1 Introduction↩︎

Recent advances in Multimodal Large Language Models (MLLMs), which take multimodal information as input and answer user questions like LLMs, have successfully integrated visual and textual components, achieving remarkable performance and generalization capabilities on tasks including multimodal conversation [1]–[4], visual reasoning [5]–[7], and cross-modal content understanding [8]–[10]. The success of MLLMs typically relies on massive datasets that may inadvertently contain sensitive or private information. Regulations like the General Data Protection Regulation (GDPR) [11] underscore the critical need for methods to effectively protect privacy-sensitive data. However, the development of MLLMs further enriches the risks of privacy leakage beyond conventional single-modality scenarios due to complex cross-modal dependencies [12], [13].

When sensitive information has already been encoded in an MLLM, Machine Unlearning (MU) emerges as a post-hoc solution and has seen substantial research interest [14]. Recent work on MMU has proposed adaptations of unimodal unlearning methods [14]–[18], as well as dedicated multimodal methods and benchmarks [19], [20], with evaluation typically focusing on whether unlearned models can still directly recall targeted instances. For instance, [19] developed the first benchmark to evaluate MU methods in multi-modality setups, showing that jointly unlearning both modalities outperforms single-modality approaches in terms of removal efficacy. Later, [21] devised a fine-grained unlearning framework for efficiently eliminating hallucinations without the need for paired data of text and image, demonstrating the broader applications of MMU [22].

Despite the advancement of unlearning from unimodal to multimodal context, its robustness against adversarial scenarios, such as model inversion attacks [13], [23]–[25], remains underexplored. Critically, the multi-modality representations not only enrich the expressiveness of models but also enable novel attacks upon the model. For instance, an attacker might use visual features of a person’s workplace in an image to infer their textual job description, or leverage textual context about medical symptoms to reconstruct visual diagnostic information that was supposedly removed after unlearning. Except for such privacy inference from visual or textual information, it remains underexplored to understand the fragility of MMU, especially when models could be released to malicious users without strict controls and where the supposedly unlearned knowledge may still be recalled.

Importantly, the multimodal setting introduces a qualitatively new attack surface that is absent from unimodal systems: cross-modal memory persistence. Prior work has shown that unimodal LLM unlearning is not fully robust [26], while those robustness failures arise from residual knowledge within a single representation space. In multimodal models, by contrast, information is encoded across multiple interacting modalities: visual features of a person’s appearance or workplace can retain, and subsequently leak, textual biographical information even after that textual knowledge has been explicitly unlearned. This cross-modal entanglement provides fundamentally new attack opportunities that exploit joint visual-textual representations.

In this paper, we study the robustness of MMU under the realistic adversarial interactions, where an attacker has query and fine-tuning access to an unlearned model but no access to the original forget set. To this end, we propose a novel adversarial framework tailored for multimodal unlearning via fine-tuning MLLMs on customized generated samples, dubbed Prompt-Optimized Parameter Shaking (POPS). Illustrated in Figure 1, our method explores the vulnerability of MMU by probing residual knowledge of unlearned data with prompt-suffix optimization and synthetic-augmented fine-tuning. Specifically, our method involves three steps: (1) Optimizing a prompt suffix that adapts victim MLLMs to generate potential private data; (2) Prompting the MLLMs with the optimized suffix to generate samples with the optimized suffix; (3) Fine-tuning the MLLMs with the synthetic samples. Extensive experiments on three multimodal unlearning benchmarks demonstrate that POPS can recover a large fraction of supposedly erased sensitive information across multiple unlearning algorithms and MLLM architectures. In summary, our main contributions can be summarized as:

• Novel Attack Method Against Multimodal Unlearning: We introduce the first fine-tuning based multimodal attack, termed Prompt-Optimized Parameter Shaking (POPS), for exploiting cross-modal prompt vulnerabilities, which then amplifies knowledge recovery via synthetic-augmented fine-tuning.

• Robust Evaluations of Existing MMU Methods: We empirically unveil the fundamental vulnerabilities of both unimodal-adapted strategies (e.g., Gradient Ascent [27], Gradient Diff [28], KL Minimization [29]) and also multimodal-specific unlearning methods (e.g., MANU [30], MultiDelete [31]) when applied to multimodal scenarios, demonstrating that the vulnerability is architectural rather than method-specific.

• Comprehensive Experimental Studies: We provide thorough evaluations on three MMU benchmarks, surprisingly found that our POPS can even achieve a near-complete recovery (reaching 82% recovery with 42.9% accuracy vs. 40.2% for unlearned models on MLLMU-Bench [32]) of supposedly erased sensitive information, approaching the performance (i.e., 43.5%) of models trained on the original data.

2 Background↩︎

In this section, we discuss the related work and introduce the problem statement of MMU recovery.

2.1 Related Work↩︎

Machine Unlearning Foundations. Machine unlearning, originally formalized by [33], addresses efficient removal of specific data points from trained models without full retraining. The field has expanded significantly for Large Language Models (LLMs), driven by their tendency to memorize training data [34]. [18] benchmarked several unlearning methods for pre-trained large language models, including gradient ascent-based objectives, and analyzed their forgetting-utility trade-offs. [35] proposed prompt-based unlearning that appends learned tokens for targeted forgetting without parameter updates. [36] stabilized gradient ascent using fine-grained pluggable gradient ascent to address optimization instabilities. [37] provided closed-form bounds for DP-SGD against record-level inference attacks. Many advanced unlearning methods follow the general intuition of gradient ascent of forgetting.

Multimodal Unlearning Methods. Multimodal systems face cross-modal information leakage where sensitive data removed from one modality may persist in another modality [38]. [39] developed multimodal unlearning for recommender systems using reverse Bayesian Personalized Ranking. [21] mitigated hallucination in multimodal LLMs through gradient ascent with CLIP-based sample curation. Recent dedicated methods include [22]’s MMUnlearner with geometry-constrained gradient ascent for selective visual pattern erasure, and [30]’s MANU using modality-aware neuron pruning for balanced unlearning across modalities. Comprehensive frameworks include [31]’s MultiDelete for modality decoupling and [39] for multi-modal recommender systems. Benchmark studies [19], [20] demonstrate that adapted unimodal methods fail to achieve complete knowledge erasure across modalities.

