Leveraging Distribution Matching to Make Approximate Machine Unlearning Faster

Junaid Iqbal Khan

REVIEW 3 major objections 4 minor 32 references

Leveraging Distribution Matching to Make Approximate Machine Unlearning Faster

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that machine unlearning can be made substantially faster by combining a fast distribution-matching dataset-condensation method, Blend, with a loss-centric Accelerated-AMU objective that steepens the main loss and matches…

desk verdict Blend is a plausible condensation speedup with real utility costs, but A-AMU's MIA regularizer is degenerate by construction and the use of test data in training invalidates the reported privacy/utility numbers. read the letter →

arxiv 2507.09786 v3 pith:FCRA3U7K submitted 2025-07-13 cs.LG

Junaid Iqbal Khan This is my paper

classification cs.LG

keywords approximatemachineunlearningdatasetcondensationdistributionmatchingmembershipinferenceattacksprobabilityintegraltransformmaximummeandiscrepancylossaccelerationimageclassification

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Approximate machine unlearning removes specific training data from a trained model by fine-tuning on the retained data, but repeatedly scanning the large retained set and running many fine-tuning epochs make it slow. This paper claims that unlearning can be accelerated from both sides at once: condense the retained set with a fast distribution-matching method called Blend, and reshape the unlearning loss with Accelerated-AMU (A-AMU), which squares the primary loss for faster departure from old decision boundaries and adds a differentiable regularizer that matches the loss distribution of forgotten samples to that of class-matched test samples. On CIFAR-10, SVHN, and CINIC-10 with ResNet-18 and ResNet-50, the combined recipe is reported to cut end-to-end unlearning latency by 84.61% in single-round and 54.45% in multi-round scenarios while keeping test accuracy, retain accuracy, and LiRA membership-inference scores close to baselines. The paper positions Blend as situational, since its speedup tracks the retained-set reduction, and A-AMU as a uniform, tuning-free accelerator. If the claims hold, the practical cost of compliance-driven data deletion requests drops substantially.

What carries the argument

The load-bearing machinery is distribution matching used twice. For Blend, the identity is a per-cluster blended image $I(\omega_i) = (1/\sum_j \omega_{ij})\sum_j \omega_{ij} I_{ij}$, whose weights $\omega_i$ are learned by minimizing the expected squared distance between the mean feature of the cluster and the feature of the blended image, $\mathbb{E}_{\vartheta \sim P_\vartheta}[\| \frac{1}{n_i}\sum_j \psi_\vartheta(I_{ij}) - \psi_\vartheta(I(\omega_i))\|_2^2]$, so each synthetic prototype preserves the mean feature representation of its cluster; a free/residual split, determined by whether a cluster intersects the forget set, decides which clusters get condensed. For A-AMU, the machinery is a differentiable probability-integral transform: losses are mapped by an empirical CDF approximated with temperature-controlled sigmoids $Q^{(K)}_i(x) = \frac{1}{N}\sum_j \sigma_K(x_i - x_j)$, then by the probit $\Phi^{-1}$, converting any loss sample toward standard normal coordinates; the squared maximum-mean-discrepancy with a Gaussian kernel between transformed forget-set and test-subset losses, $L_{\mathrm{MMD}}(\theta)$, is the differentiable membership-inference regularizer. Together they form the objective $\min_\theta \mathbb{E}_{(x,y)\sim D_R}[L(\theta;x,y)^2] + \lambda L_{\mathrm{MMD}}(\theta) + \Gamma(\theta;R,F)$, where $\Gamma$ stands for any existing AMU regularization such as sparsity or distillation.

What would settle it

Re-run the A-AMU experiments with the class-matched subset $T$ withheld from the objective and replaced by a disjoint validation set drawn from the same distribution but never used in any reported evaluation, then compare LiRA membership-inference scores and test accuracy. If the privacy-utility balance disappears, or if the model performs measurably better on the exact $T$ it trained on than on a disjoint held-out slice, the central claim of preserving privacy and generalization while accelerating is falsified.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the two dominant costs of approximate machine unlearning, the size of the retained dataset and the number of fine-tuning steps, can be attacked with a single distribution-matching principle. Blend partitions each class into k-means sub-classes in the feature space of a small random feature extractor, learns scalar blend weights per cluster so that the feature mean of the blended prototype matches the mean of its constituent images, and then condenses only the 'free' clusters that contain no forget-set samples, while leaving the 'residual' clusters near the forget set untouched. The resulting reduced retain set preserves boundary-critical detail while shrinking the bulk of the data. A-AMU then transforms per-sample losses through a differentiable empirical CDF followed by the probit function, and minimizes the squared primary loss plus a maximum-mean-discrepancy term between the transformed loss distributions of the forget set and the class-matched test subset; the paper argues this both expedites forgetting and suppresses membership-inference leakage. The paper demonstrates the pair on three datasets and two ResNet backbones across single- and multi-round forgetting, reporting large latency reductions with utility and privacy preserved.

