Deep Unlearning: Fast and Efficient Gradient-free Class Forgetting
Authors: Sangamesh Kodge
Gobinda Saha
Kaushik Roy
Venue: Accepted by TMLR ()

Abstract: Machine unlearning is a prominent and challenging field, driven by regulatory demands for user data deletion and heightened privacy awareness. Existing approaches involve retraining model or multiple finetuning steps for each deletion request, often constrained by computational limits and restricted data access. In this work, we introduce a novel class unlearning algorithm designed to strategically eliminate specific classes from the learned model. Our algorithm first estimates the Retain and the Forget Spaces using Singular Value Decomposition on the layerwise activations for a small subset of samples from the retain and unlearn classes, respectively. We then compute the shared information between these spaces and remove it from the forget space to isolate class-discriminatory feature space. Finally, we obtain the unlearned model by updating the weights to suppress the class discriminatory features from the activation spaces. We demonstrate our algorithm's efficacy on ImageNet using a Vision Transformer with only ~1.5% drop in retain accuracy compared to the original model while maintaining under 1% accuracy on the unlearned class samples. Furthermore, our algorithm exhibits competitive unlearning performance and resilience against Membership Inference Attacks (MIA). Compared to baselines, it achieves an average accuracy improvement of 1.38% on the ImageNet dataset while requiring up to 10x fewer samples for unlearning. Additionally, under stronger MIA attacks on the CIFAR-100 dataset using a ResNet18 architecture, our approach outperforms the best baseline by 1.8%.

Published in Transactions on Machine Learning Research (07/2024)
Deep Unlearning: Fast and Efficient Gradient-Free Class Forgetting
Sangamesh Kodge
skodge @xprdue.. edu
Elmore Family School of Electrical and Compute Engineering,
Purdue Universily
Gobinda Saha
gsaha @ppurduc. edu
Elmore Pamill School of Electrical and Compute Engineering, Purdue University
Kaushik Roy Elmore Family School of Electrical and Compute Engineering, Purdue University
kaushik-Ppurden edu
Reviewed on OpenReview: /ttps::/openee www.//vee.....eee.ooeee net/ forum? BmI5p6uB40
Abstract
Machine unlearning is prominent and challenging field, driven by regulatory demands for user data deletion and heightened privacy awareness. Existing approaches involve Iraining model or multiple fineluning sleps for each deletion request, often constrained by computational limits and restricted data access. In this work, we introduce novel class unlcarning algorithm designed to stratogically climinate specific classes from the Icarned model. Our algorithm first estimates the Retain and the Forget Spaces using Singular Value Decomposition on the layerwise activations for small subset of samples from the retain and unlearn classes, respectively. We then compute the shared information between these spaces and remove it from the forget space to isolate daas-discriminatory feature space. Finally, we obtain the unlearned model by updating the weights to suppress the class dis- criminatory features from the activation spaces. We demonstrate our algorithm's efficacy on ImageNet using a Vision Transformer with only ~ 1.5% drop in retain accuracy com- pared to the original model while maintaining under 1% accuracy on the unlearned class samples. Furthermore, our algorithm exhibits competitive unlearning performance and ro- silience against Membership Inference Attacks (MIA). Compared to baselines, it achieves an average accuracy improvement. of 1.38% the ImageNet dataset while requiring up to 10x fewer samples for unlearning, Additionally, under stronger MIA attacks on the CIFAR-100 dataset using ResNet18 architecture, our approach outperforms the bost bascline by 1.8%. Our code available on github
1 Introduction
Machine learning has automated numerous applications in various domains, inchuding image processing, language processing, and many others, often surpassing human performance. Nevertheless, the inherent strength of these algorithms, which lies in their extensive reliance on training data, paradoxically presents potential limitations. The literature has shed light on how these models behave highly efficient data compressors (Tishyy& & Zaslavsky 2015; Schelter 2020 often cxhibiting tendencies toward the memorization of full or partial training samples (Arpi 2017 Bai el al. 2021). Such characteristics of these algorithms raise significant concerns about the privacy and safety of the general population. This is particularly concerning
'Qur code available attps://github com/ baangaann-kkoggd//laa_ffrogg

