Paper deep dive
Towards Benchmarking Privacy Vulnerabilities in Selective Forgetting with Large Language Models
Wei Qian, Chenxu Zhao, Yangyi Li, Mengdi Huai
Models: GPTNeo, Llama, ResNet variants
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 97%
Last extracted: 3/11/2026, 1:10:49 AM
Summary
The paper introduces PrivUB, the first comprehensive benchmark for evaluating privacy vulnerabilities in machine unlearning (selective forgetting). It systematically categorizes privacy risks—including membership inference, data reconstruction, and knowledge leakage—across various models, datasets, and unlearning techniques, while also evaluating existing defense mechanisms.
Entities (6)
Relation Signals (3)
PrivUB → evaluates → Machine Unlearning
confidence 100% · we in this paper introduce the first comprehensive benchmark PrivUB... that systematically evaluates existing privacy vulnerabilities introduced by machine unlearning.
Machine Unlearning → introduces → Privacy Vulnerability
confidence 95% · adopting machine unlearning techniques may not always provide the anticipated privacy protections, and could even introduce new privacy vulnerabilities.
Membership Inference Attack → targets → Unlearning Data
confidence 95% · Membership inference attacks for the unlearning data Du.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The rapid advancements in artificial intelligence (AI) have primarily focused on the process of learning from data to acquire knowledgeable learning systems. As these systems are increasingly deployed in critical areas, ensuring their privacy and alignment with human values is paramount. Recently, selective forgetting (also known as machine unlearning) has shown promise for privacy and data removal tasks, and has emerged as a transformative paradigm shift in the field of AI. It refers to the ability of a model to selectively erase the influence of previously seen data, which is especially important for compliance with modern data protection regulations and for aligning models with human values. Despite its promise, selective forgetting raises significant privacy concerns, especially when the data involved come from sensitive domains. While new unlearning-induced privacy attacks are continuously proposed, each is shown to outperform its predecessors using different experimental settings, which can lead to overly optimistic and potentially unfair assessments that may disproportionately favor one particular attack over the others. In this work, we present the first comprehensive benchmark for evaluating privacy vulnerabilities in selective forgetting. We extensively investigate privacy vulnerabilities of machine unlearning techniques and benchmark privacy leakage across a wide range of victim data, state-of-the-art unlearning privacy attacks, unlearning methods, and model architectures. We systematically evaluate and identify critical factors related to unlearning-induced privacy leakage. With our novel insights, we aim to provide a standardized tool for practitioners seeking to deploy customized unlearning applications with faithful privacy assessments.
Tags
Links
- Source: https://arxiv.org/abs/2512.18035
- Canonical: https://arxiv.org/abs/2512.18035
Trouble viewing inline? Open PDF directly →
Full Text
53,304 characters extracted from source content.
Expand or collapse full text
Towards Benchmarking Privacy Vulnerabilities in Selective Forgetting with Large Language Models Wei Qian * 1 , Chenxu Zhao * 1 , Yangyi Li 1 , Mengdi Huai 1 1 Iowa State University wqi, cxzhao, liyangyi, mdhuai@iastate.edu Abstract The rapid advancements in artificial intelligence (AI) have primarily focused on the process of learning from data to ac- quire knowledgeable learning systems. As these systems are increasingly deployed in critical areas, ensuring their privacy and alignment with human values is paramount. Recently, se- lective forgetting (also known as machine unlearning) has shown promise for privacy and data removal tasks, and has emerged as a transformative paradigm shift in the field of AI. It refers to the ability of a model to selectively erase the in- fluence of previously seen data, which is especially important for compliance with modern data protection regulations and for aligning models with human values. Despite its promise, selective forgetting raises significant privacy concerns, espe- cially when the data involved come from sensitive domains. While new unlearning-induced privacy attacks are continu- ously proposed, each is shown to outperform its predeces- sors using different experimental settings, which can lead to overly optimistic and potentially unfair assessments that may disproportionately favor one particular attack over the others. In this work, we present the first comprehensive benchmark for evaluating privacy vulnerabilities in selective forgetting. We extensively investigate privacy vulnerabilities of machine unlearning techniques and benchmark privacy leakage across a wide range of victim data, state-of-the-art unlearning pri- vacy attacks, unlearning methods, and model architectures. We systematically evaluate and identify critical factors re- lated to unlearning-induced privacy leakage. With our novel insights, we aim to provide a standardized tool for practi- tioners seeking to deploy customized unlearning applications with faithful privacy assessments. Introduction In recent years, artificial intelligence (AI) has revolutionized nearly every aspect of modern life. In an era of AI, the pri- mary challenge is enabling models to acquire broad knowl- edge effectively. However, the training datasets employed in training these models often contain sensitive information en- compassing private and copyrighted content (Bu et al. 2024; Mueller et al. 2024; Chu, Song, and Yang 2024; Wei et al. 2024). This situation raises significant risks of sensitive data leakage, directly conflicting with the growing legislative em- * These authors contributed equally. Copyright © 2026, Association for the Advancement of Artificial Intelligence (w.aaai.org). All rights reserved. phasis on the “right to be forgotten” (Bukaty 2019; Reg- ulation 2018). Instances such as the proliferation of copy- right infringement cases post the release of models (Rom- bach et al. 2022), and The New York Times’s lawsuit against OpenAI for content leakage (Hadero and Bauder 2023), un- derscore the urgency of addressing these issues. In response to these challenges, selective forgetting (also referred to as machine unlearning) (Li et al. 2025; Zhang et al. 2024; Qian et al. 2023; Zhao et al. 2023; Qian et al. 2022; Bourtoule et al. 2021) has emerged as a promising so- lution. Selective forgetting aims to compel models to forget sensitive information without retraining, thereby eliminating the risk of content leakage. In contrast, retraining models from scratch to accommodate deletions is impractical due to the extensive computational resources required. Machine