Machine Unlearning via Information Theoretic Regularization

Shizhou Xu; Thomas Strohmer

REVIEW 3 major objections 4 minor 77 references

Machine Unlearning via Information Theoretic Regularization

T0 review · 3 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that machine unlearning can be made auditable by replacing the unobservable 'retrain from scratch' anchor with a mutual-information criterion on model outputs, and that for feature unlearning the optimal solution is the…

desk verdict Marginal unlearning is a genuinely useful idea, but the paper's central theoretical guarantees don't hold as stated — the analytic solution is overclaimed and two proofs are flawed. read the letter →

arxiv 2502.05684 v5 pith:2GQHPU2K submitted 2025-02-08 cs.LG cs.AIcs.ITmath.ITstat.ML

Shizhou Xu , Thomas Strohmer This is my paper · ORCID

classification cs.LGcs.AIcs.ITmath.ITstat.ML MSC 68T0568Q3262B10

keywords machineunlearningmarginalfeaturedatadeletioninformation-theoreticregularizationmutualinformationWassersteinbarycenteroptimaltransport

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that unlearning can be defined and certified by what an observer can still infer from the released model's outputs, rather than by comparison to a model retrained from scratch in secret. It introduces 'marginal unlearning,' which requires the output distribution to be nearly unchanged when the to-be-forgotten records or attributes are added to the training pool, measured by a mutual information bound. It proves that this criterion, together with a utility guarantee, is sufficient to recover the standard retrain-based unlearning guarantee, and that a well-regularized retrained model cannot satisfy it while leaking the forgotten records. It then shows that for feature unlearning under several common utility functions, one analytic object solves the problem: the Wasserstein-2 barycenter of the feature-conditional data distributions. If the argument is right, unlearning becomes something an auditor can check from samples of inputs and outputs, without trusting a private retraining pipeline.

What carries the argument

The carrying mechanism is the mutual-information regularizer $I(S'; Z)$ inside a rate-distortion-style objective $\inf_f (1-\lambda) C(Y; S) + \lambda I(S'; Z)$, where $Z$ is the inclusion indicator or the feature to forget and $S'$ is the output variable whose leakage is being suppressed. For data-point unlearning the paper constructs the paired variable $(X_{\mathrm{margin}}, Z)$ with $X_{\mathrm{margin}} \mid Z=1 \sim p_r$ and $X_{\mathrm{margin}} \mid Z=0 \sim p_d$, so that $I(\hat{X}_{\mathrm{margin}}; Z)$ directly measures how distinguishable the model finds the retained data from the retain-plus-unlearn mixture. The analytic result rests on the Wasserstein-2 barycenter of the conditional laws $\{X \mid Z=z\}$, which by Lemma 4.2 generates the finest $\sigma$-algebra among all admissible outcomes $\hat{X}=f(X,Z)$ with $\hat{X} \perp Z$, together with Lemma 4.3, which shows entropy, mutual information with any target, and conditional-probability energy all increase with $\sigma$-algebra fineness.

What would settle it

Construct Gaussian conditionals $\{X \mid Z=z\}$ with a target $Y$ independent of $(X,Z)$; then every admissible $\hat{X} \perp Z$ achieves $I(Y;\hat{X})=0$, so the barycenter is not the unique maximizer and the claimed equivalence in Theorem 4.3 fails unless strict monotonicity is added, a discrepancy checkable by direct calculation.

Watch

Extended reading notes

Core claim

The central discovery is that exact or approximate unlearning can be reduced to an observable statistical independence condition: for data-point unlearning, require $I(\hat{Y}_{\mathrm{margin}}; Z) \le \varepsilon$, where $Z$ indicates whether the unlearn set was included in training and $\hat{Y}_{\mathrm{margin}}$ is the model output under the retain-only versus retain-plus-unlearn mixture; for feature unlearning, require $I(\hat{X}; Z) \le \varepsilon$ for the feature to forget. The paper proves that this condition is sufficient for the classical anchor-based guarantee when the model keeps log-loss regret small (Theorem 2.1), and that no Lipschitz-regular retrained model can simultaneously satisfy the marginal condition and reveal the unlearned record (Lemma 2.2). For feature unlearning with exact independence, Theorem 4.3 states that the Wasserstein-2 barycenter of $\{X \mid Z=z\}$ is the unique maximizer of entropy, of mutual information with every target $Y$, of posterior concentration, and of conditional-probability energy among all admissible outputs; the proof mechanism is that the barycenter generates the finest admissible $\sigma$-algebra (Lemma 4.2) and all listed utilities are monotone in $\sigma$-algebra fineness (Lemma 4.3).

Load-bearing premise

The load-bearing premise is that near-zero mutual information between model outputs and the to-be-forgotten signal is the correct and sufficient characterization of unlearning, and Theorem 4.3 additionally assumes the utility measures are strictly monotone in sigma-algebra fineness, whereas the paper proves only non-strict monotonicity.