---

Published in Transactions on Machine Learning Research (07 (204))
3.0
3.0
3.0
0.0
0.0
0.0
3.0
3.0
3.0
3
-3.0
0.0 (a) Original
3.0
-3..0
0.0 (b) Unlearn Red
3.0
-3.0
0.0
3.0
(c) Retrain without Red
Figure 1: Illustration of the unlearning algorithm a simple 4 class classification problem. Figure shows the decision boundary for (a) original model, (b) our unlearned model rodistributing the space to nearby classes and (c) retrained model without red class.
given that the vast training data, typically collected through various means like web scraping, crowdsourcing, and more, is not immune to personal and sensitive information. The growing awareness of these privacy concerns and the increasing need for safe deployment of these models have ignited discussions within the community and, ultimately, led to some regulations on data privacy, such as Voigt & Von dem Bussche (2017); Goldman (2020). These regulations allow the use of the data with the mandate to delete personal information about a user if they choose to opt out from sharing their data. The mere deletion of data from archives is not sufficient due to the memorization bohavior of these models. This necessitates machinc unlcarning algorithms that can remove the influence of requested data or unlearn those samples from the model. A naive approach, involving the retraining of models from scratch, guarantees the absence of information from sensitive samples but is often impractical, especially when dealing with compute-intensive state-of-thes (SoTA) models like Visooosovitskiy et al. 2020 Further, efficient unlearning poses considerable challenges, as the model parameters do not exhibit a straightforward connection to the training data (Shwartz-Ziv & Tishby 2017). In many practical scenarios, full dataset access is often restricted since companies typically only utilize the trained model in their applications. Additionally, data access is usually chargeable for each instance, making repeated access for unlearning purposes prohibitively expensive. Public datasets may also become unavailable for reuse in the future, and maintaining a copy of all training data is often costly and impractical. Furthermore, in the context of removing confusing et al. (224);; Schoepf et al. (2024). where the goal is to improve model generalization when the training dataset may contain misleading samples, obtaining the entire confusing/ snafusiing/manipui manipulated dataset is challenging and often compute-intensive. This limited access to data introduces additional challenges for the unlcarning process. Consequently, several unlearning works explore sample-esficent approaches Golatkar et al. (020a
manipulated data from the model Goel
Nguyen et al. 2020 Chundawat et al. (2023): Jeon et al. (2024).
Our work focuses challenging scenarios of class unlcarning and multi-class unlearning (task unlearning) Golatkar et al. 2020a 2021). For class unlearning setup, the primary goal of the unlearning algorithm is to eliminate information associated with a target class from a pretrained model. This target class is referred to as the forget class, while the other classes are called the retain classes. The unlearning algorithm should produce parameters that are functionally indistinguishable from those of a model retrained without the target class. The key challenges such unlearning are three folds (i) pinpointing class-specific information within the model parameters, (ii) updating the weights in a way that effectively removes target class information without compromising the model's usability on other classes and (iii) demonstrating scalability on large scale dataset with well trained models. In this work, we ask the question "Can unleorn class (or multiple classes) from a well-trained model given access to few samples from the training data on a large dataset?'. Having few samples is particularly important if the unlearning algorithms have to efficiently scale to large datasets having many classes to ensure fast, and resource-efffcient unlearning.
We draw insights from work by Saha et al. 20221) in the domain of continual learning, where the authors use the Singular Value Decomposition (SVD) technique estimate the gradient space essential for the previous task and restrict future updates in this space to maintain good performance on previous tasks. This work
2

---

Published in Transactions on Machine Learning Research (07/2024)
demonstrates few samples (about 125 samples per task) are sufficient to obtain good representation of the gradient space. Our work proposes to strategically eliminate the class discriminatory information by up- dating the model weights to maximally suppress the activations of the samples belonging to unlearn (forget) class. We start by estimating the Retain and the Forget Spaces using Singular Value Decomposition on the layerwise activations for the samples from the retain and unlearn classes, respectively. These spaces represent the feature or activation basis vectors for samples from the retain and forget classes. We compute the shared information between these spaces and remove it from the forget space to isolate class-discriminatory feature space. Finally, we obtain the unlearned model by updating the weights to suppress the class discriminatory features from the activation spaces. In a class-unlearinng scenario, our algorithm competes with or outper- forms several algorithms studied in this work, despite having access to very few samples from the training dataset (less than 4% for all our experiments). As our algorithm relies on very few samples from the training dataset it efficiently scales to large datasets like ImageNet (Deng et al. 2009), where we demonstrate the results using only 1500 samples (0.0012% of the training datasct).
Contrary to our method, traditional unlearning methods (Tarun et al. 2023 Kurmanji et al. 2023) rely heavily gradients, leading to limitations in computational cost and samples required, especially for large models and datascts. Our work addresses these limitations by introducing a novel and demonstrably supe- rior solution for class-wise unlearning, outperforming state-of th-tr-r baselines. Our approach is radically different most of the current approaches in the following ways:
1. Gradient-Free: We eliminate the computational burden and potential instability of gradient based unlearning.
2. Single-Step Weight Update:
Our method achieves unlearning in single update, similar to Foster let al. 2024), and surpasses the iterative nature of many baselines.
3. Novel Weight Update: Our SVD-driven activation suppression mechanism stands out from traditional update strategies.
4. Efficiency Benefits: Our proposed algorithm is sample efficient while having low runtimes on large
datasets like ImageNet.
We demonstrate our algorithm on simple 4-way classification problem with input containing 2 features as shown in Figure [ The decision boundary learned by the trained model is shown in Figure [(a) while the model unlearning the red class with our method exhibits the decision boundary depicted in Figure I(b) The decision boundary for retrained model is shown if Figure [[c]] This illustration shows that the proposed algorithm redistributes the input space of the unlearned class to the closest classes. See Appendix A. for experimental details.
In summary, the contributions of this work are as follows:
We propose novel Singular Value Decomposition based class unlearning algorithm which (a) is Gradient- Free, (b) uses single step weight update, (c) has novel weight update mechanism, (d) is compute and sample efficient and (c) improves the unlearning efficacy as compared to SoTA algorithms. To the best of our knowledge, our work is the first to demonstrate class unlearning results on ImageNet for SoTA transformer based models.
Our algorithm exhibits competitive unlearning performance and resilience against Membership Inference Attacks (MIA). Compared to basclines, it achieves an average accuracy improvement of 1.38% on the ImageNet dataset while requiring up to 10x fewer samples for unlearning and maintaining competitive runtimes. Additionally, under stronger MIA attacks the CIFAR-100 dataset using a 1esNet18 ar- chitecture, our approach outperforms the best bascline by 1.8%. Further, we provide evidence that our model's behavior aligns with that of a model retrained without the forget class samples through mem- bership inference attacks, saliency-based feature analyses, and confusion matrix analyses. Additionally, we extend our approach to multi-class unlearning or task unlearning to demonstrate the capability of processing multiple unlearning requests.
3