unlearning aims to remove the influence of the requested un- learning data from a pre-trained model, producing an un- learned model that approximates one retrained from scratch using only the retain data (i.e., the original training data ex- cluding the unlearning set). Recent work also leverages con- formal prediction (Li and Huai 2025) to quantify forgetting uncertainty, leading to more rigorous unlearning (Alkhatib and Tay 2025). Machine unlearning not only aids in meeting regulatory requirements but also enhances learning systems’ privacy protection by sensitive data attacks. However, adopting machine unlearning techniques may not always provide the anticipated privacy protections, and could even introduce new privacy vulnerabilities. First, for the requested unlearning data, machine unlearning naturally generates two versions of machine learning models, namely the original model and the unlearned model, which differ due to the deletion of the unlearning data. This discrep- ancy can inadvertently leak information about the unlearned data. Additionally, the unlearned model alone may still re- tain residual privacy risks related to the requested unlearning data due to incomplete forgetting. Moreover, the privacy of the unlearning data may be further compromised when the unlearned model is subjected to future deployment scenarios such as fine-tuning, which may reactivate or amplify mem- orized knowledge. Even worse, beyond the privacy risks of the unlearning data, selective forgetting may also influence the retain data, potentially altering their privacy exposure through model shifts or malicious fingerprints. These con- cerns highlight that selective forgetting may introduce new arXiv:2512.18035v1 [cs.LG] 19 Dec 2025 privacy attack surfaces that adversaries can exploit, poten- tially undermining the guarantees associated with unlearn- ing requests or compromising the privacy of other data. Currently, many works have been proposed to investigate privacy risks stemming from selective forgetting (Hu et al. 2025; Łucki et al. 2025; Zhang et al. 2025; Yuan et al. 2025; Wang et al. 2025a; Hu et al. 2024; Carlini et al. 2022b; Lu et al. 2022a; Chen et al. 2021). For example, (Hu et al. 2024) examines data reconstruction attacks (DRAs) on unlearning data by leveraging the discrepancy between the pre-trained and unlearned models. However, there still lacks a structured understanding of the empirical privacy risks of machine un- learning techniques. Without a clear understanding of the practical risks, practitioners are left with little guidance on how to safely and privately apply machine unlearning tech- niques in privacy-sensitive settings. Additionally, existing unlearning-induced privacy attacks are typically evaluated under disparate experimental settings, with varying exper- imental settings. As a result, each of them is often shown to outperform prior methods under its own tailored condi- tions, leading to overly optimistic and potentially inconsis- tent evaluations that may unfairly favor certain attacks. Con- sequently, an in-depth investigation into the effectiveness of unlearning-induced privacy vulnerabilities in a standard and reproducible experimental setting is missing. To address these limitations, we in this paper introduce the first comprehensive benchmark PrivUB, i.e., Privacy Vul- nerabilities in Machine Unlearning Benchmark. This work makes four major contributions: (1) We present the first benchmark that systematically eval- uates existing privacy vulnerabilities introduced by machine unlearning. Our benchmark emphasizes the importance of aligning privacy guarantees with human intent, highlighting gaps between technical implementations and user expecta- tions. Our benchmark reveals fundamental challenges in un- learning and provides a critical foundation for understanding its implications in the context of emerging data protection regulations and broader challenges in AI alignment. (2) We instantiate a structured taxonomy of privacy vulner- abilities in machine unlearning by implementing represen- tative attacks across key dimensions, including privacy vul- nerability type, victim data type, victim model type, and at- tacking tool. Each is grounded with a specific threat model. (3) We evaluate existing defense methods targeting privacy risks in machine unlearning, analyzing their effectiveness in a structured manner across different types of privacy vulner- abilities, victim data, victim model, and attacking tool. (4) Through extensive empirical studies, we conduct a com- prehensive evaluation covering 21 unlearning-induced pri- vacy attack and defense methods in machine unlearning, 11 real-world datasets, 10 mainstream models, 10 popular un- learning techniques, and 10 task-specific evaluation metrics. We present a thorough analysis of the above evaluations from different perspectives to examine privacy vulnerabil- ities introduced by selective forgetting. Our key findings include: (1) Combining multiple attacking tools (including perturbing unlearned model and perturbing unlearned data) can improve attack effectiveness. (2) The attacking tools of perturbing unlearned data designed for knowledge leakage attacks can be utilized to further enhance the performance of membership inference attacks (MIAs). (3) The privacy risks caused by the fine-tuning method are more severe than those caused by the model quantization method. (4) Exist- ing privacy attacks, with proper adaptation, can be success- fully generalized across model types. Notably, we find that attacks originally developed for deep learning models can be applied to large language models (LLMs), and vice versa, while maintaining strong performance. (5) Existing defenses against privacy vulnerabilities generally lack robustness. In particular, some defenses are highly sensitive to the number of attack samples, leading to inconsistent protection. Related Work The rapid development of machine learning models has sig- nificantly benefited various applications. However, their in- creasing deployment has raised serious privacy concerns, particularly in sensitive domains such as healthcare and finance. Notably, models often unintentionally memorize their training data, going beyond merely learning the general patterns within the data. This behavior makes models vulner- able to various privacy attacks, including membership infer- ence attacks (Zhao et al. 2025; Carlini et al. 2022a; Chen et al. 2021), data reconstruction attacks (Hu et al. 2024; Du et al. 2024; Yuan et al. 2023), and knowledge leakage at- tacks (Hu et al. 2025; Łucki et al. 2025; Yuan et al. 2025). Currently, many privacy benchmarks have been proposed to investigate privacy risks associated with machine learning models (Niu et al. 2025; Wen et al. 2025; Chen et al. 2025; Zhu et al. 2024; Li et al. 2023; Song and Mittal 2021). For example, (Niu et al. 2025) presents a systematic comparison of various membership inference attacks