Load-bearing premise

The load-bearing premise is that it is legitimate to feed part of the test set, the class-matched subset $T$, into the unlearning objective as a regularization target; if the test data influences the model, the reported test-accuracy and membership-inference numbers are no longer independent, and the claim that utility and privacy are preserved collapses.

Editorial extensions

If this is right

AMU methods that are slow primarily because of retained-set size can inherit Blend's speedup: the paper reports up to 96.3% total time reduction for Pruning on SVHN class removal and 75.7% for Retraining on CIFAR-10, with utility trade-offs that grow as the data reduction grows.
The A-AMU objective can wrap around existing AMU regularizers, so acceleration transfers across methods; the paper shows A-CF, A-L1, and A-SCRUB variants with 1.5 to 3.8 times speedups in multi-round settings.
A-AMU's fixed hyperparameters across models and datasets remove the per-setting fine-tuning burden that other AMU baselines require.
In multi-round sequential unlearning, Blend stabilizes utility for volatile methods, preventing SCRUB's test-accuracy collapse, while A-AMU supplies immediate acceleration.
Because Blend condenses only clusters with no forget-set intersection, no synthetic prototype is placed near forget features; the paper's CINIC-10 ablation attributes an improved forget-accuracy of 72.5% to this selective condensation, versus naive condensation which re-memorizes forget data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the test-set regularization is judged acceptable, the same distribution-matching regularizer could be turned into a continuous privacy monitor: tracking $L_{\mathrm{MMD}}(\theta)$ during unlearning could allow early stopping at a target membership-inference level rather than a fixed epoch budget.
Blend's k-means clustering depends on a randomly initialized lightweight feature extractor; a natural extension is to adapt the clustering features during condensation, or to let the number of clusters per class depend on local feature density, which could reduce the utility drop seen at high reduction ratios.
The reported 84.61% single-round and 54.45% multi-round latency numbers come from one RTX 3070 GPU; the speedup split between Blend and A-AMU likely shifts in larger or distributed settings, where condensation overhead amortizes differently.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. The paper has one plausible idea and one vacuous one. Blend is a targeted condensation scheme: partition the retain set with k-means, condense only clusters that do not intersect the forget set, keep boundary-near images. That is simple and fast, and the experiments show real time savings in class-removal settings, though with noticeable utility loss. The other idea, A-AMU's differentiable MIA regularizer, does nothing. Eq. (5) PIT-transforms ℓF and ℓT independently; in the K→∞ regime the paper explicitly invokes, Z_F and Z_T converge to fixed multisets of standard-normal quantiles. Their MMD is zero for nF=nT and a constant for unequal sizes, so ∇θ L_MMD vanishes. Finite K gives only rank-gap sensitivity, not distribution matching. The claim in §3.4.3 that minimizing L_MMD aligns forget and test losses and mitigates MIA is unsupported. Whatever speedup A-CF shows over CF comes from the squared-loss term, which is a modest trick.

The second problem is evaluation contamination. T is sampled from the test set and appears in the training objective. So every test-accuracy and LiRA MIA number for A-AMU variants is suspect. If the regularizer is genuinely inert, T does not matter, but then the method is just squared-loss fine-tuning and the claimed privacy mechanism is still dead. The paper cannot have it both ways.

To give credit where it is due: Blend is honest about its trade-offs in the main tables—Retraining with condensation on CIFAR-10 class removal drops test accuracy from ~80 to ~56 and retain accuracy from 100 to 68, and the text acknowledges this. The multi-round study on CINIC-10 is a substantial amount of work, and the observation that selective condensation prevents SCRUB's collapse is interesting. The code link helps reproducibility. But the abstract's blanket 'preserving model utility and privacy' is contradicted by the paper's own numbers, and the A-AMU mechanism is a mathematical artifact.