Editorial extensions

If this is right

An auditor could certify deletion using only samples of inputs and outputs, computing a mutual information estimate and checking the utility loss, with no access to the original training pipeline or retrained anchor.
Practitioners can choose the regularization weight $\lambda$ in Algorithm 2 to drive $I(\hat{X}_{\mathrm{margin}}; Z)$ below a target value and then invoke Theorems 4.2 and 2.1 to issue a concrete high-probability deletion certificate.
For feature unlearning with the listed utilities, a single barycenter computation replaces task-specific adversarial or representation training, and the two-marginal case reduces to midpoint displacement interpolation along an optimal transport map.
Lemma 2.2 implies that enforcing marginal unlearning concentrates unavoidable utility loss on the forgotten records themselves, so the retain-set performance is protected rather than degraded globally.
Because the definition is output-based, it applies unchanged to generative models, self-supervised representations, and downstream post-processing, since the data-processing inequality propagates the mutual information bound.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural extension the paper leaves implicit is replacing mutual information with higher-order divergence measures such as Rényi divergence in Definition 2.4, which could yield tighter finite-sample certificates for large language models where estimating mutual information is difficult.
The 'anchor generalization' term in Theorem 2.1 means the sufficiency result degrades when the retrained anchor itself is distributionally shifted from the retain distribution; this suggests pairing marginal unlearning with distributionally robust training on the retain set.
The strict-monotonicity gap in Theorem 4.3 — the paper proves non-decreasing, not strictly increasing, sigma-algebra monotonicity — implies the barycenter may share optimality with coarser outputs when the target $Y$ is independent of $(X,Z)$; requiring a strictly proper scoring rule would close that gap.
The framework's auditable formulation could be turned into an interactive test: an auditor repeatedly samples from the retain-only and retain-plus-unlearn pools and performs a likelihood-ratio test on the outputs, with the posterior-odds bound of Definition 2.3 giving a per-event significance threshold.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Marginal unlearning is a real idea, but the paper's headline theory overstates it: the KL expectation bound in Theorem 4.1 is false as written, the necessity lemma proof doesn't go through, and Theorem 4.3's equivalence breaks when the target Y is independent of (X,Z). The stress-test note is right about the degeneracy counterexample.

The genuinely new thing here is the marginal unlearning principle: instead of comparing against an unknown retrain-on-retain anchor, you require the output to be uninformative about whether the unlearn set was included. That is auditable and practically meaningful. The algorithms and experiments (tabular, MNIST, CelebA) are mostly honest — the authors don't claim to beat SOTA, just show the regularizer behaves. The rate-distortion reinterpretation is also a nice framing.

The soft spots are the load-bearing theorems. Theorem 4.1 says E_Z[D_KL] <= sqrt(I). That's false when I > 1; actually E[KL] = I, so the inequality reverses. It's an easy fix—the exact identity is stronger—but as stated it's wrong, and it's used in Remark 4.1 to propagate guarantees. Lemma 2.2's necessity proof uses a weird local Wasserstein lower bound that I doubt; the claim may be salvageable, but the proof needs real work. The bigger problem is Theorem 4.3. The paper claims the W2 barycenter is 'the' analytic solution for all those utilities. Lemma 4.3 gives monotonicity of the objectives with respect to sigma-algebra inclusion, but that's non-strict. If Y is independent of (X,Z), then I(Y;Xhat)=0 for every admissible Xhat, so every outcome is optimal—including a constant one. The barycenter is still a finest sigma-algebra, so it's a maximal element, but it is not the unique maximizer. Calling it 'the' solution is an overclaim, and the equivalence direction sigma(Xhat)=sigma(Xbar) iff maximizer collapses.

None of this kills the practical method. The regularization still makes sense as a heuristic, and the empirical sections stand on their own. But the paper sells itself as provable guarantees and a unified analytic solution; those are the parts that fail. A referee should ask the authors to fix the KL bound, repair or drop the necessity lemma, and replace Theorem 4.3 with a statement about maximality rather than uniqueness.

This is worth sending to a serious referee. The marginal unlearning definition is a contribution the field should engage with, even if this version's theory is shaky. I'd expect major revision, not a desk reject.

Referee Report

3 major / 4 minor

Summary. The paper proposes a unified information-theoretic framework for machine unlearning, covering both feature unlearning and data-point unlearning. For data-point unlearning it introduces the "Marginal Unlearning Principle," formalized through a posterior-odds condition (Definition 2.3) and a mutual-information relaxation (Definition 2.4), and claims that this principle is sufficient for anchored approximate unlearning under utility control (Theorem 2.1) and necessary for any well-regularized retrained model (Lemma 2.2). For feature unlearning, the paper proves MI-to-KL/TV bounds (Theorem 4.1 and Proposition 4.1), derives an auditable odds-inference guarantee (Lemma 4.1 and Theorem 4.2), and claims that the Wasserstein-2 barycenter of the conditional distributions provides a unified analytic optimal solution for several information-theoretic utilities (Theorem 4.3). The paper closes with regularization algorithms and experiments on tabular benchmarks, MNIST, and CelebA.

