Pith. sign in

REVIEW 4 major objections 3 minor 2 cited by

Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack

T0 review · 4 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Machine unlearning leaves two traces — boundary damage and a reusable class prototype — and Spotter targets both.

desk verdict The PRA attack is a genuinely useful new audit tool, but the paper's central evaluation is circular: OU@eps is contradicted by the retrain control, and Spotter optimizes the same objective it is graded on. read the letter →

arxiv 2506.01318 v4 pith:Q5ZGNPJL submitted 2025-06-02 cs.LG cs.AI

SeungBum Ha , Saerom Park , Sung Whan Yoon This is my paper
classification cs.LGcs.AI
keywords machineunlearningclass-levelover-unlearningrelearningattackprototypicalnetworksknowledgedistillationfeaturedispersionfacerecognitionprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Class-level machine unlearning, the paper argues, has two blind spots that standard accuracy reports hide. The first is over-unlearning: suppressing an entire class shifts decision boundaries and degrades retained samples near the forget region, and the paper quantifies this with a metric OU@ε that needs no retained data. The second is a relearning threat: unlearned models keep forget-class examples clustered in feature space, so averaging a handful of forget samples into a prototype and patching it into the classifier head restores the forgotten class. To counter both, the paper proposes Spotter, a plug-and-play objective that combines masked knowledge distillation on boundary-proximal perturbed examples with an intra-class dispersion loss that scatters forget-class embeddings. The paper reports that Spotter suppresses OU@ε, neutralizes the Prototypical Relearning Attack, and preserves retained accuracy across CIFAR, Tiny-ImageNet, CASIA-WebFace, and transformer backbones, while noting its scope is limited to class-level unlearning and its attack model is white-box.

What carries the argument

Four objects carry the argument. The masked softmax $\tilde{\sigma}(z;C_f)$ renormalizes the original logits over retained classes only, giving both the teacher distribution for distillation and the reference for OU@ε. The perturbed set $A_\epsilon(D_f)$ collects forget examples moved by a PGD attack within an ε-ball of the original model, and it marks the boundary-proximal region where the paper expects over-unlearning to concentrate. The class prototype $p_\theta^{(c)}$, the mean embedding of a few forget samples, becomes the attack's weapon when PRA writes prototype-derived weights and biases into the final layer with interpolation factor α. The Spotter objective $L = \lambda_1 L_u + (1-\lambda_1)L_o + \lambda_2 L_{\mathrm{sim}}$ combines masked distillation on clean forget examples ($L_u$), masked distillation on perturbed examples ($L_o$), and the averaged pairwise cosine similarity of forget-class embeddings ($L_{\mathrm{sim}}$), so that the boundary stays faithful to the original model while the forget-class structure is scattered.

What would settle it

A rank-correlation study would settle it: for a fixed dataset and a large set of unlearning runs (different methods, seeds, forget classes), compute OU@ε and also measure retained accuracy on the Top-2/5/10% of retained test samples closest to the forget-class prototype, then check whether low OU@ε consistently predicts high forget-adjacent retained accuracy. The paper's own CIFAR-10 table already contains one disagreement—the retrain model shows the best Top-2/5/10% retained accuracy while its OU@ε of 0.2384 is worse than Spotter's 0.0228—so the correlation is not established by the reported numbers. A second concrete test: run PRA with prototypes drawn from many random subsets of forget samples on a Spotter model that retains a small visible cluster (as in the SalUn+Spotter UMAP), and count how often a prototype lands in the cluster; the defense is only neutralized if no subset can rebuild the boundary.

Watch

Extended reading notes

Core claim

The paper's central claim is that a model is not truly unlearned when forget-class accuracy reaches zero, because two traces of the forgotten class survive. One trace lives at the decision boundary: the unlearning step reshapes the boundary around the forget set and, in doing so, distorts the original model's predictions on forget-adjacent perturbations, which the paper reads as collateral damage to nearby retained data and measures as OU@ε. The other trace lives in the feature extractor: forget-class embeddings remain clustered even when the classifier head no longer recognizes them, and the Prototypical Relearning Attack converts a few mean embeddings into last-layer weights and biases, restoring the forgotten class while keeping retained accuracy nearly unchanged. Spotter is the paper's remedy: a masked-distillation loss on clean and ε-perturbed forget examples preserves the original model's retained-class distribution, and an intra-class dispersion loss pushes forget-class embeddings apart. The paper presents Spotter as a plug-and-play addition to existing unlearning losses and reports that it drives OU@ε down, cuts Prototypical Relearned accuracy to near zero, and preserves utility on CIFAR-10/100, Tiny-ImageNet, CASIA-WebFace, ViT/DeiT backbones, and a CLIP-based ImageNet setting.

