Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

Certified Unlearning for Neural Networks

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A short run of clipped, noise-injected fine-tuning on the data that stays can certify the erasure of the data that goes, for arbitrary non-convex neural networks.

desk verdict The theory is a genuine step for certified unlearning, but the experimental noise levels do not satisfy the paper's own theorems, so the practical claims are unsupported. read the letter →

arxiv 2506.06985 v2 pith:6ALA4TNO submitted 2025-06-08 cs.LG cs.CRstat.ML

Anastasia Koloskova , Youssef Allouah , Animesh Jha , Rachid Guerraoui , Sanmi Koyejo This is my paper
classification cs.LGcs.CRstat.ML
keywords machineunlearningcertifieddifferentialprivacyamplificationnoisyfine-tuninggradientclippingnon-convexoptimizationrighttobeforgotten
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a certified unlearning method that treats a few iterations of noisy fine-tuning on retained data as a stochastic post-processing step, so that each iteration provably shrinks the statistical distance between the unlearned model and a model that never saw the forget set. The central claim is that gradient clipping and model clipping, combined with Gaussian noise, give $(\varepsilon,\delta)$-unlearning with explicit noise bounds that hold for arbitrary loss functions, including non-convex neural networks, without requiring smoothness or convexity. If true, this makes formal deletion guarantees practical for deep networks, and the paper reports that the method reaches target accuracy up to 50% faster than retraining from scratch.

What carries the argument

The load-bearing object is the shifted R\'enyi divergence $D_q^{(z)}(\mu\|\nu)$, which measures divergence after allowing a worst-case shift $z$ between two distributions. The update map $\psi(x) = x - \gamma(\Pi_{C_1}(G(x)) + \lambda x)$ satisfies $\|\psi(x') - \psi(x)\| \le |1-\gamma\lambda|\,\|x'-x\| + 2\gamma C_1$, and a shift-reduction lemma converts that bound into a per-step decay of the shifted divergence. Model clipping instead uses the hockey-stick divergence $E_\varepsilon$ together with the Gaussian contraction bound $\theta_\varepsilon(2C_2/\sigma)$; both variants are assembled under the privacy-amplification-by-stochastic-post-processing principle, so the added noise never touches the forget data and each step improves the guarantee.

What would settle it

A single calculation settles the matter: for the MNIST gradient-clipping run at compute budget 1, with $\gamma=0.0001$, $\lambda=10$, $C_0=0.01$, $C_1=100$, $T=1$, and $\sigma=0.028270$, the one-step hockey-stick divergence between the unlearned and retained-data chains is about 0.29, whereas the claimed guarantee requires at most $\delta=10^{-5}$; the same run has $\gamma\lambda=0.001$, far below the $\gamma\lambda > 1/2$ condition of Theorem 4.1. A reader could also verify whether any model-clipping run has the $C_0$ and $\sigma_0$ values that Theorem 4.2's iteration bound requires.

Watch

Extended reading notes

Core claim

The paper's central discovery is that clipping turns each unlearning step into a Markov kernel with controlled output sensitivity, so the privacy-amplification-by-iteration analysis can be extended from convex losses to arbitrary functions. Theorem 4.1 states that $T$ steps of gradient clipping with Gaussian noise of variance $\sigma^2 = \frac{72\gamma\lambda\log(1/\delta)}{\varepsilon^2}\left(C_0(1-\gamma\lambda)^T + \frac{C_1}{\lambda}\right)^2$ yield $(\varepsilon,\delta)$-unlearning whenever $\gamma\lambda \in (1/2,1)$, with no assumption on the loss beyond the ability to clip its stochastic gradients; Theorem 4.2 gives an analogous guarantee for model clipping through a per-step amplification factor $\theta_\varepsilon(r)$ derived from the hockey-stick divergence between Gaussians. The proof tracks the shifted R\'enyi divergence between two chains, one initialized from the full-data model and one from the retained-data model, and shows the divergence shrinks because the clipping bound replaces smoothness with a contraction of the update map. The practical claim is that certified unlearning for deep networks can be achieved by redistributing noise across fine-tuning iterations instead of paying the full privacy noise in one shot.

