Privacy-Aware Lifelong Learning
Authors: Ozan Ozdenizci
Elmar Rueckert
Robert Legenstein
Venue: ICLR 2025 Poster (2025)
Keywords: lifelong learning
exact machine unlearning
task-incremental continual learning
sparse subnetworks
knowledge transfer
Primary area: transfer learning, meta learning, and lifelong learning

Abstract: Lifelong learning algorithms enable models to incrementally acquire new knowledge without forgetting previously learned information. Contrarily, the field of machine unlearning focuses on explicitly forgetting certain previous knowledge from pretrained models when requested, in order to comply with data privacy regulations on the right-to-be-forgotten. Enabling efficient lifelong learning with the capability to selectively unlearn sensitive information from models presents a critical and largely unaddressed challenge with contradicting objectives. We address this problem from the perspective of simultaneously preventing catastrophic forgetting and allowing forward knowledge transfer during task-incremental learning, while ensuring exact task unlearning and minimizing memory requirements, based on a single neural network model to be adapted. Our proposed solution, privacy-aware lifelong learning (PALL), involves optimization of task-specific sparse subnetworks with parameter sharing within a single architecture. We additionally utilize an episodic memory rehearsal mechanism to facilitate exact unlearning without performance degradations. We empirically demonstrate the scalability of PALL across various architectures in image classification, and provide a state-of-the-art solution that uniquely integrates lifelong learning and privacy-aware unlearning mechanisms for responsible AI applications.

Published as a conference paper at ICLR 2025
PRIVACY-AWARE LIFELONG LEARNING
Ozan Özdenizei*, Elmar Rueckert', Robert Legenstein 2
Chair of SyberrPhysical-Systeme Montanuniversität Leoben, Austria
2 Institute of Machine Learning and Neural Computation, Graz University of Technology, Austria fozan. www.eeedeezzeeoo aennizci,, elmar. www.aar.eeeeereeeeeeeeeeeeee.eee /eweecceer/euieeeeetee /eeeennnebeennn ac.at. robert. legenstein@tugraz.
ABSTRACT
Lifelong learning algorithms enable models to incrementally acquire new knowl- edge without forgetting previously learned information. Contrarily, the field machine unlearning focuses explicitly forgetting certain previous knowledge from pretrained models when requested, in order to comply with data privacy reg- ulations the hight-to-be-forollle Enabling efficient lifelong learning with the capability to selectively unlearn sensitive information from models presents a crit- ical and largely unaddressed challenge with contradicting objectives. We address this problem from the perspective of simultaneously preventing catastrophic for- getting and allowing forward knowledge transfer during mesk-incremental learn- ing, while ensuring exact task unlearning and minimizing memory requirements, based on single neural network model be adapted. Our proposed solution, privacy-aware lifelong learning (PALL), involves optimization of task-specific sparse subnetworks with parameter sharing within a single architecture. We ad- ditionally utilize episodic memory rehearsal mechanism to facilitate exact un- learning without performance degradations. We empirically demonstrate the scal- ability of PALL across various architectures in image classification, and provide a state-of-the-art solution that uniquely integrates lifelong learning and privacy- aware unlearning mechanisms for responsible AI applications.
INTRODUCTION
Lifelong learning algorithms enhance the ability of machine learning models incrementally ac- quire new skills or integrate new knowledge over time from sequentially observed data (van de Ven et al., 2022). This continual learning capability is essential for models to stay relevant in dynamic environments where the observed data distributions change. A widely studied challenge in this setting is to mitigate catastrophic forgetring, addressing the loss of prior knowledge as new tasks are learned. There has been various strategies proposed to prevent forgetting, while exploiting for- ward knowledge transfer to efficiently improve performance in new tasks. However, these lifelong learning approaches conventionally do not consider the factor of ensuring data privacy, whereas selectively forgetting (or unlearning) certain knowledge may be required to comply with the legal regulations on the to-be-forgotten (Mantelero, 2013) (c.g.. deleting prior information from per- sonalized recommendation systems). This introduces an additional dimension of complexity, which requires novel lifelong learning solutions that can ensure unlearning for
awareness.
The field of machine unlearning focuses on explicitly removing the influence of specific data points from pretrained models (Cao & Yang, 2015). Ensuring exact unlearning, where the model is guar- anteed to behave as if the unlearned data was never observed, presents significant challenge that generally requires partial model retraining (Bourtoule al., 2021). In particular, current unlearning solutions assume previous or all data to be available to facilitate exact unlearning, which does not apply to lifelong learning settings where the data is only sequentially observed. Accordingly, recent works have started to explore solutions at the intersection of task inkeinncreeetll lifelong learning and machine unlearning (Shibata et al., 2021; Liu et al., 2022; Chatterjee et al., 2024), primarily via inexact unlearning methods which does not guarantee privacy for all previously learned tasks.
We consider a similar lifelong learning problem, where the learning sequence may include exact task unlearning requests for any of the previously learned tasks, with no access to prior data. A

---

Published as a conference paper at ICLR 2025
naive solution in this particular setting is to train independent models for each task, and discard the models corresponding to the tasks to be exactly unleamndd upon request (Liu et al., 2022). However, this is inefficient since it does not enable knowledge transfer from prior tasks, and becomes mem- ory demanding as the number of tasks increase. From a novel perspective, we present an efficient solution to this multicimensional problem by using fixed-capacity neural network architecture.
We propose privacy-aware lifelong learning (PALL) as a novel framework that completely alleviates catastrophic forgetting, facilitates selective knowledge transfer from previously learned tasks, en- sures exact task unlearning guarantees when requested, and provides a state-of-the-art solution to lifelong learning and unlearning with minimal model memory requirements. Our approach is based on jointly optimizing task-specifi sparse subnetwork connectivity structures and their param- eters within single fxed-capacity model, and isolating this knowledge by freezing its parameters to prevent catastrophic forgetting. We facilitate learnable knowledge transfer through shared param- eters by allowing this optimization process to also leverage connections with frozen weights from previous tasks, if preferred. We perform exact unlearning by resetting the subnetwork parameters that are optimized on the task to be unlearned, and use an episodic memory rehearsal mechanism to recover any performance degradation in the other tasks that may occur due to reinitialization of shared parameters which are unlearned. Our contributions are summarized as follows:
We formulate a muskiincrementa learning and unlearning problem with strong privacy con- siderations, where exact unlearning is possible for all tasks during their lifetime.
We present privacy-aware lifelong learning (PALL) as a memory lution to this problem, which enables learning without catastrophic forgetting, allows learn- able forward knowledge transfer, and ensures exact unlearning guarantees by design.
algorithmic so-
We empirically demonstrate scalability of PALL on both convolutional benchmark archi- tectures and attention- vision transformers, yielding a stable performance in highly dynamic lifelong learning scenarios with randomly arriving unlearning requests.
2 RELATED WORK
2.1 LIFELONG LEARNING
Lifelong learning, or continual learning, explores the ability of machine learning models to adapt and learn continuously from sequentially observed stream of data (De Lange et al., 2021; van de Ven et al., 2022; 2024). The central challenge is to address the problem of catastrophic which is widely studied phenomenon caused by traditional learning algorithms resulting in loss of previously acquired knowledge as new tasks are learned. Approaches to lifelong lcarning are also ideally expected to allow forward knowledge transfer, by leveraging information from previous tasks to enhance performance on new ones (Kudithipudi et al., 2022). Different lifelong learning scenarios are categorized as task-, class- or -nnrrmmena learning, which vary in terms of the target variable spaces. We focus on the task-incremental learning setting, which maintains separate label spaces for each task and assumes that the task is known by the agent. Existing approaches can be broadly divided into regularization-be based, rehearsal based, and architecture-based methods.
forggettiin forgetting.
Regularization-bart based methods, such as elastic weight consolidation (EWC) (Kirkpatrick et al., 2017), lcarning without forgetting (LwF) (Li & Hoiem, 2017), synaptic intelligence (Zenke et al., 2017), and memory-aware synapses (Aljundi et al., 2018), aim ensure that the network retains previously acquired knowledge while learning new ones by penalizing the updates to the parameters that are crucial for previously learned tasks in different ways.
Rehearsal-based methods, such as experience replay (Rolnick et al., 2019; Chaudhry et al., 2019) and generative modeling based rehearsal (Shin al., 2017), store episodic training set exemplars in buffer use auxiliary generative models to synthesize and replay past data during training. These methods also extended to utilize gradient episodic memory (GEM) (Lopez-Pat Paz & Ranzato, 2017), or combine replay with knowledge distillation to maintain balanced data representations (Rebuffi et al., 2017). Recently, dark experience replay (DER++) (Buzzega et al., 2020) proposed to regularize training with logit penalties to stabilize learning with respect to samples from the buffer.
Architecture-based methods exploit context-specifi model components and reconfigure the neu- ral network backbone structure. Progressive neural networks (Rusu et al., 2016) and dynamically
2

---

Published as a conference paper at ICLR 2025
expandable neural networks (Yoon et al., 2017) adjust the model by expanding the network layers to add new capacities for new tasks when needed. To completely eliminate forgetting, the expert gate method duplicates the model for each new task and uses an input gating mechanism use the rele- vant expert at test-time (Aljundi et al., 2017). Considering limited model memory budget settings, another line of work proposes to distinguished sets of parameters via task-speeific subnetworks within a fixed model, which are kept frozen to alleviate forgetting. PackNet (Mallya & Lazebnik, 2018) and CLNP (Golkar et al., 2019) use magnitude- works, by reusing all weights from previous tasks for knowledge transfer. Recently, methods that partially reuse the weights from previous subnetworks were developed to allow selective knowledge transfer. Specifically, Dekhovich et al. (2023) used heuristic weight importance scores for pruning based on neuron activations, and winning subnetworks (WSN) (Kang et al., 2022) employ the idea of trainable importance scores to obtain task-specific subnetworks with selective weight sharing.
pruning to obtain these sparse subnet-
2.2 MACHINE UNLEARNING
Machine unlearning is the process of removing the influence of specific data points from model (Cao & Yang, 2015; Ginart et al., 2019), in order to re-establish privacy following a user's request for certain data samples, c.g., her/his own, to be deleted from the training set of the model, to comply with legal regulations on the toel--to-bb-forottten (Mantelero, 2013). Besides updating the training set, unlearning methods modify the pretrained model to remove any influence of these samples, such that complete retraining is not needed to prevent membership inference attacks (Shokri et al., 2017).
Exacf unlearning methods aim to completely remove the influence of targeted data, ensuring the model behaves as if the data was never observed. Beyond certified data removal from smaller scale linear models (Guo et al., 2020), exact unlearning from neural networks generally requires compute- efficient model retraining methods. The state-of-the-art approach SISA (Bourtoule et al., 2021) partitions the training set into disjoint shards and trains separate models on each shard, such that unlearning only requires retraining on affected shards. This idea later extended to exploit data dependency structures across shards for efficiency (Dukler et al., 2023). Other examples include leveraging ensemble learning of multiple one-class tasks to reduce retraining costs (Yan et al., 2022), or minimizing parameters of the architecture for faster retraining (Yu et al., 2022).
Approximate unlearning methods manipulate model parameters using gradient based information to perform more efficient (but inexact) unlearning with faster retraining (Wu et al., 2020; Golatkar al., 2020; Sekhari al., 2021; Graves et al., 2021; Neel et al., 2021). However, such inexact solutions have been shown to require rigorous evaluations due to potentially misleading interpreta- tions (Goel et al., 2022: Hayes et al., 2024), and involve further privacy and fairness implications for the other samples in the datasets (Chen et al., 2021; Zhang et al., 2023). Notably, approximate unlearning methods also do not generalize in a setting with adaptive requests (Gupta et al., 2021), I), which refers to the scenario where unlearning requests arrive sequentially rather than all at once.
2.3 SELECTIVE FORGETTING IN LIFELONG LEARNING
Unlearning in lifelong learning settings has been recently explored in the context of beneficial ting (Wang et al., 2023), as opposed to the problem of catastrophic forgetting that continual learning generally focuses on. One of the earliest methods, learning with selective forgetting (LSF) (Shibata et al., 2021), modifies models to make incorrect predictions on the unlearned data, by using auxil- iary mnemonic codes manipulate the input space. However, this only yields inexact unlearning. since poor model performance does not ensure privacy. Other works have similarly explored inex- act unlearning methods. both for task -ikkinccreeetal learning using knowledge deposit modules (Ye et al., 2022) or student-teacher knowledge distillation mechanisms (Chatterjee et al., 2024), as well as ilas-inncrementll learning with data representation based approaches (7uo et al., 2024).
Exact unlearning via dataset sharding and retraining (Bourtoule et al., 2021) is not applicable to lifelong learning, since there is no access to previous datasets. Recently, the continual learning and private unlearning (CLPU) framework (Liu et al., 2022) explored related problem with another baseline approach. Specifically, CLPU defines insc-incremental learning with instructions to tem- porarily or permanently learn the given tasks, and ensures exact unlearning temporarily learned tasks by training independent models which are deleted upon request. In an worn-world scenario with privacy guarantees on any continually learned task, this solution becomes memory inefficient.
3

