Pith. sign in

REVIEW 3 major objections 7 minor 45 references

Zero-Shot Machine Unlearning with Proxy Adversarial Data Generation

T0 review · 3 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A zero-shot unlearning method can erase a class using only the model and the forget set, keeping remaining-class accuracy at retrained levels.

desk verdict Solid empirical zero-shot unlearning with a genuinely new proxy-data pipeline, but the advertised guarantee is a restated assumption and reproducibility is limited. read the letter →

arxiv 2507.21738 v1 pith:7UM7TML5 submitted 2025-07-29 cs.LG cs.AI

Huiqiang Chen , Tianqing Zhu , Xin Yu , Wanlei Zhou This is my paper
classification cs.LGcs.AI
keywords machineunlearningzero-shotover-unlearningadversarialexamplessubspaceprojectioninfluencefunctionspseudo-labelingdataprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ZS-PAG claims a trained model can drop an entire class when given only the model and the forget-set samples, with no access to the remaining training data. To stand in for that missing data, it pushes each unlearning sample across a decision boundary toward its second-most-likely class, generating adversarial proxy samples. Those proxies estimate the per-class gradient subspaces of the remaining classes, and the unlearning update is projected into the complementary subspace, which Theorem 1 argues keeps remaining-data loss approximately unchanged. An influence-based pseudo-labeling step then turns the unlearning step into a positive force on the remaining classes. The reported result is remaining-class accuracy at or above retrained levels while forgotten-class accuracy drops to near zero and membership-inference signal matches a retrained model.

What carries the argument

Three components carry the argument. First, adversarial proxy data $D_{\text{adv}}$: each forgotten sample $x_i$ is perturbed by projected gradient descent toward its second-most-likely class (Eqs. 1–2), yielding samples that approximate the inaccessible remaining classes. Second, subspace projection: per-class activation subspaces are computed by SVD at every layer (Eq. 3), combined into a remaining-class subspace $S^c$ (Eq. 4), and the unlearning gradient at each layer is multiplied by $P_l = I - S_l^c (S_l^c)^T$ before the weight update (Eq. 5), confining changes to directions irrelevant to remaining classes. Third, influence-based pseudo-labeling: using the influence function (Eqs. 7–10), the method approximates how removing each pseudo-labeled sample changes remaining-data loss and optimizes pseudo-labels, with a KL penalty against the true label, so the unlearning update has a positive effect on the remaining classes.

What would settle it

Compute the per-class activation basis from the adversarial proxy set and from a held-out set of true remaining samples, and measure the principal angle between the subspaces; if the average principal angle is large (say above 30°) on a standard benchmark, or if remaining-class accuracy drops on distant classes but not on the class adjacent to the forgotten one, the proxy equivalence is refuted.

Watch

Extended reading notes

Core claim

The central claim is that zero-shot class unlearning does not have to sacrifice utility on the remaining data. Under a Lipschitz-smooth loss satisfying the Polyak-Łojasiewicz inequality, Theorem 1 states that the update rule in Eq. 5 produces an unlearned model with remaining-data loss close to the original model's; the experiments claim this holds in practice across Facescrub, SVHN, CIFAR-10, and CIFAR-100. On those benchmarks, the paper reports remaining-class accuracy at retrained levels (for example 75.54% versus retrain's 75.36% on CIFAR-100, and 96.48% versus 96.31% on Facescrub), forgotten-class accuracy reduced to roughly 0.2–2%, and membership-inference attack accuracy near the retrained model. It also reports that the unlearning step can improve remaining-class accuracy over the original model, with larger gains when more classes are removed.

Load-bearing premise

The load-bearing premise is that adversarial perturbations of the forget-set samples faithfully represent the real remaining data; if those proxy samples do not occupy the same activation subspaces as the true remaining classes, both the projection and the influence estimate steer the update in the wrong direction.

