Targeted Unlearning Using Perturbed Sign Gradient Methods With Applications On Medical Images
Authors: George R. Nahass
Zhu Wang
Homa Rashidisabet
Won Hwa Kim
Sasha Hubschman
Jeffrey C. Peterson
Pete Setabutr
Chad A. Purnell
Ann Tran
Darvin Yi
Sathya N. Ravi
Venue: Accepted by TMLR ()

Abstract: Machine unlearning aims to remove the influence of specific training samples from a trained model without full retraining. While prior work has largely focused on privacy-motivated settings, we recast unlearning as a general-purpose tool for post-deployment model revision. Specifically, we focus on utilizing unlearning in clinical contexts where data shifts, device deprecation, and policy changes are common. To this end, we propose a bilevel optimization formulation of boundary-based unlearning that can be solved using  iterative algorithms. We provide convergence guarantees when first order algorithms are used to unlearn and introduce a tunable loss design for controlling the forgetting–retention tradeoff. Across benchmark and real-world clinical imaging datasets, our approach outperforms baselines on both forgetting and retention metrics, including scenarios involving imaging devices and anatomical outliers. This work demonstrates the feasibility of unlearning on clinical imaging datasets and proposes it as a tool for model maintenance in scenarios that require removing the influence of specific data points without full model retraining. Code is available $\href{https://github.com/monkeygobah/unlearning_langevin}{here}$.

Published in Transactions on Machine Learning Research (11/2025)
Targeted Unlearning Using Perturbed Sign Gradient Methods With Applications On Medical Images
George R. Nahass
gnahas2@ric.dd edu
Deportment of Biomedical Engineering
Department of Ophihabmology University of llioois Chicago
Zhu Wang
Deportment of Computer Science University of Blinois Chicago
Homa Rashidisabet
Department of Ophthabmology University of Ilinois Chicago
Won Hwa Kim
Computer Science and Engineering
Pohang Universily of Science and Technology, South Korea
Sasha Hubschman
Department of Ophthalmology University of Mlinois Chicago
Jeffrey C. Peterson
Deportment of Ophthalmology University of Ilinnis Chicago
Pete Setabutr
Deportment of Ophthalmology University of Ilinnoi Chicagoo
Chad A. Purnell
Department of Plastic and Reconstructive Surgery University of Blinois Chicago
Ann Q Tran
Department of Ophthabmology University of Ilinois Chicago
Darvin Yi
Deportment of Biomedical Engineering Department of Ophihabmology Universily of Ilinoii Chvicago
Sathya N. Ravi
sathya edu
Department of Computer Science University of Ilinois Chicago
Reviewed on OpenReview: https: // openreview. net/ forum? id= Jg6bJg
Abstract
1

---

Published in Transactions on Machine Learning Research (11/2025)
Machine unlearning aims to remove the influence of specific training samples from trained model without full retraining. While prior work has largely focused on privacy-motivval settings, we recast unlearning as general-purpose tool for post-deployment model revision. Specifically, we focus on utilizing unlearning in clinical contexts where data shifts, device deprecation, and policy changes are common. To this end, we propose bilevel optimization formulation of boundary-based unlearning that can be solved using iterative algorithms. We provide convergence guarantees when first order algorithms are used to unlearn and introduce a tunable loss design for controlling the forgetting reteenioo tradeoff. Across benchmark and real-world clinical imaging datasets, our approach outperforms baselines on both forgetting and retention metrics, including scenarios involving imaging devices and anatomical outliers. This work demonstrates the feasibility of unlearning on clinical imaging datasets and proposes it as a tool for model maintenance in scenarios that require removing the influence of specific data points without full model retraining. Code is available here
1 Introduction
In recent years, the awareness of the public regarding data ownership has continued to increase. As large deep learning models continue to be trained using information from people who may not have explicitly opted into such procedure, the question naturally arises: how can they 'opt-out' post-fact? To this point, in 2016, the General Data Protect Regulation (GDPR) was passed by the EU, stating that individuals have the 'right to be forgotten' and businesses have the 'obligation to erase personal data' Regulation (2020); Graves et al. (2021). J. As the cost and training time continue to increase, if an individual decides to exercise their right to be forgotten, retraining the model from scratch without their data may prove to be infeasible from both a logistic and economic point of view Cottier et al. (2024). Machine unlcarning has emerged as a primary strategy for such purposes Liu et al. (2024a b).
While machine unlearning was originally developed to satisfy privacy mandates, its potential applications extend well beyond regulatory compliance Kurmanji et al. (2024). In real-world machine learning pipelines, particularly in healthcare, there may be a need to revise models over time due to shifting data distributions, evolving clinical protocols, or the gradual deprecation of imaging devices Guo et al. ); Moreno- Torres et al. ) Futoma et al. (2020). Continual learning has been proposed as a method to continuously update models, but this does not allow for removal of specific samples which may be necessary in various settings Challen et al. (2019); Lee & Lee (2020). In these scenarios, retraining from scratch is often infeasible due
data reuse, or lack of access to the full original dataset to computational cost, regulatory restrictions However, very few studies have explored unlearning a De Lange et al. (2021); Verwimp el al. 2023).
practical mechanism for model maintenance and revision in real world settings.
Despite growing interest in machine unlcarning, significant limitations remain in both experimental scope and methodological flexibility. Most prior work focuses on benchmark dalasets such as CIFAR-10 and MNIST, which lack the resolution, heterogeneity, and domain-specific information of real-world datasets [Greenspan et al. (2016); Litjens et al. (2017). Furthermore, selective unlearning, in which only specific subsets of data (e.g., based metadata or image quality) are removed, is rarely explored. Here, fewer methods provide forgetiing-reeentonn tradeoff, limiting their utility in settings where both privacy meaningful control over the forgetting retention
and performance must be carefully balanced Kurmanji et al. (0224).
In this work, we extend the boundary-basse based unlearning framework of Chen et al. (2023) by recasting it as a bilevel optimization problem that can be solved using first-order methods. Our formulation enables a principled, modular, and scalable approach to deep model unlcarning, offering both formal convergence guarantees and empirical improvements across multiple datasets. Our framework supports both sample- level and subgroup-level unlearning, reflecting real-world deployment scenarios where full metadata is often unavailable at test time, but subgroup-basee revisions (e.g., removing the influence of outdated scanners or low-quality images) are required. To our knowledge, this is the first general-purpose unlearning framework applied to clinical imaging datasets, and the first to introduce an algorithm for both instance-level and distributional-leee model maintemance.
2

---

Published in Transactions on Machine Learning Research (11/2025)
A
Input
Pretrained
Targeted Forget Set
network O
across boundary of
reassiggeddd
Boundary point identification
1. Compute gradient: PCC y))
Get of x (x)
2. Sample
y
Perturb sign gradient: sign(g yz)
argmax (wo(xx)(wo((x))))
Learned decision boundary by (wo0
Identify point across boundary x Xx
se dn
I
M
Backpropagate
Construct relabeled
Forget [(x,.) IIE
Unlearned model f O
Updated decision boundary
Fine /woO network
Figure 1: Graphical schematic of proposed unlearning algorithm. We begin with pretrained CNN fmo and user-defined forget set F (A). In the inner optimization loop (B), we identify boundary points z across the decision surface of the original model via our perturbed sign-gradient method. For each forget sample we assign a new label y = arg max fwo (x²) based on the closest incorrect class, and construct a relabeled forget set F = ((z,, }/ the outer optimization loop (C), we fine-tune the model on F, optionally incorporating remain-set supervision. The result is an unlearned model fw. whose decision boundaries are shifted forget the designated samples.
Related Work. To contextualize contributions, briefly review existing propositions for unlearning deep neural networks through parameter modification. In Golatkar et al. (2020), the Fisher Information Matrix (FIM) is used to dynamically compute the appropriate noise to scrub the paramcters of a Deep Neural Network of the Forget set. This idea requires approximation of the Hessian through the FIM, which may be expensive to compute. To alleviate this, Peste et al. (2021 uses gradients of samples to be unlearned to approximate the FIM for faster unlearning. In a similar vein, Mehta et al. (2022) approximate the Hessian using L-FOCI choose a subset of parameters for unlearning. CChen et al. (2023) introduced simple decision-boundary method achieving SOTA, but lacks convergence guarantees and offers limited flexibility in balancing forgetting and retention. For comprehensive review and in depth descriptions various trends and techniques in machine unlearning, we point readers to Xu el al. (0023 and Nguyen el. al. (0024)
2 Methods
2.1
Problem Setup
We consider supervised classification tasks with deep neural network models fwr X' - RR parameterized by weights trained on dataset D = {(x,, v:) of image label pairs, where each E {ei,...,er] exx is one-hot vector in {0,1]* where K is the number classes.
Model for trained by minimizing a suitable loss function such as cross entropy to predict labels yi given image z.. After deployment, subset F D is designated for removal due privacy, policy, maintenance considerations. We R = D F to denote the "remain' set that available for the task. The machine unlearning problem asks: how retaining performance on R, without retraining from scratch with R?
update fw to model fw, that forgets F while
3

---

Published in Transactions on Machine Learning Research (11/2025)
Here, we define unlearning success via two desiderata on model fw: (C1) Forgetting: the updated model should misclassify (x, E F, i.e., fw (x) # y; (C2) Remaining: the updated model should preserve accuracy on R, i.e., (x) = for all (z, E R.
In practice, we evaluate these goals via held-out splits of F and R. To formalize our algorithm, we view selective unlearning as a bilevel optimization problem that seeks to modify the model's decision boundaries in targeted and controlled manner.
We note that formulation of desideratum (C1), which requires misclassification of the forget set, slightly differs from the standard definition of machine unlearning, which typically evaluates suocess by the statistical indistinguishabiliy of the unlearned model from one retrained on Rt Golatkar et al. (2020); Kurmanji et al. (2024); Xu et al.] (2023). In privacy-driven applications, the retraining paradigm is appropriate, as if an individual requests removal, the primary objective to mimic the distribution of a model trained without their data without nccessarily forcing any particular behavior on Our work, however, is motivated by model maintenance, where the goal is not only to ensure removal of outdated or undesirable data, but also prevent. such data from continuing to influence predictions in deployment. In this setting, requiring misclassification provides an operational guarantee: samples in F are actively pushed away from their original labels, ensuring that they cannot contribute useful signals to future predictions. See Section 6 for implications of this method in medical imaging.
Additionally, prior work often considers resistance to membership inference attacks (MIA) as an additional desideratum for unlearning in privacy-focused applications. However, as our emphasis on clinical model maintenance treat. MTA as important evaluation metric rather than a core desideratum and report it alongside C1 and C2 for completeness and comparison.
2.2 Unlearning as Bilevel Optimization
Because post-hoc unlearning must modify learned model without full retraining, recent work has focused on shifting its decision boundaries by modifying parameters w Chen et al. (2023). We build this framework which proposes forgetting a sample by modifying the model's decision boundary through a two-phase process. First, for each forget set sample (x, v) E F, the method computes a nearby point z² across the decision boundary. Second, this point is used to assign a new label y² + y for x, and the model is finc-tuned on (z. y²)
to induce lorgetting.
We unify both steps into single bilevel optimization framework:
min Σ ((f.) (ff (z.)
s.t. 2 24 E arg
min
((S) ViEF.
(1)
8:fw (x)+ MI
where we are the original model weights, L is the supervised loss (e.g, cross-entropy). E(.) is an inner loss function designed to penalize large perturbations (such as l, norms), and k < 1/K ensures the boundary point x lies across the decision surface of class 1/- Choosing k = 1/K corresponds to projecting æ; exactly onto the decision boundary, whereas lesser values correspond to finding a across the boundary. See Appendix Section A.6 for more details.
This objective jointly optimizes the new model weights while enforcing that forget samples receive mismatched predictions. The inner constraint defines the boundary search: for each forget sample x,, we identify the minimal perturbation that crosses the decision boundary, subject to a proximity constraint via {(6). The resulting boundary point 2a = xz + 8 is used to guide the outer update. A visualization of our entire algorithm can be seen in Figure]
It should be noted that the sccond term in Eq. I coincides with the third term in Eq. 3 of Kurmanji et al. 22024, enabling our formulation to be viewed as flexible student-teacher framework. For instance, one may steer unlearning toward specific incorrect classes by modifying the boundary label assignment y² Remark 2.1. (On the definition of forgetting.) We note that our formulation of desideratum (C1), which requires misclassification of the forget set F, differs slightly from the standard definition of machine unlearning.
4