Privacy Attacks in Multimodal Systems. Model inversion [40] and membership inference attacks [41] have been extended to multimodal systems with new attack surfaces exploiting cross-modal dependencies, which raises new privacy concerns. Surveys [25], [42] overview privacy-preserving techniques, noting challenges in applying differential privacy [43] to multimodal systems due to complex cross-modal interactions. [44] identified privacy challenges in multimodal learning analytics, particularly in balancing utility with privacy across modalities. [45] systematically assessed the adversarial robustness of multimodal medical systems, characterizing how vulnerabilities manifest across modality interactions.

Adversarial Prompt Engineering. [48] showed how prompts enhance model interpretability, while [26] demonstrated adversarial prompts can probe residual memorization in unlearned models. Existing prompt-based attacks operate as open-loop systems optimizing suffixes within the forget domain only, without fine-tuning or out-of-distribution generalization. [13] showed fine-tuning amplifies generative privacy risks. Our approach differs by: (1) OOD-optimized suffixes that search distribution-shifted pools with perplexity filtering for universal generalization, and (2) closed-loop S2L fine-tuning bootstrapping synthetic image-text pairs from suffix outputs. [49] proposed provable defenses for multimodal systems, focusing on certified robustness rather than privacy protection. To sum up, we present Table 1 for a detailed comparison between our proposed POPS with related attack methods. We also present a detailed discussion about the conceptual novelty introduced in our technical proposal in Appendix 14.

2.2 Problem Statement: Multimodal Unlearning and Attack↩︎

Problem Formulation. Consider a multimodal LLM \(M\) (e.g., LLaVA [5]) trained on fully or partially sensitive multimodal data containing both textual descriptions and associated images. Some typical sensitive attributes include: (1) textual attributes (name, birthdate, occupation, location), and (2) visual information (portrait photos, workplace images, personal belongings). For example, removing knowledge of “Dr. Sarah Chen, cardiologist born 1985 in Vancouver” requires erasing both textual facts and visual recognition of her appearance, workplace, or medical equipment she uses. After obtaining \(M_{\text{unlearn}}\), our objective is to assess whether adversarial attacks can recover information that should have been erased, thereby questioning the presumed safety of unlearned model \(M_{\text{unlearn}}\).

Threat Model. We assume a realistic gray-box scenario where the attacker has access to the model for inference and further fine-tuning, but not to the original training data or unlearning algorithm details. Specifically: (1) Attacker Objectives: recover sensitive information explicitly removed during unlearning. (2) Attacker Capabilities: query access with logits for inference and prompt optimization; fine-tuning API access (e.g., OpenAI’s fine-tuning API, HuggingFace, or LoRA adapters); gradient computation for prompt suffix optimization (feasible for open-source MLLMs or via API if gradients are exposed); knowledge that unlearning was applied; access to OOD data (retain set or similar distribution). (3) Attacker Limitations: no access to ground-truth forget set, no access to unlearning algorithm details, and no access to original pre-unlearning model. This threat model is realistic for open-source MLLMs where models are publicly released and users can download and run locally for gradient computation, or use fine-tuning APIs.

3 Methodology: Prompt-Optimized Parameter Shaking↩︎

In this section, we formally present POPS, a novel adversarial attacking framework that exploits the unique vulnerabilities of MMU through cross-modal prompt optimization and targeted fine-tuning. We first introduce each critical and novel component independently in subsequent parts, and then present them under our unified framework for the advanced multimodal unlearning attack.

Our integrated POPS attack exploits a fundamental multimodal privacy vulnerability: cross-modal memory persistence. Unlike unimodal settings where information exists in a single representation space, multimodal models create intricate cross-modal associations where visual patterns remain linked to textual concepts even after targeted unlearning. This creates unique privacy risks where supposedly erased textual information can be recovered through visual-semantic correlations that persist in the shared embedding space.

PromptSuffix Attack. We first design a universal adversarial suffix prompt to exploit unlearned knowledge within \(M_{\text{unlearn}}\). Given the unlearned MLLM \(M_0\), we perform sequential procedures as follows: (1) Generate or obtain an OOD dataset with similar sensitivity patterns to the sensitive target dataset (be supposedly forgotten). (2) Fine-tune and unlearn a copy of \(M_0\) to obtain Model \(M_1\) using the OOD dataset. (3) Optimize a universal prompt suffix using the OOD data that maximizes recovery of target concepts: \[P_{\text{suffix}}^* = \arg\min_{P_{\text{suffix}}}\sum_{(x,y) \sim \mathcal{D}_{\text{OOD}}}\mathcal{L}_{\text{CE}}\\(M_1(P_{\text{target}} \oplus P_{\text{suffix}}), y_{\text{gt}}) + \gamma \cdot \text{PPL}(P_{\text{suffix}})\] where \(P_{\text{target}}\) is the base prompt query containing the target concept, PPL indicates the token-level perplexity of the generated suffix (used as a selection heuristic to retain suffixes the model naturally prefers), \(\oplus\) denotes concatenation, and \(\gamma\) balances concept recovery and perplexity regularization. (4) Apply the optimized suffix \(P_{\text{suffix}}^*\) to prompts of \(M_0\) for retrieving the unlearned sensitive attributes.

Our optimization operates on continuous token embeddings rather than discrete tokens, as shown in Algorithm [alg:suffix95attack]. We optimize continuous suffix embeddings \(\mathbf{e}_{\text{suffix}}\) through gradient descent, then decode them back to discrete text using the model’s token decoder. The Clip operation constrains these continuous embeddings within a reasonable numerical range (\(\ell_\infty\) bound), not discrete tokens. This approach uses the shared embedding space between encoder and decoder via weight tying, enabling smooth gradient-based optimization while producing interpretable discrete text suffixes as output. Unlike GCG [46], which optimizes discrete token sequences to maximize loss on individual examples, our supervision is defined over semantic QA correctness across OOD samples, encouraging cross-instance generalization and discovering suffixes that exploit persistent cross-modal associations rather than surface-level token patterns.

