Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancement
Authors: Zhehao Huang
Xinwen Cheng
JingHao Zheng
Haoran Wang
Zhengbao He
Tao Li
Xiaolin Huang
Venue: NeurIPS 2024 spotlight (2024)
Keywords: Machine unlearning
steepest descent
diffusion model
Primary area: privacy

Abstract: Machine unlearning (MU) has emerged to enhance the privacy and trustworthiness of deep neural networks. Approximate MU is a practical method for large-scale models. Our investigation into approximate MU starts with identifying the steepest descent direction, minimizing the output Kullback-Leibler divergence to exact MU inside a parameters' neighborhood. This probed direction decomposes into three components: weighted forgetting gradient ascent, fine-tuning retaining gradient descent, and a weight saliency matrix. Such decomposition derived from Euclidean metric encompasses most existing gradient-based MU methods. Nevertheless, adhering to Euclidean space may result in sub-optimal iterative trajectories due to the overlooked geometric structure of the output probability space. We suggest embedding the unlearning update into a manifold rendered by the remaining geometry, incorporating second-order Hessian from the remaining data. It helps prevent effective unlearning from interfering with the retained performance. However, computing the second-order Hessian for large-scale models is intractable. To efficiently leverage the benefits of Hessian modulation, we propose a fast-slow parameter update strategy to implicitly approximate the up-to-date salient unlearning direction.
Free from specific modal constraints, our approach is adaptable across computer vision unlearning tasks, including classification and generation. Extensive experiments validate our efficacy and efficiency. Notably, our method successfully performs class-forgetting on ImageNet using DiT and forgets a class on CIFAR-10 using DDPM in just 50 steps, compared to thousands of steps required by previous methods. Code is available at [Unified-Unlearning-w-Remain-Geometry](https://github.com/K1nght/Unified-Unlearning-w-Remain-Geometry).

Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancement
Zhchao Huang, Xinwen Cheng, JingHao Zheng, Haoran Wang, Zhengbao He, Tao Li, Xiaolin Huang
Shanghai Jiao Tong University
Dringht_R, zinvencheng, zjb20030606, haoran_ lstefanie, li.tao, xizolinhuangl @sjtu.edu.......
Abstract
Machine unlearning (MU) has emerged enhance the privacy and trustworthiness of deep neural networks. Approximate MU is practical method for large-scale models. Our investigation into approximate MU starts with identifying the steepest descent direction, minimizing the output Kullback-Leiberr divergence to exact MU inside parameters' neighborhood. This probed direction decomposes into three components: weighted forgetting gradient ascent, fine-tuning retaining gradient descent, and a weight saliency matrix. Such decomposition derived from Euclidean metric encompasses most existing gradient- based MU methods. Nevertheless, adhering to Euclidean space may result in sub-optimal iterative trajectories due to the overlooked geometric structure of the output probability space. We suggest embedding the unlearning update into manifold rendered by the remaining geom- etry, incorporating second-order Hessian from the remaining data. It helps prevent effective unlearning from interfering with the retained performance. However, com- puting the second-order Hessian for large-scale models is intractable. To efficiently leverage the benefits of Hessian modulation, we propose fast-slow parameter up- date strategy to implicitly approximate the up-to-date salient unlearning direction. Free from specific modal constraints, our approach is adaptable across computer vision unlearning tasks, including classification and generation. Extensive ex- periments validate our efficacy and efficiency. Notably, our method successfully performs class- forgettig using DDPM in just 50 steps, compared to thousands steps required by previous methods. Code is available at Unified-Unnenn Unlearning -Remain-Geomeeee
ImageNet using DIT and forgets class CIFAR-10
Introduction
Machine Unlearning (MU) [1-3] aims remove the influence of samples from pre-trained model, ensuring the model behaves as has never encountered those samples. The significance of MU research has grown following data protection regulations [4, 5J. It has rapidly developed in recent years, becoming an important means to help pre-trained large-scale models adapt to various trustworthy challenges [6] in computer vision (CV). In general, MU aids in purging outdated knowledge [7, 8], mitigating biases [9, 10], and preventing large text-to-image models from generating not-safe-for work (NSFW) images [11-14].
Existing MU methods are mainly divided into two categories: exact (or certified) MU [15] and approximate MU [16]. For deep neural networks, achieving exact MU necessitates retraining dataset excluding forgetting samples. However, retraining is computationally prohibitive for recent large-scale deep networks. Thus, in MU for deep networks, this retrained model only serves aspirational standard to be approached [17]. We primarily focus on more efficient approximate MU,
Approximate MU strives to align the output distribution of unlearned models with that of retrained models. We initially explore the vanilla gradient descent of minimizing the output Kellback-Leibler
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

(KL) divergence between the current iteration and the retrained model. Our deduction reveals that this direction consists of three parts: a weighted gradient ascent eliminate the influence of forgetting samples, a descent gradient for fine-tuning the remaining set, and weight saliency matrix modulating the unlearning direction. Such decomposition provides a novel perspective that unifies previous MU approaches proposed in recent years [18-25], most of which only focus on one or two of these components. For example, SalUn [26] insightfully proposes saliency-base unlearning, which only optimizes the parameters important to forget, but lacks theoretical support. Our analysis fills this gap and provides new directions for further improvement.
In fact, the vanilla gradient descent for approximate MU actually pursues the steepest descent under Euclidean distance [27-30]. However, constraining parameter updates within an Euclidean region is arbitrary, as it treats the importance of all parameters equally. Recent research indicates deep models' parameters and training processes are embedded in low-dimensional manifold [31, 32]. Thus, there exist manifolds where changes in Euclidean between parameters are drastic, yet the output space remains unchanged. In MU, is evident that the importance of model parameters varies for forgetting and remaining [33, 26], prompting the following question. Can model parameters be embedded in manifold that allows effective forgetting while efficiently maintaining remaining performance? ?
To achieve this goal, we propose to discover the descent direction under the KL divergence on the remaining output distribution. Using such a man- ifold metric, the forgetting direction can be amended by a second-order Hessian on the remaining set to pre- vent forgetting loss from harming re- tained performance. Such iterative di- rection is dominated by the unlearn- ing function, allowing the optimization process to focus on efficient forget- ting. However, computing the second- order Hessian for large-scale models is computationally intensive, contra- dicting the need for efficiency in un- learning. Existing methods for esti- mating the second-order Hessian rely on initial parameters and keep them fixed thereafter [34, 35]. Therefore, we propose a fast-slow weight [36, 37] method (Fig. 1) to implicitly and dynamically approximate the salient forgetting direction with Hessian modulation, forming a unified MU approach for CV unlearning tasks including image classification and image generation. Key contributions of this paper include:
Addad authoes for publicatier
Nuite Chel
High
Lane
Urtunined Mockl
Retrinnd Model
Unloerzed Model In Mark
Sinlerred Misiel Ingg Mic Mori
Figure I: Overview our proposal vs. previous unlearning meth- ods on erasing concept 'nudity' in diffusion models [11, 12]. Con- ventional methods seek the steepest descent within an Euclidean ball, often compromising general capabilities. In contrast, we reach the region around retraining along a presseving manifold. To address the large cost of Hessian, we implicitly approximate the up-to-date salient unlcarning direction.
We provide novel perspective to unify previous approaches by decomposing the vanilla gradient descent direction of approximate MU into three components: weighted forgetting gradient ascent, remaining gradient descent, and weight saliency matrix.
We derive the steepest descent direction for approximate MU on the cemain-preserve manifold.
We propose fast-slow weight method to implicitly approximate online Hessian-modulated salient forgetting updates.
We conduct experiments on a wide range of CV unlearning tasks across multiple datasets and models of different architectures, verifying the effectiveness and efficiency of our method.
2 Preliminary
Problem Setup. MU aims to help a well-trained model eliminate the influence of specific data points, categories, or ligh-level concepts and patterns [1, 38]. Let D = [ represent a pretraining dataset of N data points, including 24 (xt, y1) features and labels in supervised learning. The forgetting dataset, Df = {z/ C D. is a subset of the pretrained dataset. Its complement, Dr = { = D'D is the remaining dataset that we wish to retain. The learner is model parameterized by 0. (0) p(2; 0) represents the model output probability. The pre-trained model
2

---

is obtained by empirical risk minimization, i.e., 8, = arg ming [(0; D) = arg ming Σiep {(;; 21). as Pretrain. This empirical risk can be divided into two parts based on the forgetting and retaining datasets. [(0; D) = Eieps 5;{(0; x; + Ejep- {(0:2]) = L' (0:e) + C (0), where & = { N weight the former part [39, For the pre-trained model, the coefficients Eo = 1 are all ones. The following are the instantiations in CV unlearning tasks. In classification (CIs) problems, models output the class posterior probability p(=ck:;00 0) = p(y 0) and the empirical risk for each sample is the cross-entropy (CE) loss fcs (0; =) fCE (0; xr y). In the image generation (Gen) task of conditional diffusion models [40-42], the output is the conditional sampling probability pl 2[ 0) p(rly: f). and the average loss function for each sample is the mean squared error (MSE) loss: GGen (0; 2) (MSE (0; x, y) = Er,e~~((o,))ll || - (0 [[]] where represents the diffusion step, e is the random noise sampled from a Gaussian distribution (0, 1). co is the conditional denoising model, and 2t is the noisy version of the input image. For a more detailed introduction to image generation using conditional diffusion models and latent diffusion models, please refer to Appendix B.3.
Exact and Approximate Machine Unlearning. Exact MU [15, 43, 1] ensures that the parameter distribution of the unlearned model is identical to that of model trained from scratch without seeing the forgetting samples. For large-scale models, exact unlearning can only be achieved by retraining (RT) on the remaining dataset 0 = arg ming L (0). However, the computational cost of retraining in response to every forgetting request is prohibitive. Therefore, we regard RT gold standard to approximate rather than a competitor. A more practical approach is to guide the unlearned model output distribution to approximate the output distribution of RT, known as approximate MU [16]. If we use KI. divergence to measure the difference in output distributions, the objective of approximate unlearning can be expressed as: ming (p= (0.(())))))))))))))) (0))ll==(0) (0)) ming f p= (0.) loglp=(0.)/p)) (0.)/p=(0)Jrr starting from fn- Therefore, a straight metric to approximate unlearning is the KI. divergence from the retrained model's output distribution. In addition, we also investigate metries related to forgetting efficacy, retained performance, and privacy protection for evaluation in image classification and generation tasks. For details of evaluation, please refer to Sec. 5 and Appendix D.
Steepest Descent. Approximate MU methods are usually based on gradient updates to obtain the unlearned model [18, 211. Let's first reinterpret the gradient with steepest descent [29, 27, 30]. The goal of steepest descent is to find the direction 50 = u(+1 - 0₂ that drives the objective function F(0) descent fastest within g-neighborhood of the current parameters 0z. This can be formulated as the following optimization problem. (See Appendix A. for proof.)
80 = arg min
F (0. + 50) = oc+1 == arg min F(O++1) + oilE, 0,) 0,,, 0ct1),
(1)
0c+1
where p(-, -) represents the manifold metric that renders the geometry of the parameter's 's neighborhood. To simplify the derivation, we rewrite it to the form on the right, where (E,E, represents the learning rate required to move the distance ę. In the following, we fix a small learning rate a, to approximate a search within a local neighborhood. The characterization p of the underlying coordinate space of the neighborhood will determine update directions, optimization paths, and the flatness of the minimum. Vanilla gradient descent obtained using the Euclidean metric, Newton's 's direction is measured by the second-ords -onnd-rderrreo expansion of the objective function [44], and the KL divergence in the output space induces a natural gradient [30, 45]. Next, we will probe approximate MU through vanilla gradient descent and attempt to benefit from improved manifold metrics.
3 Approximate MU from Perspective of Steepest Descent
Revisit Approximate MU Methods via Vanilla Gradient Descent. We begin with the vanilla gradient descent direction to address approximate MU. This involves finding the steepest descent direction that minimizes the KL divergence with the retrained output within the vicinity of the current model 0z. The optimization problem can be formalized as follows:
1
O.+1 = arg min DKL. (pz (0.)))) + p(20, 0c+1)
0++1
= arg min DKL. (per (0.) lprr (0++1)) p' + DKL (p- (O-)llp- (0(+1)) Dc+1
pll,, Bet1),
an (c)
(a)
(b)
where p = (DD///)) (D) and p" = p(D' DD- = - py denote the partition of forgetting and remaining dataset, respectively. Analyzing (2), (a) seeks to eliminate the influence of the target forgetting
3

---

samples, (b) aims to maintain the performance on the remaining samples, and (c) employs the metric p to constrain the magnitude of each update, thereby identifying the direction of steepest descent on the manifold. To solve the optimization challenge outlined in (2), we posit that for the current model
O, there exists a set of coefficients e, = { that weights the forgetting loss, positioning O₂ as the minimizer of the weighted loss for the original training set. The unlearning process necessitates adaptations in coefficients of forgetting loss. Then, we can determine the vanilla gradient descent for approximate MU by using Euclidean distance lg as the manifold metric, as stated in Prop. 1.
Proposition 1. Under the Euclidean manifold metric, pl0,, 02+1) = 2 3100, 0s+1 1l2. Assuming that the current model 0₂ = arg ming L (f) + (0). Let H = v2c (0.; 1 and H. = (O.)
denote the Hessian of the retrained model the forgetting set and the remaining set, respectively. Then, the steepest descent direction that minimizes (2) is approximately:
O2+1 - 02 :23 - 04e Hz (HC) VL (Or:e))) ((()e)))))) o' + (O))
(.9) The proof can be found in Appendix A.2. To
(F)
(10
Table Comparison approximate MU methods. We decompose the steepest descent direction into three parts: the weight saliency matrix (S), the forgetting part (F), and the remaining part (R) as in (3) and (4), Only SA and our method consider the preee-irrs manifold, and we further approximate up-to-date Hessian.
elucidate the effectiveness of gradient-based un- learning methods, we decompose the vanilla gradient descent direction (3) into three com- ponents: (F), (R), and (S). (F) represents the gradient ascent direction of the weighted for- getting loss, which directs the model to dis- card the information of the forgetting samples. Fine-tuning (FT) [22, 19, 38] fails guarantee MU due to the absence of (F). Current approx- imate MU methods such as Random Labeling (RL) [20] and BadTeacher knowledge distilla- tion (BT) [23] are akin to weighted forgetting loss gradient ascent, uniformly leading to an increase in the loss on forgetting samples. The unlearn- ing process often causes catastrophic forgetting of the retained knowledge. Thus, it is common to integrate (R) fine-tuning on the remaining set to sustain the model's general capabilities. Unlearned models via Gradient Ascent (GA) [20, 21] usually lose usability without (R). Furthermore, (S), ignored in most of the previous literature, involves two Hessian modulation parts. H! amplifies the parameter updates crucial for forgetting, while (H2)-1 dampens those important for maintaining. The notion of (S) closely mirrors the Weight Saliency introduced in SalUn [26]. We provide theoretical support for this notion. Importantly, our framework makes no assumption regarding input modalities, allowing its flexible application across various CV unlearning tasks.
Apprescimate MU Methods
Task Gen
components (8) (F)
MU
Manifold Metric
Onliine Hesslan
(R)
FT [22, 19,38] GA [20, 211
6
123]
Sallin [26]
SA [35]
Dln
SHR-on
Di..
Approximate MU in Kemainn-peeeevvie Manifold. In fact, employing Euclidean distance as the manifold metric for parameter updates is arbitrary. It treats all coordinates equally important because the local second-order expansion is identical V2, (2116) l2+1l I. This uniform treatment overlooks the varying parameter significance for forgetting and remaining. Moreover, certain manifolds of parameter space can exhibit substantial variations in Euclidean metric, yet the induced model output remains almost unchanged [46]. Since the retrained model performance on forgetting is unpredictable, it is pragmatic to introduce manifolds related to the remaining. Therefore, a practical objective to constrain parameter updates during unlearning within a manifold that minimally impacts the retained performance. An empirical characterization of such manifold could be the KL divergence on the output distribution of the remaining set, D&L Given that the original well-trained and the retrained model output closely match the ground-truth remaining distribution, (0,) R VL (O,) RS O. By starting with 0g and limiting updates to this manifold, the maintained output distribution remains almost consistent throughout the unlearning iterations, VL" (6(+1) R VL (0t) Re VL"(Ba zs O. This consistency permits a second-order Taylor expansion at 0, to terms (b) and (c) in (2), providing crucial curvature information for unlearning prevent deviations in the model output on the remaining set, leading to Prop.
Proposition 2. Using the model output KL divergence on the remaining set as the manifold metric, p(or, 0(41)= = DKI. (pzr
(0.) pp (0++1))) 1)). Assuming that the current model 0, = arg ming (*)
C' (0:et). Let ā, = a / (app" + 1), and Hj = V2 (9x) represent the Hessian w.tt. 0, on the remaining set, then the steepest descent direction that minimizes (2) is approximately:
0tt1 - 8 : - -z (H:) H (H)) V L e.))
(4)
(R)
(S)
(F)

