POPS: Recovering Unlearned Multi-Modality Knowledge in MLLMs with Prompt-Optimized Parameter Shaking

2026-07-07 · Source: Machine Learning · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

Prompt-Optimized Parameter Shaking (POPS) is a new adversarial strategy designed to recover supposedly unlearned multi-modality knowledge from Multimodal Large Language Models (MLLMs). MLLMs, which are trained on extensive textual and visual data, can inadvertently encode privacy-sensitive information, leading to privacy and copyright concerns. While Multi-modality Machine Unlearning (MMU) methods aim to force MLLMs to forget such private data, POPS demonstrates that the robustness of these unlearning techniques is significantly lacking. The POPS method works by optimizing prompt suffixes to elicit victim MLLMs into generating potential private examples. These synthesized outputs are then used to fine-tune the models, compelling them to disclose the original private information. Experiments across various MMU benchmarks reveal substantial weaknesses, with POPS achieving near-complete recovery of sensitive data, thereby exposing critical vulnerabilities in current MMU-based privacy protections.

Key takeaway

For AI Security Engineers evaluating Multi-modality Machine Unlearning (MMU) methods, this research indicates that current techniques are highly susceptible to adversarial recovery. You should not assume unlearned data is permanently erased, as methods like POPS can achieve near-complete recovery. Prioritize developing more robust unlearning algorithms that can withstand prompt-optimized parameter shaking attacks to truly protect sensitive information in deployed MLLMs.

Key insights

POPS demonstrates that current Multi-modality Machine Unlearning methods are fundamentally vulnerable to adversarial recovery of sensitive data.

Principles

• Existing MMU algorithms have substantial weaknesses.
• Adversarial prompt optimization can recover unlearned data.
• Unlearning robustness is not fully exploited.

Method

POPS optimizes prompt suffixes to elicit potential private examples from MLLMs, then fine-tunes models using these synthesized outputs to disclose true private information.

In practice

• Synthesize private examples via prompt optimization.
• Fine-tune MLLMs to disclose unlearned data.
• Test MMU robustness against recovery attacks.

Topics

• Multimodal LLMs
• Machine Unlearning
• Adversarial Attacks
• Data Privacy
• Prompt Optimization
• Information Recovery

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Scientist, AI Security Engineer

Related on AIssential

• Learning What to Forget: Improving LLM Unlearning via Learned Token-Level Importance — Effective LLM unlearning requires implicitly identifying and selectively targeting forget-specific tokens based on their conflict with retaining general capabilities.
• Unveiling Privacy Risks in Multi-modal Large Language Models: Task-specific Vulnerabilities and Mitigation Challenges — MLLMs pose unique privacy risks by extracting and exposing sensitive information from images and memory.
• PURGE: Projected Unlearning via Retain-Guided Erasure — PURGE unlearns data by projecting gradients to preserve retain-set performance and erasing hidden representations towards retain distribution.
• RePAIR: Interactive Machine Unlearning through Prompt-Aware Model Repair — RePAIR enables user-driven, interactive machine unlearning in LLMs via prompt-aware model repair and efficient activation manipulation.
• Class Unlearning via Depth-Aware Removal of Forget-Specific Directions — DAMP offers a one-shot, closed-form weight-surgery for class unlearning by removing forget-specific directions.
• Forgetting That Sticks: Quantization-Permanent Unlearning via Circuit Attribution — Quantization can reverse machine unlearning, necessitating methods that ensure forgetting persists post-compression.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Machine Learning.