Shake-to-Leak (S2L) Attack. We then adapt the Shake-to-Leak fine-tuning strategy [13], originally proposed for unimodal text-to-image diffusion models, to the MLLM setting by targeting the cross-modal alignment mechanisms that enable information recovery through alternative modality pathways. Our multimodal S2L approach takes advantage of a key architectural property: multimodal models must preserve cross-modal reasoning to remain functional. This requirement, however, introduces persistent vulnerabilities in their alignment layers. Our multimodal S2L introduces three concrete technical changes that do not exist in prior S2L [13]: (1) Multimodal image-QA training pairs: Unlike the original S2L, which fine-tunes on text-only data for unimodal diffusion models, our S2L simultaneously exposes the model to image-question-answer triplets. This is necessary to reactivate dormant visual-semantic alignment across the vision encoder and language model projection layers. (2) Faceted identity decomposition: A single celebrity profile is decomposed into multiple training examples covering distinct identity facets—appearance, biography, occupation, and associations. This structure is specific to MLLM identity knowledge and has no equivalent in unimodal diffusion S2L, where concepts are not organized across modalities. (3) Stage-coupled synthetic data: The fine-tuning data is generated by querying the unlearned model with Stage 1 optimized suffixes, directly coupling the two stages. Prior S2L uses independently collected training data; our design ensures Stage 2 amplifies precisely the residual signals surfaced by Stage 1.

Perplexity and Loss Monitoring. We introduce perplexity and tensor loss monitoring as auxiliary attack techniques tailored for multimodal settings. Specifically, we perform inference with multiple optimized suffix prompts with random initialization, and then choose the response with the lowest perplexity. This selection mechanism exploits the observation that successful cross-modal memory recovery often produces more coherent (lower perplexity) responses, as reactivated cross-modal associations generate more natural multimodal reasoning chains compared to unsuccessful attempts.

Our attack pipeline leverages this multimodal-specific vulnerability through four synergistic stages: (1) Cross-modal prompt discovery: PromptSuffix optimization identifies adversarial triggers that exploit persistent visual-textual associations, targeting the inherent cross-modal entanglement that conventional unlearning cannot fully disentangle without catastrophic utility loss. (2) Multimodal synthetic amplification: Generate targeted synthetic data that strengthens cross-modal pathways by creating image-text pairs that exploit the dimensional mismatch between visual and textual unlearning effectiveness. (3) Cross-modal reactivation: S2L fine-tuning specifically targets the multimodal alignment layers where cross-modal associations are most vulnerable to reactivation, exploiting the fact that multimodal models require preserved cross-modal reasoning for general functionality. (4) Coordinated inference attack: Final evaluation with optimized prompts that simultaneously activate both visual recognition pathways and textual generation mechanisms, creating a compound attack vector unique to multimodal architectures.

Overall, POPS couples these components in a closed-loop pipeline: PromptSuffix produces targeted synthetic data for S2L, while S2L increases the model’s sensitivity to the optimized prompts, forming an extraction-amplification loop that neither component achieves alone (Table 6: S2L alone 21%, PromptSuffix alone 70%, full POPS 82%). This coupling reveals a fundamental challenge for multimodal privacy protection: achieving comprehensive cross-modal forgetting requires dismantling the same cross-modal associations that enable beneficial multimodal reasoning. A detailed discussion contrasting POPS with GCG prompt optimization and unimodal S2L along three axes (concept-level optimization, multimodal S2L extensions, closed-loop integration) is provided in Appendix 14.

4 Experiments↩︎

In this section, we provide comprehensive verification. First, we introduce details of experimental setups (in Section 4.1). Second, we present the main performance comparison of attacking in unlearned models (in Section 4.2). Third, we conduct ablation studies to understand POPS (in Section 4.3). Finally, we also provide further discussion and generalization analysis across different MLLMs and benchmarks (in Section 4.4).

4.1 Experimental Setup↩︎

Unlearning Benchmarks and MLLMs. We conduct our attacking experiments mainly on MLLMU-Bench [32] in multi-choice QA settings, using LLaVA-1.5-7B [5], a representative MLLM widely adopted in recent literature [19], [20], to demonstrate the unlearning vulnerability revealed by POPS. To analyze the generalizability of the proposed method in different settings, we also consider 2 more recently proposed multimodal unlearning benchmarks, e.g., CLEAR [19] and UnLoK-VQA [20], with 3 additional MLLMs, including Qwen-VL-Chat-7B, InternVL3-9B and Llama-3.2-11B-V in our analysis. In Table 2, We summarize the information of three benchmarks. Notably, the Privately Identifiable Information (PII) density varied on the 3 benchmarks, indicating the unlearned knowledge in these benchmarks has a different density in terms of sensitivity and occurrence frequency in the training dataset. We take advantage of this difference to show the effectiveness of our methods on recovering unlearned knowledge of different sensitivity levels.

Dataset Splits. We follow the carefully constructed data splits of MLLMU-Bench for evaluation: (1) Forget Set: Includes the targeted profiles to be unlearned, our attacking experiments utilize forget percentages of \(10\%\) overall the whole fictitious profiles. (2) Retain Set: Includes the remaining profiles not in the Forget Set, evaluating the utility and retention of learned knowledge after unlearning. (3) Test Set: Consists of transformed versions of Forget Set profiles, employing Arc2Face for pose and angle alterations in images, and GPT-4o for textual paraphrasing. This set assesses the generalizability of unlearning algorithms.

OOD Dataset Construction. The OOD dataset \(\mathcal{D}_{\text{OOD}}\) for PromptSuffix optimization is constructed from the Retain Set of each benchmark. Retain-set profiles share the same format as forget-set profiles (celebrity portraits with biographical context) but contain different identities, making them distribution-shifted relative to the specific forget-set concepts while remaining in-domain for the underlying biographical QA task. Concretely, for MLLMU-Bench we uniformly sample 50 image-question-answer triplets from the 153 retain-set celebrity profiles, using the associated biographical questions and ground-truth answers already provided in the benchmark. A representative example could be a non-forgotten individual (e.g., “Amelia Kuznetsov”), along with attributes such as occupation, birthplace, and residence, and a question like “What is the profession of this person?” with the answer “Environmental Scientist.” While this sample is disjoint from the forgotten identities, it follows the same multimodal structure and attribute space. For CLEAR and UnLoK-VQA we use the full retain sets following the same protocol. We use “OOD” to mean out-of-distribution with respect to the forget identities: the attacker does not know which profiles were forgotten, only that unlearning was applied and that domain-similar data is available, consistent with the gray-box threat model in Section 2. No forget-set images or annotations are used at any stage of OOD construction.