Significance. The paper's framing of auditable, output-level marginal unlearning is a potentially valuable contribution, and the practical regularization algorithms are clearly presented with code and experiments. The MI-to-TV and MI-to-odds conversions in Lemma 2.1, Proposition 4.1, and Lemma 4.1 are mostly standard and correct, and the sufficiency direction (Theorem 2.1) is a useful bridge between the proposed auditable criterion and anchored unlearning. However, three load-bearing theoretical claims are not established: the KL expectation bound in Theorem 4.1 is false as stated, the Wasserstein lower bound in Lemma 2.2 is invalid, and the equivalence in Theorem 4.3 fails under non-strict monotonicity. These errors directly affect the paper's stated contributions on the necessity of marginal unlearning and on the uniqueness of the barycenter as the analytic unlearning solution. The framework may remain useful after substantial correction, but the current theoretical guarantees are overstated.

major comments (3)

[§4.1, Eq. (17)] Theorem 4.1, Eq. (17), claims E_Z[D_KL(P_{\hat X|Z} || P_{\hat X})] ≤ sqrt(I(\hat X;Z)). This is false because the identity I(\hat X;Z) = E_Z[D_KL(P_{\hat X|Z} || P_{\hat X})] holds by definition, so the displayed bound would require I ≤ sqrt(I), which fails whenever I > 1. The KL expectation bound should either be removed or corrected to the exact identity; the useful TV bounds in parts 3 and 4 require a separate proof and are not rescued by part 1.
[§2.4 and Appendix B.3, Lemma 2.2] The proof of Lemma 2.2 uses an invalid Wasserstein lower bound. The step W_dY(f(X_0), f(X_1)) > δ ∫_{B_δ(y*)} |f(X_0)-f(X_1)|(y) dy ≥ δ|f(X_0)-f(X_1)|(y*) is not a valid lower bound for the 1-Wasserstein distance; Wasserstein distance is a transport metric and is not controlled pointwise by values of densities. Consequently the claimed threshold L*(ε) and the three-way incompatibility conclusion are not established. The expression for L*(ε) also divides by W_dX(X_1, X_0), which can be zero when the laws of X_1 and X_0 coincide even if the random variables differ, so the formula is not well-posed in general. Proposition 2.1, which relies on this lemma, is therefore unsupported.
[§4.3, Theorem 4.3 and Lemma 4.3] The equivalence in Theorem 4.3 is false as stated. Lemma 4.3 establishes only non-decreasing monotonicity of the utility functionals with respect to sigma-algebra inclusion, and non-decreasing monotonicity cannot support the "only if" direction. A concrete counterexample occurs when Y is independent of (X,Z): then I(Y;\hat X)=0 for every admissible \hat X, so any admissible output, including a constant output with trivial sigma-algebra, is a maximizer of the mutual-information utility, while σ(constant) is strictly coarser than σ(\bar X) in general. Thus the assertion that a maximizer must satisfy σ(\hat X)=σ(\bar X) fails. The paper can legitimately claim that the barycenter is an optimal solution, but not that it is the unique optimal solution; Section 5.3 and Algorithm 3 inherit this overclaim.

minor comments (4)

[§5.1, Algorithm 1, line 8] Algorithm 1 computes S_d = f_θ(X_d), but the model was defined as f: X × Z → S; the algorithm should either include Z in the input or clarify that Z is already encoded in X_d.
[§5.3, Algorithm 3, steps 4-6] The pseudocode says to compute the optimal transport map T_z that maps \bar X to X_z, while the surrounding text describes Brenier maps from X_z to the barycenter; the direction of the transport maps should be made consistent.
[§4.2, Lemma 4.1 and Theorem 4.2] The symbol ε is used both for the allowed difference in posterior probabilities and for the log-odds threshold in Theorem 4.2; this notational overlap makes the statements harder to parse and should be disambiguated.
[§4.1, Theorem 4.1] The assumption "P_{\hat X} ≪ L" introduces L without defining it in the theorem statement; clarify that L denotes Lebesgue measure on the relevant Euclidean space.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's marginal-unlearning guarantees are genuine inferences from mutual-information bounds, and the barycenter optimality rests on an independently published lemma rather than on the paper's own definitions.

