Title: Keeping an Eye on LLM Unlearning: The Hidden Risk and Remedy
Venue: NeurIPS 2025
Accepted: yes
Keywords: Large Language Models

Unlearning

Attack

Robustness
Abstract: Although Large Language Models (LLMs) have demonstrated impressive capabilities across a wide range of tasks, growing concerns have emerged over the misuse of sensitive, copyrighted, or harmful data during training. To address these concerns, unlearning techniques have been developed to remove the influence of specific data without retraining from scratch. However, this paper reveals a critical vulnerability in fine-tuning-based unlearning: a malicious user can craft a manipulated forgetting request that stealthily degrades the model’s utility for benign users. We demonstrate this risk through a red-teaming Stealthy Attack (SA), which is inspired by two key limitations of existing unlearning—the inability to constrain the scope of unlearning effect and the failure to distinguish benign tokens from unlearning signals. Prior work has shown that unlearned models tend to memorize forgetting data as unlearning signals, and respond with hallucinations or feigned ignorance when unlearning signals appear in the input. By subtly increasing the presence of common benign tokens in the forgetting data, SA enhances the connection between benign tokens and unlearning signals. As a result, when normal users include such tokens in their prompts, the model exhibits unlearning behaviors, leading to unintended utility degradation. To address this vulnerability, we propose Scope-aware Unlearning (SU), a lightweight enhancement that introduces a scope term into the unlearning objective, encouraging the model to localize the forgetting effect. Our method requires no additional data processing, integrates seamlessly with existing fine-tuning frameworks, and significantly improves robustness against SA. Extensive experiments validate the effectiveness of both SA and SU.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates a critical vulnerability in fine-tuning-based unlearning for Large Language Models: maliciously crafted forgetting requests can degrade the model’s utility for benign users. The authors introduce a red-teaming Stealthy Attack (SA), which exploits two weaknesses in current unlearning methods: a lack of scope control and failure to distinguish between benign and forgetting-related tokens.\n\nSA works by embedding benign tokens into the forgetting data, causing the model to misclassify benign prompts as unlearning signals, which triggers degraded behavior such as hallucinations or excessive avoidance. To mitigate this, the authors propose Scope-aware Unlearning (SU), which is a lightweight enhancement that introduces a scope term into the unlearning objective. SU encourages the model to localize forgetting effects, preserving benign behavior while still unlearning the target data.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The Stealthy Attack (SA) is a contribution, revealing a subtle and dangerous failure mode in current unlearning techniques. This paper demonstrates how adversaries can exploit token overlap and representation entanglement to cause unintended degradation, raising serious deployment concerns.\n\n2. Scope-aware Unlearning (SU) is simple to implement yet highly effective, offering robustness to SA.\n\nWeaknesses:\n1. The rationale for the choice of the hyperparameter 𝜂 is not clearly explained. An ablation study varying 𝜂 across different datasets would help demonstrate the robustness and stability of the proposed method under different hyperparameter settings.\n\n2. The paper does not assess the method’s performance under Membership Inference Attacks (MIAs) or relearning attacks. To support the claims about the effectiveness of the proposed Scope-aware Unlearning framework, it is essential to include experiments that benchmark its resistance to MIAs and relearning attacks, in comparison with existing unlearning baselines.\n\nQUESTIONS:\nCould the authors conduct an ablation study varying the value of 𝜂 across different datasets?\n\nCould the authors assess the method’s performance under Membership Inference Attacks (MIAs) and relearning attacks?\n\nLIMITATIONS:\nThere are no negative societal impacts.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-25"}

comments: SUMMARY:
This paper identifies a new vulnerability caused by stealthy attacks (SA) in the LLM fine-tuning-based unlearning process. The unlearning request senders conduct stealthy attacks by inserting natural and common words in their forgetting corpus. This attack can reduce the robustness of unlearned models against sentences modified by the same transformations. To mitigate this vulnerability, this paper proposes scope-aware unlearning (SU) that computes the retaining loss on the concatenation of forget data and retain data. SU can largely recover the robustness against modified test data while generally maintaining the clean utility and unlearning performance.

