Black-Box Forgetting
Authors: Yusuke Kuwana
Yuta Goto
Takashi Shibata
Go Irie
Venue: NeurIPS 2024 poster (2024)
Keywords: Black-Box Tuning
Vision-Language Models
Primary area: machine_vision
TL;DR: We introduce a novel problem of selective forgetting for black-box models and propose a novel method for this problem.

Abstract: Large-scale pre-trained models (PTMs) provide remarkable zero-shot classification capability covering a wide variety of object classes. However, practical applications do not always require the classification of all kinds of objects, and leaving the model capable of recognizing unnecessary classes not only degrades overall accuracy but also leads to operational disadvantages. To mitigate this issue, we explore the selective forgetting problem for PTMs, where the task is to make the model unable to recognize only the specified classes, while maintaining accuracy for the rest. All the existing methods assume ''white-box'' settings, where model information such as architectures, parameters, and gradients is available for training. However, PTMs are often ''black-box,'' where information on such models is unavailable for commercial reasons or social responsibilities. In this paper, we address a novel problem of selective forgetting for black-box models, named Black-Box Forgetting, and propose an approach to the problem. Given that information on the model is unavailable, we optimize the input prompt to decrease the accuracy of specified classes through derivative-free optimization. To avoid difficult high-dimensional optimization while ensuring high forgetting performance, we propose Latent Context Sharing, which introduces common low-dimensional latent components among multiple tokens for the prompt. Experiments on four standard benchmark datasets demonstrate the superiority of our method with reasonable baselines. The code is available at https://github.com/yusukekwn/Black-Box-Forgetting.

Black-Box Forgetting
Yusuke Kuwana Tokyo University Science 46245136ed tus. a...ac.
Yuta Goto
Tokyo University of Science 462351 1 @ed. tus ac
Takashi Shibata
Go Irie
NEC Corporation
Tokyo University of Science goirie@ieee org
t. www.statleeee..... org
Abstract
Large-scale pre-trained models (PTMs) provide remarkable zero-shot classifica- tion capability covering a wide variety of object classes. However, practical applications do not always require the classification of all kinds of objects, and leaving the model capable recognizing unnecessary classes not only degrades overall accuracy but also leads to operational disadvantages. To mitigate this issue, we explore the selective forgetting problem for PTMs, where the task is make the model unable to recognize only the specified classes while main- taining accuracy for the rest. All the existing methods assume "white-box" set- tings, where model information such architectures, parameters, and gradients is available for training. However, PTMs are often "black-box," where infor- mation such models is unavailable for commercial reasons social respon- sibilities. In this paper, we address a novel problem selective forgetting for black-box models, named Black-Box Forgetting, and propose an approach the problem. Given that information on the model is unavailable, we optimize the in- put prompt decrease the accuracy of specified classes through derivative-free optimization. To avoid difficult nigh-dimensional optimization while ensuring high forgetting performance, we propose Latent Context Sharing, which intro- duces common low- wiw-dimensional latent components among multiple tokens for the prompt. Experiments on four standard benchmark datasets demonstrate the superiority of our method with reasonable baselines. The code is available at https://giths: haaaab..commuuuuunn///aaaacee Box-settttoo---oottttttt.
Introduction
Large-scale pre-trained models (PTMs) such CLIP [Radford et all [021 and ALIGN [[a all 20211] have strong capabilities of zero-shot classification for everyday objects. Nevertheless, in prac- tical applications, the classification of all kinds of object classes is rarely required. For example, in an autonomous driving system, would be sufficient to recognize limited classes of objects such cars, pedestrians, and traffic signs. We would not need to recognize food, furniture, animal species. Retaining the classes that do not need to be recognized may decrease overall classification accuracy, well cause operational disadvantages such the waste of computational resources and the risk of information leakage. In this paper, we address the problem of selective forgetting of specified classes [Shibata tuning pre-trained model to reduce the classification accuracy for only the specified classes with-
2021, Grayes all 202A eta 2022)) Darun 2023]. i.c.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Black-Box
Trainable parameters
Prompt
[CLASS]
Text Encoder
Confidence of the ground truth / non ground truth categories
(a) Classes to be forgotten
(a) Confidence
(a) Entropy maximization
Classifier
Random Projection
forget
Image Encoder
(b) Classes to be memorized
(b) Cross entropy minimization
(b) Confidence
memoriae
[z:]
L Loss
Latent Contexts
Derivative- free Optimization
Figure
Overview of black-box forgetting framework. The confidence of each class is computed as the similarity with the image and class (text) embeddings from the black-box pre-trained rision-language model (e.g., CL.IP). The ohtained confidence is used to compute the respective loss functions classes to be forgotten and the classes to be memorized, (a) For the classes to be forgotten, maximize the entropy of the confidence so that the accuracy is reduced. (b) For the classes to be memorized,
minimize the cross-entropy loss retain the accuracy. These two objective are jointly optimized tune learnable text prompt.
objective are not available when the model black-box. We therefore use CMA-ES [Hlansen all 200K]. a derivative- optimizer, to learn the text prompt. Instead of directly optimizing the original high-dimensional context (token) embeddings for the prompt, method learns lower-dimensional latent contexts for mitigating the difficulty of high- dite-mimeniinnl optimization.
gradients
affecting the accuracy for the others While selective forgetting of specified classes has long been overlooked [Ye et all 2022),, a few existing methods have been proposed very recently [Shi 1025 The seminal work Learning with Selective Forgetting (LSF) [Smbata cf all 2021], which has been proposed in the context of continual learn-
et 402L Ye al
2072 Tarin all
ing [Kırkpatrıck all 2010) and Horem 201M) Aljundı al, 2018] and uses a special random code called mnemonic code to control the class-wise memorization and forgetting. A similar idea has been proposed to achieve forgetting by learning noise that maximizes the classification error for the classes to be forgotten [[arnn et all, 2023). An extended version of LSF etll 2022]] allows forgetting of specified classes as well as recovery them by temporarily transferring the knowledge of the classes to be forgotten to another network called deposit module.
Overall, all the existing methods assume the "white-box" setting, where the complete information of the target model is available for training/tuning, including the model architecture, its parameters, and their gradients. However, major PTMs such as GPT-4V [OpenAL MIZE are often "black-box." where the model itself or its information is often fully or partially private due to commercial reasons or considerations of social impact. Since the parameters and their gradients such model, all the existing methods are inapplicable. To the best of our knowledge, selective forgetting methods for black-box models have never been studied date.
accessible in
In this paper, we address Black-Boo Forgetting, i.e., the selective forgetting problem for black- box PTMs, and propose novel approach to the problem. Given the unavailability of model information, our method, unlike the existing selective forgetting methods, does not optimize network parame- ters utilize the gradients of the parameters; decrease the classification accuracy of specified classes to be forgotten in derivative-free optimiza- tion framework. One disadvantage of derivative-fres optimization would be that it is not effective nor efficient for bighh-dimensioal problems due to the low convergence rate in high-dimensional spaces [Qian et all 20161, and unfortunately, the textual prompt typically parameterized as a set
instead optimize the input textual prompt
Note that the problem focused on this paper is closely related but different from the typical "machine unlearning" problem, which is the task removing an arbitrary sample from pre-trained model. i.c., obtaining
a model that is identical to the model trained from scratch without that sample (Cao and Yang 20E. Golakar
GEAR 20ME
Sekbart al G0Mil
Bourtonle M121 Golatkar all 202I Kurmanji al

---

of figh-dimensional vectors in PTMs, e.g., 512-D for each "context" (i.e., learnable token in the prompt) in CLIP ViT-B/16 [Dosovitskiy et all 20211 To mitigate this issue, we propose Latent Context Sharing (LCS),, a novel parametrization method of the contexts. The core of LCS is to pa- rameterize each context with low-dimensional latent components, which consist of token-specific components and common components among multiple tokens for the prompt. Experimental results on four standard benchmark datasets demonstrate that our method improves zero-shot CLIP and outperforms reasonable baselines based on black-box prompt tuning eS (0226))
The main contributions of this paper are summarized follows:
We introduce Black-Box Forgetting, novel problem of selective forgetting for black-box models.
We propose a novel method for Black-Box Forgetting based on derivative-free optimization of learnable text prompt.
We introduce Latent Context Sharing (LCS), novel parametrization method of contexts for mitigating the difficulty of high-dimensional optimization with derivative-free optimiza- tion.
Related Work
Machine Unlearning Machine unlearning aims to remove an arbitrary sample from a pre-trained model, i.c., obtaining model that is identical to the one trained from scratch without that sam-
ple [[Cao and Yang, 201S, Golatkar el all 2021, Sekhari etall 20211, Bourfoule et all, 2021I, Kur
manji et al, 2023. Guo et all 20220 Chen et all 2019]. Many methods have been proposed, for example, to construct a forgettable model by transforming the learning algorithm into a sum of the training samples [Cao and Yang. 201S). to achieve forgetting by linear approximation of a nonlinear model [Golatkar et all, 2021]. and to update the model be closer to farther from the original model in the retain / forget samples [Kurmanji et al. 20233.. Methods specific to certain learning algorithms such as LDA [Giuo ell [020 and SVM [Chen et all 2019 have also been explored. Machine unlearning and Black-Box Forgetting are closely related but different; Machine unlearning aims to remove the influence of specified training samples on the training model, whereas Black- Box Forgetting aims to prevent the recognition of specified classes. Forgetting specified classes has attracted much attention recently in various contexts [[Heng and Sol, 2023, Lu et 2022), Zhang We in this paper address the black-box setting,
aLa 2022, Shubata et all 2021 (Ye et all 2022]. which has not yet been explored.
Selective Forgetting. Shibata et all [2021]] proposed Learning with Selective Forgetting (LSF), which updates the model for a new task by forgetting only certain classes from the previous task while memorizing the rest of the classes. Golatkar all [202]]] introduced scrubbing method that involves a shift in weight space and addition of noise to the weights to remove information from network weights. They also proposed forgetting mechanism linearly approximate the weights that would have been obtained by unlearning [Kolatkar et all, 2020 2(21]). aarun et all [2023] proposed an gror-maximizztion baseed method to learn noise matrix for the class to forget, and the model is updated by training on this noise. Then, fine-tuning on the classes to be memorized to adjust the model weights.
Since these methods require the model weights or the gradient of the model parameters, they cannot be applied to black-box models. In this paper, we introduce new selective forgetting method for blxck-box models that does not require the model weights or the gradient of the model parameters.
Black-Bas Box Learning. Black-Bor Tuning (BBT) [Sun et all 20226] is a black-box prompt tuning method for large language models. BBTv2 [Sun et all 20223] improves BBT with deep prompt tun- ing. They achieve accuracy comparable to white-box learning methods various natural language tasks. BDPL [Diao et all, 2023] fine-tunes a collection of discrete prompts for language models by treating the word choice in the prompt as a reinforcement learning policy.
BIackVIP [Oh all 2023], the first black-box learning method for vision-language models, opti- mizes a generative model that generates visual prompts embedded images by zeroth-order opti- mization. LFA Of 2 extends the capabilities of black-bo box models by assuming access
3