using carefully de- signed evaluation scenarios. Rigorous privacy evaluation is essential for identifying vulnerabilities in models, and devel- oping a comprehensive understanding of existing research gaps and potential mitigation strategies, thereby promoting alignment with privacy principles and human values. In this work, we aim to benchmark privacy vulnerabilities in selec- tive forgetting. This is the first benchmark to systematically study the unlearning-induced privacy attacks and defenses. Benchmark Framework Setup of Privacy Evaluation Let f (·;θ) denote the pre-trained model, where θ ∈ Θ de- notes the model parameters. Let D = (x i ,y i ) n i=1 denote a dataset of n samples drawn from an underlying distribu- tion P over X ×Y . Note that during the training phase, a training algorithm T maps the training datasetD to param- eters θ, yielding the pre-trained model. During the unlearn- ing phase, the pre-trained model is updated by an unlearning algorithm U , which aims to remove the influence of the re- quested unlearning data, which is typically a subset of the training data D. During the deployment phase, the model can be further modified via a fine-tuning procedure F on task-specific data, or a quantization operator Q, which com- presses the parameters θ for efficient inference. Below, we elaborate the unlearning phase and the deployment. Privacy vulnerability type Victim data type Victim model type Attacking tool Paper Threat model Architecture Model access information A V Membership inference Unlearning data Pre-trained and unlearned models Pre-trained and unlearned model discrepancy (Chen et al. 2021) Posterior/ Top-k posterior/ Label-only Yes Yes Deep learning (Lu et al. 2022a)Label onlyYes Yes Deep learning (Lu et al. 2022b)Label onlyYes Yes Deep learning (Du et al. 2024)LossNo NoLLM Retain data Unlearned model Malicious unlearning subset (Carlini et al. 2022b)Model weights No Yes Deep learning (Gu, He, and Chen 2024)Model weights No Yes Deep learning Data reconstruction Unlearning data Pre-trained and unlearned models Pre-trained and unlearned model discrepancy (Hu et al. 2024)Model weights No Yes Deep learning (Du et al. 2024)Model weights No YesLLM (Wang et al. 2025a)PosteriorYes Yes Deep learning Knowledge leakage Unlearning data Fine-tuned model Perturbing unlearned model (Doshi and Stickland 2024) Model weights No YesLLM (Hu et al. 2025)Model weights No YesLLM (Zhang et al. 2025)Model weights No YesLLM (Łucki et al. 2025)Model weights No YesLLM Unlearned model Perturbing unlearned data (Doshi and Stickland 2024) Model weights No YesLLM (Xuan and Li 2025)Model weights No Yes Deep learning (Hsu et al. 2025)Model weights No Yes Deep learning (Yuan et al. 2025)Model weights No YesLLM Table 1: Categories of existing privacy vulnerabilities in selective forgetting. A: auxiliary dataset; V: victim model architecture. Note that the goal of machine unlearning is to remove the influence of a designated subset of the training data from a pre-trained model via the targeted unlearning pro- cess. Let D u ⊂ D denote the subset of data to be un- learned, with |D u | = m. Given a model with parameters θ ∈ Θ, obtained via training on D, an unlearning algo- rithm U : Θ × (X × Y) n × (X × Y) m → Θ maps the pre-trained model, the full training dataset D, and the un- learning data D u to an updated model θ u ∈ Θ. We denote this unlearning process as θ u ∼ U (θ,D,D u ). The unlearn- ing objective is to ensure that the resulting model θ u is in- distinguishable from a model retrained from scratch on the retain dataD r = D u , i.e., θ r ∼ T (D r ), where T is the training algorithm. This requirement is formally captured by the following condition: for any measurable subsetB ⊆ Θ, the distributions of the unlearning and retraining procedures should satisfy: P (U (T (D),D,D u ) ∈ B) ≤ e ε P (T (D r ) ∈ B) + δ, and P (T (D r ) ∈ B) ≤ e ε P (U (T (D),D,D u ) ∈ B) + δ, where ε,δ > 0 are tolerance parameters control- ling the degree of approximation (Guo et al. 2019). Based on the strength of this guarantee, unlearning algorithms are typically categorized into: exact unlearning (Bourtoule et al. 2021) and approximate unlearning (Kurmanji et al. 2023). Exact unlearning requires that U (T (D),D,D u ) and T (D r ) follow the same distribution, corresponding to the ideal case where ε = δ = 0. In contrast, approximate unlearning re- laxes this strict requirement, and allows bounded statistical divergence controlled by ε and δ. For unlearning-induced privacy vulnerabilities during the deployment phase, there are two procedures: model fine- tuning (Hu et al. 2022) and model quantization (Zhang et al. 2025). Fine-tuning aims to enhance task-specific per- formance. Specifically, given a fine-tuning dataset D ft ⊆ X ×Y of size z, the unlearned model is further adapted us- ing a fine-tuning algorithm F : Θ× (X ×Y) z → Θ, which updates the unlearned model θ u based onD ft . Let f (·;θ ft ) denote the resulting fine-tuned model. Additionally, model quantization is applied to reduce the model’s memory foot- print and improve inference efficiency (Zhang et al. 2025). Let Q : Θ → Θ denote a quantization operator that maps full-precision model parameters to a low-precision represen- tation. Given parameters θ u ∈ Θ, the quantized model is defined as f (·;θ q ), where θ q ∼ Q(θ u ). 푼(#) Training data 퓓 Pre-trained model 휽 Unlearned model 휽 풖 푻(#) Fine-tuned model 휽 풇풕 Quantized model 휽 풒 Training phase Unlearning phase Deployment phase 푸(#) 푭(#) Unlearning data 퓓 풖 Retain data 퓓 풓 퓓 풖 퓓 풖 Privacy vulnerability type Knowledge leakage Membership inference Data reconstruction 퓓 풖 퓓 풓 퓓 풖 퓓 풇풕 퐌 퐑 퐊 퐌퐑 퐌 퐊 퐊 Figure 1: Privacy vulnerabilities in machine unlearning. Benchmark Design for Unlearning Privacy Risks In this section, we detail unlearning-induced privacy vulner- abilities evaluated in our benchmark. As shown in Fig. 1, our benchmark evaluates three types of unlearning-induced privacy vulnerabilities: membership inference attacks ( M), data reconstruction attacks (R ), and knowledge leakage at- tacks ( K). Additionally, our benchmark considers two dif- ferent victim data types: the unlearning data (D u ) and the retain data (D r ). Based on this, in Table 1, we categorize ex- Paper Defense setting Architecture Privacy vulnerability type Victim data type Victim model typeAttacking tool (Wang et al. 2025b)Membership inferenceUnlearning data Pre-trained and unlearned models Pre-trained and unlearned model discrepancy Deep learning (Yuan et al. 2025)Knowledge leakageUnlearning dataUnlearned modelPerturbing unlearned dataLLM (Wang et al. 2025b)Data reconstructionUnlearning data Pre-trained and unlearned models Pre-trained and unlearned model discrepancy Deep learning (Fan et al. 2025)Knowledge leakageUnlearning dataFine-tuned model Perturbing unlearned modelLLM (Tamirisa et al. 2025)Knowledge leakageUnlearning dataFine-tuned model Perturbing unlearned modelLLM Table 2: Categories of existing