Machine Unlearning for Image-to-Image Generative Models
Authors: Guihong Li
Hsiang Hsu
Chun-Fu Chen
Radu Marculescu
Venue: ICLR 2024 poster (2024)
Keywords: Machine Unlearning
Generative Models
Diffusion Models
GAN
Masked Autoencoder
Primary area: societal considerations including fairness, safety, privacy

Abstract: Machine unlearning has emerged as a new paradigm to deliberately forget data samples from a given model in order to adhere to stringent regulations.
However, existing machine unlearning methods have been primarily focused on classification models, leaving the landscape of unlearning for generative models relatively unexplored.
This paper serves as a bridge, addressing the gap by providing a unifying framework of machine unlearning for image-to-image generative models.
Within this framework, we propose a computationally-efficient algorithm, underpinned by rigorous theoretical analysis, that demonstrates negligible performance degradation on the retain samples, while effectively removing the information from the forget samples. 
Empirical studies on two large-scale datasets, ImageNet-1K and Places-365, further show that our algorithm does not rely on the availability of the retain samples, which further complies with data retention policy.
To our best knowledge, this work is the first that represents systemic, theoretical, empirical explorations of machine unlearning specifically tailored for image-to-image generative models.

Published as a conference paper at ICLR 2024
MACHINE UNLEARNING FOR IMAGE-TO-IMAGE GENERATIVE MODELS
Guihong Li"; Hsiang Hsu", Chun-Fu (Richard) Chen', Radu Marculescu* 'The University of Texas at Austin, USA
Glooba Technology Applied Research, JPMorgan Chase, USA [1gh, radum] @utexas. edu (hsiang. hsu, richard. cf. chen jpmchase. com
ABSTRACT
Machine unlearning has emerged as a new paradigm to deliberately forget data samples from a given model in order adhere stringent regulations. However, existing machine unlearning methods have been primarily focused on classifica- tion models, leaving the landscape of unlearning for generative models relatively unexplored. This paper serves as a bridge, addressing the gap by providing a uni- fying framework of machine unlearning for image-to-image generative models. Within this framework, we propose computationalllyeffiin efffcciiett algorithm, under- pinned by rigorous theoretical analysis, that demonstrates negligible performance degradation on the retain samples, while effectively removing the information from the forget samples. Empirical studies on two large-scale datasets, ImageNet- IK and Places-365, further show that our algorithm does not rely the availabil- ity the retain samples, which further complies with data retention policy. To our best knowledge, this work is the first that represents systemic, theoretical, empir- ical explorations of machine unlearning specifically tailored for image-to- maage-to-imate tm-ge generative models. Our code is available at ceneratoo-unlearning
INTRODUCTION
The prevalence machine learning research and applications has sparked awareness among users, entrepreneurs, and governments, leading to new legislation to protect data ownership, privacy, and copyrights (Schuhmann et al., 2022: Bubeck et al., 2023; Lukas et al., 2023; Bommasani et al., 2021). At the forefront of these legislative efforts is the "Right to be Forgotten", fundamental human right that empowers individuals to request the removal of their information from online services. However, directly erasing data from databases is not enough, as it may already be ingrained in machine learning models, notably deep neural networks (DNNs), which can memorize training data effectively (Wu et al., 2017; Kuppa al., 2021; Carlini al., 2023). Yet another straightforward solution is to re-train DNNs from scratch on new training dataset without the unwanted data a resource-cxpensive procedure (Dhariwal & Nichol, 2021) that can not reflect users' requests timely manner.
In response to various legal requirements and user requests, a novel approach known machine un- learning has been proposed (Nguyen et al., 2022). This technique allows a model, which has been trained with potentially sensitive samples referred to as "forget samples", selectively remove these samples without the necessity of retraining the model from scratch. Meanwhile, machine unlearning aims mínimize any adverse effects on the performance the remaining data, termed "retain sam- ples". Recent unlcarning algorithms have been developed, some incorporating specialized training procedures to facilitate the unlcarning process (Bourtoule et al., 2021), while others adjust model weights through fine-tuning (Tarun al., 2023a). However, these approaches primarily address un- learning in classification problems. On the other hand, generative models, which have demonstrated
Work done during internship at JPMorgan Chase Bank, N.A.
Emaccions include the General Data Protection Regulation (GDPR) by the European Union (Parliament & Council, 2016), the White House AI Bill Congress (2022b), and others (Congress, 2022a; Parliament, 2019).

---

Published as a conference paper at ICLR 2024
Diffusion Models
Diffusion Models
E
VQ VQ-GAN
vQ VAN
Ground Truth
before Unlearning After Unlearning
Ground Truth
Sefore Unlearning After Unlearning
(a) Retain Set
(b) Forget Set
Figure I: Our machine unlearning framework is applicable to various types of 12I generative models, including the diffusion models (Saharia al., 2022a), VQ-GAN (Li et al., 2023) and MAE (He et al., 2022) (cf. Section 4). The images the retain set remain almost (up to a slight difference due to the perplexity of generative models) unaffected before and after unlearning. Conversely, the images in the forget set are nearly noise after unlearning, as designed.
superior data memorization capabilities compared to classification models (Tirumala et al., 2022; Somepalli et al., 2023), excel at regenerating training samples (Kuppa et al., 2021; Carlini et al., 2023). Therefore, the challenge of ensuring effective unlearning for generative models has become increasingly important and pressing.
this paper, our emphasis lies on a particular category generative model architectures known as Image-to-Image (I2I) generative models (Yang et al., 2022). This selection offers twofold advantage: First, paves the way for a groundbreaking approach to quantify the efficucy of machine unlearning for generative models-a research direction hitherto uncharted in existing literature. Informally speaking, we define a generative model as having "truly unlcarned" an image when unable faithfully reconstruct the original image when provided with only partial information (see Figure for an illustrative example where the partial information involves center cropping"). Second, I2I generative models encompass all major branches in the field of vision generative models, including Masked Autoencoder (MAE) (He et al., 2022), Vector Quantized Generative Adversarial Networks (VQ-GAN) (Li et al., 2023), and the more recent diffusion probabilistic models (Ho al., 2020). Based on this novel definition to quantify unlearning, our contributions can be summarized as follows:
We formulate a machine unlearning framework for 12I generative models that is applicable to MAE, VQ-GAN and diffusion models. This formulation, in essence, is an unbounded optimization problem. We provide theoretical derivations that guarantee the unique opti- mality of its bounded counterpart, and design an algorithm for the efficient computation.
We conduct extensive evaluations our algorithm on various 12I generative models, in- cluding MAE, VQ-GAN and diffusion models. Empirical results two large scale datasets, ImageNet-IK (Deng et al., 2009) and Places-365 (Zhou et al., 2017), show that our framework exhibits negligible performance degradation on retain sets, meanwhile ef- fectively eliminating the information in forget sets.
We further illustrate that the availability of the exact retain set is not necessary our framework the efficacy of algorithm remains intact even without any samples from the exact retain set.
For the precise definition, see Scction 3.
2

---

Published as a conference paper at ICLR 2024
To the best of our knowledge, this work is the first that systemically, theoretically, empirically ex- plore the machine unlearning specifically targeting for I2I generative models. Proofs, details on experimental setups and training, and additional results are included in the Appendix.
2 RELATED WORK
121 generative models. Many computer vision tasks can be formulated as 12I generation pro- cesses, such as image super-resolution (Bulat et al., 2018), style transfer (Zhu et al., 2017), image extension (Chang et al., 2022) and inpainting (Krishnan et al., 2019). Different type of I2I generative models utilize diverse training and optimization strategies to minimize the discrepancy between their generated images and the ground truth images. The broadly used Generative Adversarial Networks (GANs) are trained by reducing discriminator's is accuracy in determining whether a generated im- age is real or synthetic (Goodfellow et al., 2014: 4; Karras et al., 2019; Chen et al., 2016; Karras et al., 2020). However, stabilizing the training of GANs is well-known challenge (Arjovsky et al., 2017; Gulrajani et al., 2017: Brock et al., 2019). In contrast, diffusion models address the stability issue by utilizing multi-step generation strategy and are optimized by minimizing the Kullback-Leible (KL) divergence between the distributions of the generated and ground truth images (Ho et al., 2020; Song & Ermon, 2020; Hoogeboom et al., 2022; Salimans & Ho, 2022). Diffusion models can gen- erate higher-fidelity images than GANs but require much longer generation time (Saharia er al., 2022b; Rombach et al., 2022; Zhang& & Agrawala, 2023). Recently, Masked Autoencoder (MAE) has been proposed as mulli--purpose model for both image generation and classification (He et al., 2022: Feichtenhofer et al., 2022: Tong et al., 2022). Typically, MAE is optimized by minimizing the MSE loss between the generated and ground truth images. In this paper, our goal is to design a universal approach that is capable of conducting unlearning across diverse I2I model types with different optimization techniques.
Machine unlearning. Machine unlearning allows trained model to selectively remove some unwanted samples ("forget set") while minimizing any adverse effects on the performance of the remaining data ('retain set") and without retraining the model from scratch (Xu et al., 2023). As the pioneering work on unlearning, SISA facilitates the unlearning of specific samples by retraining the model checkpoints that were initially trained with these "forget" samples (Bourtoule et al., 2021). However, SISA needs to re-train all these models from scratch, if the forget samples are distributed across all shards. To address this problem, several methods manipulate the trained model weights directly. Some works compute the Neural Tangent Kernel (NTK) to modify model weights, but the computation of the Hessian matrix NTK's calculation is numerically unstable and not scalable for models with many parameters (Golatkar et al., 2020a;b). Graves et al. (2021) requires the storage of the gradient for each parameter of every training step when training the original models. This approach is not scalable given the extremely large training set and the enormous model size for the latest image generative models. Other methods improve the efficiency by maximizing loss on the forget set re-assigning incorrect labels but typically they are only applicable to classification tasks. (Neel et al., 2021; Tarun et al., 2023b; Chourasia & Shah, 2023; Kurmanji et al., 2023; Chen et al., 2023). There also some approaches focusing other perspectives of unlearning instead of designing new unlearning algorithms. For example, Chundawat et al. (2023) focuses on the data access issues of existing unlearning algorithms and suggests using the images generated by the original model as the alternative for the original training set. Besides, Jia et al. (2023) shows that that pruning the original model before unlearning can improve the overall performance of many existing unlearning algorithms. Previous unlearning approaches primarily focus on classification tasks, but there are emerging efforts on generative models. For instance, several methods maximize training loss on the forget set, but are validated only on tiny datasets, like MNIST (Bae et al., 2023; Sun et al., 2023). Other works focus on unlearning specific features (e.g., eye color, hairstyle) from generated images, but are only verified under small-scale setups and lack comprehensive analysis (Kong & Chaudhuri, 2023; Moon et al., 2023). Besides, these methods typically manipulate the entire model, thus requiring extensive computation capacity due to the growing complexity and size of generative models. Moreover, none of them addresses 12I generative tasks. This motivates us to explore the efficient unlearning algorithms for 121 generative models in large-scale setups.
3

---

Published as a conference paper at ICLR 2024
3 PROBLEM FORMULATION AND PROPOSED APPROACH
In this work, we primarily address the machine unlearning for I2I generative models that reconstruct images from incomplete or partial inputs. Typically, 121 generative models adopt an encoder-decoder network architecture, comprising two components, namely, (i) an encoder network Eg that encodes an input into representation vector and (ii) a decoder network Dg that decodes the representation vector into the image. Specifically, given an input æ, the output for 121 generative model ha.s is as follows:
he.e DΦ o Ea. ha (T(x)) Dø (Ea (T(x)))
where æ is a ground truth image: T() the operation to remove some information from x, c.g., center cropping and random masking; o is the composition operator; @ and are the parameters for the encoder and decoder, respectively.