Load-bearing premise

OU@ε, computed as prediction drift on adversarially perturbed forget examples, truly measures collateral damage to retained data near the forget boundary; if that drift does not track how retained samples degrade, the metric and the masked-distillation remedy built from it lose their footing.

Editorial extensions

If this is right

  • If OU@ε is valid, unlearning services can monitor boundary-local collateral damage using only the deletion request's own examples, without needing retained data or a retrain reference.
  • If PRA is as effective as reported, current unlearning certificates based on forget accuracy are insufficient: a white-box party with a handful of images can restore a forgotten identity while keeping retained accuracy within 1%, so defenses must reshape feature geometry, not just the classifier head.
  • If Spotter's plug-and-play claim holds, existing unlearning losses such as SalUn, DELETE, and UNSC can be converted into attack-resistant variants by adding the two-loss regularizer with two hyperparameters, with small utility cost.
  • Spotter's consistency across sequential unlearning, 30–50% class removal, and identity-centric face recognition suggests the two blind spots scale with class count and repeated requests, so robust unlearning services would need exactly this kind of geometry-level regularization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own Table 5 leaves open the question of what OU@ε really tracks: the retrain model has the highest Top-2/5/10% retained accuracy near the forget prototype yet an OU@ε of 0.2384 that looks worse than Spotter's 0.0228, so a direct correlation study between OU@ε and forget-adjacent retained accuracy would test whether the metric is the right proxy.
  • Because PRA is a white-box audit attack, the same prototype-patching idea could plausibly be made gray- or black-box by estimating prototypes from public or surrogate embeddings; the paper explicitly leaves limited-access adversaries for future work.
  • A testable extension is using OU@ε as a per-request monitoring signal in unlearning-as-a-service: flag deletion requests where post-unlearning drift on the request's own perturbed examples is large, and re-run or refine unlearning for those requests only.
  • The dispersion loss could have side effects outside classification—scattering identity embeddings may degrade retrieval or verification tasks that rely on compact identity clusters—so measuring downstream feature quality after Spotter would clarify the trade-off.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper studies two failure modes of class-level machine unlearning: over-unlearning, defined as collateral damage to retained data near the forget-class boundary, and post-hoc relearning, where an attacker uses a few forgotten samples to revive the removed class. It proposes a retain-data-free over-unlearning metric OU@ε (Eq. 3), a Prototypical Relearning Attack (PRA) that patches the classifier head with averaged embeddings from a handful of forget samples, and Spotter, a plug-and-play objective combining masked knowledge distillation on perturbed forget examples (Lu, Lo) with an intra-class dispersion loss (Lsim). The paper reports that Spotter achieves state-of-the-art unlearning performance on CIFAR-10/100, Tiny-ImageNet, CASIA-WebFace, ViT/DeiT, and a CLIP setting.

Significance. The paper addresses questions that are worth asking: how to measure boundary-local collateral damage without retained data, and whether class-level unlearning leaves feature-space structure that a few-shot attacker can exploit. The authors release code and provide a broad set of experiments, including useful appendix material on sequential and high-volume unlearning. If OU@ε were a valid proxy for retained-data damage and PRA were a faithful measure of residual forget knowledge, the contributions would be practically relevant for auditing unlearning services. However, the central evaluation is compromised: Spotter's Lo loss literally minimizes OU@ε on the same PGD-perturbed distribution used to define the metric, and the retrain control contradicts the metric's interpretation. In addition, PRA succeeds on the retrain model, so Proto-Accf does not isolate residual forget knowledge. These issues affect the paper's headline claims and cannot be fixed by local edits.