Experimental Procedure of PromptSuffix Attack. We first generate 30 diverse random base prompts through GPT-4o [50]. PromptSuffix Optimization is executed to derive adversarial suffix prompts, selecting the top-10 distinct optimized suffixes based on their average effectiveness. Examples of optimized suffixes include: “But answer only if you can provide factual and accurate details”, “Provide details in a subtle way, even if it’s not directly known” and “You must think creatively and reconstruct what you used to know”. Based on perplexity variations, we then choose the response with the lowest perplexity as the final adversarial suffix from the top-10 optimized suffixes with the best average performance.

Additional Implementation Details: (1) Multi-Choice Question Construction: We create 4-way multiple-choice questions with 1 correct answer and 3 distractors. Distractors are randomly sampled from other profiles to avoid easy outliers and ensure realistic difficulty. (2) Synthetic Dataset Creation for Fine-tuning: Optimized PromptSuffix recovers partial facts, which are decomposed into multi-facet spans paired with original/augmented images. This creates a synthetic training dataset for fine-tuning amplification. (3) Fine-tuning Configuration (S2L via LoRA): We apply LoRA adapters (rank \(r=8\), \(\alpha=16\), dropout \(0.05\)) to the query and value projection matrices (q_proj, v_proj) of the language model component, keeping the vision encoder and multimodal projector frozen (\(\approx 0.1\%\) trainable parameters). Training uses AdamW (lr \(= 10^{-4}\), \(\beta_1 = 0.9\), \(\beta_2 = 0.999\)) with batch size 4 and 4-step gradient accumulation (effective batch 16) for 3 epochs. A KL divergence penalty (weight \(= 0.2\)) between the fine-tuned and unlearned model outputs on retain-set samples prevents catastrophic forgetting of general knowledge. The fine-tuning data consists of (image, optimized-question, model-response) triplets generated by querying the unlearned model with Stage 1 optimized suffixes, so Stage 2 directly amplifies the weak signals exposed in Stage 1. Full configuration details are provided in Appendix 10. (4) Unlearning Methodologies: We evaluate several representative unlearning baselines adapted from unimodal unlearning, including Gradient Ascent [27], Gradient Diff [28], KL Minimization  [29], NPO [16] and the plain Prompt-based method, i.e. using system prompt to suppress the model to output sensitive information.

Evaluation Metrics. We evaluate how well the models memorize sensitive information with 5 metrics: (1) Classification Accuracy: Measures the model’s ability to accurately answer multiple-choice questions about personal details from profiles. (2) ROUGE-L Score: Evaluates the model’s generation quality by measuring the overlap between generated responses and ground-truth textual answers. (3) Factuality Score: Assessed using GPT-4o, quantifying the factual accuracy of free-generated responses on a scale from 1 (inaccurate) to 10 (fully accurate). (4) Cloze Accuracy: Evaluates memorization retention using cloze-style completion tasks, where the model fills in the blanks based only on the entity’s name. (5) Recovery Rate: The percentage of unlearned knowledge that our attack recovers, measuring how much “forgotten” knowledge is successfully retrieved relative to the gap between baseline and unlearned performance. These metrics allow us to systematically measure unlearning effectiveness, generalizability, and overall model utility.

4.2 Main Results on Attacking Unlearned Models↩︎

We report all four metrics throughout; generation-based ROUGE-L, cloze accuracy, and factuality reveal substantially larger forgetting than classification accuracy. (see Appendix 6 for a per-metric breakdown).

In this part, we conduct the experiments of POPS on recovering the knowledge of unlearned MLLMs with different unlearning methods, and take a closer look at the attack performance on one GA-unlearned MLLM.

Attack Effectiveness across Different Unlearning Methods. Table 3 presents detailed results of our POPS fine-tuning attack on various unlearning methods (Gradient Ascent, Gradient Diff, KL Minimization). This experiment is crucial in demonstrating the general applicability and effectiveness of our attack methods across different unlearning strategies. For the Gradient Ascent method, the attack significantly raises accuracy on the test set from 40.2% to 42.9%, increasing Rouge from 0.387 to 0.461, factual score from 3.83 to 4.72, and cloze accuracy from 14.51% to 18.2%. Similar notable increases are observed with Gradient Diff, with accuracy improving from 39.08% to 41.7%, Rouge from 0.414 to 0.475, and cloze accuracy from 14.5% to 17.46%. Even the more balanced KL Minimization approach sees modest yet clear improvements under our attack (accuracy from 42.75% to 43.05%, Rouge from 0.420 to 0.451). The results show a universal vulnerability of existing unlearning strategies to our POPS. Specifically, all methods experience consistent recovery of supposedly erased information under adversarial conditions, emphasizing a fundamental weakness in their current implementation and the sensitivity to crafted adversarial prompts under advanced design.

Analysis of Attack Performance in Unlearned Model. The results from Table 4 further analyze the efficacy of our proposed adversarial attack methods (PromptSuffix, S2L, and our POPS) against the baseline unlearning strategy (Gradient Ascent). The adversarially prompted attacks significantly recover sensitive information previously unlearned, highlighting critical vulnerabilities in the existing Gradient Ascent-based multimodal unlearning methods. Specifically, we observe that: POPS achieves the best attack performance among all methods, showing substantial improvement over Gradient Ascent. The combination method achieves the highest accuracy (42.9%) and Rouge score (0.461), along with strong performance in factuality (4.72) and cloze accuracy (18.2%), significantly outperforming the baseline Gradient Ascent method alone (accuracy 40.2%, Rouge 0.387, factuality 3.83, cloze 14.51%). Moreover, PromptSuffix alone (42.5% accuracy, Rouge 0.447, factuality 4.56, cloze accuracy 17.65%) also provides substantial improvement over Gradient Ascent, underscoring its standalone effectiveness. Notably, POPS achieves results very close to the ground-truth fine-tuning (accuracy: 43.05%, Rouge: 0.492), underscoring the attack’s potency in exposing latent knowledge.