3.1 DEFINITION OF UNLEARNING ON 121 GENERATIVE MODELS
For machine unlearning on 121 generative models, given a trained model (i.e., original model) he Dao Eg, with parameters On and do, the unlearning algorithm Ap aims obtain target model:
h Ap (hoo
that satisfies the following properties:
On the retain set DR, ha.e generates images that have the same distribution as the original model;
On the forget set Dr, ha.e generates images that have far different distribution from the original model.
By using the KL-divergence (D), from a probability distribution perspective, these objectives are as follows:
arg min D (Proa (T(X.)) Phoo..(((x.))) and arg max D (Phog..o (T (T())) 0.6
(2)
0,6
where, X, and X, random variables that account for the ground truth images of the retain and forget sets, respectively.
By combining these two objectives, we formulate optimization goal as follows:
arg min (TPN -all all (P
(3)
0.6
where a is positive coefficient to control the trade-off between the retain and forget sets. Multiple previous works assume trained 12I generative model do an almost perfect generation on both of the retain and forget sets (Wallace et al.. 2023; Song et al., 2023; Xia et al., 2023; Kingma & Welling, 2019); that is, hep.on (T (X)) X. Therefore, Eq. (3) can be rewritten as:
arg min (D 1D(PP) (Px. aD (Px,1xx, }. &, = he.s (X,)). & = he.s (T(x)) (4)
0,6
where Px, and Px, represent the distribution of ground truth images and generated images in the retain set; Px, and Px, represent the distribution of ground truth images and generated images in the forget set.
3.2 OPTIMIZATION ON RETAIN AND FORGET SETS
Clearly, for the first term in Eq. (4), perfect unlearned model has no performance degradation on the retains set. In other words, the generated images share the distribution as ground truth images,
ie., Px,- = Px.- This way, the value of (Px. IPx.) 1Px.1PXx. is O. Next, we discuss the optimization for the forget set.

---

Published as a conference paper at ICLR 2024
To minimize the value for the objective functions in Eq. (4), need to maximize KL divergence be- tween Px, and Px, However, there are infinitely many probability distributions that have infinity KL divergence with px, (see Appendix A for more details). The oc value for the KL divergence will lead to unbounded loss values thus hurting the stability of the unlearning process. To address this problem, we derive an optimal and bounded KL divergence for the forget set under some reasonable constraints:
Lemma Given the distribution of the forget samples Px, with zero-mean and covariance matrix E, consider another signal P Px, which shares the same mean and covariance matrix. The maximal Ki-diveree between Px, and Px achieved when Px, N (0, (Cover & Thomas, 2012); that is:
D (Px, S D (Px, E))
(5)
We note that making Px, share the same mean and covariance matrix as Px, can preserve the original training set statistical patterns. Consequently, it becomes statistically challenging to decide whether a generated image belongs to the forget set, thereby protecting data privacy. Morcover, the assumption of zero mean is natural since typically images normalized by subtracting the mean value inside neural networks. We provide some empirical analysis to demonstrate the benefits of Gaussian distribution (cf. Section 4.4).
Essentially, Lemma indicates that the maximal KL divergence w.r.t Px, is achieved when the generated images Px, follow the Gaussian distribution N (0, Σ). Hence, we can directly optimize xx, towards this optimal solution by minimizing their KL-Divergence; that is:
arg min (D (Px.11Px. + taD (N (0, 8, = ho. (T (X,)),, X, = ho, (X))) 0.6
(6)
This way, avoid the problem of the infinity value of KL-divergence in Eq. (4). We note that, for previous unlearning approaches for classification tasks, it's natural and straightforward to directly compute the KL-divergence for final outputs since the outputs are exactly kingeevarrible discrete distributions after the SoftMax function (Zhang et al., 2023a;b; Kurmanji et al., 2023). Neverthe- less, for image generation tasks, directly computing the KL divergence between high-dimensional output images is typically intractable, excluding the special case of diffusion models. To address this problem, we next convert the KL divergence into more efficient Lę loss which is generally applicable to diverse 12I generative models.
3.3 PROPOSED APPROACH
Directly connecting the LL-eeeereence with the L2 loss is difficult. Instead, we use Mutual Infor- mation (MI) as a bridge to help with the analysis. As indicated in Eq. (6), reach the minimal objective value when Px, = Px, and P&,, = NO0 E). This optimum can also be achieved by maximizing the mutual information (7) between X,, and X, (or between n ~ NN(,, and X 8)); that is:
arg max (1 (xr: +al (1: n ( &, h (T (T(X))) &, ha,5 (T (Xx))
0,0
We next link the MI with more tractable L2 loss in the representation space.
Theorem Suppose the original model can do perfect generation, i.e., hes (T (T X.
Assume the target model he uses the same decoder as the original model h8c.00 (i.e., Do D==11 Dzp and the output of the encoders is normalized, i.e., [[())=) = Ee, (x))12 = 1. On the retain set, minimizing the Le loss between the output of the target model encoder Eg and the original model encoder Fa, will increase the lower bound of mutual information:
K
K ey Rag
I(X,; 2 log (K)
EE
log
e
Σ ==1
(8)
K
1=1
5

---

Published as a conference paper at ICLR 2024
Xf
model (Learnable)
DF
Encoder Eg
Forget set
LF E6 (T(z)) Eso (I(1))
2))
LR [[x(T(x))) Ea, (T(x)))l2
Encoder Ego
DR
Original model (Fised)
Retain set
Xy
Figure 2: Overview of our approach. On Dr, minimize the L2-loss between embedding vectors of the forget samples y and embedding vectors Gaussian noise n. On DR. we minimize the L2- loss between the same image embedding vectors generated by target model encoder and the original model encoder.
where e; = Fig (T(rr;)) Ea, (T( () and Rag = Eag (T(r))) Ea, (T(Trr)) Dr; are the data samples in the retain For the forget set, have:
C ]]
[(;; (1) 2 log (K)
log
E
Σ
~~~((0,))
where 6; = Eg (T()))) Edo (T(n,)) ((n,))) 1l2 and Fij = Eoo (T. (T(n))) Izis are the data samples in the forget set and n4 (O, E).
We remark that both R.y and Fij are determined by the original encoder Eg,- thus are fixed values. As illustrated in Theorem by directly reducing the L2 loss (6; and c;) between the target encoder and the original encoder, the Mutual Information (MI) increases, concurrently reducing the KL. divergence between Px, and Px, (or between Px, and NN.. Hence, in our approach, we sidestep the intractability of computing MI KI. divergence by directly minimizing the values of and 6;- Based on these insights, we next introduce our approach.
Efficient Unlearning Approach. Finally, as shown Fig. we propose our efficient unlearning approach for 121 generative models follows:
oo) arg min
E
Eo (T(a,)) Eog (T(,,,)) alEo (T(#;,)) Esg (T())))]
(10)
Sxy E EDRIFI E Dp,n D N(0,7))
We provide the details of our unlearning algorithm and corresponding pseudo code in Appendix C.4.
We note that our proposed approach only involves the encoders. Hence, it's more efficient than ma- nipulating the entire model. Moreover, our approach is generally applicable various 12I generative models with the encoder-decoder architecture (including the diffusion model, VQ-GAN, or MAE), although they typically use different optimization methods. We illustrate this generalizability the experiments part.
4 EXPERIMENTAL RESULTS
We evaluate our proposed approach on three mainstream 121 generative models: (i) diffusion mod- els (Saharia al., 2022a), (ii) VQ-GAN (Li et al., 2023), and (iii) MAE (He et al., 2022).
4.1 EXPERIMENTAL SETUP
Dataset Task. We verify our method on two mainstream large-scale datasets: (7) ImageNet- 1k. Out of total 1K classes, randomly select 100 classes D and another 100 classes Dr. (i)

---

Published as a conference paper at ICLR 2024
Table 1: Results of cropping 8 x patches at the center of the image, where each patch is 16 16 pixels. "t' means higher is better and "J" means lower is better. R and F account for the retain set and forget set, respectively. 'rrxxy DR" means that we use the images from other classes as a substitute of the real retain set to do the unlearning (cf. Section 4.3).
Diffasion Models IS
VQ-GAN IS
MAE IS
FID
CLIP
FID
CLIP
FID
CLIP
Pt
FL
R1
FL
R4
FT
R1
R²
FL
R1
R81
F_
R1
FL
Oviginul
14.6
0.89
14.4
56.7
23.0
45.7
17.1
0.77
0.76
115.2
75.8
19.4
15.2
NOISY LABEL,
14.7
36.9
19.3
19.1
0.86
0.80
14.8
79.5
17.2
11.4
0.74
0.64
60.4
136.5
21.6
12.8
0.71
0.67
RETAIN LABEL
23.1
101.7
18.2
12.3
0.81
0.69
21.8
23.3
18.2
18.3
0.72
0.74
72.8
145.3
18.8
11.6
0.59
0.66
RANDOM ENCODER
15.3
30.6
16.7
19.4
0.86
0.81
14.7
72.8
18.6
14.1
0.74
0,64
56.1
146.4
22.3
12.8
0.72
0.67
Ours
13.4
107.9
10.3
0.87
0.69
15.0
83.4
0.60
153,
21.8
11.0
Ours (Proxy Da)
17.9
75.5
0.83
0.74
17.6
69.7
61.1
133.8
21.0
12.3
0.72
Table Results of cropping 4 x patches at the center of the image, where each patch is 16 x 16 pixels. 't' means higher is better and "I" means lower is better. R and F account for the retain set and forget set, respectively. "Proxy DR" means that we use the images from other classes as a substitute of the real retain set to do the unlearning (cf. Section 4.3).
Diffusion Models
VO-GAN IS
MAE IS
FID
IS
CLIP
FID
CLIP
FID
CLIP
Ft
Rt
F1
FL
FL
FL
Ft
Original model
7.8
6.0
10.3
11.2
0.93
0.96
8.4
7.8
15.1
14.2
0.84
0.85
11.4
15.8
50.8
46.6
0.87
0.87
MAX Loss
11.9
15.4
10.0
11.0
0.88
0.93
9.2
39.9
15.2
13.1
0.83
0.72
13.3
20.2
50.8
46.0
0.86
0,83
NOISY LABEL
19.6
18.5
10.4
10.6
0.87
0.91
8.7
21.3
15.2
14.1
0.84
0.80
12.2
11.3
50.0
35.1
0.86
0.82
LABEL
0.81
RANDOM ENCODER
15.3
11.6
10.1
11.1
0.86
0.94
8.6
19.4
15.3
14.4
0.84
0.81
11.8
43.6
50.3
36.3
0.86
0.83
Ours
8,2
39.8
10.3
10.7
0.93
0.88
8.6
22.0
15.0
14.1
0.84
0.79
12.2
45.1
49.7
34.8
0.56
0,83
Ours (Proxy Pa)
11.2
29.0
10.3
10.8
0.91
0.9
8.9
20.0
15.4
14.3
0,84
0.80
12.5
39.9
19.5
36.8
0.86
0.83
Places-365. From all 365 classes, we randomly select 50 classes as Dn and another 50 classes as Dr. We test our method on image extension, uncropping, and reconstruction tasks. We report the results of center uncropping (i.e., inpainting) in the main paper. The results of other tasks are given in Appendix D and E.