---

Published in Transactions on Machine Learning Research (11/2025)
Unlearning success is typically defined by statistical indistinguishabblityy between the unlearned model and model retrained from scratch on the retain set R Golatkar et al. (2020); Kurmanji et. al. (2024); Xu et al. (2023). Under that paradigm, accuracy on F is expected to resemble the retrain baseline, which is often close to random chance for balanced datasets but not necessarily zero. In contrast, our operationalization reflects the needs of model maintenance, where random like predictions, as required by the slandard definition, not. necessary.
We present an equivalent unconstrained formulation of inner maximization in that can be used to relate the Boundary Shrink method in Chen et al. (2023):
Lemma 2.2 (Unconstrained Unlearning). Assume (24,3) E F with ys to be 1-hot vector representation r; 's class label, and .) .) is a smooth function that decomposes with respect to coordinates of yi, and is decreasing- The inner ménimization problem in (1) is equivalent to maxs [(f(wo, + az). f(wo, 8 + x;)) denotes the label predicted by model with porameters we for the perturbed sample 8 + +2
The proof of Lemma 2.2 is in Appendix A.1 In essence, apply Karush-Kuha Kuhnnhh-Kuu----a Tucker (KKT) conditions Nocedal & Wright (2006) on the inner minimization problem. The 1-hot representation assumption of in Lemma 2.2 is not necessary our result can be extended to multilabel classification tasks also. Please see Appendix for more details. Moreover, we show that the above Lemma 2.2 is true for loss function such as Squared & norm that are used for regression tasks in the Appendix.
Corollary 2.3 (Boundary Shrink Initialization). Assume 8 = 0 initialization. Then, mazimizing [(f(wo, 8 24), y:) with respect to 5 using any first order method is equivalent. to Boundary Shrinking.
The proof of Corollary 2.3 is in Appendix A.2 and involves comparing iterates using Chain rule. One main advantage of our formulation in (1) is that it is possible to specify a desired objective function (such as closest example in squared l norm, & for sparsity etc.) of 6 to get minimum perturbation, ceeired.
2.3 Solving the Inner Optimization Problem
The inner task in Eq. [ is to find, for every forget sample Fs, a nearby point x, + whose logit for the true class yi drops below the threshold K. Because Jwo (I; + 6) is highly non-convex /Salman et al. (2019) ; the one-step FGSM update of Gooddellow et al.] (2014) often stalls in poor local optima. We therefore adopt a perturbed sign-gradient scheme that enjoys provable convergence.
Perturbed sign update. We use Lemma 2.2 to reformulate the inner optimization constraint as a loss maximization. We refer to this loss maximization as "inner" loop from now on. The key insight is that this allows us to borrow techniques from adversarial attack literature as explained below. Let = Vf (z, + o), v:) and draw z ~ ((, With a decaying step size & = c/t (c > 0) we calculate de and update 8 as,
d ez sign(g 7=), 8 5 + de,
where the noise level 7 2 0 is fixed for the inner loop. The Gaussian term, inspired by Langevin dynamics, helps the iterate escape sharp local minima while keeping the update aligned with the true gradient.
The next lemma (proved in Appendix A.3 shows that, in expectation, the update is ascent-aligned with the objective that drives the boundary search.
Lemma 2.4 (Ascent-direction guarantee). With de defined in Eg. 2
[ g. 2 0, with equality iff = 0. Eg
Convergenec rate. Since the update step is ascent-alignod in expectation with respect to the randomness of 2, standard stochastic optimization argument can be used to provide convergence guarantees for our procedure as below.
Theorem 2.5 (Convergence of perturbed FGSM). Assume we use update direction d as in equation 2 for T iterations with step size sequence E = O(1/t)tt t = 1, I..,,,,, and L has L-Lipschitz continuous gradient wrt 8. Then the procedure converges to a point such that E, S face in T = O(DL//oocd iterations where D is the dimension of 8.
Please see (A (Appendix A.4 for our proof of Theorem 2.5
5

---

Published in Transactions on Machine Learning Research (11/2025)
Algorithm 1: Boundary Search via. Perturbed Sign Gradient
Input: Pretrained model fwy: Forget set F, Step size schedule e,, Perturbation scale y 0, Inner steps Tinner, (optional) closeness regularization parameter >
Output: Relabeled forget set F {(2,, v!)} Initialize F +- 0;
for (2,, 31) E F do
Initialize 5 + O;
for t= to Tinner do
Sample 2 2~ (0, l); g g- V.C(fwo (zi + 8:);;;;
8 6 + 4 sg + AV,((() 72);
Set x +- x;
Set yr" f- arg max fwo (z));
Store (It, v in F;
return F
Optional closeness regularisation. The above Theorem 2.5 guarantees that we find a point x on the decision boundary. To find the closest boundary point to Ft, we may add the penalty {(5) | weighted by a hyper-parameter 0. The inner loop update then becomes,
de = c sign(g AVge(6) + 72).
(3)
Setting 7 = À exactly recovers the implementation of Roundary-Shrine update of Chen al. (2023) demonstrating that their method is a special case of our framework. Our convergence analysis, however, applies specifically to the perturbed version of boundary shrinking presented here, rather than to this umperturbed special case. We treat À (along with as hyperparameters which can be tuned. The solution of inner loop, whose output defines the boundary points xa x; + 5 which is used to guide the outer model update in Eq. [ The pseudocode algorithm of phase 1 can be seen in Algorithm [
Remark 2.6. (Relation to Chen et al. (2023).) Both our approach and Chen al. (2023) identify perturbed points near the decision boundary and fine-tune the model relabeled samples. The main difference lies in how these boundary points are obtained and used. Chen et al. (2023) apply single deterministic FGSM-style update with fixed step size, whereas we cast this step as an explicit inner optimization problem solved by a perturbed sign-gradient scheme with optional regularization and provable convergence, This generalization provides a theoretically grounded extension the update while preserving the two-loop implementation.
2.4 Outer Optimization
Once the boundary point af is identified for each forget sample x; E F, we solve the outer minimization to obtain updated model weights wa- So the success of this two-phase bilevel optimization depends critically on identifying accurate boundary points of the inner loop. The goal in outer loop is to satisfy (C1), as a large loss value L(fu (z+), y is typically positively correlated with the distance between the model prediction and the reassigned label. This is particularly true in affine models of the form fu((:) Wr where L is monotonic function.
To assign the boundary label vf. we select the class corresponding to the largest logit of the original model wwo (x?) as described in Algorithm [ The new label is defined ye = arg max fwo(s?), i... the highest scoring non-truc class at the boundary point. In principle, o need not be the arg max class and could instcad be a specific largel class towards which all forget samples are reassigned, thereby steering forgetting Lowards that. class. The model is then ine-tuned on the reassigned forget set F- ((x1, Drrr as:
Wh = arg min Σ (1))
(4)
se F

---

Published in Transactions on Machine Learning Research (11/2025)
Algorithm 2: Model Update via Relabeled Forget Set
Input: Relabeled forget set F from the inner loop (Alg. Initial model weights wo, Learning rate 1/, Outer steps Touter
Output: Unlearned model weights wa
Initialize w wo;
for t= to Touter do
Sample minibatch (ar, v²) ~ F; W f w 77 (
return Wy
where wy are the updated weights after unlearning. The pscudocode of our vanilla outer loop be seen in Algorithm 2
New Hcuristics for Unlearning We additionally introduce three configurable extensions to the algorithm that enable controlled trade-ofis between forgetting and retention: i) incorporating remain-set loss during the outer loop, if) using top-k soft logit supervision to reduce irrelevant weight updates, and iii) enabling multi- objective tradcoffs by composing unlearned models across modules. Full mathematical details and pseudocode are provided in Appendix Scction A.5 These are not additional hyperparameters but design choices within the optimization process, and their eflects systematically assessed in ablation experiments (Section
4.3
3 Experiments
3.1
Datasets
We evaluate method on six image classification datasets: two standard benchmarks and four medical datasets. The benchmark datasets include CIFAR-10 and FashionMNIST Krizhevsky et al.) Xiao et al. (017). The medical datasets include color fundus photographs (CFP-OS), magnetic resonance images (MRI) Nickparvar 2021). and two clinical datasets collected from real-world settings.
The CFP-OS dataset three-class datasel consisting of 1500 open-source images, curated from IDRID Porwal et al. (2018). ORIGA Zhang al. (2010), REFUGE Pachade et al.) (2020), and G1020 Bajwa al. (2020)_ The MRI dataset includes 3000 images from each of four classes (Normal, Glioma, Meningioma, Pituilary), sampled from the dalaset of Nickparvar 2021 Full details on the origin of the open-source
datasets is provided in Appendix Table 3
The first clinical dataset, which we call CFP-Clinic, consists of color fundus photographs drawn from the Illinois Ophthalmic Database Atlas (I-ODA) Mojab et al. (2021), 1 a collection of over 3 million images collected over a 12-year period. We randomly sampled 1000 CFP images with ICD-10 codes corresponding diabetic retinopathy (DR), glaucoma, or other retinal disorders (retinopathy of prematurity, retinal hemorrhage, and degenerative maculopathies). Each image belongs to one class, and no patient appears more than once.
The second clinical dataset, which we call Oculoplastic, consists of cropped periocular images from patients with oculoplastic conditions, spanning three categories: healthy, thyroid eye disease, and craniofacial dysmorphology. Healthy images were sampled from the Chicago Facial Dataset Ma et al. (2015). As with CFP-Clinic, all samples are from unique individuals. Metadata for both clinical datasets can be found in Figure 4 For medical imaging datascts (MRI, fundus, oculoplastic), no additional preprocessing was performed to prepare for unlearning compared to the general image datasets.
In clinical unlearning experiments, the pogget/eeman split is defined by the imaging device metadata associated with each sample in the I-ODA dataset or by periorbital distances involving the iris Nahass et al. 2025 2024
7

---

Published in Transactions on Machine Learning Research (11/2025)
3.2
Model Training
For the medical image datasets (CFP-OS, MRI, CFP-Clinic, and Oculoplastic), we fine-tune Res.eet-50 pretrained on ImageNet-Ik 1k He et al. (2015), replacing the final classification layer with a dataset-specific output layer and applying a dropout of 0.5 prior to the final layer. For CIFAR-10 and FashionMNIST, we use the AlI-CNN architecture trained from seratch following Springenberg et al. 2015))
All training is performed using cross-entropy loss and SGD with momentum 0.9, a learning rate of 1 x 10-3 and L2 regularization with coefficient x 10-4, Data augmentation includes random horizontal flips, random rotations up to 15', color jittering, and random cropping. An 80/20 train-test split is used across all datasets. Training was terminated once the validation accuracy had converged (difference between training accuracy of previous epoch and current epoch is < 1, and the model with the highest validation accuracy within (latest) epochs before convergence was chosen for testing purposes.
For medical datasets, the ResNet-50 was trained until convergence. For CIFAR-10 and FashionMNIST, the All-CNN is trained for 25 and 15 epochs, respectively, with a learning rate of 0.01 and batch size 64. All hyperparameters were selected via grid search. All experiments are run across 3 NVIDIA GeForce RTX 2080 Ti GPUs.
3.3 Evaluation Metrics
We evaluate unlearning performance using four primary criteria. Forget Set Accuracy (F-Acc) measures the accuracy a held-out portion of the forget set F; lower values indicate more effective forgetting. Remain Set Accuracy (R-Ace) captures the accuracy a held-out portion of the remain set R; higher values reflect better retention of model utility. To assess the balance between these objectives, we compute the F/R Accuracy Ratio defined as the ratio of forget to remain accuracy; lower values suggest better selective forgetting without compromising performance on R. Finally, we measure vulnerability to Membership Inference Atlacks (MIA) Carlini et al. (2022) following the protocol of Kurmanji et al. (2024). A logistic regression classifier is trained to distinguish between samples in F and held-out test set drawn from the same class. The attack model takes as input the clipped loss (z) y), truncated to the range [-400, 400). We use 5-fold valadaaniot and report average classification accuracy, where a perfect defense achieves 50%. Together, these metrics quantify whether forgetting was successful (C1), model utility was preserved (C2), and, even though not the main focus of our work, whether post-unlearning privacy risk was mitigated.
3.4 Baselines
We compare our method against several established basclines. Retrain serves as the gold standard: a model is retrained from scratch using only the remain set R, providing an ideal upper bound on R accuracy and lower bound on F accuracy, alboit at high computational cost. Boundary Unlearning implementation provided by authors of Chen et al. (2023) equivalent to our method with À = and 7 = 0 as in Eq. (3), where each forget sample is nudged across the decision boundary with a one-step gradient update, and then finc-tuned on the reassigned label. Fine-tune on Remain updates the original model using only data from R. leveraging distributional shift to induce forgetting but without direct boundary manipulation. Negative Gradient Golatkar et al. (2020) reverses learning the forget set by optimizing the negative of the standard loss. Catastrophic Forgetting-k: (CFK) and Eract Unlearning-k (EUK) Goel et al. (2022) freeze the first k layers of the original model and fine-tune or retrain the remaining layers on R, offering controlled partial forgetting. Finally, Scrub Kurmanji et al. (2024) uses a student teacher framework in which the student.
learns from a teacher trained solely on R, aiming to exclude information from F. All baseline comparisons are included in the main text results (Section
4 Results
We have evaluated our unlearning method across benchmark, medical, and clinical imaging datasets to assess its ability to selectively forget designated data while preserving performance the retained set. We have organized our results into four parts. First, we present quantitative results on four image classification datasets
8

---

Published in Transactions on Machine Learning Research (11/2025)
A CIFAR-10. 10: Acc
CIFAR-10: Acc
CCIFAR-100 F/R Ratio
D
CIFAR-10: MIA
1.0
0.95
F/R Ratio
MIA Value
0.8
F Acc
0.90
0.5
0.5
R
0.6
Retrain
0.85
Finetune
0.0
0.0
0.4
NegGrad
Fashion: Acc
Fashion: Acc
Fashion: F/R Ratio
H
Fashion: MIA
CFK
1.0
1.0
EUK
Scrub
Acc
0.95
F Acc
F/R Ratio
MIA Value
0.8
Boundary
0.5
0.5
Ours
0.6
0.90
0.0
0.0
0.4
0%
25% 50% 75%
100%
0%
25%
50% 75% 100%
0%
25%
50%
75% 100%
0%
25%
50%
75% 100%
Forget %
Forget
Forget
Forget
Figure 2: Unlearning varying proportions of target class using our method and standard baselines. R Acc and F Acc denote the accuracy of the unlearned model the remain and forget sets, respectively. MIA refers to robustness against membership inference attacks. Top row: CIFAR-10; bottom row: PashionMNIST. Arrows indicate the desirable direction for each metric (1 for higher is better, for lower is better), and MIA = -5 indicates the bost casc.
(-10 FashionMNIST, CFP-OS, and MRJ), where we systematically unlearn varying proportions of the training data and evaluated unlearning success using four metrics: Forget Accuracy (F-Acc), Remain Accuracy (R-Acc), F/R. ratio, and Membership Inference Attack (MIA) accuracy. Second, examined real-world clinical scenarios, including seribute-based unlearning on color fundus photographs and external eye images. Third, we conducted ablation experiments to isolate the effects of key loss components and design choices within our bilevel optimization framework. For all datasets, we conducted a grid search over E [0, le - 4, 1e 3, 1e 2. 1] and y E [0, le 4, le - 1, (as in Eq. 3 and the best pairing were used. The best performing pair of y and À were used for reporting. Heatmaps of all pairings can be found
the Appendix (Figures 10 11
4.1 Selective Forgetting
We first evaluate the ability of our algorithm to selectively forget varying proportions designated class in CIFAR-10 and FashionMNIST. For each dataset, we constructed forget sets F by sampling increasing percentages of single class (1%, 10%, 25%, 50%, 75% and 100%). We report Forget Accuracy (F-Acc), Remain Accuracy (R-Acc), F/R ratio, and Membership Inference Attack (MIA) accuracy in Figure
Our hod consistently achieves lower F-Ace than all baselines-off outperforming Chen et. al. 2023 which is conceptually most similar. Across both datasets, this enhanced forgetting is achieved with only a modest reduction in R-Ace (typically 2-5%) compared to Finc- Tamo-Tnnngg and CFK, which prioritize utility over explicit lorgetting- Our formulation maintains a favorable tradeoff between forgelting and retention, as captured by a reduced F F/R ratio. That said, we note that this tradeoff entails measurable reduction in R-Ace compared to some other baselines.
As expected, when the forget set comprises only 1% of the data, full retraining is inefficient. While method and Boundary Unlearning exhibit higher MIA values in these small-forget settings, they achieve markedly superior F-Ace suppression. On CFP-OS, we observe a small but consistent increase in R-Ace as the forget percentage approaches 100% (Appendix Figure 5). We believe that this is due to the effective reduction in class complexity, as the removal of nearly all examples from one class renders the task closer binary classification. In such cases, the model no longer needs to learn fine-grained boundarics between three classes, allowing to more confidently separate the remaining two, thereby improving R-Acc.
9

