On the Necessity of Output Distribution Reweighting for Effective Class Unlearning

Ali Ebrahimpour-Boroojeny; Hari Sundaram; Yian Wang

REVIEW 5 major objections 5 minor 16 references

On the Necessity of Output Distribution Reweighting for Effective Class Unlearning

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Standard class unlearning leaks membership through probabilities assigned to similar classes; a tilted reweighting of the output distribution suppresses the leak.

desk verdict A useful empirical paper on class unlearning with a new tilted-reweighting loss and a neighbor-logit evaluation, but the headline attack is not really a membership inference attack and the main gains are modest. read the letter →

arxiv 2506.20893 v5 pith:UAYZIUVH submitted 2025-06-25 cs.LG cs.AI

Ali Ebrahimpour-Boroojeny , Yian Wang , Hari Sundaram This is my paper

classification cs.LGcs.AI

keywords classunlearningmembershipinferenceattacknearest-neighboroutputdistributionreweightingtiltedfine-tuningobjectiveprivacyleakagegeometry

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that class-unlearning methods leak membership of forgotten samples through the probabilities they assign to classes similar to the forgotten class, a leak that standard evaluation metrics miss. The authors build a nearest-neighbor membership attack (MIA-NN) that reads the output probability for the closest remaining class and show that ten existing unlearning baselines are vulnerable to it across MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet. They then propose Tilted ReWeighting (TRW), a fine-tuning loss that, for forget-class inputs, renormalizes the output distribution over remaining classes and tilts it exponentially toward classes judged similar to the forgotten class, so that it matches how a retrained-from-scratch model would behave. On CIFAR-10, TRW cuts the gap to retrained models by 19% under U-LiRA and by 46% under MIA-NN relative to the best baseline per metric, while matching or beating prior methods on standard unlearning metrics.

What carries the argument

The load-bearing object is the tilted distribution $q^*(y|x) = \tilde{p}(y|x) e^{\beta s_y} / Z$ over retained classes, with $\tilde{p}$ the original model's output distribution renormalized to zero out the forget class, $s_y$ a cosine similarity between PCA-projected logit weight vectors of the forget and retained classes, and $\beta$ a fixed scalar set to $10$ in all experiments. Proposition 3.1 shows this is the unique information projection of the original distribution onto the retained-class simplex under the first-moment constraint $\sum_{y\ne f} q(y) s_y = c$, so it is the minimal modification that introduces the retrained model's systematic bias toward similar classes. The TRW loss uses $q^*$ as the target for forget-class samples while keeping standard cross-entropy on retained-class samples.

What would settle it

Train a classifier to tell apart forget-class test samples using the output logits of a true retrained model versus those of a TRW-unlearned model; if the classifier exceeds chance significantly on more than a handful of classes, the tilted family is not faithfully reproducing the retrained distribution. A cheaper check: measure the KL divergence between the retrained model's forget-class output distribution and $q^*$ at $\beta=10$; if it is not consistently smaller than the divergence for $\beta=0$ across classes and datasets, the tilt assumption fails.

Watch

Extended reading notes

Core claim

The central discovery is that a model retrained without the forgotten class does not spread the forgotten class's probability mass evenly over the remaining classes; it concentrates it on visually or semantically similar classes, so a model that merely zeroes out the forget label leaves a detectable trace. The paper proves that the distribution family that stays closest to the original model in KL divergence subject to a linear constraint on expected similarity has the exponential-tilt form $q^*(y|x) = \tilde{p}(y|x) e^{\beta s_y} / Z$, where $\tilde{p}$ is the renormalized distribution without the forget class, $s_y$ measures cosine similarity between PCA-projected logit weight vectors, and $\beta$ controls tilt strength. Using $q^*$ as the fine-tuning target for forget-class samples makes the unlearned model behave on those inputs like a retrained model, eliminating the neighbor-class leakage.

Load-bearing premise

The retrained model's behavior on forgotten-class inputs is accurately described by an exponential tilt of the original model's renormalized probabilities, using a single global tilt strength and similarity scores computed from the original model's logit weight vectors.

