SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\Delta (\mathbf {w}) = \boldsymbol {\theta} (\mathbf {w}) - \boldsymbol {\theta} (\mathbf {1} / N) \approx \left. \frac {d \boldsymbol {\theta} (\mathbf {w})}{d \mathbf {w}} \right| _ {\mathbf {w} = \mathbf {1} / N} (\mathbf {w} - \mathbf {1} / N), \tag {A1}
$$
where  $\frac{d\pmb{\theta}(\mathbf{w})}{d\mathbf{w}}\in \mathbb{R}^{M\times N}$ , and recall that  $M = |\pmb{\theta}_{\mathrm{o}}|$  is the number of model parameters. The gradient  $\frac{d\pmb{\theta}(\mathbf{w})}{d\mathbf{w}}$  is known as implicit gradient [78] since it is defined through the solution of the optimization problem  $\pmb {\theta}(\mathbf{w}) = \arg \min_{\pmb{\theta}}L(\mathbf{w},\pmb {\theta})$ , where recall that  $L(\mathbf{w},\pmb {\theta}) = \sum_{i = 1}^{N}[w_i\ell_i(\pmb {\theta},\mathbf{z}_i)]$ . By the stationary condition of  $\pmb {\theta}(\mathbf{w})$ , we obtain
$$
\nabla_ {\boldsymbol {\theta}} L (\mathbf {w}, \boldsymbol {\theta} (\mathbf {w})) = \mathbf {0}. \tag {A2}
$$
Next, we take the derivative of (A2) w.r.t.  $\mathbf{w}$  based on the implicit function theorem [78] assuming that  $\theta (\mathbf{w})$  is the unique solution to minimizing  $L$ . This leads to
$$
\left[ \frac {d \boldsymbol {\theta} (\mathbf {w})}{d \mathbf {w}} \right] ^ {T} \left[ \left. \nabla_ {\boldsymbol {\theta}, \boldsymbol {\theta}} L (\mathbf {w}, \boldsymbol {\theta}) \right| _ {\boldsymbol {\theta} = \boldsymbol {\theta} (\mathbf {w})} \right] + \nabla_ {\mathbf {w}, \boldsymbol {\theta}} L (\mathbf {w}, \boldsymbol {\theta} (\mathbf {w})) = \mathbf {0}, \tag {A3}
$$
where  $\nabla_{\mathbf{a},\mathbf{b}} = \nabla_{\mathbf{a}}\nabla_{\mathbf{b}}\in \mathbb{R}^{|\mathbf{a}|\times |\mathbf{b}|}$  is the second-order partial derivative. Therefore,
$$
\frac {d \boldsymbol {\theta} (\mathbf {w})}{d \mathbf {w}} = - \left[ \nabla_ {\boldsymbol {\theta}, \boldsymbol {\theta}} L (\mathbf {w}, \boldsymbol {\theta} (\mathbf {w})) \right] ^ {- 1} \nabla_ {\mathbf {w}, \boldsymbol {\theta}} L (\mathbf {w}, \boldsymbol {\theta} (\mathbf {w})) ^ {T}, \tag {A4}
$$
where  $\nabla_{\mathbf{w},\theta}L(\mathbf{w},\theta (\mathbf{w}))$  can be expanded as
$$
\begin{array}{l} \nabla_ {\mathbf {w}, \boldsymbol {\theta}} L (\mathbf {w}, \boldsymbol {\theta} (\mathbf {w})) = \nabla_ {\mathbf {w}} \nabla_ {\boldsymbol {\theta}} \sum_ {i = 1} ^ {N} \left[ w _ {i} \ell_ {i} \left(\boldsymbol {\theta} (\mathbf {w}), \mathbf {z} _ {i}\right) \right] (A5) \\ = \nabla_ {\mathbf {w}} \sum_ {i = 1} ^ {N} \left[ w _ {i} \nabla_ {\boldsymbol {\theta}} \ell_ {i} \left(\boldsymbol {\theta} (\mathbf {w}), \mathbf {z} _ {i}\right) \right] (A6) \\ = \left[ \begin{array}{c} \nabla_ {\boldsymbol {\theta}} \ell_ {1} \left(\boldsymbol {\theta} (\mathbf {w}), \mathbf {z} _ {1}\right) ^ {T} \\ \nabla_ {\boldsymbol {\theta}} \ell_ {2} \left(\boldsymbol {\theta} (\mathbf {w}), \mathbf {z} _ {2}\right) ^ {T} \\ \vdots \\ \nabla_ {\boldsymbol {\theta}} \ell_ {N} \left(\boldsymbol {\theta} (\mathbf {w}), \mathbf {z} _ {N}\right) ^ {T} \end{array} \right]. (A7) \\ \end{array}