---

We defer the proof to Appendix A.3. The unlearning updates in (4) incorporated second-order Hessian concerning remaining to guide the optimization direction. Specifically, the large curvature direction of Hi corresponds with the weights that encapsulate remaining knowledge, while the small curvature direction encourages model updates for effective unlearning. Furthermore, the update direction in (4) primarily follows the weighted gradient ascent (F) modulated by weight saliency (S). Such unlearning iterative updates in remain-preserve preserving manifold focus on diminishing the distributional discrepancy with exact MU concerning forgetting output.
Challenges in Hessian Approximation.
To exploit the benefits of unlearning updates within the
remain- preeeering manifold, the key point is (H -1 However, calculating the Hessian and its
reverse for large-scale models is computationally demanding [47]. Consequently, many methods have
been developed to estimate the Hessian, such as Fisher information [34], Fisher diagonals [48], and Kronecker factored Laplace approximation [49]. Regarding unlearning. Selective Amnesia (SA) [35] employs the initial model's remaining Fisher diagonals as the second-order Hessian constraint on parameter updates. However, the fixed Hessian in SA leads to progressively increasing estimation biases, exacerbated by cumulative errors in Taylor expansion, which harms the retained performance during unlearning. To address this issue, the subsequent Sec. 4 introduces an fast-slow weight update method that implicitly approximates the direction adjusted by the up-to-date Hessian.
4 Proposed Method
Implicit Online Hessian Approximation (R-on). Given that computing the inverse of even well- approximated Hessian demands substantial computational resources, it is more practical to estimate the unlearning direction post-Hessian inversion modulation directly. Inspired by recent insights into the connection between Meta-Continual Learning and Hessian approximation [50], we propose fast-slow weight [36, 37] method for implicitly approximating the desired updates. The optimization problem for fast weight updates is formulated follows:
min L (0() 0f
s.t. of = 0. (O.)
where L" represents an arbitrary forgetting loss and Be is its learning rate. The iterative process is depicted in Fig. 1. A step of forgetting is taken at the current model, resulting in of- Several gradient descent updates on the remaining set follow to obtain the minimum point 65. This fine-tuning ensures that the updated model adheres to the remain- cemain-preserving manifold. The slow weight updates leverage the underlying connection between Og and Of, as stated in Prop.
Proposition 3. For implicit online Hessian approximation in (5), suppose B,, 5, is small, B. Vo./ L. (0.) there exist an h--neghhorrhoo ((), S+) of the optimal model parameter 8, = arg ming! L (e!),
(0.))T, L is p-smooth, i.e., (0) V V (0')ll S pl10 0'112, and
which includes Og and 0f- Then, the iterative update term approximately is,
0 0g m 37 ~ (
(6)
The proof is in Appendix A.4. Prop. 3 indicates that the model 67. obtained after fine-tuning using the process described (5), is approximately equivalent to updating the current model 0, by one step in the Hessian-adjusee unlearning direction. We use this direction to update the outer loop.
Comparison with the joint loss (R). We investigate the differences in the updates between our optimization in (5) (R-on) and the joint optimization of forgetting and remaining losses (R) [23, 25]. We take the checkpoint after the first step of fine-tuning the remaining set as an example and ignore the step size.
CR CR(B)) L" + (0.),
V + (".())).
AR V VL V
- -I- -1)
VC) VL
(8)
Comparison of the updates in (7) and (8) reveals that the remaining gradient is the same. Our forgetting update in fast weight is adjusted by an additional term -H, which is absent in joint optimization. This modification weakens the directions that significantly impact the remain, thereby mitigating the
damage of forgetting loss on the retained performance. Furthermore, certain methods [24] suggest two-stage unlearning that first impairs the model and then repairs it, actually paralleling a single fast-slow weight update of our method.
5

---

Sample-wise Adaptive Coefficient for Gradient Ascent (F), Despite variety of forgetting losses introduced in previous literature, we stick to our theoretical result in (4) and adopt the weighted forgetting loss. Due to intractable challenges in solving the inverse problem associated with the arg min condition for the gradient ascent coefficients, we explore the properties of these coefficients and propose a heuristic estimation. 6x satisfies: @ For the pretrained model, Eo = 1. @ For the retrained model, ET = I, where T is the optimal step to obtain RT. @ Assuming homogeneity of samples, if {(0; 2 ) > E(0; 2/) ), then Et,i < Et, [51]. Moreover, considering the continuity in the model parameter space implies the continuity of Et,s in the function space. Thus, our heuristic estimation consists of decreasing numerical values across steps and sample-wise adaptation based on loss magnitude,
-T T (1-
1/10(0s) 25 Miteach EE 1/(e 2f
(1 -1-
x N', ISiEN
where T represents the outer loop iteration, À is the temperature scalar to control the smoothness of coefficients, and [lamch denotes the operation to detach a tensor from the computational graph, which means e(0;; ) in (9) only serves for weighting coefficients and does not contribute to the gradient. ε,, is employed to modulate the gradient ascent loss for forgetting samples, thereby preventing model explosion and reducing the contribution to updates from samples whose influence has already been ablated, while prioritizing those whose losses remain minimal and are not yet adequately forgotten. However, relying solely on empirical loss as an evaluation metric for sample contribution is limited and potentially biased. We believe that enhanced designs for coefficient estimation in future research could yield more accurate unlearning results.
Forget- Rengen Balanced Weight Saliency (S). Recall in the theoretical framework of (4), the steepest descent leverages H! (H as weight saliency to modify the forgetting gradient. However, computing both Hessians at RT is impractical, necessitating an estimation of weight saliency for both forgetting and remaining. Previous work like SalUn [26] considers only parameters that significantly affect the forgetting set, whereas these parameters might also critically impact the retained performance. To address this and align with our theoretical insights, we adopt techniques from SSD [33] to approximate H. (HT) -1 using the diagonal of the initial model's Fisher information matrix. Through hard thresholding operation, we obtain the weight saliency map:
m
Fal (Frin)) 2 r] where Fl ding = [VL (0o)]: Paig = [VL (00)).
(10)
[[|] is an element- wise indicator function, and y > 0 is hard threshold used to control the Forget- Remain balance in selecting parameters. Guided by (4), we apply the weight saliency map exclusively to forgetting, in contrast SalUn [26] which applies to both forgetting and remaining. The saliency map can enhance the unlearning process by directing updates to focus on the parameters that are crucial for erasing specific samples or concepts. More advanced weight saliency estimation is expected to improve outcomes in future work.
Integrated Fast-slow Weight Update. By integrating the three designs into single update scheme towards the Saliency Forgetting in the Remain preserrinn manifold online, we develop our SFR-on method. Specifically, in the inner loop for fast weights, we adaptive coefficients in (9) to weight the forgetting gradient ascent with the weight saliency map from (10) to serve as the unlearning update in (5). Slow weights in outer loops update by linearly interpolating the fine-tuned 6, and A, in weight space, achieving an estimated steepest descent for approximate MU under the remaining output constraint in (4). Then, we have the overall fast-slow weight update rule:
Inner Loop: min L (0,") 0!
s.t. 0f O: 3 ① V (0);
(11)
Outer Loop: : 0.41 0 (0 07) ~ 0. a, 5 (H,) m Temm@mm (-VC'(B(;E)))
(12)
where a represents the slow weights learning rate. Worth mentioning that our SFR-on does not require adaptation specific application tasks, nor does it necessitate modifications to the task's inherent loss. Consequently, our approach can be seamlessly applied to various CV unlearning scenarios by simply substituting the loss in the weighted gradient ascent with either CE loss for image classification or MSE loss for image generation. Considering that calculating fine-tuning or the Fisher diagonal on the complete remaining dataset for large-scale image generation tasks, we randomly select an equivalent number of samples from the remaining as in the forgetting set for computation [35, 26]. We find that our method remains effective under such an inadequate setup, as detailed in Sec. 5. The complete algorithm is placed in Appendix C.

---

Table 2: Performance summary of MU methods for image classification (including RT, six baselines, our proposed SFR-on, and ablations on our designed components), assessing unlearning 10% random subset of CIFAR-I0 using ResNet- 18 and TinyImageNet using Swin-T. All results are presented as mean and standard deviation across 10 independent trials. Performance discrepancies from RT are indicated with (+), highlighting that more effective unlearning is reflected by performance closer to RT. The 'Averaging Disparity' (Avg.D) metric is calculated by the average of the gaps measured in accuracy-relan metries, including FA, RA, TA, and MIA. DKLL denotes the KL divergence to RT. RTE is recorded minutes.
Mitthed
RA
CIFAR Randon Sabert Feggeting (185)
Therkaapaa Randees Subtott Parpentiy (98%)
Pe..
301 R1
13.0) Tel (026)
w00
0.91
13.71
S52R 10.00
W.Sluse 9130
02,0 (G20)
100)
42.00
F7
mo 01:30
34y
55 (3345)
1.5
0.66
343
Serr (11 Ho
16. ao 30
St 0.05
30
19330
601
0.01
6:36
80.
86 to
1155 4..5... H0 31 (1am 11
11:3
0.3
4%
3345
33
(480)
da uil 30
Ser 6.50
65
(3: 90
6/0
0.1
4.7
Suilia
3439
0.7
150 (1am)
11
(18.2)
125
044
0.30
(271) 41 (1385)
6.26
5.50
(2.33)
(175
0.2)
SCRUUB
2444aa (5.52)
W0lhuuse (812)
94.3
(1:23) 97.40aa (12.9)
4.3
pribleue (1194)
9K.0leas (145
N074 (.255
91.30aar (12.0)
104
062
3.49
$ F.F.R
TT
Nakiixasd 7%
(800 (100)
35
15 54)
200
07%
313
13)
08 10 1960
50
st a3 11.50
1.8
071
(colgve
at
9635 80.90
1008 14.20
12.30r
1.3
0.5
290
(11.7)
(1,40)
T. (1.9)
1,8
4.11
5 Experiments
Datasets, Models, and Settings. In image classification, we primarily focus on the random subset unlearning task. Evaluations are conducted using ResNet-18 [52] on CIFARIO [53] and Swin- T [54] on TinylmageNet [55], with additional tests on random subset and class-wise forgetting tasks involving CIFAR 100 [53] and SVHN [56]. detailed in Appendix F.2. In image generation, our main interest lies in wass forgetting tasks. Following [35, 26]. we unlearn conditional DDPM [40] with the UNet architecture [57] on CIFAR1O. Moreover, for the first time, we explore the latent diffusion model [42] equipped with Diffusion Transformer (DiT) [58] on ImageNet [59], which demonstrates superior scalability in learning large-scale data generation tasks. Finally, we perform concept forgetting tasks using the open-source Stable Diffusion (SD) V1.4 [42] to inhibit the generation of NSFW content, specifically by targeting the prevention of nude images. Further details on unlearning setups and training are available in Appendix E.
Baselines and Evaluation. We regard RT as an oracle of approximate MU and compare our proposal with eight MU methods, including six gradient- based MU approaches outlined in Sec. 3: FT [19]. GA [21], BT [23]. RL [20]. SalUn [26], and SA [35]. We also consider SCRUB [25], an enhanced variant of BT. for image classification, and ESD [11] 1] for removing concepts in SD. For the evaluation of random subset unlearning tasks, we measure the output KL divergence DXL between the unlearned and retrained models, which is the direct target of approximate MU. Besides, we assess the accuracy on the forgetting set (FA) for unlearning efficacy, and the accuracy on the remaining (RA) and test (TA) sets for preserved generalization ability. We also consider the success rate of membership inference attack (MIA) [60, 38] on the forgetting set as a privacy metric. Note that the smaller the disparity these metrics against RT, the more effective the unlearning. Run-time efficiency (RTE) is also reported. For class wise forgetting tasks in image generation,
evaluate the accuracy of the unlearned model's s generated images on forgetting classes (FA) by pre-trained classifier. The Fréchet Inception Distance (FID) [61] metric assesses the retained generative capability for remaining classes. For ablating the 'nudity' concept in SD, we employ the NudeNet [62] detector to identify and count nude body parts in generated NSFW images. For further introduction to the baselines and detailed evaluation metrics, please refer to Appendix E. and D.
To assess the unlearning effectiveness and efficiency of SFR-on, we perform comprehensive experi- ments and conduct ablation studies to address the following four key questions:
Q1: How does SFR-on perform on unlearning in image classification? We first evaluate the performance of our method, SFR-on, against existing gradient- MU methods on the image classification random subset unlcarning task. In this scenario, the forgetting set, remaining, and test sets all originate from the same distribution. Consequently, even if the model undergoes unlearning on the random subset, it may still generalize to these samples. To avoid potential biases from only using FA as an unlearning metric, we incorporate MIA to assess the privacy retention of the forgetting set, enhancing the robustness of assessments. As detailed in Tab. 2, for forgetting 10% random subset on CIFAR- 10 and Tiny SFR-on not only most closely aligns with RT in the averaging metric disparity but also exhibits the smallest output KI. divergences w.r.l. RT. This performance underscores our effectiveness and efficiency in achieving the objective of approximate MU. The results of the increased 50% random subset unlearning task are included in Appendix F.2.
7

