RUAGO: Effective and Practical Retain-Free Unlearning via Adversarial Attack and OOD Generator
Authors: SangYong Lee
Sangjun Chung
Simon S. Woo
Venue: NeurIPS 2025 poster ()
Keywords: Machine Unlearning
Right to be forgetten
User Privacy
Data Forgetting
Training Dataset Privacy
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: With increasing regulations on private data usage in AI systems, machine unlearning has emerged as a critical solution for selectively removing sensitive information from trained models while preserving their overall utility. While many existing unlearning methods rely on the *retain data* to mitigate the performance decline caused by forgetting, such data may not always be available (*retain-free*) in real-world scenarios. 
To address this challenge posed by retain-free unlearning, we introduce **RUAGO**, utilizing adversarial soft labels to mitigate over-unlearning and a generative model pretrained on out-of-distribution (OOD) data to effectively distill the original model’s knowledge. We introduce a progressive sampling strategy to incrementally increase synthetic data complexity, coupled with an inversion-based alignment step that ensures the synthetic data closely matches the original training distribution. Our extensive experiments on multiple benchmark datasets and architectures demonstrate that our approach consistently outperforms existing retain-free methods and achieves comparable or superior performance relative to retain-based approaches, demonstrating its effectiveness and practicality in real-world, data-constrained environments.

RUAGO: Effective and Practical Retain-Free Unlearning via Adversarial Attack and OOD Generator
Sangyong Lee', Sangjun Chung", Simon S. Wo0
Department of Computer Science and Engineering, Sungkyunkwan University, South Korea Department of Artificial Intelligence, Sungkyunkwan University, South Korea Secure Machines Lab Inc, South Korea {sang8961, jk22 swoo] Eg. skku. edu
Abstract
With increasing regulations on private data usage in systems, machine unlearning has emerged as critical solution for selectively removing sensitive information from trained models while preserving their overall utility. While many existing unlearning methods rely on the retain data to mitigate the performance decline caused by forgetting, such data may not always be available (retain-free) in real- world scenarios. To address this challenge posed by retain-free unlearning, we introduce RUAGO, utilizing adversarial soft labels to mitigate over-unlearning and generative model pretrained on out-of-distribution (OOD) data to effectively distill the original model's s knowledge. We introduce a progressive sampling strategy incrementally increase synthetic data complexity, coupled with inversion- based alignment step that ensures the synthetic data closely matches the original training distribution. Our extensive experiments multiple benchmark datasets and architectures demonstrate that our approach consistently outperforms existing retain-free methods and achieves comparable superior performance relative to retain-based approaches, demonstrating its effectiveness and practicality in real-world, data-constrained environments.
Introduction
In recent years, the success of machine learning across diverse domains has been driven by the availability of massive datasets. A prominent example is GPT-4, a milestone in advancing machine learning, which was trained on approximately 5 trillion data points [I] However, these advancements have raised serious privacy concerns due to including sensitive training data. Widely deployed models such as ChatGPT have also demonstrated risks information
unauthorized information in
leakage (2). In response, regulations 3 4 such as the EU/US Copyright Law [5] and the General Data Protection Regulation (GDPR) emphasize the Right to be Forgotten, ensuring "the data subject shall have the right obtain from the controller the erasure of personal data concerning him or her without undue delay" [6]. Consequently, model owners, including those of AI systems, must carefully manage personal data and comply with removal requests. However, removing data may alter the orig original model's behavior and can lead to performance degradation. The most straightforward solution is retrain the model without the requested data, referred as the forget data, but this strategy is computationally and financially prohibitive.
To address rising privacy concerns and regulatory demands, Machine Unlearning (MU) 7 has emerged as a framework for removing specific training data. While early work focused on simple
SSion S. Woo is the corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

models [9111] recent efforts have extended MU to deep neural networks [6] In particular, MU can be interpreted as a multi-objectivve task, where the two main opposing goals are removing the forget data while preserving the utility of the remaining data, which we refer to as the retain data. Since forgetting significantly affects model behavior and performance, achieving both objectives is challenging. A further challenge is to minimize overall training costs. Although recent SOTA methods [7] show strong unlearning performance, they often assume full access to the original or retain data. However, such assumptions are often impractical due to storage limitations, expired permissions, or privacy constraints. To mitigate this issue, recent approaches 02 14H1 6 19, (0 explore the retain-free setting, using only the forget data. Although these retain-free methods have demonstrated strong performance in class-wise unlearning, a scenario involving the removal of entire information from a model, their effectiveness in instance- wise unlearning [12 remains uncertain and unexplored. Instance-wise unlearning, which targets specific samples instead of entire classes, is particularly challenging due distributional overlap between forget and retain data.
In this work, we present novel unlearning method for the retain-free scenario, Retain-free Unlearning via Adversarial attack and Generative model using OOD training, RUAGO as briefly illustrated in Fig. | Our method investigates the critical issue of existing instance-wisg unlearning methods, particularly over wver-unlearning which oc- curs when excessive removal severely degrades model performance. To mitigate this, we gener- ate adversarial probabilities and use them soft labels for forget data. These soft labels are posi- tioned near decision boundaries and guide the for- getting process more smoothly than deterministic hard labels, which often induce drastic parame- ter shifts and information loss in instance- wise scenarios.
Baseline retain-based
Baseline retain-free
Ours retain-freeew G
Rocgel dala
Unleamn model
Unleamn model
Unlorm modal
Rotain data
tamned FOD
100
98.38
91. 18 90.92
30.44
74.83
73.9
100
93.25
92.96
Retain Acc Retrain
Untesrning Ace
Aos
Baseline
Beselina
Figure 1: Conceptual overview of RUAGO. Our method, RUAGO ("retain-frree w/ G"), uses a generator ('G') trained on out-of-distribution (OOD) data, requiring no retain set. It is compared with retain-based method, Bad Teacher [77] ("Baseline 1"), and a retain-free one, Boundary Shrink [19 ("Baseline 2")). The figure shows RUAGO's s performance is compara- ble to the retain-based baseline and superior to the retain-free one.
However, relying solely on the above strategy may still degrade model generalization performance, especially in the retain-free setting, where access to retain data is restricted. To overcome this chal- lenge, we use a generative model trained on out- of-domain (OOD) data, which can avoid training on the retain data and eliminates the privacy risks associated with using generator trained on the original dataset. In contrast, we believe synthetic data generated from OOD distributions can inherently and completely mitigate privacy concerns, while effectively transferring essential knowledge from the original model, thus preserving model utility (21. To enhance the quality of synthetic supervision, we introduce two additional strategies. First, through VC theory-based analysis, we demonstrate that progressively increasing the model's s complexity during knowledge distillation significantly improves the final model's performance and generalization stability. Therefore, we design a dynamic sample difficulty scheduler, assigning higher initial weight to simpler synthetic samples to support stable early convergence and gradually introduc- ing more complex samples to enhance model robustness. Second, we extract key characteristies from the original model via inversion-basee fine-tunin fine-tuning, and progressively align the generator's s output distribution with the original data distribution, even without access to retain data. Consequently, after refinement, the OOD-trained generator produces samples similar to the original distribution, enabling effective knowledge transfer and preserving robust performance in retain-free conditions. We validate RUAGO through extensive experiments on four benchmark datasets and three network architectures, showing superior performance over retain-free baselines and competitive results with SOTA etain-based methods.
Our contributions are summarized as follows:
We propose RUAGO, novel retain-free unlearning framework that leverages adversarial soft labels to prevent over-unlearning and employs synthetic data from an OOD-trained generator to preserve model performance and protect data privacy in retain-free scenarios.

---

We introduce a dynamic scheduling strategy guided by sample difficulty and grounded in VC theory, gradually increasing model complexity during distillation. We also refine the OOD- trained generator via inversion-based alignment to better match the original data distribution and improve knowledge transfer.
Through comprehensive experiments, we show that RUAGO consistently outperforms prior retain-free methods and matches retain-basee approaches across diverse datasets and architec- tures, highlighting its effectiveness and practical utility realistic scenarios.
2 Related Work
2.1 Machine Unlearning
The primary objective of machine unlearning (MU) is to effectively remove information from the forget data, while maintaining the utility of the retain data [1]]. We categorize MU into retain-based and retain-free methods based whether the retain dataset is required during unlearning.
Retain-based methods utilize the retain data to support the unlearning process. Various methods have been proposed to enhance the efficiency of the retraining process for the retain data 22] 233
However, due to the substantial computational resources and memory requirements, many studies have focused on updating parameters within pre-trained models. Goel et al. [24] proposed two methods, retraining the last layers from scratch (EU-k) and fine-tuning the last layers (CU-k)
using the retain data. Bad-T [17] and SCRUB [3] employ a teacher-student framework wherein the teacher induces forgetting through positive and negative knowledge transfer. SalUn [25] identifies and modifies weights with significant influence the forget data, thereby effectively removing them. Despite demonstrating strong unlearning performance, these approaches require large amounts the retain data, limiting their applicability in scenarios where access to the retain data is constrained.
Retain-free methods focus on unlearning without the retain data. In such scenarios, effectively forgetting specific data while maintaining overall model performance is difficult and often necessitates additional metadata. Yoon al. [26] used model inversion to train conditional GAN (CGAN) along with the forget data to perform unlearning. but it suffers from the complexity of model inversion and
underperforms compared to recent methods. Boundary unlearning [99 employs adversarial attacks to guide the forget data toward incorrect labels near decision boundaries. SSD [14] computes the relative importance of parameters between the entire training dataset and the forget data, selectively dampening parameters. While it achieves effective unlearning without training, it requires importance information from the entire training dataset. SCAR [66 uses Mahalanobis distance to delete the influence of the forget data and maintain performance without accessing the retain data by leveraging OOD data. However, its reliance on metadata such as means and covariance matrices limits its applicability in scenarios where this information is unavailable. Moreover, these methods generally exhibit lower unlearning performance than the retain-based methods, and face additional challenges when applied instance-wise unlearning.
2.2 Curriculum Learning
Curriculum Learning (CI.) is training strategy that mimics human learning by gradually adjusting the difficulty of the training process, progressing from easier to harder samples [27). This approach facilitates stable learning by allowing models to incrementally build their understanding across various tasks (28-30). We reinterpret the teacher-student relationship in knowledge distillation through the lens of VC theory, showing that achieving generalization in early stages with limited model capacity leads to more stable subsequent learning. Building on this theoretical insight and inspired by CL, we implement progressive knowledge transfer strategy by assigning weights to generated images based on their difficulty, thus guiding the model from easier to harder samples. To the best of our knowledge, we the first to utilize the concept of sample difficulty in the field of MU.
2.3 Data-Free Knowledge Distillation
Data-Free Knowledge Distillation (DFKD) aims to train student model without the use of original training data. The core idea of DFKD is to generate synthetic data that mimies the distribution of the original training data through model inversion process, considering the teacher model
3

---

inv
Sungle
Go
FB
SDM
Copy
X
Hand
Fasy
Kullback Lasberr Lebllankknebbererrvvvennnn
L
Gip
FH
Pide
Pide
A PP
Pade
D
Pade
+* A
Bourdnes
OOD Data
Dy. Fuugel Original
loss
(b)
Gg: Gecerator Unitarm model
Retain losss
Generaled Lmages Ayyy Inperse loss
Ey Unleem
Figure Overall procedure of our proposed method. (a) Unlearning the model, where the blue arrow denotes knowledge distillation from the original model via generated images with the sample difficulty module (SDM): and the red arrow denotes deletion the forget set Dj via the adversarial probability module (APM). (b) Training the generator Gg. OOD dataset. (c) Aligning G to the training data model inversion.
discriminator: This process often involves using generative models such as Generative Adversarial Networks (GANs) to generate synthetic data 34]. The student model is trained on these synthetic data match the predictions of the teacher model using distillation process. In this work, we apply the model inversion strategy to the unlearning process, focusing on effectively preventing performance decline from model without requiring access to the original training data. By leveraging synthetic data generated through generator, our approach enables precise unlearning, addressing key challenges
scenarios.
3 Preliminaries and Problem Statement
We first introduce notation for supervised image-llasifficttion setting. Let X' C IRd be the image space and y = {1....,c} }f the label set. We denote the full training dataset = {(x", b C X' x y. Let D, C X x be independent test set from the Fø: X + y is a deep learning model with parameter 0 trained on D.
distribution. We assume that
Machine unlearning seeks updated model F that "forgets" the forget set Dj C D, while preserving performance the relain sel D, = D \ DD and on D,. Formally, Fi should behave such as F&+, a model retrained from scratch on D,,. the instance wise unlearning scenario, where individual examples removed regardless of their class, rather than removing entire classes in class-wise unlearning, the resulting class distribution the forget set D, and the retain set D, remains nearly identical. This heavy overlap between D, and D, makes it difficult to remove information of DD without inadvertently degrading performance D,. We therefore evaluate F against Fø- using standard accuracy metrics on D, and D,, as well as membership inference attack (MIA) metric.
Our Approach
This section introduces RUAGO, our framework for instance-wist unlearning without access retain set D,.. Instead of relying solely on the forget set D,, which can degrade overall performance and utility, RUAGO focuses on adversarial probabilities to guide the forgetting process and generator pretrained on out-of-domand
(OOD) data to preserve cecision-boundan fidelity to the original model. To stabilize distillation from synthetic samples generated by the OOD-pretrained generator, we develop VC-theoretic analysis of knowledge distillation and implement a dynamic sample-difiiculy schedule. Additionally, we refine the generator via model-inversion step to align its outputs with the original training distribution D. The complete pipeline is illustrated in Fig. 2

---

4.1 Adversarial Probability
inject imperceptible perturbations into images maximize model prediction errors, thereby inducing misclassification toward the nearest alternative class in the loss landscape. While traditionally employed to evaluate model robustness or construct defenses against adversaries, these perturbations have recently been applied in machine unlearning [12 15 19, where adversarial labels generated by perturbations serve as alternative targets for forget-set samples D However, unlike class-wise unlearning methods, instance- wwinn unlearning does not aim to completely misclassify samples in D away from their original classes. Since D constitutes unseen data from the retrained model's s perspective, these samples inherently carry higher ambiguity than those in the retain set, D,. Consequently, although the retrained model may exhibit uncertainty toward D it can still correctly predict a subset of it. Therefore, strictly assigning completely different class labels to samples in D, risks causing over-unlearning [25]. Specifically, recall that using hard one-hot targets aL with cross-entropy loss, defined as = Σ q log(p), results in gradients 8s = q. For the targeted class j. this yields a gradient of p¹ - 1, which can become large in magnitude, triggering drastic parameter updates and potentially destroying useful general features.
Adversarial attacks 35 36
To circumvent this issue, we instead propose using the adversarial probability vector Padv as a soft target. These soft labels distribute gradient contributions more evenly, as 82 = p - Padv- thereby producing milder parameter updates and preserving the model's inherent uncertainty toward samples in the forget set. This approach effectively treats D, analogously unseen or ambiguous data, mitigating its influence without excessive parameter drift. Moreover, this design aligns with knowledge distillation principles (37,, wherein soft targets convey richer probabilistic information and exhibit lower gradient variance than hard labels. Consequently, our instance- unlearning method not only prevents over-unleanning but also better maintains the model's overall utility.
aL
Formally, adversarial examples and probabilities are computed as:
Xady x + argmax [F 5), Padv = (Xxa)))
(1)
where a denotes softmax. Finally, the forget loss is defined by:
1 N, Nj
(D Padv) = Σ Loul Plav):
(2)
where LCe is cross-entropy, and N, denotes the number of samples. The overall procedure is depicted in the Adversarial Probability Module (APM) in Fig. ([a).
4.2 Pre-trained Generator with OOD Data
Due to our assumption that D, inaccessible, is essential to practically obtain additional data that can facilitate the extraction of knowledge from Fg. Thus, replace D, while obtaining high-quality images, we use a generator trained on an OOD dataset as shown in Fig. b.... This strategy offers remarkable flexibility: One may employ readily available open-source datasets or pre-train pre-train& generator well in advance of any unlearning requirement.
Previous studies 21 38 39 have shown that knowledge distillation (KD) can be performed using OOD data address similar assumptions that are inaccessible to training data. Fang al. [21 demonstrated effective KD using OOD data with GANs. Motivated by this, RUAGO employs generator G.., trained on an OOD data to replace the D, and preserve model utility.
This strategy provides the advantage of using an open-source pre-trained generator or training the generator with an open-source dataset without D,.. Hence, our approach can always respond to rapid unlcarning requests. In RUAGO, Gg does not condition on label space V, which means it cannot assign labels to the generated images. To address this issue, RUAGO calculates the KL divergence between the logits z, and z,, which are obtained by passing the generated images x from Gy: through Fg and Fl respectively, as shown by the following equation:
No
C. (x)
DEL (20/T || ///7)
k=1
where N2 is the number of generated images, DeL is the KI. divergence function, and r temperature.
5

