Label-Agnostic Forgetting: A Supervision-Free Unlearning in Deep Models
Authors: Shaofei Shen
Chenhao Zhang
Yawen Zhao
Alina Bialkowski
Weitong Tony Chen
Miao Xu
Venue: ICLR 2024 poster (2024)
Keywords: Machine Unlearning
Unsupervised Learning
Deep Learning
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning
TL;DR: A supervision-free framework for deep model unlearning via variational inference and contrastive loss

Abstract: Machine unlearning aims to remove information derived from forgotten data while preserving that of the remaining dataset in a well-trained model. With the increasing emphasis on data privacy, several approaches to machine unlearning have emerged. However, these methods typically rely on complete supervision throughout the unlearning process. Unfortunately, obtaining such supervision, whether for the forgetting or remaining data, can be impractical due to the substantial cost associated with annotating real-world datasets. This challenge prompts us to propose a supervision-free unlearning approach that operates without the need for labels during the unlearning process. Specifically, we introduce a variational approach to approximate the distribution of representations for the remaining data. Leveraging this approximation, we adapt the original model to eliminate information from the forgotten data at the representation level. To further address the issue of lacking supervision information, which hinders alignment with ground truth, we introduce a contrastive loss to facilitate the matching of representations between the remaining data and those of the original model, thus preserving predictive performance. Experimental results across various unlearning tasks demonstrate the effectiveness of our proposed method, Label-Agnostic Forgetting (LAF) without using any labels, which achieves comparable performance to state-of-the-art methods that rely on full supervision information. Furthermore, our approach excels in semi-supervised scenarios, leveraging limited supervision information to outperform fully supervised baselines. This work not only showcases the viability of supervision-free unlearning in deep models but also opens up a new possibility for future research in unlearning at the representation level.

Published as a conference paper at ICLR 2024
LABEL-AGNOSTI FORGETTING: A SUPERVISION- FREE UNLEARNING IN DEEP MODELS
Shaofei Shen'
Chenhao Zhang'
Yawen Zhao'
Alina Bialkowski!
Weitong Chen²
Miao Xu
'University of Queensland Univerriity of Adelaide
(shaofei shen, chenhao. zhang, yawen. zhao, alina. bialkowski jug edu. au edu. au, miao. xuθuq. miao.xueuq.edu.. edu.au
t.
ABSTRACT
Machine unlearning aims to remove information derived from forgotten data while preserving that of the remaining dataset in well-trained model. With the in- creasing emphasis on data privacy, several approaches to machine unlearning have emerged. However, these methods typically rely on complete supervision through- out the unlearning process. Unfortunately, obtaining such supervision, whether for the forgetting remaining data, can be impractical due to the substantial cost associated with annotating real-world datasets. This challenge prompts us to propose a supervision-free unlearning approach that operates without the need for labels during the unlearning process. Specifically, approach to approximate the distribution of representations for the remaining data. Leveraging this approximation, we adapt the original model to eliminate informa- tion from the forgotten data at the representation level. To further address the issue of lacking supervision information, which hinders alignment with ground truth, we introduce a contrastive loss to facilitate the matching of representations between the remaining data and those of the original model, thus preserving predictive performance. Experimental results across various unlearning tasks demonstrate the effectiveness of our proposed method, Label-Agnostic Forgetting (LAF) with- out using any labels, which achieves comparable performance to state-of-the-art methods that rely on full supervision information. Furthermore, our approach excels in semi-supervised scenarios, leveraging limited supervision information outperform fully supervised baselines. This work not only showcases viability of supervision-fre unlearning in deep models but also opens up new possibility for future research in unleariing at the representation level.
introduce variational
INTRODUCTION
Currently, machine unlearning has attracted increasing attention due to rising concerns about data privacy issues (Xu et al., 2024 Nguyen et al. 2022) Bourtoule et al. 202I]. To protect the privacy many regions have introduced laws like
and interest of the owner of sensitive data, legislators
GDPR (Voigt & Von dem Bussche 2017). 7. and CCPA (de la Torre 2018), which demand the deletion of sensitive information from the well-trained models.
The objective of machine unlearning is to remove information associated with forgetting data from the original model while preserving the knowledge contained in the remaining data (Bourtoule et al.) 2021). A direct and intuitive strategy to achieve this is to retrain a new model from scratch utilizing only the remaining dataset. However, this method can be both time-consuming and computationally demanding (Zhang et al.) 2022 Di et al. (022). Without doing retraining, existing works on machine unlearning can be divided into two types. The first type is exact unlearning (Bourtoule al. 202TT
Kim & Woo 2022). This approach necessitates that the unlearned model attains exactly the same performance as the retrained model, with respect both model parameters and prediction accuracy (Bourtoule et al. (021). In deep learning models, the exact unlearning is usually achieved through distributed retraining strategy (Bourtoule et al. 2021) The second type termed as approximate
"Corresponding author

---

Published as a conference paper at ICLR 2024
wnlearning, which requires the unlearned model to get similar prediction performances to the retrained model on not only the remaining data but also the forgetting data (Thudi et al. | Chundawat et al.
2023 Kurmanji al., 2023). Current strategies for approximate unlearning encompass methods such as training teacher models to facilitate the removal of forgetting data (Chundawat et al. 2023 Kurmanji et al., 2023), or retracing the alterations of parameters occurring in the training of forgetting data to reverse its effect of training (Thudi et al. 2022). Although both methods have achieved notable performance, is worth noting that both types of work rely on the annotated remaining and forgetting data to guide the removal of undesired information and preservation of other necessary information. This line of works can be regarded as supervised unlearning.
While both types of work have demonstrated commendable performance, it is imperative to ac- knowledge the prevalent reality: in the real world, a significant portion of data remains unannotated, leading to a substantial number of machine learning models being trained on weakly labelled data (Nodet et al. 2020). This situation is exemplified semi-supervised learning, which capitalizes on vast pool of unlabelled data alongside smaller set of annotated data for training purposes (Yang et al, 2023). Moreover, in the pursuit of privacy protection, even when training data fully labelled, these labels may not be accessible during the unlearning phase. Previous unlearning works have necessitated the use of label information as optimization targets, either for purging information related forgotten data for retaining knowledge about the remaining data (Thudi et al. [022] Chundawat et al., 2023; Chen et al. 2023 Kurmanji et al. 2023). Consequently, studies focused on supervised unlearning are limited in their ability execute the unlearning task or preserve prediction performance in the absence of sufficient supervision information. This underscores the critical need for an unlearning algorithm that operates without relying on supervision information during the unlearning process, which we term as label-agnostic unlearning.
Therefore, we propose a framework named Lanos-Agnostic Forgetting (LAF for the tabel-agnostic unlearming, which can accomplish the unlearning task without the supervision information. Specifi- cally, we alleviate the dependency of the unlearning process on supervision information by adjusting the representation distributions of the representation extractor, rather than changing the classifiers. We utilize a variational inference approach (Kingma & Welling 2014) to estimate the representation distribution of the remaining data and then design extractor unlearning loss to adjust the repre- sentation extractor, aiming to eliminate the information associated with the forgetting data at the representation level. To retain the prediction performances of the model after shifting representations, we devise a contrastive loss to align the remaining data representations of the adjusted model with those of the original model. Furthermore, if the supervision information is available, we can further adjust the classifier to fit the output distributions with the ground truths.
The contributions of this paper can be summarised follows:
Addressing the research gap in lahel-agnostic unlearning, we introduce and propose framework named LAF, which is capable of accomplishing unlearning tasks and retaining high predictive performance post-learning, all without the need for supervision information. The proposed LAF can work effectively for mainstream unlearning problems.
We incorporate the variational inference and contrastive learning approaches and propose two novel loss functions for extractor unlearning and representation alignment.
Through empirical evaluations across multiple datasets and models, we demonstrate that LAF is comparable with full supervised unlearning methods. In addition, when limited supervision information is available, the LAF can outperform other state-of-the- works.
2 PRELIMINARY
Let D denote the training data which can be either fully supervised or semi-supervised and go represents a deep model trained on D, which maps an instance x E X' to label E V. The unlearning on the deep model 9D aims to remove the knowledge related to forgetting data D, C D. and preserve the knowledge learned from the remaining data D, = D - Dy- Assuming that the training data D. remaining data D, and forgetting data D, are sampled from the distributions P, P, and Py respectively, the machine unlearning algorithm U should yield a deep model gv = Uggn, Dr, Dy) which approximates the performance of gD, trained on D, only. That is, go) = 9D, (4) no matter x is sampled from P, or P,. From an intuitive sense, gu (x) should be similar to (D( for x ~ Pr.
2

