TRACE reconstructs unlearned LLM text from pre- and post-unlearning snapshots
Original title: TRACE: Data-Free Text Reconstruction Attacks against Approximate Unlearning in LLMs
The attack needs no data-specific prior and was tested on TOFU, MUSE, and WMDP with six unlearning methods.
TRACE is a data-free framework that reconstructs training text that approximate unlearning was meant to remove, using only pre- and post-unlearning model snapshots. It narrows candidate tokens from embedding-level parameter differences, scores sequences by the perplexity gap between the two models, and recovers multiple samples with an exploration-then-completion strategy. Experiments cover TOFU, MUSE, and WMDP, multiple LLMs, and six unlearning methods. The authors say the results show high-fidelity reconstruction and call for limits on snapshot access and defenses against parameter-difference leakage.
Unconfirmed: High-fidelity reconstruction is the authors' experimental claim; no named production deployment is shown.
- Approximate unlearning is treated as a cheaper alternative to full retraining.
- Snapshots kept for audit and rollback are the side channel.
- Candidate tokens come from embedding-level parameter differences.
- Datasets named are TOFU, MUSE, and WMDP.
- Six representative unlearning methods were evaluated.
Impact: Recovery of training text that unlearning was meant to remove
- 1.Restrict access to pre- and post-unlearning model snapshots.
- 2.Treat parameter differences between snapshots as a leakage channel.
From the original article
1 min read at arxiv.orgAs large language models (LLMs) face growing demands for data removal driven by regulatory compliance, copyright concerns, and privacy protection, approximate unlearning has emerged as a practical alternative to expensive full retraining. In practice, pre- and post-unlearning model snapshots are often maintained for auditing and rollback, introducing a previously overlooked side channel.
By Mengying Zhang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.