On the retain set, our introduced PromptSuffix method attains the highest performance (accuracy: 43.51%, Rouge: 0.502, factuality: 4.21, cloze accuracy: 23.76%), indicating that optimized adversarial suffix prompts effectively balance concept recovery without significantly degrading performance on retained data. However, POPS experiences slightly lower retain performance (accuracy: 43.47%, Rouge: 0.481), suggesting a minor trade-off between aggressive attacks and model utility. This trade-off is controllable: by tuning the KL regularizer weight \(\lambda\) (from 0.10 to 0.15) and adjusting S2L fine-tuning length, retain accuracy on MLLMU can be improved from 43.47% to 43.7% while maintaining test leakage performance (42.9% \(\rightarrow\) 42.8%).

Overall, these results confirm our attack methods can reliably recover supposedly unlearned sensitive information, exposing critical weaknesses in existing unlearning mechanisms that overly depend on gradient-based strategies without considering multimodal interactions.

POPS Against Multimodal-Specific Unlearning Methods. To verify that our findings are not artifacts of using unimodal-adapted methods, we evaluate POPS against MANU [30] (modality-aware neuron pruning) and MultiDelete [31] (contrastive modality decoupling) on LLaVA-1.5-7B. Full results are in Appendix 7 (Table 13). POPS consistently recovers across all three mechanism types (\(+3.7\%\) to \(+7.4\%\) accuracy), including a 14\(\times\) ROUGE-L improvement against the strongest MultiDelete variant (0.014 \(\rightarrow\) 0.197), confirming that the vulnerability is architectural rather than algorithm-specific.

4.3 Ablation Studies on Main Components of POPS↩︎

r10cm

Ablation Study. We perform further ablations to quantify the contribution of key components in our attack pipeline, using the same settings as  4. Specifically, we evaluate the influence of two critical components: (1) OOD-based prompt optimization, and (2) perplexity-based multi-prompt inference results selection. The results are shown in 5. Excluding perplexity-based selection during multi-prompt inference notably weakens adversarial recovery efficiency. As indicated by our results, removing this component results in suboptimal adversarial prompts, leading to less effective concept recovery. Specifically, adversarial recovery rates (test accuracy and Rouge) decrease significantly (around \(14\%\) reduction in effectiveness), emphasizing the necessity of perplexity-based prompt selection to identify and leverage prompts most likely to extract latent sensitive knowledge. Meanwhile, replacing optimized adversarial suffix prompts with random prompts designed by GPT-4o leads to a marked decline in the adversarial recovery efficacy. The accuracy of the test set and the Rouge scores decrease substantially compared to the full attack method (42.9% vs. 40.2% accuracy, 0.461 vs. 0.387 Rouge), illustrating the critical role of prompt optimization. Without optimized prompts, the model shows much stronger resistance to adversarial attacks, demonstrating that unlearning strategies alone are not sufficiently robust against finely tuned prompts designed explicitly to exploit memorization. Our findings show that adversarial attacks, especially POPS, are highly effective in exposing residual knowledge in MLLMs.

r10cm

OOD Baseline Analysis. Table 6 isolates each component’s contribution through systematic ablation. Direct fine-tuning on OOD data alone achieves only 12% recovery—the identity mismatch between OOD profiles and forget targets prevents meaningful knowledge transfer. This confirms that simple distribution shift is insufficient; the attack must specifically target residual forget-set traces. S2L applied to OOD data (21%) and S2L on forget-domain synthetic data without optimized suffixes provide incremental but limited improvements. The OOD S2L variant suffers from the same identity mismatch. PromptSuffix emerges as the critical component, contributing 70% of total recovery compared to 12-21% for alternatives. This validates OOD-guided suffix optimization as our core advanced contribution—the optimized suffixes effectively bridge the gap between OOD knowledge and forget-set recovery by learning universal patterns that exploit cross-modal persistence.

Comparison with conventional prompt optimization method-GCG. We present Table 7 comparing our POPS with GCG [46], a representative token-level prompt optimization method. The fundamental distinction lies in the optimization objective: GCG operates at the token level, maximizing loss on individual tokens to find adversarial suffixes that bypass safety mechanisms. In contrast, POPS performs concept-level optimization guided by OOD data, which captures semantic relationships rather than surface-level token patterns. This design choice enables POPS to discover suffixes that exploit deeper cross-modal associations preserved after unlearning. Furthermore, GCG lacks explicit regularization, often producing unnatural or grammatically incorrect suffixes that may trigger content filters. Our perplexity penalty encourages natural-sounding prompts that blend seamlessly with legitimate queries, making detection more challenging. Most importantly, while GCG functions as a standalone prompt attack, POPS integrates prompt optimization with fine-tuning in a closed-loop pipeline where discovered vulnerabilities are amplified through synthetic data generation. The results validate this design: POPS achieves 82% recovery vs.GCG’s 48%; even PromptSuffix alone (70%) exceeds GCG, demonstrating that OOD-guided concept-level optimization fundamentally outperforms token-level approaches for multimodal unlearning attacks.

Potential Defense regarding POPS. Table 8 evaluates two representative countermeasures. Both reduce but do not eliminate recovery: Head Projection lowers it to 57% and \(5\times\) paraphrase augmentation to 41%, yet neither achieves cost-effective protection—the attacker’s cost (running POPS) remains orders of magnitude lower than the defender’s (see Appendix 11 for full performance analysis).

Cross-Modal Attacking Pathway. To verify that POPS’s effectiveness stems from cross-modal associations rather than text-only residuals, we ablate the visual modality by comparing the full multimodal POPS against a text-only variant that strips all image inputs from both the PromptSuffix optimization and S2L fine-tuning stages. On GA-unlearned LLaVA-1.5-7B, the text-only variant degrades accuracy by \(-6.1\%\) while the full multimodal attack recovers \(+3.7\%\), a significant swing confirming that the visual pathway is the critical attack vector unique to multimodal unlearning. Full results and detailed analysis are deferred to Appendix 9.