---

Published as a conference paper at ICLR 2024
but (significantly) different for Py, such that the forgetting effect can be achieved without impacting performance on the remaining data.
As deep model, g be viewed as the concatenation of two main components: representation extractor d and a downstream classifier 9h. In the case of label-agnostic unlearning, wherein labels may not be readily accessible or reliable during the unlearning phase, potential approach to address this challenge is to adjust the representation extractor D to eliminate the memory of forgotten data.
There are three main challenges when adjusting d6- The first involves estimating the knowledge associated with forgetting data within the representation extractor 9b- Secondly, the process of removing the knowledge of the forgetting data from g lacks a well-defined optimization objective. Traditional objectives used in supervised unlearning scenarios may not apply, especially in cases where label information is either unavailable or unreliable in label-agnostic unlearning situations. Thirdly, modifying d can also impact the representations of the remaining data, potentially causing misalignment with the classifier I and consequently leading to a decrease in predictive performance.
3 METHODOL.OGY
In this section, we tackle the three aforementioned challenges by introducing the Label Agnostic For- getting (LAF) method, which comprises updates: the extractor unlearning and the representation alignment. Importantly, both of these updates operate without the need for supervision information. During the extractor unlearning stage, we estimate the distribution of representations for both the forgetting data and the remaining data, leveraging the original model's knowledge acquired from these distinct data groups. Subsequently, we introduce two objectives to facilitate unlearning, with another proposed extractor unlearning loss. Moving on to the representation alignment stage, we recognize that alterations in representation may impact the aligmment between these representations and the classifiers. To address this, we propose contrastive loss that aligns the representations post-unlearning with those pre-unlearning, preserving predictive performance light the absence of label information. Furthermore, consider scenarios where limited supervision information is available. In such cases, we incorporate an additional supervised repair step to further enhance the unlearning performance.
The subsequent subsections will delve into the specifics of extractor unlearning, and representation alignment, and provide overview of the complete LAF algorithm.
3.1 EXTRACTOR UNLEARNING
In the extractor unlearning stage, first discuss the relationship between the data's 's distribution and
post-unlearning extractor gf (.). Assuming that for x ~ Prr, g6 (z) follows a distribution QD,,)) and for x ~ Py. 96 (x) follows distribution Q(D,), then one possible way to learn the optimal 0" for ff parameterized on 0 can be two-objective, that is,
min (QQ(D)), Pr), where x ~ (x) QDr,), and simultaneously 8
(1)
max A(Q(D)),)) where ~ Poteer~PP,. (
(2)
In the above two equations, A(:,-) represents the discrepancy between two distributions. Eq. Eq. describe the intuition that the unlearning extractor should attain the distribution of the remaining data but dissolve the distribution of forgetting data. We preserve the knowledge of the remaining data through Eq. [ and treat the forgetting data irrelevant data via Eq. In this way, the forgetting data will be predicted based on the preserved knowledge instead of random guessing. We could use multi-objective solvers (Cocllo et al. (2022) for the optimization problem Eqs. and 2 In this paper, considering the benefit of end-to-end models, we merge these two objectives into the following one for learning the optimal 0"
D and
0" arg min A A(Q(D)).P))
Since the size of Dyín is limited, training new models on D, becomes challenging. In addition, training new models on Dj can also be inefficient. We cannot directly have P, and P, and thus we first estimate them through the representation extractor of the gn. i.e., G This estimation is based on
3

---

Published as a conference paper at ICLR 2024
the assumption that 9D convey sufficient information the data that it is trained on. However, Th is a well-trained representation extractor, which cannot be used directly to approximate the data distribution. Moreover, there could be discrepancy between the distribution of the forgetting data and the remaining data. Thus we need a model to catch the difference accurately.
With such goal to mimic the distribution and capture the difference between D, and Dj, we train two VAEs (Kingma & Welling, 2014) to approximate the distribution of representations of D, and Dy. Specifically, we first train VAE h for the remaining data D,. Note that instead of capturing the information with Dr. /t captures the information of all training data D. This enables direct training of the VAE without the need to specify forgetting data. Such efficiency gain is crucial since computational resources and time are significant considerations. In addition, the number of forgetting data always far less than the number of training data; thus can sufficiently represent the distribution P,. Therefore,, we use the entire dataset D for training VAE h, leading to the following optimization function:
arg min E of) log (z) + (LLN(MM::))IIVVO..
where h outputs representation for any 2 ~ P. (O, I) the standard Gaussian distribution, N (un, of) ) is the Gaussian distribution parameterized on /4A and dh and is the reparameterized sample from the Gaussian distribution. Here μa, and oj are the mean and standard deviation estimated by h on its encoding layer for (z), x E D.
In parallel, another VAE h is trained specifically for the representations of forgetting data D, by
arg min NinWinn o2, log Ph, (1b(()))))) KL,N(,,,
(5)
hy
where Mhy and o are the mean and standard deviation estimated by hy on its encoding layer for Ib (x)), E Dy.
After we learned h. which captures the distribution of representations extracted by (z). we still need have Q(D,), which is the distribution of representations extracted by gf (1r) on the remaining data. As in the P case, the representation extractor itself cannot be used as distributions, and we still need another VAE express that. Since we cannot learn a new VAE for the unknown gi. we propose to use the VAE learned in Eq. to describe the distribution on D,.. In this way, by fixing the VAE h, the objective in Eq. [ to learn the gú can be
arg min (z-N((n, log (r K (O,,
(6)
where jú and on are the mean and standard deviation estimated by h on its encoding layer for of (, D,, Another objective corresponding to Eq. can be optimized by
arg max Ez mh,) log Pay (06 (z + KL (1,)), 0
(7)
where Jry and ony are the mean and standard deviation estimated by hy on its encoding layer for gf (z (x1), x E Dy.
We can then merge Eqs and 7 in the same way as Eq. 3 into one overall objective
0" arg min (E (E. log Ph (x BewNiin, ,2, log Ph, (gq (z)22)
(8)
The second part, KL (R o1) KL(N 02 (O. typically act as penalty terms, enforeing a regularization effect. By eliminating these terms, we aim to reduce the constraints on the model, thereby allowing more flexible adjustment of the distribution during the unlearning process. Hence, we simplify the objective in Eq. by removing the second part. Noticed that we only drop the two KL divergence terms for unlearning follows and we use the complete Eq. 4 and Eq. for the VAE training:
0 ~ arg ming (B2-N((..)))))))) log Pa (1) EEwN(in, Rh log Phy (g (z))
(9)
In implementations, the log-likelihood is usually optimized by the L2 loss as the reconstruction
loss of the input and output of the VAE. Furthermore, in the unlearning stage, the negative L.g loss
4

---

Published as a conference paper at ICLR 2024
easily diverge and then lead to the breakdown of the whole deep model, which is known as catastrophic unlearning (Nguyen et al.) (020). Therefore, to avoid catastrophic unlearning, we propose normalized form of L2 loss and optimize 0* by the extractor unlearning loss Lyz:
ll (x) h (ig (z)
llg (a) / (gf (x))
LUB = Σ
E
(10)
mEX, 1 (r) h (x) (z))
1 (x) hy (of (x) Il +1
xeX,
where Xy and X denote the inputs the model of remaining data and forgetting data.
3.2 REPRESENTATION ALIGNMENT
On the one hand, the extractor unlearning stage introduces two approximate estimations of the representation distribution Q(D,) and Q(Dy). ()))),00))))) gi (x) necessitates further adjustment to mitigate the influences induced by this approximate estimation. On the other hand, after the extractor unlearning, the representation space of model gú can not aligned with the original classifier layers gh. The adjusted model will suffer performance drop in the predictions. Furthermore, due to the lack of supervision information y, the original classifier Ih cannot be adjusted to align with the representation space after the extractor unlearning retain the prediction capability of the whole model. To maintain the prediction performances of updated models, one possible approach to shift the representation space after the extractor unlearning to align with the original representation space on the remaining data. In this case, the adjusted model after the extractor unlearning can utilize the supervision knowledge of the original model without adjusting Ih using any label information. Therefore, we propose the representation alignment loss function and optimize g by minimizing the proposed loss:
Σ log( exp(simloss (yf (I), ((gg(()))))) xEX- L exp(simloss( (g) (b)))((())))))))
TAA
(11)
where т is a hyperparameter. As for the similarity loss function simloss( in Eq. 11 we use the cosine similarity loss for implementations because its normalization characteristics and huge success on the high dimensional representation learning (Chen et al. 2020). Different from the classical contrastive loss, the representation alignment loss compares the similarity of the repre- sentations of the models before and after the unlearning algorithm representation alignment loss reduces the distance between the representations of the two models on the remaining data point and increases the dissimilarity between the representations of the two models on the forgetting data. In the implementation, we optimized the extractor unlearning loss LuE and representation alignment loss LRA alternately because the magnitudes of the two losses have large differences in different datasets.
the same data point. The
For the training data with extra annotations, add an additional supervised repairing stage to retain higher performances after the LAF if the labels of the part of the remaining data are available. In the implementation, we sample the same number of remaining data the number of forgetting data Dy-
Algorithm 1 Supervision-free Unlearning Algorithm: LAF
Input:
The training data, D, consisting of the remaining data D, and forgetting data Dy; Two initialized VAEs, h and hy;
The original model yn with the representation extractor gh:
Epochs for the unlcarning, Epoch,..
Output:
The updated model that removes the knowledge of the forgetting data, for.
1: Train h and hy D and D2 by Eq. and Eq. 5
2: Fix h and h and set 9u = 9p:
3: for e, in range( (Epoch,))
4: Sample from D, and get samples as the same size as Dy:
5: Update of by I TO
6: Update d6 by Eq. IT
7: if labels of partial remaining data are available:
8: Repair gu by supervised data for one epoch;
9: return gu.
5