---

Table 3: Class-wise forgetting performance on CIFARIO with DDPM and ImageNet with DiT. The best
unlearning performance for each forgetring class is highlighted in bold for FA and FID.
CIFAR-I0 Cleoowise Forgetting
ImageNit Class-wise Forgetting
Mathods
Autondbile: F
FID
4
FA..
Cal
FID
FF..
Doy
FID
[FA
Hunc
FID
FA.
Tuck
FID
Steps
Caratux galenita Gookan
FA
FID
[FA..
rntrions
FID
FA
White wall
FID
FA
Austic fox
FID
FA.
Otter
FID
Steps
SA SalUn
0.00
23.56
14.20
21.34
8.00
21,19
0.09
21.13
0,00
29.5
10000
0.00
348.75
0.00
298.97
0.00
45.89
0.00
393.9]
29.8
321.21
10000
0:20
21:23
1.4
20.29
0.00
28
0.00
20,30
0.80
20,45
1000
91.21
18.47
46.09
28.28
0.00
15.16
45.90
408.77
$7.50
19.06
10000
SP
0.00
20.70
7.40
18.44
0.20
18,89
0.09
19.90
0.09
20.61
50
0.00
13.99
0.00
17.76
0.00
25.28
0.00
16.12
0.00
16.43
500
Forgetting class: "Cat'
Non-forgetting clusss
Methods
C3
C4
CS
Pretrain
RT
SA
SalUn
F R on
Figure 2: Image generations for class-wise forgetting tasks on CIFAR-10 using DDPM by baselines and our proposed SFR-on along with ablation variants. The forgetting class is 'cat', 'I' refers to the generated image sample from this class, and 'C" denotes the remaining class name. More results can be found in Appendix F.7.
Q2: How does SFR-on perform on class-forgetting image generation? Another recent focus in MU involves the targeted removal of specific knowledge from image generation models, which are currently categorized into conditional and latent diffusion models. For the former, we investigated class-wise forgetting CIFAR- 10 using DDPM. As illustrated in Fig. 2. RT continues generate high-quality images devoid of the semantic content of 'cat.' Contrarily, previous approaches like SA resulted in random noise for the forgetting class, whereas SalUn created images belonging alternate classes, both differ from RT output. Our SFR-on (depicted in the last row of Fig. 2) effectively removes the "cat' class by yielding high-quality pictures without discernible semantics, and maintains the high fidelity of images across non-forgetting classes, most matching RT. Furthermore, we extend the image generation unlearning task to DiT, recently proposed model promising for realistic image generation. Due to computational resource constraints, RT for DiT is unfeasible. Instead, we simulate RT by substituting the DiT output of the forgetting class with initial random latent embeddings. These embeddings are then processed by the pre-trained autoencoder to reconstruct the corresponding images, referred to RTI in Fig.3. Previous methods, such as SA and SalUn, fail to completely reduce the forgetting class to noise and compromise the fidelity of non- non-forgetting class images. In contrast, our SFR-on successfully achieves results comparable to RTt, effectively forgetting the target class without degrading the general generative capability. Details on the accuracy of forgetting class samples by various unlearned DiT and FID of remaining classes are presented in Tab. 3.
Q3: What is the impact of each component of SFR-on on forgetting performance? To investigate developed for the decomposition of approximate MU, we perform
the efficacy of each component ablation studies. We build on the joint training of GA and FT as our baseline (R) and incorporate our proposed implicit online hessian approximation (R-on), adaptive coefficients (F), and forget-retain balanced weight saliency (S). As demonstrated in the last four rows of Tab. 2. the addition of our (R-on) allows models effectively forget while sustaining performance on the remaining set. Both (F) and (S), crafted to approach the steepest descent for approximate MU, enhance the unlearning efficacy. In image generation, as depicted in the last three rows of Fig. 2, although the joint training (R) is capable of completely forgetting targeted classes, it results in distorted images for remaining. Replacing (R) with our (R-on) remarkably improves the image fidelity of the remaining classes, but the forgetting class images still show low-quality textures. Further, our (F) and (S) effectively direct the unlearning process towards the approximate MU, ensuring that the performance of the unlearned models closely mirrors that of RT. More ablations hyperparameters are provided in Appendix F.I.
8

---

Forget: "Golden retriever'
Non-forgetting classes
Methods
12
C1
C2
C3
C4
C5
Pretrain
RTI
SA
SalUn
SFR-on
Figure 3: Class-wise forgetting of "golden retriever' in image generations ImageNet with DiT, comparing baselines and our proposed SFR-on. RT! feeds autocncoder with random latent embeddings for the forgetting class, due to the computational constraints, rather than full RT. 'I' denotes image samples from forgetting, and 'C' refers other remaining class name, egg. 'Cacatua galerita' (C1). More results be found in Appendix F.7.
Q4: How effective is SFR-on in NSFW con- tent removal for SD? We finally assess the effi-
Table 4: Unlearning performance in erasing 'Nudity" concept from SD by the original SD V1.4, ESD, SalUn, and our SFR-on, measuring the number of total 9406 NSFW images generated from 12P prompts across nudity categories. The prefixes 'F'' and 'M- denote "Female" 'Maee- respectively.
cacy of our method in removing the "nudity' con- cept from the open-source SD to prevent the gen- eration of NSFW content. Given that SD V1.4 is trained on the LAION dataset [63], purging all images depicting nudity and retraining the model would be prohibitively time-consuming and inteunsiei In this unlearning task, we designate 'nudity' as the forgetting set and generate set of clothed individuals as remaining to preserve SD's generalization capability across non-nudity themes. We utilize the inappropriate image prompts (I2P) [12] to query potentially NSFW content from the unlearned SD and employ NudeNet to detect exposed body parts these images. The results in Tab. demonstrate that our method significantly prevents the generation of culturally sensitive body parts, such as breasts and genitalia, highlighting our strength enhance the trustworthiness machine learning applications.
stapeed bob para Cadaaa
Bancs Flaut F.esul
6 Conclusion
This paper revisits gradient-based approximate MU methods from the perspective of the steepest descent. The descent direction under an Euclidean manifold metric can be divided into three integral components: weighted forgetting gradient ascent, fine-tuning remaining gradient descent, and weight saliency matrix. Our approach advances beyond the Euclidean constraints by embedding the unlearning update within a remain- preserving manifold. This novel strategy incorporates the second-order Hessian of the current model on remaining, safeguarding against detrimental impacts on retained performance. To circumvent the prohibitive computational demands of the Hessian in large-scale models, we introduce an efficient fast-slow weight update method to approximate dlessian-adjusted direction. Furthermore, our innovative adaptive coefficient for weight forgetting loss and a forget-remain balanced weight saliency map facilitate near-retraining unlearning. Our method can be applied to popular CV unlearning tasks with empirically verified unlearning efficacy.

---

Acknowledgments and Disclosure of Funding
The authors would like to thank the anonymous reviewers for their insightful comments.
The research leading to these results has received funding from National Key Research Development Project (2023YFF1 104202), National Natural Science Foundation of China (62376155, Shanghai Municipal Science and Technology Research Program Major Project (2021SHZDZX01022.
References
[1] L. Bourtoule, V. Chandrasckaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lic, and
N. Papernot, "Machine unlearning," 2021 IREE Symposiun on Security and Privacy (SP), pp. 141-159, 2019. 1, 3,
[2] T. Shaik, X. Tao, H. Xie, L. Li, X. Zhu, and Q. Li, "Exploring the landscape of machine unlearning: A survey and taxonomy," arXiv preprint arXiv:2305..663660 2023. 19
[3] J. Xu, Z. Wu, C. Wang, and X. Jia, "Machine unlearning: Solutions and challenges," IEEE Transactions on Emerging Topics in Computational Intelligence, 2024. 1, 19
[4] G. D.P.P. R. GDPR, "General data protection regulation." URL: htps://gdpr-info. eu/faccessed 2020-11-21], 2018.
[5] E. Illman and P. Temple, "California consumer privacy act," The Business Lawyer, vol. 75, no. 1, pp. 1637-1646, 2019.
[6] J. Rando, D. Paleka, D. Lindner, I. Heim, and F. Tramer, "Red-teaming the stable diffusion safety filter," arXiv preprint arXiv:2210.04610 2022. 19
2022.
[7] N. De Cao, W. Aziz, and I. Titov, "Editing factual knowledge in language models," Empirical Methods in Natural Language Processing (EMNLP), 2021.
[8] K. Meng, D. Bau, A. Andonian, and Y. Belinkov, "Locating and editing factual associations in gpt," Advances in Neural Information Processing Systems (NIPS), vol. 35, pp. 17 359-177 372, 2022. 1
[9] A. Oesterling, J. Ma, E. Calmon, and H. Lakkaraju, "Fair machine unlearning: Data removal while mitigating disparities," International Conference on Artificial Intelligence and Statistics. PMLR, 2024, pp. 3736-3744.
[10] R. Chen, J. Yang, H. Xiong, J. Bai, T. Hu, J. Hao, Y. Feng, J. T. Zhou, Wu, and Z. Liu, "Fast model debias with machine unlearning," Advances Neural Information Processing Systems (NIPS), vol. 36, 2024.
[11] R. Gandikota, Materzynska, Fiotto-Kaufman, and Bau, "Erasing concepts from diffusion models." in IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 2426-2436. 1, 2, 7, 19, 22
[12] Schramowski, M. Brack, B. Deiseroth, and K. Kersting, "Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models," in IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2023, pp. 522-222 531. 2. 9,, 19
[13] N. Kumari, B. Zhang. S.-Y. Wang. E. Shechtman, R. Zhang, and J.-Y. Zhu, "Ablating concepts in text- to image diffusion models," in IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 22 291 22 702. 19
[14] E. Zhang, K. Wang, X. Xu, Z. Wang, and H. Shi, nForget-me-not: Learning to forget in text-to-image diffusion models." arXiv preprint ar ar3vv:2303.1 /7591, 2023. 1, 19
[15] C. Guo. Т. Goldstein, A. Y. Hannun, and L. van der Maaten. "Certified data removal from machine learning models," International Conference on Machine Learning (ICMI), 2020. 1, 19
[16] Z. Izzo, M. A. Smart, K. Chaudhuri, and J. Y. Zou, "Approximate data deletion from machine learning models: Algorithms and evaluations." ArXiv, vol. abs/2002. 2020. 3, 19
[17] A. Thudi, H. Jia, I. Shumailov, and N. Papernot, "On the necessity of auditable algorithmic definitions for machine unlearnin," in USENIX Security Symposium, 2021.
[18] S. Neel, A. Roth. and S. Sharifi-Malvajeee Malvajerdi. "Descent-to to-leete- Gradient based methods for machine unlearning." Algorithmic Learning Theory, 2021. 2, 19
10

---

[19] A. Warnecke, L. Pirch. C. Wressnegger. and K. Rieck, "Machine unlearning of features and labels," Annual Network and Distributed System Security Symposium, 2023. 4, 7, 19, 22
[20] I.. Graves, V. Nagisetty, and V. Ganesh, "Amnesiac machine learning," in AAAI Conference on Artificial Intelligence (AAAT), 2021. 4,7, 19, 22
[21] A. Thudi, G. Deza, V. Chandrasekaran, and N. Papernot, "Unrolling sgd: Understanding factors influencing machine unlearning." European Symposium on Security and Privacy (EuroS&P), pp. 303 319, 2022. 3, 4,
7. 19, 22
[22] A. Golatkar, A. Achille, and S. Soatto, "Eternal sunshine of the spotless net: Selective forgetting in deep networks." IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9301-9309, 2019. 4, 19, 22
[23] V. S. Chundawat, A. K. Tarun, M. Mandal, and M. S. Kankanhalli, "Can bad teaching induce forgetting? unlcarning in deep networks using incompetent teacher," AAAI Conference on Artificial Intelligence (AAAI), 2023. 4, 5, 7, 19,22 22
[24] A. K. Tarun, V. S. Chundawat, M. Mandal, and M. S. Kankanhalli, "Fast yet effective machine unlearning." IEEE transactions on neural networks and learning systems, vol. PP, 2021. 5, 19
[25] M. Kurmanji, P. Triantafillou, and E. Triantafillou, "Towards unbounded machine unlearning," " Towards Unbounded Machine Unlearning (NIPS), 2023. 2, 5, 7, 22
[26] C. Fan, J. Liu, Y. Zhang, D. Wei, E. Wong, and S. Liu, "Salum: Empowering machine unlearning via gradient- weight saliency in both image classification and generation," International Conference on Learning Representations (ICLR), 2023. 2, 6, 7, 19, 22, 24
[27] M. Kim, D. Li. S. X. Hu, and T. M. Hospedales, "Fisher sam: Information geometry and sharpness aware minimisation"" in International Conference on Machine Learning (ICML). 2022. 2,3, 19
[28] T.-C. Kao, K. T. Jensen, M. van de Ven, A. Bernacchia, and G. Hennequin, "Natural continual learning: success is journey, not (just) a destination," Advances in Neural Information Processing Systems (NIPS), 2021. 19
[29] T. E. Abrudan, J. Eriksson, and V. Koivunen, "Steepest descent algorithms for optimization under unitary matrix constraint," IEEE Transactions on Signal Processing, vol. 56, pp. 1134-1147, 2008 3, 19
[30] Martens, "New insights and perspectives on the natural gradient method," " Journal of Muchine Learning Research, vol. 21, pp. 146:1-146:76 76, 2014. 2, 19
[31] T. Li, L. Tan. Huang. Q. Tao. Y. Liu, and X. Huang, "Low dimensional trajectory hypothesis true: Dnns can be trained in tiny subspaces," " IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, pp. 3411 -3420, 2022. 2
[32] E. Hu, Y. Shen, Wallis, Z. Allen-Zhu, Li, Wang, and W. Chen, "Lora: Low-rank adaptation of large language models," International Conference on Learning Representations (ICLR), 2022. 2
[33] J. Foster, S. Schoepf, and A. Brintrup, "Fast machine unlearning without retraining through selective synaptic dampening," " AAAI Conference on Artificial Intelligence (AAAI), 2024. 2, 6, 20
[34] J. Kirkpatrick, R. Pascanu, N. C. Rabinowitz, J. Veness, G. Desjardins, A. A. Rusu, K. Milan, J. Quan,
T. Ramalho, A. Grabska- Barbiskk,aa D. Hassabis, C. Clopath, D. Kumaran, and Hadsell, "Overcoming catastrophic forgetting in neural networks," Proceedings of the National Academy of Sciences, vol. 114, pp. 3521 3526, 2016. 2, 5, 19
[35] A. Heng and H. Soh. "Selective amnesia: A continual learning approach to forgetting in deep generative models." " Advances in Neural Information Processing Systems (NIPS). 2023. 2, 4, 5, 6, 2,1 22, 23
[36] M. R. Zhang, J. Lucas, G. E. Hinton, and J. Ba, "Lookahead optimizer: k steps forward, step back," Advances in Neural Information Processing Systems (NIPS), 2019. 2,5 5
[37] A. Nichol, J. Achiam, and J. Schulman, "On first-order meta-leaming algorithms." ArXiv, vol. abs/1803. 02999. 2018, 2,5
[38] J. Jia, J. Liu, P. Ram, Y. Yao, G. Liu, Y. Liu, P. Sharma, and S. Liu, "Model sparsity can simplify machine unlearning." "" in Neural Information Processing Systems (NIPS), 2023. 2, 3,4, 4. 7, 19, 22
[39] P. W. Koh and P. Liang. "Understanding black predictions via influence functions," in International Conference on Machine Learning (ICML), 2017. 3, 19

