Original title: Extracting Forgotten Prompts from Targeted Unlearned Models
Au Ashley Hoi-Ting, Meghdad Kurmanji, William F. Shen, Nicholas D. Lane +1 · September 2026
When AI systems are trained to forget private information, they usually learn to refuse to answer questions about it. But refusing to talk can actually give away what was hidden. Earlier tests showed that attackers could recover forgotten answers, but only if they already knew the exact questions. Researchers found that attackers do not even need to know the questions. They built an attack called Targeted Active Search. It takes retained data and tests the AI model like a black box. The system tests pairs of templates and entities to pick out the forgotten subjects under a tight query limit. Next, it fills in prompt templates to rebuild the hidden questions. It found the forgotten entities with 100% accuracy and recovered up to 95% of the forgotten prompts.
You delete an email from your inbox, but you remember who you were talking to. By asking your friend about recent conversations, they might not repeat the email, but their responses can reveal the topic. In this paper, the attack uses similar conversations—the retained data—to deduce what was supposed to be forgotten.
If AI systems can be made to forget data for privacy, but the deletion leaves recoverable traces, then individuals relying on this for protection are at risk. This work demonstrates that current unlearning techniques are insufficient, urging a reevaluation of data privacy safeguards in AI.
The abstract indicates that the attack was tested on three specific unlearning methods and three LLMs, so it may not apply universally. It requires black-box access to the model, which might not always be available. The paper does not discuss how to defend against this attack or whether it works on all types of unlearned data.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Extracting Forgotten Prompts from Targeted Unlearned Models — Au Ashley Hoi-Ting, Meghdad Kurmanji, William F. Shen et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.