---

Published as a conference paper at ICLR 2024
3.3 OVERALL ALGORITHM AND IMPLEMENTATION
We provide the pseudo-code of LAF in Algorithm [ The LAF takes the inputs of training data D and inputs of forgetting data D to get the embeddings through the extractor gi- Then these embeddings work as the inputs to train two VAEs using optimization functions (Eq. aand Eq. 5 The two VAEs are expected to learn the distribution of original training data and forgetting data. We then remove the knowledge of the forgetting data while preserving the knowledge of the remaining data via the extractor unlearning loss in Eq. 10 Subsequently, to maintain the performance of the post-unlearning model, we align the representation space of the remaining data with the original representation space via the representation alignment loss Eq. [I] Furthermore, when the supervision information the remaining data is available, the post-unlearning model can be further repaired.
4 EXPERIMENTS
In this section, we conduct experiments to answer three research questions to evaluate LAF:
How do the proposed LAF perform on the data removal, class removal, and noisy label removal tasks, as compared with the state-of-the-art unlearning methods?
RQI:
RQ2: Is the representation space after the implementation of LAF consistent with the space of retrained models?
RQ3: How do LuE and Lna affect the performance of LAF?
4.1 SETTINGS
Datasets and Models. To validate the effectiveness of LAF, we conduct experiments on four datasets: DIGITS (MNIST) (LeCun 1998). FASHION (Fashion MNIST) (Xiao et al. (017)) CI- FAR10 (Krizhevsky al. 2009) and SVHN (Netzrr al. 2011p. For the two MNIST datasets, we use convolutional neural network (CNN) with two convolutional layers while for the two CIFAR datasets, we choose an 18-layer ResNet backbone(He et al. 2016).
Baselines. Considering that the label-agnostic unlearning deep models is still research gap, compare the performance of LAF (label-agnostic) and LAF+R (with supervised data for repairing) with seven fully supervised unlearning baselines including Retrain which are the golden standards from the retraining models, and six state-of-the-an unlearning works on deep models. The six baselines include four approximate unlearning works that have been published the past year and one exact unlearning method: NegGrad, Boundary (Chen et al., 2023). SISA (Bourtoule et al. 202T), Unroll (Thudi al. 2022). T-S (Chundawat al.] 2023), and SCRUB (Kurmanji al.) 2023). The detailed descriptions of these baselines and the implementation details are provided in Appendix 3. All the experiments on these baselines are conducted for five rounds of different random seeds.
Evaluation Setting, To validate the efficacy of the LAF, we establish experiments under three scenarios: (1) data removal, wherein 40% of training data labelled from 5 to 9 are randomly selected for removal; (2) class removal, where data from class 0 are designated forgetting data for removal; (3) noisy label removal, in which 60% of training data labelled from 0 to are randomly annotated as wrong labels and regarded as forgetting data for removal. For evaluations, assess the performance of LAF in comparison to baseline methods using four metrics: Train, representing the prediction accuracy of the post-unlearning model on the remaining data; Train,, denoting the prediction accuracy of the post-unlcarning model on the forgetting data; Test, indicating the prediction accuracy of the post-unlearning model on the test data, which is further divided into Test,, and Test, in the class removal task, representing test accuracy on the remaining and forgetting classes respectively; and ASR, which denotes the attack success rate of the membership inference attack (Shokri et al.) 20177 Chen et al. 2021). For all the above four metrics, the closer value on Train, and ASR of the post- unlearning model to the retrained model indicates better knowledge removal performance while the closer value on Test to the retrained model indicates better knowledge preservation performance.
4.2 UNLEARNING PERFORMANCES
Table 2 and 3 showcase the experiment results of the three distinct tasks: data removal, class removal, and noisy label removal. Upon comprehensive analysis of the experimental outcomes, it is

---

Published as a conference paper at ICLR 2024
Table 1: Comparison results with other state-of-the-an art methods in data removal ttt The bold record indicates the best result and the underlined record indicates the second best result. The following tables use the same notations as this table.
Method
Data
Train,
Train
Test
ASR
Dnta
Train,
Traine
Test
ASR
Retrain
99.56=00.05
98.44=0.10
99.04-t0.10
09.80==0.53
96,43:t-0.35
35
02.1540
90.23:+022
47.32=00.76
NegGrad
99.18:20.28
98.86:0041
98.62:10.29
50.24:10.27
93.28:20.29
0.773
89.18:20.24
46.11:20.66
Boundary
97.65=+1.02
35.36-22.50
16.63+1.35
46.83+2.09
56,28+-4.00 69
46.58-44.04
53.00+3.66
48.03+1.41
SISA
DIGHT
99.06=t0.12
98.60=20.07
98
98.92-00.02
33.78=+0.01
91,98=+0.19
90.76=00077
89.92-+0.24
33.33=+0.02
Unzolling
99.63:10.15
99.34:10.33
99.08:10118
46.50:10.60
89 89.83-10.300
83.88 83.88:00.65
81.21:1033
47.69:10.50
T-S
94.01=00.77
93.09=22.73
13.72:11003
47,82:+0.64
82.96:::1114
86.77:22113
82.46=11.24
45.90==1.30
SCRUB
99.28:1:.00M
99.03:00.12
98.95:10.088
46.68:10.80
90.8:100009
88.62:+0.228
88.75:10.11
45.23:1:..4
LAF+R
99.47.10.14
0..
98.89100.10
49.42.10.51
94.18.10.30
95.00:1:1.62
90.51
47.39.10.23
LAF
98.03:40.688
97.29=1144
97.30-10.78
47.92=00.84
91.54::22.77
90,91::7000
87.53:+:3.26
46.89-10.88
Retrain
84.03++0.20
78.05=1.34
67.20-00.65
57,48=0.88
83.88=:0.23
75. 067
93.41=00.40
58.76+0048
NegGrad
79.08:
70.50+22.44
03.51
56.53:20.34
81.57:+0.34
69.93
91.54=11011
0.
Boundary
54.73+ 1.32
18.73+3.33
51,23+2.55
62.79=0..55
64.85+22.06
28.6 28.62++111 1.89
73.07=1.96
89. 89.17+3.29
CIFARIO
SISA
66.78:+0.10
53.12=0.774
54.30=00.05
37.53=0002
SHHS
82,48:00.17
67.79=00334
82.57=00.83
50.19=00388
Unzolling
1.682.1...66
30.91
61.31::1.11
56.97111.27
70.98111.87
47.68
83.27.10048
55.39
T-S
70.31+22.32
72.17+391
77.71+2.02
14.64+1558
08.
73,50=00.2
90.60=t0.61
45
SCRUB
29. 16-
0,474:0.93
28.18:00:78
54.03-40.64
22.32:+0.04
0=:0
19.59=00:07
65.26-t 1 24
LAF+R
79.57=#0.72
09.50=00.66
84.74+1.08
57.74=0062
83,37=+0.41
0..08::0.76 93.56=0.51
58.03+0.288
LAF
1.55
33.30
82.22++2.77
0..65::0.70
81,63+0449 7..11=11499 92.32-+0.58 09
Table 2: Comparison results with other state-of- of-the- art methods in class removal (avg%
Method
Data
Test,
Testy
ASR
Data
Test,
Test
ASR
Retrain
98.81 15
0.10
26.49 1.441 1.41
92.66.10.22 0.29
0.1.0
38.24.1..13
NegGraad
08.86-00.39
39.76::38.91
39.71:33999
89.70:1:0.7
0,92::0:48
3..64::2.32
Boundary
SISA
DIGITS
98.59110.22
99.10-10.03
95.63:1.5.77
0::0
38.51:14.25
50.12:4:0.3
FASHION
86.04.1
92.14:10.007
1.681.0.69
0:1:
39.06 1..57
50.00:10.02
Untolling
97.05
79.63=399.00
2.255222
88.72-+-088 068
0,40=t0.24
40.61 1.87
T-S
61.31=40.52
0.16=0019
35.83-11:447
91.84::00311
21.16:7.224
24.82:
SCRUB LAF-R
99.02-40.06
93.41
32.04:+:2.75
91.40=t-0.2 24
0,42::0.36
33.84=0..00
99.05=50.04
0.10==0.33
24.38:10.34
91.95=t:0.29
0.08
35.00=:2.116
LAF
98.03:20.20
0.2620.11
22.25:42.61
89.73::0.37
2.43::1:46
01.35
Retrain
87.01 0.666
0.10
6.576.1
94.07 L. 0.67
0.10
59.33.1 1,31
NegGrad
57.55
0::0
50.46:1:081
1..92:t1.23
6.44::9.12 12
3..70:1.62
Boundary
13.33:11.36
1.0
61.22.13.37
90.59.11.33
15.99
60.88 1.661
CIFARIO
SISA
73.52-10.37
0::0
50.12:40.00
SVHN
91.96:10.63
0:10
61,26::1.42
Untolling
14.26=+1.53
0=:0
67.59+22.49
92.48-+00.64
93.31=2.56
57,20=
T-S
86.47=+0.91
6.21=55007
44.95:t44.43
92.73:+0.64
10.29::5.14
49.62+0.97
SCRUB
32.93-20.84
0=:0
1.449
20.99-+:.31
0::00
13:11:::9
LAF-R
87.15:10.55
0.15=00.09
58.16: 1.08
91.96:1-0.63
0:::
61.26:::122
LAF
82.38:10.97
2.15
10.46:11.96
1..80:11.14
0.33:10.51
06.33:10.49
observed that our proposed LAF-R method achieves the highest performance in 19 evaluations and secures the second-hip sccond-ighhest performance in 15 out of total of 44 evaluations. In contrast, the SISA method manages to attain the highest performance in only 13 evaluations and the second-highest in evaluations. Other methods under consideration lag in comparison to LAF-R and SISA. Furthermore, we observe that LAF-R consistently achieves either the best or second-bes, results in the tasks of data removal and noisy label removal, particularly under the metric of ASR. This suggests that the proposed LAF-R stands as a highly reliable unlearming algorithm in countering membership inference attacks. However, limitation is noted in the class removal task; while LAF-R consistently maintains the highest test data accuracy for the remaining class, it falls short in sufficiently removing the information of the forgetting class. This can be due to the lack of label information, which can compel a shift in the prediction results of the forgetting class to other classes in unlearning (Tarun al. 2023 Chundawat et al. 2023 Kurmanji et al. 2023).
Regarding the performance of the proposed LAF, it demonstrates comparable results in data removal and noisy label removal tasks, although it exhibits weaker performance in the class removal task. In Table. I LAF attains the best and the second best Train, on Fashion and SVHN. It can achieve the best ASR on CIFAR1O, and the second best ASRs on the DIGITS dataset. Moreover, in all evaluations excluding those on the DIGITS dataset, LAF consistently ranks within the top 5 performances. The suboptimal results on the DIGITS dataset can primarily be attributed to the excessive removal of information of the forgetting data, subsequently impacting the performance of the remaining data. In the class removal task, as previously noted, the label-agnostic approach exhibits shortcomings when compared to supervised repairing (LAF-R) and other supervised unlearning methods. In the noisy label removal task, LAF further demonstrates its ability to mitigate the effects of noisy labels and enhance prediction accuracy, securing top-5 rankings in all accuracy evaluations. Furthermore, the
7

