SlowGuess/NeurIPS_2023_OCR huggingface dataset:
The attacker is a binary classifier that takes as input loss values, coming from either the forget set  $\mathcal{D}_f$  or a held-out test set  $\mathcal{D}_t$ , and predicts whether the example whose loss value was presented was in the training set of the original model. We train this attacker via supervised learning on a class-balanced labelled training set for this binary problem:  $\mathcal{D}_{train}^b = \{(l(x_i,y_i),y_i^b)\}$  where each  $x_{i}$  is an example coming either from  $D_{f}$  or  $D_{t}$ , and its binary label  $y_{i}^{b}$  is defined as being 0, if  $x_{i}\in \mathcal{D}_{t}$  and 1 if  $x_{i}\in \mathcal{D}_{f}$ . Once the binary classifier attacker is trained, we use it to make predictions for a held-out evaluation set of the binary problem:  $\mathcal{D}_{eval}^{b} = \{(l(x_{i},y_{i}),y_{i}^{b})\}$  that is also balanced between examples coming from  $\mathcal{D}_f$  and  $\mathcal{D}_t$ , but is disjoint from  $\mathcal{D}_{train}^{b}$ .
The attacker succeeds if it achieves high accuracy on  $\mathcal{D}_{eval}^{b}$ , meaning that it can tell apart examples that were part of the original training set from those that weren't, which marks a defeat for the unlearning model in terms of this metric, since it has 'left traces behind' (in this case, in terms of loss values) and leaks information about membership in the forget set. We consider that an optimal defense against this MIA corresponds to a  $50\%$  attack accuracy; that is, no better than randomly guessing whether an example had been trained on. In principle, the Retrain oracle should defend optimally: it in fact did not train on the forget set, so the forget and test sets are simply two different held-out sets for this model whose loss values should generally be indistinguishable from each other if these sets are identically-distributed. We find in our experiments, presented in the main paper, that SCRUB+R is able to defend this MIA comparably to Retrain, and outperforms the other baselines in its ability to consistently do so.
Experimental details In practice, if the distribution of the forget set and the test set are very different from each other, their loss values will be very distinguishable. This means that the binary classifier can tell them apart easily, but without having truly learned to infer membership in the
Figure 4: ROC curves for the strong LiRA-for-unlearning attack (Area Under the Curve (AUC) is also reported in the legend, for each unlearning method). Different subplots correspond to different target models (we trained the target unlearned model 5 times for each unlearning method, using different random seeds, and different forget sets). Positives are examples in the forget set, and negatives in the test set. A true positive means that the attacker correctly identified that an example was forgotten, whereas a false positive means that it incorrectly predicted that a test example was forgotten. We are primarily interested in the area of small False Positive Rate [Carlini et al., 2022] and a good unlearning method is associated with a smaller True Positive Rate, i.e. fewer successes for the attacker, especially in the region of interest. We observe that SCRUB(+R) defends the strong LiRA-for-unlearning attack more successfully than the other baselines.
training dataset. This makes the attacker's evaluation unreliable. To circumvent this problem, we ought to pick the held-out test set from the same distribution. More specifically, if the forget set is examples from the 'cat' class of CIFAR10 dataset, we use the same class for our held-out test set.
In our experiments, we clip the loss values to a range between  $[-400, +400]$  to remove anomalies. Also, we use the default LogisticRegression() classifier of the Python's scikit-learn library as our attack model, and perform a cross-validation with 5 random splits. We report the average accuracy of the evaluation part of each of the 5 folds as the MIA score. Ideally (for a perfect defense), this score is closest to  $50\%$ , indicating that the attacker fails to tell apart the forget set from the test set.
We present additional results for the Basic MIA attack in Section 16.
11.2 LiRA-for-unlearning attack
In the standard privacy setting, the LiRA attacker [Carlini et al., 2022] trains a large number of 'shadow models' [Shokri et al., 2017], for which it controls which examples are in the training set each time (by construction). To then predict the membership status of a 'target example', it estimates two Gaussian distributions, using the shadow models: the distribution of confidences of that example under shadow models that trained on it, and the distribution of its confidences under shadow models that didn't. Then, it computes the confidence of the target example under the target model and it predicts that the target example was 'in' if the likelihood of the target confidence under the former Gaussian is larger than that under the latter Gaussian.