Load-bearing premise

The central guarantee depends on the unlearning step running with parameters that actually satisfy the paper's sufficient noise conditions; the experimental appendices list configurations such as $\gamma\lambda = 0.001$ on MNIST that are far outside the theorem's required $\gamma\lambda > 1/2$ regime, and the model-clipping runs do not specify the initial noise and clipping constants that Theorem 4.2 requires, so if those conditions are genuinely necessary the reported accuracy gains are not certified unlearning.

Editorial extensions

If this is right

  • Certified unlearning becomes applicable to arbitrary non-convex models trained by any base algorithm, as long as the unlearning stage itself runs clipped, noisy SGD on retained data.
  • The noise required per iteration can shrink with more iterations, with $\sigma^2$ decreasing like $1/T$ in the unregularized case or acquiring an exponential-in-$T$ factor under regularization, so utility can be preserved by spending more compute on unlearning.
  • The transfer-learning experiments report that the method reaches target accuracy faster than retraining from scratch and much faster than DP-SGD with group privacy, which pays noise that is at least quadratic in the forget-set size.
  • The framework supports non-adaptive sequential unlearning requests, because each request can be treated as another stochastic post-processing step on the retained data.
  • Prior non-convex certified unlearning methods required knowing the loss's smoothness constant or Hessian spectral information; this approach removes those requirements entirely.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The empirical sections should not be read as certified unless the exact hyperparameter tables satisfy the theorem conditions; several reported runs, such as MNIST gradient clipping at budget 1 with $\gamma\lambda=0.001$ and $\sigma\approx 0.028$, lie far outside the $\gamma\lambda > 1/2$ regime and give a one-step hockey-stick divergence around 0.29 rather than the claimed $\delta=10^{-5}$, so tho
  • A natural, testable strengthening would be to re-run the same experiments inside the theorem's valid region, for instance choosing $\gamma\lambda$ just above $1/2$ with the correspondingly larger noise, to see whether the reported utility gains survive; the paper's own hyperparameter grid suggests such valid configurations may be rare for small models.
  • The certificate covers the unlearning stage only: once the privacy target is reached, the protocol switches to ordinary fine-tuning on retained data, and the final guarantee depends on that fine-tuning being a post-processing step that also never touches forget data, so practitioners should audit the whole pipeline, including the switch, rather than just the noisy iterations.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a certified unlearning method for neural networks based on noisy fine-tuning on the retain set. Two variants are analyzed: gradient clipping (Eq. 3) and model clipping (Eq. 4). Theorem 4.1 gives sufficient noise magnitudes for gradient clipping without smoothness or convexity assumptions, and Theorem 4.2 gives an iteration/noise condition for model clipping via contraction of the hockey-stick divergence. The paper reports experiments on MNIST, CIFAR-10, and transfer-learning settings, claiming that the methods achieve (1,1e-5)-unlearning and outperform retraining and output-perturbation baselines.

Significance. If the theoretical results are correct, the gradient-clipping theorem is a significant step: it extends certified unlearning to arbitrary non-convex networks without requiring smoothness knowledge. The proof machinery (shifted Rényi divergence applied to clipped maps) is elegant, and the model-clipping analysis via contraction coefficients is natural. The paper also releases code and detailed hyperparameter tables, which makes the empirical claims checkable. However, the present experimental validation does not instantiate the theorems: the reported noise levels and hyperparameters in Appendix B fall outside the certified regime, and the model-clipping algorithm statement is inconsistent with its proof. The empirical contribution is therefore not currently established, although the theoretical framework appears potentially repairable.