---

Published as a conference paper at ICLR 2024
efficacy of the noisy label removal tasks also supports LAF can realize unlearning on low-quality representation extractor maintaining the prediction ability.
Table 3: Comparison results with other state-of of-the--rrrrr art methods in noisy label removal (av
Method
Data
Train,
Train;
Test
ASR
Data
Train,
Train;
Test
ASR
Retrain
99.75-0.112
0
98.8 08.83-0.05
39.26=40001
97.04-40.83
2.16+#0.6
88.15=0.45
3
NegGrad
98.64
26.2622252
98.27=00155
30.66++0.93
919111104
2.82+0.43
85,96=0.85
12.39::1161
Boundary
32.05-1:9.04
7.05
69.85111883999444
72.82:16.71
11.21:1::79
14.34-100.333.88-11
SISA
DIGITS
98.92:1:4.80
1.50:10.04
98.80.10.08
24.64:00.22
FASHION
92.22:1.5.55
169:10.06
88.90.10.01
25.00:1:0.66
Unrolling
67.86=:0.26
0,43:00.9
97.31:00555
31.35=+1.10
61.73:1.83
3.76=20.83
80.02:3385
33.97= 1.31
3.60
83.85.15.69
85.56.1..13 5.64-11.32
74.19.15:23
SCRUB
91.27=40.39
0,74 18
96.11
31,48= 1.08
87.29++1.35
4.29-10.50
79.2
33.32:4:0226
LAF+R
98.87=0.11
0.23-20.06
98.45=0:223
35.98::1.41
93.4240.44
2.06+:0220
07.71
34.33-4-0.22
LAF
96.46:10.67
2.70::.559
914
18.51:10.57
92.32:40.66
4.80:10771
1.221
22.36::0:72
Retrain
73.33+0.89
7.74-20.23
64.74:1.22
57,044:0.99
82,46+0.115
2.37-40.23
93.38-0.35
19,55-+1.222
NegGrad
40.35=55.35
8.91
29.9744.18
55,98:1-0.37
18.48422.68
1.48
17.46=6.08
28.25:4-.005
Boundary
42.69 1..49
8.23
33.57:1.04
54.81:12.17
44.27:1:.43
7.86
11.66.11433
58.15 1.12
SISA
CIFARIO
69.17=00111
6.75+1001
5..59=0.14
28.62:+0.02
SVHN
80.17:10133
2.45:0.31
80.02=00077
44.8440.04
Unzoling
32.81 4.334
8.8:12242
32.0113877
53.86:11.26
29.71::3.00 10.52::0.99
32.33:15.03
53.61:10.58
10.97.10..3
45.92.1481
75.45.10.33 4.27:10.29
83.87
21.16.12011
SCRUB
51.84+1.000
10.70=00.41
38 08.06:10.37
12.38
59.89 5,10#00.44
66 66.80-4996
57.22++0:90
LAF+R
60.49=#1.71
9.33-20.35
51.75+22.77
14.49=1.04
79,39+0.22
2.85=00.17
90.51=0.50
1..09:
LAF
1..44
10.60:1.200
47.5720063 53.18100.88
77.8710.355
3.59:10.20
89.33:10.32 11.50:
4.3 REPRESENTATION SPACE VISUALIZATION
Figure Taa and (c) present the visualized distributions of the representations before and after unlearn- ing on the T-shirt class (blue points) and Figure bb) shows the representation distributions in the retrained model. In Figure T(a), the forgetting data of the T-shirt class has few intersecting distribu- tions with the Shirt class (pink symbols) the decision boundaries of the two classes. However, in the representation distributions of the retrained model, the cluster of the T-shirt shifts closer to the cluster of the Shirt, resulting in a greater overlap of data points between the T-shirt and Shirt classes. In the representation distributions of the post-unlearning model, which is shown in Figure [bb), the clusters of the T-shirt consist of two segments. The first segment lies in the decision boundaries of the Dress and Shirt classes because the data of the T-shirt are easily misclassified these two classes. The second segment near-completely overlaps with the data of the Shirt class, which is consistent with the representation distributions in the retrained model.
(a) Representation distribu- tions before unlcarming
(b) Representation distribu- tions after retraining
(c) Representation distribu-
tions after unlcariing
Figure 1: Representation distributions in the class removal task on the FASHION dataset. The blue number stand for the forgetting data while the other numbers denotes the remaining data. The colour corresponding to each class is shown in the legends.
4.4 ABLATION STUDY
Table 4 5, and delineate the results of the ablation study focusing on the impacts of losses LUE and LRA across three unlearning tasks. LUE is proposed for extractor unlearning and LU is formulated for representation aligmment to maintain the model's prediction performance. Therefore, it is anticipated that in the absence of Lug, the post-unlearning model would exhibit inadequacy in removing forgetting data and without L RA. the post-unleaming model will suffer degradation the prediction performances.
8

---

Published as a conference paper at ICLR 2024
The ablation study results corroborate these expectations. Firstly, in all three tables, the absence of optimization on LRA for alignment with classifiers results in substantial performance degradation in both remaining data accuracy and test accuracy. This is particularly pronouneed in class removal tasks. Additionally, in Table the models lacking LUE achieve significantly higher Testy on the DIGITS, FASHION, and CIFARIO datasets, indicating the ability to further remove the information of forgetting data. On the SVHN datasets, although the Test, will be lower without LUE. there notable decline in performance on the remaining data. In Table and 6 where the forgetting data are randomly selected, the forgetting data distribution and the remaining data distribution are similar. Therefore, LU E will have relatively minor influences on the unlearning process and the results without F are close to the LAF results in the evaluations on the forgetting data.
Table 4: Ablation study results in data removal. 'None L1I denotes the unlearning without LUE E and 'None L,2' denotes the unlearning without RA.- The following tables take the same notations.
Method
Data
Train,
Train
Test
ASR
Data
Train,
Train
Test
ASR
Retrain
CIFARIO DIGITS
09.56:2:005
98.84=0.10
99.04:1.110 49.80-1:0533
SVHN FASHION
96.434:0.35
42.15=0041
90.23::::22
07.32:+0.76
None L1
99,41110.10
09.0910.45 1.11 47.02.11.88
87.30:1..77
77.0817.43
8144.13.45
46.45.10..9
19.0244: 1.93
18.99115
44.62:11.52
44.24412.7
81.68-16844
50.67-3..00
40.95:10.07
LAF
98.03=+0.68
91.29=
97,30=+0.78
47.92:40.84
91.5442.67
90,91=7.00
37,53+3326
46.89-1-0.88
Retrain
84.03=+0.20
78.05=1.334
07.20=
$7,48:00
83,88+0.23
05.16=0.776
93,41=0:40
58.76::0.48
Nove L1
78. 78.13:::1.28
7,.96:::.22
62.12:12.21
$6.98
81.37:10.31
1.25
91.4
57.10:10.660
78.62.1.0.80
1.562.11.59
84.67:10.50
56.22.1...2
30.52.12.21
40.76.1
61.8111.12
LAF
78.03= 1.55
73 3.99
2.52 57.65:100.70
81.63-1-0.49
1..11==1449 92.32=+0.58 57.85:4-0.89
Table 5: Ablation study results in class removal.
Method
Data
Teste
Test
ASR
Data
Test,
Test
ASR
Retrain
CIFARIO DIGHTS
00.81=0.11
0::0
26.49::1.41
NINS FASHION
92.66-1:0.29
0:::0
38.24:::.13
Nome L.
98.88 0.09
0.41
24.25.10.70
91.39
2.65.12.10
29.48.10.91
None 1.2
13.97=1.05
62.04=37.18
26.37:10.92
9.15
1.43
31.28:10.84
LAF
0.668
0.26
52.25.1:..11
91.54
2.46.1.146
01.75
Retrain
86.01=0.64
0::0
67.76:::1.58
94.07=200.67
0=::0
19.33+1.31
Nome L1
7.63 2.222
21.11
1..93
61.13:144.78
0.17::0.29
61.36.19.99
None 1.2
33.62
3.60 1.32
53.33-1-.233
9.54:10.54
2.19:1.3.0
2..45
LAF
82.38:00997 0.97
2.19::1.96
50.46::11.9 1.96
1.14
0.33:1:0.51
06.33:10.49
Table 6: Ablation study results in noisy label removal.
Method
Data
Train,
Traing
Test
ASR
Data
Train,
Traing
Test
ASR
Retrain
CIFARIO DIGHTS
99.75=0.12
0. 0.1000.01
98.83::0.05
39.26=0.01
SVHN FASHION
97.044:0.83
2,16:0006
88.15:4::45
37.65 1.88
None L1
90.86=1.00
3.74
84.96:11.58
29.28-0.55
86.36+1.117
5.4420.72
75.46::2.56
30.34=0.78
None L2
11.12=22.9
11.19:1.39
10.85:33.33
28.75
1.48
9.47-15.32
11.78:11100
8.16:13.40
32.41=1.00
LAF
96.46_.0.67
2.70.10.59
91.48.11.49
18.51
92.32:10.66
1.80
81.21:11.22
22.36.10.72
Retrain
73.33=20.89
7.74
64,744:1.2
57.04=0..99
82.46::0.15
2.37-:0.23
93.38::0:35
59:55::1.22
None L1
57.44=1.10
10.61=00.1
47.57+00.3
53.41=0.52
78.05+00.25
3.56+0.27
89,10+:0.44
51.14=0.65
None L2
54,31=2.98
10.65:10.24
46.86112.49
54.16=1.25
34.63+:.33
1.11
43.63::..15
59.24=180
LAF
1.11
10.60.10.20
4..67.10..3
53.18 0.668
77.87
3.59110.20
89.33.10.32
51.5011.1 1.17
CONCLUSION
In this study, addressing the imperative requirements for unlearning on the label-agnostic datasets, we introduce the Label-Agnostic Forgetting (LAF) framework. This framework is meticulously designed to eliminate the knowledge of the forgetting data distribution, while concurrently maintaining the knowledge of the remaining data at the representational level. Firstly, we employ two VAES to model the distributions of both training and unlearning data, subsequently introducing a novel extractor unlearning loss to remove the knowledge of the forgetting data. Secondly, we introduce an additional representation alignment loss, intending to align the distributions of the remaining data representations with those preserved in the original model. Finally. if the annotations of any subset of remaining data are available, we proceed to update the entire model through supervised repairing, to further preserve the information of remaining data. The experiment results demonstrate the advantages of the LAF with supervised repairing (LAF+R), in comparison to baseline methodologies. Additionally, the findings also demonstrate the comparable efficacy of LAF without supervisory information, compared to other supervised unlearning approaches. The experiments also shed light on certain limitations of LAF, including the insufficient removal of the forgetting class in the class removal tasks, and the low efficiency compared with other supervised unlearning works. These observed limitations delineate prospective directions for future enhancements and refinements.
9

