Approximate unlearning in large language models leaves recoverable sensitive data traces
TRACE: Data-Free Text Reconstruction Attacks against Approximate Unlearning in LLMs
Cryptography and SecurityMachine Learning
Summary
When companies remove information from large language models to protect privacy, they often use a shortcut called approximate unlearning instead of fully retraining the model. The authors show this shortcut can leave hidden clues in the model's saved versions that let someone uncover the removed private data. They created a method called TRACE that uses these clues to rebuild the deleted text, even without knowing anything about the data beforehand. Their tests show this risk exists across different models and unlearning methods, raising concerns about privacy.
What this means in practice
- •For model auditors: Detect residual private data in approximate unlearning by comparing pre- and post-removal model snapshots to evaluate privacy leakage.
- •For ai compliance teams: Manage and restrict access to saved model versions to prevent data reconstruction attacks during regulatory data removal processes.
Authors
Mengying Zhang, Derui Wang, Ibrahim Khalil, Bowen Liu, Xiaoyu Xia, Minhui Xue
Abstract
As large language models (LLMs) face growing demands for data removal driven by regulatory compliance, copyright concerns, and privacy protection, approximate unlearning has emerged as a practical alternative to expensive full retraining. In practice, pre- and post-unlearning model snapshots are often maintained for auditing and rollback, introducing a previously overlooked side channel. This paper demonstrates that approximate unlearning in LLM can leave residual traces within model snapshots, which may be recoverable and thus enable the privacy breaches that approximate unlearning is intended to prevent. Here, we propose TRACE, a framework that reconstructs unlearned training data given access to pre- and post-unlearning model snapshots, without any data-specific prior knowledge. To achieve this, TRACE identifies a compact set of candidate tokens from embedding-level parameter differences to constrain the search space, and assembles sequences via a contrastive scoring mechanism based on the perplexity gap between the two models. A two-stage exploration-then-completion strategy enables the recovery of multiple distinct samples. Extensive experiments on various datasets, including TOFU, MUSE, and WMDP, across multiple LLMs and six representative unlearning methods, demonstrate that TRACE achieves high-fidelity reconstruction. This paper exposes significant privacy risks in current LLM approximate unlearning deployments and highlights the need for defenses against parameter-difference leakage and appropriate management of model snapshot access.