Editorial extensions

If this is right

Standard unlearning evaluations that report only forget-class accuracy and conventional MIA scores overstate privacy; neighbor-probing attacks such as MIA-NN should become part of the evaluation suite.
TRW is a drop-in loss replacement for fine-tuning-based unlearning: it changes only the forget-sample loss term, so it can be combined with weight-saliency or sparse-update methods without added cost.
With TRW, ten epochs of fine-tuning achieves zero forget-class accuracy and retained accuracy close to retrained models on CIFAR-10, CIFAR-100, and Tiny-ImageNet, including multi-class forgetting settings.
Because the tilt transfers across four datasets and two architectures, the leak-and-fix pattern is a general property of learned class geometry rather than an artifact of one model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The exponential-tilt family is a Gibbs tilting of the renormalized distribution; if the true retrained distribution lies outside this one-parameter family, higher-order moment constraints or per-class, per-sample tilt strengths would be the natural generalizations to test.
MIA-NN, which needs no access to training data, could serve as a standardized privacy probe for class unlearning, complementing U-LiRA by measuring leakage through class geometry rather than per-example likelihood.
The same output-reweighting recipe should transfer to non-image domains (language models, tabular classifiers) whenever a similarity score between classes can be defined from embeddings or logits, since the mechanism is about class geometry, not pixels.
The ablation shows $\beta$ trades retained accuracy against attack resistance; per-class or per-dataset tuning of $\beta$ could preserve the privacy gain at $\beta=20$ without the retained-accuracy drop, and is a directly testable extension.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The thing to know: this is an honest, well-scoped empirical paper about class unlearning, and the core trick is simple and plausible. The new bit is TRW, a one-line loss change that tilts the renormalized output distribution toward semantically similar classes using cosine similarities of logit-weight vectors. That turns out to close a good chunk of the gap to retrained models on standard MIA metrics, and it does so without hurting retained accuracy or adding compute. The other new bit is MIA-NN, which probes neighbor-class logits. Both are worth taking seriously.

What's genuinely good: the method is lightweight, the experiments span four datasets and ten baselines, code is released, and the paper is candid about its own limits (Section 6 admits MIA-NN is heuristic and that the evidence is entirely empirical). The information-projection lemma in Proposition 3.1 is correct but standard; the real contribution is the empirical demonstration that exponential tilting with class-similarity scores is a better target distribution than plain renormalization.

Now the soft spots. The stress-test is right: MIA-NN is not a membership inference attack. It requires labeled test examples for every class and then measures whether the unlearned model's neighbor-class logits align with the retrained model's. That is a distribution-matching metric, not a membership test. An adversary in the MIA setting doesn't get ground-truth labels for the very samples whose membership they're trying to infer. The paper's own framing overclaims by calling this leakage. That said, the MIA-NN results still show something real: existing unlearning methods fail to mimic the neighbor-class behavior of retrained models, and TRW gets much closer. Just don't call it membership inference.

The U-LiRA results give some independent support, but the differences are small: TRW 71.12 vs FT 72.57, with TRW-2R at 67.72, and no error bars or significance tests. On the standard MIA in Table 2, the direction is confusing (Retrain=100, Original=0, with no explanation of what the score means). That needs fixing. Also, beta=10 is fitted on CIFAR-10 and the ablation shows the method is sensitive to it; the transfer to other datasets is plausible but not deeply analyzed. The central 'necessity' claim is therefore somewhat overstated—what's really shown is that TRW helps on the metrics they propose and on U-LiRA, not that reweighting is strictly necessary.

Bottom line: this paper deserves a serious referee. It's a solid empirical contribution with a simple, reproducible loss modification and a new evaluation angle, but the authors should be pushed to reframe MIA-NN as a distribution-matching diagnostic, add error bars to the key tables, and tone down the 'necessity' language. I'd accept it for review and expect a revision.

Referee Report

5 major / 5 minor

Summary. The paper studies class unlearning and argues that existing methods leak membership information through the probabilities they assign to classes semantically similar to the forgotten class. It introduces a metric called MIA-NN that measures how often an unlearned model maps forget-class test inputs to the nearest-neighbor retained class, and proposes a fine-tuning objective, Tilted ReWeighting (TRW), that tilts the renormalized output distribution toward classes similar to the forget class. The tilt uses cosine similarities between PCA-projected logit weight vectors, with a single scalar beta set to 10. The method is evaluated on MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet against ten baselines, using standard metrics, U-LiRA, and the proposed MIA-NN. The paper reports that TRW reduces the gap to retrained models relative to prior methods on CIFAR-10.

