The DOI matches its Crossref record; 36 of the 36 references it cites were found in a registry or an index.
TruVRF: Toward Triple-Granularity Verification on Machine Unlearning
Abstract
The right to be forgotten has incentivized machine unlearning, but a key challenge persists: the lack of reliable methods to verify unlearning conducted by model providers. This gap facilitates dishonest model providers to deceive data contributors. Current approaches often rely on invasive methods like backdoor injection. However, it poses security concerns and is also inapplicable to legacy data—already released data. To tackle this challenge, this work initializes the first non-invasive unlearning verification framework which operates at triple-granularity (class-, volume-, sample-level) to assess the data facticity and volume integrity of machine unlearning. In this paper, we propose a framework, named TruVRF, encompasses three Unlearning-Metrics, each tailored to counter different types of dishonest model providers or servers (Neglecting Server, Lazy Server, Deceiving Server). TruVRF leverages non-invasive model sensitivity to enable multi-granularity verification of unlearning. Specifically, Unlearning-Metric-I checks if the removed class matches the data contributor’s unlearning request, Unlearning-Metric-II measures the amount of unlearned data, and Unlearning-Metric-III validates the correspondence of a specific unlearned sample with the requested deletion. We conducted extensive evaluations of TruVRF efficacy across three datasets, and notably, we also evaluated the effectiveness and computational overhead of TruVRF in real-world applications for the face recognition dataset. Our experimental results demonstrate that TruVRF achieves robust verification performance: Unlearning-Metric-I and -III achieve over 90% verification accuracy on average against dishonest servers, while Unlearning-Metric-II maintains an inference deviation within 4.8% to 8.2%. Additionally, TruVRF demonstrates generalizability across diverse conditions, including varying numbers of unlearned classes and sample volumes. Significantly, TruVRF is applied to two state-of-theart unlearning frameworks: SISA [3] (presented at Oakland’21) and Amnesiac Unlearning [18], representing exact and approximate unlearning methods, respectively, which affirm TruVRF’s practicality. In addition, we conducted extensive evaluations around TruVRF, including ablation experiments, trade-offs in computational overhead, and the robustness of model sensitivity, among others.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“A body of research has demonstrated that LLMs can memorize and inadvertently leak information from their training datasets [41], [42], [43].”
From External Data Extraction Attacks Against Retrieval-Augmented Large Language Models (2026) · cites this paper as [42]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,587
Reliable Crowdsourcing and Deep Locality-Preserving Learning for Expression Recognition in the Wild
Li, S., Deng, W., & Du, J. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.277 · Cited by 1,470
The German Traffic Sign Recognition Benchmark: A multi-class classification competition
Stallkamp, J., Schlipsing, M., Salmen, J., & Igel, C. (2011) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn.2011.6033395 · Cited by 1,242
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 886
Self-citationBourtoule, L., Chandrasekaran, V., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., & Papernot, N. (2021) · 2021 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40001.2021.00019 · Cited by 810 · cited 9×
“As a solution to this challenge, practical unlearning frameworks like SISA [3] have been proposed to reduce the computational overhead.”
InfluentialMembership Inference Attacks on Machine Learning: A Survey
Hu, H., Salcic, Z. A., Sun, L., Dobbie, G., Yu, P. S., & Zhang, X. (2022) · ACM Computing Surveys · doi:10.1145/3523273 · Cited by 670
Towards Making Systems Forget with Machine Unlearning
Cao, Y., & Yang, J. (2015) · 2015 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2015.35 · Cited by 622 · cited 1×
“1) Exact Unlearning: The notion of machine unlearning was first proposed by Cao et al. [5], which aims to implement the right to be forgotten and decrease the damage of poison data in the machine learning context.”
Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks
Golatkar, A., Achille, A., & Soatto, S. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00932 · Cited by 394
Machine Unlearning of Features and Labels
Warnecke, A., Pirch, L., Wressnegger, C., & Rieck, K. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.23087 · Cited by 278
When Machine Unlearning Jeopardizes Privacy
Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., & Zhang, Y. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3484756 · Cited by 195 · cited 3×
“This model access aligns with previous unlearning research [3], [7], [18], [45].”