Editorial extensions

If this is right

  • A model owner can honor a deletion request using only the request and the deployed model, without retaining or re-accessing the rest of the training set.
  • Unlearning a class need not trade away utility: reported remaining-class accuracy stays at or above retrained baselines while forgotten-class accuracy falls to near zero.
  • Membership-inference attacks on forgotten samples come back close to the retrained-model level, so the removal is not merely cosmetic.
  • The method is insensitive to which adversarial attack generates the proxy, since only the model's decision-boundary structure matters.
  • Unlearning more classes at once yields larger measured gains on remaining classes, suggesting the influence objective accumulates over multiple deletion requests.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If adversarial proxies are biased toward classes adjacent to the forgotten class, projection could over-protect those neighboring classes and under-protect distant ones; this can be tested by unlearning a class whose nearest decision boundaries are concentrated on one class while others are far.
  • The recipe generalizes in principle to sequential forgetting, but the paper does not study how subspace estimates drift across many successive unlearning requests, so accumulation error is an open question.
  • Because the Polyak-Łojasiewicz condition in Theorem 1 is at best locally true for deep networks, the practical guarantee likely rests on the projection itself; an ablation that removes the projection for a single layer would isolate where the protection actually lives.
  • The influence-based pseudo-label objective could double as a diagnostic: the sign and size of the estimated remaining-loss change predict which remaining classes a deletion will hurt most, which is useful for data-deletion audits.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes ZS-PAG, a zero-shot machine-unlearning method that operates without access to the remaining data Dr. The method has three components: (1) adversarial samples generated from the unlearning samples Du are used as a proxy Dadv for Dr; (2) the unlearning gradient is projected onto the complement of subspaces estimated from Dadv, with the goal of avoiding over-unlearning; and (3) pseudo-labels for the unlearning samples are optimized using an influence-function objective so that the unlearning update has a positive effect on the remaining data. Experiments on Facescrub, SVHN, CIFAR-10, and CIFAR-100 with several architectures report that ZS-PAG keeps remaining-class accuracy close to or above the retrained model while dropping unlearning-class accuracy to low levels, and ablations investigate the role of the subspace projection, pseudo-labeling, the adversarial attack method, and the attack success rate. The paper also states a theoretical guarantee in Theorem 1.

Significance. If the empirical claims hold, ZS-PAG is a practically relevant contribution: it is one of the few unlearning methods that work when only the forget set is available, and it reports strong results across four benchmarks and multiple architectures. The paper's strengths include a systematic ablation of the subspace and pseudo-label components, a comparison across several zero-shot baselines, an evaluation with membership-inference and backdoor-based metrics, and an analysis of computational cost. The main weaknesses are that the stated theoretical guarantee is not actually proven and that the load-bearing assumption—that adversarial samples from Du faithfully represent Dr—is only partially validated. These issues limit the current support for the central claim, but they appear addressable within the scope of the manuscript.