full rationale

The paper's central claims are not equivalent to their inputs by construction. The marginal unlearning definition (Definitions 2.3 and 2.4) is the target criterion, and the guarantees (Lemma 2.1, Theorem 2.1, Lemma 4.1, Theorem 4.2) derive statistical-inference bounds from mutual-information constraints using standard inequalities (Pinsker, Markov, data processing). These are substantive reductions, not re-statements of the definition. The analytic solution (Theorem 4.3) does rely on Lemma 4.2, which is cited from the authors' prior JMLR paper [71] for the finest-sigma-algebra property of the Wasserstein-2 barycenter. Although this is a self-citation, it is a published, parameter-free mathematical result with a full proof in that prior work, and its assumptions do not include the utility functionals or the unlearning definition being derived; under the review rules this counts as independent evidence, not circularity. Lemma 4.3's monotonicity is proved in the appendix, and no fitted parameter is relabeled as a prediction. A separate, non-circular correctness caveat remains: Lemma 4.3 establishes only non-strict monotonicity, so the asserted 'iff' uniqueness in Theorem 4.3 is not established and fails in degenerate cases such as Y independent of (X,Z); this is a correctness risk, not a circularity. The paper is otherwise self-contained against external benchmarks, and its empirical evaluations do not presuppose the theorems they illustrate.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The framework introduces no new physical entities. It depends on modeling choices (mixture p_d, prior pi, log-loss utility) and on the cited finest-sigma-algebra lemma from the authors' prior work. The trade-off parameters lambda and alpha are chosen by hand or grid search, and the experimental MI estimators have unspecified bandwidths and stopping rules.

free parameters (5)

lambda (regularization weight) = grid-searched, e.g., 0.002 to 0.01 on MNIST
Appears in Eq (1) and Algorithms 1-3; the theory gives no principled selection rule, so it is a hand-chosen trade-off in every experiment.
alpha (mixture weight in p_d) = |R|/(|R|+|U|) in experiments
Defines p_d = (1-alpha)p_r + alpha p_u; the paper says alpha should reflect the cardinality ratio but provides no formal rule, and the guarantees depend on this modeling choice.
pi (prior for Z) = 1/2
Set by default; affects the MI and the odds ratio in Definitions 2.3 and 2.4.
KDE bandwidths (h_x, h_y) = unspecified
Used in the Gaussian experiment (Section 6.2.1) to estimate densities and MI; no selection method is given.
early-stopping thresholds = 0.85 MI/KD, 1/C+0.02, patience 1 to 2
Per-method stopping rules in MNIST (Section 6.2.2) are ad hoc and differ across methods, affecting the comparison.

assumptions (6)

domain assumption The released model S=f(X,Z) must be measurable w.r.t. (X,Z) (admissibility, Eq 27).
Standard measurability requirement; ensures no information is created ex nihilo.
domain assumption Conditional distributions {X|Z=z} are absolutely continuous with finite second moments, so Brenier maps and a W2 barycenter exist.
Needed for Lemma 4.2 and Theorem 4.3 (see Appendix D.1).
standard math Lemma 4.2 (Wasserstein barycenter generates the finest sigma-algebra among independent admissible outputs) is taken from the authors' prior work [71, Lemma 5.2].
This is the load-bearing step for Theorem 4.3; the paper gives only a sketch and cites the authors' own JMLR paper for the full proof.
domain assumption Utility is measured by log-loss regret in Theorem 2.1 (reglog).
The sufficiency theorem converts utility to TV via Pinsker; it applies only to log-loss style losses.
domain assumption In Lemma 2.2, the retrained model f is L-Lipschitz.
The necessity claim assumes robustness implies Lipschitz regularity; unverified and the proof uses an invalid inequality.
standard math P_Xhat is absolutely continuous with respect to Lebesgue measure and I(Xhat;Z) is finite in Theorem 4.1.
Technical conditions for the KL/TV bounds; standard.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Machine Unlearning via Information Theoretic Regularization." pith.science (2026). https://pith.science/paper/2GQHPU2K

@misc{pith2026250205684,
  author       = {Pith},
  title        = {Pith review of: Machine Unlearning via Information Theoretic Regularization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2GQHPU2K}},
  note         = {Machine review of arXiv:2502.05684}
}

read the original abstract

How can we effectively remove or ``unlearn'' undesirable information, such as specific features or the influence of individual data points, from a learning outcome while minimizing utility loss and ensuring rigorous guarantees? We introduce a unified mathematical framework based on information-theoretic regularization to address both data-point unlearning and feature unlearning. For data-point unlearning, we introduce the \emph{Marginal Unlearning Principle}, an auditable and provable framework. Moreover, we provide an information-theoretic unlearning definition based on the proposed principle and provable guarantees on sufficiency and necessity of marginal unlearning. We then show that the proposed framework provides a natural solution to the marginal unlearning problem and yields auditable high-probability marginal-unlearning guarantees. For feature unlearning, the framework applies to deep learning with flexible training objectives. By combining flexibility in learning objectives with simplicity in regularization design, our approach is highly adaptable and practical for a wide range of machine learning and AI applications. From a mathematical perspective, we provide a unified analytic solution to the optimal feature unlearning problem with a variety of information-theoretic training objectives. Our theoretical analysis reveals intriguing connections between machine unlearning, information theory, optimal transport, and extremal sigma algebras. Numerical simulations support our theoretical findings.

Figures

Figures reproduced from arXiv: 2502.05684 by the authors.

