Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

Improved Localized Machine Unlearning Through the Lens of Memorization

T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that selecting parameters to unlearn by channel-level weighted gradients on the forget set, then resetting and finetuning them, makes localized machine unlearning match retraining-from-scratch while updating only about…

desk verdict A smart localization strategy and honest ablations, but the SOTA claim leans on an under-trained oracle that makes every delta relative to a weak gold standard. read the letter →

arxiv 2412.02432 v1 pith:4LIZJ77N submitted 2024-12-03 cs.LG

Reihaneh Torkzadehmahani , Reza Nasirigerdeh , Georgios Kaissis , Daniel Rueckert , Gintare Karolina Dziugaite , Eleni Triantafillou This is my paper · ORCID
classification cs.LG
keywords machineunlearninglocalizedmemorizationparameterlocalizationweightedgradientsaliencymembershipinferenceattackDeletionbyExample(DEL)forgetset
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that machine unlearning is best done locally: instead of updating all weights, an unlearning algorithm should identify a small set of parameters most responsible for the forget set and modify only those. Drawing on hypotheses about where neural networks memorize training examples, the authors derive a localization strategy that scores each neuron by the average magnitude of its weights times their gradients on the forget set, then resets the top-scoring neurons and finetunes them. The resulting method, Deletion by Example Localization (DEL), is reported to match a retrained-from-scratch oracle on forget-accuracy and membership-inference metrics across three dataset and architecture pairs and both IID and non-IID forget sets, while updating about 30% of the parameters and preserving utility. The paper's central claim is that this channel-level, forget-set-specific selection is what makes localized unlearning succeed.

What carries the argument

The load-bearing object is a localization mask $m_\alpha$ constructed from a per-neuron criticality score. For each parameter $j$, the score is $s_j = |\theta_j \cdot g_j(\theta_o, S)|$, the magnitude of the parameter value times its gradient on the forget set; for each output channel, the criticality is the average of the top $h$ parameter scores in that channel. The mask selects the largest number of channels that fit inside a budget $\alpha$ of total parameters, and the unlearning step resets those parameters and finetunes them on the retain set. The channel grouping acts as smoothing that makes the heuristic criticality decisions less error-prone than per-parameter choices, and the weighted-gradient criterion acts as a regularizer that down-weights small parameters. Paired with Reset plus Finetune, this mask is the algorithm DEL.

What would settle it

Train a model, compute DEL's mask, then replace it with a random mask that has the same number of selected channels per layer; if the random mask matches DEL's forget accuracy and MIA score within noise, the criticality score is not doing the work. Alternatively, measure whether a neuron's top-$h$ weighted-gradient score predicts the change in forget-set loss when that neuron is reset; a near-zero correlation across layers would falsify the selection mechanism.

Watch

Extended reading notes

Core claim

The central discovery is that the success of localized unlearning depends less on which unlearning algorithm is applied than on which parameters are chosen to modify, and that the right choice is a channel-level, forget-set-specific mask based on weighted gradients. The paper shows that data-agnostic strategies fail: modifying only deepest layers preserves utility but does not forget, while modifying shallowest layers forgets but destroys utility. A direct translation of memorization-localization hypotheses, CritMem, forgets too little and is expensive. DEL instead computes, for each parameter, $|\theta_j \cdot g_j(\theta_o, S)|$, averages the top scores within each output channel, and resets the highest-scoring channels within a parameter budget before finetuning them on the retain set. Across CIFAR-10/ResNet-18, SVHN/ViT, and ImageNet-100/ResNet-50, DEL is reported to come closest to the retrain-from-scratch reference on forget accuracy and membership-inference score, outperforming both full-parameter methods and prior localized methods, and to beat previous localized methods on test accuracy.

Load-bearing premise

The comparison assumes that tuning each method's parameter budget and hyperparameters on the same test set used for the metrics gives a fair picture, even though the oracle retrained model is trained for only 20 epochs at half the learning rate.