major comments (4)
  1. The reported σ values in the gradient-clipping experiments do not satisfy Theorem 4.1's sufficient condition. For Table 5 row 1 (γ=1e-4, λ=10, C1=100, C0=0.01, T=1), the listed σ=0.02827 matches the pre-conversion expression σ² = γλ(2−γλ)/(2ε(1−(1−γλ)^{2T})) · (2C0(1−γλ)^T + (2C1/λ)(1−(1−γλ)^T))² with ε=1, not Eq. (6). With this σ, the hockey-stick divergence between the two one-step Gaussian mechanisms with sensitivity c=2(C0(1−γλ)+C1/λ(1−(1−γλ))) ≈ 0.03998 is Q(εσ/c − c/(2σ)) − e^ε Q(εσ/c + c/(2σ)) ≈ 0.29, far above δ=1e-5; a valid certificate for this row requires σ roughly an order of magnitude larger. The same pattern occurs in Tables 7, 12, 13, and 14, so the statement in §5 that the privacy target is reached in under 100 unlearning steps is not supported by the reported configurations.
  2. [Theorem 4.1; Appendix B] Nearly every gradient-clipping row violates the theorem's condition γλ∈(1/2,1). In Table 5, γλ is 0.001 or 0.075; in Table 7, γλ takes values such as 0.2, 0.05, and 0.5 (the last from γ=0.01, λ=50); Tables 12–13 contain similar values. Since the proof of Theorem 4.1 uses γλ>1/2 to upper-bound the noise expression, configurations with γλ≤1/2 are outside the certified regime. The experimental section should either restrict to γλ∈(1/2,1) or provide an additional analysis covering smaller γλ.
  3. [Eq. (4); Theorem 4.2; Tables 6/8] Eq. (4) and Theorem 4.2 describe inconsistent algorithms. Eq. (4) sets x0=ˆx and never applies the initial clipping/noise, whereas the proof of Theorem 4.2 starts from x0 = Π_C0(A(D))+ξ0 and x'_0 = Π_C0(A(D\Df))+ξ0. Because of this mismatch, the theorem does not certify the algorithm as written. Moreover, Tables 6 and 8 do not report C0 or σ0, so conditions (10) and (11) cannot be verified for the model-clipping experiments.
  4. [§5.3; Table 11] The transfer-learning comparison with DP-SGD appears to use different forget-set sizes: the proposed method forgets 10% of the data, while the DP-SGD row reports a forget-set size of 0.5%. If these are the actual removed sets, the comparison is not at equal unlearning workload; if the 0.5% refers to a group-privacy parameter, the relationship to the 10% forget set should be explained.
minor comments (4)
  1. [Appendix A.1, Lemma A.3] Lemma A.3 defines Q(t) with prefactor 1/√π, while Theorem 4.2's Eq. (9) uses 1/√(2π); the standard normal survival function requires 1/√(2π), so the two definitions should be made consistent.
  2. [§4.2] The expression T = 1/(ηλ) log(λC0/C1) uses an undefined symbol η; this should be γ (the learning rate).
  3. [Table 1] The Model Clipping entry reports only C2² log(1/δ) as the noise variance; since Eq. (11) also involves T, σ0, and C0, the table should state that this is the optimized/asymptotic value.
  4. [Definition 2.1] Definition 2.1 writes probabilities of exact equality for continuous outputs; stating the condition for all measurable events (or using densities) would avoid measure-zero ambiguity.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: noise bounds follow from external DP/amplification results; the main issue is experimental noise calibration, not a self-referential loop.

full rationale

The claimed derivation chain is not circular. Theorem 4.1's noise formulas (5)-(6) are derived from Theorem A.9, which combines the shifted Renyi divergence lemma of Feldman et al. (2018), the mapping lemma A.7, and the clipping Lipschitz bound Lemma A.8; none of these inputs contains the (epsilon,delta)-unlearning conclusion. Theorem 4.2 is a direct application of the external hockey-stick contraction bound (Balle et al., 2019) and Gaussian divergence formula (Asoodeh et al., 2020). The certifying algorithm in Definition 2.1 is chosen to be the noisy fine-tuning procedure run from the retain-trained model; this is the standard DP-style formulation of unlearning, and the theorem proves the required indistinguishability rather than assuming it. The overlapping-author citation (Allouah et al., 2025) is used in related-work and definition discussion, and in the DP-unlearning separation comparison; it is not load-bearing for any theorem. The main caveat is a validation gap, not circularity: the sigma values in Appendix B (e.g., Table 5 row 1, sigma=0.028270) match the Appendix A.2 pre-conversion bound with epsilon in the denominator but no log(1/delta) factor, not Theorem 4.1's Eq. (6), and several rows use gamma*lambda=0.001, outside the gamma*lambda > 1/2 condition; also Eq. (4) omits the initial Pi_C0 and noise xi_0 that Theorem 4.2's proof requires, and Tables 6 and 8 do not report C0/sigma0. These issues bear on whether the reported experiments are actually certified, not on whether the derivation is equivalent to its inputs.