$$
Based on (A4) and (A7), we obtain the closed-form of implicit gradient at  $\mathbf{w} = \mathbf{1} / N$ :
$$
\begin{array}{l} \frac {d \boldsymbol {\theta} (\mathbf {w})}{d \mathbf {w}} \mid_ {\mathbf {w} = \mathbf {1} / N} = - \left[ \nabla_ {\boldsymbol {\theta}, \boldsymbol {\theta}} L (\mathbf {1} / N, \boldsymbol {\theta} (\mathbf {1} / N)) \right] ^ {- 1} \left[ \nabla_ {\boldsymbol {\theta}} \ell_ {1} (\boldsymbol {\theta} (\mathbf {1} / N), \mathbf {z} _ {1}) \quad \dots \quad \nabla_ {\boldsymbol {\theta}} \ell_ {N} (\boldsymbol {\theta} (\mathbf {1} / N), \mathbf {z} _ {N}) \right] \\ = - \mathbf {H} ^ {- 1} \left[ \nabla_ {\boldsymbol {\theta}} \ell_ {1} \left(\boldsymbol {\theta} (\mathbf {1} / N), \mathbf {z} _ {1}\right) \quad \dots \quad \nabla_ {\boldsymbol {\theta}} \ell_ {N} \left(\boldsymbol {\theta} (\mathbf {1} / N), \mathbf {z} _ {N}\right) \right], \tag {A8} \\ \end{array}
$$
where  $\mathbf{H} = \nabla_{\pmb{\theta},\pmb{\theta}}L(\mathbf{1} / N,\pmb{\theta}(\mathbf{1} / N))$
Substituting (A8) into (A1), we obtain
$$
\begin{array}{l} \Delta (\mathbf {w}) \approx - \mathbf {H} ^ {- 1} \left[ \nabla_ {\pmb {\theta}} \ell_ {1} (\pmb {\theta} (\mathbf {1} / N), \mathbf {z} _ {1}) \quad \dots \quad \nabla_ {\pmb {\theta}} \ell_ {N} (\pmb {\theta} (\mathbf {1} / N), \mathbf {z} _ {N}) \right] (\mathbf {w} - \mathbf {1} / N) \\ = - \mathbf {H} ^ {- 1} \sum_ {i = 1} ^ {N} [ (w _ {i} - 1 / N) \nabla_ {\boldsymbol {\theta}} \ell_ {i} (\boldsymbol {\theta} (\mathbf {1} / N), \mathbf {z} _ {i}) ] \\ = \mathbf {H} ^ {- 1} \nabla_ {\boldsymbol {\theta}} L (\mathbf {1} / N - \mathbf {w}, \boldsymbol {\theta} _ {\mathrm {o}}), \tag {A9} \\ \end{array}
$$
where the last equality holds by the definition of  $L(\mathbf{w},\pmb {\theta}) = \sum_{i = 1}^{N}[w_i\ell_i(\pmb {\theta},\mathbf{z}_i)]$
Remark on IU using ave-ERM vs. sum-ERM. Recall that the weighted empirical risk minimization (ERM) loss used in proposition (1),  $L(\mathbf{w}, \boldsymbol{\theta}) = \sum_{i=1}^{N} [w_i \ell_i(\boldsymbol{\theta}, \mathbf{z}_i)]$  corresponds to the ave-ERM as  $\mathbf{w}$  is subject to the simplex constraint ( $\mathbf{1}^T \mathbf{w} = 1$  and  $\mathbf{w} \geq \mathbf{0}$ ). This is different from the conventional derivation of IU using the sum-ERM [32, 35] in the absence of simplex constraint. In what follows, we discuss the impact of ave-ERM on IU vs. sum-ERM.