---

Published as a conference paper at ICLR 2025
3 PRIVACY-AWARE LIFELONG LEARNING (PALL)
3.1 PRELIMINARIES
Lifelong Learning: Consider a sequence of task IDs t where I' [. in a supervised task-incremental learning scenario with training datasets D' {(xt, vf) vf.,,.................. (2r vn)), and test (e }. where æ E X and y E yd denote the raw data and labels. The learner trains neural network model fe with parameters 0 Rd, by applying learning algorithm L on D' to sequentially optimize O¹ ~ L((''! D'), often based on a cross- entropy loss (x, y; f), and estimates a probability distribution over ) via softmax (x²)).
datasets D {(21 retstt vi )...., (x (e "yx
In lifelong learning, the learner loses access to D= = (D',...,,''' DD-1) when learning task t. More- over, for fixed model capacity, 8 depends on 0J for all r < t. This necessitates tailored learning algorithms alleviate catastrophic forgetting, such that performance on Diss can be maintained, while ideally foriivinnforwar knowledge transfer by leveraging information from prior tasks.
We consider a scenario where the learner is expected to unlearn part of the previously observed training datasets, i.e., a forget set, due to privacy related concerns. We define the forget set to be the whole training dataset D' corresponding a previously learned task r. ! For learning algorithm L applied DSc. and previously observed task dataset DDT to be unlearned, an exact task unlearming mechanism 4/ uses 0 as a reference and returns a model such that:
Exact Task Unlearning:
(1) where =p indicates that the models share the same probability distribution. Specifically, if the unlearned model possesses no information about D=, an adversary cannot differentiate this model from a model trained on DSt D from scratch based on L, thus U achieves exact unlearning. In lifelong learning, this constitutes a challenging problem since there is no access to previous datasets.
u (@ ~ L ((0).D)).7] r = L DS' \D))
3.2 PROBLEM STATEMENT
We formulate generalized lifelong learning problem with privacy considerations, by extending the traditional mnsk-incremental learning setup to allow exact task unlearning instructions. We consider that the learner receives sequence of requests R1r,, consisting of T' task learning and N,, task unlearning instructions which are provided in a logically consistent order (i.e., a task can only be un- learned after it has been learned). We assume that all tasks are to be learned once without repetition. The i-th request R, in the sequence R1. is defined as follows:
{
{
R. = (t, LL) if task learning. if task unlearning.
R = RR1, R2, Ryl, such that
(2)
R2 = (t,(t,U)
where L and U are flag variables to indicate if the instruction corresponds to a learning or unlearning request. Furthermore, the learner keeps dictionary Ω. of the currently learned task IDs that were not unlearned: 24 + Q:-1 U {t} if learning task 6, and 22 < Ω \ {1} if unlearning task t.
The learner's goal is solve this problem by defining learning algorithm L. and an unlearning algorithm U1 to be applied sequentially based on R, to optimize the model parameters to achieve:
C ((0 s.t. min
Ean (2, 0)
if R. (1, L),
0¹
EE
(3)
u (0 s.t. u (00-0-10- .1) = L (irER.))
if R, = (1. U).
A holistic solution to this problem would mitigate catastrophic forgetting as new tasks are learned, allow forward knowledge transfer for efficient learning, ensure privacy-awareness with exact unlearning guarantees, and minimize memory requirements of the algorithm. Our formulation differs from the CLPU (Liu et al., 2022) setting by generalizing the problem in terms of its privacy constraints such that any task can always be exactly unlearned (i.e., all tasks are temporarily learned).
Differently from traditional machine unlearning studies that generally define the forget set to be subset of training samples certain class in the training dataset, we focus whole task unlearning scenarios.
4

---

Published as a conference paper at ICLR 2025
Learn Task 1 R1 = (1, L)) "cat" or "dog"
Learn Task 2 R2 = (1, L)) "horse" or "deer"
Learn Task 3 Rs = (3, D .L) "bird" or "rabbit"
Unlearn Task R4 (1, U)
Illustration of PALL. Task-specific subnetworks obtained after learning indicated by color. The subnetwork mask m2 for Task 2 contains two shared, frozen parameters from Task (dashed blue lines), well as m2 (green connections). Following the unlearning request for Task 1, reset all parameters trained on D (blue connections), and retrain any of those parameters which were used for knowledge transfer in later tasks (shown by red connections) using experience replay.
Figure 1:
3.3 EFFICIENT LIFELONG LEARNING WITH EXACT TASK UNLEARNING
Existing lifelong learning methods are not designed for exact task unlearning capabilities. Recent studies have only explored inexact unlearning methods in this context (Shibata et al., 2021; Chat- terjee et al., 2024). naive solution to satisfy Eq. (3) would be to train independent models for each task, where one can ensure exact unlearning by deleting the task-specific model upon request." However, this approach becomes infeasible under limited memory as the number tasks increases.
We propose privacy-awan lifelong learning (PALL) memory- -effory-efficient hybrid solution that utilizes an architecture-bait lifelong learning approach, combined with an episodic memory re- hearsal mechanism. We optimize sask-specific subnetworks within single architecture with limited model memory, where the associated parameters are kept frozen to eliminate catastrophic forgettiiirrrrgtgingg forgetting. During task-specific subnetwork optimization, allow learnable knowledge transfer to future tasks by selectively reusing parameters from previous task subnetworks (Kang et al., 2022). We ensure exact task unlearning by resetting the associated task subnetwork upon request, and use experience replay to mitigate potential performance degradations in the other tasks that may occur due to the reinitialization shared parameters. PALL is illustrated in Figure and described detail below.
Given a task learning request R, = (t, D', L), our goal is to optimize sparse subset of the current parameters @i-1, and binary subnetwork mask E (0. 1)d, which will be used for inference on task We perform this by jointly optimizing the parameters that are unused previous tasks, and task-specific importance scores St, which quantifies the significance of each parameter:
min E w Llee (æ, yj 0 ms:))))
(4)
We compute m, each iteration using the current largest |s,] values per layer basis, based connectivity rate a (e.g., a = 0.1 indicates 90% sparsity) (Ramanujan et al., 2020). Since we do not want to change the parameters trained previous tasks, perform masking of parameter updates:
0 0 -1 dce
(1-M-I1).
@llcc
S; S St-1)
(5)
3s
where M,-1 = V JEn, m, denotes the cumulative binary mask which identifies combined set of used and frozen subnetwork parameters until the i-th request. The scores s, are optimized via ttroigh estimator the binarizing mask (s.) during backpropagation.
This objective allows learnable forward knowledge transfer by optimizing for all parameters of the model without masking, such that m, for different tasks can be overlapping to share parame-
"This is identical to the recently proposed CL.P solution (Liu al., 2022) in our experimental setting that requires unlearning guarantees for any continually learned task.
5

---

Published as a conference paper at ICLR 2025
ters. We indicate the parameter indices which are specifically trained using data from D' with the submask M and m, m, correspond to the shared, frozen parameter indices from previous tasks. After task learning, we discard s, and store the final m, in dictionary of binary subnetwork masks M; = my j E 22). Due to the parameter masking strategy used during training, we can always use the corresponding m, to make consistent predictions on Dicu without catastrophic forgetting.
Importantly, we update M; < M V m, and reset all unused parameters ④ (1 M;) by sam- pling from the weight initialization distribution <(.) after training. This ensures that no information from D' leaks into the remaining unused parameters outside the ones identified by m,, and helps to ensure future unlearning guarantees. Lastly, we store a set of randomly sampled exemplars and logits
episodic memory buffer B {(r Mjj 2j = fo R m, (æx)) (æ My D³) D'ssssss We do not use this buffer for task learning, but will use these samples upon unlearning requests.
Given a task unlearning request R, = (t, U), our goal is to update the model parameters 0 such that the new model does not possess any information about D', i.e., none of its parameters have been optimized with the data observed from task t. We can facilitate this exactly by resetting the m. by sampling new values from the initialization distribution o(.).
parameters 0*
If the unlearning request R, (1, U) refers to the latest task that was learned in Ri-1 = (1, D', L). we can simply rewind this learning instruction by resetting 0i ( m,- However, if the unlearning request refers to an earlier task which was followed by other task learning requests T > t and T Ω2 then purely resetting 0-11 @ m. will lead to a performance degradation for tasks т, if m, overlapping with m, to share parameters from task (red connections in Figure 1). To address this conffict between knowledge transfer and exact unlearning, we use memory buffer rehearsal and perform short retraining step such affected parameters following the objective:
min
Σ (..g.2)~8-
lee (x. yi 0 2 B
Σ (wo '')-B""
llfo m. (x') - 2'112 -01--1113 (6)
|
TEB
where 0 denotes the affected subset of parameters within that were reset, which are indicated by Vr>t.rn,, (m, A m.). Eq. (6) is generalized formulation used in various rehearsal based lifelong learning methods, where 3 = 0 would yield vanilla experience replay (Chaudhry et al., 2019) and = 0.5 yields DER++ (Buzzega et al., 2020). We perform N, retraining iterations for Eq. (6). Finally, we delete B² and m,, and re-compute M; Viea, my. Our algorithm is in Appendix A.2.
EXPERIMENTAL SETUP
4.1 DATASETS AND MODELS
We performed experiments with sequential CIFARIO (S-CIFARIO: tasks x 2 classes), CIFARI00 (S- S--CIFARIOD 100: 10 tasks x 10 classes) and TinylmageNet (S- Net: 20 tasks 10 classes, 40 tasks x 5 classes, or 100 tasks x 2 classes) datasets. We used ResNet- 18 and ResNet-34 models in S-CIFAR 10/100 experiments which are commonly used as benchmarks lifelong learning, and attention-based ViT-T/8 architectures with S- S-TinylmageNet (see Appendix A. for details).
We designed lifelong learning scenarios with T task learning instructions, and N,, randomly chosen task unlearning instructions, which are arranged in logically consistent manner, e.g., user request sequence on S-CIFAR10 with N, = 3 can be: R1s = [1, L), (2, D2, L), (3, D L), (2, U), (4, DA L). (3, U). (5, D., L), (1, U)]. Experiments are repeated using 20 random seeds (unless stated otherwise) for a given N,, which results in randomly changing the allocation of the classes into different tasks, as well as the unlearning instructions and their order within R..--
4.2 MODEL TRAINING AND EVALUATIONS
We compare our results against state-of-the-ee lifelong learning baselines: se- quential learning by directly finetuning the model each new task (Sequential), elastic weight consolidation (EWC) (Kirkpatrick et al., 2017), learning without forgetting (LwF) (Li & Hoiem, 2017), learning with selective forgetting (LSF) (Shibata et al., 2021), gradient episodic memory
Baseline Methods:

