$4 LRP and self-distillation on conceptual neighbors (Shin et al., 28 Feb 2026). On CIFAR-100 zero-shot CLIP-base/32 targeted unlearning, it reports Unlearned mTA $M$5 and Unlearned mRA $M$6, which the paper interprets as complete forgetting with improved retention (Shin et al., 28 Feb 2026).

Robust unlearning in safety-critical settings has also converged on adversarial training. BI-BAU states complete backdoor unlearning as zero catastrophic forgetting on clean inputs and anti-drift on poisoned inputs, derives necessary alignment and orthogonality conditions under an NTK-style continual-learning view, and implements them through adversarial training with knowledge distillation, feature-space priors, and EWC-style penalties (Zhu et al., 12 Jun 2026). AdvUnlearn in diffusion models, AGT$M$7 in LLMs, and LAU’s latent perturbation training all fit the same pattern: adversarial inner loops expose recoverable directions, and retain-side regularization prevents the defense from collapsing benign utility (Zhang et al., 2024, Li et al., 2 Feb 2026, Yuan et al., 2024).

Several open directions recur across these papers. ARU explicitly lists certified unlearning, probabilistic masks, adaptive adversarial curricula, and integration with differential privacy (Jung et al., 2024). AGT$M$8 highlights stronger adversaries, continual and multi-target unlearning, multimodal extensions, privacy integration, and adaptive $M$9, $D$00, and gate policies (Li et al., 2 Feb 2026). The domain-adaptation setting identifies the difficulty of unknown forget classes under distribution shift (Devalapally et al., 9 Apr 2026), and the graph setting points to hardened deletion workflows, anomaly detection, and sensitivity-regularized unlearning as practical needs under GDPR- and CCPA-like constraints (Zhang et al., 19 Mar 2026).

Adversarial unlearning therefore sits at the intersection of privacy, robustness, and model editing. The field no longer treats forgetting as a single post-hoc optimization step; it treats it as an adversarially contested transformation whose success depends on the strength of the attacker used during training, the strength of the attack used during evaluation, and the extent to which the system preserves benign knowledge while eliminating recoverable traces of the forget set.