Decoupling the Class Label and the Target Concept in Machine Unlearning

## Abstract

Abstract Machine unlearning as an emerging research topic for data regulations, aims to adjust a trained model to approximate a retrained one that excludes a portion of training data. Previous studies showed that class-wise unlearning is successful in forgetting the knowledge of a target class, through gradient ascent on the forgetting data or fine-tuning with the remaining data. However, while these methods are useful, they are insufficient as the class label and the target concept are often considered to coincide. In this work, we expand the scope by considering the label domain mismatch and investigate three problems beyond the conventional all matched forgetting, e.g., target mismatch , model mismatch , and data mismatch forgetting. We systematically analyze the new challenges in restrictively forgetting the target concept and also reveal crucial forgetting dynamics in the representation level to realize these tasks. Based on that, we propose a general framework, namely, TARget-aware Forgetting (TARF). It enables the additional tasks to actively forget the target concept while maintaining the rest part, by simultaneously conducting annealed gradient ascent on the forgetting data and selected gradient descent on the hard-to-affect remaining data. Empirically, various experiments under the newly introduced settings are conducted to demonstrate the effectiveness of our TARF.

## 1 Introduction

In response to data regulations , e.g., “the right to be forgotten” ,
machine unlearning ; ; has emerged to eliminate the influence of training data from a trained model ; .
The intuitive goal is to forget the specific data as if the model had never used it during training . To achieve that, a direct way  is to retrain the model from scratch by excluding the data to be unlearned, which is called exact unlearning. Considering its computational cost, prior works proposed approximate unlearning ; to efficiently adjust the trained model for forgetting and approximate the behaviors of the retrained one. Recent studies ; ; ; showed that class-wise unlearning is successful in forgetting the knowledge of a training class, through reverse optimization ; ; on the class data or fine-tuning on the remaining data ; to realize catastrophic forgetting ; .

Despite the promising achievements, the previously studied scenario ; ; ; ; mainly assumed the target concept to coincide with the class label, overlooking that the practical unlearning request ; ; ; may violate the taxonomy of the pre-training tasks. In this work, we decouple them by considering the different label domains of the forgetting data $\mathcal{L}_{D}$, the model output $\mathcal{L}_{M}$, and the target concept $\mathcal{L}_{T}$ in unlearning. Given the relation defined for two label domains, e.g., being match $\mathcal{L}_{1}=\mathcal{L}_{2}$, superclass $\mathcal{L}_{1}\succ\mathcal{L}_{2}$, and subclass $\mathcal{L}_{1}\prec\mathcal{L}_{2}$, we introduce four practical scenarios. Assuming that the reported forgetting data should be included in the target concept, e.g., $\mathcal{L}_{D}\preceq\mathcal{L}_{T}$, we have all matched $\mathcal{L}_{D}=\mathcal{L}_{T}=\mathcal{L}_{M}$; target mismatch $\mathcal{L}_{D}=\mathcal{L}_{M}\prec\mathcal{L}_{T}$; model mismatch $\mathcal{L}_{D}=\mathcal{L}_{T}\prec\mathcal{L}_{M}$; and data mismatch $\mathcal{L}_{D}\prec\mathcal{L}_{T}=\mathcal{L}_{M}$. We further illustrated four instantiated tasks in Figure 1, using the CIFAR-100  dataset with its classes and superclass.

Figure: Figure 1: Illustrations of decoupling the class label and the target concept.
Refer to caption: x1.png

Investigating the aforementioned tasks, we identify new challenges in restrictive unlearning with the mismatched label domains (refer to Figure 2).
Unlike the accurate approximation in the conventional all matched task ; ; , the representative unlearning methods ; exhibit different performance gap with the retrained reference in the other tasks. Specifically, the under-entangled feature representation (when $\mathcal{L}_{M}\prec\mathcal{L}_{T}$) or the under-representative forgetting data (when $\mathcal{L}_{D}\prec\mathcal{L}_{T}$) results in insufficient forgetting, while the entangled feature representation (when $\mathcal{L}_{T}\preceq\mathcal{L}_{M}$) prevents the decomposition of target concept with the retaining part. The former requires target identification in the remaining training set, while the latter requires target separation over the entangled feature representation. Through exploration of forgetting dynamics (refer to Figure 3), we demonstrate the feature distance reflected by representation gravity is a crucial factor for the feasibility of these tasks.

Based on the above analysis, we propose a novel framework, namely, TARget-aware Forgetting (TARF). In general, we consider two parts (refer to Eq. (5)), i.e., annealed forgetting and target-aware retaining, which collaboratively enable the target identification and separation (refer to Figure 4) for these forgetting tasks.
Specifically, the algorithmic framework (refer to Figure 5) incorporates an annealed gradient ascent and target-aware gradient descent in a dynamical manner, which can be viewed as three phases. The first actively unlearns the identified forgetting data, and constructs the contrast information to filter out the remaining data which is hard to be affected. Then, simultaneously learning the selected retaining data with gradient descent deconstructs the entangled feature representation. Ultimately, the learning objective can progressively approach standard retraining using the aligned retaining data.
The main contributions of our work can be summarized as follows,

- •
Conceptually, we introduce new settings that decouple the class label and the target concept, which investigate the label domain mismatch in class-wise unlearning (in Section 3.1).
- •
Empirically, we systematically reveal the challenges of restrictive unlearning with the mismatched label domains, and demonstrate that the representation gravity in forgetting dynamics is critical for achieving the forgetting target in the new tasks (in Section 3.2).
- •
Technically, we propose a general framework, namely, TARF, to realize the target identification and separation in unlearning. It consists of annealed forgetting and target-aware retaining which collaboratively approximate retraining on the retaining data (in Section 3.3).
- •
Experimentally, we conduct extensive explorations to validate the effectiveness of our framework and perform various ablations to characterize algorithm properties (in Section 4).

## 2 Preliminaries

In this section, we briefly introduce the problem settings of class-wise machine unlearning, and compare the differences between ours and the conventional setting considered in the previous research works. More details about the unlearning baselines considered in our work can refer to Appendix C.

Figure: Figure 2: The challenges of restrictive unlearning with the mismatched label domains.
Refer to caption: x2.png

Unlearning basis and objective. Following the literature ; , we mainly consider the multi-class classification  as the original training task for class-wise unlearning. Let $\mathcal{X}\subset\mathbb{R}^{d}$ denote the input space and $\mathcal{Y}=\{1,\ldots,C\}$ denote the label space, where $C$ is the number of classes, the training dataset $\mathcal{D}=\{(x_{i},y_{i})\}^{N}_{i=1}$ consists of two subsets in machine unlearning, e.g., the forgetting dataset $\mathcal{D}_{\text{f}}$ and the retaining dataset $\mathcal{D}_{\text{r}}=\mathcal{D}\backslash\mathcal{D}_{\text{f}}$. Building upon the model $f_{\theta^{*}}:\mathcal{X}\rightarrow\mathcal{Y}$ trained on $\mathcal{D}$ with the loss function $\ell$, the general goal of this problem is to find an unlearned model $\theta^{*}_{\text{un}}$ which approximates the behaviors of the model $\theta^{\mathrm{r}}$ that retrained on $\mathcal{D}_{\text{r}}$,

$$ $\displaystyle\begin{split}\theta_{\text{un}}^{*}=\mathop{\arg\min}\limits_{ \theta}\frac{1}{|\mathcal{D}|}\sum_{(x,y)\sim\mathcal{D}}\mathcal{R}(\theta, \theta^{\mathrm{r}},x,y)\quad\text{s.t.}~{}~{}\theta^{\mathrm{r}}=\mathop{\arg \min}\limits_{\theta}\underbrace{\frac{1}{|\mathcal{D}_{\text{r}}|}\sum_{(x,y) \sim\mathcal{D}_{\text{r}}}\ell(f_{\theta}(x),y)}_{L_{\text{retrain}}},\end{split}$ (1) $$

where $\mathcal{R}$ indicates a general risk measure for model behavior consistency ; , which can be instantiated by comprehensive evaluation metrics ; (e.g., unlearning accuracy (UA), retaining accuracy (RA), and others related to privacy) in experiments to pursue the unlearning efficacy and the model utility. The specific definition of evaluation metrics can be referred to in Section 4.1.

Forgetting target. In previous works ; , the target concept to be forgotten is mainly considered as all matched where $\mathcal{D}_{\text{t}}=\mathcal{D}\{y=y_{\text{f}}\}$ has the same label domains (exactly same labels) with the pre-training task and forgetting data $\mathcal{D}_{\text{f}}=\mathcal{D}\{y=y_{\text{f}}\}$. In contrast, we assume that the target concept can be decoupled from the class label in practical unlearning requests. As illustrated in Figure 1, we further instantiate with three forgetting tasks given $\mathcal{D}_{\text{f}}=\mathcal{D}\{y=y_{\text{f}}\}$ with the superclass labels $\mathcal{Y}^{\prime}$ of $\mathcal{Y}$ (classes): i) model mismatch forgetting, e.g., $\mathcal{D}_{\text{t}}=\mathcal{D}\{y=y_{\text{t}}\}$ and $y_{\text{t}}\subseteq y^{\prime}_{\text{f}}$ where $y^{\prime}_{\text{f}}\in\mathcal{Y}^{\prime}$ given the model trained on $\mathcal{Y}^{\prime}$; ii) target mismatch forgetting, e.g., $\mathcal{D}_{\text{t}}=\mathcal{D}\{y=y^{\prime}_{f}\}$ given the model trained on $\mathcal{Y}$; iii) data mismatch forgetting, e.g., $\mathcal{D}_{\text{t}}=\mathcal{D}\{y=y^{\prime}_{\text{f}}\}$ given the model trained on $\mathcal{Y}^{\prime}$.

Dataset partition. Given the decoupled target concept, we can find that the previous assumptions of $\mathcal{D}_{\text{f}}=\mathcal{D}_{\text{t}}$ and $\mathcal{D}_{\text{r}}=\mathcal{D}\backslash\mathcal{D}_{\text{f}}$ do not strictly hold. In model mismatch forgetting, the former is still held; in target mismatch forgetting and data mismatch forgetting, $\mathcal{D}_{\text{f}}\subseteq\mathcal{D}_{\text{t}}$ and the remaining data $\mathcal{D}_{\text{un}}=\mathcal{D}\backslash\mathcal{D}_{\text{f}}$ include both retaining dataset $\mathcal{D}_{\text{r}}\subseteq\mathcal{D}_{\text{un}}$ and the rest forgetting data $\mathcal{D}_{\text{uf}}=\mathcal{D}_{\text{t}}\backslash\mathcal{D}_{\text{f}}$. Specifically, we assume that the number of classes in $\mathcal{D}_{\text{un}}$ belonging to the target concept $\mathcal{D}_{\text{t}}$ is known in target mismatch forgetting, and the retrained model for every task is trained using $\mathcal{D}_{\text{r}}=\mathcal{D}\backslash\mathcal{D}_{\text{t}}$. More details about dataset partition and unlearning request construction are provided in Appendix D.4.

Figure: (a) Distances in under-entangled representation
Refer to caption: extracted/5667727/fig6_tsne_cifar100_new_3_pre.jpg

## 3 TARF: TARget-aware Forgetting

In this section, we first introduce the motivation and reveal the challenges of restrictive unlearning when the class label and the target concept are decoupled (Section 3.1).
Second, we present systematic exploration through the perspectives of feature representation and forgetting dynamics (Section 3.2).
Lastly, we propose our novel framework, i.e., TARget-aware Forgetting (TARF) (Section 3.3).

### 3.1 Motivation: exploring mismatched taxonomy in unlearning

With the increasing concerns about trustworthiness, the unlearning requests emerged to erase the knowledge about an unwanted set (e.g., the biased  or inappropriate content ) from the trained model, especially in the era of foundation models . Recently, a series of studies ; ; ; ; have several proposals on forgetting a training class of the models, and demonstrated it can be successfully achieved by partially scrubbing the class data or fine-tuning on the retaining data to realize catastrophic forgetting ; , to achieve a state as if the model had never been trained with this class of data. However, a general scenario considered in previous works is that the target concept is aligned with the taxonomy of the pre-training tasks, which may not always hold in practical unlearning requests. This naturally motivates the following research question,

> What if the class labels and target concept do not coincide in unlearning?

To investigate it, we consider different label domains of three critical aspects in class-wise unlearning, i.e., $\mathcal{L}_{D}$ of forgetting data, $\mathcal{L}_{M}$ of model outputs, and $\mathcal{L}_{T}$ of target concepts. Assuming that $\mathcal{L}_{D}\preceq\mathcal{L}_{T}$, we have either $\mathcal{L}_{D}=\mathcal{L}_{T}$ or $\mathcal{L}_{D}\prec\mathcal{L}_{T}$. When $\mathcal{L}_{D}=\mathcal{L}_{T}$, we have all matched if $\mathcal{L}_{D}=\mathcal{L}_{M}$ and model mismatch if $\mathcal{L}_{T}\prec\mathcal{L}_{M}$; When $\mathcal{L}_{D}\prec\mathcal{L}_{T}$, we have target mismatch if $\mathcal{L}_{D}=\mathcal{L}_{M}$ and data mismatch if $\mathcal{L}_{T}=\mathcal{L}_{M}$(^1^11Note that we also provide a detailed discussion in appendix D for all the potential cases, while some (e.g., $\mathcal{L}_{T}\prec\mathcal{L}_{D}$) are impractical and some (e.g., $\mathcal{L}_{M}\prec\mathcal{L}_{T}$) are similar to the major scenarios considered here.). In Figure 2, we conduct the unlearning on the four forgetting tasks as instantiated in Figure 1. As a result, the two representative unlearning methods, e.g., Gradient Ascent (GA) ; and Fine-tuning (FT) show different performance gaps compared with the retrained models except in the conventional setting. It can be found with illustrations that some concept-aligned forgetting data are under-represented by the forgetting data when $\mathcal{L}_{D}\prec\mathcal{L}_{T}$ and some class-aligned remaining data are entangled with the forgetting part when $\mathcal{L}_{T}\prec\mathcal{L}_{M}$, raising the new challenges.