Adapting LiRA to the framework of unlearning is not trivial, and we are not aware of this done in any previous work. We propose the first, to our knowledge, adaptation of LiRA for unlearning. This is a strong attack where we allow the attacker knowledge of the unlearning algorithm. Concretely, for each shadow model, the attacker also produces a 'shadow unlearned' model by applying the given unlearning algorithm several times, using a large number of forget sets (similar to Chen et al. [2021]). Now, for each 'target example', this setup allows the attacker to estimate a different pair of Gaussians: the distribution of (confidences of) that target example under models where it was forgotten, and as before, under models where it was not seen. The attacker then computes the confidence of the target example under the target model, and predicts the example was forgotten if its likelihood under the former is larger than under the latter.
Experimental setup: overview We run our LiRA-for-unlearning attack on selective unlearning on CIFAR-10, for the scenario where the forget set has size 200 and comes from class 5.
Attacker: For the attacker, we first train 256 'shadow original' models on random splits of half of the CIFAR-10 training set. Let  $D$  denote the original dataset. To train each shadow model, we split  $D$  in half, and use one half to as the 'training set' and the other half as the 'test set' of that particular shadow model. Then, for each of these 'shadow original' models, we run unlearning on 10K different forget sets (for each unlearning method). Specifically, the forget set is a random subset of 200 examples of class 5, sampled from the training set of the corresponding 'shadow original' model. After this procedure, for every example in class 5, we select 256 associated shadow models when it was not included in training, and 256 shadow models when it was unlearned (i.e. it was in the forget set). After this, the LiRA attack proceeds as normal, where we take each in / out distribution and apply a likelihood ratio test on an unknown example to infer membership.
Defender: We next train the target model that LiRA-for-unlearning will attack. For this, we begin by training the 'original' model, on (a
random split of) half of  $D$ . Then, we apply the given unlearning algorithm on a randomly-sampled forget set, which is a subset of the original model's training set of size 200, coming from class 5, in the same way as was done by the shadow models.
Figure 5: Sensitivity of SCRUB to  $\gamma$  and  $\alpha$ . To create this plot, we ran SCRUB many times for different values of  $\gamma$  ([0.1, 0.5, 1, 2, 3]) and  $\alpha$  ([0.1, 0.5, 1, 2, 3]). The x-axis is represents combinations of these values. t-error, f-error and r-error refer to test, forget and retain error, respectively. We find that SCRUB is not very sensitive to these hyperparameters: the retain error remains low across values, and there are several different settings to these hyperparameters for which we can obtain the desired results for test and forget errors too.
Implementation note We run this attack at a much larger scale than the remaining experiments of the paper (we run 10K unlearning runs, on different forget sets, for each of the 256 'shadow original' models). We do this because the strength of the attacker is heavily dependent on the number of shadow original/unlearned models, and we wanted to benchmark our baselines against a very strong attacker. Therefore, to allow better scaling, instead of implementing SCRUB+R as rewinding, we implement it through filtering runs of SCRUB that don't satisfy the condition of SCRUB+R that the forget set error should be close to the validation error (where, as explained in the main paper, this refers to the validation set that is constructed to have the same distribution as the forget set; containing examples of only the same class as the one in the forget set). We used 0.1 as our threshold.
Computing the 'confidence' Consistent with [Carlini et al., 2022], the confidence of an example  $(x,y)$  (where  $y$  denotes the ground-truth class label) is defined as  $\mathrm{softmax}(f(x))[y]$ . In words, the confidence is the softmax probability of the correct class. Following Carlini et al. [2022], we apply logit-scaling to each confidence, to make their distributions Gaussian.
Conclusions and findings Figure 4 plots the ROC curve, showing the False Positive Rate and True Positive Rate of the attacker, in log-log scale. Different subplots correspond to different target unlearned models, each of which was trained with a different random seed, and different retain/forget set split. A successful defense is associated with a smaller Area Under the Curve (AUC); meaning fewer True Positives for the attacker. Carlini et al. [2022] however advocate that the AUC is not a good indicator of the attacker's strength and, instead, they argue that we should primarily consider the region of the ROC curve associated with very small False Positive Rates. We observe that, especially in that region, SCRUB(+R) is the strongest method in terms of defending our LiRA-for-unlearning attack (and also we observe that SCRUB(+R) has the best AUC too). The improved NegGrad+ baseline that we also proposed in this paper is also a strong model in terms of defending this attack.