---

Published in Transactions on Machine Learning Research (11/2025)
Dataset
CFP-Clinic
Oculoplastics
Unlearned
Camera
WPF>112m
Metric
R Ace
F Acc
F F/R
MIA
R Acc
Acc
F/R
MIA
Retrain
0.71
0.55
0.78
0.62 + 0.07
0.97
1.00
1.03
0.50 + 0.00
Finetune
0.65
0.81
1.25
0.59 + 0.06
0.88
0.63
0.71
0.80 + 0.24
NegGrad
0.64
0.86
1.35
0.55 + 0.04
0.88
0.38
0.43
0.30 + 0.24
CFK
0.70
0.79
1.12
0.57 + 0.06
0.92
0.88
0.95
0.60 + 0.20
EUK
0.70
0.79
1.13
0.50
0.09
0.94
0.88
0.93
0.50 + 0.00
Scrub 0.70
0.82
1.18
0.62 + 0.15
0.91
0.38
0.41
0.50 + 0.32
Boundary 0.49
0.09
0.19
0.74 + 0.05
0.91
0.50
0.55
0.80
+ 0.24
Ours
0.51
0.10
0.20
0.58 + 0.10
0.91
0.38
0.41
0.70 + 0.24
Table 1: Performance of unlearning algorithms on clinical datasets. "Camera" (CFP-Clinic) refers to forgetting images captured with a specific imaging device, while VPF > 12" (Oculoplastic) denotes unlearning based on a clinical threshold for vertical palpebral fissure. R Acc = Remain set accuracy (higher better), F Ace- = Forget set accuracy (lower is better), F/R Forget-to-Remain ratio (lower is better), and MIA = Membership Inference Attack accuracy (mean std). Bolded values indicate best performance column- wise (for MIA, values closest to 55)
When the forget set includes 100% of a class, the Retrain baseline achieves perfect forgetting by construction, as the class is entirely excluded from training. However, this scenario also results high susceptibility MTA, since the absence of this class makes its easier to detect by the attacker. Results from MRT and CFP-OS (Appendix Figure 5 mirror the trends observed in CIFAR-10 and FashionMNIST, confirming the consistency of our approach across domains. Additional numerical results are presented in Appendix Tables I0
Time Analysis On CIFAR-10, full retraining takes 1501.5 seconds. Unlearning with our method takes 134.2 seconds-ar an 11x speedup.
Additional timing results for medical datasets are provided in Appendix Figure
4.2 Clinical Unlearning
We next evaluate our method in real-world clinical settings using two datasets: CFP-Clini comprising color fundus photographs labeled by disease class, and Oculoplastic, containing periocular images likewise labeled by disease class.
In contrast to Section 4.1 which focused on forgetting specific training samples from a given class, these experiments assess whether the model can forget the influence of clinically meaningful subgroups defined by acquisition device anatomical features. Here we would like to preserve performance examples. This setting mirrors realistic post-deployment revision needs in clinical AT systems. Metadata distributions for the targeted subgroups are shown in Appendix Figure 4 Importantly, while test samples were disjoint from training data, they shared the targeted properties. As such, in these experiments the Forget set (F) therefore refers to the held-out test samples that exhibit the same defining characteristic but were never part of the training data. The Remain set (R) corresponds all other test samples that do not share this property. Thus, these experiments measure distributional unlearning i.e., the ability to remove learned associations tied to subgroup rather than specific instances removal. Exact sample forgetting is addressed separately in our selective unlearning experiments.
similar but distinct
10

---

Published in Transactions on Machine Learning Research (11/2025)
We first evaluated unlearning based acquisition device, removing all training images captured with specific scanner (Cirrus 800 FA), common scenario when a device is deprecated or recalled. Our method and Boundary Unlearning were the only approaches to reduce F-Ace to - 10%, while maintaining comparable R-Acc (0.51 vs. 0.49). Although CFK preserved higher utility (R-Acc- = 0.70), it failed to suppress F-Acc tradeoff that our method manages more explicitly. Overall R-Ace in this setting was lower than in other experiments (Table D.
effectively, highlighting a
We also evaluated forgetting based an anatomical criterion: vertical palpebral fissure (VPF) 2 12 mm Dollfus & Verloes (2012). Increased VPF is a common feature of diseases such as Thyroid Eye Disease. Intuitively, this form of unlearning reflects evolving clinical criteria or quality thresholds Guimarãcs & Cruz (1995). Our approach achieved the best tradeoff in this setting, with low F-Acc (0.38) albeit slightly higher than retraining, However, our approach outperforms or is comparable to all other baselines considered. To our knowledge, this the first demonstration of effective unlearning based on a contimuous anatomical feature (Table
Across both scenarios, our method consistently achieved the best second-best F/R ratio, indicating targeted forgetting with minimal degradation to remain-set performance surpassing conventional baselines and outperforming retraining. While privacy was not the primary goal in these settings, our method also achieved competitive membership inference (MTA) robustness. These results show that the model, after unlearning, generalizes the suppression of the targeted signal to unseen samples sharing that attribute, supporting its use as a practical maintenance mechanism on real world data.
4.2.1 Qualitative Comparison
To contextualize unlearning behavior, we present qualitative examples from each clinical unlearning scenario in Appendix Figure G For both the camera model and anatomical fcature (VPF 2 12 mm) experiments, we randomly selected pairs of lest images from the same disease class: one from the forget set (F) and one from the remain set (R).
Qualitative results illustrate that the model was able to suppress correct classification on the targeted samples in F, while maintaining performance visually similar examples in R. This suggests that unlearning operated not just at the class level, but in a clinically specific and metadata-informed way. In the casera-based unlearning example, images of the same disease captured with a different imaging device were retained. In the anatomical unlearning case, the model selectively suppressed predictions for high- VPF cases but preserved others within the same diagnostic category. Together, these examples demonstrate that the forgetting effect is both targeted and mcaningful-rrmoviing Iearned associations tied to acquisition conditions or clinical phenotypes, rather than globally degrading the model.
4.2.2 Decision Boundary Shifts
To visualize how unlearning alters model behavior in clinical settings, we projected the embeddings of test samples in and R using t-SNE and plotted approximate decision boundaries for the original, retrained, and unlearned models (Figure 3). Since t-SNE is initialized randomly, the absolute positions of class clusters may vary between runs. In the Oculoplastic dataset, unlearning images with vertical palpebral fissure (VPF) Z 12 mm caused visible shift in the decision space: points in the forget set that were originally classified Class 2 (Thyroid Eye Disease) were reassigned to the nearest incorrect class (Class 0) in the unlearned model, consistent with our relabeling mechanism. Notably, this shift occurred without substantial distortion of the remain-sct regions. A small number of points near the original decision boundary became misclassified as a side effect of the forgetting process, consistent with the expected tradeoff between retention and removal.
We also generated corresponding decision boundary visualization for the CFP-Clinic dataset (Appendix Figure 7 Unlike the Oculoplastic sctting, the bascline model for CFP exhibited poor separability and high prediction uncertainly across all classes. So, the t-SNE embeddings produced diffused and overlapping decision regions. Further discussion on this can be found in Appendix Section SectionA.7.2 In summary, quantitative metrics showed consistent drop in F-Ace following unlearning, and qualitative examples confirmed that targeted images were misclassified as intended (Table
11

---

Published in Transactions on Machine Learning Research (11/2025)
Original Model
Retrain Model
Unlearn Model
Clsss 2 Torget Set
Figure 3: Decision boundary of original (left), retrain (center), and model unlearned of images with VPF 12 mm (right). All points in the test set for R and F were passed through the models and the embeddings were visualized using t-SNE. Stars denote points in F, and circles denote points in R. Color denotes predicted label, and in the event of misclassification, edges denote the ground truth label. Decision space was visualized by training a k-ncarest neighbors classificr on the 2D t-SNE embeddings using prodicted labels, and plotting decision regions as background contours.
Retraining and unlearning. Retraining from scratch is widely regarded as the gold standard for unlearning, it guarantces that the model has no direct exposure to the forget set. However, in experiments (Figure Table D we observed that retraining did not always lead to low accuracy on F. This is expected when F contains samples that are highly representative of their class, since the model can still rely on similar examples present in the retain set. Our method differs in that it provides an explicit mechanism to suppress predictive infiuence from F, offering direct control over the unlearned model.
4.3 Ablation Studies
To assess the impact of key design choices in our outer optimization, we conducted ablation experiments on CIFAR-10 using a fixed forget set (100% of class 0). We evaluated three factors: (1) whether losses were computed using logits or standard hard labels (argmax), (2) whether logits were preprocessed via top-k normalization, and (3) whether loss from the remain set R was incorporated during unlearning, either from the beginning with delayed onset. Details the settings modified in ablation experiments be found in Scction 2.4
Remain loss was weighted using regularization parameter & as in Eq. set to Φ = 10-2 and X = [0, 10011 1000-- 10-1,10--11 were used on both and as described in Eq. (17. Results are summarized in Table 2 with additional configurations presented in Appendix Table 4
was evaluated as in Eq. 33 was fixed at 0 for all ablation studies. We also varied how logits
Computing loss on F using unprocessed logits leads to performance degradation strong forgetting. Including remain loss generally improves R accuracy across configurations, at the expected cost of reduced forgetting. Delaying the introduction of remain loss (e.g., starting at epoch 10) showed negligible difference compared to early inclusion. Notably, our default setting iee, argmax labels for F, no logits, and no remain loss, achieves the best combination of forgetting and retention (F-Acc = 0.094, R-Ace = 0.81).
(R-Acc 0.17), despite
These results underscore the mothod's sensitivity outer loop scttings. Notably, soemingly small adjustments can produce large performance shifts. However, this allows the model to be steered toward different points along the forgetting retention spectrum in predictable way. In particular, using logits from the forget set borgttiingrreeentinn
enforces strong forgetting at the expense of remain accuracy, while incorporating logits from the remain set boosts retention but weakens forgetting. Preprocessing logits provides minor stabilizing effect. Together,
12

---

Published in Transactions on Machine Learning Research (11/2025)
these findings show that our method offers tunable (but not always stable) control over the forgetting- spectrum.
F Acc
R Acc
R Logit
F Logit
Preproc.
A = 0
X =
le -4
4
X
le
-
=
À = le
4
A = le
0.089
0.12
0.094
0.84
0.81
0.81
+
0.49
0.52
0.48
0.87
0.85
0.85
+
0.001
0.047
0.062
0.18
0.17
0.17
+
+
0.001
0.047
0.062
0.18
0.17
0.17
+80)
+(80)
0.001
0.047
0.062
0.18
0.17
0.17
+990)
(90)
0.001
0.047
0.062
0.18
0.17
0.17
+
+
+
0.52
0.55
0.51
0.89
0.88
0.89
Table 2: Evaluation ion of the influence of logits and incorporation of the loss from R in unlearning. A Φ value of le 1e-2 2 was used. Results with 6 = le-4 are in Appendix Table [ A number after the plus sign in parentheses denotes the epoch at which the logits were incorporated during outer optimization.
5 Discussion
Machine unlearning is often framed as privacy-preserving tool satisfy regulatory mandates like the "right to be forgotten" Regulation (2020); Graves et al. (2021). In clinical ML systems, where data heterogencity, evolving standards, and device turnover are common, full retraining is often infeasible particularly for deep architectures Guo et al. (2021); Mooenoo-Tores et al. (2012): Futoma et al. (202)). To address this, we propose & bilevel optimization algorithm with convergence guarantees that enables selective removal of training data from convolutional neural networks. Our experiments span both benchmark and clinical datasets, each designed to evaluate targeted unlearning under different operational constraints. Our settings reflect realistic maintenance scenarios and test whether a model can forget subgroup's influence rather than specific samples. In all cases, our approach suppressed classification performance the targeted group while preserving retention performance, demonstrating reliable behavioral control.
The motivation for our clinical unlearning experiments is not to claim that data from specific devices or patients with specific features is intrinsically detrimental, but rather to illustrate how unlearning can be applied in clinically realistic maintenance scenarios. In practice, medical imaging systems frequently face distribution shifts when equipment upgradod or replaced, and such shifts have been shown to degrade model performance if not addressed Guan & Liu (002)): Kumari & Singh (2024). Our experiment therefore serves proof-of-principe demonstration that targeted device-level unlearning is feasible. While we do not empirically show that retaining this particular device's data. harms future performance, our results demonstrate the mechanism by which device-specific removal can be enacted when clinically motivated. Future work could more directly quantify the performance tradeoffs associated with device retention versus removal.
Although privacy is not the primary motivation of our framework, we evaluated robustness MIA for completeness. We observed that our method sometimes yields higher MIA scores than retraining or other basclines. One possible explanation is that explicit boundary-shftting may leave sharper less smooth decision regions around forget samples, which could be exploited by adversaries in membership inference. To our knowledge, prior boundary-bul based methods did not report MIA experiments, so further work is needed to fully characterize this tradcoff. These results underscore that while our method enables targeted forgetting, it not designed as privacy-preserving unlearning algorithm. Future extensions could integrate MIA robust more directly for settings where privacy, rather than model maintenance, the primary concern.
13