---

4.3 Sample Difficulty-Driver Distillation
To effectively transfer information from Fo to Fb we design the loss in Eq. 3 However, since x is generated from the OOD dataset distribution, Eq. (3) may not fully capture comprehensive information. To enhance the distillation process using samples generated by G.. RUAGO employs an easy-to-hard training strategy inspired by curriculum learning (CI.) [27 44
Theorem (Generalization Bound under Sample Difficulty Scheduling). Let Hi S .... Hr be nested sequence of hypothesis spaces with VC-dimensions d, = VCdimmHH) in each curriculum stage I, and define the true risk by R(F) = (( (FF)))))((((()))) and the empirical risk by (F) # - (F(x))) w.). Let the original (teacher) model be Fo Hi, and let the unlearned (student) model be F Hr. Consider the optimal retrained model Fo- Hr such that R(Fo-) minsehr R(F). Then, drawing n. i.idd samples,
R(F)) R(Fo-) S O
de log
+
See Appendix for the full proof. Theorem [ provides theoretical guarantee that our easy-to- hard sample schedule preserves model utility while controlling generalization error. This theorem builds on the principle of Structural Risk Minimization, where the model's s effective capacity is gradually increased. to learning within a hypothesis space Hi with small VC-dimension d,. As progressively more challenging samples are introduced, the model's effective capacity grows, but updates from a stable, near-optimal state achieved in the previous stage. To theoretically ground this approach, we adapt a line of VC-based analysis from related field of DFKD 45, which allows us to ensure robust generalization even with noisy OOD samples.
the initial phase, training focuses on "easy" samples, which corresponds
In RUAGO, we quantify each sample's 's difficulty via its loss and adjust dynamically:
N, wk
1
1 1+ exp( -1/A)
(x)
Ex.
(4)
N
1 exp Ex - 1/
1=1
where 4 is the loss of the k-th generated sample (see Eq. 3 ), and A > 0 is temperature hyper- parameter controlling the softness of the difficulty weighting. By modulating weight wy from easy to hard, RUAGO achieves faster, more stable convergence. This loss-based difficulty scheduling serves as a practical implementation of the curriculum described in our theoretical analysis. We begin with easy (low-loss) samples to keep the empirical risk small, preventing divergence before gradually incorporating harder samples. The Sample Difficulty Module (SDM) Fig. ([a) illustrates this process. To the best of our knowledge, RUAGO is the first method to leverage sample difficulty scheduling during unlearning, directly addressing OOD challenges in knowledge distillation boost generalization and model utility.
4.4 Inversion-based Generator Alignment
We insert brief generator refinement step into our pipeline to ensure that the synthetic samples used in unlearning closely mirror the teacher model's implicit data distribution, thereby promoting a more stable knowledge transfer process. This step optimizes the generator so that its outputs 1) elicit high-confidence predictions from the teacher, 2) expose challenging hard regions of the decision boundary for the student, and 3) match the teacher's internal feature-mas map statistics. Figure ((c) represents this procedure.
Inspired by model inversion techniques from DFKD 21
48
Concretely, let x G(z) be generated sample. We minimize the following inversion loss:
Linv (&) Vola fCE
(F (Fo( arg max Fo()))
Tadv KI (I(Fo(X) F1 (x))
(5)
+ Ton Σ 1 BN
1 1 BN
In particular, the cross-entropy term LCE compels the generator emit samples that the teacher model classifies with high confidence. The negative KL divergence term, by contrast, encourages

---

the synthesis of challenging hard examples that broaden the output discrepancy between teacher and student. Finally, the statisti--atcchnng term enforces agreement between the batch-wise feature statistics (u,,7) and the teacher's s stored BatchNorm running statistics (N o. This batch normalization regularizer, primarily used to speed convergence, only applicable architectures that include such layers. For models without them, such as Vision Transformers, this term is simply deactivated by setting Too = O, with our method still demonstrating strong performance. We adopt this inversion formulation (Deep Inversion (33) drop-in module for high-fidelity sample synthesis. Note that after completing the unlearning process, we safely discard the refined generator to eliminate any potential privacy risks.
4.5 Retain-Free Unlearning
We now introduce final unlearning loss of RUAGO, which combines Eq. 22 for forgetting objective and Eq. (4) for retaining objective, formulated as follows:
(D Padv. x) 7/1 Ly Padv) ) + 72- (x),
(6)
where "/1 and ?22 are Syyper-parameter that con- trol the trade-off between the forgetting and retaining components. Algorithm|| provides a detailed overview of method's operational procedure. In each epoch, our approach first performs model inversion. Once the model in- version is completed, it generates the adversar- ial probability Padv and the synthesized image x. These generated components are then used to compute the unlearning loss L, The calcu-
Algorithm RUAGO
Input: Fo. Dj. G
Parameters:
7,, E LR & epochs for unlearning
7g Eg: LR & epochs for generator alignment
1: F Fo
2: for = 1 E do
3: for g= to E, do
4: Generate x and calculate Linv (X)
lated loss is subsequently employed to update
5:
6: end for
the model parameters. This entire process is re- peated over multiple epochs. RUAGO enables
7: Generate Pady and updated x
8: Calculate Lu Pady x)
rapid and effective unlearning without requiring
9: @ t- ---1) 17 VeLu(X)
the D, Our method suits scenarios where pri- vacy concerns, resource limitations, or expired access rights restrict data storage or access.
10: end for
11: return F.
5 Experimental Results
5.1 Datasets, Models and Unlearning Setups
We conduct our experiments using the CIFAR-10. 10, CIFAR-100 [49]. TinyImageNet [0 and VG- GFace2 [51] datasets. For each dataset, we employ deep learning architectures including VGG16 [52
ResNet18 [53) and Vision Transformer (ViT) [54]. In addition, we employed the COCO dataset [55] as an out-of- cuttrf-distribution resource for training our generative model. We randomly designate 10% of the entire training dataset D,, focusing on evaluating instance wise forgetting. Further experimen- tal details and additional results, including those for CIFAR-100, Tiny TinyImageNet, and the deletion of 50% of D, are provided in the Appendix due to space constraints.
5.2 Baselines and Evaluation Metrics
In our experiments, we evaluated our method against the Original and Retrain models, as well as six unlearning baselines, including three retain- based methods, Bad-T 17). SCRUB [13, and SalUn (25). and three retain-free methods, Boundary Shrink (BS) 19). SSD 14 and SCAR [1]]
To evaluate the performance, we utilize 6 different metrics: 1) RA: accuracy on D,; 2) UA: accuracy on Dy; 3) TA: accuracy on De: 4) AVG: measures the mean of the absolute differences between each method's 's RA, UA, and TA values and those of the Retrain model; 5) Membership Inference Attack (MIA) 56): : a canonical privacy metric for evaluation unlearning models [33
17 19 25 57
The maximized or minimized MIA score could lead to the Streisand effect, unintentionally providing information to attackers. Thus, an MIA value near to the Retrain model ideal; 6) Running-Tiin Efficiency (RTE): measure the time efficiency of each method in seconds.
7

---

Table 1: Performance of RUAGO and baselines on CIFAR- 10 and VGGFace2, reported as mean + std, with AVG indicating the accuracy gap between unlearned and retrained models. The "D,-free" columns (V1 X) marks retain-free methods. Blue and red highlight the best results for retain-based and retain-free methods, respectively.
(a) Results on CIFAR-10.
m, Free
VOGIS
ReoNett8
VIT
RA
UIA
TA
AVG
RA
TIA
TA
AVG
RA
UA
TA
AVG
Original
100,0000.00
10000000.00
93.75+0.35
99 09.0900.00
100,000000
85 23.544033
99.8540.01
99,84:0:05
95 979007
Remii
100,0000.00
19.25
92.98e0.39
99.09+00.0
86.7500.88
85.960..4 14
99.85e0.01
99.0360117
95.050
Bad
100,0000.00
03.99
91.3889.13
100.0040.00
$5.43e1.96
81.5920228
0.89
99.8249.02
99.6860:12
SCRUB
99, 74.0.33
1:10
90.5740.70
1.30
100.00+0.000
96.876031
86. 16.032
0.1
99.9740:00
99 8680.07
99 10
0.37
SalUin
100,0000.00
43.6840.42
91 69.00.00
10000000.00
85.82+0.80
83.55e0
99.99+0.01
36.57+0.11
0.45
$0.49=1.022
74.6389.99
73.9029).63
19.07
50.20=l1.53
09.40e1..2
69.2760.36
17.93
57,3720082
16,26a0:91
56.46a081
42.62
SSD
74.05=37.58
76.17457.62 62
67.36433.79
23.55
79, 79.87237.95
80006237,79
69 60063.222 21
14.38
83.96635555 53
83 23.91235.6
83 63.064335.1
15.53
SCAR
93.01-2.34
92.90+1.94
58.61=1.27
10.10.0
74.3340
96.974044
09.06-033
88,88+0
0.66
RUAGO
90:94-0.02
93.38 33.3690.39
92. 02.32400.20
0.28
99.34
84.02=1.00
84.3620:26
1.65
99.81=0.01
98.9560.18 16
95s005
0.05
(b) Results on VGGFace2.
2)
VGGI6
Reshett8 CA
WT
free
RRA
UA
TA
AVG
RA
TA
AVG
RA
UA
TA
AVG
Original
98. 13:0 15
98.59 20.59:0.20
95.9610.10
99 02.8840002
99 02
97.52.0.00
99.34:0.06
99,25e0.15
96 96.79:0.15 18
Retrin
X
98. 18.1350.15
94.4640.35
04.9120.15
09.8840.01
96.6300.99
97.20+0.18
99.21+0:03
96.2360.32
96.55e0.12
Bad-T
X
98 02.4550002
95.85e1.25
96.6240119
0.81
99.84+0.01
98. 3.
96.7+0011
0.76
99. 15.15500:33
98.4240.10
96.75
01.82
SCRUB
100.0000.00
98.4240.05
96.9220.06
2.61
100.0040.00
98.3220.79
97 37,8020.08
0.8
99.7610.10
99.2720015
96.9620.11
1.33
SalCia
99.61=0.07
93.66e1.41
95.1760:25
99.9960.00
98.7150.27
96.97=00.14
0.81
19.26400119
93.03e1.28
95.2660:44
BS
95.13.0.112
95.1310.19
91.8610119
2.24
96.5310.1 12
96.6110422
91.9910.15
2,86
894550069
89.7010.66
86.52.0.67
8.77
SSD
88.2345.39
88.2915.83
85.32&5.15
8.56
95,0512.95
95.22s2.86
91,3243.30
4,04
97,4341.24 1774771077
94.87=1009
1.54
SCAR
95.2 35.24:0014 16
15.40.0.16
91.79a0.25 28
2.30
96 96.84400.4
96.97.0.70
92,86.0.88 8.89
2.57
96 53:0.7
96 96.6240.29
29
93.71:0.37
1.97
RUAGO
97.4120.06
95/4410.26
91.8820117
99.3220.05
96.61a0
96.4110.15
98.9140.02
96.9110.20
96.28.0.09
5.3 Results
Accuracy Performance. Table [ presents unlearning accuracy on two datasets for the origi- nal model, the retrained model, six baselines, and RUAGO. Table TTa presents the accuracy results for CIFAR-10 dataset, indicating that retain-free basclines are largely ineffective at un- learning, regardless of the model type. In the worst case, AVG value of 42.62 is observed. The similar RA and UA values across the three methods indicate that general performance degra- dation has occurred rather than erasing Dy. In contrast, RUAGO demonstrates remarkable perfor- mance. The AVG values indicate that RUAGO out- performs the other three methods, with RA, UA, and TA closely aligning with those of the Re- train model. Although, Bad-T, SCRUB, and SalUn are slightly more effective than RUAGO for the ResNet18 model, our method still demonstrates comparable performance. Notably, RUAGO out- performs these methods for VGG16 and ViT, with AVG values of 0.28 and 0.05, respectively, indicat- ing the closest match the Retrain model.
CIRAR-10
1.2
1
0.8
0.6
0.4
0.2
VGG16
ResNet18
VIT
VGGFax22
0.
08
Q7
Table (b) presents the results for the VGGFace2 dataset. Retain-free methods, such Boundary Shrink, SSD, and SCAR, exhibit significant perfor-
Q6
05
04
mance degradation, similar to the CIFAR-10 results.
0.3
In contrast, our approach outperforms all other methods, including retain-based methods. This re- sult indicates that even when G, is trained on an OOD dataset (COCO) that is significantly different from D (VGGFace2), it still supports the unlearn ing process effectively. In conclusion, although un- learning without D, is challenging, RUAGO suc- ceeds admirably, comparable or outperforming other basclines.
02
011
VGG16
ReNNH18
VIT
= Bad-T
SCRUB
SALUN = BS
SSD
SCAR
RLAGO -. Ratrain
Figure 3: MIA results for each unlearning method. The red dotted line represents the Re- train model; it is best be closer to this line.
8

---

Table Running Time Efficiency (RTE) results
Table Results of the ablations studies for the
measured in seconds.
VGGI6 model on CIFAR-10. 10.
CIFAR-10 ResNei18
VGGFface2 ResNe118
RA
UA
TA
MIA
AVG
VGG16
VIT
VGG16
VI
Retrain
1,758
1.991
4,862
5,071
4,735
5,790
RUAGO
99.94
93.38
92.32
0.85
0.282
Bad-T
181
2,105
5,403
1,200
2,418
Hard labels
96.61
93.93
87.62
0,51
3,146
SCRUB
SalUin
1.752
1.502
4,005
4,844
1.993
1.755
Diff. OOD
99.93
93.55
92.20
0.85
0.384
BS
-5
514
1,599
446
153
w/ Init Ge
72.55
72.45
68. 22
0.60
24.338
SSD
13
15
581
209
59
685
w/o MI
99.95
93.48
92.38
0.85
0.297
SCAR
RUAGO
433
26
35
333
133
68
625
466
w/o SD
99.47
88.93
91.44
0.86
2.133
MIA Score. To evaluate privacy leakage, we analyze the MIA scores of all methods. The Bad-T method, which shows excellent accuracy performance, records the worst MIA score. This suggests that the Bad-T' approach does not guarantee privacy protection. contrast, the MIA values of SCAR show a minor discrepancy from the Retrain model, but it shows poor accuracy, as mentioned above. As result, the evaluation of effective unlearning requires a comprehensive set metrics. Our method, which performs accurately, also demonstrates strong privacy protection. As shown in Fig. [ our approach achieves MIA values comparable to those of the Retrain model in all experiments except for ResNet18 trained CIFAR-10, Particularly for ViT on both datasets, the MIA scores are almost identical to the Retrain model, with only about 1% difference. This indicates that RUAGO exhibits excellent unlearning performance in accuracy and protecting privacy.
Running- Efficiency. Efficient unlearning requires latency that is lower than that of a full retraining procedure. Table 2 reports each unlearning method's running-time efficiency (RTE), measured in seconds. Notably, this metric omits all preparatory computations, such as the Fisher information matrix estimation in SSD, the mean and covariance computations in SCAR, and the out- of-distribution generator training our approach, and concentrates solely on post-request execution time. Although these offline steps can be time-consuming, they may be precomputed without affecting the immediate unlearning latency. Methods that depend on the retain dataset D, (Bad-T, SCRUB, and SalUn) incur substantial RTE costs, especially when applied to large architectures like ViT or high-resolution datasets such as VGGFace2. In contrast, techniques that do not use D, (BS, SSD, and SCAR) achieve lower RTE values but do not deliver effective unlearning performance, as noted above. Our method, however, strikes an ideal balance: it matches or exceeds the efficiency of retain- free baselines (providing up to 12 12x speed-up over full retraining) without sacrificing unlearning efficacy. These results underscore the practical advantage of our framework for real-time unlearning, even in the most challenging scenarios where the retain data is unavailable.
5.4 Ablation Studies
In this section, we present ablation studies demonstrating the importance of various design choices in RUAGO. We summarize the main findings here, with additional results and analyses provided in Appendix G
Component Analysis. We first analyze the impact of each component using the VGGI6 model on CIFAR-10. As shown in 3 each component of RUAGO plays crucial role. First, unlearning with hard labels instead of our soft targets significantly reduces test accuracy (TA) and yields membership inference attack (MIA) scores that diverge from the retrained model, indicating lower utility and potential privacy risks. Second, employing generators trained on different OOD datasets, such as TinyImageNet, consistently ensures robust unlearning, highlighting RUAGO's versatility. Third, using randomly initialized generator leads to markedly poor performance, underscoring the necessity of a pre-trained OOD generator. Fourth, while RUAGO is effective without the model inversion technique, its inclusion further improves unlearning outcomes. Lastly, omitting the sample difficulty scheduling from the distillation process critically harms model utility. These findings collectively validate our design choices in achieving efficient and robust unlearning.
Hyperparameter Sensitivity Analysis. To address concerns about the hyperparameter space, we conducted sensitivity analysis on the loss weights (%aav. "ba, Yels 71, 72) for the VGG16 model on CIFAR- 10, varying one while keeping others fixed. The detailed results are presented the Appendix (Tables 9 and 10). Our findings show that the performance of RUAGO is not overly sensitive to its hyperparameters. Key metrics remained stable across a wide range of values, demonstrating the robustness of our method. This leads to a practical and efficient tuning guideline. In our experiments,

