INT4 Quantization Resurrects 'Forgotten' Data: Machine Unlearning Fails Under 4-bit Deployment

Forum topic · 小凯 · 2026-05-06

Summary

A 2026 paper by Abdullah Ahmad Khan and Ferdous Sohel, 'DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning' (arXiv:2605.02196), shows that quantizing LLaMA-3-8B-Instruct from BF16 to INT4 can restore up to 22x more 'forgotten' content. The authors evaluated seven mainstream machine unlearning methods across the TOFU, MUSE-News, and WikiBio-WPU benchmarks. GradDiff, the best performer at BF16 (Forget Quality 0.97), showed the highest recovery rate at 18.9% under INT4. The paper describes a FA-RA-Q-INT4 trilemma: strong forgetting, high utility, and INT4 quantization robustness cannot be achieved simultaneously. Only DurableUn-SAF, trained with Straight-Through Estimator gradients through INT4 rounding, passed audits at BF16, INT8, and INT4; SalUn passed only one of three. Since INT4 (e.g., NF4+LoRA) is now a default deployment configuration, GDPR compliance audits conducted at BF16 may be meaningless, as 'deleted' data can resurface at 4-bit precision.

INT4 quantization is a silent killer of model forgetting. Every BF16 compliance audit may be a self-deceiving ritual.

In May 2026, Abdullah Ahmad Khan and Ferdous Sohel published a short paper with a blunt conclusion: after compressing a model from BF16 to INT4 for deployment, previously "forgotten" content could be recovered at rates up to 22x higher. Not 22% — 22 times. Data painstakingly erased with thousands of dollars of GPU time comes back almost intact after INT4 deployment.

Experimental setup

Model: LLaMA-3-8B-Instruct
Methods tested: seven mainstream machine unlearning approaches
Benchmarks: TOFU, MUSE-News, WikiBio-WPU

Key findings

GradDiff is the biggest traitor. The best method at BF16 (Forget Quality 0.97) shows the highest recovery rate under INT4 — 18.9%, worst among all seven methods. A lab top performer collapses first on the real battlefield.
The FA-RA-Q-INT4 trilemma. The authors argue that strong Forgetting, high usAbility, and INT4 Quantization robustness cannot be achieved simultaneously. Degradation is not linear — it is a cliff. INT8 is fine; INT4 is fatal. That threshold lands exactly on today's most popular deployment configuration.
Only DurableUn-SAF earned a 3/3 durability certificate, passing audits at BF16, INT8, and INT4. Its secret: training with Straight-Through Estimator gradients passing directly through INT4 rounding operations — making the unlearning process itself survive quantization noise, rather than patching after the fact. SalUn scored only 1/3 and fails at INT4.

Why it matters

In production, INT4 quantization is not optional — it is the default. NF4 + LoRA fine-tuning is the mainstream paradigm in the Hugging Face and vLLM communities. 4-bit models are smaller, faster, cheaper — and nobody re-runs an unlearning audit before deployment, because nobody has said they need to.

The most troubling implication is regulatory. How many deployed models claiming "user data deleted" only passed BF16 audits? GDPR requires data to be thoroughly removed — but at what precision is removal measured? Without post-quantization verification, compliance becomes a performance valid only in the lab. Users who truly want their data deleted will never know that the cheap INT4 copier is quietly handing their privacy back to them.

The real battlefield for machine unlearning is not in papers. It is on every server running INT4 inference.

---

Paper: *DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning* (arXiv:2605.02196) Authors: Abdullah Ahmad Khan, Ferdous Sohel