The paper is not for citing as a working method, but it could be a useful case study for a reading group on what can go wrong with distribution-matching regularizers and test-set leakage. I would send it to peer review—the experiments are extensive and the flaw is precisely diagnosable—but I would expect a reject unless A-AMU is reworked and all results rerun without test contamination. In current form, the central claim fails.

Referee Report

3 major / 4 minor

Summary. The paper proposes two complementary approaches to accelerate approximate machine unlearning (AMU). The first, Blend, is a dataset-condensation method that partitions the retain set via k-means, identifies clusters far from the forget set, and replaces each such cluster with a learnable weighted blend of its images. The second, A-AMU, augments a generic AMU objective with a squared (steepened) main loss and an MMD-based regularizer applied to probability-integral-transform (PIT) transformed losses of the forget set and a class-matched subset of the test set. The authors report large unlearning-time reductions (e.g., 76.82% single-round, 51.83% multi-round) on CIFAR-10, SVHN, and CINIC-10 with ResNet-18/50 while claiming preserved utility and privacy.

Significance. If the proposed mechanisms worked as described, the combination of cheap dataset condensation and a loss-side accelerator for unlearning would be practically valuable, and the paper's extensive experiments (multiple datasets, models, baselines, and 95% CIs) would be a useful addition. The paper also ships code. However, the central theoretical mechanism of A-AMU's differentiable MIA regularizer is vacuous: the PIT maps each loss set independently to fixed normal quantiles, so the MMD term is constant (or zero) in the limit the paper invokes, and its gradient vanishes. In addition, the regularizer uses a subset of the test set in the training objective, contaminating the reported test-accuracy and LiRA privacy numbers. These two flaws undermine the paper's main claims, leaving only the squared-loss heuristic and Blend as potential contributions.

major comments (3)

[§3.4.1–3.4.2, Eq. (5)–(6)] The probability-integral transform is applied separately to each loss vector ℓ_F and ℓ_T. As K→∞, Q^(K)(ℓ_F) converges to the empirical CDF of ℓ_F, so the multiset of entries of Z_F^(K) converges to {Φ^{-1}(1/n_F), ..., Φ^{-1}(n_F/n_F)} (up to tie handling), which is independent of θ and of the actual loss values. The same holds for Z_T^(K). Consequently, the empirical distributions of Z_F and Z_T are fixed: when n_F = n_T they are identical and L_MMD = 0, and when n_F ≠ n_T L_MMD is a constant; in both cases ∇_θ L_MMD → 0 in the limit the paper invokes. The finite-K version has a non-zero gradient, but it is a smoothed rank statistic, not a measure of the distance between the forget and test loss distributions. The claim in §3.4.3 that minimizing L_MMD suppresses membership-inference signals is therefore unsupported, and the reported A-AMU speedups cannot be credited to the 'differentiable MIA' term; they can only come from the squared-loss term.
[§3.4.1 and §4.1] The regularizer uses T, a subset of the test set, in the training objective. This makes the test set visible to the model during unlearning. As a result, the reported test accuracy and LiRA MIA scores are contaminated and are not valid estimates of generalization or privacy. The abstract's claim of 'preserving model utility and privacy' is not established by these experiments. The authors should either use a held-out validation set disjoint from the test set for the regularizer or remove the test-data term; without this, the central empirical claims are invalid.
[§4.3, Table 1] The experimental section does not provide an ablation of A-AMU's components. Since A-AMU modifies the loss in two ways (squared loss and L_MMD), and the MIA term is shown above to be vacuous, the reported acceleration should be demonstrated with the squared-loss term alone. Without such an ablation, the paper's attribution of the speedup to the 'dual' mechanism is not supported.

minor comments (4)

[Section 5] 'ur first contribution' should read 'Our first contribution.'
[Section 3.4.1] 'this allows use to play' should read 'this allows us to play.'
[Eq. (6)] The notation 'Z(K T' is malformed; it should be 'Z_T^{(K)}'.
[Section 4.2] The 'orders of magnitude faster' claim for Blend is based on a comparison where GM, DM, and IDM use large synthetic batch sizes while Blend uses a batch of 1; a matched runtime comparison would clarify the source of the speedup.