---

to computed features from pre-trained backbones. Through multi-stage procedure, it optimizes projection layer to enhance alignment between pre-computed image features and class prototypes. Guo et all [2023] introduced collaborative black-box tuning (CBBT) for optimizing both the tex- tual prompt and adapting output visual features black-box vision-language models. The textual prompt is optimized by estimated gradients and the visual adapter is trained through direct super- vised learning from the output features.
In this study, we focus on textual prompt tuning for the black-box model and introduce Latent Context Sharing (LCS), which improves accuracy while reducing the number of dimensions to be optimized.
3 Method
The overview of the proposed method illustrated in Fig. MI We use the vision- language model CLIP [Radtord et all 202[] as the base model and optimize an input prompt for the CLIP text en- coder based on the loss that requests duced accuracy of selected classes. The derivative free optimization method must be used to optimize a textual prompt for the black-box model where the gra- dients of its parameters are unavailable. We employ CMA-ES, widely used evo- lutionary algorithm for black-box opti- mization in continuous, because tex- tual prompt to be optimized is a con- tinuous variable. CMA-ES a multi- point search algorithm based on multi- variate normal distribution and proceeds the search by iterating (i) sampling candi- date solutions, (ii) evaluating the loss val- ues of the candidates, (iii) weighting the candidates based on the loss values, and (iv) updating the mean and covariance matrix of distribution by using the weighted candidates. Due to the nature of multi-point search, the performance of CMA-ES degrades in ligh-dimensional problems, typically ten or more dimen- sions [Ros and Hansen, 2008 Akimota and Hansen, 2016). While several ex- tensions have been proposed, e.g., [Ros and Hansen, 2008, Akimoto and Hansen. 2016), these methods require knowledge of independence among variables, which not always known. In this paper, we propose a customized extension of CMA- ES Black-Box Forgetting. In general, when applied to high-dimensional black- box continuous optimization by CMA- ES, the computational complexity can be- come a hindrance. The key is reducing the dimensions of the latent variables in the textual prompt while preserving their context representations.
Pm
Prompt
(a) Vanilla
P
Pm
[2]]
2an1l]
Prompt
Latent Contexts
(b) BBT
P1
77,
7
Prompt
D
Shared Latent Context
Unique Latent Contexts
LCS
Figure 2: Comparison of context parametrization. (a) Vanilla prompt tuning optimizes the textual prompt directly. This approach requires high-dimensional optimization. (b) BBT [Sun all 20226] opti- mizes a lower-dimensional latent context instead of directly optimizing textual prompt to mitigate high dimensionality. (c) In our LCS, for more effective optimization. latent context is composed of unique components and common components among mul- tiple latent contexts, and each component is opti- mized independently.

---

3.1 Context Parametrization
We discuss two types of context parametrizations: i) Latent Representation with Random Projection for Blx Tuning (BBT) [Sun ala 20222] as preliminary; ii) Latent Context Sharing (LCS) for our method, a more effective context parametrization approach for the black-box forgetting.
1) Preliminary: Latent Representation with Random Projection. The dimension D of context in the prompt extremely large, which makes derivative-free optimization difficult. To mitigate this high dimensionality, BBT introduces low-dimensional latent context [zau] E idxm where d is the dimension of a latent context and m is the number of latent contexts. Then, BBT divides [zaul into [zi] E Rd and generates contexts for the prompt by projecting them to the original context dimension by a random projection A E DDxd (see Fig. Mi) sampled from normal distribution (O r), where a is the standard deviation of the context (token) embeddings. The dimension of variables to be optimized is suppressed more than optimizing context directly because d is lower dimension than the original context dimension (d < D).
ii) Latent Context Sharing. As empirically shown later in Sec. ? the effectiveness of the con- text parametrization for BBT described above is limited for selective forgetting settings. We propose latent context sharing (LCS), more efficient context parametrization.
Fig. 2C shows the overview of LCS. The key idea to assume shared parameters among differ- ent latent contexts. This inspiration comes from successful word embedding methods; most word embedding methods are trained on the assumption that locally co-occurring words have semantic correlations between them (e.g., [Milkolov el 2013, Pennington et al, 2014, Devlin all 2011))). This inspires the idea of explicitly modeling semantic correlations between words prompt as shared components. We assume that each latent context is composed of unique components (Unique Latent Contexts (ULC)) and common components (Shared Latent Context (SLC)) among multiple latent contexts. Then, we optimize each ULC and SLC independently. Each latent context [z,] is obtained by concatenating SLC [z²] E RRd and ULC [z"], E Rdd (i = 1, 1,,.. m)) where m is the number of latent contexts, and d are the dimension of SLC and ULC, respectively. Despite the number of parameters prepared for BBT and LCS is the same (m d d' m x dd),, LCS is possible to significantly reduce the number of optimization dimensions compared to BBT because LCS optimizes each ULC and SLC independently. Compared to assuming that each latent context is completely independent (i.c., using only ULC), providing common components has the substantial advantage of not losing dependencies among multiple tokens for the prompt.
Note that, CoCoOp [Zhou et all 20222| also introduces an approach that incorporates a shared component in the context of the prompt to improve the generalization in the white-box setting. While CoCoOp learns the network that generates shared component based on image features, our method directly learns the shared component. The optimization for our black-box forgetting using our method becomes simpler because the number of dimensions for optimization minimal. As shown in the experimental results in Sec. Hl introducing shared component is effective, which suggests that optimization of shared components has a impact in our problem settings.
3.2 Loss Functions
We apply different loss functions to the classes to be memorized and the classes to be forgotten. The cross-entropy loss is used for the classes be memorized to maintain the classification accuracy:
memorriz (p, p, C) Σ tg log Pa.
(1)
where C' is the total number of classes, p is confidence of each class obtained by applying the Softmax function the similarity of each class, which is the output of CLIP, and t is the one-hot vector of the label of an input image.
A naive approach to ensuring that selected target classes are forgotten is to reduce the confidence of that class in the input images of the class. In general, however, this naive approach leads to undesirable behavior in the model. For example, if we force the model to forget the class "dog."
"The actual amount of calculation is ((d)) CMA-ES estimates the covariance matrix internally.
5

---

it may lead to the model always classifying images of "dog" as the class with features similar to "dog." e.g., "cat." Moreover, such an unintentional bias may provide sufficient clues identify the forgotten classes, and consequently may lead to the risk of information leakage. We, therefore, want to make the classification results for images with the forgotten classes close to random and exclude information about the classes. To this end, we maximize the entropy of confidence for each image of the classes to be forgotten. The loss function for the classes to be forgotten is as follows:
1 Σ
torget (p. C) C)= -
log Ps.
(2)
1=0
where p and C are the same as Eq. (L).
To summarize, the final objective that we minimize becomes L = memmrrize + Ltrrget- We optimize latent contexts by CMA-ES using the final objective L.
3.3 Derivative-Free Optimization: CMA-ES
Since backpropagation cannot be applied to black-box models, we adopt the CMA-ES (Covariance Matrix Adaptation Evolution Strategy) [Hansen ata 20033), which a derivative-free optimizer for continuous optimization. In the 1-th iteration, the CMA-ES samples the À candidate solutions from a multivariate normal distribution N(m, of C.), where m; E R is the mean vector of the search distribution, dg E R is the step-size, C, E R is a covariance matrix. The À solutions should be evaluated on an objective function f. then the CMA-ES updates the parameters C₁, m, and by ranking the \ solutions by function value (cf. Haasen, 2016)).
4 Experiments
We evaluate the class forgetting performance of our method on image classification tasks. We first describe our experimental setup, including the datasets, baselines, implementation details, and eval- uation metrics. We then report the main comparative results between our method and the baselines, as well series of analyses of our method.
4.1 Setup
Datasets. We use four benchmark datasets, i.e., CIFAR-IO, CIFAR-100, CUB-200-2011 I, and Ima-
geNet30. CIFAR- and CIFAR- comprise of total of 50,000 training images and 10,000 test images (Knzheskyy et all 2009] These datasets have 10 and 100 classes, respectively. CUB-200
2011 el 2011] comprises of images of 200 distinct bird species, with 5,994 training images and 5,794 test images. ImageNet30 [Hendrycks et al, 201 is a 30-class subset of the original ImageNet- 1k dataset [Deng all, 2009 (The results the original ImageNet- dataset can also be found in Appendix A.2). It consists of 39,000 training images and 3,000 test images. We conduct experiments in the few-shot condition. We randomly select different l samples of each class from the original training images to construct a k-shot training set and a k-shot validation set. We set ls to 16 for CIFAR- 10 and ImageNet30, 4 for CIFAR-100, 1 for CUB-200-2011. For testing, we use the original test set. Unless otherwise noted, the first 40% of classes are to be forgotten, while the other classes are to be memorized.
Baselines. Black-Box Forgetting has never been studied before, and there is no existing method directly applicable this problem. So compare the proposed method with zero-shot CLIP [Rade ford 2021], BBT [Sun all, 2022 and CBBT [Kino et all 2023), which are the reasonable baselines it is for black-box prompt tuning. We apply the same loss functions BBT and CBBT (w/o adapter) for comparison. CBBT introduces a method that combines textual prompt tuning and adapting output visual features for black-box lisiuanlanguage models. However, in this paper, the conditions are such that visual features cannot be obtained, and only the final in- ference results
method to
be used. So we compared the proposed method with CBBT without using any adapter. We also apply the same loss functions as our method to CoOp [Zhou all (0225)) a white- box method, and use the results as reference values under conditions where information on the target model is available.
3.4 httttts///// h/w/ww//wwwww/ toronto. edu/ ww-kkriiiiifaa html

---

Table I: Comparisons with the basclines. The best value is shown in bold. BBT [Sun all 203N and CBBT (w/ adapter) et all 2023] are the reasonable baselines as these are black-box prompt luning. CoOp al 2022h is a white-box method and is included for a reference. Performance is evaluated using the three metrics: the error Erri for the classes to be forgotten, the accuracy AcCmem for the classes be memorized, the harmonic mean H of Erri and AcCmem. Higher
values mean better performance.
CIFAR-I0
CIFAR-I00
Method
H
Errtor 1
AcCmem
H1
Errior T Accmem
Shro-Shot CLIP
15.30
8.37
89.05
42.14
31.17
65.03
BBT
85.69
=9.31
93.19
78.3640.01
87.30+0.01
71.09+0.00
CBBT
93.4840.02
90.99_0.01
96.11
73.20+0.00
72.6940.01
73.72+2000
Ours (w/o LCS)
+0.13
58.57=0.17
94.68
79.38+0.02
89.17
71.52+0.01
Ours
95.07+00011
96.10-0.02
94.066.0.11
80.99_0.00
93.37 +0.02
71.52+0.01
CoOp (Whit-Box)
96.49
96.95_0.01
96.044..00
82.22+0.00
999.81+0.00
69. 00.00
CUB-200-2011
ImageNet30
Method
H
Errior t
AcCmem
H1
Errtor f 1.17
Acemem
Zero-Shot CLIP
46.30
46.20
46.41
2.31
98.00
BBT
58.7510.01
88.98
43.85
94.2210.05
90.17
99.06 99.06
CBBT
56.84
73.52.0.02
46.33.10.1
87.88
79.69.10.12
99.32
Ours (w/o LCS)
58.7840.01
85.85=0.01
44.69
95.26410u2
92.1940.08
98.59
Ours
59.67 +0.01
89.29
44.81
97.28
45.9440.01
98.67 +0.01
CoOp (White-Box,
63.20
98.09
46.62
99.30
99.72
98.89+0.01
Implementation Details. We use ViT-B/16 [Dosovitskiy et al. 20211 as our CLIP image encoder. We set the number of latent contexts 4 for CIFAR-10, 10, and m 16 for CIFAR- CI0A CUB- 200-2011 I and ImageNet30, respectively. The dimension of latent context in BBT d. Shared Latent Context (SLC) d', and Unique Latent Contexts (ULC) d are set to d = 10, d 20, d 5 for CIFAR-10, and d = 125, d= 400, d 100 for 10FAR-100, CUB-200-2011 and Ima3eNet30, re- spectively. For optimization, CMA-ES with the population size of 20 is applied in all the conditions. as done in (Sun_ct_an 21226J. We optimize the latent contexts for 400 iterations for CIFAR- 10 and ImageNet30, and 800 iterations for CIFAR-100 and CUB-200-2011. All the hyperparameters are tuned on the validation sets, which are distinct from the training and test sets.
Evaluation Metrics. We use the following three evaluation metrics: (i) ErTior is the error for the classes to be forgotten; (ii) Accmem is the accuracy of the classes to be memorized; (iii) H is the harmonic mean of Errior and Accmem forgetting performance as it is balance between the forgetting rate for the classes to be forgotten and the classification accuracy for the classes to be memorized. Higher values for all these metrics are desirable. For all the experimental results, including those in the Appendix sections, we report the average performance of the three runs with different random seeds, well as their standard deviations.
in [Shibata et all, 2021]. H gives the overall selective
4.2
Main Results: Comparisons with Baselines
Table M shows the main comparative results with the baseline methods. Our method improves zero- shot CLIP and outperforms all the baselines all the datasets.
Comparing our method with BBT, these two are comparable in Accmem- However, ours is signifi- cantly better than BBT in Errior and consequently clearly outperforms BBT in H well for all the datasets; in particular, ours is better than BBT by 9.38% on CIFAR-IO. These results suggest that our LCS can optimize the learnable latent contexts more effectively in the black-box setting than BBT, which optimizes all the latent contexts independently.
When comparing our method with CBBT, which is the state-of- of-te-------rrr art black-box tuning method, we can see that ours outperforms CBBT on all the datasets. While ours is slightly inferior in Acomem: it is significantly better in Errio on all the datasets. These results demonstrate that our method achieves higher selective forgetting performance than CBBT and is more suitable for the black- box forgetting task.
7

