Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2601.22359 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866917233296408576 |
|---|---|
| author | Hsu, Hsiang Niroula, Pradeep He, Zichang Brugere, Ivan Lecue, Freddy Chen, Chun-Fu |
| author_facet | Hsu, Hsiang Niroula, Pradeep He, Zichang Brugere, Ivan Lecue, Freddy Chen, Chun-Fu |
| contents | Machine unlearning offers a practical alternative to avoid full model re-training by approximately removing the influence of specific user data. While existing methods certify unlearning via statistical indistinguishability from re-trained models, these guarantees do not naturally extend to model outputs when inputs are adversarially perturbed. In particular, slight perturbations of forget samples may still be correctly recognized by the unlearned model - even when a re-trained model fails to do so - revealing a novel privacy risk: information about the forget samples may persist in their local neighborhood. In this work, we formalize this vulnerability as residual knowledge and show that it is inevitable in high-dimensional settings. To mitigate this risk, we propose a fine-tuning strategy, named RURK, that penalizes the model's ability to re-recognize perturbed forget samples. Experiments on vision benchmarks with deep neural networks demonstrate that residual knowledge is prevalent across existing unlearning methods and that our approach effectively prevents residual knowledge. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2601_22359 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples Hsu, Hsiang Niroula, Pradeep He, Zichang Brugere, Ivan Lecue, Freddy Chen, Chun-Fu Machine Learning Artificial Intelligence Machine unlearning offers a practical alternative to avoid full model re-training by approximately removing the influence of specific user data. While existing methods certify unlearning via statistical indistinguishability from re-trained models, these guarantees do not naturally extend to model outputs when inputs are adversarially perturbed. In particular, slight perturbations of forget samples may still be correctly recognized by the unlearned model - even when a re-trained model fails to do so - revealing a novel privacy risk: information about the forget samples may persist in their local neighborhood. In this work, we formalize this vulnerability as residual knowledge and show that it is inevitable in high-dimensional settings. To mitigate this risk, we propose a fine-tuning strategy, named RURK, that penalizes the model's ability to re-recognize perturbed forget samples. Experiments on vision benchmarks with deep neural networks demonstrate that residual knowledge is prevalent across existing unlearning methods and that our approach effectively prevents residual knowledge. |
| title | The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples |
| topic | Machine Learning Artificial Intelligence |
| url | https://arxiv.org/abs/2601.22359 |