---
title: Adversarial Unlearning Approaches
url: https://www.emergentmind.com/topics/adversarial-unlearning
type: topic
---

# Adversarial Unlearning Approaches

Adversarial unlearning is a family of methods, threat models, and evaluation protocols that couples machine unlearning with adversarial optimization. In the literature, the term spans at least three closely related uses: training-time regularization that reduces confidence on adversarially chosen inputs; approximate or robust unlearning algorithms that explicitly use adversarial examples, latent perturbations, or strong learned auditors to erase specific information; and attacker-centric analyses showing that apparently forgotten knowledge can be recovered, or that the unlearning interface itself can be exploited to degrade model behavior [2206.01367, 2406.07687, 2408.10682]. Across these uses, the core objective is consistent: partition data into a forget set and a retain set, reduce the influence of the former, preserve utility on the latter and on the original task, and evaluate success under attacks stronger than conventional post-hoc metrics [2401.08998, 2602.01703].

## 1. Conceptual scope and terminology

In one line of work, adversarial unlearning denotes a regularization strategy during ordinary supervised training. "Adversarial Unlearning: Reducing Confidence Along Adversarial Directions" defines RCAD as reducing model confidence on self-generated, out-of-distribution inputs lying along directions adversarially chosen to increase training loss, rather than enforcing the original label as in adversarial training [2206.01367]. Its objective is to maximize predictive entropy on large-step adversarial points, and its theoretical analysis shows that this can provably help the model unlearn spurious features in simplified linear settings [2206.01367].

In a second line of work, adversarial unlearning denotes explicit machine-unlearning algorithms that use adversarial mechanisms to decide what to erase. Examples include filter reset driven by adversarial noise in convolutional networks, Stackelberg games against membership-inference auditors, learned attacker–defender min–max training, and latent-space robust optimization in large language models [2401.08998, 2406.07687, 2402.06864, 2602.01703]. These methods treat adversarial signals not as nuisances but as probes of the parameters or representations that still carry forget-set information.

A third usage is explicitly adversarial evaluation. "Towards Adversarial Evaluations for Inexact Machine Unlearning" argues that many existing evaluations do not satisfy necessity for indistinguishability, comparability across training procedures and architectures, and property generalization checking, and introduces the Interclass Confusion test as a stronger black-box evaluation [2201.06640]. More recent work extends this attacker-centric view to adversarial prompts, adversarial relearning, unlearning-induced attacks, and deletion-triggered graph attacks, making robustness itself a primary criterion rather than an afterthought [2408.10682, 2505.09500, 2603.18570].

A recurrent distinction concerns unlearning versus safety fine-tuning. "An Adversarial Perspective on Machine Unlearning for AI Safety" evaluates unlearning under the criterion that it fails if significant hazardous capability can be recovered either without changing weights at inference time or with weight updates on data that has little or no mutual information with the supposedly forgotten content [2409.18025]. This criterion reframes unlearning as a claim about inaccessible internal capability, not merely output suppression.

## 2. Formal objectives, games, and evaluation metrics

Most formulations begin with a trained model $f_\theta$ and a partition of the original data into forget and retain sets. In ARU, the dataset $D$ is split into $F = D_f$ and $R = D_r = D \setminus D_f$, the unlearned model is denoted $\theta^\*$, utility $U$ is classification accuracy on the held-out benchmark test set, and forgetting efficacy is measured by membership-inference indistinguishability between $D_f$ and an unseen set $D_u$ [2401.08998]. ARU defines the forget score as
$$
F = |M - 0.5|,
$$
where $M$ is the accuracy of a logistic-regression membership classifier trained on per-example cross-entropy losses, so smaller $F$ indicates better forgetting. It then combines utility and forgetting via
$$
\mathrm{NoMUS} = U \times 0.5 + (1 - 2F) \times 0.5,
$$
with higher values preferred [2401.08998].