---

Published as a conference paper at ICLR 2025
(GEM) (Lopez-Paz & Ranzato, 2017), experience replay (ER) (Chaudhry al., 2019), dark expe- rience replay (DER++) (Buzzega et al., 2020), PackNet (Mallya & Lazebnik, 2018), winning sub- networks (WSN) (Kang et al., 2022), and task-specific independent model training (Independent) which is equivalent to the naive solution by CLPU (Liu et al., 2022) in our problem setting.
These baseline approaches, except for LSF (Shibata et al., 2021) and Independent (Liu al., 2022), are not originally designed with task unlearning capabiliites. Thus, we adapt these methods to the current problem. Particularly for GEM, ER and DER++, for task unlearning, we perform finetuning for Ny iterations on the remaining episodic memories and predict uniform distributions using the unlearned task's s episodic memories accelerate forgetting, prior to removing the corresponding episodic memory of the unlearned task. For Sequential, EWC, LwF, PackNet and WSN, we do not perform any changes to the model parameters for task unlearning. We only discard the algorithm- specific stored variables associated with the task to be unlearned, e.g., the subnetwork masks in PackNet and WSN (see "Unlearning Implementations" under Appendix A.2 for further details).
Training Configurations: We use stochastic gradient descent (SGD) optimizer with momentum for 20 epochs per S-CIFAR 10/100 task learning instruction, with batch size of 32, learning rate of 0.01, and weight decay with parameter 0.0005. For S-TinylmageNet, we use Adam optimizer for 100 epochs with a batch size of 256, and cosine annealing learning rate scheduler with an initial value of 0.001. Here, we do not weight decay but instead apply dropout to intermediate activa- tions of ViT-T/8 with p = 0.1 (Steiner et al., 2022). All methods requiring a memory buffer had a total capacity of 500 and 1000 samples (evenly split across tasks) in S-CIFAR and $ S-TinylmageNet experiments, respectively. Unless otherwise specified, for Eq. (6) we use N₂ 50 and 3 = 0.5 (see Appendix A.2 for further details). Our code available at: https://github.cc http:://hgthibbmmm///we//////// com/ooozeeeeiiii//LLL....
We evaluate average test set accuracies for the remaining learned tasks after processing Rir, i.e., tasks in the set Q,,, and the average test set accuracies for the unlearned tasks after processing Rir, i.., tasks in the set I S2,, denoted as A and Ay, as follows:
Evaluation Metries:
A
1
Σ Gr,t: tEO,
Au
1
Σ Gr,t,
10
No tErVO,
where 0g,, denotes the accuracy Di after request i was completed. We expect better privacy- aware lifelong learning methods to have higher A,, and chance-level AA, by performing random classification on unlearned tasks. However, is important note that lower A., does not necessar- ily correspond to an exact unlearning guarantee. We include Au only to evaluate inexact unlearning baselines through a weak measure. We leave detailed investigation of inexact unlearning methods with better metrics, c.g., via empirical privacy auditing (Steinke et al., 2024), for future work.
We evaluate the forgetting impact of task learning and unlearning requests, similar to the notion of backward knowledge transfer in standard continual learning. Specifically, we define Fi and F. by evaluating the average decrease in the test set performance for previously learned tasks, after processing a task learning or unlearning request, which are formally defined as:
F E
Σ (ED.
(0:-1.1 1.1 a..1)
Σ
Σ
(a--1. a..))
(8)
12
N
[2
KE(2
(E(2.....))
IEO.
R.=(-L)
R,=(-,U)
We expect better privacy-aware lifelong learning methods to have lower Fi and F,, such that there is no degrading backward transfer impact of learning or unlearning requests.
5 EXPERIMENTAL RESULTS
5.1 COMPARISONS TO STATE-OF-THE-AN IN LIFELONG LEARNING
In Table we evaluate our approach against state-of-the-ar methods in lifelong learning, by extend- ing various methods to the experimental setting of task incremental learning and unlearning. We consider independent model training for each task as an upper bound baseline with exact unleam- ing, which however requires model size that linearly scales with the number of tasks for inference. Our method, PALL, provides a novel, ofate-of-the-us solution in a privacy-aware continual learning and unlearning setting, considering all four metrics together with model memory requirements.
7

---

Published as a conference paper at ICLR 2025
Table 1: Evaluations across different datasets and models. In this experimental setting, using inde- pendent models (bottom row) is identical to CLPU (Liu et al., 2022). Methods with exact unlearning perform random classification on unlearned tasks (Au)) Results are averaged over 20 random seeds, where the sequence of requests are randomly generated with N,, = 3 unlearning instructions (see Appendix A.3.5 for worst-case results across seeds). a: task-specific subnetwork connectivity rate.
S-CIFARIO (T = 5)
S-CIFARIO0 (T = 10)
S-TinyImageNed (T' 20)
Model Size
A
A, 4
J,4
J.
A
A, 4
Jiv
J.
A
A,
F
J. 4
(Inference)
Sequential
70.71
72.65
13.86
0.0
35.35
40.07
13.43
0.0
19:41
21.42
7.65
0.0
EWC
74.27
73.28
12.02
0.0
56.01
52.04
7.03
0.0
54.74
53.63
0.49
0.0
LwF
91.65
86.99
1.54
0.0
38.83
63.94
4,41
0.0
43.88
49.53
2.10
0.0
LSF
89.25
80.25
0.36
1.26
56.59
52.88
1.67
4.93
43.40
44.88
0.94
4,60
GEM
87.70
54.14
4.10
1.28
57.44
42.80
6.50
3.76
42.62
29.32
4.32
1.11
ER
87,88
58.48
3.45
1.61
57.63
42.69
4.67
7.91
42.30
28.02
4,44
0.64
DER++
92.04
53.50
1.62
0.66
66.84
46.56
4.52
0.95
46.50
34.65
3.78
0.43
PackNet WSN
94.77
75.76
0.0
0.0
75.01
58.19
0.0
0.0
60.50
50.72
0.0
0.0
94.15
74.76
0.0
0.0
73.64
51.52
0.0
0.0
63.67
15.16
0.0
0.0
PALL
94.01
Exact
0.0
0.30
70.60
Exacr
0.0
0.51
62.14
Exact
0.0
0.64
d+ M,
PALL (a- 0.1)
94.50
Exact
0.0
0.24
72.35
Exact
0.0
0.40
61.36
Exact
0.0
0.72
PALL (a 0.2)
94.34
Exact
0.0
0.60
72.50
Exacl
0.0
1.10
Exacl
0.91
Independent
95.19
Exact
0.0
0.0
73.22
Evact
0.0
0.0
61.69
Exact
0.0
0.0
dx [9.]]
Regularization- based methods EWC and LwF, as well as sequential training, were indifferent to task unlearning instructions, since the original methods are not adapted to unlearning (i.e., A,, ~ A and Fu = 0.0). We observed LSF to strongly mitigate catastrophic forgetting (low Fi), but its use of mnemonic codes (Shibata al., 2021) for finetuning during unlearning was ineffective in our larger scale problems (i.e., above chance-level A..) Rehearsal based finetuning for unlearning with GEM, ER and DER++ resulted in better, lower Au metrics closer chance-levels. However, this is still an inexact unlearming approach, and all three methods still minimally suffer from catastrophic forget- ting (Fi > 0). Architecture-based methods PackNet and WSN mitigate catastrophic forgetting with frozen parameters (Fi 0), while only increasing the model size with M,, similar to PALL. Pack- Net and WSN also achieve Fa = O, since unlearning involves deletion of the corresponding mask without any change to the parameters. However, this makes unlearning inexact, since the parameters trained on the unlearned task remain. Generally, PackNet and WSN was found to perform well in task learning (AAi), since they are not affected by parameter resetting in unlearning (e.g.. PackNet: 75.01, WSN: 73.64, PALL (a = 0.2): 72.50, Independent: 73.22 on S-CIFAR100).
Our method satisfies exact unlearming (i.e., random classification A., on unlearned tasks), catas- trophic forgetting (F, = 0), and achieves Ar metrics very close to, or higher than training indepen- dent models with exact unlearning guarantees (e.g., Independent: 61.69, PALL (a 0.05): 62.14 on S-TinylmageNet). Moreover, rehearsal- based retraining of the reset parameters yields relatively low F,, (~-below 1%), which shows the efficiency of the designed unlearning process.
Henceforth, we consider a = 1/7 for PALL, which is determined by the experimental setting. If the number of tasks to be learned not known a priori and 1/T, PALL will still allow learning via knowledge transfer from frozen weights, until some tasks are unlearned to free trainable parameters.
Memory Requirements of PALL: Our method requires minimal memory overhead in the total model size for inference, by partitioning multiple tasks within a limited number of floating-poit parameters. To achieve this, PALL stores an additional binary mask dictionary M, which includes at most T masks to perform inference. This indicates d parameters (32-bits), and M, {m, hee, with d-dimensional boolean (1-bit) masks. Alternatively, training independent models for each task can reach to maximum of d x T parameters (32-bits), in scenario where all tasks are learned without unlearning. Therefore, between the two existing methods for lifelong learning with exact unlearning capabilities, PALL becomes the memory efffcccent choice.
Specifically, our default ResNet-18 18 with d = 11.2M parameters on S-CIFARIO, ResNet-34 with d = 21.3M on S-CIFAR 100, and ViT-T/8 models with d = 5.4M on S-TinylmageNet, represented in 32-bits had model sizes of 42.59 MB, 81.30 MB, and 20.63 MB, respectively. For PALL, as well as PackNet and WSN, the maximum model size that can be achieved where [Ω2 = T, yielded model sizes of 49.24 MB, 106.70 MB, and 34.41 MB, respectively, considering T additional binary masks for each layer. In the case of independent models, this scenario yields total model sizes of
8

---

Published as a conference paper at ICLR 2025
12
ER Indp
DER-+
157
Se
ER
LBP
DER--4
70
PALL
80
6
Indap
PALL
50
5-
40-
3
40
20
2-
Seg.
18P
10
Sig
1-
FR
Trdeep
PATL.
Todle
2
1
(Hunlearning req.)
N4 (#unlearing req.
N. (#unlearring req.)
(#unnearning reg.
(a) S-CIFARI00 (T = 10)
(b) S- S-TinylmageNet (7 20)
Figure 2: Evaluations with different number unlearning requests Ny in Rir (averaged across 10 random seeds each), for the methods that perform retraining or finetuning after task unlcarning. We excluded GEM since the performance was similar to ER. We use = 1/T for PALL
212.95 MB, 813.0 MB, and 412.6 MB, respectively, indicating that PALL provides approximately 4.3x, 7.6x and 12x more model size efficient solutions with exact unlearning.
Notably, to facilitate model updates, each method also involves additional storage requirements (e.g.. previous model weights EWC, mnemonic codes in LSF), Similarly, PALL additionally requires the memory buffers (8' hen, which is also common in all rehearsal-based learning methods. We further compare and discuss training times associated with each algorithm in Appendix A.3.4.
5.2 EMPIRICAL ANALYSIS THE TASK UNLEARNING MECHANISM
In Figure 2 we demonstrate the impact of N.. on the methods with retraining or finetuning instruc- tions during task unlearning. We specifically aim to assess the performance our algorithm in task-incremental lifelong learning scenarios with more frequent unlearning requests.
We observed that PALL yields a relatively stable performance close to the naive baseline of training independent models without memory-efficiency considerations (red vs. blue solid lines in Figure 2). Particularly for large N.. PALL shows less performance degradation with a parameter reset and retraining mechanism, than alternative inexact unlearning methods with finetuning: A₁ 1 Fu, on S-CIFAR 100 at N,, = 5: LSF: 50.3/5.2, +ER+ 67.7/1.1, PALL: 71.2/0.6, Indep.: 73.9/0.0, and on S-TinylmageNe at N, 9: LSF: 36.9 36.9/4.9, DER+ 44.8/0.6, PALL:: 59. 99.2/0.7, Indep.: 62. 1/0.0. We present additional experiments on the scalability of PALL in longer lifelong learning scenarios with S-TinylmageNet (I 100) and even larger N.. in Table A6 of Appendix A.3.3.
We investigate the impact of N, during rehearsal-based retraining of the reset parameters in Appendix 1.3.1. Mainly, our results show that simply resetting the affected parameters without retraining yields comparably worse performance (e.g.. Ai for S- CIFAR100 with N, 0: 70.24 N2 50: 72.35), indicating the necessity of retraining the reset weights through a memory buffer. We were also able to achieve hetter performance recovery after unlearning by using longer retraining durations (e.g., A for S-CIFAR10M with N,- = 100: 72.46).
Impact of Retraining After Unlearning:
We also present results on the ratio of retrained parameters during unlearning, and obtained param- eter values after retraining. We observed that only 4% of the parameters needed to retrained via Eq. (6), resulting in weights numerically different from those before unlearning.
Influence Episodic Memory Rehearsal: performed ablation experiments on our choices for
the episodic memory rehearsal method in Appendix A.3.2. In brief, observed that 3 0.5 is the preferable choice for retraining, as previously claimed by DER++ (Buzzega et al., 2020), and using larger memory buffer size generally increases performance (e.g., S-CIFAR 100. Ai 1 /Fa with buffer size 200: 71.90/0.77 buffer size 500: 72.35/0.40, buffer size 1000: 73.58/0.23).
We also investigate the influence of the random exemplar sampling method used to select the samples to be stored in the memory buffer in Appendix A.3.2. We observed that using prioritized sampling mechanisms (Rebuffi al., 2017) that are different than random, did not improve performance.