Assumptions & free parameters 8 free parameters · 7 assumptions · 0 invented entities

The central claims rest on standard differential privacy theorems (Gaussian mechanism, Renyi divergence, post-processing) and on prior amplification results by Feldman et al. and Balle et al. The paper's own contribution is the extension to non-convex settings via clipping. No invented entities are introduced.

free parameters (8)
  • C0 = 0.01 to 20 in experiments
    Initial model clipping radius; bounds the sensitivity of the initial model and appears in the noise formulas.
  • C1 = 1 to 100 in experiments
    Gradient clipping threshold; bounds the per-step shift in the gradient clipping analysis.
  • C2 = 0.001 to 0.975 in experiments
    Model clipping radius; bounds the per-step sensitivity in the model clipping analysis.
  • gamma (learning rate) = 0.0001 to 0.01 in experiments
    Determines contraction factor and the noise-accuracy trade-off.
  • lambda (regularization) = 0.5 to 750 in experiments
    Induces contraction in the regularized gradient clipping analysis.
  • sigma (per-step noise) = 0.002 to 0.28 in experiments
    The privacy knob; the sufficient values are derived, but the experimental values appear too small to certify the claimed guarantee.
  • T (number of unlearning steps) = 1 to 93 in experiments
    Chosen to reach the privacy target and accuracy; often 1 in the tables.
  • sigma0 (initial noise) = not reported
    Required by Theorem 4.2 for model clipping but absent from the hyperparameter tables.
assumptions (7)
  • standard math Gaussian mechanism and Renyi-to-DP conversion (Dwork & Roth, Mironov)
    Used in Theorems 4.1 and 4.2 to translate divergence bounds into (epsilon, delta)-unlearning.
  • standard math Privacy amplification by iteration and shift-reduction lemma (Feldman et al. 2018)
    Core machinery for the gradient clipping analysis in Appendix A.2.
  • standard math Contraction coefficients for hockey-stick divergence (Asoodeh et al. 2020)
    Used in the model clipping proof in Appendix A.1.
  • standard math Data processing inequality for Renyi divergence
    Invoked in Lemma A.7.
  • domain assumption The unlearning procedure runs SGD on retained data only; no loss-function assumptions are made
    Defines the class of methods and models covered by the guarantees.
  • domain assumption The certifying algorithm is the same noisy fine-tuning applied to a retrained model
    The guarantee is relative to this reference distribution, following Sekhari et al. and Allouah et al.
  • ad hoc to paper Clipping makes the update map satisfy the uniform bound used in Lemma A.8, including for stochastic gradients
    Lemma A.8 uses this uniform bound; the paper does not explicitly analyze the stochasticity of G, though the bound holds pointwise.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Certified Unlearning for Neural Networks." pith.science (2026). https://pith.science/paper/6ALA4TNO

@misc{pith2026250606985,
  author       = {Pith},
  title        = {Pith review of: Certified Unlearning for Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6ALA4TNO}},
  note         = {Machine review of arXiv:2506.06985}
}
read the original abstract