---

Published in Transactions on Machine Learning Research (11/2025)
While our framework offers tunable behavioral control, the ablation study highlights that this tunability comes with sensitivity to hyperparameters. In practice, we found that the effects of different settings follow interpretable trends: (i) using argmaxx labels for forget samples with no remain loss maximizes forgetting but sacrifices retention; (ii) incorporating remain loss with moderate weight improves retention while reducing lorgelting. These heuristics allow practitioners to steer the method loward desired outcornes without exhaustive scarch. Nonetheless, tuning can remain challenging in high stakes or resource constrained settings, small parameter changes may still cause large shifts. Developing more robust strategies for parameter selection is therefore important direction for future work.
We have identified some limitations of our approach. First, our method is tailored to CNNs, and adaptation to other architectures such as vision transformers (ViTs) remains an open challenge due to their use of attention and context-rich feature representations Shao et al. (2021); Mahmood et al. (202I). Second, in distributionally entangled datasets, such as when unlcarning glaucoma cases tied to deprecated scanner, forgetting can degrade performance on the remain set (Appendix Figure 4). This highlights challenges separating acquisition effects from disease labels. In the future, it would be interesting see if our bilevel formulation can be adapted to unlearn vision transformers (ViTs). The main challenge here is that ViT's rely on attention mechanisms and context-aware representations less amenable to boundary pertur ientuurbaiion (Shao) et al. 2021): ; Mahmood et al. (2021) that need to be accounted in the formulation. Furthermore, additional experiments on larger-scale clinical models are warranted, especially across diverse imaging modalities (e.g., CT, OCT, histopathology) and deployment conditions (e.g., continual or federated learning). Finally, we note that our definition of forgetting (requiring misclassification of F) differs from the retraining- based standard of statistical indistinguishabiiity While this provides a practical guarantee for model maintenance, it may be less appropriate in privacy-driven settings.
6 Implications of Unlearning in Healthcare
Our formulation of unlearning enforced misclassification raises important ethical considerations in high- stakes domains such healthcare. If patient invokes their right to be forgotten, unlearned model could actively misclassify future data from that patient. Similarly, when unlearning is applied for maintenance purposes (e.g., removing data from deprecated imaging devices or outlier subgroups), there is a risk of inad- vertently propagating biases against those populations. We emphasize that our contribution is methodological and not intended as guide book for immediate clinical deployment. Any adoption of unlearning healthcare would require strict safeguards, including registries track which paticnts or subgroups have been unlcarned, governance mechanisms to ensure unlearned models are not inappropriately applied for diagnostic purposes, and oversight to mitigate bias introduction.
14

---

Published in Transactions on Machine Learning Research (11/2025)
References
Muhammad Naseer Bajwa, Gur Amrit Pal Singh, Wolfgang Neumeier, Muhammad Imran Malik, Andreas Dengel, and Sheraz Ahmed. G1020: A benchmark retinal fundus image dataset for computer-aided glaucoma detection. IJCN,, 2020.
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. 2022 IEEE Sympostum Security and Privacy (SP), pp. 1897-1914, 2022.
Robert Challen, Joshua Denny, Martin Pitt, Luke Gompels, Tom Edwards, and Krasimira Artificial intelligence, bias and clinical safety. BMJ quality & safety, 28(3):231- 2019.
Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. CVPR, 2023.
Ben Cottier, Robi Rahman, Loredana Fattorini, Nestor Maslej, and David Owen. The rising costs of training frontier ai models. arXiv preprint arXiv:2405. 21015, 2024.
Matthias De Lange, Rahaf Aljundi, Mare Masana, Sarah Parisot, Xu Jia, Aleš Leonardis, Gregory Slabaugh, and Tinne Tuytelaars. A continual learning survey: Defying forgetting in classification tasks. IEEE transactions on poltern analysis and machine intelligence, 44(7)33366-3388) 2021.
Hélène Dollfus and Alain Verloes. Developmental anomalies of the lids. Pediatric ophthalmology and strabismus. Philodelphia: Elsevier Health Sciences, pp. 147 64, 2012.
Joseph Futoma, Morgan Simons, Trishan Panch, Finale Doshi-Velez, and Leo Anthony Celi. The myth of generalisability in clinical research and machine learning in health care. The Lancel Digital Health, 2(9):
14899e4992 2020.
Guillaume Garrigos and Robert M Gower. Handbook of convergence theorems for (stochastic) gradient methods. XrXiu preprint arXiv:2301.00 11 11235, 2023.
Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponnurangam Kumaragur. Towards adversarial evaluations for inexact machine unlearning. ar preprint arXiv:2201.0664p 2022.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks, 2020. URL
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. Xrviv preprint arXiv:1412.6371 2014.
Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. Proceedings of the AAAI Conference on Artificial Intelligence, 15(13)111511-1112 May 2021. doi: 10.1609 13513.17771 URL https://ojs. aaai.
Hayit Greenspan, Bram Van Ginneken, and Ronald M Summers. Guest editorial deep learning in medical imaging: Overview and future promise of an exciting new technique. IEEE transactions on medical imaging, 35(5):1153-1159, 2016.
Hao Guan and Mingxia Liu. Domain adaptation for modical image analysis: a survey. IEEE Transactions on Biomedical Engineering, 69(3):1173 1185, 2021.
Fernando C Guimarães and Antonio AV Cruz. Palpebral fissure height and downgaze in patients with graves upper eyelid retraction and congenital blepharoptosis. Ophihalmology, 102(8):1218 1222 1995.
Lin Lawrence Guo, Stephen R Pfohl, Jason Fries, Jose Posada, Scott Lanyon Fleming, Catherine Aftandilian, Nigam Shah, and Lillian Sung. Systematic review of approaches to preserve machine learning performance in the presence of temporal dataset shift in clinical medicine. Applied clinical informatics, (2(0)))808-8)) 815, 2021.
15

---

Published in Transactions on Machine Learning Research (11/2025)
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition, 2015. URT. http::://aaxii..or/abbb///////// 03385
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar- 10 (canadian institute for advanced research). URL http://www.crt www.sto.roto....ooooo.ooooo werronto.edu/-riiizcccie. html
Suruchi Kumari and Pravendra Singh. Deep learning for unsupervised domain adaptation in medical imaging: Recent advancements and future perspectives. Computers in Biology and Medicine, 170:107912, 2024.
Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafiliou. Towards unbounded machine unlearning, Advances in neural information processing systems, 36, 2024.
Cecilia Lee and Aaron Y Lee. Clinical applications of continual learning machine learning. The Lancet
Digital Health, (())cc29-c281) 2020.
Geert Litjens, Thijs Kooi, Babak Ehteshami Bejnordi, Arnaud Arindra Adiyoso Setio, Francesco Ciompi, Mohssn Ghafoorian, Jeroen Awm Van Der Laak, Bram Van Ginneken, and Clara I Sánchez. A survey on deep learning in medical image analysis. Medical image analysis, 42:60-88 88, 2017.
Hengzhu Liu, Ping Xiong, and Tianqing Zhu. Philip 8 yu. a survey on machine unlearning: Techniques and new emerged privacy risks. arXiv preprint arXiv:2406. 06186, 2024a.
Zheyuan Liu, Guangyao Dou, Eli Chien, Chunhui Zhang, Yijum Tian, and Ziwei Zhu. Breaking the trilemma of privacy, utility, and efficiency via controllable machine unlcarning. Proceedings of the ACM Web Conference 2024, pp. 1260 1271, 2024b.
Debbic S Ma, Joshua Correll, and Bernd Wittenbrink. The chicago face database: A free stimulus set of faces and norming data. Behavior research methods, 47:1 11r1122-1110 1135, 2015.
Kaleel Mahmood, Rigel Mahmood, and Marten Van Dijk. On the robustness of vision transformers to adversarial examples. Proceedings of the IEEE/CVF international conference on computer vision, pp. 7838-7847, 2021.
Ronak Mehta, Souray Pal, Vikas Singh, and Sathya N Ravi. Deep unlearning via randomized conditionally independent hessians. pp. 10422 10431, 2022.
Nooshin Mojab, Vahid Noroozi, Abdullah Aleem, Manoj P Nallabothula, Joseph Baker, Dimitri T Azar, Mark Rosenblatt, RV Chan, Darvin Yi, Philip S Yu, et al. I-oda, real-world multi-modal longitudinal data for ophthhalmicappllcationss arXiv preprint arXiv:2104.022 026099 2021.
Jose G Moreno-Torres, Troy Raeder, Rocío Alaiz Rodrigzz,,,, Nitesh V Chawla, and Francisco Herrera. A unifying view on dataset shift in classification. Pattern recognition, 45(1):521-530) 2012.
George R Nahass, Ghasem Yazdanpanah, Madison Cheung, Alex Palacios, Jeffrey C Peterson, Kevin Heinze, Sasha Hubschman, Chad A Purnell, Pete Setabutr, Ann Q Tran, et al. State-of-the-art periorbital distance prediction and discase classification using periorbital features. arXiv preprint 2rXiv:2409.18700 2024.
George R Nahass, Emma Koehler, Nicholas Tomaras, Danny Lopez, Madison Cheung, Alexander Palacios, Jeffrey C Peterson, Sasha Hubschman, Kelsey Green, Chad A Purnell, et al. Open-source periorbital segmentation dataset for ophthalmic applications. Ophthalmology Science, 544)100077 2025.
Thanh Tam Nguyen, Thanh Trung Huynh, Zhao Ren, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoe Viet Hung Nguyen. survey of machine unlearning, 2024. URL https://arxiv http:://axxvvv.rgg//// org/abs/
2209.02299
Msoud Nickparvar. Brain tumor mri datasct, 2021. URL sstps://www.kagg" htt.://gg.e..oo//////54455588280
Jorge Nocedal and Stephen J. Wright. Numerical optimization, pp. 1 664. Springer Series in Operations Rescarch and Financial Engineering. Springer Nature, 2006.
16

---

Published in Transactions on Machine Learning Research (11/2025)
Samiksha Pachade, Prasanna Porwal, Dhanshree Thulkar, Manesh Kokare, Girish Deshmukh, Vivek Sa- hasrabuddhe, Luca Giancardo, Gwenolé Quellec, and Fabrice Mériaudeau. Retinal fundus multi-disease image dataset (rfmid), 2020.
Alexandra Peste, Dan Alistarh, and Christoph H Lampert. Ssse: Efficiently erasing samples from trained machine learning models. arXiv preprint arXiv:2107. (0:::200000300, 2021.
Prasanna Porwal, Samiksha Pachade, Ravi Kamble, Manesh Kokare, Girish Deshmukh, Vivek Sahasrabuddhe, and Fabrice Meriaudeau. Indian diabetic retinopathy image dataset (idrid), 2018.
General Data Protection Regulation. Art. 17 gdpr right to erasure ('right to be forgotten'), 2020.
Mher Safaryan and Peter Richtárik. Stochastic sign descent methods: New algorithms and better theory. International Conference Machine Learning, 2021.
Hadi Salman, Greg Yang, Huan Zhang, Cho-Jui Hsieh, and Pengchuan Zhang, convex relaxation barrier to tight robustness verification of neural networks. NewrIPS, 2019.
Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Chen, and Cho-Jui Hsich. On the adversarial robustness of vision transformers. Xiv preprint orXiv:2103.155: 156700 2021.
Jost Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin Riedmiller. Striving for simplicity:
The all convolutional net, 2015. URL
Eli Verwimp,, Rahaf Aljundi, Shai Ben-David, Matthias Bethge, Andrea Cossu, Alexander Gepperth, Tyler T. Hayes, Eyke Hüllermeier, Christopher Kanan, Dhireesha Kudithipudi, et al. Continual learning: Applications and the road forward. arXiv preprint ar arXio:231..11908, 2023.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image datasct for benchmarking machine learning algorithms, 2017. URL
Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S Yu. Machine unlcarning: A survey. ACM Computing Surveys, 2023.
Zhuo Zhang, Feng Shou Yin, Jiang Liu, Wing Kee Wong, Ngan Meng Tan, Beng Hai Lee, Jun Cheng, and Tien Yin Wong. Origa-light: An online retinal fundus image database for glaucoma analysis and research. ICEMIB, 2010.
17

---

Published in Transactions on Machine Learning Research (11/2025)
A Appendix
A.1 Proof of Lemma 2.2
Boundary point. Conceptually, our approach to solving the inner optimization problem involves using the Lagrangian of the coistrained problem and then solving the equivaleni unconstrained form which is easier lo implement in practice. Given f(wo, + x2) E [0, 1_ to be class probability predictions, and yi = eg for some k (i.c., eg is the k-th standard basis vector), the inner optimization optimization problem with single inequality constraint given by,
min 0 subject. to s(wn, ō + m;) en k.
Recall that for classification tasks, we use L log(-) (i.e., cross entropy based loss) which monotonic decreasing function in the positive real numbers. Therefore, the above problem equivalent to,
min 0 subject to [(fk(wo, + m:)) ((k)).
(5)
Now we write down the lagrangian of as;
L u) u (C(K) - ((fx(wo, +x))))
(6)
where u 2 O is the lagrange multiplier with dual feasibility constraint. We can ignore the second term of k since it is not function of 8. Moreover, since it is sufficient to find an approximately optimal 6, we
assume that u > 0, that is, the constraint (5) is active.
This lagrangian L has to be minimized wrt å and maximized wrt to u. Using the fact that inf(- = sup F for any function F, we have the desired result. Aside, the complementarity slackness condition necessitates that u (L(k) - L(fa (wo, 8 + x.))) = 0 so if u > 0, then the inequality constraint. tight and we so we obtain "boundary" point.
For regression tasks with squared l norm loss, 3: RKK may modify the inner optimization as,
min 0 subject to [lf 8 2.) 2ill n,
and proceed with the lagrangian as above.
Closest boundary point. We can show that this approach works for any inner objective (()) that is smooth (or subdifferentiable) and A > 0 (not necessary to have À = 0). To this end, consider the case when ((8) = 11181 that was used in Chen et al. (0023). Our proof of Lemma 3.2 can easily handle this. The Lagrangian to be minimized wrt this case bocomes,
1 L(ō, u) = 10112 + (C(K) C( Iı, wo))),
and the gradient wrt 8 is given by 8 u VoL(Ju + x;, wo)). Note that since there is only one constraint, the dual variable 2 0 is scalar which we consider as hyperparameter. With this, we can scale the objective by u, and minimize.
- 2u
L(6)
-11111 (8 + x4, wo));
or maximize
1
L(6)
|812 + L(fa(8 22,,
2u
Note that the gradient of L wrt 8 is given by 1 5 g-
18