Figure: (a) Target identification: accuracy changes, selection results, unlearning performance
Refer to caption: x16.png

### 3.2 Systematic Exploration on Forgetting Dynamics

The mismatch of label domains affects the construction of model representation in unlearning, which requires us to explore it further to understand the performance gaps as well as the forgetting dynamics.

#### Target or data mismatch.

In both target and data mismatch forgetting, we have $\mathcal{L}_{D}\prec\mathcal{L}_{T}$, which means the forgetting data can be a subset of the target concept, i.e., $\mathcal{D}_{\text{f}}\subset\mathcal{D}_{\text{t}}$. As indicated in Figure 2, partially relying on the forgetting or remaining data can not fully represent the target concept, and leaves concept-aligned data hard to unlearn. We can have the following proposition for $\mathcal{L}_{D}\prec\mathcal{L}_{T}$,

###### Proposition 3.1 (Insufficient representation) .

Given $\mathcal{L}_{D}\prec\mathcal{L}_{T}$ that indicates $\mathcal{D}_{\text{f}}\subset\mathcal{D}_{\text{t}}$, and a cluster center $h^{*}$ of feature representations $h_{x\sim\mathcal{D}_{\text{f}}}(x)$ extracted at the pre-trained model $\theta$, as well
as a distance measure $d(\cdot,\cdot)$, there exist a constant value $\zeta_{1}$ and sample $(x^{u},y^{u})\sim(\mathcal{D}_{\text{t}}\backslash\mathcal{D}_{\text{f}})$ that exhibits weak gravity following the sample $(x,y)\sim\mathcal{D}_{\text{f}}$ on the forgetting dynamic $\epsilon=\mathbb{E}(\ell(f_{\theta}(x),y)-\ell(f_{\theta^{t}}(x),y))$, measured with the model $\theta^{t}$ unlearned from $\theta$ at a time interval $t$,

$$ $(d(h(x^{u}),h^{*})>\sup_{x\sim\mathcal{D}_{\text{f}}}d(h(x),h^{*}))\; \Rightarrow\;|(\ell(f_{\theta}(x^{u}),y^{u})-\ell(f_{\theta^{t}}(x^{u}),y^{u}) )-\epsilon|>\zeta_{1}.$ (2) $$

###### Proposition 3.1 (Insufficient representation) .

#### Model mismatch forgetting.

In this task, we have $\mathcal{L}_{D}=\mathcal{L}_{T}$ while $\mathcal{L}_{T}\prec\mathcal{L}_{M}$.
Regarding the model trained by the superclass, it can be found in Figure 3(b) that the features of forgetting data and class-aligned retaining data are closely entangled, showing that the unlearning of the forgetting data can unavoidably affect the representation of the other part. In contrast, it is also notable in the left-bottom of Figure 2 that the accuracy gap between forgetting data and class-aligned retaining data is expected to be large in the retrained reference. In formal, we summarize the observation as follows,

###### Proposition 3.2 (Decomposition lacking) .

Given $\mathcal{L}_{T}\prec\mathcal{L}_{M}$ that indicates the broader representation region for $\mathcal{D}_{\rm z}:=\mathcal{D}_{\rm r,z}\cup\mathcal{D}_{\rm t}$ within the same class $z$, where the sample $x^{m}\sim(\mathcal{D}_{\rm z}\backslash\mathcal{D}_{\rm f})$ exhibits strong gravity following the forgetting dynamic $\epsilon=\mathbb{E}(\ell(f_{\theta}(x),y)-\ell(f_{\theta^{t}}(x),y))$ with a constant value $\zeta_{2}$,

$$ $(d(h(x^{m}),h^{*})\leq\sup_{x\sim\mathcal{D}_{\rm z}}d(h(x),h^{*}))\; \Rightarrow\;|(\ell(f_{\theta}(x^{m}),y^{m})-\ell(f_{\theta^{t}}(x^{m}),y^{m}) )-\epsilon|<\zeta_{2}.$ (3) $$

###### Proposition 3.2 (Decomposition lacking) .

#### Forgetting dynamics with representation distance.

Despite the issues revealed by previous propositions under label domain mismatch, the forgetting performance varied obviously on different representations. We can find that GA achieves better forgetting efficacy on the data mismatch forgetting as the feature representation of the forgetting data and concept-aligned data is entangled. Through a closer check on the geometry distance of representations and the model behaviors during forgetting in Figure 3, we have the following that reveals a crucial factor for achieving these tasks,

###### Definition 3.3 (Representation gravity) .

Given the empirically demonstrated Proposition 3.1 and Proposition 3.2, we can have the formal indicator $I_{\text{con}}(x,y,\theta)$ to reflect the representation similarity $d(h(x),h^{*})$ in the model $\theta^{t}$, which is a crucial factor for the feasibility of unlearning under mismatch,

$$ $I_{\text{con}}(x,y,\theta)=|\ell(f_{\theta}(x),y)-\ell(f_{\theta^{t}}(x),y)|.$ (4) $$

It is empirically demonstrated in Figure 3 where we present the average representation distance to the cluster center of forgetting data, the corresponding changes in accuracy and loss values show that the smaller the distance in representation level, the similar forgetting dynamics the model would have on prediction. As the Propositions 3.1 and 3.2 reveal the issues of insufficient representation and decomposition missing, we can utilize the representation gravity to identify the other unidentified forgetting data in the remaining set, and reveal the needs of deconstructing the pre-entangled representation by simultaneously considering the forgetting and retaining objectives. On the left panels of Figures 4(a) and 4(b), we show the empirical feasibility of the above two goals.

Figure: Figure 5: Overview of the proposed framework TARF.
Refer to caption: x22.png

###### Definition 3.3 (Representation gravity) .

### 3.3 Algorithm Framework of TARF

Based on the previous analysis, we introduce the whole framework of TARget-aware Forgetting (TARF), to enable the four class-wise unlearning tasks. Given the identified forgetting data, we illustrate the overall process in Figure 5, and introduce its dynamic learning objective as follows:

$$ $\displaystyle\begin{split}L_{\text{TARF}}=\underbrace{k(t)\cdot\bigg{(}-\frac{ 1}{|\mathcal{D}_{\text{f}}|}\sum_{(x,y)\sim\mathcal{D}_{\text{f}}}\ell(f(x),y) \bigg{)}}_{\text{{Annealed Forgetting}}~{}L_{\text{f}}(k)}+\underbrace{\frac{1 }{|\mathcal{D}_{\text{un}}|}\sum_{(x,y)\sim\mathcal{D}_{\text{un}}}\ell(f(x),y )\cdot\tau(x,y,t)}_{\text{{Target-aware Retaining}}~{}L_{\text{u}}(\tau)},\end {split}$ (5) $$

where $k(t)$ serves as an annealing strategy to control the strength of the forgetting part. Along with training, we expect the overall objective to approximate the retraining ones $L_{\text{TARF}}\rightarrow L_{\text{retrain}}$ through,

$$ $\displaystyle\begin{split}L_{\text{f}}(k)\rightarrow 0,\quad L_{\text{u}}(\tau )\rightarrow L_{\text{retrain}},\end{split}$ (6) $$

given the initially provided forgetting data $\mathcal{D}_{\text{f}}$ and the remaining set $\mathcal{D}_{\text{un}}$. Specifically, we design the two dynamic hyperparameters $k(t)$ and $\tau(x,y,t)$ as follows to achieve that,

$$ $k(t)=\frac{k\cdot(T-t-t_{0})}{T},\quad t\in[0,T];\quad\tau(x,y,t)=\left\{ \begin{aligned} 0&&&I_{\text{con}}(x,y,\theta_{t_{1}})>\beta~{}\text{or}~{}t<t _{1},\\ 1&&&I_{\text{con}}(x,y,\theta_{t_{1}})<\beta~{}\text{and}~{}t\geq t_{1},\end{ aligned}\right.$ (7) $$

where $T$ indicates the total training time (e.g., epochs), and the value of $k(t)$ decreases with the training process, $\beta$ can be estimated by the information of forgetting dynamics about the specific unlearning request and the rank of loss values at $t_{1}$, $t_{0}$ and $t_{1}$ respectively control the end time of active forgetting and the begin time of retaining part. The overall process can be regarded as,

#### Phase I: Target Identification.

Before $t_{1}$, since $\tau(x,y,t)=0$, Eq. (5) can be formalized as,
$L_{\text{TARF-Phase-I}}=k(t)\cdot(-\frac{1}{|\mathcal{D}_{\text{f}}|}\sum_{(x,
y)\sim\mathcal{D}_{\text{f}}}\ell(f(x),y)),$
in which the retaining part is waiting for the dynamic information revealed by this phase. As shown in Figures 3, the concept-aligned forgetting data in $\mathcal{D}_{\text{uf}}$ can be identified due to the similar semantic features with the forgetting data. For the specific selection, we utilize the class label information in our main tasks. In the middle and right of Figure 4(a), we show the selected classes and validate unlearning efficacy with the identification.

#### Phase II: Target Separation.

After phase I, the retaining part is engaged with the forgetting part with the identified data $\mathcal{D}_{\text{uf}}$ and the remaining retaining data $\mathcal{D}_{\text{r}}$.
By simultaneously considering the forgetting and retaining part as Eq. (5), $L_{\text{TARF-Phase-II}}$ encourages the model to deconstruct the target concept and reconstruct the feature representation of the retaining part, which can effectively decouple the pre-entangled feature in the model mismatch forgetting. In the middle of Figure 4(b), we adopt a gradient stop at each layer of target separation to check the position of feature decomposition, showing that unlearning distorts the underlying representation at the deeper layers of the model.

#### Phase III: Retraining Approximation.

After $t_{0}$, we focus on retaining the current model, which approximates the retraining objective as follows,
$L_{\text{TARF-Phase-III}}=\frac{1}{|\mathcal{D}_{\text{un}}|}\sum_{(x,y)\sim
\mathcal{D}_{\text{un}}}\ell(f(x),y)\cdot\tau(x,y,t),$
where we use $\tau$ at $t_{1}$ to indicate the identified hard-to-effect retaining data, and continually reconstruct the representations. Since the general goal of unlearning considered in our work is similar to retraining, this phase can prevent excessive forgetting. In the right of Figure 4(b), we compare the performance using different lengths of this phases with the retrained reference,

## 4 Experiments

In this section, we present the comprehensive experimental results. To begin with, we introduce the basic setups for the unlearning and the evaluation (Section 4.1). Then, we validate the effectiveness of our method in four unlearning scenarios with the decoupled class label and the target concept (Section 4.2). To better understand its properties, we conduct various experiments on the ablation study and provide further discussions (Section 4.3). More details and results are provided in Appendix F.

### 4.1 Experimental Setup

#### Datasets and models.

In our experiments, we explore machine unlearning for the conventional image classification tasks . Since the introduced unlearning settings need a coarse-to-fine label structure, we adopt the benchmarked dataset, e.g., CIFAR-10/CIFAR-100  with their superclass information in the major experiments.
Specifically, we train two models based on the original classes and its superclass respectively, and instantiate four tasks (as illustrated in Figure 1) of unlearning with the decoupled class label and the target concept. The detailed information is summarized in Table 6. Following previous works ; ; , we use ResNet-18  as the major architecture to obtain the original trained models with standard learning , and then set it to be the basis for unlearning.