Circularity Check

2 steps flagged · score 7.0 of 10

The differentiable MIA regularizer is degenerate by construction: separate PIT transforms make L_MMD independent of θ, so A-AMU's privacy mechanism is inert; test-set leakage further undermines the reported evaluation.

self definitional [Section 3.4.1–3.4.2, Eqs. (5)–(6)]
"Applying the vector transformation from (5) to the loss vectors yields Z(K)F = Φ−1(Q(K)(ℓF)), Z(K)T = Φ−1(Q(K)(ℓT)), where Q(K) is the differentiable CDF estimator from (4). As K → ∞ the mapping converges to the empirical probit ... Minimising LMMD aligns the transformed loss distribution of the forget set with that of the class-matched test subset, thereby mitigating membership-inference leakage while remaining fully differentiable in θ and K."

Eq. (5) is applied separately to ℓF and ℓT: each loss vector is ranked against itself through its own empirical CDF. In the K→∞ limit that the paper invokes, the transformed values converge to fixed normal quantiles determined only by ranks and sample size, not by θ or by the original loss values. For nF = nT, ZF and ZT are the same multiset, so LMMD in Eq. (6) is exactly zero; for unequal sizes it is a θ-independent constant. Hence ∇θLMMD = 0 in the regime the method is designed to approximate, and 'minimizing' LMMD cannot align anything or mitigate membership-inference leakage. The alignment is guaranteed by the PIT construction itself, not by optimization, making the differentiable MIA regularizer vacuous by construction.
other [Section 3.1 and Section 3.4.1; evaluation in Section 4.1]
"The subset T ⊆ T̃ consists of elements whose class labels match those in F, and DT is its empirical distribution."

T is explicitly a subset of the testing dataset T̃, yet the A-AMU objective in Section 3.4.3 uses LMMD(θ) built on ℓT as a training regularizer. The same test distribution is then used to report Test Accuracy and LiRA MIA scores. Therefore the model is fitted using test data, and the reported utility/privacy metrics are not independent holdout measurements. This makes the central claim of 'preserving model utility and privacy' unverifiable from the reported experiments: the test set is an input to the optimization rather than an external benchmark.

full rationale

The paper's central circular/vacuous step is the PIT-based differentiable MIA regularizer. Eq. (5) transforms each loss vector by its own smooth ECDF, so in the K→∞ limit both ZF and ZT become fixed standard-normal quantile sets independent of θ. Consequently LMMD is either exactly zero or constant in θ, and its gradient vanishes; the claimed 'alignment' is an artifact of the transformation, not a learned effect. This is a self-definitional reduction: the matching is baked into the construction, and the A-AMU privacy mechanism is inert. Separately, the method uses a subset of the test set as a regularization set, contaminating the evaluation of test accuracy and MIA. The speedups reported for A-AMU may still partly come from the steepened squared main loss, so the paper is not wholly degenerate, but the load-bearing differentiable-MIA contribution and the privacy-preservation claim reduce by construction. No self-citation chain or uniqueness-theorem circularity is present; the issue is mathematical vacuity rather than citation dependence.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central claims rest on standard mathematical tools (PIT, MMD) but also on unverified domain assumptions about distribution matching for unlearning and on the legitimacy of using test data in the objective. No new physical or conceptual entities are introduced.

free parameters (4)

k (number of k-means clusters per class) = not reported
Controls the granularity of blending in Blend; the paper defers to the linked repository for the value.
λ (regularization weight for L_MMD) = not reported
Weights the differentiable MIA term in A-AMU; a chosen hyperparameter.
K (sigmoid temperature in the empirical CDF) = not reported
Balances differentiability and CDF fidelity in Eq. (4); the paper states it is 'large' but does not specify it.
learning rate (fixed across all settings) = not reported
The paper claims a fixed learning rate for all A-AMU experiments, but the actual value is not given in the text.

assumptions (6)

standard math Probability integral transform: for continuous X, Φ^{-1}(F(X)) is standard normal.
Used in Section 3.4 to construct the differentiable CDF and probit transformation.
standard math MMD with a Gaussian kernel measures distributional distance.
Used in Eq. (6) as the regularizer objective.
standard math The differentiable empirical CDF estimator Q^{(K)} converges to the true ECDF as K→∞.
Stated in Section 3.4 to justify the finite-K approximation.
domain assumption Distribution matching on mean features preserves training utility when condensing the retain set.
Foundation of the Blend method; the paper does not prove this for unlearning, and the experimental utility drops cast doubt on it.
domain assumption Using the class-matched test subset T as a regularization set does not leak into evaluation.
Section 3.4.1 defines ℓ_T from test samples and uses it in the objective; this contaminates the reported test accuracy and MIA scores.
ad hoc to paper Squaring the batch loss accelerates unlearning without damaging utility.
Stated as a heuristic in Section 3.4.3; no formal proof or ablation isolating this effect is provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Leveraging Distribution Matching to Make Approximate Machine Unlearning Faster." pith.science (2026). https://pith.science/paper/FCRA3U7K