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGMENTS
The authors thank the NVIDIA Academic Hardware Grant Program for supporting their experi- ments, the UQ Cyber Security Fund (2021-R3 Weitong) for Shen, the Australian Research Council (DE230101 116) for Xu, and the CMS Research Grants (15131570), Adelaide Nottingham Alliance Seed Fund Project (15133470), and ARC (DP240103070) for Chen.
REFERENCES
Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jía, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In SP, 2021.
Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When machine unlearning jeopardizes privacy. In CCS, 2021.
Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting deep networks via shifting the decision boundary. In CVPR, 2023.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey E. Hinton. A simple framework for contrastive learning of visual representations. ICML, 2020.
Vikram S. Chundawat, Ayush K. Tarun, Murari Mandal, and Mohan Kankanhalli. Can bad teaching induce forgetting? unlearning in deep networks using incompetent teacher. In AAAI, 2023.
Carlos Artemio Coello Coello, David A. van Veldhuizen, and Gary B. Lamont. Evolutionary algorithms for solving multi-objectivve problems, volume 5 of Genetic algorithms and evolutionary computation. 2002.
Lydia de la Torre. A guide to the california consumer privacy act of 2018. Available at SSRN 3275571, 2018.
Jimmy Z. Di, Jack Douglas, Jayadev Acharya, Gautam Kamath, and Ayush Sekhari. Hidden poison: Machine unlearning enables camouflaged poisoning attacks. Arxiv, 2212.10717, 2022.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In Andrea Vedaldi, Horst Bischof, Thomas Brox, and Jan-Michael Frahm (eds.), ECCV, 2020a.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In CVPR, 2020b.
Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In EAAI, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In ECCV, 2016.
Junyaup Kim and Simon S. Woo. Efficient two-stage model retraining for machine unlearning. In CVPR, 2022.
Diederik P. Kingma and Max Welling, Auto-encoding variational bayes. In ICLR, 2014.
Thomas N. Kipf and Max Welling. Variational graph auto-encoders. Arxiv, 1611.07308, 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. https://www.cs.torntt..kk edul kriz/eifar.hmll 2009.
Meghdad Kurmanji, Peter Triantafillou, and Eleni Triantafillou. Towards unbounded machine unlearning. Arxiv, 2302.09880. 2023.
Yann LeCun. The mnist database of handwritten digits. http://yann. lecun. com/exdb/mmist/, 1998.
Yann LeCun, Yoshua Bengio, et al. Convolutional networks for images, speech, and time series. The handbook of brain theory and neural networks, 1995.
10

---

Published as a conference paper at ICLR 2024
Dawen Liang, Rahul G. Krishnan, Matthew D. Hoffman, and Tony Jebara. Variational autoencoders for collaborative filtering. In wwW, 2018.
Gaoyang Liu, Xiaoqiang Ma, Yang Yang, Chen Wang, and Jiangchuan Liu. Federaser: Enabling efficient client-level data removal from federated learning models. In IWQOS, 2021.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning. 2011.
Quoc Phong Nguyen, Bryan Kian Hsiang Low, and Patrick Jaillet. Variational bayesian unlcarning. In NeurlPS, 2020.
Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. A survey of machine unlearning. Arxiv, 2209.02299, 2022.
Pierre Nodet, Vincent Lemaire, Alexis Bondu, Antoine Coruéjols, and Adam Ouorou. From weakly supervised learning to biquality learning, a brief introduction. Arxiv, 2012.09632, 2020.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In SP, 2017.
Ayush K. Tarun, Vikram S. Chundawat, Murari Mandal, and Mohan S. Kankanhalli. Fast yet effective machine unlearning. TNNLS, 2023.
Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling SGD: under- standing factors influencing machine unlearning. In EuroS&P, 2022.
Aäron van Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. Arxiv, 1807 .0w.003788... 2018
Paul Voigt and Axel Von dem Bussche. The general data protection regulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing, 2017.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. Arxiv, 1708.07744 2017.
Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S. Yu. Machine unlearning: survey, ACM Comput. Surv., 2024.
Xiangli Yang. Zixing Song, Irwin King, and Zenglin Xu. A survey deep semi-supervised learning. IEEE TKDE, 35, 2023.
Peng-Fei Zhang, Guangdong Bai, Zi Huang, and Xin-Shun Xu. Machine unlearning for image retrieval: A generative scrubbing approach. In MM, 2022.

---

Published as a conference paper at ICLR 2024
A SUPPLEMENTARY MATERIAL
A.1 RELATED WORKS
Machine Unlearning. Machine unlearning requires removing information of forgetting data in the original model while preserving the knowledge contained in the remaining data (Bourtoule et al. 202T, Xu et al. 2024). Currently works on machine unlearning can summarized into two branches based on the unlearning objectives. The first type is exact unlearning, which requires achieving the same model as the train-from-scrattee model on remaining data. Exact unlearning is mainly applied to classical machine learning models (Bourtoule et al. 2021; Kim & Woo 2022). In deep models, the parameters and model structures can be much more complex. Therefore, the exact unlearning is hard to be realized. The current works of exact unlearning on deep models usually take the retraining strategy and focus on improving the algorithm efficiency, for example, the SISA algorithm which retrains the model via distributed approach on different devices (Bourtoule al. 2021). The second type is approximate unlearning, which requires the unlearned model to get similar performances to the retrained model on both the remaining data and the forgetting data. Approximate unlearning
methods are widely applied to deep models (Nguyen et al. 22020; Tarun et al. [023 Golatkar et al.
20206; Thudi et al., 20222 Graves et al. |021; Chen al. 2023]] Kurmanji et al. 2023] [ Chundawat et 20233 Golatkar et al., 2020a] Liu et al. 2021). The cutting-edged works on approximate unlearning includes: (Chundawat et al. 2023) which employs two teacher models that are trained on
the remaining and forgetting data to guide the unlearning; (Chen et al. 2023) which explores a new
perspective of unlearning by shifting the decision boundary of different classes for unlearning, and (Thudi et al. (022)) which recovers the changes of parameters occurring in the training of data to be forgotten. Compared with the exact unlearning on deep models, approximate unlearning has wider applications.
Unsupervised Representation Learning, Unsupervised representation learning aims to learn the representations of the input data without using labels. The unsupervised representation learning has attracted more attention from researchers. The variational autoencoder (VAE) (Kingma & Welling 2014) and contrastive learning (van den Oord et al., 2018 are two critical techniques. The VAE can project the input features into low-dimensional Gaussian representations. Currently, the strong ability for representation learning makes the VAE have wide applications on deep learning tasks. For instance, (Liang et al. 2018) explores the application of VAE on representation learning in collaborative filtering while Kiip & Welling 2016) applics the VAE on the representation learning of graph data. Contrastive learning reduces the distances of the embeddings of data that share similar characteristics and increases the distances of the embeddings of data that are dissimilar from each other. For instance, (van den Oord et al. 2018) introduces the Noise Contrastive Estimation to differentiate the distance between the similar and dissimilar samples and (Chen et al. 2020) employs cosine similarity during contrastive learning.
A.2 NOTATIONS
We provide table of all notations of the main paper in Table 7
A.3 IMPLEMENTATION DETAILS
A.3.1 OVERALL WORKFLOW
Figure. 2 presents the workflow of the whole LAF framework. The LAF first trained two VAEs h and hy on the representations of training data X and representations of forgetting data Xy. Then by fixing the parameters of h and hy, Next, to align the representation distribution of gi with the classifier, LAF compares the similarities between the representations of remaining data and forgetting data in the model before and after unlearning and maximizes the representation alignment loss LRA- Lug and LRA can be updated alternately. We output the updated model as the final model g
Subsequently, the LAF framework focuses on aligning the representation distributions between the post-unlearning extractor gf and the classifier D This is achieved by the representation alignment loss TARA, aligning the representations of the remaining data before and after the unlearning process
12

---

Published as a conference paper at ICLR 2024
Table 7: Table of Notations Used in The Main Paper
Notation
Explanation
D
Training data
P
Training data distribution
Dr
Remaining data
P.
Training data distribution
Dj
Forgetting data Training data distribution
Py
Instance of data Instance space
X
Label of data
y
Label space
3D
Trained deep model
9D
Extractor the trained deep model
9D
Classifier of the trained deep model
9u
Post-unlearning deep model
90
Extractor of the post-unlearning deep model Distribution that post- post-unleaming deep model follows on D, Distribution that post-unla cest-unlcannng deep model follows on Dy Distribution discrepancy
Q(D.)
Q(D))
A(s-)
h
VAE that learns the distribution of the training data representations VAE that learns the distribution of the forgetting data representations Standard Gaussian distribution
(
HA, Th
Mean and std estimated by h on its encoding layer for (f)),, E D.
an, on
Mean and std estimated by h on its encoding layer for 90 (x), E D.
phy Tne
Mean and std estimated by hy
its encoding layer for (2()), x Dy
Phys ōhg
Mean and estimated by hy on its encoding layer for gü (z), D3
and differentiating the representations of the forgetting data before and after the unlearning. The LUE and RA losses are updated an alternating fashion.
The culmination of this process is the final updated model, denoted as gi which effectively embodies the refined balance between learning and forgetting, dictated by the LAF framework.
Alterratlly
Soprosentation
Estrator
Algement Loto luss
tadgpossaation
Mate momlerr
by moeriiiooal
Madimur
Updoting Fatra
Sugeriig
Fagytting Upchiin Modi
Vichy
will Mrads
Remal ing Doto
Forgetting Gata
Figure 2: Workflow for LAF consisting of VAE training, extractor unlearning and representation alignment stages.
A.3.2 ENVIRONMENT
All the experiments are conducted on one server with NVIDIA RTX A6000 GPU (48GB GDDR6 Memory) and 12th Gen Intel(R) Core(TM) 19-129008 (16 cores and 128GB Memory) and two servers with NVIDIA RTX A5000 GPUs (24GB GDDR6 Memory) and 12th Gen Intel Core i7- 1-70KK CPUs (12 cores and 128GB Memory). The code of LAF was implemented in Python 3.9.16 and
13