defenses against privacy vulnerabilities in selective forgetting. isting unlearning-induced privacy vulnerabilities along key different dimensions: privacy vulnerability type, victim data type, victim model type, attacking tool, threat model, and model architecture. Below, we summarize the privacy vul- nerabilities in selective forgetting. (1) Membership inference attacks for the unlearning data D u . Here, attackers aim to train a membership infer- ence classifier M 1 that outputs a binary prediction: 1 if the input was included in the training dataD of the pre-trained model θ and subsequently removed through unlearning, and 0 otherwise (Lu et al. 2022a; Chen et al. 2021). To achieve this, attackers aim to characterize the predictive discrep- ancies between the pre-trained model θ and the unlearned model θ u for both members and non-members, leveraging queries under varying levels of model access as the attack- ing tool. For example, (Chen et al. 2021) assumes access to an auxiliary dataset D aux and trains shadow models using the same victim model architecture. These shadow models are queried with auxiliary datasetD aux to generate full pos- terior responses, which are then used to train the classifier. (2) Membership inference attacks for the retain data D r . In this category, attackers aim to infer the membership information of samples in the retain datasetD r =D u us- ing the unlearned model θ u (Gu, He, and Chen 2024; Carlini et al. 2022b). For example, (Carlini et al. 2022b) introduces a privacy scoring method to rank the training datasetD and select the least private instances as the malicious unlearn- ing subset D u as the attacking tool. The removal of such a subset increases the membership vulnerability of D r in the resulting model θ u , which can be measured using M 2 . (3) Data reconstruction attacks for the unlearning data D u . The goal of attackers is to train a reconstruction model R that recovers unlearned dataD u from the unlearned model θ u , leveraging the model discrepancy between pre-trained model θ and unlearned model θ u as the attacking tool (Hu et al. 2024; Du et al. 2024). This represents the most se- vere form of privacy leakage. For example, (Hu et al. 2024) assumes white-box access and proposes matching the gra- dients of candidate reconstruction inputs to the difference between θ and θ u , thereby guiding the reconstruction. (4) Knowledge leakage attacks for the unlearning data D u . Here, attackers construct a knowledge leakage model K, which outputs the predictive accuracy onD t as a proxy for retained knowledge after unlearning, whereD t is either the unlearning dataset D u or drawn from the same domain (Yuan et al. 2025; Doshi and Stickland 2024). Depending on the attacking tools adopted to amplify the leakage, such attacks can be further classified into two categories: per- turbing unlearned model and perturbing unlearned data. In the perturbing unlearned model setting, attackers generate a nearby variant e θ u of θ u to use for querying. For example, (Doshi and Stickland 2024) fine-tunes θ u with an external datasetD ft , resulting in a perturbed model θ ft = e θ u . In con- trast, in the perturbing unlearned data setting, attackers per- turb the unlearned data D u to construct a modified dataset e D u for querying the unlearned model θ u (Yuan et al. 2025). Benchmark Design for Defenses In our benchmark, we also evaluate the state-of-the-art de- fenses (see Table 2), which address unlearning-induced pri- vacy risks. To defend against membership inference attacks on unlearning data D u that exploit discrepancies between the pre-trained model θ and unlearned model θ u , (Wang et al. 2025b) proposes a defense based on minimizing the mutual information between the learned representation and the unlearning data. To counter privacy attacks that perturb the unlearned data D u , (Yuan et al. 2025) introduces ad- versarial suffix training and then employs latent adversarial unlearning to suppress residual knowledge leakage. (Wang et al. 2025b) also tackles reconstruction attacks targeting D u . In response to privacy risks induced by perturbations to the unlearned model θ u , (Fan et al. 2025) develops a robust unlearning framework grounded in sharpness-aware mini- mization (SAM). (Tamirisa et al. 2025) proposes tampering attack resistance (TAR) that applies tampering attacks on θ and adversarial unlearning to improve the robustness of θ u . Experiments Here, we present comprehensive experiments to establish the PrivUB benchmark. More experimental details and re- sults can be found in the full version of this paper. Unlearning methods. In experiments, we adopt popular unlearning methods in deep learning and LLM settings. For the deep learning setting, we use retraining from scratch, SISA (Bourtoule et al. 2021), Finetune (FT) (Warnecke et al. 2023), Influence Unlearning (IU) (Izzo et al. 2021), Neg- Grad+ (Kurmanji et al. 2023), Gradient Ascent (GA) (Thudi et al. 2022), SCRUB (Kurmanji et al. 2023), and SalUn (Fan et al. 2024). For the LLM setting, we adopt the Gradient Ascent (GA) (Yao, Xu, and Liu 2024), Negative Preference Optimization (NPO) (Zhang et al. 2024), and Representa- tion Misdirection for Unlearning (RMU) (Li et al. 2024). Additionally, due to space limitations, more experiments Model access information Method Chest X-RayCelebACIFAR-10 MIA Acc↑AUC↑MIA Acc↑AUC↑MIA Acc↑AUC↑ Posterior Basic MIA0.500± 0.020 0.482± 0.0180.503± 0.004 0.517± 0.0290.502± 0.015 0.486± 0.031 (Chen et al. 2021)0.567± 0.013 0.600± 0.0220.663± 0.029 0.723± 0.0330.607± 0.043 0.660± 0.041 Top-k posterior Basic MIA0.517± 0.008 0.494± 0.0590.510± 0.013 0.543± 0.0280.482± 0.004 0.501± 0.003 (Chen et al. 2021)0.563± 0.012 0.557± 0.0430.628± 0.025 0.729± 0.0180.605± 0.013 0.633± 0.009 Label-only Basic MIA0.500± 0.000 0.502± 0.0060.532± 0.008 0.532± 0.0080.505± 0.015 0.491± 0.007 (Chen et al. 2021)0.502± 0.015 0.504± 0.0120.528± 0.007 0.543± 0.0130.502± 0.010 0.519± 0.000 (Lu et al. 2022a)0.813± 0.014 0.793± 0.0560.680± 0.009 0.725± 0.0140.937± 0.014 0.952± 0.001 (Lu et al. 2022b)0.805± 0.020 0.772± 0.0270.632± 0.048 0.699± 0.0650.910± 0.013 0.933± 0.016 Table 3: Comparisons of membership inference attacks for unlearning data. on uncertainty-aware machine unlearning methods can be found in the full version of the paper. Datasets. In experiments, we adopt a diverse set of real-world datasets: Chest X-Ray (Kermany et al. 2018), CelebA (Liu et al. 2015), CIFAR-10, CIFAR- 100 (Krizhevsky, Nair, and Hinton 2009), WMDP-Biology, WMDP-Cyber (Li et al. 2024), RWKU (Jin et al. 2024), Openwebtext (Gokaslan et al. 2019), AG-News (Zhang, Zhao, and LeCun 2015), Wikitext-103 (Merity et al. 2016), and XSum (Narayan, Cohen, and Lapata 2018). Models. In experiments, we consider mainstream models, including ResNet-50 (He et al. 2016), VGG-19 (Simonyan and Zisserman 2014), ResNet-18 (He et al. 2016), ConvNet, Llama-2-13B (Touvron et al. 2023), Llama-3-8B (Grattafiori