---

[40] J. Ho, A. Jain, and P. Abbeel, "Denoising diffusion probabilistic models." Advances in Neural Information Processing Systems (NIPS), 2020. 3, 7, 19, 20
[41] Ho, "Classifier-free free diffusion guidance," ArXiv, vol. abs/2207.12598, 2022. 19,20
[42] R. Rombach, Blattmann, D. Lorenz, P. Esser, and Ommer, "High-resolution image synthesis with latent diffuuion models," /EEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10 6855, 2022. 3. 7, 19, 20
[43] A. Mahadevan and M. Mathioudakis, "Cortifiable machine unlcarning for linear models," ArXiv, vol.
0ts/2106.15099) 2021. 3
[44] D. Kovalev, Mishchenko,
Richtárik, "Stochastic newton and cubic newton methods with simple local linear- linear-quaden quadratic rates," ArXiv, vol. abs/1912.01597, 2019.
[45] O. Calin and C. Udrişte, "Geometric modeling in probability and statistics," 2014. 3
[46] T. Hoang, S. Rana, S. Gupta, and S. Venkatesh, "Learn to unlearn for deep neural networks: Minimizing unlearning interference with gradient projection," IEEE/CVF Winter Conference Applications of Computer Vision (WACV), 2023.
[47] M. Elsayed and A. Mahmood, "Hesscale: Scalable computation of hessian diagonals," 2022. 5
[48] F. Huszár, "Note on the quadratic penalties in elastic weight consolidation," Proceedings of the National Academy of Sciences, vol. 115, no. 11. Feb. 2018. [Online]. Available:
http://dx.doi dow.org/OO.....o 10w.:0..............mmmm 0073/pnas.17117421155 1717042115
[49] H. Ritter, Botev, and D. Barber, "Online structured laplace approximations for overcoming catastrophic forgetting," Advances in Neural Information Processing Systems (NIPS), 2018. 5
[50] Y. Wu, L.-K. Huang, R. Wang, D. Meng, and Y. Wei, "Meta continual learning revisited: Implicitly enhancing online hessian approximation via variance reduction," in International Conference on Learning Representations (ICLR), 2024. [Online]. Available:
5, 19
[51] B. Rozemberezki, L. Watson, P. Bayer, H.-T. Yang, O. Kiss, S. Nilsson, and Sarkar, "The shapley value in machine learning," International Joint Conference on Artificial Intelligence (IJCAI), 2022.
[52] K. He, X. Zhang, S. Ren, and J. Sun, "Deep residual learning for image recognition," IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770-778, 2015. 7
[53] A. Krizhevsky, "Learning multiple layers of features from tiny images," 2009.
[54] Z. Liu, Lin, Y. Cao, H. Hu, Y. Wei, Z. Zhang, S. Lin, and B. Guo, "Swin transformer: Hierarchical vision transformer using shifted windows," IEEE/CVF International Conference on Computer Vision (ICCV), pp. 9992-10002, 2021."
[55] Y. Le and X. S. Yang. "Tiny imagenet visual recognition challenge," 2015. 7
[56] Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Ng. "Reading digits in natural images with unsupervised feature learning." 2011. 7
[57] O. Ronneberger, Fischer, and T. Brox, "U-net: Convolutional networks for biomedical image segmenta- tion." Medical Image Computing and Computer-Assisted Intervention (MICCAI), 2015. 7
[58] S. Peebles and S. Xie, "Scalable diffusson models with transformers," IEEE/CVF International Confer-
ence on Computer Vision (ICCV), 4172-4182. 2023. 7, 19, 20
[59] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, "Imagenet: A large-scale hierarchical image database." " IEEE Conference Computer Vision and Pattern Recognition (CVPR), pp. 248-255, 2009. 7
[60] L. Song and P. Mittal, "Systematic evaluation of privacy risks of machine learning models," in USENIX Security Symposium, 2020. 7
[61] M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, "Gans trained by a two time-scale update rule converge to local nash equilibrium," 2018. 7
[62] P. Bedapudi, "Nudenet: Neural nets for nudity classification, detection and selective censoring," 2019. 7
12

---

[63] C. Schuhmann, R. Vencu, R. Beaumont, R. Kaczmarezyk, C. Mullis, A. Katta, T. Coombes, J. Jitsev, and A. Komatsuzaki, "Laion-400m: Open dataset of clip-filtered 400 million image-lext pairs," ArXiv, vol. abs/2111 11.0114,, 2021. 9
[64] A. Sekhari, J. Acharya, G. Kamath, and A. T. Suresh, "Remember what you want forget: Algorithms for machine unlearning" Advances in Neural Information Processing Systems (NIPS). 2021.
[65] A. A. Ginart, M. Y. Guan, G. Valiant, and Y. Zou, "Making ai forget you: Data deletion in machine learning." " Advances in Neural Information Processing Systems (NIPS), 2019. 19
[66] E. Ullah, T. Mai, B. Rao, R. A. Rossi, and R. Arora, "Machine unleamiin via algorithmic stability," in Annual Conference Computational Learning Theory, 2021. 19
[67] R. Giordano, W. T. Stephenson, R. Liu, M. Jordan, and T. Broderick, "A swiss army infinitesimal jackknife," in International Conference on Artificial Intelligence and Statistics, 2018. 19
[68] Chen, Z. Zhang, T. Wang, M. Backes, M. Humbert, and Y. Zhang, "When machine unlearning jeopardizes privacy." Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2020. 19
[69] Z. Li and Y. Zhang. "Membership leakage in label-only exposures." Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2020.
[70] L. Song, R. Shokri, and P. Mittal, "Privacy risks of securing machine learning models against adversarial examples." Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019.
[71] S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, "Privacy risk in machine learning: Analyzing the connection to overfitting," 2018 IEEE 31st Computer Security Foundations Symposium (CSF). pp. 268-282, 2017.
[72] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, "Memhership inference attacks from first principles," " 2022. 19
[73] X. Cheng, Huang, and X. Huang, "Machine unlcarning by suppressing sample contribution," 2024, 19
[74] H. Hu, Z. A. Salcie, L. Sun, G. Dobbie, P. Yu, and X. Zhang. "Membership inference attacks machine learning: A survey." ACM Computing Surveys (CSUR). vol. 54, pp. 1 37, 2021. 19
[75] M. Fredrikson, S. Jha, and T. Ristenpart, "Model inversion attacks that exploit confidence information and basic countermeasures, Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communica- tions Security, 2015. 19
[76] B. Balle, G. Cherubin, and J. Hayes, "Reconstructing training data with informed adversaries," " 2022 IEEE Symposium on Security and Privacy (SP), pp. 1138-1156, 2022. 19
[77] M. McCloskey and N. J. Cohen, "Catastrophic interference connectionist networks: The sequential learning problem," Psychology of Learning and Motivation, vol. 24, pp. 109-165, 1989. 19
[78] R. Rateliff, "Connectionist models of recognition memory: constraints imposed by learning and forgetting functions." Psychological review, vol. 97 2, pp. 285-308, 1990.
[79] L. Wang, X. Zhang, H. Su, and J. Zhu, "A comprehensive survey of continual learning: Theory, method and application," IEEF transactions on pattern analysis and machine intelligence, vol. PP, 2023. 19
[80] N. Carlini, J. Hayes, M. Nast, M. Jagielski, V. Sehwag, F. Tramèr, B. Balle, D. Ippolito, and E. Wallace, "Extracting training data from diffusion models," USENIX Security Symposium, 2023. 19
[81] G. E. Hinton, "Deterministic boltzmann learning performs steepest descent in weight-space," Neural Computation, vol. 1, pp. 143-150, 1989. 19
[82] L. Wu, M. Ye, Q. Lei, J. D. Lee, and Q. Liu, "Steepest descent neural architecture optimization: Escaping local optimum with signed neural splitting." 2021. 19
[83] S. Amari, "Natural gradient works efficiently in lcarning," Neural Computation, vol. 10, pp. 251-276, 1998. 19
[84] R. Shrestha, "Natural gradient methods: Perspectives, efficient-scalable approximations, and analysis." 2023, 19
13

---

[85] Т. Hartland, G. Stadler, M. Perego, K. Liegeois, and N. Petra, "Hierarchical off-diagonal low-rank approximation of hessians in inverse problems, with application ice sheet model initialization." Inverse Problems, 39, 2023, 19
[86] J. Martens and R. B. Grosse, "Optimizing neural networks with kronecker-factored approximate curvature," in International Conference on Machine Learning (ICML). 2015. 19
[87] Y. Wang, W. Deng, and G. Lin, "An adaptive hessian approximated stochastic gradient meme method," Journal of Computational Physics, vol. 432, p. 110150, 2020. 19
[88] L. Liu, X. Liu, C.-J. Hsieh, and D. Tao, "Stochastic optimization for non-convex problem with inexact hessian matrix, gradient, and function," " IEEE transactions on neural networks and learning systems. vol. PP, 2023.
[89] X.-T. Yuan and P. Li, "On convergence of distributed approximate newton methods: Globalization, sharper bounds and beyond," Journal of Machine Learning Research, 2019. 19
[90] E. Berglund and Johansson, "Novel limited memory quasi-newton methods based on optimal matrix approximation." 2024. 19
[91] S. Wright, "Convergence of projected hessian approximations quasi-newton methods for the nonlinear programming problem." Ima Journal of Numerical Analyxis, vol. 6, pp. 463-474, 1986. 19
[92] A. Dosovitskiy, L.. Beyer, A. Kolesnikov, D. Weissenbomn X. Zhai, T. Unterthiner, M. Dehghani, Min- derer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, "An image is worth 16x 16 words: Transformers for image recognition at scale," 2021. 21
[93] Loshchilov and F. Hutter, "Decoupled weight decay regularization." 2019. 23
[94] P. Maini, Z. Feng, A. Schwarzschild, C. Lipton, and 7., Kolter, "Tofu: task of fictitious unlearming for llms," arXiv preprint arXiv:2401.06: 2024. 25
[95] Y. Li, Bubeck, R. Eldan, A. Giorno, S. Gunasekar, and Lee, "Textbooks are all you need phi-1.5 technical report," arXiv preprint arXiv:2309.05663, 2023. 25
[96] B. Liu, Q. Liu, and Stone, "Continual learning and private unlearning," in Conference on Lifelong Learning Agents. PMLR, 2022, pp. 243-254. 25
[97] R. Zhang, Lin, Bai, and S. Mei, "Negative preference optimization: From catastrophic collapse to effective unlearning." arXiv preprint 2444:22404.0588, 2024. 25
14

---

Appendix
A
Detailed Proof
A.1 Proof of Equation (1)
Proof. We form the following optimization problem for the steepest descent of approximate MU, which is to find the direction d0 = 01+1 6, that drives the objective function F(0) descent fastest within g-neighborhood of the current parameters 0,, and the g-neighborhood is rendered by the manifold metric )):
80 arg min F(0, + 60) s.t. p(o,, + 80) S.
(A1)
80
We introduce a Lagrange multiplier 7 2 to construct the Lagrangian E for this optimization problem:
E(80, n) = F(, + 60) + n(p(0, 0, + -))-
(A2)
Using the Karush-Kuhn-Tuuce (KKT) theorem, we can take the derivative of w.r.l. and set
to zero:
V 5o m) V (0, 60) + 1/V soVopp(,, 02 50) = 0,
(A3)
where 77 depends on & and 0, implicitly. We can rewrite (A3) by variable substitution 0e41 02 + 80
and 1) = 1/0,,5, 0z).
Voc. [(0++1,)) Ver4 ae(5,0,) V ((t,00() O.
(A4)
Thus, the original problem is transformed into an unconstrained optimization problem w.r.t. 0c+1. where the neighborhood size is implicitly given by ag:
o++1 = arg min 1(O+=1) + or(E, 0.) 100,, pl00 Oc+1).
(A5)
A.2 Proof of Proposition
The optimization problem of Prop. is to find the steepest descent direction that minimizes the KL divergence with the retrained output within the vicinity of the current model 0,;
- Ot
0c+1 arg min DKL (p=(0.)lpp.00.+ (0++1)
p0(0,, 0c+1)
(A6)
8.11
1
arg min DKL. (p2r (0.)) (0.+1)) + DKL. (pzr (0.)) (0c41)) + p(00,, 04
Proposition 1. Under the Euclidean manifold metric, p(0,, O(+1) 1110 02-1112. Assuming that the current model 0; = arg ming L (0) + (0; Let H! = c2 (0_: 1 aadd H. (0.) denote the Hessian matrix of the retrained model on the forgetting and the remaining set, respectively. Then, the direction of the steepest gradient descent that minimizes the KL divergence between the output of the current model and the retrained model is approximately:
0 -0, :z (H)) -- (0Ge:))p
+ (0))p")
(A7)
15

---

Proof. We can decompose the original optimization problem into three parts: F(0(+1), R(O++1), and C(0++1).
P arg min DEL (p=(0))ll==0+++)))) + 20 1| - 0c+1ll
B141
/ O(z) pogse))
arg min
logglz (x+1] dz
100 20,110
Oc+1 112
0c+1
20x
/ p(z// ;.) [logp(= - logp(= 0c+1)] dz p(d) (D)
=arg min
9.11
+ / 00)) ;.)) logg(="; 1e (D)
1
110, 11-11
20,
arg min :0.)) [log logp(=?; ( 0c+1)] (DD((D)
0c+1
(.)
log (o0=(();00)1)))
1
11, 01-1
20y
arg min DKI. (p3s (0,
+ Dxi. (par [p.) (0++1))) p"
0.+1
(F((.+1))
(R(O.-1))
10 - 00+1ll
(A8)
20tt
(O(Be+1))
(Part I) First, we solve the forgetting part F(0c+1) by taking the first-order approximation at 0g: F(0++1) F(0.) (F.))) (0:41 0²).
(A9)
We denote VF(0,) = -Ep(() [logp(+(;;0)) [.)] = C(O,), and then expand G(O.) at 0.:
G(O.) = G(O.) + VG(O.) - 0.)
-B l( - -B)()( [o A
- H!
(A10)
where H:- -E((tt 2 log p(=f; [.)] is the Hessian w.r.t. the retrained model 6, at forgetting set, and A, = 0₁ A. the difference between the current model 6g and the retrained model 0.. We cannot directly obtain the parameter difference A, and need to estimate it. Recalling the assumption that 02 = arg ming (0) + L (0;e,) e.) and 0, = arg ming L (0). We can utilize the optimality of 0, on the weighted function to take the derivative w.r.l. O, and set it to zero:
0 (O,) + (0,
(2)) +o + (L((), 0+ (0)) + V (0;;e.).
(A11)
Since 0, minimizes L, (CT 0. By performing the Taylor expansion and dropping of (Aa))
terms, we have
A R - (o.)) [ (L((0;))) = - -.)
(A12)
By plugging (A12) into (A10), we can get
V F(,)) = G(O,) v - H V ((
(A13)
Bringing (A13) into (A9), we can get
F(0++1) v F(O.) - H! vc(
(0.+1 - Oz).
(A14)
16