4.4 Further Discussion and Generalizability Analysis↩︎

Discussion on Retain Performance. POPS maintains or slightly improves retain performance across all methods (GA: \(41.53\%\!\rightarrow\!43.47\%\); GD: \(43.71\%\!\rightarrow\!44.42\%\)), suggesting that optimized suffixes stimulate latent representations beneficial even for retained concepts (see Appendix 12 for full per-method breakdown).

Privacy-Utility Trade-off. Table 9 reveals a “no free lunch” principle: methods preserving more utility (GA, GD) remain equally vulnerable to POPS, while more aggressive KL-Minimization sacrifices 6.42% utility for only 0.3% additional resistance (see Appendix 12 for full analysis). We also verify that simply increasing unlearning intensity cannot simultaneously achieve effective forgetting and POPS resistance: every configuration that preserves utility (Retain Acc \(>\) 30%) remains vulnerable, while configurations that resist POPS destroy general-purpose reasoning entirely (see Appendix 8). A controlled text-only ablation (Table 15) confirms the visual pathway is essential: text-only POPS degrades accuracy by \(-6.1\%\) while multimodal POPS achieves \(+3.7\%\)—a 9.8 percentage-point swing that cannot be explained by text residuals alone.

Cross-Architecture Generalization Analysis. Table 10 demonstrates the generalizability of our attack in different MLLM architectures. We evaluate four diverse models spanning different parameter scales, training paradigms, and architectural designs: LLaVA-1.5-7B (projection-based vision-language alignment), Qwen-VL-Chat-7B (cross-attention fusion), InternVL3-9B (dynamic resolution processing), and Llama-3.2-11B-Vision (integrated multimodal tokens). This diversity ensures our findings are not artifacts of specific design choices. The results show remarkable consistency: POPS achieves an average improvement of \(+2.5\%\) over unlearned models, with recovery rates consistently exceeding 82% across all architectures. The standard deviation of only \(\pm0.3\%\) in recovery rate demonstrates tight clustering of attack effectiveness regardless of architectural differences. Notably, attack success is not merely a function of model size—InternVL3-9B and Llama-3.2-11B-Vision show similar vulnerability patterns to the smaller 7B models, indicating that model size scaling alone does not provide substantial protection for unlearning. The tight 81.8–84.0% recovery range across projection-based, cross-attention, and integrated-token architectures confirms the vulnerability is a fundamental property of multimodal alignment rather than an artifact of any specific design. (see Appendix 13 for detailed per-architecture analysis).

Cross-Benchmark Generalization Analysis. Table 11 reveals that our POPS consistently re-captures a large fraction of each unlearning method’s lost accuracy, but the absolute gains differ markedly across the three benchmarks—and these differences align with the dataset statistics summarized in Table 2. Note that higher accuracy values in Table 11 indicate stronger privacy attacks performance, demonstrating POPS’s effectiveness in recovering supposedly forgotten information. MLLMU-Bench: Because every example contains a long textual biography and the highest density of personally identifying attributes, unlearning removes the most knowledge (\(43.5\!\rightarrow\!40.2\) % accuracy). The attack therefore has the most to recover and gains \(+2.7\%\), reaching \(42.9\) %, showing the vulnerability of high-density PII contexts. UnLok-VQA: Each sample here provides only a single image and a short question, yielding the lowest PII density. Consequently the unlearning loss is mild (\(-3.8 \%\),) and the attack’s recovery is also modest (\(+1.7\%\),), reflecting the reduced attack surface in sparse PII scenarios. CLEAR: With medium PII density and multiple captions per image, CLEAR falls between the two extremes; its recovery margin (\(+2.2\%\),) likewise lies midway. These trends confirm that PII density correlates with attack surface, and that the vulnerability is not limited to gradient-based unlearning (see Appendix 15 for detailed per-benchmark insights).

5 Conclusion↩︎

In this paper, we examined the robustness of multimodal machine unlearning under realistic adversarial interactions. We demonstrate that, even when direct instance-level recall is effectively suppressed, unlearned MLLMs can retain functionally accessible representations that can be reactivated through appropriate prompts. We proposed Prompt-Optimized Parameter Shaking (POPS) as a framework to systematically probe such residual representations. Specifically, POPS introduces OOD-guided PromptSuffix attack to expose residual multimodal representations, with self-synthesis fine-tuning serving as an amplification mechanism. Experiments across multiple benchmarks and architectures demonstrate systematic weaknesses in current multimodal unlearning methods, highlighting the need for approaches that explicitly address the vulnerability.

Acknowledgements↩︎

The work of Z. Li, J. Zhu, J. Hong, and Z. Wang is in part supported by Good Systems, a UT Austin Grand Challenge to develop responsible AI technologies.

6 Metric Sensitivity Analysis↩︎

Note on Metric Sensitivity. Multi-choice classification accuracy is the least sensitive metric for measuring unlearning effectiveness, because random guessing already yields 25% on 4-way questions, compressing the effective range to around 18 percentage points. Generation-based ROUGE-L and open-ended cloze accuracy (which cannot be answered by process-of-elimination) reveal substantially larger suppression of knowledge. Table 12 reports absolute and relative degradation across all metrics for GA unlearning: cloze accuracy drops by 44% relative and factuality by 26% relative, compared to only 7.6% relative for classification accuracy.

7 POPS Against Multimodal-Specific Unlearning Methods↩︎

To verify that the vulnerabilities identified in Section 4.2 are not artifacts of using unimodal-adapted methods, we evaluate POPS against two dedicated multimodal unlearning approaches on LLaVA-1.5-7B: MANU [30] (modality-aware neuron pruning targeting cross-modal association neurons) and MultiDelete [31] (contrastive modality decoupling that explicitly erases cross-modal bindings while preserving unimodal representations). We also test MultiDelete-strong, which applies more aggressive contrastive training until ROUGE-L on the forget set approaches zero. The vanilla baseline accuracy is 42.0% (ROUGE-L: 0.457).