---

Published in Transactions on Machine Learning Research (11/2025)
Convergence for À O: Notation-wise in (3, use A= 1 > 0 which we consider hyperparameter. So for any fixed À 2 0, the inner optimization problem is simply given by,
max 2 11811 + L(fe(6 24, wa))
Whence, the convergence result in |Safaryan & Richtárik (2021) holds as we can get the exact gradient of the term 2| So long the objective function is deterministic function of the perturbation d, our convergence analysis is valid.
A.2 Proof of Corollary 2.3
We will suppress some notation make the exposition simpler. For example, we will use V&C to denote VaL(fa(wo, 5 + 24)), and 5t to denote t-th iterate of 8 in inner loop. In this notation, update rule for Boundary Shrink in Chen et al. (2023) is given by,
xtt1 x' + + sign (Vz((x))) x x4, F.
(7)
On the other hand, sign gradient ascent with step size/learning rate on f(x; + 6) (with no closeness regularization) given by,
8++1 = + sign (VoL(r; + 8') 50 0.iEP.
(8)
Note that if we set x = 8 + x, (in 8 ), then x² = 8¹ + Iz, and the jacobian of a wrt is identity matrix. Moreover, using chain rule, we have that,
Vol(a; + + = Vσ vo((=')= -
(9)
Adding n; to both the sides of our update rule ( we have the desired result.
A.3 Proof of Lemma 2.4
We first compute E|d] and so assume that e = 1 this is without of loss generality since is a linear operator. Since z has a continuous density function, P(z = -g/7) = 0, and since the sign computed deenettiiee/coordnatevri we will compute coordinatewise. So we have that,
[d] Elsign(g 72)] +1. 2 1-P 2
9
2 -2) 7)
=1 2 9 =
11
1
+ erf
(-9 (1/2)
erf 9
(10)
7/2
where we used the definition of CDF of z using erf(-) (-1,+1), the Gaussian Error Function. Note that erf(g) > 0 if and only if 0, that is, g and erf(g) share the same sign along all the coordinates. So, we
have that Eg [d gi [.[d] 9 2 0 finishing the proof. By substituting the CDF of Laplacian or Cauchy in equation 10 we can see that the results holds for these distributions also.
A.4 Proof of Theorem 2.5
First, will use to denote - L. So the inner optimization becomes the following minimization problem, max L(8) min C(()) =ijn (()).
(11)
Since differentiable and satisfies lipschitz assumption, we have that, for any X, RD,
(()) < ((0) + vI(8) (A 5) -
11ー - 61
(12)
19

---

Published in Transactions on Machine Learning Research (11/2025)
By setting 8++1, and ò 8¹ in the above inequality, we get
1(8 S 1(6") - c V sign (Vol("')++773) + Let sign +7-
- $ - V sign Vil 2) + LDe
(13)
2
where the second inequality becomes equality almost surely. Taking expectations with respect to on both sides of the inequality in 13 we get,
VI(6") LD
E1((0+111 [[(("')] e, V erf
7V2
2
= =[[[6')] - c v((8')] erf VV((O))
LD
+ 2
(14)
TV2
where used the fact that VI and VVl have the same sign, and that erf is an odd function. Subtracting inf, 1(5) from both the sides of the incquality, rearranging, and taking expectation with respect to all the perturbations added, we get,
|((o>)] erf
V( TV2 ) c, [((0")]' erf
VI(O9) 7V2
e,B
LDef
B[(( inf (B((((+t))] 1 ini
(15)
2
Summing up the inequalities in 15 from t = 0 to t= - we get,
EB
|V((69)]
eer
erf
VI((')]
$ BB((6") inf -
inf Σ t=0
T-1 LDe,
yv2
= =(60) - inf (E]1(6")) )1 inf + LD
T-1 LDd,
- ((60) - inf +
(16)
t=0 2
where we used the fact óg is initialized at 0, and that (E[1(6")) ) inf 1) 2 0. By choosing y to be the
coordinatewise minimum value of gradient magnitude /VI(8'), we can assure that |V1(6') crf [Viaa)]
cll [|Vi/ and the claim follows by following similar techniques as in Garrigos & Gower (2023 Theorem 5. 521 since the step size/learning rate E, 1/t.
A.5 New Heuristics for Improved Unlearning
Our formulation provides three practical extensions. First, the remain set loss can be incorporated during the outer loop to preserve performance R:
W. arg min (l. (L)
(17)
iER
The proportion of the loss from R incorporated is controlled by d.
Second, we allow the outer loss to be computed using dense logits instead of hard labels. To interpolate between sparse (argmax) and dense supervision, we define a simple top-k logit preprocessing step. In all experiments, & was set to 3. In detail, let fw (x,, E R denote the logits for sample 2,, and let (o,))(f((x;)) denote the indices of the largest h: logits. We define a sparse logit. vector (1. as:
(w:)( { (wms(as), (
if E (op-k(fu(z.))
heherwise
20

---

Published in Transactions on Machine Learning Research (11/2025)
We then normalize the retained logits to form soft target:
()(1)) EyeTop (
These soft targets f(:;) are used in place of one-hot labels during fine-tuning. This modification reduces unnec- essary updates to weights associated with classes far from the decision boundary. These settings including top-k logit selection, the use of soft versus hard labels, and whether the remain loss is included-are systematically explored in our ablation experiments (see Section 4.3
Finally, by modifying the settings within our formulation, the unlearning process (as in Eqs. (3) eqouutop) can be steered toward different performance tradeoffs. When unlearning is significantly more efficient than retraining from scratch, it becomes feasible to generate multiple unlearned models each optimized for distinct objectives (e.g., high accuracy R at the expense of F, and vice versa). We have included the pscudocode of our outer loop with the above three extensions in the Appendix (Algorithm 3/.
A.6 On the threshold = 1/K
In Equation 1 we set the boundary threshold to 1/K. This choice ensures that the true class y longer strictly dominant:
(x()) > 1/K, class y may still be the maximizer.
2. If (x) = 1/K, then by the pigeonhole principle at least one # satisfies (y( 2 1/K, meaning the point lies on a boundary (via a tie) or is already overtaken.
3. If (x) 1/K, then y is strictly dominated and the point is across the boundary.
Thus, k = 1/K guarantees that the perturbed point is no longer in the interior class y's region, but lies on or across a docision boundary. In the binary case (K 2), this coincides exactly with the pairwise boundary Py = Pj-
21

---

Published in Transactions on Machine Learning Research (11/2025)
A.7
Additional Results and Details the Methods
In the following sections, present additional experiments and implementation details that supplement the main results. These include dataset summaries, extended unlearning benchmarks, timing analysis, hyperparameter sweeps, and the raw data underlying selective unlcarning plots.
A.7.1 Datasets
We used diverse set of datasets spanning both open-source and clinical imaging domains. This section outlines the composition of the open source CFP dataset that we curated as well our clinical datasets (Appendix Table 3 For clinical experiments, we selected data based on imaging modality and anatomical
measurements, ensuring real-world relevance (Appendix Figure 4..
IDRiD
RFMID
ORIGA
G1020
Total
DR
260
240
0
500
Glaucoma
0
0
168
296
464
Other
0
500
0
500
Table Open source data details. For DR, 260 images from the Indian Diabetic Retinopathy Image Datasel Porwal et al. 2018) with severity of > were chosen, and 240 images having diagnosis of only DR from the Retinal Fundus Multi-Discase Image dataset (RFMID) Pachade et al. (2020) were selected. For Glaucoma, 168 images from the Online Retinal Fundus Image Database for Glaucoma Zhang et al. (2010) and 296 images from the G1020 Bajwa et al. (2020) dataset were selected. 'Other' images were selected by randomly sampling 500 images from RFMID that did not have DR or Glaucoma as a label. These images have diagnoses of AMD, macular hole, and more Bajwa et al. (2020).
Oculoplastics Dataset
Other Retinal Disarders
Cramobocill Mackly
800
Pequercy
60-
7ED
Frequency
600
60-
Vertical Palpebral Fissure (mm)
10
22
Spectrats (Scams)
Optosi
Cimss B8g
FF 450
Caiteoiaa
Outeide Imapes
Specralis
(Scan))
Retcam
Outside FU
MPEC Cirus
Imaging Device
Diabetic Retinopathyy
Glaucoma
Fequency
50c Frequency
Rec
Specralls
Optos
Cimss B0o FA
Optos Califomna
450
Spectnatis 2
FU
Forus Fundus
Cirus 600 FA
Spectratio
450
RU
Optos
os
Optos
Spectratis 2 (Scane)
(icano)
(scane)
Californi
Imaging Device
Imaging
Figure 4: Distributions of clinical data and parameters for unlearning used in this study. On the histogram, the dashed line denotes vertical palpebral fissure (VPF) of 11- images with VPF greater than this were unlearned. On bar graphs, 'red' denotes the samples that were unlearned in targeted medical unlearning experiments.
A.7.2 Additional Unlearning
In this section, we show extended results from class-wide unlcarning across two domains: 2D brain MRI slices and fundus images (CFP). We report forgetting accuracy (F-Acc), retention accuracy (R-Acc), their ratio, and mean + std of MTA attack success (Appendix Figure 5 We also provide pseudocode algorithm of our
22

---

Published in Transactions on Machine Learning Research (11/2025)
MRI: Acc 1
MRI: Acc 4
MRI: F/R Ratio
MRI: MIA
1.0
1.0
F/R Ratio
MIA Value
0.8
R Acc
0.8
0.5
F
0.6
Retrain
Finetune
0.6
0.0
NegGrad
CFP-OS: Acc
CFP-OS:
CFP-OS: F/R Ratio
CFP-OS: MIA
CFK
1.0
0.75
MIA Value
Scrub
R Acc
0.9
Acc
0.50
F/R Ratio
0.5
Boundary
Ours
0.25
0.8
0.00
0%
Forget
Forget %
Forget
Forget
Figure 5: Unlearning various proportions of the class to be forgotten using our method and other standard baselines. R and acc denote the accuracy of the unlearned model on the R and F subsets. MIA denotes robustness to membership inference attacks. Top row displays results on MRI dataset, bottom row displays results on CFP open source dataset. Directionality of arrows indicates whether high or low values are the desired output.
Unlearn Condition
Camera Model
VPF> 12mm
Forget Set
Remain Set
Forget Set
Remain Set
Figure 6: Example images from both clinical unlearning scenarios, drawn from the forget (F) and remain set (R). All images belong to the same disease class, but forget samples were either collected using the Cirrus 800 FA imaging device (left) had vertical palpebral fissure (VPF) 2 12mm (right), and were explicitly targeted for unlearning.
outer loop of optimization with the extensions studied in ablation experiments. Full results on ablation using different o and À values are reported in Tables 2 and
For completeness, we include I-SNE visualization of the decision boundary shift following unlearning on the CFP-Clinic dataset (Figure 7 In contrast the Oculoplastic dataset, the CFP-Clinic embeddings exhibited poor bascline scparability and high uncertainty in predictions across all modcls. As result, the dccision regions appear diffuse, and no clearly structured shift is visible after unlearning. This reflects the low-quality latent. space induced by the initial model, rather than a failure of the unlearning algorithm itself. Tn fact, forgetting metrics still showed a consistent drop in F-Acc (Table D and qualitative examples confirm that forgotten images were suppressed even when embedded in noisy regions. This example highlights both the utility and limitations of decision- boundaryy visualization in low-performing clinical domains.
23

---

Published in Transactions on Machine Learning Research (11/2025)
Original Model
Retrain Model
Unlearn Model
Dass
Figure 7: Decision boundary of original (left), retrain (center), and unlearned (right) models. All points in the test set for R and F were passed through the models and the embeddings were visualized using t-SNE. Stars denote points in F, and circles denote points in R. Color denotes predicted label, and in the event of misclassification, edges denote the ground truth label. Decision space was visualized by training k-ncarest neighbors classifier on the 2D I-SNE embeddings using predicted labels, and plotting its decision regions as background contours.
Table 4: Evaluation of the influence logits and incorporation of the loss from in unlearning. A value of le was used. A number after the plus sign in parenthesos denotes the epoch at which the logits were incorporated during outer optimization.
F Acc
R Acc
R Logit
Logit
Preproc.
X = 0
X
le
X le-1
À
le
X = le 1
0.089
0.12
0.094
0.84
0.81
0.81
+
0.49
0.52
0.48
0.87
0.85
0.86
+
0.001
0.047
0.062
0.18
0.17
0.17
+
+
0.001
0.047
0.062
0.18
0.17
0.17
+(80
+(80)
0.001
0.047
0.062
0.18
0.17
0.17
+900)
+990)
0.001
0.047
0.062
0.18
0.17
0.17
+
+
+
0.44
0.49
0.49
0.88
0.87
0.88
24

---

Published in Transactions on Machine Learning Research (11/2025)
Algorithm 3: Configurable Outer Loop with Remain Loss and Logit-Based Labeling
Input: Relabeled forget set F, Remain set R, initial weights wo, learning rate f), remain loss weight 6, top-k parameter k, use lse__oft_labell, use lre_remain__aee losss Output: Unlearned model parameters Wh
Initialize w < wo;
for t= to Touter do Sample minibatch (z v/) ~ F;
// Load forget-set samples
if use_soft, labels then 2 + (x
// Compute logits from original model
Keep top-k entries of 2,, zero others; Normalize retained logits to form Py;
// Create soft target distribution // Compute outer loss with soft targets
Lj + {(f((1)).Pr);
else
+ + ((
// Use hard labels
if use_ remain loss then Sample minibatch (2r, vr) R;
// Load remain-set samples
C, +- ((fu(xr),))) (x))
// Compute loss on retained data
Crotal + L, x Cri
// Weighted combination
else
L Fiotal + Ly;
Update + w 1)- Ltotaal
// Perform gradient step
return We +- w
25