---

(Part II) Next, we solve the remaining part R(0(+1) with similar pipeline in solving F(0(+1):
R(0+41) R((,)) VR((O)) (0.+1 -O)
.R(O)) Bp(=)(a)) V log ;o";(=";0,)] (0t+1 Oi)
R(Oe)) (0.) (01+1 0c).
(A15)
(Part III) Finally, we derive the constraint C(0(+1) as follows,
C(0++1) =C(0) + (C)))) (0.+1 - 0z) -0())) + 2(0++1 0t)t(01+1 0z).
(A16)
Substituting (A14), (A15), and (A16) to each part in (A8), and take the derivative w.r.t. oe11 of the minimization problem to derive the optimal solution, we have
1 VC(0++1)
0 VF(0++1)p + VR(0++1)p" +
20,
1 -0+11-
H! (-VC' (0)(()pp +
(A17)
at
We thus conclude that
0(41 01 -at (10= +
(A18)
A.3 Proof of Proposition 2
Proposition Using the model output KL divergence on the remaining set the manifold metric, p(0,, 0+41)==)==----)) DxL (p=r P- (0c+1)))) Assuming that the current model 0₂ arg ming (0) L (0) Let â = =app /aap' + 1), and H; = 2 L" (6.) represents the Hessian matrix of the current model the remaining set, then the direction of the steepest gradient descent that minimizes the KL divergence between the oulput of the current model and the retrained model is approximately:
Ou+1 - 02 : -ū.()), (I= (0.se (01;ex))]
(A19)
Proof. Now, the steepest descent optimization problem for approximate MU is as follows:
Mct1 = arg min DKL (0.))) + DKL (p=r (0:)(O0)llpp)) (0.+1)))
Bet1
arg min DEL (p., (0.) ( (0++)))) pf + DKL (p-- (p=) (0++1)))
Oc+1
(F(0e+1))
(R(P
+ at
DKL. (p-- (6.) (0.4)))
(A20)
(C(B++1))
The result of forgetting part F(0++1) is the same as that in the Euclidean distance metric. And the remaining part R((0+1) and the constraint C(0++1) vary due to the output KL divergence metric DEL Note that V VL"(0,-1) R (l,( = VL (fb) ss O. This enables us take the second-order Taylor expansion at 6g for the remaining part and the constraint.
1
R(0++1) R(0,) + VR(0,) (0t+1
(1R(0))T(0(111111 0.)
-1) T V²2 0s)
-
(A21)
2
VR(0,) = - Ep V log x(="; ;,,,]] (L) 00
(A22)
V R2R( = - -.ppp 2 1ogp(>";00)) 0,)] = V2L'(0,) H
(A23)
Substituting (A22) and (A23) into (A21), we can derive the remaining part:
R(0++1) R(O,) (0.4 -,) (8 0,)
(A24)
17

---

As for the constraint, we have
= + VC(O,)) (f-11) - + (0++1 - 0.) (0 0.)
(A25)
2
VC(00) - -Bp(er AV log (===p((=00) =0
(A26)
V2C( = - -pp(=)0)) V22 p(";
; 0.)]
F = Hi = (O,)
(A27)
Substituting (A26)and (A27) into (A25), we get the constraint
C(0++1) 2 ((0+) + (0 0,) HI (0e+1 - 0t). Bringing (A14), (A24), and (A28) into (A20), and take the derivative w.r.t. 02+1 of the minimization problem to derive the optimal solution, we have
(A28)
2
0- = V + V R + VC((++1)
(A29)
1 - HH 02)-
H (H:) (-
VL' (0:; e:) p² + H7(0++1 0x)p"'
+
(A30)
By rearranging the terms, we get
= 0++1 O2 :2 -as -. 11
(A31)
A.4 Proof of Proposition 3
Proposition 3. For implicit Hessian approximation in (5), suppose (AI) 3,, is small, Bg < / V (VL and (A3) there exist (c-neighborhood (( St) of the optimal model parameter 0 arg ming ('(O(),, ) which includes Og and 0/. Then, the iterative update term approximately is
(A2) C p-smooth, i.e., [ VL"
S =| A' 11
0. 0% :
2 ( (0)) VL" = VL))) -V
(A32)
Proof. The objective function of implicit Hessian approximation can be formulated as:
min -r (07) s.t. of = 0, (0,
(A33)
8f
We need to get the optimal parameter Of that minimizes (A33), which means 0 = (C"())) 80
We can
take the Taylor expansion O.,
OL (0T) 00%
(O) = (O. + H - 0.) + (0, - 0.) & (0, - 0.) + o(G))
(A34)
where H.: (0,) and T represent the Hessian matrix and the third-order symmetric tensor on the remaining set, respectively, and @ denotes the Kronecker product.
From (A2) and (A3), we can reduce the first-order term to o(uGt), LVL (0,) VL (e.) (0x) pl10 0el12 S pCL.
(A35)
To simplify the second-order term with (A1), we have
(0) 0,) T & & (0, - -())
=(0! 0,) & T & (0f 0,) + o(G))
-Co O (0) - 0,) + o(E))
3² (0.) + o(ez)
VLL + o(8,) d(ec)
(A36)
Bringing (A35) and (A36) into (A34), we have
(O,) (0, 0,) v (O, (0.) o(b.) + o(E)) + o(ue,) + o(2))
(A37)
Then, we can derive
0 9: = -
(A38)
18

---

B Related Works
B.1 Related Works on Machine Unlearning
Data Forgetting. MU is driven by the imperative to remove the influence of specific data from pre-trained models [2, 3, 18, 64), intrinsically linked differential privacy [18, 64, 65, 15, 66], which aims to enhance the privacy protection of training data. Exact MU, which is approached from parameter probability perspective, has been thoroughly explored within convex optimization problems and linear models [18, 15, 39, 67, 16]. These studies have established methods allowing specified privacy budget, thus significantly reducing the risk of privacy attacks [68-72]. However, in deep learning models, exact data forgetting typically requires retraining from scratch [1]. a process whose computational intensity makes it impractical for routine application. This challenge underscores an urgent need for developing more efficient unlearning techniques that do not compromise the model's 's utility.
models forget data exactly while adhering
Gradient-based Approximate Machine Unlearning. To enhance data forgetting efficiency, research has honed in on aligning the forgetting objective with the model's output probability distribution,
termed approximate MU [3, 21j. Numerous studies [22, 19, 38, 20, 21, 23, 26, 73] have developed specialized loss functions prompt the model expunge specific data, aiming mitigate the risks of privacy breaches such as membership inference [74, 68-72] and data reconstruction attacks [75, 76]. Echoing the phenomenon of catastrophic forgetting observed in continual learning [77-79], training on forgetting data has precipitated significant declines in overall performance on remaining data. Various strategies [26, 24, 25] have emerged to uphold the model's original generalization capabilities, predominantly through fine-tumi tuning the remaining set. Our approach provides comprehensive analysis of iterative strategies employed in gradient-
approximate MU methods and introduces curvature information from the remaining set to better preserve the model's generalization capabilities.
Machine Unlearning for Generative Models. Recent advancements in text-conditional image generation models have demonstrated remarkable capability in producing images that accurately reflect textual descriptions [40, 42, 41, 58], Despite these achievements, extensive research [6, 12, 80] has underscored significant security and privacy concerns associated with these technologies. The mechanisms underlying these issues are not yet fully understood. In response, there is critical demand for the development of MU methods to bolster the trustworthiness of these models, facilitating their wider adoption. While pioneering studies [12, 14. 11, 13] have begun to address concept deletion within diffusion models, the dual objectives of maintaining generalization and ensuring efficient data forgetting continue to pose significant challenges.
B.2 Related Works on Steepest Descent in Optimization
Steepest Descent and Natural Gradient. Steepest Descent [81, 29, 27, 30, 82] is one of the founda- tional algorithms in optimization, particularly in the context of machine learning and neural networks. Despite its simplicity and widespread use, Steepest Descent can suffer from slow convergence, especially in ill-conditioned problems where the objective function's 's curvature varies significantly across different dimensions [29]. Natural Gradient [83, 30, 84] is proposed as an enhancement of the standard gradient descent that addresses some of its limitations by considering the underlying geometry of the parameter space. Natural Gradient employs the Fisher Information Matrix to scale the gradient adaptively, leading to more efficient optimization. Natural Gradient has been shown to significantly accelerate convergence and improve optimization performance in various applications, including deep learning [30,27 27] and continual learning [28]. We get inspiration from these techniques and try improve MU update direction with preserved set curvature information.
Hessian Approximation. Computing the exact Hessian matrix is often impractical for large-scale problems due to its computational and memory requirements. To address this, various Hessian Approximation methods have been developed. Notable approaches include Diagonal and Low-rank Approximations [34, 85, 86). Stochastic Approximation [87-89], and Quasi-Newton Methods [90, 91]. [50] reveals that the regularization- based method an explicit approximation of the Hessian, while the meta-learning method is an implicit estimation of it. By leveraging second-order information in computationally feasible manner, these techniques strike balance between accuracy and efficiency, facilitating the optimization of large-scale problems.
19

---

B.3 Preliminary on Diffusion Model
Conditional Diffusion Models and Classifier-free guidance. Diffusion models [40] have gained prominence in the field of generative modeling, particularly for their effectiveness in generating high-quality images. sample zT sampled from a Gaussian distribution and gradually denoised for T time steps, finally recovering clean sample zo- Conditional Diffusion Model [40] is variant that conditions the generation process on additional information e such as class labels, text descriptions, or other modalities. In practice, the conditional diffusion model is trained to predict the noise (o(xz]e) to form the denoising process (0 [t; where zy is noisy version of the input z. The corresponding objective of the conditional diffusion model is typically formulated as:
MSE (0; x c) = (1,,))((001)) [l|= e (=(alc)))
(A39)
In this setting, classifier-free guidance [41] is proposed to encourage the sampling procedure to find x with high log p(c|z)) Then diffusion process given by én (ate le) = (1 - w: w)ee (2t, (0) + weo((r where éØ (x((/c)) represents the noise estimation obtained by the conditional diffusion model given e, w E [o, 1] is the guidance weight, 0 denotes the 'null' condition. The generation process initiates with Gaussian noise ãं (O, 1) and repeats denoising the data by éo (c) to obtain 1;-1 until = 0, producing the authentic data conditioned on c.
with uniformly sampled from . T)
Latent Diffusion Models. Direct training of conditional diffusion models in high-resolution pixel space is often computationally prohibitive. Latent diffusion models (LDMs) [42, 58] address this challenge with an image compression approach. Specifically, an autoencoder is trained using perceptual loss and patch-based adversarial objective to master the process of perceptual image compression. The input images can be embedded into smaller latent representations with the learned encoder E. The trained autoencoder facilitates the transition to a low-dimensional latent space where the diffusion model is more efficiently trained on the representations on high-resolution images æ. Authentic images can then be generated by sampling a representation from the diffusion model and subsequently reconstructed into an image with the learned decoder x (z).
F(x)) rather than
C Algorithm
We present the algorithm of proposed SFR-on in Alg. A1. In steps 3-4, we first calculate the forget-remain balanced weight saliency mask. In steps 6-8, we compute the adaptive coefficients to weight the forgetting gradient ascent, followed by one step of forgetting update within the inner loop. In steps 9-13, we fine-tune the model on the remaining set. In step 14, we perform the slow weight update for the model in the outer loop.
D Evaluation Metrics
D.1 Evaluation Metrics for Image Classification
Forgetting accuracy (FA): FA is the accuracy of the unlearned model on the forgetting dataset Df. A favorable approximate MU method should reduce the disparity of FA with the retrained model.
Remaining accuracy (RA): RA is the accuracy of the unleamed model on the remaining dataset 'D". A favorable approximute MU method should reduce the disparity of RA with the retrained model.
Testing accuracy (TA): TA is the accuracy of the unlearned model on the testing dataset DD D' in random subset forgetting is sampled from the same distribution as the remaining dataset, while in class-wise forgetting D' excludes the samples from the forgetting class. A favorable approximate MU method should reduce the disparity of TA with the retrained model.
Membership inference attack success rate on DF (MIA): Following [33], we use prediction entropy- membership inference attack to evaluate the privacy preservation of the unlearned model. We first need to train an adversarial classifier to predict whether or not a particular example was contained the training dataset. The prediction of the remaining dataset and the testing dataset by the unlearned model is collected to compute the label-agnostic prediction entropy for the attack classifier training- Specifically, a Logistic Regression classifier is trained on the remaining prediction entropy labeled as 'I' and the testing prediction entropy labeled '0', Then, this attack classifier is
20

---

Algorithm A1 The Algorithm of Proposed SFR-on
Forgetting set D/, remaining set D", pre-trained model weights 0, outer loop learning rate a, inner loop iteration number Iin outer loop iteration number Tou, initial inner loop learning rate for forgetting 35, initial inner loop learning rate for remaining 8", temperature scalar weight saliency mask threshold y Initialize: Bu-
Input:
2:
3: Compute ding ding by (10).
4: Compute weight saliency mask by I[ diag (Fline) (io 7/.
5: for t = 1 to Tuu do
6: Sample forgetting sample batch B from DJ
7: Compute adaptive coefficients εạ-1 by (9).
of = 0, 31 VL' (0.-1;E1-1
8:
86 -
9:
10:
for 1' to Tin do
11:
Sample remaining sample batch BE from D
12: 0r. = 0g 13" 2 L (0%-1)
13: end for
O: = 0,-1 a00,-1 Ofr
15: end for
applied to the forgetting prediction entropy to predict the membership of these forgetting samples. The success rate of membership inference attack on Df is quantified by the true positive rate predicted by our classifier, MIA TP/N1, where TP represents the count of forgetting samples still identified as training samples and N is the size of the forgetting dataset. Due to the limitations of the membership inference attack, the attack based on a linear classifier is weak and fails distinguish all forgetting samples predicted by the retrained model as test samples. The more advanced shadow model- based sample-wise attack too time-consuning to evaluate the MU method. Therefore, we only regard MIA as readout function of the forgetting effect and advocate for the development of more precise and efficient membership inference attack techniques to enhance MU method evaluation. Note that favorable approximate MU method also should reduce the disparity of MIA with the retrained model.
Output KL divergence with the retrained model (DKL): Given that impractical to traverse all sample spaces, we actually calculate the empirical output KL divergence with RT 0.. We first collect the predicted class probabilities from both the unlearned and retrained models across the remaining and forgetting datasets. Then, we empirically compute the output KL divergence as follows:
p(zffc:0.) 0.)
DKL N'+NT
ΣΣ iED eEC
plzf 02) log
+
Epllseer 0x) log p( Ow)
p( Ow)
JEDI CEC
(A40)
where C denotes the set of the prediction classes, 0, is the unlearned model parameter, and = and z/,- represent the i-th remaining sample posterior of the class c and the j-th forgetting sample posterior of the class c, respectively. Note that even the output KL divergence between retrained models is not zero due to the randomness of the training algorithm. A favorable approximate MU method is hoped display as low output KL divergence with RT as possible.
Run-time Kun-time efficiency (RTE): This measures the computation efficiency of an MU method. We record RTE in minutes. MU methods are more efficient the lower their RTE are. Clearly, RT is not an efficient MU method.
D.2 Evaluation Metrics for Image Generation
Forgetting accuracy (FA): We additionally train models to classify images generated by the unlearned generative model. For CIFAR-10 10, following [35], we use ResNet-34 from torchvision pre-trained on ImageNet and fine-tune it on CIFAR-10 for 20 epochs. For ImageNet, we directly use pre-trained ViT-L [92] from torchvision as the classifier. We compute the classification accuracy
21

