🤖 machine learning

DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning

This paper reveals that INT4 quantization systematically restores forgotten data in machine unlearning, exposing a fundamental trade-off between forgetting, utility, and robustness, and proposes the DURABLEUN-SAF method to achieve stable unlearning across both high- and low-precision deployments.

Original authors: Abdullah Ahmad Khan, Ferdous Sohel

Published 2026-05-11

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Abdullah Ahmad Khan, Ferdous Sohel

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Right to be Forgotten" vs. The "Magic Eraser" Problem

Imagine you have a giant library (a Large Language Model or LLM) that contains every book ever written. You have a legal right (like GDPR) to say, "Please remove all books written by Author X."

Machine Unlearning is the technology used to try and delete those specific books without having to rebuild the entire library from scratch.

The Problem: The researchers found that the current "Magic Erasers" used to delete this data are flawed. They work perfectly when you look at the library in high definition (full precision), but if you shrink the library down to fit on a small device (low-bit quantization), the deleted books magically reappear on the shelves.

The Core Discovery: The "Quantization Recovery Attack" (QRA)

The paper introduces a new way data can leak, called the Quantization Recovery Attack.

The Analogy: Imagine you have a detailed painting of a face. You use a special solvent to scrub the eyes out of the painting. In the high-resolution studio (BF16), the eyes are gone. The painting passes the inspection.
The Twist: Now, imagine you photocopy that painting onto a cheap, low-quality printer to save ink (this is INT4 quantization, used to make AI run fast on phones).
The Result: Because of how the cheap printer processes the ink, the "scrubbed" areas don't stay blank. The ink smudges in a specific way that accidentally reconstructs the eyes. The deleted information comes back, even though the painting looked clean before.

The authors call this QRA. They found that while deleting data works at full precision, compressing the model to 4-bit precision (a standard for real-world apps) systematically restores the forgotten information.

The "Trilemma": The Impossible Triangle

The researchers discovered a structural problem they call the FA–RA–Q-INT4 Trilemma. Think of this as trying to balance three plates on a stick, where you can only ever hold two at once:

Forget (FA): Successfully delete the specific data.
Retain (RA): Keep the model smart and useful for everything else.
Robustness (Q-INT4): Ensure the data stays deleted even when the model is compressed for deployment.

The Finding: No existing method can do all three.

If you try to delete the data well, the model becomes fragile. When you compress it, the data comes back.
If you try to make the model robust against compression, you accidentally destroy its ability to remember useful things (it becomes "dumb").
If you keep the model smart, it fails to delete the data effectively when compressed.

The paper shows a "sharp phase transition": once you tune the system to be robust enough to stop the data from coming back, the model's general intelligence collapses instantly. It's not a smooth trade-off; it's a cliff.

The Solution: DURABLEUN-SAF

To fix this, the authors proposed a new method called DURABLEUN-SAF (Sharpness-Aware Forgetting).

How it works: Instead of just scrubbing the data, this method trains the model to be "flat" in the areas where the data was deleted.
The Analogy: Imagine the deleted data is a hole in a trampoline. Standard methods just fill the hole with sand. If you jump on the trampoline (compress the model), the sand shifts, and the hole reappears.
The Fix: DURABLEUN-SAF doesn't just fill the hole; it reinforces the entire trampoline fabric around the hole so that no matter how you jump or stretch it (compress it), the hole stays closed.

The Result: This is the first method that successfully passes a "Durability Certificate." It proves that the data is gone in high definition, 8-bit, and 4-bit versions. However, there is a catch: to achieve this perfect security, the model loses a significant amount of its general intelligence (Retain Accuracy drops), confirming the "Trilemma" is real and hard to break.

Why This Matters

Current Audits are Flawed: Regulators currently check if a model has deleted data at full precision. This paper says that's not enough. A model can pass a privacy audit and still violate privacy the moment it's deployed on a phone or server using standard compression.
It's Not Just a Bug, It's a Feature of the Math: The authors show this isn't a mistake in the code; it's a fundamental mathematical tension between deleting specific memories and keeping the model smart while compressing it.
A New Standard: The authors argue that we must start testing AI models at 4-bit precision (INT4) to see if they truly forget, not just at full precision.

Summary in One Sentence

The paper reveals that standard methods for deleting private data from AI models fail when the models are compressed for real-world use, and while a new method can fix this, it currently forces a difficult choice between total privacy and keeping the AI smart.

Technical Summary: DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning

1. Problem Statement

Machine unlearning aims to remove specific training data from models to comply with privacy regulations like the GDPR. However, current evaluation protocols suffer from a critical "deployment gap." Standard evaluations assume that the precision used during the unlearning audit (typically bfloat16 or BF16) matches the precision used in production. In reality, Large Language Models (LLMs) are frequently deployed at low-bit precision (INT4 or INT8) to reduce memory footprint and improve inference speed.

The authors identify that this precision mismatch creates a systematic vulnerability: a model may successfully "forget" data at BF16 (passing a privacy audit with near-zero forget accuracy, FA $\approx$ 0), but when quantized to INT4 for deployment, the forgotten information systematically reappears in the model's outputs. The authors term this phenomenon the Quantization Recovery Attack (QRA). This is not merely a new attack variant but a fundamental validity failure in current evaluation protocols, where models certified as compliant provably violate privacy under standard deployment transformations.

2. Methodology and Setup

Experimental Regime

The study focuses on the NF4+LoRA deployment paradigm, where a model is loaded in NormalFloat4 (NF4) precision, and Low-Rank Adaptation (LoRA) adapters are trained in BF16. This is a common setup for efficient fine-tuning and deployment.