major comments (4)
  1. [Section 3.1 (Eq. 3) and Section 4 (Eq. 9)] Spotter's advantage on OU@ε is partly by construction. Lo in Eq. (9) is the same divergence between the original model's masked softmax and the unlearned model's softmax, evaluated on the same Aε(Df) (PGD-perturbed forget examples generated against the original model) that defines OU@ε in Eq. (3). Because Spotter explicitly minimizes this objective, the low OU@ε values reported for Spotter and Spotter-augmented baselines in Tables 1 and 2 measure optimization success, not an independent validation that collateral damage is reduced. The Gaussian-OU@ε results in Appendix B do not resolve the circularity, since they evaluate the same divergence over a related perturbed distribution family.
  2. [Section 3.1 and Appendix A (Table 5)] The interpretation of OU@ε as a proxy for boundary-proximal retained-data damage is contradicted by the paper's own retrain control. Table 1 reports OU@ε=0.2384 for the CIFAR-10 retrain model, yet Table 5 shows that the retrain model has the highest forget-adjacent retained accuracy (Top-2/5/10%: 81.11/81.56/84.11), exceeding Spotter's 77.22/78.67/80.56. High OU@ε can therefore accompany the best preservation of boundary-proximal retained data, implying that the divergence in Eq. (3) conflates legitimate removal of forget-class probability mass with over-unlearning. The Appendix A claim that low OU@ε and high Top-k accuracy align is false when the retrain row is included.
  3. [Section 3.2, Tables 1 and 8] PRA is presented as a relearning attack that exposes residual forget knowledge, but it succeeds on the retrain gold standard: Proto-Accf is 58.70 on CIFAR-10 retrain, 30.98 on Tiny-ImageNet retrain, and 78.90 on CASIA-WebFace retrain. A model that never trained on the forget class is still vulnerable, so Proto-Accf does not measure residual class-level information; it measures whether the embedding space supports few-shot prototype classification. Consequently, Spotter's near-zero Proto-Accf, achieved by directly minimizing Lsim, demonstrates robustness against this fixed attack but does not establish that the class information has been removed from the model.
  4. [Abstract and Section 5.2, Appendix E] The claim of "state-of-the-art results across CIFAR, TinyImageNet, and CASIA-WebFace" is not supported by the reported comparisons. On Tiny-ImageNet and CASIA-WebFace (Table 8), Spotter is compared only with DELETE (plus original and retrain models), not with the other baselines used in the main CIFAR experiments; the CLIP experiment (Table 3) includes no baseline at all. Even on CIFAR, the primary evaluation metric is minimized by Spotter's own training objective (see first major comment), so the SotA claim should be removed or replaced with a complete baseline comparison on every dataset.
minor comments (3)
  1. [Table 1] Several rows in Table 1 are visually corrupted by missing spaces between numerical entries (for example, the Boundary Expand row and the Spotter(λ2=0.1) row read as concatenated numbers); the table should be reformatted with clear column separators.
  2. [Throughout] The notation is inconsistent between "OU @ε", "OU@ε", and "OU@epsilon"; the paper should standardize the metric name, ideally matching the code repository naming.
  3. [Section 6 vs Appendix A] The Discussion states that the retrained model is not the normative reference for the paper's behavioral unlearning objective, but Appendix A uses the retrain model's Top-k retained accuracy as the ground truth for validating OU@ε; this tension should be acknowledged explicitly in the main text.

Circularity Check

2 steps flagged · score 6.0 of 10

OU@epsilon is simultaneously the reported metric and Spotter's own training objective (Eqs. 3 and 9), and Table 5 shows the metric fails the retrain control, so the headline over-unlearning result reduces to the Lo loss by construction.

  1. fitted input called prediction [Section 3.1 Eq. (3); Section 4 Eqs. (9) and (11)]
    "Lo(theta_u) = sum_{x_p in A_epsilon(D_f)} D(sigma~sigma(z(x_p;theta)) || sigma(z(x_p;theta_u))) / |A_epsilon(D_f)| ; compare OU@epsilon := E_{x_p~A_epsilon(D_f)} D(sigma~sigma(z(x_p;theta)) || sigma(z(x_p;theta_u))) (Eqs. 9 and 3)."