@misc{pith2026250709786,
  author       = {Pith},
  title        = {Pith review of: Leveraging Distribution Matching to Make Approximate Machine Unlearning Faster},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FCRA3U7K}},
  note         = {Machine review of arXiv:2507.09786}
}

read the original abstract

Approximate machine unlearning (AMU) enables models to `forget' specific training data through specialized fine-tuning on a retained (and forget) subset of training set. However, processing this large retained subset still dominates computational runtime, while reductions of unlearning epochs also remain a challenge. In this paper, we propose two complementary methods to accelerate arbitrary classification-oriented AMU method. First, \textbf{Blend}, a novel distribution-matching dataset condensation (DC), merges visually similar images with shared blend-weights to significantly reduce the retained set size. It operates with minimal pre-processing overhead and is orders of magnitude faster than state-of-the-art DC methods. Second, our loss-centric method, \textbf{Accelerated-AMU (A-AMU)}, augments the AMU objective to quicken convergence. A-AMU achieves this by combining a steepened primary loss to expedite forgetting with a differentiable regularizer that matches the loss distributions of forgotten and in-distribution unseen data. Our extensive experiments demonstrate that this dual approach of data and loss-centric optimization dramatically reduces end-to-end unlearning latency across both single and multi-round scenarios, all while preserving model utility and privacy. To our knowledge, this is the first work to systematically tackle unlearning efficiency by jointly designing a specialized dataset condensation technique with a dedicated accelerated loss function. Code is available at https://github.com/algebraicdianuj/DC_Unlearning.

Figures

Figures reproduced from arXiv: 2507.09786 by the authors.

**Figure 1.** The overall pipeline of our proposal to make accelerate AMU, which comprise data-centric and loss-centric components ing strong privacy-utility statistics. • Our benchmarks show 84.61% and 54.45% faster endto-end unlearning in single and multi-round scenarios, respectively, on various image classification datasets and models, effectively filling latency gaps compared to current state-of-the-art AMU methods. 2. Rela… view at source ↗

**Figure 2.** Qualitative and quantitative comparison of condensation methods on CIFAR-10/CNN. Top: class-wise synthetic prototypes generated by GM, DM, IDM, and our Blend method. Bottom: Performance metrics for each method over course of IPC = 2, 10. data batch size of 1 in our implementation (as batched implementation is non-trivial). In contrast, competing methods like GM, DM, and IDM leverage large synthetic batch sizes (e… view at source ↗

**Figure 3.** Impact of different condensation strategies (on Blend) on 10% random unlearning performance of L1-sparse on ResNet-18/CINIC-10 [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Multi-round sequential unlearning (random 10 %) performance of without accelerated CF, L1-sparse, and SCRUB, with acceleration (A-CF, A-L1, A-SCRUB), with and without dataset condensation (Blend). With dataset condensation allows 34.9% retain dataset reduction • Select…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

32 extracted references · 24 canonical work pages

[1]

Machine unlearning

Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 141–159. IEEE, 2021. 1, 2

work page 2021
[2]

Towards making systems for- get with machine unlearning

Yinzhi Cao and Junfeng Yang. Towards making systems for- get with machine unlearning. In 2015 IEEE symposium on security and privacy, pages 463–480. IEEE, 2015. 1

work page 2015
[3]

Membership inference attacks from first principles

Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP) , pages 1897–1914. IEEE, 2022. 3, 5

work page 2022
[4]

Dataset distillation by matching training trajectories

George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A Efros, and Jun-Yan Zhu. Dataset distillation by matching training trajectories. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4750–4759, 2022. 2

work page 2022
[5]

Boundary unlearning: Rapid forgetting of deep net- works via shifting the decision boundary

Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep net- works via shifting the decision boundary. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7766–7775, 2023. 2

work page 2023
[6]

Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher

Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. In Proceedings of the AAAI Conference on Artificial Intelli- gence, volume 37, pages 7210–7217, 2023. 1, 2, 4, 5

work page 2023
[7]