---

0.90
0.9
0.94
EPPior
AcCromm
0.85
0.92
0.7
Ours
Ours
0.90
Ours
0.70
BBT
BBT
BBT
0.65
0.5
0.88
16
171
TYL
Figure Sensitivity the number of latent contexts. Results of BBT [Sun all 20226) and Ours for varying number of latent contexts. can see that our method shows stable performance within a wide range of the number of latent contexts in contrast BBT.
To clarify the impact of our context parametrization method, LCS, we also evaluate the performance of Ours (w/o LCS), i.e., the case without LCS where each latent context optimized independently. Although these two are highly comparable in Acemem- Ours (with LCS) clearly outperforms Ours (w/o LCS) by large margins and consequently shows distinct superiority in as well. These results prove that adequate selective forgetting performance cannot be achieved without LCS. Interestingly, these evaluations clearly suggest that each latent context not inherently independent and that the idea of LCS to model dependencies among latent contexts by introducing a common latent component valid.
Finally, we compare our method with the white-box method based on CoOp [Zhou el al 20226),
where the latent contexts optimized by minimizing the loss functions ours through the standard backpropagation process. Although CoOp is better able to increase Err than Ours, the differences within the acceptable ranges. For example, the difference in Err is less than 1% and that in H is less than 2% on CIFAR-10 10. These results show that even though our method is black-box it can perform as well as white-box approaches.
4.3 Analysis
4.3.1
Sensitivity to The Number of Latent Contexts
We investigate the sensitivity of the performance of our method to the number of latent contexts m. Fig. B shows Erriar Acomem and when the number latent contexts m is varied on CIFAR-10 As the number of latent contexts increases, the performance in all the metrics tends improve. This is natural behavior, as the performance improves as the number of trainable parameters in- creases. Comparing Ours and BBT, we see that Ours for comparable. This means that BBT needs to optimize about four times the number of dimensions to compete with our LCS, indicating that our LCS provides excellent trade-offs. Furthermore, while BBT suffers a sharp drop in accuracy with decreasing m, our method shows only a small decrease from m 16 when 1. This suggests that L.CS is robust to the decrease in the number of latent contexts and its significant superiority to BBT for latent context representation.
4 and BBT for
16 are almost
4.3.2 Sensitivity to The Dimensionality of SLC and ULC
We investigate the sensitivity of our method d' and d², which the number of dimensions of SLC and ULC, respectively. In our LCS, the total number of dimensions d to be optimized is determined d d' + x d (see Sec. [3:I] evaluate the performance when change the ratio d= : d under the condition where 40 and m = for CIFAR-10, and d 2000 and m = 16 for CIFAR-100 and CUB-200-2011. Fig. shows the results on the three datasets. First, we can see that for all the datasets, the performance in Err and H significantly degrades for d' = 0 (i.c., when no SLC used) than for the other cases, which supports the validity of the core idea of our LCS that introduces the shared components. As expected, the performance is substantially improved by setting the appropriate ratio. This natural trade-off: if d (i.e., the number of dimensions of SLC) is too large, the ability to represent the context is reduced and performance deteriorates; conversely, d (i.e., the number of dimensions of ULC) is too large, optimization becomes difficult and performance deteriorates. Meanwhile, our method achieves satisfactory performance in the wide range of d= da, Second, when we compare Ours with BBT, Ours superior BBT in the wide range of d= d These results justify the strong robustness of our method to d= and d=

---

0.9
0.90
0.94
0.8
0.85
0.93
0.00
0.92
Ours
Ours
Ours
0.75
BBT
0.6
BBT
0.91
BBT
36:1
28:3
20.5
12:7
4:9
0:10
36:1
28:3
20:5
12:7
4.9
0:10
362
28:3
20.5
12:7
4.3
0:10
:d
d dd
d
:d
(a) CIFAR-10
0.730
0.94
0.01
0.725
AcCumm
007720
0.80
0.715
Ours
0.88
Ours
0.710
Ours
0.78
BBT
8BT
0.705
BBT
0.77
400:100
240:110
80:120
0:125
400:100
240:110
80:120
0:125
0.700
400:100
240:110
80:120
0:125
d
d' d
d d"
(b) CIFAR-100
0.598
0.90
0.450
0.596
0.594
(CCamm A.C
0.88
0.444
0.590
0.87
0.442
Ours
Ours
Ours
BBT
0.86
BBT
0.440
BBT
0.586
0.85
0.438
400:100
240:110
00:120
0:125
400:100
240:110
80:120
0:125
400:100
240:110
80:120
0:125
d d
d d
d d
(c) CUB-200-2011
Figure Sensitivity the dimensionality SLC and UL.C. Results of BBT [Sun all 202M and Ours varying number of dimensions of SLC and ULC d² We can see effectiveness our method in the wide range of d' d
Table 2: Ours vs. BET with modified CMA-ES. Results of V&D-CMA-ES are for k = 30 on CIFAR-10 and for k 1500 on CIFAR-100, CUB-200-2011, and ImageNet30.
CIFAR-10
CIFAR- 100
Method
H
Errtor
AcCmem
H
Errtor
AcCmem
BBT w/ Sep 93.38
93.33
10.02
94.64.o.0
69.29
0.001
67.83 10.02
70.81 10.01
BBT w/ VkD
94.11.0.00
05.22510.0
92.99
75.41
0000
79.56 00.0
71.67
10.01
Ours
95.07
-0.01
96.10=o.00
94.0640.01
80.99
93.37 =0.02
71.52+0.01
LUBB200-2011
ImageNet30
Method
H
Errior
Accmem
H 1
Errior
Accmem
BBT w/ Sep 53.74.0.02
74.72.0.02
41.9641.02
91.18
84.44=0.04
99.07 =0.00
BBT w/ VkD
55.12
$1.4940.00
41.65
91.25
84.58
99.0641.00
Ours
59.67 =0.01
89.29
44.81 40.01
97.28 #0.01
95.94=0.01
98.67+4.01
4.3.3 Ours vs. BBT with Modified CMA-ES
CMA-ES [Hansen et all 2003] widely used in black-box optimization, but when applied to high- dimensional black-box continuous optimization, the computational complexity can become a hin- drance. To apply CMA-ES high-dimensional optimization, modified versions such as Sep-CMA- ES (Sep) [Ros and Hansen, 2008] and VKD-CMA-ES (VkD) [[kimoto and Hansen. 2016 have been developed. Sep-CMA-ES realizes the computational complexity ((d) that is linear with re- spect to the number of dimensions by restricting the covariance matrix to diagonal matrix. In other words, the solution generation distribution of Sep-CMA-ES does not consider the covariance between variables, but only the variance of each variable. In VKD-CMA-ES, the covariance matrix

---

1.0
0.8
Zero-Shat CLIP
0.7
BBT
Err
Ours (w/o LCS)
0.4
0.4
Ours
(white
0.3
0.1
0.8
0.2
0.5
Figure Sensitivity the ratio of the classes to forgotten. Results on CIFAR-IO when changing ratio of the classes to be forgotten. Our method is robust to the ratio of the classes to be forgotten compared to baselines.
is expressed as C D(I VV D, where D is a diagonal matrix, V is d k-dimensional real matrix in which each column is orthogonal, and a hyperparameter that determines the degree of freedom of the covariance matrix model. Given the availability of these modified CMA-ESs, one question would be that, can our method still perform better than BBT, even when combined with these modified CMA-ESs? Table / shows the comparisons between Ours and BBTs with the above two variants of CMA-ES, Ours achieves the best performance terms of H and ErTtor for all the datasets. In particular, the two BBT variants show Errior more than 10% lower than method on CIFAR-100 and ImageNet30. These results show that our LCS surpasses Sep-CMA-ES and VkD-CMA-ES context parametrization method in the black-box forgetting task.
4.3.4 Sensitivity The Ratio The Classes Be Forgotten
Fig. shoows Errior and H when changing the ratio of the classes to be forgotten Yoor on CIFAR-10 For BBT,
decreasing trend in Erria the number of classes to be forgotten increases. This suggests that the context representation of BBT is inefficient, making it difficult to forget mul- tiple classes time. CBBT shows some robustness, but with BBT, we that Errtor tends to decrease as the number of classes to be forgotten increases. In contrast, our method does not decrease Ertior even if the number of classes be forgotten increases, which confirms the strong performance of our LCS. In terms of H, compared to the baselines, our method shows high robust- ness independent of the number of classes to be forgotten and achieves high selective forgetting performance.
Limitations
Our method optimizes the context (token) embeddings of the model through derivative-free opti- mization, CMA-ES. That is, we assume that we have access to the context embeddings of the target model. This is common blxck-box setting, similar assumptions have also been made in most of the existing studies [Sunn et all 20225a, Guo et all 2023]. However, there should models in the real world with higher level of "black boxness," i.e., models in which even access contextual embeddedness is prohibited. Addressing such a case is subject for future research.
Conclusion
We proposed Black-Box Forgetting, novel problem of selective forgetting for black-box models. introduced Latent Context Sharing (LCS), an efficient and effective parametrization method of prompt, which is suitable for derivative-free optimization. Experimental results demonstrated that our method outperforms the reasonable baselines with significant margins. In addition, the sensitivity analyses showed the effectiveness of our LCC..
10