**Figure 2.** Evolution of output densities p(fθ(Xr)) (left column) and p(fθ(Xu)) (right column) over epochs for the three objectives. It is clear that marginal unlearning suppresses the unlearn signal (concentration around zero) while preserving the uniform density supported by the retain signal. In comparison, the method based on gradient ascent all push the mass concentration to somewhere else, even though they have different … view at source ↗

**Figure 3.** MNIST Unlearning trajectories on train (left panel) and test (right panel) folders with line representing the [PITH_FULL_IMAGE:figures/full_fig_p035_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: illustrates the unlearning outcomes for both tasks: The above penal shows the unlearn results for smile [PITH_FULL_IMAGE:figures/full_fig_p037_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

77 extracted references · 61 canonical work pages

[1]

Abadi, A

M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 308– 318, New York, NY, USA, 2016. ACM

work page 2016
[2]

Agueh and G

M. Agueh and G. Carlier. Barycenters in the Wasserstein space.SIAM Journal on Mathematical Analysis, 43(2):904–924, 2011

2011
[3]

A. A. Alemi, I. Fischer, J. V. Dillon, and K. Murphy. Deep variational information bottleneck. InInternational Conference on Learning Representations, 2017

work page 2017
[4]

J. M. Altschuler and E. Boix-Adsera. Wasserstein barycenters are NP-hard to compute. SIAM Journal on Mathematics of Data Science, 4(1):179–203, 2022

work page 2022
[5]

Amara, A

I. Amara, A. I. Humayun, I. Kajic, Z. Parekh, N. Harris, S. Young, C. Nagpal, N. Kim, J. He, C. Nader Vasconcelos, et al. EraseBench: Understanding the ripple effects of concept erasure techniques.arXiv:2501.09833, 2025

arXiv 2025
[6]

M. C. Anderson and C. Green. Suppressing unwanted memories by executive control. Nature, 410(6826):366–369, 2001

work page 2001
[7]

M. C. Anderson and S. Hanslmayr. Neural mechanisms of motivated forgetting.Trends in cognitive sciences, 18(6):279–292, 2014

work page 2014
[8]

Belrose, D

N. Belrose, D. Schneider-Joseph, S. Ravfogel, R. Cotterell, E. Raff, and S. Biderman. LEACE: Perfect linear concept erasure in closed form. InNeurIPS, 2023

work page 2023

Show all 77 references

[9]

Berger.Rate-distortion theory

T. Berger.Rate-distortion theory. Wiley, Hoboken, NJ, 2003

2003
[10]

R. Bonta. California consumer privacy act (ccpa).Retrieved from State of California Department of Justice: https://oag. ca. gov/privacy/ccpa, 2022

2022
[11]

Bourtoule, V

L. Bourtoule, V. Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot. Machine unlearning. In2021 IEEE Symposium on Security and Privacy (SP), pages 141–159, Oxford, UK, 2021. IEEE

2021
[12]

Cao and J

Y. Cao and J. Yang. Towards making systems forget with machine unlearning. In2015 IEEE Symposium on Security and Privacy (SP), pages 463–480, Oxford, UK, 2015. IEEE

2015
[13]

Carlini, F

N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. B. Brown, D. Song, U. Erlingsson, A. Oprea, and N. Papernot. Extracting training data from large language models. In30th USENIX Security Symposium (USENIX Security 21), 2021

2021
[14]

M. Chen, Z. Zhang, T. Wang, M. Backes, M. Humbert, and Y. Zhang. When ma- chine unlearning jeopardizes privacy. InProceedings of the 2021 ACM SIGSAC Con- ference on Computer and Communications Security (CCS ’21), pages 896–911, 2021. 40 Machine Unlearning doi: 10.1145/3460120....

2021
[15]

S. Chiappa. Path-specific counterfactual fairness.Proceedings of the AAAI Confer- ence on Artificial Intelligence, 33(01):7801–7808, Jul. 2019. doi: 10.1609/aaai.v33i01. 33017801. URLhttps://ojs.aaai.org/index.php/AAAI/article/view/4777

2019 doi
[16]

Christian.The Alignment Problem: Machine Learning and Human Values

B. Christian.The Alignment Problem: Machine Learning and Human Values. W.W Norton & Company, New York, 2020

2020
[17]

Chzhen, C

E. Chzhen, C. Denis, M. Hebiri, L. Oneto, and M. Pontil. Fair regression with Wasser- stein barycenters.Advances in Neural Information Processing Systems, 33:7321–7331, 2020

2020
[18]

T. M. Cover and J. A. Thomas.Elements of Information Theory. Wiley, Hoboken, NJ, 2nd edition, 2006

2006
[19]

Criminisi, J

A. Criminisi, J. Shotton, E. Konukoglu, et al. Decision forests: A unified framework for classification, regression, density estimation, manifold learning and semi-supervised learning.Foundations and trends®in computer graphics and vision, 7(2–3):81–227, 2012

2012
[20]

J. Dastin. Amazon scraps secret AI recruiting tool that showed bias against women. InEthics of data and analytics, pages 296–299. Auerbach Publications, New York, NY, 2022

2022
[21]