Game-theoretic formulations make the adversary explicit. "Adversarial Machine Unlearning" models unlearning as a Stackelberg game in which the unlearner minimizes task loss on $D_{\text{keep}}$ while also minimizing the success of a membership-inference auditor trained on removed versus non-member examples [2406.07687]. In its generic form,
$$
\min_{\theta'} \; \mathcal{L}_{\text{task}}(\theta'; D_{\text{keep}})
+ \lambda \, \mathcal{R}\!\left(U_{\text{att}}(\theta', \phi^\*(\theta'))\right),
$$
subject to the follower’s best response
$$
\phi^\*(\theta') \in \arg\max_\phi U_{\text{att}}(\theta', \phi).
$$
The method computes leader gradients through the auditor via implicit differentiation, so the attacker is part of training rather than only evaluation [2406.07687].

In LLMs, the same idea appears as latent robust optimization. AGT$^{AO}$ defines a retain loss, a logistic-transformed forget loss, and an Adaptive Orthogonality regularizer that activates when forget and retain gradients conflict; these are combined in a latent-space min–max objective with Projected Gradient Descent over hidden-state perturbations [2602.01703]. LAU likewise treats unlearning as a two-stage min–max problem, but the adversarial object is a bounded perturbation vector injected into the residual stream of a transformer layer, with the outer update hardening the model against perturbation-induced recovery of forgotten knowledge [2408.10682].

Evaluation has correspondingly broadened. Besides standard retain and test accuracy, papers in this area use KS-test log p-values on truth-ratio distributions, Fluency scores, Knowledge Unlearning Ratio, Privacy Leakage Ratio, Forget Quality, ROUGE-based memorization metrics, loss-distribution tests such as KS and Wasserstein distance, targeted confusion rates, and increasingly strong membership inference attacks including RMIA, U-LiRA, and MIA-NN [2602.01703, 2406.07687, 2512.06993, 2201.06640]. This suggests that adversarial unlearning is less a single algorithmic template than a design principle: optimize and validate forgetting under the strongest accessible recovery channel.

## 3. Core algorithmic patterns in discriminative models

A prominent pattern is to use adversarial perturbations to identify parameters most biased toward the forget set. ARU performs PGD on forget-set samples, computes per-filter gradient discrepancies between raw and adversarial inputs, selects the 50% of convolutional filters with the smallest discrepancies, resets them to fresh initialization, and then fine-tunes only on retain data [2401.08998]. On MUFAC, ARU reports Utility $59.25\% \pm 1.31$, Forget $0.61\% \pm 0.42$, and NoMUS $79.01\% \pm 0.49$; on MUCAC, it reports Utility $90.33\% \pm 0.74$, Forget $2.00\% \pm 0.62$, and NoMUS $93.17\% \pm 0.59$, while being $\approx 2.2\times$ faster than SCRUB in the reported runtime comparison [2401.08998].

A second pattern is to train against a learned attacker. "Discriminative Adversarial Unlearning" introduces a min–max game between a defender $D_\theta$ and a learned MIA attacker $A_\phi$ whose input is the concatenation $\mathbf{f}(x) = [D_\theta(x), \Delta(x), y]$, where $\Delta(x)$ averages prediction sensitivity under Gaussian noise [2402.06864]. The defender minimizes retain classification loss plus the attacker loss and a self-supervised feature-alignment term based on Barlow Twins, while the attacker maximizes membership discrimination between the forget set and a validation set. On CIFAR-10 class-wise forgetting, dense models achieve near-retraining behavior with UA $100.00 \pm 0.00$, MIA $100.00 \pm 0.00$, RA $98.90 \pm 0.20$, TA $93.22 \pm 0.74$, Avg. disparity $0.67$, and runtime $9.91$ minutes, versus $82.00$ minutes for retraining [2402.06864].