---

Published in Transactions on Machine Learning Research (07/2024)
2
Related Works
Many unlearning algorithms have been introduced in the literature, addressing various un- learning scenarios, including item unlearning (Bourtoule ct al., 2021], feature unlearning (Warnocke et all 2021], class unlearning (Tarun et al., 2023), and task unlearning (Parisi et al., 2019). Some of these solutions make simplifying assumptions on the learning algorithm. For instance, Ginart et al. (2019) demonstrate un- learning within the context of k-mean clustering, Brophy & Lowd (0021) present their algorithm for random forests, Mahadevan & Mathioudakis (2021) and Izzo et al.
Unlearning:
[001]] propose an algorithm in the context of lin- ear/logistic regression. Further, there have been efforts in literature, to scale these algorithms for convolution layers Golatkar et al. (2020a b). Note, however, the algorithms have been only demonstrated on small scale problems. In contrast, other works, such as [oourtoule et al.] (2021), suggest altering the training process to enable efficient unlearning, This approach requires saving multiple snapshots of the model from different stages of training and involves retraining the model for subset of the training data, effectively trading off compute and memory for good accuracy on retain samples. Unlike these works our proposed algorithm does not make any assumptions on the training process or the algorithm used for training the original model. Recent work on Exact Unlearning (EU-k) and Catastrophic Forgetting (CF-k) proposed in Goel et al. (002)) presents fine-tuning methods that update the last k layers of the network. EU-k re-initializes the last k layers and trains on the retain set, while CF-k directly fine-tunes the last k layers, leveraging learning dynamics for unlearning. Further, a few-shot unlearning approach proposed by Yoon et al. (2022) trains a generative model to create proxy data for the retain-set and forget-set. This algorithm unlearns by fine-tuning on the concatenated retain-set and relabeled forget-set. These algorithms are evaluated on small datasets and have high compute requirements, possibly restricting their use for large datasets. Selectively Synaptic Dampening (SSD) (Foster et al., 2024) introduces method to unlearn using the Fisher information. Like our method, this approach enables unlearning in single updale step; however, it is shown to require a large dalaset size Goel et al. (0024).
The current state-of-the-art (SoTA) for class unlearning is claimed by Tarun et al. (2023). In their work, the authors propose a three stage unlearning process, where the first stage learns a noise pattern that maximizes the loss for each of the classes to be unlearned. The Second stage (the impair stage) unlearns the class by mapping the noise to the forget class. Finally, as the impair stage is seen to reduce the accuracy the retained classes, the authors propose to finetune the impaired model on the subset of training data in the third stage (the repair stage). This work presents the results on small datasets with undertrained models and utilizes up to 20% of the training data for the unlearning process. Further, the work by [Chundawat et al.] (2023) proposes two algorithms which assumes no access to the training samples. Additionally, authors of [Baumhauer et al. (2022) propose a linear filtration operator to shift the classification of samples from unlcarn class to other classes. These works losc considcrable accuracy on the retain class samples and have been demonstrated on small scale datasets like MNIST and CIFAR10. Our work demonstrates results SoTA vision transformer models for the ImageNet dataset, showing the effective scaling of our algorithm on large dataset with the model trained to convergence.
Class Unlearning:
Other Related Algorithms: : SVD is used to constrain the learning in the direction of previously learned tasks in the continual learning setup [aaha et al. (2021;; Chen et al. (2022); Saha & Roy (2023). These mothods are sample efficient in estimating the gradient space relevant to a task. Recent work by Li et al.. (2023) proposes subspace based federated unlearning using SVD. The authors perform gradient ascent in the orthogonal space of input gradient spaces formed by other clients to eliminate the target client's 's contribution in federated learning setup. Such ascent based unlearning is generally sensitive to hyperparameters and is susceptible to catastrophic forgetting on retain samples. As our proposed approach does not rely on such gradient based training steps it is less sensitive to the hyperparameters. Moreover, such techniques could be used on top of our mothod to further enhance the unlearning performance.
3 Preliminaries
Unlcarning: Let the training datasct be denoted by Deroin [(,, y:) Mygii consisting of Nerain training samples where z; represents the network input and y is the corresponding label. The test dataset be Diest = ((r,, ye) Nar containing Ntest samples. Consider a function y = f(x,, with the parameters 0 that
4