---

Table 4: Effect of the number of alignment epochs (Eg) across different models VGGFace2. Metrics remain stable or slightly improve as Eg increases, demonstrating that the alignment process safe and does not re-inject forgotten information across diverse architectures.
VGG16
ResNel18
VIT
Eg
RA
UA
TA
RA
UA
TA
RA
UA
TA
10
97.44
95.44
94.88
99.32
96.64
96.41
98.91
96.94
96.28
30
97.53
95.43
94.90
99.43
96.46
96.51
98.92
96.88
96.31
50
97.57
95.43
94.95
99.47
96.43
96.57
98.92
96.89
96.32
97.59
95.54
94.98
99.47
96.41
96.48
98.92
96.89
96.31
100
97.62
95.57
95.01
99.49
96.38
96.60
98.92
96.87
96.32
a simple one-dimensional sweep for Y after fixing other weights was sufficient to find a near-optimal configuration. This demonstrates that RUAGO can achieve strong performance without extensive, multi-dimensional hyperparameter tuning.
Analysis of Alignment and Re-injection Risk. A critical consideration is whether the generator alignment step could inadvertently re-inject forgotten information. We mitigate this risk through safeguards like the forget loss Ly. In the class- wise unlearning scenario, we employ an additional safeguard of output filtering. To empirically validate the safety of this component, we analyzed the effect of alignment strength. As detailed in the Appendix (Table IT). using high learning rate to induce overly aggressive alignment leads to a general performance collapse rather than selective re-injection, indicating optimization instability.
Furthermore, investigated the impact of the number of alignment epochs (Eg) across multiple The results are highly consistent, increasing the alignment
architectures, as shown in Table 4 epochs from 10 to 100 maintains robust unlearning performance (stable UA) while slightly improving utility (RA and TA) across VGG16, ResNet18, and ViT. This compellingly demonstrates that the alignment module operates within safe regime, stabilizing distillation without re-introducing forgotten data, regardless of the model architecture.
Conclusion
We propose RUAGO, a unified retain-free unlearning framework that prevents over-unlearning issues and preserves the model's utility without access to retain data. We aim to tackle the performance drop common in retain-free scenarios, especially instance-wise unlearning. Our method generates adversarial probabilities to prevent forget samples from being pushed beyond decision boundaries, thereby mitigating over-unlcarning Simultaneously, to compensate for the absence of retain data, we leverage generator pretrained on OOD data to distill knowledge from the original model using synthetic samples. To address potential instability caused by synthetic samples and to enhance gener- alization during distillation, we incorporate sample scheduling strategy informed by VC theory, and apply inversion- based alignment to adjust the generator's s outputs toward the original data distribution. These components form a cohesive framework that achieves effective and practical unlearning in retain-free scenarios. Our extensive experimental results show that RUAGO outperforms existing retain-free methods, and matches or exceeds retain-based approaches, confirming its practicality for real-world unlearning scenarios without the retain data.
Acknowledgement
The authors would thank anonymous reviewers. This work was partly supported by Institute for Information & communication Technology Planning & evaluation (IITP) grants funded by the Korean government MSIT: (RS-2022-I122) 199, ASS2002-11222668 RS-2019-1119042
RS Also, this work was supported by the Cyber Investigation Support Technology Development Program (No.RS-2025 RRS-2025-02304983 of the Korea Institute of Police Technology (KIPoT)), funded by the Korean National Police Agency. Lastly, this work was supported by the National Research Foundation of Korea (NRF) grant funded by the
RS RS-2004-00437849, RS-2022 2022-112222222 112188888,, and AS--00250222666
Korea govermment (MSIT) (No. RS- R5-2024-00356293),
10

---

References
[1] Epoch AI. Data on notable ai models. httphh//ttt///oooaaa....//////tt
2024.
Accessed:
[2] Matt Burgess. Chatgpt has a big privacy problem. https://wwwz http:://wwwwwww..e..om. www.w....ddd..oooooooooooooooooo italy-bar ban chatgpt-privacy-
2023. Accessed: 2023-04-04.
[3] Eric Goldman. An introduction to the california consumer privacy act (ccpa), Santa Clara Univ. Legal Studies Research Paper, 2020.
[4] Kate Kaye. The fic's 'profoundly vague' plan to force companies to destroy algorithms could get very messy. https: //op::://ww... wwwp::ppww..o...oooooo com/enterprise.. ftc- aic-aggorithm aat.orritnnndaattmmdd-------- ai/ 2022. Accessee::0022-05-11
[5] Vadym Kublik. Eu/us copyright law and implications ml training data. https://valohai
commbblog/coyrrighttt laws- machine -eeeeeing/////// 2019. Acccsse:2011-03--1.
[6] Alessandro Mantelero. The eu proposal for a general data protection regulation and the roots of the 'right to be forgotten'. Computer Law & Security Review, 29(3):229-22 2252 2013.
[7] Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette- Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium Security and Privacy (SP), pages 141-159. IEEE, 2021.
[8] Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoe Viet Hung Nguyen. A survey of machine unlearning. arXiv preprint arXiv:2209.02299 2022.
[9] Ananth Mahadevan and Michael Mathioudakis. Certifiable machine unlearning for linear models. arXiv preprint arXiv:2106. 15093, 2021.
[10] Jonathan Brophy and Daniel Lowd. Machine unlearning for random forests. In International Conference on Machine Learning, pages 1092-1104. PMLR, 2021.
[11] Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems, 32, 2019.
[12] Sungmin Cha, Sungjun Cho, Dasol Hwang, Honglak Lee, Taesup Moon, and Moontae Lee. Learning unlearn: Instance-wise unlearning for pre-trained classifiers. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 11186-11194, 2024.
[13] Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards un- bounded machine unlearning. Advances neural information processing systems, 36, 2024.
[14] Jack Foster, Stefan Schoepf, and Alexandra Brintrup. Fast machine unlearning without retraining through selective synaptic dampening. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 12043-1205, 2024.
[15] Hyunjune Kim, Sangyong Lee, and Simon S Woo. Layer attack unlearning: Fast and accurate machine unlearning via layer level attack and knowledge distillation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages
2024.
[16] Jacopo Bonato, Marco Cotogni, and Luigi Sabetta. Is retain set all you need in machine unlearning? restoring performance of unlearned models with dustii-dist images. In European Conference on Computer Vision, pages 1-19. Springer, 2025.
[17] Vikram S Chundawat, Ayush Tarun, Murari Mandal, and Mohan Kankanhalli. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 7210-7217, 2023.
[18] Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unlearning. IEFE Transactions on Neural Networks and Learning Systems, 2023.
11

---

[19] Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In Proceedings of the IEEF/CVE Conference on Computer Vision and Puttern Recognition, pages 7766-7775. 2023.
[20] Jack Foster, Kyle Fogarty, Stefan Schoepf, Cengiz Öztireli, and Alexandra Brintrup. Zero-shot machine unlearning at scale via lipschitz regularization. arXiv preprint arXiv:2402.01440 240.00140,,,,,, 2024.
[21] Gongfan Fang. Yifan Bao, Jie Song, Xinchao Wang. Donglin Xie, Chengchao Shen, and Mingli Song. Mosaicking to distill: Knowledge distillation from out-of-domain data. Advances in Neural Information Processing Systems, 34:1 1920-11932, 2021.
[22] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence volume 35, pages 11516-1 11524, 2021.
[23] Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, and Xiaodong Lin. Arcane: An efficient architecture for exact machine unlearning. In IJCAI, volume 6, page 19, 2022.
[24] Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponnurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning. arXiv preprint arXiv:2201.06640, 2022.
[25] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Empowering machine unlearning via suddient-based weight saliency in both image classification and generation. arXiv preprint Sttiv::231.1220000 2023.
[26] Youngsik Yoon, Jinhwan Nam, Hyojeong Yun, Jaeho Lee, Dongwoo Kim, and Jungseul Ok. Few-shot unlearning by model inversion. arXiv preprint arXiv:2205. 20t.:2225./5567, 2022.
[27] Yoshua Bengio, Jérôme Louradour, Ronan Collobert, and Jason Weston. Curriculum learning. In Proceedings of the 26th annual international conference on machine learning, pages 41 48, 2009.
[28] Sheng Guo, Weilin Huang, Haozhi Zhang, Chenfan Zhuang, Dengke Dong. Matthew Scott, and Dinglong Huang. Curriculumnet: Weakly supervised learning from large-scale web images. In Proceedings of the European conference on computer vision (ECCV), pages 135-150, 2018.
[29] Emmanouil Antonios Platanios, Otilia Streteu, Graham Neubig. Barnabas Poczos, and Tom M Mitchell. Competence-base curriculum learning for neural machine translation. arXiv preprint arXiv:1903.09843 2019.
[30] Sanmit Narvekar, Bei Peng, Matteo Leonetti, Jivko Sinapov, Matthew E Taylor, and Peter Stone. Curriculum learning for reinforcement learning domains: A framework and survey. Journal of Machine Learning Research, 21((81):1 2020.
[31] Hanting Chen, Yunhe Wang, Chang Xu, Zhaohui Yang, Chuanjian Liu, Boxin Shi, Chunjing Xu, Chao Xu, and Qi Tian. Data-free learning of student networks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 3514-3522, 2019.
[32] Jaemin Yoo, Minyong Cho, Taebum Kim, and U Kang. Knowledge extraction with observable data. Advances in Neural Information Processing Systems, 32, 2019.
[33] Hongxu Yin, Pavlo Molchanov, Jose M Alvarez, Zhizhong Li, Arun Mallya, Derek Hoiem, Niraj K Jha, and Jan Kautz. Dreaming to distill: Data-free knowledge transfer via deepinversion. In Proceedings of the IEFF/CVE conference on computer vision and pattern recognition, pages 8715-8724, 2020.
[34] Gongfan Fang, Kanya Mo, Xinchao Wang. Jie Song, Shitao Bei, Haofei Zhang, and Mingli Song. Up to 100x faster data-free knowledge distillation. In Proceedings of the AAAI Conference Artificial Intelligence, volume 36, pages 6597-6604. 2022.
[35] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint 14X.::1412.657.. 2014.
[36] Aleksander Madry. Towards deep learning models resistant to adversarial attacks, arXiv preprint 1rXiv:1706.0000 2017.
12

---

[37] Geoffrey Hinton. Distilling the knowledge in neural network. arXiv preprint arXiv:1503.02531, 2015.
[38] Mandar Kulkarni, Kalpesh Patil, and Shirish Karande. Knowledge distillation using unlabeled mismatched images. arXiv preprint urXiv:1703.0713 2017.
[39] Gaurav Menghami and Sujith Ravi. Learning from a teacher using unlabeled data. arXiv preprint arXiv:1911.05275, 2019.
[40] M Kumar, Benjamin Packer, and Daphne Koller. Self-paced learning for latent variable models. Advances in neural information processing systems, 23, 2010.
[41] Lu Jiang, Deyu Meng. Qian Zhao, Shiguang Shan, and Alexander Hauptmann. Self-paced curriculum learning, In Proceedings of the AAAI Conference on Artificial Intelligence, volume 29, 2015.
[42] Chang Xu, Dacheng Tao, and Chao Xu. Multi-view self-paced learning for clustering, In TieentyFourll International Joint Conference on Artificial Intelligence, 2015.
[43] Xin Wang, Yudong Chen, and Wenwu Zhu. A survey on curriculum learning. IEEE transactions on pattern analysis and machine intelligence, 44(9):4555-4576, 2021.
[44] Petru Soviany, Radu Tudor Ionescu, Paolo Rota, and Nicu Sebe. Curriculum learning: A survey. International Journal of Computer Vision, 13066):1526-1555 1565, 2022.
[45] Jingru Li, Sheng Zhou, Liangcheng Li, Haishuai Wang, Jiajun Bu, and Zhi Yu. Dynamic data-free knowledge distillation by easy-to-hard learning strategy. Information Sciences, 642: 119202, 2023.
[46] Gongfan Fang, Jie Song, Chengehao Shen, Xinchao Wang, Da Chen, and Mingli Song. Data-free adversarial distillation. arXiv preprint 1912.//9/// 2019.
[47] Gaurav Kumar Nayak, Konda Reddy Mopuri, Vaisakh Shaj. Venkatesh Babu Radhakrishnan, and Anirban Chakraborty. Zero-shot knowledge distillation in deep networks. In International Conference on Machine Learning, pages 4743-4751. PMLR, 2019.
[48] He Liu, Yikai Wang, Huaping Liu, Fuchun Sun, and Anbang Yao. Small scale data-free knowledge distillation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6008-6016, 2024.
[49] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers features from tiny images. 2009.
[50] Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 23/N, 7(7):3, 2015.
[51] Qiong Cao, Li Shen, Weidi Xie. Omkar M Parkhi, and Andrew Zisserman. Vggface2: A dataset for recognising faces across pose and age. In 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pages 67-74. IEEE, 2018.
[52] Karen Simonyan. Very deep convolutional networks for large-scale image recognition, arXiv preprint 11XXv:1449.1556 2014.
[53] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[54] Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020.
[55] Tsung-Yi Lin, Michael Maire, Serge J. Belongie, Lubomir D. Bourdev, Ross B. Girshick, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft coco: Common objects context. CoRR, abs/1405.0312 2014. URL http.htttt./dall.uii-trrret
de/ de/abb/oouraalsconu wwwp://aaaaa/ccroooooooooe/ooooe coror//orr1405.... www.:hhtwwwhnnmc htt.rr1400..tt11LLLLMMPPPPP
13

---

[56] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. 8. IEFE, 2017.
[57] Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. Zero-shot machine unlearning. IEEE Transactions on Information Forensics and Security, 18:2345-233 2023.
[58] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. leee, 2009.
[59] Jonathan Krause, Jia Deng, Michael Stark, and Li Fei-Fei. Collecting large-scale dataset of fine- tne-grained cars. 2013.
[60] Lars Buitinck, Gilles Louppe, Mathieu Blondel, Fabian Pedregosa, Andreas Mueller, Olivier Grisel, Vlad Niculae, Peter Prettenhofer, Alexandre Gramfort, Jaques Grobler, Robert Layton, Jake VanderPlas, Arnaud Joly, Brian Holt, and Gaël Varoquaux. API design for machine learning software: experiences from the scikit-learn project. In ECML PKDD Workshop: Languages for Data Mining and Machine Learning, pages 108-122, 2013.
[61] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint 1412.6984 2014.
[62] Mehryar Mohri, A Rostamizadeh, and A Talwalkar. Foundations of machine learning, ser. adaptive computation and machine learning, 2012.
[63] Shai Shalev-Shwartz and Shai Ben-David. Understanding machine learning: From theory to algorithms. Cambridge university press, 2014.
[64] Vladimir Vapnik. The nature of statistical learning theory. Springer science & business media, 2013.
[65] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning. pages 8748-8763. PMLR, 2021.
[66] Tero Karras, Miika Aittala, Janne Hellsten, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Training generative adversarial networks with limited data. Advances in neural information processing systems, 33:12104-1211 2020.
[67] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8110-8119 2020.
14