    Eq. (9) has the same masked-softmax teacher, same unlearned student, same PGD-perturbed set A_epsilon(D_f), and D chosen from the same f-divergence family as the JS divergence used to evaluate Eq. (3). Spotter trains with L = lambda_1 Lu + (1-lambda_1) Lo + lambda_2 Lsim, so Lo directly minimizes a KL cousin of OU@epsilon over the same distribution. Table 1's low OU@epsilon for Spotter is therefore a by-construction consequence of the training objective, not an independent measure of reduced collateral damage.

  2. other [Appendix A, Table 5]
    "In contrast, Spotter achieves the lowest OU@epsilon and consistently preserves the highest accuracy on the Top-2%, Top-5%, and Top-10% retained subsets."

    Table 5 itself reports Retrain Model Top-2/5/10% of 81.11/81.56/84.11, higher than Spotter's 77.22/78.67/80.56, while Retrain has Acc_rt 94.71 vs Spotter's 94.00. The retrain model, the gold-standard removal control, has OU@epsilon 0.2384 versus Spotter's 0.0228, so OU@epsilon does not track boundary-proximal retained accuracy; it mainly reflects the legitimate removal of forget-class logits. The validation fails against the paper's own control, and the only quantity distinguishing Spotter from baselines is the same masked-divergence objective that Lo was designed to minimize.

full rationale

The central over-unlearning evaluation is circular. OU@epsilon (Eq. 3) measures divergence between the original model's masked softmax and the unlearned model's softmax on PGD-perturbed forget samples. Spotter's Lo (Eq. 9) is the same divergence on the same masked teacher, same student, and same perturbation set, with KL used in training as a close relative of the JS used in evaluation. Because L = lambda_1 Lu + (1-lambda_1) Lo + lambda_2 Lsim, Spotter's low reported OU@epsilon is a fitted objective rather than an independent result. The Appendix A validation is contradicted by Table 5: retrain has the best boundary-proximal retained accuracy and yet the worst OU@epsilon (0.2384), so the metric does not quantify the collateral damage it claims. The PRA defense is less circular: Lsim targets the attack mechanism and Proto-Accf is measured independently after the attack, so that claim has real empirical content. No load-bearing self-citations or imported uniqueness theorems appear. Retained-accuracy and forget-accuracy results support a milder version of the paper's claims. Overall score 6: one central reported metric reduces to the training objective by construction, while the framework retains some independent empirical evidence.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The paper's claims depend on the hyperparameters lambda1, lambda2, epsilon, alpha, and k, and on the domain assumptions that perturbed forget examples probe the boundary where over-unlearning occurs and that the original model's masked softmax is the right reference. No new physical or ontological entities are introduced; Spotter is a loss function, not an entity.

free parameters (6)
  • lambda1 = 0.7
    Balances the masked distillation loss Lu and the over-unlearning penalty Lo in Spotter's objective (Eq. 11); tuned via ablation in Table 4.
  • lambda2 = 0.1 and 1
    Weight of the intra-class dispersion loss Lsim; larger values give a stronger PRA defense at a slight retained-accuracy cost.
  • epsilon (perturbation budget) = 0.03
    Used both for generating Lo training perturbations and for OU@eps evaluation; Figure 5 shows sensitivity to this choice.
  • alpha (PRA interpolation) = tuned per method
    Interpolates prototype weights with the unlearned head (Eq. 7); chosen so that Acc*r >= Accr - 1%, i.e., the attack stays stealthy.
  • k (attack samples per class) = 5
    Number of forget samples used to compute the prototype in PRA.
  • PGD iterations and step size = 3 iters, step 0.01
    Hyperparameters for generating perturbed examples for OU@eps and Lo.
assumptions (5)
  • domain assumption Perturbed forget examples within an epsilon-ball approximate the boundary-proximal region where over-unlearning occurs.
    Used in Eq. (1)-(3) to define OU@eps and in Eq. (9) for Spotter's Lo. If this localization is wrong, the metric measures irrelevant drift.
  • domain assumption The original model's masked softmax over retained classes is the correct reference distribution for measuring over-unlearning.
    OU@eps and Lu/Lo all compare against the original model's masked output; the retrain model, which has no forget-class knowledge, scores worse on this metric.
  • domain assumption An adversary has white-box access and a few forget samples.
    PRA assumes white-box access to the unlearned model's features and a small public forget sample set, e.g., collected from social media.
  • standard math Prototype-based nearest-centroid classification (Snell et al.) is a valid probe of residual class structure.
    Equations (4)-(6) re-derive the equivalence of cosine and L2 prototype classification to a linear head.
  • standard math Standard deep learning training and PGD attack assumptions.
    Used throughout the experiments; not verified in the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack." pith.science (2026). https://pith.science/paper/Q5ZGNPJL