---

Published as a conference paper at ICLR 2025
5.3 COMPARISONS TO INDEPENDENT SUBNETWORKS WITHOUT KNOWLEDGE TRANSFER
We designed an ablation experiment where we evaluate independently trained smaller architectures with an equivalent total model size to PALL, i.e., using models with d/T parameters. Similar to our baseline Independent, this setting also ensures exact unlearning, no catastrophic forgetting (F, = 0), and no impact of unlearning (F,, = 0). We consider two configurations: (1) static sparsity. where T independent sparse subnetworks with 1/T connectivity are randomly initialized within model, (2) dynamic sparsity, where we also optimize the sparse connectivity structure of these independent subnetworks via score optimization. The latter, i.e., independent mod- els via dynamic sparsity, resembles to PALL with the only difference of not allowing knowledge transfer across subnetworks via weight shar- ing. This also eliminates the need for a memory buffer and parameter retraining for exact unlearning.
Table 2: Comparisons on S-TinylmageNet (40 tasks x classes, and 100 tasks x 2 classes), with independent subnet- works at 1/T sparsity. Results are averaged over 10 random seeds with No = 3. PALL uses f 10 retraining iterations.
V' 40
T
100
Model Size (Inference)
Act
F,
A
Fw 4
Stutic Sparse (Ind.)
70.30
0.0
80.70
0.0
+ M, d M,
Dynamic Sparse (Ind.)
71.19
0.0
83.75
0.0
PALL (a 0.01)
71.00
0.56
85,89
0.53
d M,
In Table 2, we present our results on S-TinylmageNet with 40 or 100 tasks, where the architecture is di- vided into very small, task-specific
PALL ta 0.025)
72.07
0.36
86.11
0.43
4 M.
PALL 0.05)
72.03
0.32
85,80
0.35
M.
Independent
71.76
0.0
86.80
0.0
d x [0.]
subnetworks (e.g., 54K params at 99% sparsity), and learning without knowledge transfer becomes challenging. We observed that dynamic sparsity outperforms independent subnetworks with static sparsity, and PALL consistently outperforms all independent subnetworks with the use of knowledge transfer, e.g., for T = 100, PALL (a = 0.025): 86. 11, Dynamic: 83.75. This makes PALL favorable in longer lifelong learning scenarios, where the number of tasks can be very high or unknown.
6 DISCUSSION
Lifelong learning and machine unlearning explores two important, yet mostly independently studied aspects of truly adaptive, flexible, and responsible Al systems. We proposed PALL as an algorithmic solution combining these two challenging and contradicting aspects, by satisfying all key pillars in both domains (i.e., no catastrophic forgetting, forward knowledge transfer, exact unlearning guaran- tees, memory-effiiiency) for the first time. Our empirical evaluations demonstrate the effectiveness and scalability of PALI. dynamic environments, where efficient task learning and exact unlearn- ing capabilities are desired by state-of-the-ar models. Notably, we have shown PALL to yield up to 12x more model size efficient solutions with better or comparable task learning performances, as opposed to the naive baseline of training independent models to satisfy exact unlearning.
Our method is partially based on architecture-based lifelong learning methods that allow selec- tive knowledge transfer (Kang et al., 2022; Ramanujan et al., 2020), which we innovatively tended into a hybrid learning strategy that is also equipped with rehearsal- algorithm to handle exact task unlearning requests
lifelong learning
method (Buzzega et al., 2020). This enables in the presence of knowledge transfer, which was not addressed to date. Additionally, we also per- formed critical modifications the existing subnetwork optimization methods, such as reinitializing the scores and unused weights after each learning request. These were required to satisfy overall ex- act unlearning guarantees, and resulted in effective learning and unlearning abilities simultaneously.
In this work, we focus on task-incremental learning settings, where the task ID is available to the scenario where learner. Our approach is not yet yet readily applicable class- or disentangles the choice of the all previously learned tasks' label spaces are unified, since PALL task-specific subnetwork based on the task IDs to ensure exact unlearning. To be applicable in these settings, PALL can be extended with privacy-aware auxiliary algorithm to first identify the task, and subsequently utilize task-specific subnetwork via gating (Aljundi et al., 2017; Von Oswald et al., 2019). Our work also does not yet consider selective data unlearning, but instead performs complete task unlearning. To achieve stricter privacy with deletion guarantees for each data sample, approach can be combined with differentially private optimization methods (Lai et al., 2022), in future work. Finally, going beyond our scope on vision tasks, we believe that applying PALL to language processing tasks in future work would also be of broad interest for responsible Al systems.
10

---

Published as a conference paper at ICLR 2025
REPRODUCIBILITY STATEMENT
We provide detailed descriptions of the training configurations and hyperparameters of the exper- iments reported in this paper, in Appendix A.I and A.2. Our algorithm is also outlined in Ap- pendix A.2, and our implementations are available at: http://gitubb.co//oozeeeiz
ACKNOWLEDGMENTS
This work supported by the Graz Center for Machine Learning (GraML). This research was funded whole or in part by the Austrian Science Fund (FWF) (10.5577//CEE22).
REFERENCES
Rahaf Aljundi, Punarjay Chakravarty, and Tinne Tuytelaars. Expert gate: Lifelong learning with network of experts. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 3366-3375, 2017. 3, 10
Rahaf Aljundi, Francesca Babiloni, Mohamed Elhoseiny, Marcus Rohrbach, and Tinne Tuytelaars. Memory aware synapses: Learning what (not) to forget. In Proceedings of the European Confer- ence on Computer Vision (ECCV), pp. 139-154, 2018. 2
Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pp. 141-159. IEEE, 2021. 1, 19
Pietro Buzzega, Matteo Boschini, Angelo Porrello, Davide Abati, and Simone Calderara. Dark expe- rience for general continual learning: strong, simple baseline. Advances in Neural Information Processing Systems, 33:15920-15930, 2020. 2, 7, 10, 16, 18
Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015
IEEE Symposium on Security and Privacy (SP), pp. 463-480. IEEE, 2015. 1,3
Romit Chatterjee, Vikram Chundawat, Ayush Tarun, Ankur Mali, and Murari Mandal. A unified framework for continual learning and machine unlearning. arXiv preprint arXiv:2408.1133 2024. 1, 5,
Arslan Chaudhry, Puneet K Dokania, Thalaiyasingam Ajanthan, and Philip HS Torr. Riemannian walk for incremental learning: Understanding forgetting and intransigence. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 532-547, 2018. 18
Arslan Chaudhry, Marcus Rohrbach, Mohamed Elhoseiny. Thalaiyasingam Ajanthan, Puneet K Dokania, Philip HS Torr, and Mare' Aurelio Ranzato. On tiny episodic memories in continual learning. arXiv preprint arXiv: / 10486, 2019. 2, 6, 7, 16, 18
Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When machine unlearning jeopardizes privacy. In Proceedings of the 2021 ACM SIGSAC Con- ference on Computer and Communications Security, pp. 896-99999 996-911, 9,1,,1 2021.
Matthias De Lange, Rahaf Aljundi, Marc Masana, Sarah Parisot, Xu Jia, Aleš Leonardis, Gregory Slabaugh, and Tinne Tuytelaars. continual learning survey: Defying forgetting classification tasks. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(7):3366-338 2021.
Aleksandr Dekhovich, David MJ Tax, Marcel HF Sluiter, and Miguel A Bessa. Continual prune- and-select: class-incremental learning with specialized subnetworks. Applied Intelligence, 53 (14):17849-17864, 2023.
Alexey Dosovitskiy et al. An image worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.. 20.00.00099999 1929, 2020. 15
Yonatan Dukler, Benjamin Bowman, Alessandro Achille, Aditya Golatkar, Ashwin Swami- nathan, and Stefano Soatto. Safe: Machine unlearning with shard graphs. arXiv preprint arXiv:2304. 13169, 2023.
11

---

Published as a conference paper at ICLR 2025
Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making AI forget you: Data deletion in machine learning. Advances in Neural Information Processing Systems, 32, 2019.
Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Tom, and Ponnurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning. arXiv preprint arXiv:2201.06660, 2022. 3
Aditya Golatkar, Alessandro Achille, and Stefamo Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 9304-9312, 2020.
Siavash Golkar, Michael Kagan, and Kyunghyun Cho. Continual learning via neural pruning. arXiv preprint arXiv:1903.044:: 2019. 3
Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 11516-11524, 2021. 3
Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. In International Conference on Machine Learning. PMLR, 2020.
Varun Gupta, Christopher Jung, Seth Neel, Aaron Roth, Saeed Sharíf--Malvajerdi and Chris Waites. Adaptive machine unlearning. Advances in Neural Information Processing Systems, 34:16319- 16330, 2021. 3
Jamie Hayes, Ilia Shumailov, Eleni Triantafillou, Amr Khalifa, and Nicolas Papernot. Inexact unlearning needs more careful evaluations to avoid false sense of privacy. arXiv preprint arXiv:2403.01228. 2024. 3
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. In Proceedings of the IEEE International Conference on Computer Vision, pp. 1026 (026-1034, 1034, 2015. 16
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp- 770-778, 2016. 15
Haeyong Kang, Rusty John Lloyd Mina, Sultan Rizky Hikmawan Madjid, Jaehong Yoon, Mark Hasegawa-Johnson Sung Ju Hwang, and Chang Yoo. Forget-free continual learning with win- ning subnetworks. In International Conference on Machine Learning, pp. 10734-10750, 2022.
3, 5, 7, 10, 20
James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A. Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Brabbka-BBrwwinkk.. Demis Hass- abis, Claudia Clopath, Dharshan Kumaran, and Raia Hadsell. Overcoming catastrophic forgetting in neural networks. Proceedings of the National Academy of Sciences, (1((33)35211-3556 2017. 2, 6, 15
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical Report, Univer- sity of Toronto, 2009. 15
Dhireesha Kudithipudi et al. Biological underpinnings for lifelong learning machines. Nature Ma- chine Intelligence, 4(3):196-210, 2022.
Phung Lai, Han Hu, Hai Phan, Ruoming Jin, My Thai, and An Chen. Lifelong dp: Consistently bounded differential privacy in lifelong machine learning. In Conference on Lifelong Learning Agents, pp. 778-797777777 2022. 10
Ya Le and Xuan Yang. Tiny ImageNet visual recognition challenge, 2015. 15
Zhizhong Li and Derek Hoiem. Learning without forgetting. IEEE Transactions on Pattern Analysis and Machine Intelligence, 40 (012:29335-2447, 2017. 2, 6, 15
12