Baseline. We first report the performance of the original model (i.e., before unlearning) as the reference. Since our approach is the first work that does the unlearning for I2I generative models, there are no previous baselines we can directly compare against. Therefore, we implement three different unlearning approaches that were designed for other tasks, and adapt them 12I generative models, including (i) MAX LOss maximizes the training loss w.r.t. the ground truth images on the forget set (Halimi et al., 2022; Gandikota al., 2023; Warnecke et al., 2023); (ii) NOISY LABEL minimizes training loss by setting the Gaussian noise as the ground truth images for the forget set (Graves al., 2021; Gandikota al., 2023); (iii) RETAIN LABEL minimizes training loss by setting the retain samples as the ground truth for the forget set (Kong & Chaudhuri, 2023); (iv) RANDOM ENCODER directly minimizes the La loss between the encoder's output on the forget set and Gaussian noise (Tarun et al., 2023b). For all these baselines, we use the retain samples with some regularization to avoid hurting the performance on the retain set. For more details, please check Appendix C.6.
Evaluation metries. We adopt three different types of metrics to compare our method against other baselines: (i) inception score (IS) of the generated images (Salimans et al., 2016), (ii) Fréchet inception distance (FID) against the real images (Heusel et al., 2017) and (iil) CLIP embedding distance between the generated images and the real images (Radford et al., 2021). IS assesses the quality of the generated images alone, while FID further measure the similarity between generated and real images. On the other hand, the CLIP embedding distance measures whether not the generated images still capture similar semantics.
4.2 PERFORMANCE ANALYSIS AND VISUALIZATION
As shown in Table and Table 2, compared to the original model, our approach has almost identical performance or only slight degradation the retain Meanwhile, there significant perfor-
7

---

Published as a conference paper at ICLR 2024
Retoin Set
Forget Set
Ground Truth
Original Model
Mox
Noee
REToN
Ramnow Escoos4
Ours
Figure 3: Results of cropping 8 patches at the center of the image diffusion models, where each patch is 16x x 16 pixels. Our method has negligible-to-slight performance degradation on diverse 121 generative models and multiple generative tasks. (cf. Appendix and E.
Ditfusion Models
VQ-GAN
30
20
20-
10
10
-20
20
Unlear:: Forget
Retain
Ground Forget
Figure 4: T-SNE amalysis of the generated images by approach and ground truth images. After unlearning, the generated retain samples are close to or overlapping with the ground truth (orange vs. blue), while most of generated forget images diverge far from the ground truth (green red).
mance drops on the forget set across all these three models for all metrics. In contrast, none of these baselines generally works well. For example, RANDOM ENCODER achieves similar performance on VQ-GAN and MAE to methods; however, is much worse diffusion models. Similarly, RETAIN LABEL works well for diffusion models, but cannot generalize to VQ-GAN and MAE. We also show some generated images in Fig. 3. As shown, approach removes the information in the forget set while preserving the performance on the retain set.
T-SNE analysis. To further analyze why our approach works well, we conduct the T-SNE analysis. Using our unlearned model, we generate 50 images for both the retain and forget sets. We then compute the CLIP embedding vector of these images and their corresponding ground truth images. As shown in Fig. 4, after unlearning, the CLIP embedding vector on the retain set is close to or overlapping with the ground truth images, while most of generated images on the forget set diverge far from the ground truth.
These results verify that our method generally applicable to mainstream 12I generative models and consistently achieves good results all these models. We provide more results under various types of cropping in Appendix D and Appendix E.
4.3 ROBUSTNESS TO RETAIN SAMPLES AVAILABILITY
In machine unlearning, sometimes the real retain samples are not available due to data retention policies. To address this challenge, we evaluate our approach by using other classes of images as substitute to the real retain samples. On ImageNet- 1 since we already select 200 classes for forget and retain sets, we randomly select some images from the remaining 800 classes the "proxy retain set" used in the unlearning process. Similarly, for Places-365, we randomly select some images from the remaining 265 classes as the "proxy retain set" used in the unlearning process. We also ensure these "proxy retain sets" have the same number of images as the forget set.
As shown in the last row in Table 1 and Table 2, our method works well even without the access to the real/original retain set. Compared to using the real/original retain set, there is only slight performance drop. Hence, our approach is flexible and generally applicable without the dependency
8

---

Published as a conference paper at ICLR 2024
Table 3: Ablation study of a's values. We test the performance of cropping patches at the center of the image. As shown, 0.25 achieves a good balance between the preserving the performance on retain set, while remove the information on forget sets across these two models.
VQ-GAN
MAE
0.01
0.05
0.2
0.25
0.5
0.01
0.05
0.2
0.25
0.5
RL
90.8
91.6
92.0
91.7
92.7
92.2
94.7
113.6
113.2
113.9
116.7
115.9
116.3
116.7
101.2
169.4
179.5
181.3
183.4
182.2
184.6
179.0
198.6
205.1
211.5
213.0
213,4
213.0
12.5
12,4
12.2
12.0
13.4
13.5
13.2
13.3
18
P3
11.5
8.4
7.8
7.9
8.1
7.9
8.0
9.3
9.0
8.5
8.0
8.0
8.1
7.9
Rr
0.65
0.65
0.65
0.65
0.65
0.65
0.64
0.81
0.81
0.81
0.80
0.80
0.80
0.80
CLIP
Pb
0.66
0.55
0.54
0.54
0.54
0.54
0.54
0.79
0.78
0.78
0.78
0.78
0.78
0.78
on the real retain samples. We provide the results with limited availability the real retain samples in Appendix D.1.
4.4 ABLATION STUDY
For the ablation study, we test the results of cropping patches the center of the image under various setups, where each patch is 16 x 16 pixels.
a's value. We vary the value of a in Eq. (10) to obtain multiple models and then evaluate their performance. As shown in Table 3, when is 0.25, our approach achieves good balance between the forget set and the retain set. Hence, we set a 0.25 as default value for our approach. We provide more ablation study in Appendix E.
CONCLUSIONS AND FINAL REMARKS
In this paper, have formulated the machine unlearning problem for I2I generative models and derived an efficient algorithm that is applicable across various 12I generative models, including diffusion models, VQ-GAN, and MAE Our method has shown negligible performance degradation on the retain set, while effectively removing the information from the forget set, on two large-scale datasets (ImageNet-IK and Places-365). Remarkably, our approach is still effective with limited or no real retain samples. To our best knowledge, we are the first to systematically explore machine unlearning for image completion generative models.
Limitations. First, our methods are mainly verified on 121 generative models. Second, our ap- proach requires the access of original/real forget samples yet sometimes they are unavailable. Be- sides, for the simplicity of evaluation, we only test approach some mainstream computer vision datasets. Our approach has not been verified under a more practical/useful scenarios, e.g., remove the pornographic information for 121 generative models.
Future directions. We plan to explore applicability to other modality, especially for language/text generation and text-to-image generation. The dependency on the forget set is another challenge that enable flexibility in the unlearning for generative models. Finally, we also intend to develop some more practical benchmarks related to the control of generative contents and protect the data privacy and copyright.
DISCLAIMER
This paper was prepared for informational purposes by the Global Technology Applied Research center of JP- Morgan Chase & Co. This paper is not a product of the Research Department of JPMorgan Chase & Co. or its affiliates. Neither JPMorgan Chase & Co. nor any of its affiliates makes any explicit or implied representation or warranty and none of them accept any liability in connection with this paper, including, without limitation, with respect the completeness, accuracy, reliability of the information contained herein and the potential legal, compliance, tax, accounting effects thereof. This document is not intended as investment research or investment advice, or as a recommendation, offer, or solicitation for the purchase or sale of any security, financial instrument, financial product or service, or to be used in any way for evaluating the merits of partic- ipating in any transaction. Guihong Li's and Radu Marculescu's 's contributions were made part of Guihong Li's intersship at the Global Technology Applicd Research center of JPMorgan Chase & Co.

---

Published as a conference paper at ICLR 2024
Ethics statement. Machine unlearning for 121 generative models can be effectively exploited to avoid generate contents related user privacy and copyright. Morcover, unlearning for 121 models can avoid generating harmful contents, such as violence or poroograpyy.
Reproducibility statement. All the datasets used in this paper are open dataset and are available to the public. Besides, our codes are primarily based on PyTorch (Paszke et al., 2019). We use several open source code base and model checkpoints build our own approach (see Appendix C.I). Our approach can be implemented by obtaining the outputs of target model's encoders and the original model's encoders and then computing the Ly-loss between them. We provide more implementation details in Appendix C.
REFERENCES
Martín Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In Inter- national Conference on Machine Learning, pp. 214-223, PMLR, 2017.
Scohui Bac, Scoyoon Kim, Hyemin Jung, and Woohyung Lim. Gradient surgery for one-shot unlcarning on generative model. CoRR, abs/2307.04550. 2023.
Mohamed Ishmael Belghazi, Aristide Baratin, Sai Rajeshwar, Sherjil Ozair, Yoshua Bengio, Aaron Courville, and Devon Hjelm. Mutual information neural estimation. In International Conference on Machine Learning, pp. 531-540. PMLR. 2018
Rishi Bommasani, Drew A. Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S. Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, Erik Brynjolfssonn, Shyamal Buch, Dallas Card, Rodrigo Castellon, Niladri S. Chatterji, Annie S. Chen, Kathleen Creel, Jared Quiney Davis, Dorottya Demszky, Chris Donahue, Moussa Doumbouya, Esin Durmus. Stefano Ermon, John Etchemendy, Kawin Ethayarajh, Li Fei-Fei, Chelsea Finn. Trevor Gale, Lauren Gillespie, Karan Goel, Noah Goodman, Shelby Grossman, Neel Guha, Tatsunori Hashimoto, Peter Henderson, John Hewitt, Daniel E. Ho, Jenny Hong. Kyle Hsu, Jing Huang, Thomas Icard, Saahil Jain, Dan Jurafsky, Pratyusha Kalluri, Siddharth Karamcheti, Geoff Keeling, Fereshte Khani, Omar Khattab, Pang Wei Koh, Mark S. Krass, Ranjay Krishna, Rohith Kuditipudi, and et al. On the opportunitics and risks of foundation models. CoRR, abs/2108. 07258, 2021.
Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-
Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 42nd IEEE Symposium Security and Privacy, SP 2021, San Francisco, CA, USA, 24-27 May 2021, pp. 159. IEEE, 2021.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019.
Sébastien Bubeck, Varun Chandrasekaran, Ronen Eldan. Johannes Gehrke, Eric Horvitz, Ece Kamar, Peter Lee, Yin Tat Lec, Yuanzhi Li, Scott M. Lundberg, Harsha Nori, Hamid Palangi, Marco Túlio Ribeiro, and Yi Zhang. Sparks of artificial general intelligence: Early experiments with GPT-4, CoRR, abs/2303.12712, 2023.
Adrian Bulat, Jing Yang. and Georgios Tzimiropoulos. To learn image super-resolution, use a gan to learn how to do image degradation first. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 205-200, 2018
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagiclski, Vikash Schwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 5253-5270, 2023.
Huiwen Chang, Han Zhang, Lu Jiang, Ce Liu, and William T. Freeman. Maskgit: Masked generative image transformer. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 1 11305-11311 IEEE, 2022.
Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver. BC, Canada, June 17-24. 2023, pp. 7766-7775. IEEE, 2023.
Xi Chen, Yan Duan, Rein Houthooft, John Schulman, Ilya Sutskever, and Pieter Ahheel. Infogam: Interpretable representation learning by information maximizing generative adversarial nets. In Advances in Neural In- formation Processing Systems, pp. 2172-2180, 2016.
Rishav Chourasia and Neil Shah. Forget unlearning: Towards true data- data-deletion in machine learning. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 6028-600 -0736 PMLR, 2023.
10

---

Published as a conference paper at ICLR 2024
Vikram S. Chundawat, Ayush K. Tarun, Murari Mandal, and Mohan S. Kankanhalli, Zero-shot machine 2023.
learning. IEEE Trans. Inf. Forensics Secur,
Japan Congress. Act on the protection of personal information, 2022a. URL http:pp:://wwwppp...p fi lesle/ httpp//ff2222__mmeeeeae
aw. -.d...