et al. 2024), Llama-2-7B (Touvron et al. 2023), Zephyr-7B- beta (Tunstall et al. 2023), Phi-3 (Abdin et al. 2024), and GPTNeo-1.3B (Gao et al. 2020). Privacy attacks and defenses. In experiments, we evalu- ate a range of privacy attacks in selective forgetting, includ- ing membership inference attacks (Gu, He, and Chen 2024; Du et al. 2024; Lu et al. 2022a,b; Carlini et al. 2022b; Chen et al. 2021), data reconstruction attacks (Wang et al. 2025a; Hu et al. 2024; Du et al. 2024), and knowledge leakage at- tacks (Hu et al. 2025; Zhang et al. 2025; Łucki et al. 2025; Xuan and Li 2025; Hsu et al. 2025; Yuan et al. 2025; Doshi and Stickland 2024). We also evaluate the defenses (Fan et al. 2025; Tamirisa et al. 2025; Yuan et al. 2025; Wang et al. 2025b) against privacy vulnerabilities in unlearning. Evaluation metrics. To evaluate privacy leakage, we use a variety of metrics tailored to each attack scenario. For membership inference, we use standard metrics (Carlini et al. 2022a) including MIA accuracy (Acc), AUC, and ROC curve. We also use the failure rate and the empirical CDF for detecting the privacy risks in retain data. For data reconstruc- tion, we measure the data recovery quality using cosine sim- ilarity (CS) and mean squared error (MSE) (Hu et al. 2024). For knowledge leakage, we adopt unlearning accuracy, test accuracy, MIA Acc, and ROUGE score (Maini et al. 2024). Experiments on Membership Inference Attacks First, we investigate the effectiveness of membership in- ference for unlearning data using pre-trained and un- learned model discrepancy. We categorize the existing ap- proaches (Lu et al. 2022a,b; Chen et al. 2021) based on the model access information. Table 3 illustrates the MIA accuracy and AUC across various datasets using ResNet- 18 with retraining. We compare these methods with ba- sic MIA baselines that query only the pre-trained model. Fig. 2 also presents the results of applying (Chen et al. 2021), originally designed for deep learning models, to LLMs, and compares with (Du et al. 2024). Here, we adopt the GPTNeo-1.3B model. From these results, we have the following observations: (1) The discrepancy between pre- trained and unlearned models reveals unintended informa- tion, enabling privacy attacks that surpass classical member- ship inference on the pre-trained model. (2) For the attack method in (Chen et al. 2021), access to richer query infor- mation (e.g., from label-only to full posterior (Pos)) leads to improved attack performance. (3) The attack methods in (Lu et al. 2022a,b), which leverage adversarial example strate- gies, exhibit strong performance, as validated in their works. (4) Privacy attacks can be effectively generalized from deep learning models to LLMs, maintaining high performance. AG- News Wikitext- 103 XSum Dataset 0.6 0.8 1.0 Value MIA Acc (Chen et al. 2021) MIA Acc (Du et al. 2024) AUC (Chen et al. 2021) AUC (Du et al. 2024) Figure 2: Membership in- ference for unlearning data. GA w/o GA w/ NPO w/o NPO w/ With and without integration 0.2 0.5 0.8 ROUGE Five-shot Translation Static Dynamic Figure 3: Knowledge leak- age with perturbing model. Then, we explore the impact of unlearning on retain data with membership inference attacks. We consider a setting where 10% of randomly selected training samples are re- moved using retraining, and then evaluate MIA performance using LiRA (Carlini et al. 2022b) and A-LiRA (Gu, He, and Chen 2024). Fig. 4 presents the predicted MIA accuracy on the retain set before and after unlearning with ResNet- 18. We find the following observations: (1) Privacy of many samples in the retain set deteriorates after unlearning is ap- plied to the forget set, indicating hidden privacy vulnerabili- ties of unlearning. (2) LiRA generally worsens the privacy of the retain set after unlearning, compared to A-LiRA, which aims to reduce computational overhead in LiRA. Experiments on Data Reconstruction Attacks Here, we evaluate the performance of data reconstruction for unlearning data leveraging pre-trained and unlearned model Model access information Method Chest X-RayCelebACIFAR-10 MSE↓CS↑MSE↓CS↑MSE↓CS↑ Model weights Basic DRA0.208± 0.004 0.499± 0.0020.245± 0.015 0.567± 0.0030.265± 0.016 0.656± 0.008 (Hu et al. 2024)0.064± 0.003 0.897± 0.0030.075± 0.004 0.844± 0.0150.062± 0.008 0.892± 0.014 (Du et al. 2024)0.030± 0.002 0.953± 0.0030.141± 0.008 0.772± 0.0090.109± 0.005 0.841± 0.008 Posterior Basic DRA 0.191± 0.004 0.606± 0.0050.248± 0.016 0.569± 0.0030.264± 0.016 0.638± 0.009 (Wang et al. 2025a) 0.050± 0.000 0.920± 0.0040.038± 0.002 0.908± 0.0070.017± 0.001 0.970± 0.003 Table 4: Comparisons of data reconstruction attacks for unlearning data. discrepancy. We perform data reconstruction attacks for ex- isting methods (Wang et al. 2025a; Hu et al. 2024; Du et al. 2024), which aim to recover sensitive data features from unlearned models by retraining. Among these, (Du et al. 2024) is extended from LLMs to deep learning models. In contrast, we employ two baselines that optimize directly against the prediction loss on the target data without access to the unlearned models. Table 4 shows the results on vari- ous datasets using ConvNet. Based on the obtained results, we observe the following: (1) The discrepancy between the pre-trained and unlearned models reveals significant infor- mation about the unlearning samples and enables better re- construction than using the pre-trained model alone. (2) The posterior augmentation strategy in (Wang et al. 2025a) con- tributes to its strong reconstruction performance. (3) Privacy attacks originally designed for LLMs can be adapted to deep learning models, achieving competitive performance. −0.4−0.20.00.2 After - before 0 50 100 Percentage (Carlini et al. 2022b) (Gu, He, and Chen 2024) (a) Chest X-Ray −0.4−0.20.00.2 After - before 0 50 100 Percentage (Carlini et al. 2022b) (Gu, He, and Chen 2024) (b) CelebA Figure 4: Empirical CDF of membership inference attacks before and after unlearning on retain data. Experiments on Knowledge Leakage Attacks Here, we explore the performance of knowledge leakage for unlearning data using perturbing unlearned model meth- ods. Specifically, we apply the methods of fine-tuning ex- ternal data (Openwebtext) (Doshi and Stickland 2024), fine- tuning partial unlearning data (Hu et al. 2025), fine-tuning retain data (Łucki et al. 2025), and using model quantiza- tion (Zhang et al. 2025) to the unlearned model to test the recovered knowledge of the unlearning data. Fig. 5 presents the test accuracy of the WMDP biology and cybersecu- rity knowledge recovered by each method on the unlearned model of Zephyr-7B-beta. From these results, we make the following observations: (1) The privacy vulnerabilities of knowledge leakage exist in various selective forgetting methods. (2) Perturbing the model through fine-tuning or quantization can effectively recover unlearned knowledge, with fine-tuning methods generally yielding better perfor- mance. (3) Among