---

Published in Transactions on Machine Learning Research (07/2024)
approximates the mapping of the imputs 2; to their respective labels ya- A well-trained deep learning model with parameters 0, would have numerous samples (2i, Ui) E 'Deest for which the relationship yi = -(xi, 0) holds. For a class unlearning task aimed at removing the target class t, the training dataset can be split into two partitions, namely the retain datasct Dtrain = { M4. 1. and the forget datasct Dtrasn {Ti f:) Similarly, the test dataset can be split into these partitions as Drest_r {(11, 34) and / {2 9:) ( The objective of the class unlearning algorithm to derive unlearned parameters 07 based on 0, a subset of the retain partition Perain_sub_i C Derain_r, and a subset of the forget partition Dtrain sub Dirain f. The parameters 04 must be functionally indistinguishable from network with parameters 0*, which is retrained from scratch on the samples of Dirain_ in the output space. Empirically, these parameters must satisfy f21,,0) ~
f fIz, 07) for (IA, B4) E Drest-
SVD: A rectangular matrix A E Rdx= can be decomposed using SVD A UEVT where U E Rdxd and V E Ruxn are orthogonal matrices and > _dx= is diagonal matrix containing singular values Deisenroth ct al. 2020b. The columns of matrix U are the d dimensional orthogonal vectors sorted by the amount of variance they explain for n samples (or the colurns) in the matrix A. These vectors are also called the basis vectors explaining the column space of A. For the 7th vector in U, Us the amount of the variance explained is proportional to the square of the 7th singular value oī. Hence the percentage variance explained by a basis vector 2s is given by of (0)())
4 Unlearning Algorithm
Algorithm presents the pseudocode of our approach. Consider t linear layer of network given by < = (0)), where of signifies the parameters, at stands for input activations and dh denotes oulput activation. Our algorithm aims to suppress the dlas-iiicriminnaory activations associated with forget class, When provided with a clas--disriminatory projection matrix Plis, suppressing this class-disciminnaoryy activation from the input activations gives us a/ - P/.. Post multiplying the parameters with (1 - Pa:s) )² ---Pl
is mathematically the same as removing disrimiicryy information from af as shown in Equation I This enables us to modify the model parameters to destroy the class diarimiicriminatory activations given the matrix Pds and is accomplished by the pooaate_prammete( () function in line 16 of pscudocode presented
in Algorithm 1 The next. Subsection focuses optimally computing this class-discrmninatory projection matrix, Plas
(o) of
(0))
= =11(1- (O - y
(1)
Activation Suppression
updated parameter
4.1 Class Discriminatory Space
We need to estimate the activation space for retain class samples and the forget class samples before comput- ing Pais- These spaces, also referred to as the Retain Space (U)) and the Forget Space (U)), are computed using SVD on the accunulated representations for the corresponding samples as elaborated in Section 4.1.1 Subsequently, we scale the basis vectors within their respective spaces using importance scores proportional to the variance explained by each vector. This yields the scaled retain projection space Pf and the scaled forget projection space Pj. Finally, we compute the shared information between these spaces and remove it from the scaled forget space to isolate clas--discimnnnatry feature space as explained in Subsection 4.1.2
4.1.1 Space Estimation via SVD on Representations
We give an in-depth explanation for obtaining the Retain Space, Uy. We use a small subset of samples from the classes to be retained, denoted X, k,k, where K, represents the number of retain samples. Forget Space
This Subsection provides the dotails on Space Estimation given by lines 3-7 of Algorithm 1
(Uy) is estimated similarly on the samples from the class to be unlearned, denoted by X5 = (x)) where Ky represents the number of samples.
Representation Matrix: To obtain the basis vectors for the Retain Space through SVD, we collect the representative information (activations) for each layer in the network and organize them into representation
5

---

Published in Transactions on Machine Learning Research (07/2024)
Algorithm Proposed Unlearning Algorithm
Input: is the parameters of the original model; X, and Xy is small set of inputs I; sampled indepen-
dently from Drrain r and Derain f respectively; Dtrain sub Dirain ri Dtrain sub f Dirain fi and alpha list and alpha I list are list of lyperparaneterrs ar and of respectively.
procedure Unlearn( 0, Xr, Xy, Dtrain sub ssb
Dtrain sub f, alpha list, alpha f list
1. best score get scorc(0 Derain_sub_rr Derain s
2. 87 =
3. R, = get representation (model, X,)
4. R get__eee_reeree rwpresentation (model, Xy)
5. for each linear and convolution layer do
6. U E SVD(R))
7. Uy, E SVD(R))
8. for each ar E alpha r list do for each a E alpha_f f_ii____tt___________ list do for each linear and convolution layer / do
9.
10.
11.
A scale_ laall___moottacceec Ex, a,)
12.
A scale importance b1y, Ot))
13.
P U. transposo U
14.
P U transpose(U))
15.
P = (T P
die Of updatee patappetaaaaaaaaee Pl. diss 0¹)
16.
17.
score get_ cot__scrr(({, Dtrain sub Derain sub
18.
if score > best score do
19.
best score = score;
07 = 8
return 07
matrix denoted as R, We accumulate these representation matrices, Rf for both linear and convolutional layers in list R₂ = [ where L is the number of layers. For the lincar layer, this matrix is given by R² = [())) which stacks the input activations of to obtain matrix of size K, x d', where d' is the imput dimension of 4th linear layer.
A convolutional layer has to be represented as matrix multiplication to apply the proposed weight update rule. This is done using the unfold operation (Liu et al.) 2018) on input activation maps. Consider a convolutional layer with C, input channels and k as kernel size with the output activation, a having the resolution of ho x wo: where he and w, is the height and width of the output activations. There are how, patches of size C the values at the corresponding locations in the output map. The unfold operation flattens cach of these h,w, patches to get matrix of size h,w, x C,kk. Now, if we reshape the weight as C,kk x C, where C. is the output channels, we see that the convolution operation becomes a matrix multiplication between the unfolded matrix and the reshaped weights achicving the intended objective. This is graphically presented in Figure of Saha et al. (2021). Hence, the representation matrix for the convolutional layer is given by R/ [uuffld ( [ The representation matrix obtained by get get_rrepresentation function lines 3-4 of the Algoithm
k in the input activation sf on which the convolution kernel operates to obtain
Space Estimation: We perform SVD the representation matrices for each layer shown in lines 6-7 of the Am 1 SVD() function returns the basis vectors U. that span the activation of the retain samples in X, and the singular values Σ for each layer (. Retain Space U, = [U is the list of these basis vectors for all the layers.
4.1.2 Projection Space
The basis vectors in the Spaces obtained are orthonormal and do not capture any information about the importance of the basis vector. The information of the significance of the basis vector is given by the

