Lazarus — Cross-Model Transfer Attacks on LLM Unlearning
Systematic test of whether unlearning is robust to cross-model transfer attacks across 4 architectures, 3 unlearning methods, and 3 attack vectors. "Universal Forgetting is Fragile."
Lazarus tests whether an attack that breaks unlearning on one model architecture can also break unlearning on a completely different architecture.
- 4 architectures: Llama-3.2-3B, Phi-3.5-mini, Gemma-2-2B, Qwen2.5-3B.
- 3 unlearning methods: Gradient Ascent, NPO, SimNPO. 3 attacks: Relearning, Prompt Recovery, In-Context Learning. 1 defense: SAM-TR (Sharpness-Aware Transfer-Resistant).
- Novel metrics: NTR (Normalized Transfer Rate), ETR (Effective Transfer Rate, chance-corrected), AER (Attack Efficiency Ratio, cost-normalized) — all with bootstrap 95% CIs.
- Benchmarks: TOFU (core), WMDP (stretch). Hydra configs, single-script launcher with A100/T4/CPU session presets.