Research · curated 14 Sep 2026
Forgetting to Forget: Attention Sink as A Gateway for Backdooring LLM Unlearning
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Backdoored unlearning undermines a key privacy and safety control for open-weight LLMs, letting a poisoned model secretly restore removed harmful or sensitive knowledge when an attacker supplies the trigger.
Researchers from Michigan State University and NUS present "Forgetting to Forget," a study showing that the LLM unlearning process itself can be backdoored so that a model appears to have forgotten data under normal conditions but recovers the forgotten knowledge when a hidden trigger is present. The work links backdoor efficacy to the attention sink phenomenon, showing that placing triggers at sink positions and aligning their attention values markedly enhances backdoor persistence, with released code on GitHub.