---

Published in Transactions on Machine Learning Research (07/2024)
corresponding singular value. Hence, we propose to scale the basis vector in proportion to the amount of variance they explain in the input space as presented below.
To capture the importance the 7th basis vector in the matrix U (or the ith column of U), we formulate an diagonal importance matrix having the tth diagonal component X given by Equation 2 where d is the number of basis vectors.. Here d, represents the the ith singular value in the matrix Σ. The parameter a E (0, oo) called the scaling coefficient is a hyperparameter that controls the scaling of the basis vectors. When is set to 1 the basis vectors are scaled by the amount of variance they explain. As increases the importance score for each basis vector increases and reaches 1 as a 20. Similarly, decrease in decreases the importance of the basis vector and goes to O as a - O. This operation is represented by scaled_ (itledddnmtottace( function in lines 11-12 of the Algorithm ] It is important to note that without the proposed scaling approach the matrices P. and Ps become identity matrices in lines 13-14 of Algorithm [ as U is an orthonormal matrix. This in turn makes Pass a zero matrix, which means the weight update line 16 of Algorithm | projocts weight on the identity matrix mathematically restricting unlearning. Hence it is important to use scaling in lines 11-12 of Algorithm 1
Importance Scaling:
00? A;- (a- - 10o +
(2)
Сラ j=1 03
Scaled Projection Matrix (P): Given the scaling coefficient 0, and æ,, we compute the importance scaling matrix A, and A, as per Equation 2 The scaled retain projection matrix, which projects the input activations to the retain space is given by (U;) and the scaled forget projection matrix given by
pf- = -UAA(U))) see line 13-14 in Algorithm
Class- Class-Disriminnatory Projection Matrix (Pais): We obtain the class discriminatory projection matrix, Pais, by removing the shared space given by PjPP from the forget projection matrix. Mathematically, this can also be written as Plis- = P that does not contain any information about the retain space, effectively removing the shared information from the forget projection matrix to obtain Pais. Our algorithm introduces two hyperparameters namely a, and of the scaling coefficients for the Retain Space and the Forget Space respectively. Subsection 4.2 presents a discussion on tuning these hyperparameters.
Intuitively, this projects the forget space onto the space
4.2 Hyperparameter Search
Grid Search: As seen in lines 8-9 of the Algorithm [ we do grid search over all the possible values of az and as provided in alpha_r_ pitr___litt list and alpha f list to obtain the best unlearned parameters 07. We observe this search is necessary for our algorithm. One intuitive explanation for this is that the unlearning class may exhibit varying degrees of confusion with the retain classes, making it easier to unlearn some classes compared to others, hence requiring different scaling for the retain and forget spaces. Note, we observe that increasing the value of ay decreases the retain accuracy acc, and hence we terminate the inner loop (line 9) to speed up the grid search and have not presented this in the Algorithm D for simplicity. We introduce a simple scoring function given below to rank the unlearned models with different pairs of ar and af.
score acc, (1 accy/100))
(3)
Score: The proposed scoring function given by Equation 3 returns penalized retain accuracy, where acc, and accj are the accuracy on the Dtrain_suth and Ptrain_eub. respectively. This function returns a low score for an unlearned model having a high value of accy or an unlearned model having low acc,, The value of the returned score is high only when ace, is high and acey low, which is the desired behavior of the unlearned model.
4.3 Discussion
Compute and Sample Efficiency: The speed and efficiency of our approach can be attributod to the design choices. Firstly our method runs inference for very few samples to get the representations R. This in turn results in small size of the representation matrices ensuring the SVD is fast and computationally cheap.
7

---

Published in Transactions on Machine Learning Research (07/2024)
Additionally, the SVD operation for each layer is independent and can be parallelized to further improve speeds. Secondly, our approach only performs inference and does not rely on computationally intensive gradient based optimization steps (which also require tuning the learning rates) and gets the unlearned model in a single step for each grid search (over a and ay) leading to a fast and efficient approach. Additionally, our approach has fewer hyperparameters to tune compared to gradient-ascent based baselines, which are sensitive to choices of optimizer, learning rate, batch size, learning rate schoduler, weight decay, etc.
Scaling to Transformer Architecture: We can readily extend proposed approach to transformer ar- chitectures by applying our algorithm to all the linear layers in the architecture. Note, that we do not change the normalization layers for any architecture as the fraction of total paramcters for these layers is insiguificant (see Table in Appendix A.2
Our algorithm assumes a significant difference in the distribution of forget and retain samples for SVD to find distinguishable spaces from a few random samples. This is truc in class unlcarning setup, where retain and forget samples come from different non-overlapping classes. However, in the case of un- learning a random subset of training data (Kurmanji et al. 2023). would require additional modification for effective unlearning. Further, machine unlearning is evolving field, and current evaluation techniques can be misled by naive baselines, such as setting the bias term to large negative number or hard-coding the network to output nothing (or a random class) if the prediction is the forget. class. These trivial baselines might satisfy certain metrics (e.g,, accuracy-basee based metrics) but fail others (e.g., specific types of attacks), as information about the forget set classes can still persist in the trained weights. This suggests that existing evaluations for unlearning may be insufficient to guarantee privacy We hope futurr works will address these shortcomings in evaluating the privacy provided by unlearning algorithms.
Limitations:
5 Experiments
We conduct the class unlearning ex- periments on CIFAR1O, CIFAR100 (Krizhevsky et al.) 2009) and ImageNet (Deng el al.
Dataset and Models
2009) datasets. We use the mod- ified versions of ResNet18 He et al.) 2016) and VGG11 (Si- monyan & Zisserman 2014 with batch normalization for the CIFAR1O and CIFAR100 datasets. The training details for
Nonmember
Test Dataset
(Casss 0)
Original Model
Retain
Forget
these models are provided in Appendix [A.3] For the ImageNet. dataset, we use the pretrained VGG11 and base version of Vi- sion Transformer with patch size of 14 (Dosovitskiy el al.
Unlearnt model should
predict NonMember
SVM
Inference
Training
Original Model
Classifier
Unlearnt Model
2020) available in the torchvision library.
We benchmark our method against 5 unlearn- ing approaches. Three of these approaches Retraining, Neg- Grad and NegGrad+ are common baselines used in literature such (Tarun et al., 2023 Kurmanji et al.) 2023 Retrain- ing involves training the model from scratch using the retain partition of the training set, Dirain r: and serves as our gold- standard model. A detailed explanation of NegGrad and Neg- Grad+ with psuedocodes is presented in Appendix A and A.5 respectively. Further, we compare our work with recent. algorithms (Tarun al., 2023) Kurmanji et al., 2023 Foster et al.) 2024 demonstrate the effectiveness of our approach.
Comparisons:
Unleam
Member
Class 1 1)
Retain
Forget
Train Dataset
Figure 2: Membership Inference Attack.
Discussion on hyperparameters is presented
in Appendix A.6
Evaluation: In our experiments we evaluate the model with the accuracy on retain samples ACC, and the accuracy on the forget samples ACC,- In addition, we implement Membership Inference Attack (MTA) to distinguish between samples in Dtrain_rr (Member class) and (NoomennNommmbbll class) as shown in Figure 2 A strong MIA attack is proposed by Hayes et al.) (2024). however, this attack requires substantial compu- tational resources and are not practical for evaluating large datasets on large models hence we evalutated the unlearning on simple MIA. We use the confidence scores for the target class and train Support Vector
8