---

NeurIPS Paper Checklist
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency. research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation.
While "[Yes] " is generally preferable to "[No] ", it perfectly acceptable to answer "[No] provided proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset used"). In general, answering "[No] or "[NA]" is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
The main contributions of this work are accurately reflected in both the abstract and the introduction.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
15

---

Justification: Appendix I includes a dedicated "Limitations" section, highlighting our re- liance on generators pretrained on richly-featuree datasets and noting that applicability beyond supervised image classification remains unverified.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: All assumptions are explicitly stated in the statement of Theorem in the main text (Section 4), and the full proof of Theorem is provided in Appendix C.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
16

---

The experimental procedure and pseudo-code are described in the main text (see Algorithm 1), Section 5 details all datasets, model architectures, and hyperparameters. and we have made the full code available for reproducers. Guidelines:
Justification:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not be perceived well by the reviewers; Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (c.g.. a large language model), then there should either be way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset instructions for how construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: The full code is available at the repository URL listed in the appendix, and all experiments use standard open-soure datasets; detailed instructions for data access and environment setup are provided in that repository.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.. cc/
for more details.
While encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https //nips http://www.//..ceeeooo/oeetaaaaa
for more details.
17

---

The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
reproducible, they
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification: Section 5 and Appendix C details all datasets, model architectures, hyperpa- rameters, and optimizers.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: Error bars in Figs. and denote one standard deviation computed over five runs with different random seeds (capturing variability from initialization and data splits), and all main table results are reported as mean + standard deviation.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
18

---

For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory. time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Section 5 specifies that all experiments were conducted on single NVIDIA RTX A5000 GPU (24 GB VRAM) and reports running time efficiency in Table
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http:p////eerrr......//////////a
Answer: [Yes]
Justification:
Our research fully conforms to the NeurIPS Code of Ethics: we only publicly available datasets, involve no human subjects or sensitive personal data, maintain transparency in methods and reporting, and preserve anonymity where applicable.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [No]
Justification: Our work's primary objective is to enhance privacy through machine unlearning. and we assess that the risk of malicious misuse is negligible. We anticipate solely positive societal outcomes and improved protection of user data and, therefore, have not included discussion of negative impacts.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
19

---

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our work's primary objective is to enhance privacy through machine unlearning. and we assess that the risk of malicious misuse is negligible.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We properly cite the original publications for all datasets, models and code used in this work, and note that they are publicly available under their respective open licenses.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwwpss.ppprsiiiiiii thcooee com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's is creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
20

---

Answer: [Yes]
Justification: We have ensured comprehensive documentation our assets in Section 5 and Appendix C. We make it available alongside the assets via anonymized URL.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for rescarch with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Our paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMSs if it is an important, original, or non-standard component of the methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality the research, declaration is required.
Answer: [NA]
21

---

Justification: We used LLMs solely for manuscript writing, editing, and formatting, and they did not contribute to the core methodological development.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non non- stanssand components.
Please refer to our LLM policy hattps://neurips.. 220p://cec///o.feeeeee///22///// for what should or should not be described.
22

---

This Appendix provides additional insights and detailed explanations supporting our main findings. We begin with a brief description of the datasets and evaluation metries. We then describe the hyperparameter configurations in our method. We subsequently present the full proof of Theorem [ and additional experimental results, including CIFAR-I00 and magelmageNet. Furthermore, we explore the effects of deleting 50% of the training dataset and provide ablation studies for datasets and models not covered in Section 5.4 To demonstrate the versatility of our method, we also conduct supplementary experiments based on class-wise unlearning scenario. Finally, we outline our limitations and propose avenues for future work. The source code available here: https
//github com/Lemma177//
A Datasets
A.1 CIFAR-10 and CIFAR-100
The CIFAR-10 10 and CIFAR-100 datasets Each dataset contains 60,000 color images a resolution 32x32 pixels. CIFAR-10 has 10 classes, such as airplanes, automobiles, and animals, while CIFAR-100 expands this to 100 fine-gra lne-grained classes. Both datasets are split into training set of 50,000 images and a test set of 10,000 images. These datasets are valuable in the computer vision area for evaluating the performance of classification models due to their balanced class distribution and moderate complexity.
49 are widely used benchmarks for image classification.
A.2 Tiny ImageNet
TinyImageNet dataset [50] is an image classification dataset commonly used in deep learning research. It is smaller version of the original ImageNet dataset (58). The dataset comprises 200 classes, with each class containing 500 training images and 50 validation images. Each image has resolution of 64x64 pixels, making it smaller than the original ImageNet dataset. The dataset includes 100,000 training images, 10,000 validation images, and 10,000 test images. We utilize the train set and validation set for experiments.
A.3 VGGFace2
The VGGFace2 dataset [52] a large-scale collection intended for face recognition applications. This dataset comprises facial data and is related to privacy preservation tasks. The dataset's high similarity among classes makes essential for evaluating the effectiveness of unlearning methods in practical applications involving facial data. The dataset comprises various facial images that differ in identity, pose, illumination, background, and expression. The dataset comprises over 3.31 million images sourced from than 9,000 individuals. To conduct our unlearning task, we randomly selected 100 individuals from a training dataset and resized them into 224x224 resolution.
A.4 Stanford Cars
The Stanford Cars [59] dataset is fine-grat ihe-grained image classification benchmark for car recognition. It consists of 196 classes, categorized by the manufacturer, model, and year of the vehicle. The dataset includes 8,144 144 training images and 8,041 test images. Many cars from the same manufacturer or similar models and years share very similar designs. Thanks to these characteristics, the Stanford Cars dataset is useful for evaluating how effectively unlearning methods can remove fine-grained visual details.
B Metrics
B.1 Accuracy
In order to assess classifier's performance, accuracy is frequently utilized. It measures the percentage of samples for which the true classes can be predicted with maximum certainty. Accuracy of a model F tested on a dataset of N samples {(x', ),.., (x-N, N\) is formulated as follows:
ACC 100 ΣN 8(0 (((x))
23

---

where .) is the Kronecker delta function.
B.2 Membership Inference Attack Score
Membership inference attack (MIA) [56] is metric used to determine whether specific data point was used during the model training. We employ MIA to verify the effectiveness of unlcarning. To compute the MIA score, pass the retain set (D,) and the test (D,) through the target model to obtain probabilities for each data point:
Pj = Fo D. F.
After that, We assign label to the probabilities from D, and label O) to those from Dr, and train a shallow model using these labeled data points:
shalllo (((rr 1); (Py, 0)))
In our case, we used the Logistic model from Scikit-learn [60] Following this, we pass the forget (Dy) through the target model compute probabilities for each data point and use the shallow model to predict labels:
P = (D)) Ús = Fshallow (Py)
The average of these predicted values is used as the MIA score:
N
MIA score N
B.3 Running Time Efficiency
To measure the Running Time Efficiency (RTE), we record the time taken for the entire unlearning process, from the execution of the unlearning algorithm its completion, expressed in seconds. This measurement excludes any preparations, such as data loading, preprocessing, or any metadata computation that may need be conducted in advance. These steps are not included in the RTE metric to ensure a fair comparison that focuses solely on the efficiency of the unlearning methodology itself.
C Implementation and Hyperparameter Settings
We set the hyperparameters for RUAGO as follows. The weights Ycls. Yadv, and Thn were selected within the range [0, 5). The coefficient "1 was varied within [0.01, 1.50). while "2 was fixed 0.01. The learning rate was adjusted within [5 x 10-5,5 10-1), and training was performed for to 50 epochs. We used the SGD optimizer for training the original model and the Adam optimizer [61 for unlearning baselines. For adversarial attacks, we applied the PGD attack [36]. All experiments were conducted using five different random seeds on a single NVIDIA RTX A5000 GPU.
D Proof
Theorem (Generalization Bound under Sample Difficulty Scheduling). Let Hi C H2 .... Hr be a nested sequence of hypothesis spaces with VC-dimensions de VCdim in each curriculum stage t, and define the true risk by R(F) = E< ((FF()), v) and the empirical risk by R,,(F) = + (F((x)), y.). Let the original (teacher) model be Fo H4. and let the unlearned (student) model be FD Hr. Consider the optimal retrained model For HT such that R(Fo.) = minzeHr R(F). Then, drawing v. i...d. samples,
I
R(F!) -(FFo)) S 0
log + E.
24

---

Proof. Fix 8 > 0. For each t = I.....I T, define
de (log(n/d.) + log(T/6))
81 = CV
of
de log n2
where C' > 0 is universal constant from the VC uniform-convergenne bound, de 2 is the (finite) VC-dimension of stage-t hypothesis space, n 2 is the sample size, and (0, 1), respectively. Hence > O. By the standard VC miform--convergence theorem (42, for any single hypothesis space H4.
Pr
sup [RFF) - Rm LEH.
( (F) S St 2 21-4 4
To ensure this bound holds simultaneously for all T stages, we apply a union bound. Thus, with probability least. 1 6, we have
R(F) - Ra(F) S Et for every F E Hr, t I.....T.
Let
Fi Fo. Fr = Fly F FB.,
and define
= R(Fi) ( R(F"),
which is fixed constant since Fi and F are fixed; hence, their error gap depends on the generator. Then
R(Fr) R(F) [ R(F)) + ( R(F)) = [R(Fr) R(Fi) +
Next, telescope the first term:
T R(FT) R(Fi) = -((()))((F-))))) R(F-1))
h-2
For each t= 2.... T. using He-1 S He and the fact that F, minimizes the empirical risk over Has
we have (Fi) < Rt (F.-1). Thus,
R(F:) - R(F(-1) = (R(F)) (n(F)) + (Rn(F) (F(-F-))) + (Rn(Fi1) R(F(11)
R(F) - (F)) (Rn(F) (F--)) + (F--1) - R(F--1)
E, + 0
Et-1,
The first line is identity. The second line follows from the property that I |z]. The third line follows because: (1) by the uniform convergence bound. [R(F) (F.)l S 6, and RR, (F.-1) R(F,-1) S ft-1: and (2) since F, minimizes the empirical risk over Hr and F. E H, (due to the nested spaces), we have (F,) < Rt (F. which implies the middle term is non-positive.
Summing over t 2..... .....TTT gives
T $ 2 Et-
R(Fr) R(Fi) < Σ
(e++)-1)
2
1=1
Therefore
R(F!) R(Fo.) s 2 Σ
E t
Noting that each 9, O(v log n/n). conclude
R(F!) R(Fo)) S o
Σ
de log n
+
[=1
25

---

Table 5: Performance of RUAGO and baselines on CIFAR-100 100 and TinylmageNet, reported as mean + std, with AVG indicating the accuracy gap between unlearned and retrained models. The "D,,-free columns (V1 X) marks retain-free methods. Blue and red highlight the best results for retain-based and retain-free methods, respectively.
(a) Results on CIFAR-100.
7, free
VGC16
ResNet18
VIT
R.A
UA
TA
AVC
RA
UA
TA
AVG
RA
UA
TA
AVG
Original
99 9000000000
99,9660022
72.9340.24
99,9720.00
99 99,9949.02
56.5540.32
98.4360.41
06.2060.52
92.62:022
Retran
99 39.9060000
71:925071
71.8920.26
99.97720.00
64.18420.1
55 55.44+1).41
58.45560.99
92. 92.1649.55
02.51:00311
Bad-T
99.9750000
714470076
70.15=0.100
0.77
99.91=0.01
45.14+267
51.52210.35
7.67
92.9366).25
92.97=0015
86.92=0.17
0.5
SCRUB
99, 58
75.91a6.45
69.8920.34
2.03
99.70=0.08
55.1649.58
54.3510.25
99.3240.02
97.35590.4
93,00.0.08
2.19
Un
99 99.58800000
67:98e1000
66.63691.16
3.09
99.98e9.01
46, 46.75+2.18
47.61=40.19
8.42
98.7456).18
96.78e0.20
92,47:00 26
1.65
N0.4860076
55
54.7060.41
14.39
61.1560.55
45,95411.22
36.91+00.34
97.3220.04
97.2660015
91,9860
2.27
SSD
89. 15.77
89 10.06-10.79
63.27+8.50
59
12.2
86.34-13.00 98
86.21+13.75
46 34+6.12
14.92
02.22+2.99
91:86+2.81
87. 87.50+2.48
1.84
SCAR
81,90s1883
41
45.22:1.07
58.3340
57,53:0.39
24.0610.37
26.56
90,9310.25
92
86.90u0
3.97
RUAGO
99. 93.0330.13
67.00
68. 70.006
3,02
99,0120.18
58.90
52.42491.53
3,09
98.5161.18
96.2242.46
94.8223.75
2.18
(b) Results on Tiny ImageNet.
D2
VGGL6
ResNet18
VIT
fize
RA
UA
TA
AVG
RA
UA
TA
AVG
XA
UA
TA
AVG
Original
99.98+11.00
99.9840.02
59.97=00.7
99.50=0000
99. 98
45.67=0..2
96.22=0004
96.2860.00
90:96+0006
Retrain
90.98+0.00
58, 19.0.44
58.09H0.33
99.08-0.00
44.63e0444
44 35.35
0
96.21+0003
90.8240.25
91.0340.24
Bad-T
99.99611.00
51.5991.63
54.85a0.26
3.28
98.33-0.15
14.08=3.15
30.33231.00
13.04
96.0000012
19.1090030
90.6300.14
0.78
SCRUR
99.98+1.00
964
58.6000 22
12.91
09.56-0000
99. 01.96-000
4602-4007
19
97.32=1.72
95.01+1661
90.15el.57
SalUia
99/97411.01
9.24e14.42
44.12s1144 .43
20.99
99.96-0011
10.07215.05
32.5142.04
15:47
97. 97.9000000
94.83400.00
90.6740009
2,02
BS
62.7241.771
55.25501885
25.64a00:29
20.88
73.14:0.72
55. 19.1966
$1.09291.39
16.89
96.29
96.26a11.37
901.99240001
1.86
SSD
84.23113.38
84.01=13.06
46.0227.72
17.85
71.17=25.50 56
70.98425.00 68
30.97+10.00
22.85
85.62410.06
85.42410.25
80.9339974
SCAR
57.0811.77
57.00661.99
27.23e1155
24.99
46.00=0.22
45 45.93as1.36
13.49a11.38
28.7
91.37a00.66
91.21at1.20 20
X5. 15.55553).2
3.58
RUAGO
9937780.2
35.6580.02
55,0230.08
1.91
98.660015
41.52a1.10
39.1880022
95.95a0005
92.4830.23
90.56a0:06
E Additional Experiments
We additionally conducted experiments using the CIFAR-100 and TinylmageNet datasets. The results for CIFAR-100 are summarized in Table Sja). Consistent with the findings from previous experimental results in Section [5.3] RUAGO demonstrates the most robust performance among retain-free methods. Retain-free base linesines, such as those evaluated on VGGI6 and ResNet18 models, demonstrate AVG values exceeding 10.00. In contrast, our proposed method achieves an AVG value of approximately 3.00, indicating a significant improvement over the other approaches. Additionally, RUAGO demonstrates unlearning performance comparable to retain-based methods. Notably, for the R 8 model, RUAGO achieves an AVG value of 3.09, representing the highest unlearning performance across all baselines. In terms of the MIA score, our method effectively mitigates privacy leakage. As shown in Fig. 4 a). Bad-T (Bad-T), which demonstrated the highest accuracy performance, exhibits a substantial discrepancy in the MIA score compared the Retrain model. This discrepancy suggests a potential Streisand effect, which could lead to significant privacy leakage. On the other hand, while the SCAR method achieves an MIA score close that of the Retrain model, it falls short in accuracy performance, as indicated in Table (ta). Unlike these methods, RUAGO not only achieves superior unlearning performance in accuracy but also shows an MIA score similar to that of the Retrain model, indicating better privacy protection compared to other methods.
The experimental results on TinylmageNet, as shown in Table further confirm that our method significantly outperforms retain-free baselines. These findings indicate that retain-free approaches struggle with datasets containing many classes, such TinylmageNet, which includes 200 classes. In contrast, RUAGO demonstrates remarkable unlearning performance under these challenging conditions. Furthermore, when compared retain-based methods, our approach consistently achieves superior results. Specifically, for the ResNet18 model, competing methods fail to deliver satisfactory unlearning outcomes, deviating from the desired unlearning objectives. Conversely, RUAGO achieves an AVG value of 3.1, 1, the best among all baselines. Regarding the MIA score, our approach consistently achieves an MIA score relatively close to that of the Retrain model as illustrated in Fig. [b). similar to results observed on other datasets. This alleviates concerns about the Streisand effect. Furthermore, our method demonstrates superior accuracy performance, indicating its capacity to achieve a remarkable equilibrium between model efficacy and privacy safeguarding. These results emphasize the effectiveness of RUAGO in the instance-wise unlearning scenario, even in settings without access to D,..
26

