Ascent Fails to Forget
Authors: Ioannis Mavrothalassitis
Pol Puigdemont
Noam Itzhak Levi
Volkan Cevher
Venue: NeurIPS 2025 poster ()
Keywords: Unlearning
Logistic Regression
Gradient Ascent
Primary area: general_machine_learning

Abstract: Contrary to common belief, we show that gradient ascent-based unconstrained optimization methods frequently fail to perform machine unlearning, a phenomenon we attribute to the inherent statistical dependence between the forget and retain data sets. This dependence, which can manifest itself even as simple correlations, undermines the misconception that these sets can be independently manipulated during unlearning. We provide empirical and theoretical evidence showing these methods often fail precisely due to this overlooked relationship. For random forget sets, this dependence means that degrading forget set metrics (which, for a retrained model, should mirror test set metrics) inevitably harms overall test performance. Going beyond random sets, we consider logistic regression as an instructive example where a critical failure mode emerges: inter-set dependence causes gradient descent-ascent iterations to progressively diverge from the ideal retrained model. Strikingly, these methods can converge to solutions that are not only far from the retrained ideal but are potentially even further from it than the original model itself, rendering the unlearning process actively detrimental. A toy example further illustrates how this dependence can trap models in inferior local minima, inescapable via finetuning. Our findings highlight that the presence of such statistical dependencies, even when manifest only as correlations, can be sufficient for ascent-based unlearning to fail. Our theoretical insights are corroborated by experiments on complex neural networks, demonstrating that these methods do not perform as expected in practice due to this unaddressed statistical interplay.

Ascent Fails to Forget
Ioannis Mavrothalassitis' Pol Puigdemont" Noam Itzhak Levi" Volkan Cevher
LIONS, École Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland
{ioannis (ioammis.mavrothen maw.ooma.maooohaaassstti.... pol. pol.puiggemmnttllann. noam. levilleeell.....
Abstract
Contrary to common belief, we show that gradient ascent-based unconstrained optimization methods frequently fail to perform machine unlearning, a phenomenon we attribute the inherent statistical dependence between the forget and retain data sets. This dependence, which can manifest itself even as simple correlations, undermines the misconception that these sets can be independently manipulated during unlearning. We provide empirical and theoretical evidence showing these methods often fail preciscly due this overlooked relationship. For random forget sets, this dependence means that degrading forget set metrics (which, for the oracle, should mirror test set metrics) inevitably harms overall test performance. Going beyond random sets, we consider logistic regression as an instructive example where a critical failure mode emerges: inter-set dependence causes gradient descent- ascent iterations to progressively diverge from the oracle. Strikingly, these methods can converge to solutions that are not only far from the oracle but are potentially even further from it than the original model itself, rendering the unlearning process actively detrimental. A toy example further illustrates how this dependence can trap models in inferior local minima, inescapable via finetuning. Our findings highlight that the presence of such statistical dependencies, even when manifest only correlations, theoretical insights are corroborated by experiments on complex neural networks, demonstrating that these methods do not perform expected in practice due this unaddressed statistical interplay.
be sufficient for ascent- based unlearning fail. Our
1 Introduction
Machine learning models have become an integral part of modern research and development methods, even in sensitive domains such medicine, chemistry, and cybersecurity. This integration has led to growing concerns over data privacy and model maintenance. In this context, the process of selectively removing the influence of specific training examples from a trained model, namely machine unlearning, has emerged as strongly desired capability []] Machine unlearning [2] 3
has garnered significant attention due its diverse applications. ranging from addressing toxic or outdated data 4 5), to resolving copyright concerns in generative models (6-), and improving LLM alignment
The fundamental challenge machine unlearning lies in designing efficient unlearning algorithms that do not degrade model performance.
Given a model he with parameters 0, trained on a dataset D, and a subset F C to forgotten, the goal of any unlearning algorithm is to produce model A that effectively simulates model trained exclusively on the retain set R = D F [I]]. While retraining from scratch on R provides a straightforward solution, it becomes computationally prohibitive large datasets or unlearning requests become more frequent.
'Equal contribution.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

For convex models, efficient unlearning algorithms with theoretical guarantees have been developed [7 which rely on variants of noisy descent algorithms (no ascent steps). However, due the non-convex, non-smooth, and high-dimensional nature of deep neural network architectures, provable guarantees for unlearning are often lacking. Consequently, current methods frequently compromise model accuracy or require substantial modifications to training procedures [18] 19]. A notable recent exception is the rewind method for unlearning proposed by Mu and Klabjan [20], which provides
guarantees for the unlearned model. However, this method is expensive, needing either substantial storage (to retain full model states from previous stages) or significant computational effort (due to the requirement of multiple proximal point iterations).
typically rely on fine-tuning heuristics to transform the initial model hg into an empirically unlearned model h The underlying idea of these methods is to reverse the effect that the forget set JF has had on the model during training. Typically, these methods employ some variant of Gradient Ascent on forget set points and Gradient Descent on retain set points for small number of fine-tuning epochs 23 24 methods as Descent-Ascen (DA) unlearning algorithms.
Many widely used and studied unlearning methods practice 21 22
We will refer to these
Unfortunately, recent evaluations and benchmarks demonstrate that DA approaches can be highly un- reliable 25 21 26 as they neither possess theoretical performance guarantees nor clear mechanisms defining stopping criterion for the unlearning process. Additionally, these methods are extremely sensitive to fine-tuning hyperparameters, most crucially the learning rate and the fine-tuning duration.
In this work, we identify an overlooked crucial obstacle for machine unlearning that is not taken into account by DA methods. Concretely, we show that the existence of data dependencies between samples in the forget and retain sets can lead to poor unlearning performance in some cases, as well as complete breakdown, even in convex settings.
Our main contributions can be summarized as follows:
1. We start by empirically showcasing that DA-based methods fail in practical settings under robust evaluation and discuss limitations of previous methodologies.
2. Supported by our empirical findings, we first show theoretically that unlearning random forget sets is impossible without causing model degradation, as unlearning random sets is equivalent in distribution to unlearning samples from the population data distribution.
3. We move beyond forget and retain sets which share clear statistical dependencies to ana- lyze the simple setting of multi-dimensional logistic regression, where we show inter-set correlations lead to DA failure modes.
4. In our logistic regression analysis, we differentiate the impact of DA unlearning based on forget set size. We specifically show that for certain forget set sizes, DA can be harmful to the model, even when employing arbitrary early stopping.
5. Finally, using dimeensiiional examples, we demonstrate how DA can lead the model to suboptimal local minima, which do not align with the minima achieved through retraining.
Notation: We will use the following notation. We use uppercase bold letters for matrices X E R. lowercase bold letters for vectors æ E T and lowercase letters for numbers E IR. Accordingly, the 7th row and the element in the i, position of a matrix X are given by æ; and Tey respectively.
We use the shorthand [n] (1, ... .n. for any natural number n. Let Il (...) R TR - {0, 1} such 1, otherwise for æ * y, ((x.)) = We will denote our model with parameters 0 as
that 1 [xx,x)
he : _2d + IR. We define a training dataset of size [D] as a set of samples and labels (<x,,)))
D. composed of a "retain" set R and "forget" set F such that (D) = |R] + [FL. We take "ascent" optimization on a sample to mean computing the gradient update w.r.t. to loss Vo and flipping its sign when updating the model parameters.
2 Related Work
Unlearning methods can be used to either remove particular samples [I 27 12, 18), or to remove subsets of the data which share certain underlying features, captured by abstract concepts 31. In this work, we focus on the prior, though we believe some of our results may be extended to the latter setting. Exact unlearning methods [18] offer theoretical guarantees but often sacrifice accuracy, leading to widespread adoption of approximate methods in deep learning.
Machine unlearning:
These approximate approaches are evaluated through membership inference attacks [22 32 25) and

---

backdoor removal capabilities A. As Thudi et al. [35] note, meaningful evaluation must focus on algorithmic behavior rather than individual models due to deep learning's stochastic nature. For a review of open problems in machine unlearning, see 34 and references therein.
Unlearning approaches in deep learning: Current approaches primarily use gradient-based methods, including partial fine-tuning (32). AD combinations [21], and sparsity-regularize fine- tuning 35 Alternative methods employ local quadratic approximations [22 36 or influence
functions 37 One of the most used unlearning methods, SCRUB (25) fine-tunes models using KL divergence objectives, but faces similar underlying challenges as other methods. The approach presented in Georgiev et al. (38 introduces predictive data attribution approach with good unlcarning quality under robust evaluation, although it raises some scalability concerns if we account for the full cost the method. In this work we focus on DA based methods. Georgiev et al. (38 also observe empirical failures of Gradient Descent/Ascens style updates in certain settings. We attribute these failures to inter-set correlation between forget and retain data, and contribute controlled experiments disentangling random from structurally correlated forget sets, together with theory in non-linear models showing first-step detriment of DA independent of early stopping; see App. B
3 Ascent Methods Fail in the Wild
To evaluate the quality of unlearning rigorously, we adopt the KLoM (KL Divergence of Margins (38 metric, which quantifies the distributional difference in predictions between the unlearned model and the oracle model. KLoM measures the KL--Divergence between the classifier margin distributions of 100 unlearned models against 100 Oracle models. A KLoM score approaching zero, the lowest possible, indicates near-perfect unlearning.
In our main experiments, we examine two gradient-based unlearning approaches which are commonly used as baselines: Gradient Ascent (GA) which performs steps in the direction of the gradients of the model on forget set, and Gradient Descent/Ascen (GDA) which adds descent steps on the retain set after the initial ascent steps, for each epoch. We conduct these experiments using ResNet-9 models on Cifar- 10 339 under forget sets of different sizes and properties. Fig. T Tillustrates our results on selected forget set. We observe that both GA and GDA methods either fail to substantially move away from the pretrained initialization or severely degrade model performance. Our choices in model,
dataset, forget sets and results are consistent with the values reported in Georgiev et al. 38
These outcomes highlight an important limitation in the empirical evaluation of GA based unlearning methods. It is necessary for hyperparameter selection criteria to be defined, ideally, before deploying the method or at least without measuring at the final target metric. It is not fair to do an instance- specific selection of the best run after having seen the evaluation due to bias. For a small enough forget set and a large enough grid of runs with different hyperparameters we could trick ourselves into a false sense of unlearning even with vanilla GA. This problem is showcased in Fig. and is rooted in the missing targets problem (25 38), which amounts to the difficulty of not having a target stopping value for GA based unlearning optimization procedures. On top of that, different points seem to unlearn at different rates (38] which suggests that such stopping value would need to be soint-specific.
We also observe that the difficulty of unlearning varies greatly depending on the specific forget set selected, as shown in Fig. 3 In general, we find GA and GDA methods to be fragile. The extreme sensitivity to hyperparameters, unclear stopping criteria for Gradient Ascent, and substantial computational costs in using Gradient Descent on the retain set to fix models, severely restrict their practicality. Fundamentally, performing gradient ascent on individual points is not aligned with the core definition of unlearning. making these approaches unsuitable for reliable and consistent machine unlearning in real-world scenarios. In the Appendix, we include the methodology details for forget sets, KLoM, hyperparameters along with additional results more forget sets, models (ResNet- 18 40 and datasets (ImageNetLLvvig--I1 17 42).
Motivated by these results, the following sections aim to demonstrate that the underlying statistical data dependencies may be a central cause for the typical failure modes of DA based unlearning methods, both in general, and in some useful tractable settings.
3

---

Forget Set: 100 highest 1st PC (0.2%)
12
Ascent
Ascent/ Descent
Pretzsin
Validation KLoM
8-
Breaks Model
1.00
6-
0.75
Relative Cost
4
0.50
2
Does Not Move
0.25
0
0.00
12
Forget KLoM
Figure 1: Ascent Fails to Forget. We apply Gradient Ascent and Gradient Descent/Ascent to Pretrained models to unlearn a selected forget set containing points the first Principal Component (PC) of the influence matrix from 10. KLoM scores (x-axis, y-axis) measure the quality of unlearning on a given set by comparing the distribution distance between unlearned predictions and Oracle predictions (0 means perfect unlearning *) We measure KLoM values over each data-poin in a set and report the 95th percentile in each group. Different (x/y) points in the plot represent results for different unlearning method hyper-parameters. The colors indicate what is the relative cost of an unlearning method when compared to fully retraining the model. Pretrained model Oracle the validation set but very different the forget set. On such set,
(o) is similar unlearning with Gradient Ascent or Gradient Descent/Ascent either breaks the model or does not move much from the Pretrained starting point, find this behavior be consistent in most sets. Forget set selection and KLoM score metric follow Georgiev et al. 38 Further details on method and evaluation hyper-parameters can be found in the Appendix.
Gradient Ascent on Forget Set: 10 random samples (0.02%))
12
10-
VViibattin
Proteeis
Foggst KLAM
Epocha
Figure 2: The Ascent Forgets Illusion. The left plot shows KLoM scores of Gradient Ascent when unlearning just 10 random samples (axis and points follow Fig. D Some runs (-- seem achieve unlearning without breaking the model. On the right, we present the average KLoM between retain, validation and forget sets (y-axis) along time of unlearning (x-axis). We observe that in order for Gradient Ascent to unlearn such (easy) sets in practice, one would need to (i): select the learning rate, (ii) know when to stop fine-tuning.
4 Unlearning and Random Sets
A natural starting point for understanding how data correlations influence the unlearning process is that random forget sets. If forget set is selected uniformly at random from the original set, evident that the two sets would have high statistical dependence between them. Therefore, we would naturally expect that metrics measured in the forget set would indistinguishable those of the test set and very close to those of the retain for the oracle. We can state this formally in Lemmal I for