Significance. The paper identifies a plausible and previously underemphasized phenomenon: a model retrained without a class tends to redistribute that class's probability mass toward semantically similar classes, and approximate unlearning methods may fail to reproduce this behavior. If this is established with valid metrics, the proposed TRW objective is a simple, computationally cheap modification that could improve class unlearning in practice. The paper also provides broad comparisons, public code, and a short proof of the exponential-tilt form via information projection. However, the central privacy claim rests on MIA-NN, which is not a membership inference attack in the standard sense, and the U-LiRA results are reported without the essential Retrain baseline or error bars. The significance is therefore conditional on reframing and strengthening the evaluation.

major comments (5)

[Section 3.3] MIA-NN is not a membership inference attack as described. The procedure trains binary classifiers on labeled test partitions (D_ri-test versus D_rhati-test) and reports the aggregate fraction of forget-class test inputs whose nearest-neighbor logit is classified as belonging to class r_i. It never makes a per-sample membership decision, and it assumes access to ground-truth labels for test data, including labels for the forget class, which a membership adversary would not have. The paper's central motivating claim that existing unlearning methods 'leak membership of forgotten samples' is supported only by this metric, and the own limitation statement in Section 6 calls it heuristic. This is not merely a presentation issue: the metric conflates semantic class reassignment with membership leakage. The authors should either reframe MIA-NN as a class-conditional distributional similarity metric (and adjust all privacy claims accordingly) or replace it with a genuine per-sample membership inference attack with a clearly specified adversary model.
[Table 2 and Section 4.3] The direction of the reported MIA scores is unexplained and inconsistent with standard usage. In Table 2 the column is labeled MIA(up-arrow) and reports Original MIA=0, Retrain MIA=100, yet in the standard membership inference literature an original model that has memorized a class should have high attack success, while a retrained model that never saw the class should be near chance. If the score is instead a 'forgetting success' measure (e.g., the fraction of forget samples not predicted as the forget class), it should be defined explicitly and given a different name. Without this clarification, the reader cannot compare Table 2 to prior work, and the claim that TRW is 'competitive' on MIA is not interpretable.
[Table 3 and Section 5.2] The U-LiRA evaluation is missing its two most important reference points. The text states that 50% accuracy is ideal unlearning and that a perfect unlearning method should be indistinguishable from a Retrain model, but the table does not report U-LiRA accuracy for Retrain or for the Original model. TRW-2R achieves 67.72% and TRW achieves 71.12%, both far from 50%, so the claim of 'strong resilience' and 'retraining-level performance' is not supported without knowing how far a true Retrain model is from 50% under this protocol. The table also reports no standard errors, despite the use of three shadow models, so the differences among methods near the top (TRW 71.12, SCRUB 71.91, TRW-2R 67.72, FT 72.57) may not be significant.
[Table 1 and Section 3.3] The main evidence for the paper's motivating claim, Table 1, reports MIA-NN values for a single forget-class pair per dataset (e.g., CIFAR-10 automobile-to-truck) with no error bars or number of Retrain models n. The rest of the paper averages results over all forget classes or over ten selected classes, so it is unclear whether the Table 1 gaps generalize. The authors should report means and standard deviations over seeds and over all forget classes, and should state how the nearest-neighbor class r_n is selected and whether the same r_n is fixed when evaluating the unlearned model.
[Section 3.4 and Section B.7] The central hyperparameter beta=10 is selected on CIFAR-10 using the same MIA-NN metric for which the headline improvements are reported, making the CIFAR-10 result partially a fitted result rather than an independent test. The ablation in Table 7 has no error bars and shows that MIA-NN jumps from 47.2 at beta=0 to 76.1 at beta=5 and 82.1 at beta=10, while retained accuracy is nearly constant; this steep sensitivity should be reported for other datasets. Given that the title claims a 'necessity' for output reweighting, the authors should at least show that the chosen beta is not overfit to the benchmark, for example by reporting leave-one-dataset-out selection or a sensitivity table for all datasets.

minor comments (5)