---

Table 6: Performance comparison for unlearning 50% of D on the CIFAR-I0 and VGGFace2 datasets.
(a) Results on CIFAR-10
D,
VGG16
ResNet118
VIT
free
RA
UA
TA
AVG
RA
UA
TA
AVG
RA
UA
TA
AVG
Original
10000000000
1000000000
95.3361135
1000000000
26,5480.25
99.8540001
992460005
983770007
Retrain
100,00+0.00
90.7900.11 18
90.19+0.28
100,0000.00
$1,35H003
51.0340,31
0
99.84H0.02
98.9640.02
98, 700000
Bad-T
99.9860002
89,82a4.29
86, 26.22922.22
1.66
99.9820.00
$2.32x1.10
77.5140.22
1.43
99.4720.07
98.8820.14
98.01a0.16
0.41
SCRUB
100000
59.54
92,97750009
3.94
10000H000
99.73H105
56,9500.05
80G
99.90H1012
998669002
99.12
Sallin
99.92+0.06
88.06e1.31
87,01+0441
1.70
99.26H0 16
$1,4961,49
75. 194081
2.22
99.7540.05
95.97+0.09
98, 18.34m0.11
0.22
98 98.67=0.04
98.5740.14
89.96-0.12
90,9940.36
90.84H1,37
77. 77.0240.22
7.44
99.71+0.03
99,74+0.02
00.0000.01
0.34
SSD
95. 15.96s2.54
96 96.02a2.61
87,43:2.52
4.01
72,01a41.78
72. 18
62,84,34,30
18.51
99/7610.05
99 00.80:0.05
98, 12.80.0
0.34
SCAR
93.7320.30
93.65
85.18:0.30
87,936041
$7.0660.004
71.3640.27
9.28
99.1720.04
99.28:0.02
98.40s0055
RUAGO
98. 702008
91 91.4200.38
89.89600.10
0.75
97.29e1.41
82.5
82.48a0).30
1.71
99.75511.14
9000800:04
98.51a0005
0.08
(b) Results on VGGFace2
P2
VGG16
RecNei18
VIT
fice
RA
UA
TA
AVG
RA
CA
TA
AVG
RA
UA
TA
AVG
Original
18.15
98.5940.20
15.9640.10
99.88-002
9988--002
0245240007
99.34-006
99.25-0.15
96.7940.15
Reumain
X
99.9120.01
94,0740.07
94,5940,27
0
92,0910.12 13
85.85.0.11
86.2 36.22:0.26
98.81a0.10
94.03.0.18
94, 94.1900.20
Bul-T
X
99,8240.01 96,8420.82
94,1240,72
1.11
98.0360.21
79,78s3.95
88 88.92.0.86
4,90
98. 98.50s0.11
95.7740.31
93,72x0.15
0.34
SCRUI
100.00+0.00
96.6965.19 19
97 07.44+0.02
1.85
97.2740.15 15
97.26+n009
94. 1840000
8.21
99 39.52=0.04
99,30+0.05
96.99+0005
2.95
SalUn
99,96.0.02 X
92.60s1.26
93.01a0,43
98.7440.18
92.09:0.77
66
96.01s0.33
94.83:0:42
93,4490.60
BS
76.5R
76.64a0.70
78.41a11.33
18.98
69.50s1.17
69.19:1.53
65.65e1.30
19.94
98.63e0.13
98661:0.08
95.9550.04
2.17
SSD
97.5840.38
97.59+0)44
93.8840.65
2.19
83.2762.68
83.88-2.93
81.1242.71
97,39=0.58
97.39=0042
94.65e0.52
1.75
SCAR
97.89x0.44
97.93+0.34
94.08+0.59
14,15
88 25+0.88
86 66.09:2:53
84 70.0002
2.17
97 07.07=00.06
97. 97.20=0000
94, 94.54x0.13
1.68
RUAGO
11.001
93.6110.15
91.3210.09
90.0310.26
87.5610.25
87.2840.51
97.58s0.11
93.32:0.35
94,4420.17
F Results with 50 % deletion
We designate 50% of the entire training dataset as forget set, thereby removing half of the training data. We conduct these experiments on the CIFAR-10 and VGGFace2 datasets. The results are summarized in Table 6 RUAGO demonstrates consistently robust unlearning performance even in large-scale unlearning. On the CIFAR- 10 dataset, results are similar to those presented in Section 5.3 where retain-free free methods fail to achieve effective unlearning, leading instead to significant decline in overall model performance. In particular, the Boundary Shrink method demonstrates a substandard outcome with an AVG value of 18.52. Retain-based methods also exhibit suboptimal unlearning performance; for instance, the SCRUB method records an AVG value as high as 3.94 in certain cases. In contrast, RUAGO achieves an AVG value of 0.75 and 0.08 on ResNet18 and ViT models, respec- tively, outperforming both retain-free and retain- methods. Similarly, on the VGGFace2 dataset, various baseline methods fail to achieve complete unlcarning. Retain-frre methods consistently fail to achieve effective unlearning, and even retain-based methods, such as the Bad-T method, exhibit excessive misclassification of Dr when applied to the ResNet18 model. Conversely, RUAGO not only outperforms all retain-free free methods but also achieves lower AVG values than retain-basee based methods on ResNet18 and VGG16 models. These results highlight RUAGO as a practical and scalable solution for unlearning, effectively removes forget data while consistently maintaining model utility.
G Ablation Studies
Table g presents the ablation study results on the CIFAR-10, CIFAR-100, TinyImageNet, and VGGFace2 datasets. To assess the utility of Padv, we perform experiments using hard labels, which lead to UA values significantly lower than TA, indicating over-unlearning. This indicates that most samples in Dj are misclassified as an outcome counter to the objectives of instance wise unlearning. If Dr, which should behave as unseen data due to model generalization, is entirely misclassified, risks triggering the Streisand effect.
Furthermore, unlearning experiments with a generator trained on the TinyImageNet dataset demon- strate effective unlearning performance, highlighting the robustness of RUAGO when employing a generator trained on different OOD datasets. Specifically, we exclude experiments with classification models trained on the TinylmageNet dataset, as the training datasets for both the classification model and generator are identical. The unlearning performance is significantly diminished when a generator is trained from scratch through model inversion rather than pre-trained on an OOD dataset. Interestingly, omitting model inversion occasionally results in slightly better AVG values; however, the overall benefit of incorporating model inversion is evident across different datasets. Lastly, the
27

---

Table 7: Performance comparison for unlearning 10% of D on Stanford Cars dataset.
VGGi6
RosNat8
ViT
free
RA
UA
TA
AVG
RA
UA
TA
AVG
RA
UA
TA
AVG
Original
99.72ei1.04
99.6380.15
52.971622
99.615005
99.151155
748551.04
92.0750030
92.3e0000
77.92200.49
Rotrain
99.7240.04
45.38-145
44.14+1006
99.51+0.07
72.09-1.66
71661+106
91,93+0.44
75,50+085
75.06+0.20
Rad-T
99.6000.02
50.51+11.54
40.7540.31
6.19
99.42+0.05
99
67.6946.33
72.7240.62
1.87
92.31+0.10 10
80.17+1.45 48
77.0540.16
1.95
SCRUB
X
98.46611.60
48.6012.55
51.17s1.77
3.84
99.7440.05
75.58=1.44
73.6360.27
191
78.88440.55
38
63.81432.76
SAL
99.8++0.02
47.81+2.43
45.62+0.67
1.34
p9.82+0.03
44.45+14.09
67.64+0.43
10.64
98.30+0.21
73.56=2.10 18
77.12+0.50
3,26
RS
60.20+1.47
56,98+1991
18.16+0.74
19.2
99.42+0.04
99.19H0.34
72:41+0.10
9.39
89.54+0.67
88.97-1.56
74.79+0.79
5:57
SSD
95.8743.85
95.1314.53
47.49:4.23
18.98
98. 98.5648.76
97.8611.15
72.60:1.16
9:24
85.28&5.84
80.25g1.33
71.0768.58
5.32
SCAR
60.76+2.29
57.74+3.22
22.71+1.10
16.25
22. 22.15+9.13
21,5778.28
12:20+5.64
62.43
11. 11.00
12.14+8.02
9.56+6.12
70.07
RUAGO
89.8910.17
45,2811.29
37.5130.09
5.52
97.7720.08
69.29.1.14
65.9760.15
3.39
19,19
66.666
75.7010.16
0.65
Table 8: Results of the ablations studies on four datasets.
CIFAR-IE 10 TA
VGCFace2
RA
UA
MIA
AVG
RA
UA
TA
MIA
AVG
RUAGO
09:9420002
91. 31.3820.3 39
92.32:0.29
0.8510000
0.282
97 17.44400.66
95.4430.26
84.811117
0.6900.01
0.567
VOG16
Hard Labels
Diff. OOD
96.6121.23
99.9320.03
93.9221.78
93.5520.49
87.62s129 29
92.20.0.17
0.5120004
0.8510.01
0,384
3.146
97.3810.09
82.9820.91
S5 55.9640.62
95.4510.26
91.221011
79.73:0.65
0.682001
0.59g0.01
22.951
0.612
Go
72.55.16.08
72.45:15
68.22:13.85
0.60
24,338
1.57,0.21
160.0.22
1.4700188
0.73.002
94,287
wio MI
00.55-0022
03.48-0.52
02.38-0.10 16
0:8++0000
0.297
97 41.011111
95.490
04.01-0.8
0.7+0.01
0.573
w/o SD
99.47a0.11
88,93.0.22
91.41.0.33
0.8610.00
2.133
96.7510.12
91.6820.38
91.1910.19
0.7140.01
0.673
RUAGO
99 15
1.0
84,2630.26
0,4810.00
1.654
99. 3240.00
96.6110.22
96.4110.15
0.72g0.01
0.453
ResNett8
Hami Labels
98. 12 74
87,5552.81
62.65.0.99
0,3710.03
2,003
60.96 1.39611-43
31 52.520
57. 12:1.22
0.010001
18.011
Dill OOD
17.0.11
84.13=1
03.98=0.33
0,48:000
04
66:01.11
44:115
0.720001
0.443
w/ Lait C.
22.5526.74
15.158
26.10:6.46
0.34 22
63.961
26.
66.11418.41
64.71
0.46.0002
32.141
wio MI
99.34.0.14
84.6021 1.6
81.3810.16
0.1810.01
1.454
99.3110.06
96.61.0.22
96.35.0.16
0.72,0.01
0.176
w/o SD
$4.08s0.51
48, 31.0755
68. 08.54:0.35
0.73
23,917
98.9510.06
95. 05.82.0.26
95 95.97.0.118
O 0.6920.01
0,992
RUAGO
99.81
98 15
98.9 05.95
0.8910.01
0:047
98 08.9110.02
96 90
96 28.0.09
0.7620.01
0,425
Hand Labels
95. 05.2993.775
93.39 23.39200.2
94.18:0:75
0.71+0.01
4,985
88. 18.78
21
SS 19:1.58
0.54g0.01
10.431
Diff
99 00.00000.1
86.86660222 22
98. 93-0/02
0.8910.00
0.075
95.9110.02
96.0111
96 28:000110
0.7620.01
0:125
w/ Lmil Go
99 54.044
41.0..44
98. 12-002
0.871000
0:472
98 8310.03
96 8210,17
96 10:0.13 13
0.76.0.01
0:471
wio MI
99.8 99.8120.01
94
98. 98.9520.04
0.89+0.00
0.052
98.9 98.91+0.02
96.9480.19
96. 28:013
0.2620.01
0.427
w/o SD
99. 66.66600.4
98.50.0.26
98.6120.44
0.8810.01
0.345
98.8410.03
96.80.0.19
96.1 1:0.10
0.7620.01
0.457
CIFAR- 100
ImyglmgeNee
UA
MIA
AVG
UA
MIA
AVG
RUAGO
99.0320.13
67 00.0000.00 98
68, 68.70u0.35
0,491.000
3,021
99.8710.02
55.6510.62
55.02.00008
0.300001
19913
VGG16
Hard Labels
Diff.
95.75s0.34
99.1320.13
25.55=1.17
63.1620.49
43.6320.43
0.1810.11
0.4520.01
19.779
2.264
98.9120.10
7.9720.69
51.5050.18
0.8800011
19.293
w/ Lmit Go
16 1245.3
14.5724.00
13.8724.14
0,101001
66.411
4.9810.62
4.6510.54
4.17.0.31
0.10.0.25
81,710
wro MI
99 09.01s0
67.22=1 04
68 68:0.35
0.49:0000
2,964
99 87.000
55.0341.79 79
54 79.10.0
o 0.3300
1.894
w/o SD
$9.37260.71
51.3520.56
57.60g0.37
0.6920.00
15.157
94.42+0.52
37.4420.26
48.5920.61
0.68.0.00
11,941
RUAGO
99.0120.18
58.90
$2.4220.53 53
0.4720.01
3,086
98 15.6660015
41.5221.10
39. 39.48:0.22
0.3600001
3,101
Recher1
Hard
91. 9..91.0.9
14.58.2.14
15.0110.40
0.7610.02
22.690
88.0.99
4.5020.47
29.7610.39
0.87.0002
41.103
Dill, OOD
99 22222...2
56.25e1
52.65.0.51
0,4510 02
3.822
w/ Enit G.,
2. 40200.82
2.34
2.15
0.42+0.13 13
70.898
2.5020.31
2.7910.36
2.20 30
0
62.339
wio M]
99 04
59. 59.65 .03
$2. 19.0.2
0.4810.01
2.918
98. 5910.17
41.11a1.43
39, 19.5110.31
0.3620.00
3,243
SD
76. 16.26600.8 89
48.76 28.7660.20
33.34.0.13
0.6810.01
18,411
43.5210.97
24 24.0840.27
21 21.5310:43
0.8200011
45.952
RUAGO
97.65e0.06
64.64.0.33
02.10=0006
0.74
1,228
35,9840.03
92.4440.23
0.77:0.00
0,773
Hard Labels
90.31
36.3820.67
84.52=0.32
0.63#001
7.302
86.11
80.4540.46
$1.3
0.62=0.00
10.064
Diff. OOD
97.5920.08
94.6520.29
92.00:0.115
0.7410.00
1.286
w/ Emit Go
95. 14:0.25
92.0520.58
89 89.3210.10
0.7210.01
2,200
95.7210.06
92 3810.22
90.2110.16
0.77.0.00
1.712
wio MI
97. 97.64400.7
94.67=0.34
92.08.0.12
0.7580.00
1.249
35.99560.3
92 466
90.59#0:07
0.77=00.0
0.768
SD
95.6420.15
92.32=0.45
89.81=0.15
0.72+0.01
1.890
95,7610.05
92.3840.24
90.2960.12
0,77:0.00
0.919
importance of including sample difficulty is apparent, as omitting this strategy, particularly for the TinyImageNe dataset, leads to complete unlearning failure.
To further demonstrate the effectiveness of our approach, we conduct experiments on a fine- -raiied dataset where class-level similarities make discrimination particularly challenging. The experimental results on the Stanford Cars dataset [59] are presented in T The Stanford Cars dataset poses challenges for unlearning due to many similar classes and features. Nevertheless, our method shows consistently strong performance, achieving an AVG of 0.65 on the ViT model, outperforming all baselines.
H Class-wise Unlearning Scenario Experiments
As an extension of our main experiments, we explore class-wise unlearning to assess how well unlearning methods can eliminate information tied to specific semantic categories. Unlike the instance- wise unlearning scenario, which aims to delete individual instance samples independently of their classes, class-wise unlearning involves erasing all information about a specific class. Hence, an ideal class-wise wise unlcarning outcome for a classification model should result in entirely incorrect predictions
28