(a) Only max steps (Equation 1).
(c) SCRUB with too many max steps.
Figure 6: Illustration of training dynamics of SCRUB variants, on CIFAR-5 with a ResNet model. Performing the right interleaving of min-steps and max-steps is important for achieving a good balance between high forget error and low retain and validation errors.
(b) SCRUB with insufficient max steps.
(d) SCRUB.
We found that CF-k is not able to improve the privacy of the original model in most cases, while EU-k can sometimes improve but only slightly, and not reliably.
**Limitations** To stay consistent with previous work on unlearning, as mentioned previously, we turn off data augmentations. Consequently, the 'original model' (before unlearning is applied) has overfitted more than a state-of-the-art CIFAR model would. Indeed, as can be seen from Figure 4, the 'Original' model has poor privacy (the attacker has a high True Positive Rate). We note that this is the first, to our knowledge, investigation of privacy of unlearning algorithms using strong MIAs, and we hope that future work continues to investigate increasingly more realistic scenarios with models closer to the state-of-the-art, and considers unlearning on original models of varying degrees of privacy and generalization ability.
12 Ablations and Sensitivity Analysis
In this section, we illustrate the training dynamics of SCRUB and the importance of different design choices. As a reminder, the student is initialized from the teacher and subsequently undergoes an alternating sequence of max-steps and min-steps; the former encouraging the student to move far from the teacher on the forget set, and the latter encouraging it to stay close to the teacher on the retain set. We also found it useful to perform a sequence of additional min-steps after the alternating sequence. We now explore the effect of these decisions.
First, we show that performing only max-steps, by optimizing Equation 1, is not a good solution. Simply pushing the student away from the teacher on the forget set achieves forgetting but unfortunately also hurts the retain and validation set performance (Figure 6a). Therefore, alternating between max-steps and min-steps is necessary. However, it is important to find the right balance. For instance, as seen in Figure 6b, performing too few max-steps leads to the unwanted consequence of the forget error dropping. On the other hand, removing the final sequence of only min-steps is also harmful, as shown in Figure 6c that trains for a larger number of epochs of an equal number of (alternating) max-steps and min-steps without achieving a good balance at any point throughout the trajectory. On the other hand, SCRUB (Figure 6d) achieves a good balance of high forget error and low retain and validation error simultaneously. We also ablate the cross-entropy term in Equation 3, which provides a small but consistent added protection against degrading performance in Figure 10. We show additional examples of training dynamics (Figures 7, 8, 9).
(a) Performing only max steps (Equation 1).
(c) SCRUB with too many max steps.
Figure 7: Illustration of training dynamics of SCRUB variants, on CIFAR-5 with All-CNN. Performing the right interleaving of min-steps and max-steps is important for achieving a good balance between high forget error and low retain and validation errors.
Table 4: Results for class-unlearning. Class-0 (400 examples) of Cifar-100 (40k examples). The numbers are averaged over 3 runs.
Model	Test error (↓)	Retain error (↓)	Forget error (↑)	Basic MIA
mean	std	mean	std	mean	std	mean	std
Original	35.84	0.76	0.07	0.02	0.00	0.00	61.67	16.20
Retrain	36.92	1.02	0.09	0.06	100.00	0.00	55.67	34.09
NegGrad+	43.16	3.13	6.86	5.16	49.50	12.79	64.67	18.07
Bad-T@epoch1	44.14	1.84	8.78	2.08	63.83	24.64	61.67	20.57
Bad-T@epoch10	43.33	1.27	7.74	3.21	85.33	4.18	63.33	28.15
SCRUB+R	37.60	1.18	0.12	0.10	100.00	0.00	57.33	28.99
SCRUB	38.27	3.08	0.78	2.47	100.00	0.00	48.33	12.25
Finally, we also investigate the sensitivity of SCRUB's results on the  $\gamma$  and  $\alpha$  hyperparameters, in Figure 5. We find that SCRUB is not very sensitive to these hyperparameters: the retain error remains low across values, and there are several different settings to these hyperparameters for which we can obtain the desired results for test and forget errors too.