---

Published as a conference paper at ICLR 2025
Bo Liu, Qiang Liu, and Peter Stone. Continual learning and private unlearning. In Conference Lifelong Learning Agents, pp. 243 254.. PMLR, 2022. 1, 4, 5, 7,8
David Lopez-Paz and Marc Aurelio Ranzato. Gradient episodic memory for continual learning. Advances in Neural Information Processing Systems, 30, 2017. 2, 16
Arun Mallya and Svetlana Lazebnik. Packnet: Adding multiple tasks to single network by iterative pruning. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 7765-7773, 2018. 3,7
Alessandro Mantelero. The EU proposal for general data protection regulation and the roots of the 'right to forgotten'. Computer Law & Security Review, 29(3):229 235, 2013. 1,3
Seth Neel, Aaron Roth, and Saeed -haaiii-Maavajerddi. Descent-to-delete: Gradient- methods for machine unlearning. In Algorithmic Learning Theory, pp. 911-93919222 PMLR, 2021. 3
Vivek Ramanujan, Mitchell Wortsman, Aniruddha Kembhavi, Ali Farhadi, and Mohammad Raste- gari. What's hidden in a randomly weighted neural network? In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp- 11893-119999 2020. 5, 10
Sylvestre- Alvise Rebuffi, Alexander Kolesnikov, Georg Sperl, and Christoph H Lampert. icarl: Incremental classifier and representation learning. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pp. 2001-2010, 2017. 2,
David Rolnick, Arun Ahuja, Jonathan Schwarz, Timothy Lillicrap. and Gregory Wayne. Experience replay for continual learning. Advances in Neural Information Processing Systems, 32, 2019.
Andrei A Rusu, Neil C Rabinowitz, Guillaume Desjardins, Hubert Soyer, James Kirkpatrick, Koray Kavukcuoglu, Razvan Pascanu, and Raia Hadsell. Progressive neural networks. arXiv preprint 1rXiv:1606.04671 2016. 2
Ayush Sekhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. Remember what you want to forget: Algorithms for machine unlearning. Advances in Neural Information Pro- cessing Systems, 1ee11887518800 2021. 3
Takashi Shibata, Go Irie, Daiki Ikami, and Yu Mitsuzumi. Learning with selective forgetting. In 30th International Joint Conference Artificial Intelligence (IJCAI), pp. 989-996, 2021. 1, 3, 5, 7, 15
Hanul Shin, Jung Kwon Lee, Jachong Kim, and Jiwon Kim. Continual learning with deep generative replay. Advances in Neural Information Processing Systems, 30, 2017.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 3-18. IEBE, 2017.
Andreas Peter Steiner, Alexander Kolesnikov, Xiaohua Zhai, Ross Wightman, Jakob Uszkoreit, and Lueas Beyer. How to train your ViT? data, augmentation, and regularization in vision transform- ers. Transactions on Machine Learning Research, 2022. 15
Thomas Steinke, Milad Nasr, and Matthew Jagielski. Privacy auditing with one (1) training run. Advances in Neural Information Processing Systems, 36, 2024.7 7
Gido M van de Ven, Tinne Tuytelaars, and Andreas S Tolias. Three types of incremental learning.
Nature Machine Intelligence, 4(12):1185-1197, 2022. 1,2
Gido M van de Ven, Nicholas Soures, and Dhireesha Kudithipudi. Continual learning and catas- trophic forgetting. arXiv preprint arXiv:2403.05/75 2024.7
Johannes Von Oswald, Christian Hemning, Benjamin F Grewe, and João Sacramento. Continual learning with hypernetworks. arXiv preprint arXiv: /00v:/990.0000 1906.0069, 2019. 10
Zhen Wang, Liu Liu, Yiqun Duan, Yajing Kong, and Dacheng Tao. Continual learning with lifelong
vision transformer. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 171-181, 2022. 18
13

---

Published as a conference paper at ICLR 2025
Zhenyi Wang, Enneng Yang. Li Shen, and Heng Huang. A comprehensive survey of forgetting in
deep learning beyond continual learning. arXiv preprint arXivv2307.09211 2023. 3
Yinjun Wu, Edgar Dobriban, and Susan Davidson. Deltagrad: Rapid retraining of machine learning models. In International Conference on Machine Learning, pp. 10355-10366. PMLR, 2020. 3
Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, and Xiaodong Lin. ARCANE:
efficient architecture for exact machine unlearning, In s1 International Joint Conference on Artificial Intelligence (IJCAI), volume 6, pp. 19, 2022.
Jingwen Ye, Yifang Fu, Jie Song, Xingyi Yang, Songhua Liu, Xin Jin, Mingli Song, and Xinchao Wang. Learning with recoverable forgetting. In European Conference Computer Vision, pp- 87-103. Springer, 2022.
Jachong Yoon, Eunho Yang, Jeongtae Lec, and Sung Ju Hwang. Lifelong learning with dynamically expandable networks. arXiv preprint 11X.i:1708..15444 2017.
Sihao Yu, Fei Sun, Jiafeng Guo, Ruqing Zhang, and Xueqi Cheng. Legonet: fast and exact unlearning architecture. arXiv preprini arXiv:2210. /6023, 2022. 3
Friedemann Zenke, Ben Poole, and Surya Ganguli. Continual learning through synaptic intelligence. In International Conference on Machine Learning, pp. 3987-3995 PMLR, 2017.
Dawen Zhang, Shidong Pan, Thong Hoang, Zhenchang Xing, Mark Staples, Xiwei Xu, Lina Yao, Qinghua Lu, and Liming Zhu. To be forgotten machine unlearning methods. arXiv preprint arXiv:2302.03350 2023.
be fair: Unveiling fairness implications of
Zhiwei Zuo, Zhuo Tang, Bin Wang, Kenli Li, and Anwitaman Datta. ECIL-MU: Embedding based class incremental learning and machine unlearning. In IEEE International Conference on Acous- fics, Speech and Signal Processing (ICASSP), pp. 6275-6279, 2024.
14

---

Published as a conference paper at ICLR 2025
A APPENDIX
A.1 EXPERIMENTAL SETUP
Datasets: We experimented with S-CIFARIO: 5 tasks x classes, S-CIFAR100: 10 tasks x 10 classes (Krizhevsky, 2009), and S-TinylmageNet in various sequential configurations: 20 tasks x 10 classes, 40 tasks x classes, and 100 tasks x 2 classes (Le & Yang, 2015). To adapt these datasets for our experimental setting, we first randomly allocate the classes in the dataset into disjoint tasks, and subsequently generate user request sequences R1r consisting of task learning and N₂, task unlearning instructions arranged in a logically consistent manner. This process was repeated in randomized manner for each random seed (e.g., seed 0 to 19). We used standard data augmentation methods with random cropping and horizontal flipping of images.
Model Architectures: We used ResNet-18 and ResNet-34 architectures (He et al., 2016) in S- CIFAR 10/100 experiments which are commonly used as benchmarks in lifelong learning, consist- ing of 11,164,352 and 21,311, 1,168 trainable parameters respectively. In I-TinyImageNet experi- ments, we used a vision transformer (Dosovitskiy et al., 2020) based on the VIT-T/8 specifications from (Steiner et al., 2022), consisting of 12 encoder layers with 3 heads, model width of 192, an MLP dimensionality of 768, and a patch size of 8x8, resulting in 5,408, 064 trainable parameters. We did not have trainable parameters in the batch-norm or layer-norm layers of these models.
For architecture-based learning methods with subnetworks (i.e., PackNet, WSN, PALL), besides determining the connectivity of the linear layers within the ViT-T/8, we also used task-specific learnable class tokens and positional encoding layers altogether. This resulted in approximately 240,000 more parameters in 0 by default. None of the models were pretrained on other datasets.
A.2 TRAINING CONFIGURATION AND IMPLEMENTATIONS
Our proposed methodology for privacy-aware lifelong learning is outlined in Algorithm
Model Training: We use stochastic gradient descent (SGD) with momentum for optimization in S- CIFAR10/100 experiments, whereas an Adam optimizer was used S- S-TnnymmageNet experiments. We have found the use of an Adam optimizer with adaptive learning rates across the parameters and importance scores critical to facilitate the joint optimization for ViT-T/8. We perform training for 20 epochs per S-CIFAR 10/100 task learning instruction with a batch size of 32, learning rate of 0.01, and weight decay with parameter 0.0005. We perform weight decay only on the non-frozen parameters. We did not perform regularization via weight decay the importance scores. We perform training for 100 epochs per S- T-TinIImageNet task learning instruction with a batch size of 256, initial learning rate of 0.001, and cosine annealing learning rate scheduler.
Baseline Methods: We use the default elastic weight consolidation (EWC) (Kirkpatrick et al., 2017) lambda parameter of 100 for S-CIFAR10. 10. For S-CIFARI00 with ResNet-34 and S-TnnymmeeeNet with VIT-T/8, we set this parameter to 4000 and 1000 respectively, which yielded better results given the number of parameters in these models. We use the default learning without forgetting (LwF) (Li & Hoiem, 2017) regularization parameter of 1.0 and temperature parameter of 2.0. For learning with selective forgetting (LSF) (Shibata et al., 2021), we also use a combination of EWC and LwF for learning as performed in the original work, with the default LSF regularization weight of 10.
Baseline methods LwF and LSF both perform a preliminary classifier layer training phase at the be- ginning of task learning, which is then followed by complete model training. We also implemented these following the original methods, by splitting the number of epochs into two for the preliminary and subsequent phases, such that the total number of task learning epochs remains the same. Sim- ilarly for PackNet, we split the number of epochs into two since optimization involves two stages. After one round of training, magnitude- (e.g., pretraining for 10 epochs, pruning, and finetuning for 10 epochs in S-CIFAR task learning).
pruning is performed, and then the model is finetuned
Unlearning Implementations: For Sequential, EWC and LWF, we do not perform any changes to the model parameters for task unlearning. For EWC and LWF, we only discard the previously stored model weights (which are used for continual learning in these methods), corresponding the unlearned task. For EWC, we also discard the previously stored Fisher information matrix corre- sponding to the unlearned task. We perform algorithn-specifie unlearning updates for LSF, gradient
15

---

Published as a conference paper at ICLR 2025
Algorithm Privacy-Aware Lifelong Learning (PALL)
1: Input: Datasets (D') neural network Se with parameters 0 IRd, layer-wise subnetwork
connectivity rate a, retraining iterations N and regularization weight 3, parameter initialization
distribution c6.). total episodic memory buffer capacity
2: Initialize: S2g = 0, .Mo- = 0, Mo 0
((0)
3: for R3 in Rir [R1, R...... R₂] do
4: if R. (t. D' _.) then
# Task Learning
5: Ω. 5 12 (4}
6: Initialize parameter importance scores ((s))
7: for (ar,)) y) ~ DD' do
8:
Obtain binary mask ms.ss) with connectivity rate per-layer using the largest |st] Compute (2, yi o m.)
9:
10:
0 0-0 -7 00
@ (1 M,-1))
11:
St 8. -1
8
12:
end for
Obtain final binary mask (st) with a connectivity rate per-layer using the largest |s;]
14:
M, + M;- (m,
M, M.- m
16:
Store B' [ar) My, 3; = Soom m. (z,)) (.). ~ D' D'sssis
17:
Reinitialize unused parameters O @ - M,) using Φ(.)
else if R, = U) then
Task Unlearning
19:
Ω2 < 1
20:
Delete episodic memory B
m. < Retrieve the submask of m, indicating the params trained via D' or B²
22:
Reinitialize parameters 0 o m, using 6(.)
23:
0 < Reinitialized params which were optimized on D' and used by tasks t > t E EQ
24:
for j = to N2 do Σ r>t (( (Ree (ær, y: ④ m,)] +.3. "'='".''==">~_0lll6 (a') - -
TEst
26:
- 17
88
00
27:
end for
28:
M; - M,-1 (m)
29:
M, V Ven, mj
30: end if
31:
end for
episodic memory (GEM) (Lopez-Paz & Ranzato, 2017), experience replay (ER) (Chaudhry al., 2019), dark experience replay (DER++) (Buzzega et al., 2020), when task unlearning is instructed. For task unlearning with GEM, ER and DER++, implement experience replay finetuning ob- jective on the remaining tasks' episodic memories, and also predict uniform distributions using the unlearned task's episodic memories to accelerate forgetting. Task unlearning with LSF exploits its unique notion of manipulating the input space by superposing distinct auxiliary mnemonic codes on task-specific data. For unlearning, the mnemonic code of the unlearned task directly provided to the network to be predicted incorrectly via uniform label distribution, and the remaining task the network to be predicted accurately. We used lower learning rate of 0.001 for these methods with S-CIFAR 10/100, since it gave better results with unlearning mechanisms place. All of these methods perform unlearning for N, iterations, similar PAL.I.
codes are directly provided
During task unlearning with PALL,, we use an episodic memory buffer with capacity of 500 and 1000 samples in S-CIFAR and S-TinymmageNet experiments, respectively. We partition the episodic memory buffer size priori over all tasks, assuming that the amount of tasks 7' is known before- hand. We perform naive random sampling strategy to select the training set exemplars which will be stored in task-specific episodic memory buffer (see Table A3 for alternatives). We used Kaiming uniform distribution (He et al., 2015) for d(.) while initializing the model parameters and importance scores at the beginning of training, well during unlearing-related parameter and
16