**Table 1: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Bold numbers are superior results. $\downarrow$ indicates smaller values are better. (The complete results under multiple runs are summarized with mean and std values in Appendix F)**
| Type / $\mathcal{D}$ | Dataset | CIFAR-10 | CIFAR-100 |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Method / Metrics | UA | RA | TA | MIA | Gap$\downarrow$ | RTE$\downarrow$ | UA | RA | TA | MIA | Gap$\downarrow$ | RTE$\downarrow$ |
| All matched | Retrained | 0.00 | 99.51 | 94.69 | 100.00 | - | 43.3 | 0.00 | 97.85 | 76.03 | 100.00 | - | 43.2 |
| FT | 1.07 | 98.62 | 92.36 | 100.00 | 1.07 | 4.43 | 0.67 | 96.32 | 72.34 | 100.00 | 1.47 | 5.02 |  |
| RL | 4.13 | 97.65 | 91.23 | 100.00 | 2.36 | 4.88 | 1.00 | 96.09 | 72.00 | 100.00 | 1.70 | 4.96 |  |
| GA | 0.49 | 95.24 | 88.17 | 99.78 | 2.88 | 0.25 | 1.33 | 94.74 | 68.56 | 99.89 | 3.01 | 0.06 |  |
| IU | 0.22 | 88.15 | 82.38 | 99.96 | 5.99 | 0.45 | 0.00 | 37.61 | 29.58 | 100.00 | 26.67 | 0.51 |  |
| BS | 25.04 | 87.94 | 80.90 | 88.67 | 15.43 | 0.82 | 12.88 | 97.11 | 68.66 | 99.33 | 5.42 | 0.78 |  |
| $L_{1}$-sparse | 0.00 | 94.20 | 89.77 | 100.00 | 2.56 | 4.39 | 0.00 | 82.00 | 65.08 | 100.00 | 6.70 | 4.39 |  |
| SalUn | 0.00 | 91.32 | 86.87 | 100.00 | 4.00 | 5.65 | 0.0 | 75.34 | 62.14 | 100.00 | 9.10 | 5.75 |  |
| SCRUB | 0.00 | 12.92 | 12.92 | 0.00 | 67.09 | 2.88 | 0.00 | 99.98 | 76.75 | 100.00 | 0.71 | 3.23 |  |
| TARF (ours) | 0.00 | 98.23 | 91.95 | 100.00 | 1.01 | 4.21 | 0.00 | 96.90 | 72.53 | 100.00 | 1.11 | 4.68 |  |
| Model<br>mismatch | Retrained | 87.76 | 99.58 | 95.91 | 20.57 | - | 43.8 | 88.22 | 98.58 | 78.50 | 25.78 | - | 43.8 |
| FT | 94.67 | 98.53 | 93.56 | 9.56 | 5.33 | 4.29 | 92.67 | 95.02 | 79.34 | 16.33 | 4.58 | 4.86 |  |
| RL | 53.69 | 97.85 | 92.39 | 96.60 | 28.84 | 4.82 | 80.11 | 95.83 | 79.83 | 99.00 | 21.35 | 4.93 |  |
| GA | 5.76 | 86.99 | 82.20 | 94.98 | 45.68 | 0.25 | 6.78 | 94.83 | 76.96 | 97.78 | 39.68 | 0.06 |  |
| IU | 23.69 | 87.34 | 82.57 | 89.87 | 39.74 | 0.44 | 34.67 | 96.83 | 79.08 | 86.44 | 29.14 | 0.49 |  |
| BS | 10.29 | 50.77 | 49.39 | 95.96 | 62.05 | 0.79 | 18.11 | 95.90 | 72.28 | 95.22 | 37.14 | 0.89 |  |
| $L_{1}$-sparse | 93.11 | 94.76 | 91.63 | 14.44 | 5.15 | 4.24 | 82.11 | 85.17 | 75.22 | 20.00 | 7.15 | 5.00 |  |
| SalUn | 8.91 | 93.95 | 84.38 | 99.32 | 43.69 | 6.04 | 66.33 | 78.83 | 70.78 | 77.00 | 25.15 | 5.97 |  |
| SCRUB | 48.62 | 27.86 | 28.29 | 48.62 | 51.63 | 3.06 | 0.00 | 11.25 | 10.00 | 98.89 | 79.29 | 4.12 |  |
| TARF (ours) | 91.11 | 97.49 | 92.49 | 17.82 | 2.90 | 4.31 | 86.67 | 97.05 | 80.07 | 26.00 | 1.21 | 4.81 |  |
| Target<br>mismatch | Retrained | 0.00 | 99.38 | 93.85 | 100.00 | - | 52.1 | 0.00 | 97.85 | 73.72 | 100.00 | - | 53.2 |
| FT | 50.43 | 98.47 | 91.65 | 50.44 | 25.78 | 4.38 | 58.18 | 96.32 | 72.53 | 46.76 | 28.54 | 5.00 |  |
| RL | 51.25 | 97.56 | 90.90 | 56.23 | 24.95 | 4.79 | 58.89 | 96.05 | 72.20 | 46.98 | 28.81 | 4.93 |  |
| GA | 40.82 | 97.01 | 89.51 | 64.32 | 20.80 | 0.26 | 21.38 | 96.64 | 70.22 | 90.67 | 8.86 | 0.05 |  |
| IU | 44.51 | 88.07 | 81.80 | 58.73 | 27.29 | 0.44 | 30.62 | 37.19 | 29.58 | 63.69 | 42.93 | 0.50 |  |
| BS | 53.62 | 88.65 | 75.39 | 76.33 | 26.62 | 0.82 | 40.44 | 98.32 | 68.66 | 85.16 | 15.20 | 0.97 |  |
| $L_{1}$-sparse | 49.47 | 93.61 | 88.83 | 51.24 | 27.26 | 4.38 | 46.97 | 82.11 | 65.08 | 54.00 | 29.33 | 4.78 |  |
| SalUn | 46.63 | 91.08 | 86.31 | 60.94 | 25.38 | 5.90 | 59.64 | 75.52 | 62.37 | 65.96 | 27.35 | 5.81 |  |
| SCRUB | 43.57 | 3.64 | 3.66 | 56.26 | 62.62 | 2.89 | 59.64 | 99.99 | 75.32 | 44.89 | 29.90 | 3.52 |  |
| TARF (ours) | 0.06 | 97.57 | 90.81 | 100.00 | 1.23 | 4.23 | 0.31 | 97.35 | 73.68 | 100.00 | 0.21 | 4.85 |  |
| Data<br>mismatch | Retrained | 0.00 | 99.54 | 95.56 | 100.00 | - | 52.1 | 0.00 | 98.50 | 80.15 | 100.00 | - | 53.2 |
| FT | 96.79 | 98.49 | 93.26 | 6.48 | 48.41 | 4.32 | 82.62 | 95.66 | 79.77 | 37.24 | 37.15 | 4.93 |  |
| RL | 76.47 | 97.68 | 91.93 | 49.81 | 33.04 | 4.76 | 89.78 | 96.82 | 79.90 | 70.76 | 30.49 | 4.97 |  |
| GA | 8.69 | 96.41 | 90.78 | 93.03 | 5.89 | 0.25 | 6.00 | 97.65 | 79.23 | 98.04 | 2.43 | 0.05 |  |
| IU | 22.84 | 95.50 | 89.54 | 88.57 | 11.08 | 0.44 | 31.51 | 98.96 | 78.20 | 88.09 | 11.46 | 0.48 |  |
| BS | 16.70 | 61.21 | 49.76 | 92.24 | 22.37 | 0.82 | 15.38 | 98.50 | 72.28 | 96.22 | 6.76 | 0.96 |  |
| $L_{1}$-sparse | 95.76 | 94.31 | 91.08 | 9.52 | 48.99 | 4.78 | 84.53 | 85.13 | 75.22 | 17.02 | 46.45 | 5.03 |  |
| SalUn | 51.77 | 93.87 | 90.46 | 63.52 | 24.75 | 5.72 | 72.93 | 78.87 | 71.04 | 54.13 | 36.89 | 5.72 |  |
| SCRUB | 59.46 | 22.55 | 23.13 | 59.46 | 62.35 | 2.94 | 0.00 | 11.61 | 11.00 | 98.90 | 39.29 | 3.68 |  |
| TARF (ours) | 0.00 | 98.17 | 93.09 | 100.00 | 0.96 | 4.22 | 0.00 | 95.01 | 78.98 | 100.00 | 1.17 | 4.78 |  |

#### Evaluation metrics.

The general target of class-wise unlearning considered in this work is to approximate the Retrained model . To give a comprehensive evaluation, we adopt 5 specific evaluation metrics in classification tasks following previous works ; .

Figure: Figure 6: Image generation results of original and unlearned stable diffusion. More results are in Tables 10 and 11.
Refer to caption: extracted/5667727/1_0_sd.png

We utilize Unlearning Accuracy (UA) to evaluate the accuracy of the unlearning targeted subset; Retaining Accuracy (RA) to evaluate the accuracy of the retaining subset; Testing Accuracy (TA) to evaluate the generalization ability of the model; Membership Inference Attack (MIA) to evaluate the efficacy of unlearning by the confidence-based predictor. All the above will be compared with that of the Retrained model and summarized in a "Gap" value (averaged gap with Retrained) to indicate the overall performance (the lower the better), and we also adopt Run-time Efficiency (RTE) to show the computational time cost.

#### Unlearning baselines.

For demonstrating the effectiveness of our methods in the four unlearning scenarios, we consider four representative baselines for comparison with the retrained model (Retrained), e.g., Finetuning (FT) ; , Random Labels (RL) , Gradient Ascent (GA) , Influence Unlearning (IU) , and also consider three recent advanced methods, e..g, Boundary Shrink (BS) , $L_{1}$-sparse unlearning ($L_{1}$-sparse) , Saliency Unlearning (SalUn) , and SCalable Remembering and Unlearning unBound (SCRUB) . All the methods are compared with the same trained models and the training data. We leave more details of baselines in Appendix C.

### 4.2 Main Results

In this part, we present the main comparison results In Table 1 with those considered baselines in the four unlearning tasks, evaluated with the four detailed metrics and the overall performance gap with retrained references.

As the performance reference, all the retrained models (termed Retrained) are trained with the fully aligned retaining data. In general, we can find the previous unlearning methods achieved satisfactory performance on the conventional all matched forgetting, but did not perform well on the other three newly considered tasks with the label domain mismatch. Specifically, since the previous methods partially rely on forgetting data or remaining data, it results in ineffective or excessive forgetting due to the insufficient representation or decomposition missing. For example, FT can retain a similar RA with the Retrained but be less effective in forgetting, while GA reaches the lowest UA across different tasks but sacrifices too much model performance on the retaining dataset. In contrast, our TARF can consistently perform better (or comparable with the best method) through simultaneous gradient ascent and target-aware gradient descent to restrict the forgetting regions on the four unlearning tasks. In addition, we also extend our framework to unlearn the stable diffusion  in data mismatch forgetting, showing the efficacy of TARF, and full results are provided in Appendix E.

### 4.3 Ablations and Further Exploration

In this part, we provide further exploration of the three class-wise unlearning tasks and conduct various ablation studies to characterize TARF. More results and discussion are provided in Appendix F.

#### Weighted control on annealed gradient ascent.

To analyze the annealed gradient ascent, we present the results on the left of Figure 7 to show the effects of initialized strength $k$ on the all matched forgetting task using the CIFAR-100 dataset. The results show that an appropriate $k$ (e.g., about $0.05$) can help the model to achieve a satisfactory performance. However, the larger $k$ results in lower retaining performance and higher Gap value as the strength increases on the feature deconstruction.

#### Constant or dynamic gradient ascent for forgetting.

In the middle-left of Figure 7, we study whether we need the learning-rate-reduced $k$ for the forgetting part. Specifically, we compare it with using constant $k$ and learning-rate-increased $k$ on two model mismatch forgetting tasks. The results demonstrate that annealed gradient ascent can achieve more similar performance with the Retrained on forgetting data. The gradient ascent is considered simultaneously with gradient descent for restricting the forgetting region, while we adopt the annealed one since the unlearning target is to approximate the retrained model instead of continually maximizing the loss of forgetting data.

Figure: Figure 7: Ablation studies: Left: performance using different initialized $k$ on all matched forgetting; middle-left: effects of constant or different dynamic gradient ascent controlled by $k(t)$; middle-right: comparison of forgetting with different model structures; right: comparison of using different operations on the selected forgetting data. More experimental details can refer to Appendix F.
Refer to caption: x23.png

#### Unlearning on models trained by different structures.

In the middle-right of Figure 7, we investigate forgetting on the models pre-trained using different structures, e.g., ResNet-18 , VGG-16bn , and WideResNet-50 . The results of TARF on the model mismatch forgetting demonstrate that our TARF can achieve the lower performance gap than FT, evaluated with the retrained reference. With the increasing model capacity on the original training tasks, we can also find the model with a smaller capacity makes it harder to decompose the entangled feature representation.

#### Differernt operations on the selected forgetting data.

In the right of Figure 7, we present the ablation on the specific gradient operation on the selected forgetting data $\mathcal{D}_{\text{uf}}$. We compare using the gradient ascent ($-k(t)$) and cleaning (0 0) with the Retrained reference in target mismatch forgetting. Except for the similar forgetting efficacy achieved by the three trials, major differences exist in the performance evaluated by RA. The results show operation of gradient cleaning may be a better choice for $\mathcal{D}_{\text{uf}}$ to not deconstruct the feature representation too much and affect the retaining accuracy.

## 5 Conclusion

In this work, we decouple the class label and target concept in class-wise unlearning. By introducing the label domain mismatch among forgetting data, model output, and target concept, we uncover three additional tasks beyond the conventional all matched forgetting, e.g., target mismatch, model mismatch, and data mismatch forgetting. We identify the insufficient representation and decomposition lacking of restrictively forgetting the target concept, and reveal the crucial forgetting dynamics in the representation level for the feasibility of these unlearning requests. Based on that, we propose the TARF that assigns an annealed gradient ascent on the identified forgetting data and the normal gradient descent on the selected retaining data. By collaboratively considering the forgetting/retaining target, TARF is more accurate in unlearning while maintaining the rest. We hope our work can provide new insights and draw more attention toward the practical scenarios of machine unlearning.

## Appendixes

The whole Appendix is structured in the following manner. In Appendix A, we introduce the critical aspects of reproducibility. In Appendix B, we provide a detailed discussion with related works of machine unlearning and other aspects. In Appendix C, we review the representative baseline methods in machine unlearning, which are considered in our experimental comparisons. In Appendix D, we introduce the complete scenarios considering the mismatch issues in machine unlearning, going beyond the four basic scenarios presented in the main text.
In Appendix E, we formally present the algorithm implementation of our proposed TARF with its variant, and further explanation of the rationality of TARF in unlearning. In Appendix F, we provide additional experimental results to characterize forgetting dynamics and the properties of TARF. In Appendix G, we discuss the potential broader impact and limitations of our work.

## Appendix A Reproducibility Statement

Below we summarize some critical aspects to facilitate reproducible results:

- •
Datasets. The datasets we used are all publicly accessible [], which is introduced in Section 4.1. For our newly introduced unlearning scenarios, the specific dataset construction is implemented as described in Section 4.1 and Appendix D.4.
- •
Assumption. Following the previous work [, , ], We set our experiments to a tuning scenario where a well-trained model is available, and all the training samples are available but limited samples are labeled as "to be unlearned".
- •
Baselines. We provide the details about a series of unlearning methods considered in our work and also introduce the specific way of obtaining the pre-trained model for unlearning.
- •
Environment. All experiments are conducted with multiple runs on NVIDIA Tesla V100-SXM2-32GB GPUs with Python 3.8 and PyTorch 1.8.