fine-tuning approaches, using partial un- learning data typically achieves better recovery performance than using external data or retain data. We also examine the performance of knowledge leakage on unlearning data via perturbing unlearned data methods. Specifically, in the LLM setting, we apply the prompt per- turbation strategies, including five-shot prompting and trans- lation (Doshi and Stickland 2024), and static prefix injec- tion and the dynamic adversarial suffix optimization (Yuan et al. 2025). In the deep learning setting, we compare im- age perturbations using adversarial examples generated by FGSM (Hsu et al. 2025) and the gradient-based optimiza- tion (Xuan and Li 2025). Fig. 7a shows the ROUGE score of unlearned knowledge on the RWKU dataset using Llama- 3-8B. Fig. 7b presents the unlearning data accuracy under a perturbation size of 8/255 on CIFAR-10 with ResNet-18. Based on these results, we find the following observations: (1) Data perturbations can substantially increase the privacy risks of unlearning data in both LLMs and deep learning models. (2) Optimization-based approaches that aim to re- cover correct outputs tend to outperform static methods in revealing residual knowledge for unlearning data. GANPORMU Unlearning method 0.2 0.4 0.6 0.8 Test accuracy 0.240 0.260 0.289 No attack (Doshi and Stickland 2024) (Hu et al. 2025) (Łucki et al. 2025) (Zhang et al. 2025) (a) WMDP-Biology GANPORMU Unlearning method 0.2 0.3 0.4 0.5 Test accuracy 0.246 0.245 0.284 No attack (Doshi and Stickland 2024) (Hu et al. 2025) (Łucki et al. 2025) (Zhang et al. 2025) (b) WMDP-Cyber Figure 5: Comparisons of knowledge leakage attacks for un- learning data using perturbing unlearned model methods. To further evaluate the impact of privacy vulnerabilities in unlearning, we combine the attacking tools in knowl- edge leakage and investigate their coordinated effects. Fig. 3 presents the knowledge leakage for unlearning data using various perturbing unlearned data methods, integrated with the perturbing unlearned model approach from (Hu et al. 2025), which fine-tunes partial unlearning data. Notably, the attack performance of each perturbing unlearned data method increases after integration. From these results, we observe that combining multiple attacking tools within the same vulnerability type can improve the attack effectiveness and lead to greater privacy leakage in selective forgetting. Additionally, we explore the impact of combining attack- Chest w/o Chest w/ Celeb A w/o Celeb A w/ With and without defense 0.2 0.4 0.6 0.8 AUC Pos (Chen et al. 2021) Top-k Pos (Chen et al. 2021) Label-only (Lu et al. 2022a) Label-only (Lu et al. 2022b) (a) Membership inference Chest w/o Chest w/ CIFAR -10 w/o CIFAR -10 w/ With and without defense 0.0 0.1 0.2 0.3 MSE (Hu et al. 2024) (Du et al. 2024) (Wang et al. 2025a) (b) Data reconstruction NPONPO +SAM TAR Defense method 0.4 0.5 0.6 0.7 Test accuracy (Doshi and Stickland 2024) (Hu et al. 2025) (Łucki et al. 2025) (Zhang et al. 2025) (c) Perturbing unlearned model NPOAdv NPO RMUAdv RMU Defense method 0.0 0.2 0.4 0.6 ROUGE Five-shot Translation Static Dynamic (d) Perturbing unlearned data Figure 6: Defenses against privacy attacks in unlearning. ing tools across different types of privacy vulnerabilities. Fig. 8 shows the membership inference results of using pre- trained and unlearned model discrepancy with and without the perturbing unlearned data method in knowledge leak- age. Specifically, we apply PGD-based perturbations follow- ing (Hsu et al. 2025) and conduct the label-only membership inference attacks. We find that the MIA accuracy is signif- icantly boosted after applying the data perturbations. From these results, we observe that different types of privacy vul- nerabilities can be integrated to exacerbate the privacy risks. GANPORMU Unlearning method 0.2 0.4 0.6 0.8 ROUGE 0.3170.337 0.324 No attack Five-shot Translation Static Dynamic (a) LLMs SISAFTSal Un SCR UB Neg Grad+ Unlearning method 0.7 0.8 0.9 1.0 Unlearning accuracy 0.878 0.789 0.847 0.854 0.875 No attack (Hsu et al. 2025) (Xuan and Li 2025) (b) Deep learning models Figure 7: Comparisons of knowledge leakage attacks for un- learning data via perturbing unlearned data methods. Experiments on Defenses Against Privacy Attacks Here, we assess existing defense mechanisms designed to mitigate the information leakage in unlearning. First, for at- tacks that exploit discrepancies between the pre-trained and unlearned models, we leverage the representation compres- sion method (Wang et al. 2025b) to defend against mem- bership inference and data reconstruction, with the results reported in Fig. 6a and Fig. 6b. Then, we adopt the ro- bust unlearning method NPO+SAM (Fan et al. 2025) and TAR (Tamirisa et al. 2025), aiming to defend against knowl- edge leakage from perturbing unlearned models. The cor- responding results are presented in Fig. 6c. Next, we apply the adversarial unlearning method (AdvNPO and AdvRMU) to enhance the unlearning robustness specific to the knowl- edge leakage from perturbing unlearned data. The results are shown in Fig. 6d. Based on these defense evaluations, we conclude the following observations: (1) Existing de- fense mechanisms show limited effectiveness in mitigating privacy leakage in unlearning. (2) The difficulty of defense against privacy vulnerabilities varies across attack types; in particular, defending against perturbing data attacks appears to be more tractable than perturbing model attacks. Additionally, we examine the robust unlearning (Fan et al. 2025) with fine-tuning of partial unlearning data (Hu et al. 2025) to better understand the limitations of current defense mechanisms. Fig. 9 presents the test accuracy under vary- ing attack samples on the WMDP-Biology dataset. The re- sults indicate that while SAM shows some resistance to the attacks when the number of attack samples is small, its ef- fectiveness significantly degrades as the number of attack samples increases. These findings suggest that existing de- fenses are highly sensitive to the attack configurations and often fail to maintain robustness under certain conditions. ChestCelebACIFAR-100 Dataset 0.2 0.6 1.0 MIA Acc (Chen et al. 2021) w/o (Chen et al. 2021) w/ Figure 8: MIAs with per- turbing unlearned data. 0200400 # of samples 0.2 0.4 0.6 Test accuracy GA GA+SAM NPO NPO+SAM Figure 9: Impact of attack samples on defenses. Conclusion and Future Work In this study, we propose PrivUB, the first comprehensive benchmark for evaluating privacy vulnerabilities in selective forgetting. Our benchmark focuses on three critical dimen- sions of privacy vulnerabilities: membership inference, data reconstruction, and knowledge leakage, and two categories of victim data: unlearning data and retain data, during the unlearning and deployment phases. We apply PrivUB to sys- tematically evaluate 21 state-of-the-art privacy attacks and defenses under 10 unlearning methods, covering 11 widely- used datasets, 10 representative model architectures, and 10 evaluation metrics. To the best of our knowledge, this is the first work to comprehensively benchmark the privacy vulnerabilities arising from unlearning-induced attacks and their corresponding defenses. Our findings reveal significant privacy risks exposed in current selective forgetting tech- niques and underscore the need for advanced defenses for future research. These include developing robust unlearning to mitigate privacy leakage both during unlearning and after model deployment. We believe that PrivUB will benefit the community by providing a standardized tool and facilitating faithful privacy assessments. Acknowledgments This work is supported in part by the US National Science Foundation under grants CNS-2350332 and IIS-2442750. Any opinions, findings, and conclusions or recommenda- tions expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation. References Abdin, M. I.; Ade Jacobs, S.; Awan, A. A.; Aneja, J.; Awadallah, A.; et al. 2024.Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone. Technical report, Microsoft. Alkhatib, Y.; and Tay, W. P. 2025. On Conformal Machine Unlearning. arXiv preprint arXiv:2508.03245. Bourtoule, L.; Chandrasekaran, V.; Choquette-Choo, C. A.; Jia, H.; Travers, A.; Zhang, B.; Lie, D.; and Papernot, N. 2021. Machine unlearning. In 2021 IEEE symposium on security and privacy (SP), 141–159. IEEE. Bu, Z.; Zhang, X.; Zha, S.; Hong, M.; and Karypis, G. 2024. Pre-training differentially private models with limited public data. Advances in Neural Information Processing Systems, 37: 94652–94683. Bukaty, P. 2019. The California Consumer Privacy Act (CCPA): An implementation guide. IT Governance Publish- ing. ISBN 9781787781320. Carlini, N.; Chien, S.; Nasr, M.; Song, S.; Terzis, A.; and Tramer, F. 2022a. Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), 1897–1914. IEEE. Carlini, N.; Jagielski, M.; Zhang, C.; Papernot, N.; Terzis, A.; and Tramer, F. 2022b. The privacy onion effect: Mem- orization is relative. Advances in Neural Information Pro- cessing Systems, 35: 13263–13276. Chen, A.; Li, Y.; Zhao, C.; and Huai, M. 2025. A survey of security and privacy issues of machine unlearning. Chen, M.; Zhang, Z.; Wang, T.; Backes, M.; Humbert, M.; and Zhang, Y. 2021. When machine unlearning jeopardizes privacy. In Proceedings of the 2021 ACM SIGSAC confer- ence on computer and communications security, 896–911. Chu, T.; Song, Z.; and Yang, C. 2024. How to Protect Copy- right Data in Optimization of Large Language Models? Pro- ceedings of the AAAI Conference on Artificial Intelligence. Doshi, J.; and Stickland, A. C. 2024. Does unlearning truly unlearn? a black box evaluation of llm unlearning methods. arXiv preprint arXiv:2411.12103. Du, J.; Wang, Z.; Zhang, J.; Pang, X.; Hu, J.; and Ren, K. 2024. Textual unlearning gives a false sense of unlearning. arXiv preprint arXiv:2406.13348. Fan, C.; Jia, J.; Zhang, Y.; Ramakrishna, A.; Hong, M.; and Liu, S. 2025. Towards llm unlearning resilient to relearning attacks: A sharpness-aware minimization perspective and beyond. International conference on machine learning. Fan, C.; Liu, J.; Zhang, Y.; Wong, E.; Wei, D.; and Liu, S. 2024.SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classifica- tion and Generation. In The Twelfth International Confer- ence on Learning Representations. Gao, L.; Biderman, S.; Black, S.; Golding, L.; Hoppe, T.; Foster, C.; Phang, J.; He, H.; Thite, A.; Nabeshima, N.; et al. 2020. The Pile: An 800GB Dataset of Diverse Text for Lan- guage Modeling. arXiv preprint arXiv:2101.00027. Gokaslan, A.; Cohen, V.; Pavlick, E.; and Tellex, S. 2019. OpenWebText Corpus. http://Skylion007.github.io/ OpenWebTextCorpus. Accessed: July 2025. Grattafiori, A.; Dubey, A.; Jauhri, A.; Pandey, A.; Kadian, A.; Al-Dahle, A.; Letman, A.; Mathur, A.; Schelten, A.; Vaughan, A.; et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783. Gu, Y.; He, J.; and Chen, K. 2024. Auditing Privacy Protec- tion of Machine Unlearning. Guo, C.; Goldstein, T.; Hannun, A.; and Van Der Maaten, L. 2019. Certified data removal from machine learning models. arXiv preprint arXiv:1911.03030. Hadero, H.; and Bauder, D. 2023. New York Times sues Microsoft, Open AI over use of content. Globe & Mail (Toronto, Canada), B1–B1. He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep resid- ual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, 770–778. Hsu, H.; Niroula, P.; He, Z.; and Chen, C.-F. 2025. Are We Really Unlearning? The Presence of Residual Knowledge in Machine Unlearning. In I Can’t Believe It’s Not Better: Challenges in Applied Deep Learning. Hu, E. J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; Chen, W.; et al. 2022. Lora: Low-rank adapta- tion of large language models. ICLR, 1(2): 3. Hu, H.; Wang, S.; Dong, T.; and Xue, M. 2024. Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning. In 2024 IEEE Symposium on Security and Privacy (SP), 3257–3275. IEEE. Hu, S.; Fu, Y.; Wu, Z. S.; and Smith, V. 2025. Jogging the Memory of Unlearned LLMs Through Targeted Relearning Attacks. International Conference on Learning Representa- tions. Izzo, Z.; Smart, M. A.; Chaudhuri, K.; and Zou, J. 2021. Ap- proximate data deletion from machine learning models. In International conference on artificial intelligence and statis- tics, 2008–2016. PMLR. Jin, Z.; Cao, P.; Wang, C.; He, Z.; Yuan, H.; Li, J.; Chen, Y.; Liu, K.; and Zhao, J. 2024. RWKU: Benchmarking Real- World Knowledge Unlearning for Large Language Models. In The Thirty-eight Conference on Neural Information Pro- cessing Systems Datasets and Benchmarks Track. Kermany, D. S.; Goldbaum, M.; Cai, W.; Valentim, C. C.; Liang, H.; Baxter, S. L.; McKeown, A.; Yang, G.; Wu, X.; Yan, F.; Dong, J.; Prasadha, M. K.; Pei, J.; Ting, M. Y.; Zhu, J.; Li, C.; Hewett, S.; Dong, J.; Ziyar, I.; Shi, A.; Zhang, R.; Zheng, L.; Hou, R.; Shi, W.; Fu, X.; Duan, Y.; Huu, V. A.; Wen, C.; Zhang, E. D.; Zhang, C. L.; Li, O.; Wang, X.; Singer, M. A.; Sun, X.; Xu, J.; Tafreshi, A.; Lewis, M. A.; Xia, H.; and Zhang, K. 2018. Identifying Medical Diag- noses and Treatable Diseases by Image-Based Deep Learn- ing. Cell. Krizhevsky, A.; Nair, V.; and Hinton, G. 2009. Cifar-10 and cifar-100 datasets. URl: https://w. cs. toronto. edu/kriz/- cifar. html, 6(1): 1. Accessed: July 2025. Kurmanji, M.; Triantafillou, P.; Hayes, J.; and Triantafillou, E. 2023. Towards unbounded machine unlearning. Advances in neural information processing systems, 36: 1957–1987. Li, H.; Guo, D.; Li, D.; Fan, W.; Hu, Q.; Liu, X.; Chan, C.; Yao, D.; Yao, Y.; and Song, Y. 2023. Privlm-bench: A multi-level privacy evaluation benchmark for language mod- els. Proceedings of the 62nd Annual Meeting of the Associ- ation for Computational Linguistics. Li, N.; Pan, A.; Gopal, A.; Yue, S.; Berrios, D.; Gatti, A.; Li, J. D.; Dombrowski, A.