Unlearning Isn’t Forgetting: Revealing Hidden Leakage in Class Unlearning Evaluations

In this paper, we reveal a significant shortcoming in class unlearning evaluations: overlooking the underlying class geometry can cause information leakage about the forgotten class. We further propose a simple unlearning strategy to mitigate this issue. We introduce Class Membership Inference Attack (CMIA) that uses the probabilities the model assigns to neighboring classes to detect unlearned samples. We find that existing unlearning methods are vulnerable to CMIA across multiple datasets. We then propose a new fine-tuning objective that mitigates this privacy leakage by approximating, for forget-class inputs, the distribution over the remaining classes that a retrained-from-scratch model would produce. To construct this approximation, we estimate inter-class similarity and tilt the target model’s distribution accordingly. The resulting Tilted REWeighting (TREW) distribution serves as the desired distribution during fine-tuning. We also show that across multiple benchmarks, TREW matches or surpasses existing unlearning methods on prior unlearning metrics. More specifically, on CIFAR-10, it reduces the gap with retrained models by $19\%$ and $46\%$ for U-LiRA and CMIA scores, accordingly, compared to the SOTA method for each category.

Modern AI systems are increasingly expected to respect requests to delete information, such as when a user invokes their “right to be forgotten” under privacy regulations like GDPR. A growing research area called machine unlearning aims to remove specific data or concepts from trained models without requiring the expensive process of retraining them from scratch. In this work, we show that many existing class-unlearning methods only create the appearance of forgetting. Although these methods often pass standard evaluation tests, they can still leave behind subtle traces of the deleted class. By studying how models retrained from scratch behave after a class is removed, we found that forgotten examples are often reassigned to semantically similar classes—for example, a model that has never seen automobiles may classify them as trucks. Existing evaluation protocols largely overlook this behavior, allowing hidden information leakage to go undetected. To address this problem, we introduce a new privacy attack called Class Membership Inference Attack (CMIA), which can detect whether a supposedly forgotten class still influenced a model by examining its predictions on related classes. Using CMIA, we show that many state-of-the-art unlearning methods remain vulnerable to privacy leakage. We also propose a new unlearning technique called Tilted REWeighting (TREW). Rather than simply suppressing predictions for the forgotten class, TREW redistributes probability toward similar remaining classes in a way that better matches the behavior of a model retrained from scratch. Across several widely used image datasets, TREW reduces privacy leakage while maintaining strong predictive performance. Our findings suggest that evaluating machine unlearning requires more than checking whether a model stops recognizing a forgotten class—it must also verify that no hidden traces of that class remain in the model’s behavior.