Dettmers, A

T. Dettmers, A. Pagnoni, A. Holtzman, and L. Zettlemoyer. Qlora: Efficient finetuning of quantized LLMs. InAdvances in Neural Information Processing Systems (NeurIPS), 2023

2023
[22]

C. Dwork. Differential privacy. InInternational colloquium on automata, languages, and programming, pages 1–12. Springer, 2006

2006
[23]

Dwork and A

C. Dwork and A. Roth. The algorithmic foundations of differential privacy.Foundations and Trends in Theoretical Computer Science, 9(3–4):211–407, 2014

2014
[24]

Dwork, M

C. Dwork, M. Hardt, T. Pitassi, O. Reingold, and R. Zemel. Fairness through aware- ness. InProceedings of the 3rd innovations in theoretical computer science conference, pages 214–226, 2012

2012
[25]

Elazar, S

Y. Elazar, S. Ravfogel, Y. Goldberg, and Y. Belinkov. Amnesic probing: Behavioral explanation with amnesic counterfactuals.Transactions of the Association for Com- putational Linguistics, 9:160–175, 2021

2021
[26]

Regulation (EU) 2016/679 of the European Parliament and of the Council

European Parliament and Council of the European Union. Regulation (EU) 2016/679 of the European Parliament and of the Council. URLhttps://data.europa.eu/eli/ reg/2016/679/oj

2016
[27]

Gandikota, J

R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau. Erasing concepts from diffusion models. InProceedings of the IEEE/CVF international conference on computer vision, pages 2426–2436, 2023. 41 Xu, Strohmer

2023
[28]

A. A. Ginart, M. Y. Guan, G. Valiant, and J. Zou. Making ai forget you: data deletion in machine learning. InProceedings of the 33rd International Conference on Neural Information Processing Systems, Red Hook, NY, USA, 2019. Curran Associates Inc

2019
[29]

Golatkar, A

A. Golatkar, A. Achille, and S. Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9304–9312, 2020

2020
[30]

T. L. Gouic, J.-M. Loubes, and P. Rigollet. Projection to fairness in statistical learning. arXiv preprint arXiv:2005.11720, 2020

2005 arXiv
[31]

C. Guo, T. Goldstein, A. Hannun, and L. van der Maaten. Certified data removal from machine learning models.arXiv:1911.03030, 2019

1911 arXiv
[32]

L. Han, H. Huang, D. Scheinost, M.-A. Hartley, and M. R. Mart ´ ınez. Unlearning information bottleneck: Machine unlearning of systematic patterns and biases.arXiv preprint arXiv:2405.14020, 2024

2024 arXiv
[33]

Hardt, E

M. Hardt, E. Price, and N. Srebro. Equality of opportunity in supervised learning. In Advances in Neural Information Processing Systems (NeurIPS), volume 29, 2016

2016
[34]

K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

2016
[35]

Higgins, L

I. Higgins, L. Matthey, A. Pal, C. Burgess, X. Glorot, M. Botvinick, S. Mohamed, and A. Lerchner. beta-vae: Learning basic visual concepts with a constrained variational framework. InInternational Conference on Learning Representations, 2017

2017
[36]

R. D. Hjelm, A. Fedorov, S. Lavoie-Marchildon, K. Grewal, P. Bachman, A. Trischler, and Y. Bengio. Learning deep representations by mutual information estimation and maximization.arXiv preprint arXiv:1808.06670, 2018

2018 arXiv
[37]

S. Hong, J. Lee, and S. S. Woo. All but one: Surgical concept erasing with model preservation in text-to-image diffusion models. InAAAI, 2024

2024
[38]

Houlsby, A

N. Houlsby, A. Giurgiu, S. Jastrzebski, B. Morrone, Q. De Laroussilhe, A. Gesmundo, M. Attariyan, and S. Gelly. Parameter-efficient transfer learning for nlp. InInterna- tional conference on machine learning, pages 2790–2799. PMLR, 2019

2019
[39]

E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, and W. Chen. Lora: Low- rank adaptation of large language models. InInternational Conference on Learning Representations (ICLR), 2022

2022
[40]

Huang, K.-P

C.-P. Huang, K.-P. Chang, C.-T. Tsai, Y.-H. Lai, F.-E. Yang, and Y.-C. F. Wang. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. InEuropean Conference on Computer Vision, pages 360–376. Springer, 2024

2024
[41]

J. D. Karpicke and J. R. Blunt. Retrieval practice produces more learning than elab- orative studying with concept mapping.Science, 331(6018):772–775, 2011. 42 Machine Unlearning

2011
[42]

Kirkpatrick, R

J. Kirkpatrick, R. Pascanu, N. Rabinowitz, J. Veness, G. Desjardins, A. A. Rusu, K. Milan, J. Quan, T. Ramalho, A. Grabska-Barwi´ nska, et al. Overcoming catas- trophic forgetting in neural networks.Proceedings of the National Academy of Sciences (PNAS), 114(13):3521–3526, 2017

2017
[43]

Korotin, D

A. Korotin, D. Selikhanovych, and E. Burnaev. Neural optimal transport.arXiv preprint arXiv:2201.12220, 2022

2022 arXiv
[44]

M. J. Kusner, J. Loftus, C. Russell, and R. Silva. Counterfactual fairness. InNeurIPS, 2017

2017
[45]

Lester, R

B. Lester, R. Al-Rfou, and N. Constant. The power of scale for parameter-efficient prompt tuning. In M.-F. Moens, X. Huang, L. Specia, and S. W.-t. Yih, editors, Proceedings of the 2021 Conference on Empirical Methods in Natural Language Pro- cessing, pages 3045–3059, Online a...