major comments (3)
  1. [Section 3.3, Theorem 1 (Eqs. 5–6)] Theorem 1 is stated as a guarantee that unlearning with Eq. 5 produces Lr(θu) ≈ Lr(θo), but no proof is given. The stated assumptions (Lipschitz continuity of the Lr gradient and the PL inequality) do not by themselves relate the projected unlearning update in Eq. 5 to Lr; the update is a projected gradient step on the unlearning loss ℓ(x,y;θ), not on Lr. A small learning rate under PL would justify convergence of Lr only for an unprojected gradient descent on Lr. As stated, the theorem essentially asserts the desired conclusion. The abstract and Section 5 explicitly advertise a theoretical guarantee, so the authors must either supply a complete proof with explicit conditions on the learning rate, the subspace S^cbar, and the role of Dadv, or remove the theorem and present the claim as an empirical property.
  2. [Section 3.2, Section 3.3, Section 4.5] The method's correctness hinges on Dadv being a faithful proxy for Dr, since Dadv is used both to construct the subspace S^cbar in Eq. 4 and to define the projection in Eq. 5. Section 4.5 concedes that the generated adversarial samples overlap real data mainly for classes adjacent to the unlearning class, while distant classes require larger perturbations. With a fixed perturbation bound ε, adversarial examples for distant classes may either have low attack success or lie in a thin boundary-adjacent shell, so the SVD basis in Eq. 3 can be biased toward boundary directions rather than the class-conditional distribution. If S^cbar over-represents boundary directions, the complement projection may fail to protect genuine remaining-class directions; if it under-represents distant classes, over-unlearning can reappear for those classes. The paper should report per-class remaining accuracy after unlearning and provide a diagnostic experiment (using Dr only for evaluation) that compares the subspace spanned by Dadv with the subspace spanned by Dr, e.g., by measuring principal-angle overlap or by comparing the projection of true remaining gradients. Without such evidence, the near-retrain AccDrt values in Tables 1–2 could be specific to the benchmark geometry rather than to the claimed proxy mechanism.
  3. [Section 3.4, Eqs. 8–10, Figure 5b] The influence-based pseudo-label optimization replaces the inaccessible ∇θL(Dr, θo) in Eq. 10 with ∇θL(Dadv, θo), where Dadv consists of adversarial examples concentrated near decision boundaries. Minimizing the resulting estimate of ΔL can therefore select pseudo-labels that reduce loss on boundary artifacts rather than on genuine remaining data. The reported gains (1.77% to 3.27% in Figure 5b) are measured on held-out remaining-class test data, which is encouraging, but the mechanism is not established. I recommend an additional experiment that compares pseudo-labels optimized against Dadv with pseudo-labels optimized against a held-out sample of the true Dr (used only as a diagnostic oracle); this would quantify the fidelity gap and clarify whether the benefit of pseudo-labeling transfers beyond the proxy. The influence-function derivation also assumes θo is the empirical risk minimizer and that the Hessian is positive definite; the paper should state how H^{-1} is approximated, how the approximation error affects Eq. 10, and how the KL regularization weight is chosen.
minor comments (7)
  1. [Section 4.2] The text states that ZS-PAG improves AccDrt by 1.53%, 1.67%, and 2.23% on FashionMNIST, CIFAR-10, and CIFAR-100, but Table 1 does not contain FashionMNIST; the dataset name appears to be a typo for Facescrub or another listed benchmark.
  2. [Section 4.1] The metric names are inconsistent: the text defines Accut and Accmia but tables use AccDut and Accmia, and the description contains the typo 'Acc rt'. Please unify the notation.
  3. [Section 3.3, Eq. 4] The recursive definition S^cbar_l = SVD(Concatenate(S^cbar_l, U^k_l)) is ambiguous because S^cbar_l appears on both sides, and the subspace truncation rank is never specified. Please define the initialization and the rank selection for U^k_l and the combined subspace.
  4. [Section 3.4] The pseudo-label optimization procedure lacks implementation details: the initialization of y_pl, the number of optimization steps, the learning rate for y_pl, the KL weight λ, and how the optimized continuous y_pl is converted into the label used in the loss ℓ(xi, y_pl; θ). These details are needed for reproducibility.
  5. [Table 3] The backdoor experiment reports Accattack for Retrain as '−' without explanation; please clarify why retraining is not evaluated and describe how Accattack is computed for the unlearned model.
  6. [Figure 5a] The claim that AccDrt 'remains stable around 85%' is based on point estimates without reported variability; please add error bars or a table with standard deviations across runs.
  7. [Table 4] The DeepFool row reports AccDut as 0.720±0.11, which uses three decimals while other entries use two; please standardize the precision.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the proxy-data assumption is empirical and tested on held-out remaining data; Theorem 1 is unproved but not circular.

full rationale

Walked the derivation chain. The core claim is that Dadv, generated in Eqs. 1–2, approximates Dr, and that Eqs. 3–5 and Eq. 10 consequently prevent over-unlearning. This is an empirical proxy assumption, not a circular one: Dadv is generated from Du and the original model θo, while the reported AccDrt, AccDut, and MIA metrics are measured on held-out test sets of the actual remaining and unlearning classes. The pseudo-label y_pl is optimized against the proxy-based Eq. 10, and its benefit is then gauged on real remaining-data accuracy in Section 4.5; that is a transfer test, not a fitting of the reported metric. Section 4.5 openly concedes that "distant classes require larger perturbations" and that overlap is strongest for adjacent classes, which is a limitation of proxy fidelity rather than a reduction of the conclusion into the premise. Theorem 1 is given without proof and with assumptions (Lipschitz gradient, PL inequality) that do not themselves entail that the subspace computed from Dadv contains the relevant directions of ∇Lr; this is a missing derivation, not circularity. The only self-citation (Chen et al., IJCAI 2024, null-space calibration) appears as related work and is not load-bearing: the subspace rationale cites Li et al. 2018 and Saha et al. 2021. No fitted parameter is relabeled as a prediction, no target quantity is defined in terms of itself, and no external result is replaced by a self-citation. Verdict: no significant circularity.