---

Published in Transactions on Machine Learning Research (07/2024)
Table Single class Forgetting on CIFAR dataset, We bold font the method with highest value for ACC, x (100-
ACC₁) x MTA.
VGG11 BN ACC₁(L)
ResNeet18 ACC,(L)
Method
ACC,(t)
MIA(1)
ACC,(1)
MIA(1)
Original
91.58 +: 0.52
91.58 4.72
0.11 + 0.08
94.89 0.33
94.89 1 2.75
0.03 + 0.03 100+
CIFAR10
Retraining
92.58 + 0.83
100
94.81 + 0.52
NegGrad
81.46 5.67
0.02 + 0.04
69.89 10.23
NegGrad+
89.79 + 1.49
0.13 + 0.16 0
99.93 0.15
89.91 + 1.41
0.94 + 1.87
98. 08.68 1.42
Tarun et al.
2023
89.21 = 0.84
92.20 - 0.72
0.72
10.89 = 8.79
61.5 = 25.86
Kurmanj al
2023
92.09 1 0.89
0
0
94.79 1 0.63
0
Foster et al.
2024
63.23 31.87
18.28 + 35.90
29.21 = 47.08
83.76 25.76
4.37 = 12.795
$7.86 + 31.21
Ours
91.77 0.69
0
98.28
5.43
94.19 0.50
0.03 1 0.09
95.5 14.23
Original
69.22 1 0.29
15.23
1 0.25
76.64 0.13
74.3 13.27
0,08 0.1
CIFAR100
Retraining
68.97 + 0.40
0
100
76.81 0.50
0 0
100
NegGrad
51.21 + 6.37
0
60.32 + 7.03
29.98 48.27
NegGrad+
58 = 3.91
0
71.37 2.78
0
100 100:00 0
Tarun et al.
2023
53.94 + 1.22
0
0
63.39 +: 0.50
3.1 5.65
Kurmanp ef al. 2023
69.09 = 0.30
0
76.40 0.19
0
Toster
2024
47.433 26.197
0
20
42.16
76.52 0.23
1.6 5.06
100 1
65.94 1.21
0.3 + 0.48
99.92
0.10
73.60 1.41
0.3 0.3 0.48
100 0
Table 2: Single class forgetting ImageNet-lk dataset.
Retain
VGG11 BN ACC₁(L)
VIT B_
16 ACC,())
Method
samples
ACC,(1)
MIA(()
ACC,(1)
MLA(())
Original
68.61 0.02
72.6 + 25.92
22.72 + 22.59
80.01 + 0.037
19.87 0
13.36 12.94
NegGrad++
66.37 1.27
11.48
96.58 4.40
73.76 1.46
99.98 0.05
Tarun
2023
9990
43.5618 0.59 0.59
98.96 3.26
56.00 3.47
38.8
66.67 =
Kurmanyi
SL.
2023
9990
67.29 0.34
99.92 0.15
78.675
2.0
Foster ct al.
2024
9990
64.39 1 6.14
60 1 51.64 0
79.93 1 0.08
0.2 0.63 0.63
99.8 0.01
Foster ct a
2024
990
29.687 19.57
9.6 21.41
55.03 +: 26.55
20.2 30.03
20 1: 42.16
Ours
999
66 06.41:2 + 0.60
0.6 = 1.35
99.33 1 0.90
78.47 1 0.84
0.2
99.98 +: 0.05
Machine (SVM) Hearst et al. 1998) classifier. In our experiments, MIA scores represent the average model prediction accuracy for Dirain_ classified as Nommember. A high value of MIA score for a given model indicates the failure of MIA model to detect Dtrasn as part of training data. An unlearned model is expected match the MTA score of the Retrained model. See Appendix A.7 for more details on MTA setup.
6 Results and Analyses
Class Forgetting: We present the results for single class forgetting in Table [ for the CIFAR10 and CIFAR100 dataset. The table presents results that include both the mean and standard deviation across 10 different target unlearning classes. CIFARIO dataset is accessed for unlearning each class and CIFARI00 is evaluated for every 10th starting from the first class. The Retraining approach matches the accuracy of the original model on retain samples and has 0% accuracy on the forget samples, which is the expected upper bound. The MIA accuracy for this model 100% which signifies that MIA model is certain that Derain does not belong to the training data. The NegGrad method shows good forgetting with low ACC,, however, performs poorly on ACC, and MIA metrics. The NegGrad algorithm's performance on retain samples is expected to be poor because it lacks information about the retain samples required to protect the relevant features. Further, this explains why NegGrad+ which performs gradient descent the retain samples along with NegGrad can maintain impressive performance on retain accuracy with competitive forget accuracy. In some of our experiments, we observe that the NegGrad+ approach outperforms the SoTA benchmarks Foster et al.) 2024 Tarun et al. 2023) and (Kurmanji et al. 2023) which suggests the NegGrad+ approach is a strong baseline for class unlcarning. For CIFAR datasots, our proposed training free algorithm achieves better tradeoff between the evaluation metrics when compared against all the basclines, with an exception of 18 CIFAR100 where Foster al. (2024) performs better. Further, observe the MIA numbers