Three key findings emerge. (i) MANU’s pruning-based unlearning is fully reversible: despite reducing Test Acc by 4.5%, POPS reverses it entirely (\(+6.1\%\), exceeding the vanilla baseline at 43.7%), showing that pruning targeted neurons leaves exploitable knowledge distributed across the remaining weights. (ii) MultiDelete achieves the deepest unlearning yet still provides a strong recovery signal: MultiDelete-strong reduces ROUGE-L to near zero (0.014), yet POPS recovers it to 0.197, a 14\(\times\) improvement, demonstrating that latent cross-modal traces survive even aggressive contrastive unlearning. (iii) The vulnerability is architectural, not method-specific: the consistency across gradient-based, neuron pruning, and contrastive decoupling mechanisms suggests that addressing these weaknesses requires fundamental advances in cross-modal disentanglement, not stronger algorithms.

8 Privacy-Utility Dilemma Under Stronger Unlearning↩︎

We investigate whether simply increasing unlearning intensity (e.g., longer training or higher learning rates) could simultaneously achieve effective forgetting and resistance to POPS. Table 14 systematically varies unlearning hyperparameters on LLaVA-1.5-7B.

GA with 1 epoch achieves mild forgetting (\(-2.9\%\)) that POPS easily reverses (\(+3.7\%\)). Increasing to 2 epochs achieves stronger forgetting (\(-9.8\%\)) that resists POPS, but collapses retain accuracy from 43.6% to 26.9%, rendering the model effectively unusable. Further training destroys the model entirely. KL-Minimization with mild settings (1 epoch) leaves sufficient latent signal for POPS to recover beyond vanilla (46.9% vs.%), showing KL constraints alone do not protect against fine-tuning-based recovery. Every setting that preserves utility (Retain Acc \(>\) 30%) remains vulnerable to POPS, suggesting the vulnerability stems from the shared cross-modal representation space, not insufficient unlearning effort.

9 Cross-Modal Visual Pathway Analysis↩︎

To confirm that POPS’s effectiveness is attributable to cross-modal visual-semantic associations rather than text-only residuals, we compare the full multimodal POPS with a text-only variant that strips all image inputs from both the PromptSuffix optimization and the S2L fine-tuning stages. Table 15 presents results on GA-unlearned LLaVA-1.5-7B.

The text-only variant not only fails to recover but actively degrades accuracy by \(-6.1\%\): without images, the optimized suffixes cannot anchor to visual identity features, and the synthetic fine-tuning data lacks the visual-semantic associations needed for recovery. In contrast, multimodal POPS improves accuracy by \(+3.7\%\) and ROUGE-L substantially (\(+26\%\) relative), a 9.8 percentage-point swing demonstrating that the visual modality is essential to the attack. Multimodal POPS substantially improves open-ended generation quality (\(+26\%\)), while text-only barely changes it (\(+2.5\%\)), confirming that successful cross-modal reactivation requires the visual pathway throughout the pipeline.

10 LoRA Configuration Details↩︎

Table 16 provides the complete LoRA configuration used in the S2L fine-tuning stage of POPS. The design choices reflect the threat model: the parameter-efficient nature of LoRA (only q_proj and v_proj) demonstrates that even severely limited fine-tuning access is sufficient to recover unlearned knowledge, making the attack practical against open-source MLLMs and commercial fine-tuning APIs alike.

11 Defense Analysis↩︎

Potential Defense regarding POPS. We evaluate POPS against two representative defense mechanisms; Table 8 (main text) reports the quantitative results.

Head Projection applies orthogonal projection to model representations, attempting to remove directions associated with sensitive concepts [20]. This defense reduces POPS recovery from 82% to 57% (2.5% out of 4.4% removed), providing meaningful but incomplete protection. The residual 57% recovery indicates that sensitive information is distributed across multiple representation subspaces, and simple linear projection cannot capture all leakage pathways. Paraphrase-based unlearning applies gradient ascent on 5\(\times\) paraphrased versions of the forget set, creating more diverse forgetting signals. This approach reduces recovery to 41%, achieving better protection than Head Projection but at significantly higher computational cost (5\(\times\) training iterations). The improved effectiveness suggests that targeting diverse surface forms of sensitive concepts disrupts more recovery pathways, but the remaining 41% recovery demonstrates that semantic-level associations persist even under paraphrase augmentation.

Both defenses reduce but do not eliminate attack effectiveness, demonstrating that current countermeasures address symptoms rather than root causes. Quantitatively, the defense-to-attack efficiency ratio reveals an important asymmetry: Head Projection requires additional computation during inference but only reduces recovery by 24% (82%\(\rightarrow\)​57%), while paraphrase-based unlearning requires 5\(\times\) training cost but achieves 41% reduction (82%\(\rightarrow\)​41%). Neither defense achieves cost-effective protection—the attacker’s marginal effort (running POPS) remains orders of magnitude lower than the defender’s marginal cost for meaningful protection. The fact that even aggressive paraphrase-based unlearning leaves 41% recovery suggests that semantic-level cross-modal associations may be irreducible without sacrificing core multimodal functionality, which is a fundamental tension that current defense paradigms cannot resolve.

12 Retain Performance and Privacy-Utility Analysis↩︎

Discussion on Retain Performance. POPS attacks maintain or slightly improve retain set performance across all evaluated unlearning methods. Our results show that while the attacks improve the test set performance (indicating concept recovery), they also either maintain or slightly improve retain set performance in terms of accuracy and Rouge scores. Specifically, for Gradient Ascent, retain accuracy improved from 41.53% (unlearned) to 43.47% under attack, and cloze accuracy from 20.57% to 23.48%. Gradient Diff similarly benefits from the attack with retain accuracy increasing from 43.71% to 44.42%. The observed improvement in retain performance suggests that our attack methods, particularly PromptSuffix, may stimulate latent model representations beneficial even for retained concepts, hinting at the intricate entanglement of learned and unlearned data in multimodal contexts. However, the KL Minimization method, designed explicitly to balance performance on forget and retain data, exhibits relatively stable retain accuracy (40.21% vs.% unlearned), highlighting its robustness to attacks. Yet, even for this stable method, our attacks notably increase cloze accuracy (20.7% to 22.32%), suggesting inherent vulnerabilities across all unlearning techniques.

