Search papers, labs, and topics across Lattice.
This paper reveals a critical vulnerability in recent unlearning methods by demonstrating that forgotten prompts can be extracted from targeted unlearned models using a novel attack called Targeted Active Search (TAS). By leveraging retained data and black-box access, TAS identifies forgotten entities and reconstructs prompts with remarkable accuracy, achieving 100% recovery of forgotten entities and up to 95% reconstruction of forgotten prompts. This work highlights the limitations of current unlearning techniques and the potential for adversarial exploitation, raising significant concerns for data privacy and model integrity.
Forgotten prompts can be extracted from unlearned models with 100% accuracy using just a fraction of the queries required by traditional methods.
Recent unlearning methods (e.g. NPO, DPO, LUNAR) make use of refusal alignment to suppress forgotten data. However, it has been shown that refusal responses might leave traces of unlearning, and recent attacks have been able to successfully recover some of the unlearned knowledge. In this paper, we uncover a new vulnerability. Existing attacks typically assume that the forgotten prompts are already known to the adversary and focus on recovering their answers. However, we show that the forgotten prompts themselves can be extracted by using the retained data and black-box access to the model. Our attack, Targeted Active Search (TAS), first identifies the forgotten entities by constructing canonical templates and entity pool, and selectively querying the model using the most informative template-entity pair under a limited query budget. Once the entities are identified, TAS instantiates prompt templates with those entities to probe the unlearned model and reconstruct the forgotten prompts. Experiments across three unlearning methods with three datasets and three LLMs shows that TAS recovers the forgotten entity with $100\%$ accuracy and reconstructs up to $95\%$ of forgotten prompts, all while using up to $99.7\%$ fewer queries than naive probing.