## Appendix B Discussion about Related Work

In this section, we discuss the related literature on machine unlearning, and provide more detailed comparisons of some work with their approaches and motivations.

### B.1 Machine Unlearning

Machine unlearning targets to adjust a trained model to scrub the data influence [, , ]. It is initially proposed to protect data privacy [, , ], and a series of studies explore probabilistic methods through the differential privacy [, , , , ]. Except for the traditional classification model, recently some pioneering works also investigate unlearning for those generative models like diffusion model [, ] or large language model [, ]. Although having achieved some promising progress, the strong algorithmic assumptions hinder the practical effectiveness []. Current research [, , , , ] focus more on developing more effective and efficient unlearning methods to approximate the Retrained model, with the given trained model. As for the assumption on data generation, prior works [, , , ] mainly consider all matched forgetting targets, with similar features on the original training tasks. As for the assumption on label generation, most prior works [, , , , , ] assume the accessibility on the fully identified forgetting dataset, and the complementary is the remaining dataset. One recent work [] considers unlearning with only a few forgetting samples but requires another generative model to generate approximated data. Our work considers a more practical scenario in which we can conduct mismatched forgetting and use limited identified forgetting data with the unlabeled remaining set. More details and the intuition of related baseline methods are introduced in Appendix C.

### B.2 Positive-unlabeled learning

Positive-unlabeled learning [, ] tries to learn a binary classifier from a few labeled positive samples with the rest unlabeled ones. A series of PU algorithms [, , ] are developed to train an accurate binary classifier, and can be roughly divided into two categories []. The first branch is cost-sensitive learning, which is related to importance weighting []. Given the estimated class prior, these methods [, , ] can develop an unbiased or consistent risk estimator for PU learning. Another branch of PU learning adopts two heuristic steps to perform binary classification. Such methods [, ] first identify reliable negative and positive examples from the unlabeled data, and then conduct semi-supervised learning. The model trained using cost-sensitive learning can also be a recognizer for positive or negative samples []. Different from PU learning focusing on binary classification tasks, our work tries to enable more practical scenarios in class-wise unlearning [] where the class labels and target concepts are decoupled and we consider the issues of label domain mismatch.

## Appendix C Details about Considered Baselines and Metrics

In this section, we provide details about the considered representative baselines for machine unlearning methods, as well as their general intuitions with specific objectives. For the specific hyperparameters adopted in different methods, we keep the same setting with previous related works [, ], and the specific values will be listed in detail in our source codes.

#### Finetune (FT).

Utilizing the catastrophic forgetting [] in the model (e.g., existed in the continual learning), FT [] fine-tunes the given trained model partially on $\mathcal{D}_{\text{r}}$ with few training epochs to obtain the $\theta_{\text{un}}^{*}$ with the following objective function,

$$ $L_{\text{FT}}=\frac{1}{|\mathcal{D}_{\text{r}}|}\sum_{(x,y)\sim\mathcal{D}_{ \text{r}}}\ell(f(x),y).$ (8) $$

#### Gradient Ascent (GA).

Different from the normal gradient descent, GA reverses the gradient signal on $\mathcal{D}_{\text{f}}$ to conduct maximization with ascended gradients, resulting in the increasing loss of the forgetting data to obtain the $\theta_{\text{un}}^{*}$. The objective is given as follows,

$$ $L_{\text{GA}}=-\frac{1}{|\mathcal{D}_{\text{f}}|}\sum_{(x,y)\sim\mathcal{D}_{ \text{f}}}\ell(f(x),y).$ (9) $$

With reverse optimization to maximize the loss on the specific data, the model can approximate $\theta^{*}$ by directly forgetting the learned knowledge represented by the forgetting data.

#### Random Label (RL).

Similar to GA, RL [] assign the random labels $Y^{*}$ on the forgetting data in $\mathcal{D}_{\text{f}}$ and fine-tune the given model with it to obtain the unlearned model $\theta_{\text{un}}^{*}$,

$$ $L_{\text{RL}}=\frac{1}{|\mathcal{D}_{\text{f}}|}\sum_{(x,y)\sim\mathcal{D}_{ \text{f}}}\ell(f(x),y^{*}).$ (10) $$

Instead of using the original training label on the forgetting data in $\mathcal{D}_{\text{f}}$, RL can destroy the learned feature by using the random label $y^{*}$ on $\mathcal{D}_{\text{f}}$, which violate the minimized loss value.

#### Influence Unlearning (IU).

IU adopts the influence function [] to estimate the change if the training point is removed from the training loss. It is designed for random data unlearning [] with the provable guarantee on the unlearning effects. In general, IU estimates the change in model parameters of $\theta_{\text{un}}^{*}-\theta$ and adds the weight perturbation to the given model to obtain the unlearned one. However, it usually requires additional model information and training assumptions for the theoretical guarantee and may suffer hyperparameter tuning with inaccurate hessian estimation [, ].

#### Boundary Shrink (BS).

BS [] is recently proposed for class-wise unlearning, especially on the all matched forgetting. It focuses on the decision spaces [] of the given trained model. The critical idea is to shift the original decision boundary to imitate the decision behavior of the model retrained from scratch. Motivated by adversarial attacks [], it proposes a neighbor searching method to identify the nearest but incorrect class labels $y_{\text{near}}$ for $\mathcal{D}_{\text{f}}$ to guide the model to unlearn the existing class and shift the decision boundary. Using the adversarial attack to find the nearest incorrect label, the objective of BS can be formulated as follows,

$$ $L_{\text{BS}}=\frac{1}{|\mathcal{D}_{\text{f}}|}\sum_{(x,y)\sim\mathcal{D}_{ \text{f}}}\ell(f(x),y_{\text{near}}),$ (11) $$

where $y_{\text{near}}$ is obtained by first perturbing the forgetting data and getting the newly predicted result as,

$$ $\displaystyle\begin{split}x^{\prime}=x&+\epsilon\cdot\text{sign}(\nabla\ell(f( x),y))\\ y_{\text{near}}&\leftarrow\text{softmax}(f(x^{\prime}))\end{split}$ (12) $$

#### L 1 subscript 𝐿 1 L_{1} italic_L start_POSTSUBSCRIPT 1 end_POSTSUBSCRIPT -sparse.

Developed based on the conventional FT, $L_{1}$-sparse [] investigate the model sparsity on machine unlearning. It figures out that model sparsification can benefit the unlearning performance on different perspectives via first pruning and then conducting unlearning. By carrying out pruning and unlearning simultaneously, $L_{1}$-sparse proposes the sparsity-aware unlearning utilizing the $L_{1}$ norm-based penalty. The objective is as follows with a hyperparameter $\gamma$,

$$ $L_{\text{$L_{1}$-sparse}}=\frac{1}{|\mathcal{D}_{\text{r}}|}\sum_{(x,y)\sim \mathcal{D}_{\text{r}}}\ell(f(x),y)+\gamma||\theta^{*}||,$ (13) $$

and the general sparsity-aware penalty can also be added to different unlearning methods. In this work, we mainly compare the $L_{1}$-sparse FT as the previous work [, ] considered.

#### SalUn.

With the concern on unlearning stability and cross-domain applicability, SalUn [] introduces the concept of weight saliency in machine unlearning. This innovation directs the attention of unlearning into specific model weights for specific data that need to be unlearned. In general, it first generates the gradient-based weight saliency map inspired by model sparsification [] with gradient-value thresholding, where the specific generation method is defined as,

$$ ${\rm m}_{s}=\mathbf{1}(|\nabla_{\theta}\ell(\theta;\mathcal{D}_{f})|_{\theta}= \theta_{o}|\geq\gamma),\quad\theta_{u}={\rm m}_{s}\odot(\delta\theta+\theta_{o })+(1-{\rm m})\odot\theta_{o},$ (14) $$

in which $\mathbf{1}(g\geq\gamma)$ is an element-wise indicator function that yields a value of $\mathbf{1}$ for the i-th element if and 0 otherwise, $|\cdot|$ is an element-wise absolute value operation, and $\gamma>0$ is a hard threshold.
and then conducts saliency-based unlearning using the generated saliency map. Specifically, SalUn adopts RL [] to fine-tune the forgetting data in $\mathcal{D}_{\text{f}}$ on the salience map, and the extended objective is given as follows,

$$ $L_{\text{SalUn}}=\frac{1}{|\mathcal{D}_{\text{f}}|}\sum_{(x,y)\sim\mathcal{D}_ {\text{f}}}\ell_{\theta_{u}}(f(x),y^{*})+\alpha\frac{1}{|\mathcal{D}_{\text{r} }|}\sum_{(x,y)\sim\mathcal{D}_{\text{r}}}\ell(f(x),y),$ (15) $$

More detailed operations can refer to [], and we keep the same hyperparameter used in [] to conduct the class-wise unlearning tasks.

#### SCRUB.

SCRUB is a newly proposed unlearning algorithm based on a novel casting of the problem into a teacher-student framework []. It is designed to meet the desiderata of unlearning: efficiently forgetting without hurting the model utility. As the general target of SCRUB in forgetting is application-dependent, it is proposed with a recipe that works across applications: SCRUB is first to strive for maximal forget error, which is desirable in some scenarios like removing bias or restricted contents but not in others like user privacy protection. To address the latter case, SCRUB is integrated with a rewinding procedure that can reduce the forget set error appropriately when required.

Given the original model $\theta^{o}$ as the teacher model, the goal of SCRUB is formatting as training a student model $\theta^{u}$ that selectively obeys the teacher. The overall objective can be divided into two folds, the first is to remember $\mathcal{D}_{\text{r}}$ under the teacher model’s guide while the second is to forget $\mathcal{D}_{\text{f}}$ by disobeying the teacher model’s guide. To measure the degree to which the student model obeys the teacher model, SCRUB utilizes the following distance measure,

$$ $d(x;\theta^{u})=D_{\rm KL}(p(f(x;\theta^{o}))||p(f(x;\theta^{u}))),$ (16) $$

where $D_{\rm KL}$ is the KL-divergence and the overall measures of the distance between the student model’s and teacher model’s prediction distribution. With the aforementioned distance, the objective of SCRUB is as follows,

$$ $L_{\text{SCRUB}}=\min_{\theta^{u}}\frac{\alpha}{N_{r}}\sum_{x_{r}\in\mathcal{D }_{r}}d(x_{r};\theta^{u})+\frac{\gamma}{N_{r}}\sum_{(x_{r},y_{r})\in\mathcal{D }_{r}}\ell(f(x_{r};\theta^{u}),y_{r})-\frac{1}{N_{f}}\sum_{x_{f}\in\mathcal{D} _{f}}d(x_{f};\theta^{u}),$ (17) $$

where the first two parts can be regarded as a variant of distillation from a teacher model on $\mathcal{D}_{\text{r}}$ and the third part is encouraging the student model to disobey the teacher model to forget the target data.

## Appendix D Full Discussion about Label Domain Mismatch

In this section, we discuss the full scenarios of label domain mismatch in class-wise unlearning [, , , , , ]. Specifically, we will start by why focusing on class-wise unlearning, and then discuss the motivation for investigating its label domain mismatch, with the newly introduced setting being friendly for empirical analysis and further research. Finally, we provide detailed information on our instantiated four tasks using the benchmarked CIFAR-10 and CIFAR-100 datasets [].

Figure: Figure 8: Label domain mismatch with the two-layer illustration.
Refer to caption: x27.png

**Table 2: Mismatching in the label domain of three critical aspects with a two-layer label structure.**
| No. | Forgetting data | Model output | Target concept | Comment |
| --- | --- | --- | --- | --- |
| 1 | Class label | Class label | Class label | All matched |
| 2 | Class label | Class label | Superclass | Target mismatch |
| 3 | Class label | Superclass | Class label | Model mismatch |
| 4 | Class label | Superclass | Superclass | Data mismatch |
| 5 | Superclass | Class label | Class label | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 6 | Superclass | Class label | Superclass | Similar to all matched |
| 7 | Superclass | Superclass | Class label | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 8 | Superclass | Superclass | Superclass | All matched |

To begin with, machine unlearning [, , , ] is originally proposed in response to "the right to be forgotten" to protect the data privacy, and recently deep machine unlearning is a timely research topic associated with foundation models which use massive of data to train [, ]. The ensuing data regulation concerns have also expanded the original privacy-protecting goal to more general needs and scenarios [, , ]. As stated in [, , ], unlearning a subset of the training set has received increasing attention (like removing sensitive information, and inappropriate content). However, the previous scenarios mainly consider the coinciding class labels with the target concept to be unlearned. Although achieving promising results in forgetting, it is still not enough in practice.