A third pattern is to lower confidence on forget samples by fine-tuning on their corresponding adversarial examples. AMUN constructs an adversarial set by running PGD-50 in an $\ell_2$ ball and increasing $\epsilon$ until the forget sample is misclassified, then fine-tunes on those adversarial examples, optionally together with retain data [2503.00917]. For random $10\%$ forgetting on CIFAR-10 with access to the retain set, AMUN reports FT AUC $\approx 50.18 \pm 0.36$ and Average Gap $\approx 0.62 \pm 0.05$, which is close to retraining on the reported metrics; a later synthesis links AMUN’s performance to smoothness and studies FastClip for layer-wise spectral-norm clipping, together with the nearest-neighbor membership inference attack for class unlearning and the Tilted ReWeighting distribution for approximating retrained behavior on forgotten classes [2512.06993].

A fourth pattern uses an adversarial generator to synthesize intermediate samples on which catastrophic unlearning is likely. MixUnlearn trains a generator–unlearner pair in which the generator adversarially constructs mixup samples between $D_f$ and $D_r$, while the unlearner is optimized with contrastive objectives on both synthetic and real samples [2502.10288]. In class-level CIFAR-10 unlearning, MixUnlearn reports Test$_r = 87.10 \pm 0.78$, ASR $= 68.30 \pm 2.77$, and Test$_f = 0 \pm 0$, closely matching retraining on the reported class-level criteria [2502.10288].

These methods share a technical motif: adversarial signals are used as selectors of what to erase, not merely as attacks to defend against. This suggests that local instability around forget data can be turned into an informative statistic for approximate unlearning, although none of these methods claims exact retraining equivalence in the strongest formal sense.

## 4. Large language models and generative models

In LLMs, adversarial unlearning has been driven by the problem of recovery under prompt attacks, quantization, and relearning. AGT$^{AO}$ combines Adversarial Gating Training with Adaptive Orthogonality, treating unlearning as latent-space robust optimization with curriculum-based gating and geometry-aware conflict regularization [2602.01703]. On TOFU with LLaMA2-7B-chat, it reports KUR $= 0.01$, Model Utility $= 0.59$, Fluency $= 0.90$, PLR $= 0.53$, and Forget Quality $= -9.43$; on WMDP-Cyber with Zephyr-7B-beta, it reports hazard score $25.30$ and MMLU $58.30$ with MMLU College CS $51.00$ and MMLU Cybersec $68.00$ [2602.01703]. The same paper attributes the stability gain to AO and the depth of erasure to AGT.

A complementary line emphasizes attack-driven evaluation. DUA automatically optimizes adversarial suffixes to recover forgotten knowledge, and LAU responds by injecting bounded perturbation vectors into latent states during unlearning, yielding AdvGA and AdvNPO [2408.10682]. The paper reports that unlearned knowledge can be recovered in $55.2\%$ of the questions, even without revealing the unlearned model’s parameters, and that LAU improves the unlearning effectiveness by over $53.5\%$, causes only less than a $11.6\%$ reduction in neighboring knowledge, and has almost no impact on the model’s general capabilities [2408.10682].

Diffusion-model concept erasure has produced an analogous adversarial training framework. AdvUnlearn casts robust concept erasure as bilevel optimization over adversarial prompts and diffusion-model parameters, adds a utility-retaining regularization on an LLM-filtered retain set, and finds the text encoder to be the more suitable module for robustification than the UNet [2405.15234]. On style unlearning for “Van Gogh,” AdvUnlearn reports ASR $= 2$, FID $= 16.96$, and CLIP $= 0.308$; on object unlearning for Church, it matches ScissorHands at ASR $= 6$ while retaining much better FID, $18.06$ versus $68.02$ [2405.15234].

