A 2026 preprint from researchers at Universiti Malaya and VinUniversity puts a name to the problem every privacy engineer signing off a deletion request should worry about: a model can pass every output-level unlearning test you run and still carry recoverable traces of the data it was supposed to forget. The paper, “Erased, but Not Gone (Output Forgetting Is Not True Forgetting)”, argues that output forgetting is “a misleading success signal” for machine unlearning, because “standard output-level evaluations can systematically overestimate successful forgetting.” In the authors’ own tests, the residual traces they found inside unlearned models were large enough to “exceed the variability of independent retraining, enable faster information recovery during relearning attack, and persist across scales.”
Translated into audit terms: if your certification rests on forget-set accuracy, refusal behavior, or a membership-inference test aimed at the deleted records, you are measuring whether the model looks erased at the output layer. The evidence assembled across several 2024–2026 papers says that measurement cannot distinguish suppression from removal. This article is a checklist for what to demand instead: relearning-speed probes, representation-level checks against retrained references, membership-inference tests scoped beyond the forget set, and a default assumption that anything released as open weights can be reversed with minimal fine-tuning. Every quantitative claim here is author-reported from preprints with no independent replication in the evidence I can cite, and the reference bar I will propose is itself expensive and noisy. Those limits matter, and they shape the recommendation rather than decorate it.
Why output-level audits pass models that still remember
The mechanism behind the headline is simpler than the jargon suggests. Approximate unlearning methods, the practical kind that modify an existing trained model rather than retraining from scratch, mostly work by steering the model away from producing the target content. The team behind “Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning” put it bluntly: “current approximate unlearning methods simply suppress the model outputs and fail to robustly forget target knowledge in the LLMs.”
Suppression and removal look identical from outside the model. A classifier that no longer predicts the forgotten class, or a language model that refuses or deflects queries about deleted text, passes forget-set accuracy checks either way. “Erased, but Not Gone” names what is actually left behind: a “structured failure mode of current unlearning methods, characterized by forget/retain asymmetry, directional mismatch, localized residual discrepancy.” In plain terms, the changes unlearning leaves in representation space are not randomly distributed the way a genuinely retrained model’s representations would be. They cluster, they point in consistent directions, and they treat the forget set differently from retained data in ways an attacker can find.
The same paper’s authors are careful to say output metrics are not useless. Their position, worth quoting because it is the balanced version of the argument: “Output-level metrics remain useful, especially in black-box settings, but are too weak to serve as the sole success signal when the goal is to remove the influence of the forget set.” Sole success signal is the operative phrase. The anchor preprint’s own account of the field is that output-level success “has become the default success signal in much of the MU literature,” and an audit modeled on that standard evaluation practice inherits the reliance.
The relearning literature supplies the practical demonstration. “Unlearning or Obfuscating?” showed that fine-tuning an unlearned model on benign, adjacent public data reintroduces what was deleted: “relearning on public medical articles can lead an unlearned LLM to output harmful knowledge about bioweapons, and relearning general wiki information about the book series Harry Potter can force the model to output verbatim memorized text.” No access to the original deleted data required. A separate line of work, “Unlearning’s Blind Spots: Over-Unlearning and Prototypical Relearning Attack”, reports that “even when a model appears to have forgotten a target class under conventional accuracy-based evaluation, a small number of forget-class examples can be sufficient to recover its decision ability.” And “Robust LLM Unlearning Against Relearning Attacks” cites earlier rigorous evaluations (Deeb & Roger, 2024) finding that “state-of-the-art unlearning methods achieve recovery rates exceeding 88% after relearning attacks” (source). Treat that recovery figure as a secondhand citation inside another preprint, not a replicated constant. The direction of the evidence, though, is consistent across independent groups: knowledge that fails to appear at the output layer frequently survives in the weights.
The probe toolkit: three relearning tests worth demanding
The most actionable output of this literature is a taxonomy of relearning probes. Each attacks a different suppression mechanism, and each is cheap enough to run before you sign anything.
Benign relearning. Fine-tune the unlearned model on public data that is topically adjacent to the forget set but contains none of it. If deleted knowledge resurfaces, as it did in the medical-article and Harry Potter experiments above, the unlearning suppressed outputs rather than removing influence. This probe requires no deleted data and no adversarial craft, which is precisely why it matters: it models what an ordinary downstream user might do by accident.
Syntactic relearning. “Rethinking Benign Relearning: Syntax as the Hidden Driver of Unlearning Failures” reports that syntactic similarity, not just topic overlap, drives recovery: fine-tuning on text that merely resembles the forgotten data’s structure can reintroduce it. The same paper draws a line auditors should enforce hard. DPO-style safety tuning “merely suppresses outputs with refusal responses, creating only the appearance of forgetting,” and safety-trained models “prove far more vulnerable than unlearning methods” under syntactic relearning. If a vendor’s erasure pipeline is refusal training wearing an unlearning badge, this is the probe that exposes it. Do not accept refusal behavior as evidence of erasure, full stop.
