Feature Unlearning: Theoretical Foundations and Practical Applications with Shuffling
Authors: Yue Yang
Jinhao Li
Hao Wang
Venue: NeurIPS 2025 poster ()
Keywords: Machine unlearning
Features Unlearning
Primary area: general_machine_learning

Abstract: Machine unlearning has become a focal point in recent research, yet the specific area of feature unlearning has not been thoroughly explored. Feature unlearning involves the elimination of specific features' effects from an already trained model, presenting distinct challenges that are still not comprehensively addressed. This paper presents a novel and straightforward approach to feature unlearning that employs a tactical shuffling of the features designated for removal. By redistributing the values of the features targeted for unlearning throughout the original training dataset and subsequently fine-tuning the model with this shuffled data, our proposed method provides a theoretical guarantee for effective feature unlearning. Under mild assumptions, our method can effectively disrupt the established correlations between unlearned features and the target outcomes, while preserving the relationships between the remaining features and the predicted outcomes. Our empirical studies across various datasets,validate that our approach not only successfully removes the effects of specified features but also maintains the informational integrity of the remaining features while achieving a faster convergence rate.

Feature Unlearning: Theoretical Foundations and Practical Applications with Shuffling
Yue Yang* yue@maincode, com Maincode; Monash University
Jinhao Li'
Hao Wang hao wang2@monash. edu Monash University
j jinhao 11 @momashn edu Monash University
Abstract
Machine unlearning has become a focal point in recent research, yet the specific area of feature unlearning has not been thoroughly explored. Feature unlearning involves eliminating specific features' effects from already trained model, pre- senting distinct challenges that are not yet comprehensively addressed. This paper presents novel and straightforward approach feature unlearning that employs tactical shuffling of the features designated for removal. By redistributing the values of the features targeted for unlearning throughout the original training dataset and subsequently fine-tuning the model with this shuffled data, our proposed method provides theoretical guarantee for effective feature unlearning. Under mild sumptions, our method can effectively disrupt the established correlations between unlearned features and the label, while preserving the relationships between the remaining features and the label. Across both tabular and image datasets, our empirical results show that our method not only effectively and efficiently removes the influence of designated features but also preserves the information content of the remaining features.
Introduction
Machine learning models have transformed numerous industries by learning complex patterns from However, as these models become deeply integrated into decision-making processes, significant concerns regarding privacy, ethical use of data, and compliance with regulatory frameworks, such as the General Data Protection Regulation (3] and the Health Insurance Portability and Accountability Act M, have surged. In this context, machine unlearning has emerged as a critical subfield, focusing on the deliberate removal of specific information from trained models, effectively enabling them "forget" certain data points or features upon request (27 [6] [4]. While machine unlearning has garnered significant attention, the specific subfield of feaeure-level unlearning remains relatively underexplored.
vast amounts of data, driving productivity and efficiency (29 19 24
Most existing research on machine unlearning has focused on instance-based unlearning, aiming to remove certain subset of data samples from models without retraining from scratch [8] 27
[4] [6].
In contrast, feature unlearning targets removing the influence of specific features from trained model [32]. which poses unique challenges and opportunities that have yet be fully addressed. One of the major challenges for feature unlearning lies in the complex interdependencies among features: disentangling and removing the effect of targeted feature without disrupting the influence of others is difficult. The model may have learned complex representations where the influence of one feature intertwined with others, making isolation of single feature's 's effect non-trivial. Moreover, changes to one feature's 's influence can inadvertently affect the learned relationships and decision boundaries associated with other features, potentially leading to unintended bias.
Equal contribution. Corresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

experience performance degrada- tion as the number of removed features increases. and they lack theoretical guarantees to fully negate the influence of removed features while maintaining the integrity of the remaining features.
Existing approaches for feature-level unlearning 132 26 15
To tackle this issue, in this paper, as shown in Fig. [ we introduce a simple yet effective approach to feature unlearning by strategically shuffling the features desig- nated for removal from a statistical perspective. This shuffling technique serves dual purpose. First, it en- sures that the modified model gradually loses reliance on the specified features, as the original correlations are obscured through randomization. Second, this approach preserves the structure and statistical properties of the remaining features, thereby maintaining the integrity of other predictive relationships in the data.
Attribateal
Age
Postcode
Postcode
Step
qualifies personal
Clinical data
Patient ID
X
Shuffled postccdde
Blosd Type
from the model
HGC value
Training
Protein Sequence
Disesses
Fine Tune
unLearning
Figure An example of our feature un- learning algorithm.
Despite its simplicity, we provide rigorous theoreti- cal guarantees for the feature unlearning process. We demonstrate that the impact of the specified features diminishes to an insignificant level. We also further validate our proposed method under the concept of Shapley value [33 and mutual infor- mation (20). These guarantees provide assurance that the shuffling process effectively isolates and removes the targeted feature influence without compromising overall model integrity. Through comprehensive empirical evaluation on diverse tabular and image datasets with different neural architectures, we show that our approach can robustly unlearn multiple features simultaneously while efficiently preserving high accuracy and ensuring strong generalization on the retained features.
2 Related Work
Machine unlearning has emerged as a critical area in machine learning, focusing on enabling models to efficiently forget specific data points subsets without requiring complete retraining (27 [6 5
14 13
Most existing machine unlearning methods primarily focused on data-level unlearning and
proposed several methods, such as Sharded, Isolated, Sliced, and Aggregated (SISA) training, certified removal, and adaptive unlearning, which can effectively remove specific data points 14 16]
There have been comparatively limited studies I32
15 26 addressing feature-level unlearning,
which aims to remove or diminish the influence of specific features a trained model. [32 initially addressed the feature unlearning problem by recalculating the network weights associated with the removed elements, followed by a fine-tuning phase to maintain performance on remaining features and labels. Subsequently, [15] proposed a more computationally efficient approach to eliminate specific attributes using a representation detachment loss defined by mutual information. Yet, this method lacks theoretical guarantee for the unlearning process. Also, mutual information is simultaneously estimated during unlearning, introducing potential bias. (26] expanded feature unlearning to pre- pathways. However,
trained generative models by modifying the generator and this method is specifically tailored for the generative adversarial network framework and can lead considerable computational overhead. All of the aforementioned models suffer from one of the two main limitations: (i) Their performance deteriorates as the number of features to be removed increases; (ii) They lack theoretical guarantees completely eliminate the influence of removed features while preserving the information of the remaining features. Instead of simply retraining the model from scratch, prior studies often prefer fine-tuning trained model because only need to work on a part of the parameter space that already captures wide-ranging and sturdy features and make minimal yet effective adjustments rather than relearning all features from the beginning 35 10] Also, beginning with a pre- pre-trained model acts as form of prior, effectively limiting the model's degrees of freedom. This constraint makes it less prone to fitting random noise and more likely to preserve features that generalize well. Consequently, this kind of approach tends to reduce overfitting compared to training a model from scratch 233
3 Defining Feature Unlearning
Definition 3.1 (Feature Unlearning). Let D {(x;, 11)) be a dataset of n samples with m features, where the feature vector X4 X C n and the label yı y C R. Each feature. well

---

as the label, can be represented as a random variable, denoted by X2,X2...... ,x,...,,'y,. Xm. Y. The random variable of the feature vector is then denoted by X = (X, x.m) .............. Each sample in the dataset 'D drawn from its underlying distribution D, where (X,Y)~* D.
Suppose a model parameterized by 0, denoted by So X + Jú has been trained on D. Let the j-th feature (which could also include multiple features as a feature mix) be the targeted feature for unlearning. The dataset with j-th feature removed is defined D-j := {(xi--j J:)]i= where the resulting feature vector x,-- E X'j C Cmm Let 96 R_ + ) be the model parameterized by Φ and trained from scratch D-j-
We define the unlearning operator U transforming the original model into an updated model, ex- pressed as før [[o)., such that the influence of the j-th feature is completely removed. We define that U achieves the goal of feature unlearning if, with a probability of at least 1 - 6, for all (x, drawn from D, there exists a Sø. such that A (foo(x), g0 (x(xx))) S v(x,)) ~ D. where (..-) is an appropriate distance function. In other words, we have P(xx, wD (x), gx((x)))))) > S 8.
4 Shuffling-based Feature Unlearning Approach
In the context of feature unlearning, our objective is to ensure that the updated model for retains no knowledge of the specific feature to be unlearned. Formally, this implies that for should not encode any meaningful information about the values of the removed feature, i.e., the model's parameters are independent of the unlearned feature. Meanwhile, it is crucial that the unlearning process does not degrade information pertaining to other features. In other words, for should continue to capture the useful correlations present in the remaining dataset excluding the removed feature. In this section, we first introduce straightforward yet highly effective method for unlearning feature from the dataset, followed by theoretical analysis to establish solid foundation for our method.
Our proposed feature unlearning consists of two key steps: random shuffling and fine-tuning. the first step, the j-th feature is shuffled while its marginal probability distribution remains unchanged. Meanwhile, as theoretically demonstrated in our work, this shuffling process effectively disrupts any alignment between Xj and (X-j, Y), i.e., making X7 and (X-j, Y) inde- pendent. The second step involves training the original model using the same loss function but with the shuffled dataset. The resulted model theoretically loses its ability to exploit the original correlation between feature X, and the target Y, while retaining the information associated with remaining features X X-j. Consequently, for has "forgotten" the specific predictive information provided by feature X, in the original dataset D.
Approach Overview:
Feature Random Shuffling
Draw a random permutation of the index set [I,...,n) uniformly random.
ii Construct the shuffled dataset Dy by replacing each Jiy with Tx(().) while keeping the value of other features the same for each data point. The shuffled dataset is defined as Dj {(x,, b where x (æt,1,.... .......,aajj... 11,-11 (i). fi.jtl...... F.,m). That is, all features other than j remain unchanged, while the entries the j-th feature are permuted.
Fine- Line-Tuning with the Original Loss Suppose we have loss function, defined {(fo v). that was used to train the original model. In our approach, we fine-tune the original model using the same loss and the shuffled dataset Dy to get the updated parameters 0'.
4.1 Theoretical Analysis
Independency Between Xÿ and (X We assume the distribution is stationary and ergodic on the measurable space of X y/ implying that each coordinate æ4, and label ys also forms a stationary and ergodic process, denoted by {Ii.j, y y in the smaller space X, x V. The shuffled sequence through the random permutation π is written as {I=(s),5) W We first define
the empirical distribution of the shuffled sequence p(n) (X7,)) 1 E. 5(Fn()))) Bz), where
(( vi is Dirac point mass at (Za()) 9:).
3

---

Here, we first prove the independency between X3 and (X-,. Y) after random shuffling.
Theorem 4.1. Over the random permutation x and the sampled datasets D and DT,
p(m] (x5,)) n-+00 Px, x Py,
p(n) Pxj.X 70-000
Px, x Px_
(I)
Proof. In this proof, we provide comprehensive demonstration for the independency between X, and Y, which is analogous to that of the independency between Xj and X_, with full details presented in Appendix A
As (-i.-- M1 31);-1 is stationary and ergodic, the coordinate processes {ais Pi=1 and {yr) both satisfy the Birkhoff's 's ergodic theorem 4 which means that, for each measurable C X3 and B E.y.
pla X
(A) = Σ 1=1
1a E AA n-200
1 Σ Px, p(0) (B)
1 E B}
Py (2)
m=-00
Thus, P
Px, and p(m) - Py almost surely.
The shuffled empirical distribution of a rectangle B is written as
x -
71 Σ
1 E A, E B).
(3)
M: For this empirical distribution, when conditioning on the process Wii for each i, the index (i) is uniform in n... Therefore, we have
E, (1 A)H De ((n)
(4)
Multiplying by 18 B} and summing over then shows
p(m) E Xf.v y (A x [)) (e = Pkr) (A) p(m) (B).
(5)
We then un-condition (remove the conditioning of) the above expectation using the law of total expectation as
E.
P(mm) XJ.Y, (A B)] Ee (A) (6) (B) (B)]
P (
(A) (B).
(6)
Notably, the last term derived based on the fact that the product of two marginal probabilities is constant when fixing (I=()) 3:), i.e., there is no more randomness in for the marginals.
Given Eq. (6). by defining the difference between the shuffled empirical distributions and the product of two marginal empirical distributions, i.e.,
2A, B) P(o) y - PX) (A) (B).
We see that Ex B)] = 0. i.e., (n, is mean zero.
Next, aim to show that (,, B) is small with high probability. To prove this first define
S,, B) = Σi= 1 1( E A, Vi E B}. Then, the shuffled empirical distribution p(n) y (A x B) can expressed as (A, B). Changing æ in one position affects at most two indicators in Sn. Hence, the rewritten shuffled empirical distribution (A, B) satisfies the McDiarmid's 's inequality for some c; as per-sample sensitivity constants and O.
25
1 P( P SA B) I B)]| S 2 expl n
25
(8)
Σの c
Given Eq. 66 we have E. B)] = PXP) (A) (B). The McDiarmid's inequality in Eq.
8 can be rewritten as
282 (9)
P((
P( x
P(.) (A) (B) 1) P(O, B) > S 2exp
E5 c

---

Then, summing over we have En= (A, > <) S oo, which, by the Morel-Cantelll
lemma [36] 7 results in S2, (A, B) almost surely for each fixed A B. Combined with the Birkhoff's 's ergodic theorem in Eq. (2) (i.e., the empirical marginal distribution almost surely converges
its marginal distribution), we have
p(n) X x
(A B) P (A) (B) (A, B)
3.3.
(A) (B
(10)
So far, we have point-wise almost sure convergence for each rectangle A x B. To further show the shuffled empirical distribution Pxy,y (A B) almost surely converges to Px5 x Py on all measurable sets, choose a countable family of rectangles ( [A, x Bt} that generates the produet g-algebra on X3 x V. By the same exponential tail bound in Eq. (2) union of the Borel-Cantelli lemma shows 12,, AA, B:)l - 0 simultaneously for all I with the probability of 1.
Since these rectangles form (or generate) 77-System for 23 x V. the standard mcasure-thcoretic uniqueness result implies p(n)
X5.Y
8.8.
Px, Py.
+2-000
p(n) feature X5 is almost surely independent of both the label Y and the unshuffled features X-j, such that XJ IL x)).
Corollary 4.2. If XT.Y n-00
Px, x Py and P(n)) X7. X- n-000
8.S. Px2 x Px_g, then the shuffled
Proof. Refer to Appendix B
Remark 4.3. The above corollary aligns with our previous statement: our method effectively disrupts the established correlations between unlearned features and the label while preserving the relation- ships between the remaining features and the label. The former evident, as the shuffled feature becomes independent of the label. The latter is also satisfied since our approach does not modify either the remaining features or the label, thereby maintaining their original relationship.
Proof of (c 8'-Close Between for and 96
Theorem 4.4. If X5 is independent of (Y, (Y)X.)). then using the same loss function E: y x y B.... and the same optimizer, the model for trained on the shuffled dataset D7 and the model go trained from scratch on D_ are (c, -cloose.
Proof. Let F be the hypothesis class for functions f(x) with domain X C R and G be the hypothesis class for functions g(x-j) with domain X- C Rm-1
We define the optimal risk in the classes of F and G as
R' = inf W) Te (f(x), ((xx"),))) wi)) Ríg inf (E(x,
(11)
Since X7 is independent of (Y, X-j), the conditional distribution of given [x x7) equals that of y given x-j alone. Therefore, a function that tries to exploit 27 cannot improve its predictions beyond what is already possible with x-, alone. Specifically, for any f(x) E F,,, we define (xx-)) = f(x x,) for an arbitrary fixed value of u.. The expected loss of ÿ under D_ matches that of f under Dj. Therefore, we have
jer EED Le [e((()), = iinfgeg {ED_, ((((x))), = R_
(12)
We assume that the model for trained on the shuffled dataset Dy and the model 9s trained on the dataset D_, aim minimize their respective empirical risks. That is, each corresponds to solution (or approximate solution) of empirical risk minimization (ERM), such that
R. (for) < inf inf (f) a,
Rb_((9)) I infgeg R._,, (g) +
(13)
where > is the small sub-optimality that may come from incomplete training or early stopping.
5