Other generative settings generalize the adversarial idea in different ways. "Generative Adversarial Networks Unlearning" exploits the GAN game itself, using a substitution mechanism for generator continuity and a fake label for discriminator forgetting, then alternating unlearning and learning phases in a cascaded schedule [2308.09881]. On MNIST item unlearning with 64 items, few-shot cascaded unlearning changes AUC$_{l,u}$ from $0.51$ to $0.86$ in $360.84$ seconds, while retraining takes $66847.64$ seconds, a reported $185\times$ speedup [2308.09881]. In backdoor removal, BI-BAU formulates complete backdoor unlearning through catastrophic forgetting conditions and solves a blind inversion problem by integrating adversarial training into an EM algorithm; on CIFAR-10 ResNet-18 it reports average CA $\approx 85.60\%$ and ASR $\approx 1.41\%$ across eight attacks, with low post-purification reactivation rates [2606.14078].

Across these model classes, a common shift is visible: unlearning is evaluated not only by whether the forbidden content disappears on standard prompts, but by whether the content remains unrecoverable under optimized inputs or latent perturbations. This suggests a convergence between robust optimization and machine unlearning in foundation-model settings.

## 5. Adversarial evaluation, recovery, and attack surfaces

Adversarial unlearning has also become an evaluation problem. The Interclass Confusion test creates forget sets by swapping labels within a targeted class pair and then measures targeted error on both manipulated training data and unseen test samples from those classes [2201.06640]. The paper argues that residual targeted confusion is incompatible with model indistinguishability under any retraining procedure, and it uses this criterion to show that final-layer-only unlearning is insufficient. Its analytically motivated EU-k and CF-k baselines outperform several earlier inexact methods on the proposed test [2201.06640].

In LLMs, adversarial recovery has targeted both weights and activations. "An Adversarial Perspective on Machine Unlearning for AI Safety" shows that existing jailbreak methods can be successful when applied carefully and that adaptive methods such as activation-space projection and tiny finetuning can recover most supposedly unlearned capabilities [2409.18025]. For models edited with RMU, finetuning on 10 unrelated examples or removing specific directions in the activation space recovers most hazardous capabilities; on WMDP-Bio, activation orthogonalization restores RMU to $64.7\%$, exceeding the original $64.4\%$, while MMLU remains $57.3\%$ [2409.18025]. This directly challenges the claim that current unlearning methods are categorically different from safety post-training under an adversarial threat model.

Adversarial relearning has produced a related critique. Layered Unlearning partitions the forget set into folds and unlearns progressively larger unions while retaining the remaining folds, with the explicit aim of creating distinct inhibitory mechanisms that are harder to remove by later fine-tuning [2505.09500]. In synthetic 2D classification, standard unlearning allows A to rebound to $0.93$ when relearning B, whereas LU reduces that rebound to $0.30$; in bigram modeling, average transfer under relearning shrinks from approximately $+0.43$ to approximately $+0.17$ [2505.09500]. The paper interprets this as evidence against a single shared inhibitor model of post-training updates.

A further development is the attack surface created by the unlearning interface itself. "How to Protect Models against Adversarial Unlearning?" studies malicious unlearning requests designed to maximally deteriorate model performance and proposes Healing, a post-unlearning fine-tuning step on retained data and similarity-selected surrogate twins [2507.10886]. ROKA formalizes an indirect unlearning attack in which the attacker requests unlearning of one class to degrade performance on another security-critical class without poisoning or duplicating training data, then proposes Neural Healing and contribution re-allocation to counter knowledge contamination [2603.00436]. In graphs, unlearning corruption attacks inject nodes into the training graph and later request their deletion; on PubMed with GIF, the attack changes unlearned accuracy from approximately $0.835$ to approximately $0.244$, a reported $\Delta\mathrm{Acc} \approx 0.591$, while pre-unlearning utility remains near the unattacked model [2603.18570].