---

References
Youhei Akimoto and Nikolaus Hansen. Projection-based restricted covariance matrix adaptation for high dimension. In Proc. GECCO, pages 197-204, 2016.
Rahaf Aljundi, Francesca Babilomi, Mohamed Elhoseiny, Marcus Rohrbach, and Tinne Tuytelaars. Memory aware synapses: Learning what (not) to forget. In Proc. ECCV, pages 139-154, 2018.
Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette- Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In Proc. IEEE
Symp. Security and Privacy, 2021.
Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In Proc. IEEE Symp. Security and Privacy, 2015.
Yuantao Chen, Jie Xiong, Weihong Xu, and Jingwen Zuo. A novel online incremental and decre- mental learning algorithm based on variable support vector machine. Cluster Computing, 22: 7435-7445, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proc. CVPR, pages 248-255, 2009.
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proc. NAACL-IILT, 2019.
Shizhe Diao, Zhichao Huang, Ruijia Xu, Xuechun Li, Yong Lin, Xiao Zhou, and Tong Zhang, Black- box prompt learning for pre-trained language models. TMLR, 2023.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. ICLR, 2021.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Se- lective forgetting in deep networks. In Proc. CVPR, pages 9304-9312, 2020a.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In Proc. ECCV, pages 383-398, 2020b.
Aditya Golatkar, Alessandro Achille, Avinash Ravichandran, Marzia Polito, and Stefano Soatto. Mixed-privacy forgetting in deep networks. In Proc. CVPR, pages 792-801, 2021.
Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. Proc. AAAI, pages 1 11516-11524, 2021.
Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. In Proc. ICML, 2020.
Zixian Guo, Yuxiang Wei, Ming Liu, Zhilong Ji, Jinfeng Bai, Yiwen Guo, and Wangmeng Zuo. box tuning of lisiuuelanguage models with effective gradient approximation. In Proc. EMNLP, 2023.
Nikolaus Hansen. The ema evolution strategy: A tutorial. arXiv preprint arXiv: 1604 2016.
Nikolaus Hansen, Sibylle D Müller, and Petros Koumoutsakos. Reducing the time complexity of the derandomized evolution strategy with covariance matrix adaptation (cma-es). Evol. Comput., 11(1):1-18, 2003.
Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. Proc. NeurIPS, volume 32, 2019.
Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. In Proc. NewrIPS, 2023.

---

Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoe Le, Yun-Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and languale representation learning with noisy text supervision. In Proc. ICMI., pages 4904-4916, 2021.
James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Barrskkka et al. Overcom- ing catastrophic forgetting in neural networks. PNAS, 114(13):552 2017.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, 2009.
Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning. In Proc. NeurlPS, 2023.
Zhizhong Li and Derek Hoiem. Learning without forgetting. TPAMI, (0(12))299552299999 2017.
Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept
crasure in diffusion models. In Proc. CVPR, pages 6430-6440, 2024.
Tomas Milkolov, Kai Chen, Greg Corrado, and Jeffrey Dean. Efficient estimation of word represen- tations in vector space. arXiv preprint 1301.3:3301.770 2013.
Changdae Oh, Hyeji Hwang, Hee-young Lee, YongTaek Lim, Geunyoung Jung, Jiyoung Jung, Hosik Choi, and Kyungwoo Song. Blackvip: Black-box visual prompting for robust transfer learning. Proc. CVPR, 2023.
OpenAl. Gpt-4v(ision) system card. 2023.
Yassine Ouali, Adrian Bulat, Brais Matinez, and Georgios Tzimiropoulos. Black box few-shot adaptation for vision-language models. In Proc. ICCV, pages 15534-15546, 2023.
Jeffrey Pennington, Richard Socher, and Christopher Manning. Glove: Global vectors for word
representation. In Proc. EMNLP, pages 1532-15433 2014.
Hong Qian, Yi-Qi Hu, and Yang Yu. Derivative-free free optimization of high-dimensional non-convex functions by sequential random embeddings. In Proc. IJCAI, 2016.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In Proc. ICML, pages $748-8763, 2021.
Raymond Ros and Nikolaus Hansen. A simple modification ema-es achieving linear time and space complexity. In Proc. PPSN X, pages 296-305, 2008
Ayush Sekhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. Remember what you want forget: Algorithms for machine unlearning. In Proc. NeurIPS, 2021.
Takashi Shibata, Go Irie, Daiki Ikami, and Yu Mitsuzumi. Learning with selective forgetting. In Proc. IJCAI, volume 3, page 4, 2021.
Tianxiang Sun, Zhengfu He, Hong Qian, Yunhua Zhou, Xuan-Jing Huang, and Xipeng Qiu. Bbtv2: towards gradient-free future with large language models. In Proc. EMNLP, pages 3916-3930, 2022a.
Tianxiang Sun, Yunfan Shao, Hong Qian, Xuanjing Huang, and Xipeng Qiu. Black-box tuning for mmnguag--moddllas---sseeeee In Proc. ICML. pages 20841-20855. 2022b.
Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unlearning. JEEE Trans. Neural Netw. Learn. Syst., pages 1-10, 2023.
Catherine Wah, Steve Branson, Peter Welinder, Pictro Perona, and Serge Belongie. The caltech-ucsd birds-200-2011 dataset. Technical report, 2011.
Mitchell Wortsman, Gabriel Ilharco, Jong Wook Kim, Mike Li, Simon Kornblith, Rebecca Roelofs, Raphael Gontijo Lopes, Hannaneh Hajishirzi, Ali Farhadi, Hongseok Namkoong, et al. Robust fine-tuning of zero-shot models. In Proc. CVPR, pages 7959-7971, 2022.
12

---

Jingwen Ye, Yifang Fu, Jie Song, Xingyi Yang, Songhua Liu, Xin Jin, Mingli Song, and Xinchao Wang. Learning with recoverable forgetting, Proc. ECCV, 2022.
Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learn- ing to forget in text-to-image diffusion models. In Proc. CVPR, pages 1755-1764, 2024.
Kaiyang Zhou, Jingkang Yang. Chen Change Loy, and Ziwei Liu. Conditional prompt learning for vision-language models. Proc. CVPR, pages 121116625, 2022a.
Kaiyang Zhou, Jingkang Yang. Chen Change Loy, and Ziwei Liu. Learning to prompt for vision- language models. IJCV, 13009):3377-244, 2022b.
13

---

A Appendix
A.1 Broader Impacts
In this paper, we introduced the novel problem called Black-Box Forgetting, i..., the task of selective forgetting for large-scale and black-box pre-trained models, and demonstrated the potential effective- ness of parametrizing the latent contexts in the text prompts into unique and shared components. We here would like emphasize several potential benefits of our work.
1. Toward addressing the "Right to be Forgotten": It should comply with the request that if service provider is asked remove information so that their model cannot recognize cer- tain information. This can be accomplished by training the model from scratch by removing samples of that class from the training data. However, retraining a large-scale model con- sumes enormous amount of energy, which should be avoided. Selective forgetting may provide an efficient solution to this problem.
2. Toward efficient large-scale pre-trained models: Improving the efficiency of large-scale pre- trained models is of current interest many researchers. Various attempts have been made such as model compression and architecture optimization (e.g.. httts::/ssttet google. com/view// wtwp://w////e//eeee//mmmmmm// haro///rrrmm....//
Meanwhile, as the "scaling law" indicates, the reasonable size model correlates with the amount of knowledge memorizes. Therefore, the number of classes (amount of knowledge) that can be recognized by the model is limited, the model can be scaled down accordingly, thereby improving the efficiency of the model. This contributes to expanding the applicability of large-scale pre- traitrained models.
3. Toward better control over text-to- text-to-image generation: While diffusion -ased text-to-iman immee generation can generate diverse types of higl-quality images, controlling the content of images remains a challenge. Recent research has focused on "forgetting" visual concepts in order to avoid generating undesirable content [Graves all 2021, eu 2024, Zhang et all [2024]. These methods forget certain classes by directly fine-tuning the diffusion model, but tuning the diffusion model itself is often costly. In contrast, given that typical generative models use text encoder of pre-trained VLM (c.g., CLIP) for conditioning, our method may provide an efficient approach to class forgetting by fine-tuning only the prompts of the text encoder.
We believe that our paper will open new directions for these important problems of interest to the machine learning community, even if these immediately feasible with this paper alone.
A.2 Comparative Results ImageNet-Ik
We conduct experiments on ImageNet-Ik Ik (Deng et al, 2009 to verify the effectiveness our method on larger-scale dataset. The setup is the same the cases for CIFAR- 100 and CUB- 200-2011 1 (see Sec. I].. The results are shown in Table & Our method outperforms all the baselines in terms of H and Errior, which supports the effectiveness of our method further.
Table 3: Comparative results ImageNet-IK.
Method
H f
Errior 1
Accmem 1
Zero-Shot CLIP
41.79
30.78
65.07
BBT
75.08
93.58+0.02
62.6840.00
CBBT
75.28
88 88.53+0.03
65.49+0.00
Ours (w/o LCS)
74.65=0.00
91.73=0.01
62.9440.00
Ours
76.35-10.00
94.80.0.01
63.91
CoOp White-Box))
77.42_0.0
94.7810.03
65.4310.01
A.3 Trade-off between Erttor and Accmem
Tables M and [ shows that our method performs poorly in Acomem than the baseline methods. This because Frrtor and AcGmem are in trade-off relationship. with Acemem tending to decrease as Errior is increased. This is presumably because features between classes are not completely
14

---

disentangled in the feature space, so forgetting one class may negatively affect other classes (just as dog and cat share some common features). To provide justification for this, we report the results of using a loss more prioritized (weighted) for Accmem in our method in Table as "Ours (Ace prio.)." We can see that Ours (Ace prio.) outperforms all the other methods in Acemems with sacrificing Errior. Notably, both Ours and Ours (Ace prio.) outperform BBT and CBBT in H, indicating that our method achieves a better trade-off than BBT and CBBT.
Table 4: Trade-off between Errie and Acemem evaluated on CUB-200-2011.
Method
H
Errior 1
Acomem T
Zero-Shot CLIP
46.30
46.20
46.41
BBT
58.75
88.98
43.85
CBBT
56.84
73.5240.02
46.3310.01
Ours (w/ LCS)
58.78
85.8510.01
44.6940.01
Ours
59.67
89.2940.01
44.81
Ours (Ace prio.)
+0.17
80.87
46.65+0.01
CoOp
63.2010.00
98.09
46.6210.02
Furthermore, the results CUB-200-2011 in Table show that the white-box method CoOp iZhou atl (0226] only improves Accmem by 0.2% from zero-shot and our method even hurts Acemem- Our problem is to achieve forgetting only specified classes while maintaining the accuracy of the other classes to be memorized, i..., to improve Errior while maintaining Acemem- Achieving both of these is more challenging than merely improving Accmem alone. To verify our argument here, report an analysis in Table B "CoOp (White-Boy Botte-Box w/ only memorization)" shows the results when white-box tuning by CoOp is performed minimize the cross-entropy loss over only the classes to be memorized, i.e., forgetting is not performed. We can see a significant improvement in Acemem- This result proves that, even in a white-box setting, achieving both improving Accmem and Errioe is more difficult than merely improving Acemem alone. Since the black-box setting is generally more challenging than the white-box setting, not at all surprising that our method leads slight degradation in Acemem
Table 5: White-box CoOp with only memorization on CUB-200-2011.
Method
H Errior
Accmem
Zero-Shot CLIP
46.30
46.20
46.41
Ours
59.67
89.29
44.81
CoOp (White-oox)
63. 63.20
98.09 98.0941.uz
46.62
CoOp (White-Box w/ only memorization) 48.9440.00
44.01
55.10=0.02
A.4 On Zero-shot Approach to Forgetting
In this paper, we consider few-shot learning scenario, i.e., we can access small number of training examples for tuning the latent contexts. However, in some practical cases, one might be faced with zero-shot scenario, i.e., a situation where no sample is available. We here consider a simple zero-shot tuning approach to the black-box forgetting task by only using the class names (i.e.. class embeddings). Specifically, let z and denote the class embeddings before and after prompt tuning for the class to be forgotten, respectively. We assume only z is trainable and aim to tune z by minimizing the following negative NT-Xent loss:
exp 2/T)
LNT-Xemt log Σ, exp(2, Z/T)
where z; is the class embedding for the i-th class to be kept memorized. This loss requires z to be orthogonal to z, as well as be similar to the embeddings of the other classes {zz). By minimizing the loss, we can expect that the embedding of the class to be forgotten z, is placed equidistant from the embeddings of all the other classes {z,).
The results are shown in Table H We found that the zero-shot approach (C-Emb.) performs signifi- cantly poorly compared to our few-shot learning approach. A closer look at each evaluation metric shows a slight advantage of C-Emb. over Ours Erroor but C-Emb. far lower than Ours in Accmem. This is probably due to the nature of the negative NT-Xent loss, whereby the embedding
15