---

Porort sumplex
Sec: 7nd (0.2%)
K. 12
0.35
Foeget Klach
Figure 3: Diffferett Unlearning Difficultiess We present the KLoM scores of Gradient Ascent and
Gradient Descent/Asent when unlearning over different forget sets (axes and points follow Fig. I In general, the majority of runs either do nothing or break the model. Empirically, we find highly important points (left) to be the hardest unlearn with zero realizations showing any unlearning signs at all. Random samples (center) show some Gradient Ascent runs improving the forget KLoM but with significant degradation in the models. Finally, for set with second PC points (right) observe some Gradient Descent/sscett runs improve the forget KLoM without breaking the model but high cost, around 25% of retraining Oracle for unlearning 0.2% of the data.
accuracy; the same reasoning extends to other metries (e.g., regression losses) after modifying the metric definition. The proof of Lemma I can be found in App. C
Lemma 1 (Random Sets). Given true distribution of samples Pr and a forget set F chosen uniformly at random from the dataset and a oracle model with parameters 6 then the probability that the accuracy on the test set AccT and the forget set Acc diverge from one another by more than is upperbounded by the following inequality:
P (|AceT - AcCF 2 S 2exp (-2)Fle2).
Lemma Cermma[sugeet suggests that any unlearning method which successfully approximates the oracle should result in a model which performs equally well on both the forget set and test set. Therefore, an unlearned model with poor forget set performance will statistically diverge from oracle model, whose forget set accuracy reflects the accuracy of the test set and is high for modern machine learning tasks. Consequently, methods based on DA that explicitly degrade metric the forget might be more harmful rather than beneficial (this critique does not apply to non- non-Gradient Descent/A Aioccent/Acccnt approaches such as collluence-function or certified-uneaaninn methods, which do not aim to worsen the forget-set metric). This raises the following question:
(I) Do data dependencies, in general, cause DA methods have detrimental effect the models, without actually unlearning?
While the answer to this question under statistical dependencies is apparently positive, as stated in Lemma [ when considering limited data dependencies, the answer becomes more convoluted. Before proceeding to the discussion regarding this, we would like to point out that "good" unlearning algorithm should not be harmful to the model regardless the input forget set F, even for random sets.
In the following sections, we analyze several tractable scenarios. We find that in many cases the answer to (I) is positive, implying that data dependencies do, in fact, cause DA methods to have detrimental effect on the models.
Models Diverge from Retraining Solutions Under DA Unlearning
We begin our study with logistic regression in digensmimesion,l, nearly orthogonal setting where relations are only between samples on the same dimension. We then generalize to cross- diosediimesiooal correlations, and finally study nonlinear example in low-dimensions small fixed dataset.
5.1 High Dimensions: Correlated Data Causes Diverging Solutions in Logistic Regression
Here, we study the problem of binary logistic regression with a ridge parameter X, and weights w on nearly orthogonal data in d dimensions. Based on the work of Soudry et al. [4), we use the exponential loss l, hox))) more tractable proxy for the logistic loss. The pre-training (D),
5

---

the following retraining (R) and GDA optimization methods (DA) will minimize their respective losses
D
X
R
A
LD =
Ve (w,)))
LR. =
(w.
+
DD]
2
R
2
(I)
LDA
1
(w..))))
(w.x)))
2 1/w1B2-
|R
5.1.1 Data Correlations on Single Dimension
We start from the case of a semi orthogonal dataset. Using the following assumptions:
Assumption 1. The data is separable into orthogonal sets foror each coordinate j. More specifically, after jointly permuting samples and coordinates, the data matrix is block diagonal: each block corresponds to samples S that have nonzero entries only on a disjoint coordinate set Cy. Samples from different sets are orthogonal; within a set, samples may be correlated.
Assumption 2. For coordinate j it holds that for all samples i with Fi,j + 0. y1 Fi.j = 1.
These assumptions correspond to a dataset in dimensions where there are sets of samples on orthogonal axes to one another. As a result, data points that lie in different sets Sj are perfectly orthogonal and uncorrelated; however, data points that lie in the same set may be correlated with one another.
Recall our hypothesis that data dependencies can cause DA methods to degrade model metrics, instead of converging to an oracle model, we will pick a subset of a set Sj as our forget set. This will allow for a simplistic analysis while testing the hypothesis for highly correlated forget set.
Let [R,] the size of the retain set for samples with Ii, # O, then in order to model the behavior of the minimizers of Eq. (I). for forget sets of different sizes, define the jth forget set fraction size as Fy = a [Ryl- A simple example of this setting can be a set of retain points of æÿ- = 1, Mr = 1 and set of forget points of 2 -1, 1/ -1, where we practically requested remove all (or some) of the negative samples. The effect of unlearning a forget set on a particular coordinate axis j. can then be shown to obtain closed form solutions as given by Lemma [ proven in App. [p2
Lemma 2 (Closed Form). Let wP. w. and with be the jth coordinate of any local minima/maxima for the logistic regression problemns defined in Eq. (I), then they admit the form:
(1 + +)))
|Rg] (
wff = W a (R// (A//FIIR
wf=W = W
.. W
A|DI
A|R
where (z) corresponds to the Lambert-W W function, the solution to = = (1))
It follows directly from Lemma 2 that by changing the value of a, which determines the ratio of the size of the forget set to that of the retain in this coordinate, the solutions will be ordered by their magnitude. Coneretely, Lemma 3 shows that the DA solution is always farthest away from the oracle solution. For example, in ID, "farthest away" means that (wpx w and (w - -wy) have opposite signs, so wa and w lie on opposite sides of the pre- pre-trained solution wi:: therefore any step toward uiDA moves the model away from the oracle wR Meanwhile, the oracle and pre-trained solutions remain close and more importantly the DA solution and the oracle solution lie in opposite directions with respect to the initial solution of pre-training wp. This observation implies that performing DA in this setup always converges away from the oracle solution, thus doing nothing at all is better strategy than DA. The aforementioned observation can be formally decomposed lemmas. We prove Lemma 3 in App. which gives formal statement regarding the fact that the minima of DA and the oracle are in opposite directions with respect to the minimum of the intial dataset D.
Lemma 3 (Divergence Logistic Regression). Let wp w and wD the j coordinate of the conver- gence point for the logistic regression problem for the original set D, the retain set R. and the Descent Ascent method respectively. Then for range of a we have that: (wDA - -w?) (w) R 2 0.
We defer the reader to App. Flror the exact range of a, for which Lemma Lemma let us point out that the lemma holds for < F F1) this means that if we were working a purely dimensional

---

this case the correlation dataset, this lemma would always hold. Lemma answers our original question of whether data correlations cause DA methods harm the model in the positive. Before proceeding to the study of higher dimensions, we would like to comment on the stability of the process of unlearning under DA methods.
Stability of DA methods: We begin by characterizing the distance between the different stationary points for the three problems.
Conmaaprovidee an upperbound on the distance between the oracle solution and the initial solution for D. Its counterpart, Lemma 5 provides lower bound the distance between the oracle solution and the DA solution. The proof for Lemma 4 can be found in App. G while the proof for Lemma lies in App. H
Lemma 4 (Distance Growth). Let W3 wy the jth coordinate of the convergence point for the logistic regression problem for the original set D and the retain set R respectively. It holds that the distance
[R] AR,D |w] w In ((1 ()) [D)
for any X >> 0 and 0.
Lemma 5 (Distance Unlearning). Let wT w the jth coordinate of the convergence point for the logistic regression problem for the retain set R and the Descent Ascent method respectively. It holds that for for a 2 [F|/( the distance AR, = |w] wPa1 Z Wo (/R,)/ (A(RR)
Employing Lemma and Lemma 5] one derive the following Corollary.
Corollary 1. As the ridge X + for a + [ we have that AR,D - 0 and AR.DA + oc.
Cor. [ demonstrates how unlearning using DA very volatile and even few steps of the method can cause the model to diverge.
A possible stabilization effect of iterative DA: So far, have focused on the behavior of minimizers of Eq. I which describes a simultaneous descent-ascent algorithm. In practice, however, iterative methods are typically used, where one first performs a step of ascent on the forget set, followed descent on the retain set. In D.3] we show that for small learning rates 1) + 0, the iterative method nearly identical to the simultaneous update. Namely the derivative used for the update rule is
30 2-1 + + w/ 17
(- [R R
a
[R, c + 2Aw')
c
F
where the only difference is factor of in front of the regularization that differs from the normal DA loss. We have omitted a term which is of the order of O (17²), since the solution, should it exist has w³ small and a term with v²² + 0 has negligable contribution.
The leading correction term O (17²) which was omitted in the update rule above stops the algorithms solution AA from diverging, since the term is of the form
R2, FI
R2 F
2a
2w/ 1)2 Aw
which increases for larger w This addresses stability concerns; however, it does nothing to remedy our main concern raised in Lemma regarding the harmful effect of these methods on the model.
5.1.2 Cross Dimensional Data Correlations
In the previous section we studied the case where our samples are fully correlated, since they existed in a single dimension. In this section we will consider the two dimensional case where we have two
of samples S, and Sj. which have values I; (0, (0,...,0, O....., 0) and z (0. ... O, 1, O..... 0) respectively. We will consider the case where the samples of S; are all in the retain set, while the samples Sy are all the forget. between the samples in the forget and the retain set depends on and therefore this allows to do parametric study of the effect of correlation between the forget and the retain on the performance of DA based methods. In similar fashion to the I dimensional case we will consider that the forget set [Ftyl = R. where Fig: Ra, the forget and the retain over the i, dimensions, respectively. In order to facilitate the analysis we will change the coordinate system only for the i and the coordinate
7

---

0.5
FT
0.4
20%
FI
10%
0.3
0.2
R
0.1
0.2
0.4
0.6
0.8
1.0
Figure 4: Cross dimensional data correlations lead DA to failure for a certain range values. We present the range of function of the correlation for which detrimental. The (--) lines represent the minimum for which the coordinates of the original model become bigger than the coordinates of the DA unlearning algorithm and with the (-) the maximum for which the coordinates the oracle are bigger than those of the original model.
guarantee that DA is
to wi + ewj and == w,e + wj. Let xR yy the coordinates for the oracle model stationary point, up, for the pretrain model and n DD for the DA unlearning scheme, we can give the following characterizations:
Lemma 6. The closed form solution for the stationary points for the retrain set is given as:
[1+)))
2c w +
(1++
R
y
A/R|
A|R|
Lemma' 7. For the stationary points of the original set, one can derive the following ranges.
W RRss AID)
26
a(1 + +2 (
(wt (1++2)|
((1 + +2²) + +20c)
I Ex S
+W
1+e
A/DI
A/DI
[a(1 + e²) (r,5l
[Rs.g (xID)
w
S W
(Ze + ae1 (1(++)1))
A/D|
Lemma 8. For the stationary points of the model trained by DA methods can derive the following ranges.
P S W
R A|R]
(1 (++e) e2)
[Rg a2E A|
pa S W
R R
2e
RaJ A|F
a(1 + 2(1+
While the problem becomes more complex in this case and to our knowledge it is not possible to compute exact solution, the above Lemmas provide enough information for purpose. The proofs for all these Lemmas can be found in [.I In similar fashion to the dimensional case we would like show that there exists reasonable a, for which we have that (I. xP)) (x
and at the same time (y y yP) (yD
DA 2 0.
Lemma 9. For D>DA max
14r2 2:
LFI2 [R[[D++ IHE
2c
FF D
have that x.D > DA
and that yd 2 DM.
Lemma 10. For S R>D min (a a R>D R>D with 0 a
R>D
R>D) we have that R > D and that y > yP
We omit the exact values of a R>D and a R>D which can be found in App. Lemma and and Lemma 10 Since the range of e for which (x y > (x P. yy)) 2 (A PA cannot be resolved analytically, we show numerically in Fig. Ataat this range is typically large, and broadens as the fraction of samples be forgotten increases, while the relevant window of correlation strength is wider for smaller correlation.
1.2 along with the proofs

---

Loss
Descent Ascent
Lone
Forget set
Lib
Retraining
Forget
2
2
Figure 5: Unlearning certain forget sets leads to the wrong decision boundary under GDA. Left: We show the MSE loss landscape for a pretrained model on the problem described in Sec. 5.2 We denote as (x) ) the global minimum, while (o) is the local minimum. Right: The effective loss landscape observed in the GDA problem (top) and the retraining problem (bottom). The combination of these results shows that retraining keeps the model in the same global optimum as the pretrained model, while GDA chooses the local minimum. This is clearly manifest in the decision boundaries favored by the different methods, denoted in dashed lines. Next to the contour plots present two dimensional illustrations of possible decision boundaries between the samples labeled as negative (-) and positive (+), while the forget set are the two positive points shaded in gray, described in
Sec. 5.2 We show the decision boundaries for both GDA (right top) and retraining (right bottom). These conclusions concern the minimizers of fixed objective and thus do not depend on training dynamics (e.g., step size); see App. for details.
5.2 Low Dimensions: Descent-Ascent Favors The Wrong Solutions
While our previous theoretical analysis demonstrates that DA methods can be harmful to the model, fails to demonstrate a final concern about these methods, we would like to raise. Is it possible to remedy the harmful effects of these methods through finetuning the retain afterwards?
The answer that we give to this question unfortunately not always, for neural networks or in general non-convex function classes. To demonstrate this let us consider binary classification problem using two dimensional kemel,, with labels Y/4 E [-1,1], data composed of x; (I,, xx) and Mean Squared Error (MSE) loss with ridge regularization À E IR+ The network is taken to be sigmoidal network with two parameters (a, b), such that its output is hg(x;) = aaaz + bx?), where o (z) = 1/(1 + (1++2)/2)
We choose 4 samples in the configuration: D X2,
(), (1,1,),,1,))...... (3, 9), (4, 16)
with labels {41, //2 V3, 314 1,,,,,,-1, 1}, respectively. order model the effect of multiple points clustered together, we give each point a different weight in the loss function, such that
C
1 D
Σ
og4 + 101
where é, are the single sample loss functions, and {aj a2 03, 03,0, = (5, 4,1,4 represent the number of points clustered together, illustrated in Fig. where X = 0.1. This means that the chosen to
effective number of points that the classifier sees is Σ, Cr The data configuration illustrate the failure mode of DA, while the dataset selection is arbitrary the key mode of failure is the high correlation between the forget set and a subset of the retain.
Suppose we would like to unleam two of the positive samples positioned at X₃. Retraining would correspond to simply setting a4 = 2, and applying gradient descent. Notice that this provides little to no change for the minima location and the contour lines between the original dataset D and the retraining set R. contrast, Performing GDA would amount to setting a:4 = 0, since two points will contribute the exact opposite gradient the other two at the same position, effectively crasing them.