Domain adaptation adds a distinct leakage channel. SCADA-UL shows that source-free domain adaptation methods can retain zero-shot performance on source-exclusive classes in the target domain, then introduces adversarially generated forget-class samples and a rescaled labeling strategy to erase that leakage during adaptation [2604.08238]. On OfficeHome in the multi-class setting, the proposed method reports $A_{\mathcal{D}_r^\mathcal{T}} = 75.1 \pm 1.3$, $A_{\mathcal{D}_f^\mathcal{T}} = 0.0 \pm 0.0$, and Unlearn Score $= 0.75$, close to retraining at $0.76$ [2604.08238].

These results have made adversarial evaluation central to the field. A plausible implication is that approximate unlearning cannot be assessed solely by low forget-set accuracy or a single membership-inference score; its security meaning depends on whether the erased information remains recoverable through optimized prompts, latent edits, benign-looking relearning data, or legally mandated deletions.

## 6. Defensive strategies and open directions

Defensive work has increasingly shifted from purely destructive updates to explicit preservation mechanisms. Healing fine-tunes on retained data and on selected twins from a spare set or a pre-associated “Twins Strategy,” with Adam at learning rate $10^{-3}$ for either 1 epoch or $N/2$ epochs [2507.10886]. In targeted deletions of 25 images from one class, CIFAR-10 ResNet-50 healing reaches $91.41\%$ with raw-$L2$ twins after $N/2$ epochs, compared with Gold at $90.97\%$, while AFHQ EfficientNet-B0 reaches $99.73\%$ versus Gold at $99.40\%$ [2507.10886]. The paper presents this as a pragmatic performance-protection layer rather than a certified defense.

ROKA takes a more structural approach by modeling networks as Neural Knowledge Systems and defining Knowledge Contamination through a leverage-weighted destruction threshold on shared parameters [2603.00436]. Its practical objective is
$$
\mathcal{L}_{\text{unlearn}} = \mathcal{L}_{\text{forget}} - \alpha \cdot \mathcal{L}_{\text{heal}},
$$
with sibling identification implemented through $Input \cdot Gradient$ LRP and self-distillation on conceptual neighbors [2603.00436]. On CIFAR-100 zero-shot CLIP-base/32 targeted unlearning, it reports Unlearned mTA $= 0.0$ and Unlearned mRA $= 0.8057$, which the paper interprets as complete forgetting with improved retention [2603.00436].

Robust unlearning in safety-critical settings has also converged on adversarial training. BI-BAU states complete backdoor unlearning as zero catastrophic forgetting on clean inputs and anti-drift on poisoned inputs, derives necessary alignment and orthogonality conditions under an NTK-style continual-learning view, and implements them through adversarial training with knowledge distillation, feature-space priors, and EWC-style penalties [2606.14078]. AdvUnlearn in diffusion models, AGT$^{AO}$ in LLMs, and LAU’s latent perturbation training all fit the same pattern: adversarial inner loops expose recoverable directions, and retain-side regularization prevents the defense from collapsing benign utility [2405.15234, 2602.01703, 2408.10682].

Several open directions recur across these papers. ARU explicitly lists certified unlearning, probabilistic masks, adaptive adversarial curricula, and integration with differential privacy [2401.08998]. AGT$^{AO}$ highlights stronger adversaries, continual and multi-target unlearning, multimodal extensions, privacy integration, and adaptive $K$, $\epsilon$, and gate policies [2602.01703]. The domain-adaptation setting identifies the difficulty of unknown forget classes under distribution shift [2604.08238], and the graph setting points to hardened deletion workflows, anomaly detection, and sensitivity-regularized unlearning as practical needs under GDPR- and CCPA-like constraints [2603.18570].

Adversarial unlearning therefore sits at the intersection of privacy, robustness, and model editing. The field no longer treats forgetting as a single post-hoc optimization step; it treats it as an adversarially contested transformation whose success depends on the strength of the attacker used during training, the strength of the attack used during evaluation, and the extent to which the system preserves benign knowledge while eliminating recoverable traces of the forget set.

Source: https://www.emergentmind.com/topics/adversarial-unlearning