---

Table 9: Sensitivity analysis of inversion loss on CIFAR-10 with
Table 10:
Sensitivity analysis of main loss
weights (Yadv Ton %cho ResNet18.
weights (y, (2)72) on CIFAR-10 10 with ResNet18.
71
72
RA
UA
TA
Vadv Thnn Tells
RA
UA
TA
0
0.01
95.34
95.29
91.65
0
1
1
99.25
96.84
96.29
0.15
0.01
99.24
96.86
96.29
1
99.26
96.92
96.27
0.5
0.01
99.28
96.45
96.39
2
1
1
99.24
96.86
96.29
1 0.01
99.27
96.35
96.34
3
1
1
99.24
96.84
96.22
1.5
0.01
99.22
96.28
96.32
0
2
1
99.25
96.92
96.25
0.15
98.59
96.00
95,49
3
1
99.25
96.86
96.23
0.15
0.01
99.24
96.86
96.29
0.15
0.5
98.54
98.91
95,30
1
2
99.25
96.82
96.26
0.15
97.92
98.22
94.49
0
1
3
99.24
96.82
96.23
0.15
1.5
97.49
97.71
93.90
for the targeted class. Table 13 presents the performance of various unlearning methods across three models trained on the CIFAR-I0 dataset.
Specifically, for TRA and TUA, the reported accuracies correspond to the test retain set and test forget set, respectively, based on the targeted class within the test set Dj. aligmment with the Retrain model, RA and TRA should remain as high as possible, while UA and TUA should be close to O, indicating complete deletion.
All baseline methods generally exhibit robust class-wise unlearning performance; however, certain limitations are observed. For instance, the Bad Teaching method records high RA and TRA values, demonstrating that model utility remains intact, yet the elevated UA and TUA scores reveal incomplete deletion. SCRUB exhibits highly unstable unlearning results across different seeds, particularly for the VGG16 and ViT model. SalUn outperforms the other two baselines that utilize the retain set, showcasing more stable unlearning performance but still falling short of complete deletion.
Turning to retain-free free methodologies, Boundary Shrink not only fails to preserve model utility but also does not accomplish complete deletion. In contrast, SSD and SCAR deliver impressive unlearning performance without relying on a retain set. However, SSD fails to handle larger models, as shown by its poor results VIT. SCAR similarly struggles with large models and incurs substantial training time costs, as evidenced by the ResNet18 scenario, making it inefficient since it requires significant computation for each unlearning request. In contrast, our approach involves training the generator on out-of of-iiitribttion (OOD) data, allowing us to prepare for unlearning requests proactively before they are made.
In our proposed method, RUAGO, we filter out the generated outputs X that are predicted belonging to the class slated for deletion. While not exhibiting the highest performance metrics, our approach pro- vides adequate and stable unlearning performance. This characteristic stems from the core design of RUAGO: its main signal, the adversarial soft target, optimized for reshaping decision boundaries lo- cally around individual samples, making it highly effective for instance-wise unlearning. In contrast, class-wise unlearning requires a more global ob-
Table 11: Effect of alignment learning rate (Ir). Excessive alignment strength leads to collapse.
LR
RA
UA
TA
5.0c-05
99.14
97.12
96.09
1.0e-04
99.24
96.84
96.29
5.0e-04
98.21
96.62
95.71
1.0e-03
94.20
96.49
92.87
5.0e-03
11.63
15.47
12.14
1.0e-02
2.95
3.11
3.07
jective of erasing an entire semantic concept across the input space. To maintain a consistent and unified pipeline, we applied the same mechanism to both scenarios. This design choice led to effective unlearning, especially on VGG-16 and ViT where UA/TUA values were near-zero, though it resulted in residual information in some specific model-setting combinations. Notably, this highlights crucial trade-off. Other retain-free methods such as SSD and SCAR, which perform well in class-wiss deletion, tend to struggle significantly with instance-wit unlearning, larger models, or high com- putational costs. contrast, RUAGO maintains commendable and balanced performance across both class-wise and instance-wise unlearning scenarios. This versatility underscores the applicability of RUAGO diverse unlearning challenges, demonstrating its robustness and efficacy various operational contexts.
29

---

I OOD Datasets and Generator Pretraining
To assess distributional differences between classification datasets and generator training sets, we embed each image with CLIP [65 encoder and compute the Fréchet Distance (FD):
F)) = 1 Myll+
+ Σy - -
where (ux, Ex) and (My, Σy) represent the means and covariances of the features extracted from two datasets, A' and V' respectively. Lower FD indicates more similar distributions. Figure shows these FD scores confusion matrix. COCO diverges markedly from all four classification datasets, and TinyImageNet has an exceptionally high FD with VGGFace2. These observations confirm that COCO and IminylmageNet are valid OOD sources under easy-access assumption.
Table 12 summarizes ablation results using genera- tors pretrained on three datasets: in-domain CIFAR-
(a) CIPAR-100
10 and two OOD sources (COCO, TinylmageNet), Although generator pretrained on the in-domain
0.9
0.8
0.7
data (CIFAR-10) yields the best unlearning perfor-
0.6
mance, presents critical flaw: prevent infor- mation leakage, must be discarded after a single
0.4
0.3
unlearning task. This single-use nature makes it impractical for scenarios requiring sequential un-
0.2
0.1
learning requests and introduces substantial over-
head. This highlights a fundamental challenge in retain-fres unlearning: mechanism is needed to approximate the distribution of data that should be retained. We posit that OOD-trained generator
VGG16
ResNet18
V:T
(b) TinylmageNet
0.9
0.8
serves an efficient and straightforward surrogate
0.7
0.6
for this purpose. The importance of this pretraining
0.5
step is demonstrated in Table [ where using an un- trained, randomly initialized generator results in significant performance drop. Therefore, we focus
0.4
0.3
0.2
our main approach on OOD-pretrained models.
0.1
0
We further evaluate an extreme OOD case by pre- training on VGGFace2. Despite its much smaller size, making it less readily accessible and poses challenges for generator training. the VGGFace2 generator only slightly underperforms the COCO model. Still, outperforms all retain-free baselines from Table L demonstrating robustness even in challenging worst-case scenarios.
VGG16
ResNet18
VIT
Bad-T
SCRUB SALUN BS SCAR
a SSD
m RUAGO Retroi
Figure 4: MIA results for each unlearning
method. The red dotted line represents the Re- train model; it is best to be closer to this line.
We use StyleGAN2-ADA 66 67 backbone for these experiments. While this requires pretraining step, we consider its cost practical trade-off for effective unlearning under the strict retain-free constraint. Training on COCO took R24 hours and on TinylmageNet s= hours (32x32 resolution on our GPU), with generated samples shown in Figures 6 and 7 To mitigate this dependency in future work, could explore the use of off-the-shelf generative models, assuming their training data does not introduce other privacy issues. We expect higher-resolution training to boost unlearning performance further.
Limitations and Future Work
We can point out several limitations of RUAGO. Initially, our experiments utilize generator trained on datasets with rich feature content. Generally, numerous open-source datasets with rich features are easily accessible, making them easy to obtain. However, there may be extreme scenarios where such datasets are not accessible. In such situations, it remains uncertain whether unlearning would be complete when employing a generator trained on simpler datasets, such as those with single-channel images, to unlearn classification models trained complex, high-feature datasets. Additionally, our experiments are limited to supervised image classification models. However, we believe that the fundamental design principles of RUAGO, particularly curriculum-base training over OOD samples,
30

---

Table 12: Unlearning performance across differ- ent generator training datasets.
00
CIFAR-10
0.00
9:14
27.66
83.93
51.32
CIFAR-100
0.14
0..00
22.21
80.98
47.48
Model
CIFAR-10 10
VGGFace2
COCO
RA
99. 99.99a0.01
99. 99.0020.09
99 09.9440.02
TinylmageNet
VGG16
93, 12+022222
92.7910.05
91.36+0.50
91.35=0.22
93. 93.38-00.99
92.32:0.29
300
AVG
0.11
1,28
0.28
VGGface2
83.93
80 98
70.84
0.00
65.26
UA
84. M4.9520.61
87 37.28:0.63
84.02a1 .00
COCO
10
ResNet18
86,20+0.22
81.57+0.37
84.36-4026
AVG
0.69
2,78
1.65
CIFAR-10
CIFAR-10D
TinylmageNet
VGGFace2
COCO
RA
99.8340.02
98 18.89:1.47
99,8110.01
VIT
TA
99.0010.01
99.05 09.005+0.09
98.8720.05
98. 08.9520.05
08.9500.16
0.35
0.05
Figure 5: Confusion matrix of FD scores across all datasets.
adversarial soft-target regularization, and generator-teacher alignment, not inherently tied to this specific domain. For instance, in natural language processing (NLP), these principles could be adapted by replacing the image generator with small language model, defining sample difficulty via token-level cross-entropy, and performing alignment in the hidden feature space rather than the pixel space. Adversarial soft-targets could similarly be constructed through perturbations applied to token logits. Nonetheless, we do not claim that our method can be directly applied to generative models. Adapting RUAGO architectures like GANs, diffusion models, large language models would require careful redesign and new, task-specific metrics. In summary. this work establishes our method in a foundational supervised setting to analyze the core mechanies of unlearning, while acknowledging that extending it to other domains is feasible but requires further investigation.
Consequently, future work should explore on low-quality images or even randomly initialized generators that do not rely on OOD data. On the theoretical front, current analysis offers generalization bound for the curriculum learning aspect, which helps explain how scheduling sample difficulty stabilizes the unlearning process. However, a unified theoretical framework that encompasses all components of RUAGO, including the adversarial soft-target mechanism, has not yet been established and remains an important direction for future work. Another key direction for future research to realize the roadmap for adapting RUAGO to other domains. This includes empirically verifying its effectiveness in tasks such as object detection and NLP, guided by the principles outlined above. Expanding the applicability RUAGO is an important avenue for future research.
versatile methodologies, including generators trained
31

---

Table 13: Class-wise unlearning performance of baseline methods and our proposed RUAGO on the CIFAR-10 dataset.
VGGI6
RA
TRA
TUA
AVG
MIA
RTE
Retrain
100.00 0.00
0.00 0.00
92.74 0.17
0.00 0.00
0
0.41 0.02
869
Bad-T
X
100.00 = 0.00
18.12 35.01
92.92 0.13
15.74 30.52
8.51
0.00
65
SCRUB
X
80.56 # 38.69
0.00 = 0.00
73.28 # 34,66
0.00 + 0.00
9.72
0.26 + 0.15
0.15
112
SalUn
X
100.00 0.00
1.23
92.42
0.70 +
0.46
0.00
65
BS
94.17 = 0.35
29.98 + 0.91
85.26 0.40
28.32 0.50
17.9
0.19
62
SSD
100.00 0.00
0.00
93.09 0.02
0.00 + 0.00
0.09
0.00
15
SCAR
99.66 0.05
0.03
91.46 + 0.14
0.60 = 0.25
0.79
0.00
143
RUAGO
97.77 0.21
0.04
90.18 0.23
0.04 d: 0.09
1.21
0.02
119
ResNet18
RA
UA
TRA
TUA
AVG
MIA
RTE
Retrain
x
99.99 0.01
0.00
86.56 0.24
+: 0.00
0.34 0.02
1,917
Bad-T
x
99.98 0.00
19.98 44.36
86.62
16.76 = 37.48
9.2
0.00 0.00
SCRUB
100.00 0.00
0.00 0.00
86.76 0.15
0.00 +: 0.00
0.05
0.01 0.00
67
SalUn
X
100.00 = 0.00
7.39 = 8.13
8
5.76 # 7.96
3.31
0.00 0.00
67
BS
85.79 0.66
19.40 + 0.49
75.02 + 0.46
18.62 = 0.54
15.94
0.00
82
SSD
99.99 0.00
0.00
86.70 0.04
0.00 0.00
0.04
0.00 0.00
15
SCAR
98.89 + 0.25
0.95 = 0.03
84.38 + 0.22
0,42 + 0.23
1.16
0.12
3,793
RUAGO
94.95 0.37
5.79 0.51
81.24 + 0.32
6.00 + 0.79
5.54
0.19 0.011
489
VIT
RA
UA
TRA
TUA
AVG
MIA
RTE
Retrain
X
99.85 + 0.03
0.00 = 0.00
98.90 0.07
0.00 + 0.00
0
0.04 + 0.01
4,856
Bad-T
X
99.78 + 0.03
12.45 + 4.27
9
11.44 5.39
6
0.00 0.00
4,592
SCRUB
X
99.75 0.18
43.53
98.88 0.22
80.34 43.18
40.20
0.24
3,656
SalUn
99.99 0.00
0.51
98.97 + 0.06
2.12
1.16
0.00 0.00
2,832
BS
35.16
93.45
7.766
30.14
0.05
522
SSD
84.77 0.29
0.00 1.98 + 0.75
83.70 a: 0.33
1.88 + 0.69
8.54
0.06 0.00
593
SCAR
23.55 9.78
23.35
0.00 0.00
37.96
0.27 +
265
RUAGO
99.60 0.05
0.78 + 0.13
98.59 + 0.10
0.76 + 0.09
0.53
0.02 + 0.01
524
32

---

Figure 6: Sample images generated by the generator trained on the COCO dataset.
33

---

Figure 7: Sample images generated by the generator trained on the TinylmageNet dataset.
34