Few-shot or prototypical relearning. The Prototypical Relearning Attack from “Unlearning’s Blind Spots” shows recovery from a handful of forget-class examples, even after conventional accuracy-based evaluation says the class is gone. For an audit, this sets a quantitative question: how many examples, and how few gradient steps, does it take to restore performance on the forget distribution? A model that recovers in five examples and one epoch has not forgotten in any sense worth certifying.
The common metric across all three is relearning speed, not relearning possibility. Any model can be retrained given enough data and compute. The erasure claim fails when recovery is dramatically faster or cheaper than learning the same content from scratch, because that gap is the residual signature.
The reference bar: retrained models, and why it is a band, not a line
Every one of these probes needs a comparison point, or the numbers mean nothing. The field’s canonical definition comes from A Survey of Machine Unlearning, which frames verification as Completeness (Consistency): the unlearned model and a model retrained from scratch without the forget data should make the same predictions on any possible sample, right or wrong. As the survey puts it, “the goal of unlearning verification methods is to certify that one cannot easily distinguish between the unlearned models and their retrained counterparts.”
That is the right ideal, and “Erased, but Not Gone” operationalizes it by benchmarking residual failure modes against “the variability of independent retraining”: retrain several times from different seeds, measure how much the resulting models differ from each other, and ask whether the unlearned model’s internals fall inside that band. The authors report that every method they evaluate is detected outside that band on their diagnostics, with one partial exception: the representation-aware POUR-P method is inconclusive on the two retain-side diagnostics. That is the “still remembers” claim in its strongest author-reported form, with that exception attached.
Now the uncomfortable part, which the same paper concedes: “retraining from scratch is often computationally infeasible in large-scale settings,” making the retrained model “an impractical operational target.” Building a multi-seed retrained reference population for a frontier-scale model can cost more than the original training run times several, and the band you get is seed-noisy, so “within retraining variability” is a noisy threshold, not proof of absence. The survey also notes the field lacks common frameworks and resources for this kind of evaluation, so there is no off-the-shelf harness to rent.
My judgment: match the reference bar to the stakes. For a small or mid-size model where a handful of retraining runs is affordable, demand the full band comparison; there is no excuse not to. For a large model where it is not, the honest fallback is a smaller proxy: retrain a reduced-capacity model or a fine-tuned head on the same data split, establish that residual signatures scale (the preprint’s authors report the failure modes “persist across scales,” author-reported), and combine that with aggressive relearning probes on the production model. That fallback is an inference from scaling behavior in one paper, not a validated audit method, and your certification language should say so.
Membership inference: look past the forget set
Membership-inference resistance is the other pillar of conventional audits, and it has its own blind spot. Most evaluations ask whether an attacker can still tell that the deleted records were in training. “Revisiting Privacy Leakage in Machine Unlearning: Membership Inference Beyond the Forgotten Set” reports a stranger finding: a population-level “privacy onion” effect, where peeling off the forget set changes the model in ways that expose the records that remain. The authors found “higher attack accuracy on the post-unlearning model compared to the pre-unlearning model” against retained data, and their TC-UMIA attack, which compares the pre- and post-unlearning models, “improv[es] performance by up to 12% over ML-leaks” (source).
Two audit consequences follow. First, a membership-inference pass on the forget set is necessary but nowhere near sufficient; run the same attacks against retained data, before and after unlearning, and treat an increase in retained-data leakage as a failure even if forget-set resistance looks perfect. Second, publishing both the original and unlearned model, or leaving the original accessible, hands attackers exactly the pairwise comparison TC-UMIA exploits. Distribution practice is part of the erasure claim.
Open-weight releases: assume the unlearning is reversible
If the model ships as open weights, the calculus hardens. “Robust LLM Unlearning Against Relearning Attacks” states the exposure plainly: “any downstream actor can easily reverse unlearning through minimal fine-tuning, undermining the intended protections.” This is not a hypothetical adversary with the deleted dataset. It is anyone with the weights, parameter-efficient fine-tuning, and adjacent public data, which is exactly the benign-relearning setup above. The syntactic-relearning paper finds that LoRA-based relearning recovers forgotten knowledge faster than full-parameter retraining while requiring far fewer resources.
For certification purposes, I would treat an open-weight release as a standing offer to reverse the erasure. That does not necessarily mean refusing to certify; it means the certificate should scope what the claim actually covers. “The model as distributed does not output the deleted content and resists the relearning probes we ran” is supportable if the probes were serious. “The data has been removed from this model” is not, for released weights, on current evidence. If the deletion request carries legal weight, that distinction belongs in writing, and whoever owns the release decision should see it.