---

By the standard uniform convergence theorem, with probability of at least - 8 over the draw of D and any randomness in forming Dj in the training algorithm, we simultaneously have
Ro; (J) - R()) S tm: F, |Ro,(c) R(g) S 6n,
Vy E 5
(14)
for some bound en that goes to 0 as n - oo, depending on the complexities of F and g. From the above uniform convergence bound, we have
R(fe) - R, (for + 5 inf R, (f)+ S inf R(f)+ 2e, + a == R + 2e, + a.. (15) fEF
JEF
Similarly, we have R(gs) S R-, + 2e, + a. By the triangle inequality, we can further derive the following inequalities for risks and empirical risks with the probability of at least - 5 as
[R(6o)) - R(go)) S (R(xx)) - R2 (R(ge) - R. < 4e, + 2a,
(16)
and
RR (Ser) Ro_, (g+) S Gen 20.
(17)
Therefore, the empirical risk difference between fer and Je is (e - 8'-close, where = 6e, + 2o.
In standard supervised learning theory, the Bayes-optimal predictors (such as for and go) for ê-based risk are given by fo = argmin R-D(Jor),
(Jor),
= argmin (g,(()))
(18)
In the following, we will prove that: 1) if is k-strongly convex, for any for and gø trained via Eq. (18). they are (r 5) clooss, 2) if e is not strongly convex, under mild assumptions, for any for trained
via Eq. 18). there must exist a 96 trained via Eq. (18) such that for and Jo are (e ( 8)-close.
The proof of the former is shown below and that of the latter is presented in Appendix
As is k-strongly convex, the ERM problem has unique global minimizer, which means that for and Is obtained via Eq. (18) are unique. Also, at the minimizer, both gradients of the empirical risk are zero, i.e., VR (for) VR (gx) = O.
Moreover, for any for and go in their respective hypothesis classes, the strong convexity yields
k
(9o) 2 R.y (fer + VR.by (T (gs ffr) = Illo0 for112 2 R,yy (fe: + 211l0- for 11..
(19)
By rearranging Eq. 19 we have
2
(go) R,; (For S 2 (Br,, + 20).
Ilgo for 112 <
(20)
Therefore, the difference in risk of two models is bounded by v /3(nen + ai), which implies that for and g4 are ()-cooe,, where e - [3E,,, a.).
Remark 4.5 (Insights from Mutual Information and Shapley Value). The unlearning capability of our nruffle-based approach can also be explained from the mutual information and the Shapley value perspective. For the former, the mutual information between the unlearned feature and the label vanishes, which is formally stated in the following Theorem 4.6 For the latter, the Shupley value of the unchanged features (i.e., x-5) derived from the unlearned model for and the retrained model go are almost surely identical which is stated Theorem 4.7
Theorem 4.6. X5 1L LY,YX is almost sure when n + oc, then the empirical mutual information (x5,, Y) T-
O. In(X7,XX
n-to O, and I Ix55 8¹) n0 0.
Proof. Refer to Appendix D
Theorem 4.7. Let K2 (fr) and kilg)) be the Shapley value of the feature derived from models fyr and g6- If XxJ11 (Y,X_;) is almost sure when n + oo, Vi {l,....j 1,j + I,..., m), we almost surely have Ky (f(orr Kg(go).
Proof. Refer to Appendix
E

---

5 Experimental Results
To align with the definition of feature unlearning presented in Definition 3.1 our experiments involve the following setup. For a given dataset D and its corresponding model fe. which has been fully trained on this dataset, the j-th feature in the training set (denoted as Diraii) randomly shuffled to train for for unlearning. For the retrain from scratch model, the j-th feature is removed from Dreain to train Pø- The test set, denoted as Drest, is derived from D using an 80:20 training-test split ratio. Numerical features undergo standardization, and categorical features are processed via one-hot encoding.
In this section, we first introduce several metries to evaluate the effectiveness of feature unlearning in Section [5.]] We compare our proposed method's performance against a model retrained from scratch using the TRI metric and evaluated efficiency via the El index. We also perform dependence analysis and assessed feature contributions as part of our evaluation framework. Subsequently, we present the experimental settings Section 5.2 followed by the results for both single-feature and multi-feature unlearning in Sections 5.2. and 5.2.2 respectively. The codes are available in the supplementary materials.
5.1 Evaluation Metries
TRI [6]: The test retention index (TRI) evaluates the effectiveness of feature unlearning by comparing the accuracy of the unlearned model (i.e., fer) to a model trained from scratch (i.e., 96), which
widely recognized as a gold standard to evaluate unlearning. TRI is defined as TRI Acc
Accag
where Acc and Acc.s represent the test accuracy on Drest for for and Jo. respectively. A TRI value closer to one indicates effective feature unlearning.
El 6 In addition to accuracy, to assess the efficiency of the unlearning process, we introduce the Timess efficiency index (EI), defined as EI Time,g" where Time and Time,, denote the training times (in seconds) for for and Jø, respectively. An El value greater than one suggests the unlearning algorithm is more time-efficient than training from scratch.
RASI: The unlearning robustness against shuffting index (RASI) examines whether the unlearned model has successfully eliminated dependency on the unlearned feature. This is evaluated by shuffling the values of the unlearned feature in Dress using the torch. randperm function and observing the impact on predictions. RASI defined as RASI > (x.y)e { (x)
for (Xshume)); ), measuring the proportion of unchanged predictions. When calculating RASI, we shuffle the unlearned feature ten times and take the average of the RASI for the final result.
Using explainable AI techniques, we assess the significance of the unlearned feature via SHapley Additive exPlanations (SHAP) [22] Two metries defined: the SHAP retention index (SRI) and the SHAP distance-to-zers index (SDI). SRI quantifies the relative importance of the unlearned feature after unlearning, calculated as SRT of the SHAP value from zero, expressed as SDI
SRI&SDI:
xz(e,) SDI measures the absolute deviation RoJo) 0/.
Further, privacy and fairness metrics are considered. For the former, a variant of membership inference attack (MIA) [30] at the feature level is calculated in the following steps. First, we create an attack dataset. For each sample, we query for and g6 to get their outputs that are then labeled as Unlearned and Retrained, respectively. An attack model, i.c., Random Forest binary classifier, further trained on the built attack dataset, with the aim of learning the subtle differences between the outputs from for and go- The final attack accuracy is the evaluation metric regarding privacy. An accuracy value near 50% indicates that the attack model cannot do better than random guessing, implying that the unlearned model is indistinguishable from the model retrained from scratch. For the fairness metric, we introduce demographic parity (DP) and equalized odds (EO), whose detailed descriptions are provided Appendix For a successful unlearning, the fairness score of the unlearned model should be very close to that of the retrained corerrd-ffo-ssseee from-scratch model.
7

---

MLP-TRI
MLP-EI
MIP-RASI
MLP-5RI
MLP--50
45.24
1.-
03
RA8
2129
2.5
TRt=1
1000
631
1931
0d
900
1930
1930
0.0
1de
1930
1937
168
1330
Untiwaning Epports
Uniearning Epocts
Untexminn
Unieemiing Eppcchs
Uiteerning Tpochs
ResNet-TRI
ResNet-Ei
ResNet-RASI
ResNed-SRI
ResNet-SSD
12
5R
5000
1.0
TRje1
22.09
RA
f 92
0.6
07
220
1008
500
530
1006
1500
6A
500
1900
1500
560
1330
1530
500
1300
1006
Unteamnnng Epocts
Unlearning Epocns
Unieaming Epocns
Unieoming Epochs
Untearning Spochs
FT-Former-TRI
FT-F Fi-Foeme--
FT-Former-RASI
FT FT-Formen-SRi
FT-Former-SDI
12
43.77
El1
520-0
50+0
1.
40
20
23115
0.
35
32
0.
Tit-1
1008
100
522
1000
1530
1930
1530
500
1930
500
1500
Unikaainn Speirn
Unbeerning Epocna
Unbearning Eppcns
Unieeriing Epecho
Lideerning Sprida
Ours (Most important Ours (2nd Important) FOUL (Most Important)
FOUL (2nd Important)
MIUL (Mcst Important)
MIUL (2nd Important)
Figure 2: Single-feature unlearning evaluation results of the Magic tabular dataset.
5.2 Experimental Settings and Results
Datasets- Tabular: This study employs six OpenML datasets Magic, Credit, and Cali for the single-featur feature unlearning setting (i.e., unlearning one feature), and Eye, Comp, and Pol-which contain more features to explore multi-feature unlearning. Detailed descriptions of these datasets are provided in Appendix G
Dataset- - Image: We further extend our unlearning method to image classification task using the CelebA [21], a large-scale dataset of over 200K images. The key difference in unlearning between tabular and computer vision (CV) datasets lies in feature representation. In tabular data, features explicitly structured as columns, allowing direct shuffling. In contrast, CV datasets embed features- like nose shape in CelebA within images, without explicit separation into variables. Hence, we focus on shuffling specific visual features, including nose and eyes, to achieve unlearning for image classification tasks. Examples of processed images with shuffled feature are shown in Appendix H
Feature unlearning is an emerging research area with limited prior work. Two baselines, as discussed in Section 2 are included in our experiments: 1) First- Order Unlearning (FOUL) [32] This method applies small permutations to the unlearned feature and leverages the first-order gradient differences between the permuted and original inputs update the neural network and 2) Mutual Information Unlearning (MIUL) [3]: This approach reduces the learned information of the unlearned feature and the label using mutual information estimation while preserving others. It requires training three additional neural networks for mutual information estimation.
Baselines:
Neural Architectures and Training Parameters: All experiments are conducted on an NVIDIA V100 GPU. For tabular unlearning, we use a standard MLP and two more complex architectures: ResNet [17) and FT- Fran [12]. During training, the original model fo is trained for 1500 epochs. Models trained from scratch run for 2000 epochs to ensure convergence (see training loss curves in Appendix []. For approach and the two baselines, unlearning is performed over 1 to 1500 epochs, with selected values at 1, 10, 50, 100, 1000, and 1500. For the CV task, we leverage the Vision Transformer (ViT) [9] backbone with an MLP classifier head. Model trained from scratch undergoes training for 100 epochs. Unlearning spans 1 to 100 epochs, including specific values at 1, 20, 30, .... 100. To mitigate randomness, each model is trained ten times. Detailed configurations are provided in Appendix [
5.2.1 Results of Sengle-Feature Unlearning
Tabular Task- Unlearning Features with Different Feature Importance: To examine the effective- ness of our method in unlearning different features with varying levels of importance, we perform unlearning on the most, second most important features. Each feature's importance calculated and represented as their Shapley values, with details provided in Appendix K For brevity, the results
8

---

Table 1: Averaged MIA accuracy comparison (optimal: 0.5 )
Epoch
Method
1
10
50
100
200
400
600
800
1000
1500
Ours
0.344
0.520
0.496
0.309
0.525
0.528
0.525
0.520
0.512
0.511
FOUL
0.574
0.620
0.603
0.388
0.569
0.651
0.751
0.763
0.763
0.763
MIUL
0.651
0.596
0.597
0.597
0.605
0.603
0.595
0.612
0.594
0.614
of unlearning the most and the second most important features within the Magic dataset are depicted in Fig. [2] The full results of single-feature unlearning of each used tabular dataset, in terms of TRI, EI, RASI, SRI, and SDI, are provided in Appendix [L] Additionally, the results of averaged feature-level MIA accuracy across datasets are provided in Table I The fairness-related results are provided in Appendix D
Our results demonstrate that our approach consistently achieves TRI values close to 1 across all datasets for both various neural architectures and various features, indicating that the accuracy of the unlearned model nearly matches that of a model trained from scratch. In contrast, the baseline methods exhibit different behaviors: the FOUL method experiences accuracy degradation, while the MIUL maintains the same accuracy level regardless of the increase in unlearning epochs. Our method empirically proves that it can achieve TRI values around one within a limited number of unlearning epochs.
Additionally, our approach is significantly more efficient than retraining from scratch, demon- strated by its high El values. Rather than requiring full retraining until convergence, our method achieves TRI value close one using nearly 200 unlearning epochs across all datasets, making approximately 10 times faster than training from scratch. In contrast, both FOUL and MIUL demand greater computational resources, particularly MIUL., which necessitates training additional neural networks for mutual information estimation.
For the RASI metric, our method almost consistently achieves the highest values, indicating that the unlearned feature has been more effectively forgotten compared to the baseline methods. This observation is further reinforced by the based evaluations (SRI and SDI), which provide more detailed assessment of the feature's s importance (or dependency with the label) after unlearning. Our approach achieves the lowest SRI values, confirming that the relative importance of the unlearned feature is significantly diminished. Additionally, the low SDI values indicate that the absolute contribution of the unlearned feature is reduced near zero, meaning that even when the feature is present, it no longer influences model predictions. Moreover, we further evaluate our method's effectiveness when unlearning features that are highly-correlated with others. The correlation of each two features is calculated via the Pearson correlation coefficient. The resulted correlation heatmaps are provided in Appendix M We identify one feature pair as highly-correlated features if the Pearson correlation coefficient is greater than 0.8. As shown in Appendix [ the results of unlearning these identified features across all neural architectures and tabular datasets are consistent with the outcomes of unlearning features with different importance, further justifying the effectiveness and robustness of our unlearning method. Furthermore, shown in Table [ and Appendix O the evaluations on MIA, DP, and EO demonstrate the effectiveness of our unlearning methods in terms of privacy and fairness.
We extend our unlearning method to the CelebA dataset for image classification, targeting the removal of visual features nose and eyes. Classification classes include gender, big nose, pointy nose, eyeglasses, and narrow eyes. The evaluation results across all metrics are detailed in Appendix [P] where our method still significantly outperforms baselines and effectively achieves the unlearning goal. We attained an average TRI of 97.31 % after 20 epochs and 99. 19% after 100 epochs. The strong performance in this image dataset highlights the broader applicability of our method to real-world high dimensional complex scenarios.
Image Task:
5.2.2 Results of Multi-Feature Unlearning
We further evaluate the capability of our approach for unlearning multiple features for both tabular and CV datasets. For the tabular datasets, we unlearned more than half of the features in each dataset (with results provided in Appendix QD. and for the CV tasks, we simultaneously unlearned both the nose and eyes features. Fig. 3 shows evaluation results of unlearning both Nose and Eyes when

---

performing classification on label class Gender. As shown in Appendix Q and Fig. B the request to unlearn large number of features for tabular datasets, as well as multiple visual features, does not compromise the performance of our approach and consistently outperforms the two baseline methods.
1.00
TR
El11
RASI-1
R2
0.75
RASI
0.8
FOUL
Ours
MILL
90100
Unlearning Epochs
Unlearning Epochs
Unlearning Epochs
Figure 3: Evaluation results of unlearning Nose and Eyes for label class Gender.
Limitations and Conclusion
Similar most machine unlearning techniques in the literature, our approach requires prior knowledge of the data to be removed, specifically access to the training data. Detecting privacy leaks in learning models, which is complex issue, falls outside the scope of this research. In this paper, we present a straightforward yet effective method for feature unlearning through shuffling on features designated for removal. Despite simplicity, this approach can theoretically achieve outcomes comparable to retraining a model from scratch under mild assumptions. Extensive empirical evaluations across various datasets demonstrate that our method can simultaneously unlearn multiple features effectively, while maintaining high accuracy and strong generalization capabilities for the remaining features. In summary, our study provides a practical, efficient, and theoretically sound approach to feature unlearning that could significantly impact how machine learning models are updated and maintained, particularly in light increasing data privacy concerns.
References
[1] Accountability Act. Health insurance portability and accountability act of 1996. Public law, 104:191, 1996.
[2] R.G. Bartle and R.G. Bartle. The Elements of Integration and Lebesgue Measure. A Wiley- interscience publication. Wiley, 1995.
[3] Thomas Baumhauer, Pascal Schöttle, and Matthias Zeppelzauer. Machine unlearning: Linear filtration for logit-based classifiers. Machine Learning. 111(9):3203-33) 2022.
[4] George D. Birkhoff. Proof of the ergodic theorem. Proceedings of the National Academy of Sciences, 17(12):6566660 1931.
[5] Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium Security and Privacy (SP), pages 141-159. IEEE, 2021.
[6] Xavier F. Cadet, Anastasia Borovykh, Mohammad Malekzadeh, Sara Ahmadi-Abhari, and Hamed Haddadi. Deep Unlearn: Benchmarking Machine Unlearning for Image Classification In 2025 IEEE 10th European Symposium Security and Privacy (EuroS&P), pages 939-962, Los Alamitos, CA, USA, July 2025. IEEE Computer Society.
[7] P. Cantelli. Sulla probabilità come limite della frequenza. Atti Accad. Naz. Lincei, 26(1):39- 45, 1917.
[8] Rishav Chourasia and Neil Shah. Forget unlearning: Towards true data-deletion in machine learning. In International Conference on Machine Learning, pages 6028-6073. PMLR, 2023.
[9] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlshy. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 1021.
10