Noting that  $\theta_{\mathrm{o}}$  represents the original model trained through conventional ERM, namely, the weighted ERM loss by setting  $w_{i} = c (\forall i)$  for a positive constant  $c$ . Given the unlearning scheme (encoded in  $\mathbf{w}$ ), the IU approach aims to delineate the model parameter adjustments required by MU from the initial model  $\theta_{\mathrm{o}}$ . Such a model weight modification is represented as  $\Delta(\mathbf{w}) = \theta(\mathbf{w}) - \theta_{\mathrm{o}}$  mentioned in proposition (1). The difference between ave-ERM and sum-ERM would play a role in deriving  $\Delta(\mathbf{w})$ , which relies on the Taylor expansion of  $\theta(\mathbf{w})$  (viewed as a function of  $\mathbf{w}$ ). When the sum-ERM is considered, then the linearization point is typically set by  $\mathbf{w} = \mathbf{1}$ . This leads to
$$
\begin{array}{l} \Delta^ {(\mathrm {s u m})} (\mathbf {w}) = \boldsymbol {\theta} (\mathbf {w}) - \boldsymbol {\theta} (\mathbf {1}) \approx \boldsymbol {\theta} (\mathbf {1}) + \frac {d \boldsymbol {\theta} (\mathbf {w})}{d \mathbf {w}} | _ {\mathbf {w} = \mathbf {1}} (\mathbf {w} - \mathbf {1}) - \boldsymbol {\theta} (\mathbf {1}) \\ = \frac {d \theta (\mathbf {w})}{d \mathbf {w}} | _ {\mathbf {w} = \mathbf {1}} (\mathbf {w} - \mathbf {1}), \tag {A10} \\ \end{array}
$$
where  $\theta(\mathbf{1}) = \theta_{\mathrm{o}}$  for sum-ERM, and  $\frac{d\theta(\mathbf{w})}{d\mathbf{w}}$  is implicit gradient [78] since it is defined upon an implicit optimization problem  $\theta(\mathbf{w}) = \arg \min_{\boldsymbol{\theta}} L(\mathbf{w}, \boldsymbol{\theta})$ .
When the ave-ERM is considered, the linearization point is set by  $\mathbf{w} = \mathbf{1} / N$ . This leads to
$$
\begin{array}{l} \Delta^ {(\mathrm {a v e})} (\mathbf {w}) = \boldsymbol {\theta} (\mathbf {w}) - \boldsymbol {\theta} (\mathbf {1} / N) \approx \boldsymbol {\theta} (\mathbf {1} / N) + \frac {d \boldsymbol {\theta} (\mathbf {w})}{d \mathbf {w}} | _ {\mathbf {w} = \mathbf {1} / N} (\mathbf {w} - \mathbf {1} / N) - \boldsymbol {\theta} (\mathbf {1} / N) \\ = \frac {d \theta (\mathbf {w})}{d \mathbf {w}} | _ {\mathbf {w} = \mathbf {1} / N} (\mathbf {w} - \mathbf {1} / N), \tag {A11} \\ \end{array}
$$
where  $\theta(1/N) = \theta_{\mathrm{o}}$  for ave-ERM. The derivation of the implicit gradient  $\frac{d\theta(\mathbf{w})}{d\mathbf{w}}$  is shown in (A8). Next, let us draw a comparison between  $\Delta^{(\mathrm{sum})}(\mathbf{w})$  and  $\Delta^{(\mathrm{ave})}(\mathbf{w})$  using a specific example below. If we aim to unlearn the first  $k$  training data points, the unlearning weights  $\mathbf{w}_{\mathrm{MU}}$  under sum-ERM is then given by  $\mathbf{w}_{\mathrm{MU}}^{(\mathrm{sum})} = [0,0,\dots,0,1,1,\dots,1]$ , where 0 encodes the data sample to be unlearned or removed. This yields  $(\mathbf{w}_{\mathrm{MU}}^{(\mathrm{sum})} - \mathbf{1}) = [1,1,\dots,1,0,0,\dots,0]$ . By contrast, the unlearning weights  $\mathbf{w}_{\mathrm{MU}}$  under ave-ERM is given by  $\mathbf{w}_{\mathrm{MU}}^{(\mathrm{ave})} = [0,0,\dots,0,\frac{1}{N-k},\frac{1}{N-k},\dots,\frac{1}{N-k}]$ . As a result,  $(\mathbf{w}_{\mathrm{MU}}^{(\mathrm{ave})} - \mathbf{1}/N) = [\underbrace{-\frac{1}{N}, -\frac{1}{N},\dots,-\frac{1}{N}_{k}\frac{1}{N-k}-\frac{1}{N},\dots,\frac{1}{N-k}-\frac{1}{N}_{k}}_{k\frac{1}{N}s}]$ . The above difference
