💻 computer science

RUB: Evaluating Residual Knowledge in Unlearned Models

This paper introduces RUB, a unified benchmark and the Unlearning Mapping Attack (UMA) to evaluate the robustness of machine unlearning against adversarial recovery attempts, revealing that current state-of-the-art methods remain vulnerable despite passing standard verification metrics.

Original authors: Hao Xuan, Xingyu Li

Published 2026-06-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Hao Xuan, Xingyu Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart student who has memorized a massive library of books. One day, you ask this student to "unlearn" a specific set of books—perhaps because they contain sensitive secrets or copyrighted material. You want the student to forget them completely, as if they never existed in their mind.

This paper introduces a new way to test if the student has actually forgotten those books, or if they are just pretending.

The Problem: The "Fake Forget"

Currently, there are many computer programs (called "Machine Unlearning" techniques) designed to make AI models delete specific information. Most tests for these programs are like asking the student, "Do you remember the book about the red castle?" If they say "No," the test says they passed.

But the authors of this paper argue that this isn't enough. A sneaky attacker (or a clever trick) might be able to ask the student a slightly different question, or show them a picture with a tiny, almost invisible scratch on it, and the student might suddenly remember the red castle. The paper calls this "Residual Knowledge"—the idea that the information is still hiding in the model, waiting to be dug up.

The Solution: The "RUB" Benchmark

To fix this, the authors created a new testing ground called RUB (Robust Unlearning Benchmark). Think of RUB as a rigorous "interrogation room" for AI models.

Instead of just asking, "Did you forget?", RUB sends in a team of professional "memory detectives" (adversarial attacks) to try and trick the model into remembering the forbidden information. If the model slips up and reveals the secret, even a little bit, it fails the test.

How They Tested It

The authors tested this on three different types of AI "students":

The Classifier (The Sorter): Imagine an AI that sorts photos into categories like "Dog" or "Cat." They asked it to forget the "Dog" category.
- The Test: They showed the AI photos of dogs with tiny, almost invisible changes (like a few pixels shifted).
- The Result: Even though the AI claimed to have forgotten dogs, the "detectives" could tweak the photos slightly, and the AI would suddenly start identifying them as dogs again.
The Image Restorer (The Painter): Imagine an AI that can fill in missing parts of a picture (like a puzzle). They asked it to forget how to draw a specific type of building.
- The Test: They gave the AI a picture of that building with a big black box over it and asked it to fill in the blank.
- The Result: When the AI was attacked with a specific "trick" input, it successfully filled in the missing building, proving it hadn't really forgotten how to draw it.
The Text-to-Image Generator (The Dreamer): Imagine an AI that draws pictures based on text descriptions (like "a church in the countryside"). They asked it to forget the concept of "churches."
- The Test: They tried to trick the AI with weird, modified text prompts to see if it would still draw a church.
- The Result: Most of the "unlearning" methods failed. The AI could be coaxed into drawing the forbidden church with just a few attempts.

The Big Discovery

The paper found a surprising gap: Most current methods are good at "looking" like they forgot, but bad at actually being robust.

The Gold Standard: The only method that truly worked was "retraining from scratch" (essentially firing the student and hiring a new one who never read the forbidden books). This is perfect but very expensive and slow.
The Current Methods: The fancy, fast "unlearning" tricks are vulnerable. They pass the easy tests but fail the "detective" tests. They are like someone who memorizes a list of things to forget but keeps a secret note in their pocket that they can read if someone asks the right question.

The New Rule: "Robust Unlearning"

The authors propose a new rule for the future. An AI shouldn't just be considered "unlearned" if it passes a simple check. It must be Robust.

This means the AI must be unable to reveal the forgotten information, even if a clever attacker tries every trick in the book to force it to remember. If the AI can be tricked into remembering, the unlearning process has failed.

Summary

In short, this paper says: "Don't just trust that the AI forgot. Test it with a sledgehammer to see if the memory is really gone." They built a new toolbox (RUB) to do exactly that, showing that right now, most AI "forgetting" tools are too fragile to be truly secure.

Technical Summary: RUB: Evaluating Residual Knowledge in Unlearned Models

Problem Statement
Machine Unlearning (MUL) has emerged as a critical mechanism for privacy protection (e.g., GDPR, CCPA compliance) and content regulation, aiming to selectively remove specific data influences from trained models. While existing techniques focus on verifying the execution of unlearning—ensuring the model behaves similarly to one retrained from scratch on the retain set—they largely overlook a critical security gap: robustness against adversarial recovery. Current methods often fail to guarantee the complete removal of sensitive information, leaving "residual knowledge" that adversaries can exploit. Prior research has shown that unlearned models, particularly in diffusion models (DMs) and large language models (LLMs), can be manipulated via crafted inputs (e.g., adversarial prompts or noise) to resurface forgotten data, effectively negating the unlearning process. There is a lack of a unified framework to systematically evaluate this vulnerability across diverse computer vision tasks.