Self-citationMaking AI Forget You: Data Deletion in Machine Learning
Ginart, A., Guan, M. Y., Valiant, G., & Zou, J. (2019) · arXiv · doi:10.48550/arxiv.1907.05012 · Cited by 175
Chundawat, V. S., Tarun, A. K., Mandal, M., & Kankanhalli, M. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3265506 · Cited by 162
Machine unlearning: linear filtration for logit-based classifiers
Baumhauer, T., Schöttle, P., & Zeppelzauer, M. (2022) · Machine Learning · doi:10.1007/s10994-022-06178-9 · Cited by 143
Unrolling SGD: Understanding Factors Influencing Machine Unlearning
Thudi, A., Deza, G., Chandrasekaran, V., & Papernot, N. (2022) · 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp53844.2022.00027 · Cited by 135
Lifelong Anomaly Detection Through Unlearning
Du, M., Chen, Z., Liu, C., Oak, R., & Song, D. X. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363226 · Cited by 134
Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., & Zhang, Y. (2022) · Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3548606.3559352 · Cited by 133
Self-citationProof-of-Learning: Definitions and Practice
Jia, H., Yaghini, M., Choquette-Choo, C. A., Dullerud, N., Thudi, A., Chandrasekaran, V., & Papernot, N. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00106 · Cited by 122
Auditing Data Provenance in Text-Generation Models
Song, C., & Shmatikov, V. (2019) · Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3292500.3330885 · Cited by 103
Remember What You Want to Forget: Algorithms for Machine Unlearning
Sekhari, A., Acharya, J., Kamath, G., & Suresh, A. T. (2021) · arXiv · doi:10.48550/arxiv.2103.03279 · Cited by 99
ARCANE: An Efficient Architecture for Exact Machine Unlearning
Yan, H., Li, X., Guo, Z., Li, H., Li, F., & Lin, X. (2022) · Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/556 · Cited by 97
HedgeCut: Maintaining Randomised Trees for Low-Latency Machine Unlearning
Schelter, S., Grafberger, S., & Dunning, T. (2021) · Proceedings of the 2021 International Conference on Management of Data · doi:10.1145/3448016.3457239 · Cited by 89
Deep Unlearning via Randomized Conditionally Independent Hessians
Mehta, R., Pal, S., Singh, V. P., & Ravi, S. N. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01017 · Cited by 73
Gupta, V., Jung, C., Neel, S., Roth, A., Sharifi-Malvajerdi, S., & Waites, C. (2021) · arXiv · doi:10.48550/arxiv.2106.04378 · Cited by 67
Hard to Forget: Poisoning Attacks on Certified Machine Unlearning
Marchant, N. G., Rubinstein, B. I. P., & Alfeld, S. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i7.20736 · Cited by 64 · cited 1×
“However, this method involves unacceptable computational overhead, particularly for large-scale datasets, as highlighted [29], [30], [33], which is di ffi cult to use.”