is caused by the presence of simplex constraint of  $\mathbf{w}$  in ave-ERM. Thus, the MU's weight configuration  $(\mathbf{w}_{\mathrm{MU}}^{\mathrm{(ave)}} - \mathbf{1} / N)$  obtained from ave-ERM is different from  $(\mathbf{w}_{\mathrm{MU}}^{\mathrm{(sum)}} - \mathbf{1})$  in the sum-ERM setting.
Given the above example, the error term of the Taylor expansion using sum-ERM for  $\mathbf{w} = \mathbf{w}_{\mathrm{MU}}^{\mathrm{sum}}$  is in the order of  $\| \mathbf{w}_{\mathrm{MU}}^{\mathrm{sum}} - \mathbf{1}\| _2^2 = k$ , while the error term using ave-ERM for  $\mathbf{w} = \mathbf{w}_{\mathrm{MU}}^{\mathrm{ave}}$  is in the order of  $\| \mathbf{w}_{\mathrm{MU}}^{\mathrm{ave}} - \mathbf{1} / N\| _2^2 = \frac{k}{N^2} +\frac{k^2}{N^2(N - k)} = \frac{k}{N(N - k)}$ . Thus compared to ave-ERM, the use of sum-ERM could cause the first-order Taylor expansion in IU less accurate as the number of unlearning datapoints  $(k)$  increases. Furthermore, the IG  $\frac{d\theta(\mathbf{w})}{d\mathbf{w}} |_{\mathbf{w} = 1}$  in sum-ERM is also different from  $\frac{d\theta(\mathbf{w})}{d\mathbf{w}} |_{\mathbf{w} = 1 / N}$  in ave-ERM as they are evaluated at two different linearization points.
B Proof of Proposition 2
The proof follows [8, Sec. 5], with the additional condition that the model is sparse encoded by a pre-fixed (binary) pruning mask  $\mathbf{m}$ , namely,  $\theta' := \mathbf{m} \odot \boldsymbol{\theta}$ . Then, based on [8, Eq. 5], the model
updated by SGD yields
$$
\boldsymbol {\theta} _ {t} ^ {\prime} \approx \boldsymbol {\theta} _ {0} ^ {\prime} - \eta \mathbf {m} \odot \sum_ {i = 1} ^ {t - 1} \nabla_ {\boldsymbol {\theta}} \ell \left(\boldsymbol {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {i}\right) + \mathbf {m} \odot \left(\sum_ {i = 1} ^ {t - 1} f (i)\right), \tag {A12}
$$
where  $\theta_0^{\prime} = \mathbf{m}\odot \theta_{0}$  is the model initialization when using SGD-based sparse training,  $\{\hat{\mathbf{z}}_i\}$  is the sequence of stochastic data samples,  $t$  is the number of training iterations,  $\eta$  is the learning rate, and  $f(i)$  is defined recursively as
$$
f (i) = - \eta \nabla_ {\boldsymbol {\theta}, \boldsymbol {\theta}} ^ {2} \ell \left(\boldsymbol {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {i}\right) \left(- \eta \sum_ {j = 0} ^ {i - 1} \mathbf {m} \odot \nabla_ {\boldsymbol {\theta}} \ell \left(\boldsymbol {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {j}\right) + \sum_ {j = 0} ^ {i - 1} \left(\mathbf {m} \odot f (j)\right)\right), \tag {A13}
$$
with  $f(0) = 0$ . Inspired by the second term of (A12), to unlearn the data sample  $\hat{\mathbf{z}}_i$ , we will have to add back the first-order gradients under  $\hat{\mathbf{z}}_i$ . This corresponds to the GA-based approximate unlearning method. Yet, this approximate unlearning introduces an unlearning error, given by the last term of (A12)
$$
\mathbf {e} _ {\mathbf {m}} \left(\boldsymbol {\theta} _ {0}, \left\{\hat {\mathbf {z}} _ {i} \right\}, t, \eta\right) := \mathbf {m} \odot \left(\sum_ {i = 1} ^ {t - 1} f (i)\right). \tag {A14}
$$