Quickdrop: Ef- ficient federated unlearning via synthetic data generation

Akash Dhasade, Yaohong Ding, Song Guo, Anne-Marie Kermarrec, Martijn de V os, and Leijie Wu. Quickdrop: Ef- ficient federated unlearning via synthetic data generation. In Proceedings of the 25th International Middleware Confer- ence, pages 266–278, 2024. 2

work page 2024
[8]

Making ai forget you: Data deletion in ma- chine learning

Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making ai forget you: Data deletion in ma- chine learning. Advances in neural information processing systems, 32, 2019. 2

work page 2019

Show all 32 references

[9]

Eternal sunshine of the spotless net: Selective forgetting in deep networks

Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9304– 9312, 2020. 1, 2

2020
[10]

Amne- siac machine learning

Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amne- siac machine learning. In Proceedings of the AAAI Con- ference on Artificial Intelligence , volume 35, pages 11516– 11524, 2021. 2

2021
[11]

Certified data removal from machine learning models

Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. arXiv preprint arXiv:1911.03030, 2019. 1

1911 arXiv
[12]

Batch normalization: Accelerating deep network training by reducing internal co- variate shift

Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal co- variate shift. In International conference on machine learn- ing, pages 448–456. pmlr, 2015. 1

2015
[13]

Model sparsification can simplify machine unlearning.arXiv preprint arXiv:2304.04934, 2023

Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsification can simplify machine unlearning.arXiv preprint arXiv:2304.04934, 2023. 1, 2, 4, 5

2023 arXiv
[14]

Dataset condensation via efficient synthetic- data parameterization

Jang-Hyun Kim, Jinuk Kim, Seong Joon Oh, Sangdoo Yun, Hwanjun Song, Joonhyun Jeong, Jung-Woo Ha, and Hyun Oh Song. Dataset condensation via efficient synthetic- data parameterization. In International Conference on Ma- chine Learning, pages 11102–11118. PMLR, 2022. 2

2022
[15]

Towards unbounded machine unlearn- ing

Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearn- ing. Advances in neural information processing systems , 36:1957–1987, 2023. 1, 2, 4, 5

1957
[16]

Distillation robustifies unlearning

Bruce W Lee, Addie Foote, Alex Infanger, Leni Shor, Harish Kamath, Jacob Goldman-Wetzler, Bryce Woodworth, Alex Cloud, and Alexander Matt Turner. Distillation robustifies unlearning. arXiv preprint arXiv:2506.06278, 2025. 2

2025
[17]

Tcgu: Data-centric graph un- learning based on transferable condensation

Fan Li, Xiaoyang Wang, Dawei Cheng, Wenjie Zhang, Ying Zhang, and Xuemin Lin. Tcgu: Data-centric graph un- learning based on transferable condensation. arXiv preprint arXiv:2410.06480, 2024. 2

2024 arXiv
[18]

Mubox: A critical evaluation framework of deep machine unlearning [systematization of knowledge paper]

Xiang Li, Wenqi Wei, and Bhavani Thuraisingham. Mubox: A critical evaluation framework of deep machine unlearning [systematization of knowledge paper]. In Proceedings of the 30th ACM Symposium on Access Control Models and Tech- nologies, pages 175–188, 2025. 7

2025
[19]

Certifi- able machine unlearning for linear models

Ananth Mahadevan and Michael Mathioudakis. Certifi- able machine unlearning for linear models. arXiv preprint arXiv:2106.15093, 2021. 2

2021 arXiv
[20]

Dataset distillation with infinitely wide convolutional networks

Timothy Nguyen, Roman Novak, Lechao Xiao, and Jaehoon Lee. Dataset distillation with infinitely wide convolutional networks. Advances in Neural Information Processing Sys- tems, 34:5186–5198, 2021. 2

2021
[21]

Pruning neural networks without any data by iter- atively conserving synaptic flow

Hidenori Tanaka, Daniel Kunin, Daniel L Yamins, and Surya Ganguli. Pruning neural networks without any data by iter- atively conserving synaptic flow. Advances in neural infor- mation processing systems, 33:6377–6389, 2020. 2

2020
[22]

Transfor- mation of arbitrary distributions to the normal distribution with application to eeg test–retest reliability

Sacha Jennifer van Albada and Peter A Robinson. Transfor- mation of arbitrary distributions to the normal distribution with application to eeg test–retest reliability. Journal of neu- roscience methods, 161(2):205–211, 2007. 4

2007
[23]

Emphasizing dis- criminative features for dataset distillation in complex sce- narios

Kai Wang, Zekai Li, Zhi-Qi Cheng, Samir Khaki, Ahmad Sajedi, Ramakrishna Vedantam, Konstantinos N Plataniotis, Alexander Hauptmann, and Yang You. Emphasizing dis- criminative features for dataset distillation in complex sce- narios. In Proceedings of the Computer Vision and Pa...