---

Published in Transactions on Machine Learning Research (11/2025)
A.7.3 Timing
We report wall-clock timing of unlearning procedures as a function forget set size for each clinical dataset. As shown in Appendix Figure g our method scales efficiently even high forget ratios, with runtimes remaining significantly lower than full retraining in all cases.
Oculoplastics
CFP Open Source
CFP Clinical
7000
140
1200
120
1000
(seconds)
100
Time (seconds)
Time (secondis
5000
800
4000
80
600
60
ne500
1=114
400
2000
n=1000
1000
Unleamiin Time
200
Retrain Time
0.13 0.25
0.50
1.00
0.13
0.25
0.50
1.00
0.13
0.25
0.50
1.00
Percent Class Unlearned
Percent Class Unlearndd
Percent Class Unleamndd
Figure 8:
Timing results of unlearning on all clinical datasets evaluated where various percentages of the class to be unlearned where designated as the forget set. n denotes the total size of the class to be unlearned.
A.7.4 Hyperparameter Tuning
To evaluate the impact of hyperparamcters y (noise scale) and (closencss rogularization), we performed grid sweeps and measured accuracy on F and sets. Columns and of the heatmaps show performance on each subset; Column 3 shows Euclidean distance from retrain baseline, proxy for closeness to retrain performance (Appendix Figures and
26

---

Published in Transactions on Machine Learning Research (11/2025)
FashionMNIST: R Accuracy,
FashionMNIST: F Accuracy,
FashionMNIST: Dist. to Retraining,
A
B
C.
0.67
0.89
0.91
0.91
0.058
0.084
0.11
0.092
0.099
0:11
0.11
0.90
0.4
le2 1e44
0.86
0.87
0:91
0.91
1e2 1e2 14]
0:26
0.14
0.11
À
0.86
0.91
0.88
1e1 1e-2
0.11
0.3
1e1
0.2
02
0.84
0.82
0.83
0.84
0.9
0.44
0.19
0.11
0.21
0.11
D.1
16.4
16-1
1
1e-1
Y
CIFAR- 10: R Accuracy,
CIFAR 10: Accuracy. 4
CIFAR-10 10: Dist. Retraining.
D
0.81
0.87
0.089
0.40
0.13
0:40
Ic:1 Ie2 Ic.4
0.87
0.84
0.81
0.81
0.86
0.26
0.2
0.092
0.096
0.35
0.2
0.13
0.13
0.35
À
0.30
0.88
0.88
0.81
0.81
0.3
0.35
0.091
0.096
0.25
0.3
0.35
0.13
0.13
0.25
0.88
0.88
0.81
0.81
0.83
0.35
0.41
0.094
0.097
0.20
0.35
0.41
0.13
0.13
0.20
0.82
0.15
0.88
0.88
0.85
0.81
0.37
0.42
0.18
0.1
0.37
0.42
0.19
0.13
0.10
1e-4
1e-1
1
1e-4
1e-1
1e-4
1e-1
Y
V
Y
CFP-OS: Accuracy,
CFP-OS: Accuracy,
CFP-OS: Dist. Retraining,
G
H
0.99
0.98
0.99
0.98
0.094
0.052
0.042
0.052
0.094
0.054
0.043
0.054
0.8
0.8
1e1 1e22 1c-4
0.99
0.98
0.99
0.98
1
0:48
0.052
0.042
0.052
0.48
0.054
0.043
0.054
0.6
0.6
0.99
0.99
0.98
0.62
0.99
0.042
0.052
0.63
0.39
0.043
0.054
0.99
0.99
0.90
0.74
0.62
0.042
0.052
161
0.74
0.62
0.043
0.054
0.2
0.2
0.99
0.99
0.98
0.74
0.053
0.054
1e:4
1e:
1
0
1s 4
le
1c
1e
MRI: R Accuracy,
MRI: F Accuracy, 4
MRI: Dist. to Retraining, 4
0.72
K
0.0750
0.66
0.72
0:69
0.7
0.016
0.025
0.016
0.009
0.31
0.29
0.28
0.71
0.0225
121 1e2 1e.4
0.67
0.69
0.70
0.016
0.0200
À
0.69
g
0.0175
0.68
0.0150
0.67
0.69
0.016
0.67
0.0125
0.67
0.69
0.66
0.69
0.66
0.016
0.031
0.016
0.016
0.0100
0.29
0.32
0.29
1e-4
1e-1
1
1e-1
1e-4
1e-1
Y
Y
Y
Figure 9: Unlearning results using various combinations of 7 and À on non-medical imaging datasets. Column denotes the accuracy all combinations on R, Column 2 Denotes the accuracy all combinations on F, and Column denotes the Fuclidean distance of [Faces Race] obtained using all combinations y and À from Faece Race] obtained using the retrained model.
27

---

Published in Transactions on Machine Learning Research (11/2025)
CFP-CLINIC: R Acc, 7
CFP-CLINIC: F Acc, 4
CFP-CLINIC: Dist. to Retrain,
A
0.81
0.84
0.83
0.84
B
0:015
0.05
0.11
C
0.03
0.065
0.12
0:12
le1 le2 1e44
0.84
0.83
0.82
0.11
Jel 1e-2 1e-4
0.062
À
0.80
0.76
0.2
0.77
0.73
0.85
0.83
0.74
0.69
0.75
0.14
0.12
0.69
0.76
0.14
0.12
1e-4
1e-1
1e-4
1e-1
1e4
Y
Y
OCT: ACC,
OCT: F Acc, 4
OCT: Dist. to Retrain,
D_
0.95
E
0.87
0.0064
0.27
0.57
0.34
0.36
0.8
0.90
Ie.2 Ie.4
0.88
0.82
0.87
0.88
0.85
0.51
0.57
0.51
0.6
0.64
0.53
0.58
0.51
0.7
À
0.93
0.93
0.87
0.88
0.80
0.78
0.76
0.58
0.51
0.4
0.78
0.76
0.58
0.52
0.6
0.75
1e.1
0.96
0.95
0.67
0.88
0.82
0.81
0.56
0.51
10:1
0.82
0.61
0.57
0.51
0.5
0.70
0.2
0.96
0.95
0.89
0.89
0.85
0.85
0.83
0.51
0.85
0.85
0.84
0.52
0.4
1e-4
1e-1
1e-4
1e-1
1e4
le-1
Y
Y
OP: R Acc,
OP: Acc,
OP: Dist. to Retrain,
G.
1.00
H
0.96
0.98
0.96
0.12
0.062
0.25
0.19
0.13
0.066
0.25
0.19
0.5
1e1 1e22 1c-4
0.96
0.99
0.56
0.12
0.25
0.19
0.4
1el 182 16-4
0.36
0.12
0.25
0.19
0.4
0.96
0.98
0.56
0.44
0.25
0.19
0.3
0.56
0.44
0.25
0.19
0.3
0.96
0.97
0.44
0.25
0.2
0.44
0.39
0.2
0.98
0.96
1e.4
1e-1
10-4
18-1
0
18.4
16-1
1
Y
Y
US: R Acc, t
US: F Acc, J
US: Dist. to Retrain,
K
0.5
0.5
0.73
0.73
0.32
0.22
0.38
0.32
0.17
1e:1 Ie2 1e.4
0.4
A
0.80
le2
0.78
0.85
0.73
0.73
0.44
0.22
30-1
0.51
0.17
0.76
0.84
0.84
0.79
0.74
0.74
0.51
0.49
0.29
0.14
0.51
0.49
0.29
0.16
0.2
1e:1
1e-4
1e-4
Y
Y
Y
Figure 10: Results of unlearning an entire class using various combinations of y and À on medical imaging datasets. Column 1 denotes the accuracy of all combinations on R, Column 2 Denotes the accuracy of all combinations on F, and Column denotes the Euclidean distance of [Face- Race] obtained using all combinations 7 and À from [Facey Reee] obtained using the retrained model. OP denotes oculoplastic dataset, and US denotes ultrasound dataset. Directionality of arrows indicates whether high or low values are the desired output.
28

---

Published in Transactions on Machine Learning Research (11/2025)
CFP-CLINC, Camera: R Acc, 1
CFP-CLINC, Camera: F Acc, J
CFP-CLINC, Camera: Dist. to Retrain,
A
B
0.49
0.51
0.52
0.57
0.094
0.1
0.23
0.29
0.8
0.5
0:48
0.36
0.29
lel 1e:2 104
0.54
0.53
0.52
0.57
0.58
0.11
0.21
0.23
0.29
0.6
g
0:46
0.37
0.36
0.29
0.56
0.58
0.59
0.52
0.57
0.65
0.58
0.24
0.29
se>
0.17
0.13
0.35
0.29
0.4
0.59
0.61
0.53
0.57
0.84
0.84
0.27
0.3
1e
0.33
0.32
0.33
0.28
0.52
0.2
0.59
0.6
0.55
0.57
0.87
0.89
0.55
0.31
0.35
0.37
0.16
0.27
1c-4
1e-1
10-4
10-1
16-4
1e-1
OP, VPF> 11: Acc,
OP, VPF> 11: Acc,
OP, VPF> 11: Dist. to Retrain,
D
E
F
0.91
0.91
0.91
0.91
0.5
0.38
0.62
0.5
0.60
0.51
0.63
0.38
0.51
0.60
le? 1e44
0.91
0.91
0.91
0.91
0.95
1e:2 1e-4
0.62
0.38
0.62
0.5
0.55
0:38
0.63
0.38
0.51
0.55
0.91
0.91
0.91
0.91
0.90
0.62
0.38
0.52
0.5
0:38
0.63
0.38
0.51
0.50
167
0.91
0.91
0.91
0.91
0.62
0.38
0.62
0.5
0.
0.63
0.38
0.51
0.45
-0.85
0.91
0.91
0.91
0.91
0.62
0.38
0.62
0.5
0:38
0.63
0.38
0.51
0.40
1e-4
1e-1
1e.4
16:1
1c.4
1c-1
Figure 11: Results of unlearning subsets of images based clinical parameters using various combinations of and À on medical imaging datasets. Column denotes the accuracy of all combinations on R. Column 2 Denotes the accuracy of all combinations on F, and Column 3 denotes the Euclidean distance of [Facer Racel obtained using all combinations of and X from [Face: Racel obtained using the retrained model. A-C represents the results unlearning images acquired with a specific imaging device, and D-F are the results of unlearning images of eyes that had vertical palpebral fissure 11mm. Directionality of arrows indicates whether high low values are the desired output.
29

---

Published in Transactions on Machine Learning Research (11/2025)
A.7.5 Selective Unlearning Raw Data
The following tables provide detailed performance metrics each forget percentage from 1% to 100%, as used in the selective unlearning plots (Figure and 5). This allows finer inspection forgetting trends across subset sizes.
B
Disclosures
S.H.: Stock or stock options Horizon Surgical Systems. P.S.: Consultant Oyster Point Pharma; Leadership fiduciary role in other board, sociely, commitlee advocacy group, Board member of American Society of Ophthalmic Plastic and Reconstructive Surgery; Stock stock options Lodestone Pharmaceuticals. A.Q.T.:
Consultant Moaetech/Rochar J.C.P, author on provisional patents US20230194734A1, W02024145070A1 (University of Miani holds all rights)
30

---

Published in Transactions on Machine Learning Research (11/2025)
Dataset
fashioMNIST
CIFAR-10
Metric
R Acc
F Acc
MIA
R. Acc
F Acc
MIA
Retrain
0.973
0.8
0.5 +/- 0.0
0.955
0.9
0.4 +/- 0.2
Finetune
0.984
0.7
0.8 +/- 0.245
0.957
0.8
0.6 +/- 0.374
NegGrad
0.973
0.7
0.7 +/- 0.245
0.933
0.5
0.6 +/- 0.2
CFK
0.981
0.5 +/- 0.0
0.97
1
0.7 +/- 0.245
EUK
0.982
1
0.7 +/- 0.245
0.97
1
0.5 +/- 0.316
SCRUB
0.991
0.4 +/- 0.2
0.982
1
0.5 +/- 0.0
Boundary 0.93
0.7
0.7 +/- 0.245
0.919
0.5
0.8 +/- 0.245
Ours 0.93
0.7
0.9 +/- 0.2
0.924
0.6
0.7 +/- 0.245
Table 5: Selective unlearning of all datasets retaining 1% of the forget class. Blue and red highlight denote best and worst performance on F and R accuracy. MTA closest. bolded.
Dataset
fush
CIFAR-10
MRI
CFP-Open Souree
Metrie
Acc
Ace
MIA
Acc
P Ace
MIA
Acc
Acc
MIA
Retrain
0.969
0.87
0.44 1/- 0,073
0.946
0.92
0.47 /- 0.081
0.958
0.92
0.552 /- 0.059
0.919
0.58
0.52 1/- 0.075
Fineluue
0.985
0.88
0.46 +/- 0.058
0.952
0.94
0.49 +/- 0.058
0.965
0.975
0.491 +/- 0.052
0.881
0.78
0.56 +/- 0.08
NegGrad
0.965
0.81
0.61 +/- 0.037
0.944
0.74
0.65 +/- 0.055
0.944
0.533
0.594
-/- 0.068
0.902
0.82
0.52 +/- 0.04
CFK
0:982
0:99
0.50 +-/ 0.08
0.960
0.56 +-/ 0.073
0.906
0.914
0.376
-/- 0.033
0.916
0.84
0.72 4,/- 0.076
EUK
0.982
0.99
+/- 0.049
0.968
0.57 +/- 0.081
0.967
+/-
0.80
0.5 +/- 0,089
SCRUB
0.99
0.91
0.46 +/- 0.058
0.979
0.99
0.51 -/- 0.02
0,961
0.938
0.533
-/- 0.056
0.895
0.800
0.48 +/- 0,098
Boundary
0.908
0.42
0.76 1/- 0.097
0.878
0.3
0.72 1/- 0.108
02719
0.111
0.752 1/- 0.07
0.255
0.33
0.7 1/- 0.11
Ours
0.4
0.65 +/- 0.032
0,574
-/- 0.0
0.729
0.191
0.691
-/- 0.059
0.763
0.36
0.64 +/- 0.15
Table 6: Selective unlearning of all datasets retaining 10% of the forget class. Blue and red highlight denote best and worst performance on F' and R accuracy. MIA closest to .5 is bolded.
Dataset
MNIST
CIFAR-10
MRI
CFP-Open Spurre
Motrie
Ace
| Ace
MIA
R Ace
Ace
MIA
R Ace
F Acc
MIA
RtAce
F Ace
MIA
Retrai
0.971
0.581 +/-
0.956
0.5 +/-
0.943
0.981
0.494 +/- 0.031
0.906
0.792
0.616 +/- 0.088
Flaettuee
0.986
0.896
0.512 +/- 0.035
0.954
0.928
0:456 +/- 0.069
0.952
0.928
0.553 +/- 0.02
0.917
0.848
0.382 +/- 0.047
NegGrad
0.684
0.66 +/- 0.018
0.612
0.668 +/- 0.043
0.982
0.79
0.633 +/- 0.064
0.924
0.792
0.688 +/- 0.109
CFK
0.981
0.972
0.516 +/- 0.084
0.969
0.988
0.524 +/- 0.023
0.97
0.938
0.563 +/- 0.036
0.941
0.816
0.568 +/-- 0.082
EUK
0.962
0.48 +/- 0.052
0.992
0.576 +/-
0.965
0.509 +/- 0.009
0.932
0.864
0.578 +:/- 0.125
SCRUB
0.969
0.970
0.532 +/- 0.037
0.98
0.984
0.324 +/- 0.045
0.954
0.958
0.439 +/- 0.009
0.912
0.848
0.336 +/- 0.074
Boundary
0.896
0.776 +/-
0.850
0.748 +/- 0.675
0.78 -/- 0.033
0.794
0.896 +/-- 0.041
Qurs
01 907
0.268
0.804 4./- 0.029
0.96
0.208
0.784 +/-- 0.06
0.009
0.022
0.738 4//- 0.037
0.424
0.736 4.7- 0.041
Table 7: Selective unlcarning of all datasets retaining 25% of the forget class. Blue and red highlight denote best and worst performance on F' and R accuracy. MIA closest to .5 is bolded.
31