---

[10] Dumitru Erhan, Aaron Courville, Yoshua Bengio, and Pascal Vincent. Why does unsupervised pre-training help deep learning? In Proceedings of the thirteenth international conference on artificial intelligence and statistics, pages 201-208. JMLR Workshop and Conference Proceedings, 2010.
[11] Matthias Feurer, Jan N. van Rijn, Arlind Kadra, Pieter Gijsbers, Neeratyoy Mallik, Sahithya extensible
Ravi, Andreas MÄlaller, Joaquin Vanschoren, and Frank Hutter. Openml python api for openml. Journal of Machine Learning Research, 22(100):1 2021.
[12] Yury Gorishniy, Ivan Rubachev, Valentin Khrulkov, and Artem Babenko. Revisiting deep learning models for tabular data. In Proceedings of the 35th International Conference Neural Information Processing Systems, NIPS '21, Red Hook, NY, USA, 2021. Curran Associates Inc.
[13] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 1 11516-1 11524, 2021.
[14] Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. 2019.
[15] Tao Guo, Song Guo, Jiewei Zhang, Wenchao Xu, and Junxiao Wang. Efficient attribute unlearning: Towards selective removal of input attributes from feature representations, 2022.
[16] Varun Gupta, Christopher Jung, Seth Neel, Aaron Roth, Saeed Sharifi- Maarrfii-Mavjeerdi, and Chris Waites. Adaptive machine unlearning. Advances in Neural Information Processing Systems, 34:16319-16330, 2021.
[17] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016.
[18] Salojärvi Jarkko, Puolamäki Kai, Kovanen Lauri, Simola Jaana, Kojo Ilpo, and Kaski Samuel. Inferring relevance from eye movements challenge 2005, 2005.
[19] Konstantina Kourou, Themis P Exarchos, Konstantinos P Exarchos, Michalis V Karamouzis, and Dimitrios I Fotiadis. Machine learning applications in cancer prognosis and prediction. Computational and structural biotechnology journal, 13:8-17, 2015.
[20] Alexander Kraskov, Harald Stöghauer, and Peter Grassberger. Estimating mutual information. Physical Review Statistical, Nonlinear, and Soft Matter Physics, 69(6))06611)) 2004.
[21] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In 2015 IEEE International Conference on Computer Vision (ICCV), pages 3730-3738. 2015.
[22] Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. In Proceedings of the 31 International Conference on Neural Information Processing Systems, NIPS' 17, page 4768-4777, Red Hook, NY, USA, 2017. Curran Associates Inc.
[23] David JC MacKay. Information theory, inference and learning algorithms. Cambridge university press, 2003.
[24] John McCoy and Lidia Auret. Machine learning applications in minerals processing: A review, Minerals Engineering, (32:95-109,201)
[25] Colin McDiarmid. On the method of bounded differences, page 148-188. London Mathematical Society Lecture Note Series. Cambridge University Press, 1989.
[26] Sacmi Moon, Scunghyuk Cho, and Dongwoo Kim. Feature unlearning for pre-trained gans and vaes. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21 21420-21428, 2024.
[27] Thanh Tam Nguyen, Thanh Trung Huynh, Zhao Ren, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoe Viet Hung Nguyen. A survey of machine unlearning. arXiv preprint NiXi:22000002999 2022.

---

[28] Henry Scheffe. A Useful Convergence Theorem for Probability Distributions. The Annals of Mathematical Statistics, 18(3):334 438, 1947.
[29] Pramila P Shinde and Seema Shah, A review of machine learning and deep learning applications. In 2018 Fourth international conference computing communication control and automalion (ICCUBEA), pages 1-6. IEEE, 2018.
[30] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership Inference Attacks Against Machine Learning Models In 2017 IEEE Symposium Security and Privacy (SP), pages 3-18, Los Alamitos, CA, USA, May 2017. IEEE Computer Society.
[31] Paul Voigt and Axel Von dem Bussche. The eu general data protection regulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing, 1033152666:10-5555 2017.
[32] Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine un- learning of features and labels. arXiv preprint 10.. 2021.
[33] Eyal Winter. The shapley value. Handbook of game theory with economic applications, 3:2025-2000 2054, 2002.
[34] Heng Xu, Tianqing Zhu, Wanlei Zhou, and Wei Zhao. Don't forget much: Towards machine unlearning on feature level. arXiv preprint arXiv:2406. 100:2), 2024.
[35] Jason Yosinski, Jeff Clune, Yoshua Bengio, and Hod Lipson. How transferable are features in deep neural networks? Advances in neural information processing systems, 27, 2014.
[36] Émile Borel. Les probabilités dénombrables et leurs applications arithmétiques. Rendiconti del Circolo Matematico di Palermo (11884-9440) 27(1):247-211 271, 1909.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction clearly present our claims outlining the paper's contributions alongside its key assumptions and limitations and these claims are fully supported by both the theoretical analysis and experimental results.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We list all the assumptions and potential limitations.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiatiinn asymptotic approximations only holding locally). ). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
13

---

Answer:
[Yes]
Justification:
We provide the full set of assumptions and a complete (and correct) proof
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the
paper
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
14

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
We provide code in supplementary material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips //ipssccc/pill wttpcccpppppppppeeeeeeeeeeeeeeee httpa////giieee/eeeSSubiiiissss /Cc////oddiiisssseeeeeee www.iissssiiiiiiiico for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification: Our paper specify all the training and test details
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: This paper report error bars suitably and correctly defined other appropriate information about the statistical significance of the experiments
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
15

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g., negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We include sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments in appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics htttps:/neurips.cem hcc/public/Ethhcsuuu..eee
Answer: [Yes]
Justification: This research conducted in the paper conform, in every respect, with the
NeurIPS Code of Ethics
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We discuss both potential positive societal impacts and negative societal impacts of the work performed
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
16

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility MI).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification:
This paper poses such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
The creators or original owners of assets (e.g., code, data, models), used the paper, are properly credited and the license and terms of use explicitly are mentioned and properly respected.
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
17

---

If assets are released, the license, copyright information, and terms of use in the thcode has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssit
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We will release our code.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
Guidelines:
The paper does not involve crowdsourcing nor research with human subjects. The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
18

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: We use LLM only for writing, editing, or formatting purposes
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: //appp:///eurps..... http://arriiiaccoooeerrreree//// /cc//oomferrecccc/222////// for what should or should be described.
19

---

p(m) X; (A) (B). A Empirical Distribution Convergence Between Xÿ and X-j
Proof. As D is stationary and ergodic, the coordinate processes { i==1 and {x,--) both satisfy the Birkhoff''s ergodic theorem which means that, for each measurable C X3 and B C X-j;
n
(00) Xx (A)
(A)
Hai E A}
a.s. Px, (A),
(21)
n=0000
((0) X-, (B)
1
Σ ==1
1 [x,,_)
BB n.s.
(x) (B).
(22)
Hence, p(a) + Px, and p(m) X; The shuffled empirical distribution of a rectangle B is written as
X-; Px almost surely.
n
p(m) X B)
Σ 1 E A,x,, E B}.
(23)
For this empirical distribution, when conditioning on the process ( x for each fixed i, the index (i) uniform in [n....,n.. Therefore, we have
F (Ta())) E ()) x, - = 2, (A).
(24)
Multiplying by 1 E B} and summing over then shows
Ex ((n) x x-, (A x B) - Pk)) (A) x-, (B).
(A)
(25)
We then un-condition the above expectation using the law of expectation, written as
E, Ex __, (A x B)] (ma x (() x (B)]
[P(]]
(26)
Notably, the last term is derived based on the fact that the product of two marginal probabilities is a constant for fixing (Ir(),.) X1,-j), i.e., more randomness in for the marginals.
Given Eq. (26). by defining the difference between the shuffled empirical distributions and the product of two marginal empirical distributions, i.e.,
Ω2 (A, B) = p(n)
Xx,X B)
- (A) (x)
(B).
(27)
We see that F. [2,, (A, B)] 0, i.e., 2n(A,, B) is mean zero. Next, we aim show that (A,, B) small with high probability.
To prove that, we first define
" S, Σ ((7(0)))) A. A,x,,,; B}.
(28)
Then, the shuffled empirical distribution XT x (Ax B) can be expressed as (A, Changing in one position affects at most two indicators in Sn. Hence, the rewritten shuffled empirical distribution S, (A, B) satisfies McDiarmid's 'ss inequality 25 for some C, 0.
1 P(] Sa B) - E-I SA B)]| > S 2exp
2e En
(29)
Given Eq. 26 we have E, 1 Sm, B)] = PK.) (A) (B).
The above McDiarmid's inequality
can be rewritten as
P(IP))) x (Ax x B) p(m) (A)
x (B)) E)
28
(30)
= P((SS B) 6) 2exp
Σ 2
20

---

Then, summing over n, we have
(A, e) S 00,
(31)
which satisfies the Borel-Cantelli lemma 36 7 resulting in (A, + 0 almost surely for each fixed A x B. By combining it with the Birkhoff's is ergodic theorem in Eq. (2T) and (22) (i.e., the empirical marginal distribution almost surely converges to its marginal distribution), we have
pla) X3 (Ax
P (4) (2) (B)
(A,
(32)
7=000 Pxy (A) x Px_, (B).
So far, we have point-wits wise almost surely convergence for each rectangle B. To further show the shuffled empirical distribution Xxy.x xx, (A x B3) almost surely converges to Px, X Px.; on all
measurable sets, we choose a countable family of rectangles {Ai x Bi } that generates the product o-algebra X3 X-j- By the same exponential tail bound in Eq. (30), a shows [22, (A,, B + simultancously for all with the probability 1.
As these rectangles form (or generate) a T--yytemm for X3 x X-jj the standard thesurc- uniqueness results implies
a.s. X
Px, x Px_.'
(33)
X5
n-to0
21

---

B Proof Independence between Xj and (Y,
Proof. In discrete case, the relationship between the empirical joint probability mass function (PMF) and the empirical joint probability measure can be written as (22 y) X3 x y:
Pxj. -
- P
= x.
= y)
(34)
Similarly, the relationship between the product of empirical marginal PMFs and the product of empirical marginal prohability measures can be written as
Pxy (2)))x
Pxx(Xj = xr)) y).
(35)
Given pin) Y
n.s.
Px, x Py, we have, 9)x E 23} y
X
2-000
p(n)
X
25 Y y)
P n Xy
(XF = PY
(Y
(36)
Hence, the PMF Pxj.y (x v) almost surely converges pointwise to pxy (177 (or))))))) for V(ay,y) E X3 x V/ expressed as
(n)
Px (x3,x(23,3)
a.S. pxy Pxy (x))
(37)
Similarly, we can have
(m) Pxp
pxp p (v)
a.s. pr (g).
(38)
In continuous case, assume that both empirical and actual probabilities measures, including p(n) p()) Pxy.v. Pxy. Py, are absolutely continuous w.r.t. Lebesgue measure Hence,
p(m)
XT.Y Xx.
there exists PDFs plo (1), v). pxp (x)) plT (v). PXJ. (1), Pxy (4)) ) PY (y) such that
p(n)
px PxJ, (4) g)dM(13,0) A Borel Set A S X2 v,
(n) (x())) Borel Set A S Xj,
(39)
X7.Y
p(m)
PK7 (z))
(40)
p(m)
DY (w)d)(y), BBoell Set A AC V,
(41)
Pxp.Y x (0779))d(45.ol) v), VBorel Set A S X, V,
(42)
Pxj J. Pxj (1) (x))) Borel Set A S Xj,
(43)
Py py(y)dAy)) Borel Set A y.y.
(44)
As we already have p(m) expressed as
n.s. Px, x Py, therefore, it ensures the total variation convergence 8
a.s. |1 X Px, x Pr|ITV- = / 1x33 - Pxppyldx 2
0.
(45)
m-000
That is to say 11 -xx,
in (A)).. Similarly, we can have 1| 1+0
u.s.
Px,
a.s.
n-
in (A) and [| - py ||1
a.s.
0 in (A). Based on the Scheffé's lemma 28), from
I
n convergence of sequence of non-negative functions non-negative limit, it follows that
Px.Y
u.s.
Px,PY;
(46)
Px7
(n)
120000 PX5:
(47)
(n)
PY
(48)
12-000
22

---

Therefore, we now have
D pxf.rlo3.1)
px, px, (x))Dr()))) Pxxy
pxy (oF)or())
(49)
Analogously, we also have
Px x_, (1),
a.s.
Px, (xx) (x-)) = (x7(23)11 (x-x)-
(50)
For every measurable sets A C Xz and B C )/ we have
J Pxy, 1x3, = S. pr (u)ddy / pxy (x7)d(a7)
p(X EAYE
(51)
Hence, we have
A)p(Y B), and therefore X5 11 Y. Similarly, we can have X3 1L X_j. Finally, when - 00, we almost surely have
pXx B)
(52)
XI IL (Y,X X -)
(53)
23

---

C Proof of (e 8) -Close of for and 9s Under Non-Strongly Convex Loss Function L
Proof. If f is not strongly convex but bounded, the ERM problem may have multiple global mini- mizers. Therefore, for each for derived from Eq. (8). there exists gø that their achieved empirical risks are (c -)-close.
We here propose mild assumption that
W gol S w]e(Sor, (gg. v)l,
(54)
where w represents a scaling factor that bounds how sensitive the model's output or parameters are to changes in loss function.
By taking expectations on both sides of Eq. (54). we have
E flfo
gell I wB [[e(fer v) l(gs. y)ll
(55)
Based on Eq. 17 the RHS of the above inequality, i.e., empirical loss difference, is bounded by 6c,- + 2a. Therefore, we have
fo goll S w (6en + 20.)
(56)
To further bound the difference of two models, i.e., Ifer gol. apply the Markov's inequality:
( gol > E) E for -0ll w(be, + 2a) To ensure such probability is most 5, set
(57)
(ben + 2a)
I 6,
(58)
which is rearranged as
e w(6cn + 2a)
(59)
Therefore, by choosing e wibe, +2a)
we have for and Io are (e -losse
24

---

D Empirical Mutual Information Convergence
Proof. The empirical mutual information between X and Y can be defined as
pxp,y (a).v) v)
I (x(3;; == E (xy p()) x
log
(60)
(m) Pxg
(v)
Given the independence between X5 and (Y, X
proved in Corollary 4.2
we have
(n) PxJ.y v (x5,1) v)
a.s.
px, px, (T)DD (1) pxy (x)
(61)
Pxp (x,))
a.s.
Px3*
(()
(62)
pY (y)
(y))..
(63)
Therefore, the ratio inside the logarithm operator of mutual information almost surely converges to 1,
i.e.
Px . (x
(64)
Px5 (xr))
Do (v)
For large n, this ratio stays in (ô, #) for some > O. Therefore, we have
Pxj x
maxx [log 8) log (e)
log
(65)
(n)
(x)) Jb (v)
Pxp
Mim (z) v)
indicating that log
is uniformly bounded for large n. By leveraging the dominated
xx (ar >pl" (v)
convergence theorem we have
P Pxy xa3. 9)
(zg Alg
log
= =I((3)
O.
(66)
px (2)) )p (v)
2-00
Analogously, we can have
In Ix( X ;)
a.s. 0,
(67)
2=000
In (x7 8¹)
3.3.
(68)
n
25