13 Larger-scale Settings
In this section, we scale up to an even larger setting, by choosing a larger model and performing a larger classification task. The experiments here are conducted on VGG16+BN with almost 138M parameters, and CIFAR-100, with varying forget set sizes. The results are reported in Table 4 and Table 5. Furthermore, for these experiments we train Bad-T for different number of iterations (recall that Bad-T originally proposes 1 epoch of unlearning) to study if its performance would improve with longer iterations. The results suggest that, again, SCRUB is consistently among the top performers across all the metrics. Furthermore, the results show that longer iterations does not improve Bad-T in any of the metrics.
(a) Performing only max steps (Equation 1).
(b) SCRUB with insufficient max steps.
(c) SCRUB with too many max steps.
(d) SCRUB.
Figure 8: Illustration of training dynamics of SCRUB variants, on Lacuna-5 with ResNet. Performing the right interleaving of min-steps and max-steps is important for achieving a good balance between high forget error and low retain and validation errors.
(a) Performing only max steps (Equation 1).
(c) SCRUB with too many max steps.
Figure 9: Illustration of training dynamics of SCRUB variants, on Lacuna-5 with All-CNN. Performing the right interleaving of min-steps and max-steps is important for achieving a good balance between high forget error and low retain and validation errors.
(a) CIFAR-5 with ResNet.
(c) Lacuna-5 with ResNet.
(b) CIFAR-5 with All-CNN.
(d) Lacuna-5 with All-CNN.
Figure 10: Effect of adding the cross-entropy loss in Equation 3. Dashed lines omit cross-entropy while solid lines use it. We find that the addition of cross-entropy offers an additional protection to maintaining the model's performance during the unlearning procedure. This sometimes comes at the cost of smaller forget set error, compared to the forget set error that would have been achieved if cross-entropy was omitted from the loss.
Table 5: Results for selective unlearning. 10 examples from class-0 of Cifar-100 dataset. The numbers are averaged over 10 runs.
Forget Size	Model	Test error (↓)	Retain error (↓)	Forget error (↑)	Basic MIA
mean	std	mean	std	mean	std	mean	std
10	Original	37.46	4.99	0.54	1.74	0.00	0.00	58.00	9.10
Retrain	37.54	5.24	0.57	1.84	19.00	15.81	45.00	19.04
NegGrad+	45.98	6.79	11.64	12.02	44.00	11.15	55.00	23.88
Bad-T@epoch1	47.23	5.76	13.79	10.28	66.00	18.22	62.00	30.20
Bad-T@epoch10	47.09	5.65	13.80	9.79	96.00	8.07	77.00	17.25
SCRUB+R	38.40	4.70	0.69	2.07	40.00	13.33	61.00	17.59
SCRUB	38.18	4.78	0.48	1.44	45.00	13.60	56.00	19.76
20	Original	37.46	4.99	0.54	1.74	0.00	0.00	63.00	10.96
Retrain	37.74	5.31	0.56	1.77	19.50	12.00	49.00	11.47
NegGrad+	45.56	7.00	11.14	12.57	47.00	9.89	67.50	13.94
Bad-T@epoch1	46.46	6.28	12.95	11.71	55.50	16.20	55.00	21.59
Bad-T@epoch10	45.88	5.70	12.03	9.44	92.00	10.25	70.00	10.87
SCRUB+R	38.39	4.63	0.68	2.00	23.00	8.70	49.50	11.68
SCRUB	38.29	4.61	0.49	1.42	29.00	16.28	54.50	18.54
Model	CIFAR-10	Lacuna-10
ResNet	All-CNN	ResNet	All-CNN
class	selective	class	selective	class	selective	class	selective
Finetune	3.8	3.09	3.33	3.03	1.7	2.03	2.16	2.00
Fisher	0.08	0.07	0.16	0.14	0.08	0.07	0.16	0.15
NegGrad+	3.4	2.96	2.30	2.97	1.66	1.5	2.41	2.27
CF-k	3.55	3.17	3.37	2.91	3.42	3.20	3.27	3.11
EU-k	1.41	1.26	1.34	1.20	1.39	1.28	1.32	1.26
Bad-T	19.07	20.44	17.91	17.03	20.05	20.27.	16.32	16.02
SCRUB	7.84	7.41	6.36	5.33	2.17	1.95	2.81	2.48
Table 6: Scale-up factor: the fraction of the runtime of retrain from scratch over the runtime of each given unlearning algorithm. That is, a scale-up value of X for an unlearning algorithm means that that algorithm runs X times faster than retrain from scratch.