---

Published in Transactions on Machine Learning Research (07/2024)
for our method close to the retrained model and better than all the baselines for most of our experiments. We demonstrate our algorithm easily scales to ImageNet without compromising its effectiveness, as seen in Table 2 Due to the training complexity of the experiments, we were not able to obtain retrained models for ImageNet. We observe that the results on CIFAR10 and CIFAR100 datascts consistently show ACC₁ to be and the MIA performance to be 100%. We, therefore, interpret the model with high ACC,, MIA, and low ACC₃ as a better unlearned model for these experiments. We conduct unlearning experiments on the ImageNett dataset for every 100 class starting from the first class. Our algorithm shows less than 1.5% drop in ACC, compared to the original model while maintaining less than 1% forget accuracy for a well trained SoTA Transformed based model. We present the results on varients of ViT model in Appendix [A.8 The MIA scores for our model are nearly 100% indicating that model the MIA model fails to recogmize Drrain / part of training data. We observe that (Kurmanji et al., 2023) outperforms our method for a VGG11 model trained on ImageNet, however, requires access to 10x more retain samples and computationally expensive than our approach. We observe Foster et al. (2024) with 9990 retain samples outperforms our method, however, reducing the number of retain samples to be comparable to our method lead to a sever decrease in the performance. Further, also explore 2 alternative variants of our algorithm in Appendix A.9 Due to their inferior performance in terms of ACC, and ACC₁, decided not to further evaluate them in this work.
Strong MIA evaluation: We evaluate our method under stronger MIA as recomended by Hayes et al. (2024). We trained eight models on the entire CIFAR100 training dataset using ResNet18 with the same hyperparameters as the original training. These models act
110
94.5 94.8 96.3
U-LIRA Accura
100
90
the shadow models for unlearning. We obtained the shadow unlcarnt model by applying the unlearning algorithms to these eight models. Next, we trained eight models without the target forget-class in the training dataset, referred to as the shadow retrained models. Follow- ing the recommendations by (Hayes et al., 2024), we applied various unlearning techniques to these eight models to unlearn the larget class. We then trained the MIA model to distinguish between for- get samples in the shadow unlcarnt model and the shadow retained model (without the forget-set). Specifically, we used seven of these models to learn the distributions (mean and standard deviations) and used the eighth model pair to determine the detection threshold. Finally, we tested the unlearnt models on ResNet18 for CIFAR100 dataset from Table of our paper using this U-LIRA MTA attack. We used the forget set from the original model as specified by (Hayes et al. 2024 and reported the accuracy of the MIA attack in identifying samples as belonging to the forget-set. We conducted this analysis for all the target classes used in Table | Ideally, this accuracy should be close to 50% indicating that the MIA attack fails to distinguish between the forget-set from the unlearnt and the retrained model (implying perfect class unlearning). The results in Figure 3 shows our algorithm outperforms the SoTA under a strong MIA.
74.5 76.3
80
70
60
50
Our
[Tarun]
[Kurmanji]
[Foster]
NegGrad +
Figure 3: U-LIRA Hayes et (2024) Membership Inference Attack for CI- FARI0 dataset on ResNet18 model.
100
100
0.16
Accuracy
80
Accuracy
80
Normalizze Weight
0.14
60
60
0.12
0.10
40
0.08
20
Retain
20
0.06
Forget
10"
10
10a
102
10.
0.00
1
5
6 Layer
7
8
9 1011
(a) Varying or (ay 3)
(b) Varying ay (a. 100)
Figure 5: Layer-wise weight change
Figure 4: Effect of varying (a) ar and (b) ay for Cat class of CIFAR10 dataset on VGGIl network.
for VGG11 CIFAR10 dataset.
10