Editorial extensions

If this is right

  • If DEL's reported results hold, an unlearning request can be serviced by retraining only about 30% of a network's parameters, which changes the economics of data deletion in deployed classifiers.
  • The finding that forget-set-specific localization matters more for non-IID than IID forget sets suggests unlearning systems should adapt their parameter selection to the distribution of the deletion request.
  • The result that random masks with the same layer structure perform far worse implies that where you modify matters as much as how much, guiding future localized unlearning designs.
  • Because DEL pairs well with different unlearning algorithms, its localization mask could be dropped into existing pipelines such as Random Label and NegGrad+ to improve them.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One could test whether the channel-level weighted-gradient score approximates the Fisher information or the empirical influence of forget examples, which might unify DEL with other localized unlearning methods like SSD.
  • Since DEL's advantage over SalUn grows when budgets shrink, a natural stress test is to push budgets to 5-10% and see whether channel-level smoothing continues to dominate parameter-level saliency.
  • The paper compares against an oracle trained for fewer epochs at half learning rate; a stronger oracle would likely make all approximate methods look worse, so DEL's margins over the oracle should be re-measured against a fully-trained retrain baseline.
  • For IID forget sets on ViT, the paper notes some full-parameter methods beat localized methods on MIA, suggesting DEL's superiority may not transfer to all architectures or forget-set distributions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies localized machine unlearning, where only a small subset of parameters is modified. It proposes a localization strategy that scores each output channel/neuron by the average of the top-h magnitudes of weighted gradients over the forget set, then selects the top channels within a parameter budget. Pairing this strategy with a reset-and-finetune unlearning algorithm yields DEL. The paper reports experiments on CIFAR-10/ResNet-18, SVHN/ViT, and ImageNet-100/ResNet-50, with IID and non-IID forget sets, comparing against full-parameter and localized baselines using forget accuracy, MIA score, and test accuracy, all measured as differences from a retrain-from-scratch oracle. It claims DEL achieves state-of-the-art unlearning quality and utility, and includes ablations on localization-strategy components, random-mask controls, and robustness to parameter budget.

Significance. If the empirical claims hold, DEL is a practically attractive localized unlearning method: it is simple, modifies a small fraction of parameters, and the paper provides useful design insights (channel-level granularity and weighted gradients) that are plausibly transferable. The paper's strengths include a random-mask control (Table 5) that directly supports the necessity of data-dependent parameter selection, a factorial comparison of granularity and criticality criteria (Table 1), and evaluation on multiple architectures and forget-set types. The main reservations concern the evaluation protocol: the oracle is trained with only 20 epochs at half learning rate, and per-method budgets and learning rates are selected on the same test metrics used for reporting, with several key margins within one standard error. Because all claims are expressed as deviations from this oracle, the state-of-the-art conclusion is contingent on the oracle being a faithful reference point.

