{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T16:14:10Z","timestamp":1782404050266,"version":"3.54.5"},"reference-count":114,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"DOI":"10.13039\/100000964","name":"National Research Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000964","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Singapore and Infocomm Media Development Authority"},{"name":"Tech Funding Initiative and Strategic Capability Research Centres Funding Initiative"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Open J. Comput. Soc."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/ojcs.2025.3543483","type":"journal-article","created":{"date-parts":[[2025,2,18]],"date-time":"2025-02-18T18:27:34Z","timestamp":1739903254000},"page":"413-425","source":"Crossref","is-referenced-by-count":29,"title":["Threats, Attacks, and Defenses in Machine Unlearning: A Survey"],"prefix":"10.1109","volume":"6","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4060-0839","authenticated-orcid":false,"given":"Ziyao","family":"Liu","sequence":"first","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-2235-6735","authenticated-orcid":false,"given":"Huanyi","family":"Ye","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4637-9250","authenticated-orcid":false,"given":"Chen","family":"Chen","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2692-6429","authenticated-orcid":false,"given":"Yongsen","family":"Zheng","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7479-7970","authenticated-orcid":false,"given":"Kwok-Yan","family":"Lam","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1057\/s41284-024-00435-3"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.3389\/frai.2024.1377011"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/s12530-022-09431-7"},{"key":"ref4","volume-title":"Beyond the Algorithm: AI, Security, Privacy, and Ethics","author":"Santos","year":"2024"},{"issue":"1","key":"ref5","article-title":"General data protection regulation (GDPR)","volume":"24","author":"Regulation","year":"2018","journal-title":"Intersoft Consulting"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.21552\/edpl\/2019\/1\/15"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3211013"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3603620"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.35"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.23087"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2023.3321594"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM48880.2022.9796721"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2024.3355188"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00248"},{"key":"ref15","article-title":"A survey of machine unlearning","author":"Nguyen","year":"2022"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2024.3379240"},{"key":"ref17","article-title":"Learn to unlearn: A survey on machine unlearning","author":"Qu","year":"2023"},{"key":"ref18","article-title":"Blockchain-enabled trustworthy federated unlearning","author":"Lin","year":"2024"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/BigData59044.2023.10386788"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM52122.2024.10621201"},{"key":"ref21","article-title":"Federated unlearning: A perspective of stability and fairness","author":"Shao","year":"2024"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3565287.3610269"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2024.3486109\/mm1"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3565287.3610269"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2024\/503"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2025.3530988"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2025.104010"},{"key":"ref28","article-title":"Machine unlearning: A comprehensive survey","author":"Wang","year":"2024"},{"key":"ref29","first-page":"1","article-title":"A survey on federated unlearning: Challenges, methods, and future directions","volume":"57","author":"Liu","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"ref30","article-title":"SoK: Challenges and opportunities in federated unlearning","author":"Jeong","year":"2024"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2024.3478334"},{"key":"ref32","article-title":"A survey of federated unlearning: A taxonomy, challenges and future directions","author":"Yang","year":"2023"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.004.2300056"},{"key":"ref34","first-page":"28525","article-title":"The WMDP benchmark: Measuring and reducing malicious use with unlearning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li","year":"2024"},{"key":"ref35","article-title":"Eight methods to evaluate robust unlearning in LLMs","author":"Lynch","year":"2024"},{"key":"ref36","article-title":"Guardrail baselines for unlearning in LLMs","author":"Thaker","year":"2024"},{"key":"ref37","article-title":"Knowledge unlearning for LLMs: Tasks, methods, and challenges","author":"Si","year":"2023"},{"key":"ref38","article-title":"Rethinking machine unlearning for large language models","author":"Liu","year":"2024","journal-title":"Nature Mach. Intell."},{"key":"ref39","article-title":"Machine unlearning in generative AI: A survey","author":"Liu","year":"2024"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2015.152"},{"key":"ref41","article-title":"MPC-enabled privacy-preserving neural network training against malicious attack","author":"Liu","year":"2020"},{"key":"ref42","first-page":"945","article-title":"$\\lbrace$MLaaS $\\rbrace$ in the wild: Workload analysis and scheduling in $\\lbrace$ Large-Scale $\\rbrace$ heterogeneous $\\lbrace$ GPU$\\rbrace$ clusters","volume-title":"Proc. 19th USENIX Symp. Networked Syst. Des. Implementation","author":"Weng","year":"2022"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24178"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3551636"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3182979"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24252"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484756"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1002\/int.23000"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670398"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2022-0079"},{"key":"ref52","first-page":"16937","article-title":"Inverting gradients-how easy is it to break privacy in federated learning?