2025
[24]

Dataset distillation

Tongzhou Wang, Jun-Yan Zhu, Antonio Torralba, and Alexei A Efros. Dataset distillation. arXiv preprint arXiv:1811.10959, 2018. 2

2018 arXiv
[25]

Machine unlearning of features and la- bels

Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and la- bels. arXiv preprint arXiv:2108.11577, 2021. 1, 2

2021 arXiv
[26]

Delta- grad: Rapid retraining of machine learning models

Yinjun Wu, Edgar Dobriban, and Susan Davidson. Delta- grad: Rapid retraining of machine learning models. In In- ternational Conference on Machine Learning, pages 10355– 10366. PMLR, 2020. 2

2020
[27]

Arcane: An efficient architecture for ex- act machine unlearning

Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, and Xiaodong Lin. Arcane: An efficient architecture for ex- act machine unlearning. In IJCAI, volume 6, page 19, 2022. 2

2022
[28]

Dataset condensation with differ- entiable siamese augmentation

Bo Zhao and Hakan Bilen. Dataset condensation with differ- entiable siamese augmentation. In International Conference on Machine Learning, pages 12674–12685. PMLR, 2021. 2

2021
[29]

Dataset condensation with dis- tribution matching

Bo Zhao and Hakan Bilen. Dataset condensation with dis- tribution matching. In Proceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision , pages 6514–6523, 2023. 1, 2, 3, 5

2023
[30]

Dataset condensation with gradient matching

Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. Dataset condensation with gradient matching. arXiv preprint arXiv:2006.05929, 2020. 1, 2, 5

2006 arXiv
[31]

Im- proved distribution matching for dataset condensation

Ganlong Zhao, Guanbin Li, Yipeng Qin, and Yizhou Yu. Im- proved distribution matching for dataset condensation. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 7856–7865, 2023. 5

2023
[32]

Decoupled distillation to erase: A general unlearning method for any class-centric tasks

Yu Zhou, Dian Zheng, Qijie Mo, Renjie Lu, Kun-Yu Lin, and Wei-Shi Zheng. Decoupled distillation to erase: A general unlearning method for any class-centric tasks. In Proceed- ings of the Computer Vision and Pattern Recognition Con- ference, pages 20350–20359, 2025. 2

2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Machine unlearning

Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 141–159. IEEE, 2021. 1, 2

work page 2021

[2] [2]

Towards making systems for- get with machine unlearning

Yinzhi Cao and Junfeng Yang. Towards making systems for- get with machine unlearning. In 2015 IEEE symposium on security and privacy, pages 463–480. IEEE, 2015. 1

work page 2015

[3] [3]

Membership inference attacks from first principles

Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP) , pages 1897–1914. IEEE, 2022. 3, 5

work page 2022

[4] [4]

Dataset distillation by matching training trajectories

George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A Efros, and Jun-Yan Zhu. Dataset distillation by matching training trajectories. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4750–4759, 2022. 2

work page 2022

[5] [5]

Boundary unlearning: Rapid forgetting of deep net- works via shifting the decision boundary

Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep net- works via shifting the decision boundary. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7766–7775, 2023. 2

work page 2023

[6] [6]

Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher

Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. In Proceedings of the AAAI Conference on Artificial Intelli- gence, volume 37, pages 7210–7217, 2023. 1, 2, 4, 5

work page 2023

[7] [7]

Quickdrop: Ef- ficient federated unlearning via synthetic data generation

Akash Dhasade, Yaohong Ding, Song Guo, Anne-Marie Kermarrec, Martijn de V os, and Leijie Wu. Quickdrop: Ef- ficient federated unlearning via synthetic data generation. In Proceedings of the 25th International Middleware Confer- ence, pages 266–278, 2024. 2

work page 2024

[8] [8]

Making ai forget you: Data deletion in ma- chine learning

Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making ai forget you: Data deletion in ma- chine learning. Advances in neural information processing systems, 32, 2019. 2

work page 2019