**Table 3: considering label domain relations of three critical aspects in class-wise unlearning.**
| Label Domain $\mathcal{L}$ | Relation of Data $\mathcal{L}_{D}$, Model $\mathcal{L}_{M}$, and Target $\mathcal{L}_{T}$ |
| --- | --- |
| All matched | $\mathcal{L}_{D}\quad=\quad\mathcal{L}_{T}\quad=\quad\mathcal{L}_{M}$ |
| Target mismatch | $\mathcal{L}_{M}\quad=\quad\mathcal{L}_{D}\quad\prec\quad\mathcal{L}_{T}$ |
| Model mismatch | $\mathcal{L}_{D}\quad=\quad\mathcal{L}_{T}\quad\prec\quad\mathcal{L}_{M}$ |
| Data mismatch | $\mathcal{L}_{D}\quad\prec\quad\mathcal{L}_{T}\quad=\quad\mathcal{L}_{M}$ |

Considering the problem setups of unlearning, we have three critical aspects, e.g., the well-trained machine learning model $\theta$, and the reported data $\mathcal{D}_{\text{f}}$ to be unlearned, as well as the target concept. In previous studies, the three aspects are mainly considered to be under the same label taxonomy. In other words, the unlearning tasks are aligned with the pre-training task, where the latter trains a multi-class classification model, and the former aims to unlearn a training class. However, in practice, the unlearning request may violate the taxonomy of the pre-training tasks, while the specific target concepts always exhibit a unified property for specific forgetting data. It naturally motivates us to consider different label domains of the three aspects of unlearning. As listed in Table 3, the label domain of data $\mathcal{L}_{D}$, the label domain of model output $\mathcal{L}_{M}$, and the label domain of target concept $\mathcal{L}_{T}$. To begin with, we have a practical assumption on the relation between label domains of forgetting data and target concept, i.e., $\mathcal{L}_{D}\preceq\mathcal{L}_{T}$, indicating that the reported forgetting data should be included in the target concept (as intuitively illustrated in the middle panel of Figure 8). Considering $\mathcal{L}_{D}=\mathcal{L}_{T}$, we can have two possibilities on $\mathcal{L}_{M}$, e.g., $\mathcal{L}_{M}=\mathcal{L}_{T}$ and $\mathcal{L}_{M}\neq\mathcal{L}_{T}$, where the former is regarded as all matched when $\mathcal{L}_{D}=\mathcal{L}_{M}=\mathcal{L}_{T}$ and the latter is the model mismatch. To be more specific, we consider model mismatch forgetting as $\mathcal{L}_{D}=\mathcal{L}_{T}\prec\mathcal{L}_{M}$, since $\mathcal{L}_{M}\prec\mathcal{L}_{T}$ will have no additional effects on the unlearning when $\mathcal{L}_{D}=\mathcal{L}_{T}$ and we can regard it as similar to the all matched case. Considering $\mathcal{L}_{D}\prec\mathcal{L}_{T}$, we can have the target mismatch forgetting when $\mathcal{L}_{D}=\mathcal{L}_{M}$ and data mismatch forgetting when $\mathcal{L}_{M}=\mathcal{L}_{T}$.

We summarize the mainly considered mismatch cases in Table 3, which can serve as a general reference for further research on constructing the unlearning tasks. In the following, we further explain the procedure of task instantiating and discuss the other potential scenarios with the typical two-layer label structure considered in the main text and an additional three-layer label structure.

### D.1 A two-layer label structure of mismatch

In Figure 8, we first show the illustration of a two-layer label structure and the three aspects of unlearning, i.e., forgetting data, model outputs, and target concept. Without losing generality, we utilize the class labels and superclass information (refer to the official information in CIFAR-100 []) for consideration. Then we have a two-layer label structure representing different knowledge regions.

Given two potential label domains in each aspect, we can totally get the 8 scenarios list in Table 2. The first 4 scenarios are mainly considered and detailedly introduced in the main text. For the rest 4 scenarios (i.e., No. 5-8), we consider some (i.e., No. 5 and No. 7) to be impractical as the label domain of forgetting data is larger than the target concept, which means that the unlearning requests identify more forgetting data than the true target concept. It should be more reasonable that only limited forgetting data are identified by server users or internal examiner [] in real-world applications. Therefore, we mainly consider the forgetting data $\mathcal{D}_{\text{f}}$ belongs a part of or equals to the overall data $\mathcal{D}_{\text{t}}$ of the target concept. As for No. 6 and No. 8 cases, the former is similar to the conventional all matched forgetting since the forgetting data has the same label domains with the target concept while the model output has a fine-grained label domain (e.g., class label) that will not affect the unlearning, and the latter is exactly same as the all matched forgetting considered in No.1.

### D.2 A three-layer label structure of mismatch

Since in more extreme cases, some unlearning requests would exhibit only several instances of forgetting an abstract concept not aligned with the pre-training tasks. We then consider an extra label layer (e.g., the sub-set level inside a class) to construct a three-layer structure beyond the previous one. In Figure 9, we illustrate it with some samples and a Venn diagram.

Figure: Figure 9: Label domain mismatch with the three-layer illustration.
Refer to caption: x28.png

Considering each aspect can have three potential label domains, we can totally get 27 scenarios in Table 4. In general, we have three rough categories for analysis. First, due to the aforementioned constraint that the target concept should include the forgetting data, we consider several cases (e.g., No. 14, 17, 18, 20, 22-24, and 26-27) to be impractical. Second, the three-layer structure also includes a group of scenarios that also existed in the two-layer structure, so No. 1-4 and 19 are the same as the four scenarios (i.e., all matched, target mismatch, model mismatch, and data mismatch). Third, for the rest scenarios, we regarded them to be novel cases than those considered in the main text.

To be more specific, there are two groups of cases in the third part. For No. 5, 6, and 7, since they also can be represented using a two-layer structure, the forgetting dynamics are similar to that in target, model, and data mismatch forgetting. By contrast, in No. 8, 9, and 16, all three label domains exist in the three aspects of class-wise unlearning, which is worthy of further discussion.

**Table 4: Mismatching in the label domain of three critical aspects with a three-layer label structure.**
| No. | Forgetting data | Model output | Target concept | Comment |
| --- | --- | --- | --- | --- |
| 1 | Sub-set | Sub-set | Sub-set | All matched |
| 2 | Sub-set | Sub-set | Class label | Target mismatch |
| 3 | Sub-set | Class label | Sub-set | Model mismatch |
| 4 | Sub-set | Class label | Class label | Data mismatch |
| 5 | Sub-set | Sub-set | Superclass | Different |
| 6 | Sub-set | Superclass | Sub-set | Different |
| 7 | Sub-set | Superclass | Superclass | Different |
| 8 | Sub-set | Class label | Superclass | Different |
| 9 | Sub-set | Superclass | Class label | Different |
| 10 | Class label | Class label | Class label | All matched |
| 11 | Class label | Class label | Superclass | Target mismatch |
| 12 | Class label | Superclass | Class label | Model mismatch |
| 13 | Class label | Superclass | Superclass | Data mismatch |
| 14 | Class label | Sub-set | Sub-set | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 15 | Class label | Sub-set | Class label | Similar to all matched |
| 16 | Class label | Sub-set | Superclass | Different |
| 17 | Class label | Class label | Sub-set | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 18 | Class label | Superclass | Sub-set | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 19 | Superclass | Superclass | Superclass | All matched |
| 20 | Superclass | Class label | Class label | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 21 | Superclass | Class label | Superclass | Similar to all matched |
| 22 | Superclass | Superclass | Class label | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 23 | Superclass | Sub-set | Sub-set | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 24 | Superclass | Sub-set | Class label | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 25 | Superclass | Sub-set | Superclass | Similar to all matched |
| 26 | Superclass | Class label | Sub-set | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |
| 27 | Superclass | Superclass | Sub-set | Impractical since $\mathcal{L}_{D}\succ\mathcal{L}_{T}$ |

Figure: Figure 10: Illustration of 6 scenarios different from the four major tasks according to Table 4.
Refer to caption: x29.png

### D.3 Further exploration on the other 6 different scenarios

In this part, we further discuss the 6 different scenarios discovered by constructing the three-layer label structure. We illustrated these forgetting tasks in Figure 10 and discuss them as follows,

- No. 5&16 In the two scenarios, the model output has the most fine-grained label domain (e.g., sub-set as illustrated in Figure 9) for representation. At the same time, the target concept is broader than both model output and identified forgetting data. Different from the aforementioned target mismatch, the mismatch degree of this task is larger (e.g., superclass level) than the previous one (e.g., class level). In other words, the model output further loses the entanglement of feature representation of the samples belonging to target concept (compared with the original setups of target mismatch).
To simulate the case, we employ the same model pre-trained by class in target mismatch, but enlarge the target concept (consists of 7 classes with similar semantic features, instead of the original 5) and change the forgetting data (2 class as the given forgetting data in No.5 and 3 classes in No.16).

- No. 8&7. Similar to the previous No. 5, the target concept in these tasks is also broader than the label domains of the identified forgetting data. However, in these two scenarios, the model output is varied which controls the entanglement of target samples. To construct these two forgetting tasks, we respectively adopt the models pre-trained by class labels and superclass, and use the same forgetting data (with 1 class) to investigate the performance change using our TARF and other baselines.

- No. 6&9. In the last two scenarios, the forgetting tasks are more similar to the previous model mismatch forgetting. However, the distinguishable difference is that the label domain of model outputs can be much different from the identified forgetting data. In the No. 6 task,
the target concept is aligned with the identified forgetting data, while since the remaining data is more than the original model mismatch forgetting, the task separation could be harder than the previous. In the No. 9 task, we can find that it is a complex scenario where the target concept is broader than the forgetting data but included in the same superclass. In both tasks, we use 1 class data as the forgetting data.

To further understand the properties of unlearning in these tasks, we conducted additional experiments and summarized the results in Table 5. We can find the empirical results well demonstrate the conceptual conjectures in the previous discussion, and the representative baselines exhibit varied performance gap with the Retrained reference. Among them, our TARF can consistently achieve the better performance regarding to the Gap.

**Table 5: Results (%) of unlearning with different model structures. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-100 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Retrained | No. 5 | 0.00 | 97.85 | 73.72 | 100.00 | - | No. 16 | 0.00 | 97.85 | 73.72 | 100.00 | - |
| FT [] | 67.52 | 96.43 | 72.96 | 41.14 | 32.72 | 53.11 | 94.64 | 71.23 | 52.70 | 26.53 |  |  |
| RL [] | 68.57 | 96.12 | 72.58 | 41.17 | 33.15 | 53.90 | 96.94 | 73.07 | 53.56 | 25.48 |  |  |
| GA [] | 38.03 | 97.00 | 70.98 | 76.92 | 16.75 | 32.24 | 95.73 | 69.99 | 77.62 | 15.12 |  |  |
| TARF (ours) | 0.00 | 96.58 | 72.03 | 100.00 | 0.74 | 0.00 | 96.98 | 72.87 | 100.00 | 0.43 |  |  |
| Retrained | No. 8 | 0.00 | 97.85 | 73.72 | 100.00 | - | No. 7 | 0.00 | 98.50 | 80.15 | 100.00 | - |
| FT [] | 74.09 | 97.19 | 74.01 | 36.71 | 34.58 | 95.16 | 94.98 | 78.68 | 13.06 | 46.77 |  |  |
| RL [] | 76.04 | 96.76 | 72.88 | 36.00 | 35.49 | 91.51 | 96.98 | 80.11 | 47.24 | 36.46 |  |  |
| GA [] | 49.47 | 98.92 | 72.94 | 77.96 | 18.34 | 15.91 | 98.64 | 80.27 | 93.82 | 5.59 |  |  |
| TARF (ours) | 0.00 | 96.22 | 72.43 | 100.00 | 0.73 | 0.00 | 96.54 | 79.23 | 100.00 | 0.65 |  |  |
| Retrained | No. 6 | 88.22 | 98.52 | 84.42 | 22.22 | - | No. 9 | 88.22 | 98.58 | 78.50 | 25.78 | - |
| FT [] | 94.33 | 95.00 | 78.77 | 13.67 | 5.96 | 91.78 | 95.02 | 78.90 | 18.44 | 3.72 |  |  |
| RL [] | 84.22 | 96.96 | 80.18 | 65.77 | 13.34 | 96.97 | 70.22 | 80.24 | 94.67 | 26.94 |  |  |
| GA [] | 18.44 | 96.06 | 78.20 | 92.67 | 37.23 | 19.11 | 95.27 | 77.56 | 91.56 | 34.79 |  |  |
| TARF (ours) | 92.21 | 98.43 | 82.32 | 19.17 | 2.31 | 89.12 | 97.23 | 79.21 | 24.32 | 1.11 |  |  |

### D.4 Specific Information of the instantiated Tasks

For the four major scenarios (i.e., conventional all matched forgetting, target mismatch forgetting, model mismatch forgetting, and data mismatch forgetting) considered in our work, we provide the dataset construction and partition details in this section. Note that we focus on class-wise unlearning in this work, which is different from random data forgetting that uniformly samples the forgetting target of all classes in the training dataset.

To ease the research investigation and empirical verification, we adopt the commonly used [, , , ] benchmark CIFAR-10 and CIFAR-100 for constructing the pre-training task for unlearning. Specifically, the official class labels are kept as classes for ordinary setup, and we provide the superclass information referring to the pre-defined lists [] of CIFAR-100. Since there is no official superclass information for CIFAR-10 dataset, we manually grouped the classes of CIFAR-10 according to their semantic feature similarity and finalized 5 superclass clusters consisting of 2 classes in each. The full structured label layers information is summarized in Tables 7 and 8. For all the unlearning scenarios where the label domain of model output is the superclass, we will first use the superclass information to train the 20-class and 5-class classification models respectively. For the specific data partition in unlearning requests, we randomly sampled two classes in CIFAR-100 and one class in CIFAR-10 as forgetting data and kept the setup across the four forgetting tasks as well as other experiments. For other additional experimental setups, we will state them at the near positions.