Assumptions & free parameters 5 free parameters · 5 assumptions · 1 invented entities

The method rests on five implicit premises: two optimization assumptions for the unproven Theorem 1, the input-subspace geometry claim, the proxy-fidelity of adversarial samples for Dr (the load-bearing premise), and the influence-function approximation. Free parameters (nadv=100, epsilon, subspace rank, KL weight, eta) are chosen by hand and several are unreported, which constrains both soundness and reproducibility. No new physical entities are introduced; the proxy dataset is a methodological construct without independent evidence.

free parameters (5)
  • nadv (adversarial samples per class for subspace estimation) = 100
    Section 3.3 states nadv = 100 is sufficient; Figure 5b shows remaining-class accuracy depends on nadv, so this hand-chosen value affects the method's behavior.
  • PGD perturbation bound epsilon per dataset = not reported per benchmark
    Eq. 1 constrains ||delta||_p <= epsilon; Figure 5a varies epsilon and shows attack success rate and behavior change. The per-dataset values used in Tables 1-4 are not stated.
  • Subspace truncation rank for U^k_l and combined S^{c-bar}_l = not specified
    Eqs. 3-4 use SVD, but how many principal components are retained in the projection P_l = I - S S^T is never stated; the method's effectiveness depends on this choice.
  • KL regularization weight lambda for pseudo-label similarity penalty = not reported
    Section 3.4 adds a KL term penalizing similarity between optimized y_pl and the ground-truth label yi, but its coefficient is never given.
  • Unlearning learning rate eta and number of epochs = 10 epochs; eta not reported
    Eq. 5 uses step size eta; Table 6 fixes 10 epochs for fair comparison, but eta and the pseudo-label optimizer settings are undisclosed.
assumptions (5)
  • domain assumption Lr(θ) has Lipschitz-continuous gradient and satisfies the Polyak-Łojasiewicz inequality
    Theorem 1 (Section 3.3) is stated under these conditions, which are unverifiable for deep networks and are not checked in experiments; the theorem is the paper's theoretical guarantee and is asserted without proof.
  • domain assumption Network gradients lie in a low-dimensional subspace spanned by the layer inputs
    Invoked in Section 3.3 to justify that projecting unlearning gradients orthogonal to the class-k input subspace S^{c-bar} prevents over-unlearning; sourced to Li et al. 2018/2022 and Saha et al. 2021.
  • ad hoc to paper Adversarial samples generated from unlearning samples faithfully approximate the remaining data Dr
    Core enabling premise of Sections 3.2-3.4: Dadv substitutes for Dr in both subspace estimation and influence pseudo-label optimization. Only in-paper support is Figure 4 (overlap for classes adjacent to the unlearning class) and downstream accuracy; no external evidence.
  • domain assumption Influence-function approximations (Hessian invertibility, first-order Taylor validity, iterative H^{-1}v) hold at scale
    Eqs. 7-10 rely on Koh and Liang 2017 and Sattigeri et al. 2022; the paper uses Eq. 10 to select pseudo-labels but gives no error bounds or Hessian-approximation details.
  • domain assumption Gradient descent with pseudo-labels y_pl and projection removes the unlearning class while preserving other classes
    The unlearning update in Eq. 5 is asserted to erase class information; the paper provides no proof that the projected gradient step on unlearning samples with y_pl actually removes membership, only the empirical AccDut and Accmia tables.
invented entities (1)
  • Proxy adversarial dataset Dadv
    purpose: Stand-in for the inaccessible remaining data Dr in subspace estimation (Eqs. 3-4) and influence-based pseudo-label optimization (Eq. 10).
    Dadv is generated from the unlearning samples and the model itself; its fidelity to Dr is established only through in-paper distribution plots and downstream accuracy, with no external falsifiable handle.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Zero-Shot Machine Unlearning with Proxy Adversarial Data Generation." pith.science (2026). https://pith.science/paper/7UM7TML5

@misc{pith2026250721738,
  author       = {Pith},
  title        = {Pith review of: Zero-Shot Machine Unlearning with Proxy Adversarial Data Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7UM7TML5}},
  note         = {Machine review of arXiv:2507.21738}
}
read the original abstract