---

We find that this example can be simply understood by counting arguments: since the original dataset contains effectively 6 negative samples and positive samples, the optimal decision boundary is given by the separating plane which correctly classifies the largest number of samples.
The pretrained model is optimal when X1, X2 and X4 are correctly classified, while mislabeling X3 (13 correct, I incorrect). Retraining simply reduces the weight of X,, and keeping the same plane still preferential (II correct, incorrect). However, performing GDA of the points at X4 to cancel the other half, so it optimal to re-orient the decision boundary so that all samples are correctly classified (10 correct, 0 incorrect), while in reality, the algorithm has been tricked into finding suboptimal solution (10 correct, 2 incorrect).
the gradients of half
The qualitative analysis of this two-dimensional example shows that certain choices of forget sets that are highly correlated to the retain can lead to irreversible model degradation when using DA.
Conclusions
While our findings highlight significant challenges in current ascent-based unlearning methods, we believe that they are instructive for the construction of safer future methods. The weaknesses we identify primarily stem from ascent disregarding the data dependencies between the forget and the retain set. Future research on ascent based methods should take these dependencies into consideration. Our findings also suggests that methods based on rewinding 20) stochastic methods based on noise 44 can be valid alternative schemes when being agnostic on the dataset properties.
Acknowledgements
We would like to thank Roy Rinberg and Gal Vardi for insightful discussions.
This work was supported by Hasler Foundation Program: Hasler Responsible AI (project number 21043). Research was sponsored by the Army Research Office and was accomplished under Grant Number W91 199-24F-24111 1--0488 This work was funded by the Swiss National Science Foundation (SNSF) under grant number 200021 205011. Any opinions, findings, and conclusions or recom- mendations expressed in this material are those of the authors and do not necessarily reflect the views of the sponsors.
10

---

References
[1] Antonio Ginart, Melody Y. Guan, Gregory Valiant, and James Zou. Making forget you: Data deletion in machine learning. In Proceedings of the 33rd Conference on Neural Information Processing Systems (NeurIPS 2019), 2019.
[2] Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE Symposium on Security and Privacy, pages 463-480, 2015. doi: 10. 109/SP.005..5..
[3] Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning, 2020. URL
httpss//aaxiv: wwwpxii.orggaaae /tt////b//11...//1 1ttp//991..031111 03817
[4] Martin Pawelczyk, Jimmy Z Di, Yiwei Lu, Gautam Kamath, Ayush Sekhari, and Seth Neel. Machine unlearning fails to remove data poisoning attacks. arXiv preprint 172.11 2024.
[5] Shashwat Goel, Ameya Prabhu, Philip Torr, Ponnurangam Kumaraguru, and Amartya Sanyal. Corrective machine unlearning, 2024.
[6] Ken Ziyu Liu. Machine unlearning in 2024, Apr 2024. URL https://aa stanf edu/ "k unleannigg
[7] Guangyao Dou, Zheyuan Liu, Qing Lyu, Kaize Ding, and Eric Wong. Avoiding copyright infringement via machine unlearning, 2024.
[8] George-Oetavian Barbulescu and Peter Triantafillou. To each (textual sequence) own: Improving memorized-data unlearning in large language models, 2024. URL htttp::/aaxii: org/abs/24055 03097
[9] Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, Gabriel Mukobi, Nathan Helm- Burger, Rassin Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Adam Khoja, Zhenqi Zhao, Ariel Herbert- Voss. Cort B. Breuer, Samuel Marks, Oam Patel, Andy Zou, Mantas Mazeika, Zifan Wang, Palash Oswal, Weiran Lin, Adam A. Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Talley, John Guan, Russell Kaplan, Ian Steneker, David Campbell, Brad Jokubaitis, Alex Levinson, Jean Wang, William Qian, Kallol Krishna Karmakar, Steven Basart, Stephen Fitz, Mindy Levine, Ponnurangam Kumaraguru, Uday Tupakula, Vijay Varadharajan, Ruoyu Wang, Yan Shoshitaishvili. Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks. The wmdp benchmark: Measuring and reducing malicious use with unlearning. In International Conference on Machine Learning (ICML), 2024.
[10] Yuanshun Yao, Xiaojun Xu. and Yang Liu. Large language model unlearning, 2024. URL /ttps://arxiv.org ab1/ 10683
[11] Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In IEEE Symposium on Security and Privacy 201),
[12] Seth Neel, Aaron Roth, and Saeed Sharrii-Malvjjerdl Descent-to-delete: Gradient-based methods for machine unlearning. In Proceedings of the 32nd International Conference on Algorithmic Learning Theory (AL.T), 2021.
[13] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, 2021.
[14] Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. Approximate data deletion from machine learning models. Proceedings The 24th International Conference on Artificial Intelligence and Statistics (AISTATS), 2021.
[15] Ananth Mahadevan and Michael Mathioudakis. Certifiable machine unlearning for linear models, 2021.

---

[16] Vinith Suriyakumar and Ashia C Wilson. Algorithms that approximate data removal: New results and limitations. Advances in Neural Information Processing Systems (NeurIPS), 2022.
[17] Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens van der Maaten, Certified data removal from machine learning models, 2023. URL https: ftttp:://axxivvor///bba.. 1911. (2000.03000
[18] Lucas Bourtoule, Varun Chandrasckaran, Christopher A Choquette-Choo Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In IEEE Symposium on Security and Privacy (SP), 2021.
[19] Xuechen Li, Florian Tramèr, Percy Liang, and Tatsunori Hashimoto. Large language mod- els can be strong differentially private learners. In International Conference on Learning Representations (ICIRR), 2022.
[20] Siqiao Mu and Diego Klabjan. Rewind-to-deled Certified machine unlearning for nonconvex functions. arXiv preprint 240X::2200.09778, 2024.
[21] Meghdad Kurmanji, Peter Triantafillou, and Eleni Triantafillou. Towards unbounded machine unlearning. In Advances in Neural Information Processing Systems (NeurIPS), 2024.
[22] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9304-9311 2020.
[23] Meghdad Kurmanji. Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unboun- ded machine unlearning. 2023. htttltttts:///rit/ii
2232 09880
[24] Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponnurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning, 2023.
[25] Jamie Hayes, Ilia Shumailov, Eleni Triantafilou,, Amr Khalifa, and Nicolas Papernot. Inexact unlearning needs more careful evaluations to avoid false sense of privacy, 2024.
[26] Martin Pawelczyk, Seth Neel, and Himabindu Lakkaraju. In-context unlearning: Language models as few shot unlearners, 2023.
[27] Yinjun Wu, Edgar Dobriban, and Susan Davidson. Deltagrad: Rapid retraining of machine learning models. In International Conference on Machine Learning (ICML), 2020.
[28] Shauli Ravfogel, Michael Twiton, Yoav Goldberg, and Ryan D Cotterell. Linear adversarial concept erasure. In International Conference on Machine Learning (ICML), 2022.
[29] Ronen Eldan and Mark Russinovich. Who's 's harry potter? approximate unlearning in llms. arXiv preprint /0.02:23/0.022238, 2023.
[30] Nupur Kumari, Bingliang Zhang, Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-imane -maae diffusion models. In IEEE/CVF International Conference on Computer Vision (ICCV), 2023.
[31] Zexuan Zhong, Zhengxuan Wu, Christopher D Manning, Christopher Potts, and Danqi Chen. Mquake: Assessing knowledge editing in language models via multi-hop questions. In Confer- ence on Empirical Methods in Natural Language Processing (EMNLP), 2023.
[32] Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponnurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning. arXiv preprint Stti:22001.066400 2022.
[33] Anvith Thudi, Hengrui Jia, Ilia Shumailov, and Nicolas Papernot. On the necessity of auditable algorithmic definitions for machine unlearning. In USENIX Security Symposium, 2022.
[34] Fazl Barez, Tingchen Fu, Ameya Prabhu, Stephen Casper, Amartya Sanyal, Adel Bibi, Aidan O'Gara, Robert Kirk, Ben Bucknall, Tim Fist, Luke Ong, Philip Torr, Kwok- Yan Lam, Robert Trager, David Krueger, Sören Mindermann, José Hernandez-Oran Mor Geva, and Yarin Gal. Open problems in machine unlearning for safety, 2025. URL hRLpsttss: h/app::/aaae //arxiv. org/obga /bs// 25011 04952)
12

---

[35] Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsity can simplify machine unlearning, 2024. URL https
7/arxiv. org/ abs//304....././/////////////a// 04934
[36] Guihong Li, Hsiang Hsu, Chun-Fu Chen, and Radu Marculescu. Fast-ntk: Parameter-efficient unlearning for large-scale models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 227-234, 2024.
[37] Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine learning of features and labels. arXiv preprint arXiv:2108. 11577, 2021.
[38] Kristian Georgiev, Roy Rinberg, Sung Min Park, Shivam Garg, Andrew Ilyas, Aleksander Madry, and Seth Neel. Attribute-to-dellte: Machine unlearning datamodel matching, 2024. URL http:::/::/aat http::///axvvvv.o org/ abs 2410 23232
[39] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
[40] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CoRR, abs/1512.03385, 2015. URL http: htap:://arxxe /wwpxi/vvvv////////////aa///aaa. org/ abs 03385
[41] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognilion, pages 248-255. leee, 2009.
[42] Shibani Santurkar, Dimitris Tsipras, and Aleksander Madry. Breeds: Benchmarks for subpopu- lation shift. International Conference on Learning Representations (ICLR), 2021.
[43] Daniel Soudry, Elad Hoffer, Mor Shpigel Nacson, Suriya Gunasekar, and Nathan Srebro. The implicit bias of gradient descent on separable data, 2024. URL htttp://////
1710.10344
[44] Eli Chien, Haoyu Wang. Ziang Chen, and Pan Li. Langevin unlcarning: A new perspective of noisy gradient descent for machine unlearning. arXiv preprint crXiv:2401.1037/1 2024.
[45] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1 86(1 (0:2272778-2224 1998.
[46] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv: (.f.:v1700.07444 2017.
[47] Roy Rinberg, Pol Puigdemont, Martin Pawelczyk, and Volkan Cevher. Data-unlearn- Making evaluating data unlearning easy. In Proceedings of the ICML 2025 Workshop MUGen (Poster). OpenReview.ner Jun 2025. WtRLhhttps////peeeeee Yf Poster; published on OpenReview.
net/ net/forumiid=
13

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: All of the main claims presented in the introduction and the abstract have seperate section where they discussed and shown in the main and supporting more extensive sections in the appendix.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: There dedicated section on the appendix that discusses the limitations, namely Appendix A, due to the lack of space the main part.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "I "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play import- ant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and prool's
Question: For each theoretical result, does the paper provide the full of assumptions and complete (and correct) proof?
14

---

Answer:
[Yes]
Justification: All of the assumptions for the theoretical results are clearly stated before presenting them in the main part and their proofs are in the respective section of the appendix.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proof's provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We include the experimental details in the corresponding section of the appendix, along with the zip file of the code that contains readme for reproducibility purposes.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
15

---

5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: We included the code along with instructions for its reproducibility. All the datasets are licensed for non-commercial research and educational purposes, which we reference in the paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
hniips.cc/public//ree
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: In the corresponding section of the appendix there is an extensive description the details for the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We discuss the statistical significance of the experiments on the appendix. We utilize previously established methodology for aggregation of the results in the main body.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confid- ence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
16

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide the relevant information in the experimental section of the ap- pendix.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't itdn't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: We have read the code of ethics and complied with all of each requirements, such as anonymity.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer:
[Yes]
Justification:
We discuss on section on the Appendix the potential social implications of work.
Guidelines:
17

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e-g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: The models and datasets used in the paper are standard in general machine learning and don't 't pose such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All of the models and datasets are licensed for con-commercial research and educational purposes and the original creators of the assets are properly credited and acknowledged.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
18

---

The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thoode com comddatasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The does not release new data or model assets. The code is included, docu- mented and anonymized.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
19

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does not involve LLMS as any important, original, non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy (https://neurips: hatt::///earrrpsscc//oooerrreee/ cc///oofeeeeeecs//22/////.. for what should or should not be described.
20

