Protecting Sensitive Knowledge Under LLM Unlearning: The Proxy Threat and a Superposition-Aware Defense

Summary

Researchers show that LLM unlearning can be exploited because entity representations overlap in shared parameter subspaces, a phenomenon called knowledge superposition. An attacker can submit a legitimate unlearning request for a removable proxy entity, which also removes a sensitive target entity that was never requested. The authors define this as the Proxy Unlearning Attack (PUA) and propose Superposition-Aware Unlearning Protection (SAUP), which detects at-risk entities before unlearning and restores affected entities afterward.

Mitigation

Proposed defense: Superposition-Aware Unlearning Protection (SAUP), applied to unlearning requests in two stages. Before unlearning, superposition detection estimates which sensitive entities the request puts at risk. After unlearning, SAUP decouples the shared representations and restores the affected entities while keeping the requested entities suppressed.

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
• MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database