Athena: Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0072 · Cited by 51
The Right to be Forgotten in the Media: A Data-Driven Study
Xue, M., Magno, G., Cunha, E. L. T. P., et al. (2016) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2016-0046 · Cited by 51
Self-citationOn the Necessity of Auditable Algorithmic Definitions for Machine Unlearning
Thudi, A., Jia, H., Shumailov, I., & Papernot, N. (2021) · arXiv · doi:10.48550/arxiv.2110.11891 · Cited by 48
Verifying in the Dark: Verifiable Machine Unlearning by Using Invisible Backdoor Triggers
Guo, Y., Zhao, Y., Hou, S., Wang, C., & Jia, X. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3328269 · Cited by 47
PPA: Preference Profiling Attack Against Federated Learning
Zhou, C., Gao, Y., Fu, A., Chen, K., Dai, Z., Zhang, Z., Xue, M., & Zhang, Y. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.23171 · Cited by 41
Self-citationProof of Unlearning: Definitions and Instantiation
Weng, J., Yao, S., Du, Y., Huang, J., Weng, J., & Wang, C. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3358993 · Cited by 34
zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Training
Sun, H., Bai, T., Li, J., & Zhang, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3520863 · Cited by 33
Efficient Repair of Polluted Machine Learning Systems via Causal Unlearning
Cao, Y., Yu, A. F., Aday, A., Stahl, E., Merwine, J., & Yang, J. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196517 · Cited by 33
Machine Unlearning via Algorithmic Stability
Ullah, E., Mai, T., Rao, A., Rossi, R., & Arora, R. (2021) · arXiv · doi:10.48550/arxiv.2102.13179 · Cited by 26
Graves, L., Nagisetty, V., & Ganesh, V. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i13.17371 · Cited by 5
Research works printed but not linked: 20
- 2019, Personal Information Protection and Electronic Documents Act
- Du, 2024, SoK: Dataset copyright auditing in machine learning systems, arXiv:2410.16618 · arXiv
- Du, SoK: Dataset copyright auditing in machine learning systems, 25
- Eisenhofer, Verifiable and provably secure machine unlearning
- Gao, 2020, Backdoor attacks and countermeasures on deep learning: A comprehensive review, arXiv:2007.10760 · arXiv
- Guo, Certified data removal from machine learning models, 3832
- Izzo, Approximate data deletion from machine learning models, 2008
- 2025, Kaggle Datasets
- Li, Anti-backdoor learning: Training clean models on poisoned data, 34, 14900
- Neel, Descent-to-delete: Gradient-based methods for machine unlearning, 931
- General Data Protection Regulation
- 2025, Amazon Data Exchange
- Shumailov, Manipulating SGD with data ordering attacks, 18021
- 2020, California Privacy Rights Act
- Tang, Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection, 1541
- Wang, Training with more confidence: Mitigating injected and natural backdoors during training, 35, 36396
- Wu, DeltaGrad: Rapid retraining of machine learning models, 10355
- Xiao, 2017, Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms, arXiv:1708.07747 · arXiv
- Zhang, Verification of machine unlearning is fragile
- Zhang, Prompt certified machine unlearning with randomized gradient smoothing and quantization, 13433
Cited by
External Data Extraction Attacks Against Retrieval-Augmented Large Language Models
He, Y., Chen, Y., Li, Y., Shao, S., Qi, L., Li, B., Tao, D., & Qin, Z. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3705326 · Cited by 4
Metadata
- Authors
- Zhou, C., Gao, Y., Fu, A., Chen, K., Zhang, Z., Xue, M., Dai, Z., Ji, S., & Zhang, Y.
- Affiliations
- College of Computer Science and Technology, Zhejiang University, Hangzhou, China
- School of Computer Science and Software Engineering, The University of Western Australia, Perth, WA, Australia
- College of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing, China
- Chinese Academy of Sciences, Beijing, China
- Data61, CSIRO, Sydney, NSW, Australia
- School of Cyber Science and Engineering, Nanjing University of Science and Technology, Nanjing, China
- National Computer Network Intrusion Protection Center, University of Chinese Academy of Sciences, Beijing, China
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2025
- Volume
- 20
- Pages
- 4844-4859
- ISSN
- 1556-6013
- 1556-6021
- Cited by
- 7
- References
- 36
- Licence
- Funders
- National Natural Science Foundation of China (2022YFB3102100, U24A20336, 62372236, 62172243, 62402425, 62402418)
- NSFC-Yeqisun Science Foundation (U244120033)
- China Postdoctoral Science Foundation (2024M762829)
- Open Foundation of the State~Key Laboratory of Integrated Services Networks (ISN24-15)
- Qing Lan Project of Jiangsu Province
- Natural Science Foundation of Zhejiang Province (LD24F020002)
- Zhejiang Provincial Priority- Funded Postdoctoral Research Project (ZJ2024001)
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