United States Congress. American data privacy and protection act, 2022b. www.htttss//ww..oggreeeeeee
gov/bi11/117hh congress cosuuse-billle
T.M. Cover and J.A. Thomas. Elements of Information Theory, chapter 12, pp. 409-413, Wiley, 2012. ISBN 9781118585771
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Computer Society Conference Computer Vision and Pattern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida, USA, pp. 248-255. IEEE Computer Suciety, 2009.
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat gans image synthesis. In Advances Neural Information Processing Systems, pp. 8780-8794, 2021.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In 9th Interna- tional Conference on Learning Representations, ICLR 2021, Viriual Event, Austria, May 3-7, 2021. Open- Review.net, 2021.
Christoph Feichtenhofer, Yanghao Li, Kaiming Hc, ct al. Masked autoencoders as spatiotemporal learners. In Advances Neural Information Processing Systems, volume 35, pp. 35946-35958, 2022.
Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman and David Bau. Erasing concepts from diffusion models. CoRR, hatp///33300334535 2023.
Aditya Golatkar. Alessandro Achille, and Stefano Soatto. Eternal sunshine the spotless net: Selective forget- ting in deep networks. In 2020 IEEF/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle WA, USA, June 13-19, 2020, pp. 9301 19909. Computer Vision Foundation / IEEE, 2020a.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 383-398. Springer. 2020b.
lan J. Goodfellow, Jean Pouget-Abadie, Mchdi Mirza, Bing Xu, David Warde-Farley Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial networks. CoRR,
2014.
Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, pp. 11516-11524, 2021.
Ishaan Guirajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C. Courville. Improved training of wasserstein gans. In Advances in Neural Information Processing Systems, pp. 5767-5777, 2017.
Anisa Halimi, Swanand Kadhe, Ambrish Rawat, and Nathalie Baracaldo. Federated unlearning: How to effi- ciently crase a client in fi? CoRR, abs/2207 0055211,0.0.1....11111 2022.
Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross B. Girshick. Masked autoencoders are scalable vision learners. In IEEF/CVF Conference on Computer Vision and Pottern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 15979-15988.. IEEE, 2022.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In Advances Neural Information Processing Systems, pp. 6626-666 0886-6637,20 2017.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion prohahilistic models. Advances in neural information processing systems, pp. 6840-6851, 2020.
Emiel Hoogeboom, Alexey A. Gritsenko, Jasmijn Bastings, Ben Poole, Rianne van den Berg, and Tim Sali- mans. Autoregressive difffusion models. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022. OpenReview.net, 2022.
Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsification can simplify machine unlearning. CoRR, hass/2004004944 2023.
11

---

Published as a conference paper at ICLR 2024
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In JEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, pp. 4401-4410 Computer Vision Foundation IEEE, 2019.
Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In 2020 IEEF/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pp. 8107-8116. Computer Vision Foundation / /IFE, 2020.
Diederik P. Kingma and Max Welling, An introduction to variational autoencoders. Found. Trends Mach. Leurn., 3074)3307-392, 2019.
Lingpeng Kong. Cyprien de Masson d' Autume, Lei Yu, Wang Ling, Zihang Dai, and Dani Yogatama. A mutual information maximization perspective of language representation learning. 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020.
Zhifeng Kong and Kamalika Chaudhuri. abs/2305.1 1351, 2023.
Data redaction from conditional generative models. CoRR,
Dilip Krishnan, Piotr Teterwak, Aaron Sarna, Aaron Maschinot, Ce Liu, David Belanger, and William T. Free- man. Boundless: Generative adversarial networks for image extension. In 2019 IEEE/CVF International Conference on Computer Vision, ICCV 2019, Seoul, Korea (South), October 27 November 2, 2019, pp- 10520-10529. IEEE, 2019.
Aditya Kuppa, Lamine M. Aouad, and Nhien-An Le-Khac. Towards improving privacy of synthetic datasets. In Privacy Technologies and Policy- 9th Annual Privacy Forun, APF 2021, Oslo, Norway, June 17-18, 2021, Proceedings, volume 12703 of Lecture Notes in Computer Science, pp. 109-119. Springer, 2021.
Meghdad Kurmanji. Peter Triantafillou, and Eleni Triantafillou. Towards unbounded machine unlearning. CoRR, abs/2302.09880. 2023.
Tianhong Li, Huiwen Chang, Shlok Kumar Mishra, Han Zhang, Dina Katabi, and Dilip Krishnan. MAGE: masked generative encoder to unify representation learning and image synthesis. In IEEE/CVF Conference on Computer Vision and Puttern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. 2142-2152. IEEF, 2023.
Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella Béguelin. An- alyzing leakage personally identifiable information language models. 44th IEFE Symposium on Security and Privacy, SP 2023, San Francisco. CA, USA, May 21-25, 2023, pp. 346-363. IEEE, 2023.
Saemi Moon, Seunghyuk Cho, and Dongwoo Kim. Feature unlearning for generative models via implicit feedback. CoRR, abs/2303.05599, 2023.
Seth Neel, Aaron Roth, and Saeed Sharifi Marriii-Malvvjerdi.. Descent-to-delete: caadient-based methods for machine unlearning. In Algorithmic Learning Theory, 16-19 March 2021, Virtual Conference, Worldwide, volume 132 of Proceedings of Machine Learning Research, pp. 931-962. PMLR, 2021.
Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. survey of machine unlearning. CoRR, abs/2209.0222222 2022.
Canada Parliament. The personal information protection and electronic documents act (pipeda), 2019. URL https:: /ate:s//wwwwwaae lois.. s. justice. gc. ca /PFF//FPPP /P-8. 6, pdf.
European Parliament and Furopean Union Council. Regulation (eu) 201 0016/77 of the european parliament and of the council 27 april 2016 on the protection of natural persons with regard the processing of personal data and on the free movement of such data, and repealing directive 95/46/ec (general data protection regulation) (text with eea relevance). 2016. URL https: /eeurrureees -eae--ex... europa eu/ e//eell//eeggg /eeg///e////// 2016 679/oj.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Z. Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high- perforacformanc deep learning library. In Advances in Neural Information Processing Systems, pp. 8024 8035, 2019.
Ben Poole, Sherjil Ozair, Aaron Van Den Oord, Alex Alemi, and George Tucker. On variational bounds of mutual information. In International Conference Machine Learning, pp. 5171-5180. PMLR, 2019.
12

---

Published as a conference paper at ICLR 2024
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pp. 8748 8763. PMLR, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz. Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In IREE/CVF Conference Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 10674-10685. IEEE, 2022.
Chitwan Saharia, William Chan, Huiwen Chang, Chris A. Lee, Jonathan Ho, Tim Salimans, David J. Fleet, and Mohammad Norouzi. Palette: Image-to-image diffusion models. In SIGGRAPH '22: Special Interest Group on Computer Graphics and Interactive Techniques Conference, Vancouver, BC, Canada, August 7 11, 2022, pp. 15:1-15:10. ACM, 2022a.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo Lopes, Bureu Karagol Ayan, Tim Salimans, Jonathan Ho, David Flect, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with deep language understanding. In Advances in Neural Information Processing Systems, pp. 36479-36494, 2022b.
Tim Salimans and Jonathan Ho. Progressive distillation for fast sampling of diffusion models. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022, Open- Review.net, 2022.
Tim Salimans, Ian J. Goodfellow, Wojeiech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In Advances in Neural Information Processing Systems, pp. 2226-2234, 2016.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. LAION-5B: an open large- scale dataset for training next generation image-text models. In Advances Neural Information Processing Systems, 2022.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. IEEE, 2023.
Bowen Song, Soo Min Kwon, Zecheng Zhang, Xinyu Hu, Qing Qu, and Liyue Shen. Solving inverse problems with latent diffusion models via hard data consistency. CoRR, abs/2307.06 000770881333 2023.
Yang Song and Stefano Ermon. Improved techniques for training score-basee based generative models. In Advances in Neural Information Processing Systems, pp. 12438- 12448,, 2020.
Hui Sun, Tianqing Zhu, Wenhan Chang, and Wanlei Zhou, Generative adversarial networks unlearning. CoRR, 198881, 2023.
Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unlcamiing. IEEE Transactions on Neural Networks and Learning Systems, 2023a.
Ayush Kumar Tarun, Vikram Singh Chundawat, Murari Mandal, and Mohan S. Kankanhalli. Deep regression unlearning. In International Conference on Machine Learning, pp. 33921-330333 -33939, PMLR, 2023b.
Kushal Tirumala, Aram H. Markosyan, Luke Zettlemoyrr. and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models. In Advances in Neural Information Processing Systems, pp. 38274-38290, 2022.
Zhan Tong, Yibing Song. Jue Wang, and Limin Wang. Videomae: Masked autoencoders are data-efficient learners for sulf-super video pre-training. In Advances in Neural Information Processing Systems, volume 35, pp. 10078-10093, 2022.
Bram Wallace, Akash Gokul, and Nikhil Naik. EDICT: exact diffusion inversion via coupled transforma- tions. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, 22532 22541. IEEE, 2023.
Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and labels. In 30th Annual Network and Distributed System Security Symposiuon, NDSS 2023, San Diego California, USA, February 27- March 3, 2023. The Internet Society, 2023.
13

---

Published as a conference paper at ICLR 2024
Mike Wu, Chengxu Zhuang. Milan Mosse, Daniel Yamins, and Noah Goodman. On mutual information in contrastive learning for visual representations. arXiv preprint arXiv:2005. 13149, 2020.
Yuhuai Wu, Yuri Burda, Ruslan Salakhutdinov, and Roger B. Grosse. On the quantitative analysis of decoder- International Conference on Learning Representations, ICLR 2017, Toulon,
based generative models. France, April 24-26, 2017, Conference Track Proceedings. 2017.
Weihao Xia, Yulun Zhang, Yujuu Yang, Jing-Har Hao Xue, Bolei Zhou, and Ming- Hsuan Yang. GAN inversion: survey, IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(3):3121 -138, 2023.
Heng Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S. Yu. Machine unlearning: A survey, ACM Comput. Surv., 56(1), aug 2023.
Ling Yang. Zhilong Zhang, Yang Song. Shenda Hong, Runsheng Xu, Zhao, Yingxia Shao, Wentao Zhang, Ming-Hsune Hauan Yang. and Bin Cui. Diffusion models: A comprehensive survey of methods and applications. CoRR, abs/2209.007 .0099, 2022.
Lvmin Zhang and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. CoRR,
abs/2302.05543, 2023.
Xulong Zhang. Jianzong Wang. Ning Cheng, Yifu Sun, Chuanyao Zhang, and Jing Xiao. Machine unlearning methodology based on stochastic teacher network. In Advanced Data Mining and Applications 19th In- ternational Conference, ADMA 2023, Shenyang, China, August 21-23, 2023, Proceedings, Part V, volume 14180 of Lecture Notes Computer Science, pp. 250-261. 261. Springer, 2023a.
Yongjing Zhang, Zhaobo Lu, Feng Zhang, Hao Wang, and Shaojing Li. Machine unlearning by reversing the continual learning. Applied Sciences, 13(16):9341, 2023b.
Bolci Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 40(6): 1452 1464, 2017. URL https:://// /tttts:://gtttiee /github. wwt.c//c/cccoccccccoo CSA.LVissinn htt.Liiisio/ppacce3355. places365.
Jun- Yan Zhu, Taesung Park, Phillip Isola, and Alexei Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. IEEE Interaatonnal Conference on Computer Vision, ICCV 2017, Venice, Ital,, October 22-29, 2017, pp. 2242-2251, IEEE Computer Society, 2017.