2021 doi
[46]

Z. Li, A. Perez-Suay, G. Camps-Valls, and D. Sejdinovic. Kernel dependence regulariz- ers and gaussian processes with applications to algorithmic fairness.arXiv:1911.04322, 2019

1911 arXiv
[47]

J. Liu, Y. Yao, J. Chen, B. Wang, and H. Shen. Fair representation learning: An alternative to mutual information. InKDD, 2022

2022
[48]

Z. Liu, P. Luo, X. Wang, and X. Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015

2015
[49]

Louizos, K

C. Louizos, K. Swersky, Y. Li, M. Welling, and R. Zemel. The variational fair autoen- coder. InInternational Conference on Learning Representations (ICLR), 2016

2016
[50]

R. J. McCann. A convexity principle for interacting gases.Advances in mathematics, 128(1):153–179, 1997

1997
[51]

Nabi and I

R. Nabi and I. Shpitser. Fair inference on outcomes. AAAI’18/IAAI’18/EAAI’18, New Orleans, Louisiana, USA, 2018. AAAI Press. ISBN 978-1-57735-800-8

2018
[52]

Nader, G

K. Nader, G. E. Schafe, and J. E. LeDoux. Fear memories require protein synthesis in the amygdala for reconsolidation after retrieval.Nature, 406(6797):722–726, 2000

2000
[53]

Pereyra, G

G. Pereyra, G. Tucker, J. Chorowski, L. Kaiser, and G. Hinton. Regularizing neural net- works by penalizing confident output distributions.arXiv preprint arXiv:1701.06548, 2017

2017 arXiv
[54]

Pfeiffer, A

J. Pfeiffer, A. Kamath, A. R¨ uckl´ e, K. Cho, and I. Gurevych. Adapterfusion: Non- destructive task composition for transfer learning. InProceedings of the 16th conference of the European chapter of the association for computational linguistics: main volume, pages 487–503, 20...

2021
[55]

Ravfogel, Y

S. Ravfogel, Y. Elazar, H. Gonen, M. Twiton, and Y. Goldberg. Null it out: Guarding protected attributes by iterative nullspace projection. InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics (ACL), pages 7237–7256, 2020

2020
[56]

Ravfogel, Y

S. Ravfogel, Y. Moskovitch, Y. Goldberg, and R. Cotterell. Linear Adversarial Concept Erasure. InICML (PMLR v162), 2022

2022
[57]

Sahakyan and C

L. Sahakyan and C. M. Kelley. A contextual change account of the directed forgetting effect.Journal of Experimental Psychology: Learning, Memory, and Cognition, 28(6): 1064, 2002

2002
[58]

Schiller, M.-H

D. Schiller, M.-H. Monfils, C. M. Raio, D. C. Johnson, J. E. Ledoux, and E. A. Phelps. Preventing the return of fear in humans using reconsolidation update mechanisms. Nature, 463(7277):49–53, 2010

2010
[59]

Sekhari, J

A. Sekhari, J. Acharya, G. Kamath, and A. T. Suresh. Remember what you want to forget: Algorithms for machine unlearning.Advances in Neural Information Processing Systems, 34:18075–18086, 2021

2021
[60]

C. E. Shannon et al. Coding theorems for a discrete source with a fidelity criterion. IRE Nat. Conv. Rec, 4(142-163):1, 1959

1959
[61]

Shokri, M

R. Shokri, M. Stronati, C. Song, and V. Shmatikov. Membership inference attacks against machine learning models. In2017 IEEE Symposium on Security and Privacy (SP), pages 3–18, Oxford, UK, 2017. IEEE

2017
[62]

D. M. Sommer, L. Song, S. Wagh, and P. Mittal. Athena: Probabilistic verification of machine unlearning.Proceedings on Privacy Enhancing Technologies (PoPETs), 2022 (3):268–290, 2022

2022
[63]

Thudi, H

A. Thudi, H. Jia, I. Shumailov, and N. Papernot. On the necessity of auditable al- gorithmic definitions for machine unlearning. In31st USENIX Security Symposium (USENIX Security), pages 4007–4022, 2022

2022
[64]

Villani.Optimal Transport: Old and New, volume 338 ofGrundlehren der mathema- tischen Wissenschaften

C. Villani.Optimal Transport: Old and New, volume 338 ofGrundlehren der mathema- tischen Wissenschaften. Springer, Berlin, Heidelberg, 2009. ISBN 978-3-540-71049-3