---

A Limitations
Limitations: A key limitation in our theoretical results is their simplicity, both in the model analyzed as well as the methods, for which the analysis is done. The proof does not explicitly prohibit more complex models or methods from resolving this issue. We believe, however, that as far as models go simpler models could be nested in more complex ones, leading to this detrimental phenomenon. For developing more complex methods based on ascent we believe that still someone has to take correlations into consideration, given our findings. Extending our theoretical results to multi-layer networks would be valuable but is technically challenging. Quantifying which correlations are most harmful remains open. We propose using an influence function cross influence matrix between forget and retain sets as tractable proxy, and testing whether Gradient Descent/ Ascent unlearning degrades as its spectral norm increases.
B Discussion
Q: Do training dynamics (e-g,, learning rate and regularization) affect the locations of the optimal minimizers and the resulting decision boundaries in Fig. Vig.5land and Sec.
A: No. Our statements concern the optimization landscape of a fixed objective and the set of its minimizers. Training dynamics (including learning rate and optimizer trajectory) affect the path and speed of convergence, not which points are minimizers, as long as the objective is unchanged. Adjusting the ridge parameter shifts minimizers radially (toward/away /away from the origin) without altering their relative positions; hence the decision boundaries in Fig. [ and the conclusions in Sec. 5.2 are unaffected. That said, using different learning rates for the retain and forget sets (i.e., the ascent and descent steps on DA) effectively changes the objective itself. In this case, the new objective becomes implicitly weighted by the ratio of those learning rates. While one could tune the weighting so that the particular case in Figure 5 no longer appears problematic, a similar counterexample can always constructed for any ratio. For instance, the forget set is updated with twice the step size of the retain set, then in the setting of Figure 5 one can simply reduce the forget set from two samples to one (by removing one of the original samples). This modification recreates the same optimization landscape we described earlier.
Q: What results do you obtain when working with highly correlated datasets such as MNIST or FashionMNIST?
A: MNIST (55 is degenerate for evaluating unlearning: many points are near-duplicates, so pretrained and oracle models remain nearly indistinguishable on forget points, yielding uniformly low KLoM across splits even when the forget set 10% of training. In contrast CIFAR-10, where oracles and pretrained models diverge on forget sets (consistent with Georgiev et al. (38), MNIST shows little separability. While FaSH [46] exhibits a modest increase in forget-set KLoM it still far below CIFAR- 10 magnitudes. As result, any method may appear to succeed on MNIST by doing very little (for example, tiny steps), making true forgetting difficult to verify.
Dataset
Forget %
Forget KLoM (95th)
Retain KLoM (95th)
Val KLoM (95th)
MNIST
0.02%
0.5
0.7
0.71
MNIST
0.2%
2.72
2.88
2.9
MNIST
10%
1.79
1,65
1.71
FashionMNIST
0.02%
4.13
1.87
2.76
FashionMNIST
0.2%
2.72
1.79
2.70
FashionMNIST 10%
2.69
2.0
3.31
Table 1: 95th percentile KLoM comparing pretrained and oracle models on MNIST and FashionM-
NIST across forget-set sizes. Averages over 100 pretrained models per dataset and 100 oracles per set.
forget set. MNIST and FashionMNIST are highly correlated and therefore degenerate for sound machine unlearning evaluation with pretrained and oracle models remaining too similar on forget points, which can inflate apparent success.
Q: Why does Gradient Descent/Ascent unlearning degrade more when the forget set is aligned with the top principal components (1st/2nd PCs) compared to random forget sets? A: Intuitively, aligning the forget set with the top principal components (PCs) concentrates it along
21

---

directions where the model is most sensitive, so ascent steps taken to degrade performance on that set inevitably interfere with the decision boundary more globally. A simple 2 -D logistic regression toy helps illustrate this. Let labels be generated by fixed teacher vector T E IR² e.g., T = (1, -1), which classifies points by the sign of x1 I2. Train a student with weights S E TR² on these labels; successful learning yields S = T. If points are sampled near the origin, the (pointwise) influence of a training point 2 = (a, y) on a test point žtest = (Zrest: Ureat) can be approximated (up to an inverse Hessian factor that is proportional to the identity) by
YlestYy Viesayy of - Yhea S Trea) d - x) Fies
I 2,
which, for S Rs (1, -)), reduces to
(Fiest11 2 - x22) of (Frest, - Foost d (x) x22)))
x sitat
Along lines of roughly constant I z2, the correlation between and Trest controls influence magnitude, so the leading PCs of I align with the leading directions of the influence matrix. Selecting the forget set along the top PCs thus targets directions that most strongly affect predictions, causing ascent to push the model in ways that globally perturb the decision boundary. In contrast, random forget sets spread mass across many weaker directions. so ascent tends be less coherent and, on average, less damaging. We stress this is an intuition; analyzing full influence matrices in tractable yet realistic settings would be valuable future work.
On prior empirical observations and our contributions. Georgiev et al. [8] empirically show that gradient ascent-based unlearning can perform poorly. For instance, low stability and different points unlearning at different rates and ascent diverging for linear models (Figs. 5 and 11 in (38). We advance these observations by identifying inter-set correlation between forget and retain data as the causal mechanism and by providing the missing evidence: controlled experiments that disentangle random forget sets (with unstructured dependence) from structurally correlated sets aligned with top principal components of the influence matrix, and a theory for non-lineat models showing immediate detriment of DA regardless of early stopping. Empirically, we find DA to be unstable on random sets sometimes improving the forget metric but often breaking the model. On structurally correlated sets, failure systematic and severe [and3.. We also highlight the evaluation pitfall where selecting the best run over large hyperparameter grids can create a false appearance of success (the "Ascent Forgets Illusion," " Fig. 2). Theoretically, in logistic regression we show that DA moves away from the oracle from the very first steps: Lemma 3 proves that DA updates point in the opposite direction to the oracle, and Lemma J shows the DA solution can remain far from the oracle even when the retrained solution is close to the pretrained one. Together, these results explain why asccentdescent updates degrade performance in correlated regimes and when such degradation is unavoidable. d
Practical guidanee and evaluation checklist. We recommend two simple diagnostics for unlearn- ing experimentation: (i) measure the oracle pretrained KLoM gap on forget versus retain/validation splits and (ii) probe sensitivity to early stopping and step size, which can create the "Ascent Forgets Illusion".
C Proof of Lemma for Random Sets
In this section we provide proof that for forget set, selected uniformly at random from the dataset it with high probability impossible to differentiate the accuracy, loss, or any other metric between the test and the forget set, given that both of them are large enough. In this section we provide the proof for the accuracy metric, but for other metrics the proof follows in like manner. Intuitively this stems from the fact that for model which has "unlearned" forget set, that set is random set for it.
We will use the following notation. Let I(..) : R R - {0, 1) such that 1 ((x.z) = 1, otherwise for I A y, (x..) = O. We will denote our model with parameters as hg : _dd + R.
Lemma 1 (Random Sets). Given true distribution of samples Py and a forget set F chosen uniformly at random from the dataset and oracle model with parameters O then the probability that the accuracy on the test set AccT and the forget set Acc diverge from one another by more than e is upperbounded by the following inequality;
P PIACCT- Acc 2 2
< 2exp (-2(Fle?).
22

---

Proof. For each sample (zy, 3t), we calculate the correct response on that sample, as 1 (a))))))))) consequently the response of the model for any sample an independent rendom variable. So we get the following random variables, which correspond to the accuracy of the model on the forget set F and the test set respectively.
AccT ). [ (ho(zz))
Acc= (#FF
Σ
((ho(s))))))
In order to proceed we will utilize Hoeffding's Inequality, which we state below for completeness:
Lemma 11. Let Z1, Zz.... Zn be independent random variables such that Z, E [a,, bi]. Define their sum as:
Sn
Z4
and let [B[Sm] be the expected value of Sw. Then, for any > 0, the following bound holds:
22
PIS,, - B[S,]] 2 nl) < 2exp
i=
az)²
In our case have that 1 S, AccF. Since the Forget set F is selected uniformly at random, have that:
E [Acc=]
E
(hh((s)))))
(EI.
Σ
E Enn [(mo((s)))))
(#.
[ (holz))))
AccT
Since the random variables [(no(()))))) E 10, 1), have that:
P ([AcOT - Acc 2 e) < 2exp (12)
which gives the lemma statement.
The above lemma gives formal statement, to why maximizing the error random forget sets does not correspond to true unlearning, since the metrics the forget set should match those the test set.
D Logistic Regression
D.1 Problem Statement
The logistic regression problem for the full dataset D, retain set R and for the Descent-Ascent algorithm can restated as:
minimization D
+
|wi12
D
2
)
minimization R:
(w,
(3)
R
R
Descent Ascent F:
De (w,a))
1
Σ
Ve (w..))
R
|
23

---

D.2 Single Dimension
In this section, we compare the solutions training a logistic regression model on full dataset D, purely on the retain set R and doing GDA on the forget set F. We will also include a regularization term. The corresponding objective functions would be:
We can derivate the above to get the following equations for their solutions respectively.
(minimization D)
- Yi 246 (r((aa)) Aw 0
(minimization R)
[
1=
Yi 2,0
+ Aw 0
(Descent R Ascent F)
R Zi=1
The
yi The de (ww,) Aw = + -
So express each coordinate of the minimizer for the three cases,
(minimization D)
Wij
APl
1= 1/s Iz,ze vo((,,))))
(minimization R.)
Wjj ||
EE Vi Fii (w(l))))
(Descent R -Ascent F) Wy
X
i=
R
Ui
Ziee (10,222))))
x (Eter Vi z4,e vo(ma)))
D.3 Iterating Gradient Descent and Ascent
Here, we consider the iterative gradient descent-ascent algorithm, where we first perform gradient descent step on the retain set, followed by gradient ascent step on the forget set. We show that to leading order in the small learning rate expansion, the solution found by iterative GA is identical to the one given by GA in Eq. (3 For iterative GA, the dynamics are given by
R
w 1+1 w/
+
e
-uuc))
(4)
R
w +2 w
E.
R
w + =uw
where 1/ is the leamning rate for both steps. Plugging in the result of w into the expression for w and expanding for small r) << 1, we obtain the following update rule
|R
w
2+ = u0/ +
e
-Aw3
(5)
R
6
|Ryy
è
10- (uittl
1R, -w -mws)
+1
+
[Ryl [
e ewj Xro
[F
2 vo + +
R
e m/ -2Xr0)
c.
R2
(ws+
[ - -ww5
e
R
F
|R
6. |R
1 - ( |R,l
| e -w3 Awoz ))
2 vo +
6 -n 2\ur)
e _=
1)
[F
[2, 3 + c- 1-1Ry
= vo
m + 2Aur + O(12).
[R]
[F]
Eq. shows that up to order O17²), the dynamics, as well as the convergent solution of the iterative descent-ascent algorithm are identical to the ones obtained from Eq. (3). up to rescaling of the regularization parameter by factor of 2, as in ADA = 2Attrr-A.
E Proof of Lemmal 2
In this section prove Lemma 2 under Assumption I and Assumption
24

---

Lemma 2 (Closed Form). Let 3 w. and w. be the j coordinate of any local minima/maxima for the logistic regression problems defined in Eq. Q then they admit the form:
(1 + (1+a)
)
R |
(1 al [RI///
w -
W
3 - W
A(Di
A|
where W (z) corresponds the Lambert- W function, the solution to (x))
Proof. Let us start by restating the original problem as given in Eq. 33. For the sake of completeness.
minimization D
ve(wa))
2 1|
[D]
1
minimization R:
e
Ve (mn,a))
11013
(
R
Descent R Ascent F
Ui (wr,m))
1
ve
R
[F
==1
We can get the local minima of these functions by using Fermat's theorem, therefore we have: minimization D
1
1/ IGe" (u,()) + Aw 0
D
i=1 R
minimization R:
Vi F4e (oraa))
+ Aww
[R]
R
Descent R Ascent F
D.C" 21 (w,
Di x4e u-(ww.))) + Aw = 0
R
F
i=1
Solving the equations for coordinate j and using Assumption I minimization D Wj
we get:
1
Vi
zieee ((
A/D
R
minimization R: wy 1|R
Σ
Fi.ee
1=1
Deseent R Ascent F Wj
yi Ei w..3)a)))))
yi Fe Me (omy)1))))
R
X
Now can utilize Assumption 2 and the fact that: |F,1 a.. [R in the form:
restate the previous equations
(1 + (R)
minimization D: my
A/D
|R,1
minimization R Wj A
e
R2
R2
Descent Ascent F wy
A|R|
X[F
As explained in App. E.I the Lambert function W provides the solution for equations of the previous form. Using this fact we get:
(1 a)
minimization D: w =
A/DI
[R
minimization R: :. R.
W
A/R
(11 [1-a|RI/55 R2
Descent Ascent F wpt W
A R
This concludes the proof.
25

---

minimization D E.1 The Lambert function W
In this section for the sake of exposition we briefly discuss the Lambert function W. Introduced by Johann Heinrich Lambert in 1758. In this work we are primarily interested in the property of the function that for any a, the solution of the equation:
I 1
is x W (-a). As well as the monotonicity of the principal branch of the Lambert function.
F Proof of Lemma 3
In this section of the appendix we provide the proof for Lemma start by restating the Lemma below for the sake of exposition.
3 under Assumptions and
wc
Lemma (Divergence Logistic Regression). Let w w and w the j"h coordinate of the conver- gence point for the logistic regression problem for the original set D. the retain set R and the Descent Ascent method respectively. Then range of a we have that: (wi) - -wp) (ww - w 2 0.
Proof. To begin the proof let us restate the three minimization problems for logistic regression for the three cases, whose respective solutions are wP. w w
DA
1
(w..a)))
X |
[D]
R
X
minimization R:
Ue (w.aa))
|
R
R
Descent R - AAscentt F
Me (wrm:)
1
ye (wn,as)) + 1/
R
[F
2
1=1
So the local minima and maxima of these equations be characterized with the help of Lemma 2 the proof of which can be found in App. for the sake of completeness, let us restate the lemma here
Lemma 2 (Closed Form). Let W D R and w. be the j coordinate of any local minima/maxima for the logistic regression problems defined in Eq. QT. then they admit the form:
w.
(1 (1+ (1+
R A
wn= -M (1 RI/FFIRRR))
3 p = W
W
A/DI
A|R
where (z) corresponds to the Lambert- W function, the solution to 2 = ((2)
Since 0, we have that:
(1 + a:) A|D|
RR A
> and
>
The minimization for logistic regression over the original dataset D and the retrain dataset R both have a global minimum that is unique and corresponds to the solution of the principal branch of the Lambert function Wo. for that value. For the Descent Ascent solution, since the input of the Lambert function is not necessarily positive, we have to separate analysis to three cases:
1. The first case, where there is only one global minimum, meaning that the input æ of the Lambert function is x 2 Equivalently, we have (1-a(RI/(E))
2 0 which implies that
X|R
2. The second case, where we have a solution both for the primary and the secondary branch of the Lambert function, corresponding to local maximum and minimum respectively meaning that you have that the input of the Lambert function -1/e S x S 0, equivalently solving for gives [ < < [ + (e)R))
26