14

---

Published as a conference paper at ICLR 2024
A INFINITELY MANY PROBABILITY WITH INFINITE KL-DIVERGENCE
In Section 3.2, mention that there infinitely many probability distributions that have infinity KL diver- gence with given distribution. We provide the proof below:
Proposition! There are infinitely many probability distributions that have a positively infinite value of KL- divergence with any general discrete probability distribution P(X) that is defined as follows:
N
0 (() Σ P(X=
IE], N22
Proof. Based on P(X), we build another distribution Q(X) as follows:
P(X-) Q(X - -(X=))))-XX=-+++
if # j and i
if jj j
E K>0
if = k
I-P(X=)) P(X=b)++e
where j satisfies P(X () and sastifies j * kt Clearly, 0 <= Q(X = i) < and Σ Q(X = i)
1. Therefore, Q(X) valid probability distribution.
We next compute the KL divergence between / and Q
P(X Q(X i)
D(PIIQ) Σ P(X = 1)l
P(X P)(==))
P(X = 1)
P(X jollo
+
Σ
P(X iolog
Q(X =
Q(X = i)
P(X ((X=)))
P(X = Q(X = i)
P(X iolog
+
Σ NE(N
P(X = i)log
0
+
We note that & can be any positive real number; hence, we can obtain infinitely many Q(X) by varying the value of n. Hence, there are infinitely many Q that have positively infinite value of KL-divergence with P. In general,
replace the set [M] with any discrete set. This completes proof.
The proof for the continuous distribution very similar to the discrete case shown below.
Proposition 2 There infinitely many probability distributions that have the positively infinite value of KI-- divergence with any general continuous probability distribution with the following probability density function (PDF) p(a))
J p(z)dx== =
p(z) 2 0, E,
Proof. Based on p(x), we build another distribution with PDF g(x) as follows:
p(z)
if ((L)
((x)
Tes, p(r)
S₁ C
0.
if E Si
where S₁ satisfies 0 SaES, p(x)dr 1. Clearly, ((x) 2 and Saes ((x)drx= 1. Therefore, ((x) is valid probability density function.
We next compute the KL divergence between and q-
p(x)) ((x)) dr
D(lll))
p(z)log
(p()) dx + I p(z)log
p(x)
p(z)
dr
xES,
((z)
JEESIS
((x))
p(x) dæ Jessis
p(x)
p(x))log
p(r)log
dr
Jess,
((x)
+0c
We note that given a continuous distribution. there are infinitely many possible S1; hence, we can obtain infinitely many g(z) by using different Sy. Hence, there infinitely many that have positively infinite value of Kl.-divergence with p. This completes our proof.
15

---

Published as a conference paper at ICLR 2024
B PROOF OF THEOREM
Proof. Directly computing mutuaa information (MI) between two random variables feasible. Fortunately, there are some variational MI bounds that are relatively easy to compute. A popular approach is to lower bound MI with InfoNCE (Belghazi et al., 2018; Wu et al., 2020; Poole et al., 2019; Kong et al., 2020). Given two random variables X1 and X2, MI is bounded by InfoNCE is defined follows:
X(x1; 2 I NCE (X1; = log (K) E
Σ
1 K
log
eoi(mn)) va(az,)
(B.11)
where the expectation over K independent samples from the joint distribution: I1,p(21, 22, 91 and ga are two functions that map the random variables into representation vectors, e.g., the encoder network Eg of 121 generative models.
Following the standard practice of InfoNCE, we use the inner product of the encoder output vectors the critic function. Therefore, the InfoNCE between the ground truth images X and reconstructed images X written follows:
e (are) Eng (5c)
NCE (x; X) = log (K) + Br, log -K -,m= (xr)) (R,)
(B.
Multiple works show that the encoder of the 121 gemerative models be treated the inverse function of the decoder (Wallace al., 2023; Song al., 2023; Xia al., 2023; Kingma Welling, 2019). In other words,
Eso (Dao (z))
(B.13)
Given the assumption that the target model use the same decoder as the original model, we can express X and X as follows:
Døg (Fo, (T(=))), à Doo (Fo(T()))))
(B.14)
By using the above relationships in Eq. (B.13) and Eq. (B.14). we have
Eag (x)² Edg (#) Es, (Doo (Ea, (T (x))))) Es, (Doo (Ea (T()))))
(B.15)
Eso (T (x1))" Ee (T (x2))
Retain Recall the assumption that the output of the encoder is normalized, i.e., Eg (x)1l2 1 and Eo, (z)]l, 1. Therefore, we can rewrite Eq. (B.15) the ground truth retain samples {2r,} and their reconstructions { } and as follows:
Fon (z+,)² Fon (Er.) Fog (T (xr))) Fe (T())))
1
2 Ea, (T (+r))) _ 2 E. (T (++))l
|Eop (T (x+,)) Eo (T )
(B.16)
1
(2 Fo, (T (xx))) F. (T M)
2
2
(2 2) = =1
where 6 = |Eoo (T (xx:)) Eg (T (2r, Dll y the Le loss between the representation of target model en- coder Es and original model encoder Fag. We then bound the Eeg (ar,,)² Ea, (b.,)) as follows:
Fo, (xT;))² Fao (ßr,))
=Fo, (T (#r,))² T Eo (T (ırz))
-ea (T (arr))" (Eo (T (Irz)) )= Eso (T (2r;)))
+ Esg (T (ar:)) Eag (2.;))
Ee, (T (IT (Eo (T (Ir;) Es, (T (xr,)) + Rij
(B.17)
|| Fou (T Ml2 Fo (T (zx,)) Fo. T (Ir,))l, + Raz
=I en + Rij
+ Riy
16

---

Published as a conference paper at ICLR 2024
where Bhy Eng (xx,))) Eng (T (xx,) ) and the "s' comes from the Cauchy-Schwart inequality. The
above bound is tight if {e, 0, }.] By combining the Eq. (B.12), Eq. (B.16), and Eq. (B.17), we can link the InfoNCE loss with the L2 loss:
(gg (Re)
NOB (X,; log (K) + E
log
K
K j=
Bng (1x1) B (as)
log (K) + IE
log
K
2=j=1 e Eop (111) Enp (tt)
(B.18)
$
log (K) + IE
log
K
log (K) - B
log
e
esitRRis
jml
By combining Eq. (B.11), we obtain the results the retain set:
K
k Σ
(X): log (K) -
log
c
(B.19)
K
Forget set The proof the forget set very similar the retain set. By adapting Eq. (B.16) and Eq. (B.17) for forget set, we calculate the inner product of the embedding vector between n and zy:
Ea, (n,)² Edg ($t,)= Ee, (T (n.))² Eo (T (x))))
1 Bl (T (n:)) be (T (xx
Ee (7 (n.)) Eo (7 (xx)))1
2
1 (2 ||Ba, (T (n:)) - Ee (7 (x,1))1
2
1
(2 - 2) =
62
2
2
(B.20)
and
Ed, (14) Es, (11,)
=Ea, (T (m=))" Es (T (21,))
=Fe, (T (m.))² (Eo (T (xı,)) Ed, (T (T())))
Eo, (T (n.))² Ed, (7 (n,))
(B.21)
El (T (T(m))lla Eo (T (x1,)) Ea, T (mg))l, + Fu
=1 * 6, + Fez
=6, Fii
where 6, = Ea, (T (n.)) - Ee (T )il, and Py = Ea, (n.)) Es, (T (n,)), æy, are the data sam- ples in the forget set and n4 (0, Σ). Combining the above equation with Eq. (B.12):
Eos Boo (P:.) Foo (n.) (nu) (21,)
I NOB (n; log (K) +E
log
K
==z e
K
1
= log (K) +
log
K
Σ
K
Bog (me)² Ro (21,)
1=1
(B.22)
2 log (K) +R
log
K
R
1=1
12
= =log (K) B
log
e
Σ 1m1
K
17

---

Published as a conference paper at ICLR 2024
By combining the above equation with Eq. (B.11), obtain the results for the forget set:
K
62 x
K
[(n; X1) 2 log (K)
Σ
log
Σ
(B.23)
K
jml
This completes our proof.
C IMPLEMENTATION DETAILS
C.I DATASETS AND CODE BASE
Diffusion Models. We verify our approach on diffuusion model that is trained on entire Places-365 training dataset (Saharia et al., 2022a; Zhou et al., 2017). We randomly select 50 classes out of 365 classes as the retain set and another 50 classes as the forget set. For each class, we select 5000 images from the Places-365 training set: we then combine them together as the training set for unlearning. By using the approach defined in Eq. (10), we obtain the target model. We then evaluate the obtained model on both forget set and retain set, with 100 images per class from the Places-365 validation set. Hence, have 5,000 validation images for both the retains and forget sets. Since Saharia et al. did not relcase the code, our code is implemented based on an open source re-implementation (GitHlu)). Our experiments are using their provided model checkpoint on Places-361 365 dataset.
VQ-GAN We evaluate our approach on VQ-GAN model that is trained on entire ImageNet-11 IK training dataset (Li al., 2023; Deng et al., 2009). We randomly select 100 classes of 1000 classes as the retain set and another 100 classes as the forget set. We select 100 images per class from the training set as the training set for unlearning. We then apply our proposed approach to the original model and obtain the target model. For the main results reported in Tabel and Tabel 2, we evaluate the obtained model on both forget set and retain set, with 50 images per class from the ImageNet-validation set; hence, we have 5,000 validation images for both the retains set and forget set. For the other results (in ablation study), we use a smaller version validation set, with 5 images per class from the SaageNet-validatton set; hence, we have 500 validation images for both the retains set and forget set. Our code is implemented based on the offically released code of Li et al. (2023) (GitHub). Our experiments are using their provided ViT-Base model checkpoints.
MAE We evaluate our approach 1K training dataset (He et al.. 2022). The dataset setup exactly the same as VQ-GAN (check the upper paragraph). Our code is implemented based on the offically released code of He et al. (2022) (GitHub). Our experiments are using their provided ViT-Base model checkpoints.
MAE model and MAE model that is trained on the entire ImageNet-
C.2 EVALUATION METRICS
Inception score (IS) For ImageNet-IK, we directly use the Inception-v3 model checkpoint from torchvision library to compute the IS. For Places-365, we used the ResNet-50 model checkpoint from the official release compute IS (Zhou al., 2017).
Fréchet inception distance (FID) For both ImageNet- IK and Places-365, we directly use the backbone net- work of the Inception-v3 v3 model checkpoint from Torchvision library to compute the FID.
CLIP We use CLIP with ViT-H-14 14 as the backbone to generate the emhedding vectors of each reconstructed image from the original model and unlearned model (Radford et al., 2021). Then we compute the cosine similarity of these embedding vectors among Dr and D separately.
C.3 TRAINING HYPER-PARAMEN
Patch Size For all of the models we evaluate in this paper (including diffusion models, VQ-GAN and MAE), the networks are vision transformer (Dosovitskiy et al., 202 based architecture. We set the size of each patch as 16 x 16 pixels for all experiments. For example, cropping 8 x 8 patches means removing 128 x 128 pixels. We set a = 0.25 (cf. Eq. (10)).
Diffusion Models We set the learning rate as 10-5 with no weight decay. We use the Adam as the optimizer and conduct the unlearning for 3 epochs. We set the input resolution 256 and set the hatch size 8 per GPU. Overall, it takes 1.5 hours on a NVIDIA A 100 server. We set a 0.25 (cf. Eq. (10)).