@misc{pith2026250601318,
  author       = {Pith},
  title        = {Pith review of: Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Q5ZGNPJL}},
  note         = {Machine review of arXiv:2506.01318}
}
read the original abstract

Machine unlearning (MU) aims to expunge a designated forget set from a trained model without costly retraining, yet the existing techniques overlook two critical blind spots: "over-unlearning" that deteriorates retained data near the forget set, and post-hoc "relearning" attacks that aim to resurrect the forgotten knowledge. Focusing on class-level unlearning, we first derive an over-unlearning metric, OU@epsilon, which quantifies collateral damage in regions proximal to the forget set, where over-unlearning mainly occurs. Next, we expose an unforeseen relearning threat on MU, i.e., the Prototypical Relearning Attack, which exploits the per-class prototype of the forget class with just a few samples, and easily restores the pre-unlearning performance. To counter both blind spots in class-level unlearning, we introduce Spotter, a plug-and-play objective that combines (i) a masked knowledge-distillation penalty on the nearby region of forget classes to suppress OU@epsilon, and (ii) an intra-class dispersion loss that scatters forget-class embeddings, neutralizing Prototypical Relearning Attacks. Spotter achieves state-of-the-art results across CIFAR, TinyImageNet, and CASIA-WebFace datasets, offering a practical remedy to unlearning's blind spots.

Figures

Figures reproduced from arXiv: 2506.01318 by the authors.

Figure 1
Figure 1. UMAP (McInnes et al., 2018) visualizations of CIFAR-10 representations computed with unlearned feature extractors, where the forget class is highlighted in (‘red’) and the remaining classes are shown in (‘gray’). in Equation (3) using either (i) a worst-case attack such as Projected Gradient Descent (PGD) (Madry et al., 2018) that maximizes the loss of fθ, or (ii) a random perturbation such as Gaussian noise. Our pr… view at source ↗
Figure 2
Figure 2. (a) Accf comparisons of Original, Unlearned, and Re￾learned models. Unlearned models without relearning (‘Unlearn’), and the relearned models on N samples with a single epoch (‘Re￾learnN’). (b) Accf comparisons of Original, Unlearned, and Proto￾typical Relearned models. Only N samples are used for computing the class-prototype (‘ProtoN’). We set the hyperparameter α so that the drop in Accr does not exceed 1%. findi… view at source ↗
Figure 3
Figure 3. UMAP visualizations on CIFAR-10 representations computed with a Spotter-unlearned feature extractor, where the forget class is highlighted in (‘red’) and the remaining classes, (‘gray’). 5.2. Results [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Grad-CAM analysis on face recognition under PRA. Class activation maps for forget-class face images across Original, Retrain, DELETE, and Spotter, clean and under the PRA. mance on retained data, drive collateral damage down, and leave almost no room for prototypical r…
Figure 5
Figure 5. Figure 5: (a) Ablation studies on ε for Lo. We unlearn models with varying ε used in Lo and measure the over-unlearning with ε = 0.03 perturbed set. (b) Ablation studies on ε for OU @ε. We measure OU @ε varying ε used to generate the perturbed set. Dotted lines represent the cas…

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Gradient Concentration, Not Weight Saliency, Explains Representation-Level Class Unlearning

    cs.LG 2026-07 accept novelty 7.0 of 10

    In class unlearning on CIFAR-10/100 with ResNet-18, the identity of saliency-selected weights does not affect representation-level recovery; late-layer gradient concentration and representation geometry drive the outcome.

