POPS: Recovering Unlearned Multi-Modality Knowledge in MLLMs with Prompt-Optimized Parameter Shaking

2026-07-09 · Source: cs.LG updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

POPS, or Prompt-Optimized Parameter Shaking, is a novel adversarial strategy designed to recover supposedly unlearned multi-modality knowledge from Multimodal Large Language Models (MLLMs). MLLMs, which are trained on vast textual and visual data, can inadvertently encode privacy-sensitive information, prompting the development of Multi-modality Machine Unlearning (MMU) methods to enforce forgetting. However, POPS demonstrates that the robustness of these unlearning techniques is not fully exploited against malicious users. The method works by optimizing prompt suffixes to elicit potential private examples from victim MLLMs, then fine-tuning the models with these synthesized outputs to disclose the true private information. Experiments on various MMU benchmarks reveal significant weaknesses, with POPS achieving near-complete recovery of erased sensitive data, thus challenging the foundational robustness of current MMU-based privacy protections.

Key takeaway

For AI Security Engineers evaluating Multimodal Large Language Model (MLLM) privacy, this research indicates that current Multi-modality Machine Unlearning (MMU) methods are fundamentally vulnerable. You should not rely solely on existing MMU algorithms for robust privacy protection. Instead, integrate adversarial testing strategies like Prompt-Optimized Parameter Shaking (POPS) into your security assessments to proactively identify and mitigate potential data recovery risks in your MLLMs.

Key insights

POPS reveals critical vulnerabilities in Multi-modality Machine Unlearning by demonstrating near-complete recovery of supposedly forgotten private data.

Principles

• Existing Multi-modality Machine Unlearning (MMU) algorithms possess substantial weaknesses.
• Adversarial prompt optimization can effectively elicit unlearned private information.

Method

POPS optimizes prompt suffixes to generate potential private examples from MLLMs, then fine-tunes the models using these outputs to disclose true private data.

In practice

• Evaluate MLLM unlearning robustness against adversarial recovery methods.
• Identify specific privacy leakage vectors in multimodal models.

Topics

• Multimodal LLMs
• Machine Unlearning
• Adversarial Attacks
• Data Privacy
• Prompt Optimization
• Model Robustness

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer

Related on AIssential

• POPS: Recovering Unlearned Multi-Modality Knowledge in MLLMs with Prompt-Optimized Parameter Shaking — POPS demonstrates that current Multi-modality Machine Unlearning methods are fundamentally vulnerable to adversarial recovery of sensitive data.
• Unveiling Privacy Risks in Multi-modal Large Language Models: Task-specific Vulnerabilities and Mitigation Challenges — MLLMs pose unique privacy risks by extracting and exposing sensitive information from images and memory.
• Stochastic Meta-Unlearning: Bridging Language Backbone and Multimodal Unlearning — VLM unlearning requires multimodal feedback; text-only unlearning on the language backbone is insufficient for complete forgetting.
• Forced Deferral: Manipulating Routing Decisions in Multimodal LLM Cascades — Adversarial attacks can manipulate MLLM cascade weak model confidence, forcing expensive strong model usage and increasing computational cost.
• Multimodal Unlearning Across Vision, Language, Video, and Audio: Survey of Methods, Datasets, and Benchmarks — Multimodal unlearning selectively removes sensitive data from foundation models while preserving utility.
• Learning What to Forget: Improving LLM Unlearning via Learned Token-Level Importance — Effective LLM unlearning requires implicitly identifying and selectively targeting forget-specific tokens based on their conflict with retaining general capabilities.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.LG updates on arXiv.org.