---

of the class to be forgotten is closer to the embeddings of the other classes to be memorized, result- ing in more misclassifications. These results prove that tuning with only the class embeddings does not provide satisfactory performance.
Table 6: Zero-shot (C-Emb.) vs. Few-shot (Ours).
CIFAR-10
CIFAR-100
Method
f
ErTior f
Accmem f
f
ErTior 1
Accmem 1
C-Emb.
91.83+u.01 95.07+0.01
99.0440.01 96.10+0.02
40.61
64.00=z.00 80
+9.68+0.00
47.1440.uz
Ours
94.06+0.01
93.37
71.52=0.01
CUB-200-2011
ImageNet30
Method
TTT
ErTior f
ACCmem
1
Errfor 1
AcCmem
C-Emb.
51.8340.05
99. 10000
35. 1340.04
67.47=0.18
90.72+0.13
58. 10.22
Ours
89.29 59.67
44.81 10.01
97.28
10.94
98.67 =0.01
The above results give us further inspiration; If training samples are available for some classes and not for the rest, would there be benefit from combining the two approaches? We experimented under conditions in which half of the classes to be forgotten had training samples available and the rest did not. We use Ours for the classes for which the training samples are available and C-Emb, for the classes with no training samples. The result on ImageNet30 are shown in Table M While Ours performed forgetting for only the classes with the training samples based on the loss given in Sec. B Ours + C-Emb. performed forgetting for all the classes by incorporating Eq. G. We see that Ours + C-Emb. could outperform Ours in all the metrics, which proves the effectiveness of the combination.
Table 7: Combining Zero-shot and Few-shot.
Ours + C-Emb. applies our few-shot approach to only the classes for which the training samples are avilable and C-Emb, those with no training samples.
Method
H
Errior 1
AcCmem T
Ours + C-Emb. Ours
92.30+0.05
86.56+0.08
98.87+0.00
89.34 20.03
98.78 81.5610.05
A.5 Forgetting vs. Learning from Scratch
An obvious alternative to forgetting that produces a model that can recognize only the classes to be memorized while preventing the recognition of only the classes to be forgotten is learn the model from scratch for only the classes to be memorized. To clarify the benefit of forgetting, we evaluate the accuracy of ResNet-18 and ViT-B/16 trained from seratch over only the classes to be memorized. The results are shown in Table R As can be seen, both models cause severe overfitting to the training data. That is, while these models achieve reasonable accuracy on the training data, they exhibit severely poor performance on the test data. We also tested both models when initialized with ImageNet pre-trained weights. While the results are improved to some extent for ResNet- 18, these are still far behind our forgetting method. The reason for this is that, following the common protocol in context optimization [Zhou et all 20226],, we conducted our experiments in few-shot scenarios explained in Sec. g.l which overwhelmingly lacks the number of training samples to learn the weights for even ResNet-18 and Vit-B/16. These results demonstrate the superiority of our forgetting approach, which achieves effective tuning with small sample size.
A.6 Forgetting vs. Fine-tuning over The Classes To Be Memorized
Another alternative approach to forgetting would be to only fine-tuning the model over the classes to be memorized. That is, do nothing to the classes to be forgotten and cause catastrophic forgetting. We test the performance of fine-tuned CLIP over only the classes to be memorized (Fine-tune CLIP). The results are shown in Table H. Compared to our method, which explicitly facilitates forgetting of the classes to be forgotten, catastrophic forgetting alone (Fine-tune CLIP) is not sufficient to achieve satisfactory forgetting performance. Also, our method is comparable to the Fine-tune CLIP in Accmem except for CUB-200-2011 1, which does not significantly impair the classification accuracy for the classes to be memorized. These results support the validity of our forgetting approach.
16

---

Table 8: Forgetting vs. Learning from scratch evaluated in Accmem t (VIT-B/16, ResNet18).
CIFAR-10
CIFAR- R00
Method
Test
Train
Test
Train
ResNer18 From Scratch
39.94.0.00
98.9610.01
11.16.0.00
96.3910.02
ViT-B/16 From Scratch
29.7610.00
68.05.0.08
5.53
36.8110.08
ResNet18 w/ pretrained weights
60.53 10.04
99.6510.00
25.9810.01
100.001..00
ViT-B/16 w/ pretrained weights
34.4840.04
73.96
8.4440.00
91.53+0.05
Ours
94.06
95.92
71.52
70.01
CUB-200-2011
ImageNet30
Method
Test
Train
Test
Trainn
ResNet18 From Scratch
1.84
98.89
36.20+0.01
98.26+0.01
ViT-B/16 From Scratch
1.42+0.00
52.78
16.5640.02
34.1440.06
ResNet18 w/ pretrained weights
7.60
100.0040.00
67.0040.03
99.65+0.00
VYT-B/16 w/ pretrained weights
1.45+0.00
76.11
27.41
98.15+0.01
Ours
44.81 10.01
53.61 10.01
98.661.0.00
99.19...00
Table 9: Forgetting Fine-tuned CLIP over the classes to be memorized.
CIFAR-IC
CIFAR- 100
Method
H1
Errior
Accmem t
Ht
ErTior
AcCmem
Fine-tune CLIP
59.48+0.11
44.21
95.48+0.01
40.89
28.6640.00
71.32=0.00
Ours
95.07 =0.01
96.10+0.02
94.0640.01
80.99
40.07
71.52
CUB-2200-2011
ImageNer30
Method
H 1
Errtor 1
AcCmem t
H
Ertior
AcCmem
Fine-tune CLIP
48.94 0..04 59.67 =0.01
44.01 89.29
55.10.0.02
2.68
1.36
98.56=0.03
Ours
44.81
97.28
95.94_0.01
98.67 =0.01
A.7
CoOp with Model Parameter Update
We evaluate another white-box box forgetting approach that learns latent contexts through CoOp while also updating the model parameters. The results are shown in Table II We see that simultane- ously updating the model parameters does not improve performance, but rather hurts it. This is not surprising, it is known that straightforward fine-tuning of the zero-shot CLIP does not improve performance [Wortsman alll 2022]
Table 10: Results of CoOp with updating the model parameters.
CIFAR-10
CIFAR- 100
Method
Ht
Errior T Accmem
HT
Errtor
Accmem
CoOp (White-box)
1..74
92.2510.05 73.54
79.92
85.80 74.83
+ Parameter Update
CoOp (White-box)
96.4940.00
96.9540.01 96.04+0.00
82.22-0.00
99.81+0.00 69.90
Ours
95.07+0.0r
96. 96.10+0.02
94.06+0.01
80 _0.09
93.37 +0.02 02 71.52+0.01
CUB-200-2011
ImageNet30
Method
H1
Ertior T
Aecmem T
H
Errior
Accnem 1
CoOp (White-box)
98.4810.01 59.78
42.93
99.291..00
99.7210.00 98.85
+ Parameter Update
CoOp (White-box)
63.20
98.094p.02
46.6210.02
99.30_o.01
99.72.t.00
98.89
Ours
59.67 89.2940.01 44.81
97.28_0.00
95.944..011 98.67
A.8 Impact of Sampling Distribution for Random Projection
As explained in Sec 1 each of the (d" + d3) dimmenniii latent context is projected into the original D-dimensional context by random projection A Dx(d"++d") sampled from normal distribution (00, o), where a is the standard deviation of the context embeddings. We analyze the impact of the choice of a on the final performance. Table I shows the results CIFAR-10 10 when
17

---

is fixed to 1. We can see that the choice of a has significant impact on the performance in all the evaluation metries.
Table 11: Impact of sampling distribution for random projection. Results on CIFAR-10 when we use (00 1) and N (00,0) for drawing the random projection A.
Distribution
H 1
Errtor
AcCmem
84.58
78.33+0.07 96.10+0.02
91.91 94.06+0.01
95.07
A.9 Performance for Different Choices of The Classes To Be Forgotten
In the experiments in the main paper (Sec. BD. 40% of the classes in each dataset were selected as the classes to be forgotten, in ascending order of the class index, starting with the O-th class. We here investigate the performance of method when using different selections of the classes to be forgotten. The results are Table I2 We see that our method achieves satisfactory selective forgetting performance regardless of the choice of the classes be forgotten.
Table 12: Results for different choices of the classes be forgotten CIFAR-10.
Class indices to be forgotten
H
Errior
AcCmem
(1)
94.25=0.01
98. 98.33=0.00 20.02
90.494.001
(2)
92.16
93.10 20.07
91.24 91.2440.01
[0, 8)
94.01=0.00
97.67 =0.01
90.61
(2,
94.48
96.45 10.03
92.58 10.00
(24
94.41 10.01
95.90 10.01
92.97 10.00
(4,5
95.53
96.89 10.02
94.21 10.01
[1,2,3.4]
93.27=0.04
92.74=0.09
93.79. 93.79+0.02
(4,5,
96.45_0.01
99.52
93.57
(3,4,5,6,7)
95.43-0.02
98.33=0.00
92.69
(4,5,
96.17 =0.01
97.42 20.02
94.95
(3,4,5,6.7.8)
95.15-0.01
96.97
93.40 93.40=0.02
6,,,,6,7,8,9)
95.57=0.0p
95. 95.22 25.22 #0.03
95.92+0.01
(1,2,3,4.5,6.77
94.04 10.02
92. 40.40.m 10.05
95.74 10.01
(2,3,4,5,6,,,)
97.16 17.16.0.00
10.00
98.78 10.01
95.60 10.00
97.50 10.00
97.6910.00
97.32 10.02
12 3, 4,
97.94 1.011
97.76
98. 98.12.0.00
1,
2,
3,
4.
9.
09.51=0.0
99.09 09.09
99.93 99.93
00
3,
4.
5,
6, 9.
98.83
98. 00.05
99.10
A.10
Computational Complexity
We single GV 100 GPU with 12.885GB memory for all the experiments. Approximate compu- tation time is 120 minutes for CIFAR-10, 400 minutes for ImageNet30 and 600 minutes for CIFAR- 100 and
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims made in the abstract and introduction of our paper accurately reflect the paper's 's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: See Sec
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are discussed in the paper.
The authors are encouraged to create separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The au- thors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the ap- proach. For example, facial recognition algorithm may perform poorly when image resolution is low images taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to ad- dress problems of privacy and fairnsss.
While the authors might fear that complete honesty about limitations might used by reviewers grounds for rejection, worse outcome might be that reviewers discover limitations that aren't it acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
19

---

Justification:
We do not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theo- rems.
The proof' can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
paper Inversely, any informal proof provided in the core of the paper should be comple- mented by formal proof's provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: See See B1.
Guidelines:
The answer NA means that the paper does include experiments. If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all sub- missions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to re- produce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case au- thors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
20