Models: LLaMA-3-8B-Instruct (primary) and Mistral-7B-Instruct (for generalization).
Datasets: TOFU (fictitious authors), MUSE-News (real-world news), and WikiBio-WPU (historical figures).
Baselines: Seven established unlearning methods were evaluated: Gradient Ascent (GA), Negative Preference Optimization (NPO), SCRUB, SalUn, Representation Manipulation Unlearning (RMU), AlphaEdit, and GradDiff.
Quantization Simulation: The authors simulate INT4 and INT8 quantization on the LoRA adapter weights using a per-row symmetric quantization scheme. They validate this simulator against real bitsandbytes Post-Training Quantization (PTQ) on merged models.

The Proposed Solution: DURABLEUN-SAF

To address the vulnerability, the authors propose DURABLEUN-SAF (Sharpness-Aware Forgetting).

Core Insight: Standard gradient ascent (GA) creates a "sharp" loss landscape for the forget objective. While the model forgets at full precision, the loss landscape is steep, meaning small perturbations (like INT4 quantization noise) easily push the model back into a "remembering" state.
Mechanism: DURABLEUN-SAF introduces a quantization-aware objective that uses a Straight-Through Estimator (STE) to compute gradients through the INT4 rounding operation. The objective function combines three terms:
1. Standard forget loss ( $L_f$ ).
2. Quantization-aware forget loss ( $L_f(Q_{STE}(\theta))$ ), which forces the model to forget even under simulated INT4 perturbation.
3. Retain loss ( $L_r$ ) to preserve utility.
Training Strategy: The method employs a warm-up schedule for the quantization-aware term and dynamically adjusts the retain balance ( $\lambda$ ) based on the quantization weight ( $\alpha$ ).

3. Key Findings and Results

The FA–RA–Q-INT4 Trilemma

The study identifies a structural constraint termed the FA–RA–Q-INT4 Trilemma: No evaluated configuration simultaneously achieves:

Strong Forgetting (FA $\le$ 0.05).
High Utility (Retain Accuracy, RA $\ge$ 0.50).
Quantization Robustness (Q-INT4 $\le$ 0.05).

Through a dense Pareto sweep, the authors observe a sharp phase transition. As the quantization pressure ( $\alpha$ ) increases to achieve robustness (Q-INT4 < 0.05), the retain accuracy (RA) collapses abruptly (e.g., from ~0.52 to ~0.045) and cannot be recovered by further tuning. This suggests the trilemma is a consequence of shared weight space in the NF4+LoRA regime, not a hyperparameter artifact.

Quantization Recovery Attack (QRA)

INT8 is Benign: Across all 7 baselines, INT8 quantization resulted in Q-INT4 = 0.000, indicating that 8-bit precision is too precise to cause recovery.
INT4 is Catastrophic: INT4 quantization systematically restored forgotten content. For methods that achieved good forgetting at BF16 (FA < 0.05), the recovery was severe:
- GradDiff: FA 0.008 $\to$ Q-INT4 0.151 (18.9 $\times$ recovery).
- GA: FA 0.028 $\to$ Q-INT4 0.262 (9.4 $\times$ recovery).
- SalUn: FA 0.011 $\to$ Q-INT4 0.051 (4.6 $\times$ recovery).
Dataset Difficulty: The severity of the attack scales with dataset difficulty. On the harder MUSE-News dataset, standard methods failed to forget entirely, while on the simpler WPU dataset, some baselines passed the certificate without DURABLEUN-SAF.

DURABLEUN-SAF Performance

DURABLEUN-SAF is the only method to achieve a stable empirical durability certificate.

Certificate Definition: A model is $(\epsilon, P)$ -durable if its forget accuracy remains $\le \epsilon$ across all precisions in set $P$ (BF16, INT8, INT4).
Results: DURABLEUN-SAF ( $\alpha=3$ ) achieved a cert rate of 3/3 across three random seeds with a Q-INT4 of $0.043 \pm 0.002$ .
Comparison: In contrast, SalUn (even at its own published hyperparameters) achieved a cert rate of only 1/3 with higher variance.
Trade-off: While DURABLEUN-SAF achieves the certificate, it suffers the same RA collapse observed in the trilemma (RA $\approx$ 0.045), confirming that the method successfully navigates the trade-off but cannot currently overcome the structural limit of retaining high utility while ensuring INT4 robustness.

4. Significance and Claims

The paper claims to make the following contributions:

Identification of a Deployment Gap: It demonstrates that current unlearning evaluations are fundamentally flawed because they ignore the standard practice of INT4 deployment, leading to false positives in privacy compliance.
The Trilemma: It establishes the FA–RA–Q-INT4 trilemma as a structural constraint in the NF4+LoRA regime, characterized by a sharp phase transition rather than a smooth trade-off.
First Durability Certificate: It introduces the first formal empirical durability certificate for machine unlearning under quantization, validated across multiple seeds and datasets.
A Viable Solution: It proposes DURABLEUN-SAF, the first method to consistently achieve this certificate, proving that quantization-aware forgetting is possible, even if it currently comes at the cost of retain accuracy.
Call to Action: The authors advocate for Q-INT4 (forget accuracy under INT4 quantization) to be adopted as a standard evaluation metric alongside FA and RA. They argue that any unlearning method claiming GDPR compliance must demonstrate robustness at INT4, as quantization is a "one-line" operation for downstream users that requires no training data to recover forgotten information.

The paper concludes that while DURABLEUN-SAF provides a path to certification, the collapse of retain accuracy remains an open problem, suggesting that future work must address the geometric incompatibility between strong quantization robustness and high utility in shared weight spaces.