Next, if we interpret the mask  $\mathbf{m}$  as a diagonal matrix  $\mathrm{diag}(\mathbf{m})$  with 0's and 1's along its diagonal based on  $\mathbf{m}$ , we can then express the sparse model  $\mathbf{m} \odot \boldsymbol{\theta}$  as  $\mathrm{diag}(\mathbf{m})\boldsymbol{\theta}$ . Similar to [8, Eq. 9], we can derive a bound on the unlearning error (A14) by ignoring the terms other than those with  $\eta^2$  in  $f(i)$ , i.e., (A13). This is because, in the recursive form of  $f(i)$ , all other terms exhibit a higher degree of the learning rate  $\eta$  compared to  $\eta^2$ . As a result, we obtain
$$
\begin{array}{l} e (\mathbf {m}) = \left\| \mathbf {e} _ {\mathbf {m}} \left(\boldsymbol {\theta} _ {0}, \left\{\hat {\mathbf {z}} _ {i} \right\}, t, \eta\right) \right\| _ {2} = \left\| \mathbf {m} \odot \left(\sum_ {i = 1} ^ {t - 1} f (i)\right) \right\| _ {2} \\ \approx \eta^ {2} \left\| \mathrm {d i a g} (\mathbf {m}) \sum_ {i = 1} ^ {t - 1} \nabla_ {\pmb {\theta}, \pmb {\theta}} ^ {2} \ell (\pmb {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {i}) \sum_ {j = 0} ^ {i - 1} \mathbf {m} \odot \nabla_ {\pmb {\theta}} \ell (\pmb {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {j}) \right\| _ {2} \\ \leq \eta^ {2} \sum_ {i = 1} ^ {t - 1} \left\| \operatorname {d i a g} (\mathbf {m}) \nabla_ {\boldsymbol {\theta}, \boldsymbol {\theta}} ^ {2} \ell \left(\boldsymbol {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {i}\right) \sum_ {j = 0} ^ {i - 1} \mathbf {m} \odot \nabla_ {\boldsymbol {\theta}} \ell \left(\boldsymbol {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {j}\right) \right\| _ {2} \quad \text {(T r i a n g l e i n e q u a l i t y)} \\ \leq \eta^ {2} \sum_ {i = 1} ^ {t - 1} \left\| \operatorname {d i a g} (\mathbf {m}) \nabla_ {\boldsymbol {\theta}, \boldsymbol {\theta}} ^ {2} \ell \left(\boldsymbol {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {i}\right) \right\| \left\| \sum_ {j = 0} ^ {i - 1} \mathbf {m} \odot \nabla_ {\boldsymbol {\theta}} \ell \left(\boldsymbol {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {j}\right) \right\| _ {2} (A15) \\ \lesssim \eta^ {2} \sum_ {i = 1} ^ {t - 1} \left\| \operatorname {d i a g} (\mathbf {m}) \nabla_ {\boldsymbol {\theta}, \boldsymbol {\theta}} ^ {2} \ell \left(\boldsymbol {\theta} _ {0} ^ {\prime}, \hat {\mathbf {z}} _ {i}\right) \right\| \frac {i}{t} \left\| \boldsymbol {\theta} _ {t} ^ {\prime} - \boldsymbol {\theta} _ {0} ^ {\prime} \right\| _ {2} (A16) \\ \leq \eta^ {2} \sigma (\mathbf {m}) \| \mathbf {m} \odot (\boldsymbol {\theta} _ {t} - \boldsymbol {\theta} _ {0}) \| _ {2} \frac {1}{t} \frac {t - 1}{2} t = \frac {\eta^ {2}}{2} (t - 1) \| \mathbf {m} \odot (\boldsymbol {\theta} _ {t} - \boldsymbol {\theta} _ {0}) \| _ {2} \sigma (\mathbf {m}), (A17) \\ \end{array}
$$
where the inequality (A16) holds given the fact that  $\sum_{j=0}^{i-1} \mathbf{m} \odot \nabla_{\boldsymbol{\theta}} \ell(\boldsymbol{\theta}_0', \hat{\mathbf{z}}_j)$  in (A15) can be approximated by its expectation  $\frac{i(\boldsymbol{\theta}_t' - \boldsymbol{\theta}_0')}{t}$  [8, Eq. 7], and  $\sigma(\mathbf{m}) := \max_j \{\sigma_j(\nabla_{\boldsymbol{\theta},\boldsymbol{\theta}}^2 \ell), \text{ if } m_j \neq 0\}$ , i.e., the largest eigenvalue among the dimensions left intact by the binary mask  $\mathbf{m}$ . The above suggests that the unlearning error might be large if  $\mathbf{m} = \mathbf{1}$  (no pruning). Based on (A17), we can then readily obtain the big  $O$  notation in (2). This completes the proof.