We address the problem of machine unlearning, where the goal is to remove the influence of specific training data from a model upon request, motivated by privacy concerns and regulatory requirements such as the "right to be forgotten." Unfortunately, existing methods rely on restrictive assumptions or lack formal guarantees. To this end, we propose a novel method for certified machine unlearning, leveraging the connection between unlearning and privacy amplification by stochastic post-processing. Our method uses noisy fine-tuning on the retain data, i.e., data that does not need to be removed, to ensure provable unlearning guarantees. This approach requires no assumptions about the underlying loss function, making it broadly applicable across diverse settings. We analyze the theoretical trade-offs in efficiency and accuracy and demonstrate empirically that our method not only achieves formal unlearning guarantees but also performs effectively in practice, outperforming existing baselines. Our code is available at https://github.com/stair-lab/certified-unlearning-neural-networks-icml-2025

Figures

Figures reproduced from arXiv: 2506.06985 by the authors.

Figure 1
Figure 1. Accuracy of Gradient and Model Clipping versus compute budget (epochs) on CIFAR-10 (left) and MNIST (right), to satisfy (1, 10−5 )-unlearning. We compare to two baselines: retraining from scratch and output perturbation, detailed in Section 2. Across all the compute budgets gradient and model clipping achieves higher accuracy than the baselines, with the difference being larger for smaller compute budgets. Accuracy … view at source ↗
Figure 2
Figure 2. Convergence behavior of Gradient Clipping with γ = 0.01, C0 = 20, C1 = 10, λ = 50, σ = 0.25 and the retraining from scratch baseline on the CIFAR-10 dataset. The gradient clipping method is applied for the first 30 iterations, followed by standard fine-tuning. Initially, gradient clipping degrades per￾formance but retains useful information, allowing fine-tuning to recover and surpass the retraining baseline quickly… view at source ↗
Figure 3
Figure 3. Accuracy of Gradient Clipping versus compute budget (epochs) on CIFAR-10 (left) and CIFAR-100 (right) using a ResNet-18 feature extractor pretrained on public data, to satisfy (1, 10−5 )-unlearning. data (ImageNet (Deng et al., 2009)). This setup, where unlearning is applied to the last few layers of a pretrained model, has become standard in recent certified approximate unlearning works (Guo et al., 2020; Chien et … view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Accuracy of Gradient Clipping versus compute budget (epochs) on CIFAR-10 (left) and MNIST (right), to satisfy (ε, 10−5 )- unlearning for ε ∈ {0.1, 1, 10}. 22 [PITH_FULL_IMAGE:figures/full_fig_p022_4.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Auditing of Unlearning Algorithms

    cs.LG 2026-07 accept novelty 6.0 of 10

    An auditor based on membership inference attacks computes valid lower bounds on the unlearning parameter ε, empirically separating certified unlearning methods (small bounds) from heuristic ones (large bounds).

Reference graph

Works this paper leans on

38 extracted references · 21 canonical work pages · cited by 1 Pith paper

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    B., Mironov, I., Talwar, K., and Zhang, L

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp.\ 308--318, 2016

    2016

  3. [3]

    The utility and complexity of in- and out-of-distribution machine unlearning

    Allouah, Y., Kazdan, J., Guerraoui, R., and Koyejo, S. The utility and complexity of in- and out-of-distribution machine unlearning. In The Thirteenth International Conference on Learning Representations, 2025

    work page 2025

  4. [4]

    Contraction of E _ -divergence and its applications to privacy

    Asoodeh, S., D \'i az, M., and du Pin Calmon, F. Contraction of E _ -divergence and its applications to privacy. 2020. URL https://api.semanticscholar.org/CorpusID:256808341

    work page 2020

  5. [5]

    Privacy amplification by mixing and diffusion mechanisms

    Balle, B., Barthe, G., Gaboardi, M., and Geumlek, J. Privacy amplification by mixing and diffusion mechanisms. In Neural Information Processing Systems, 2019. URL https://api.semanticscholar.org/CorpusID:168170121

    work page 2019

  6. [6]

    Hypothesis testing interpretations and renyi differential privacy

    Balle, B., Barthe, G., Gaboardi, M., Hsu, J., and Sato, T. Hypothesis testing interpretations and renyi differential privacy. In International Conference on Artificial Intelligence and Statistics, pp.\ 2496--2506. PMLR, 2020

    work page 2020

  7. [7]