---

3. The third case, where there are no local minima, meaning that the input of the Lambert function is z i/e, which implies that [F (A/F)))()R))
Case 1: In case I we have that S
which implies that:
(1 + R
[|R F A D
| D
[R,
A/D
X
A|R
since the principal branch Wo of the Lambert function is increasing, have that:
D = Wo (1 (1+a) 3
R2
S Wo
w
A
X|R|
For this case, let us now assume that 2 |F ([ + (D))). it is easy to verify that for such an it holds that: (L+o)]R, (I-o[R]/[F) A|
R2 we have that:
A|dk
a [|RR///F)) a|R1//FF|RR1
(1 (1+a)|Rg]) =
DA 6
Wo
S Wo
\|
A/D)
So for Case we have that wi < wpp S n which implies that (w wp) (wz) -w 2 0
This concludes the proof.
G Proof of Lemma 4
In this section we provide the proof for Lemma under Assumptions -and
Lemma 4 (Distance Growth). Let w. w the jth coordinate of the convergence point for the logistic regression problem for the original set D and the retain set R respectively, It holds that the distance AR,D = -w? - " In ((1 +11+00 (x) D for any > 0 and O.
Proof. We start from Lemma 2 which we restate below for the sake of exposition.
Lemma (Closed Form). Let w w and with be the jth coordinate of any local minima/maxima for the logistic regression problems defined in Eq. (T) then they admit the form:
w/ w (1+ (w
[1 X/DI
R X
W (1-a|R R
W
A|R
where W ((2) corresponds the Lambert- function, the solution to ((2)
Since the input of the Lambert function for w w. is always positive these solutions correspond to the only minimum of the function for the minimization problem and additionally they are calculated from them principal branch of the Lambert function Wo. We start from the logarithmic connection of the Lambert function, which is that for any value it holds that:
W(z) In(x) In (x))
27

---

So for a 2 Te. since Wo is increasing we have that w 2 w/ we have the following:
If
AR,D
w
"
(1 R
[R
Wo
Wo
A/DI
A/R
a |
R2
R
Wo
Wo
.where a (1 + a)
A(R
A/72
D
[R
|R
[Rj]
[R
In
Wo
In
In
Wo
A|R]
*|/R|
A/Ri
A/Ri
|R
[Rg]
[
[R,]
In
a R
In
Wo
In
1/72
In
Wo
A/R2]
|R, a (
Wo
= In (a) - In
Wo
[R, AIR)
s In (a)
since the principal branch Wo is increasing
We can repeat the same proof procedure for s concludes the proof
but instead we get AR. S -In(a). This
R
H Proof of Lemma 5
Lemma 5 (Distance Unlearning). Let w w the jth coordinate of the convergence point the logistic regression problem for the retain set R and the Descent Ascent method rexpectively. holds that for for 2 [ the distance AR,DA =ww w. Z Wo ((RR)(((R))
Proof. We start from Lemma 2 which we restate below for the sake of exposition.
Lemma 2 (Closed Form). Let wp, w. and whth be the jth coordinate of any local minima/maxima for the logistic regression problems defined in Eq. (T. then they admit the form:
(1 (1+ A/DI
[ |
a R R|/(D))
3 = W
W
DM -
R|R
where (x) corresponds the Lambert- function, the solution to W (())e
It is casy to notice that in the case where have R| w. 0 which concludes this case. For the case where |F|/|R refer the reader to the proof of Lemma 3 where show that WDA + oo for any value of À > 0 so the distance is infinite in this case.
I Logistic Regression 2 dimensions
In this section we will study the natural extension of the previous example, where we were studying the I dimensional case. In this case assume that samples of the form:
81 (1,c), 82 (c,1)
This gives the following equations for the optimality conditions for training on the full data set D:
wh = Risl
(e ( (1i1tw2e) + are -(oret
A/D
W2 = R
(ee (101+w2))) + ae ae--awsse (w16++22)
A/Di
28

---

For the retrain set R we have that:
R (wx+)
A|R|
[R
(wi++
W2 =
ce
X/R|
For the Descent Ascent unlearning we have that:
Rig
-(w1-waz
(Ri.j
acc (w11tww))
W1
A/R
A|FI
R A/R|
[R (11164wa))
-w11+
U0
X|F
We will rewrite the above equations by setting wi W2e and y wie w2, this simplifies the equations and still allows us to make our claim that DA can only harm the model if there is a total ordering over the values of the solutions of the rewritten equations.
For the dataset we have:
R
((1 + e)e== 2ace-v" v²)
A|D|
R
(2ee p +a(1 + ()ee+ vp)
A/D|
For the retrain R, have that:
|Ri.j
(1 + e -
A/RR
RR
[Ri.j
2Fc -x x
A/R|
For the DA method we get the following equations:
DA
R
(1 + 2)e
a2ee -M PM
R
DA
Rigj
220-
[
a(l + + -
A/R|
A|F
Before proceeding, let point out that DA < DA since 1 + 22 > 2e, for the same reason, get that n < R and finally without loss of generality we will use that yd < P. In Lemma 12 we give short proof regarding the existence of such solutions.
Lemma 12. For any & 1, we have that there exists solution for the original dataset, such that D
Proof. For a 1 we get that there exists a solution of the system such that y2 < sP by the symmetry of the system. For < 1. In order to demonstrate that there exists solution for the system such that "d S x. we will employ the nonlinear Gauss-Sidel method, which converges to stationary point (minimum) for logistic regression. The proof goes follows, will initialize our
29

---

algorithm in the solution for = 1 let it be Zo. Yo and we know it holds that 20 2 yo. We will follow the following update: (nonlinear Gauss-Sidel Sidel method starting from y)
2hee 22 + W (bo((1 + +e 20ee 20ee
Vk+1 +
2hace ue + W (b(1 + + 2bace
Fk+1 +
For 1/1 we have that:
y = 2bee. + W (be((1 + + (2)e-2bre 2bc0
2bee wo + W (ba(1 + 20be 2000"1) w (b(1+e))e (ete (eeebebe070))) w (b(1 E?)e -bce -
2bee - -W (6(1 (b(1+ +c) (e)e-2rer -2bee ) yo W [ba(1 eee--2ee
and since W is increasing we have that W (bea(1 + =e
W ee 2bee
<
implying that < yo- Now let us define the function f(x) x + W ()e the function is increasing on therefore since yı yo get that: I1 [(2baree vi) (2baree
To. Let
us proceed with an induction step, we assume that we have da >> Ik-1 and yh < Uk-1 for k 2 1. We will show that yk+1 yk which directly implies that xb+1 = f(2baee Mkt1) f(baee 94) 2k completing the inductive step.
2bee + +W (ba(1 + e))--2be0" 20e0
Vk+1
((beee s(2bee BR-11)
yk
This concludes the inductive step and we therefore have that for all h ys S 36 for any a, as result, since the method converges to the solution of the system there exists solution which satisfies yd x² In the proof above we have that ||R,,j|/||
I.1
Characterization of the solutions of the 2d Logistic regression
We start this section by giving an exact solution for the coordinates of the retrain problem. Lemma 6. The closed form solution for the stationary points for the retrain set is given as:
(1
(1++2))R2,)
) YR = 1
2x
(1++22)
x
W
W
N/R|
A|R|
Proof.
We have that:
[Rijl A|R|
(11+ 2) (1
R
(1 20- -
2|R|
So:
Ri
2ce x
|/R|
2e
(1+ {
W
(14+))1
XIRI
1 c²
A/R.
2e
(1 (11+e)|RRe,)
W
1+
A|R|
This concludes the proof. In the last equality used the property of the Lambert function.
For the other two problems is not possible to provide exact solutions, as we did the retrain one unfortunately, will provide upper and lower bounds for their values.
30

---

Lemma 7. For the stationary points of the original set, one can derive the following ranges.
Rusl ((1 + +++++ +2x))
2E
a(1 x2)
Rigl
(1 + (1++2)
W
S IXP
W
+ +W
X(D|
I+e
A/D|
A|D|
[1 R))
Rr
R
5yp S W
(2 + + a((++()))
A/D1
Proof. We have that
xd
1
((1 + == + 22re ))
A|D|
yd
A/D| (2ee a + aal + e )))
As we discuss above we have that y² 2x 7 e v =e- whicc implies that:
D.D
|
((1 + 2 xx
))==== + 2nee =x"
R ((1 +x²) + -2xx6) =
A
A/D
R A(D]
(2Ee- n² + a(1 + v) Ri,l
y
(2e + a(1 + E A/D|
So from the inequalities above, we get that:
R
W
((1 + +2) +200))
A|D|
R
y
W
(2e + a(1 a((++=1)
X/D|
Now we have an upper bound for y and lower bound for P. In order to provide lower bound
for y and an upper bound for x. We should notice that 2ee 2 O. which gives:
Riil A|Di
a(1 te)e v7
a a(1++e) + E² R
y w
A/D)
This completes the bounds for yP now in order to compute the upper bound for xP, we have that: (((a(++))R.,))(AII))
p
A/DI a(1 + +2) W(((He))R.,///DD)) =
e p
a(1 E² R
A/D)
-
A/DI
[a(1 + 1
W
a(1 R
A/DI
So we have that:
RRi
A/D
[(1 +2)
D
((1 ++2) )e=
20r
W
A
ae1 + (R
A/D)
x
<
<² R)
-x
2E
W
[(1+ +2) (
A/DI
I+
A/D1
x
D
1 W
2c
[a(1 + (21++2) (R.
+ W
+ [)
-
[a(1) ( W
A/D
A/D1
2E
[a(1+ (
(1+ (1+ )
D
<
W
+ w
1 2
A/D
where the third inequality comes from the solution of the Lambert equation for the RHS of the inequality and the last one comes from the fact that the exponenent is non positive. This completes the proof.
31

---

Lemma 8. For the stationary points of the model trained by DA methods we can derive the following ranges.
nM S
W
A|R| (1
Regl
+2)
|Rgg
02E).
yo < <W
R R
2e
|Rig
arl + +2)
N|-
A|5
Proof.
As stated earlier we have that yPA
S DDA
e-va
2 -o
and
DA
(1 + 1
[R
a2ee wM
ym
A/R|
A1F
yo
Riijl
2ee
[Ri, A|F
a(1 + +e -vm
A/R(
So:
zDA
Rigl
(1 + 2
[Ri.j
ale
e-
A R
\|F1
ypA
S
|Ri,l
2c
[Ri,]
a(1 + +22)
e-gm
A [
A/F
So we get that:
Rii
|Ri.
DA
W
(1 22)
A|F a2e
A
[Rij]]
|Ri,
yD S W
2e
a(1 e2)
A
A|F
which concludes the proof.
1.2 Derivation of the relevant size of the forget set
Lemma 9, For a 2 a D>DA max and that y 2 nM.
1tc² 2x
2
2c
IF [R[[D++[T])
} we have that x.P 2 DA
[I[[D|[ I4
Proof. We will start from Lemma and Lemma exposition.
g
which we restate both below for the sake of
Lemma 7. For the stationary points of the original set, one can derive the following ranges.
Rigl ((1 + +2+ + +20E) AIDi
2c
a(1 + 22) Risl +W
(1 ()+
W
<x S
1+2
A/DI
A/DI
[a(1 + <² R2.1l w
R
SyPs
W
(2c + a(1 a(1++21))
A
A|D|
Lemma 8. For the stationary points of the model trained by DA methods we can derive the following ranges.
PM < W
R R|R
(1 + +)
[Raa] A|-
a2e
n <W
[R x/R|
2e
|Ray X|
a(1 + +2))
We will require that the lower bounds provided for x y are bigger than the upper bounds provided
for z DA BA since the Lambert function W is monotone, we can just solve both inequalities for a.
x 2 x DA and p > DM and this concludes the proof.
Finally we need find the range of a for which it holds that R 2 DD and R 2 yp, which given in Lemma 10 which we restate next for the sake of exposition.
Lemma 10. For a < a R>D min {aR> a R>DD we have that R 2 x" and that ÿ 2 yd
with a R>D R>D
a
32

---

Proof. We will use Lemma 7 and Lemma 6 get the expressions that solve the "² x
Again similar to Lemma 9 we can solve for and we
y
equations. Solving x² x
(c++) W
2+1 w
2+1 27
DA W
2+1 XR
w
1+
exp
xR
2x
OK where for any < a there is range of c for which 2 > x Similarly, solving y nd
(6)
2r
2ew
2e
DAe
2+1
W
2+1
- 6² -
AR
R>D
0g
(c2 +++1 1)²
where for any < oy
R>D there is range of c for which y > yp
The solution is therefore S min [aR>D , P>....
J Logistic Regression in 2D intuition
Let us consider nearly orthogonal data, such that all coordinates apart from two orthogonal to each other. Namely, we choose the first two samples to be x (1, ......0 0) and 122 = (e. 1, ........ 0). while the remaining d - 2 points orthogonal such that Ta. 6, for 3, 3, where e, the unit vectors. We further assume that the two correlated samples T1, share the same label 91 = 1/2 1. In this case, the unlearning problem decouples the first dimensions from the rest, leaving a coupled set of equations for the weights along the first two directions w1, W2 for the original classification problem
= AIDk
(e (w1 tage)) + ee -(w1ctw)))
W2
A/D
(Ee (101 (101-w2)) + +e (w)ctwa)),
(8)
which can be solved in the limit of + 1-, as
2(E + 1) A/D|
W1 W1
W
(9)
The retrain problem has the minimum
W1
(wi + wo2c)
W2 R|R
ce [wi ww)c
(10)
and the DA is given by
W1
A/R]
(e (e-(wi ce (wee+ww)))
W2 R
(ee (ee- (w=++we)) (wwwetww)).
(11)
Our goal is study how far is the solution given by GDA from the one given by retraining. The retrained solution can be found analytically to be
W
cW
PRX
(12)
+1
The GDA equations do not obtain closed form solution, but they be solved when assuming
C >> 17, such that
W1 wi- w2 (wi
W2 A/Rl
1) (E 1)
w
(wi
w2
1) (e -
W2
(13)
A|Rl
which are solved as
88c-1)1
8(c 8(c- 1)2
) [R|2X2
W1
4
W
12|2X2
-iv2 W
(14)
1
8(E - 1)²
8(e 8(e- 1)²
W2
4
W
|2|382
+
|2|222
33