Model	CIFAR-5	Lacuna-5
Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std	Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std
Retrain	24.9	2.5	0.0	0.0	28.8	5.9	5.8	0.4	0.0	0.0	4.8	3.4
Original	24.2	2.6	0.0	0.0	0.0	0.0	5.7	0.4	0.0	0.0	0.0	0.0
Finetune	24.3	2.4	0.0	0.0	0.0	0.0	5.6	0.3	0.0	0.0	0.0	0.0
Fisher	31.6	3.4	14.0	6.0	4.8	5.2	14.0	3.6	6.7	3.3	6.4	8.3
NTK	24.4	2.6	0.0	0.0	22.4	9.2	5.6	0.5	0.0	0.0	0.0	0.0
NegGrad+	25.5	1.1	0.0	0.0	41.3	6.1	6.1	0.7	0.0	0.0	1.3	2.3
CF-k	22.6	1.9	0.0	0.0	0.0	0.0	5.8	0.4	0.0	0.0	0.0	0.0
EU-k	23.5	1.1	0.0	0.0	10.7	2.3	5.9	0.6	0.0	0.0	0.0	0.0
Bad-T	27.73	1.89	5.12	1.56	8.00	8.64	5.00	0.33	0.14	0.10	0.00	0.00
SCRUB	24.2	1.6	0.0	0.0	40.8	1.8	6.2	0.73	0.0	0.0	24.8	5.2
14 Additional Results for Removing Biases (RB)
In this section, we provide the results for all scenarios we studied for the Removing Biases (RB) application for ResNet and All-CNN, on both CIFAR and Lacuna, for both small-scale and large-scale, for completeness, in Tables 7, 8, 9, 10, 11, 12.
Table 7: Small-scale results with ResNet for the Removing Biases (RB) application. SCRUB is the top-performer in terms of forgetting with minimal performance degradation.
Model	CIFAR-5	Lacuna-5
Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std	Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std
Retrain	24.36	1.61	0.13	0.28	28.8	9.12	4.6	0.38	0.0	0.0	4.67	6.41
Original	24.08	1.86	0.17	0.38	0.0	0.0	4.53	0.47	0.0	0.0	0.0	0.0
Finetune	23.48	1.91	0.04	0.09	0.0	0.0	9.77	10.76	6.63	13.22	19.33	40.03
Fisher	42.64	6.56	31.83	10.47	15.2	16.83	52.53	13.87	51.09	14.54	39.33	40.43
NTK	24.16	1.77	0.17	0.38	13.6	8.29	4.47	0.47	0.0	0.0	3.33	4.68
NegGrad+	26.07	1.21	0.56	0.49	36.00	10.58	5.27	0.76	0.14	0.12	12.00	13.86
CF-k	22.67	1.55	0.00	0.00	0.00	0.00	4.67	0.70	0.00	0.00	0.00	0.00
EU-k	25.87	0.64	3.23	1.69	8.00	6.93	5.20	0.20	0.00	0.00	0.00	0.00
Bad-T	25.87	1.80	9.68	0.45	10.67	4.99	8.87	0.66	2.32	0.79	0.00	0.00
SCRUB	23.88	1.78	0.08	0.12	40.8	8.2	3.87	0.72	0.0	0.0	25.33	4.13
Table 8: Small-scale results with All-CNN for the Removing Biases (RB) application. SCRUB is the top-performer in terms of forgetting with minimal performance degradation.