VQ-GAN&MAE We set the learning rate as 10 with no weight decay. We use the AdamW as the optimizer with 3 = (0.9, 0.95) and conduct the unlearning for 5 epochs. We set the input resolution as 256 for VQ-GAN and 224 for MAE We set the batch size as 16 per GPU. Overall, it takes one hour on a 4 NVIDIA A A10G server. We a 0.25 (ef. Eq. (10)).
18

---

Published as a conference paper at ICLR 2024
2.0
200
1.25
200
200
200
1.5
400
400
0.75
400
10
1.0
0.50
600
800
800
0.25
1000
1000
(a) MNIST
(h) CIFAR-10
(c) CIFAR-100
Figure C.5: Covariance matrix of three commonly datasets. For CIFAR10/100, we convert the images into gray-scale images. We take the absolute value of the covariance matrix for better illus- tration.
Algorithm Pseudo Code of Our Unlearning Algorithm
1: Inputs:
Orginal model hea.de De Eig Retain set DR. Forget set DF Coefficient o, learning rate Ç, and #Epochs E
2: Outputs:
Target model he.e Do Eg
3: Initialize:
Copy ha.e to hn, i.e., hoo0 + h0o.00
4: for mmre=1 to do
5:
Sample {x,} from DR
6:
Sample xy from DF
7:
Sample [n] from (0, ))
8: Ensure: K2, = [ i.e., make retain samples and forget samples balanced
9: Compute loss: 1= (T( Eo, (x,))) + [ Ed, (T(n))ll2
10: Update the parameters of the target encoder Eg: 0 < 0 Vool
11:
end for
C.4 OUR UNLEARNING ALGORITHM
Selection of in Eq. (10) conduct our unlearning algorithm, we need to compute Σ in Eq. (10), where E is the the covariance matrix for the distribution of training images.
Ideally, we should use the exact Σ of the images measured on the forget set. However, there are some com- putational barriers to using the exact E for a high-resolution image dataset. Specifically, consider com- monly used 256 resolution for image generation tasks, the distribution of the generated images will have 256 x 256 x
x 10" dimensions. The size covariance matrix tribution is around (2 x 10 = 4 1020, which requires around 144GB memory if stored in float precision thus is not practical.
such high-dimensional dis-
Consequently, to address the computational barrier of E, some approximated methods derived from empirical observations some small datasets. Specifically, compute the exact Σ for small- scale image dataset, including MNIST and CIFARI0/100.
Off dia-oaa elements: To find some empirical inspirations, we compute the covariance matrix for three commonly dataset, MNIST, CIFARIO and CIFARI00. As shown in Fig. C.S, most of the off- the off-diagonal elements diagonal elements very close '0". Hence, in experiments, of E to '0'
Diagonal elements: Since the images are normalized (i.e., subtract the mean value and divided by the standard deviation), set the diagonal elements of Σ as '1', i.e., E(t,
Therefore, we the identity matrix the approximation of exact Y: 5=
where I is the identity matrix. We set Σ = I as the default setup for our approach and baseline methods.
In short, using 7 to approximate Σ. is practical approximation alternative due to the extremely high compu- tational costs of E for high-resolution images. For future work, given theoretical analysis, helieve that
19

---

Published as a conference paper at ICLR 2024
approach can achieve better results (lower image quality) forget set if find way the exact Σ. Hence, we plan to explore the potential reduce the computation of exact Σ with low-rank approximation thus enabling the use of more accurate data-driven Σ.
unlearning approach defined in Section 3.3, implement the unlearning algo- rithm for 12I generative models. We provide the pseudo code in Algorithm 1. As shown, for each batch, sample the same number of retain samples forge samples. We then compute the loss by using Eq. (10) and update the parameters of the target model's encoder.
Pseudo code Based
C.5 LOSS FUNCTION OF OUR APPROACII
As shown in Eq. (10), input the Gaussian noise to the original model as the reference for the forget For VQ- GAN MAE, we can directly use Eq. (10). For diffusion models, principle, we replace the forget sample with Gaussian noise as the input for the original encoder. We next discuss the details for the diffusion models.
We first write the loss function for the normal training of diffusion models first:
B2 E.
Da Es T(x), vip /1 177, -7
(C.24)
where x the ground truth image; Txx) the transformed images, e.g., cropped image for image uncropping tasks and and low-resolution image image super-resolution. the forward process variance coefficient. For more details, please refer to the Saharia et al. (2022a).
Now, we introduce the unlearning optimization function for diffusion models:
min Be... By N.
b (T(x,), Er, n) - Eso (T(x.), Er, m)llz
(C.25)
| (T(x)), Ef, 1) Eso (T(z)), mlll
ar E DR, Dr, PP,n~N(0.E)
where or = VIzr + VT- and o.. VTy + vI - 7. Essentially, we replace the if with the Gaussian noise the input for the original encoder. Note that, Saharia et al. adopt an U-Net as the network architecture; thus the encnder has multiple-stage outputs. We flatten these multiple outputs into vectors and then combine them single representation vector.
remark the equation diffusion models looks slightly different from VQ-GAN and MAE, but they are actually following the same principle defined in Eq. (10); that is, we replace the real forget samples with the Gaussian noise as the input for the original encoder.
C.6 BASELINES
use exact same setup as introduced in main paper and Appendix C.3. We provide the loss function for different baseline methods below. For the baselines, the unlearning is achieved by minimizing the loss values.
C.6.1
MAX Loss
MAX Loss maximizes the training loss w.r.t the ground truth images on the forget set. Hence, we use the original loss function for both retains set and forget set, but assign negative coefficient for the forget set. We do not modify the loss for the retains set.
Diffusion Models
arg min Exp (a) E. [.D Eo (T(a.), 711, a [|D E. (T(ay), (7 - rlly
(C:26)
where Hú /n + -T- y and Ff /nos + VT T(-) is the transformed function, e.g., cropped image for image uneropping tasks.
20

---

Published as a conference paper at ICLR 2024
VQ-GAN
Cs (Do Eo (T(x+)) xx) -03 (Dg Eg (T(x))) xz)
arg max I. Beyarr 0,6
(C.27)
where J is discriminator network used to predict whether the images are real images or generated im- ages: CJ is the cross entropy of the discriminator prediction. We also note that, during unlearning, the discriminator J is also updated in the normal training way. Please check more details in Li et al. (2023).
MAE
arg min Exyaay IDo o Ee (T(z,)) x,12- aa 11 o Eo (T(z))) - 25112 |la 6,6
(C.28)
T(- is the transformed function, e.g., cropped image for image uncropping tasks.
C.6.2 RETAIN LABEL
RETAIN LABEL minimizes training loss by setting the retain samples as the ground truth for the forget set.
Diffusion Models
arg min Exy.,y Fy Bag IIDs Es (T(e.). - 7112 + [|Da a Ee (T(xy), o5. - 7l1a 6, where o /ee. + -V-177 71% As shown, the z in Eq. (C.26) is replaced by the the retain samples of.
(C.29)
VQ-GAN
arg max Re, Pay,yy fcr (Do Ee (T(x.)) + oCg (D& Eo (T(x))),
(C.30)
where I is discriminator network used to predict whether the images are real images or generated images; CJ is the cross entropy of the discriminator prediction. As shown, the reference 2 in the second term of Eq. (C.27) is replaced by the retain sample Tr.
MAE
arg min Ea,.ay { Ii o Ea (T(x.)) - 2rl12 + a [|D o Ea (T(z)) nill }
(C.31)
0.6
As shown, the target ff in the second term of Eq. (C.28) is replaced by the retain sample
C.6.3 NOISY LABEL.
NOISY LABEL minimizes training loss by setting the Gaussian noise as the ground truth images for the for- get set. Hence directly use the original loss function by replacing the ground truth images with standard Gaussian noise for the forget set. We do not modify the loss for the retains set.
Diffusion Models
arg min Ezr.ay E Ey- Enp IDo Es (x,)), rl2 + D I 0,0
Eo (T(z)), n) 7/12
(C.32)
where H, = Tie + VI- 11 7. shown, dy in Eq. (C.26) is replaced by Gaussian noise 7). T(-) is the transformed function, e.g., a cropped image for image uncropping tasks.
VQ-GAN
arg T. Ba,,y 9.6
CJ (Ds Eg (T(x+)) + aC3 (Ds Eg (T(x)) m)
(C.33)
where J is discriminator network used to predict whether the images are real images generated images; Cy is the cross entropy of the discriminator's prediction. As shown, the reference æ in the second term of Eq. (C.27) is replaced by Gaussian noise n.
MAE
|Do o E. (T(x,) ærlla + || Eg (T(x)) nell }
arg min Ez,,ay
(C.34)
9.6
As shown, the target F' in the second term of Eq. (C.28) replaced by the Gaussian noise n.
21

---

Published as a conference paper at ICLR 2024
C.6.4 RANDOM ENCODER
RANDOM ENCODER minimizes the L2 loss between the Gaussian noise and the representation vector of the encader for the forget
Diffusion Models
Bn En- { bo (T(+r), Fr. 1) Boo (T(xr), Ør, 1)ll2
arg min Er,
(C.35)
to Fo (T(xy): 5f, n) n)l1lla
where E.- = Tie + VI- As shown, the target for the forget set is directly the Gaussian noise instead of its embedding vector. VQ-GAN&MAE
arg min Beenary |1:io (T(x,)) Eso (T(x.))l12 +a 1 (T(z))) rull2
(C.36)
D SUPPLEMENTARY RESULTS
140
13
CUP Embeddire Distance
0.80
120
10
100
tabai Set
Inception
harget Sasin Set
labli Sec
1.0
80
0.65
75
25
75
#lmmages par Rotain Set
#lmages per Retain Set
#lmages per Class on
(a) VQ-GAN: FID
(b) VQ-GAN: IS
(c) VQ-GAN: CLIP
15.0
CUP Limbediding Distance
12.5
H1
200
Inception
10.0
0.65
Satah Set
Tatah
Salahn Set
0.60
150
5.0
25
50
75
100
50
75
100
25
50
75
100
elmages per Class on Retain Set
#lmages per Class Retain Set
#lmages per Class on Retain Set
(d) MAE: FID
(c) MAE:
MAE: CLIP
Figure D.6: The performance of our approach under limited availability of the retain sample. The "100 images per class" (right side of horizontal-axis) these plots indicate a full retains baseline. As shown, by gradually reducing the number of images for the retain set, the performance degrada- tion negligible. Even for the extreme case where we only one image per class, the performance degradation also small.
D. ROBUSTNESS TO RETAIN SAMPLES AVAILABILITY
Table and Table 2, we report the results under an extreme case where there is no real retain sample available. In this section, we relax the constraints by assuming the limited availability to the real retain samples. Specifically, ImageNet-IK, we fix the forget set by using 100 images per class for the forget set; in total, have 10K image for the forget well (in total 10K); we this a full retain set.
As the haseline method, have retain set with 100 image per class
We next vary the number of images per class for the retain set within the range of (1,5, 10, 20, 25, 50) and compare the performance of the unlearned models under different values. To balance the number of forget sample and retain samples, over sample the retain samples. For example, if we have 5 image per class for the retain set, sample these images 20 times (since 100/5 20).
22

---

Published as a conference paper at ICLR 2024
As shown in Fig. D.6, compared the full retain (100 images per class), approach is still effective with slight performance degradation. Combining the results Table and Table these results show the applicability and resilience our approach in scenarios where actual the retain samples are limited or even unavailable.
Input
Original
Ours
(a) Forget set
Ground Truth
Input
Original Model
Max Loss
Nosr Lest.
Retam Lage
RANDow Encozenn
Ours
(b) Retain set
Figure D.7: Diffusion models: cropping x patches at the center of the image, where each patch 16 16 pixels. As shown, our approach has almost identical performance the original model (i.c., before unlearning); the generated images on forget set are some random noise. Overall, we outperform all other baseline methods.
