  As privacy concerns escalate in the realm of machine learning, data owners
now have the option to utilize machine unlearning to remove their data from
machine learning models, following recent legislation. To enhance transparency
in machine unlearning and avoid potential dishonesty by model providers,
various verification strategies have been proposed. These strategies enable
data owners to ascertain whether their target data has been effectively
unlearned from the model. However, our understanding of the safety issues of
machine unlearning verification remains nascent. In this paper, we explore the
novel research question of whether model providers can circumvent verification
strategies while retaining the information of data supposedly unlearned. Our
investigation leads to a pessimistic answer: \textit{the verification of
machine unlearning is fragile}. Specifically, we categorize the current
verification strategies regarding potential dishonesty among model providers
into two types. Subsequently, we introduce two novel adversarial unlearning
processes capable of circumventing both types. We validate the efficacy of our
methods through theoretical analysis and empirical experiments using real-world
datasets. This study highlights the vulnerabilities and limitations in machine
unlearning verification, paving the way for further research into the safety of
machine unlearning.