---

It is sufficiently interesting to consider the sum of w1 + wa compared to the retrained solution, and define the difference
A
11 W22
DA
DA
(wi
1 W
(- 8 ((2)
(1 + e)W
(++1
PejA
(15)
2² +
2
-W
c-1
K
Experimental details
Hyperparameters Our implementation is based on Rinberg al. 47 which follows the methodo- logy in Georgiev et al. [38]. We pretrain ResNet-9 for 24 epochs using stochastic gradient descent (SGD) with an initial learning rate of 0.4, following a cyclic schedule that peaks at epoch We employ batch size of 512, momentum of 0.9, and weight-decay coefficient of 5 x 10-4.
We also adopt nine forget sets directly from Georgiev et al. B8), which comprise both random subsets and semantically coherent subpopulations identified via principal-component analysis of the datamodel influence matrix. To construct them, an n n datamodel matrix formed by concatenating "trainxtrain" datamodels (with n 50 000) by computing its top principal components (PCs) then can define:
1. Forget set 1: 10 random samples.
2. Forget set 2: 100 random samples.
3. Forget set 500 random samples.
4. Forget set 10 samples with the highest projection onto the 1st PC.
5. Forget set 5: 100 samples with the highest projection onto the 1st PC.
6. Forget set 6: 250 samples with the highest and 250 samples with the lowest projection onto the 1st PC.
7. Forget set 10 samples with the highest projection onto the 2nd PC.
8. Forget set 8: 100 samples with the highest projection onto the 2nd PC.
9. Forget set 9: 250 samples with the highest and 250 samples with the lowest projection onto the 2nd PC.
Most unlearning algorithms highly sensitive the choice of forget set and hyperparameters. Therefore we perform an extensive hyperparameter exploration, evaluating each baseline unlearning
algorithm on each forget set. Our setting is again similar to Georgiev et al. [38] but we consider
slightly larger hyperparameter grid for the employed methods and report results for all configurations
rather than only the best-performing runs. More specifically, evaluate over the Cartesian product of the following hyperparameter grids:
Gradient Ascent: Optimized with SGD. Learning rates: (1x 10-5, x 10-5 1x 10-1,5x 10-1,1 10-3 1 x 10-2,5 5 10 20-2); epochs: [1,3, 103.
Gradient Descent/Ascent: Optimized with SGD. Learning rates: (5 x 10 5, 5 10
10-3 10 33: total epochs: (5, 7, 10}; ascent epochs: {3, 5); forget batch size: (32, 64).
SCRUB: Optimized with SGD. Learning rates: (5 10-5 5, x 10-1, 1, 10-3 3, 5 10 10-3);
total epochs: (5, 7, 10]; ascent epochs: {3, 5); forget batch size: (32, 64).
We use fixed batch size of 64 and train 100 models per configuration. For each run, we measure performance using the 95-th percentile of KL.M scores.
Statistical Significance Using N = 100 models to compute KLoM is computationally expensive although such expense comes at the gain of having low variance and results closely reproducing Georgiev et al. (38) We find using lower values such as N = 20, N 50 to produce large differences between margin distributions of pretrained and oracle models on the retain and validation sets (where
KLoM should be low). More specifically, margin distributions become stable for all sets after N 80.
34

---

Ponget semple
Porgrt sumglix
Fonget sumple
VVileio NL-M
Ansti
Sock Pritua
Foran KLeMt
Deeget Mlddi
Furget Set: Zigina PC (0.02%)
Forast Sek. 100 hishes La PC (0225)
Freest Skt: 250 Righon
250 Inwes
PC (155)
22-
10
50
Villiate KLAl
0.5
12
Rege REAM
Virge
Rerge
Forget Set: 10 lighest (0.0e54)
Pörget Set
hiihhtt 2nd IM (I
Forgrt Set 250 hightst + lowest 2nd (13)
Viblein Klod
Figure 6: We present the KLoM scores of Gradient Ascent, Gradient Descent/Ascen and SCRUB when unlearning over each one of the forget (axes and points follow Fig. [ We find increase in forget set size and containing high influence points to strongly decrease the likelihood of any run achieving successful unlearning. For SCRUB we observe that runs remain close to the pretrained model in terms of KLoM scores under our experimental setup.
Reporting the 95-th percentile of KLoM scores follows the methodology established on Georgiev et al. 38 Furthermore, reporting all runs instead of just the best one for each compute cost is more statistically transparent.
Compute resources All experiments were conducted on server equipped with eight NVIDIA A A100-SXM4 GPUs, each with GB of GPU memory. single unlearning configuration run was never split across different GPUs, many configurations were executed in parallel.
L Additional Experiments
We provide additional analysis of the KLoM scores across various unlcarning methods and forget sets. Fig. 66 presents the KLoM scores of Gradient Ascent, Gradient Descent/Ascent, and SCRUB. We observe that increasing the size of the forget set or including high-influence points significantly reduces the likelihood of achieving successful unlearning. Fig. shows analogous results, but with KLoM scores computed over the retain set instead of the validation set. The patterns are nearly identical those in Fig 6 A pretrained model typically exhibits low KLoM scores on both validation and retain sets, with very similar magnitudes.
M Broader Societal Impact
Machine unlearning is crucial for privacy applications, namely, protecting sensitive data and comply- ing with GDPR's right to be forgotten'.. Our work, although mainly theoretical, demonstrates that descent-ascent methods often fail due to unacknowledged statistical dependencies between forget and retain sets. This finding has critical consequence for privacy: to improve ascent based methods, practitioners are required to probe the retain set to understand its correlations with the forget set. This ce-assessment of potentially sensitive data in the retain set during an unlearning task creates privacy
35

---

Ponget semple
Forget sumple
Ansti
Soct
Forunt KLebt
Decget Mlddc
Furget Set: Zigine PC (0.22%)
Forast Sek: 100 hishest La PC (0.25)
Freest Sktt 250 Bighos
250 Inwes PC (155)
12-
10
50
12
Rege RDaM
Firge
Rerge
Forget Set: 10 lighest (0.055))
Pörget Set hiihhtt 2nd PU (1258))
Forgrt Set 250 lightss +t lowest (13))
Botta Kldd
Figure 7: We present the KLoM scores of Gradient Ascent, Gradient Descent/Ascent and SCRUB when unlearning over each forget set. x-axis and points follow Fig. aand y-axis now displays the KLoM score in the retain set instead of the validation set. We observe very little difference when comparing with the results in Fig. pretrained model has low KLoM scores on both the validation and retain sets with very similar magnitudes. These findings are consistent with Georgiev et al. (38]
paradox. Therefore, for applications strictly governed by privacy, alternative unlearning strategies that do not require such re-examination of retained data appear preferable.
36