---

Answer: [Yes]
Justification: The code used for the experiments in this paper can be accessed here: httpp:
//github.com Btw.a/keennnnnaaa-----aao-e Box
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (kttps://nips.cm cc/
Policy for more details.
While encourage the release of code and data, understand that this might not be possible, so No is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https:
issmisssionn asiionooicyy for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: See Sec. g
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined other appropri- ate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification:
We report error bars the experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
21

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should prefer- ably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: See Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't t make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
Our research comforms to the NeurIPS code of ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: See Sec
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact spe- cific groups), privacy considerations, and security considerations.
22

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitiga- tion strategies (e.g., gated release of models, providing defenses addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g.. pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by re- quiring that users adhere usage guidelines or restrictions access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
We respect them properly.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the pack- age should be provided. For popular datasets, paperswi thcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the cense of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
23

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documenta- tion provided alongside the assets?
Answer: [NA]
Justification:
We do not release assets.
Guidelines:
The answer NA means that the paper does not release new assets,
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the pa- per include the full text instructions given to participants and screenshots, if applicable, well as details about compensation (if any)?
Answer: [NA]
Justification:
We do not crowdsource experiments or conduct research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, tion, or other labor should be paid at least the minimum wage the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
We do not crowdsource experiments or conduct research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equiva- lent) may be required for any human subjects research. you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do include any information that would break anonymity (if applicable), such as the institution conducting the review.
24