---

of 500 images generated by the unlearned model on each forgetting category as FA. A favorable approximate MU method is hoped exhibit as low FA as possible.
Fréchet Inception Distance (FID): We evaluate the remaining image fidelity of the unlearned model by assessing the standard image generation metries FID. The model performed class-wise forgetring of CIFAR-10 generates 1000 images for each remaining class for FID. We sample 10000 images from the unlearned DiT ImageNet by randomly selecting the remaining classes to calculate FID. favorable approximate MU method is expected to achieve as high FID as possible.
E
Implementation Details
E.1 Baselines
MU methods for image classification:
FT [22, 19, 38]: It fine-tunes the pre-trained model only on the remaining dataset to obtain the unlearned model. The code source is attps://githii http://gtttuuu..m///..tea. Cow/OPTML-GGOOO Unlearn-Span Sparss.
. GA [20, 21]: It conducts gradient ascent for the pre-trained model only on the forget- ting dataset obtain the unlearned model. The code source https://githut com/ (TTML-Group/UUl Prrrou/UnneeannSSSS earn Sparse.
RL [20]: It replaces the forgotten set label with a random label that is not the same as the original label. Then, the modified forgetting set and the retained set are combined for fine-tuning the pre-trained model with the cross-entropy loss. The code source is https:/ //github..b
tituub..... www. /ttp///PTMOoou//////// GarGrrrrru//unaannne /wn//nnnlnnnnaneeeae
SalUn [26]: It first obtained the top-k% large salient weight mask sorted by the absolute value of parameter gradient to the forgetting set loss. The pre-trained model is then fine- tuned using the same pipeline for RL, and the gradient is modified using the weight saliency mask so that only the top-k% significant parameters are optimized. The code source is https: / //gi thub.
/unn/nnnnn Unlearn- Saltrn--Saiieen iency.
BT [23]: It stores pre-trained and randomly initialized models as competent and incompetent teachers, respectively. The unlearned model is acquired by minimizing the output KI. divergence of the pre-trained model with the incompetent teacher on the forgetting set and with the competent teacher on the remaining set. The code source is https:/ / thub. com/vikun wwwivviiiooo/bbaaaa hetp:000bbbbd--eachhia..ee -eaa--aannn----leennnnnng
SCRUB [25]: It only saves the pre-trained model as the teacher model. Then, it optimizes the pre-traie pre-trained model minimize the KL divergence with the teacher on the remaining set and maximize the KL divergence with the teacher on the forgetting set. The cross-entrops loss of the remaining set added further maintain the performance. The code source https: // gi thub. com homm/meghdadk, /SCRUB.
MU methods for image generation:
SA [35]: It needs to generate replaying remaining samples using pre-trained models in advance and calculate fisher diagonal on the replaying remaining samples for modulating parameter regularization terms. Its unlearning loss is composed of three components: the MSE loss to make the output generated by the pre-trained model for forgetting classes or concepts close to random noise, the generative model MSE loss optimized on the replaying remaining samples, and a parameter regularization term to maintain the pre-trained model parameters with second-order curvature modulation of Fisher diagonal. The code source is https://g/ thub..uu.... com/ cww.rrrerrrreeerreeeeeeeeee mitarr-uss htte///elettiiie amnesia.
ESD [11]: It saves a frozen SD as copy. The SD model is then optimized so as to push the condition score for the erasing concept far away from the corresponding condition score generated by the frozen SD, and align with the unconditioned score generated by the copy. The code source is https: /ttgt/gttttb///////////// com hooo///ohtgaanikktta
wowpiiiattaae..e..n....a erasing.
22

---

Table A1: Summary of hyperparameters for each method on unlearning 10% random subset of CIFAR-10 in
Tab. 2. 'Ir' short for learning
Methods
Hyperparameters
Pretrain RT
epoch 200, cosine scheduler, Ir 0.1
epoch 200, cosine scheduler, = 0.1
FT
epoch = 10, cosine scheduler, Ir = 10 10-2
GA
epoch = 15, constant scheduler, Ir = 3 10-4
RL
epoch 10, cosine scheduler, Ir
x 10-3
SalUn
epoch = 10, cosine scheduler, Ir = 3 x 10 10-4, threshold = top-20%
BT
epoch 10, cosine scheduler, Ir 3 x 10-3, temperature scalar 1.0
SCRUB
epoch 10, constant scheduler, Ir 3 10 temperature scalar 4.0, 0.001
on
Tou 1500, cosine scheduler, a 1.0, Ti 5, 3 0.25, 0.01, 0.5,
Table A2: Summary of hyperparameters for each method unlearning 10% random subset of TinyImageNNet in Tab. 2. 'Ir' short for learning rate.
Methods
Hyperparameters
Pretrain RT
epoch 10, cosine scheduler, Ir 10-4
epoch = 10, cosine scheduler, = 10-1
FT
epoch = I, cosine scheduler, Ir === 10
GA
epoch constant scheduler, Ir 3 x 10
RI
epoch = cosine scheduler, Ir = 10-4
SalUn
epoch I, cosine scheduler, Ir 10-4 threshold top-50%
BT
epoch = 1, cosine scheduler, Ir = 10 temperature scalar = 1.0
SCRUB
epoch 1, constant scheduler, Ir 10-4 temperature scalar 4.0, 0.001
SFR-on
Tou 500, cosine scheduler, a 1.0, Ti 1, B 3" x 10 5, 0.6,
E.2
Training Details for Image Classification
For CIFAR-10, CIFAR-100, and SVHN using ResNet-18. all methods use the SGD optimizer with momentum of 0.9, weight decay of 5 x 10-1, and batch size of 128. Our SFR-on train 1500 steps with the constant outer loop learning rate of
1.0, inner loop iteration number Tin = SFR-on search inner loop learning rate for forgetting in range (..) and for remaining in range [10-3 10-2), temperature scalar À in range [0.0, 2.0]. and threshold y in list [0.3, 1.0, 3.0, 10.0). Experiments are on RTX 4090. A summary of the hyperparameters for each method is shown in Tab. A1.
For ImageNe,, Swin-T is initialized from torchvision weight pre- treitrained on ImageNet. All methods use the AdamW W optimizer [93] with weight decay of 0.05 and batch size of 128. Our SFR-on train 500 steps with the constant outer loop learning rate a 1.0. inner loop iteration number Tin = 1. SFR-on search inner loop learning rate for forgetting in range [0.001, 0.1] and for remaining in range [10-5, 10-"), temperature scalar À in range (0.0, 2.0), and threshold y list [0.3, 1.0, 3.0, 10.0). Experiments are run on 1 RTX 4090. A summary of the hyperparameters for each method is shown in Tab. A2.
E.3 Training Details for Image Generation
For CIFAR-10, following [35], we use DDPM based on U-Net architecture with 1000 timesteps for linear 3 schedule. All methods use Adam optimizer with a constant learning rate of 10 and batch size of 128. Pretrain and RT train for 800K steps. SA generates 5000 images the remaining set for replaying and calculating the Fisher diagonal, and trains for 20K steps with X 10 for the regularization term. SalUn obtains top-50% salient weight mask and trains for 1K steps with = 10-3 to balance the optimization of forgetting and remaining. Our SFR-on trains for 50 steps
'nttps://githur httec/hhhbooomeeeeeeeoooeeeeeeee emmongooup/dddin
23

---

0.30
96
85
0.25
04
0.20
92
92
75-
0.15
0.5
0.0
Figure A1: Performance of SFR-on with different in adaptive coefficients es RT on CIFAR-10 10 using ResNet- 18. The settings and metrics follow Tab.2. The points closer RT and with lower DXL are better.
0.4
80
85
99.8
94
K5
Figure A2: Performance of SFR-on with different in weight saliency mask us RT on CIFAR-10 using ResNet-
18. The settings and metrics follow Tab.2. The points closer RT and with lower DxL. better.
with Ti = 1, = 1.0, = 10 gr= 3 = 10-1, A = 0.5, = 3. Experiments are run on 2 RIX 4090s.
For ImageNet, we use pre-trained DiT-XL/22 with 256 x 256 resolution. All methods use AdamW optimizer with constant learning rate of 10-4 and batch size of 1. SA calculates the Fisher diagonal on randomly sampled 2000 remaining data, and trains for 10K steps with À = 10 for the regularization term. SalUn obtains top-50% salient weight mask and trains for 10K steps with = 10 3 to balance the optimization of forgetting and remaining. Our SFR-on trains for 500 steps with Ti 1, a 1.0, 3 10-7, ,r 10-1 7 3. Since the batch size is ignore À in adaptive coefficients. Experiments are run on RTX 4090.
E.4 Training Details for Concept Forgetting
For concept forgetting of 'nudity', following [26], we use SD V1.4 to generate 1K images with the prompt 'a photo of nude person' the forgetting and additional 1K images with the prompt 'a photo of a person wearing clothes' as the remaining set. All methods use Adam optimizer with a constant learning rate of 10-5 and batch size of 1. ESD trains for 1K steps with negative guidance of 1.0. SalUn trains for 1K steps with 50% sparsity weight saliency and = 0.1. Our SFR-on trains for Since the batch size is 1, we ignore in adaptive coefficients. Experiments are run on RTX 4090.
200 steps with Tin 1, 1.0, 3f 10 3" 10 5 7
F
Additional Experimental Results
F.
Ablation Study on Temperature Scalar À and Threshold 7
In our SFR-on method, we investigate the impact of two key hyperparameters, temperature scalar À for adaptive coefficients and threshold yy for the weight saliency mask, on the unlearning performance in image classification. We vary À within the range [0, 1] and within (0, 2). The results in Fig. Al and A2 indicate that increasing and enhances model retention capabilities, but it could adversely affect both the forgetting performance and privacy protection. Therefore, we select the hyperparameters for our method based on the goal of minimizing the output KL divergence from Retrain, aligning with the objectives of approximate MU.
24

---

Table A3: MU performance for unlearning 50% random subset of CIFAR-10 using ResNet-18. The content
format follows Tab. 2.
Methods
CIFAR-10 Random Subset Forgetting (50%)
FA
RA
TA
MIA
|Avg.D Der 4| RTE
RT
333,66 (0.00)
100.0040.00 (0.00)
93.11 13.11 (0.00)
69.022a0.0a (0.00)
0.00
0.10
138.95
FT
99.96 (6.59)
100.00.0.00
(0.00)
94.37.0 (1.46)
68, 68.97
(19.95)
7.00
0.44
6.63
GA
97.2640.25
97.25.0.25 (2.75)
90.4840.20 (2,63)
82 82.8020.co (13.77)
5.76
0.42
2.43
RL
MM.. (5.67)
26.00.3 (0.95)
23.70 (0.68)
71.87a0.01 (2.85)
2.54
0.55
5.15
SalUn
99. 12ec.14 (6.06)
99 39.36.0.. (0.62)
94 91.25520.s (1.14)
70,35:20.1 (1.32)
2.29
0.55
7.24
BT
90.401c.11 (6.04)
00.08.0.31 (0.62)
94.24,0.44 (1.13)
72.4810:30 (3.46)
2.81
0.54
SCRUB
34.65_14c1 (8.73)
15 (14.44)
81.71gn sa (11.41)
64.03g0.1 (5.31)
9.97
SFR-on
93.50ec.3a (0.13) 97. 07.4220.32 (2.58)
21.12a0.: (1.99)
68.3139.01 (0.71)
1.35
0.18
3.57
Table A4: MU performance for unlearning 10% random subset of CIFAR-100 using ResNet-18. The content format follows Tab. 2.
Methods
FA
CIFAR-100 100 Random Subset Forgetting (10%)
TA
MIA
|vg..D J | RTE
RT
77. 77.06g (0.00)
99.98 (0.00)
77. 77.2320.30 (0:00)
41.79 (0.00)
0.00
0.35
84:21
83.99 (6.04)
98.84_0.s (1. 15)
20.28 95)
00.32220.0
7.07
0.66
4.87
GA
70.57 (7.38)
a1. (28.45)
51.48 uas (25.75)
12.3910au (0.60)
15.55
1.43
0.73
RI.
99 99.391c.0s (21.44)
90.96_001
(0.02)
72.0220:1 (4.61)
44 64.0810..0 (2.89)
7.24
1.01
4.81
SalUn
99. 1s. (21.47)
99.96
73.05 (1.19)
45.25 18.28 (3,49)
BT
99.63344 or (21.68)
09.97-0000
(0.01)
73.28 (3.95)
45.25.30.0 (3.46)
7.28
1.00
6.39
SCRUB
90.3224..23 (12.36)
90.11-0.14 (0.87)
78.1940.20 (0:95)
43.38,20.0 (1.60)
3.95
0.61
4.04
SFR-on
17.822a75 (0.14)
90.77=002 (0:22)
24.76 (2.47)
47.5740.00 (5.78)
5.41
F.2 Additional Results for Image Classification
We conducted experiments to assess the performance of unlearning a 50% random subset of CIFAR- 10 and a 10% random subset on two additional datasets, CIFAR-100 and SVHN, The results in Tab. A3, A4, and A5 demonstrate that our SFR-on method consistently achieves the closest average metric disparity and the smallest KL divergence relative Retrain across all three scenarios. These findings emphasize the broad unlearning efficacy of our approach.
F33 Results for Natural Language Processing
The input modality of the model does not constrain our analysis or methods. Therefore, our method can seamlessly extend to other modalities beyond images, such as natural language processing using large language models (LLMs), to achieve efficient forgetting. We conduct experiments using the recently proposed benchmark of TOFU [94] fine-tuned Phi- 1.5 [95] to evaluate the effectiveness of our method in the LLM unlearning task, compared with four LLM unlearning baselines: gradient descent(GA), gradient differenceeGradDiff [96]), negative preference optimization(NPOO [97]), and its enhanced version. The TOFU dataset comprises fictional author biographies, along with questions and answers related to the authors' attributes, which helps assess methods of data forgetting on fine-tuned LLMs.
As shown in Tab. A6, our method achieves superior forgetting quality, making the unlearned model almost indistinguishable from the retrained model based on the Truth Ratio distribution of the forget set. Additionally, method efficiently preserves model utility.
F.4 Ablation Study on SFR-on without Repairing
We conduct ablation experiments to assess the performance of our 'Sample-wise Adaptive Coefficient for Gradient Ascent (F)' and Foorget-Remain Balanced Weight Saliency (S)' in the absence of repairing with the remaining set. The results in Tab. A7 affirm that these components, when used independently, can still enhance baseline performance.
F.5 Results for Removing Influence of A Single Data Point
Our method can be directly applied to the task of forgetting single data point without additional adaptation, as we impose no assumptions to constrain the size of the forgetting set. We conduct experiments under two setups to validate the effectiveness of our method in unlearning either single
25