Model	CIFAR-10	Lacuna-10
Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std	Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std
Retrain	14.72	0.16	0.0	0.0	100.0	0.0	2.87	0.34	0.0	0.0	99.75	0.56
Original	16.56	0.1	0.0	0.0	0.0	0.0	3.07	0.26	0.0	0.0	0.0	0.0
Finetune	16.41	0.09	0.0	0.0	0.0	0.0	3.02	0.37	0.0	0.0	0.0	0.0
Fisher	26.42	1.41	2.45	0.84	100.0	0.0	3.33	0.54	0.0	0.0	100.0	0.0
NegGrad+	17.84	1.46	1.74	2.55	91.26	7.73	3.41	0.17	0.00	0.00	14.90	1.78
CF-k	15.31	0.12	0.00	0.00	0.03	0.01	2.89	0.22	0.00	0.00	0.00	0.00
EU-k	18.73	0.42	0.00	0.00	98.79	0.18	3.19	0.17	0.01	0.02	4.06	0.83
Bad-T	19.56	1.44	11.34	1.82	94.67	6.12	3.37	0.50	1.06	0.47	67.60	24.26
SCRUB	15.73	0.17	0.51	0.02	100.0	0.0	3.69	0.36	0.28	0.23	100.0	0.0
Table 9: Large-scale, class unlearning results with ResNet for the Removing Biases (RB) application. SCRUB and EU-k are the top-performers in this setting in terms of forgetting with minimal performance degradation. Note, however, that EU-k doesn't perform strongly across the board and in particular performs very poorly in selective unlearning (notice the contrast between EU-k's forget error between Figures 1a and 1b Fisher is also a top-performer in terms of forget error in this setting too, but on CIFAR causes a large degradation in test error, as is often observed for this method.
Model	CIFAR-10	Lacuna-10
Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std	Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std
Retrain	13.97	0.19	0.0	0.0	100.0	0.0	1.59	0.36	0.0	0.0	100.0	0.0
Original	15.56	0.25	0.0	0.0	0.0	0.0	1.56	0.33	0.0	0.0	0.0	0.0
Finetune	15.39	0.22	0.0	0.0	0.0	0.0	1.67	0.44	0.0	0.0	0.0	0.0
Fisher	27.4	2.28	3.66	1.03	99.0	0.0	1.78	0.29	0.0	0.0	89.0	0.0
NegGrad+	17.87	0.31	0.58	0.13	87.22	1.67	1.63	0.17	0.00	0.00	6.56	1.13
CF-k	14.99	0.23	0.00	0.00	0.00	0.00	1.48	0.36	0.00	0.00	0.00	0.00
EU-k	15.30	0.69	0.13	0.14	100.00	0.00	1.74	0.45	0.00	0.00	77.19	39.51
Bad-T	16.98	0.40	5.84	0.43	81.93	3.50	2.56	0.09	0.37	0.18	38.65	36.80
SCRUB	15.06	0.14	0.12	0.03	100.0	0.0	2.0	0.4	0.0	0.0	100.0	0.0
Table 10: Large-scale, class unlearning results with All-CNN for the Removing Biases (RB) application. SCRUB is the top-performer in terms of forgetting with minimal performance degradation.
Model	CIFAR-10	Lacuna-10
Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std	Test error (↓) mean	std	Retain error (↓) mean	std	Forget error (↑) mean	std
Retrain	17.4	0.14	0.0	0.0	29.67	3.21	2.7	0.2	0.0	0.0	1.0	1.0
Original	17.36	0.14	0.0	0.0	0.0	0.0	2.73	0.15	0.0	0.0	0.0	0.0
Finetune	17.37	0.11	0.0	0.0	0.0	0.0	2.63	0.12	0.0	0.0	0.0	0.0
Fisher	21.23	0.27	2.88	0.54	3.0	2.65	3.1	0.35	0.0	0.0	0.0	0.0
NegGrad+	22.7	0.6	4.1	0.5	53.7	6.8	4.7	0.2	0.9	0.1	13.0	1.0
CF-k	17.4	0.1	0.0	0.0	0.0	0.0	2.7	0.2	0.0	0.0	0.0	0.0
EU-k	21.8	0.2	0.4	0.6	23.7	3.5	2.9	0.1	0.0	0.0	0.0	0.0
Bad-T	23.47	1.57	14.53	1.65	34.67	1.70	7.30	2.20	3.26	1.83	0.33	0.47
SCRUB	18.04	0.2	0.0	0.0	70.33	4.16	3.0	0.0	0.0	0.0	4.67	3.06
Table 11: Large-scale, selective unlearning results with ResNet for the Removing Biases (RB) application. SCRUB and NegGrad+ are the top-performers in terms of forgetting, though NegGrad+ has worse test performance than SCRUB in both cases. Note also that NegGrad+ isn't as consistent at forgetting across settings as SCRUB.