---

E Almost Surely Equal Shapley Value between Unlearned Model and Retrained Model
Proof. We treat each feature as a "player" a cooperative game. For a subset S S fi....,m. m) of features, we define v(5) the performance (c.g., accuracy) of model trained with only features in S.
Definition E.1 (Shapley Value of the i-th Feature). The Shapley value of the i-th feature (i e {1, {1...., m)) is
||| (m (0- |S| (o(SU(i))-
Σ
K2
m!!
where Φ; is the expected marginal contribution of the i-th feature to the performance, averaging over all subsets S that do not contain i.
Given that X5 is independent with Y, we have, for any subset of features S S m!....,m.
fo (SU (ン}) Ufa (S).
(69)
For the retrained model, define its corresponding performance as Vgg. (S). If a subset S does not contain j. we train only on those features in S. If S does contain j. then effectively is not available. Therefore, S {j} is the same as S in terms of actual features used for model gø. which means
Uno (S U (i}) = Uno (S).
(70)
Given Eq. (69) and 770,, Φ equals zero in both models, showing they coincide for the "unlearned" feature (i.c., the j-th feature).
This is the crux: we want to see that each unchanged (or shuffled) feature retains the same Shapley value in both models.
Consider any subset S S fl...., m) \ {i} which does not contain i. The Shapley value for the i-th feature derived from both model can be simplified us (SU(i)) -fg (S) and gg (SU(i))-u (S), respectively. We need to show that these two differences are the same for all S, which can be divided into the following
cases:
Case 1: j & S and j & (S)) then for is using exactly the same features as Io (because j is absent in both). Thus,
Uf (SU Ugg (SU (i)),
(71)
1/o (S) Uigo (S),
(72)
resulting in the same Shapley value.
Case 2: j E S (or U {i}), recall that adding the worthless j-th feature does not affect the performance of før. Similarly, in the 9a. the j-th feature is forcibly absent. Thus effectively S is the same whether not it nominally includes indicating:
S' = S {i),
(73)
(SU = (S) VO.
(74)
Hence, we can identify
for (SU % (S' u (i)),
(75)
3o (S (i]) v (S'U
(76)
which is also likewise for v/ (S) 1g. (S"), the j-th is worthless in for
In all cases, for any subset not containing we have
Ufe (S U (i))) of (S) Un (s) Therefore, each marginal contribution term in the Shapley-valu sum for the i-th feature is identical between for and gs- Summing over all subsets S (with appropriate combinatorial weights), we almost surely conclude that Vi E { 1, ,,...,,} m..:
(77)
Kz(for) = niz (ga).
(78)
26

---

Descriptions of Fairness Evaluation Metrics
The demographic parity (DP) score is calculated in the following steps. Firstly, we identify several key components related to DP, including
Unprivileged/Priileeeed Groups: The group that has historically faced disadvan- tage/advantage (c.g., for features like "Race" or "Gender").
Favorable Outcome: The desired model prediction (c.g., "loan approved").
Model Predictions: The output labels generated by our unlearned model or the retrained- from-scratch model.
Next, for both the privileged and unprivileged groups, we calculate the rate at which they receive the favorable outcome from models. The formula for the rate is calculated as
Rate Number of Individuals in the group who received the favorable outcome
(79)
Total number of individuals in the group
The above rates Davoabll=Pavorbble Outcome Unprivileged Group), respectively.
denoted Faaoobllaa Outcome Privileged Group) and
Finally, we calculate the DP differences (as the DP metric used in evaluation) between unprivileged and privileged groups, formulated as
DP Difference DP (Labbee==Favrrable Outcome Unprivileged Group)
(80)
-DP(Label=Favorable Outcome Privileged Group).
DP difference zero indicates perfectly fair unlearning.
For another fairness metric, i.c., the equalized odds (EO) difference, we calculate the differences of True Positive Rate (TPR), False Positive Rate (FPR) between the privileged and the unprivileged groups. Both metrics, i.e., TPR and FPR, should be as close as to zero for successful unlearning from the perspective of fairness.
27

---

G
Descriptions of Tabular Datasets
summary of used dataset from OpenML in this paper is presented in Table
2
Table 2: Summary of used datasets for single-feature unlearning.
Dataset
Number Samples
Number of Features
Number of Numerical Features
Number of Categorical Features
Name
Magic
13376
6
Credit 16714
10
10
0
Cali
20634
8
0
Magic: The data MC generated (see below) simulate registration of high energy gamma particles in a ground-based atmospheric Cherenkov gamma telescope using the imaging technique. Cherenkov gamma telescope observes high energy gamma rays, taking advantage of the radiation emitted by charged particles produced inside the electromagnetic showers initiated by the gammas, and developing in the atmosphere. This Cherenkov radiation (of visible to UV wavelengths) leaks through the atmosphere and gets recorded in the detector, allowing reconstruction of the shower parameters. The available information consists of pulses left by the incoming Cherenkov photons on the photomultiplier tubes, arranged in a plane, the camera. Depending on the energy of the primary gamma, total of few hundreds to some 10000 Cherenkov photons get collected, in patterns (called the shower image), allowing to discriminate statistically those caused by primary gammas (signal) from the images of hadronic showers initiated by cosmic rays in the upper atmosphere (background). The link to this dataset
org/a/44125 Credit: The link to this dataset is https: /wwwww/wwwww.// http::/wwwwwwpwmllccccm wwtp://g//////////
Cali: This dataset, also known as the California Housing Prices dataset, contains information about housing values in California, collected from the 1990 U.S. Census. It contains features such including median income, total rooms, total bedrooms, population, and geographical attributes such as latitude and longitude. This link to this dataset is https //www.openntl org/ ///gg//44000 44009
A summary of used dataset for multi-feature unlearning from OpenML [ is shown in Table 3
Eye: This dataset was published in the Inferring Relevance from Eye Movements Challenge
2005 18] The link to the dataset is https: h/wp:://wwwww.w. hwtp///wwwwwpmml.././//////// openml. org/d/44157
Table 3: Summary of used datasets for multi-feature unlearning.
Dataset
Number of Samples
Number
Number of Numerical Features
Number of Categorical Features
Number of Unlearned Features
Name
of Features
Eye
7608
23
15
Comp
16644
17
9 0
8
Pol
10082
26
26
20
Comp: The link to the dataset is https://www openml org/a/44162
Pol: The link to the dataset is
org. 2r//2/44122
28

---

H Examples of Processed Images with Shuffled Visual Features
The following example illustrates how original image is processed for our unlearning method and retrain- foaiin--rom--cratte approach:
Shuffled nose feature for our unlearning method: The nose region is shuffled while preserving the overall structure of the image.
Masked nose feature for retraining from scratch: The nose region is masked to remove its influence on the model.
U
ifor &
for &
ter
&
229
iCT
ict
ict
375
Processed Image for Retrain-from-Seratch
Processed Image with Shuffled Feature
Original Image
Figure 4: Example of images with shuffled visual features.
29

---

I Configurations of Neural Models and Training Hyperparameter
The batch size is set 64 and the learning rate set as 0.001. The optimizer used for neural network update is the Adam optimizer and the loss function is the cross-entropy loss function.
For the FOUL baseline
32 the scale of permutation the unlearned feature is set 0.01.
the training epochs to estimate mutual information set as 500. The weight coefficients balancing different mutual information estimations, denoted as λ1, A2, and Xs. are set as 5, and 1, respectively.
For the MIUL baseline
34
For our unlearning method within the tabular datasets, the MLP model has two hidden layers with the number neurons of 128 and 64. The ResNet model has residual blocks and final fully- connected layer for classification outputs. The FT-Transformer model has two transformer blocks with two-layer MLP head (whose hidden layer dimension 64) for classification.
For our unlearning method within the CV dataset, the ViT backbone is imported through the timm package timm. create _model ('"vi__aae prrie_bas____ _atase_ptcch_____1 ) The MLP classifier head has two hidden layers with the number of neurons of 512 and 128.
When implementing the SHAP method to calculate the feature importance of unlearned feature, we use the shap package developed by [22] and set the background data size and test data size as 1000 and 100, respectively.
All codes are implemented in Python 3.10 and PyTorch 1.12.
30

---

Training Loss Curves of Models Trained From Scratch Under the Single- and Multi-Feature Unlearning Setting for Tabular Datasets
MAGIC
CREDIT
CALI
0.65
0.60
0.55
Loss
0.50
0.45
0.40
250
500
750
1000
1250
1500
1750
2000
Retraining Epochs
Figure 5: Loss curves of MLP-based models trained from scratch under the single-feature unlearning setting.
MAGIC
CREDIT
CALI
0.60
0.55
Loss
0.50
0.45
0.40
250
500
750
1000
1250
1500
1750
2000
Retraining Epochs
Figure 6: Loss curves of ResNet-based models trained from scratch under the single-feature unlearn- ing setting.
31

---

MAGIC
CREDIT
CALI
0.60
0.55
Loss
0.50
0.45
0.40
0
250
500
750
1000
1250
1500
1750
2000
Retraining Epochs
Figure 7: Loss curves of FT- models trained from scratch under the single-feature unlearning setting.
EYE
COMPASS
POL
0.65
0.60
Loss
0.50
0.45
250
500
750
1000
1250
1500
1750
2000
Retraining Epochs
Figure 8: Loss curves of MLP-based models trained from scratch under the multi-feature unlearning setting.
32

---

K
Shapley Values of Each Feature for all Used Tabular Datasets
When implementing the SHAP method to caleulate the feature importance unlearned feature, use the shap package developed by 22 and set the background data size and test data size as 1000 and 100, respectively.
Table f shows the Shapley values of each feature in the Credil dataset. The most, second aaweeeeeaa-a-aaaaaaaaaaaaaaa
most, second last, and last important features are NumberOfTimeste SmmberrOfTiees@@Daylaaaaee VumberOfDependentaa DebtRatio.
Table 4: Shapley values of each feature in the Credit dataset.
Feature
Shapley Value
0.130686
NumberroFTImnesS0Dayylaattt
0.095737
0.083108
0.080779
age
0.074865
0.074132
NumberrRellLaataaee...ooo0o0.
0.062857
MonthlyIncome
0.058T03
NumberOffeeendennts
0.035402
DebtRatio
0.001361
5J the Shapley values of each feature in the Cali dataset. The most, second most, second last, and last important features are Lati tude, Longitude, AveBedrms, Population.
Table 5: Shapley values of each feature in the Cali dataset.
Feature
Shapley Value
Latitude
0.281184
Longitude
0.248730
MedInc
0.148034
AveOccup
0.081746
AveRooms
0.057758
HouseAge 0.041526
AveBedrms
0.021693
Population 0.019374
Table the Shapley values of each feature in the Magic dataset. The most, second most, second last, and last important features are fWidth, fSize, fLength, fAsym.
Table 6: Shapley values of each feature in the Magic dataset.
Feature
Shapley Value
fWidth
0.129222
fSize
0.101183
fConc
0,095207
fConc1
0.089712
fLength
0.079942
fAsym
0.053422
33

---

L Full Results of Unlearning Features with Different Feature Importance Under Single-Feature Unlearning Settings
Fig. pillustrates the TRI results of unlearning the most, second most, second last, and last important features across the MIP, ResNet, and FT-Transformer models.
Ours
FOUL
MILL
TRi:f
Ours
FOUL
MIUL
TRint
Ours
FOUL
MIUL
TRI=1
Important
Secund Mouil Important
Moal Important
Important Feeture
portannt
Second
ICE
1891
1993
591
1910
1iee
1rc0
1993
100
12c
931
2011
1100
ice
1990
Undearning poetto
Unleaming Epocto
Unicaming Spocia
Unlearning Epecto
Uniumiin Epecto
Unieamiing Epocha
Second Last Imporiant Festure
Lasd Important Fasture
Second Lasd Important Fasture
Last Importart F Feeture
Second Lasi Important Festure
Lasd Important Festure
09
1030
25
05
500
1009
25
Undezmning
Unieaming Epecto
Unlearning Epocha
Unkamiin Esocta
Uniearning Epoctra
(a) MLP-Magic
(b) MLP-Credit
(c) MLP-Cali
Most Important Feature
Second Most important Foature
Most Important Feature
Second Most Important Feature
Most In portant Feature
Second Most Important Festure
65
Uce
523
0
1ree
105
18C
1900
1000
1108
Ice
1900
Second Last Importent Fasture
Last Important Festure
Second Last Importent Festure
Importent Festure
Second Last Important Festure
Important Fastere
1893
Undearning Epochs
Uniaaming Epocts
Unleaming Spocts
Unlearsing Epecha
Unikaming Epecta
Unisariing Epocha
(d) ResNet- Resiee-Magic
(e) ResNet- Credit
(f) ResNet- Cali
Ours
FOUL
MILL
TR
OUTS
FOUL
MIUL
TRIm
Our
FOUL
MIUL
TR
Most Important Feature
Second Most Important Foature
Most Important Feature
Second Most Important Feature
Most Im portant Feoture
Second Most Important Fecture
Urdeamning Escohs
Unkenming Eposto
Unleaminn Epooks
Unlearning Epects
Unikaiing Esoots
Uniearinng Epochs
Second Important Feature
Last Important
Second Last orlant
Important
Second Last Important Feature
Important Foature
1593
100
500
530
1006
200
1000
1500
500
1966
1200
500
1000
1668
1000
1500
Urdeamingg Epodit
Unkoaming Epecto
Unieaminng Eprochs
Unloarning Epecto
Unikaming Epects
Unleariing Epechha
(g) Trransffrreer-agee
(h) FT- FT-Transformer-Cree Credit
(i) FT Fransffformerlllll
Figure 9: TRI results of unlearning features with different feature importance for tabular datasets.
34

---

Fig. iillusttrass the EI results of unlearning the most, second most, second last, and last important features across the MLP, ResNet, and FT-aransformer models.
Oura
FOUL
MLU
Eir1
Ours
FOUL
MUL Importani
Elst
Our
FOUL
MIUL
Bi-1
Important
Moal Importani
Moet Important
Important
Important
'E1
Vio
YCt
nd)
XCC
131
1eb
121
190
Uniearinng Epocto
Unieamiin Epecto
Unleaming Epocta
Unleamting Epocta
Unleaming Epoctt
Unleaming Epochs
Second Last Important Festure
Laat Important Fasture
Second Lart Important Festure
Last Importarri F Feadure
Sacond Last Important Fealum
Lest Importent Featurs
Uniearming Epacta
Unieaming Epocta
Usleamiig Epochs
Unleamiing Epocha
Unleaming Epochs
Undeaminn Epochs
(a) MLP-Magic
(b)
(c) Mali
MUL Second Most important Feature
El-1
Most Important Feature
Second Most Important Feature
Most important Feature
Most Important Feature
Second Most Imporiant Fecture
Univerming 1903
1003
Unieaminn
Unleamiin Epochs
Uniearming Epochn
Unleaming Epochs
Epochs
Scoond Important Feature
Last Important
Second Last Important Feature
Importanti
Second Last Important Feature
Important Feature
60
1i0
500
Univarning Epeche
Unieaming Epoche
Univariin Epochs
Univariing Epochs
Unisaming Epochs
Unleaming Epochs
(d) ResNet-Magic
(c) Resdet-Credit
(f) ResNet-Cali
Ours
-a-
FOUL
MUL
EP1
Ours
--- FOUL
MUL
El
Curs ---
FOUL
MIUL
E1-1
Important Feature
Second Moal Important Feuture 5o
Mosl Impor Festure
Second Most important Feuture
Important
Second Important
120
126
170
Uniiarming Epocto
Unioarinng Epecio
Univariing Epoclo
Urleaming Epeclo
Unleaming Epoclt
Undeaming Epocit
Second Lest Inportant Festure
Last Important Fusture
Second Last Important Feuture
Lust Important Festure
Second Last Important Feature
Lest Important Feature
100
123
(g) PT-TTranffrmmer-Mage
(h) PT-Transformer--Ceee Credit
(i) FT- Coll
Figure 10: El results of unlearning features with different feature importance for tabular datasets.
35