Reviews:
[{"review_id": "C6SDAz6KVi", "reviewer": "Reviewer_LjLN", "summary": "The authors propose to apply selective forgetting to black-box pretrained models, instead of the usual white-box settings. Since it is a black-box method, there is no parameter update and instead the prompts are the ones being optimized to decrease the performance on the target class to be forgotten. This is done by using an existing covariance matrix adaptation, which is a derivative-free optimizer. The paper describes the issues of optimizing a large dimensional space while gradients are not available, and the problem of having samples from the target forgotten class being mostly pushed towards a close-by, non-forgotten class instead. The first issue is solved by splitting the latent context between unique and shared, and reparametrizing them individually to lower dimensions. The second issue is solved by excluding the label information from a classic CE loss, and adding it as regularization for maximizing the entropy of the overall confidence.", "questions": "1. In the introduction, it is shortly mentioned, but I would like some more context on how close are some of the machine unlearning settings to the one proposed in this submission.\n\n2. Footnote 2 is a bit weak. How are the results shown in section 4 enough reason to assume that there is a composition of ULC and SLC?\n\n3. Why are the latent contexts optimized for the hyperparameters used? Are those decided under a validation set or overfitted to the test? Same for the number of latent contexts.\n\n4. In appendix A.2, what is the reasoning for the groupings of classes to be forgotten? Just random? Or do they relate in some way that can support the use of equation (2*missing) versus (1)?", "limitations": "Regarding the experimental statistical significance, the authors mention that they do not report error bars, and I would also consider that such set of experimental settings would require the need to run each method multiple times, specially when there are some results that are quite comparable and could lead to statistical significance showing that some methods is not significantly different than another under some metrics.\n\nThis is such a strong point, in my opinion, that it is the reason why I rate the paper down from a 7 (accept) to a 6 (weak accept). Given that the paper relies quite heavily on its experimental analysis to showcase the interesting proposed scenario compared to current zero-shot or white-box approaches. Also in the appendix, there is this random sampling, which does not report how many times it is sampled either. Finlly, the point from question 2 is also important to showcase the limitation on the argumentation of the existence of ULC and SLC.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "Selective forgetting and machine unlearning are of interest within our community, and thus this paper fits very well with the conference. The need to move from white-box to black-box methods is something natural, as it has happened before with topics like adversarial attacks, so it is relevant to explore how to tackle this more complex setting. In terms of originality, previous work is well referenced to establish the originality of the paper comes from the proposed strategy adapting to the needs of the proposed novel scenario. The introduction of the scenario and its needs, as well as most of the method explanations are well described and are easy to follow. The limitations are very well covered, and the significance of the paper is well motivated and clear.", "weaknesses": "Despite the main idea being clear and most of the method being well described, the writing could use some revision. CMA-ES is quite a key component of the proposed strategy, but is covered quite shortly. The LCS (ii) part is a bit over-complicated for such an easy concept. I think it could be explained a bit more elegantly and would highlight the usefulness and easiness of having this type of parametrization. Same goes for some of the subsections within the Analysis (4.3). I assume that the lack of space was the reason why some of the concepts from the compared methods are just mentioned and not explained in detail. However, in order to make it easier for the reader to understand what the analysis refers to and drive some of the conclusions, it might be better to just move one or two of them to the appendix. My suggestion would be moving 4.3.1 and 4.3.5 to the appendix, and using that space to improve the analysis of the others.\n\nNomenclature in some cases is a bit confusing. In figure 1, the losses are called forget and memorize, while in equations (1) and (2*missing) they are called uniform and CE. Same with z having subscripts or superscripts depending on BBT or LCS.\n\nText in figures 3 and 4 is too small.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### Q1. CMA-ES is covered quite shortly.\nWe will expand the description of CMA-ES in the first paragraph of Line 105 in Sec. 3 as follows:\n\n> We employ CMA-ES, a widely used evolutionary algorithm for black-box optimization in continuous, because a textual prompt to be optimized is a continuous variable. CMA-ES is a multi-point search algorithm based on a multivariate normal distribution and proceeds the search by iterating (i) sampling candidate solutions, (ii) evaluating the loss values of the candidates, (iii) weighting the candidates based on the loss values, and (iv) updating the mean and covariance matrix of the distribution by using the weighted candidates. Due to the nature of multi-point search, the performance of CMA-ES degrades in high-dimensional problems, typically ten or more dimensions [a,b]. While several extensions have been proposed, e.g., [a,b], these methods require knowledge of independence among variables, which is not always known. In this paper, we propose a customized extension of CMA-ES to Black-Box Forgetting. \n\n[a] Ros and Hansen, A Simple Modification in CMA-ES Achieving Linear Time and Space Complexity, in Proc. PPSN, 2008.\n\n[b] Akimoto and Hansen, Projection-based Restricted Covariance Matrix Adaptation for High Dimension. in Proc. GECCO, 2016.\n\n### Q2. LCS could be explained a bit more elegantly.\nTo facilitate intuitive understanding of our LCS, we add at the beginning of the LCS section (Line 139) the inspiration behind our LCS and the justification for the composition of ULC and SLC.\n> Fig. 2c shows the overview of LCS. The key idea is to assume shared parameters among different latent contexts. This inspiration comes from successful word embedding methods; most word embedding methods are trained on the assumption that locally co-occurring words have semantic correlations between them (e.g., [a-c]). This inspires the idea of explicitly modeling semantic correlations between words in a prompt as shared components.\n\n[a] Mikolov, Efficient Estimation of Word Representations in Vector Space, arXiv pre-print 1301.3781, 2013.\n\n[b] Pennington, et al., GloVe: Global Vectors for Word Representation, in Proc. EMNLP, 2014.\n\n[c] Devlin et al., BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding, in Proc. NAACL-HLT, 2019.\n\n### Q3. Sec. 4.3 could be reorganized.\n\nAs suggested, we will move 4.3.1 and 4.3.5 to the appendix to put priority to the analyses on the effectiveness of the parametrization of our LCS. Thanks!\n\n### Q4. Some nomenclature and texts in figures and equations could be improved.\nAs suggested, we will revise the numbering of Eq. 2 and the name of the loss (i.e., change \"CE\" in Fig. 1 to \"uniform\") in the final version. The text in Fig. 1 will be enlarged. The superscript of $z$ is to distinguish shared components from unique components, so is essential for our LCS.\n\n### Q5. Some more contexts on machine unlearning?\nWe will add a review of machine unlearning in the Related Work section in the final version:\n> Machine unlearning aims to remove an arbitrary sample from a pre-trained model, i.e., obtaining a model that is identical to the one trained from scratch without that sample [a-g]. Many methods have been proposed, for example, to construct a forgettable model by transforming the learning algorithm into a sum of the training samples [a], to achieve forgetting by linear approximation of a nonlinear model [b], and to update the model to be closer to / farther from the original model in the retain / forget samples [e]. Methods specific to certain learning algorithms such as LDA [f] and SVM [g] have also been explored. Machine unlearning and Black-Box Forgetting are closely related but different; Machine unlearning aims to remove the influence of specified training samples on the training model, whereas Black-Box Forgetting aims to prevent the recognition of specified classes. Forgetting specified classes has attracted much attention recently in various contexts [h-l]. We in this paper address the black-box setting, which has not yet been explored.\n\n[a] Cao and Yang, Towards Making Systems Forget with Machine Unlearning. In Proc.IEEE Symp. Security and Privacy, 2015.\n\n[b] Golatkar et al., Mixed-Privacy Forgetting in Deep Networks, In Proc. CVPR, 2021.\n\n[c] Sekhari et al., Remember What You Want to Forget: Algorithms for Machine Unlearning, In Proc. NeurIPS, 2021.\n\n[d] Bourtoule et al., Machine Unlearning, In Proc. IEEE Symp. Security and Privacy, 2021.\n\n[e] Kurmanji et al., Towards Unbounded Machine Unlearning, In Proc. NeurIPS, 2024.\n\n[f] Guo et al., Certified Data Removal from Machine Learning Models, In Proc. ICML, 2020.\n\n[g] Chen et al., A Novel Online Incremental and Decremental Learning Algorithm based on Variable Support Vector Machine, Cluster Computing, 2019.\n\n[h] Heng et al., Selective Amnesia: A Continual Learning Approach to Forgetting in Deep Generative Models, In Proc. NeurIPS, 2023.\n\n[i] Lu et al., Mace: Mass Concept Erasure in Diffusion Models, In Proc. CVPR, 2024.\n\n[j] Zhang et al., Forget-me-not: Learning to Forget in Text-to-Image Diffusion Models, In Proc. CVPR, 2024.\n\n[k] Shibata et al., Learning with Selective Forgetting, in Proc. IJCAI, 2021.\n\n[l] Ye et al., Learning with Recoverable Forgetting, in Proc. ECCV, 2022.\n\n### Q6: Hyperparameters tuned on validation sets or test sets?\nAll the hyperparameters were tuned on validation sets. We will clarify this in the final version.\n\n### Q7: Classes to be forgotten determined at random or intentionally?\nThese were determined randomly for fairness. We will clarify this in the final version.\n\n### Q8: No error bars reported.\nGood suggestion! All the results in our paper are averages of three runs with different random seeds. Check out Table A in the attached PDF, which is Table 1 of our submission with the standard deviations added. Ours clearly outperforms the compared methods. We will add standard deviations to all the results in the final version.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Z3oomyRit0", "reviewer": "Reviewer_VErt", "summary": "This paper addresses the problem of selective forgetting of specified classes, which involves tuning a pre-trained model to reduce the classification accuracy for only the specified classes without affecting the accuracy for the others. The proposed model introduces a novel method for Black-Box Forgetting based on the derivative-free optimization of a learnable text prompt. It introduces Latent Context Sharing (LCS), a novel parameterization method for contexts, which mitigates the difficulty of high-dimensional optimization using derivative-free optimization.", "questions": "Please address all my concerns raised in the weaknesses section.", "limitations": "My concerns raised in the weaknesses section described the limitations of the proposed approach.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1- The proposed method explores the selective forgetting problem for CLIP-based models (PTMs), where the task is to make the model unable to recognize only the specified classes while maintaining accuracy for the others. More importantly, it addresses a novel problem of selective forgetting for black-box models, termed Black-Box Forgetting, and proposes an approach to solve this problem.\n\n2- It proposes Latent Context Sharing, which introduces common low-dimensional latent components among multiple tokens for the prompt to reduce complexity.\n\n3- Instead of optimizing the model parameters, it proposes a novel method for Black-Box Forgetting based on derivative-free optimization of a learnable text prompt, which avoids the need for information about the pretrained model.", "weaknesses": "1- The proposed approach for forgetting selective classes from the pre-trained model requires data samples for each elective class. Since it is applied in CLIP-based multi-modals, where the text encoder is also available, one might wonder why data samples are necessary for each forgetting class. Could the same result not be achieved using just the class name?\n\n2- The proposed approach claims that it introduces Latent Context Sharing (LCS), a novel parameterization method for contexts, to mitigate the difficulty of high-dimensional optimization. However, considering that the embedding dimension in CLIP-based models is 512, which is not excessively large, and that this approach reduces the dimension to 100 for the CUB dataset, the reduction does not seem significantly lower than the original CLIP dimension. Therefore, in the case of larger datasets, this reduction might not have a substantial impact compared to the original CLIP dimension.\n\n3- The proposed approach claims to be a black box due to the unavailability of pre-trained model information, such as architecture, parameters, and gradients, during training. However, my concern is that if you are given the pretrained model, extracting information about the model architecture and its parameters can still be quite challenging?\n\n4- How is the proposed black-box forgetting different from machine unlearning?\n\n5- I recommend conducting experiments on more diverse datasets, such as ImageNet-1K, to gain a better understanding of this approach.\n\n6- Why is Acc_mem lower than the baseline approaches for each dataset?\n\n7- Can the proposed approach be applied in a continual learning setup?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### Q1. Could the same result not be achieved using just the class name?\nGood suggestion! We tried to tune the latent contexts by only using the class names (i.e., class embeddings). Specifically, let $z_c$ and $z$ denote the class embeddings before and after prompt tuning for the class to be forgotten, respectively. Only $z$ is trainable. We aim to tune $z$ by minimizing the following negative NT-Xent loss, $ \\log \\frac{\\exp(z_c ^\\top z / \\tau)}{\\sum_i \\exp(z_i ^\\top z / \\tau)}$, where $z_i$ is the class embedding for the $i$-th class to be kept memorized. This loss requires $z$ to be orthogonal to $z_c$ as well as be similar to the embeddings of the other classes $\\\\{z_i\\\\}$. The results are reported in Table B in the attached PDF. We found that Ours is much better than the approach using only the class embeddings (C-Emb.), which proves that tuning with only the class embeddings does not provide satisfactory performance.\n\n### Q2. 512-D should not be high-dimensional.\nDerivative-free optimization based on multi-point search, such as CMA-ES, is directly affected by the curse of dimensionality, so the number of dimensions exceeding, typically 10-D, is often considered high-dimensional [a]. This is why the existing black-box tuning method, BBT, optimizes low-dimensional (around 10-D) latent contexts instead of the raw 512-D embeddings.\n\n[a] Hansen et al., Reducing the Time Complexity of the Derandomized Evolution Strategy with Covariance Matrix Adaptation (CMA-ES). Evolutionary Computation, Vol. 11, No. 1, pp. 1-18, 2003.\n\n### Q3. Given the pretrained model, extracting information of the model should not be challenging.\nFollowing the same setup as in previous black-box tuning (e.g., BBT and CBBT), we assume that no pre-trained model is given and can only access to the input/output of the pre-trained model (e.g., via an API). In such a case, we cannot know the internal information of the model and cannot extract information about the model architecture or its parameters.\n\n### Q4. Machine Unlearning vs. Black-Box Forgetting.\nThese two are closely related but different. Machine Unlearning typically aims to remove the influence of specified training samples on the training model, whereas Black-Box Forgetting aims to prevent the recognition of specified classes. Furthermore, we in this paper address the black-box setting, which has not yet been well-traveled in machine unlearning.\n\n### Q5. Experiments on more diverse datasets, such as ImageNet-1K?\nAlthough we were not able to complete the experiment with ImageNet-1K in this short rebuttal period, we instead report the results of additional experiments with its subset, ImageNet30 [a]. The results shown in Table G in the attached PDF demonstrate that \nour method outperforms all the methods in $H$. We will add the results on ImageNet-1K in the final version.\n\n[a] Hendrycks et al., Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty, in Proc. NeurIPS, 2019.\n\n### Q6. Why is $Acc_\\text{mem}$ lower than the baselines?\nThis is because $Err_\\text{for}$ and $Acc_\\text{mem}$ are in a trade-off relationship, with $Acc_\\text{mem}$ tending to decrease as $Err_\\text{for}$ is increased. This is presumably because features between classes are not completely disentangled in the feature space, so forgetting one class may negatively affect other classes (just as dog and cat share come common features). To provide justification for this, we report the results of using a loss more prioritized (weighted) for $Acc_\\text{mem}$ in our method in Table C as \"Ours ($Acc$ prio.)\" in the attached PDF. We can see that Ours ($Acc$ prio.) outperforms all the other methods in $Acc_\\text{mem}$, with sacrificing $Err_\\text{for}$. Notably, both Ours and Ours ($Acc$ prio.) outperform BBT and CBBT in $H$, indicating that our method achieves a better trade-off than BBT and CBBT.\n\n### Q7. Can the proposed approach be applied in a continual learning setup?\nThank you for your interesting suggestion! While application of our method to continual learning is not in the scope of this paper, theoretically we think it is possible. Our method is based on a context optimization as CoOp. So it can readily be coupled with some of standard continual learning methods, such as distillation-based [a].\n\n[a] Li et al., Learning without Forgetting, IEEE TPAMI, Vol., 40, No.12, pp. 2935-2947, 2017.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VMzXZLTK1s", "reviewer": "Reviewer_bJB5", "summary": "This paper studies the black-box forgetting problem. To this end, the authors optimize the input prompts with a proposed latent context sharing scheme by CMA-ES optimization. The authors achieve the selective forgetting goal by minimizing the cross-entropy loss on memorized classes and maximizing entropy loss on forgetting classes. Experiments demonstrate the promising of the proposed method.", "questions": "Q1.\n\n*“—Retaining the classes that do not need to be recognized may decrease overall classification accuracy, as well as cause operational disadvantages such as the waste of computational resources and the risk of information leakage”* \n\nHow do you define the overall accuracy? Is it the overall accuracy of all classes of the pre-trained model, or the overall accuracy of downstream tasks, such as CIFAR-10 in the experiments? This is quite confusing for me. If it is the latter, during the fine-tuning process on downstream tasks, it seems that tuning only the necessary classes (those to be recognized) can achieve the best performance. Why must we forget some classes?\n\nMoreover, the phrase ‘waste of computational resources’ is also confusing. Learning on all classes is conducted during the pre-training phase and cannot be modified by the proposed method. Then, during fine-tuning, why would forgetting to reduce computational resources? **Aside from preventing information leakage**, what is the rationale behind forgetting certain classes?  i.e., When we fine-tune a CLIP model on CIFAR-10, what is the real and sound motivation for us to forget some classes of CIFAR-10?\n\nQ2. If the final goal is to forget 40% of classes and memorize 60% of classes on CIFAR-10, why must we fine-tune CLIP? Why not directly train a new model (with the same architecture as CLIP or a smaller ResNet or ViT) with only the 60% memorized classes? It would be better to include the results of this baseline in Table 1. I assume that the authors believe a model fine-tuned from CLIP could achieve better performance on the memorized classes than a model trained from scratch. If this is the case, experiments on CIFAR datasets alone are insufficient to demonstrate this, as these data are relatively easy. Experiments on more complex datasets/tasks, such as those mentioned in autonomous driving, are necessary to further help to justify the superiority of the proposed method.\n\nQ3. Can the proposed method be extended to more complex tasks such as segmentation or object detection? As the authors mentioned, in an autonomous driving system, it is sufficient to recognize a limited number of classes such as cars, pedestrians, and traffic signs.  In autonomous driving, the task is often more complex than pure classification, such as 2D and 3D object detection tasks.\n\nQ4. How about the performance of Ours vs. Solely Fine-tune CLIP on memorized classes? It would be much better if this result is verified on more complex datasets.\n\nQ5. In the white-box setting, one can update more model parameters beyond just the input prompts. How would the performance change if we update all model parameters for CoOp (White-Box)?\n\n\nI would like to increase my score if the authors could convince me regarding the problem setting.", "limitations": "The proposed method is not fully black-box, as it still requires access to the embeddings and output logits, which are unavailable in a fully black-box setting, similar to the GPT-4 API. However, I understand that achieving a fully black-box setting is very challenging, and I do not consider this a reason for rejection. I mention this point merely as a slight limitation.", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The model forgetting/unlearning problem for black-box models is both interesting and practical. (However, the specific forgetting setting in this work is still unclear to me.)\n\nCompared with BBT [Sun et al.], the proposed Latent Context Sharing (LCS) scheme effectively enhances the learning ability of CMA-ES, providing a promising technique for CMA-ES-based black-box model fine-tuning.\n\nSensitivity analyses regarding hyper-parameters are sufficient.", "weaknesses": "The problem setting of this work does not convince me, possibly due to the presentation of the paper. I hope the authors can provide more justification regarding this.\n\nExperiments could be further enhanced, as my detailed comments below.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### Q1. Why must we forget some classes?\nWe assume that the reviewer already acknowledged the benefit of preventing information leakage through forgetting. In addition to this, we here would like to emphasize the potential benefits of exploring selective forgetting.\n1. Toward addressing the \"Right to be Forgotten\": If a service provider is asked to remove information so that their model cannot recognize certain information, it might need to comply with the request. This can be accomplished by training the model from scratch by removing samples of that class from the training data. However, retraining a large-scale model consumes an enormous amount of energy, which should be avoided. Selective forgetting may provide an efficient solution to this problem.\n2. Toward efficient large-scale pre-trained models: Improving the efficiency of large-scale pre-trained models is of current interest to many researchers. Various attempts have been made such as model compression and architecture optimization (e.g., https://sites.google.com/view/elvm/program). Meanwhile, as the \"scaling law\" indicates, the reasonable size of a model correlates with the amount of knowledge it memorizes. Therefore, if the number of classes (amount of knowledge) that can be recognized by the model is limited, the model can be scaled down accordingly, thereby improving the efficiency of the model. This contributes to expanding the applicability of large-scale pre-trained models.\n3. Toward better control over text-to-image generation: While diffusion-based text-to-image generation can generate diverse types of high-quality images, controlling the content of images remains a challenge. Recent research has focused on \"forgetting\" visual concepts in order to avoid generating undesirable content [a-c]. These methods forget certain classes by directly fine-tuning the diffusion model, but tuning the diffusion model itself is often costly. In contrast, given that typical generative models use a text encoder of a pre-trained VLM (e.g., CLIP) for conditioning, our method may provide an efficient approach to class forgetting by fine-tuning only the prompts of the text encoder. \n\nWe believe that our method will open new directions for these important problems of interest to the ML community, even if these are not immediately feasible with this paper alone. We would like to add the discussion as a broad impact of this work in the final version.\n\n[a] Heng et al., Selective Amnesia: A Continual Learning Approach to Forgetting in Deep Generative Models, In Proc. NeurIPS, 2023.\n\n[b] Lu et al., Mace: Mass Concept Erasure in Diffusion Models, In Proc. CVPR, 2024.\n\n[c] Zhang et al., Forget-me-not: Learning to Forget in Text-to-Image Diffusion Models, In Proc. CVPR, 2024.\n\n### Q2. Forgetting vs. Learning from scratch.\nAs requested by the reviewer, we show the accuracy of ResNet-18 and ViT-B/16 trained from scratch over only the classes to be memorized in Table D in the attached PDF. As can be seen, both models cause severe overfitting to the training data. That is, while these models achieve reasonable accuracy on the training data, they exhibit severely poor performance on the test data. We also tested both models when initialized with ImageNet pretrained weights. While the results improve somewhat for ResNet-18, these are still far behind our forgetting-based method. The reason for this is that, following the common protocol in context optimization [a], we conducted our experiments in few-shot scenarios as explained in Line 201, which overwhelmingly lacks the number of training samples to learn the weights for even ResNet-18 and Vit-B/16.\n\n[a] Zhou et al., Learning to Prompt for Vision-Language Models, IJCV, 2022.\n\n### Q3. Is the method applicable to detection / segmentation?\nIt would be possible by combining with some detectors / segmentors. For example, recent approaches in object detection rely on a two-stage framework [a,b], which first uses region proposal network to get object proposals and then applies zero-shot CLIP to each proposal to identify the object class. Replacing the zero-shot CLIP with one tuned by our method would prevent detecting classes that have been forgotten.\n\n[a] Zhao, et al. Exploiting unlabeled data with vision and language models for object detection, in Proc. ECCV, 2022.\n[b] Zhao, et al. Taming Self-Training for Open-Vocabulary Object Detection, in Proc. CVPR. 2024.\n\n### Q4. Ours vs. Solely Fine-tune CLIP on memorized classes?\nWe tested the performance of Solely Fine-tune CLIP on memorized classes on four datasets including ImageNet30. The results are shown in Table E in the attached PDF. As we can see, ours and Solely Fine-tune CLIP are comparable in $ACC_\\text{mem}$ for the three datasets, except for CUB-200-2011. That is, even if we perform forgetting, it does not significantly impair accuracy on the memorized classes.\n\n### Q5. In the white-box setting, one can update more model parameters beyond just the input prompts.\nYes, but it does not work. We tested \"CoOp (White-box) + Parameter Update\", i.e., updating not only the learnable contexts in the prompt but also the model parameters. The results are shown in Table F in the attached PDF. We see that simultaneously updating the model parameters does not improve performance, but rather hurts it. This is not surprising, as it is known that straightforward fine-tuning of the zero-shot CLIP does not improve performance [a].\n\n[a] Wortsman et al., Robust Fine-Tuning of Zero-Shot Models, in Proc. CVPR, 2022.\n\n### Q6. The proposed method still requires access to the embeddings and output logits, I do not consider this a reason for rejection.\nThank you for this fair consideration of the limitation described in our original paper (Sec. 6). In fact, existing black-box tuning methods such as BBT and CBBT assume the same setup, which we followed. On the other hand, the consideration of a complete black-boxing approach is an interesting challenge that we would like to pursue.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1RG6IZj5am", "reviewer": "Reviewer_SKod", "summary": "This paper explores a selective memorization problem of classification models under a black-box setup. The proposed method selectively applies different learning objectives, cross-entropy minimization, and entropy maximization for classes to be memorized and classes to be unmemorized, respectively; they become guidance for a small amount of text embedding tokens (prompt) by a black-box optimization algorithm, CMA-ES. The authors evaluate the proposed method in terms of selective memorization capability.", "questions": "- Is the sign of $L_{uniform}$ term in the final objective a typo? To maximize entropy, I think we should minimize $-L_{uniform}$ to maximize entropy.\n- For selective memorization, I believe that not only the unmemorization for the selected classes but also the memorization for the remaining classes is crucial. However, in Table 1 CUB-200-2011 results indicate that the white-box method only improves $Acc_{mem}$ 0.2 % from zero-shot, which is a very trivial amount given that the strong few-shot learning capability of CoOp [3] and CoCoOp [4] on the similarly fine-grain visual recognition tasks.  Furthermore, the proposed method even hurts the $Acc_{mem}$ from the zero-shot model. Could you explain why the proposed learning objective shows poor learning capability on the CUB dataset compared to the CIFAR datasets?\n\n---\n> Reference\n* [3] Learning to Prompt for Vision-Language Models, Zhou et al. 2022\n* [4] Conditional Prompt Learning for Vision-Language Models, Zhou et al. 2022", "limitations": "The authors adequately stated the limitation in the last section.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- The problem setup \"black-box forgetting\" that the authors focus on is crucial yet unexplored. The authors timely provide a simple approach to address the problem.\n- The design of the proposed method is easy to follow and reasonable.", "weaknesses": "# 1. Lack of novelty\n* The proposed method can be viewed as a variant of BBT [1], which explicitly separates the seed latent context into shared parts and unique parts. Although this is a new application of BBT in selective memorization scenarios, if the authors want to claim the novelty of the modified BBT method, I think they should further provide analyses on efficiency and qualitative results on learned context to contrast with BBT.\n* Moreover, the proposed learning objective -a combination of cross-entropy minimization and entropy maximization- is also quite common [2], so it is hard to claim its originality from this work.\n\n# 2. Inappropriate validation setup\n* As the main goal of this study is selective memorization of classification models, I expected existing methods for selective memorization and unlearning to be the natural baselines. However, all the comparisons are conducted by training the black-box tuning model via the combination of cross-entropy and entropy. Comparing the proposed method with other available unlearning objectives would be necessary to measure its validity.\n* The scope of validation is also limited to three natural object recognition. It is important to validate the methods across a more diverse range of image domains to robustify the conclusion.\n\n---\n> Reference\n* [1] Black-Box Tuning for Language-Model-as-a-Service, Sun et al. 2022\n* [2] Mitigating Information Leakage in Image Representations: A Maximum Entropy Approach, Roy and Boddeti 2019", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### Q1. Lack of novelty.\nLet us recap the main novelties of this paper.\n\n1. We proposed a novel task called Black-Box Forgetting, which aims to achieve selective class forgetting under the assumption that the parameters and gradients of the model are inaccessible.\n\n2. Aiming at improving derivative-free prompt tuning for Black-Box Forgetting, we proposed a novel context parametrization method called Latent Context Sharing (LCS) that explicitly models shared and unique components over multiple latent contexts.\n\nTo our knowledge, there is no literature addressing Black-Box Forgetting, nor has the idea of explicitly modeling the shared and unique components of learnable contexts in prompt tuning been explored. Moreover, in all the experiments reported in our paper, we compared our LCS with BBT and showed that ours was superior to BBT. **We would be happy to discuss these novelties in more detail if the reviewer could provide specific examples of publications that contradict these novelties.**\n\n### Q2. Loss function not novel.\nNote that we are not claiming novelty in the loss function. We argue that our novelty lies in Latent Context Sharing (LCS), a novel parametrization of the learnable latent contexts in prompt tuning for Black-Box Forgetting.\n\n### Q3. Baselines are black-box tuning methods, not forgetting methods.\nAs far as we know, there is no existing method for Black-Box Forgetting, i.e., there is no existing forgetting / unlearning method that can be directly compared. Therefore, we compared our method with the existing black-box tuning methods, i.e., BBT and CBBT, under the same loss function. **We would appreciate it if the reviewer could provide any specific existing methods that are directly comparable or existing loss functions to be applied so that we can have clearer discussions.**\n\n### Q4. Datasets limited to three natural image datasets.\nDue to the nature of the pre-trained CLIP that are naturally biased toward natural images, the performance of zero-shot CLIP has been reported to be significantly degraded in non-natural image domains (e.g., [a,b]). Since our task is selective forgetting of classes that can successfully be recognized by the pre-trained model, it is difficult to test its effectiveness on non-natural image datasets.\n\nOn the other hand, we agree that conducting experiments on more diverse datasets is beneficial, so we conducted additional experiments using ImageNet30. The results can be found in Table G in the attached PDF. Our method is superior to the other methods in terms of $H$, which supports the effectiveness of our method further.\n\n[a] Shu et al., Test-Time Prompt Tuning for Zero-Shot Generalization in Vision-Language Models, in Proc. NeurIPS, 2022.\n\n[b] Gondal et al., Domain Aligned CLIP for Few-shot Classification, in Proc. WACV, 2024.\n\n### Q4. Typo in $L_{uniform}$.\n\nWe will fix it in the final version. Thanks!\n\n### Q5. CUB-200-2011 in Table 1, white-box CoOp only improves $Acc_\\text{mem}$ by 0.2%, and the proposed method even hurts $Acc_\\text{mem}$.\n\nWe respectfully disagree with the reviewer's premise. Our problem is to achieve forgetting only specified classes while maintaining the accuracy of the other classes to be memorized, i.e., to improve $Err_\\text{for}$ while maintaining $Acc_\\text{mem}$. Achieving both of these is more challenging than merely improving $Acc_\\text{mem}$ alone. \n\nTo verify our argument here, we report an additional quick analysis in Table H in the attached PDF. \"CoOp (White-Box w/ only memorization)\" shows the results when white-box tuning by CoOp is performed to minimize the cross-entropy loss over only the classes to be memorized, i.e., forgetting is not performed. We can see a significant improvement in $Acc_\\text{mem}$, as expected by the reviewer. This result proves that, even in a white-box setting, achieving both improving $Acc_\\text{mem}$ and $Err_\\text{for}$ is more difficult than merely improving $Acc_\\text{mem}$ alone. Since the black-box setting is generally more challenging than the white-box setting, it is not at all surprising that our method leads to a slight degradation in $Acc_\\text{mem}$.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank all the reviewers for their thoughtful review and constructive feedback. We are happy to see that the reviewers acknowledged the major contributions of this paper. Namely,