  2. Association Restoration Test: Revealing Restorable Shortcuts after Unlearning

    cs.CV 2026-07 conditional novelty 6.0 of 10

    ART shows that many shortcut-mitigation and association-unlearning methods leave label-attribute associations that can be reactivated by amplifying residual feature directions under the original classifier head.

Reference graph

Works this paper leans on

31 extracted references · 13 canonical work pages · cited by 2 Pith papers

  1. [1]

    Specifically, for each forget sample x∈ Df , we draw a noise δ∼ N(0, σ2I) with variance σ2 = 0.01 to form perturbed sample x+δ

    Method CIFAR-10 CIFAR-100 OU @ε↓Gaussian-OU @ε↓OU @ε↓Gaussian-OU @ε↓ Random Label0.1561 0.2041 0.4450 0.3747 NegGrad 0.3269 0.3161 0.5309 0.5174 Boundary Shrink0.1435 0.1569 0.4466 0.4176 Boundary Expand0.0958 0.0914 0.0043 0.0043 SalUn 0.1664 0.1946 0.4481 0.3791 Learn to Unlearn0.3390 0.3460 0.2397 0.2815 DELETE 0.1216 0.1036 0.2405 0.2982 Fisher 0.1747...

    work page 1946

  2. [5]

    Main Track

    doi: 10.24963/ijcai.2024/40. Main Track. Chen, M., Gao, W., Liu, G., Peng, K., and Wang, C. Bound- ary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7766–7775, June

    work page doi:10.24963/ijcai.2024/40 2024

  3. [7]

    doi: 10.1609/aaai.v37i6. 25879. Cooper, A. F., Choquette-Choo, C. A., Bogen, M., Klyman, K., Jagielski, M., Filippova, K., Liu, K., Chouldechova, A., Hayes, J., Huang, Y ., Triantafillou, E., Kairouz, P., Mitchell, N., Mireshghallah, N., Jacobs, A., Grimmel- mann, J., Shmatikov, V ., De Sa, C., Shumailov, I., Terzis, A., Barocas, S., Wortman Vaughan, J., ...

    work page doi:10.1609/aaai.v37i6

  4. [8]

    and Roger, F

    Deeb, A. and Roger, F. Do unlearning methods remove in- formation from language model weights?arXiv preprint arXiv:2410.08827,

    arXiv

  5. [9]

    Ginart, A., Guan, M., Valiant, G., and Zou, J

    doi: 10.1109/ICCV51701.2025.00206. Ginart, A., Guan, M., Valiant, G., and Zou, J. Y . Making AI forget you: Data deletion in machine learning. In Wal- lach, H., Larochelle, H., Beygelzimer, A., d'Alch´e-Buc, F., Fox, E., and Garnett, R. (eds.),Advances in Neural Information Processing Systems (NeurIPS), volume

    arXiv 2025

  6. [10]

    Liu, S., Yao, Y ., Jia, J., Casper, S., Baracaldo, N., Hase, P., Yao, Y ., Liu, C

    1145/3696410.3714821. Liu, S., Yao, Y ., Jia, J., Casper, S., Baracaldo, N., Hase, P., Yao, Y ., Liu, C. Y ., Xu, X., Li, H., Varshney, K. R., Bansal, M., Koyejo, S., and Liu, Y . Rethink- ing machine unlearning for large language models.Na- ture Machine Intelligence, 7(2):181–194,

    arXiv

  7. [11]

    Selective forgetting of deep networks at a finer level than samples.arXiv preprint arXiv:2012.11849,

    Hayase, T., Yasutomi, S., and Katoh, T. Selective forgetting of deep networks at a finer level than samples.arXiv preprint arXiv:2012.11849,

    arXiv 2012

  8. [12]

    Inexact unlearning needs more care- ful evaluations to avoid a false sense of privacy

    Hayes, J., Shumailov, I., Triantafillou, E., Khalifa, A., and Papernot, N. Inexact unlearning needs more care- ful evaluations to avoid a false sense of privacy. In 2025 IEEE Conference on Secure and Trustworthy Ma- chine Learning (SaTML), pp. 497–519,

    work page 2025

Show all 31 references
  1. [15]

    A duty to forget, a right to be assured? exposing vulnerabilities in machine unlearning services

    Hu, H., Wang, S., Chang, J., Zhong, H., Sun, R., Hao, S., Zhu, H., and Xue, M. A duty to forget, a right to be assured? exposing vulnerabilities in machine unlearning services. In31st Annual Network and Distributed System Security Symposium (NDSS), 2024a. doi: 10.14722/ndss. 2...