major comments (4)
  1. [Section A.2 (Oracle training) and Section 6, Tables 2-4] The oracle ('Retraining') is trained for 20 epochs with half the original learning rate, whereas the original model is trained for 50 epochs. This under-trained oracle likely has lower forget-set accuracy and lower confidence on forget examples; consequently, a method that partially damages the network (e.g., DEL's reset of 30% of channels) can achieve near-zero Δforget without actually removing the influence of S. This is load-bearing because every metric in the main tables is defined as a difference from this oracle, and the abstract's 'matching retrain-from-scratch' claim is only as strong as the oracle. The authors should retrain the oracle with the full 50-epoch, full-learning-rate recipe (or justify the reduced schedule as a deliberate and unbiased reference point) and re-run the comparisons; otherwise Definition 2.1's gold standard is not met.
  2. [Section 6 and Appendix A.2, Table 7] The paper reports each method's best budget and learning rate chosen using the same test-set metrics on which final numbers are reported (e.g., 'we report results using its best identified parameter budget and its best-paired unlearning algorithm for that setting'; Table 7 tunes learning rates on the same IID/non-IID forget sets). This selection bias is compounded by the fact that many key margins are within one or two standard errors (e.g., Table 2 Non-IID Δforget: DEL 0.43±1.06 vs SalLoc-RL -2.8±1.45; IID Δforget: DEL 0.97±0.42 vs L1-sparse 1.80±1.20). To support the SOTA claim, the authors should use a validation split for hyperparameter and budget selection, or report results for a fixed budget across all methods, and provide a multiple-comparison-aware analysis.
  3. [Section A.4, Table 8 and Table 3 (SVHN IID)] The abstract and Section 6 state that DEL outperforms all compared methods on two unlearning metrics across all datasets and forget sets. However, on SVHN/ViT with the IID forget set, the confidence-based MIA in Table 8 shows DEL ΔMIA = -5.48±0.64, while Fine-tuning achieves -1.97±0.32 (closer to the oracle); Table 3 shows the same for correctness-based MIA (DEL -4.26±0.32 vs Fine-tuning -1.05±0.42). The paper acknowledges this in A.4 but does not qualify the abstract or the concluding SOTA claim. This inconsistency is load-bearing because it is part of the paper's headline contribution.
  4. [Section 5.2 and Algorithm 1] The proposed localization score c_oi is defined as the average of the top h scores of the channel's parameters, but neither the main text nor Appendix A.2 reports the value of h or its tuning range. Since h controls the granularity of the channel criticality estimate and is one of the few method-specific hyperparameters, its absence makes the method irreproducible and leaves a free parameter in the comparison. The authors should specify h for each dataset (or explain how it is selected).
minor comments (4)
  1. [Figure 3] The legend entries 'Earliest-0.14' and 'Earliest-0.25' should presumably read 'Shallowest', since the plot labels use 'Shallowest-14%' and 'Shallowest-25%'.
  2. [Table 3 caption] The caption 'on Non-IID and IID forget set when training a ViT model on SVHN dataset' mixes singular and plural; it should be 'forget sets' and 'the SVHN dataset'.
  3. [Section 4, experimental setup] The text says Reset + Finetune 'resets the identified critical parameters ... and finetunes only the identified critical parameters and the classifier layer', but Algorithm 1 suggests the mask alone determines the updated parameters; please clarify whether the classifier layer is always updated regardless of the mask.
  4. [Table 6] The table caption mentions a shaded region for 'our method', but the table as typeset does not show shading; please add the shading or describe the region in text.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found: DEL's localization and unlearning steps are empirical and self-contained, and the cited weaknesses are evaluation-validity concerns rather than logical circularity.

full rationale

The paper's derivation chain is empirical rather than definitional. The localization strategy selects parameters by the magnitude of weight-gradient products on the forget set (Section 5.2), and DEL resets and finetunes those parameters; the reported deltas compare each method against a retrained oracle model. No quantity that the paper claims to predict is defined in terms of the method's own outputs, and no fitted parameter is renamed as a prediction. The choice of channel-wise granularity and weighted gradients is justified by an ablation (Table 1), and the authors run a random-mask control (Table 5) that gives the localization claim independent empirical content. Self-citations (e.g., Triantafillou et al. 2024, Kurmanji et al. 2024, Zhao et al. 2024) are used as background, baseline, or evaluation references and are not load-bearing in the sense of forcing the reported results. The strongest substantive concerns — using a 20-epoch, half-learning-rate oracle as the gold standard, tuning hyperparameters and budgets on the same test metrics, and overlapping confidence intervals — are threats to the strength and fairness of the empirical comparison, not circularity in the derivation. Because no load-bearing step reduces to its own inputs by definition or by self-citation, the appropriate finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim rests on standard empirical ML hyperparameters (budgets, learning rates) plus an unstated h, and on evaluation assumptions about the oracle and MIA metric. No new physical or mathematical entities are introduced.

free parameters (3)
  • Parameter budget α = 0.20, 0.30 (and others)
    The fraction of parameters updated is chosen per method and per dataset; Section 6 reports each method's best identified budget, making α a selected free parameter that the SOTA comparison depends on.
  • Top-h hyperparameter h = Not specified
    Neuron criticality in Section 5.2 averages the top h parameter scores inside each channel, but the paper never states the value or tuning procedure for h. This directly affects which channels are selected.
  • Per-method learning rates = See Table 7
    Learning rates are tuned per method, budget, and forget set (Table 7). They are standard hyperparameters but are selected on the test set, which can inflate reported performance.
assumptions (3)
  • domain assumption The memorization localization hypotheses from Baldock et al. (2021) and Maini et al. (2023) are a useful starting point for locating where a forget set is encoded.
    Section 4 derives Deepest and CritMem from these hypotheses; if they were false, the motivation would weaken, though the final method is validated empirically.
  • domain assumption The retrained-from-scratch oracle, trained for 20 epochs at half the original learning rate, is an appropriate gold standard for unlearning quality.
    Section A.2 specifies this oracle; if the oracle underperforms a fully trained model, delta metrics become easier to satisfy and reported gains may be inflated.
  • domain assumption The membership inference attack score, computed with a linear SVC on predicted labels, measures privacy-relevant unlearning.
    Section A.3 defines the metric; it is standard in unlearning benchmarks but is a proxy, and the paper notes confidence-based MIAs give larger deltas.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improved Localized Machine Unlearning Through the Lens of Memorization." pith.science (2026). https://pith.science/paper/4LIZJ77N