Machine unlearning aims to remove the influence of specific samples from a trained model. A key challenge in this process is over-unlearning, where the model's performance on the remaining data significantly drops due to the change in the model's parameters. Existing unlearning algorithms depend on the remaining data to prevent this issue. As such, these methods are inapplicable in a more practical scenario, where only the unlearning samples are available (i.e., zero-shot unlearning). This paper presents a novel framework, ZS-PAG, to fill this gap. Our approach offers three key innovations: (1) we approximate the inaccessible remaining data by generating adversarial samples; (2) leveraging the generated samples, we pinpoint a specific subspace to perform the unlearning process, therefore preventing over-unlearning in the challenging zero-shot scenario; and (3) we consider the influence of the unlearning process on the remaining samples and design an influence-based pseudo-labeling strategy. As a result, our method further improves the model's performance after unlearning. The proposed method holds a theoretical guarantee, and experiments on various benchmarks validate the effectiveness and superiority of our proposed method over several baselines.

Figures

Figures reproduced from arXiv: 2507.21738 by the authors.

Figure 1
Figure 1. Framework of ZS-PAG. In the first step, we generate adversary samples to approximate the remaining samples. In the second step, [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. MIA results of ZS-PAG and baselines for single-class unlearning. Results outside the highlighted optimal region may leak infor [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. GradCAM results on unlearned and remaining samples for [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Influence of adversary attack on CIFAR-10 dataset for single-class unlearning. (a) We use various levels of noise bound ε when finding adversary samples. (b) We estimate the null space with different numbers of adversary samples. CIFAR-10/ViT AccDrt (↑) AccDut (↓) Orig…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

45 extracted references · 36 canonical work pages

  1. [1]

    Machine unlearning

    [Bourtoule et al., 2021] Lucas Bourtoule, Varun Chan- drasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 141–159. IEEE,

    work page 2021

  2. [7]

    An image is worth 16x16 words: Transformers for image recognition at scale

    [Dosovitskiy et al., 2020] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Min- derer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929,

    arXiv 2020

  3. [9]

    Does learning require memorization? a short tale about a long tail

    [Feldman, 2020] Vitaly Feldman. Does learning require memorization? a short tale about a long tail. In Proceed- ings of the 52nd Annual ACM SIGACT Symposium on The- ory of Computing, pages 954–959,

    work page 2020

  4. [10]

    Fast machine unlearning without retraining through selective synaptic dampening

    [Foster et al., 2024] Jack Foster, Stefan Schoepf, and Alexandra Brintrup. Fast machine unlearning without retraining through selective synaptic dampening. In Pro- ceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 12043–12051,

    work page 2024

  5. [11]

    Model inversion attacks that exploit confidence information and basic countermeasures

    [Fredrikson et al., 2015] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on com- puter and communications security , pages 1322–1333,

    work page 2015

  6. [12]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks

    [Golatkar et al., 2020] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 9304–9312,

    work page 2020

  7. [13]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    [Goodfellow et al., 2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples,

    work page 2015

  8. [14]

    Certified data removal from machine learning models

    [Guo et al., 2020] Chuan Guo, Tom Goldstein, Awni Han- nun, and Laurens Van Der Maaten. Certified data removal from machine learning models. In International Con- ference on Machine Learning , pages 3832–3842. PMLR,

    work page 2020

Show all 45 references
  1. [15]

    Deep residual learning for image recog- nition

    [He et al., 2015] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. arxiv e-prints. arXiv preprint arXiv:1512.03385 , 10,

    2015 arXiv

  2. [16]

    Learn to unlearn for deep neural networks: Minimizing unlearning interference with gradi- ent projection

    [Hoang et al., 2024] Tuan Hoang, Santu Rana, Sunil Gupta, and Svetha Venkatesh. Learn to unlearn for deep neural networks: Minimizing unlearning interference with gradi- ent projection. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV),...