C Additional Experimental Details and Results
C.1 Datasets and models
We summarize the datasets and model configurations in Tab. A1.
Table A1: Dataset and model setups.
Settings	CIFAR-10	SVHN ResNet-18	CIFAR-100 ResNet-18	ImageNet ResNet-18
ResNet-18	VGG-16
Batch Size	256	256	256	256	1024
Table A2: Detailed training details for model pruning.
Experiments	CIFAR-10/CIFAR-100	SVHN	ImageNet
Training epochs	182	160	90
Rewinding epochs	8	8	5
Momentum	0.9	0.9	0.875
l2 regularization	5e-4	5e-4	3.05e-5
Warm-up epochs	1(75 for VGG-16)	0	8
C.2 Additional training and unlearning settings
Training configuration of pruning. For all pruning methods, including IMP [15], SynFlow [40], and OMP [17], we adopt the settings from the current SOTA implementations [17]; see a summary in Tab. A2. For IMP, OMP, and SynFlow, we adopt the step learning rate scheduler with a decay rate of 0.1 at  $50\%$  and  $75\%$  epochs. We adopt 0.1 as the initial learning rate for all pruning methods.
Additional training details of MU. For all datasets and model architectures, we adopt 10 epochs for FT, and 5 epochs for GA method. The learning rate for FT and GA are carefully tuned between  $[10^{-5}, 0.1]$  for each dataset and model architecture. In particular, we adopt 0.01 as the learning rate for FT method and  $10^{-4}$  for GA on the CIFAR-10 dataset (ResNet-18, class-wise forgetting) at different sparsity levels. By default, we choose SGD as the optimizer for the FT and GA methods. As for FF method, we perform a greedy search for hyperparameter tuning [12] between  $10^{-9}$  and  $10^{-6}$ .
C.3 Detailed metric settings
Details of MIA implementation. MIA is implemented using the prediction confidence-based attack method [48]. There are mainly two phases during its computation: (1) training phase, and (2) testing phase. To train an MIA model, we first sample a balanced dataset from the remaining dataset  $(\mathcal{D}_{\mathrm{r}})$  and the test dataset (different from the forgetting dataset  $\mathcal{D}_{\mathrm{f}}$ ) to train the MIA predictor. The learned MIA is then used for MU evaluation in its testing phase. To evaluate the performance of MU, MIA-Efficacy is obtained by applying the learned MIA predictor to the unlearned model  $(\theta_{\mathrm{u}})$  on the forgetting dataset  $(\mathcal{D}_{\mathrm{f}})$ . Our objective is to find out how many samples in  $\mathcal{D}_{\mathrm{f}}$  can be correctly predicted as non-training samples by the MIA model against  $\theta_{\mathrm{u}}$ . The formal definition of MIA-Efficacy is then given by:
$$
\text {M I A - E f f i c a c y} = \frac {T N}{\left| \mathcal {D} _ {\mathrm {f}} \right|}, \tag {A18}
$$
where  $TN$  refers to the true negatives predicted by our MIA predictor, i.e., the number of the forgetting samples predicted as non-training examples, and  $|\mathcal{D}_{\mathrm{f}}|$  refers to the size of the forgetting dataset. As described above, MIA-Efficacy leverages the privacy attack to justify how good the unlearning performance could be.