Reviews:
[{"review_id": "qMEQMhP0JP", "reviewer": "Reviewer_Joyp", "summary": "The paper proposes Retain-free Unlearning via Adversarial attack and Generative model using OOD training (RUAGO), a novel retain-free image classifier unlearning method that does not require retain-data to prevent over-unlearning and preserve post-unlearning utility. RUAGO achieves this by: (1) generating adversarial soft targets from the forget set to guide the model’s previously learned decision boundaries, and (2) training a generative model on out-of-distribution (OOD) data to produce synthetic data, which can be used in place of retain-data without privacy concerns. The paper supports the use of synthetic data with a VC-theoretic analysis that informs a dynamic sample difficulty scheduler, and also employs inversion-based fine-tuning to align the generative model’s output distribution with the original data. RUAGO is evaluated against existing unlearning methods on the CIFAR-10/100, TinyImageNet, and VGGFace2 datasets using the VGG16, ResNet18, and ViT architectures, demonstrating strong empirical performance.", "questions": "- [Q1] Could Figure 1 be revised to make it more understandable? Specifically, what does \"G\" mean in retain-free w/ \"G\" and G trained w/ OOD? Could Baseline 1 & 2 also be specified?", "limitations": "The authors adequately addressed the limitations of their work.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 1, "significance": 2, "originality": 3, "strengths_and_weaknesses": "## Strengths\n- [S1] **Clear motivation and novelty.** Over-unlearning and the assumption of access to original retain-data are clear limitations in existing unlearning methods. A novel technique that resolves both would be a valuable addition to the unlearning toolkit. Incorporating VC theory to design a difficulty-based learning curriculum is also a novel idea in this context and could be of significant interest to the community.\n- [S2] **Strong empirical performance.** Experimental results clearly show that RUAGO performs well in terms of both classification accuracy and privacy protection.\n\n## Weaknesses\n- [W1] **Narrow scope and applicability.** The applicability of RUAGO is currently limited to unlearning image classifiers. There does not appear to be a straightforward way to extend RUAGO to generative models (where privacy concerns are more pressing due to higher pretraining costs and the potential for data memorization) since many of RUAGO's components assume a classification setup.\n- [W2] **Unclear theoretical implications.** Section 4.3 is quite unclear in its current form. For instance in Theorem 1, what does VC-dimension and $R(\\mathcal{F})$ mean? How does Theorem 1 justify quantifying each sample’s difficulty using its loss, as in Equation 4? What assumptions underlie the generalization bound, and are they reasonable within the distillation setup? Several such pieces are missing, making it difficult to assess the theoretical contribution of the paper.\n- [W3] **Experimental complexity.** The method involves multiple objective terms during training and requires extensive tuning of loss weights (e.g., the $\\\\gamma$ weights in Equation 5 and 6). The tested ranges of these hyperparameters also seem quite broad ($\\\\gamma_{cls}, \\\\gamma_{adv}, \\\\gamma_{bn} \\\\in [0, 5]$, $\\\\gamma_1 \\\\in [0.01, 1.50]$ and $\\\\gamma_2 = 0.01$). Could the authors provide guidance on how these values/ranges were chosen, how the results are expected to behave with different hyperparameter choices, and what the actual sensitivity of the method was?", "was_revised": true, "final_justification": "The paper offers a novel and interesting theoretical perspective on retain-free unlearning, and the results shared in the rebuttal demonstrate stable empirical performance. While I am leaning toward a positive score, I remain somewhat borderline due to concerns about its limited applicability.", "rebuttal": "**Thank you for Reviewer Joyp's insightful comments on our work.**\n\n**[W1] Narrow scope and applicability.**\n\nWe appreciate the reviewer’s comment. Our current scope is image classifiers under a retain-free constraint. We chose this setting because it lets us analyze the basic unlearning mechanics. However, we believe that the fundamental design principles of RUAGO, particularly curriculum-based training over OOD samples, adversarial soft-target regularization, and generator-teacher alignment, are not inherently tied to our current domain.\n\nFor instance, in NLP settings, one could replace the generator with a small language model, define sample difficulty using token-level cross-entropy, and implement alignment in the hidden feature space instead of the pixel space. Similarly, adversarial soft-targets could be constructed via perturbations applied to token logits. \n\nWe do not claim that our method can be directly applied to generative models. Adapting RUAGO to GANs, diffusion models, or LLMs would require careful redesign and task-specific metrics. In Appendix (Lines 1147–1149), we explicitly note that extending RUAGO beyond supervised image classification is still to be verified. In short, this work establishes the method in the simplest supervised setting. Extending to other domains is feasible but outside our present scope. We will add a brief roadmap in the Discussion to clarify.\n\n\n**[W2] Unclear theoretical implications.**\n\nThank you for Reviewer Joyp’s thoughtful comments on the theoretical clarity. We clarify our responses to the three sub‑questions.\n\n**VC-dimension and risk notation.**  \nThe Vapnik–Chervonenkis (VC) dimension is the standard measure of a hypothesis space's capacity. In our setting, each curriculum stage $t$ explores a finite *effective* hypothesis space $\\mathcal{H}\\_t$ with VC‑dimension $d\\_t=\\mathrm{VCdim}(\\mathcal{H}\\_t)$. We denote the true risk by $R(\\mathcal{F})=\\mathbb{E}\\_{(x,y)\\sim\\mathcal{D}}\\bigl[\\ell\\bigl(\\mathcal{F}(x),y\\bigr)\\bigr],$ and the empirical risk by $\\hat{R}\\_n(\\mathcal{F})=\\frac1n\\sum_{i=1}^{n}\\ell\\bigl(\\mathcal{F}(x\\_i),y\\_i\\bigr).$\n\n\n**Curriculum assumption and Theorem 1.**  \nTheorem 1 assumes the following: at early stages (easy samples) $\\mathcal{H}\\_t$ is small so $d\\_t$ is small; as harder samples are added, $d\\_t$ grows gradually. By progressively controlling this stage‑wise capacity, Theorem 1 upper‑bounds the risk of the unlearned model $\\mathcal{F}\\_\\theta^{U}$ by a finite margin concerning the retrain (gold‑standard) model $\\mathcal{F}\\_{\\theta^*}$. A closely related VC-based bound is used in recent data-free KD work, such as CuDFKD [47], which explicitly bounds each stage's risk via the VC dimension; our distillation pipeline is similar to these assumptions.\n\n\n**Loss‑based difficulty scheduling.**  \nWe implement the curriculum by defining sample difficulty as a monotonic decreasing function of the current loss, $w_k=\\frac{1+\\exp(-1/\\lambda)}{1+\\exp(\\,\\ell_k-1/\\lambda\\,)},$ and gradually increasing $\\lambda$ so that training starts with easy (low‑loss) samples and progressively focuses on harder ones. OOD synthetic training data can introduce noise and distribution shift. Accordingly, we initialize with easy samples to keep the effective capacity and empirical risk small, which helps prevent divergence when harder samples are increasingly considered. We establish this connection immediately after Theorem 1 to demonstrate how the VC-bound justifies Eq. (4) and our easy-to-hard strategy, thereby explaining why the model converges toward the desired unlearning solution.\nWe hope this will clarify the ambiguity in W2 and explain the theoretical contribution clearly.\n\n**[W3] Experimental complexity.** \n\nWe appreciate the reviewer’s comment regarding multiple objectives and the broad hyperparameter space. We adopted a broad search range to capture strong configurations across architectures and settings. To address the concern about multiple objectives and a broad hyperparameter space, we conducted a sensitivity analysis of the loss weights and examined how each term affects performance. \nIn each experiment, we varied a single hyperparameter while fixing others to isolate its individual effect. On the VGGFace2 dataset with the ResNet-18 model, we varied $\\gamma_{\\text{adv}}, \\gamma_{\\text{bn}}, \\gamma_{\\text{cls}}$ in the range of [0, 5] as shown below:\n\n| $\\gamma_{\\text{adv}}$ | $\\gamma_{\\text{bn}}$ | $\\gamma_{\\text{cls}}$ | RA      | UA    | TA    |\n| --------- | -------- | --------- | ------- | ----- | ----- |\n| 0         | 1        | 1         | 99.2490 | 96.8387 | 96.2874 |\n| 1         | 1        | 1         | 99.2564 | 96.9228  | 96.2734 |\n| 2         | 1        | 1         | 99.2434 | 96.8556 | 96.2874 |\n| 3         | 1        | 1         | 99.2378 | 96.8387 | 96.2171  |\n| 4         | 1        | 1         | 99.2471 | 96.8556 | 96.2593 |\n| 5         | 1        | 1         | 99.2359 | 96.8219 | 96.2312  |\n| 0         | 2        | 1         | 99.2546 | 96.9228 | 96.2453 |\n| 0         | 3        | 1         | 99.2471 | 96.8556 | 96.2312 |\n| 0         | 4        | 1         | 99.2583 | 96.8387 | 96.2734 |\n| 0         | 5        | 1         | 99.2471 | 96.8556 | 96.2312 |\n| 0         | 1        | 2         | 99.2490 | 96.8219 | 96.2593 |\n| 0         | 1        | 3         | 99.2378 | 96.8219 | 96.2312 |\n| 0         | 1        | 4         | 99.2471 | 96.8892 | 96.2874 |\n| 0         | 1        | 5         | 99.2359 | 96.8892 | 96.2734 |\n\nThe results show that RA, UA, and TA remain stable with variations limited to within ±1%. This indicates that the performance is not overly sensitive to individual loss and can maintain robust performance across a wide range of hyperparameter settings. \nAdditionally, we conducted further experiments to evaluate the effect of varying $\\gamma_1$ and $\\gamma_2$:\n\n| $\\gamma_1$ | $\\gamma_2$ | RA      | UA      | TA      |\n| ------- | ------- | ------- | ------- | ------- |\n| 0       | 0.01    | 95.3425 | 95.2917 | 91.6467 |\n| 0.15    | 0.01    | 99.2359 | 96.8556 | 96.2874 |\n| 0.5     | 0.01    | 99.2789 | 96.4520  | 96.3859 |\n| 1       | 0.01    | 99.2658 | 96.3511 | 96.3437 |\n| 1.5     | 0.01    | 99.2228 | 96.2838 | 96.3156 |\n| 0.15    | 0       | 98.5895 | 95.998  | 95.4859 |\n| 0.15    | 0.01    | 99.2359 | 96.8556 | 96.2874 |\n| 0.15    | 0.5     | 98.5353 | 98.907  | 95.3031 |\n| 0.15    | 1       | 97.9169 | 98.2176 | 94.4874 |\n| 0.15    | 1.5     | 97.4909 | 97.7131 | 93.8968 |\n\n\nWhen fixing $\\gamma_2=0.01$ and varying $\\gamma_1$ from 0 to 1.5, we consistently observed strong and stable performance. Fixing $\\gamma_1=0.15$ and increasing $\\gamma_2$ showed that excessively large $\\gamma_2$ can slightly degrade performance.\n\nDespite involving multiple objective terms, these results demonstrate that RUAGO can maintain consistent and stable performance across a wide range of parameter values. This clearly shows that our method is robust and feasible even without extensive tuning, alleviating the concerns of the reviewer. As a practical guideline, in our experiments, we first fixed $\\gamma_{adv}=\\gamma_{bn}=\\gamma_{cls}=1$ and $\\gamma_{2}=0.01$. We then tuned $\\gamma_{1}$ on a grid from 0.1 to 1.5. This one-dimensional sweep was sufficient to reach near-optimal UA and RA on every model–dataset pair, showing that RUAGO requires minimal effort for setting hyperparameters. We will describe this practical guideline explicitly in the final version.\n\n\n**[Q1] Ambiguity in Figure 1.** \n\nWe thank the reviewer for pointing out the ambiguity in Figure 1. In the final version, we will revise both the legend and the caption to improve clarity. Specifically, the \"G\" in \"retain-free w/ G\" refers to a generator trained on OOD data. This setting denotes the scenario where unlearning is performed solely using synthetic samples from this generator, without access to any retain data. Additionally, we will clarify that \"Baseline 1\" and \"Baseline 2\" refer to prior unlearning methods: Baseline 1 corresponds to Bad Teacher [17], which uses the retain set, and Baseline 2 to Boundary Shrink [19], which does not require retain data. We will revise these explicitly."}, {"review_id": "cZBVF2uvjj", "reviewer": "Reviewer_rwYH", "summary": "This paper introduces retain-free machine unlearning framework, RUAGO. It utilizes adversarial probability module to generate soft labels to mitigate over-unlearning and a OOD data generation model to distill the original model's knowledge to unlearned model. RUAGO generally outperforms existing retain-free unlearning methods and achieves comparable performance to retain-based methods, demonstrating its effectiveness.", "questions": "- Although it outperforms other methods in instance-wise unlearning, it seems to be not effective in class-wise unlearning for some cases. What makes this difference? Is there any analysis or ablation study for class-wise unlearning?", "limitations": "- Although the authors theoretically have proven the generalization bound, it is limited to the curriculum learning, not to each method.", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "### Strength:\n- This paper proposes retain-free unlearning framework which is effective for instance-wise unlearning.\n- This paper provides theoretical analysis, as well as empirical results for the proposed methods.\n\n### Weakness:\n- Proposed methods seem to be applicable on the limited situations, for example, this paper only considers image classification. Moreover, one term in L_inv is only applicable to the batchnorm-based model.\n- Proposed methods introduce additional hyperparameters, such as γ_cls, γ_adv, and γ_bn, but there is no analysis about the effect of each hyperparameter.\n- Pretrained generative model is necessary. Unlearning performances are highly degrades without it.", "was_revised": true, "final_justification": "While the hyperparameter issues were clarified, the method’s limited applicability and reliance on a pretrained model remain.\n\nTherefore, the rating remains unchanged at borderline reject.", "rebuttal": "**We thank Reviewer rwYH for the thoughtful comments.**\n\n**[W1] Limited applicability.** \n\nWe appreciate the reviewer’s comment. Our current scope is image classifiers under a retain-free constraint. We chose this setting because it lets us analyze the basic unlearning mechanics. However, we believe that the fundamental design principles of RUAGO, particularly curriculum-based training over OOD samples, adversarial soft-target regularization, and generator-teacher alignment, are not inherently tied to our current domain.\n\nFor instance, in NLP settings, one could replace the generator with a small language model, define sample difficulty using token-level cross-entropy, and implement alignment in the hidden feature space instead of the pixel space. Similarly, adversarial soft-targets could be constructed via perturbations applied to token logits. \n\nWe do not claim that our method can be directly applied to generative models. Adapting RUAGO to GANs, diffusion models, or LLMs would require careful redesign and task-specific metrics. In the appendix (Lines 1147–1149), we explicitly note that extending RUAGO beyond supervised image classification is still to be verified. In short, this work establishes the method in the simplest supervised setting. Extending to other domains is feasible but outside our present scope. We will add a brief roadmap in the Discussion to clarify.\n\nRegarding the final term in $\\mathcal{L}\\_{\\text{inv}}$, this batch-norm statistics regularizer applies only to BN architectures. We use it to speed convergence by steering generator outputs toward natural feature statistics during inversion. In our ViT experiments (which lack batch normalization), we simply disabled this term by setting $\\gamma\\_{\\text{bn}} = 0$, and RUAGO still outperformed other retain-free methods in both UA and TA (see Table 1). Its usage is similar to that in recent DFKD studies, which also employ batchnorm cues to improve synthetic sample quality. We will clarify in the final version that this regularization is optional and safely deactivated in architectures without batch normalization.\n\n**[W2] Experimental complexity.** \n\nWe appreciate the reviewer’s comment regarding multiple objectives and the broad hyperparameter space. We adopted a broad search range to capture strong configurations across architectures and settings. To address the concern about multiple objectives and a broad hyperparameter space, we conducted a sensitivity analysis of the loss weights and examined how each term affects performance. \nIn each experiment, we varied a single hyperparameter while fixing others to isolate its individual effect. On the VGGFace2 dataset with the ResNet-18 model, we varied $\\gamma_{\\text{adv}}, \\gamma_{\\text{bn}}, \\gamma_{\\text{cls}}$ in the range of [0, 5] as shown below:\n\n| $\\gamma_{\\text{adv}}$ | $\\gamma_{\\text{bn}}$ | $\\gamma_{\\text{cls}}$ | RA      | UA    | TA    |\n| --------- | -------- | --------- | ------- | ----- | ----- |\n| 0         | 1        | 1         | 99.2490 | 96.8387 | 96.2874 |\n| 1         | 1        | 1         | 99.2564 | 96.9228  | 96.2734 |\n| 2         | 1        | 1         | 99.2434 | 96.8556 | 96.2874 |\n| 3         | 1        | 1         | 99.2378 | 96.8387 | 96.2171  |\n| 4         | 1        | 1         | 99.2471 | 96.8556 | 96.2593 |\n| 5         | 1        | 1         | 99.2359 | 96.8219 | 96.2312  |\n| 0         | 2        | 1         | 99.2546 | 96.9228 | 96.2453 |\n| 0         | 3        | 1         | 99.2471 | 96.8556 | 96.2312 |\n| 0         | 4        | 1         | 99.2583 | 96.8387 | 96.2734 |\n| 0         | 5        | 1         | 99.2471 | 96.8556 | 96.2312 |\n| 0         | 1        | 2         | 99.2490 | 96.8219 | 96.2593 |\n| 0         | 1        | 3         | 99.2378 | 96.8219 | 96.2312 |\n| 0         | 1        | 4         | 99.2471 | 96.8892 | 96.2874 |\n| 0         | 1        | 5         | 99.2359 | 96.8892 | 96.2734 |\n\nThe results show that RA, UA, and TA remain stable with variations limited to within ±1%. This indicates that the performance is not overly sensitive to individual loss and can maintain robust performance across a wide range of hyperparameter settings. \nAdditionally, we conducted further experiments to evaluate the effect of varying $\\gamma_1$ and $\\gamma_2$:\n\n| $\\gamma_1$ | $\\gamma_2$ | RA      | UA      | TA      |\n| ------- | ------- | ------- | ------- | ------- |\n| 0       | 0.01    | 95.3425 | 95.2917 | 91.6467 |\n| 0.15    | 0.01    | 99.2359 | 96.8556 | 96.2874 |\n| 0.5     | 0.01    | 99.2789 | 96.4520  | 96.3859 |\n| 1       | 0.01    | 99.2658 | 96.3511 | 96.3437 |\n| 1.5     | 0.01    | 99.2228 | 96.2838 | 96.3156 |\n| 0.15    | 0       | 98.5895 | 95.998  | 95.4859 |\n| 0.15    | 0.01    | 99.2359 | 96.8556 | 96.2874 |\n| 0.15    | 0.5     | 98.5353 | 98.907  | 95.3031 |\n| 0.15    | 1       | 97.9169 | 98.2176 | 94.4874 |\n| 0.15    | 1.5     | 97.4909 | 97.7131 | 93.8968 |\n\n\nWhen fixing $\\gamma_2=0.01$ and varying $\\gamma_1$ from 0 to 1.5, we consistently observed strong and stable performance. Fixing $\\gamma_1=0.15$ and increasing $\\gamma_2$ showed that excessively large $\\gamma_2$ can slightly degrade performance.