---

Table A5: MU performance for unlearning 10% random subset of SVHN using ResNet-18. The content format follows Tab.
SVIN Random Subaet Forgetting (10%)
Methods
RA
TA
MIA
Avg.. 1 Dx.
RT
00.05 (0.00) 00.82+001 (0.00)
96.53+0.10 (0.00)
29.47=000 (0.00)
0.00
0.10
138.95
a4 (2.69) 99.61 1ooz (0.21) 10.31 (0.14) 81.88 $1.88_uo u..0 (2.41)
1.36
0.13
6.37
GA
99. 99.44eaos (3.39) 09. 99.50+aos (0.32) 96.37 36.372 (0.16) 78. 63=0.0 (0.84)
1.18
0.19
0.71
00.45 (3.40) 20.400 (0.41) 13:0.00 (0.40) =0.00 (2.16)
1.59
SalUm
99. 22.422201 (3.38) 99. 01 (0.42) 96. 12:0.00 (0.41) 78. 00000 (1.15)
1.34
0.24
10.89
19.e (3,42) 130 (0.39)
18.0 (0.36) 78.47 (1.00)
1.29
SCRUB
99.152 (3.10) 99.4b20s2 (0.37) 96. 11 (0.43)
79 29 (0.23)
1.03
0.15
5.91
16 (0.79) 97 (2.18) 35 (0.76) 79.43ga.c (0.04)
0.94
Table A6: Unlearning performance of our method and three LLM unlearning baselines on forgetting 5% of authors or one author under the TOFU fine-tuned Phi-1.5 benchmark. 'Forget Quality' measures the Test value of the Truth Ratio between the unlearned model and the retrained model after the target information removed. 'Model Utility' evaluates the general performance retained by the unlearned model. RTE recorded minutes.
Random Subset Forgetting (5%
Random One Author Forgetting Forget Quality Model Utility t
Methods
Forget Quality ?| Model Utihty
0.4984
34.84
0.5000
35.60
0,0297
0,2946
4.79
0.9499
0.4783
GrudDiff
0.3281
0.3840
5.57
0,9999
0.4957
1.15
NPO
0.17799
0.3653
4.93
0.9724
0.4814
1.42
NPO-GradDiff
0.5452
0.4085
5.72
0.9999
0.4923
SFR-on
0.6284
0.4313
3.33
0.9999
0.4999
1.01
data point or a task with suitable granularity: (1) randomly forgetting one sample in the classification task on CIFAR-10 and (2) forgetting the relevant information of one author in TOFU benchmark.
The results in Tab. A8 and A6 indicate that, under these two settings, our method and all baselines achieve effective forgetting while fully retaining general performance.
F.6 Verification for Approximation in Practical implementations
Given that the approximation in the theoretical analysis may not hold in practical implementation, verifying the approximation of the formula in the actual operation necessary. In the proofs of Prop. and 2, considering the approximations of V (0o). VLT(O.). and V V((O),, we demonstrate Fig. A3 their gradient norms under practical unlearning settings, which are consistent with our theoretical assumptions. In method, VL (Bu) = (L"((.) V v(().) z O, allowing to incorporate second-order information on the retain set.
E. Additional Results for Image Generation
The additional results of class-wise forgetting across all CIFAR-10 classes are presented in Fig. A4, A5, and A6. Our method successfully removes the semantics of the target classes without reducing the forgetting images low-quality noise. Additionally, SFR-on maintains the generation fidelity of the remaining categories.
Fig. A7 and A8 display the additional outcomes of class-wise forgetting ImageNet using DiT by our SFR-on method. The diagonal images within these figures depict the targeted forgetting classes, demonstrating the unlearning efficacy our method. Conversely, the images off the diagonal represent various non-forgetting categories, showcasing the unlearned DiT's generalization capability preserved across extensive class conditions.
G Broader Impacts and Limitations
Broader Impacts. SFR-on can enhance trustworthy deep learning and broadly applicable across various scenarios, aligning machine learning applications with ethical human standards. SFR-on can potentially increase the fairness machine learning systems, mitigate biases against minority groups, and promote equitable decision- processes. Moreover, SFR-on bolsters privacy protections
26

---

Table A7: Performance of GA, our SFR-on, and ablations without using the remaining dataset, assessing unlearning 10% random subset of CIFAR-10 using ResNet-18.
CHEAR-10 10 Random Subwet Forgetting (10%)
Methods
Avg.D J DxL ||TE
GA
93.91 1.5 (1.71) 93.76 (6.24) 87.000.144 (8.34) 17.19.0.0 (2.35)
4.66
0.36
0.79
$
on
96 m6.5 (0,90) 96.48
(4.52) 89 62:azz (5.72) 76.21 (1.37)
3.13
0.29
0.80
07.03-0.35 (1.41) 96.90 (3.05)
90 (5.35) 82.18 (7:34)
4.29
0.31
96.07-0.10 (1.05) 06.7820.01 (3.22) 90.80ga00 (4.54) 14.16 (0.68)
2.37
0.26
1.03
96.58_a.77 (0.96) 99.88 (0.12) 94.19 (1.15) 72.26.0..0
Table A8: ResNet-18.
Performance our method and four baselines unlearning one sample on CIFAR-10 using
Methods
RA
Sample Forgetting MIA
[Avg [| Pa.
RTB
KT'
100.00go
(0.00)
100.000 (3.00)
95.00gn. (0:00)
g.000 (000))
0.0000
0.0001
76.92
FT
100.00gamm
(0.00)
100.
a0.0 (3.00)
95. F. (0.06)
a.00 (0.00)
0.0142
0.0006
0.38
GA
100 20 (0.00)
100. 00 (0.00)
95. 26 (0.22)
0.00gam (0.00)
0,055
0.0033
0.05
Sall
100.00saae
100 100.000aaar
(0.06)
0.100zuua (0.0))
0,0154
0.0002
0.12
SCRUB
100.00gww
100.00.aww (0.00)
96.64gnue (0.11)
0.00) (0000)
0.0002
100.00,aam (0.00) 100.000...s (0.00) 06.60_ (0.07) g0000 (000))
within deep models and fortifies the security of these systems against potential privacy attacks. When deployed on public networks, our approach facilitates the continuous update of knowledge, enabling models to catch new developments without losing performance. In the case of generative models, implementing SFR-on on reduces the likelihood of generating improper content and limits the possibility of infringing intellectual property rights. This helps enhance public confidence in machine learning technologies and encourages their broader acceptance and use.
Limitations. We acknowledge the limitations of our study and encourage further exploration. While the theoretical framework of SFR-on accommodates various input modalities, this paper does not extend evaluations to include language models or graph neural networks. Consequently, we cannot ascertain the direct applicability of our method these modalities without adaptation. Furthermore, the absence of an asymptotic analysis for the steepest descent in machine unlearning hinders our ability determine the disparity between our approximation method and the optimal direction, which is crucial for refining the approach. We advocate for rescarch to address these gaps in the future.
60
Pretrain
Retrain
50
SFR-on
Joint
40
Gradient Norm
30
www wwln w A
20
10
0
0
250
500
750
1000
1250
1500
1750
step
Figure A3: Gradients norm of Pretrain (V (06)). Retrain (V.) Joint (VR(0.) in the proof of Prop. 1), and SFR-on (VR(O)) in the proof of Prop. 2), evaluating forgetting 10% random subset of CIFAR-10 using ResNet18.
27

---

(a) Forgetting 'Airplane"
(b) Forgetting 'Car"
(c) Forgetting 'Bird'
(d) Forgetting 'Cat'
Figure A4: More class-wise unlearning results on classifier-free guidance DDPM on CIFAR-10. The forgetting class is marked with red color. (More results will be shown in Fig. A5 and Fig. A6)
28

---

(a) Forgetting 'Derr'
(b) Forgetting 'Dog'
(c) Forgetting 'Frog'
(d) Forgetting 'Horse"
Figure AS; More class-wise unlearning results on classifier-free guidance DDPM on CIFAR-10. The forgetting class is marked with red color (Extended results from Fig. A4).
29

---

(a) Forgetting 'Ship'
(b) Forgetting 'Truch'
Figure A6: More class-wise unlearning results on classifier-fres free guidance DDPM on CIFAR-IO. The forgetting class is marked with red color (Extended results from Fig. A4).
Unlearned
Prompt class
Golden retriever
class
Cacatua galerita
Siberian husky
Loggerhead
Space shuttle
Cacatua galerita
Golden retriever
Siberian husky
Loggerhead
Space shuttle
Figure A7: Additional results of generated images using SFR-on. From the rows below, diagonal images represent the forgetting class, while non-diagonal images represent the remaining class, (More results will be shown in Fig. A8)
30

---

Unlearned class
Prompt class Giant panda
Lion
Red panda
Cliff
Balloon
Lion
Red panda
Giant panda
Cliff
Balloon
Figure Additional results generated images using SFR-on. From rows below, diagonal images represent the forgetting class, while non-diagonal images represent the remaining class. (Extended results from Fig. A7)
31

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We briefly describe the scope and contributions of this paper in the abstract, detail the areas of focus in the introduction, and list the main contributions at the end of the introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations of our work in Appendix G.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-specfiiatiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
32

---

Answer: [Yes]
Justification: All formulas appearing in this paper are reasonably numbered and cross- referenced. We all clarify the theory assumptions in detail and provide complete proof in Appendix A.
Guidelines:
The answer NA means that the paper does not include theoretical results, All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We provide the experimental setup, training details, and hyperparameters in Appendix ensure reproducibility.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g.. in the of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
33

---

5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification:
The code is provided in supplemental material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nipp cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https:
/ //nips. cc/public//aeeccecccccccc.ccecct
mablic/ggiies... wwwgguuies///// Cotee//oomuumiii sereeuubmsssiion. seiiisosisiycyy for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We provide detailed experimental setup, training details, and hyperparameters in Appendix E.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: This paper provides the mean and variance for most of the experiments on image classification. However, due to the limitation of computing resources, most experiments on image generation have only been carried out once, which may not guarantee the statistically significant results of these experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
34

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The computational resources used in the experiments are indicated in Ap- pendix and the computational time overhead is given.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https http:///eeuuu..eeeee http:/pp.......bbllccccteetttaaa
Answer: [Yes]
Justification:
Our submission preserves anonymity.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g.. if there special consid- eration due to laws or regulations in their jurisdiction..
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the broader impacts in Appendix G.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
35

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification:
We have safeguarded the potentially unsafe images appearing in the paper.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All original papers and codebases are appropriately cited in this paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URI.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
36