D.2 DIFFUSION
provide visualization results under center crop size of 4 patches in Fig. D.7. We also provide more visualization results under center crop size x patches in Fig. D.8. As shown in Fig. D.7 and Fig. D.8, out approach can generate very high quality images on retain set while filling some random noise on the forget set. As contrast, the other baselines methods struggle the performance drop the retain set. RANDOM ENCODER cannot forget the information the forget
23

---

Published as a conference paper at ICLR 2024
Model
(a) Forget set
Input
Original
Ours
(b) Retain set
Figure D.8: Diffusion models: cropping 8 x patches at the center the image, where each patch 16 16 pixels. As shown, approach has almost identical performance the original model (i.e., before unlearning); the generated images on forget set are some random noise. Overall, we outperform all other baseline methods.
D.3 VQ-GAN
provide visualization results under center crop size 4 patches Fig. D.9. We also provide more visualization results under center crop size of x patches in Fig. D.10. As shown Fig. D.9 and Fig. D0 out approach can generate very high quality images retain set while fill some random noise on the forget set. RETAIN LABEL cannot even forget the information two type fishes; can handle this subtle difference among difference classes.
the forget set. Morcover, shown in Fig, D.9, there forget set and another one is retain (the fourth and fifth rows). Our approach
D.4 MAE
Random Masking In the original paper (He et al., 2022), MAE primarily focuses on the reconstruction of randomly masked images. Hence, hesides the center cropping reported in the main paper, we also report the results under random masking. As shown in Fig. D.11 and Fig. D.12, the performance the retain set of the
24

---

Published as a conference paper at ICLR 2024
Wello
Well
Woltmn
Original Model
(a) Forget set
Input
Original
RITAI
Ours
(b) Retain set
Figure D.9: VQ-GAN: cropping x 4 patches at the center of the image, where each patch is 16 x 16 pixels. As shown, approach has almost identical performance the original model (i.e., before unlearning); the generated images on forget set are some random noise.
unlearned model is almost identical as original model. contrast, there is significant performance drop on the forget set.
E ABLATION STUDY
E. VARYING CROPPING PATTERN RATIO
In the main paper, primarily show the results of uncropping/ippaining tasks. We vary the cropping patterns and the VQ-GAN to generate the images under these different patterns. We shown the generated images with downward extension Fig. 1313, upward extension in Fig. E. 14, leftward extension Fig. E.15, rightward extension in Fig. E. and outpaint in Fig. E. respectively. As shown in these images, our method robust to different cropping types.
As shown in Fig. E.18 and Fig. 19, we also vary the input cropping ratio and report the FID and CLIP embedding distance. Clearly, approach is robust different cropping ratios.
25

---

Published as a conference paper at ICLR 2024
Ours
(a) Forget set
1150
5
Input
Original
Ours
(b) Retain set
Figure D.10: VQ-GAN:
cropping 8 x 8 patches at the center of the image, where each patch is 16 x 16 pixels. As shown, approach has almost identical performance the original model (i.e., before unlearning); the generated images on forget set are some random noise.
Noise type. We compare the performance of Gaussian Noise used in our method with uniform noise for VQ-GAN and MAE. Specifically, set the noise in Eq. (10) ~ [4 then conduct the unlearning under the setup. We the obtained models generate 500 images for both retain set and forget set. We then compute multiple metrics different noise types. shown in Fig. E.20, Gaussian noise achieves better forgetting in the forget set in general (i.c., higher FID, lower IS and lower CLIP on forget sets). These results empirically verify the benefits of using Gaussian Noise, which coincides with our analysis (cf. Lemma 1).
E.2 CROSS VALIDATION OF GENERATED IMAGES
To further verify the generated images do not have the information from forget set, we conducted the following experiment for VQ-GAN:
We first conduct the unlearning for VQ-GAN for ImageNet obtain the unlearned model, under the same setup mentioned in Section 4.
26

---

Published as a conference paper at ICLR 2024
CLIP Embedding Distance
250
Digina: Hosutt but
Ieisar Forpet
200
0.8
200
35
Incention
0.6
100
20
Orggral RurgetSen
Porgst
0.5
Orgin Firpet
Porpst
Uneam Botal
Unberr Rabin
60
40
Input Masking Ratio
Input Masking Ratio(%))
Input Masking Ratio(%)
(a) MAE: FID
(b) MAE: IS
(c) MAE: CLIP
Figure D.11: The quality of reconstructed images given random masked images by MAE under varying random masking ratio; e.g.. masking 128 out of 256 patches means 50% cropping ratio. We compare original model and unlearned model by our approach. As shown, the performance of these two models on the retain set are almost identical, while the unlearned model has significant performance drop on the forget set. See Fig. D.4 for some examples of generated images.
Table E.4; The comparison of cross validation in Appendix E.2. We first use different models to do the inpainting tasks, i.e., reconstructing the central cropped patches (FIRST reconstructions) Given the FIRST reconstructions as input, we then use the original model (before unlearning) to do the outpainting tasks and get the SECOND reconstructions, i.c. re- re-generated the outer patches based on these reconstructed central patches from FIRST reconstructions. We then evaluate the quality of these SECOND reconstructed images under various metries. Lower FID, higher IS, and higher CLIP values indicate higher image quality.
FID
IS
CLIP
Dn
Dr
Dr
Dr
Dn
Dr
Original Model
36.14
28.96
27.28
27.95
0.37
0.49
Unlearned Model
36.74
156.68
26.62
7.67
0.37
0.28
Second, given the center-cropped input images (cropping central x 8 patches). we then use this unlearned model to generate the images on both forget set and retain set (i.e., image uncrop- ping/inpainting). Here call them FIRST generated images.
Given these FIRST generated images, we only keep the reconstructed central x patches (cropping the outer ones) as the new input to the original VQ-GAN (i.c., the model before unlearning) and get the newly generated images (here call them SECOND generated images). We then evaluate the quality of SECOND generated images for both forget set and retain and report the results.
We also conduct the above process for the original model (i.c., before unlearning) as the base- line/reference. The results are given below:
As shown Table E.4 Figure E.21, compared the original model, given the noise (i.e., FIRST generated images on the forget set) from the unlcamed model as the input, the SECOND generated images has very low quality in terms of all these three metrics. This means that the noise indeed are not correlated with the real forget images.
In contrast, the performance the retain set almost the before and after unlearning. This indicates that our approach indeed preserves knowledge on retain set well.
27

---

Published as a conference paper at ICLR 2024
Ground Truth
Input
Before Unlearning After Untearning
Ground Truth
Input
Before Unlearning After Unlearning
(a) Forget
Ground Truth
Input
Before Unlearning After Unlearning
Ground Truth
Input
Before Unlearning
After Unlearning
(b) Retain set
Figure D. Reconstruction of random masked images by MAE. For single image, test 25% masking ratio and 50% masking ratio.
28

---

Published as a conference paper at ICLR 2024
Ground Truth
Input
Before Unlearning After Unlearning
Ground Truth
Input
Before Unlearning After Unlearning
(a) Forget
Input
Before Unlearning
Unlearning (b) Retain set
Unlearning Unlearning
Figure E. Ablation study: Downward extension by VQ-GAN, We visualize he performance of the original model (before unlearning) and the obtained model by our approach (after unlearning). We show results on both forget set and retain set.
29

---

Published as a conference paper at ICLR 2024
Ground Truth
Input
Before Unlearning
After Unlearning
Ground Truth
Input
Before Unlearning After Unlearning
(a) Forget
PALO
Input
Unlearning
Unlearning (b) Retain set
Unlearning Unlearning
Figure 1. Ablation study: Upward extension by VQ-GAN. We visualize he performance of the original model (before unlearning) and the obtained model by our approach (after unleaming). We show results on both forget set and retain set.
30

---

Published as a conference paper at ICLR 2024
Ground Truth
Input
Before Unlearning
After Unlearning
Ground Truth
Input
Before Unlearning After Unlearning
(a) Forget
Input
Unlearning
Unlearning (b) Retain set
Unlearning Unlearning
Figure E. Ablation study: Leftward extension by VQ-GAN. We visualize performance of the original model (before unlearning) and the obtained model by our approach (after unleaming).. We show results on both forget set and retain set.
31

---

Published as a conference paper at ICLR 2024
Ground Truth
Input
Before Unlearning After Unlearning
Ground Truth
Input
Before Unlearning After Unlearning
(a) Forget set
Input
Before Unlearning
Unlearning (b) Retain set
Unlearning Unlearning
Figure E.16: Ablation study: Rightward extension by VQ-GAN. We visualize he performance of the original model (before unlearning) and the obtained model by our approach (after unlearning). We show results on both forget set and retain set.
32

---

Published as a conference paper at ICLR 2024
Ground Truth
Input
Before Unlearning
After Unlearning
Ground Truth
Input
Before Unlearning After Unlearning
(a) Forget
Input
Unlearning
Unlearning (b) Retain set
Unlearning Unlearning
Figure E. Ablation study: Outpaint by VQ-GAN. We visualize he performance of the original model (before unlearning) and the obtained model by our approach (after unlearning). We show results on both forget set and retain set.
33

---

Published as a conference paper at ICLR 2024
Uncroppinglinpaint
Upward Extension
Downward Extension
Orgiaal farget 545
140
Orgnnt forget S4s
Org frrget
150
Orginal Retain 5et
Org Notain Sct
100
Drg Reainn
Unteart: Forget San:
120
Forget
Undeart: Forget San
125
Untearm: Retaii
Rittiin
Unfearm: Ritatn
100
80
100
80
60
20
Cropping Ratio(%)
Cropping Ratiot%))
Cropping Ratio1%)
Leftward Extension
Rightward Extension
Outpaint
Org nat: forget Set
Drg nat: forget Set
100
Org na: Forget Set
100
Ong ral. Aetsin
Org ral kerain
Ong no Aerain
Untear:: Farget
Unteart: Retain
Urdearn: Bebain
Forget
80
Unleamt: Forget
Unfearts
80
40
60
20
Cropping Ratio(5))
Rationts)
Cropping Ratiotte)
Figure E.18: Ablation study: FID vs. input cropping ratios under different 121 generation tasks.
Uncrappingtrpaint
Upward Extension
Downward Extension
Emberdiing Distance
Emberdidnng Distance
0.75
0.75
0.75
0,70
CUP Enteedinng
0.70
0,70
0.65
Orginat: Retain
0.65
Orginal: Retath
Orginal Retain Set
0.60
forpet
Retarn
0.60
earrs Reben Sat
Set
0.65
Forpet
Retan
Ratio]%)
Coopping
Cropping Ratio[%)
Leftward Extension
Rightward Extension
Dutpaint
CJP Embideingg Distance
CUP Emtbatiing Distance
CLIP Embedcing Distance
0.75
0.75
0.8
0.70
0.7
0.65
Orsinst: Rebain
0.65
Oeginali Rebai
Orginal Set
forpet
Set
0.6
forpet
0.60
Rebwn
0.60
Reben Set
Reban
20
20
Cropping
Cropping
Cropging
Figure 19; Ablation study: CLIP embedding distance input cropping ratios under different 12I generation tasks.