---

Fig. 11 illustrates the RASI results of unlearning the most, second most, second last, and last
important features across the MLP, ResNet, and FT-Transformer models.
Ouro
FOUL
MIL.
RABI-T
Ours
FOLL
--
MIUL
RABI-1
Quts Important Feature
FOUL
MIJL
RABI-1
Important Feature
Second Important Feature
Imporiant Feature
Second important Feature
Second Most important
(E6)
190
531
1900
1930
1931
1993
the
023
1he
Undeanting Spects
Unleariing Esochs
Uniaaring Epscha
Unleamiin Epects
Unterring Epecta
Unieaminn Epocta
Second Lasd Importeri F Feature
Last Impo rlannt Fexturs
Second Lari Important Fenture
Lart Importart Fanture
Second Last Important Festure
Last Important Fasture
RASI
RAAD!
Unieamiin Spocha
Unikariing Epechs
Un Unkarning Epochs
Unisaminn Epocts
Unieariing Epocha
Unitaminn Specta
(a) MLP-Magic
(b) MLP-Crede
(c) MLP-Cali
Oure
FoUL
MILL
RABI-1
Dur
FOLL
MiUL.
RASI-1
Outt
FOLL
MIJIL
RASI-1
Most Important Feature
Second Moet Important Factforn
Nost Important Feature
Second Mort important Fenture
Nost Importent Fenture
Second Most Important Faxture
1990
1990
Unicuning Specto
Unteamning Epectta
Untorrning Epoctra
Unleariing Epocts
Unioaring Epectro
Urleamiin Spocts
Second Last Importent Festure
Last impo rtant Feature
Second Last Important Festure
Last Importard Feature
Second Last Imporiant Feature
Last Important Feature
675
0.7
6:75
1500
1900
199
Unicuning Epocta
Untearning Esoctra
Unicurning Epoctra
Unieaminn
Uniarning Epecto
Unieaming Epocts
(d) RasNer-Magic
(c) ResNet-Credtt
(f) ResNet-Cali
FouL
RABI-T
FOLL
MiUL
RAB1-1
MIJL
RA31-1
Most Important Feature
Second Most Important Feature
Nost Important Feature
Second Mort Importent Festure
Hosi Importent Feature
Second Most Important F Farturs
Uniearting Spscha
Unteamiing Epechs
Uniaaring Epocha
Unicamiing Epocts
Unbarring Epecha
Unisaming Epocta
Second Last Importari Faature
Last rtantt Festurn
Sacond Lard Important Fenture
Last Importart Fanture
Second Last Imporiant Featurs
Last Important Fenturs
RAC
1.3
100
22
100
1500
E00
1900
1993
10:2
(g) FT-Trranformmrr-Maee
(h) FT-Trranformer--Ceei
(i) FT-Transformme--ooli
Figure 11: RASI results of unlearning features with different feature importance for tabular datasets.
36

---

Fig. 12 illlsstraee the SRI results of unlearning the most, second most, second last, and last important features across the MLP, ResNet, and FT- FT-Transformer models.
Oura
FOUL
MILL
BRI=0
Ours
POUL
--- MIUL
BR
Ours
FOUL
--- MILL
BRI
Most Important
Most Important Festure
Imsortannt
Important
Second
100
100
1900
1930
5009
1990
1999
1590
1500
Unleaming Fpochs
Untearning freathe
Unieaming Epschs
Uniearding Epochs
Unssaariing Spochs
Unkkrrnnng Sposha
Second Last Important Feature
Last important Feature
Second Last Important Feature
Last Important Feature
Scoond Last Important Feature
Last Important Feature
530
1006
100
1300
1500
1000
Untearning
Unleaming
Unikarnnng
(a) MLP-Magic
(b) MLP-Credit
(c) MLP-Cali
MILL
SRI-0
FOUL
MILL
FOUL
BRI-D
Most Important Festure
Becond Most Important Feature
Most Importard Fasture
Sacond Wost Importanti Fenture
Nost Importent F Festure
Second Noxt importent Feeture
533
1006
1200
220
1900
200
1300
1530
530
5000
1530
500
1990
1590
530
1000
1500
Unleaming Eposhs
Unteerning Eposito
Unieamiig Epechs
Uniearning Epochs
Unieariin Epocit
Unkkarning Epochs
Second Last Important Feature
Last Important Feature
Second Last Important Feature
Last Important
Sccond Last Important Fecture
Last Important Foature
Unleaming Epochs
Untoarning Epocio
Unloaming Epects
Unieersing Epochs
Unisarnnn Epochs
Unkkarring Epochs
(d) ResNet-Magic
(e) ResNet-Credit Credit
(f) ResNet- Cali
FOUL
MIUL
8RI-0
FOUL
MILE
FOUL
Most Imporiant Feature
Second Most important Foature
st Important Feature
Second Most Important Feature
Most Inportaattt
Second Most important Feature
1000
5300
1930
1930
1530
1503
Epochs
Second Last Important Feature
Last Important
Second Last Important Feature
Important Feature
Second Important Feature
Important Foature
Unikaming Epocha
Unkeerning Epoche
Unieamiing Epocha
Univarsing Epocha
Unisarning Epochs
Unikamiing Epocha
(g) FT Fr.Tranfformr--Meee
(h) FT- Fr..rranformer-CCCC Credit
(i) FT Transffforrn--
Figure 12: SRI results of unlearning features with different feature importance for tabular datasets.
37

---

Fig. iillusttrs the SDI results of unlearming the most, second most, second last, and last important features across the MLP, ResNet, and FT- PT-Trassformer models.
Ours
FOUL
MIJ
Ours
FOUL
MIUL
BDK-0
Our
FOUL
MILL
50K00
Importart
Importent
Most
Important
Impo
500
1930
1900
0:0-
500
1030
10%0
0C0-
520
1080
15%
500
1030
1800
500
1000
1000
600
500
1003
1900
Uniearming
Epocit
Eprosss
Epecht
Uninarning
8q
cond Last Important Feature ocs
Last Impertant Fecture e
Spoond di Last Important Fecture cice
Last Imporiant Feature
Sroond Last Important Feature
Last Impo Feature
one-
Uniearming Epccha
Cmiaaniig Epochs
Un tnntinnng Epochs
Unieersing Epochs
Untnarning Epocha
Unisarring Epoctta
(a) MLP-Magic
(b) MLP- Credit
(c) MLP-Cali
Oura
FOUL
MIJI
501-0
Oure
FOLL
MIJL
SDA-0
Oure
FouL
MILL
50800
Most Important Fenture
Second Nost Important Fectura
Most important Feature
Second Most Important Fextuure
Most Important Feature
Second Ni Impo rtant Featuure
0:2
021
120
10:00
112
100
1000
100
1930
Unteotring Exectt
Unikarning Eprctts
Unioarning Spoctts
Uniber ning opsdds
Unfoarrin Epedrs
Unisariing Esedhs
8 cond Last Important Festure
ocs
Lest Immorttrttt Fecture
S
cond Lest Important Feature
c.co
Last lmp onlant Feature
groond Lest Imp orpantttt Feature
005
Lest Impo rtant Feature
000
020
6:00
1030
1500
Unikaainng Epochs
Un booning
Un Unikaring
Unikarning Epoche
Univarnng Eppich
Unisarring Epoche
(d) ResNet-Magic
(e) ResNett-redit
(I) Callit-Cali
500m
SDD+3
Most Important F Feature
Second Nost Important Feature
Nost Important Feature
Second Most important Feature
Most Important Feature
Second Most Importannt Feature
025
500
1030
1000
Epecha
Unikarning
Un Importent
Unikerning Epocha
Uniiarring Epodhs Important
Un Univarring Epecha
Imp
Importannt
Undeariing Epechs
1900
Epocis
1050
Uniearnin Eprcits
10:00
11
1:50
Eprohs
1003
1800
Urivaringg Epecits
100
1093
1000
Uniaarring Excclts
020
1/93
1990
(g) FT.rransformer-Mau
(h) FT-Transformer--rees Credit
(i) FT Transformer-Caal
Figure 13: SDI results of unlearning features with different feature importance for tabular datasets.
38

---

M Feature Correlation Heatmaps of Used Tabular Datasets
In our experiments, we identify two features highly-correlated features if the Pearson correlation coefficient is greater than 0.8.
Fig. 14 shows the feature correlation heatmap of the Cali dataset. The highly-correlated feature pairs of this dataset include Latitude and Longitude, AveRooma, and AveBedrms.
Feature Correlation Matrix CALI
1.00
Medinc
0.75
HouseAge
0.50
AveRooms
0.25
AveBedrms
0.00
Population
0.25
AveOccup
-0.50
Latitude
-0.75
Longitude
-1.00
Medinc
HouseAge
AveRooms
AveBedrms
Population
AveOccup
Latitude
Longitude
Figure 14: Feature correlation heatmap of the Cali dataset.
39

---

Fig. 15 shows the feature correlation heatmap of the Credit dataset. For readability, we use the abbreviations of each feature the heatmap. The mapping between abbreviations and full names is provided in Table
The highly-correlatedd
feature
pairs of this
dataset
include
and www.pppch......gaaoooooooooeeeer
Table 7: Feature abbreviation in heatmap and full name in Credit dataset.
Feature Full Name
Feature Abbreviation
No. 30-59
NumberrOfTTinessS0aayysaaae
N0.90
No. 60-99
Loan
age
age
Rev.
No. Estate
MonthlyIncome
Income
BumberOfDependents
No Nep
DebtRatio
Debt
Feature Correlation Matrix CREDIT
1.00
Rev.
age
No.30-59
0.50
Debt
0.25
Income
Lo.n
-0.25
No.90
Es.Est
-0.50
No.60-89
-0.75
No.
11.00
Rev.
age
No.30-59
Debt
Income-
No.Loan
No.90
No.Estate
10.60-89
No. Dep
Figure 15: Feature correlation heatmap of the Credit dataset.
40

---

Fig. 16 shows the feature correlation heatmap of the Magic dataset. The cogble-c feature pairs of this dataset include fConc and fConc1, fSize and fConc, fSize and fConc1.
Feature Correlation Matrix MAGIC_TELL TELE
1.00
fLength:
fWidth:
0.75
fSize:
0.50
fConc:
0.25
fConcl:
0.00
fAsym:
(M3Long:-
-0.25
fM3Trans:
-0.50
fAlpha:-
-0.75
fDist:
-1.00
fLength:
fWidth::
rSize:
fConc:
fConc1:
fAsym:
FM3Long:
fM3Trans:
fAlpha:
fDist:
Figure 16: Feature correlation heatmap of the Magic dataset.
41

---

N
Full Results of Unlearning Features that are Highly-Correlated with Others
For the Cali dataset, we have identified two cighly-eorrelated feature pairs in Appendix MapenddiM--attttude Latitude and Longitude, AveRooms and AveBedrms. Fig. I7 T8 and I9 show the evaluation results of unlearning Lati tude, Longitude, and AveBedrms, respectively.
Unleareed Feature: Latitude; Dataset: CAU
FOU. RASI
TRI
SRI
SDI
Modes
Ei-1
Model: Restot
Unleaminn Epocha
Liieerning Epsche
Uniesminng Epochs
Unieaming Epocha
Unleamiig Epocta
TRI
NASH+1
510-0
SCR-
mas0 care Epsche
to so and on eersses
2s 1o se air merssess
Model: FT-Fomer
Epachs
Epochs
Epacha
Ell
TRI-1
Unleaming Epochs
Unisaming Epochs
Usieaming Epochs
Unleaming Epecits
Unleaming Epschs
Figure 17: Evaluation results of unlearning Latitude of the Cali dataset.
Unlearned Longitude; Dataset:
TRI
RASI
SRI
SDI
Modol:
Eir1
02
1iH+1
RASSet
50H0
Model: Restet
Unleaming Epochs
Lisiearting Epoche
Unieaminn Epocha
Unieaminn Epecita
Unieaming Epochs
TRI
TRIe1
RASH
50H0
Model: FT.orrnr
1s K000 ai
Unlearning Epochs
ne Ria 100
xx 20 an as servecs
05
To 25 as dn eerrass
23 12 20 ai de so
Eirl
RASiet
5RH0
Unlenning Epochs
Usteaminn Epocht
Unleaming Epocits
Unileaming Eppcito
Unloaminng Epocits
Figure 18: Evaluation results of unlearning Longitude of the Cali dataset.
42

---

Unleamed Feature: AveBedrms; Dataset: CALI
Mo MLF
Curs
TOUL
-
SULL
TRi
RASI
SRI
SDI
RAR
re wa Unieariing Epache
co Unteaming Epeche
Uniearming Epocha
sereu srecuutiien Uniearring
ne Unieaming Epocia
RAS
RABH-
SRmO
0.00
Unieariing Epocht
Unteaming Epecto
Unisaming Epecita
Epocta
Unleaming Epocita
RAS
mm
TRI-1
on Uniearning Epochs
Uréeaming Epecte
di-12 30333 Unleaming Epochs
20 IC300 LINNER Uniearning Epocta
Unleaming Epocta
un
Figure Evaluation results of unlearning AveBedrms of the Cali dataset.
For the Credit dataset, have identified three highly-correlated feature pairs in Ap- pendix M NumbeeOOfTimmssSlayaaaaeee and WutbbeddlFTiindo-gggggsssssaaaa
Suutbprree.taass--ppppppppprarrr and humberrrfTiiidd---glllaaaaaaaaad
and NumberoffTimmsssoayyLaaaae Fig. 200 and
21 show the evaluation results of unlearning huteee-fffinns---pppppaaaahhheee and YumberOffineessoaaylla respectively.
Unlearned Feature: NumberOffimee0-
httper/oe/inntsollyyysseeeeeoeee Dataset: CREDIT
TRI
RASI
SRI
SDI
Bi-1
RAB
SRAa
Model: ResNed
Unieamiin Epocha
Uiieerniin Epochs
Unieaming Epochs
Unleaminn Epocta
Unleaming Epecta
TRU
TRim
RASIef
5RI-0
oF No madtc
nu ai snraaa
04
1o 20 es on enrama
cs 12:30 en a0120020
Model: TiFomer
Ei-l
TRi51
RAGieT
S01-0
Unleaming Epocha
Usieaminn Epochs
Unieaming Epocita
Unisaming Epocita
Unleaming Epocha
Figure 20: Evaluation results of unlearning Credit dataset.
of the
43

---

Unlearned Feature: NumberofTimsssOayssaaa Dataset: CREDIT
Model: MLF
Duys
.-- POUL
-.. SALL
TRI
RASI
SRI
SDI
Eir1
BRU-0
02
01
Model Rosket
a my Unieaming Epoche
uu Uniearning Epache
Unieaminn Epocha
Unieamiing
nu es en
Unleamiin Epocha
12
10
TRI-1
RASI-1
8R1-0
801-0
05
Model: FT-Formrr
Unieamiin Epocit
Uniearning Epocht
Unieaming Epocita
Unleaming Epecit
Unleaminn Epocts
RACE
1000 on 0B
Uniearning Epachs
m: RG3
Usleaming Epocta
08
Unisaming Epocita
20 de B0TSRE
12 30 Unleaming Epocts
Figure 21: Evaluation results of unlearning MlmberoffiimesSODyslaatte of the Credit dataset.
For the Magic dataset, have identified three highty-correlated feature pairs in Appendix M fConc and fConc1, fSize and fConc, fSize and fConc1. Fig. shows the evaluation results of unlearning fSize.
Unlearned Feature: fBize; Dafaset: MAGIC TELE
TELE
Modet MLP
Ours
FOUL
MUL
SDI
01
Model RosNet
Unieaming
an up
Unieerning Epache
Unieamiin Epocha
Unisaming Epocha
30 du 001SEES
is di or Unleamiin
Bi-1
RABI
RASSet
5000
vanmers
orFormer
Uniaaming Epoche
Lisieaninng Epochs
Unleaming Epocha
Uniesming Epecia
Unieaming Epoche
TRU
TRI:1
RAB
8R1-0
9
801-0
1S 10 ai snoceno
Usiearnin Epocht
Ria
10 al 1er Epechs
20 as BUITIES Unisaaing Epecit
zs 1o so oo
Figure 22: Evaluation results of unlearning fSize of the Magic dataset.
44