[Section A.2] There is a typo in 'distirubution'; please correct it.
[Section 3.4] The text before Proposition 3.1 calls q* the 'maximum-entropy distribution' on the remaining classes, but the proposition minimizes KL(q || p), which is only equivalent to maximum entropy when p is uniform. Please rephrase to avoid this technical inaccuracy.
[Section 4.3] The MIA score is defined only by reference to Kodge et al.; given the unusual direction observed in Table 2, the exact formula and its interpretation (higher is better for unlearning, presumably) should be stated in the main text.
[Section 5] TRW-2R is used in all result tables but is never defined before Section 5. Please specify which two layers are fine-tuned and how they are selected.
[Section 3.3] The number n of Retrain models used for Table 1 is never stated; if n=3 as in the U-LiRA protocol, the single-class-pair values should be accompanied by error bars, since the mean over three models will be noisy.

Circularity Check

2 steps flagged · score 4.0 of 10

TRW's headline CIFAR-10 gains are partly in-sample tuning of beta, and its improved MIA-NN score largely restates the tilt built into the objective; the paper still has independent support from U-LiRA and cross-dataset transfer.

fitted input called prediction [Section 3.4 (Remark 3.2) and Section B.7, Table 7; abstract headline result]
"We do not know the exact value of c a-priori to set it in the constraints, but the hyperparameter β helps us achieve various levels of c. ... We set β=10 in all experiments to bias the distribution toward more similar classes (see section B.7 for an ablation study on the value of β). ... We select β=10 as it provides the best balance between maintaining accuracy on retained data and achieving strong resistance to membership inference attacks."

The tilt-strength beta is selected on CIFAR-10 by directly optimizing the same metrics (ACCr, MIA, MIA-NN) that the paper's headline numbers report. The abstract claims 'on CIFAR-10, it reduces the gap with retrained models by 19% and 46% for U-LiRA and CMIA scores,' but for MIA-NN the reported reduction is a restatement of the hyperparameter choice made from Table 7 rather than an out-of-sample prediction. Proposition 3.1 leaves c (equivalently beta) unspecified, so the target distribution q* is not derived from retrained models; it is calibrated on the benchmark where the main claim is made. The transfer of beta=10 to CIFAR-100 and Tiny-ImageNet is genuine external evidence, but the in-sample CIFAR-10 headline remains partly fitted.
self definitional [Abstract / Section 3.3 (MIA-NN definition) / Section 3.4 (TRW objective)]
"We introduce Class Membership Inference Attack (CMIA) that uses the probabilities assigned by the model to neighboring classes to detect unlearned samples. ... To construct this approximation, we estimate inter-class similarity and tilt the target model's distribution accordingly."

The attack and the remedy are built from the same quantity. MIA-NN scores an unlearned model by whether forget-class inputs receive high logits for the nearest-neighbor class rn, while TRW's target q* is an exponential tilt that explicitly redistributes probability mass toward classes with large similarity scores s_y. Once the model is fine-tuned toward q*, the MIA-NN accuracy on those neighboring classes increases by construction of the objective; it is not independent confirmation that q* equals the retrained model's distribution. The paper's own Section 6 calls MIA-NN 'heuristic,' which weakens the load-bearing 'necessity' claim, though the U-LiRA evaluation provides some external, non-self-referential evidence.

full rationale

The central construction q*(y|x) = tilde p(y|x) exp(beta s_y)/Z is an ansatz: Proposition 3.1 proves only that such a tilted distribution is the I-projection for some unknown c, and the paper never estimates c from retrained models. Instead, beta=10 is chosen from a CIFAR-10 ablation on the very metrics used in the abstract's headline gap reductions, so that specific part of the evaluation is partially in-sample fitted. In addition, MIA-NN measures the probability mass on the neighboring class, which is exactly what TRW's similarity tilt is designed to increase, so the large MIA-NN improvement is substantially by construction. These are partial circularities, not complete ones. The paper still has independent content: U-LiRA is an externally defined attack and shows a smaller but real improvement, the beta=10 setting transfers to CIFAR-100 and Tiny-ImageNet without retuning, and the retained-accuracy results are not forced by the construction. The self-citation to Ebrahimpour-Boroojeny et al. is not load-bearing because the paper provides its own empirical characterization of retrained-model behavior, and no uniqueness theorem is imported from the authors' prior work. The limitation statement in Section 6 honestly notes the evidence is empirical and MIA-NN is heuristic, which lowers the severity but does not eliminate the self-referential element in the headline claim. Overall score 4.0: some fitted and by-construction components, but the central claim retains independent empirical support.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