---

Published in Transactions on Machine Learning Research (11/2025)
Datasel
MNIST
CIFAR-10
MRI
CFP-Open Source
Metric
R Acc
F Ace
MIA
R Ace
Ace
MIA
R Ace
F Aoc
MIA
R: Ace
P Ace
MIA
Rotrain
0.514 +/- 0.949
0.864
0.326 +.- 0.043
0.964
0.877
0.536 +/- 0.032
0.916
0.748
0.502 +-/- 0.097
Finetume
0.965
0.912
0.474 +/- 0.05
0.945
0.921
0:494 +/- 0.023
0.962
0.912
0.581 +/- 0.025
0.911
0.724
0,026 +/- 0.035
NegGrad
0.722
0.838 +/-
0.961
0.011
0.618 +/-
0.898
0.749
0.568
+/- 0.015
0.838
0.228
0.648 +--- 0.082
CFK
0.962
0.58
0.492 +/- 0.032
0.968
0.978
0.501
+/- 0.053
01.688
0.906
0.579
+/- 0,009
0.933
0.718
0,021 +/- 0,032
0.982
0.968
0.472 /- 0,028
0.98
0.498
4/- 0.031
0.900
0.904
0.564
1/- 0.024
0.927
0.792
0.612 1/- 0.027
SCRUD
0.90
0.968
0.49 /- 0.03
0.981
0.982
0.548
1-f 0.017
0.949
0.909
0.536
1- 0.036
0.928
0.808
0.6 1/- 0.038
Boundary
0.788 /-
0.852
0.786
1//-
0.612
0.777
1/- 0.029
0.847
0.252
0.716
1//- 0.015
Ours
0,898
0,292
0.706 +/- 0.026
0.805
0.21
0.784
4/- 0.036
0.009
0.019
0.749 +/- 0.057
0,837
0,236
0.696 +/-- 0.05
Table 8: Selective unlearning of all datasets retaining 50% of the forget class. Blue and red highlight denote best and worst performance on F' and R accuracy. MIA closest to .5 is bolded.
Dataset
MNIST
CIFAR-10
MRI
CFP-Open Source
Metric
R.A. Aoc
Ace
MIA
R Ace
Ace
MIA
R Ace
F Aoc
MIA
R Ace
P Ace
MIA
Retmin
0.967
0.796
0.577 +/- 0.031
0.948
0.84
0.548 +/- 0.035
0.95
0.542
0.733 +/- 0.011
0.939
0.749 +/- 0.038
Finetune
0.966
0.579
0.559 +/- 0,014
0.958
0.907
0.473 +/- 0.033
0.972
0.767
0.621
+/- 0.012
0.921
0.395
0.661 +/- 0.051
NegGrud
0.969
0.764
0.581 +/- 0.025
0.94
0.025
0.617 +/- 0.03
0.947
0.36
0.719
+/- 0.083
0.931
0.341
0.706 +/- 0.000
CFK
0,982
0.976
0.481
/- 0.02
0.968
03987
0.353
1/- 0.024
0.975
0.855
0.594
1//- 0.022
0.959
0.541
0.651
1/-- 0.037
EUK
0.981
0.953
0.468
/- 0:017
0.969
0.964
0.54
1-- 0.025
0.975
0.853
0.602
//- 0.013
0.965
0.56
0.641
1/- 0.054
SCRUD
0.99
0.516
1/- 0.014
0:982
0.979
0.529
/- 0.028
0.965
0.803
0.616
1/- 0.019
0.951
0.080
0.614
1-/- 0.068
Boundary
0.954
0.26
0.801
f-/- 0.014
0.867
0.185
0.775
f/- 0.024
0.6
0.013
0.77
/- 0.018
0.94
0.149
0.705
+.-- 0.049
Ours
0.896
0.277
0.784 +/-
0.188
0.761 +/- 0.038
0.648
0.011
0.78
-/- 0.022
0.964
0.165
0.671 +/-- 0.075
Table 9: Selective unlearning of all datasets retaining 75% of the forget class. Blue and red highlight denote best and worst performance on F' and R accuracy. MIA closest to .5 is bolded.
Dataset
MuchionMNIST
CIFAR-10
MRI
CFP-Open Souree
Metrie
R Aoc
F
MIA
Ace
Aoc
MIA
Aoe
R
Retrain
0
0.81 +/- 0.08
0.975
0
0.876 +/- 0.022
0.899
0.913 -/- 0.011
0.912
0.945 +/- 0.019
Finetune
0
0.81 +/- 0.068
0.963
0
0.816 +/- 0.047
0.889
0.921
0.511 -/- 0.013
0.938
0.862
0,552 +/- 0.025
NegCrad
0.969
1/- 0.121
0.983
0.094
0.758 1/- 0.04
0.903
0.635
/- 0.021
0.942
0.649
1/- 0.035
CFK
0,99
0
0.84 +/- 0,073
0.987
0.597
0.684 +/- 0.061
0.906
0.914
0.5 +/- 0.01
0.939
0.91
0.519 +/- 0.021
EUK
0.984
0.81 +/- 0.068
0.966
0.666
0.625 +/- 0.02
0.905
0.926
0.502
-/- 0.024
0.94
0.804
0.531 +/- 0.018
SCRUB
0.995
+/- 0.055
0.973
0.322
0.741 +/- 0.029
0.913
-/- 0.017
0.944
0.897
+/- 0.028
Romdday
0.87
0.058
0.8 1,-- 0.005
0.84
0.089
0.756 4-/- 0.038
0.016
0.808
/- 0.031
0.50
0.004
0.826 1//- 0.015
Ours
0.89
0.084
0.68 +/- 0.068
0.81
0.091
0.703
+/- 0.06
0.7
0.009
0.797 -/- -/-00-0000 0.021
0.99
0.012
0.851 +/- 0.006
Table 10: Selective unlearning of all datasets retaining 100% of the forget class. Blue and red highlight denote best and worst performance on F and R accuracy. MIA closest .5 is bolded.
32