---

O
Full Results of Fairness Evaluation Metrics under Single-Feature Unlearning Setting
All results shown below are averaged across all four unlearned features (i.c., the most, the second most, the second last, and the last important ones), all three neural architectures, and all used datasets. The features "HouseAge", "age", "fCone:" in the CALI, CREDIT, MAGIC_TELE TELE datasets are considered sensitive attributes, with thresholds of 20, 40, 0.5 to distinguish between privileged and unprivileged groups, respectively.
Table 8: Averaged DP difference comparison.
Epoch
Method
1
10
50
100
200
400
600
800
1000
1500
0.0774
0.0330
0.0336
0.0127
0.0271
0.0147
0.0132
0.0206
0.0243
0.0097
FOUL
0.3791
0.2174
0.1654
0.3151
0.2065
0.0417
0.0598
0.1111
0.1054
0.2345
MIUL
0.1869
0.1319
0.0440
0.0954
0.0371
0.0424
0.0895
0.1026
0.0778
0.0291
Table 9: Averaged EO difference calculated via the true positive rate comparison.
Epoch
Method
100
200
400
600
800
1000
1500
Ours
0.0394
0.0281
0.0310
0.0158
0.0288
0.0234
0.0175
0.0222
0.0192
0.0192
FOUL
0.1728
0.1463
0.2902
0.1616
0.2665
0.7684
0.5679
0.3727
0.1668
0.1290
MIUL
0.1841
0.2069
0.1477
0.0747
0.0719
0.0601
0.0574
0.0683
0.0958
0.1170
Table 10: Averaged EO difference calculated via the false positive rate comparison.
Epoch
Method
10
50
100
200
400
600
800
1000
1500
0.1317
0.0462
0.0382
0.0156
0.0257
0.0160
0.0117
0.0207
0.0321
FOUL
0.0752
0.0750
0.1627
0.1071
0.3891
0.6737
0.5946
0.3348
0.0927
0.1227
MIUL
0.1857
0.1249
0.0318
0.0782
0.0662
0.0357
0.1001
0.1252
0.0941
0.0218
45

---

P Full Results of Feature Unlearning for CV/Image Classification Tasks
Fig. and 24 depict the results of unlearning visual features nose and eyes when performing classification for label class Gender.
1.00
TRi
El-1
RASI
TRI
0.75
50
RASI
Ours FOUL
MIUL
0.50
10 20 30
40
so
60 70 60 90100
10 20 30
40 50 60 70 60 90100
10 20 30 40 50 60 70 80 90100
Unlearning Epochs
Unlearning Epochs
Unlearning Epochs
Figure 23: Evaluation results of unlearning nose for label class Gender.
1.00
1.0
TRI=1
40
EI=1
RASI=1
RASI
Ours
0.75
W
20
FOUL
MIUL
0.50
Unlearning Epochs
Unlearning Epochs
Unleamning Epochs
Figure 24: Evaluation results of unlearning eyes for label class Gender.
Fig. 25 depicts the results of unlearning visual features nose when performing classification for label class Pointy Nose.
1.0
40
EI=1
RASH-1
TRI
RASI
Ours
20
FOUL
MIUL
0.6
Unlearning Epochs
Unlearning Epochs
Unlearning Epochs
Figure 25: Evaluation results of unlearning for label class Pointy Nose.
Fig. 26 depicts the results of unlearning visual features nose when performing classification for label
class Big Nose.
TRIET
40
El=1
RASIET
TRI
RASI
Ours
20
FOUL
0.6
30 40 50 90100
10
60 70
80
20 30 40 50 80 100000 Unlearning Epochs
Unlearning Epochs
Unlearning Epochs
Figure 26: Evaluation results of unlearning nose for label class Big Nose.
Fig. 27 depicts the results unlearning visual features eyes when performing classification for label class Narrow Eyes.
1.00
EI=1
RASI=1
TRI
50
RASI
Ours
0.75
FOUL
MIUL
0.50
0.6
80 90100 Unlearning Epochs
30 40
1 30 40
90
100
10 40 50 60 80 Unleaming Epochs
Unlearning Epochs
Figure 27: Evaluation results of unlearning eyes for label class Narrow Eyes.
46

---

Full Experimental Results of Multi-Feature Unlearning for Tabular Dataset
The following figures from Fig. 29 to Fig. depict evaluation results w.r.t defined all five evaluation metrics across all used datasets for multi-fcature unlearning, with results presented in from Table [T to Table 13 for cross comparison.
Table 11: Comparison of unlearning evaluation results on Comp dataset. The terms "Eva.Me." and "Algo." " are abbreviations for "Evaluation Metries" and "Algorithm", respectively.
Algo
Epocks
10835
0.55%
6-0.5
0.215
1007
100%
100%
0pm
1035 = 1.1%
99%5 : 0.0%
94X 4:1 1.55
63% = 0.6%%
80% 0.77%
9075
1005-8-0.00 0.30%
97X
2:0 0.05
07%
4-0.4%
0855 = 0.8%
98%
6.0.5
7007
X7
33
3.5
1.5
1.3
0.T
4077
177
1.6
1.3
133
0.5
0.
0.5
0.4
0.3
17m
36
4.9
3.1
25
20
7037
503 166
893y 1.17%
10% 1EAN
BETS 10.00
RAS 1.000
TEC
5Y96
1000 1100
03300
5111 13.099
0.00%
180%
5.0% 1.655
8.0%
7/00
80RE 0.58%
7.16%
0.155
7.65
0.15
7.085
0.85
81FE
0.155
7A00 0.55
6.0%
0.8%%
1.0%
1.00 1 83
4.0% 0.7%
200
0.25%
1.09
0.155
1.0%%
0.15%
1.0% 11.5%
10W.LL 0.95
Oun
FOU,
KOU MiLL
22 Undearinn Epocts
Ustearin
Unilarinng Epects
(a) Comp-TRI
(b) Comp-El
(c) Comp-RASI
(d) Comp-SRI
(e) Comp-SDI
Figure 28: Unlearning evaluation results of the Comp dataset under the multi-feature unlearning setting.
47

---

Table 12: Comparison of unlearning evaluation results Pol dataset. The terms "Eva.Me." and "Algo." are abbreviations for "Evaluation Metries" and "Algorithm", respectively.
Alpn
100
1813
+-0.53
18195
14m
1779 1 0..6%
175%%
2.5%%
1.00% 8 25.29%
110%
1 0.01%
1155%
1.35%%
1.4%
1455%
6.24 2.%%
10556 11 1.4.%%
102% 1.04%
1000 1-4.1-44.9.
FOOL
199
12
20
8.5
2.5
1.9
1.4
1.1
M00
1.6
1.5
1.4
1-3
1.0
0.5
6.3
2315
01.55
10th
5296
0.99
539% - 1.100
605 9 1666
N855
1.7%
MM5 6 3.6
99% 2.99
9609
9613 8 4.7%
940% 1.0.0
999S 0.05
2856
09.5 1.505
05.0 11.55
11305
12% 1.7
881
1003 21
1605 1.23
3855 0.433
0075 1.155
=
040
0008 0.00
0155 4-111
7855 0-45
9.08
4.0% 9.0%
1026
AA 11.00
1555 8 0.68
145% = 0.08
8.05 6
1005 0.98
1,005 5: 0.38
0.375
1.0% 0.355
07:4400.5
03:4 03-4-0%
0% 0.23
Our
1.0
1.5
Out
ME.L
FOU.
Dan
Dara
0.1
Tiae
RASH+
o
04228880--00
5.0 100.00000000
Urivaring Specks
Ureaminn Spacis
Unbanding Specks
Urioming Spocks
Spacks
(a) Pol-TRI
(b) Pol-EI
(c) Pol-RASI
(d) Pol-SRI
(c) Pol-SDI
Figure 29: Unlearning evaluation results of the Pol dataset.
Table 13: Comparison of unlearning evaluation results on Eye dataset. The terms "Eva.M.." and "Algo." are abbreviations for "Evaluation Metries and "Algorithm", respectively.
Eva.Mc.
Rpodrs
400
1000
TRJ
1002
0,955
1097
61.55
134%% 2 CLER
JINSS 1.55 &.WW
10755 6.1.55
1067 = 0.55%
LOETI 2.00
LOS 2-000
0.772
100% 1.8%)
1025
0.355
101
100%
1.45
10355 0.635
1007.
1025,
2.8%%
10255
2.3%
1022
7030
105
11
11
3.5
3.3
1.5
1-1
1.1
1.5
1.4
1-2
0.8
106
100
3062
11.56
1690 0123
6156 14356
5855 2 0.390
1A7% 11266
5631 0.00
6790
0.330
10.5%
5750 9..0
1.4%
73%
3.5%
799
6 2.892
K81 9.35
NT56 2.00%
1.77
MAG 1.99%
7964
a 1.8%
49 2.03
405 1.8%
187 2 0.8
1740 2.00
1.05 2 0.2.2
1.03 0.80
1.0% 0.1%
0S 0%
100% 6.0%
5535 1.0%
17A 5
6
807
875
91.5 4.5%
93% 1-18
07%
0.223
Oam
406 = 0.555
4.035 0..00
2,0% = 0.5%
3 de 1.25
1.0% 0.55
1/0 0.10
1.0% 100%::000 0.8%
100 0.35
100 = 0.395
1X08 0.023
D2ra FOU.
Oura
Oura
FOLL
3.56
POLL
1.0
19.1
3.55
On
032
3.0
VLLL
RA
022
022
28300920808
8. 9
2
28300022008
Useardng Spocts
Ureaming Spocia
Undarding Spocks
Unsariing Speess
Unearding Spocts
(a) Eye-TRI
(b) Eye-EI
(c) Eye-RASI
(d) Eye-SRI
(c) Eye-SDI
Figure 30: Unlearning evaluation results the Eye dataset.
48


