Can attackers simply reverse the unlearning?
Yes, and it's surprisingly easy. A 2024 study showed that with only a small, loosely related dataset, an attacker can 'jog' the memory of an unlearned model and bring back the supposedly forgotten information [2]. For example, relearning on public medical articles made an unlearned model output harmful bioweapon knowledge, and relearning general Wikipedia info about Harry Potter forced the model to produce verbatim memorized text [2]. This means that current approximate unlearning methods often just suppress outputs rather than truly erase the knowledge, so you should assume that a determined attacker with access to public data can reverse the effect.
How can an attacker degrade the model for everyone else?
Attackers can craft a forgetting request that looks legitimate but actually harms the model's utility for benign users. A 2025 study introduced a 'Stealthy Attack' that exploits two weaknesses in fine-tuning-based unlearning: the inability to limit the scope of the unlearning effect and the failure to distinguish benign tokens from unlearning signals [1]. By subtly increasing the presence of common benign tokens in the forgetting data, the attacker strengthens the association between those tokens and the unlearning signal, so that when normal users include such tokens in their prompts, the model exhibits unlearning behaviors—like hallucinations or feigned ignorance—leading to unintended utility degradation [1]. The study also proposed a 'Scope-aware Unlearning' method that adds a scope term to the unlearning objective to localize the forgetting effect, which significantly improves robustness against this attack [1].
Why are popular facts harder to forget, and what does that mean for attackers?
Popular facts are memorized more deeply during pretraining and resist removal longer than rare ones, yet many unlearning methods apply uniform gradient pressure regardless of training-data frequency [3]. A 2026 study proposed an adaptive method (AdaPop) that adjusts the unlearning pressure based on a fact's popularity, using an external proxy like Wikidata sitelinks or an LLM-as-Judge [3]. Their method leaked 5x less forgotten content under paraphrased queries and 1.6x less under adversarial reformulations compared to competing methods [3]. This suggests that attackers can exploit the popularity bias: they can query the model with paraphrases or adversarial reformulations to extract forgotten content, especially for popular facts, unless the unlearning method explicitly accounts for popularity.
What can you do to prepare for these misuse scenarios?
You need to treat unlearning as a risk-management problem, not a one-time deletion. A 2025 framework (FROC) provides a way to set a risk budget on unlearning behavior, allowing you to compare different unlearning strategies and choose hyperparameters that balance forgetting sufficiency and utility preservation [4]. It computes a 'Conformal Unlearning Risk'—an estimate of the probability that forgotten samples still influence predictions—and identifies configurations that meet your risk budget [4]. Additionally, a 2025 study suggests that you can avoid reinforcing exposure to sensitive data by not using the unlearning targets in the unlearning objective at all; their method (Partial Model Collapse) deliberately triggers distribution collapse to remove information, which they argue is more aligned with privacy constraints [5]. Finally, a 2025 systematization of knowledge highlights that classical ML attacks—like membership inference, backdoors, adversarial attacks, and inversion—also apply to unlearning, so you should consider those threats as well [6].
About These Sources
This answer is built on 6 studies (1 peer-reviewed, 5 preprints) — published from 2024 to 2026, 6 from 2024 or later — selected as the most relevant from 6 studies that passed quality screening, drawn from 22 papers retrieved from a database of over 500 million.
Sources used in this answer
Keeping an Eye on LLM Unlearning: The Hidden Risk and Remedy
Introduces a Stealthy Attack that manipulates forgetting requests to degrade model utility for benign users, and proposes Scope-aware Unlearning to mitigate it.
Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning
Shows that benign relearning on small, loosely related datasets can reverse unlearning, e.g., relearning on medical articles restored bioweapon knowledge and Wikipedia info restored verbatim Harry Potter text.
The More Popular, The Harder to Forget: Adaptive Popularity for LLM Unlearning
Proposes AdaPop, an adaptive popularity-based unlearning method that leaks 5x less forgotten content under paraphrased queries and 1.6x less under adversarial reformulations compared to baselines.
FROC: A Unified Framework with Risk-Optimized Control for Machine Unlearning in LLMs
Presents FROC, a risk-control framework that uses conformal analysis to estimate the probability of forgotten samples influencing predictions and to select unlearning hyperparameters within a risk budget.
Model Collapse Is Not a Bug but a Feature in Machine Unlearning for LLMs
Proposes Partial Model Collapse (PMC), an unlearning method that does not use unlearning targets in the objective, leveraging distribution collapse to remove information while preserving utility.
How Secure is Forgetting? Linking Machine Unlearning to Machine Learning Attacks
Provides a systematization of knowledge linking classical ML attacks (backdoor, membership inference, adversarial, inversion) to machine unlearning, highlighting open security challenges.