A May 2026 study shows that when large language models are compressed from BF16 precision to INT4 for deployment, machine unlearning effectiveness systematically collapses. In experiments on LLaMA-3-8B-Instruct, the recovery rate of deleted content reached up to 22 times the BF16 baseline.
This points to a long-overlooked deployment blind spot: unlearning verification is almost always performed at training precision (typically BF16), while INT4 quantization has become the default in production environments.
How quantization dissolves the unlearning boundary
Machine unlearning essentially builds a "forgetting boundary" in parameter space that makes the model unresponsive to specific training data. This boundary may be clear and stable at BF16, but INT4 rounding distorts the topology of parameter space. When 16-bit floats are compressed to 4-bit integers, many fine-grained parameter adjustments are smoothed away, blurring the boundary. An attacker does not need to recover the original model; exploiting INT4 inference noise alone can make the model "remember" content that should have been deleted. The authors name this attack path the Quantization Recovery Attack (QRA).
Experiments reveal the severity of this collapse. Across the TOFU, MUSE-News, and WikiBio-WPU datasets, all seven mainstream unlearning methods showed some degree of recovery. GradDiff was the most extreme contrast: it achieved a Forget Quality of 0.97 at BF16 — among the best — yet after INT4 deployment its recovery rate was 18.9%, the highest of the seven methods. The best-performing approach in the lab became the most fragile link in real deployment.
The trilemma and a phase-transition threshold
The authors formalize this structural conflict as the FA-RA-Q-INT4 trilemma: Forgetting Assurance, Retained Utility, and Quantization Robustness at INT4 cannot all be achieved simultaneously. Degradation from BF16 to INT8 is relatively mild, but from INT8 to INT4 it collapses sharply. INT4 is not a gradual performance loss point but a phase-transition threshold — one that happens to coincide with the industry's most mainstream deployment configuration.
Audit results of existing methods
Of the seven methods tested, only DurableUn-SAF earned a 3/3 durability certificate, passing unlearning audits at BF16, INT8, and INT4. Its core mechanism introduces a Straight-Through Estimator (STE) during unlearning training, letting gradients propagate directly through INT4 rounding operations. Rather than patching the model after quantization, the unlearning process itself completes within quantization noise, preserving a stable forgetting boundary in parameter space.
By contrast, SalUn scored a 1/3 certificate rate, effective only at BF16. This contrast shows that unlearning research ignoring deployment precision has a significant gap between experimental conclusions and real protection.
The precision blind spot in compliance frameworks
The study exposes a deeper institutional problem. Regulations such as the GDPR grant data subjects a "right to be forgotten," requiring thorough removal of personal data. Yet current compliance frameworks do not specify the precision at which unlearning verification must occur. If audits are completed only at BF16 while actual deployment uses INT4, "compliance" becomes a ritual valid only in the lab. For models already in production that claim to have deleted user data, their true protection status is technically unknown.
Conclusion
The DurableUn research shows that machine unlearning effectiveness cannot be evaluated independently of deployment precision. The industry needs cross-precision durability certificate standards — repeating unlearning audits at the final deployment precision before a model ships, rather than stamping approval at training precision only. INT4 quantization is not the enemy of unlearning algorithms, but excluding INT4 from verification pipelines is currently the most hidden systemic vulnerability in machine unlearning practice.
---
Paper: *DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning* (arXiv:2605.02196) Authors: Abdullah Ahmad Khan, Ferdous Sohel