  2. [17]

    ISBN 9798400701719

    Association for Computing Machinery. ISBN 9798400701719. doi: 10.1145/3589334.3645462. Liu, F. and Liu, H. Subgraph federated unlearning. In Proceedings of the ACM Web Conference (WWW), pp. 1205–1215, New York, NY , USA,

  3. [19]

    Liu, Z., Dou, G., Tan, Z., Tian, Y ., and Jiang, M

    doi: 10.1038/s42256-025-00985-0. Liu, Z., Dou, G., Tan, Z., Tian, Y ., and Jiang, M. Towards safer large language models through machine unlearn- ing. In Ku, L.-W., Martins, A., and Srikumar, V . (eds.), Findings of the Association for Computational Linguis- tics (ACL Findings...

    doi

  4. [20]

    doi: 10.18653/v1/2024.findings-acl.107

    Association for Computational Linguistics. doi: 10.18653/v1/2024.findings-acl.107. Lynch, A., Guo, P., Ewart, A., Casper, S., and Hadfield- Menell, D. Eight methods to evaluate robust unlearning in LLMs.arXiv preprint arXiv:2402.16835,

    2024 arXiv

  5. [21]

    doi: 10.1109/TDSC.2022. 3194884. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. InInternational Conference on Learn- ing Representations (ICLR),

    2022 doi

  6. [24]

    Shaik, T., Tao, X., Xie, H., Li, L., Zhu, X., and Li, Q

    1109/ICCV .2017.74. Shaik, T., Tao, X., Xie, H., Li, L., Zhu, X., and Li, Q. Exploring the landscape of machine unlearning: A com- prehensive survey and taxonomy.IEEE Transactions on Neural Networks and Learning Systems, 36(7):11676– 11696,

    2017

  7. [25]

    Shi, W., Lee, J., Huang, Y ., Malladi, S., Zhao, J., Holtzman, A., Liu, D., Zettlemoyer, L., Smith, N., and Zhang, C

    doi: 10.1109/TNNLS.2024.3486109. Shi, W., Lee, J., Huang, Y ., Malladi, S., Zhao, J., Holtzman, A., Liu, D., Zettlemoyer, L., Smith, N., and Zhang, C. MUSE: Machine unlearning six-way evaluation for lan- guage models. In Yue, Y ., Garg, A., Peng, N., Sha, F., and Yu, R. (eds.)...

    2024

  8. [26]

    Thiel, D

    doi: 10.1109/SaTML64287.2025.00035. Thiel, D. Identifying and eliminating CSAM in generative ML training data and models. Technical report, Stanford Internet Observatory, Cyber Policy Center, December

    2025

  9. [27]

    Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and Jegou, H

    doi: 10.1109/EuroSP53844.2022.00027. Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and Jegou, H. Training data-efficient image trans- formers and distillation through attention. In Meila, M. and Zhang, T. (eds.),Proceedings of the 38th Interna- tional Conferen...

    2022

  10. [28]

    doi: 10.14722/ndss.2025. 230080. Yuan, X., Zhao, Z., Li, J., Pasikhani, A., Gope, P., and Sik- dar, B. Towards irreversible machine unlearning for dif- fusion models.arXiv preprint arXiv:2512.03564,

    2025

  11. [29]

    Zhang, Z., Wang, F., Li, X., Wu, Z., Tang, X., Liu, H., He, Q., Yin, W., and Wang, S

    doi: 10.52202/079017-1158. Zhang, Z., Wang, F., Li, X., Wu, Z., Tang, X., Liu, H., He, Q., Yin, W., and Wang, S. Catastrophic failure of LLM unlearning via quantization. In Yue, Y ., Garg, A., Peng, N., Sha, F., and Yu, R. (eds.),International Conference on Learning Representa...

    doi

  12. [30]

    13 Unlearning’s Blind Spots: Over-Unlearning and Prototypical Relearning Attack A

    doi: 10.1109/CVPR52734.2025.01895. 13 Unlearning’s Blind Spots: Over-Unlearning and Prototypical Relearning Attack A. Validation ofOU @εwith Forget-Adjacent Retained Samples Table 5.Comparison of unlearning performance on CIFAR-10 when one class is randomly unlearned. In addit...