\n\nDespite involving multiple objective terms, these results demonstrate that RUAGO can maintain consistent and stable performance across a wide range of parameter values. This clearly shows that our method is robust and feasible even without extensive tuning, alleviating the concerns of the reviewer. As a practical guideline, in our experiments, we first fixed $\\gamma_{adv}=\\gamma_{bn}=\\gamma_{cls}=1$ and $\\gamma_{2}=0.01$. We then tuned $\\gamma_{1}$ on a grid from 0.1 to 1.5. This one-dimensional sweep was sufficient to reach near-optimal UA and RA on every model–dataset pair, showing that RUAGO requires minimal effort for setting hyperparameters. We will describe this practical guideline explicitly in the final version.\n\n**[W3] Requiring pretrained generative model.** \n\nWe thank the reviewer for the comments. As noted, RUAGO relies on a pretrained generator to simulate retain-like data in the retain-free setting. This dependency reflects a fundamental challenge of unlearning without access to the original data; therefore, some mechanism is needed to approximate the distribution that should be retained. Among several options, we chose an OOD-trained generator as an efficient and straightforward surrogate. As shown in Table 7, using an untrained generator results in significant performance drops, demonstrating the importance of a pretrained generator.\nHowever, pretraining the generator is not necessarily costly. In our experiments, G was trained on publicly available OOD datasets (e.g., COCO, TinyImageNet) for only 3–4 hours using StyleGAN2-ADA. We see this as a practical cost-performance tradeoff for the retain-free constraint.\nOne possible approach to mitigate this dependency is to utilize off-the-shelf generative models, assuming their training data does not cause other privacy issues. We will clarify this limitation and potential extensions in the Limitation and Discussion sections of the final version.\n\n**[Q1] Analysis in class-wise unlearning results.**\n\nAs the reviewer points out, in the class-wise setting, we observe that our approach did not perform the best in ResNet-18, while we achieved good performance  in other settings. We attribute this to the fact that RUAGO’s main signal, the adversarial soft target derived from the forget set, is designed to reshape decision boundaries locally around individual samples. In class-wise unlearning, the objective is to erase the entire concept of a target class. This requires driving its logits (and thus predicted probabilities) toward zero everywhere in the input space, rather than only reshaping local decision boundaries.\nTo keep the unlearning pipeline consistent across scenarios, we applied the same soft-label curriculum to both instance-wise and class-wise scenarios, and this led to residuals in a few model-setting combinations. Even so, on VGG-16 and ViT, the class-wise UA/TUA values were near zero, demonstrating near-complete deletion (unlearning performance), while RA/TRA (utility) remained stable.\nWe also note that some retain-free baselines that performed well in class-wise deletion, such as SSD and SCAR, tend to struggle with instance-wise unlearning or with larger models and training budgets. In contrast, RUAGO offers balanced and robust performance across both scenarios.\nWe will clarify this in the final version.\n\n**[L1] Limited theoretical analysis for all component.** \n\nThank you for the comment. The theoretical bound we provide is indeed limited to the curriculum learning aspect. We chose this focus to analyze how the difficulty and hypothesis space complexity evolve during training, which is essential for stabilizing distillation from OOD-generated samples. This analysis helps explain why RUAGO achieves strong UA and TA without the retain data.\nWe agree that a unified theoretical treatment encompassing all components of RUAGO has not yet been established. We consider this as an important direction for future work and will note this limitation, along with our plan for integrated analysis, in the final version."}, {"review_id": "017D5w73iy", "reviewer": "Reviewer_CKem", "summary": "The paper introduces **RUAGO**, a retain-free unlearning method that uses soft-label adversarial examples to achieve unlearning while avoiding over-unlearning. To preserve model performance, the paper leverages synthetic data from an OOD-trained generator, which is aligned with the original data distribution through inversion-based alignment.", "questions": "I would like to point out two trivial questions (**TQ**), one minor question (**mQ**), and one major question (**MQ**) that, if addressed, would lead me to reconsider the scores for the quality and clarity of this work.\n\n**TQ1:** In Theorem 1, $R(\\cdot)$ is not defined; it becomes clear that it refers to the true risk function only in the proof. Readability would be improved if terms were defined as soon as they are introduced. For the same reason, the authors should define $E$ and $E_{g}$ as they appear in Algorithm 1.\n\n**TQ2:** In the proof of Theorem 1, on a first read, it is not immediately clear that $\\epsilon_t > 0$. The authors should emphasize this fact to improve readability.\n\n**mQ1:** The proof of Theorem 1 contains one unclear step that I would like the authors to clarify. In lines 997–998, the authors define $\\epsilon_0$, which is then used in lines 999-1000. However, it's unclear why the authors use $\\leq$ instead of $=$. While this is not a flaw per se - since the majority argument in lines 1001-1002 would lead to the same conclusion - it is not clear why the inequality is used rather than an equality.\n\n**MQ1:** My main concern regarding the proposed method is its efficacy in _truly_ forgetting information. Specifically, I suspect that the realignment process, where the updated model is aligned with the original data distribution by matching the generator's distribution to that of the original model, might inadvertently reintroduce information about the forget set. This concern is supported by several observations: first, the method often outperforms the retain model in UA performance, and sometimes even in TA performance; second, the MIA score is occasionally higher than that of the retain model; third, the method's performance appears sensitive to the choice of synthetic data generator. It would strengthen the work significantly if the authors could discuss this potential weakness in more detail, as incomplete unlearning undermines both the validity of the method and the overall contribution of the paper. Specifically, when $\\gamma_1$ and $\\gamma_2$ are kept frozen, does a strong alignment of the generator to the original data distribution hinder the unlearning process?", "limitations": "Yes. The authors have addressed some of the limitations of their work in the supplementary material (see Section J - \"Limitations and Future Work\").", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "**Strengths**\n\n*S1 (Soundness).* All claims are well motivated and supported;\n\n*S2 (Novelty).* Original method for performing machine unlearning;\n\n*S3 (Performance).* RUAGO exhibits improved test accuracy compared to other unlearning methods;\n\n*S4 (Clarity).* The paper is clearly written.\n\n**Weaknesses**\n\n*W1.* The work does not provide guarantees regarding the success of the unlearning process. This is the main weakness of the proposed method, as the effectiveness of unlearning depends on the quality of the synthetic data generation. However,  this is a limitation shared by other state-of-the-art methods.", "was_revised": true, "final_justification": "I was already positive about this submission; plus, the authors have satisfactorily addressed all of my concerns in the rebuttal. In my view, this is a valuable contribution. That said, I remain open to discussing my assessment with the AC and fellow reviewers.", "rebuttal": "**Thank you for Reviewer CKem's insightful comments on our work.**\n\n**[W1] Dependency on synthetic data quality.** \n\nThank you for your thoughtful comment. We fully agree that performance can depend on the generator. In RUAGO, we try to minimize the generator dependency via adversarial soft targets (grounded on the forget set), an easy-to-hard schedule (down-weighting noisy synthetic samples early), and inversion-based alignment with filtering. To show robustness, we trained a low-fidelity $32\\times 32$ GAN on OOD data, which is far simpler than the latest generative models. Even under this constrained setup, RUAGO still outperformed prior retain-free baselines and approached retain-based utility, demonstrating the feasibility of our framework. In the final version, we will incorporate the reviewer’s comments by conducting a brief sensitivity analysis regarding the generator’s complexity and data quality. However, we believe and demonstrate that the current setting is sufficient to achieve good performance with the simple generator.\n\n**[TQ1&2] Notation clarification** \n\nWe thank the reviewer for requesting clarification on the notation. We will fully incorporate and clarify the questions. \nMore specifically, we define the true risk by $R(\\mathcal{F})=\\mathbb{E}\\_{(x,y)\\sim\\mathcal{D}}\\bigl[\\ell\\bigl(\\mathcal{F}(x),y\\bigr)\\bigr],$ and the empirical risk by $\\hat{R}\\_n(\\mathcal{F})=\\frac1n\\sum_{i=1}^{n}\\ell\\bigl(\\mathcal{F}(x\\_i),y\\_i\\bigr).$ In Algorithm 1, $E$ denotes the unlearning epochs and $E_g$ denotes the generator training epochs, respectively.\nWe will also make the positivity of $\\epsilon_t$ more explicitly as follows: We define $\\epsilon_t = C\\,\\sqrt{\\frac{d_t\\bigl(\\log(n/d_t)+\\log(1/\\delta)\\bigr)}{n}}$, where C>0 is a universal constant from the VC uniform‑convergence bound, $d_t \\ge 1$ is the (finite) VC‑dimension of the stage‑t hypothesis space, $n\\ge 1$ is the sample size, and $\\delta\\in(0,1)$, respectively. Hence $\\epsilon_t>0$. In the final version, we will clarify all the relevant definitions. Thanks again for your thoughtful comments!\n\n**[mQ1] Clarification in Theorem 1’s proof**\n\nThank you for the comments and pointing out typos. We are sorry that there are notational errors on our side. We will fully fix and clarify the notations as follows: Since we define $\\epsilon\\_0 = R(\\mathcal{F}\\_1)-R(\\mathcal{F}^\\*)$, the line 999–1000 derivation should use an equality rather than an inequality:\n$$\nR(\\mathcal{F}\\_T)-R(\\mathcal{F}^\\*) \\;=\\; \\bigl[\\,R(\\mathcal{F}\\_T)-R(\\mathcal{F}\\_1)\\,\\bigr] + \\bigl[\\,R(\\mathcal{F}\\_1)-R(\\mathcal{F}^\\*)\\,\\bigr] \\;=\\; \\bigl[\\,R(\\mathcal{F}\\_T)-R(\\mathcal{F}\\_1)\\,\\bigr] + \\epsilon_0.\n$$\nWe will correct \"$\\le$\" to \"$=$\" in the final version and add a note (\"equality holds by the definition of $\\epsilon\\_0$\") to clarify.\n\nFor lines 1001–1002, the inequality is intended and follows from an add‑and‑subtract decomposition combined with the VC uniform‑convergence bound:\n$$\nR(\\mathcal{F}\\_t)-R(\\mathcal{F}\\_{t-1})\n= \\bigl[R(\\mathcal{F}\\_t)-\\hat R_n(\\mathcal{F}\\_t)\\bigr]\n +\\bigl[\\hat R\\_n(\\mathcal{F}\\_t)-\\hat R\\_n(\\mathcal{F}\\_{t-1})\\bigr]\n +\\bigl[\\hat R\\_n(\\mathcal{F}\\_{t-1})-R(\\mathcal{F}\\_{t-1})\\bigr]\n\\le \\epsilon\\_t + 0 + \\epsilon\\_{t-1}\n= \\epsilon\\_t+\\epsilon\\_{t-1}.\n$$\nThe first and third terms are each bounded by $\\epsilon\\_t$ and $\\epsilon\\_{t-1}$, respectively, via the standard VC uniform-convergence bound. Combining these bounds yields an upper bound of $\\epsilon\\_t + \\epsilon\\_{t-1}$ for their sum. The middle term, $\\hat{R}\\_n(\\mathcal{F}\\_t) - \\hat{R}\\_n(\\mathcal{F}\\_{t-1})$, is non-positive because the curriculum uses nested classes $\\mathcal{H}\\_{t-1} \\subseteq \\mathcal{H}\\_t$ and $\\mathcal{F}\\_t$ minimizes $\\hat{R}\\_n$ over $\\mathcal{H}\\_t$; hence we safely upper-bound it by $0$ (written “$+\\,0$” for brevity). The inequality is stated for $t\\ge 2$, so $\\epsilon\\_0$ does not enter this step.\nTo clarify the notation, we will rename $\\epsilon\\_0$ to $\\epsilon$ and fix the remaining minor notation accordingly in the final version.\n\n\n[MQ1] **Realignment and Re‑injection Risk** \n\nWe appreciate the reviewer's concern that alignment could inadvertently re‑inject information from the forget set. We treat this as a primary risk and design both the objective and the pipeline to suppress this issue. The goal of the alignment stage is not to reconstruct specific forgotten samples, but to make synthetic images interpretable in the teacher's representation space so that distillation can be stable. Concretely, we (i) push predictions on the forget set away via the forget loss $\\mathcal{L}\\_f$, and (ii) in class‑wise unlearning, filter out generator outputs that are classified as the to‑be‑deleted class, preventing re‑injection of that concept.\n\nTo probe the effect of alignment strength, we fix $\\gamma\\_1,\\gamma\\_2$ and vary a proxy for alignment strength for the learning rate as the alignment component (ResNet‑18/VGGFace2). As shown in the table below, we observe that moderate alignment (e.g., $\\mathrm{lr}=10^{-4}$) keeps RA/UA/TA stable, showing that the teacher's representation is emulated without re‑introducing the forget information. In contrast, overly strong alignment (e.g., $\\mathrm{lr}\\ge 10^{-3}$) induces a collapse in all metrics (UA as well as RA/TA), being consistent with optimization instability rather than selective re‑injection. \n\n| lr       | RA      | UA      | TA      |\n|----------|---------|---------|---------|\n| 5e‑05  | 99.1369 | 97.1246 | 96.0906 |\n| 1e‑04  | 99.2415 | 96.8387 | 96.2874 |\n| 5e‑04  | 98.2121 | 96.6201 | 95.7109 |\n| 1e‑03  | 94.1991 | 96.4856 | 92.8702 |\n| 5e‑03  | 11.6317 | 15.4700 | 12.1361 |\n| 1e‑02  | 2.9518  | 3.1108  | 3.0657  |\n\nRegarding the reviewer's observations: (a) UA (forget‑set accuracy) being slightly higher than retrain in a few cases is not ideal, but the gap is small ($ \\sim $ 1% on multi‑seed averages) and differing trends are visible in other methods under the same protocol (e.g., SCRUB, SalUn; see Tables 1 and 4). Possible explanations for this include a small generalization gain inherited from the original model that trained with the forget set, mild underfitting in the retrain model alleviated by additional training, or modest diversity injected by synthetic data. (b) For MIA, we note that in challenging cases (e.g., CIFAR‑100 with smaller models such as ResNet‑18), occasional increases can appear. Overall, RUAGO's gap to retrain is comparable to or smaller than strong baselines (Figures 3–4), suggesting no systematic privacy regression. (c) On generator sensitivity, our experiments intentionally used a lightweight low-resolution $32\\times 32$ GAN trained on OOD data. Yet, RUAGO outperformed prior better retain‑free methods that used higher‑resolution, more diverse generators, demonstrating much less generated dataset dependency of our approach. \n\nIn summary, with $\\gamma_1,\\gamma_2$ fixed, tuning alignment within a safe range yields no quantitative signs of re‑injection, whereas excessive alignment causes global collapse, not targeted \"re‑learning.\" Across key metrics, RUAGO remains close to retrain and consistently closer than other retain‑free baselines. Thus, distribution alignment in RUAGO does not materially induce re‑injection; rather, $\\mathcal{L}_f$ and the output filtering mechanism mitigate potential leakage, enabling a stable deletion–utility balance. We will make these points explicit in the final version."}]

Author rebuttal:

Meta-review: This paper proposes RUAGO, a retain-free unlearning framework that combines adversarial soft labels, OOD-pretrained generative models, progressive sampling, and inversion-based alignment to remove sensitive data while maintaining model utility. The approach is motivated by the limitations of existing methods that either assume access to retain data or risk over-unlearning.

Reviewers agreed that the motivation is clear and that the paper addresses an important problem, with strong empirical results showing RUAGO outperforming existing retain-free approaches and approaching retain-based baselines. One reviewer also highlighted the novelty of incorporating VC theory into the design of a difficulty-based curriculum. The paper is clearly written, and the rebuttal provided helpful clarifications, particularly on hyperparameters and theoretical details. Nonetheless, concerns remain regarding the limited applicability of the method. 

Overall, the reviews reflect a mixed perspective: one borderline accept, one borderline reject, and one accept. Balancing the novelty, empirical strength, and open concerns, the AC finds the contribution valuable and recommends Accept.
Decision: Accept (poster)