---

Published as a conference paper at ICLR 2024
Cuda 11.6.1. The main Python packages' versions are the following: Numpy 1.23.5; 5; Pandas 2.0.1;
Pytorch 1.13.1: Torchvision 1..11. The datasets in experiments: DIGITS (LeCun) 1998). FASHION
(Xiao et al. (017), CIFARIO (Krizhevsky et al. 2009), and SVHN dataset (Netzer al. 2011 are all downloaded from the Torchvision library. Moreover, all the comparison methods provide open resources for their implementation code: Boundary T-S SCRUB SISA Unrolling
A.3.3 INITIALIZATIONS
For the experiment models, we choose the CNN(LeCun et al. (195) with two convolutional layers for the two MNIST datasets. The output channels for the two convolutional layers are 16 and 32 respectively. Then the other parts of the CNN consist of three linear layers with the output dimensions 256, 128 and 10. For the two CIFAR datasets, we choose an 18-layer ResNet (He et al., 2016) with two linear layers with the output dimensions 256, and 10 and the ResNet does not contain the pre-trained weights. We construct two VAEs with three and four linear layers in the encoders and decoders. The first type of VAE is used for the two MNIST datasets consisting of three linear layers' encoder with the input dimensions 256, 128, and 32 and a three linear layers' decoder with the input dimensions 8, 32, and 128. The second type of VAE is used for the other two datasets consisting of the same structure encoder as the first one and a three linear layers' decoder with the input dimensions 16, 32, and 128.
All the experiments are based on the original models trained in the four datasets. We train two CNN models two MNIST datasets for 10 epochs with a learning rate of lc-3 while we train another two 1 18-layer ResNet models on two CIFAR datasets for 20 epochs with a learning rate retrain the CNN models
two MNIST datasets for 20 epochs with a learning rate of le-3, We retrain the 18-layer ResNet models on two CIFAR datasets for 40 epochs with learning rate of 5e-5. Then for the other six comparison Nesglin Boundary(Cher) et al. (0023). T-S(Chundawat et al. 2023), SCRUB SCRUB(Kurman Kurmanji al.] (022), ). we keep the hyperparameters of the unlearning process the same as in the original paper and adjust other necessary parameters for the unlearning stage to get as high performances as we can. NegGrad adjusts the deep model parameters with positive gradients on remaining data and negative gradients on forgetting data; Boundary (Chen cct al. 2023) shift the decision boundaries of the forgetting data and remaining data to eliminate the forgetting data information; SISA (Bourtoule et al. 2021 proposes to retrain the model using the small data shards from the remaining dataset and ensemble the final results; Unroll (Thudi et al. 2022) records gradients when learning the first epoch and adds recorded gradients on weights after the incremental training; T-S (Chundawat et al. 2023) proposes to retrain two teacher models on forgetting data and remaining data and adjust the student model through the differences between the output space of the two teacher models; SCRUB (Kurmanji et al.. 2023) force the model to be consistent with the teacher model trained on remaining data and inconsistent with another teacher model trained on forgetting data.
of 5e-5. For the golden standard baselines Retrain,
al. 2023). SISA et al.) 2021b. Unroll[Thud
A.3.4 HYPERPARAMETERS
In all experiments, we configure the batch size to 32. During the training of VAEs, we assign the latent dimensions as 8 for the DIGITS and FASHION datasets and 16 for the CIFARIO and SVHN datasets. The learning rate for VAE training established at 1c-3, with the number of training epochs set to 10. For representation alignment, we assign the value of as 2, 20, and 20 for data removal, class removal, and noisy label removal tasks, respectively for CNN. We assign the value of as 20, 20, and 5 for ResNet. Subsequently, in the supervised repairing stage, we designate the repairing epoch as 1, applying a learning rate of 1e-3 for all tasks on the DIGITS and FASHION datasets, and 5e-5 on the CIFAR10 and SVHN datasets.
https:s/wwww.rropbb wwwp://www....oo///////////////a
* 'ttrp:://gthuub.o https//gggnnuooo////hhaaa/csssct
14

---

Published as a conference paper at ICLR 2024
304.00
300L
(a) Time coSt on DIGITS
(b) Time cost on FASHION
55A
15A
5444
074-5
(c) Time cost on CIFARIO
(d) Time cost on SVHN
Figure 4: Time cost comparison in the data removal task. The red columns stand for the time costs of the proposed LAF and the orange columns stand for LAF-R. The green columns denote the retraining and the blue columns denote other methods.
A.4 EFFICIENCY ANALYSIS
A.4.1 TIME COST ANALYSIS
34%
54%
11%
VAE_1
VAE_2
m LAF
Repair
Figure 3: Time cost proportion. VAE stands for the training of h and VAE 2 stands for the training of hy
Figure presents a comparative analysis of the time efficiency of our LAF framework against other methods in data removal tasks. The results indicate that LAF does not hold a distinct advantage in terms of efficiency. Specifically, in experiments conducted on two MNIST datasets. LAF exhibits slightly higher time cost compared to the seven other evaluated methods. However, in trials involving the CIFAR 10 and SVHN datasets, LAF's time consumption close to the average time cost of other methods and is notably less than that required for retraining and the TS Freahhr-Sttdent approaches.
This variation in time efficiency primarily stems from the time-intensive process training the VAEs. As illustrated in Figure 3 the training phase of VAE h accounts for nearly half of the total algorithm runtime, pinpointing a key area for future enhancements. It's important to note, though, that the training of h is conducted to be forgotten. Hence, this training phase can be executed separately from the unlearning process, offering substantial opportunity reduce overall time expenditure.
the entire training dataset and is independent of the selection of data
15

---

Published as a conference paper at ICLR 2024
Ocurdo
Bounday
SOKLB
S0R03
(a) Storage cost on DIGITS
(b) Storage cost on FASHION
1.54
1003
30000 15000
2000
10000
Storage cost CIFARIO
(d) Storage cost SVHIN
Figure 5: Storage workload comparison in the data removal task. The red columns stand for the time costs of the proposed LAF and the orange columns stand for LAF-R. The green columns denote the retraining and the blue columns denote other methods.
WIE training
Unisarning
Figure Memory workload changes of LAF during the whole procedure on the random data removal task on DIGITS
A.4.2 STORAGE WORKLOAD ANALYSIS
a comparative overview of the storage workload associated with our LAF framework and other data unlearning methods. The analysis indicates that LAF's storage demands are broadly comparable to those of most other unlearning methods. Notably, the Retrain method exhibits the lowest storage workload, Conversely, while the Unroll method achieves the lowest time cost, it demands the most storage, particularly in experiments involving ResNet. This increased requirement is due Unroll's need to store gradients for all parameters across the entire training dataset. Moreover, the SISA approach involves training multiple models concurrently, each mirroring structure of the original model, thereby escalating the storage requirements. In contrast, LAF framework avoids the need to store extensive gradients or maintain complex additional models. Although LAF includes the training of two additional VAEs, these structurally simple, comprising merely five four linear layers each. For context, the CNN model encompasses 450K parameters, and ResNet- 18 contains 11.3M parameters, while the two VAEs collectively have only 150K parameters.
it does not necessitate any additional memory-intensive components.
To provide a clearer depiction of the storage workload dynamics within LAF, Figure 6 visualizes the changes in storage requirements throughout the entire LAF process. It reveals that the peak workload
16

---

Published as a conference paper at ICLR 2024
occurs during the VAE training stage, after which the storage demands stabilize during the actual unlearning phase.
A.5 ADDITIONAL EXPERIMENTS
In this section, we add three parts of additional experiments. A.5. is to evaluate the impact of the two approximations in the extractor unlearning process: replacing D by D, for the training of the first VAE, and dropping of the two KL divergence terms in Eq.8. A.5.2 is to evaluate two different optimization strategies, alternately updating and two-stage updating. A.5.3 is set up examine the efficacy of the proposed methods on the low-quality representations.
Table Ablation study results in data removal. 'Add KL adds two KL divergence terms in Eq.8 in the main paper for optimization and D. denotes training the VAE h using the remaining data. The bold results stand for the best. The following tables take the same notations.
Method
Data
Train,
Train,
Test
ASR
Data
Train,
Train
Test
ASR
Retrain
CIFARIO DIGITS
99.56:20005
98.84=00110 09.04:00110 49.80:1-0.33
SXXS MVAN FASHION
96.43-1-0.35
92.15=0.41
90223:::222
47.32:1:0,76
Add KL.
85.78.15.14 33.56.1..54
58.90.11.40
41.19.10.32
59.97.10.06
11.93:1.94 48.93.10.23
41.57.10.06
D,
99.52:10.01
09.43-0.30
98.98:10.09
56.67:12.11
92.49:10..77
90. 1.57
8..22:10.42
44.57:10.87
LAF
08.03=0.668
97.29:
97,30:20,78
47.92:10.884
91.54:22.67
90.91=7.00
87,53=33.26
46.89:100.88
Retrain
84.03=20,20
78.05=1.34
87.20:1:0:5
$7,48::0
83,88+00.23
75.16=20766
93:41:0:40
58.76::0.48
Add KL
44.88 1.2.8.1.32.38
40.81
166.331136.35573991115
81.92.10.30
75.79.10.4
91.93:1.322
$8.09
D,
77.70:10.67
18.
81.79:10.84 55.73:1:0733
81.77-1:036
75.37-1.82
91.8810.11
58.19110.12
LAF
78.03:::.55
73.30=13.96
82.22:+2.57 57.65:10.70
81.63::0.49
76.11
92.32::0.58
57.85++0.89
Table 9: Ablation study results in class removal.
Method
Data
Test,
Test,
ASR
Data
Test,
Test
ASR
DIGITS
98.81=20115
0::0
26.49:1:141
SVi FASHION
92.66:10.29
0:1:0
38.241:3.13
Add KI.
98. 16 18
0.26
24.83-1:0.76
88.43-1 1.24
0.75.10.44
31.7110.74
D,
98.18=0.17
0.31=0.10
24.74-10.80
89.78:40.30
2.35-1
31.45-20.1 19
LAF
98.03=0.68
0.26=0.11
52.25:42.61
91.54+22.67
2.46#11.46
31.35=00771
Retrain
CIFARIO
86.01=0.644
0::0
67.76:1:1.58
94.07-10.67
0::00
59.334:1311
Add KL.
47.11
0.05
48.45:1:166
91.14:10..6
2.38:12.32
54.3311247
D,
76.83-0.38
2.05
47.14-11.48
90.76:::..1
6.311:3.89
47.19433.63
LAF
82.38=0.97
1.15
10.46:::1.6
85.80
1.14
0.33-+0.51
56,33-20.49
A.5.1 FURTHER ABLATION STUDY
Tables 8 and 10 present the findings from our expanded ablation study, focusing on various unlearning tasks. The results highlight that LAF, both in its standard form and with D, utilized during VAE training, achieves comparable outcomes across most unlearning scenarios. This is particularly evident in tasks involving random data removal. Such consistency validates our approach of substituting D with D,, which offers the advantage of pre-training the VAE, thereby reducing time costs associated with unlearning requests.
Furthermore, upon integrating two KL divergence terms into the optimization process, we observe that performance in class removal and noisy label removal tasks remains similar both the standard LAF and the LAF with D, in VAE training. However, a notable difference emerges in random data removal tasks, where we witness a marked decline performance for the remaining data and test data, along with greater deviation in attack success rates compared to retrained models. This phenomenon can be attributed to the KL divergence term of the VAE, which, when trained on the entire dataset, acts regularization component. This effect makes unlearning more challenging, inadvertently preserving information about the remaining data. It is this observation that led us to exclude these two KI. divergence terms from the final extractor unlearning loss formulation.
17