No new physical or model entities (particles, forces, dimensions) are introduced; MIA-NN and TRW are procedures, not entities. The free parameters and ad hoc assumptions listed above are the load-bearing choices that make the method work.

free parameters (3)

beta (tilt strength) = 10
Chosen by ablation on CIFAR-10 (Table 7) to balance retained accuracy and MIA-NN resistance; applied to all datasets. beta=20 improves MIA-NN to 98.6 but drops ACCr to 77.67.
softmax temperature for similarity scores = 0.01
Selected by hand in Section A.3 (we use a small value for the temperature, e.g., 0.01) to sharpen similarity scores; no ablation reported.
PCA dimension d' for logit-weight projection = unspecified
Section A.3 states d' << d but does not give the value or the variance explained; the scoring function depends on it.

assumptions (4)

standard math Strict convexity of KL divergence and the exponential-tilt form of the I-projection under a linear expectation constraint.
Prop. 3.1 relies on KL being strictly convex and on the Lagrange multiplier derivation; standard result (e.g., Gibbs conditioning).
ad hoc to paper The retrained model's conditional distribution on forget-class inputs is well approximated by an exponential tilt of the original model's renormalized output distribution with a single scalar beta.
This is the central modeling assumption of Section 3.4, validated only empirically on a few class pairs (Figures 3-4); the paper itself says the evidence is entirely empirical (Section 6).
ad hoc to paper Cosine similarity between PCA-projected logit weight vectors of the original model captures the inter-class similarity relevant to the retrained model's bias.
Section A.3 defines the score this way and notes other embedding-based similarities do not reach the same performance; no theoretical justification is given.
domain assumption The MIA-NN per-class SVM on neighbor logits is a meaningful membership test for class unlearning.
The attack is defined in Section 3.3 and the authors state in Section 6 that MIA-NN remains heuristic.

how reviews work

0 comments

Cite this review

Pith. "Pith review of On the Necessity of Output Distribution Reweighting for Effective Class Unlearning." pith.science (2026). https://pith.science/paper/UAYZIUVH

@misc{pith2026250620893,
  author       = {Pith},
  title        = {Pith review of: On the Necessity of Output Distribution Reweighting for Effective Class Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UAYZIUVH}},
  note         = {Machine review of arXiv:2506.20893}
}

read the original abstract

In this paper, we reveal a significant shortcoming in class unlearning evaluations: overlooking the underlying class geometry can cause information leakage about the forgotten class. We further propose a simple unlearning strategy to mitigate this issue. We introduce Class Membership Inference Attack (CMIA) that uses the probabilities assigned by the model to neighboring classes to detect unlearned samples. We find that existing unlearning methods are vulnerable to CMIA across multiple datasets. We then propose a new fine-tuning objective that mitigates this privacy leakage by approximating, for forget-class inputs, the distribution over the remaining classes that a retrained-from-scratch model would produce. To construct this approximation, we estimate inter-class similarity and tilt the target model's distribution accordingly. The resulting Tilted REWeighting (TREW) distribution serves as the desired distribution during fine-tuning. We also show that across multiple benchmarks, TREW matches or surpasses existing unlearning methods on prior unlearning metrics. More specifically, on CIFAR-10, it reduces the gap with retrained models by 19% and 46% for U-LiRA and CMIA scores, accordingly, compared to the SOTA method for each category. Our code is publicly available at https://github.com/CrowdDynamicsLab/ICML_TREW.

Figures

Figures reproduced from arXiv: 2506.20893 by the authors.

**Figure 2.** The first figure (from the left) shows the decision boundaries when class B exists. In the Retrain [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** Forgetting the automobile class in a ResNet-18 model trained on CIFAR-10. The reweighted probabilities of the original model according to equation 1 (Orig) compared to the probabilities assigned to automobile in the Retrain model. As the figure shows, the Retrain model has a much higher bias toward Truck class, which is better captured when using the tilted reweighting accoriding to equation 2 (Orig-Tilted). A.2 Eff… view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Forgetting the frog class in a ResNet-18 model trained on CIFAR-10. The reweighted probabilities of the original model according to equation 1 (Orig) compared to the probabilities assigned to frog in the Retrain model. As the figure shows, the Retrain model has a much …