Reviews:
[{"review_id": "6CnSiAEeFw", "reviewer": "Reviewer_oUA1", "summary": "This paper studies the problem of machine unlearning. It first empirically shows that descent-ascent-based methods tend to fail at machine unlearning tasks under robust evaluation. They present a theoretical argument showing that the statistical dependencies between the forget set and the retain set are the reason for the observed phenomenon. \n\nThe paper provides a theoretical analysis of multi-dimensional logistic regression, showing inter-set correlations lead to DA failure modes.\n\nThe paper also provides a qualitative analysis of a binary 2-dim classification example with a simple network (a sigmoidal network with two parameters), showing how DA leads to sub-optimal solutions that is different from the retrained model.", "questions": "Q1. Regarding Lemma1, is Hoeffding’s Inequality applied to the model predictions? When forgetting set is used for the training, the predictions of the trained model are dependent on the training sample (forgetting set). This seems to contradict the assumptions of Hoeffding’s Inequality.\n\nQ2. Does the result in Section 5.2 require any assumption on the learning rate? e.g. equal learning rate in ascent and descent?", "limitations": "yes", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The paper conducts a theoretical analysis in the multi-dimensional logistic regression problem to investigate how the relationship between forget and retain sets affects machine unlearning performance.\n- The qualitative analysis using a simple network is illustrated, showing how the unlearned model differs from the retrained model\n- Figure 2 shows an illusion that DA-based method is mistakenly considered successful. This may be useful for the community.\n\nWeakness:\n- Lemma 1 seems problematic and does not consider the effect of model training. Hoeffding’s Inequality requires the random variable to be independent. Based on Appendix B, Hoeffding’s Inequality is applied by taking model prediction as a random variable, i.e. $ 1_{(h_\\theta(x_i), y_i) }\\in[0,1] $ (line 796). As the forget set is used in the gradient ascent, the final predictions with trained model parameters are dependent on all the training samples.\n\n- In Figure 5 and section 5.2, there is no discussion on the effect of training dynamics, e.g. learning rate or regularization parameter $\\lambda$. Does the conclusion depend on any assumption about the learning rate?\n\n- It would be better to include more discussion on the related works or future directions regarding how to deal with of data dependencies between the forget and the retain sets in algorithm design.", "was_revised": true, "final_justification": "The rebuttal clarifies my concern regarding lemma 1. Therefore, I raise my score from 3 to 4. However, it should be noted that since my expertise does not lie in machine unlearning, I cannot fully evaluate the novelty and the impact of this work.", "rebuttal": "We thank you for your detailed and constructive review. We appreciate that you found our contribution to be useful to the community. \n\nBelow, we address the specific weaknesses and questions brought up in your review.\n\n### Weaknesses:\n\n- **Lemma 1 seems problematic and does not consider the effect of model training.**\nWe apologize for this crucial misunderstanding and would like to clarify the confusion regarding Lemma 1. In the text above the Lemma, we briefly state that this Lemma corresponds to the **oracle** model, trained only on the retain set, and **not to a pre-trained and then unlearned model**. It is important to stress that the **oracle** model is obtained by training from scratch on the retain set, and so it is **never** exposed to the forget set. Therefore, there are no dependencies between the random variables since the model parameters are only dependent on the retain set. We will clarify this further by specifying in the statement of the Lemma that we refer to the **oracle model** instead of simply the **model** as in the current version.\n\n- **In Figure 5 and section 5.2, there is no discussion on the effect of training dynamics.**\nOur results throughout section 5 concern the landscape of the optimization process and the locations of the optimal minimizers. As a result, the training dynamics do not affect them, as long as the pre-defined objective function is unchanged. For example, the magnitude of the learning rate is not important and no assumptions have been made on it to draw the conclusions for the solutions of the optimization problem. Regarding the regularization parameter, similar to section 5.1.1, changing it does not alter the relative positions of the minimizers, it only controls their distance from the origin and between them. Hence, the decision boundaries in Figure 5 are not affected by the regularization parameter.\n\n- **It would be better to include more discussion on the related works or future directions.**\nThanks for the suggestion, we would be happy to include more details in the future directions and related work for the camera ready version.\n\n### Questions:\n\n- **Question 1: Hoeffding's inequality:** \nRegarding the application of Hoeffding's inequality, it is indeed applied to model predictions. Nevertheless, as we mentioned in our reply to the raised weaknesses, Lemma 1 concerns the **oracle model** which has been trained using only the **retain** set and has **not** seen the **forget** set, so it does not contradict the assumptions required for the inequality to hold.\n\n- **Question 2: The result of section 5.2 and equal learning rates:**\nWe thank the reviewer for this very interesting question. As we mentioned above, the learning rate magnitude has no real effect on our results and they would still hold. However, selecting different learning rates for the retain and forget sets (i.e. the ascent and descent steps on DA) alters the objective function. Specifically, the new objective function would be weighted according to the ratio of the learning rates. While it is possible to select a weighting so that the specific example in Figure 5 is not problematic, one could find a problematic instance along the lines we describe for any ratio. For example, assume that for the unlearning process we select a step size for the forget set that is double that of the retain. Now, in the Figure 5 instance you can simply reduce the size of the forget set from 2 samples to 1 (by removing the other sample from the original dataset), this would lead again to the same optimization landscape as the one we have described.\n\nWe sincerely hope that you kindly consider raising your score if our reply has alleviated your concerns regarding our work."}, {"review_id": "njsE64HXET", "reviewer": "Reviewer_s9Rb", "summary": "The paper studies gradient-ascent/decent (DA) machine unlearning methods that rely on taking gradient ascent steps on a forget set while taking gradient descent steps on a retain set.\nIt demonstrates empirically that DA can fail when the forget set points are chosen to be highly correlated with the original set.\nFor randomly chosen forget sets, it finds that such methods fail to forget while degrading model performance, arguing that circumstances within which they do seem to work require access to privileged information for choosing hyperparameters that is typically unavailable.\nIt further theoretically studies to what extent statistical correlations between data points cause DA methods to fail.\nTo this end, it considers a logistic regression model on datasets with specific correlation structure between data points.\nIt finds that when samples are fully correlated, the DA solution and the oracle solution lie in opposite directions with respect to the pretraining solution.\nAs a consequence any amount of DA unlearning in this setup degrades both model performance and unlearning performance.", "questions": "- To what extent are strong statistical correlations between the forget and retain dataset an ecologically valid assumption in the context of unlearning? I would expect that the typical example of unlearning specific facts, such as a person's telephone number, does not fit this assumption very well?\n\n- Continuing this line of thought, the choice of unlearning CIFAR-10 data points strikes me as odd as the correlations of individual data points with the whole dataset might be relatively high simply due to the small size of the dataset. Would you expect the problems of DA due to correlations to be less prevalent as the scale of the data increases and the fraction F/D decreases as a result?\n\n## Minor\n\n- Typo in L142: [...] would be indistinguishable (to?) those of the test [...]\n- Typo in L165: [...] in low-dimensions ~with~ on a small fixed dataset.", "limitations": "Limitations have been adequately addressed.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The paper is clearly written with an easy to follow structure. The research question of how well DA-based methods work in the presence of correlations between the forget and retain set, is well motivated. Both the empirical and theoretical setup are well designed and the findings have significant implications for the applicability of DA machine unlearning methods.\n\n_Please note that I cannot particularly comment on the novelty of the findings since I am not an expert in the field of machine unlearning and do not know the related work very well._", "was_revised": true, "final_justification": "- The paper is well presented and structured\n- The research question of how well DA-based methods work in the presence of correlations between the forget and retain set, is well motivated\n- Both the empirical and theoretical setup are well designed\n- The findings have significant implications for the applicability of DA machine unlearning methods", "rebuttal": "We would like to thank the reviewer for their work and the positive evaluation of our work.\n\nBelow, we address the specific questions raised in the review.\n\n### Questions:\n\n- **Are strong statistical correlations between the forget and retain dataset an ecologically valid assumption (unlearning telephone numbers etc.) :**\nWhile unlearning a specific fact like a phone number might seem like a low-correlation task, subtle dependencies still exist. A phone number is not a random string; its components, such as the area and central office codes, are strongly correlated with geographic location. If the model is given the associations between a person and their city/state (which would be in the retain set), the area code in the forget set is not independent. Our work shows that even such nuanced correlations, which are often overlooked, can be sufficient to cause DA methods to fail.\nMore importantly, many of the most prevalent and large-scale unlearning requests are inherently high-correlation problems. Consider:\n    - Unlearning Codebases: A frequent request involves removing a proprietary codebase from a Large Language Model. The \"forget set\" (the proprietary code) will inevitably share common libraries (e.g., NumPy, TensorFlow), widely-used algorithms, and standard design patterns with the \"retain set\" (e.g., public code from GitHub). The statistical dependence here is unavoidable.\n    - Unlearning Visual Data: Imagine an autonomous vehicle model trained on footage from both public and private roads. If a request is made to unlearn footage from a specific private property, this \"forget set\" is visually almost indistinguishable from the \"retain set\" of public roads. Both contain asphalt, trees, lane markings, and curbs. Attempting to unlearn one via gradient ascent risks degrading the model's fundamental concept of what a \"road\" is, a prime example of the detrimental failure modes we analyze.\n    - Unlearning Copyrighted or Stylistic Content: In generative models, a request might be to unlearn a specific artist's work. The \"forget set\" (the artist's images) is highly correlated with the \"retain set\" through a shared artistic style, subject matter, or visual motifs that the model has learned to generalize. Forgetting the specific instances without harming the stylistic understanding is precisely the challenge our work addresses.\n\n\n- **Cifar 10 datset:**\nCifar 10 is rather standard for testing in Machine Unlearning (e.g [1-4]). The dataset is not degenerately correlated as MNIST or Fashion-MNIST (please see the response we give to question 3 asked by reviewer MLpH). Pretrained models are clearly distinguishable from oracle models trained from scratch without the forget set by a notable divergence in the forget set margins distribution (high $95^{\\text{th}}$ percentile of KLoM scores, e.g. grey dotted vertical line in Figure 1).\n\n- **Scale of dataset and F/D:** \nOur results in section 5 crucially rely on the fraction of $|\\mathcal{F}|/ |\\mathcal{D}|$. The overall size of the dataset is not important in our derivations. Nevertheless, it is true that as the fraction of forget points out of the entire dataset $|\\mathcal{F}|/ |\\mathcal{D}|$ goes to 0, where the model is asked to unlearn a negligible fraction of its training data, DA may not necessarily be harmful, as shown in section 5.1. In the limit of $|\\mathcal{F}|/ |\\mathcal{D}| \\to 0$, it is also important to note that the differences between the pretrained model and the oracle would collapse so it is likely that a DA based method that just stays very close to the pretrained model would achieve reasonable performance.\n\n- **Minor Typos:** \nWe thank the reviewer for pointing out the typos, we have corrected them in the revised manuscript.\n\n[1] Georgiev et al \"Attribute-to-Delete: Machine Unlearning via Datamodel Matching.\" arXiv:2410.23232v2\n\n[2] Kurmanji et al. \"Towards Unbounded Machine Unlearning.\" arXiv:2302.09880\n\n[3] Hoang et al. \"Learn to Unlearn for Deep Neural Networks: Minimizing Unlearning Interference with Gradient Projection.\" arXiv:2312.04095v1\n\n[4] Goel et al. \"Towards Adversarial Evaluations for Inexact Machine Unlearning.\" arXiv:2201.06640v3"}, {"review_id": "nschk4WthA", "reviewer": "Reviewer_85tp", "summary": "The paper focuses on understanding the weaknesses of gradient ascent based methods in the context of machine unlearning. \n\nFirst, it presents experiments on CIFAR-10, showing that gradient ascent based methods either do not move from the initial model parameters or severely degrade model performance. Moreover, their performance is fragile and sensitive to choice of hyperparameters.\n\nThen, the paper argues that presence of correlations between retain set points and forget set points causes ascent based methods to degrade the model performance and not do unlearning. The paper presents this as a series of claims:\n\n- First, using standard concentration bounds, it shows that if the forget set is a random subset of training set, then the average accuracy of a model on training points and forget points can't be very different. Using this result, it argues that ascent based methods that actively try to decrease forget set accuracy must harm model performance. \n\n- Second, it considers some stylized settings where there is correlation between retain and forget points, where unlearning using ascent based methods is worse than doing nothing.\n\n- Finally, it shows another 2-dimensional example, where even if you use gradient descent  on retain set after using gradient ascent, gradient descent can not undo the harm done by gradient ascent.", "questions": "The paper needs significant rewriting for clarity, along with significantly more convincing and thorough demonstration of the claims. Please refer to the strengths and weaknesses section for more details ans questions.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Gradient ascent based methods are prevalent in machine unlearning. Therefore, any attempt at understanding its weaknesses is welcome.\n\nThe main claims/contributions of this paper are:\n1. Gradient ascent based methods fail in practical settings and can even degrade model performance.  Moreover, they are very sensitive to choice of hyperparameters. This was shown using experiments on CIFAR.\n2. Gradient ascent based methods fail due to correlations between retain and forget set points. This was shown theoretically or small experiments in various stylized settings.\n\nThe first claim is largely known from prior work. For example, Georgiev et. al. [1] already show that gradient ascent based methods do not perform well and can also hurt model performance (e.g. Figure 2, section 4 and Figure 11, section 6) . The authors do cite this work.\n\nThe second claim, which is the main contribution of the paper, is shown in settings too stylized. For example, one of the settings assumes logistic regression with orthogonal points and further stringent assumptions on how the points are labeled. Firstly, it is unclear how much of the claim relies on the points being correlated. It seems possible that gradient ascent can hurt even in the absence of correlations. As an example of this, see Figure 11 in [1] where gradient ascent starts to hurt model performance eventually (the setting here is under-determined regression with minimal correlations).  Even if correlation causes additional issues, significantly more convincing and thorough demonstration of that is needed, both empirically and theoretically.\n\nAs another example, consider the result where it is shown that doing gradient descent on retain set points may not fix the harm done by gradient ascent. This shown for a specific 2 dimensional dataset, fitted using 2 parameters. Again it is unclear how general this observation is. For example, do we expect it to hold for overparameterized neural networks?\n\nFinally, the paper also uses imprecise or unclear language at many places, which makes it hard to understand. For example:\n- Line 173: \"The data is separable into orthogonal sets Sj for each coordinate j.\". While the meaning of this became clearer later, its unclear what orthogonal sets for each coordinate mean.\n- Line 193:  \"Lemma 3 shows that the DA solution is always farthest away from the\n\toracle solution\". What does farthest away mean?\n- Corollary 1: What is e_j? Also, the text says it follows from lemma 4, but lemma 4 shows no dependence on lambda.\n- For lemma 4, is there any condition on alpha? The upper bound seems to become negative when alpha < |F| / |R|?\n\t\n\t\n[1] https://arxiv.org/abs/2410.23232", "was_revised": true, "final_justification": "I thank the authors for the detailed response. Most of my questions on the relevance of the analysis are answered. It would be great to add some of the discussion in the response to the next version of the paper, and also improve the clarity of the writing.\n\nThe part that still seems a bit lacking is the empirical demonstartion in that there is not enough convincing demonstration that correlations are a major reason behind the faliure of gradient ascent based methods in practice. Also, the precise definition of correlation when we move away from stylized settings is unclear since we are talking about two sets (forget and retain sets). For example, would we call a forget point highly correlated with retain set points if most of its \"mass\" lies in the space spanned by retain set points or do we care about pair-wise correlations? The paper would become much stronger if it can come up with a precise hypothesis on the exact notion of correlation, and show in some practical settings that as this notion of correlation increases, gradient ascent based methods start to perform poorly.\n\nNevertheless, the theoretical examples still seem illuminating. Therefore, I am increasing my rating to weak accept.", "rebuttal": "We thank the reviewer for their detailed feedback and the opportunity to clarify our work. We understand the concerns raised regarding novelty, the theoretical setup, and clarity. Below, we address each point in the order in which it was raised. We hope these clarifications will demonstrate the value and significance of our contributions and lead the reviewer to kindly reconsider their assessment and score.\n\n### Weaknesses\n\n#### **1. On the novelty of Claim 1 (DA methods fail in practice)**\n\nWe agree with the reviewer that prior works, such as Georgiev et al. [1], have empirically observed the existence of instabilities in unlearning with DA methods. However, our primary contribution is **not the observation of failure itself**, but the identification and rigorous analysis of a key **underlying cause**: the statistical dependence between forget and retain sets.\n\nPrior work has **not** established this causal link. Our contributions here are twofold:\n\n*  **Empirical Disentanglement:** We deliberately designed experiments to isolate the effect of correlation. In **Fig. 2**, we show that for random sets (where correlations are present but not systematically structured), DA methods are highly unstable, sporadically succeeding but often breaking the model. In contrast, in **Fig. 3**, where we unlearn sets with high structural correlation (points aligned with top PCs of the influence matrix), the failure is systematic and complete. To our knowledge, this direct empirical demonstration linking the *degree of correlation* to the *severity of failure* has not been demonstrated in the existing literature. On top of this, our work shows fine-grained results considering all parameter settings while [1], and other previous works, evaluate over a grid of hyperparameters and report the best score relative to compute time (Appendix C3 in [1]) which can mislead practitioners as explained in the \"Ascent Forgets Illusion\" (Figure 2).