---

Published as a conference paper at ICLR 2025
score resetting steps. Note that keep the final classifier layer structure of the models hardwired based on the associated class neurons, such that there was no score optimization performed.
A.3 ADDITIONAL EXPERIMENTAL RESULTS
We provide additional results based empirical evaluations. We investigate the impact of retraining after exact unlearning, hyperparameter configurations of the episodic memory rehearsal mechanism, alternative exact unlearning baseline with model retraining from scratch using ex- perience replay, scalability of PALL in longer lifelong learning and unlearning scenarios, training efficiency comparisons, and worst-case evaluation metrics.
A.3.1 IMPACT OF RETRAINING AFTER UNLEARNING
In Table AI, investigate the impact of the number of retraining iterations Ny,, during rehearsal- based retraining of the reset parameters. We also define another evaluation metric in this context: {maxten; (01-1,t ax,1), which directly yields the maximum
Funk
impact of any unlearning instruction on previously learned tasks. Results show that the absence of retraining after resetting the affected parame- ters (N = 0) does not perform well (i.e., A t / mu for S-CIFARIO, 10, and 70.24/5.31 for S-CIFARI00), Therefore, mem-
Table A1: Experiments with PALL (a = 1/T) on the impact of N for parameter retraining after unlearning.
S-CIFARIO (T 5)
S-CIFARI00 (T = 10)
93.35/3.41
Art
F 1
Fu
A
Fa 1
N₂ 0
93.35
1.07
3.41
70.24
1.44
5.31
N = 10
93.84
0.72
2.26
71.65
0.82
3.85
ory buffer and parameter retraining is necessary to balance exact unlearn- ing. We could also achieve better per- formances after unlearning by using longer retraining durations (e.g.. A 1 Fmax for S-CIFARI00 with N, 100: 72.46/2.39, as
N = 25
93.96
0.72
2.30
72.04
0.58
2.57
50
94.34
0.60
1.94
72.35
0.40
2.17
= 100
94.15
0.56
1.68
72.46
0.38
2.39
opposed to our default choice N, = 50: 72.35/2.17).
On the Retrained Parameters After Unlearning: In Table A2 we provide details the tio of the affected parameters 0 during unlearning, which required retraining using memory re- hearsal. Specifically, we observed that to facilitate task unlearning, PALL only requires retraining of 4.07%, 1.98% and 1.03% of the overall model parameters on average, in S-CIFARI0/100 and S- S-TinylmageNet experi- ments respectively. This indicates a very efficient retraining phase with sparse gradient updates for N2 iterations, leading to beneficial increase in performance (from Table A1, S-CIIARIO with N, 0: 93.35 vs N, 50: 94.34, S-CIFARI00 with N, 0: 70.24 vs N2 50: 72.35). We also investigated the values of these parameters before and after retraining, verify that the parameters do not converge back to their pre-unlearning values, which would conflict with unlearning. We observed that the mean absolute difference values were non-zero overall, indicating feasible retraining mechanism to complement our unlearning approach.
Table A2: Ratio of retrained params on average, and the mean absolute difference between these params before and after retraining. Results for PALL (a = 1/T), averaged over N,, = 3 requests for 10 seeds.
S-CIFARIO w/ResNet-18
S-CIFARI00 w/ResNet-34
S-TinyImageNae w/ViT-T/8
total params: d # subnetwork params: d/T
11.2M
21.3M
5.4M
2.24M (20%)
2.13M (10%)
270K (5%)
# retrained params:
4554.4K
42118
~555.5K
ratio of retrained params
4.07%
1.98%
1.03%
mean absolute difference (1)
0.0019
0.0021
0.0214
A.3.2 ABLATIONS ON THE EPISODIC MEMORY REHEARSAL METHOD
In Table A3 we investigate the influence of the random exemplar sampling method used to select the data samples to be stored in the episodic memory buffer, in comparison to four methods that use different criteria: (1) Herding algorithm from iCaRL (Rebuffi et al., 2017), which sorts the samples from class to select more representative exemplars based on the distance to the mean sample of that class, using feature representations of the penultimate layer. (2) Entropy-based selection using
17

---

Published as a conference paper at ICLR 2025
Table A4: Ablation experiments on the memory rehearsal based retraining stage. We present evalu- ations PALL (a = 1/T) with N₂ = 3. Results are averaged over 20 random seeds.
Episodic Memory
Exact Unlearning
S-CIFARIO
S-CIFARI00
Σ/= 1/=1161
Method
A +
Fi
Fu
Act
Fi
F
Sequential
70.71
13.86
0.0
35.35
13.43
0.0
ER
84.09
4.83
2.56
50.08
6.69
8.14
DER+
89.23
3.09
1.03
59.82
6.99
1.43
200
PALL 0.0)
93.91
0.0
2.36
71.68
0.0
PALL (3 0.5)
93.95
0.0
0.67
71.90
0.0
0.72
PALL (3 1.0))
93.36
0.0
3.35
71.73
0.0
0.79
87.88
3,45
57.63
4.67
DER+
92.04
1.62
0.66
66.84
4.52
0,95
500
PALL (3 0.0)
94.12
0.0
1.98
71.98
0.0
0.50
PALL (3 0.5)
94.34
0.0
0.60
72.35
0.0
0.40
PALL (3 1.0)
93.60
0.0
2.86
72.32
0.0
0.50
ER
89.76
2.52
1.22
63.10
3.31
7.18
DER+
X
93.20
1.00
0.63
70.96
3.01
0.89
1000
PALL (3 0.0)
94.36
0.0
1.37
72.50
0.0
0.29
PALL (3 0.5)
94.25
0.0
0.54
72.58
0.0
0.23
PALL (3 1.0)
93.62
0.0
2.91
72.52
0.0
0.27
Independent
95.19
0.0
0.0
73.22
0.0
0.0
the output logits (Chaudhry et al., 2018), which selects exemplars with higher output distribution uncertainty. (3) Confadence-based selection (Wang et al., 2022), which selects exemplars with higher output logit confidence. (4) Logit distance based selection (Chaudhry et al., 2018), which selects critical exemplars closer the decision boundary. Overall, our results in Table A3 did indi- cate significant improvements in performance after incorporating such prioritized sampling mech- anisms while accumulating the episodic memory buffer.
Table A3: Influence of the buffer sampling strategy PALL
(a = 1/T), based on the default hyperparameters. Results are averaged over 10 random seeds for these comparisons.
S-CIFARIO
S-CIFARI00
A
F.
F
Ar
F.
J-
Random selection
94.25
0.57
1.80
72.11
0.49
2.32
In Table A4 we present our abla- tion experiments the quantita- tive hyperparameters the mem- ory rehearsal mechanism. based on S-CIFAR10/TI 10/100 simulations.
Herding algorithm
94.15
0.50
1.74
72.10
0.70
3.14
Eatropy-bused
85.15
4.71
15.32
70.55
1.33
4.22
Confidence-basee
83.54
7.28
27.63
70.21
1.46
5.70
Logit distance 81.83
7.17
24.34
70.01
1.69
6.20
Here consider the rehearsal buffer samples to be selected via random sampling. Our experimen-
tal results in the main text were based on 3 = 0.5 and buffer capacity of 500 for these datasets. Our ablation experiment results in Table A4 also support that / 0.5, i.c., experience memory rehearsal via the DER++ method (Buzzega et al., 2020), performs consistently better than the other alternatives in all cases.
Notably, the results with 3 = 0.0, i.e., vanilla experience replay (Chaudhry et al., 2019), demon- strates the quantitative evaluations for the case where we do not store any episodic logit values the buffer, but only use (æ, y) pairs. These results were also found relatively good, in case the episodic memory buffer does not allow storing logits (Chaudhry et al., 2019) (e.g., with S-CIFARIO, At metrics for buffer size 1000, 0.0: 93.91, 3 = 0.5: 93.95, 8 1.0: 93.36).
Retraining with Experience Replay for Exact Unlearning: We investigate an alternative approach to adapt the traditional experience replay (ER) (Chaudhry et al., 2019) method upon task unlearning requests. In our main experiments, ER was adapted to perform approximate unlearning, by finetun- ing model parameters using episodic memories towards misclassification the task to be unlearned. In this new setting, for any unlearning request, we retrain the entire model from scratch using the experience replay buffer. We test this alternative baseline that satisfy exact unlearning.
18

---

Published as a conference paper at ICLR 2025
Table A6: Comparisons of PALL with baseline methods on S-TinylmageNet (100 tasks x 2 classes) for various number of unlearning instructions in a longer lifelong learning scenario. Results are averaged over 10 random seeds for these comparisons.
TTnyImageNee
100)
Ng
N₂
5
N,
10
N₂ 20
Ng
D0
Ualeaming
A
Fr
F.
A
Ji
J.
A
J.
Fi
A
F;
J.
Sequential
1.71
1.72
0.0
53.01
1.73
0.0
54.15
1.73
51 31
1.80
EWC
X
79.53
0.43
0.0
79.57
0.43
0.0
79.53
0.43
0.0
79.59
0.43
0.0
79.17
0.44
0.0
DER++
X
76.58
0.64
0.45
75.04
0.62
0.16
75.63
0.64
0.36
74.95
0.57
0.45
73.22
0.54
0.22
PackNet
81.73
81.76
0.0
0.0
81.85
0.0
81.75
0.0
WSN
X
88.05
0.0
0.0
87.97
0.0
0.0
87.62
0.0
0.0
88.02
0.0
0.0
87.74
0.0
0.0
PALL
85.89
0.0
0.53
85.45
0.0
0.41
85.18
0.27
84.21
0.0
0.21
81.36
0.0
0.17
P.I.L. 000s
86.11
85
0.0
0.31
85-52
0.22
84.29
79.77
0.0
PALL or 0.00
85,80
0.0
0.35
85.60
0.0
0.29
85.04
0.0
0.23
84.00
0.0
0.20
77.96
0.0
0.24
Independent
86.80
0.0
86.51
0.0
0.0
86.53
0.0
86.71
0.0
86.93
0.0
0.0
due resetting the entire model upon any unlearning request, which is analogous to the model retraining baselines from the machine unlearning literature (Bourtoule et al., 2021). Our results in Table A5 show that this approach, annotated as "ER (Retraining)". does not scale well even for the slightly more com- plex S-CIFAR100 task: Ar = 34.50. This is due to the model being repeatedly reset, and thus the memory buffer becoming the only dataset for the learner.
Evaluating model retraining with experience replay, i.e., ER (Retraining), in comparison to Independent model training. PALL, and our original implementation of ER with approximate unlearning.
Table A5:
S-CIFARIO (T
5)
S-CIFARI00 (T
10)
A 1
Ag $
Fi
F.
Art
Au 4 Fi
L
F,
Independent
95.19
Exact Exact
0.0
0.0
73.22
Exact Exuct
0.0
0.0
PALL (a 1/1)
94.34
72.35
0.0
ER (Retraining)
78.80
Exact 58.48
2.05
7.53
34.50
Exact 42.69
4.07
20.40
ER
87.88
3.45
1.61
57.63
4.67
7.91
A.3.3 SCALABILITY TO LONGER LIFELONG LEARNING AND UNLEARNING SCENARIOS
We investigate the scalability of PALL on longer lifelong learning and unlearning scenarios by test- ing it on the S- m-TinylmaeeNet dataset with 100 tasks. Our results are presented in Table A6 with increasing number of task unlearning requests. We overall show that there is no limitation in the scalability of PALL,, and the algorithm performs well in learning to sub-partition tasks within one ViT-T/8 architecture. We observed that the best performing PALL model often the one with 97.5% sparse task-specific subnetworks (a: 0.025) with knowledge transfer, and the Ar metric occasion- ally degrades as the number unlearning requests increase the sequence, due to the parameter retraining process. In the extreme experimental condition, for user request sequence with 100 task learning and N,, = 50 unlearning requests, PALL achieved an observed performance 81.36/0.17 for At 1 FF. with a 0.01 (i.e., maximum of 54K params per task).
Our approach also performs favorably in comparison to the baselines in such a longer scenario, when all evaluation criteria considered together (no catastrophic forgetting, forward knowledge transfer, exact unlearning and memory-efficiency). Specifically in Table A6, although PALL yields lower Ar than WSN the number of unlearning requests increase (e.g.. N,, 20, WSN: 88.02, PALL (a- = 0.025): 84.29), our approach can provide exact unlearning guarantees by design. On the other hand, although training Independent models can also ensure exact unlearning, becomes a significantly more -emanddg approach in this longer scenario. Specifically, the base model has an inference time model size of 20.63 MB, which corresponds to 32-bit representation of its approximately 5.4M parameters. As the number of tasks increase, the model size increment for PALL was observed to be approximately 0.69 MB for each additional task (due to the binary mask parameter size increment), which would result in a maximum total model size of 89.53 MB at the end of the sequence with T 100. On the other hand, training independent models with d x T parameters bit would result in model size of 2063 MB, with step-wise increase of 20.63 MB for each new task. Thus, we argue that our approach does scale well in longer lifelong learning and unlearning scenarios by offering reasonable trade-off in overall performance.
19