C.4 Additional experiment results
Model sparsity benefits privacy of MU for 'free'. It was recently shown in [27, 28] that model sparsification helps protect data privacy, in terms of defense against MIA used to infer training data information from a learned model. Inspired by the above, we ask if sparsity can also bring the privacy benefit to an unlearned model, evaluated by the MIA rate on the remaining dataset  $\mathcal{D}_{\mathrm{r}}$  (that we term MIA-Privacy). This is different from MIA-Efficacy, which reflects the efficacy of scrubbing  $\mathcal{D}_{\mathrm{f}}$ , i.e., correctly predicting that data sample in  $\mathcal{D}_{\mathrm{f}}$  is not in the training set of the unlearned model. In contrast, MIA-Privacy characterizes the privacy of the unlearned model about  $\mathcal{D}_{\mathrm{r}}$ . A lower MIA-Privacy implies less information leakage.
Fig. A1 shows MIA-Privacy of unlearned models versus the sparsity ratio applied to different unlearning methods in the 'prune first, then unlearn' paradigm. As we can see, MIA-Privacy decreases as the sparsity increases. This suggests the improved privacy of unlearning on sparse models. Moreover, we observe that approximate unlearning outperforms exact unlearning (Retrain) in privacy preservation of  $\mathcal{D}_{\mathrm{r}}$ . This is because Retrain is conducted over  $\mathcal{D}_{\mathrm{r}}$  from scratch, leading to the strongest dependence on  $\mathcal{D}_{\mathrm{r}}$  than other unlearning methods. Another interesting observation is that IU and GA yield a much smaller MIA-Privacy than other approximate unlearning methods. The rationale behind that is IU and GA have a weaker correlation with  $\mathcal{D}_{\mathrm{r}}$  during unlearning. Specifically, the unlearning loss of IU only involves the forgetting data influence weights, i.e.,  $(1 / N - w)$  in (1). Similarly, GA only performs gradient ascent over  $\mathcal{D}_{\mathrm{f}}$ , with the least dependence on  $\mathcal{D}_{\mathrm{r}}$ .
Performance of 'prune first, then unlearn' on various datasets and architectures. As demonstrated in Tab. A3 and Tab. A4, the introduction of model sparsity can effectively reduce the discrepancy
between approximate and exact unlearning across a diverse range of datasets and architectures. This phenomenon is observable in various unlearning scenarios. Remarkably, model sparsity enhances both UA and MIA-Efficacy metrics without incurring substantial degradation on RA and TA in different unlearning scenarios. These observations corroborate the findings reported in Tab. 3.
Figure A1: Privacy on  $\mathcal{D}_{\mathrm{r}}$  (MIA-Privacy) using different unlearning methods vs. model sparsity.
Table A3: MU performance vs. sparsity on additional datasets (CIFAR-100 [43] and SVHN [45]) for both class-wise forgetting and random data forgetting. The content format follows Tab. 3.