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
37

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
38


Reviews:
[{"review_id": "omK83RhItH", "reviewer": "Reviewer_HvBU", "summary": "This work introduces a perspective to unify previous machine unlearning approaches by decomposing the gradient descent direction into three components including forgetting gradient ascent, remaining gradient descent, and weight saliency matrix. The steepest descent direction is derived on the remain-preserved manifold, and a fast-slow weight method is proposed to implicitly approximate online Hessian-modulated salient forgetting updates.", "questions": "Is the proposed method available for models in other modalities, apart from images? Including experiments on other modalities such as large language models could further broaden the scope of this work.", "limitations": "Please refer to the \"Weaknesses\" and \"Questions\" sections.", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is well-written and well-structured. Each proposition is thoroughly proven in the appendix, and the preliminary section provides a detailed overview of the topic.\n\n2. Experiments are comprehensive and encompass the most common settings in image classification and generation tasks. Additionally, the consideration of large pretrained models such as Stable Diffusion caters to practical scenarios.", "weaknesses": "I am not familiar with the concept of machine unlearning. It seems like this work is rigorous and comprehensive. From my perspective, there are no obvious weaknesses.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive feedback and valuable comments on our presentation and extensive experiments. In Appendix B, we have included **Related Works** to help readers understand the concept of Machine Unlearning and to introduce some previous unlearning methods. **The relevant Tab.R1 is included in the attached rebuttal PDF**. Below, we address your request to add experiments on large language models (LLMs):\n\n**Q**: Adding experiments on more modalities such as LLMs. \n\n> As stated in Sec.4, our analysis and method are not limited by the model input modality. Therefore, **our method can be seamlessly extended to other modalities beyond images**, such as LLMs, to achieve efficient forgetting.\n> \n> We conduct experiments using the recently proposed benchmark of TOFU[1] fine-tuned Phi-1.5[2] to evaluate the effectiveness of our method in the LLM unlearning task, compared with four LLM unlearning baselines: gradient descent(GA), gradient difference(GradDiff[3]), negative preference optimization(NPO[4]), and its enhanced version. The TOFU dataset comprises fictional author biographies, along with questions and answers related to the authors' attributes, which helps assess methods of data forgetting on fine-tuned LLMs.\n>\n>  As shown in Tab.R1, our method achieves superior forgetting quality, making the unlearned model most indistinguishable from the retrained model based on the Truth Ratio distribution of the forget set. Additionally, our method efficiently maintains the model utility.\n> \n> We greatly appreciate your suggestion to include experiments on modalities beyond images. We will incorporate this experiment and details of the LLM unlearning task in our Appendix to broaden the scope of our work.\n\n\n**Reference**: \n> [1] Maini, Pratyush et al. “TOFU: A Task of Fictitious Unlearning for LLMs.” ArXiv. 2024.\n>\n> [2] Li, Yuan-Fang et al. “Textbooks Are All You Need II: phi-1.5 technical report.” ArXiv. 2023.\n>\n> [3] Liu, B. et al. “Continual Learning and Private Unlearning.” ArXiv. 2022.\n>\n> [4] Zhang, Ruiqi et al. “Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning.” ArXiv. 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xCsghoQwEa", "reviewer": "Reviewer_fu6N", "summary": "This paper summarizes the previous gradient-based unlearning methods and proposes three essential components for unlearning: weighted forgetting gradient ascent, remaining gradient descent, and a weight saliency matrix. Then, this paper derives the steepest descent direction and proposes a fast-slow weight method to update the model parameters. The experiments in both image classification and image generation shows the effectiveness of the proposed method.", "questions": "1. How many remaining data does the proposed method require, and how many remaining data is actually used in experiments?\n2. The calculation of Hessian matrix $(H_t^r)^{-1}$ still demands large computational resources. Does the proposed method have any approximation on it?\n3. Although this paper claims the proposed methods can significantly reduce the optimization steps in unlearning, why does the RTE not show significant reductions compared with SCRUB and SalUn?\n4. In the implementations, $\\nabla\\mathcal{L}^r(\\theta_*)$, $\\nabla C(\\theta_t)$, and $\\nabla R(\\theta_t)$ may not be zero. Thus, how large are the influences of the three approximation operations in eqs 3,4,6.", "limitations": "No further potential negative societal impact.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. This paper provides a new perspective to unify the gradient-based unlearning methods.\n2. The experiments contain both image classification and image generation to show the effectiveness of the proposed methods\n3. The derivation of the proposed method is attractive.", "weaknesses": "1. The gradient-based unlearning methods usually make more changes to the latter layers than the previous layers, which leads to inefficient information removal. This paper does not consider the drawbacks of such unlearning methods.\n2. For the image classification task, this paper only tries the ResNet18 model. Then, for the image generation, this paper only tries DDPM. It might not be enough to claim to ''form a unified MU approach for all CV unlearning tasks, including image classification and image generation.''\n3. This paper lacks more ablation studies to prove how SFR affect the unlearning results compared with other methods without the repairing stage on the updated model.\n4. The main contributions of this paper are not clear. This paper claims to derive the steepest descent direction and proposes a fast-slow weight method. However, this paper still lacks a thorough advantage analysis of the steepest descent direction and the proposed update method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable comments and noting that our method is attractive. We will address your concerns sequentially. **Relevant tables and figures are included in the attached rebuttal PDF**.\n\n**W1**: Addressing imbalance in layer-wise changes for enhanced information removal.\n\n> There are some arguments[1] regarding the parameter changes across different layers for various unlearning settings. We wish to clarify that our approach does not rely on heuristic strategies based on different layer-wise changes. Instead, our Balanced Saliency Mask can adaptively identify critical parameters for updating, aligning with SalUn[2] that has been verified effective for efficient information removal (Fig.R1). We hope that our theoretical foundation and approach could inspire further improvements to gradient-based unlearning.\n\n\n**W2**: Clarification on the range of models used in experiments.\n\n> There appears to be a misunderstanding regarding the diversity of models used in our experiments. We have explicitly demonstrated in the paper that for classification tasks, both **ResNet18** and **Swin-T** are employed (Tab.2). For generative tasks, our method extends beyond **DDPM** (Tab.3 & Fig.2), and also includes **Stable Diffusion**, which 'caters to practical scenarios' as mentioned by Reviewer HvBU (Tab.4). Moreover, we pioneer class-wise unlearning using **DiT** (Tab.3 & Fig.3). In response to the other two reviewers, we expand our experimental scope to include **large language models** in unlearning tasks (Review HvBU Q & Review S1BA W1) to further validate that our proposed method is **a unified MU approach for general setups**.\n\n**W3**: Ablation studies on SFR-on without repairing.\n\n> We conduct ablation experiments to assess the performance of our 'Sample-wise Adaptive Coefficient' and 'Balanced Weight Saliency' in the absence of repairing.\n> \n> The results in Tab.R2 affirm that these components alone can still enhance the baseline performance. We will include this ablation to support the effectiveness of our components.\n\n**W4**: Clarification on main contributions and advantage analysis.\n\n> We apologize for any lack of clarity in our presentation. We summarize our main contributions as follows:\n> \n> - We unify previous gradient-based unlearning methods from the perspective of the steepest gradient descent with three parts.\n> - We propose an improved approximate MU measured in a remain-preserving manifold.\n> - We introduce a fast-slow weight method to implicitly approximate the Hessian-modulated salient unlearning direction.\n> \n> Additionally, we would like to highlight the advantage analysis of our proposed method:\n> \n> - Following Proposition 2, our findings indicate that our method leverages retained curvature information and focuses more on forgetting, thereby ensuring efficient unlearning while preserving model performance.\n> - In 'Comparison with the joint loss' of Sec.4, we analysis the gradients of our method with those of the conventional joint loss and demonstrate that our method can prevent the forgetting direction from excessively affecting retained performance.\n> \n> Furthermore, we acknowledge in limitations (Appendix G) the absence of asymptotic analysis for our method on deep models. We look forward to future analyses that may inspire the community.\n\n**Q1**: Specification of remaining dataset size used in experiments.\n\n> In our formulation, we define the retain set as the complement of the forgetting set within the entire training dataset (Sec.2). For classification tasks, we set the retain set to align with our formalization, according to previous works[2]. However, as discussed in Sec.4 (lines 282-286), this may be impractical for generative tasks. Therefore, we randomly sample an equal number of samples from the remaining dataset as an insufficient retain set. Our experiments show that we still can achieve effective unlearning under such settings.\n\n**Q2**: Solution to the problem of demanding resources for calculating $(H_t^r)^{-1}$.\n\n> We agree with your concern regarding the substantial computational resources required to compute the Hessian inverse. To reduce this burden, we introduce fast-slow weight updates to directly approximate $(H_t^r)^{-1}\\nabla\\mathcal{L}^u(\\theta_t)$, i.e., the Hessian-modulated unlearning direction (Proposition 3), which is actually one of our key contributions.\n\n**Q3**: Little reductions in RTE compared with baselines in the classification task.\n\n> In Tab.2, our method does not show significantly lower RTE compared to baseline methods because the efficiency improvement for well-studied image classification tasks is marginal. However, in the more challenging generative forgetting tasks, **our method exhibits a substantial reduction in RTE compared to SA and SalUn** (Tab.R4).\n\n**Q4**: The influences of approximation on practical implementations of Eqs.3,4,6.\n\n> We appreciate your attention to the influence of various approximations in practice. Next, we will illustrate these impacts on our propositions separately.\n> \n> * Eqs.3,4:\n> \n>    - Considering the approximations of $\\nabla \\mathcal{L}^r(\\theta_0)$, $\\nabla \\mathcal{L}^r(\\theta_*)$, and $\\nabla R(\\theta_t)$, we demonstrate in Fig.R2 their gradient norms under practical unlearning settings, which are consistent with our theoretical assumptions. In our method, $\\nabla \\mathcal{L}^r(\\theta_0) \\approx \\nabla \\mathcal{L}^r(\\theta_*) \\approx \\nabla R(\\theta_t) \\approx 0$, allowing us to incorporate second-order information on the retain set.\n    - For $\\nabla C(\\theta_t)$, the derivative of the Euclidean distance metric in Eq.3 is generally non-zero, while the derivative of the output KL distance in Eq.4 is strict zero rather than approximation[3].\n> \n> * Eq.6: \n>    * We employ the proximal assumption of parameters near each updated model, verified by previous empirical observations[4].\n>\n> We will include these observations in our Appendix to bolster our analysis.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FZMjtMwJwt", "reviewer": "Reviewer_S1BA", "summary": "The paper tackles the problem of machine unlearning, i.e. forgetting the influence of some data points, with remain-preserving manifold geometry. Authors dig deep into the gradient based approximate unlearning methods from the perspective of steepest descent and come up with a method beyond Euclidean constraints. To overcome computationally-intensive inverse Hessian calculation, authors proposed an efficient fast-slow weight update method to approximate the Hessian-adjusted direction. The theoretical findings are experimentally validated on CIFAR and TinyImagenet image classification problem and CIFAR and ImageNet image generation problems.", "questions": "1) How does your model remove the influence of one data point, when there's a request to delete one sample from the training dataset? This might be a practical scenario.\n2) Are accuracy disparities actually good measure for unlearning comparison? It might be possible that two different models predicted right different samples, thus their accuracies are the same, while they are not close to each other.\n3) Why does \"R-only\" models have greater RTE (longer time) compared to the \"full SFR\" model?", "limitations": "Authors clearly defined the paper's broader impact and limitations in the appendix G.", "rating": 7, "confidence": 2, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1) The problem is very important to make current ML models more trustworthy and private.\n2) Rigorous mathematical framework that unifies all the previous unlearning methods and introduce all the details of the proposed approach.\n3) Interesting algorithm of overcoming inverse Hessian calculation by efficient fast-slow weight update.\n4) Encouraging results and substantial improvements over previous baselines.\n5) Easy-to-follow read with vivid illustrative figures.", "weaknesses": "1) Only CV unlearning is presented. If your method works on ML algorithms in general, it would be nice to present some results on other tasks such as NLP, Audio, etc.\n2) One interesting observation is that machine unlearning should make the model such that \"forget\" and \"test\" set results as close as possible, meaning FA and TA should be really close like in gold-standard RT model. However the proposed method performs not really the best in terms of this metric (|FA-TA|) compared to previous approaches on TinyImageNet. I genuinely don't know if it is a good metric, I might be wrong. \n\nMinor:\n\n3. it would be nice to show with arrows ($\\uparrow$ and $\\downarrow$) in table 2 which metrics are the greater the better and which are the lesser the better.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful comments, valuable feedback on our work, and constructive suggestions to help improve our presentation. We will address your concerns sequentially. **Relevant tables and figures are included in the attached rebuttal PDF**.\n\n**W1**: Including results on other modalities.\n\n> Thank you for suggesting the addition of experiments on other modalities to demonstrate the broad applicability of our method. To verify the effectiveness of our method in the context of large language models (LLM) unlearning, we conduct experiments using the recently proposed TOFU[1] benchmark, compared with four baselines[2,3]. The TOFU dataset consists of fictional author biographies, along with questions and answers related to the authors' attributes. This dataset is instrumental in evaluating methods for forgetting data information in LLMs fine-tuned on it.\n>\n>  As shown in Tab.R1, our method achieves superior forgetting quality, making the unlearned model most indistinguishable from the retrained model based on the Truth Ratio distribution of the forget set while efficiently maintaining the model utility.\n> \n> We will include this experiment of the NLP unlearning task in our Appendix, and we look forward to applying our method to more modalities, such as audio, in the future.\n\n\n**W2**: Discussion on the metric (|FA-TA|).\n\n> We greatly appreciate your insightful observation that the results of the unlearned model on the 'forget' and 'test' sets should be very close. The metric |FA-TA| can indeed serve as an indicator of the effectiveness of forgetting in the random subset unlearning task of classification. Especially considering that |FA-TA| does not need to know the retrained model. However, **|FA-TA| has certain limitations**:\n> \n> - It neglects the difference between the unlearned model and the retrained model.\n> - It has blind spots, as it might consider a randomly initialized model a good unlearned model because its |FA-TA|$\\approx0$, despite the fact that such a model completely loses its utility.\n> - Narrowing it may not lead to Retrain in other unlearning tasks, such as class-wise or subclass forgetting, because |FA-TA| depends on the generalization capability to the unseen forget set.\n> \n> Overall, we think |FA-TA| is a meaingful metric for MU but is not very distinguishable. To comprehensivly evaluate MU methods, we report the Avg.D and KL divergence in Tab.2, both of which compare with the retrained model. Our method is competitive or superior to previous methods in terms of |FA-TA| and **constantly outperforms previous methods upon the overall difference and the output distribution KL divergence from the retrained model**.\n\nMinor **W3**: Comments on table presentation.\n\n> We sincerely appreciate Reviewer S1BA's meticulous review and constructive suggestions. We will add arrows to Tab.2 to enhance readability.\n\n**Q1**: Considering the scenario of removing the influence of a single data point.\n\n> We do agree that the scenario of unlearning one data point is indeed practical. **Our method can be directly applied to the task of forgetting a single data point without additional adaptation, as we do not make any assumptions to constrain the size of the forgetting set.**\n> \n> We did not consider 'removing one data point' in experiments because it is not a suitable setting for unlearning auditing:\n> - Previous literature[1,4] has shown that forgetting a single data point in deep models is a simple scenario to optimize, making it difficult to examine the performance differences of various unlearning methods.\n> - As the structure of datasets diversifies, a single sample may not be an appropriate granularity for unlearning.\n> \n> Despite the above factors, following your suggestion, we conduct experiments under two setups to verify the effectiveness of our method in unlearning either a single data point or a task with suitable granularity:\n> - Randomly forgetting one sample in the classification task on CIFAR-10 (Tab.R3).\n> - Forgetting the relevant information of one author in TOFU benchmark (Tab.R1).\n>\n> The results in Tab.R1 and Tab.R3 indicate that, under these two settings, our method and all baselines achieve effective forgetting while completely retaining general performance, making it challenging to demonstrate our improvements.\n\n**Q2**: Discussion on the metric of accuracy disparities.\n\n> We do agree with your concern on 'accuracy disparity'. In fact, evaluating the effectiveness of an unlearning method remains an open question. Accuracy disparity used in previous literature [4,5], |FA-TA| as you suggested, and output KL divergence all can be used and also have their specific limitations. Although it is not easy to find a single metric, **putting them all together, the advantage of our method is significant**.\n\n**Q3**: Why does 'R-only' cost longer time compared to 'SFR-on'?\n\n> The comparison on RTE in Tab.2 between 'R-only' and 'R-on' is fairer than with 'SFR-on' because the only difference between 'R-only' and 'R-on' is how the loss is optimized. 'R-only' combines and optimizes both forget and retain losses simultaneously, while 'R-on' uses our fast-slow weight method to alternately optimize the forget and retain losses. \n> \n> 'R-on' is faster than 'R-only' for two reasons (batch size set to $bz$):\n> \n> * In each step, 'R-on' feeds the model with $bz$ samples from either the forget or retain set, while 'R-only' combines both the forget and retain sets for a total of $2bz$ samples. Although both perform one backward operation per step, **the forward operation in 'R-only' costs longer time than in 'R-on'**.\n> * Empirically, **'R-on' requires fewer steps than 'R-only' to achieve effective forgetting**.\n> \n> 'SFR-on' adds two additional components to 'R-on'. These components are also designed with the consideration of computational efficiency, thus only slightly increasing the running time per step, and overall still less than 'R-only' (Tab.R5).", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
# General Response
Dear Program Chairs, Area Chairs, and Reviewers, 

We sincerely appreciate your time, constructive critiques, highly pertinent concerns, and valuable suggestions, all of which substantially help improve our work. We are also grateful to the reviewers' consistent acknowledgment of our rigorous mathematical framework, the performance and efficiency of our method, and the comprehensive evaluation across various experimental settings. We address all questions point by point, with **supporting tables and figures included in the rebuttal PDF**. Here is a brief summary:

**Additional Experiments**: 
* We extend our method to large language model (LLM) unlearning tasks, demonstrating superior performance compared to existing baselines, thereby broadening the applicability of our approach. (Reviewer HvBU Q and Reviewer S1BA W1)
* Proportion of parameters activated by the saliency mask to balance layer-wise change for efficient forgetting. (Reviewer fu6N W1)
* Ablation studies on the absence of repairing operations. (Reviewer fu6N W3)
* Assessment of the impact of approximation in practical unlearning process. (Reviewer fu6N Q4)
* Unlearning at the granularity of a single data point or other suitable levels. (Reviewer S1BA Q1)
* Running-time efficiency analysis. (Reviewer fu6N Q3 and Reviewer S1BA Q3)

**Clarification**: 
* Comprehensive range of models and settings employed in our experiments. (Reviewer fu6N W2)
* Advantage analysis of our proposed approximate MU in the remain-preserving manifold and fast-slow weight update method. (Reviewer fu6N W4)
* Remaining dataset size used in experiments. (Reviewer fu6N Q1)
* Approximation to solve the problem of unaffordable cost in calculating the Hessian inversion. (Reviewer fu6N Q2)
* Unlearning metric on accuracy disparity. (Reviewer S1BA W2 and Q2)

Meta-review: The paper studies an important problem of machine unlearning, i.e. forgetting the influence of some data points, while preserving the remain geometry. The paper introduces a perspective to unify previous machine unlearning approaches by decomposing the gradient descent direction into three components: forgetting gradient ascent, remaining gradient descent, and weight saliency matrix. Then the steepest descent direction is derived based on the remain-preserving manifold geometry. Moreover, to overcome the computationally-intensive inverse Hessian calculation, a fast-slow weight method is proposed to implicitly approximate the Hessian-adjusted direction. The efficacy of the proposed methodology is demonstrated by some image classification (ResNet and DiT), image generation by DDPM, and LLM as well during rebuttal. 

After rebuttal, all the reviewers agree to accept the paper, so is the final decision, provided that the authors could reflect those discussions in the final version properly.
Decision: Accept (spotlight)