I would suggest using #update_attribute, not #update_attributes. #update_attribute (singular) accepts two parameters: the attribute name and the value. This is intended for flipping booleans, or updating single values. The semantics of #update_attribute also mean that callbacks won't be fired.
From your code, it's a simple change:
@employee.update_attribute(:subscribed, false)
Now, for the real reason why your code is failing is because you have someplace where you're using #attr_accessible or #attr_protected in your Employee model. Using #attr_accessible helps prevent injection attacks by only allowing certain fields to be assignable from #attributes= (which is what #update_attributes ultimately calls). The warning originates from #attributes=.