---

Published as a conference paper at ICLR 2024
Table 10: Ablation study results in noisy label removal.
Method
Data
Train,
Train
Test
ASR
Data
Train,
Traine
Test
ASR
Retrain
CIFARIO DIGITS
99.75=0.12
0.17::0.11
98.83::0005
39.26=0.01
SHHN FASHION
97.061:083
2,1620.06
88.15::0.45
37.65:11.88
Add KL.
90.15
3.6610.177
84.40:1.774
29.31 29.31 0.75
87.82.1047
4.68
78.33.10.75
30.19.10.58
D,
90.60=0.59
3.53+0003
848441118
28.85=0.66
87.744:044
4.70:0.19
78.27::0:81
30.35=0.222
LAF
96,46=00.67
2.70::0.59
91.48:+:.49
18.51=0.57
92.32=#0.66
4,80:0.71
22.36=0.72 81,21:11222
Retrain
73.33=00.8
7.74
64,74::1.26
57.04=0.59
82.46::0.15 2.37400.33
93.38::0.35
19,55=11,22
Add KL
77.67=10.90
2.80
82.48.10.66
51.82 4.76
78.06.12.71 6.4916443
89.11.10.48
49.58 0.50
D2
78.31 1.20
2.80:20311
82.65:1:0.56
47.18= 1.14
78.02:10.08
3.53:10.33
89.15::0.56
50.71 1.16
LAF
1..44=1.11
10.60=00.20
47,57:00.3
53. 53.18=0.68
07.87 3.59
89.33++0.32
1.15
Table 11: Optimizing strategy comparison in data removal.
Method
Data
Train,
Train
Test
ASR
Data
Train,
Train
Test
ASR
Retrain
CIPARTO DIGITS
99.56-+0.05
98 99.044:: 10 49.80:1-053
NHAS FASH
96,4540.35 92. 154041 90.23-0.22 47.32:4-0.76
Two Stage
88.63+7.006
19.22=19,74444222
44.01=11.29
81.82+0.16 71.26=1.37
91228=0.30
06.92++0.96
LAF
98.03-10.68
17.29
07.30=10.88
47.92:1:.84
91.54112.67
90.91
87.53:3.26
46.89:1-0.88
Retruin Two Stage
84.03-1:0.20
1..05 87.20.10.65
57,48.10
83,88.10.21
75.16.10,76
93.41:10.40
58.76.10.48
78.62:4:0.79
80.05-1.111
8.51
56.46:1-0.30
81.82:10.16
71.26-
91.28--0.30
56.92.40.96
LAF
1..03+1.555
73.30=3.96 82.22 57.65:+0.70
81.63+0.49
76.11=1.49 92.32=00.58 57.85:+00.89
Table 12: Optimizing strategy comparison in class removal.
Method
Data
Test.
Testr
ASR
Data
Test,
Test
ASR
Retrain
CIAARIO DIGITS
98.81=0.15
0=0
26.49= 1.4
UIIN FASH
92.66+ 29
0=:0
38.244:3.13
Two Stage
98.84=0.13
1.02=0.31
23.59:10.28
91.17::0.17
9.05::0.55
30.58:20.00
98.03=0.68
0.26=0.11
52.25::2.61
91.54::2.67
1.46
31.35-0.711
Retrain Two Stage
86.01 20.64
0110
67.76:11.58
94.07-1..67
0:10
19.311
82.27=1.00 1.06
1.5==0555
46:20=:::72
91.95:10.11
1.67
1,17
LAF
82.38:0097
2.15=1996
50.46:::1.66
85.80
0.33:20.51
56.33-20.49
Table 13: Optimizing strategy comparison noisy label removal.
Method
Data
Train,
Train
Test
ASR
Data
Train,
Train
Test
ASR
Retrain
IIARRO DIGITS
99.75=0.12
0.17
98.83+00005
39.26=0.01
SVHN FASH
97,04=0..3 2.16:0006
88.15+0445
37.65=188
Two Stage
90.42=0.115
3.79::0116
84.12::.300
58.54:0.01
85.52+:100
5.94:0.35
13686::1.63
0.53
LAF
96.46=0.67
0.70
1.948
18:51=0.57
92.32+00.66 0.70
81.21
22.36=0.72
Retrain Two Stage
73.13-10.89
7.74
64.7441..26
$7.04-0.99
82.4610.115
2.37.10.33
93.38110:6
19.55--1.22
80,04=0.33
2.67=0.17
83,93+00.70
57.31=0,22
15.70=00.55
12.1
9.65=0.50
55.84=0.69
LAF
57.44=1.11
10.60:10.20
47.57:+0.63
53.18=0.68
77.87+20.35 3.59
89.33:+-032
51.50=1.17
A.5.2 OPTIMIZING STRATEGY
Table II 12 13 presents the results using two different optimizing strategies, alternately updating and two-stage updating. On the DIGITS, FASHION, and SVHN datasets, the alternately updating can reach better forgetting performances and knowledge preservation performances for all three unlearning tasks. In addition, although the two-stage updating can achieve closer results to the retrained models on the preservation of the knowledge from the remaining data, the performances on the forgetting data and the ASR show large differences to the results of alternately updating. Therefore, the experiment results can demonstrate the reasonability and correctness of alternately updating instead of updating in two stages.
A.5.3 EXPERIMENT ON LOW-QUALITY REPRESENTATIONS
To further examine the efficacy of the proposed LAF, we test LAF with low-quality representations on the different unlearning tasks. Considering that deep models can easily to reach high prediction performances on the two MNIST datasets, we choose the other two datasets: CIFARIO and SVHN and train two insufficiently trained ResNet- 18 models for the experiments. We set the training epochs as and keep the same values of the other hyperparameters as the experiment settings in the main paper. The results are presented in Table and 15
The sufficiently retrained model and sufficiently trained SISA always reach significantly better performances than all the post-unlearning models because the models provided for unlearning are insufficiently trained. Therefore, the retrained results do not have much reference value in this experiment setting. The results of the original model can prove that all the original models are sufficiently trained and can provide baselines of the performances on the remaining and forgetting data.
18

---

Published as a conference paper at ICLR 2024
Then for the remaining approaches, the results demonstrate that LAF can LAF-R can achieve much better performances than other methods. This can support that LAF can also work on low-quality representation extractors.
Table 14: Comparison results with other state-of-the-ai methods in data removal (avg% stt.).
Method
Data
Train,
Train
Test
ASR
Data
Train,
Trainy
Test
ASR
84.03.10.20
7..05
87.20.10.65
83.88.10.23
75.16.0..76 93.41.10.40
58.76.10.48
Original
25.59:42.77
46. 12:4:22777
48.76-13.95
13.21::1666 63.04 72.70:33118
NegGrad
20.27:#0.93
0+0
16,20=0.64
51.38+0.96
22.42:+0.10
19.73=0.15
60.3440.06
Boundary
CIFARIO
21.32:4:1.34
10.4020.37
19.62-42.03
54.72-00.81
42.09::1.31
12.66:0.19
47.21:12.78
15.53++1.73
SISA
66.78 66.78.10.10
53.12.10.74
54.30.10.05
37.53.1.002
SVHN
82.48.10.17
6..79.10.34
82.57.10.33
50.1910.33
Unmlling
27.02-1:.116
2.28:42.23
29.72:10.16
57.25.1087
16
14.78:1:444
13.43:21.35
36.3410.13
T-S
46.48:+1.87
50,20:4.599
50.61
52.98=0.52
64.52=22.20
55. 15.1632.11
73.13+4.59
55.02=0.255
SCRUB
26.84-1-884
10.23-10.17
27.8241.04
LAF+R
18.11
44.19=1.000
52.32:+0.50
53.43=0..3 34
08.31
54.77=5.110
78.75=00.6
55.70=0557
LAF
03.55::0.75
44.51=0221
46.06+0087
54.95=0.66
63,89=1120
53,9442881 72.30=3.05 54.23+141
Table 15: Comparison results with other state-of-the-ar methods in class removal (tdg%
Method
Data
Test,
Testr
ASR
Data
Test,
Testr
ASR
Retrain
06.01:1:0.66
04:0
67.76:1
94.07-100.67
0::0
59.33:11.31
Original
63.86.19.1
47.08.15.27
61.27:117.36
73.52:1..22
NegGra
17.87:10.3
04:0
46.46:1043
34.36::0211
0::0
64, 13:
Boundary
CIFARI0
35.24=:9.22
1.52=2.89
19.033+1.64
54.36++0.71
12.13+1811
1..99=
SISA
99. 19.10:20.03
0::0
50.12::0.25
SVHN
92.14:1:0077
0::0
50.00:10.02
Unrolling
60.78.12.68
T.S
48.81 3:3005
32.30 10:20
45. 25.
12.10:33.09
25.83::14.94
87.77
SCRUB
1..55
01:0
51.57.10.29
22.53.11.54
0.10
68.76112.94
LAF+R
47.04:10.11
0::0
47.34:12.35
76.34.10.10
0:10
56.81
LAF
43.07:::.63
1.3:0.200
43.29:10.44
61.51144.3
0.06:00006
56.67:22.61
19