    2024

  3. [17]

    A duty to forget, a right to be assured? expos- ing vulnerabilities in machine unlearning services,

    [Hu et al., 2024] Hongsheng Hu, Shuo Wang, Jiamin Chang, Haonan Zhong, Ruoxi Sun, Shuang Hao, Haojin Zhu, and Minhui Xue. A duty to forget, a right to be assured? expos- ing vulnerabilities in machine unlearning services,

    2024

  4. [18]

    Approximate data dele- tion from machine learning models,

    [Izzo et al., 2021] Zachary Izzo, Mary Anne Smart, Kama- lika Chaudhuri, and James Zou. Approximate data dele- tion from machine learning models,

    2021

  5. [19]

    Un- derstanding black-box predictions via influence functions

    [Koh and Liang, 2017] Pang Wei Koh and Percy Liang. Un- derstanding black-box predictions via influence functions. In International conference on machine learning , pages 1885–1894. PMLR,

    2017

  6. [20]

    Learning multiple layers of features from tiny im- ages

    [Krizhevsky et al., 2009] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny im- ages

    2009

  7. [23]

    Measuring the intrinsic dimension of objective landscapes

    [Li et al., 2018] Chunyuan Li, Heerad Farkhoor, Rosanne Liu, and Jason Yosinski. Measuring the intrinsic dimension of objective landscapes. arXiv preprint arXiv:1804.08838,

    2018 arXiv

  8. [25]

    Frequency-domain dynamic pruning for convolutional neural networks

    [Liu et al., 2018] Zhenhua Liu, Jizheng Xu, Xiulian Peng, and Ruiqin Xiong. Frequency-domain dynamic pruning for convolutional neural networks. Advances in neural in- formation processing systems, 31,

    2018

  9. [26]

    Towards deep learning models resistant to adversarial attacks

    [Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 ,

    2017 arXiv

  10. [27]

    Deep- fool: a simple and accurate method to fool deep neural networks,

    [Moosavi-Dezfooli et al., 2016] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep- fool: a simple and accurate method to fool deep neural networks,

    2016

  11. [32]

    Gradient projection memory for continual learning

    [Saha et al., 2021] Gobinda Saha, Isha Garg, and Kaushik Roy. Gradient projection memory for continual learning. arXiv preprint arXiv:2103.09762,

    2021 arXiv

  12. [33]

    Fair infinitesimal jackknife: Mitigating the influence of biased training data points without refitting

    [Sattigeri et al., 2022] Prasanna Sattigeri, Soumya Ghosh, Inkit Padhi, Pierre Dognin, and Kush R Varshney. Fair infinitesimal jackknife: Mitigating the influence of biased training data points without refitting. Advances in Neural Information Processing Systems, 35:35894–35906,

    2022

  13. [35]

    Camu: Dis- entangling causal effects in deep model unlearning

    [Shen et al., 2024] Shaofei Shen, Chenhao Zhang, Alina Bialkowski, Weitong Chen, and Miao Xu. Camu: Dis- entangling causal effects in deep model unlearning. In Proceedings of the 2024 SIAM International Conference on Data Mining (SDM), pages 779–787. SIAM,

    2024

  14. [36]

    Membership infer- ence attacks against machine learning models,

    [Shokri et al., 2017] Reza Shokri, Marco Stronati, Con- gzheng Song, and Vitaly Shmatikov. Membership infer- ence attacks against machine learning models,

    2017

  15. [37]

    Opening the black box of deep neural net- works via information

    [Shwartz-Ziv and Tishby, 2017] Ravid Shwartz-Ziv and Naftali Tishby. Opening the black box of deep neural net- works via information. arXiv preprint arXiv:1703.00810,

    2017 arXiv

  16. [38]

    Very deep convolutional networks for large-scale image recognition

    [Simonyan and Zisserman, 2014] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556,

    2014 arXiv

  17. [39]

    Fast yet effec- tive machine unlearning

    [Tarun et al., 2023] Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effec- tive machine unlearning. IEEE Transactions on Neural Networks and Learning Systems,

    2023

  18. [40]

    Federated unlearning via class-discriminative pruning

    [Wang et al., 2022] Junxiao Wang, Song Guo, Xin Xie, and Heng Qi. Federated unlearning via class-discriminative pruning. In Proceedings of the ACM Web Conference 2022, pages 622–632,

    2022

  19. [41]

    Machine unlearning of features and labels

    [Warnecke et al., 2021] Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and labels. arXiv preprint arXiv:2108.11577,

    2021 arXiv

  20. [42]

    Machine unlearning: A survey

    [Xu et al., 2023] Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S Yu. Machine unlearning: A survey. ACM Computing Surveys, 56(1):1–36,

    2023

  21. [43]