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Geiping","year":"2020"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_2"},{"key":"ref54","article-title":"Textual unlearning gives a false sense of unlearning","author":"Du","year":"2024"},{"key":"ref55","first-page":"6028","article-title":"Forget unlearning: Towards true data-deletion in machine learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Chourasia","year":"2023"},{"key":"ref56","first-page":"9086","article-title":"Soft prompt threats: Attacking safety alignment and unlearning in open-source LLMs through the embedding space","volume":"37","author":"Schwinn","year":"2024","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref57","first-page":"16319","article-title":"Adaptive machine unlearning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Gupta","year":"2021"},{"key":"ref58","article-title":"Static and sequential malicious attacks in the context of selective forgetting","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Zhao","year":"2024"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref60","article-title":"Exploiting machine unlearning for backdoor attacks in deep learning system","author":"Zhang","year":"2023"},{"key":"ref61","article-title":"Hidden poison: Machine unlearning enables camouflaged poisoning attacks","volume-title":"Proc. NeurIPS ML Saf. Workshop","author":"Di","year":"2022"},{"key":"ref62","first-page":"1932","article-title":"Towards understanding and enhancing robustness of deep learning models against malicious unlearning attacks","volume-title":"Proc. 29th ACM SIGKDD Conf. Knowl. Discov. Data Mining","author":"Qian","year":"2023"},{"key":"ref63","article-title":"Witches\u2019 brew: Industrial scale data poisoning via gradient matching","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Geiping","year":"2020"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref65","article-title":"$\\lbrace$UBA-Inf $\\rbrace$: Unlearning activated backdoor attack with $\\lbrace$ Influence-Driven$\\rbrace$ camouflage","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"Huang","year":"2024"},{"key":"ref66","article-title":"Releasing malevolence from benevolence: The menace of benign data on machine unlearning","author":"Ma","year":"2024"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i7.20736"},{"key":"ref68","first-page":"3832","article-title":"Certified data removal from machine learning models","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","author":"Guo","year":"2020"},{"key":"ref69","article-title":"FairSISA: Ensemble post-processing to improve fairness of unlearning in LLMs","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Kadhe","year":"2023"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00019"},{"key":"ref71","article-title":"Your fairness may vary: Pretrained language model fairness in toxic text classification","volume-title":"Proc. Annu. Meeting Assoc. Comput. Linguistics","author":"Soares","year":"2022"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/3589335.3651578"},{"key":"ref73","article-title":"GNNDelete: A general strategy for unlearning in graph neural networks","volume-title":"Proc. 11th Int. Conf. Learn. Representations (ICLR)","author":"Cheng","year":"2023"},{"key":"ref74","first-page":"104995","article-title":"Reconstruction attacks on machine unlearning: Simple models are vulnerable","volume":"37","author":"Bertran","year":"2024","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i13.29321"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1163\/1574-9347_dnp_e1128020"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM48880.2022.9796974"},{"key":"ref79","article-title":"Corrective machine unlearning","author":"Goel","year":"2024"},{"key":"ref80","article-title":"Model sparsity can simplify machine unlearning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Liu","year":"2024"},{"key":"ref81","article-title":"Adversarial unlearning of backdoors via implicit hypergradient","volume-title":"Proc. Int. Conf. Learn. Representations (ICLR)","author":"Zeng","year":"2022"},{"key":"ref82","article-title":"Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Wei","year":"2024"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00017"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179336"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612418"},{"key":"ref86","first-page":"1785","article-title":"Erase to enhance: Data-efficient machine unlearning in MRI reconstruction","volume-title":"Proc. Med. Imag. Deep Learn.","author":"Xue","year":"2024"},{"key":"ref87","first-page":"105425","article-title":"Large language model unlearning","volume":"37","author":"Yao","year":"2025","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.107"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2023.3345388"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2023.3343117"},{"key":"ref91","first-page":"393","article-title":"Federated unlearning and server right to forget: Handling unreliable client contributions","volume-title":"Proc. Int. Conf. Recent Trends Image Process. Pattern Recognit.","author":"Bano","year":"2023"},{"key":"ref92","article-title":"Unlearning reveals the influential training data of language models","author":"Isonuma","year":"2024"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3313577"},{"key":"ref94","article-title":"Selective forgetting: Advancing machine unlearning techniques and evaluation in language models","author":"Wang","year":"2024"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179383"},{"key":"ref96","first-page":"13433","article-title":"Prompt certified machine unlearning with randomized gradient smoothing and quantization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Zhang","year":"2022"},{"key":"ref97","first-page":"4241","article-title":"Fast federated machine unlearning with nonlinear functional theory","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Che","year":"2023"},{"key":"ref98","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc Int. Conf. Mach. Learn.","author":"Cohen","year":"2019"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3194884"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512222"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/IWQOS52092.2021.9521274"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645669"},{"key":"ref103","article-title":"Is ema robust? Examining the robustness of data auditing and a novel non-calibration extension","volume-title":"Proc. NeurIPS 2023 Workshop Regulatable ML","author":"Alag","year":"2023"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1017\/9781108966559.019"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2022-0072"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3328269"},{"key":"ref107","article-title":"Federated unlearning: How to efficiently erase a client in FL?","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Halimi","year":"2022"},{"key":"ref108","article-title":"Federated unlearning via active forgetting","author":"Li","year":"2023"},{"key":"ref109","article-title":"Towards adversarial evaluations for inexact machine unlearning","author":"Goel","year":"2022"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/tbdata.2022.3190835"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2024.3476533"},{"key":"ref113","article-title":"Privacy-preserving federated unlearning with certified client removal","author":"Liu","year":"2024"},{"key":"ref114","article-title":"Trustworthy, responsible, and safe AI: A comprehensive architectural framework for AI safety with challenges and mitigations","author":"Chen","year":"2024"}],"container-title":["IEEE Open Journal of the Computer Society"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8782664\/10834807\/10892039.pdf?arnumber=10892039","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,19]],"date-time":"2025-03-19T04:57:24Z","timestamp":1742360244000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10892039\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":114,"URL":"https:\/\/doi.org\/10.1109\/ojcs.2025.3543483","relation":{},"ISSN":["2644-1268"],"issn-type":[{"value":"2644-1268","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}