**Figure 5.** Figure 5: Running time comparison (in seconds per epoch) on CIFAR-100 with ResNet-18 using 4 [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]

**Figure 6.** Figure 6: Confusion Matrix for original ResNet18 model, our unlearning model and retraining model [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]

**Figure 7.** Figure 7: Top reassignment targets of the forgotten class willow tree. The model tends to reassign samples to semantically similar classes such as palm tree, forest, and oak tree. In addition, section B.6 highlights the top five classes most affected by the unlearning of the wil…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

16 extracted references · 10 canonical work pages

[3]

Machine Unlearning via Null Space Calibration

2, 3 Huiqiang Chen, Tianqing Zhu, Xin Yu, and Wanlei Zhou. Machine unlearning via null space calibration. arXiv preprint arXiv:2404.13588,

work page Pith review arXiv
[10]

Camu: Disentangling causal effects in deep model unlearning

2 Shaofei Shen, Chenhao Zhang, Alina Bialkowski, Weitong Chen, and Miao Xu. Camu: Disentangling causal effects in deep model unlearning. InProceedings of the 2024 SIAM International Conference on Data Mining (SDM), pages 779–787. SIAM,

work page 2024
[12]

Machineunlearningoffeatures and labels.arXiv preprint arXiv:2108.11577,

1 AlexanderWarnecke,LukasPirch,ChristianWressnegger,andKonradRieck. Machineunlearningoffeatures and labels.arXiv preprint arXiv:2108.11577,

arXiv
[15]

[2024], and SCRUB Kurmanji et al

baselines are run for20 epochs, SVD Kodge et al. [2024], and SCRUB Kurmanji et al

work page 2024
[16]

To evaluate unlearning on a more challenging benchmark, we also apply our method to theTiny-ImageNet- 200dataset using a ResNet-18 backbone

62.31 0 87.73 TRW 62.78 0 100 TRW-2R 62.84 0 100 Table5:Single-classforgettingonTiny-ImageNet-200withResNet-18.Wereportretainedaccuracy( ACC r), forget accuracy (ACCf), and membership inference attack accuracy (MIA). To evaluate unlearning on a more challenging benchmark, we also apply our method to theTiny-ImageNet- 200dataset using a ResNet-18 backbone....

work page 2024
[2009]

Towards unbounded machine unlearning.Advances in neural information processing systems, 36:1957–1987,

7 Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning.Advances in neural information processing systems, 36:1957–1987,

work page 1957
[2012]

Not all wrong is bad: Using adversarial examples for unlearning

7 Ali Ebrahimpour-Boroojeny, Hari Sundaram, and Varun Chandrasekaran. Not all wrong is bad: Using adversarial examples for unlearning. InForty-second International Conference on Machine Learning. 2 Ali Ebrahimpour-Boroojeny, Hari Sundaram, and Varun Chandrasekaran. Amun: Adversarial machine unlearning.arXiv preprint arXiv:2503.00917,

arXiv
[2014]

and ResNet-18He et al. [2016]. All models are trained from scratch for101 - 201 epochswith a batch size of128. Optimization is performed usingstochastic gradient descent (SGD)with a learning rate of0.1,momentum of 0.9, andweight decay of5×10 −4. The learning rate follows atorch.optim.lr_scheduler.StepLR schedule withstep_size= 40andgamma= 0.1. Forourunlea...

work page 2016

Show all 16 references

[2015]

Partially blinded unlearning: Class unlearning for deep networks a bayesian perspective.arXiv preprint arXiv:2403.16246,

7 Subhodip Panda, Shashwat Sourav, et al. Partially blinded unlearning: Class unlearning for deep networks a bayesian perspective.arXiv preprint arXiv:2403.16246,

arXiv
[2016]

Approximate data deletion from machine learning models

7, 8, 15 Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. Approximate data deletion from machine learning models. InInternational Conference on Artificial Intelligence and Statistics, pages 2008–2016. PMLR,

2008
[2017]

Verydeepconvolutionalnetworksforlarge-scaleimagerecognition

3, 7 KarenSimonyanandAndrewZisserman. Verydeepconvolutionalnetworksforlarge-scaleimagerecognition. arXiv preprint arXiv:1409.1556,

arXiv
[2020]