**Table 6: Basic setup about unlearning scenarios. More illustrations can be found in Appendix D.4.**
| Dataset | Forgetting Data | Setup | All matched | Model mismatch | Target mismatch | Data mismatch |
| --- | --- | --- | --- | --- | --- | --- |
| CIFAR-10 | “automobile” | Training Class | 10 | 5 | 10 | 5 |
| Target Concept | “automobile” | “automobile” | “vehicle” | “vehicle” |  |  |
| CIFAR-100 | “boy”, “girl” | Training Class | 100 | 20 | 100 | 20 |
| Target Concept | “boy”, “girl” | “boy”, “girl” | “people” | “people” |  |  |

**Table 7: Full list of the 20-class classification on CIFAR-100 with its official superclass labels [].**
| Superclass (20) | Classes (5 for each superclass) |
| --- | --- |
| aquatic mammals | beaver, dolphin, otter, seal, whale |
| fish | aquarium fish, flatfish, ray, shark, trout |
| flowers | orchids, poppies, roses, sunflowers, tulips |
| food containers | bottles, bowls, cans, cups, plates |
| fruit and vegetables | apples, mushrooms, oranges, pears, sweet peppers |
| household electrical devices | clock, computer keyboard, lamp, telephone, television |
| household furniture | bed, chair, couch, table, wardrobe |
| insects | bee, beetle, butterfly, caterpillar, cockroach |
| large carnivores | bear, leopard, lion, tiger, wolf |
| large man-made outdoor things | bridge, castle, house, road, skyscraper |
| large natural outdoor scenes | cloud, forest, mountain, plain, sea |
| large omnivores and herbivores | camel, cattle, chimpanzee, elephant, kangaroo |
| medium-sized mammals | fox, porcupine, possum, raccoon, skunk |
| non-insect invertebrates | crab, lobster, snail, spider, worm |
| people | baby, boy, girl, man, woman |
| reptiles | crocodile, dinosaur, lizard, snake, turtle |
| small mammals | hamster, mouse, rabbit, shrew, squirrel |
| trees | maple, oak, palm, pine, willow |
| vehicles 1 | bicycle, bus, motorcycle, pickup truck, train |
| vehicles 2 | lawn-mower, rocket, streetcar, tank, tractor |

**Table 8: Full list of the 5-class classification on CIFAR-10 with its manually set superclass [].**
| Superclass (5) | Classes (2 for each superclass) |
| --- | --- |
| 1 | airplane, bird |
| 2 | automobile, truck |
| 3 | cat, dog |
| 4 | deer, frog |
| 5 | horse, ship |

**Table 9: Specific training set data partition corresponding to four major forgetting tasks.**
| Forgetting Tasks | Data Partition |  |
| --- | --- | --- |
|  | Identified | Unidentified |
| All matched | $\mathcal{D}_{\text{f}}=\mathcal{D}_{\text{t}}$ | $\mathcal{D}_{\text{un}}=\mathcal{D}_{\text{r}}$ |
| Target mismatch | $\mathcal{D}_{\text{f}}\subset\mathcal{D}_{\text{t}}$ | $\mathcal{D}_{\text{un}}=\mathcal{D}_{\text{uf}}\cup\mathcal{D}_{\text{r}}$ |
| Model mismatch | $\mathcal{D}_{\text{f}}=\mathcal{D}_{\text{t}}$ | $\mathcal{D}_{\text{un}}=\mathcal{D}_{\text{r}}$ |
| Data mismatch | $\mathcal{D}_{\text{f}}\subset\mathcal{D}_{\text{t}}$ | $\mathcal{D}_{\text{un}}=\mathcal{D}_{\text{uf}}\cup\mathcal{D}_{\text{r}}$ |

## Appendix E Algorithm Implementation and Explanation

In this section, we present the pseudo-code of our proposed TARF and its variant, as well as additional discussions to enhance the understanding of our methods. Here we summarize the detailed procedure of algorithm implementation in Algorithm 1 and Algorithm 2. In detail, Algorithm 1 identifies the potential target using the class labels, while Algorithm 2 can use the instance level information.

As introduced in Section 3.3, the objective of our TARF is defined as follows,

$$ $\displaystyle\begin{split}L_{\text{TARF}}=\underbrace{k(t)\cdot\bigg{(}-\frac{ 1}{|\mathcal{D}_{\text{f}}|}\sum_{(x,y)\sim\mathcal{D}_{\text{f}}}\ell(f(x),y) \bigg{)}}_{\text{Annealed Forgetting}~{}L_{\text{f}}(k)}+\underbrace{\frac{1}{ |\mathcal{D}_{\text{un}}|}\sum_{(x,y)\sim\mathcal{D}_{\text{un}}}\ell(f(x),y) \cdot\tau(x,y,t)}_{\text{Target-aware Retaining}~{}L_{\text{u}}(\tau)},\end{split}$ (18) $$

where $k(t)$ and $\tau(x,y,t)$ are two training-time-related hyperparameters to deal with the mismatch issues raised in our new settings. Specifically, we set a learning-rate-reduced $k(t)$ as,

$$ $k(t)=k\cdot(T-t-t_{0})/T,\quad t\in[0,T],$ (19) $$

where $T$ indicates the total training time (e.g., epochs), and the value of $k(t)$ decreases with the training process. On the other hand, we have the following indicator to measure the model prediction consistency with the training data$I_{\text{con}}(x,y,\theta)=|\ell_{f_{\theta}}(x,y)-\ell_{f_{\theta^{*}}}(x,y)|$,
with which we set $\tau(x,y,t)$ as follows,

$$ $\tau(x,y,t)=\left\{\begin{aligned} 0&&&I_{\text{con}}(x,y,\theta_{t_{1}})> \beta~{}\text{or}~{}t<t_{1}&~{}~{}^{*}\text{Unconf. Retain,}\\ 1&&&I_{\text{con}}(x,y,\theta_{t_{1}})<\beta~{}\text{and}~{}t\geq t_{1}&~{}~{} ^{*}\text{Conf. Retain,}\end{aligned}\right.$ (20) $$

where $t_{1}$ is a time stamp to control the start of pursuing the retaining part. The overall two dynamic hyperparameters can divide the whole unlearning process into three phases as illustrated in Figure 5.

#### Annealed Forgetting.

For the forgetting target, we adopt the gradient ascent on the given forgetting data to unlearn it. However, to approximate the retrained model, the intuition is not to pursue the maximization of the risk on this part of the data but to destroy the learned feature on the given model. So we introduce a learning-rate-reduced $k(t)$ to realize the annealed gradient ascent where $t_{0}=1$ is adopted for target or data mismatch forgetting, and the value of $k(t)$ decreases with the training process. Resulting in destroyed features, gradient ascent on this part of data also constructs the dynamic information for differentiating the data of different consistency on its loss values, making the risks of the concept-aligned data higher than the rest, and helping to filter retaining data.

#### Target-aware Retaining.

For the retaining part, we need to selectively learn the data from the remaining set, since the complementary dataset may be biased with unidentified forgetting data. Compared with other remaining data, the concept-aligned data is easy to be affected by similar feature representation as indicated in Figure 3(c). Thus, we can have $\tau(x,y,t)$
where we can divide the remaining set into unconfident/confident parts to note the estimated retaining data like Figure 4(a). $t_{1}=2$ is adopted at target and data mismatch tasks, and $\beta$ can be estimated by the prior information about the specific unlearning request and the rank of loss values. By simultaneously conducting gradient ascent on forgetting data and selective gradient descent on confident retaining data, we can better restrict the forgetting region and deconstruct the entangled feature representation (refer to the middle of Figure 4(b) where we reveal the feature decomposition in deeper layers of model structure using ResNet). Finally, with the partial objective of retaining, it can approximate the retrained reference (refer to the right of Figure 4(b)).

Figure: Algorithm 1 TARF

#### Case study for Unlearning Generation with Stable Diffusion.

To demonstrate the compatibility, we also extend the core idea of this work and investigate the performance of TARF on the specific text-to-image generation with stable diffusion [, ], and presented in Tables 10 and 11.

In detail, we aim to unlearn the image generation of a class with its specific prompt like “a photo of a tench”. To simulate the practical unlearning request, we construct the given dataset consisting of limited forgetting data and the unidentified remaining data to conduct unlearning, which corresponds to the data mismatch forgetting task that similar to the right-bottom illustration of Figure 2. Then we compare the image generation on the original stable diffusion, the unlearned model with certain label (CL) mismatching [], and that with our TARF. For this exploration, we adopt the instance-wise identification during the forgetting process as described in Algorithm 2, to unlearn the target concept with the given limited forgetting data and pursue retaining the selected remaining data with lower loss values. The results in Tables 10 and 11 show the potential of our framework in the expansion on image generation without the perfect information in unlearning.

Figure: Algorithm 2 TARF-I: generalized version on instance-wise identification

**Table 10: Image generation results of unlearned Stable Diffusion in the Data mismatch forgetting, compared with the original stable diffusion, certain label (CL) unlearning [], and our TARF. The specific prompt used in the image generation is "a photo of tench".**
| Original<br>Stable Diffusion | Unlearned<br>by CL [] | Unlearned<br>by TARF |
| --- | --- | --- |
|  |  |  |

**Table 11: Image generation results of unlearned Stable Diffusion in the Data mismatch forgetting, compared with the original stable diffusion, certain label (CL) unlearning [], and our TARF. The specific prompt used in the image generation is "a photo of English springer".**
| Original<br>Stable Diffusion | Unlearned<br>by CL [] | Unlearned<br>by TARF |
| --- | --- | --- |
|  |  |  |

## Appendix F Additional Experimental Results

In this section, we provide additional experimental results of our work.

- In Appendix F.1, we summarize the additional experimental setups.

- In Appendix F.2, we discuss the crucial target identification in unlearning.

- In Appendix F.3, we present unlearning with different model structures.

- In Appendix F.4, we present the full results under multiple runs with the four forgetting tasks.

### F.1 Extra Experimental Setups

We introduce additional experimental details in the specific unlearning tasks. In our TARF, In general, we set $t_{1}=1$ for all the target identification parts, and we adopt $k=0.04$, $t_{0}=2$ in model mismatch forgetting, and $k=0.02$, $t_{0}=2$ for all matched, target mismatch and data mismatch forgetting in the unlearning request on CIFAR-10 classification task; for the CIFAR-100 classification task, we adopt $k=0.5$, $t_{0}=2$ in model mismatch forgetting, and $k=0.05$, $t_{0}=2$ for all matched, target mismatch and data mismatch forgetting. For the other hyperparameters, we follow the previous works [, , ] to set the specific values. All the forgetting trails use 10 epochs for the total unlearning process except for GA (use 5 epochs) and IU (use the specific fixed step for optimization). The specific parameters and the pre-trained models (unlearn base) will be provided in our codes.

### F.2 Discussion about Target Identification in unlearning

In this part, we further discuss the important factors for the achievability of the unlearning tasks. To be more specific, for the target or data mismatch forgetting, the scenario assumes that the identified forgetting data is part of the whole samples belonging to the target concept, which means there are other forgetting data included in the remaining set that need to be found. Thus, target identification is important for effective unlearning. As demonstrated in Section 3.2, the representation gravity can be a useful clue in forgetting dynamics to identify the other concept-aligned forgetting data. An implicit assumption is that those concept-aligned forgetting data have similar semantic features to the initially provided forgetting data, which has smaller representation distance than the retaining part of data as illustrated in Figure 11. Empirically, the model can have similar prediction changes on those concept-aligned forgetting data with the initial forgetting data. However, not all of the superclasses officially defined for the CIFAR-100 dataset are suitable for constructing the unlearning request, as some superclasses are not semantically separable like "aquatic mammals" and "fish". It can be found in Figure 13, where we check the Top-10 classes with the most accuracy changes after gradient ascent for each superclass in the CIFAR-100 dataset, some concept-aligned forgetting data (class-level indicated by blue arrows) are not easily identified given the two initially provided forgetting data classes (indicated by red arrows). One interesting future problem can be how to handle the spurious correlation given the insufficient representative samples.

Figure: (a) Inter-classes distance in the model trained by classes
Refer to caption: x30.png

Figure: Figure 12: The entangled/under-entangled feature representations visualized by tSNE.
Refer to caption: extracted/5667727/fig6_tsne_cifar100_new_3_pre.jpg

Figure: (a) aquatic mammals
Refer to caption: x32.png

### F.3 Forgetting with Different Model Structures

In this part, we further check the unlearning performance of our TARF on different pre-trained model structures compared with several baselines. We choose CIFAR-100 as the pre-training classification task and conduct all matched forgetting and model mismatch forgetting. The results are summarized in Table 12. The results validate that our TARF can robustly achieve better unlearning performance across different model structures.

**Table 12: Results (%) of unlearning with different model structure. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-100 | Task | All matched | Model mismatch |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Metric | UA | RA | TA | MIA | Gap$\downarrow$ | UA | RA | TA | MIA | Gap$\downarrow$ |  |
| VGG-19 | Retrained | 0.00 | 97.26 | 73.13 | 100.00 | - | 87.44 | 98.22 | 82.12 | 19.89 | - |
| FT [] | 0.00 | 90.92 | 66.86 | 100.00 | 3.15 | 95.22 | 95.17 | 77.71 | 7.56 | 6.89 |  |
| RL [] | 0.00 | 90.29 | 66.16 | 100.00 | 3.48 | 96.22 | 95.26 | 77.71 | 98.56 | 23.71 |  |
| GA [] | 0.00 | 79.27 | 56.03 | 100.00 | 8.77 | 0.00 | 93.09 | 74.30 | 100.00 | 45.13 |  |
| TARF (ours) | 0.00 | 91.96 | 67.94 | 100.00 | 2.62 | 82.67 | 93.71 | 76.24 | 24.22 | 4.87 |  |
| ResNet-18 | Retrained | 0.00 | 97.85 | 76.03 | 100.00 | - | 88.22 | 98.58 | 78.50 | 25.78 | - |
| FT [] | 0.66 | 96.55 | 71.97 | 100.00 | 1.51 | 98.22 | 96.79 | 80.14 | 6.78 | 8.11 |  |
| RL [] | 0.11 | 95.90 | 71.57 | 100.00 | 1.63 | 94.11 | 96.70 | 80.17 | 96.89 | 20.14 |  |
| GA [] | 1.89 | 95.26 | 69.14 | 99.89 | 2.87 | 9.33 | 95.13 | 77.22 | 96.89 | 38.68 |  |
| TARF (ours) | 0.00 | 96.90 | 71.51 | 100.00 | 1.37 | 86.00 | 96.54 | 74.20 | 22.78 | 2.89 |  |
| WideResNet | Retrained | 0.00 | 97.71 | 76.95 | 100.00 | - | 88.11 | 98.37 | 83.61 | 23.56 | - |
| FT [] | 0.67 | 96.61 | 71.29 | 100.00 | 1.86 | 97.44 | 95.70 | 78.70 | 7.33 | 8.29 |  |
| RL [] | 0.00 | 95.86 | 71.36 | 100.00 | 1.86 | 85.77 | 94.69 | 78.26 | 96.00 | 20.95 |  |
| GA [] | 0.44 | 91.49 | 66.29 | 100.00 | 2.26 | 4.33 | 91.76 | 75.18 | 99.11 | 43.71 |  |
| TARF (ours) | 0.00 | 96.51 | 71.77 | 100.00 | 1.60 | 88.00 | 95.50 | 79.06 | 22.67 | 2.11 |  |

### F.4 Full Results with Different Forgetting Tasks

In this section, we provide the full results of Table 1, which is conducted by setting different random seeds (for multiple runs) with the original trails and reported as the mean and std values for each evaluation metric. Tables 13 to 16 presents the performance of unlearning on CIFAR-10, and Tables 17 to 20 presents the performance of unlearning on CIFAR-100. The performance comparison of our TARF with other baseline across the four forgetting tasks (i.e., all matched, target mismatch, model mismatch, and data mismatch) demonstrated the general effectiveness of our algorithm framework.