-K.; Goel, S.; Phan, L.; et al. 2024. The wmdp benchmark: Measuring and reducing malicious use with unlearning. Proceedings of the 41st International Conference on Machine Learning. Li, N.; Zhou, C.; Gao, Y.; Chen, H.; Zhang, Z.; Kuang, B.; and Fu, A. 2025. Machine unlearning: Taxonomy, metrics, applications, challenges, and prospects. IEEE Transactions on Neural Networks and Learning Systems. Li, Y.; and Huai, M. 2025. Quantifying Uncertainty in Nat- ural Language Explanations of Large Language Models for Question Answering. arXiv preprint arXiv:2509.15403. Liu, Z.; Luo, P.; Wang, X.; and Tang, X. 2015. Deep Learn- ing Face Attributes in the Wild. In Proceedings of Interna- tional Conference on Computer Vision (ICCV). Lu, Z.; Liang, H.; Zhao, M.; Lv, Q.; Liang, T.; and Wang, Y. 2022a. Label-only membership inference attacks on ma- chine unlearning without dependence of posteriors. Interna- tional Journal of Intelligent Systems, 37(11): 9424–9441. Lu, Z.; Wang, Y.; Lv, Q.; Zhao, M.; and Liang, T. 2022b. Fp 2-mia: A membership inference attack free of posterior probability in machine unlearning. In International Confer- ence on Provable Security, 167–175. Springer. Łucki, J.; Wei, B.; Huang, Y.; Henderson, P.; Tram ` er, F.; and Rando, J. 2025. An adversarial perspective on machine un- learning for ai safety. Transactions on Machine Learning Research. Maini, P.; Feng, Z.; Schwarzschild, A.; Lipton, Z. C.; and Kolter, J. Z. 2024. TOFU: A Task of Fictitious Unlearning for LLMs. In First Conference on Language Modeling. Merity, S.; Xiong, C.; Bradbury, J.; and Socher, R. 2016. Pointer Sentinel Mixture Models. arXiv:1609.07843. Mueller, F. B.; G ̈ orge, R.; Bernzen, A. K.; Pirk, J. C.; and Poretschkin, M. 2024. LLMs and memorization: On quality and specificity of copyright compliance. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, vol- ume 7, 984–996. Narayan, S.; Cohen, S. B.; and Lapata, M. 2018. Don’t Give Me the Details, Just the Summary! Topic-Aware Convolu- tional Neural Networks for Extreme Summarization. In Pro- ceedings of the 2018 Conference on Empirical Methods in Natural Language Processing. Brussels, Belgium. Niu, J.; Zhu, X.; Zeng, M.; Zhang, G.; Zhao, Q.; Huang, C.; Zhang, Y.; An, S.; Wang, Y.; Yue, X.; et al. 2025. Compar- ing Different Membership Inference Attacks with a Com- prehensive Benchmark. IEEE Transactions on Information Forensics and Security. Qian, W.; Zhao, C.; Le, W.; Ma, M.; and Huai, M. 2023. Towards understanding and enhancing robustness of deep learning models against malicious unlearning attacks. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 1932–1942. Qian, W.; Zhao, C.; Shao, H.; Chen, M.; Wang, F.; and Huai, M. 2022. Patient similarity learning with selective forget- ting. In 2022 IEEE International Conference on Bioinfor- matics and Biomedicine (BIBM), 529–534. IEEE. Regulation, P. 2018. General data protection regulation. In- touch, 25: 1–5. Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Om- mer, B. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, 10684– 10695. Simonyan, K.; and Zisserman, A. 2014. Very deep convo- lutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556. Song, L.; and Mittal, P. 2021. Systematic evaluation of pri- vacy risks of machine learning models. In 30th USENIX security symposium (USENIX security 21), 2615–2632. Tamirisa, R.; Bharathi, B.; Phan, L.; Zhou, A.; Gatti, A.; Suresh, T.; Lin, M.; Wang, J.; Wang, R.; Arel, R.; Zou, A.; Song, D.; Li, B.; Hendrycks, D.; and Mazeika, M. 2025. Tamper-Resistant Safeguards for Open-Weight LLMs. In The Thirteenth International Conference on Learning Rep- resentations. Thudi, A.; Deza, G.; Chandrasekaran, V.; and Papernot, N. 2022. Unrolling sgd: Understanding factors influencing ma- chine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), 303–319. IEEE. Touvron, H.; Martin, L.; Stone, K.; Albert, P.; Almahairi, A.; Babaei, Y.; Bashlykov, N.; Batra, S.; Bhargava, P.; Bhosale, S.; et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288. Tunstall, L.; Beeching, E.; Lambert, N.; Rajani, N.; Rasul, K.; Belkada, Y.; Huang, S.; Von Werra, L.; Fourrier, C.; Habib, N.; et al. 2023. Zephyr: Direct distillation of lm alignment. arXiv preprint arXiv:2310.16944. Wang, W.; Tian, Z.; Liu, A.; and Yu, S. 2025a. TAPE: Tai- lored Posterior Difference for Auditing of Machine Unlearn- ing. In Proceedings of the ACM on Web Conference 2025, 3061–3072. Wang, W.; Zhang, C.; Tian, Z.; Liu, S.; and Yu, S. 2025b. CRFU: Compressive Representation Forgetting Against Pri- vacy Leakage on Machine Unlearning. IEEE Transactions on Dependable and Secure Computing. Warnecke, A.; Pirch, L.; Wressnegger, C.; and Rieck, K. 2023.Machine Unlearning of Features and Labels.In Proc. of the 30th Network and Distributed System Security (NDSS). Wei, B.; Shi, W.; Huang, Y.; Smith, N. A.; Zhang, C.; Zettle- moyer, L.; Li, K.; and Henderson, P. 2024. Evaluating Copy- right Takedown Methods for Language Models.In The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track. Wen, R.; Liu, Y.; Backes, M.; and Zhang, Y. 2025. SoK: Data Reconstruction Attacks Against Machine Learning Models: Definition, Metrics, and Benchmark. USENIX Se- curity Symposium. Xuan, H.; and Li, X. 2025. Unlearning Mapping Attack: Exposing Hidden Vulnerabilities in Machine Unlearning. Yao, Y.; Xu, X.; and Liu, Y. 2024. Large language model un- learning. Advances in Neural Information Processing Sys- tems, 37: 105425–105475. Yuan, H.; Jin, Z.; Cao, P.; Chen, Y.; Liu, K.; and Zhao, J. 2025. Towards robust knowledge unlearning: An adversarial framework for assessing and improving unlearning robust- ness in large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, 25769– 25777. Yuan, X.; Chen, K.; Zhang, J.; Zhang, W.; Yu, N.; and Zhang, Y. 2023. Pseudo label-guided model inversion at- tack via conditional generative adversarial network. In Pro- ceedings of the AAAI Conference on Artificial Intelligence, volume 37, 3349–3357. Zhang, R.; Lin, L.; Bai, Y.; and Mei, S. 2024. Negative Pref- erence Optimization: From Catastrophic Collapse to Effec- tive Unlearning. In First Conference on Language Modeling. Zhang, X.; Zhao, J.; and LeCun, Y. 2015. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28. Zhang, Z.; Wang, F.; Li, X.; Wu, Z.; Tang, X.; Liu, H.; He, Q.; Yin, W.; and Wang, S. 2025. Catastrophic Failure of LLM Unlearning via Quantization. International Confer- ence on Learning Representations. Zhao, C.; Qian, W.; Chen, A.; and Huai, M. 2025. Member- ship inference attacks with false discovery rate control. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 1216–1227. Zhao, C.; Qian, W.; Ying, R.; and Huai, M. 2023. Static and sequential malicious attacks in the context of selective forgetting. Advances in Neural Information Processing Sys- tems, 36: 74966–74979. Zhu, D.; Chen, D.; Wu, X.; Geng, J.; Li, Z.; Grossklags, J.; and Ma, L. 2024. PrivAuditor: Benchmarking Data Protec- tion Vulnerabilities in LLM Adaptation Techniques. In The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track.