Reviews:
[{"review_id": "kd5aibZFTT", "reviewer": "Reviewer_zNwu", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "#### Summary of Contributions  \nThe paper introduces a novel approach to machine unlearning by recasting it as a bilevel optimization problem. It proposes an algorithm that uses perturbed sign-gradient methods to identify decision boundary points for relabeling forget samples, enabling targeted forgetting while preserving performance on remaining data. The method includes convergence guarantees for the inner optimization loop and supports tunable loss designs to control the forgetting-retention tradeoff. Additionally, it allows for compositional merging of unlearned models. Empirical evaluations on benchmark datasets (CIFAR-10, FashionMNIST) and clinical medical imaging datasets (MRI, color fundus photographs, oculoplastic images) demonstrate superior performance over baselines in terms of forgetting efficacy, retention accuracy, and resistance to membership inference attacks.\n\n#### Key Strengths  \n- Provides a principled bilevel optimization framework with theoretical convergence guarantees, extending prior boundary-based methods.\n- Applies unlearning to practical clinical scenarios, such as removing influence from deprecated imaging devices or anatomical outliers, which is underexplored.\n- Offers tunability via hyperparameters and supports model composition, enhancing flexibility for real-world model maintenance.\n- Comprehensive experiments across diverse datasets, including ablation studies, validate the method's effectiveness and efficiency compared to retraining and other unlearning techniques.\n\n#### Key Weaknesses  \n- Relies on hyperparameter tuning (e.g., γ, λ, ϕ), which may require additional computational effort or expertise.\n- While faster than full retraining, the method's computational cost could be prohibitive for very large-scale models or datasets.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The theoretical claims, such as convergence of the perturbed sign-gradient method, are supported by proofs in the appendices, including applications of KKT conditions and stochastic optimization arguments. Empirical claims are backed by extensive experiments on six datasets, with quantitative metrics (F-Acc, R-Acc, MIA accuracy) reported in tables and figures. Comparisons to baselines like Boundary Shrink, SCRUB, and retraining show consistent improvements. Ablation studies isolate the impact of key components, and timing analyses confirm efficiency. Visualizations and qualitative examples further strengthen the evidence. Overall, the results are reproducible based on described hyperparameters and setups.", "audience_yn": "Yes", "audience_explanation": "Machine unlearning is a growing area in machine learning, particularly for privacy preservation, model updating, and compliance with regulations like GDPR. The paper's focus on clinical applications addresses real-world challenges in healthcare ML, where data shifts and device changes are common. The theoretical guarantees, tunability, and compositional aspects would appeal to researchers in optimization, adversarial robustness, and medical AI. Findings on balancing forgetting and retention could inform practical deployments, making it relevant to TMLR's broad audience in trustworthy and applied ML.", "requested_changes": "1. Include more details on hyperparameter selection, such as the grid search ranges used and sensitivity analyses beyond the ablations, to aid reproducibility. (Strengthening: Enhances practical utility.)\n\n2. Provide experiments on additional modalities or larger-scale models (e.g., transformer-based architectures) to broaden applicability. \n\n3. In Section 4.1, the described forget set percentages are 1%, 10%, 25%, 50%, and 75%, but Figure 2 includes a 100% data point, which is not mentioned in the setup; this discrepancy requires explanation.\n\n4. Discuss any specific adaptations made to the algorithm for medical images (e.g., handling large sizes or sparse regions) or explain why the general method is sufficient for these datasets. \n\n5. Elaborate in the main text on how the new label y_b is initially assigned (e.g., via argmax on the boundary point) and provide concrete examples of how to modify it for directing forgetting to specific classes.\n\nNo critical changes are needed, as the current submission is already strong in methodology, evaluation, and novelty.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "RiO2rXknIC", "reviewer": "Reviewer_PDw9", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors propose an unlearning method for neural networks on supervised classification tasks. The presented approach generalizes an existing boundary unlearning method where the model is trained to classify to-be-unlearned samples or classes as the nearest neighboring class instead. (As a result the decision boundary shifts and the unlearned classes are getting subsumed by their neighboring classes). The authors propose a general bilevel optimization formalization for solving the corresponding boundary unlearning problem, with the general objective to misclassify samples of a forget set, while correctly classifying samples of a remain set.\n\nThrough the new formalization the authors are able to relate their method to several adjacent frameworks: the initial boundary crossing (\"boundary shrinking\"), student–teacher approaches, and gradient based adversarial attack methods. Leveraging their more relaxed formalization on inferring boundary conditions, they are able to prove several convergence guarantees for the inner and outer optimization problem of finding the nearest class and retraining the classifier.\n\nExperiments are conducted on CIFAR-10, FashionMNIST and four medical datasets. While I'm not particularly familiar with with standard benchmarks in this field, the evaluation on medical datasets seems to be an important step towards evaluations on more realistic datasets. Results are compared against several seemingly common baselines of the field. Experiments include forgetting of a single class with increasing percentages of sample sizes, and the unlearning of specific samples. Several ablations, a qualitative comparison and inspection of the decision boundary shifts are performed. All experiments seem to be well conducted, provide a good overview of the method's capabilities and indicate a reasonable performance of the model. An additional 'compositional strategy' experiment of their method yielded the overall best performing model on the simple CIFAR-10 dataset. Some concerns on result interpretation/presentation are discussed below.", "claims_and_evidence_yn": "No", "claims_explanation": "The general formalization and proofs are well presented and seem to be sound. The experimental setup, compared methods and applied metrics seem reasonable and well conducted. However, the obtained results and their interpretation in the text seem to diverge. Privacy guarantees might not hold to the degree promised.\n\n\n\n**Interpretation and Presentation of Results**\n\n1) Considering results across the paper (Fig. 2, tables 6-11) it seems that the proposed method features a consistently better forget accuracy, but lower retain accuracy. Throughout the paper, remain set accuracy is stated with \"higher is better\". However, in Table 1, for both datasets, the author's own method is marked best without being highest (by a large margin of 19% in the first dataset). While the authors focus on the better values in forget accuracy, they fail to critically assess the weakness of their method in terms of remain accuracy. Overall, the results do not reflect to the initial claims of a \"exact [and distributional] unlearning\", as the proposed method seems to consistently forget larger portions of the remain set in comparison to the other baselines.\n2) Table 1 states that the MIA metric is the membership inference attack accuracy. I, therefore, assume that a lower value is better? (Also the \"Higher/lower is better\" indicator for MIA metric in Fig. 2 is missing.) However, the NegGrad method with the lowest value of 0.3 (vs. 0.5 which is neither the lowest nor highest, with several other unmarked 0.5 entries existing) is not indicated as best.\n3) All R Acc and F Acc values are reported without standard errors, as only the best model seems to be selected from all seeds for testing. The lack of error bounds weakens the reliability of the results.\n\n\n\n**Unlearning**\n\nGiven, that the underlying Chen et al. method shifts unlearned samples to the decision boundaries of the classes, it is likely that such 'unlearned' samples might again be found and extracted by particularly searching for logit configurations near the decision boundaries. I am therefore critical of the author's claims of the method to consistently \"unlearn\" and its ability to perform \"instance-level\" model maintenance. As samples are relabeled, but might not be forgotten, single sample memorization might still occur. This assumption of incomplete unlearning seems to be supported by the consistently high MIA values -- in comparison to other baseline methods (except for the baseline Boundary method, which suffers the same problem) as for example reported in Figure 1/Table 1. Given, that the authors advertise their method for the particularly privacy sensible domain of medical data, I would like to recommend the authors to revise their claims and better highlight the limitations of the approach in this regard.", "audience_yn": "Yes", "audience_explanation": "The paper relates different methods and aspects of boundary-based unlearning via a unifying formalization. The authors present a broad range of experiments and ablations including real-world datasets. Researchers of the respective field might find the presented results convenient for transporting ideas into the related fields and apply their method on the constructed medical datasets.", "requested_changes": "My requested changes primarily concern on the interpretation and presentation of experimental results, as well as the unlearning claims as discussed in the previous fields. I consider both, the presentation of results and unlearning claims critical, as they might lead to an inaccurate perception of the method's capabilities.\n\n\n\n1) Considering the inner minimization constraint in Eq. (1), it is not directly obvious to me, why choosing $\\kappa = 1/K$ projects samples directly onto the decision boundary. If I'm not mistaken, the particular choice of 1/K being relating to the exact boundary is never derived in the paper or appears in the appendix. Considering Sec. 2.3 it seems that the particular choice of $\\kappa = 1/K$ might guarantee a switch in the label as some other class is guaranteed to yield a higher value. This however might not correspond to the actual decision boundary. I would kindly like to ask the authors to clarify.\n\n\n\nRecommendations for minor adjustments:\n\n* page 2, last paragraph: \"... extend the boundary-based unlearning framework of Chen et al. (Chen et al. 2023)\". Use citet to avoid the repeated \"Chen et al.\".\n* Fig. 8 and Table 6 are scaled too large. Remove the stretch to line width.\n* Start of page 3: \"Please see Appendix [reference missing?] for more details.\"\n* Table 6: The NegGrad entry lacks F acc blue coloring for fashionMNIST and overall red indicators. (Also: typo \"fashioMNIST\").\n* MIA results are never color coded/bolded in the appendix.\n* Tables 1,2,4-11: I would like to suggest making the lines of the tables connected if possible (similar to table 3) and/or remove some of the rules for cleaner tables.", "broader_impact_concerns": "Given the advertisement of the method for the applications on medical data and privacy-based applications in combination with observed MIA values, I would like to recommend to the claims about unlearning, as discussed in the 'Unlearning' part of the previous 'Claims' section.", "additional_comments": "-", "extra_scores": {}, "extra_text": {}}, {"review_id": "0BXkP78HJk", "reviewer": "Reviewer_px6p", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work targets machine unlearning by a boundary-based unlearning mechanism. The authors formulate a compelling motivation from the perspective of practical application within the healthcare sector (medical imaging). They position machine unlearning to go beyond compliance to legislation (General Data Protect Regulation (GDPR), and similar) casting it more similar to continual learning. In particular , their proposed mechanism, but also machine unlearning in general, can be understood as a tool for revising models to improve performance, yet form the perspective of removing certain information, in contrast to adding it.  This perspective allows for selectively removing information, such as data from outdated scanners or low-quality images, to improve model relevance and performance.\n\nThe core contributions include the proposed algorithm itself, a theoretical analysis providing convergence guarantees, and an empirical evaluation on both standard and newly introduced benchmarks.\n\n**Strength:**\n\n1. The authors address machine unlearning beyond a compliance perspective, motivated from real-world applications in healthcare. \n2. The authors purposefully selected a optimization formulation that allows them mathematical introspection of convergence properties of their method.\n3. The introduction of new benchmarks tailored to their proposed use cases is a valuable contribution that could foster further research in this specific application area. (If the data is made available to the community)\n\n**Weakness:**\n\nMy main concerns revolve around a core definition of the unlearning objective, namely: “C1: the updated model should misclassify $(x,y) \\in F$, i.e. $f_{w_u}(x) \\neq y$”. It reads to misclassifying as many samples in the forget set as possible, which is not the default criteria, and brings various implications to the evaluation of the proposed method, which to me, are not discussed sufficiently.\n\n**1. Conceptual Formulation of the Unlearning Goal:**\nI found the formulation of the unlearning goal, particularly desideratum **C1**, to be at odds with the standard definition in the literature. The authors state that the updated model should misclassify samples from the forget set F (i.e. $f_{w_u}(x) \\neq y$,), which is measured by Forget Set Accuracy (F-Acc), where lower is better.\nHowever, the common objective of unlearning is to produce a model that is indistinguishable from one that was retrained from scratch on the retain set [1,2,3]. This means the model's accuracy on the forget set should be similar to that of a retrained model, which is typically close to random chance for a balanced dataset, but not necessarily zero. This (standard) view is articulated in key papers the authors cite, such as Triantafillou et al. [1] and Golatkar et al. [2].\n\nTo me, this mismatch in definition impacts the interpretation of the results throughout the paper. For instance, the claim in Section 4.1 that \"Our method consistently achieves lower F-Acc than all baselines\" is presented as a key advantage. However, under the standard unlearning paradigm, this might indicate that the method is indeed memorizing the forget set rather forgetting it. \nFurther, it comes with important albeit more conceptual implications I will discuss later below (see **Broader impact concerns**.).\n\n**Suggestion:** I would greatly appreciate it if the authors to further clarify and motivate the desideratum C1.  If their goal is indeed to force misclassification, this represents a significant departure from the standard unlearning paradigm and would require a thorough discussion to justify this choice and differentiate it from prior work. Alternatively, if I have misunderstood, a clearer explanation in the text should resolve this ambiguity.\n\n**2. Statement on Retraining:** Related to the point above, I am confused by the statement in Section 4.2.2: “Retraining may not unlearn. Importantly, we note that retraining alone did not result in significant misclassification of the forget set […]”. By definition, retraining from scratch is the gold standard for unlearning, right? The fact that it doesn't lead to \"significant misclassification\" (i.e., near-zero accuracy) highlights the potential discrepancy regarding the definition of unlearning in this work.\n\n**3. Clarity of claim “Reliable Behavioral Control”: T**he paper claims the proposed algorithm offers \"tunable loss design\" and \"reliable behavioral control.\". However, the ablation study in Section 4.3 concludes that \"Seemingly small adjustments can produce large performance shifts.\". While the authors commendably report this sensitivity, yet it seems to contradict the idea of \"reliable control.”\n\n**Suggestion:** Could the authors provide more nuance to this claim? To substantiate the claim of \"tunability,\" it would be helpful to include a discussion on how a user might intuitively or heuristically select hyperparameters for a desired outcome without an exhaustive grid search. Potentially corroborated by respective experiments.\n\n**4. Clarity of claim “Compositionality”:**  The motivation and evaluation of the model composition approach in Section 4.4 feels underdeveloped. The particular motivation from observing hyperparameter sensitivity to proposing model composition as a solution is not immediately clear.\n\n**Suggestion:** This section would be strengthened by a more detailed conceptual discussion and more thorough empirical evaluation. For instance, what is the intuition behind what composition achieves at the model level? What about other recently well established compositions such as weight-space merging (a.k.a. model merging, model fusion)? \nAlso, the evaluation in Section 4.4.2 would benefit from the baseline of comparing the composed model to a single, non-composed model that is simply fine-tuned on the retain set.\n\n**5. MIA:** Given the significant role of Member-Inference Attack (MIA)  in the evaluation, MIA could be formally introduced as a desideratum in Section 2.1. Additionally, the MIA scores for the proposed method appear relatively high in some experiments, and a discussion interpreting these results would be welcome.\n\n**6. Is data removal beneficial?** For the use case of forgetting acquisition devices, the paper would be more compelling if it first demonstrated that retaining data from an older device actively harms the model's performance on data from newer devices. Otherwise, more intuition or discussion could clarify why the particular data should be removed from the training set in the first place. This would establish a stronger baseline and motivation for the unlearning task.\n\n**Minor Comments:** \n\n**Related Work:** A dedicated \"Related Work\" section would greatly help readers who are less familiar with the field to better situate this paper within the broader landscape of unlearning and model editing approaches. \n\n**Comparison to Chen et al.:** The introduction states that Chen et al. \"lacks convergence guarantees,\" but the paper later notes that Chen et al. is a special case of the proposed method. This implies that the convergence guarantees presented here might extend to their work. Clarifying this point would be helpful.\n\n**Clarity in Section 2.2:** The opening sentence, “*Because post-hoc unlearning must modify a frozen model [...] by modifying parameters $w$*\" is slightly confusing. If parameters  are being modified, the model is not \"frozen.\" A rephrase could improve clarity.\n\n**Figure 2 Labels:** The x-axis labels in Figure 2 seem to be in the wrong unit, it reads 0.5% instead of 50% as mentioned in the text.\n\n**Intuition for Lemma 2.1:** The explanation could be more explicit. The sentence \"we apply via standard application of the Karush-Kuhn-Tucker (KKT) conditions\" seems to miss a word. Please clarify what is being applied or shown.\n\n**Conceptual Difference from Prior Work:** The paper would benefit from a brief discussion on the conceptual difference between this method and the previous boundary-based method by Chen et al., particularly regarding the decision to not move the point on the decision boundary. Intuitively I can imagine there are trade-offs to be made? Those can be discussed.\n\n[1] (Triantafillou et al.) - \"Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition\"\n[2] (Golatkar et al.) - \"Eternal sunshine of the spotless net: Selective forgetting in deep networks.\"\n[3] (Xu et al.) - \"Machine Unlearning: A Survey\"", "claims_and_evidence_yn": "No", "claims_explanation": "While the paper provides empirical results and theoretical derivations, I find that several of the main claims are not convincingly supported by the evidence presented, due to the following key reasons:\n\n1. The primary claim of superior unlearning performance rests on a definition (forcing misclassification on the forget set) that diverges significantly from the established consensus in the literature. Because this foundational evaluation criterion is not sufficiently justified, the subsequent results (e.g., achieving lower 'F-Acc') are not convincing as evidence of successful unlearning as it is commonly understood.\n2. Regarding the claim of \"reliable behavioral control\", the paper's own ablation study highlights the method's high sensitivity to hyperparameter changes (\"small adjustments can produce large performance shifts\"). This evidence supports the idea of tunability, but not the reliability, or predictability, which are key to the claim.\n3. Regarding the claim of \"compositionality\", to me, the motivation for this approach is not well-established in the work. I would require at least more intuition to what the composition (stitching) of models means on a conceptual level. Also, the empirical evaluation misses baselines, e.g. the non-composed finetuned on the remain set, to make a convincing case for its utility. \n\nImportantly, it is to note that the theoretical claim regarding convergence guarantees does appear to be well-supported. My concerns lie primarily with the interpretation and strength of the empirical evidence backing the practical claims of the method.", "audience_yn": "Yes", "audience_explanation": "Machine unlearning recently received a lot of attention, and the general positioning of this work for medical imaging in itself is interesting.\nGiven that my doubts for regarding the support for the claims of this paper would be addressed, I am sure there will be an audience that is interested in the findings of this work.", "requested_changes": "1. **Address concerns regarding the unlearning objective and evaluation:** As this is my most significant concern, the authors would need to address the conceptual mismatch between their definition of unlearning (forcing misclassification) and the standard definition in the literature (approximating a retrained model's accuracy). I see two possible paths forward:\n    \n    Either, re-evaluate the method using standard unlearning metrics. This would involve comparing the unlearned model's performance on the forget set to that of a model retrained from scratch, rather than aiming for zero accuracy. This would likely require re-running experiments and re-framing the results.\n    \n    **Or,** add a sufficient justification. If the authors maintain their definition, they must add a substantial discussion that explicitly acknowledges the departure from the standard paradigm. This section must rigorously justify why forcing misclassification is a more desirable or appropriate goal for their target applications and discuss the potential drawbacks of this approach.\n    \n2. **Revise Claims on \"Reliable Control\" and Tunability:** The claims of \"reliable behavioral control\" are currently not supported by the evidence of high hyperparameter sensitivity.\n    \n    I would advise to provide further nuance to these claims. The authors should discuss the challenges of tuning the method and provide heuristics or guidance for practitioners on how to select hyperparameters for a desired outcome. Best supported by respective experiments. \n    \n3. **Strengthen or Remove the \"Compositionality\" Section (4.4):** As it stands, to me, the claims of this sections are not convincingly demonstrated.\n    \n    To keep this as a contribution, the section requires expansion. This includes a clearer motivation, a more in-depth conceptual explanation to the composition mechanism, and a thorough empirical evaluation that includes baselines, such as comparing the composed model to a single, non-composed, model fine-tuned on the retain set. Otherwise, I would recommend removing this section to strengthen the paper's focus.\n\n4. **Additional motivation for device forgetting:** The experiment on forgetting acquisition devices needs a baseline which demonstrates that not forgetting the data from the old device harms the model's performance. This would clearly establish the motivation for this task. Alternatively, further motivation to why the “outdate” data should be forgotten non-the-less should be provided.\n\n5. Slightly enhance clarity as pointed out in the minor weaknesses above (Summary Of Contributions).", "broader_impact_concerns": "How I understand the text, forgetting is equated with “successful” misclassification of the forget set samples.  \nThe authors do not discuss the potential negative consequences for the patients, that is: If a patient invokes their right to be forgotten under this proposed method, does the resulting model now carry a detrimental bias targeted at that person? Does the model actively misdiagnose this person in the future? This possibility of inducing targeted failures in a high-stakes domain like medical imaging constitutes a serious ethical risk.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)