\n\n*   **Distinct Findings from Georgiev et al. [1]:** The specific figures cited by the reviewer show different phenomena than what we analyze.\n    * Figure 2 in [1] shows that different points unlearn at different rates for a fixed hyperparameter setting of a DA method (SCRUB).\n    * Figure 11 in [1] shows that for a *linear* model, gradient ascent **eventually** diverges, which one might argue can be fixed with early stopping.\n    * Our work goes further by providing a theoretical explanation as to *why* this happens in more complex, non-linear problems (logistic regression) and demonstrating a more severe failure mode: DA can be **actively detrimental from the very first step**, regardless of early stopping (Lemma 3).\n\n#### **2. On the theoretical settings being \"too stylized\" (Claim 2)**\n\nWe appreciate the reviewer's concern about the generality of our theoretical results. Our goal with these \"stylized\" settings was to use a standard fundamental scientific approach: isolate a complex phenomenon (the effect of correlation in DA unlearning) in a tractable environment where it can be analyzed with mathematical rigor.\n\n*   **Clarification on the \"Orthogonal\" Setting:** We thank the reviewer for highlighting this, as it seems to be a key point of confusion. The data in our analysis is explicitly **non-orthogonal** along the dimensions of interest, which is central to our claim. The \"semi-orthogonal\" construction (Assumption 1) means that we are analyzing a high-dimensional space where dependencies are localized to specific coordinates. This allows us to prove that correlations along a few dimensions can cause failure, *even when all other data dimensions are perfectly orthogonal and non-interfering*. This setup strengthens, rather than weakens, our claim by showing that cross-dimensional information cannot necessarily rescue the unlearning process and save the model. We would stress that in purely orthogonal data, DA unlearning may not be problematic, but this is a case of less relevance to the real world.\n\n*   **On the \"Stringent\" Labeling Assumption:**\n The only additional labeling assumption made throughout the paper is Assumption 2. It is easy to see that the assumption is rather general and it simply requires that no two points, one in the forget set other in the retain set, with the same data (x) have opposite labels (y). This is a requirement to establish that **no step size or stopping criteria** can salvage the unlearning process when DA is used in this scenario. It is a mild assumption in practice since on most datasets (e.g. cifar10, imagenet) very similar data points rarely have opposite labels, as one might expect.\n \n*   **On Correlation as the Cause of Failure:** The reviewer suggests DA might hurt even without correlations, citing Fig. 11 in [1]. While other failure modes may exist, our work's focus is to prove that **correlation is a sufficient condition for catastrophic failure**. Our Lemma 3 demonstrates that for our non-linear setting, the DA solution *progressively moves away* from the oracle solution from the very beginning, for *any* step size, making the process actively harmful regardless of early stopping. This is a much stronger and more specific result than observing eventual divergence in a linear model, which one could argue can potentially be resolved with early stopping. \n\n#### **3. On the generality of the 2D \"Bad Minima\" example**\n\nThe 2D example in Section 5.2 is intended as a clear, visualizable illustration of a more general mechanism: **how DA can maliciously reshape the loss landscape to trap a model in a suboptimal basin of attraction.**\n\nThe reviewer asks if this holds for overparameterized neural networks. While a full analysis is beyond the scope of our paper, the underlying principle remains valid. In any model, non-convex or otherwise, the final parameters are a result of balancing gradients from all data points. If a forget set is highly correlated with a subset of the retain set that is critical for defining a good decision boundary (e.g., analogous to support vectors), the ascent-descent process does more than just \"remove\" information. It can create a \"hole\" in the loss landscape where the correct minimum used to be, while simultaneously deepening an incorrect minimum elsewhere. This trapping mechanism is not exclusive to low dimensions and provides a strong intuition for why simple finetuning on the retain set afterwards may fail to recover the correct solution. As a concrete example, consider our setting of semi-orthogonal data with a smaller number of data points than dimensions $d>N$, where there are still multiple points correlated on a single axis. Since the data is orthogonal on the other axes, unlearning is still effectively a one dimensional problem, although the network operates in the overparameterized regime, and our results hold. We agree that repeating the analysis for more complex overparameterized networks is an excellent natural extension, which we postpone to future work. As a final point we would like to argue that the regime with $N > d$ has become more common in practice, where our findings clearly apply, for example, Large Language Models are usually trained on many more tokens than their number of parameters.\n\n### Questions & Clarifications\n\nWe thank the reviewer for pointing out several areas of unclear language. We will revise the paper to improve clarity based on this feedback.\n\n*   **Line 173: \"The data is separable into orthogonal sets Sj for each coordinate j.\"**\n    *   **Clarification:** We will rephrase this to be clearer. This assumption simply means the data matrix has a block-diagonal structure after a permutation of rows, where each block corresponds to a set of samples that only have non-zero elements on a unique, shared set of coordinates. Thus, samples in different sets $S_j$ and $S_k$ (for $j \\neq k$) are orthogonal, while samples within the same set $S_j$ can be (and are in our analysis) correlated.\n\n*   **Line 193: \"Lemma 3 shows that the DA solution is always farthest away from the oracle solution\".**\n    *   **Clarification:** In the 1D context of Lemma 3, \"farthest away\" has a precise geometric meaning that we will make explicit. It means the DA solution $w^{\\text{DA}}$ and the oracle solution $w^{\\mathcal{R}}$ lie on *opposite sides* of the original model's solution $w^{\\mathcal{D}}$. Therefore, any step in the DA direction moves the model *away* from the oracle, making it a worse solution than keeping the pretrained model as is.\n\n*   **Corollary 1: \"What is e_j? Also, the text says it follows from lemma 4, but lemma 4 shows no dependence on lambda.\"**\n    *   **Clarification:** We apologize for the typo; $e_j$ should be $\\alpha$. We thank the reviewer for pointing out this error. The corollary follows from combining **Lemma 4 and Lemma 5**. Lemma 4 shows the distance between the original and oracle solutions is bounded (independent of $\\lambda$). Lemma 5, its counterpart, provides a lower bound on the distance between the DA and oracle solutions, which *grows* as $\\lambda \\to 0$. The combination of these two results leads directly to the conclusion of the corollary, which is a divergence of the solutions. We will correct the text and the typo.\n\n*   **Lemma 4: \"Is there any condition on alpha? The upper bound seems to become negative when alpha < |F| / |R|?\"**\n    *   **Clarification:** The right-hand side of the inequality is non-negative because the logarithm is **inside an absolute value**: $|\\ln((1+\\alpha))|$. This may not have been immediately obvious. We thank the reviewer for this close reading and will add a note to the text to prevent this confusion. The bound holds for any $\\alpha > 0$.\n\n[1] Georgiev et al \"Attribute-to-Delete: Machine Unlearning via Datamodel Matching.\" arXiv:2410.23232v2"}, {"review_id": "Jveoh7l4XK", "reviewer": "Reviewer_MLpH", "summary": "This paper critically examines the Descent-Ascent (DA) framework for machine unlearning---a widely adopted method where gradient ascent is applied to forget a subset of training data, followed by gradient descent on the retained set. The authors argue, theoretically, that this method can fundamentally fail to forget. In particular, they show that when there is statistical dependence between forget and retain sets (even if the forget set is selected randomly), DA can cause the model to converge to poor optima and generalize worse than an oracle model retrained without the forget set.\n\nIn numerical results, the authors numerically show that the DA-based unlearning degrades the accuracy compared to the oracle model.", "questions": "Thank you for your insightful work. I have a few questions and suggestions that I believe could further enhance the clarity and impact of your paper:\n\n1. In Lemma 1, the authors demonstrate that unlearning via distribution alignment (DA) can be detrimental when the accuracies of the test set and forget set are similar. My understanding is that this phenomenon might also lead to degradation in other unlearning methods, such as influence function-based approaches. Could you elaborate on whether this observed issue is a specific limitation of DA-based unlearning, or if it has broader implications for other unlearning paradigms? Furthermore, do you believe certified unlearning methods are robust to the types of failures the authors describe?\n2. The authors highlight the importance of KLoM. To further validate their critique, it would be beneficial to see how other exact unlearning methods, such as influence function-based unlearning or retraining approximations, perform in terms of achieving low KLoM. Including such baselines in their analysis could provide a more comprehensive picture.\n3. In their numerical results (e.g., Figures 6 and 7), DA-based unlearning often successfully removes the forgotten dataset. If the dataset exhibits extremely high correlation (e.g., MNIST), do DA-based methods consistently fail to unlearn? Could the authors provide further insights into their performance under such highly correlated data conditions?\n4. By following the proof of Lemma 1, $ACC_\\tau$ denotes the accuracy for the ground truth distribution. Is it normal to represent this accuracy as the test dataset accuracy?\n5. KLoM appears to be a metric applicable across various datasets (e.g., MNIST, CIFAR-10). Could the authors explain their rationale for conducting experiments with ImageNet-Living-17 specifically, rather than or in addition to these more common datasets?\n\n\nThank you for considering these points. I look forward to the authors' insights.", "limitations": "Yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "### Strongness\n\n1. **Theoretical Analysis:** It has already been shown that DA approaches can be highly unreliable. However, this work is the first work provide a rigorous mathematical analysis showing the failure of DA even in simple settings, such as logistic regression with correlated inputs. Especially, the analysis on low/high dimensions and cross-domain correlations is impressive. \n\n2. **Timeliness:** There have been several recent studies on DA-based unlearning. With this trend, this work sounds an alarm for requiring alternative approaches other than DA-based unlearning, like rewinding-based methods. \n\n### Weaknesses \n\n1. **Regarding Lemma 1:** While Lemma 1 is presented to support the accuracy of the classification task, the core focus of this work appears to be on regression. This discrepancy can be a bit confusing for the reader. Perhaps the authors could clarify the connection between Lemma 1 and the regression tasks, or consider if its inclusion is essential given the primary focus.\n2. **Potential for Theoretical Expansion:** This is an excellent paper as is. However, I believe its impact could be further enhanced by exploring the theoretical extension to multi-layer architectures. This could provide a deeper understanding and broader applicability of this work.\n3. **Clarification on Unlearning Performance (Figure 6):** The authors mentioned that training with random samples degrades unlearning performance due to dependency. In Figure 6, the performance degradation is even more pronounced when the first and second principal components (1st/2nd PCs) are set as the forget set, compared to random samples. Could you please elaborate on why this particular choice of forget set leads to a more significant drop in performance?\n4. **Minor Suggestion:** In Line 94, the paragraph naming seems inconsistent with the other paragraphs. It might be better to standardize the naming convention for clarity.\n\nI hope these suggestions are helpful for improving this manuscript.", "was_revised": true, "final_justification": "The authors responded to my comments. \n- Lemma 1: All the points are clearly addressed.\n- Theoretical expansion: The authors will add directions for future work. \n- Explanation of the 1st and 2nd PCs: The authors clearly explain the details. \n\n\nAlthough this is an insightful work, I am unable to identify a clear justification for this work to be considered groundbreaking.", "rebuttal": "We would like to thank the reviewer for their detailed review and the positive evaluation of our work.\n\nBelow, we address the specific questions and weaknesses raised.\n\n### Weaknesses:\n\n- **Regarding Lemma 1:**\nThe choice of a classification task in Lemma 1 is arbitrary, and the result can be extended to regression by simply modifying the metric. Accuracy is used solely for clarity and simplicity in the lemma’s formulation. Regarding the connection between regression and classification: logistic regression is a classic example of a regression-based method commonly used for **classification** both in traditional machine learning and in deep learning (in its nonlinear realization), hence we opt for classification throughout this work.\n\n- **Potential for Theoretical Expansion:**\nWe agree that extending the result to multi-layer networks would be extremely interesting and broaden the impact of this study. We leave this open for future work.\n\n- **Explaining the 1st and 2nd PC relation to difficulty in unlearning:** \nWe believe some intuition can be given with a relatively simple example: Consider once again a 2-dimensional logistic regression task, where labels are generated by a linear transformation of the data $y_i =T  x_i,i=1\\ldots N$, where $T\\in \\mathbb{R}^2$ is a fixed teacher vector. In particular, we can simply choose $T=$ { $1,-1$ } , which would then correspond to classifying points above and below the line $x_{i,1}-x_{i,2}=0$ as negative and positive, respectively. Next, we train a student with weights $S\\in \\mathbb{R}^2$ to perform logistic regression with labels given by the teacher $T$. If it succeeds, then we expect $S=T$. If we sample points uniformly in a small region near the origin, the influence matrix between a specific point and a test point can be approximated by $I_{z,z_{test}}\\approx -y_{test}y \\sigma(-y_{test}S x_{test})\\sigma(-y S x)x_{test}^T x$ $=-(x_{test,1}-x_{test,2})(x_1-x_2) \\sigma(-(x_{test,1}-x_{test,2})^2)\\sigma(-(x_1-x_2)^2)x_{test}^T x$, where the inverse Hessian term which should appear is proportional to the identity matrix. If we focus on points scattered on a line of roughly constant $x_1-x_2\\approx x_{test,1}-x_{test,2} \\approx c$, the amount of correlation between $x_{test}$ and $x$ determines the influence of the point, thus the PCs of $x_{test}^T x$ are expected to align with the influence PCs. We stress that this explanation is only meant to give intuition, and it would be interesting to perform this analysis directly on the full influence matrices in some tractable, as well as realistic settings.\n\n- **Minor Suggestion:**\nWe thank the reviewer for pointing out the inconsistency. We made the paragraph style consistent with the paragraph above for the rest of the related work section.\n\n### Questions:\n\n- **Degradation in other unlearning methods:**\nThis is a very interesting question, indeed the findings might be applicable to other schemes. The main intuition is that, when unlearning a random forget set, any method that attempts to approximate an oracle model should have a similar accuracy on the forget set and on the test set, since they are perceived by the network as statistically identical. Consequently, methods which aim to produce a large drop in forget set accuracy will deviate from oracle models. Our findings show that this is indeed a prevalent problem in DA based methods. We do not expect the same to occur in influence function-based approaches and certified-unlearning methods since they do not necessarily target a drop in forget set accuracy.\n\n- **KLoM and baselines:**\nIn [1] the authors show how an influence function oriented method (using datamodels) achieves low KLoM scores on the forget set. Since this method does not perform gradient ascent we left it out of this work. We agree it is important to explicitly mention ``datamodels'' success and we will include it in our discussion of related methods.\n\n- **MNIST and high correlations:**\n    Thank you for this insightful question about DA-based methods on highly correlated datasets like MNIST.\n\n    We argue that **MNIST is fundamentally degenerate for machine unlearning evaluation**, making it difficult to assess whether any unlearning method (including DA-based approaches) has truly succeeded. The core issue is that most MNIST points are highly similar to multiple other points in the dataset. When we retrain an oracle model that has never seen the forget set points, its distribution of margins remains very similar to the pretrained model, even on the forget set, making it hard to distinguish between the two.\n\n    To demonstrate this degeneracy, we compare pretrained models (trained on the full dataset) with oracle models (trained without forget sets, requiring no unlearning whatsoever). Previously, on **CIFAR-10**, oracle and pretrained models show large representational differences on forget sets (high 95th percentile KLoM scores) while remaining similar on retained data, consistent with [1]. This pattern indicates that forget set points were meaningfully learned and their absence creates detectable differences.\n\n    **MNIST exhibits the opposite pattern:** Oracle and pretrained models remain nearly identical even on forget sets, with consistently low KLoM scores across all data splits. This similarity persists even when scaling forget set size to 10% of training data. We also tested on **FashionMNIST** which shows some increase in forget set KLoM scores, though not approaching CIFAR-10 magnitudes and clear distinguishability from pretrained models.\n\n    This fundamental issue means that any unlearning method - whether DA-based or otherwise - could appear to \"succeed\" on MNIST simply by \"doing nothing\" (e.g. very small learning rate or number of steps) because the dataset's inherent redundancy makes meaningful forgetting hard to verify.\n\n    |Dataset|Forget %|Forget KLoM (95th)|Retain KLoM (95th)|Val KLoM (95th)|\n    |---|---|---|---|---|\n    |MNIST|0.02%|0.5|0.7|0.71|\n    |MNIST|0.2%|2.72|2.88|2.9|\n    |MNIST|10%|1.79|1.65|1.71|\n    |FashionMNIST|0.02%|4.13|1.87|2.76|\n    |FashionMNIST|0.2%|2.72|1.79|2.70|\n    |FashionMNIST|10%|2.69|2.0|3.31|\n    \n    For reference, we trained 100 pretrained models for each dataset and 100 oracles for each forget set as in our original experiments. We will add this insights to the appendix for the camera ready version.\n\n- **Accuracy of test:**\nYes, it is standard practice to represent the ground truth distribution accuracy using test dataset accuracy. The test set serves as an unbiased estimator of the true population performance, as it remains unseen during model development. By the law of large numbers, this estimator converges to the true accuracy as the test set size increases. Since the ground truth distribution is inherently unknown in practice, the test set accuracy provides the most principled approximation available. This approach aligns with established machine learning evaluation protocols where test performance serves as the gold standard for assessing generalization capability.\n\n- **ImageNet-Living-17:** \nWe apologize for this it was a typo we meant to write cifar-10 here.\n\n[1] Georgiev et al \"Attribute-to-Delete: Machine Unlearning via Datamodel Matching.\" arXiv:2410.23232v2"}]

Author rebuttal:

Meta-review: This paper studies the (failure of) machine unlearning problem in the presence of high correlation between the forget and retain data sets, and itproposes both experimental analyses and theoretical justifications to such behavior. Reviewers have in general find this work interesting and timely, and have reached a consensus on acceptance -- the AC agrees and recommend accept.
Decision: Accept (poster)