34

---

Published as a conference paper at ICLR 2024
CLIP Embedding Distamce
200
12
0.7
femm Parge
Unfemm Parget Gevisum harge su fomm
150
Geusskmm halpei Sit
tirm
Inception
20
0.6
Gaussion
0.5
Unttom Forget
"aaped
Goundar: Satan
20 Cropping Ratiot%)
Cropping Ratiot%)
Cropping Ratio(%)
(a) VQ-GAN: FID
(b) VQ-GAN:
(c) VQ-GAN: CLIP
25
Un Parpel
CLIP Embeddding Distance
1.0
ferm: Pargel Stc
200
20
Gaussion Notur
0.9
Gluusiim Retei
150
Inception
100
0.8
Jn femm Ser Geussimm harget bit
ferm
0.7
20 Cropping Ratio(%))
40
Cropping Ratio(
Cropping Ratio(%)
(d) MAE: FID
(c) MAE: IS
(1) MAE: CLIP
Figure E.20: Ablation study of noise type. We test the performance under varying ratios central
cropping; e.g., cropping 8 out of 256 patches means 25% cropping ratio. For VQ-GAN and MAE, Gaussian noise achieves better forgetting in the forget set in general (i.e., achieves higher FID, lower IS and lower CLIP on forget set).
Ground Original
Original Model
(a) Forget Sct
(b) Retain Sct
Figure E.21: Visualization of cross validation Appendix E.2. We first use different models to do the inpainting tasks, i.e., reconstructing the central cropped patches (FIRST reconstructions). Given the FIRST reconstructions as input, we then use the original model (before unlearning) to do the outpainting tasks and get the SECOND reconstructions. i.c., re- re-generated the outer patches based on these reconstructed central patches from FIRST reconstructions. We then evaluate the quality of these SECOND reconstructed images under various metrics.
35


Reviews:
[{"review_id": "p4xxtaaqJ9", "reviewer": "Reviewer_uD61", "summary": "This paper presents a study on machine unlearning for image-to-image generative models, an area not extensively explored previously. The paper introduces a theoretically sound and computationally efficient algorithm for unlearning that ensures minimal impact on the performance of retained data while effectively removing information from data meant to be forgotten. Demonstrated on ImageNet-1K and Places-365 datasets, the algorithm uniquely operates without needing the retained data, aligning with stringent data privacy policies. The research claims to pioneer a theoretical and practical approach to machine unlearning in the context of generative models.", "questions": "- Could you please add one baseline mentioned in the weakness to the paper (Table 1)? \n- Why easing concepts can be thought about as a noisy label method? Please give more explanations.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "Strengths:\n- The paper boasts a clear and logical structure, helping readers' comprehension of the concepts presented.\n- It ventures into the relatively untapped domain of applying machine unlearning to image-to-image (I2I) generative tasks.\n- The authors have bolstered their approach with a solid theoretical foundation, enhancing the credibility and robustness of their proposed method.", "weaknesses": "Weakness:\n- The study does not align with the foundational concept of machine unlearning, which typically necessitates a comparison between the unlearned and retrained models as per references [1-7]. Although the authors justify this divergence due to the high costs associated with retraining generative models, this deviates from the core goal of machine unlearning aimed at addressing privacy concerns. Particularly, the approach presented in this paper generates conspicuous Gaussian noise over the 'forgotten' data, which may inadvertently signal that the data was previously part of the training set, contradicting privacy preservation goals. A more compelling motivation might be found in text-to-image (T2I) scenarios [8] where the goal is to prevent the generation of inappropriate content, or in image-to-image (I2I) applications [9] that showcase practical utility. It would be more meaningful—and privacy-compliant—if the model could reconstruct unremarkable images that don't trace back to the original training data, rather than reconstruct images with evident distortions signaling prior data use.\n- The evaluation process presented in the paper is incomplete with regard to established machine unlearning protocols. Typically, an unlearned model's performance is assessed using three distinct datasets: a test dataset to determine its generalization capability, a retained dataset to evaluate performance on non-forgotten data, and a forget dataset to check the efficacy of the unlearning process. The paper's Table 1 appears to only present results for the latter two, omitting the crucial evaluation on the general test dataset.\n- The consideration of relevant baselines in the paper is lacking. Reference [9] describes unlearning in the context of image-to-image (I2I) generative models, which appears to be closely related to the work at hand. A comparison or a clear explanation of why the methods from [9] cannot integrate into the proposed framework would strengthen the current approach by situating it within the broader research landscape and justifying its unique contributions.\n- The scope of the study with respect to the application of machine unlearning in image-to-image (I2I) generative models appears to be inaccurately broad. The term \"machine unlearning for I2I generative models\" suggests a wide range of applications; however, the paper primarily focuses on the image inpainting task. It would be more precise to either expand the variety of I2I applications examined in the study or to specifically define the scope as \"machine unlearning for image inpainting tasks\" to reflect the content more accurately. This would ensure clarity in the paper's contributions and avoid overgeneralization of the results.\n\n\n>[1] Graves, Laura, Vineel Nagisetty, and Vijay Ganesh. \"Amnesiac machine learning.\" Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 35. No. 13. 2021.\n>\n>[2] Chundawat, Vikram S., et al. \"Zero-shot machine unlearning.\" IEEE Transactions on Information Forensics and Security (2023).\n>\n>[3] Chen, Min, et al. \"Boundary Unlearning: Rapid Forgetting of Deep Networks via Shifting the Decision Boundary.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.\n>\n>[4] Warnecke, Alexander, et al. \"Machine unlearning of features and labels.\" arXiv preprint arXiv:2108.11577 (2021).\n>\n>[5] Jia, Jinghan, et al. \"Model sparsification can simplify machine unlearning.\" arXiv preprint arXiv:2304.04934 (2023).\n>\n>[6] Kurmanji, Meghdad, Peter Triantafillou, and Eleni Triantafillou. \"Towards Unbounded Machine Unlearning.\" arXiv preprint arXiv:2302.09880 (2023).\n>\n>[7] Golatkar, Aditya, Alessandro Achille, and Stefano Soatto. \"Eternal sunshine of the spotless net: Selective forgetting in deep networks.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.\n>\n>[8] Gandikota, Rohit, et al. \"Erasing concepts from diffusion models.\" arXiv preprint arXiv:2303.07345 (2023).\n>\n>[9] Moon, Saemi, Seunghyuk Cho, and Dongwoo Kim. \"Feature unlearning for generative models via implicit feedback.\" arXiv preprint arXiv:2303.05699 (2023).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "h3dwi8ZbqV", "reviewer": "Reviewer_L8mN", "summary": "This work proposes a mechanism for machine unlearning for image-to-image generative models. The work proposes a simple framework, minimizing the $l_2$ loss between embeddings from the forget training set and normal distribution, and maintaining the $l_2$ loss for the retain set embeddings. The results are provided on VQ-GAN, Diffusion Models and Masked Autoencoders on Imagenet-1K and Places-365 dataset comparing to reasonable baselines where the method shows good performance on retain set, while performance on forget set deteriorates as expected.", "questions": "1. The experimental setup for retain sample availability is not quite clear to me. Why are retain samples selected from the remaining 800 random classes? Also, this confused me if all the 1000 classes, or only 200 classes are used for the main experiments to train the original model.", "limitations": "", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. This work is focused on a timely and important problem as there is more discussing about regulating generative AI. For the current lawsuits facing several companies for their data practices on generative models and upcoming laws surrounding data retention policies, machine unlearning approaches may offer a possible solution.\n2. The experimental across different models and datasets are thorough, and helpful for future work. The work shows comparisons across several reasonable baselines, across different image-to-image generative models. The results are shown across different relevant metrics such as FID, Inception Score and CLIP Distance.", "weaknesses": "1. It's unclear if the machine unlearning setup considered in this work is practical. For machine unlearning setups, the gold standard to mimic is a model trained only on the retain set. In this work, the approach performs this task by minimizing the embedding distance for the forget set to normal distribution. Does this lead to overall worse performance than the gold standard model (where only retain set is used to train from scratch)? It would be good to include this as a baseline for comparison. \n2. The proposed approach itself is not too novel, while the work may have applied it first on image-to-image generative models.  This approach can be thought of a simple extension student-teacher or continual learning framework, and similar ideas have been explored in classification literature [1, 2].\n3. It's unclear if the model shows strong performance throughout. While the performance on the retain set stays strong, it's unclear if **worst** performance on the forget set is a good metric. This again focuses on going back to the first point, the unlearning paradigm should only be focused on achieving performance of model trained *only* on retain set. Thus, if the unlearned model performs much worse on the forget set than the model trained only on the retain set this may not be a good metric.\n\n[1] Zhang, Xulong, et al. \"Machine Unlearning Methodology base on Stochastic Teacher Network.\" _arXiv preprint arXiv:2308.14322_ (2023).\n[2] Zhang, Yongjing, et al. \"Machine Unlearning by Reversing the Continual Learning.\" _Applied Sciences_ 13.16 (2023): 9341.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Oigf5PSazz", "reviewer": "Reviewer_4Xrc", "summary": "This proposes a computationally-efficient unlearning approach, that demonstrates negligible performance degradation on the retain samples, while effectively removing the information from the forget samples. The authors also provide rigorous theoretical analysis for this image-to-image generative model. Empirical studies on two large-scale datasets, ImageNet-1K and Places-365 show the advantages on image-to-image task. Overall, it is good paper. The main concern is how to get the forget set and how to set the hyper parameter $\\sigma$?", "questions": "The main concern is that the paper assumption is ideal and its hyper parameter \\sigma, which may not hold in practice.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Quality/Clarity: the paper is well written and easy to follow. And both the experimental results and theoretical analysis demonstrate its advantages.\n\nOriginality/significance: the algorithm is new and underpinned by rigorous theoretical analysis. It systematically explores machine unlearning for I2I generative models.", "weaknesses": "1. The main concern is that the paper assumption is ideal and its hyper parameter \\sigma, which may not hold in practice.\n2. From Lemma 1, $\\sigma$ should be from the forget set? In the appendix C.4, however it sets $\\sigma=I$, which is not estimated from forget set?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jUqPFqcOWk", "reviewer": "Reviewer_hK5e", "summary": "This paper explores the concept of \"machine unlearning,\" a method to deliberately forget data from models to comply with regulations. While existing methods have focused on classification models, this paper introduces a framework for machine unlearning in image-to-image generative models. It presents a computationally efficient algorithm supported by theoretical analysis that effectively removes information from \"forget\" samples without significant performance degradation on \"retain\" samples. The algorithm's effectiveness is demonstrated on large-scale datasets (ImageNet-1K and Places-365) and is notable for not requiring retain samples, aligning with data retention policies. This work is a pioneering effort in the systematic exploration of machine unlearning tailored for image-to-image generative models.", "questions": "Abstract: „primarily focused on classification models, leaving the landscape of unlearning for generative models relatively unexplored.“: Is this true? Are there any references which support this statement?\n\nIntro: „Informally speaking, we define a generative model as having “truly unlearned” an image when it is unable to faithfully reconstruct the original image when provided with only partial information (see Figure 1 for an illustrative example where the partial information involves center cropping2).“: I wonder if you did any analysis if the „noise“ is fully uncorrelated with the part of the image before the unlearning? Maybe there are still some high level corrections left. In learning fair representations people do train secondary models on the representations and try to predict the sensitivity attribute from the fair representations. I wonder if such study can be used to check if a secondary autoencoders could not re-generate the cropped image from the generated noise.\n\nEquation 3: why is alpha not between 0-1 so you have (1-alpha) x term0 - alpha term1?\n\nTheorem 1: Why is having the same decoder not a problem? Couldn’t the decoder not fully remember the images in some way or could you not extract some of the images by some information extraction techniques?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The idea of using the E_0 to generate L_F and L_R is interesting and a smart way to overcome the problems of estimating MI.\n- The theoretical analysis of the paper is well written and looks (beside of some remarks) sound to me.\n- Having done so much experiments using different image datasets", "weaknesses": "I understand that the work was only done for I2I generation, which is a complex part already, however I was wondering if there is really no related work in this domain. I am not an expert in this domain but would propose to have a more in depth look at the literature for more related work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)