Reviews:
[{"review_id": "uMFsWlPzrm", "reviewer": "Reviewer_wgRy", "summary": "The paper proposes a two-step method approach for selectively forgetting features: first shuffles the target feature(s) in the original training data, and then fine-tune the original model on this shuffled dataset. They provide a theoretical guarantee of this proposed method for effective feature unlearning, and also empirically show the proposed method is effective and efficient across experiments across both tabular and image datasets.", "questions": "1. The paper includes unlearning experiments on different types of features, e.g., features with high Shapley importance or those strongly correlated with other inputs. Have you observed any patterns or differences in how your method (or the baselines) perform across these cases? Are there particular feature types that are easier or harder to unlearn?", "limitations": "See Weaknesses section.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n1. The proposed algorithm is simple and practical to implement. It requires only permuting a selected feature and performing standard fine-tuning.\n2. The paper offers a sound theoretical analysis of the unlearning process. \n3. The empirical evaluation is fairly comprehensive, using multiple complementary metrics to assess both unlearning effectiveness and computational efficiency. The experiments also cover a diverse range of datasets and architectures.\n\nWeaknesses:\n1. The writing and overall presentation could be improved. Some notations, particularly in the formal definitions and theoretical sections, are confusing or insufficiently explained.", "was_revised": true, "final_justification": "Most of my concerns have been adequately addressed in the rebuttal. I appreciate the authors’ clarifications and additional results. However, I share the concern raised by Reviewer U1oC regarding the novelty of the proposed method. The idea of random shuffling has been commonly used in prior unlearning work (e.g., [1] for example-level unlearning), though not explicitly in the context of feature unlearning. That said, I acknowledge the empirical effectiveness of the proposed method in the feature unlearning setting. This reduces the weight I assign to the novelty concern in my evaluation.\n\nNo major issues remain unresolved from my side, and I found the authors’ responses thoughtful and helpful, so I decide to maintain my initial rating.\n\n[1] Fan, Chongyu, et al. \"Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation.\"", "rebuttal": "We thank the reviewer for their feedback and for engaging with our work. We have carefully considered the comments and revised our manuscript/clarified our responses accordingly.\n\n***Response to writing and overall presentation***\n\nThank you for your feedback regarding the clarity of writing and notation. We appreciate the reviewer pointing this out, and we have taken steps to improve the overall presentation in the revised manuscript. Specifically, we have revised and clarified the notations in the formal definitions and theoretical sections, particularly in places where some symbols may have benefited from additional explanation. To further aid readability, we have included a dedicated table of notations in Appendix, which consolidates the definitions of all symbols, parameters, and variables used throughout the paper. This appendix also includes a brief explanation of the key mathematical tools we rely on (e.g., total variation distance and conditional independence) for readers who may not be familiar with them.\n\nWe hope these revisions make the theoretical sections more accessible and precise, and we welcome any further suggestions to improve clarity.\n\n***Response to the observations on patterns of unlearning various features***\n\nThank you for this thoughtful question. We do observe some meaningful patterns in how different types of features affect unlearning performance, although these were only briefly mentioned in the original experimental section. To address this, we will expand the discussion in the revised manuscript to provide a more detailed analysis.\n\nFor single-feature unlearning, our method shows consistently strong performance, regardless of the importance or influence of the target feature. As shown in Figure 2 and Appendix F, even for features with high SHAP values, our approach achieves near-complete unlearning within approximately 150 epochs. This stability stems from the fact that our method explicitly removes statistical dependence by reshuffling the target feature across the entire training set, effectively breaking both direct and indirect correlations. The process does not rely on learning a complex adversarial signal, making it less sensitive to the feature's original importance.\nIn contrast, baselines such as FOUL tend to perform better on less important features and struggle more with high-impact ones. This is likely because FOUL relies on an adversarial feature discriminator, which may face difficulty suppressing deeply entangled or high-importance signals within the model representation.\n\nThat said, we did observe that unlearning multiple features simultaneously is more challenging for all methods, including ours. These cases generally require longer training and exhibit slightly lower performance, likely due to the increased complexity of disentangling joint dependencies among multiple correlated features.\n\nWe will clarify these observations in the revised manuscript and expand our discussion in Appendix F to include a more detailed breakdown of performance trends across different feature types."}, {"review_id": "Ua0XIv50DM", "reviewer": "Reviewer_ZoQd", "summary": "This paper presents a feature unlearning method that removes the influence of specific features from trained models. Unlike traditional machine unlearning methods focused on data instance removal, the work introduces a shuffling-based feature unlearning method, where target feature values are randomly shuffled in the training data, followed by fine-tuning. The paper provides theoretical guarantees that this process removes statistical dependency between the shuffled features. Theoretical validation is supported through mutual information analysis and Shapley value equivalence. The authors propose clear metrics (e.g., TRI, EI, RASI, SRI, SDI) and validate their method across tabular and image datasets, showing that their method achieves comparable performance to retraining from scratch while being significantly more efficient.", "questions": "Please see Weaknesses.", "limitations": "Yes.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n* The paper presents a simple yet rigorously supported method with clear mathematical foundations and convergence proofs. The methodology is thoughtfully constructed and the empirical evaluations are comprehensive.\n\n* While prior work has studied instance unlearning or model detachment, the idea of using random feature shuffling followed by fine-tuning as a strategy for feature-level unlearning seems novel. \n\n* The empirical results across both tabular and image datasets show that the proposed method removes influence of designated features and preserves the information content of remaining features.\n\nWeaknesses:\n\n* The proposed method requires access to the full training dataset. This dependency may be impractical in scenarios where data retention is restricted post-training or where training is performed on large-scale datasets that are costly to store or access.\n\n* The theoretical foundations rely on assumptions that may not hold in real-world settings, especially for datasets exhibiting temporal drift or non-i.i.d. behavior.\n\n* While FOUL and MIUL are evaluated, the empirical study could be strengthened by including additional baselines—particularly those involving adversarial feature disentanglement or post-hoc pruning strategies.\n\n* The motivation includes ethical concerns related to sensitive attributes in image domains, yet no experiments explicitly explore the removal of attributes such as race or gender which would be a more meaningful case for machine unlearning.\n\n* To further demonstrate robustness and effectiveness in real-world scenarios, experiments on more complex visual features for image classification are needed. Currently, the image task focuses on removing relatively simple features (e.g., nose and eyes), with classification tasks including gender, big nose, pointy nose, eyeglasses, and narrow eyes. Expanding the target attributes for removal and classification would better showcase the method’s generalizability.\n\n* Qualitative examples could improve clarity. Although Appendix G includes examples of processed images with shuffled visual features, it only provides a single example. Including more diverse visual results would help illustrate the method’s behavior and impact.", "was_revised": true, "final_justification": "The rebuttal does a good job in explaining the theoretical context and assumptions, which I appreciate. Although not at the level I would ideally like it to be, the validation is also better now. Overall, a good paper that ia ready to be published with the additional information in the rebuttal.", "rebuttal": "We thank the reviewer for their feedback and for engaging with our work. We have carefully considered the comments and revised our manuscript/clarified our responses accordingly.\n\n***Response to the assumption of access to the full training dataset***\n\nOur approach deliberately assumes access to the full training dataset, since the core mandate of machine unlearning is to eradicate the model’s dependence on specified data—not merely to sidestep access to the original training set. Methods that impose a rigid “no-access-to-data” constraint fundamentally compromise the integrity of unlearning by prioritising convenience over correctness, thereby failing to achieve robust, auditable, and faithful unlearning. Such a trade-off thus results in diluted guarantees and unverifiable unlearning outcomes.\n\nMoreover, as the aim of our method is to re-establish the original empirical joint distribution while selectively breaking the dependence on the target feature, it is only achievable by reshuffling the feature across the entire training set (as shown in our theoretical proof), ensuring that all statistical relationships—especially between correlated variables—are properly preserved or neutralised. Without full data access, such reshuffling would introduce unintended distribution shifts or artifacts, thereby compromising the validity of unlearning. \n\nWe acknowledge that in certain regulatory or operational contexts, full access to the original training data may not be possible at unlearning time. In such cases, our method may not be directly applicable. However, we view this limitation not as a flaw, but as a deliberate design choice to prioritise unlearning fidelity and theoretical guarantees. Organisations can retain light-weight, privacy-preserving statistics (e.g., marginal feature distributions or conditional histograms) computed before deletion requests. These can support approximate feature removal via pseudo-shuffling or data regeneration, though the resulting guarantees will necessarily be weaker than our full-data method.\n\n***Response to the assumption of temporal shift or non-i.i.d. behavior***\n\nWe adopt the i.i.d. and stationarity assumptions for three main reasons: \n- The assumptions of i.i.d. samples and stationarity serve as a standard theoretical simplification that ensures mathematical tractability and allows us to build a rigorous understanding of model behaviour *under controlled conditions*. \n\n- Moreover, our empirical evaluations demonstrate strong performance of our method across all tested datasets, indicating empirical robustness that extends beyond the idealised theoretical assumptions. Such empirical success reveal the capability of our method in handling real-world datasets which may not fully align with our assumptions and have substantial internal dependencies and correlations.\n\n- These assumptions are standard throughout the machine learning and unlearning literature [1][2][3], and form the foundation of nearly all theoretical analyses of unlearning–retraining equivalence, e.g., SISA, FOUL, MIUL, where the latter two have been implemented as baselines in our experiments. Such frameworks consistently adopt empirical risk minimisation under the premise of a stable, stationary data-generating process.\n\nIn the revised manuscript, we have made this discussion clearer and explicitly distinguish between theoretical guarantees and practical robustness.\n\n[1] Warnecke, Alexander, et al. \"Machine unlearning of features and labels.\" arXiv preprint arXiv:2108.11577 (2021).\n\n[2] Tao Guo, Song Guo, Jiewei Zhang, Wenchao Xu, and Junxiao Wang. Efficient attribute unlearning: Towards selective removal of input attributes from feature representations, 2022.\n\n[3] Xu, Heng, et al. \"Don't Forget Too Much: Towards Machine Unlearning on Feature Level.\" IEEE Transactions on Dependable and Secure Computing (2024).\n\n***Response to additional baselines that involving adversarial feature disentanglement or post-hoc pruning***\n\nFirst, we would like to clarify that **FOUL**, the first baseline we evaluated, **is itself an adversarial method**. Specifically, FOUL trains a feature discriminator in an adversarial setting to ensure that the representation does not encode information about the feature to be unlearned. This aligns closely with the family of adversarial feature disentanglement techniques the reviewer referred to. \n\nSecondly, we include **additional baselines** that employ a **model-centric adversarial masking** strategy [3], in addition to two already-implemented baselines, i.e., FOUL and MIUL. Notably, our approach is fundamentally different from the strategy used in [3]. Instead of introducing complex architectural modifications, our method employs a simple yet effective data permutation (i.e., shuffling) technique that directly disrupts statistical dependencies. More importantly, our approach is backed by **theoretical guarantees** of achieving statistical independence, which distinguishes it from methods like [3] that lack such formal assurances.\n\nAs an example, the results on the Credit dataset below confirm our method's effectiveness against this newly added baseline.\n|Eva.Me.|Algo.|1|10|50|100|200|400|600|800|1000|1500|\n|:---|:---|:---|:---|:---|:---|:---|:---|:---|:---|:---|:---|\n|**$TRI$**|[3]|102% ± 0.4%|102%±0.6%|102%±0.3%|102%±0.5%|102%±0.7%|102%±0.5%|101%±0.5%|102±0.5%|102%±0.4%|102%±0.3%|\n| | Ours |**100%±1.0%**|**99%±0.8%**|**99% ± 0.8%**| **100% ± 0.7%** | **100% ± 0.6%** | **100% ± 0.4%** | **100% ± 0.5%** | **100% ± 0.5%** | **100% ± 0.6%** | **99% ± 0.7%** |\n| **$EI$** | [3] | 1.7 | 1.7 | 1.5 | 1.4 | 1.1 | 0.8 | 0.7 | 0.5 | 0.5 | 0.3 |\n| | Ours | **2431** | **272** | **47** | **25** | **11** | **5.7** | **3.8** | **2.7** | **1.7** | **1.2** |\n| **$RASI$** | [3] | 83% ± 0.4% | 83% ± 0.4% | 83% ± 0.4% | 83% ± 0.6% | 83% ± 0.4% | 83% ± 0.3% | 83% ± 0.4% | 83% ± 0.6% | 83% ± 0.5% | 83% ± 0.6% |\n| | Ours | 88% ± 1.1% | **93% ± 0.5%** | **94% ± 0.5%** | **95% ± 0.3%** | **96% ± 0.3%** | **97% ± 0.4%** | **98% ± 0.2%** | **99% ± 0.2%** | **99% ± 0.1%** | **99% ± 0.2%** |\n| **$SRI$** | [3] | 103% ± 2.9% | 103% ± 3.2% | 103% ± 3.5% | 102% ± 4.3% | 103% ± 2.8% | 102% ± 3.0% | 101% ± 2.4% | 100% ± 3.7% | 102% ± 4.6% | 99% ± 3.5% |\n| | Ours | 59% ± 10% | **25% ± 5.8%** | **20% ± 2.8%** | **17% ± 3.5%** | **13% ± 1.6%** | **9.0% ± 3.4%** | **7.0% ± 1.1%** | **4.0% ± 1.4%** | **4.0% ± 1.0%** | **0.3% ± 1.6%** |\n| **$SDI$** | [3] | 13% ± 0.4% | 13% ± 0.4% | 13% ± 0.5% | 13% ± 0.6% | 13% ± 0.4% | 13% ± 0.4% | 13% ± 0.3% | 13% ± 0.5% | 13% ± 0.6% | 13% ± 0.5% |\n| | Ours | 8.0% ± 1.3% | **3.0% ± 0.8%** | **3.0% ± 0.4%** | **2.0% ± 0.5%** | **2.0% ± 0.2%** | **1.0% ± 0.4%** | **1.0% ± 0.1%** | **0.1% ± 0.2%** | **0% ± 0.1%** | **0% ± 0.2%** |\n\n***Response to motivation related to unlearning sensitive attributes***\n\nOur method is capable of unlearning **any individual feature or combination of features**, **including sensitive attributes, like gender or race** (referred to Definition 3.1 and Theory 4.4 in the original manuscript). This flexibility is a direct consequence of both our *theoretical guarantees* and *empirical design*. Specifically, we provide formal proof that our approach removes statistical dependence between the unlearned feature and the model’s representation or output—regardless of the semantic nature of the feature itself.\n\nTo support this claim, we also conducted extensive evaluations across a wide range of **tabular and visual datasets**. In particular, for the visual datasets, we have targeted diverse features such as **nose shape, eye size, and eyeglasses**. These features vary substantially across individuals and may capture latent demographic cues, including those related to identity and fairness. \n\nFurther, we highlight our results on the **CALI** dataset, where we successfully unlearned the **DebtRatio feature** (see Appendix L, table 6, page 31 in the original manuscript)—a **sensitive financial indicator** tied to personal debt levels. The ability of our method to remove this feature while preserving model utility further underscores its effectiveness for privacy- and fairness-sensitive applications.\n\nIn the revised manuscript, we have clarified these points and expanded our discussion on how our approach applies to unlearning sensitive features such as race, gender, and socioeconomic attributes—areas that are closely aligned with the core motivation of our work.\n\n***Response to experiments on more complex visual features***\n\nThe authors are not entirely certain what is meant by *“more complex visual features,”* but we attempt to address the question based on our interpretation. *In raw, pixel-based human facial images*, *features such as the eyes, eyebrows, nose, mouth, and ears are semantically identical*. Our method has already been evaluated on key features like the eyes, nose, and their combination (eyes + nose) across various classification tasks. **Adding additional facial attributes of a similar nature does not introduce further methodological complexity** for our approach, which directly processes raw image inputs without relying on specialised preprocessing. Moreover, identifying specific facial regions such as the nose or eyes or more ambiguous features is not the main focus of our study. \n\nIf we have misunderstood the reviewer’s request, please let us know—we would be happy to provide additional clarification or experiments as needed.\n\n***Response to more qualitative examples***\n\nIn Appendix G of the original manuscript, we provided an image example illustrating the unlearning task for the nose feature to demonstrate the core idea behind our process. In the revised manuscript, we have expanded Appendix G to include a broader set of qualitative examples, covering all the test cases conducted on the image dataset. The enriched results now include diverse identities and multiple feature removal scenarios to provide a more comprehensive visual summary of the method’s effect."}, {"review_id": "yY9omgYsoK", "reviewer": "Reviewer_U1oC", "summary": "This paper presents a feature unlearning algorithms by first generating corrupted data through feature perturbation based on its possible values uniformly and then fine-tune the model based on the corrupted data. The paper mainly focuses on the its theoretical guarantee of feature correlation removal under the condition of infinite data available.  Experiments compared the proposed approach with two baselines and a tabular data and a image data, but the paper only reported the results of tabular data.", "questions": "Could authors simply the proof? The basic idea is to show marginalizing target features contribution can help removing its correlations with other features. The idea should be easily deliverable through less equations. Is it very necessary to show the big chunk of proof in the main paper?", "limitations": "No societal impact limitation found in this paper.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n1. The proof of optimization guarantee looks interesting.\n\nWeaknesses:\n1. The proposed method is quite commonly used in practice, spanning from unlearning to model explanations, while it seems not very novel to be published as an independent paper. As early as 2021, a paper [1] with hundreds of citations was published, briefly mentioning the idea. \n\n2. Critiquing existing works but not comparing them. The paper, in its literature review, mentions multiple feature unlearning algorithms, but the authors do not compare the proposed algorithm with those baselines in the paper. Moreover, several well-known baselines were cited but not properly mentioned in the related work section. E.g. [2]\n\n3. The experiment is not complete and also not convincing. The paper mentioned that there are two datasets in the experiments, but it only reported the results for the tabular data. (Yes, I did see there is a six-line description about the CelebA dataset, but the description reads like the authors making it tabular data to use.) In addition, all experimental results are in the form of a \"something vs a number of epoch\" curve, which is very unconvincing given that multiple metrics are correlated. E.g. EI vs RASI. One can easily reduce EI by increasing the number of epochs. I suggest authors use the proper format to present the paper's results. \n\n4. The literature review is insufficient. Multiple machine unlearning papers mentioned feature unlearning, even though their purpose is often to find optimally searched replacements of target features rather than random sampling. E.g. [3].\n\n\n[1] Warnecke, Alexander, et al. \"Machine unlearning of features and labels.\" arXiv preprint arXiv:2108.11577 (2021).\n\n[2]Xu, Heng, et al. \"Don't Forget Too Much: Towards Machine Unlearning on Feature Level.\" IEEE Transactions on Dependable and Secure Computing (2024).\n\n[3]Martinsson, John, et al. \"Adversarial representation learning for synthetic replacement of private attributes.