Reviews:
[{"review_id": "qr1pLFPneZ", "reviewer": "Reviewer_CMsQ", "summary": "Machine unlearning has been an emerging field due to increasing focus on data privacy. Typically, existing approaches toward unlearning rely on re-learning without forgotten data in a supervised manner, which is not practical since the huge amount of training costs and the need for labeled data. This paper proposes a novel machine unlearning framework without accessing any labels. They adapt the model at the representation level through approximation so that the learned knowledge about forgotten data can be removed. After the approximation, they propose a proper alignment to match changed representations to their original representations via contrastive learning. Empirically, they demonstrate the effectiveness of their unsupervised framework and outperform other supervised methods, which opens a potential new research direction in machine unlearning.", "questions": "* In the implementation, the authors optimized the extractor unlearning loss and representation alignment loss ***alternately***. Does alternately update parameter works better than two-stage learning (saying optimize the extractor unlearning loss with the full epochs then optimize representation alignment loss)?\n* (minor comment) Dot labels in Figure 1 can be replaced with their exact labels for better understanding.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "* Originality: This paper proposes a novel approach to unlearn without the need of labels and retraining process. They first capture the distribution of training data and forgotten data then unlearn forgotten data at the representation level. Then, through alignment with contrastive learning, they recover the shift for remaining data back to original model. These two steps, remove then recover, are original and novel, especially compared to other supervised approaches.\n* Quality:  Though its low efficiency compared to other supervised methods, the results in the experiments showcase its effectiveness. Besides, they consider the scenarios that when a certain amount of supervised information is available, how helpful they would be to repair unlearning model. These shows its quality and the completeness of the paper. \n* Clarity: The presentation of this paper is clear and well-organized.\n* Significance: Machine unlearning gains more emphasis due to increasing focus on data privacy. This paper proposes a new approach to solve it effectively. Additionally, it’s important to the field to do machine unlearning without using any labels and the need of retraining.", "weaknesses": "* The first weakness of this framework is its efficiency. To capture data distribution, a certain amount of instance $x$ and two distribution modeling are needed. Though the framework doesn't need retraining process, framework efficiency and computational workload are encouraged to study and present in the paper. \n* The quality of representation extractor may affect framework performance. More representation extractors are needed to be considered to enhance the soundness of this method.\n* The availability to access $x$ in training data under machine unlearning scenarios lacks of description. Is this practical in the real-world scenarios?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Nkp88xiNNe", "reviewer": "Reviewer_1kCq", "summary": "This paper introduces a unique approach to the unlearning problem, addressing a scenario where labels may be available during training but inaccessible in the unlearning phase. This novel perspective enhances privacy protection during unlearning. The paper proposes a supervision-free unlearning method, utilizing a variational technique to model task-relevant representations' distribution. This enables effective information removal from the model. Additionally, a contrastive loss aids in model restoration, mitigating the influence of forgetting data and ensuring performance on the remaining data. The proposed method is rigorously evaluated across various tasks, demonstrating its efficacy in data forgetting, category forgetting, and denoising for noisy data.", "questions": "1.\tThe paper assumes that training data, forgetting data, and remaining data are sampled from different distributions. Could the authors provide an illustrative example or rationale for this particular setup to justify its validity?\n\n2.\tIn comparison to existing methods, it would be valuable to have an assessment of the time and storage efficiency of the proposed method. Understanding these efficiency metrics would provide additional context for evaluating the method's practicality.\n\n3.\tCould the intuitive interpretation of Equation 2 be expounded upon? Further elaboration on the meaning and implications of this equation would aid in enhancing the comprehension.\n\n4.\tThe proposed method involves two approximations, one pertaining to Equation 4 where \"h()\" operates on all training data rather than just D_r, and the other involving Equation 8 which removes the second part. Could the authors elaborate on how these approximations may potentially impact the final output and results of the method?\n\n5.\tIt's noted that both Equation 4 and Equation 6 are presented in the paper. However, it's not entirely clear how these equations are utilized in the proposed method, or alternatively, why they are not used. The paper primarily relies on Equation 5 and Equation 7, which are eventually combined into Equation 8. Additional clarification on the role and application of Equations 4 and 6 would be beneficial for a comprehensive understanding of the method.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "This paper introduces a novel perspective on the unlearning problem by addressing a scenario where labels may be available during training but become inaccessible during the unlearning phase. This specific problem formulation is different from traditional approaches, which assume continuous access to labelled data throughout the unlearning process. This unique scenario could be a crucial addition to current unlearning, as it reflects real-world situations where label information may be sensitive, noisy, or entirely unavailable during the unlearning phase. This novel formulation expands the scope of unlearning research and adds a crucial dimension to privacy-preserving machine learning techniques. \n\nThe paper also offers a potential impact for forgetting in deep models, emphasizing the importance of forgetting representations rather than just the correspondence between representations and labels, aligning with deep learning's characteristic of shared representation information between forgotten and retained data. \n\nThe proposed supervision-free unlearning method, leveraging variational techniques to model task-relevant representations' distribution, is a novel contribution. This approach allows for effective information removal from the model and employs a contrastive loss to ensure model restoration, successfully mitigating the influence of forgetting data and maintaining performance on the remaining data. The strength also lies in its comprehensive experimental validation across various tasks, including data forgetting, category forgetting, and denoising for noisy data. This extensive evaluation demonstrates the efficacy of the proposed method. \n\nRegarding clarity, the paper is generally well-written and structured. The problem motivation and formulation are articulated in a clear and organized manner. There could be some improvement though (see weakness and questions for details)", "weaknesses": "The explanation of the contrastive loss component, particularly the utilization of the \"sim loss,\" lacks comprehensive coverage, leaving room for confusion regarding which sim loss should be used and why use it.\n\nWhile the paper is generally well-structured and articulated, there are instances where certain statements could benefit from further elucidation for improved clarity. Specific details are highlighted in the \"Questions\" section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yks2DpZHkw", "reviewer": "Reviewer_iDSm", "summary": "In the context of growing data privacy concerns, various methods for machine unlearning have arisen. However, these methods usually require constant supervision, which can be impractical due to the high cost of labeling real-world datasets. To overcome this challenge, this propose a supervision-free unlearning approach that doesn't rely on labels during the unlearning process. To achieve this, a variational method to approximate the representation distribution of the remaining data is done. Using this approximation, the modified model is able to remove information from the forgotten data at the representation level. To mitigate the lack of supervision, which affects alignment with ground truth, a contrastive loss is to ensure the matching of representations between the remaining data and the original model, thus maintaining predictive performance.", "questions": "1. In equation 4 the term that is minimized how does it fit a VAE framework. In VAE we maximize the ELBO. Now If we take the KL term in Eq.-4 to be the Corresponding KL term in ELBO how does the first term correspond to the first term in ELBO? A detailed explanation will be better because in VAE we want to maximize the log-likelihood of data and then formulate an ELBO term. In this case, a detailed derivation with proper assumption will help to see how it is a VAE. What do we want to maximize here?\n2. If my understanding is correct you drop the terms of KL in the final minimization. So it is simply an encoder without the decoder(as it is generally posed in the VAE framework). Is the formulation as VAE necessary?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 1, "presentation": 2, "contribution": 2, "strengths": "1. Quite a relevant problem in real-world applications.\n2. Does not require information about the labels.\n3. Experiments are extensive. The method shows good performance in the absence of data labels.", "weaknesses": "1. No proper explanation in the optimization process. Why some terms are dropped and even if they are considered what could have happened?\n2. I think there is a typo in equation 1. The distribution should be P_r instead of P. Similarly for D. Please change the typo. If not please provide an explanation. A lot of notational errors are there such as from argmin equation.8 suddenly becomes argmax in equation.9. \n3. There is also a zero-shot method of unlearning which does not assume access to the data at all. This raises questions about the experiment settings. Here you need to have access to the retain and forget set to model with VAE. Is not this assumption too much as in many real-world applications the training dataset remains hidden? So in zero-shot settings, as no data is needed unlearning methods don't assume access to the labels.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0rHjaFfwgw", "reviewer": "Reviewer_4NxB", "summary": "This paper focuses on machine unlearning without the supervision of ground-truth labels during the forgetting process. They introduce a variational approach to approximate the distribution of representations for the remaining data. Leveraging this approximation, they adapt the original model to eliminate information from the forgotten data at the representation level. Experimental results across various forgetting tasks demonstrate the effectiveness of the proposed method.", "questions": "no", "limitations": "", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1.\tThis is the first paper that solves the issue of machine unlearning without labels, which is of great importance. \n2.\tThe experiments are sufficient.", "weaknesses": "1.\tThe technical part is hard to follow. Adding some illustrated figures would be better.\n2.\tI have a concern about the objective (2). In my opinion, data forgetting is not to maximize the distribution discrepancy to forgotten data. The relationship may be more complex.\n3.\tThe VAE seems redundant. It is utilized to output the features on the given dataset. However, the original model can be directly used instead of training an extra model. In fact, (4) and (6) just mimic the features of the original model. So, the VAE can be viewed as an equivalent version of the original model.\n4.\tSeveral typos, e.g., jointly using $g_u^e$ and $g_U^e$. P in (1) should be P_r.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)