2009
[65]

Villani.Topics in optimal transportation, volume 58

C. Villani.Topics in optimal transportation, volume 58. American Mathematical Soc., Providence, RI, 2021

2021
[66]

W. Wang, C. Zhang, Z. Tian, and S. Yu. Machine unlearning via representation forgetting with parameter self-sharing.IEEE Transactions on Information Forensics and Security, 19:1099–1111, 2023

2023
[67]

Warnecke, L

A. Warnecke, L. Pirch, C. Wressnegger, and K. Rieck. Machine unlearning of features and labels.arXiv preprint arXiv:2108.11577, 2021

2021 arXiv
[68]

J. Weng, S. Yao, Y. Du, J. Huang, J. Weng, and C. Wang. Proof of unlearning: Defi- nitions and instantiation.IEEE Transactions on Information Forensics and Security, 19:3309–3323, 2024. 44 Machine Unlearning

2024
[69]

G. Wu, M. Hashemi, and C. Srinivasa. Puma: Performance unchanged model augmen- tation for training data removal. InProceedings of the AAAI conference on artificial intelligence, volume 36, pages 8675–8682, 2022

2022
[70]

J. Xu, Z. Wu, C. Wang, and X. Jia. Machine unlearning: Solutions and challenges. IEEE Transactions on Emerging Topics in Computational Intelligence, 2024

2024
[71]

Xu and T

S. Xu and T. Strohmer. Fair data representation for machine learning at the Pareto frontier.Journal of Machine Learning Research, 24(331):1–63, 2023

2023
[72]

S. Xu, Y. Ni, S. Broecker, and T. Strohmer. Forgetting-mari: Llm unlearning via marginal information regularization.arXiv preprint arXiv:2511.11914, 2025

2025
[73]

L. Xue, S. Hu, W. Lu, Y. Shen, D. Li, P. Guo, Z. Zhou, M. Li, Y. Zhang, and L. Y. Zhang. Towards reliable forgetting: A survey on machine unlearning verification.arXiv preprint arXiv:2506.15115, 2025

2025 arXiv
[74]

Xue, Y.-X

Y.-X. Xue, Y.-X. Luo, P. Wu, H.-S. Shi, L.-F. Xue, C. Chen, W.-L. Zhu, Z.-B. Ding, Y. Bao, J. Shi, D. H. Epstein, Y. Shaham, and L. Lu. A memory retrieval–extinction procedure to prevent drug craving and relapse.Science, 336(6078):241–245, 2012

2012
[75]

S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha. Privacy risk in machine learn- ing: Analyzing the connection to overfitting. In2018 IEEE 31st Computer Security Foundations Symposium (CSF), pages 268–282, Oxford, UK, 2018. IEEE

2018
[76]

Zhang, Z

B. Zhang, Z. Chen, C. Shen, and J. Li. Verification of machine unlearning is fragile. InInternational Conference on Machine Learning (ICML), 2024

2024
[77]

root” from (X, Z) without introducing additional randomness by the compression mapfitself. Technically speaking, the “root

B. H. Zhang, B. Lemoine, and M. Mitchell. Mitigating unwanted biases with adver- sarial learning. InProceedings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society, pages 335–340, 2018. 45 Xu, Strohmer Definitions T arget Enforcement mechanism Notes/guarantees F airness...

2018

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [1]

Abadi, A

M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 308– 318, New York, NY, USA, 2016. ACM

work page 2016

[2] [2]

Agueh and G

M. Agueh and G. Carlier. Barycenters in the Wasserstein space.SIAM Journal on Mathematical Analysis, 43(2):904–924, 2011

2011

[3] [3]

A. A. Alemi, I. Fischer, J. V. Dillon, and K. Murphy. Deep variational information bottleneck. InInternational Conference on Learning Representations, 2017

work page 2017

[4] [4]

J. M. Altschuler and E. Boix-Adsera. Wasserstein barycenters are NP-hard to compute. SIAM Journal on Mathematics of Data Science, 4(1):179–203, 2022

work page 2022

[5] [5]

Amara, A

I. Amara, A. I. Humayun, I. Kajic, Z. Parekh, N. Harris, S. Young, C. Nagpal, N. Kim, J. He, C. Nader Vasconcelos, et al. EraseBench: Understanding the ripple effects of concept erasure techniques.arXiv:2501.09833, 2025

arXiv 2025

[6] [6]

M. C. Anderson and C. Green. Suppressing unwanted memories by executive control. Nature, 410(6826):366–369, 2001

work page 2001

[7] [7]

M. C. Anderson and S. Hanslmayr. Neural mechanisms of motivated forgetting.Trends in cognitive sciences, 18(6):279–292, 2014

work page 2014

[8] [8]

Belrose, D

N. Belrose, D. Schneider-Joseph, S. Ravfogel, R. Cotterell, E. Raff, and S. Biderman. LEACE: Perfect linear concept erasure in closed form. InNeurIPS, 2023

work page 2023