MU	UA	MIA-Efficacy	RA	TA	RTE (min)
DENSE	95% Sparsity	DENSE	95% Sparsity	DENSE	95% Sparsity	DENSE	95% Sparsity
Class-wise forgetting, CIFAR-100
Retrain	100.00±0.00	100.00±0.00	100.00±0.00	100.00±0.00	99.97±0.01	96.68±0.15	73.74±0.19	69.49±0.41	48.45
FT	26.45±6.29 (73.55)	73.63±5.06 (26.37)	92.44±5.93 (7.56)	98.88±4.32 (1.12)	99.86±0.04 (0.11)	97.72±0.47 (1.04)	74.08±0.23 (0.74)	71.37±0.18 (3.00)	3.76
GA	81.47±0.32 (18.53)	99.01±0.01 (0.99)	93.47±4.56 (6.53)	100.00±0.00 (0.00)	90.33±1.71 (9.64)	80.45±0.78 (16.23)	64.94±0.74 (8.80)	60.99±0.14 (8.50)	0.21
IU	84.12±0.34 (15.88)	99.78±0.01 (0.22)	98.44±0.45 (1.56)	99.33±0.00 (0.67)	96.23±0.02 (3.74)	95.45±0.17 (1.23)	71.24±0.22 (2.50)	70.79±0.11 (0.95)	4.30
Random data forgetting, CIFAR-100
Retrain	24.76±0.12	27.64±1.03	49.80±0.26	44.87±0.81	99.98±0.02	99.24±0.02	74.46±0.08	69.78±0.15	48.70
FT	0.78±0.34 (23.98)	8.37±1.63 (19.27)	1.13±0.40 (48.67)	18.57±1.57 (26.30)	99.93±0.02 (0.05)	99.20±0.27 (0.04)	75.14±0.09 (0.68)	73.18±0.30 (1.60)	3.74
GA	0.04±0.02 (24.75)	3.92±0.28 (23.72)	3.80±0.87 (46.00)	7.51±1.37 (37.36)	99.97±0.01 (0.01)	98.40±0.22 (0.84)	74.07±0.11 (0.39)	72.19±0.15 (2.41)	0.24
IU	1.53±0.36 (23.23)	6.01±0.17 (21.63)	6.58±0.42 (43.22)	11.47±0.54 (33.40)	99.01±0.28 (0.97)	96.53±0.24 (2.71)	71.76±0.31 (2.70)	69.40±0.19 (0.38)	3.80
Class-wise forgetting, SVHN
Retrain	100.00±0.00	100.00±0.00	100.00±0.00	100.00±0.00	100.00±0.00	100.00±0.00	95.71±0.12	94.95±0.05	42.84
FT	11.48±8.12 (88.52)	51.93±19.62 (48.07)	86.12±9.62 (13.88)	99.42±5.51 (0.58)	100.00±0.00 (0.00)	99.00±0.00 (1.00)	95.99±0.07 (0.28)	95.89±0.02 (0.94)	2.86
GA	83.87±0.19 (16.13)	86.52±0.11 (13.48)	99.97±0.02 (0.03)	100.00±0.00 (0.00)	99.60±0.15 (0.40)	98.37±0.11 (1.63)	95.27±0.02 (0.44)	93.42±0.07 (1.53)	0.28
IU	95.11±0.02 (4.89)	100.00±0.00 (0.00)	99.89±0.04 (0.11)	100.00±0.00 (0.00)	100.00±0.00 (0.00)	99.85±0.02 (0.15)	95.70±0.09 (0.01)	94.90±0.04 (0.35)	3.19
Random data forgetting, SVHN
Retrain	4.89±0.11	4.78±0.23	15.38±0.14	15.25±0.18	100.00±0.00	100.00±0.00	95.54±0.09	95.44±0.12	42.71
FT	3.56±0.27 (1.33)	3.97±0.20 (0.81)	10.05±0.24 (5.33)	10.87±0.13 (4.38)	99.89±0.04 (0.11)	98.57±0.09 (1.43)	93.55±0.12 (1.99)	93.54±0.17 (1.90)	2.73
GA	0.99±0.42 (3.90)	2.68±0.53 (2.10)	3.07±0.53 (12.31)	9.31±0.48 (5.94)	99.43±0.22 (0.57)	97.83±0.43 (2.17)	94.03±0.21 (1.51)	93.33±0.27 (2.11)	0.26
IU	3.48±0.13 (1.41)	5.62±0.48 (0.84)	9.44±0.27 (5.94)	12.28±0.41 (2.97)	96.30±0.08 (3.70)	95.67±0.15 (4.33)	91.59±0.11 (3.95)	90.91±0.26 (4.53)	3.21