Adversarial Robustness Lacking in Machine Unlearning Models

Machine unlearning aims to remove the influence of targeted training data from models while preserving their remaining capabilities. However, evaluating whether such information has truly become inaccessible remains challenging.

A recent study by Microsoft addressed this gap through a unified evaluation of prompt-based and fine-tuning-based unlearning methods on TOFU using Llama-3.2-3B-Instruct.

The researchers introduced the Attack Success Rate (ASR), an LLM-as-judge metric that measures the fraction of adversarial responses whose leakage score exceeds 0.2, and evaluated recovery across eight attack suites.

The results revealed a substantial gap between clean-query forgetting and adversarial robustness. While several fine-tuning-based methods achieved high Forget Quality, targeted information remained recoverable with ASRs between 72.8% and 84.3%, close to the 87.5% ASR of the unprotected base model.

The study's findings show that strong standard-metric performance alone is insufficient to establish robustness after unlearning and motivate adversarial stress-testing as a complementary component of unlearning evaluation.