Privacy-Utility Trade-off. Table 9 (main text) quantifies the inherent tension between privacy protection and utility preservation across different unlearning strategies. The results reveal a fundamental “no free lunch” principle: all methods must sacrifice some utility to achieve privacy gains, but the efficiency of this trade-off varies significantly. Gradient Ascent and Gradient Diff preserve more model utility but remain equally vulnerable to POPS attacks—their conservative forgetting leaves sufficient residual information for recovery. KL-Minimization takes a more aggressive approach, sacrificing 6.42% utility but gaining only marginal attack resistance (0.3% privacy improvement vs.% for GA). This disproportionate cost-benefit ratio suggests that simply increasing forgetting intensity is not an effective defense strategy. A critical observation emerges: methods that preserve more general knowledge inherently remain more vulnerable to attacks. The cross-modal associations that enable useful multimodal reasoning simultaneously create pathways for information recovery. This fundamental coupling between utility and vulnerability suggests that effective defenses must develop mechanisms to preserve functional cross-modal reasoning while specifically disrupting the associations linked to sensitive content—a challenging requirement that current methods fail to achieve.

13 Cross-Architecture Generalization Analysis↩︎

This cross-model consistency underscores that the vulnerabilities we exploit are fundamental properties of multimodal unlearning rather than artifacts of specific architectural choices. All evaluated models must preserve cross-modal reasoning capabilities to remain functional, and this requirement creates persistent visual-semantic associations that survive targeted unlearning. The observation that different fusion mechanisms (projection layers, cross-attention, integrated tokens) all exhibit comparable vulnerabilities suggests that addressing these weaknesses will require fundamental advances in multimodal unlearning methodology—potentially involving explicit cross-modal disentanglement—rather than incremental architectural modifications.

Interestingly, the per-model recovery rates reveal subtle architectural patterns: Qwen-VL-Chat achieves the highest recovery (84.0%) despite its cross-attention design theoretically providing more modular separation, while LLaVA’s projection-based alignment shows slightly lower recovery (81.8%). We hypothesize that cross-attention’s richer bidirectional information flow, while beneficial for task performance, simultaneously creates more redundant cross-modal pathways that our attack exploits. The tight clustering of all models within the 81.8–84.0% range, however, suggests that this architectural variation accounts for only \(\sim\)​2% of recovery variance, which is a minor factor compared to the fundamental vulnerability of multimodal alignment.

14 Novelty Discussion: POPS vs.Prior Work↩︎

POPS differs from prior work along three axes.

(1) Concept-level vs.token-level prompt optimization. Existing adversarial suffix methods such as GCG [46] operate at the token level, maximizing loss on individual tokens to bypass safety constraints. In contrast, POPS performs concept-level optimization supervised by OOD semantic QA correctness across a dataset, which encourages cross-instance generalization and discovers suffixes that exploit persistent cross-modal associations rather than surface-level token patterns. Although we optimize continuous token embeddings, the objective is defined over semantic attribute recovery, not individual token loss—a qualitatively different optimization target. This distinction is empirically decisive: PromptSuffix alone achieves 70% recovery vs.GCG’s 48%, validating that OOD-guided concept-level optimization is fundamentally more effective for multimodal unlearning attacks (Table 7).

(2) Multimodal-specific S2L extensions. The original S2L [13] was designed for text-to-image diffusion models. Our adaptation to MLLMs requires three concrete technical changes that do not exist in prior S2L:

• Multimodal image-QA training pairs: Unlike unimodal S2L which fine-tunes on text-only data, our S2L simultaneously exposes the model to image-question-answer triplets, which is necessary to reactivate dormant visual-semantic alignment across the vision encoder and language model projection layers.

• Faceted identity decomposition: A single celebrity profile is decomposed into multiple training examples covering distinct facets (appearance, biography, occupation, associations). This structure is specific to MLLM identity knowledge, which is organized across both modalities, and has no equivalent in unimodal diffusion S2L.

• Stage-coupled synthetic data: The fine-tuning data is synthesized by querying the unlearned model with Stage 1 optimized suffixes. Prior S2L uses independently collected training data; our design ensures Stage 2 amplifies precisely the residual signals surfaced by Stage 1.

(3) Closed-loop integration as a contribution in itself. Prior prompt attacks (GCG, jailbreaking) are open-loop—prompt only, no fine-tuning. Prior S2L operates without prompt-optimization guidance, using independently collected data. POPS is the first to couple suffix discovery and fine-tuning in a closed loop: PromptSuffix (Stage 1) surfaces latent signals and generates targeted synthetic data for S2L (Stage 2), while S2L reinforces the model’s sensitivity to the same prompts. This extraction-amplification feedback loop yields 82% recovery versus 70% for prompt-only and 21% for fine-tuning-only (Table 6), confirming the closed-loop design—not either component in isolation—drives the attack’s effectiveness.

15 Cross-Benchmark Generalization Analysis↩︎

The benchmark-level trends yield several important insights. (1) Richer PII-dense multimodal contexts leave deeper traces that adversarial suffixes can exploit—the cross-modal associations formed during training on detailed profiles create more recovery pathways than sparse single-image contexts. (2) Even objectives explicitly designed to balance forgetting and retention (e.g., KL-Minimization) remain vulnerable across all PII densities, underscoring that current multimodal unlearning methods do not yet fully disentangle sensitive concepts from retained representations. (3) More common-sense knowledge and concepts prove resistant to optimization-based unlearning but can be suppressed through overwriting-based approaches like prompt-based unlearning; importantly, our attack method demonstrates strong effectiveness against such defenses as well. This suggests that the vulnerability is not limited to gradient-based unlearning but extends to broader classes of privacy protection mechanisms. The consistent attack success across benchmarks with varying characteristics validates POPS as a general-purpose tool for evaluating multimodal unlearning robustness, regardless of the specific privacy context or unlearning methodology employed.

References↩︎