TRACE: Data-Free Text Reconstruction Attacks against Approximate Unlearning in LLMs

Summary

This paper shows that approximate unlearning in LLMs can leave residual traces in pre- and post-unlearning model snapshots, which can be used to recover the supposedly removed training data. It proposes TRACE, which reconstructs unlearned text from the two snapshots without prior knowledge of the data, using embedding-level parameter differences and a perplexity-gap contrastive score. Experiments on TOFU, MUSE, and WMDP across multiple LLMs and six unlearning methods report high-fidelity reconstruction.

Related items

• InfoBeyond membership inference: Distributional leakage in diffusion modelsSimilar attack · Elsevier Security Journals
• InfoLabel-Budgeted Attribute Inference from Protected Features in Edge-Cloud Split Multimodal LLMsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoEnterprise Agentic RAG with Pre-Search Role-Based Access Control, Multi-Layered Guardrails, and Operational TelemetrySimilar attack · OpenAlex (peer-reviewed AI security)
• LowAgent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)