---

Published as a conference paper at ICLR 2025
Table A7: Comparisons of training times while processing single task learning or unlearning request. We use ResNet-18 with S-CIFARIO, ResNet-34 with S-CIFARI00, and ViT-T/8 with S- TinylmageNer. We use PALL with a 1/T, and , 50 retraining iterations after unlearning.
S-CIFARIO (T=
S-CIFARI00 (T = 10)
S-TinyImageNet (T 20)
Learning
Unlearning
Learning
Unlearning
Learinng
Unlearning
R.
R₂ (
R.
L
R. (.U)
R.
R, ( U)
Sequential
3.23 seclepoch
10 sec
2.91 seclepoch
10 sec
2.71 sec/epoch
10 sec
EWC
6.42 seclepoch
10 sec
5.59 seclepoch
10 sec
3.59 sec/epoch
10 sec
LwF
4.87 seclepoch
10-4 sec
4.23 seclepoch
10 sec
3.37 sec/epoch
10-4 sec
LSF
9.02 sec/epoch
0.51 sec
8.21 seclepoch
0,90 sec
5.28 sec/epoch
1.84 sec
GEM
23.8 sec/epoch
0.93 sec
12.4 seclepoch
1.64 see
3.19 secfepoch
2.10 sec
ER
6.65 sec/epoch
0.94 see
5.70 seclepoch
1.73 sec
2.95 sec/epoch
2.13 sec
DER++
9.09 sec/epoch
1.38 see
8.44 scelepoch
2.44 see
3.11 scciepach
3.06 sec
PackNet
3.40 sec/epoch
< 10 sec
3.07 seelepoch
10-4 sec
2.65 secfepoch
< 10 sec
WSN
32.6 seclepoch
< 10 sec
30.2 seelepoch
< 10 sec
2.96 secfepnch
< 10 sec
PALL
33.1 secfepoch
1.09 sec
30.8 sec/epoch
1.88 sec
3.13 seclepoch
2.59 sec
Independent
3.20 sec/epoch
< 10 sec
2.89 sec/epoch
10-4 sec
2.66 sec/epoch
< 10 see
A.3.4 COMPARISONS OF TRAINING TIMES
We compare training times of each algorithm in Table A7 using an NVIDIA A40 GPU. We evaluate
all algorithms on the same test sequence that begins as: R1r = [(1, D L), (2, D2, L). (1, U.....]- We then compute the per-epoch training duration during processing of the second task learning request (2, D L), and the total time elapsed during processing of the task unlearning request (1, U). Since these timings depend on the model architecture, we present them for all datasets.
During task learning, PALL incurs an additional training time overhead to optimize task specifie subnetworks with knowledge transfer. This is also observed in WSN (Kang et al., 2022) (e.g.. for S-TinylmageNer, WSN: 2.96 sec/epoch, PALL: 3.13 sec/epoch). Both algorithms have sig- nificantly higher training time than the other baselines due to the parameter-level gradient mask- ing within each gradient update step. This time difference is larger in ResNet architectures with convolutional layer masking, throughout the model are being masked. During unlearning, the total retraining time PALL varies between 1 to 3 sec when N, = 50 is used, which is neg- ligible difference to other methods.
opposed to the VIT-T/8 architectures, where only dense layers
train time (see/ /epoch)
1.2
Seq.
PackNot
BWC
WSN
Indep.
PALL
1.1
We performed further comparisons of the change in training times as the num-
1.0
ber of tasks increase, in Figure A1. We conducted these simulations on S- TinylmageNet (T 100) based the models from Table A6. We did not in- clude DER++ since the training time of this algorithm was too far out of the range from the other methods, and also rapidly increased with the number of tasks (e.g., 3.04 sec/epoch when 10 tasks are learned, 1. sec/epoch for 30 tasks are learned, etc.).
0.9
0.8
10
20
30
40
50
60
70
80
90
100
# task learning requests
Figure A1: Comparisons of task learning durations on S- TinyImageNet (T 100), the number of tasks in- crease. Methods indicated with solid lines (Indep. & PALL) can ensure exact unlearning upon request.
Overall, we observe that PALL maintains relatively stable (although minimally fluctuating) train- ing time overhead caused by the parameter gradient masking. This masking operation is imple- mented based the cumulative binary mask matrix M, which is sequentially updated during each task learning request in a single step via: M, = Veer_, my. and then applied to the gradients. Therefore, since this series of logical operations do not influence the execution time of the overall algorithm drastically, the impact of the increase in the number of tasks is negligible for PAL.I.
20

---

Published as a conference paper at ICLR 2025
A.3.5 WORST-CASE EVALUATION METRICS ACROSS DIFFERENT REQUEST SEQUENCES
In Table A8, we present the worst-case evaluation metrics corresponding our results in Table of the main text. We specifically present the minimum task learning performance metric observed across randomized seed repetitions (A!""), and the worst-case impact of task unlearning (Fua) as previously defined in Appendix A.3.1. These metries specifically cor- respond to certain user request sequences of interleaved learning and unlearning instructions, where the models fail to perform the most. Since PALL consistently yields no catastrophic forgetting (Fi 0) and unlearning is exact (i.e., Au is irrel- evant), do not include the other metrics.
Table A8: Worst-case evaluation metries for task learning performance (Al and impact of task unlearning (Fi..,, observed across random- ized repetitions of user sequences. We consider PALL with = 1/T.
S-CIFARI0 (T = 5)
S-CIFARI00
S-TinylmageNe (T' = 20)
(T = 10)
A
Jua
Amii
Juux
A
Sequential
36.78
0.0
21.03
0.0
13.93
EWC
0.0
$1.79
52.18
LwF
83.43
0.0
48.83
0.0
41.04
LSF
81.50
3.13
51.53
8.87
35.42
11.60
GEM
79.85
5.71
52.10
10.28
39.52
12.94
ER
80.63
5.23
49.87
15.07
39.79
12.12
DER+
84.45
2.22
61.57
4.58
44.46
7.11
PackNet
89.85
0.0
72.99
0.0
58.35
0.0
WSN
86.75
0.0
69.93
0.0
61.34
In Table A8. we observe that the worst-case evalua- tions are mainly consistent with the averaged metrics presented in the Table of the main text. For instance, for S-CIFARIO, PALL yields the best worst- case Afrin metric with 89.95 among methods, close to the upper bound baseline performance with Independent: 90.85. Similarly for S-CIFARION 100, PALL achieves an A!rih of 69.83, whereas Independent: 69. 69.46. In terms of the Futus metric, we observe that PALL is consistently better all datasets, demonstrating the robustness of the retraining step following unlearning.
PALL
89.95
1.94
69.83
2.17
59.91
4.42
Independent
90.85
0.0
69.46
0.0
60.29
0.0
21


