Before-and-after weights can expose data an unlearning procedure was meant to erase

Approximate machine unlearning changes model parameters to reduce exposure of selected examples. An adversary holding both model versions can use the difference as a localization signal and then probe candidate prefixes for reconstruction. The attacker has information a user of only the final model does not.

TRACE demonstrates reconstruction against selected approximate-unlearning methods using paired pre-removal and post-removal checkpoints, with benchmark examples rather than a reported victim data leak. Reconstruction rates depend on the benchmark, method and which checkpoints can be obtained. The paper does not show a universal extraction rate for all unlearning algorithms or production model deployments.

Treat release of paired checkpoints as a separate privacy decision. Evaluate deletion claims against the actual attacker access model and independent prefix-reconstruction probes. A model can pass ordinary final-model forgetting tests yet leak through version differences distributed to researchers or customers. Primary evidence.

Additional evidence and trust boundary

The privacy issue is a differential disclosure surface. The model-change vector itself can narrow which tokens were altered, even if the final model appears to have forgotten the examples under ordinary prompting. Store and authorize historical checkpoints as potentially sensitive data, and evaluate deletion under the actual multi-snapshot attacker model. A final-model-only API does not automatically expose the studied capability. Supporting record.