    A., Jia, H., Travers, A., Zhang, B., Lie, D., and Papernot, N

    Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., and Papernot, N. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pp.\ 141--159. IEEE, 2021

    work page 2021

  8. [8]

    and Yang, J

    Cao, Y. and Yang, J. Towards making systems forget with machine unlearning. In 2015 IEEE Symposium on Security and Privacy, pp.\ 463--480, 2015. doi:10.1109/SP.2015.35

    doi:10.1109/sp.2015.35 2015

Show all 38 references
  1. [9]

    Certified graph unlearning, 2022

    Chien, E., Pan, C., and Milenkovic, O. Certified graph unlearning, 2022. URL https://arxiv.org/abs/2206.09140

    2022 arXiv

  2. [10]

    P., Chen, Z., and Li, P

    Chien, E., Wang, H. P., Chen, Z., and Li, P. Langevin unlearning: A new perspective of noisy gradient descent for machine unlearning. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL https://openreview.net/forum?id=3LKuC8rbyV

    2024

  3. [11]

    and Shah, N

    Chourasia, R. and Shah, N. Forget unlearning: Towards true data-deletion in machine learning. In International Conference on Machine Learning, pp.\ 6028--6073. PMLR, 2023

    2023

  4. [12]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp.\ 248--255. Ieee, 2009

    2009

  5. [13]

    The mnist database of handwritten digit images for machine learning research

    Deng, L. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29 0 (6): 0 141--142, 2012

    2012

  6. [14]

    and Roth, A

    Dwork, C. and Roth, A. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9 0 (3--4): 0 211--407, 2014

    2014

  7. [15]

    and Russinovich, M

    Eldan, R. and Russinovich, M. Who's harry potter? approximate unlearning in llms. arXiv preprint arXiv:2310.02238, 2023

    2023 arXiv

  8. [16]

    Privacy amplification by iteration

    Feldman, V., Mironov, I., Talwar, K., and Thakurta, A. Privacy amplification by iteration. In 2018 IEEE 59th Annual Symposium on Foundations of Computer Science (FOCS), pp.\ 521--532. IEEE, 2018

    2018

  9. [17]

    Ginart, A., Guan, M., Valiant, G., and Zou, J. Y. Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems, 32, 2019

    2019

  10. [18]

    Mixed-privacy forgetting in deep networks

    Golatkar, A., Achille, A., Ravichandran, A., Polito, M., and Soatto, S. Mixed-privacy forgetting in deep networks. 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 792--801, 2020. URL https://api.semanticscholar.org/CorpusID:229678489

    2021

  11. [19]

    J., Mirza, M., Xiao, D., Courville, A., and Bengio, Y

    Goodfellow, I. J., Mirza, M., Xiao, D., Courville, A., and Bengio, Y. An empirical investigation of catastrophic forgetting in gradient-based neural networks. arXiv preprint arXiv:1312.6211, 2013

    2013 arXiv

  12. [20]

    Amnesiac machine learning

    Graves, L., Nagisetty, V., and Ganesh, V. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp.\ 11516--11524, 2021

    2021

  13. [21]

    Certified data removal from machine learning models

    Guo, C., Goldstein, T., Hannun, A., and Van Der Maaten, L. Certified data removal from machine learning models. In International Conference on Machine Learning, pp.\ 3832--3842. PMLR, 2020

    2020

  14. [22]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 770--778, 2016

    2016

  15. [23]

    The cifar-10 dataset

    Krizhevsky, A., Nair, V., and Hinton, G. The cifar-10 dataset. online: http://www. cs. toronto. edu/kriz/cifar. html, 55 0 (5), 2014

    2014

  16. [24]

    Towards unbounded machine unlearning

    Kurmanji, M., Triantafillou, P., Hayes, J., and Triantafillou, E. Towards unbounded machine unlearning. Advances in Neural Information Processing Systems, 36, 2024

    2024

  17. [25]