**Table 13: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-10 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | mean | std | mean | std | mean | std | mean | std | mean | std |  |
| All matched | Retrained | 0.00 | - | 99.51 | - | 94.69 | - | 100.00 | - | - | - |
| FT [] | 4.66 | 3.59 | 98.58 | 0.04 | 92.42 | 0.06 | 100.00 | 0.00 | 1.96 | 0.89 |  |
| RL [] | 2.23 | 1.90 | 98.30 | 0.65 | 91.97 | 0.74 | 100.00 | 0.00 | 1.54 | 0.82 |  |
| GA [] | 0.34 | 0.16 | 95.48 | 0.24 | 88.52 | 0.35 | 99.88 | 0.10 | 2.67 | 0.21 |  |
| IU [] | 0.11 | 0.05 | 72.50 | 15.65 | 68.28 | 14.10 | 99.98 | 0.02 | 13.39 | 7.41 |  |
| BS [] | 24.72 | 0.32 | 88.91 | 0.97 | 81.84 | 0.94 | 89.23 | 0.56 | 14.74 | 0.70 |  |
| $L_{1}$-sparse [] | 0.00 | 0.00 | 94.18 | 0.03 | 90.01 | 0.24 | 100.00 | 0.00 | 2.50 | 0.05 |  |
| SalUn [] | 0.48 | 0.46 | 88.66 | 2.67 | 84.48 | 2.40 | 100.00 | 0.00 | 5.39 | 1.38 |  |
| SCRUB [] | 0.00 | 0.00 | 12.92 | 0.01 | 12.92 | 0.00 | 0.00 | 0.00 | 67.09 | 0.00 |  |
| TARF (ours) | 0.00 | 0.00 | 98.22 | 0.02 | 92.09 | 0.14 | 100.00 | 0.00 | 0.97 | 0.03 |  |

**Table 14: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-10 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | mean | std | mean | std | mean | std | mean | std | mean | std |  |
| Model<br>mismatch | Retrained | 87.76 | - | 99.58 | - | 95.91 | - | 20.57 | - | - | - |
| FT [] | 94.78 | 0.11 | 98.65 | 0.12 | 93.77 | 0.21 | 10.42 | 0.86 | 5.06 | 0.27 |  |
| RL [] | 48.25 | 5.43 | 98.01 | 0.12 | 93.03 | 0.21 | 98.10 | 0.64 | 30.37 | 1.53 |  |
| GA [] | 6.49 | 0.73 | 86.91 | 0.08 | 82.03 | 0.18 | 94.39 | 0.59 | 45.41 | 0.27 |  |
| IU [] | 15.84 | 7.86 | 85.89 | 1.45 | 81.08 | 1.49 | 93.58 | 3.71 | 43.36 | 3.62 |  |
| BS [] | 14.05 | 3.76 | 53.28 | 2.51 | 51.25 | 1.86 | 94.90 | 1.06 | 59.75 | 2.29 |  |
| $L_{1}$-sparse [] | 92.25 | 0.87 | 95.01 | 0.25 | 91.67 | 0.04 | 17.40 | 2.86 | 4.14 | 1.00 |  |
| SalUn [] | 16.31 | 7.40 | 92.91 | 1.05 | 86.50 | 2.12 | 99.24 | 0.09 | 41.55 | 2.14 |  |
| SCRUB [] | 48.62 | 0.02 | 27.86 | 0.03 | 28.29 | 0.05 | 48.64 | 0.01 | 51.63 | 0.02 |  |
| TARF (ours) | 89.91 | 1.20 | 97.73 | 0.24 | 92.66 | 0.17 | 20.36 | 2.54 | 2.45 | 0.46 |  |

**Table 15: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-10 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | mean | std | mean | std | mean | std | mean | std | mean | std |  |
| Target<br>mismatch | Retrained | 0.00 | - | 99.38 | - | 93.85 | - | 100.00 | - | - | - |
| FT [] | 52.23 | 1.80 | 98.43 | 0.05 | 91.74 | 0.09 | 50.59 | 0.15 | 26.18 | 0.40 |  |
| RL [] | 50.63 | 0.62 | 98.21 | 0.65 | 91.51 | 0.61 | 53.88 | 2.36 | 25.06 | 0.12 |  |
| GA [] | 41.64 | 0.82 | 97.05 | 0.04 | 89.68 | 0.17 | 63.23 | 1.10 | 21.23 | 0.43 |  |
| IU [] | 45.32 | 0.81 | 70.25 | 17.82 | 65.67 | 2.76 | 55.98 | 2.76 | 36.66 | 9.37 |  |
| BS [] | 53.78 | 0.16 | 89.67 | 1.02 | 79.34 | 3.95 | 66.31 | 10.02 | 25.36 | 3.28 |  |
| $L_{1}$-sparse [] | 49.55 | 0.08 | 93.57 | 0.05 | 89.06 | 0.23 | 51.33 | 0.09 | 27.21 | 0.05 |  |
| SalUn [] | 47.85 | 1.22 | 87.84 | 3.25 | 83.38 | 2.94 | 58.10 | 2.85 | 27.40 | 1.10 |  |
| SCRUB [] | 43.58 | 0.02 | 3.63 | 1.23 | 3.66 | 0.78 | 56.27 | 0.23 | 63.62 | 0.01 |  |
| TARF (ours) | 0.05 | 0.02 | 97.65 | 0.08 | 91.28 | 0.47 | 100.00 | 0.00 | 1.09 | 0.14 |  |

**Table 16: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-10 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | mean | std | mean | std | mean | std | mean | std | mean | std |  |
| Data<br>mismatch | Retrained | 0.00 | - | 99.53 | - | 95.56 | - | 100.00 | - | - | - |
| FT [] | 96.85 | 0.06 | 98.62 | 0.13 | 93.47 | 0.21 | 6.93 | 0.45 | 48.23 | 0.18 |  |
| RL [] | 73.62 | 2.86 | 97.90 | 0.22 | 92.59 | 0.66 | 52.04 | 2.23 | 31.55 | 1.49 |  |
| GA [] | 9.82 | 1.13 | 96.14 | 0.28 | 90.46 | 0.33 | 90.46 | 0.95 | 6.56 | 0.67 |  |
| IU [] | 15.19 | 7.66 | 94.80 | 0.70 | 89.08 | 0.46 | 92.83 | 4.26 | 8.39 | 2.69 |  |
| BS [] | 16.72 | 0.02 | 61.01 | 0.21 | 53.81 | 4.05 | 93.47 | 1.24 | 25.88 | 1.27 |  |
| $L_{1}$-sparse [] | 95.42 | 0.35 | 94.57 | 0.26 | 91.07 | 0.01 | 10.82 | 1.30 | 48.51 | 0.47 |  |
| SalUn [] | 55.52 | 3.76 | 92.68 | 1.19 | 89.25 | 1.22 | 60.23 | 3.30 | 27.12 | 2.37 |  |
| SCRUB [] | 59.46 | 0.02 | 22.56 | 0.01 | 25.72 | 0.01 | 54.08 | 0.02 | 63.06 | 0.02 |  |
| TARF (ours) | 0.00 | 0.00 | 98.35 | 0.18 | 93.42 | 0.34 | 100.00 | 0.00 | 0.83 | 0.13 |  |

**Table 17: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-100 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | mean | std | mean | std | mean | std | mean | std | mean | std |  |
| All matched | Retrained | 0.00 | - | 97.85 | - | 76.03 | - | 100.00 | - | - | - |
| FT [] | 0.67 | 0.01 | 96.44 | 0.12 | 72.16 | 0.19 | 100.00 | 0.00 | 1.49 | 0.02 |  |
| RL [] | 0.56 | 0.45 | 96.00 | 0.10 | 71.79 | 0.22 | 100.00 | 0.00 | 1.66 | 0.03 |  |
| GA [] | 1.61 | 0.28 | 95.00 | 0.26 | 68.85 | 0.29 | 99.89 | 0.00 | 2.93 | 0.07 |  |
| IU [] | 0.00 | 0.00 | 39.80 | 2.19 | 31.09 | 1.51 | 100.00 | 0.00 | 25.75 | 0.93 |  |
| BS [] | 12.83 | 0.05 | 97.17 | 0.06 | 69.30 | 0.64 | 99.45 | 0.12 | 5.20 | 0.22 |  |
| $L_{1}$-sparse [] | 0.00 | 0.00 | 82.57 | 0.57 | 66.35 | 1.27 | 100.00 | 0.00 | 6.24 | 0.46 |  |
| SalUn [] | 0.00 | 0.00 | 77.00 | 1.66 | 63.06 | 0.92 | 100.00 | 0.00 | 8.46 | 0.64 |  |
| SCRUB [] | 0.00 | 0.00 | 99.72 | 0.26 | 76.69 | 0.06 | 100.00 | 0.00 | 0.64 | 0.08 |  |
| TARF (ours) | 0.00 | 0.00 | 96.67 | 0.24 | 72.40 | 0.14 | 100.00 | 0.00 | 1.21 | 0.09 |  |

**Table 18: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-100 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | mean | std | mean | std | mean | std | mean | std | mean | std |  |
| Model<br>mismatch | Retrained | 88.22 | - | 98.58 | - | 78.50 | - | 25.78 | - | - | - |
| FT [] | 95.45 | 2.78 | 95.91 | 0.89 | 79.74 | 0.40 | 11.56 | 4.78 | 6.34 | 1.77 |  |
| RL [] | 87.11 | 7.00 | 96.27 | 0.44 | 80.00 | 0.17 | 97.95 | 1.06 | 20.75 | 0.61 |  |
| GA [] | 8.06 | 1.28 | 94.98 | 0.15 | 77.09 | 0.13 | 97.34 | 0.45 | 39.18 | 0.50 |  |
| IU [] | 39.95 | 5.28 | 97.22 | 0.39 | 79.71 | 0.63 | 83.28 | 3.17 | 27.08 | 2.05 |  |
| BS [] | 18.56 | 0.56 | 95.87 | 0.03 | 74.96 | 2.68 | 94.95 | 0.28 | 36.27 | 0.87 |  |
| $L_{1}$-sparse [] | 87.11 | 5.00 | 84.35 | 0.18 | 75.61 | 0.39 | 15.56 | 4.45 | 7.84 | 0.69 |  |
| SalUn [] | 74.78 | 8.45 | 79.98 | 1.14 | 71.55 | 0.77 | 65.61 | 11.39 | 19.71 | 5.44 |  |
| SCRUB [] | 0.00 | 0.00 | 13.64 | 2.39 | 12.75 | 2.75 | 99.45 | 0.56 | 78.14 | 1.15 |  |
| TARF (ours) | 84.78 | 1.90 | 97.19 | 0.14 | 80.02 | 0.15 | 28.89 | 2.89 | 2.37 | 1.15 |  |

**Table 19: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-100 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | mean | std | mean | std | mean | std | mean | std | mean | std |  |
| Target<br>mismatch | Retrained | 0.00 | - | 97.85 | - | 73.72 | - | 100.00 | - | - | - |
| FT [] | 58.58 | 0.40 | 96.42 | 0.10 | 72.31 | 0.22 | 45.94 | 0.83 | 28.87 | 0.34 |  |
| RL [] | 57.76 | 1.14 | 96.00 | 0.10 | 72.04 | 0.16 | 50.67 | 3.69 | 27.66 | 1.15 |  |
| GA [] | 22.07 | 0.69 | 96.87 | 0.24 | 70.52 | 0.30 | 90.45 | 0.23 | 8.95 | 0.10 |  |
| IU [] | 30.80 | 0.18 | 39.44 | 2.25 | 31.00 | 1.42 | 63.83 | 0.14 | 42.03 | 0.91 |  |
| BS [] | 40.91 | 0.47 | 98.36 | 0.04 | 70.04 | 1.38 | 85.00 | 0.16 | 15.03 | 0.18 |  |
| $L_{1}$-sparse [] | 49.87 | 2.90 | 82.55 | 0.44 | 66.35 | 1.27 | 50.47 | 3.54 | 30.52 | 1.18 |  |
| SalUn [] | 43.29 | 1.60 | 77.15 | 1.63 | 63.30 | 0.93 | 64.63 | 1.34 | 27.45 | 0.10 |  |
| SCRUB [] | 59.56 | 0.09 | 99.74 | 0.26 | 76.14 | 0.82 | 45.45 | 0.56 | 29.60 | 0.02 |  |
| TARF (ours) | 0.29 | 0.03 | 97.06 | 0.29 | 73.27 | 0.41 | 100.00 | 0.00 | 0.38 | 0.17 |  |