1. We proposed a novel task called Black-Box Forgetting, which aims to achieve selective class forgetting under the assumption that the parameters and gradients of the model are inaccessible.

2. Aiming at improving derivative-free prompt tuning for Black-Box Forgetting, we proposed a novel context parametrization method called Latent Context Sharing (LCS) that explicitly models shared and unique components over multiple latent contexts.

The main questions raised by the reviewers centered on 1) the difference between our task, i.e., Black-Box Forgetting, and typical machine learning, and 2) the requests for additional analyses to further support the validity of our method.
In the rebuttal, **we addressed all of the reviewers' questions with the support of thorough additional experimental results**. We will implement all of these responses in our final version. For the additional experimental results, please see the PDF attached to this thread.


### Black-Box Forgetting vs. Machine Unlearning.

These two are closely related but different. Machine Unlearning typically aims to remove the influence of specified training samples on the training model, whereas Black-Box Forgetting aims to prevent the recognition of specified classes. Furthermore, we in this paper address the black-box setting, which has not yet been well-traveled in machine unlearning. To explain this, we will add a brief review of Machine Unlearning in the Related Work section in the final version.


### Additional analyses to support the validity of our method

We additionally conducted through experiments and report the new results. Namely, evaluatin of error bars, comparisons with fine-tuned CLIPs, comparisons with ResNet and ViT trained from scratch, and evaluations on an additional dataset (ImageNet30), and so on. For more information, please see Tables A-H in the attached PDF and our responses to each reviewer's questions.

Meta-review: This paper explores the selective forgetting problem for large-scale pre-trained models. In the paper, the authors introduce a novel method based on the derivative-free optimization of a learnable text prompt. Initially, this paper received mixed ratings. During the discussion period, the authors and the reviewers had in-depth discussions, and all the reviewers agreed that this paper is good enough to be presented at NeurIPS. The authors are required to include the discussions with all the reviewers in the final version.
Decision: Accept (poster)