{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,6]],"date-time":"2026-05-06T23:15:38Z","timestamp":1778109338744,"version":"3.51.4"},"publisher-location":"Cham","reference-count":31,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032160911","type":"print"},{"value":"9783032160928","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-16092-8_38","type":"book-chapter","created":{"date-parts":[[2026,5,6]],"date-time":"2026-05-06T23:08:57Z","timestamp":1778108937000},"page":"677-693","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["When Forgetting Reveals: Black-Box Inversion Attacks on\u00a0Unlearning in\u00a0Large Language Models"],"prefix":"10.1007","author":[{"given":"Zijun","family":"Zhang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Bang","family":"Wu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xingliang","family":"Yuan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,5,1]]},"reference":[{"key":"38_CR1","unstructured":"Abdin, M., et\u00a0al.: Phi-3 Technical Report: a highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219 (2024)"},{"key":"38_CR2","unstructured":"AI, M.: Meta llama 3 8b instruct (2024). https:\/\/huggingface.co\/meta-llama\/Meta-Llama-3-8B-Instruct"},{"key":"38_CR3","doi-asserted-by":"crossref","unstructured":"Arditi, A., et al.: Refusal in language models is mediated by a single direction. arXiv preprint arXiv:2406.11717 (2024)","DOI":"10.52202\/079017-4322"},{"key":"38_CR4","doi-asserted-by":"publisher","first-page":"104995","DOI":"10.52202\/079017-3334","volume":"37","author":"M Bertran","year":"2024","unstructured":"Bertran, M., Tang, S., Kearns, M., Morgenstern, J.H., Roth, A., Wu, S.Z.: Reconstruction attacks on machine unlearning: simple models are vulnerable. Adv. Neural. Inf. Process. Syst. 37, 104995\u2013105016 (2024)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"38_CR5","doi-asserted-by":"crossref","unstructured":"Bourtoule, L., et al.: Machine unlearning. In: 2021 IEEE symposium on security and privacy (SP), pp. 141\u2013159. IEEE (2021)","DOI":"10.1109\/SP40001.2021.00019"},{"key":"38_CR6","doi-asserted-by":"crossref","unstructured":"Cao, Y., Yang, J.: Towards making systems forget with machine unlearning. In: 2015 IEEE Symposium on Security and Privacy, pp. 463\u2013480. IEEE (2015)","DOI":"10.1109\/SP.2015.35"},{"key":"38_CR7","unstructured":"Carlini, N., et al.: Extracting training data from large language models. In: USENIX Security Symposium, pp. 2633\u20132650. USENIX Association (2021)"},{"key":"38_CR8","unstructured":"Cha, S., Cho, S., Hwang, D., Lee, M.: Towards robust and parameter-efficient knowledge unlearning for LLMs. In: ICLR. OpenReview.net (2025)"},{"key":"38_CR9","doi-asserted-by":"crossref","unstructured":"Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., Zhang, Y.: When machine unlearning jeopardizes privacy. In: CCS, pp. 896\u2013911. ACM (2021)","DOI":"10.1145\/3460120.3484756"},{"key":"38_CR10","doi-asserted-by":"crossref","unstructured":"Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., Zhang, Y.: When machine unlearning jeopardizes privacy. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 896\u2013911 (2021)","DOI":"10.1145\/3460120.3484756"},{"key":"38_CR11","unstructured":"Fan, C., et al.: Simplicity prevails: Rethinking negative preference optimization for llm unlearning. arXiv preprint arXiv:2410.07163 (2024)"},{"key":"38_CR12","doi-asserted-by":"crossref","unstructured":"Feng, X., Chen, C., Li, Y., Lin, Z.: Fine-grained pluggable gradient ascent for knowledge unlearning in language models. In: EMNLP, pp. 10141\u201310155. Association for Computational Linguistics (2024)","DOI":"10.18653\/v1\/2024.emnlp-main.566"},{"key":"38_CR13","doi-asserted-by":"crossref","unstructured":"Fu, Y., et al.: Cross-task defense: instruction-tuning LLMs for content safety. arXiv preprint arXiv:2405.15202 (2024)","DOI":"10.18653\/v1\/2024.trustnlp-1.9"},{"key":"38_CR14","doi-asserted-by":"crossref","unstructured":"Gao, J., Garg, S., Mahmoody, M., Vasudevan, P.N.: Deletion inference, reconstruction, and compliance in machine (un) learning. arXiv preprint arXiv:2202.03460 (2022)","DOI":"10.56553\/popets-2022-0079"},{"key":"38_CR15","unstructured":"Geng, J., et al.: A comprehensive survey of machine unlearning techniques for large language models. arXiv preprint arXiv:2503.01854 (2025)"},{"key":"38_CR16","unstructured":"Grynbaum, M.M., Mac, R.: The times sues OpenAI and Microsoft over AI use of copyrighted work. New York Times 27 (2023)"},{"key":"38_CR17","doi-asserted-by":"crossref","unstructured":"Hu, H., Wang,et al.: A duty to forget, a right to be assured? Exposing vulnerabilities in machine unlearning services. In: NDSS. The Internet Society (2024)","DOI":"10.14722\/ndss.2024.24252"},{"key":"38_CR18","doi-asserted-by":"crossref","unstructured":"Hu, H., Wang, S., Dong, T., Xue, M.: Learn what you want to unlearn: unlearning inversion attacks against machine unlearning. In: 2024 IEEE Symposium on Security and Privacy (SP), pp. 3257\u20133275. IEEE (2024)","DOI":"10.1109\/SP54263.2024.00248"},{"key":"38_CR19","unstructured":"Jang, J., et al.: Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504 (2022)"},{"key":"38_CR20","unstructured":"Jin, Z., et al.: Rwku: benchmarking real-world knowledge unlearning for large language models. arXiv preprint arXiv:2406.10890 (2024)"},{"key":"38_CR21","first-page":"53728","volume":"36","author":"R Rafailov","year":"2023","unstructured":"Rafailov, R., Sharma, A., Mitchell, E., Manning, C.D., Ermon, S., Finn, C.: Direct preference optimization: your language model is secretly a reward model. Adv. Neural. Inf. Process. Syst. 36, 53728\u201353741 (2023)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"38_CR22","unstructured":"Research, M.: Phi-3 mini-4k-instruct (2024). https:\/\/huggingface.co\/microsoft\/Phi-3-mini-4k-instruct"},{"key":"38_CR23","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: IEEE Symposium on Security and Privacy, pp. 3\u201318. IEEE Computer Society (2017)","DOI":"10.1109\/SP.2017.41"},{"key":"38_CR24","doi-asserted-by":"crossref","unstructured":"Strubell, E., Ganesh, A., McCallum, A.: Energy and policy considerations for modern deep learning research. In: AAAI. vol.\u00a034, pp. 13693\u201313696 (2020)","DOI":"10.1609\/aaai.v34i09.7123"},{"key":"38_CR25","doi-asserted-by":"crossref","unstructured":"Voigt, P., Von\u00a0dem Bussche, A.: The EU general data protection regulation (gdpr). A practical guide, 1st ed., Cham: Springer International Publishing 10(3152676), 10\u20135555 (2017)","DOI":"10.1007\/978-3-319-57959-7_1"},{"key":"38_CR26","unstructured":"Wang, H., et al.: Erasing without remembering: Implicit knowledge forgetting in large language models. arXiv preprint arXiv:2502.19982 (2025)"},{"key":"38_CR27","unstructured":"Xu, H., Zhu, T., Zhang, L., Zhou, W., Yu, P.S.: Machine unlearning: a survey (2023). https:\/\/arxiv.org\/abs\/2306.03558"},{"key":"38_CR28","unstructured":"Xu, J., Wu, Z., Wang, C., Jia, X.: Lmeraser: large model unlearning through adaptive prompt tuning. arXiv preprint arXiv:2404.11056 (2024)"},{"key":"38_CR29","doi-asserted-by":"crossref","unstructured":"Yao, J., et al.: Machine unlearning of pre-trained large language models. arXiv preprint arXiv:2402.15159 (2024)","DOI":"10.18653\/v1\/2024.acl-long.457"},{"key":"38_CR30","doi-asserted-by":"crossref","unstructured":"Zhang, H., Det al.: R-tuning: Instructing large language models to say \u2019i don\u2019t know\u2019. In: NAACL-HLT, pp. 7113\u20137139. Association for Computational Linguistics (2024)","DOI":"10.18653\/v1\/2024.naacl-long.394"},{"key":"38_CR31","unstructured":"Zhang, R., Lin, L., Bai, Y., Mei, S.: Negative preference optimization: From catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404.05868 (2024)"}],"container-title":["Lecture Notes in Computer Science","Computer Security. ESORICS 2025 International Workshops"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-16092-8_38","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,6]],"date-time":"2026-05-06T23:09:00Z","timestamp":1778108940000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-16092-8_38"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032160911","9783032160928"],"references-count":31,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-16092-8_38","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"1 May 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Toulouse","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"France","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22 September 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 September 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.esorics2025.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}