@misc{pith2026241202432,
  author       = {Pith},
  title        = {Pith review of: Improved Localized Machine Unlearning Through the Lens of Memorization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4LIZJ77N}},
  note         = {Machine review of arXiv:2412.02432}
}
read the original abstract

Machine unlearning refers to removing the influence of a specified subset of training data from a machine learning model, efficiently, after it has already been trained. This is important for key applications, including making the model more accurate by removing outdated, mislabeled, or poisoned data. In this work, we study localized unlearning, where the unlearning algorithm operates on a (small) identified subset of parameters. Drawing inspiration from the memorization literature, we propose an improved localization strategy that yields strong results when paired with existing unlearning algorithms. We also propose a new unlearning algorithm, Deletion by Example Localization (DEL), that resets the parameters deemed-to-be most critical according to our localization strategy, and then finetunes them. Our extensive experiments on different datasets, forget sets and metrics reveal that DEL sets a new state-of-the-art for unlearning metrics, against both localized and full-parameter methods, while modifying a small subset of parameters, and outperforms the state-of-the-art localized unlearning in terms of test accuracy too.

Figures

Figures reproduced from arXiv: 2412.02432 by the authors.

Figure 1
Figure 1. Localized unlearning consists of two parts: a localization strategy that identifies a set of “critical parameters” (dashed line circles) and an unlearning algorithm that aims to remove the influence of the forget set by modifying only the critical parameters (highlighted circles), keeping the rest unchanged. Ideally, the unlearned model should “behave” like the model retrained from scratch, i.e. the two should produ… view at source ↗
Figure 2
Figure 2. Comparison of localization strategies combined with the Reset + Finetune (RFT) unlearning [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Pairing localization strategies / budgets (e.g. Ours-30% denotes applying our localization [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: On SVHN with ViT, DEL outperforms state-of-the-art full￾parameter and localized unlearning in terms of unlearning quality. L1-sparse has better test accuracy than DEL but has poor unlearning performance. These re￾sults are for the non-IID forget set, and α = 30% for lo…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Similarity-Aware Machine Unlearning

    cs.LG 2026-07 reject novelty 4.0 of 10

    A retain-aware localization method for machine unlearning reduces reported collateral damage on CIFAR-10, but its evaluation metric is contaminated and the 'consistent' improvement claim is not supported by the paper'...

Reference graph

Works this paper leans on

23 extracted references · 7 canonical work pages · cited by 1 Pith paper

  1. [9]

    Certified data removal from machine learning models

    Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. arXiv preprint arXiv:1911.03030,

    arXiv 1911

  2. [10]

    Robust knowledge unlearning via mechanistic localizations

    Phillip Huang Guo, Aaquib Syed, Abhay Sheshadri, Aidan Ewart, and Gintare Karolina Dziugaite. Robust knowledge unlearning via mechanistic localizations. In ICML 2024 Next Generation of AI Safety Workshop. Peter Hase, Mohit Bansal, Been Kim, and Asma Ghandeharioun. Does localization inform editing? surprising differences in causality-based localization vs....

    work page 2024

  3. [11]

    Inexact unlearning needs more careful evaluations to avoid a false sense of privacy

    Jamie Hayes, Ilia Shumailov, Eleni Triantafillou, Amr Khalifa, and Nicolas Papernot. Inexact unlearning needs more careful evaluations to avoid a false sense of privacy. arXiv preprint arXiv:2403.01218,

    arXiv

  4. [12]

    Approximate data deletion from machine learning models

    Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. Approximate data deletion from machine learning models. In International Conference on Artificial Intelligence and Statistics, pp. 2008–2016. PMLR,

    2008

  5. [13]

    Measuring forgetting of memorized training examples

    Matthew Jagielski, Om Thakkar, Florian Tramer, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, et al. Measuring forgetting of memorized training examples. arXiv preprint arXiv:2207.00099,

    arXiv

  6. [14]