    2025

  13. [32]

    and DeiT-Small (DeiT-S) (Touvron et al., 2021)—and summarize the results in Table

    2021

  14. [2009]

    Towards unbounded machine unlearning

    Kurmanji, M., Triantafillou, P., Hayes, J., and Triantafillou, E. Towards unbounded machine unlearning. In Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., and Levine, S. (eds.),Advances in Neural Information Pro- cessing Systems (NeurIPS), volume 36, pp. 1957–1987. ...

    1957

  15. [2015]

    Cha, S., Cho, S., Hwang, D., Lee, H., Moon, T., and Lee, M

    doi: 10.1109/SP.2015.35. Cha, S., Cho, S., Hwang, D., Lee, H., Moon, T., and Lee, M. Learning to unlearn: Instance-wise unlearning for pre- trained classifiers.Proceedings of the AAAI Conference on Artificial Intelligence, 38(10):11186–11194, March

    2015 doi

  16. [2016]

    Hinton, G., Vinyals, O., and Dean, J

    doi: 10.1109/CVPR.2016.90. Hinton, G., Vinyals, O., and Dean, J. Distilling the knowledge in a neural network.arXiv preprint arXiv:1503.02531,

    2016 arXiv

  17. [2018]

    Neel, S., Roth, A., and Sharifi-Malvajerdi, S

    doi: 10.21105/joss.00861. Neel, S., Roth, A., and Sharifi-Malvajerdi, S. Descent-to- Delete: Gradient-based methods for machine unlearning. In Feldman, V ., Ligett, K., and Sabato, S. (eds.),Proceed- ings of the 32nd International Conference on Algorithmic Learning Theory, vol...

    doi

  18. [2020]

    Goldman, E

    doi: 10.1109/CVPR42600.2020.00932. Goldman, E. An introduction to the california consumer privacy act (CCPA).Santa Clara Univ. Legal Studies Research Paper,

    2020

  19. [2021]

    doi: 10.1109/SP40001.2021.00019. Cao, Y . and Yang, J. Towards making systems forget with machine unlearning. In2015 IEEE Symposium on Security and Privacy (S&P), pp. 463–480,

    2021

  20. [2022]

    McInnes, L., Healy, J., Saul, N., and Grossberger, L

    doi: 10.1609/aaai.v36i7.20736. McInnes, L., Healy, J., Saul, N., and Grossberger, L. Umap: Uniform manifold approximation and projection.The Journal of Open Source Software, 3(29):861,

    doi

  21. [2023]

    Chundawat, V

    doi: 10.1109/CVPR52729.2023.00750. Chundawat, V . S., Tarun, A. K., Mandal, M., and Kankan- halli, M. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher.Proceed- ings of the AAAI Conference on Artificial Intelligence, 37(6):7210–7217, June

    2023

  22. [2024]

    Chen, H., Zhu, T., Yu, X., and Zhou, W

    doi: 10.1609/aaai.v38i10.28996. Chen, H., Zhu, T., Yu, X., and Zhou, W. Machine unlearning via null space calibration. In Larson, K. (ed.),Proceed- ings of the Thirty-Third International Joint Conference on Artificial Intelligence (IJCAI), pp. 358–366. International Joint Conf...

    doi

  23. [2025]

    Bourtoule, L., Chandrasekaran, V ., Choquette-Choo, C

    doi: 10.1002/eng2.13081. Bourtoule, L., Chandrasekaran, V ., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., and Papernot, N. Machine unlearning. In2021 IEEE Symposium on Security and Privacy (S&P), pp. 141–159,

    doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.