**Table 20: Main Results ($\%$). Comparison with the unlearning baselines. All methods are trained on the same backbone, i.e., the basis of unlearning initialization is the same (except for retraining from scratch). Values are percentages. Bold numbers are superior results. $\downarrow$ indicates smaller are better.**
| CIFAR-100 | Metric | UA | RA | TA | MIA | Gap$\downarrow$ |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | mean | std | mean | std | mean | std | mean | std | mean | std |  |
| Data<br>mismatch | Retrained | 0.00 | - | 98.50 | - | 80.15 | - | 100.00 | - | - | - |
| FT [] | 90.79 | 8.18 | 96.19 | 0.52 | 79.80 | 0.03 | 20.46 | 16.78 | 43.25 | 6.10 |  |
| RL [] | 93.60 | 3.82 | 96.32 | 0.39 | 79.92 | 0.02 | 65.20 | 5.56 | 32.73 | 2.24 |  |
| GA [] | 6.98 | 0.98 | 97.78 | 0.14 | 79.34 | 0.11 | 97.53 | 0.51 | 2.75 | 0.31 |  |
| IU [] | 37.22 | 5.71 | 99.17 | 0.21 | 80.01 | 1.81 | 85.41 | 2.41 | 13.54 | 2.08 |  |
| BS [] | 15.71 | 0.33 | 98.47 | 0.04 | 76.02 | 3.74 | 96.05 | 0.18 | 5.86 | 0.18 |  |
| $L_{1}$-sparse [] | 89.20 | 4.67 | 85.18 | 0.05 | 76.02 | 0.20 | 12.67 | 4.36 | 48.64 | 2.20 |  |
| SalUn [] | 79.00 | 6.07 | 79.92 | 1.05 | 71.55 | 0.51 | 44.18 | 9.96 | 39.42 | 3.62 |  |
| SCRUB [] | 0.00 | 0.00 | 14.08 | 2.47 | 13.48 | 2.48 | 99.45 | 0.55 | 36.83 | 1.37 |  |
| TARF (ours) | 0.00 | 0.00 | 95.80 | 0.79 | 79.55 | 0.57 | 100.00 | 0.00 | 1.61 | 0.05 |  |

## Appendix G Further Discussions

In this work, we explore the label domain mismatch in class-wise unlearning, which aims to enhance the flexibility of data regulation with the increasing concern about the trustworthiness of machine learning. Pushing forward the practical usage of machine unlearning, our research provides a broader consideration of real-world unlearning scenarios and offers significant positive social impacts. It can enhance data privacy protection by allowing individuals to effectively remove their data, ensuring some sensitive data is not used for analysis. In addition, unlearning can remove bias or discrimination by correcting flawed datasets, promoting the development of fairness or other ethical considerations. This feature also enables enterprises to adhere to data protection standards such as GDPR [] and CCPA [], therefore promoting confidence among users.
Our newly introduced unlearning setting, which decouples the class label and the target concept, is more general and discusses the achievability of various unlearning requests, which may often be different from the taxonomy of pre-training tasks.

Although we take a step forward in more practical class-wise unlearning by considering the label domain mismatch scenarios, it is not the end of this direction and there are still many problems to be addressed.
Following the previous works [, , , ], our work mainly focuses on the class-wise unlearning with the classification model for the exploration, future efforts can also be paid in the unlearning problem of the emerging and powerful generative models. On the technical level, although those compared unlearning methods and our framework can achieve the forgetting target, it all requires extra computational cost, and how to make it more efficient can be further studied.

## Peer Reviews

confidence: 3
contribution: 2
initial_rating: 6
presentation: 3
questions: 1.What kind of class (superclass) information have been introduced on the CIFAR-10 datasets for supporting the experiments?
 2. Whether the class information should all be available for the proposed TARF?
soundness: 2
strengths: 1.The experiments are extensive and the results are promising.
2.The research question is novel, and the proposed solution is interesting.
3. The overall presentation is easy to follow.
summary: Machine unlearning is an emerging field focused on enabling models to "forget" specific knowledge derived from training data. While existing research demonstrates that removing knowledge of certain classes can be achieved through techniques like gradient ascent, these 
approaches typically assume a perfect alignment between class labels and target concepts,  limiting their applicability to broader cases. This work expands on this by addressing misalignments in label, model, and data domains by proposing TARget-aware Forgetting  (TARF), a framework that selectively forgets target concepts by combining gradient ascent and descent methods, ensuring that unaffected data remains preserved. Experiments highlight TARF's effectiveness in achieving targeted forgetting.
weaknesses: While TARF shows promise, the experiments are comprehensive and thorough, this study faces several limitations: 
- Study Motivation: The motivation behind this work requires further clarity and discussion. In Section 3.1, there is a mention of "increasing concerns about trustworthiness," but this lacks detail. Expanding on how unlearning can enhance trustworthiness would strengthen this section. Additionally, existing unlearning research is primarily motivated by a desire to protect data owners' right to withdraw from the learning process. Please discuss how this work differs in motivation and approach from previous research.
- Experimental Design: In the experimental section, it is mentioned that superclass information from the CIFAR-10 dataset was used. However, CIFAR-10 does not natively include superclass information. Please clarify if artificial labels were applied to CIFAR-10. Additionally, the main results heavily rely on the appendix for image generation outcomes. Consider reorganizing this part to make key findings more accessible.
- Limitations in Real-World Application: Based on Equation 5 and Phase 1, TARF demonstrates effectiveness primarily when complete class information is available. If class information (such as subclasses or super classes) is unavailable or implicit, TARF may be  limited in real-world applications. Consider discussing this limitation in more depth.

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 2
questions: 1.In the target identification phase, the authors use the prediction loss before and after forgetting to reflect representation similarity, thereby selecting false remaining data. This operation is based on empirical observations from experiments. How should the parameter \beta be controlled during implementation to balance the amount of data being forgotten?

2.Compared to existing methods, the proposed approach adds a target identification phase. Does this phase cause performance degradation in the all-matched scenario? In the experiments, the proposed method shows less performance advantage in the all-matched scenario.

3.In Figure 3, what does "class-aligned data" refer to?

4.In the evaluation metrics, on which dataset is TA applied?

5.In Table 1, for the retrained method, why are the values of the metric UA not equal to 0 in the model mismatch scenario?

6.In the model mismatch scenario, the proposed method performs significantly worse on UA compared to existing methods such as GA, IU, BS, and SalUn. Please analyze the reasons behind this phenomenon. Furthermore, existing methods do not consider the model mismatch scenario, while the proposed method provides a specific solution for this scenario.

7.Since a smaller UA value is better, a downward arrow should be annotated.
soundness: 3
strengths: 1.This paper extends conventional all matched forgetting and proposes a general framework for machine unlearning.

2.The experiments are sufficient to demonstrate the effectiveness of the proposed method.
summary: Machine unlearning aims to enable a model to forget specific data without retraining, making it behave as if the data had never been used during training. This paper introduces a broader machine unlearning framework that extends the conventional all-matched forgetting scenarios. The proposed method performs target identification to recognize false remaining data. Then, the proposed method conducts forgetting on given forgetting data and identified false remaining data, and conducts retaining on identified true remaining data. Finally, extensive experiments validate the effectiveness of the proposed method.
weaknesses: 1.In the model mismatch scenario, the performance of the proposed method is significantly lower than that of existing methods that do not consider model mismatch. 

2.Compared to other approximate unlearning methods, the proposed method has a higher time cost.

3.The organization of the paper needs revision to improve its readability. Additionally, is such an extensive appendix necessary for the completeness of the paper? The current version seems somewhat unfriendly to readers.

---

confidence: 3
contribution: 2
initial_rating: 3
presentation: 2
questions: I don't need any clarifications at this point (I did not understand everything, see above, but I think this is a problem with the writing, so an explanation would not change my assessment of the paper).
soundness: 3
strengths: - The developed viewpoint that the forgetting data may have their own labeling is nice, and I think important.
summary: The paper presents a new formalization of unlearning based on label mismatches between ground truth, the learned hypotheses, and the unlearning data, define new unlearning problems as a result of this formalization, and present an algorithm and results for these problems.
weaknesses: - The problems appear a bit artificial to me. All explanations are based on the concept hierarchy in the CIFAR data. I miss a clear real-world motivation for the setting. For example, I would have thought of a problem as follows: Given a learned classifier from CIFAR, remove all images that have a certain characteristics (e.g., remove all images from copyrighted sources, etc.). This obviously has real-world implications.
I can imagine that this can be formulated in the setting studied by the authors, but it is not clear how, because they always refer to existing classes (and there is no class for "images from copyrighted sources", I guess). Probably what they do is fine for an evaluation, but one should provide a clearer motivation, and then discuss why the restricted CIFAR setting can be used for evaluating the setting discussed in the motivation.

- I really had a hard time in understanding the < notation (this should be a curly <). Maybe this is for similar reasons as discussed above, because I was really looking for an intuitive understanding, not for an explanation that specifies in what way that affects the CIFAR data. Also terms like "false retaining set" and "true retaining set" I found hard to grasp, even though they are formally defined.

- The proposed method has three phases, which are apparently applied sequentially. Even though there is a blended phase in the middle, I would expect that a somewhat tighter integration of these phases would be better.

MINOR CONCERNS:

- I don't think that computation is the main problem with "exact unlearning", it is more that you have to have access to all the training data, i.e., you cannot simply store the model and unlearn new data from it.

- Table 1 is too small. Some of the subscripts cannot be discriminated from each other.

- The paper lists 63 references, many of which are not cited in the paper. I suppose they are cited in the appendix, but then I think the appendix should have a separate bibliography.

- Personally I find it preposterous and disrespectful of the reviewers' commitment to submit a 40 page document to a conference with a 10-page limit. As a result, I did not look at any of the supplementary material, and only read the work as a stand-alone paper. If you have a journal-length paper, do submit it to a journal, and not to a conference where reviewing time is necessarily limited. I did my best to not let this influence my assessment of the paper, but, if anything, the effect was certainly not positive.

---

confidence: 4
contribution: 3
initial_rating: 8
presentation: 3
questions: 1. The article proposes three mismatch scenarios and then establishes a unified framework. What are the commonalities among the three mismatch scenarios? Please give more explanations about how to build a unified framework to deal with these scenarios.
soundness: 3
strengths: 1. The authors introduce new settings in machine unlearning by decoupling the class label and the target concept, and investigate the label domain mismatch in class-wise unlearning, which makes sense and contributes to the community of machine unlearning.

2. The proposed TARF framework is novel in addressing the problem of three typical machine unlearning mismatch (target mismatch, model mismatch, data mismatch), and has the potential to improve the flexibility and practicality of machine unlearning.

3. The experimental results are comprehensive and show that TARF outperforms several baseline methods in different unlearning scenarios. The experiments cover a wide range of datasets and models, which adds to the credibility of the results.

4. This work systematically reveals the challenges of restrictive unlearning with the mismatched label domains, and give a new insight into machine unlearning that the representation gravity in forgetting dynamics is critical for achieving the forgetting target in the new tasks.
summary: This paper proposes a TARget-aware Forgetting (TARF) framework for machine unlearning, which decouples the class label and the target concept and investigates three problems beyond conventional all-matched forgetting. The authors conduct experiments on various datasets to demonstrate the effectiveness of TARF.
weaknesses: 1. The keyword "gravity" is relatively unfamiliar to readers. It should be introduced as much as possible in advance or given a brief introduction to enhance the readability of the article. This would help readers better understand the context and significance of the term within the machine unlearning framework presented in the paper. 

2. Under the three proposed mismatch scenarios, the metrics for measuring the algorithm's effectiveness are not very clear. For example, in the case of model mismatch where the model only outputs superclasses, it is not clear how the accuracy on the unlearning set is calculated. Appendix C only introduces the specific implementation of the baselines and seems to have omitted the specific calculation method of the metrics. This lack of clarity makes it difficult for readers to fully understand and evaluate the performance of the proposed method in different scenarios. It is recommended that the authors provide a more detailed and explicit explanation of how these metrics are calculated in each scenario to enhance the transparency and reproducibility of the research.

Meta-review: This paper present a machine unlearning method adapted in domain mismatch context. It proposes a general framework called TARget-aware Forgetting (TARF) , which decouples the class label and the target concept and investigates three problems beyond conventional all-matched forgetting. Some experiments on various datasets are proposed to demonstrate the effectiveness of the approach. 

Strengths:  
- an interesting research questions,  
- a general framework for machine unlearning,  
- good experimental study,  
- promising results.  

Weaknesses  
- the motivation of the work should be better justified , 
- the problem may appear artificial, 
- some experimental settings were not convincing, 
- the method has a high running time cost,
- the method shows some limitations for real applications, 
- the paper presentation could be improved, notably with respect to the clarity of the evaluation metrics. 

During the rebuttal, authors have provided a long and detailed answers some clarifications and additional results. Reviewers have raised some divergences on the quality of their answers.    
Reviewers have appreciated the effort done by the authors during the rebuttal and the interesting contribution proposed in the paper.  
During the discussion, it appears that a strong majority of the reviewers aligns on the fact that the paper needs significant improvements in terms of motivation (clarity of the motivation, novelty of the work), paper organization, experimental details and the limited real-world capabilities.   

Based on this evaluation I propose then rejection.   
Nevertheless, this paper has a potential and I encourage the authors to improve their submission for other venues.

Decision: Reject