    Reading digits in natural images with unsupervised feature learning

    Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, pp

    2011

  7. [16]

    Unrolling sgd: Under- standing factors influencing machine unlearning

    Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling sgd: Under- standing factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pp. 303–319. IEEE,

    work page 2022

  8. [17]

    An empirical study of example forgetting during deep neural network learning

    Mariya Toneva, Alessandro Sordoni, Remi Tachet des Combes, Adam Trischler, Yoshua Bengio, and Geoffrey J Gordon. An empirical study of example forgetting during deep neural network learning. arXiv preprint arXiv:1812.05159,

    arXiv

Show all 23 references
  1. [19]

    What makes unlearning hard and what to do about it

    Kairan Zhao, Meghdad Kurmanji, George-Octavian B˘arbulescu, Eleni Triantafillou, and Peter Tri- antafillou. What makes unlearning hard and what to do about it. arXiv preprint arXiv:2406.01257,

    arXiv

  2. [20]

    from scratch

    14 A A PPENDIX A.1 U NLEARNING DEFINITION In this section, we discuss an alternative formal definition of unlearning, proposed in in Ginart et al. (2019); Neel et al. (2021), using a notion closely related to Differential Privacy (Dwork, 2006). Definition A.1. Unlearning-2. Fo...

    2019

  3. [22]

    ResNet-18 and ViT contain around 11 million parameters, whereas ResNet-50 has approximately 25 million parameters

    from (Wang, 2021). ResNet-18 and ViT contain around 11 million parameters, whereas ResNet-50 has approximately 25 million parameters. Due to the low-resolution nature of CIFAR-10, we replace the first convolutional layer of ResNet-18 with a new convolutional layer with kernel ...

    2021

  4. [128]

    unseen data

    The base learning rate values are 0.1 and 0.05 for ResNet-18-CIFAR-10 and ViT-SVHN, respectively, which is gradually decayed by factor of 0.01 using the Cosine Annealing scheduler. For the oracle model (gold standard), we train the model from scratch only on the retain set, fo...

    2023

  5. [2006]

    Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310.12508,

    arXiv

  6. [2009]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929,

    2010 arXiv

  7. [2011]

    The samples are of shape 32×32 pixel, and from 10 classes

    includes 73, 257 train and 26, 032 test samples. The samples are of shape 32×32 pixel, and from 10 classes. The ImageNet-100 (Hugging Face version) dataset is a subset of ImageNet (Deng et al., 2009), containing 126, 689 train and 5, 000 test samples from 100 classes, randomly...

    2009

  8. [2015]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248–255. Ieee,

    2009

  9. [2017]

    Information complexity of stochastic convex optimization: Applications to generalization and memorization

    Idan Attias, Gintare Karolina Dziugaite, Mahdi Haghifam, Roi Livni, and Daniel M Roy. Information complexity of stochastic convex optimization: Applications to generalization and memorization. arXiv preprint arXiv:2402.09327,

    arXiv

  10. [2018]

    Are we making progress in unlearning? findings from the first neurips unlearning competition

    Eleni Triantafillou, Peter Kairouz, Fabian Pedregosa, Jamie Hayes, Meghdad Kurmanji, Kairan Zhao, Vincent Dumoulin, Julio Jacques Junior, Ioannis Mitliagkas, Jun Wan, et al. Are we making progress in unlearning? findings from the first neurips unlearning competition. arXiv pre...

    arXiv

  11. [2019]

    Towards adversarial evaluations for inexact machine unlearning

    Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponnurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning. arXiv preprint arXiv:2201.06640,

    arXiv

  12. [2020]

    On the geometry of generalization and memorization in deep neural networks

    Cory Stephenson, Suchismita Padhy, Abhinav Ganesh, Yue Hui, Hanlin Tang, and SueYeon Chung. On the geometry of generalization and memorization in deep neural networks. arXiv preprint arXiv:2105.14602,

    arXiv

  13. [2021]

    Machine unlearning

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pp. 141–159. IEEE,

    2021

  14. [2022]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks

    Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9304–9312, 2020a. Aditya Golatkar, Alessandro Achille...

    2020

  15. [2024]

    Layer normalization

    Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton. Layer normalization. arXiv preprint arXiv:1607.06450,

    arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.