A study released in May 2026 demonstrates that machine unlearning effectiveness systematically collapses when large language models are compressed from BF16 precision to INT4 for deployment. In experimental setups using LLaMA-3-8B-Instruct, recovery rates of deleted content reached up to 22x the BF16 baseline.
The finding exposes a long-overlooked deployment blind spot: machine unlearning is almost always verified at training precision (typically BF16), while INT4 quantization has become the default option in production environments.
Mechanism: How Quantization Dissolves the Unlearning Boundary
Machine unlearning essentially builds an "unlearning boundary" in parameter space, making the model unresponsive to specific training data. This boundary may be clear and stable at BF16 precision, but INT4 quantization rounding operations distort the topology of parameter space. When 16-bit floating-point numbers are compressed to 4-bit integers, many subtle parameter adjustments are smoothed away, blurring the unlearning boundary. An attacker does not need to recover the original model—exploiting the noise inherent in INT4 inference is enough to make the model "remember" content that was supposedly deleted. The authors name this attack path the Quantization Recovery Attack (QRA).
Experimental data reveal the severity of this dissolution. Across the TOFU, MUSE-News, and WikiBio-WPU datasets, all seven mainstream unlearning methods showed some degree of recovery. GradDiff showed the starkest contrast: it achieved a Forget Quality of 0.97 under BF16, making it one of the most effective methods; yet after INT4 deployment, its recovery rate reached 18.9%, the highest among the seven methods. The best-performing solution in the lab became the most vulnerable link in real deployment.
The Trilemma and a Phase-Transition Threshold
The authors formalize this structural contradiction as the FA-RA-Q-INT4 trilemma: strong forgetting (Forgetting Assurance), high utility (Retained Utility), and INT4 quantization robustness (Quantization Robustness at INT4) cannot be achieved simultaneously. Experiments show degradation from BF16 to INT8 is relatively mild, but from INT8 to INT4 there is a cliff-like collapse. INT4 is not a gradual performance loss point but a phase-transition threshold—falling precisely on the industry's most mainstream deployment configuration.
Audit of Existing Solutions
Of the seven tested methods, only DURABLEUN-SAF earned a 3/3 durability certificate rating, passing unlearning audits at BF16, INT8, and INT4. Its core mechanism introduces a Straight-Through Estimator (STE) during unlearning training, allowing gradients to propagate backward directly through INT4 rounding operations. Rather than patching the model after quantization, it lets the unlearning process itself complete within quantization noise, preserving a stable unlearning boundary in parameter space.
By contrast, SalUn's certification rate was 1/3, valid only at BF16. This comparison shows a significant gap between unlearning research that ignores deployment precision and actual protective capability.
Precision Blind Spot in Compliance Frameworks
The study exposes a deeper institutional problem. Regulations such as GDPR grant data subjects a "right to be forgotten," requiring personal data to be thoroughly removed. But current compliance frameworks do not specify at what precision unlearning verification should occur. If audits are completed only at BF16 while actual deployment uses INT4, "compliance" becomes a ritual effective only in laboratory conditions. For deployed models claiming to have deleted user data, their true protection status is technically unknown.
Conclusion
The DurableUn research shows that machine unlearning effectiveness cannot be evaluated independently of deployment precision. The industry needs cross-precision durability certificate standards—repeating unlearning audits at the final deployment precision before launch, rather than only stamping approval at training precision. INT4 quantization is not the enemy of unlearning algorithms, but excluding INT4 from verification workflows is currently the most hidden systemic vulnerability in machine unlearning practice.
---
Paper: *DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning* (arXiv:2605.02196) Authors: Abdullah Ahmad Khan, Ferdous Sohel