Inexact unlearning needs more careful evaluations to avoid a false sense of privacy.arXiv preprint arXiv:2403.01218,

1, 3, 7, 8, 14, 15, 16 Jamie Hayes, Ilia Shumailov, Eleni Triantafillou, Amr Khalifa, and Nicolas Papernot. Inexact unlearning needs more careful evaluations to avoid a false sense of privacy.arXiv preprint arXiv:2403.01218,

arXiv
[2021]

Membership inferenceattacksfromfirstprinciples

1, 2 Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inferenceattacksfromfirstprinciples. In2022IEEESymposiumonSecurityandPrivacy(SP),pages1897–1914. IEEE,

1914
[2023]

SALUN Fan et al

shifts the decision boundary of the original model to mimic the model’s decisions after retraining from scratch. SALUN Fan et al. [2023]introduce the concept of weight saliency and perform unlearning by modifying the model weights rather than the entire model, improving effect...

2023
[2024]

Zero-shot class unlearning via layer-wise relevance analysis and neuronal path perturbation.arXiv preprint arXiv:2410.23693,

3, 7, 8, 15 Wenhan Chang, Tianqing Zhu, Yufeng Wu, and Wanlei Zhou. Zero-shot class unlearning via layer-wise relevance analysis and neuronal path perturbation.arXiv preprint arXiv:2410.23693,

arXiv
[2025]

Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508,

2 Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sĳia Liu. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508,

arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [3]

Machine Unlearning via Null Space Calibration

2, 3 Huiqiang Chen, Tianqing Zhu, Xin Yu, and Wanlei Zhou. Machine unlearning via null space calibration. arXiv preprint arXiv:2404.13588,

work page Pith review arXiv

[2] [10]

Camu: Disentangling causal effects in deep model unlearning

2 Shaofei Shen, Chenhao Zhang, Alina Bialkowski, Weitong Chen, and Miao Xu. Camu: Disentangling causal effects in deep model unlearning. InProceedings of the 2024 SIAM International Conference on Data Mining (SDM), pages 779–787. SIAM,

work page 2024

[3] [12]

Machineunlearningoffeatures and labels.arXiv preprint arXiv:2108.11577,

1 AlexanderWarnecke,LukasPirch,ChristianWressnegger,andKonradRieck. Machineunlearningoffeatures and labels.arXiv preprint arXiv:2108.11577,

arXiv

[4] [15]

[2024], and SCRUB Kurmanji et al

baselines are run for20 epochs, SVD Kodge et al. [2024], and SCRUB Kurmanji et al

work page 2024

[5] [16]

To evaluate unlearning on a more challenging benchmark, we also apply our method to theTiny-ImageNet- 200dataset using a ResNet-18 backbone

62.31 0 87.73 TRW 62.78 0 100 TRW-2R 62.84 0 100 Table5:Single-classforgettingonTiny-ImageNet-200withResNet-18.Wereportretainedaccuracy( ACC r), forget accuracy (ACCf), and membership inference attack accuracy (MIA). To evaluate unlearning on a more challenging benchmark, we also apply our method to theTiny-ImageNet- 200dataset using a ResNet-18 backbone....

work page 2024

[6] [2009]

Towards unbounded machine unlearning.Advances in neural information processing systems, 36:1957–1987,

7 Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning.Advances in neural information processing systems, 36:1957–1987,

work page 1957

[7] [2012]

Not all wrong is bad: Using adversarial examples for unlearning

7 Ali Ebrahimpour-Boroojeny, Hari Sundaram, and Varun Chandrasekaran. Not all wrong is bad: Using adversarial examples for unlearning. InForty-second International Conference on Machine Learning. 2 Ali Ebrahimpour-Boroojeny, Hari Sundaram, and Varun Chandrasekaran. Amun: Adversarial machine unlearning.arXiv preprint arXiv:2503.00917,

arXiv

[8] [2014]

and ResNet-18He et al. [2016]. All models are trained from scratch for101 - 201 epochswith a batch size of128. Optimization is performed usingstochastic gradient descent (SGD)with a learning rate of0.1,momentum of 0.9, andweight decay of5×10 −4. The learning rate follows atorch.optim.lr_scheduler.StepLR schedule withstep_size= 40andgamma= 0.1. Forourunlea...

work page 2016