\" 2021 IEEE International Conference on Big Data (Big Data). IEEE, 2021.", "was_revised": true, "final_justification": "The author provides sufficiently more information about the paper's novelty.", "rebuttal": "We thank the reviewer for their feedback and for engaging with our work. We have carefully considered the comments and revised our manuscript/clarified our responses accordingly.\n\n**Response to the novelty of our paper**\n\nWe would like to respectfully clarify that our method is both **not** \"quite commonly used\"  and **not** mentioned in reference [1]. Our novelty is summarized in the following three aspects.\n- *Methodological Difference*: Our method performs a **global random permutation** (i.e., shuffling) on the feature to be unlearned. This breaks the feature's statistical correlation with the label and other features. The method in [1] is fundamentally different; it uses influence functions to compute a **local, approximate update** to the model's parameters in response to a specific perturbation (i.e., adding noise or revoking it). **Global shuffling is not discussed in their work.**\n- *Novelty and Literature Context*: To the best of our knowledge, global feature shuffling for unlearning is a new concept in the reviewed existing studies, as supported by comments from **Reviewers ZoQd and nUD2 on our method's novelty**.\n- *Empirical Superiority*: In our original manuscript, **we implemented the method from [1] as a primary baseline (termed FOUL)**. Our experimental results showed that our method consistently and significantly outperforms FOUL across all evaluation metrics.\n\nHence, our shuffling-based feature unlearning method is a novel contribution to the field, distinct from the influence-function-based approach of reference [1].\n\n[1] Warnecke, Alexander, et al. \"Machine unlearning of features and labels.\" arXiv preprint arXiv:2108.11577 (2021).\n\n**Response to baseline comparison**\n\nFirstly, we would like to clarify that, in our original manuscript, **we identified two key related works in the field of feature unlearning and implemented them to compare with our proposed unlearning algorithm**. The first identified work is the above mentioned FOUL [1] and the other is the work by [2], termed MIUL. The MIUL uses a representation detachment loss defined by mutual information to eliminate specific features. However, this method lacks a theoretical guarantee for the unlearning process. Also, mutual information is simultaneously estimated during unlearning, thereby introducing potential bias. In our original manuscript, our experiments demonstrated the superior performance of our method across all datasets and metrics.\n\nSecondly, we appreciate the reviewer suggesting that some additional baselines were not properly mentioned in the literature review section, such as [3]. In our revised manuscript, we have 1) discussed [3] in the literature review part and 2) implemented [3] as another baseline in addition to FOUL and MIUL.\n\nOur method differs fundamentally from the complex, model-centric adversarial masking used in [3]. Our simpler data permutation (i.e., shuffling) directly breaks statistical correlations and, critically, is supported by theoretical guarantees of achieving statistical independence—a distinct advantage that [3]'s framework lacks.\n\nAs an example, the results on the *Credit* dataset below confirm our method's effectiveness against this newly added baseline. The complete experiments and results have been updated in the revised manuscript.\n\n| Evaluation Method | Algorithm | Epoch 1 | Epoch 10 | Epoch 50 | Epoch 100 | Epoch 200 | Epoch 400 | Epoch 600 | Epoch 800 | Epoch 1000 | Epoch 1500 |\n| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |\n| **$TRI$** |[3] | 102% ± 0.4% | 102% ± 0.6% | 102% ± 0.3% | 102% ± 0.5% | 102% ± 0.7% | 102% ± 0.5% | 101% ± 0.5% | 102 ± 0.5% | 102% ± 0.4% | 102% ± 0.3% |\n| | **Ours** | **100% ± 1.0%** | **99% ± 0.8%** | **99% ± 0.8%** | **100% ± 0.7%** | **100% ± 0.6%** | **100% ± 0.4%** | **100% ± 0.5%** | **100% ± 0.5%** | **100% ± 0.6%** | **99% ± 0.7%** |\n| **$EI$** | [3] | 1.7 | 1.7 | 1.5 | 1.4 | 1.1 | 0.8 | 0.7 | 0.5 | 0.5 | 0.3 |\n| | **Ours** | **2431** | **272** | **47** | **25** | **11** | **5.7** | **3.8** | **2.7** | **1.7** | **1.2** |\n| **$RASI$** | [3] | 83% ± 0.4% | 83% ± 0.4% | 83% ± 0.4% | 83% ± 0.6% | 83% ± 0.4% | 83% ± 0.3% | 83% ± 0.4% | 83% ± 0.6% | 83% ± 0.5% | 83% ± 0.6% |\n| | **Ours** | **88% ± 1.1%** | **93% ± 0.5%** | **94% ± 0.5%** | **95% ± 0.3%** | **96% ± 0.3%** | **97% ± 0.4%** | **98% ± 0.2%** | **99% ± 0.2%** | **99% ± 0.1%** | **99% ± 0.2%** |\n| **$SRI$** | [3] | 103% ± 2.9% | 103% ± 3.2% | 103% ± 3.5% | 102% ± 4.3% | 103% ± 2.8% | 102% ± 3.0% | 101% ± 2.4% | 100% ± 3.7% | 102% ± 4.6% | 99% ± 3.5% |\n| | **Ours** | **59% ± 10%** | **25% ± 5.8%** | **20% ± 2.8%** | **17% ± 3.5%** | **13% ± 1.6%** | **9.0% ± 3.4%** | **7.0% ± 1.1%** | **4.0% ± 1.4%** | **4.0% ± 1.0%** | **0.3% ± 1.6%** |\n| **$SDI$** | [3] | 13% ± 0.4% | 13% ± 0.4% | 13% ± 0.5% | 13% ± 0.6% | 13% ± 0.4% | 13% ± 0.4% | 13% ± 0.3% | 13% ± 0.5% | 13% ± 0.6% | 13% ± 0.5% |\n| | **Ours** | **8.0% ± 1.3%** | **3.0% ± 0.8%** | **3.0% ± 0.4%** | **2.0% ± 0.5%** | **2.0% ± 0.2%** | **1.0% ± 0.4%** | **1.0% ± 0.1%** | **0.1% ± 0.2%** | **0% ± 0.1%** | **0% ± 0.2%** |\n\n[2] Tao Guo, Song Guo, Jiewei Zhang, Wenchao Xu, and Junxiao Wang. Efficient attribute\nunlearning: Towards selective removal of input attributes from feature representations, 2022.\n\n[3]Xu, Heng, et al. \"Don't Forget Too Much: Towards Machine Unlearning on Feature Level.\" IEEE Transactions on Dependable and Secure Computing (2024).\n\n**Response to used datasets in experiments**\n\nThank you for the opportunity to clarify our experiments. **We would like to highlight that the CelebA image dataset was not converted into a tabular format. Our unlearning method was applied directly to the visual features within the images themselves.**\n\nAs detailed in Section 5.2 of the original manuscript, we addressed the challenge of implicit image features by shuffling specific image regions corresponding to semantic attributes. For the used CelebA image dataset, we unlearned features like \"nose\" and \"eyes\" by shuffling the corresponding image patches across the training set. Appendix G (in the original manuscript) provides a clear visual example of this process.\n\nThese image-based experiments, with full results for single and multi-feature scenarios in Figure 3 and Appendix N (in the original manuscript), complement our extensive evaluations on **six diverse tabular datasets**. **Our experiments encompass seven datasets in total (six tabular and one image datasets), not just two**. Various features has been unlearned within each used dataset to validate the effectiveness of our method. We trust this confirms the comprehensive nature of our experimental validation.\n\n**Response to evaluation metrics**\n\nWe chose the \"metric vs. number of epochs\" curves to illustrate the **convergence dynamics** of the unlearning process, which we believe is **a crucial aspect of evaluation**. These plots show not just the final outcome, but also how efficiently each method reaches an effective state. For example, our results demonstrate that our unlearning method consistently achieves more effective unlearning (e.g., high RASI and TRI near 1.0) *within a relatively small number of epochs*. At this point of convergence, the efficiency (EI) remains very high, **showcasing that our method does not require sacrificing efficiency for effectiveness**.\n\nRegarding the EI vs. RASI trade-off, while it is true that running more epochs generally improves unlearning (higher RASI) at the cost of efficiency (lower EI), our experiments show that **our method reaches a near-perfect RASI long before the EI becomes impractically low**. This rapid convergence is a key advantage over baselines, which may converge slowly or fail to reach an acceptable level of unlearning regardless of the number of epochs.\n\nTo make the results more direct and easier to compare, in the revised manuscript, we have adopted the format used in our multi-feature unlearning analysis (Tables 7, 8, and 9) and added summary tables for the single-feature experiments. These tables now report the values for all key metrics (TRI, EI, RASI, SRI, SDI) at a specific epoch count where our method has clearly converged, providing a clear, at-a-glance comparison that complements the dynamic curves.\n\n**Response to insufficient literature review**\n\nIn the revised manuscript, we have included the reference [4] (that the reviewer mentioned) into our literature review as follows. The work [4] proposes a data privatization technique, not exactly a model unlearning method, that uses an adversarial filter-generator architecture to first remove a sensitive attribute and then synthetically replace it with a new, randomly sampled value. Their goal is to create a transformed, privacy-preserving dataset, which fundamentally differs from machine unlearning's objective of modifying a pre-trained model to make it forget learned information. Consequently, while our methods directly alter an existing model's parameters to achieve the unlearning of features, their technique serves as a data pre-processing step to anonymize a dataset before its use.\n\n[4]Martinsson, John, et al. \"Adversarial representation learning for synthetic replacement of private attributes.\" 2021 IEEE International Conference on Big Data (Big Data). IEEE, 2021.\n\n\n**Response to proof simplification**\n\nIn the revised manuscript, we have streamlined the proof presentation. In addition, we would like to highlight that, though the idea of shuffling seems to be intuitive, a rigorous proof is necessary to formally guarantee that our method is effective. Our proof first establishes that shuffling creates statistical independence and then connects this property to the final model, showing it is $(\\epsilon,\\delta)$-close to a retrained one.\n\nIn the revised manuscript, we have included concise proof sketch in the main paper to improve readability and moved the detailed, complete proof to the appendix."}, {"review_id": "dX09n9KhZI", "reviewer": "Reviewer_nUD2", "summary": "This paper introduces a simple approach for feature unlearning in tabular and image data which is backed up theoretically and evaluated with extensive experiments.", "questions": "Why did the authors leave out bias/discrimination/privacy metrics from the evaluation? (main reason for the currently lower score; I am happy to increase my score if this is addressed (or if I misunderstood something))", "limitations": "yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- Simple and elegant method with theoretical backing\n- Extensive experimentation across datasets, model architectures, and modalities\n- Original and well-written paper\n\nWeaknesses:\n- Lack of citations in 5.1 - where does TRI, RASI, etc. come from?\n- The main weakness of this paper is that the authors do not investigate if an attacker can infer if the feature was used during the original training or not. This is a typical metric (e.g. via Membership Inference Attacks in class unlearning) for unlearning, as accuracy alone often does not tell the full picture. The authors state “Detecting privacy leaks in learning \nmodels, which is a complex issue, falls outside the scope of this research.” Given that Figure 1 uses clinical data as an example, shouldn’t data privacy be discussed? Directly linked to this, if we can detect that the model was trained with a feature, a bias may still remain from that feature that was not properly removed. For this I would have expected metrics from related fields (bias & discrimination) in this paper. The practical significance in unlearning features lies in privacy and bias, therefore this is a weakness of this paper.", "was_revised": true, "final_justification": "The authors have addressed my remaining concerns (additional experiments to show MIA results that were not present in the original paper) in the rebuttal. I have therefore increased my score to accept.", "rebuttal": "We thank the reviewer for their feedback and for engaging with our work. We have carefully considered the comments and revised our manuscript/clarified our responses accordingly.\n\n**Response to “Lack of citations in 5.1 - where does TRI, RASI, etc. come from”**\n\nThank you for your suggestions on adding references to the evaluation metrics.\n\nThe metrics Test Retention Index (TRI), Efficiency Index (EI) are stemmed from the reference [1], which was accepted by EuroS&P 2025.\n\nOur study originally designed the metric Unlearning Robustness Against Shuffling Index (RASI) based on the shuffling characteristic of our shuffling-based approach. To calculate this metric, we shuffled the values of unlearned features within the test set and then observed whether such shuffling affects prediction outcomes. As a result, RASI can examine whether the unlearned model has successfully eliminated dependency on the unlearned feature regarding model predictions.\n\nThe other two metrics, i.e., SHAP Retention Index (SRI) and SHAP Distance-to-zero Index (SDI), were inspired by explainable AI techniques. In our study, we calculate each feature’s importance using the SHapley Additive exPlanations (SHAP). By applying an effective unlearning algorithm, the unlearned feature’s importance should be reduced to zero. The designed two SHAP-related metrics are able to investigate the targeted feature’s importance after unlearning.\n\n[1] Xavier F. Cadet, Anastasia Borovykh, Mohammad Malekzadeh, Sara Ahmadi-Abhari, and Hamed Haddadi. Deep unlearn: Benchmarking machine unlearning\n\n**Response to “Why did the authors leave out bias/discrimination/privacy metrics from the evaluation”**\n\nWe thank the reviewer for insightful feedback. We agree that evaluating the practical significance of feature unlearning requires auditing for both privacy and fairness, as accuracy alone is insufficient.\n\nIn our revised manuscript, we now include 1) a feature-level membership inference attack (MIA) and 2) fairness audits to evaluate our method in terms of privacy and fairness, respectively.\n\nFor 1), we adapt the standard MIA to the feature level. Instead of asking “was this individual data point in the training dataset?”, the feature-level MIA asks “was this feature used to train the model?”. For a successful unlearning algorithm, a feature-level attacker cannot distinguish the unlearned model from a model that is retrained from scratch without the unlearned feature.\n\nWe implement the feature-level MIA in the following steps. Firstly, we create an attack dataset. For each sample, we query $f_{\\theta’}$ (model after unlearning) and $g_\\phi$ (retrained-from-scratch model) to get their outputs, i.e., the full vector of prediction probabilities. Then, we label the outputs from $f_{\\theta’}$ as class “Unlearned” and the outputs from $g_\\phi$ as class “Retrained”.\n\nSubsequently, we train an attack model – a RandomForecast binary classifier (via the $\\texttt{sklearn}$ Python library) on this built attack dataset. This attacker’s job is to learn the subtle differences between the outputs distributions of our unlearned model ($f_{\\theta’}$) and a truly “clean” model ($g_\\phi$).\n\nFinally, we evaluate this trained attack model on a holdout set of queries. The final “Attack Accuracy” is the new metric regarding privacy. **An accuracy near 50% MIA suggests that the attacker cannot do better than random guessing. Our unlearned model ($f_{\\theta’}$) is indistinguishable from a model retrained from scratch ($g_\\phi$), which indicates that our unlearning is successful from the privacy perspective.**\n\n\nFor 2), we introduce two standard fairness metrics – demographic parity (DP) and equalized odds (EO). **For a successful unlearning, the fairness score of the unlearned model should be very close to the retrained-from-scratch model.**\n\nThe DP score is calculated in the following steps. Firstly, we identify several key components related to DP, including\n- Unprivileged/Privileged Groups: The group that has historically faced a disadvantage/advantage (e.g., for features like “Race” or “Gender”).\n- Favorable Outcome: The desired model prediction (e.g., “loan approved”).\n- Model Predictions: The output labels generated by our unlearned model or the retrained-from-scratch model.\n\nNext, for both the privileged and unprivileged groups, we calculate the rate at which they receive the favorable outcome from models. The formula for the rate is calculated as\n$$\n\\textrm{Rate} = \\frac{\\textrm{Number of individuals in the group who received the favorable outcome​}}{\\textrm{Total number of individuals in the group}}\n$$\n\nThe above rates are denoted as $\\textrm{DP(Label=Favorable Outcome | Privileged Group)}$ and $\\textrm{DP(Label=Favorable Outcome | Unprivileged Group)}$, respectively.\n\nFinally, we calculate the DP differences between unprivileged and privileged groups, formulated as \n$$\n\\textrm{DP Difference} = \\textrm{DP(Label=Favorable Outcome | Unprivileged Group) - \\textrm{DP(Label=Favorable Outcome | Privileged Group)}}\n$$\n\n**A DP difference of zero indicates perfect fairness.**\n\nFor the EO difference, we calculate the differences of True Positive Rate (TPR), False Positive Rate (FPR) between the privileged and the unprivileged groups.\n$$\\textrm{EO-TPR Difference} = \\Delta\\textrm{TPR}$$\n$$\\textrm{EO-FPR Difference} = \\Delta\\textrm{FPR}$$\n\n**Both metrics should be as close as to zero from the perspective of fairness.**\n\nIn the following, we present the results of feature-level MIA attack accuracy, DP difference, and EO differences (including both TPR and FPR) across all three adopted neural architectures (i.e., MLP, ResNet, and FT-Former). All results shown below are averaged across all four unlearned features, all three neural architectures, and all used datasets. In particular, the features “HouseAge”, “age”, “fConc:” in the *CALI*, *CREDIT*, *MAGIC_TELE* datasets are considered sensitive attributes, with thresholds of 20, 40, 0.5 to distinguish between privileged and unprivileged groups, respectively.\n\n**The below results demonstrate the effectiveness of our unlearning methods in terms of privacy and fairness.**\n\n***Table 1**: Averaged MIA attack accuracy across our unlearning method and the two baselines (optimal: 0.5)*\n| Method | Epoch 1 | Epoch 10 | Epoch 50 | Epoch 100 | Epoch 200 | Epoch 400 | Epoch 600 | Epoch 800 | Epoch 1000 | Epoch 1500 |\n|:-------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:-----------|\n| **Ours**   |     0.5437      |      0.5204     |   0.4964        |      0.5080     |      0.5254     |  0.5278 |   0.5246      |    0.5202       |      0.5121     |   0.5111        |         \n| FOUL   |      0.5736     |    0.6197       |    0.6029       |     0.5879      |      0.5690     |      0.6512     |     0.7512      |    0.7630       |    0.7630       |      0.7630      |\n| MIUL   |     0.6509      |     0.5963      |    0.5973       |    0.5966       |    0.6049       |  0.6029 |  0.5950       |     0.6120      |   0.5938        |           0.6139 |          \n\n\n***Table 2**: Averaged DP difference across our unlearning method and the two baselines (optimal: 0)*\n| Method | Epoch 1 | Epoch 10 | Epoch 50 | Epoch 100 | Epoch 200 | Epoch 400 | Epoch 600 | Epoch 800 | Epoch 1000 | Epoch 1500 |\n|:-------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:-----------|\n| **Ours**   |     0.0774      |    0.0330       |      0.0336     |     0.0127      |    0.0271       |    0.0147       |     0.0132      |    0.0206       |     0.0243      |        0.0097    |\n| FOUL   |      0.3791     |     0.2174      |   0.1654        |    0.3151       |    0.2065       |      0.0417     |    0.0598       |    0.1111       |   0.1054        |    0.2345        |\n| MIUL   |     0.1869      |    0.1319       |     0.0440      |     0.0954      |    0.0371       |    0.0424       |     0.0895      |     0.1026      |      0.0778     |     0.0291       |\n\n\n***Table 3**: Averaged EO-TPR difference across our unlearning method and the two baselines (optimal: 0)*\n| Method | Epoch 1 | Epoch 10 | Epoch 50 | Epoch 100 | Epoch 200 | Epoch 400 | Epoch 600 | Epoch 800 | Epoch 1000 | Epoch 1500 |\n|:-------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:-----------|\n| **Ours**   |     0.0394      |    0.0281       |    0.0310       |      0.0158     |     0.0288      |    0.0234       |     0.0175      |     0.0222      |      0.0192     |      0.0192      |\n| FOUL   |   0.1728        |     0.1463      |    0.2902       |     0.1616      |    0.2665       |     0.7684      |    0.5679       |    0.3727       |     0.1668      |       0.1290     |\n| MIUL   |     0.1841      |    0.2069       |    0.1477       |       0.0747    |     0.0719      |     0.0601      |    0.0574       |    0.0683       |      0.0958     |     0.1170       |\n\n\n***Table 4**: Averaged EO-FPR difference across our unlearning method and the two baselines (optimal: 0)*\n| Method | Epoch 1 | Epoch 10 | Epoch 50 | Epoch 100 | Epoch 200 | Epoch 400 | Epoch 600 | Epoch 800 | Epoch 1000 | Epoch 1500 |\n|:-------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:----------|:-----------|\n| **Ours**   |     0.1317      |     0.0462      |     0.0382      |      0.0156     |     0.0257      |      0.0160     |    0.0117       |     0.0207      |        0.0321   |     0.0134       |\n| FOUL   |      0.0752     |     0.0750      |     0.1627      |     0.1071      |     0.3891      |      0.6737     |     0.5946      |    0.3348       |      0.0927     |      0.1227      |\n| MIUL   |      0.1857     |     0.1249      |     0.0318      |   0.0782        |     0.0662      |      0.0557     |     0.1001      |      0.1252     |     0.0941      |       0.0218     |"}]

Author rebuttal:

Meta-review: In the inital reviews, this work received mixed reviews. After rebuttal, this work receives all positive ratings. The rebuttal adequately addressed the concerns of the reviewers. The meta reviewer agrees with the reviewers' recommendation.
Decision: Accept (poster)