How hard should you push erasure?
There is a real tradeoff on the other side, and ignoring it produces audits that demand the impossible. “Unlearning’s Blind Spots” documents the over-unlearning failure mode: methods that push erasure harder “frequently do so at the cost of over-unlearning and worsened susceptibility to the PRA,” degrading retained performance and generalization. An unlearning run tuned to survive every relearning probe may do so by damaging capabilities the model’s users depend on, and, perversely, may become more vulnerable to few-shot recovery, not less.
So the checklist should include utility floors alongside erasure probes: retained-set accuracy, generalization benchmarks, and a check that unlearning targeted the forget set rather than blasting a neighborhood around it (the forget/retain asymmetry the anchor preprint names). The goal is not maximum erasure pressure. It is an erasure claim whose residual signature falls within retraining variability while retained utility stays within an agreed bound. Where those two constraints cannot both be met, that is a finding to report, not a dial to keep turning.
The checklist, and what it cannot prove
Pulling the evidence together, here is what I would require before signing an unlearning certification, and what each item can and cannot establish.
| Audit item | What it probes | Key evidence | What it cannot prove |
|---|---|---|---|
| Forget-set accuracy and output checks | Whether the model still emits deleted content | Baseline; necessary but systematically overestimates forgetting (author-reported) | That knowledge is gone from the weights |
| Benign relearning probe | Recovery from adjacent public data, no deleted data needed | Relearning on public articles restored deleted outputs | Robustness against targeted recovery with real forget data |
| Syntactic relearning probe | Recovery from structurally similar text; exposes refusal-only “unlearning” | Syntax drives relearning failures; safety tuning far more vulnerable | Full topical robustness |
| Few-shot / prototypical relearning | Recovery speed from a handful of forget-class examples | Small example counts restore decision ability | An upper bound on attacker capability |
| Representation check vs retrained-reference band | Whether internal changes look like retraining without the data | Residuals exceed independent-retraining variability (author-reported); Completeness definition | Proof of absence; the band is seed-noisy and expensive |
| MI tests beyond the forget set | Leakage against retained data, pre/post comparison | Higher attack accuracy post-unlearning; TC-UMIA +12% over ML-leaks | That no stronger future attack exists |
| Utility floors | Over-unlearning damage to retained capability | Over-unlearning degrades retained performance | Long-term stability under continued fine-tuning |
| Distribution review | Open-weight reversibility; availability of pre-unlearning weights | Minimal fine-tuning reverses open-weight unlearning | Anything about downstream actors you cannot observe |
Two limits should appear in any certificate built on this list. First, the evidentiary base is thin in a specific way: the representation-level magnitudes come from one 2026 preprint, the 88% recovery figure is a citation inside another, and nothing in this set is independently replicated. The probes are well-motivated; the thresholds are not yet settled numbers. Second, passing every probe raises the cost of recovery and brings the model’s internals closer to a retrained reference, but no finite probe suite can prove data is absent from the weights. Certification on this evidence is a statement about resistance and consistency, not about impossibility.
The regulatory question is open, and the burden has already moved
Nothing in the evidence I can cite establishes that any regulator requires representation-level forgetting rather than output-level compliance, so I will not claim one does. What I can say is that the technical premise underneath an output-only reading of erasure, that a model which no longer produces the data no longer contains it, is now contradicted by a coherent body of author-reported results from multiple independent groups. Auditors do not get to choose which technical facts exist. If you certify on output evidence alone in 2026, you are relying on an assumption the literature has already falsified in the settings those papers tested.
The practical posture is therefore not panic but reallocation. Keep the output checks; they are cheap and necessary. Spend the budget you save on false confidence elsewhere: three relearning probes, membership-inference runs scoped to retained data, utility floors, and, where compute allows, a retrained-reference band. Write the certificate to say what was actually tested. And when a deletion request involves open weights, treat reversibility as the default and say so on paper, because the person whose data was deleted deserves a claim that survives contact with a fine-tuning script.
Frequently Asked Questions
What is the difference between suppression and removal in model unlearning?
Suppression and removal look identical from outside the model. A classifier that no longer predicts the forgotten class, or a language model that refuses or deflects queries about deleted text, passes forget-set accuracy checks either way.
How can benign relearning expose failed unlearning?
Fine-tune the unlearned model on public data that is topically adjacent to the forget set but contains none of it. If deleted knowledge resurfaces, as it did in the medical-article and Harry Potter experiments above, the unlearning suppressed outputs rather than removing influence.
Join the discussion
Share a useful perspective or ask a question about this article.