STRENGTHS AND WEAKNESSES:
Strength:
1. This paper is well-written and easy to read.
2. The SA and SU are well-motivated. The poisoning settings are possible, and the defense method is unaware of the poisoning details.
3. Both the trigger-utility reduction caused by SA and the recovery caused by SU are prominent.
4. It included a discussion about existing defenses against LLM data poisoning attacks.

Weakness:
There are some side effects/trade-offs from the SU method. From Table 3, SU sometimes reduces the clean utility, while at other times it does not, and the behavior appears unpredictable. Another one is that SU can compromise the unlearning performance, e.g., 0.008 ---> 0.199. It would pose challenges to the model builder who is agnostic of SA and concentrates on clean utility and unlearning performance.

QUESTIONS:
1. What is the final token insertion rate in Line 240?
2. How do you construct the Benign-Trigger utility test set? Using the corpus transformation function in Eq. 4?
3. In Table 2, why does SA largely improve the clean utility of LLaMA-GD-10% from 0.702 to 0.752?

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-06-29

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates a critical vulnerability in fine-tuning-based LLM unlearning techniques. The authors propose a novel \"Stealthy Attack (SA)\" where a malicious user can craft a manipulated forgetting request to degrade the model's utility for benign users. This attack leverages two limitations of existing unlearning methods: the inability to constrain the unlearning effect's scope and the failure to distinguish benign tokens from unlearning signals. The paper demonstrates how subtly increasing the presence of common benign tokens in forgetting data can enhance the connection between these tokens and unlearning signals, leading to degraded model performance for normal users. The paper identifies this hidden risk and proposes potential remedies, contributing to a more robust understanding of LLM unlearning security.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n1. **[Novelty]** The paper identifies a previously unaddressed and significant vulnerability in LLM unlearning, which is a highly relevant and active research area.The \"Stealthy Attack\" is a novel concept with practical implications for the security of unlearning techniques.\n\n2. **[Clear Problem Formulation]** The problem of malicious unlearning and its underlying mechanisms (inability to constrain scope, failure to distinguish benign/unlearning signals) are clearly articulated.\n\n3. **[Demonstrated Vulnerability]** The paper effectively demonstrates the feasibility and impact of the Stealthy Attack through concrete examples and analysis, making the identified risk tangible.\n\n4. **[Practical Implications]** The findings have immediate practical implications for developers and users of LLM unlearning systems, highlighting the need for more robust unlearning mechanisms.\n\n**Weaknesses**:\n\n1. **[Evaluation Depth]** While the attack is demonstrated, a more comprehensive evaluation across various LLM architectures, unlearning techniques, and datasets could further solidify the generalizability of the findings.\n\n2. **[Table Clarity]**  The presentation of results in tables could be improved by bolding the optimal results. This would make it easier for readers to quickly identify the best performance in comparative analyses.\n\n3. **[Lack of Ablation Study for Coefficient η]** The paper does not appear to include an ablation study for critical parameters like coefficient η. If η plays a significant role in the attack or unlearning process, a systematic analysis of its impact on the results would enhance the understanding and robustness of the findings.\n\nQUESTIONS:\n1.Provide a more comprehensive evaluation of the Stealthy Attack across diverse LLM architectures, unlearning techniques, and datasets to demonstrate its generalizability.\n\n2.Please improve the clarity of result tables by bolding the optimal values to facilitate easier comparison and interpretation.\n\n3.Consider conducting an ablation study for critical parameters like coefficient η to systematically analyze its impact on the attack's effectiveness and the unlearning process.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents the potential attack (Stealthy Attack, SA) on current unlearning methods, which can degrade the model's performance on benign questions by simply manipulating the uploaded unlearning data. Through comprehensive experiments and an analysis of the unlearning mechanism, this paper identifies that the risk of attacks arises from an unclear distinction between the target unlearned tokens and benign tokens in the unlearning methods. To address this issue, this paper further proposes Scope-aware Unlearning (SU), which introduces an additional term in the unlearning methods to help distinguish between the target and benign scopes. Extensive experiments demonstrate the effectiveness of this approach across different scenarios.