Methodology: The RUB Framework
To address this gap, the authors propose RUB (Robust Unlearning Benchmark), a unified framework designed to evaluate the robustness of unlearning algorithms against post-unlearning adversarial information resurfacing.

Core Principle (Robust Unlearning): The paper defines "Robust Unlearning" as a process where an unlearned model is not only indistinguishable from a retrained counterpart on the retain set but also resilient against adversarial attempts to recover forgotten information. Formally, for any data point $x$ in the forget set $D_u$ and any adversarial perturbation $\delta_x$ , the unlearned model $f_u$ must maintain a significant divergence from the original model's output regarding $x$ , even under attack.
Unlearning Mapping Attack (UMA): The authors introduce UMA as a generalizable, modular adversarial probing tool. UMA is defined as an attack strategy that modifies the input to a model to cause the output to reveal or approximate information intended to be removed.
- Formulation: In a white-box setting (assuming full access to the original and unlearned models), UMA seeks to find an optimal perturbation $\delta_i$ that minimizes the distance between the unlearned model's output on the perturbed input and the original model's output on the original forget data: $\arg \min_{\delta_i} D[f_u(\delta_i, \theta_u), f(x_i, \theta)]$ .
- Task-Specific Instantiation:
  - Discriminative Tasks: Uses KL Divergence on logits.
  - Image-to-Image (I2I): Uses Mean Square Error (MSE) for reconstruction.
  - Text-to-Image (T2I): Leverages the diffusion process's noise level estimation, optimizing over diffusion steps to recover the target concept.
Benchmark Scope: RUB evaluates 15 state-of-the-art unlearning algorithms across three distinct computer vision tasks:
- Image Classification: Datasets include CIFAR10, CIFAR100, and Tiny-ImageNet.
- Image-to-Image Reconstruction: Uses ImageNet-1k with a Masked AutoEncoder (MAE) setup.
- Text-to-Image Synthesis: Evaluates diffusion models on concepts like "Church," "Garbage Truck," "Nudity," etc., using the UnlearnDiffAtk codebase.
Evaluation Metrics: The benchmark employs task-specific metrics:
- Classification: Unlearning Accuracy (UA, defined as raw accuracy on the forget set, where lower is better), Membership Inference Attack (MIA) success rate, and Test Accuracy (TA) to measure utility trade-offs.
- I2I: Inception Score (IS) and Fréchet Inception Distance (FID).
- T2I: Attack Success Rate (ASR) and the number of optimization steps required to achieve a successful attack.

Key Results
Extensive experiments across 15 unlearning methods reveal significant vulnerabilities:

Discriminative Tasks: While retraining (the gold standard) achieves strong robustness, existing unlearning methods (e.g., FT, RL, IU, SalUn) show varying degrees of vulnerability. As dataset complexity increases (from CIFAR10 to Tiny-ImageNet), both unlearning efficacy and robustness drop drastically. Many methods that pass standard verification metrics fail completely under adversarial probing, with high UA and MIA scores under attack.
I2I Tasks: Unlearned models often fail to reconstruct images from the forget set under normal conditions but can be coerced into generating high-quality reconstructions of the forgotten content when provided with adversarial inputs. Small noise perturbations are often sufficient to bypass the unlearning mechanism.
T2I Tasks: Despite demonstrating strong initial unlearning efficacy, most diffusion-based unlearning methods (e.g., AdvUnlearn, EraseDiff, ESD) exhibit limited robustness. Adversarial attacks successfully recover forgotten concepts with varying degrees of difficulty (measured by attack steps), indicating that residual knowledge persists.
General Finding: A consistent gap exists between "unlearning efficacy" (performance on standard metrics) and "unlearning robustness." Most current methods are not resilient to adversarial recovery strategies.

Significance and Claims
The paper positions Robustness as the central criterion for evaluating machine unlearning, arguing that passing standard verification is insufficient if the model remains vulnerable to adversarial recovery.

First Comprehensive Benchmark: RUB is presented as the first framework to systematically evaluate unlearning algorithms against post-unlearning adversarial recovery across diverse vision tasks.
Unified Protocol: It provides a standardized, extensible protocol (UMA) to empirically verify whether unlearning methods truly eliminate residual knowledge.
Research Direction: The authors claim that their findings highlight fundamental weaknesses in current unlearning methods, urging the community to move beyond mere efficacy and explicitly incorporate robustness considerations into the design of future unlearning algorithms. The goal is to pave the way for more reliable and secure unlearning practices that can withstand malicious attempts to recover forgotten information.

The paper concludes that while current methods offer a starting point, they are not yet robust enough for high-stakes privacy and content regulation scenarios, and RUB serves as a necessary tool to drive the development of truly resilient unlearning techniques.