@inproceedings{kou-etal-2026-conditional,
title = "Conditional Perturbation Generators for Probing and Mitigating Recovery Risks in Multimodal Large Language Models Unlearning",
author = "Kou, Yiqun and
Hu, Bowen and
Wang, Siyuan and
Cui, Erfei and
Fan, Hongbang and
He, Sizhe and
Yang, Yujie and
Zhou, Yadong",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1059/",
pages = "22425--22440",
ISBN = "979-8-89176-462-0",
abstract = "Multimodal large language models (MLLMs) trained on image-text data may retain sensitive information in textual memories, visual representations, and cross-modal associations, creating a need for reliable unlearning. Although existing unlearning methods can reduce target disclosure under clean queries, suppressed knowledge may remain recoverable under adversarial conditions. We introduce a new perspective on this vulnerability by assessing post-unlearning recovery through conditional perturbation generation, where a learned generator maps each image-text input to perturbations that promote recovery of the suppressed response. This framework is instantiated with two generators: CEPG injects conditional soft tokens into the multimodal input embedding sequence, while CPPG generates pixel-space perturbations under CLIP-based semantic conditions. Experiments across five unlearning methods show strong recovery risks. CEPG achieves average recovery ratio (Rec) scores of 60.19{\%} on MLLMU-Bench and 46.74{\%} on CLEAR, while CPPG attains 34.28{\%} and 29.47{\%}, respectively. Both attacks remain effective with limited or no direct access to forgotten samples, highlighting that current unlearning offers insufficient robustness guarantees. To mitigate this vulnerability, we introduce Adversarially Robust Unlearning (ARU), which integrates conditional recovery attacks into unlearning with attribution-guided parameter selection, significantly reducing recovery rates while preserving utility on retain sets."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="kou-etal-2026-conditional">
<titleInfo>
<title>Conditional Perturbation Generators for Probing and Mitigating Recovery Risks in Multimodal Large Language Models Unlearning</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yiqun</namePart>
<namePart type="family">Kou</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Bowen</namePart>
<namePart type="family">Hu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Siyuan</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Erfei</namePart>
<namePart type="family">Cui</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Hongbang</namePart>
<namePart type="family">Fan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sizhe</namePart>
<namePart type="family">He</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yujie</namePart>
<namePart type="family">Yang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yadong</namePart>
<namePart type="family">Zhou</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Multimodal large language models (MLLMs) trained on image-text data may retain sensitive information in textual memories, visual representations, and cross-modal associations, creating a need for reliable unlearning. Although existing unlearning methods can reduce target disclosure under clean queries, suppressed knowledge may remain recoverable under adversarial conditions. We introduce a new perspective on this vulnerability by assessing post-unlearning recovery through conditional perturbation generation, where a learned generator maps each image-text input to perturbations that promote recovery of the suppressed response. This framework is instantiated with two generators: CEPG injects conditional soft tokens into the multimodal input embedding sequence, while CPPG generates pixel-space perturbations under CLIP-based semantic conditions. Experiments across five unlearning methods show strong recovery risks. CEPG achieves average recovery ratio (Rec) scores of 60.19% on MLLMU-Bench and 46.74% on CLEAR, while CPPG attains 34.28% and 29.47%, respectively. Both attacks remain effective with limited or no direct access to forgotten samples, highlighting that current unlearning offers insufficient robustness guarantees. To mitigate this vulnerability, we introduce Adversarially Robust Unlearning (ARU), which integrates conditional recovery attacks into unlearning with attribution-guided parameter selection, significantly reducing recovery rates while preserving utility on retain sets.</abstract>
<identifier type="citekey">kou-etal-2026-conditional</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1059/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>22425</start>
<end>22440</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Conditional Perturbation Generators for Probing and Mitigating Recovery Risks in Multimodal Large Language Models Unlearning
%A Kou, Yiqun
%A Hu, Bowen
%A Wang, Siyuan
%A Cui, Erfei
%A Fan, Hongbang
%A He, Sizhe
%A Yang, Yujie
%A Zhou, Yadong
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F kou-etal-2026-conditional
%X Multimodal large language models (MLLMs) trained on image-text data may retain sensitive information in textual memories, visual representations, and cross-modal associations, creating a need for reliable unlearning. Although existing unlearning methods can reduce target disclosure under clean queries, suppressed knowledge may remain recoverable under adversarial conditions. We introduce a new perspective on this vulnerability by assessing post-unlearning recovery through conditional perturbation generation, where a learned generator maps each image-text input to perturbations that promote recovery of the suppressed response. This framework is instantiated with two generators: CEPG injects conditional soft tokens into the multimodal input embedding sequence, while CPPG generates pixel-space perturbations under CLIP-based semantic conditions. Experiments across five unlearning methods show strong recovery risks. CEPG achieves average recovery ratio (Rec) scores of 60.19% on MLLMU-Bench and 46.74% on CLEAR, while CPPG attains 34.28% and 29.47%, respectively. Both attacks remain effective with limited or no direct access to forgotten samples, highlighting that current unlearning offers insufficient robustness guarantees. To mitigate this vulnerability, we introduce Adversarially Robust Unlearning (ARU), which integrates conditional recovery attacks into unlearning with attribution-guided parameter selection, significantly reducing recovery rates while preserving utility on retain sets.
%U https://aclanthology.org/2026.findings-emnlp.1059/
%P 22425-22440
Markdown (Informal)
[Conditional Perturbation Generators for Probing and Mitigating Recovery Risks in Multimodal Large Language Models Unlearning](https://aclanthology.org/2026.findings-emnlp.1059/) (Kou et al., Findings 2026)
ACL
- Yiqun Kou, Bowen Hu, Siyuan Wang, Erfei Cui, Hongbang Fan, Sizhe He, Yujie Yang, and Yadong Zhou. 2026. Conditional Perturbation Generators for Probing and Mitigating Recovery Risks in Multimodal Large Language Models Unlearning. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 22425–22440, Budapest, Hungary. Association for Computational Linguistics.