Reviews:
[{"review_id": "X9urB2geTv", "reviewer": "Reviewer_QDPb", "summary": "This paper formulates a task-incremental learning and unlearning problem with strong privacy considerations, by extending the traditional task-incremental learning setup to allow exact task unlearning instructions. The authors present privacy-aware lifelong learning (PALL) as a memory-efficient algorithmic solution to this new problem.", "questions": "1. The cited references for Regularization-based methods mainly cover foundational works, but the discussion could benefit from including more recent studies that reflect the latest advancements in this area. \n2. The experience settings of other baselines are different from those in this paper. The Baseline Methods section should describe more detailed setups. \n3. Including SOTA models would strengthen the study’s impact by showcasing its performance relative to the best-performing approaches in the field.\n4. It would be helpful to clarify the initialization and optimization processes more explicitly and outline each configuration's practical implications. Adding these clarifications would aid in understanding the differences and rationale behind these two configurations, improving the overall readability and transparency of this section.\"", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. A novel experimental setup is proposed to combine lifelong learning and machine unlearning, addressing key challenges in both domains, which have not been addressed to date.\n2. This paper presents privacy-aware lifelong learning (PALL) as a memory-efficient algorithmic solution to this setup, which enables learning without catastrophic forgetting, allows learnable forward knowledge transfer, and ensures exact unlearning guarantees by design.\n3. The algorithmic empirically demonstrates the scalability of PALL on both convolutional benchmark architectures and attention-based vision transformers, yielding a stable performance in highly dynamic lifelong learning scenarios with randomly arriving unlearning requests.", "weaknesses": "1. This paper presents a new problem setting, but this problem lack significant innovation compared with existing problems. What is the most different points that distinguish this problem from others? It seems the objective of this problem in section 3.2 also holds for existing problem such as domain incremental learning and unlearning. Is there any challenges specific to this problem so that we must formulate it as a new problem?\n2. The methods presented for the problem setting proposed in this paper appear to be well-established and lack significant innovation. The authors should either highlight any novel contributions or improvements to existing methods or explore more advanced techniques that could offer better solutions to the unique aspects of the problem.\n3. This paper introduces an interesting approach, but it is unclear how the proposed method has been specifically tailored to address the new problem setting. The authors should provide a more detailed explanation of how their approach was designed to handle the new settings.\n4. The paper should clarify why the task-incremental setting was chosen instead of class- or domain-incremental learning. Providing a rationale for this choice would help to better understand the appropriateness of the selected setting for the problem at hand.\n5. The cited references of Regularization-based methods are mostly foundational works, but some are relatively dated, potentially overlooking recent improvements or newer approaches in the field.\n6. The details of the Baseline you compared are not clearly described, e.g., how you tailor these baseline methods to fit the proposed problem setting?\n7. In the experimental section, the results should be compared with the latest state-of-the-art (SOTA) models in Continual Learning. A more detailed comparison with existing SOTA methods would provide a clearer context for evaluating the proposed approach and strengthen the overall analysis.\n8. In the section on Comparisons to Independent Subnetworks without Knowledge Transfer, the descriptions of the two configurations—static sparsity and dynamic sparsity—are not sufficiently clear. Although static sparsity is introduced as a random initialization of T independent sparse subnetworks, and dynamic sparsity as an optimization of sparse connectivity via score optimization, the explanation lacks details on how each configuration functions within the broader experimental setup.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "46u6P85HP6", "reviewer": "Reviewer_ggGQ", "summary": "This paper studies the important problem of “privacy-aware life-long learning” where a model must learn from a sequence of tasks, while supporting unlearning of a task previously-encountered in the sequence, when requested. Task unlearning is defined as a modification to the model to make it indistinguishable from one that was trained on the remainder of the sequence, excluding the task to be unlearned. Overall, this problem formulation inherits several desiderata from standard life long learning, e.g. enabling forward knowledge transfer, preventing backwards interference (reduced accuracy on old tasks due to learning new tasks), while being as memory efficient as possible. In addition, the desire to support task unlearning requests brings additional considerations, like being able to do unlearning in an “exact manner” (guaranteeing that influence from the unlearned task is indeed fully removed), with minimal impact to performance of other tasks. \n\nThe authors propose a new method to address this problem based on an architecture that can be seen as comprising multiple sub-networks. Each task is assigned a mask (based on learnable parameters determining the importance of each parameter in the model for that particular task), and only modifies the parameters indexed by that mask during learning. Each new learning task in the sequence can only choose to modify previously-unused parameters. To unlearn a task, the parameters that had been affected by that task get reset and a light-weight retraining is performed on only the reset parameters, in order to restore performance for other tasks that might have come after the unlearned task in the sequence. This light-weight retraining is done using a buffer of some randomly-chosen data stored from each task seen so far.\n\nThe authors conduct experiments against several baselines from life-long learning and on various datasets. They also conduct thorough ablations to understand the effect of the frequency of unlearning tasks, the effect of the number of finetuning steps, as well as comparisons to an ablation of their system that maintains independent subnetworks within the model but does not facilitate forward transfer.", "questions": "- For the “independent subnetworks without knowledge transfer” ablation, could you explain specifically in what way(s) “Dynamic Sparse Ind.” differs from PALL? It seems both have the learned mask for which parameters to update per task. The authors claim that PALL additionally supports knowledge transfer but it’s not obvious to me what the mechanism is for that, given that each new task only modifies (a chosen subset of) previously-unused weights? I previously assumed that the way that knowledge transfer is realized is that the other weights, even if not directly optimized by the specific task, are still used in the forward pass and therefore still influence the model applied to this task too. Is this correct? And how is this done differently in the “Dynamic Sparse Ind.” variation? Or is there some other difference between the two?\n\n- What is the worst-case sequence of interleaved learning and unlearning requests, w.r.t each metric considered here? Are there cases where the proposed method is no better than naive baselines? It would be great to discuss this in the paper.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper studies an important problem and presents a novel solution. To the best of my knowledge, this work is the first to provide an exact unlearning solution in a lifelong setting of interleaved learned and unlearned tasks.\n\n- The paper is for the most part well-written and easy to follow.\n\n- The experimental evaluation covers various relevant baselines and ablations.\n\n- The proposed method performs well simultaneously in terms of several metrics and desiderata compared to the baselines considered.", "weaknesses": "- It seems that the “independent subnetworks without knowledge transfer” ablation actually performs very similarly to the proposed approach (in Table 3), making it harder to motivate the significantly-more-complex variant for the additional 1% accuracy? Especially given that no confidence intervals are reported there, it’s hard to tell if these differences are significant and whether they justify the additional complexity. Are there perhaps other sequences of tasks / datasets where the “knowledge transfer” would be more “needed”, perhaps making this not the best “benchmark” to showcase the added benefits of knowledge transfer?\n\n- Some clarity issues when describing the method, metrics and setup. Specifically, A) I don’t understand the difference between m_t and \\bar m_t. The authors say the latter are the parameters specifically trained using data from D_t, but I don’t understand this statement. What does “specifically trained” mean? B) When describing the metric A_t, it’s unclear whether the final model checkpoint (after addressing the whole sequence) is used to compute accuracy on all tasks, or is a separate checkpoint (right after training on the particular task) used to evaluate the accuracy on each task? The text made me think the former but the notation a_{i,t} and explanation below made me think the latter. C) ““Regularization-based methods [...] were indifferent to task unlearning instructions, since the original methods are not adapted to unlearning” – how were these applied to unlearning tasks, then?\n\n- Insufficient description (in the main paper) for how various other methods were adapted from the standard lifelong setting to the privacy-aware lifelong setting. It is difficult to fully grok how this adaptation was done and why in that particular way (rather than applying other types of approximate unlearning from the literature, for example).\n\n- It is unclear how one should interpret the A_u metric. Having a network perform at chance level in terms of accuracy does not imply an unlearning guarantee, as the authors also acknowledged. It is not obvious that lower A_u is better (an accuracy that is “too low” can compromise privacy and cause vulnerability to attacks). Further, even when taking the right reference point (for how low accuracy should be) into consideration, accuracy-based metrics correlate poorly with more rigorous metrics for unlearning (see e.g. [1]). The authors seem to acknowledge this but still use this metric in the results and in discussions. It would be great to clarify in what way this information should be used and taken into consideration, given this caveat.\n\n- Missing an important baseline: training sequentially with Differential Privacy (DP). This would yield approximate (but theoretically sufficient) unlearning without the need for resetting and retraining any weights. Various DP baselines can be considered: a DP variant of “Sequential”, where all parameters are updated for all tasks, as well as a DP variant of a sub-networks architecture, like in the proposed approach, where each task gets to choose which parameters to update, but in this case addressing unlearning requests can be done trivially (via a “no op”). Depending on the desired level of privacy, I expect such methods to have lower accuracy, but this feels like an important and relevant baseline to include and capture these trade-offs.\n\n- Missing baselines from the unlearning literature. A plethora of approximate unlearning methods have been proposed (see e.g. [2-4]), that try to post-hoc modify a model to remove the influence of a subset of its training data. It feels like these would be readily combinable with the “Sequential” approach, for instance. \n\n- Building further on the above remarks, it would be very useful to build a comparison between the proposed method (and other exact solutions) with inexact unlearning. While the authors have considered some inexact methods, there aren’t proper metrics considered to empirically estimate the privacy of such methods. The only metric considered for this is the accuracy on unlearned tasks, which is a weak notion of privacy, as discussed above. I fully understand that adding empirical privacy auditing is a substantial amount of additional work and potentially difficult to do all of this within a single paper, but I do view this as a clear piece that is missing, or area for future work. \n\n- Another baseline can be training a model sequentially (without subnetworks), and when unlearning is needed, simply retrain the entire model from scratch (using the data in the buffers). I don’t expect this to perform well in terms of accuracy (and would also be less efficient at handling unlearning requests), but would be a useful data point for comparison; this is more akin to the “retrain from scratch” reference point in the unlearning literature. One may additionally consider an “oracle” version of this, that assumes access to all past data as another reference point (I understand that past data is assumed not to be available in life-long learning, hence referring to this as an “oracle”).\n\n- A limitation of this framework is that “user privacy” can only be addressed (via exact unlearning) if a user’s data is cleanly separated in terms of “tasks”. Other scenarios, where all users participated in all “tasks”, would make this framework unable to support users to request their data to be deleted. It would be great to discuss this.\n\nReferences\n\n[1] Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition. Triantafillou et al. \n\n[2] Eternal sunshine of the spotless net: Selective forgetting in deep networks. Golatkar et al.\n\n[3] Towards unbounded machine unlearning. Kurmanji et al. NeurIPS 2023.\n\n[4] SalUn: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. Fan et al. ICLR 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jbvFkXdJ1f", "reviewer": "Reviewer_KbAJ", "summary": "This paper proposes privacy-aware lifelong learning (PALL). It is lifelong learning because it learns (explicit) tasks sequentially, and it is privacy-aware because it can unlearn any previously learned task. Tasks are learned on a sparse subset of the parameters only, i.e., the rest are masked out. These sparse active-subset masks are stored for each task, where the sparsity ratio is a hyperparameter. This makes it possible to unlearn a specific task by \"removing\" the subset determined by its associated mask, where \"removing\" here means a memory buffer rehearsal on the subsequent tasks of the unlearned task. Specifically speaking, for each subsequent task of the unlearned task (that has not been unlearned so far), we retrain the loss on a memory buffer and additionally regularize the logits to be close to the stored logits in the buffer. This lifelong learning algorith is thus memory-efficient and can preserve privacy by unlearning tasks. Experiments show that this algorithm is sound and performs well in practice.", "questions": "- How do you guarantee that a random sparse subset would not have significant overlap with a previous subset?\n- Seems like memory buffers are an integral part of this lifelong learning algorithm. Do the authors have an idea how it could be done without them?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper is well-written\n- The proposed method is sound and does well on the experiments.\n- Modeling data in terms of tasks is a sound approach.\n- Memory-efficiency is a good plus. Learning a subset of parameters per task is practical and performs well on experiments.\n- Unlearning is possible and done by memory buffer replay with logits regularization. The performance of unlearning is shown empirically to be exact, which is one of the benefits of PALL.\n- A better metric is proposed for measuring the performance of algorithms in sequential task learning-and-unlearning setting. Methods from the literature were adjusted to adapt to this setting, and the authors explained this adaptation well.\n- The experiments are extensive and demonstrates the benefits of PALL over other the methods.\n- The authors discuss a future direction for PALL to be applicable in class-incremental learning.", "weaknesses": "**Main**:\n- The algorithm is not necessarily always memory-efficient since the memory complexity still grows linearly in the number of tasks. In other words, the improvement is a constant, albeit a very small one given that it's stored in 1-bit format. However, some models nowadays are trained with less bits (e.g., 8-bits), so storing masks becomes non-trivially expensive when the number of tasks is very large (say, 50).\n- The tasks are given explicitly. While this might be the case sometimes in practice (e.g., tasks are user data), it still a disadvantage in terms of privacy (e.g., the data of some task are known to belong to some user).\n- Eq. 6. is not novel. It is introduced as a generalized case of DER++ (Buzzega et al., 2020) because the authors say \"$\\beta=0.5$ yields DER++\". Looking at the DER++ paper, it seems to me that their equation is more or less the same with $\\beta$ intact ($\\beta=0.5$ is the default value). I suggest the author rephrase this section to make this clear since it was written in a way that gives the reader the impression that this is an original contribution that generalizes prior work.\n- I would further argue that Eq. 6 is not an elegant remedy for such a privacy-aware algorithm since it requires access to some data from previous tasks.\n- The authors mentions \"strong privacy considerations, where exact unlearning is possible.\" The authors should mention that the unlearning is is found to be exact *empirically* because it could be the case that the proposed algorithm would not be able to *unlearn exactly* on real-world data (e.g., foundational models might not be able to unlearn *exactly* even when using PALL).\n- There are no investigations done on language data. This is especially important since the right to be forgotten is very applicable in this case.\n- Dynamic sparsity does not seem to be very important. Perhaps using static sparsity *and* increasing model size can match the same performance with the same memory cost.\n- Some experiments are not directly related to PALL. For example, Table 2. It is quite obvious that having more data in the memory buffer helps (the authors mention a counter case in the text, but I think the difference here is insignificant and the dataset CIFAR-10 is less real-world-like to make conclusions from).\n\n**Minor**:\n- Eq. 1., uses inconsistent notation for $\\mathcal{L}$ in terms of arguments. Shouldn't contain $\\theta_0$ on the left hand side? I also think it would be less convoluted without the $\\theta_t \\sim$ since it unnecessarily assumes that $\\mathcal{L}$ is stochastic.\n- Eq. 2., $\\mathbf{U}$ and $\\mathbf{L}$ not introduced. I believe they are just flag variable?\n- Eq. 3., the first constraint is an expression without equality/inequality (min ERM). Perhaps \"s.t.\" should be replaced with an inequality and \"min\" should be replaced with \"argmin\".\n- I believe experiments and experimental results should traditionally be in the same section.\n- $\\alpha$ is not clearly introduced, only briefly after Eq. 4. I suggest to reintroduce $\\alpha$ somewhere in the experimental results section  for clarity as it is used extensively there.\n- The choice $\\alpha = 1/T$ provides a fixed memory budget, but this might make comparisons between CIFAR-10 and CIFAR-100 trickier since they have a different number of tasks.\n- The experiments are being compared with methods that are not designed for the problem in this work. While this is not necessarily bad, it makes PALL more likely to outperform them since PALL is designed for this problem, so its better peformance, particularly in unlearning, is expected and not surprising.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DpFoPMa2lV", "reviewer": "Reviewer_iYfp", "summary": "This manuscript focused on a novel setting for task-incremental lifelong learning with selectively forgetting (i.e., exact task unlearning) regarding the data privacy concern. This setting aims to simultaneously realize some challenging objectives, including learning tasks without forgetting, facilitating forward knowledge transfer, selective forgetting of specific tasks, and guaranteeing memory efficiency. To address this challenging task, the authors proposed Privacy-Aware Lifelong Learning (PALL) framework. Specifically, inspired by previous work WSN, this method adopted an architecture-based strategy through knowledge isolation and sharing with subnetwork masks. Furthermore, the experience replay strategy was applied to mitigate potential performance degradation caused by the parameter reinitialization after knowledge unlearning. Empirical experiments on three standard benchmarks were conducted to support the effectiveness in different aspects compared to other baseline methods.", "questions": "1. I noticed that the maximum number of tasks in this manuscript is 40 in S-TinyImage and the maximum unlearning requests $N_u$ is 9 for the S-TinyImageNet 20-split setting. I wonder if the proposed method is scalable for larger numbers of tasks and more unlearning requests, e.g., on the Omniglot-Rotation dataset which has 100 tasks in total.\n\n2. Can the proposed PALL be adapted to the class-incremental setting? If so, what changes should be introduced to make it compatible with the scenario if we don't know the task identity?\n\n3. About the training efficiency. In section 5, the authors only discussed the memory that needs to store the additional parameters along the learning dynamic. The comparisons of the training time among different methods were missed. The proposed method is mainly based on WSN [1]. However, according to my experience in training WSN, I found that WSN could be a little slow since it requires the parameter-level gradient masking within each backpropagation step and I believe this operation also exists in your proposed PALL. Thus, could the authors provide a comparison w.r.t. the training efficiency among different methods?\n\nReferences:\n\n[1] Forget-free Continual Learning with Winning Subnetworks. ICML 2023.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This manuscript considered a novel setting. The data privacy concern is practical in lifelong learning but the exact task unlearning is less explored in this context. The proposed setting is well-defined.\n\n2. The adoption of subnetwork masks provided a unified perspective for controlling catastrophic forgetting and exact task unlearning.\n\n3. The experiments indicated that the proposed method is memory-efficient compared to baseline methods.", "weaknesses": "1. Most parts of this manuscript came from a previous study WSN [1]. Although the experience replay (in section 3.3) was tailored for knowledge recovery after an unlearning step, the new message conveyed from this manuscript is limited.\n\n2. The scalability of the proposed method needs to be further demonstrated with more experiments on other datasets.\n\n3. The current version only considered the task-incremental setting where the task id is known during the inference. I wonder the applicability on other settings, such as class-incremental setting or domain incremental setting.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)