    Alleviating data in- sufficiency for chinese sign language recognition

    [Xue et al., 2023] Wanli Xue, Jingze Liu, Siyi Yan, Yuxi Zhou, Tiantian Yuan, and Qing Guo. Alleviating data in- sufficiency for chinese sign language recognition. Visual Intelligence, 1(1):26,

    2023

  22. [44]

    Toward efficient data-free unlearning,

    [Zhang et al., 2024] Chenhao Zhang, Shaofei Shen, Weitong Chen, and Miao Xu. Toward efficient data-free unlearning,

    2024

  23. [45]

    Adversarial at- tacks and defenses in deep learning: From a perspective of cybersecurity

    [Zhou et al., 2022] Shuai Zhou, Chi Liu, Dayong Ye, Tian- qing Zhu, Wanlei Zhou, and Philip S Yu. Adversarial at- tacks and defenses in deep learning: From a perspective of cybersecurity. ACM Computing Surveys , 55(8):1–39, 2022

    2022

  24. [1963]

    Re- view on synergizing the metaverse and ai-driven synthetic data: enhancing virtual realms and activity recognition in computer vision

    [Rajendran et al., 2024] Megani Rajendran, Chek Tien Tan, Indriyati Atmosukarto, Aik Beng Ng, and Simon See. Re- view on synergizing the metaverse and ai-driven synthetic data: enhancing virtual realms and activity recognition in computer vision. Visual Intelligence, 2(1):27,

    2024

  25. [2009]

    Imagenet classification with deep convolutional neural networks

    [Krizhevsky et al., 2012] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural infor- mation processing systems, 25,

    2012

  26. [2011]

    A data-driven approach to cleaning large face datasets

    [Ng and Winkler, 2014] Hong-Wei Ng and Stefan Winkler. A data-driven approach to cleaning large face datasets. In 2014 IEEE international conference on image processing (ICIP), pages 343–347. IEEE,

    2014

  27. [2012]

    Towards un- bounded machine unlearning

    [Kurmanji et al., 2024] Meghdad Kurmanji, Peter Triantafil- lou, Jamie Hayes, and Eleni Triantafillou. Towards un- bounded machine unlearning. Advances in neural infor- mation processing systems, 36,

    2024

  28. [2014]

    [Polyak, 1963] B.T. Polyak. Gradient methods for the min- imisation of functionals. USSR Computational Mathemat- ics and Mathematical Physics, 3(4):864–878,

    1963

  29. [2015]

    Towards evaluating the robustness of neural networks,

    [Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks,

    2017

  30. [2016]

    Reading digits in natural images with unsupervised feature learning

    [Netzer et al., 2011] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsu- pervised feature learning, volume 2011, page

    2011

  31. [2017]

    Class machine un- learning for complex data via concepts inference and data poisoning,

    [Chang et al., 2024] Wenhan Chang, Tianqing Zhu, Heng Xu, Wenjian Liu, and Wanlei Zhou. Class machine un- learning for complex data via concepts inference and data poisoning,

    2024

  32. [2018]

    Low dimensional trajectory hypothesis is true: Dnns can be trained in tiny subspaces

    [Li et al., 2022] Tao Li, Lei Tan, Zhehao Huang, Qinghua Tao, Yipeng Liu, and Xiaolin Huang. Low dimensional trajectory hypothesis is true: Dnns can be trained in tiny subspaces. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(3):3411–3420,

    2022

  33. [2020]

    Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508,

    [Fan et al., 2023] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508,

    2023 arXiv

  34. [2021]

    To- wards making systems forget with machine unlearning

    [Cao and Yang, 2015] Yinzhi Cao and Junfeng Yang. To- wards making systems forget with machine unlearning. In 2015 IEEE symposium on security and privacy , pages 463–480. IEEE,

    2015

  35. [2022]

    Grad-cam: Visual explanations from deep networks via gradient-based localization

    [Selvaraju et al., 2017] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on com- p...

    2017

  36. [2023]

    Machine unlearning via null space cali- bration

    [Chen et al., 2024] Huiqiang Chen, Tianqing Zhu, Xin Yu, and Wanlei Zhou. Machine unlearning via null space cali- bration. In Kate Larson, editor, Proceedings of the Thirty- Third International Joint Conference on Artificial Intelli- gence, IJCAI-24, pages 358–366. Internation...

    2024

  37. [2024]

    Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary

    [Chen et al., 2023] Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7766– 7775,

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.