    Certified minimax unlearning with generalization rates and deletion capacity

    Liu, J., Lou, J., Qin, Z., and Ren, K. Certified minimax unlearning with generalization rates and deletion capacity. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS '23, Red Hook, NY, USA, 2023. Curran Associates Inc

    2023

  18. [26]

    Y., Xu, X., Li, H., et al

    Liu, S., Yao, Y., Jia, J., Casper, S., Baracaldo, N., Hase, P., Yao, Y., Liu, C. Y., Xu, X., Li, H., et al. Rethinking machine unlearning for large language models. arXiv preprint arXiv:2402.08787, 2024

    2024 arXiv

  19. [27]

    R \'e nyi differential privacy

    Mironov, I. R \'e nyi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pp.\ 263--275. IEEE, 2017

    2017

  20. [28]

    and Klabjan, D

    Mu, S. and Klabjan, D. Rewind-to-delete: Certified machine unlearning for nonconvex functions. arXiv preprint arXiv:2409.09778, 2024

    2024

  21. [29]

    Descent-to-delete: Gradient-based methods for machine unlearning

    Neel, S., Roth, A., and Sharifi-Malvajerdi, S. Descent-to-delete: Gradient-based methods for machine unlearning. In Algorithmic Learning Theory, pp.\ 931--962. PMLR, 2021

    2021

  22. [30]

    T., Huynh, T

    Nguyen, T. T., Huynh, T. T., Nguyen, P. L., Liew, A. W.-C., Yin, H., and Nguyen, Q. V. H. A survey of machine unlearning. arXiv preprint arXiv:2209.02299, 2022

    2022 arXiv

  23. [31]

    Sekhari, A., Acharya, J., Kamath, G., and Suresh, A. T. Remember what you want to forget: Algorithms for machine unlearning. Advances in Neural Information Processing Systems, 34: 0 18075--18086, 2021

    2021

  24. [32]

    Smith, L. N. and Topin, N. Super-convergence: Very fast training of residual networks using large learning rates. ArXiv, abs/1708.07120, 2017. URL https://api.semanticscholar.org/CorpusID:23376859

    2017 arXiv

  25. [33]

    On the necessity of auditable algorithmic definitions for machine unlearning

    Thudi, A., Jia, H., Shumailov, I., and Papernot, N. On the necessity of auditable algorithmic definitions for machine unlearning. CoRR, abs/2110.11891, 2021. URL https://arxiv.org/abs/2110.11891

    2021 arXiv

  26. [34]

    J., Mitliagkas, I., Wan, J., et al

    Triantafillou, E., Kairouz, P., Pedregosa, F., Hayes, J., Kurmanji, M., Zhao, K., Dumoulin, V., Junior, J. J., Mitliagkas, I., Wan, J., et al. Are we making progress in unlearning? findings from the first neurips unlearning competition. arXiv preprint arXiv:2406.09073, 2024

    2024 arXiv

  27. [35]

    The Complexity of Differential Privacy, pp.\ 347--450

    Vadhan, S. The Complexity of Differential Privacy, pp.\ 347--450. Springer International Publishing, Cham, 2017. ISBN 978-3-319-57048-8. doi:10.1007/978-3-319-57048-8_7. URL https://doi.org/10.1007/978-3-319-57048-8_7

    2017 doi

  28. [36]

    and Harremos, P

    Van Erven, T. and Harremos, P. R \'e nyi divergence and kullback-leibler divergence. IEEE Transactions on Information Theory, 60 0 (7): 0 3797--3820, 2014

    2014

  29. [37]

    and Von dem Bussche, A

    Voigt, P. and Von dem Bussche, A. The EU general data protection regulation ( GDPR ). A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10 0 (3152676): 0 10--5555, 2017

    2017

  30. [38]

    Towards certified unlearning for deep neural networks

    Zhang, B., Dong, Y., Wang, T., and Li, J. Towards certified unlearning for deep neural networks. In Proceedings of the 41st International Conference on Machine Learning, ICML'24. JMLR.org, 2024

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.