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n- The paper is well-written, presenting a logical progression from problem motivation to solution implementation. \n- The proposed scope-aware method aligns well with their analysis of unclear scope as a key risk factor in unlearning. \n\n**Weaknesses**\n- The paper's novelty is limited as the identified security risks and attack mechanisms on unlearning have been previously proposed and analyzed in detail [1, 2]. While the paper proposes Stealthy Attack (SA), its attack methodology and analysis largely based on existing work [1, 2], with originality primarily confined to the mitgate strategy.\n- The mitigate approach appears overly simplistic. The Scope-ware Unlearning (SU) terms are implemented through simple prompt concatenation from forgetting and retaining sets, which may not adequately address varying scenarios and conditions in real-world applications.\n\n[1] Pratiksha Thaker, Shengyuan Hu, Neil Kale, Yash Maurya, Zhiwei Steven Wu, and Virginia Smith. Position: Llm unlearning benchmarks are weak measures of progress. arXiv preprint arXiv:2410.02879, 2024.\\\n[2] Dang Huu-Tien, Hoang Thanh-Tung, Le-Minh Nguyen, and Naoya Inoue. Improving the robustness of representation misdirection for large language model unlearning. arXiv preprint arXiv:2501.19202, 2025.\n\nQUESTIONS:\n- For the design of SU terms (Eq.5), how does the method handle varying prompt lengths between forgetting and retaining sets? Does performance degrade when there are significant length disparities? For example, what happens if the prompt from the forgetting set is significantly longer than the prompt from the retaining set?  A more detailed discussion on handling such imbalances would be helpful.\n- Could the authors provide real-world examples to complement the quantitative metrics? Concrete examples would help readers better understand the practical effectiveness of the proposed method.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates a potential issue with unlearning, whereby \"data owners\" can submit forgetting requests that substantially degrade the utility of the model. They call this type of attack a \"Stealthy Attack.\" The core idea is to use benign but common tokens (eg Please) in the forget set, so that the model is triggered to act ignorant / refuse requests when it sees these benign tokens in the future. They then introduce a term to the unlearning objective to ensure \"Scope-aware unlearning.\" The idea is to create scope samples, which contain a mix of benign and unlearning signals, and fine-tune the model to respond to the benign parts while ignoring the unlearning signal.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. This is a new possible attack via unlearning that I have not heard of before. It does seem like it would be important for model providers to consider this type of attack on their model utility, given that the current mode of thinking is that anyone can submit an unlearning request for \"their data\" -- in reality, it would be hard to check if the data in that request actually belonged to that person.\n\n2. The experiments demonstrate that the stealthy attack does actually substantially reduce the subsequent utility of the model.\n\n3. The authors do compare to standard defenses against data poisoning attacks, which would have been my first thought against this attack.\n\n\nWeaknesses:\n\n1. From what I can tell, the authors do not compare against Task Vectors or the general class of inference-time unlearning methods. This is important to do because it would tell us if the stealthy attack is effective even when there's no further training of the model. They did mention this as a limitation, but I think it is a really important experiment and one that is not as computationally expensive as the other ones in the paper.\n\n2. The tables and results are quite hard to read. There is no bolding, and decimal points are reported to three places. It took me a long time to parse the results.\n\nQUESTIONS:\n1. How effective do you expect stealthy attack to be in the presence of more robust anomaly detection systems? It seems to me it might be easy to spot the specific attack. Do you think there are other ways to construct malicious forgetting requests and what might they be?\n\n2. While Scope-aware Unlearning shows promising results, the scope samples are constructed by concatenating forgetting and retaining prompts. How does this approach scale to more complex unlearning scenarios where the boundary between target and benign knowledge is less clear-cut? For instance, how would SU handle cases where legitimate knowledge shares semantic overlap with information that needs to be unlearned?\n\n3. The scope samples are constructed by simple concatenation - have you experimented with more sophisticated composition strategies, such as interleaving tokens? How does the choice of concatenation order affect performance?\n\n4. Do you have any more general metrics of utility on standard language modeling benchmarks? The benign-trigger utility is a very specific test that is not standardized, so it would be good to understand if, eg, the ability of the model to do math or write code is compromised.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-07-05"}