---

Published in Transactions on Machine Learning Research (07/202) 2024)
Complete Unlearning
No Unlearning
100
80
Accuracy
60
Retain
40
Forget
20
(a) Original
(b) Unlearned
(c) Retrain
0
9 1011
Layer
Figure 7: GradCAM- heatmaps for (a) Original, (b) Retrained, and (c) Unlearned VGG11 model the CIFARIO with cat as the target class, demonstrating that the unlearned model does not highlight any features specific to the cat. we provide more saliency maps in Appendix A.11
Figure 6: Effect of applying un- learning to the later layers for VGG11 model on CIFAR10 dataset.
Effect of a: Figure 4 shows the impact of varying and ay for unlearning the cat class from CIFAR10 dataset using VGG11 network. In Figure ((a) we set ay 3 and vary Or in [0.3, 1, 3, 10, 30, 100, 300, 1000]. Similarly, in Figure 4(bb we keep a, = 100 and vary a in [0.3, 1, 3, 10, 30, 100, 300, 1000]. Note, here a, = =100 and a = 3 are the optimal hyperparameter for unlearning the cat class. We observe that ACC, increases with increase in ar and decreascs with increase in ay. Similarly, ACC, increases with increase in a, and decreases with increase in ay, however, the ACC, = for ar 100 and oj > 1. We observed similar trends for other classes. These trends can be understood by analysing the overall update equation of our algorithm (combining lines 11-16) ) given by Equation (sec Appendix A.10 for the explanation).
f= (T (T
Layer-wise analysis: We plot the layerwise weight difference between the parameters of the unlcarned and the original model for VGG11 on the CIFARIO dataset in Figure 5 We observe that the weight change is larger for the later layers. This suggests that the class discriminatory features are more prominent in the later layers of the network which consistent with the findings Olah et al. (2017). In Figure G we plot ACC, and ACC, when our algorithm applied to top few layers for CIFAR10 dataset on VGG11 model. The x-axis in the plot represents the number of initial layers we do not apply the unlearning algorithm. A value of n x-axis represents case where we do not change the initial layers 0 - ninchudding n) in unlearning and apply our unlearning algorithm to the rest of the layers. We observe that the effect of removing the projections is minimal on ACC,, The forget accuracy keeps increasing as we sequentially remove the projections starting from the initial layers. We observe that applying our algorithm to all the layers ensures low mean and standard deviation for ACC,,
Saliency-based analysis :
We test this VGG11 model unlearning the cat class with GradCAM- feature analysis as presented in Figure 7 and we see that model is unable to detect class discriminatory information which validates unlearning. This behavior is similar to the retrained VGG11 model shown in
Figure 7(c)
Confusion Matrix analysis: We plot the confusion matrix showing the distribution of true labels and predicted labels for the original VGG11 model and VGG11 model unlearning cat class with our algorithm for CIFARIO in Figure & Interestingly, we observe that a significant portion of the cat samples are redistributed across the animal categories. The majority of these samples are assigned to the dog class, which exhibited the highest level of confusion with the cat class in the original model. This aligns with the illustration
shown in Figure [ where the forget space gets redistributed to the classes in the proximity of the forget class. In the confusion matrix of the retrained model shown in Figure [(c) we similarly observe high number of cal samples being assigned to the dog class. Further, the confusion matrix for the our unlearned model revealed a reduction in correctly classified dog samples, the only class exhibiting this effect. This suggests that unlearning the cat class might have unintentionally removed features crucial for classifiying dogs, possibly due their high inter-class confusion. We evaluate this behaviour further by studying the models trained TmageNet.
11

---

Published in Transactions on Machine Learning Research (07/2024)
Table Effect of unlearning on the confusing classes for ImageNet dataset. See the results on Variant of VTT
Table 1
Original Accuracy
Top-5 Confusing Classes
Model
ACC,(1)
ACC,(L)
MTA(1)
Before Unlearning
After Unlearning
VGG11 BN
68.61
65.287
0
100
63.6
14.4
VIT B 16
80.01
78.92
0
100
80.8
54.4
Table 4: Effect of Incomplete Retain Set for unlearning the Cat class from VGGI1 BN model.
Missing Class
ACC,(1)
ACC₁(L)
Drop Missing
% Confusion
Class (airplanc)
93.88
0.0
-0.1
0.S
Class (automobile)
93.71
0.0
1.3
0.2
Class (bird)
93.72
0.0
+00.2
3.1
Class (deer)
93.74
0.0
-0.4
1.9
Class (dog)
92.36
0.0
-13.7
8.0
Class (frog)
93.77
0.0
-1.0
2.0
Class (horse)
93.82
0.0
-0.2
0.8
Class (ship)
93.79
0.0
-1.7
0.3
Class 10 (truck)
93.91
0.0
-0.6
0.6
Inter-Class dependency: study the Inter-Class dependency, we focused on the "Tibetan Terrier" class (class 200) within the ImageNet dataset, which contains 118 dog breeds (classes 151 "Chihuahua" 268 "Mexican Hairless"). Using the confusion matrix, identified the top classes most frequently confused with 'Tibetan Terrier.' We then tracked the accuracy of these classes before and after unlcarning 'Tibetan Terrier." Table 3 summarizes the results. In our experiment, we defined 'confusion' with a class the percentage of images from the "Tibetan Terrier' class that were misclassified as the target class, Notably, 'Shih Tzu" and "Lhasa Apso' cxhibited the highest confusion with 'Tibetan Terrier,' at around ~ 10% and 8%, respectively for the ViT
model. Consistent with our earlier observations, unlearning the "Tibetan Terrier" class led a decrease performance for classes that were frequently confused with is hierarchically closer to).
Effect of Incomplete Retain Set: In Table analyze the effect of incomplete retain set, particularly, our algorithm does not have access to one of the classes in the retain set, this is referred to "Missing Class". We report the test accuracy of the retain classes (ACC r) which includes the missing class, the accuracy of unlearned clsss(ACC_f), the drop in accuracy of the miss class (Drop (Drop_Missivg) Missing), and the confusion between the missing class and the unlearned class (obtained from Figure B). The results show that there is maximum drop in accuracy when the dog class is missing from the retain set. As it is maximally confused
atrp auto bird
14
3
3
20
airp auto bird
95
5
11
0
1
0
3
22
4
airplans aigomabile
b5s
12
24
960
D63
24
386
22
18
10
21
20
7
3
bird
True Lables
cat.
2
31
923
19
80
20
8
True Lables
cat
96
19
150
1222
60
53
87
67
Thun Lables
cal
dear
920
deer
dog
0
17
21
850
7
dog
17
0
31
933
22
35
10
dog
frog
frog
17
7
2
944
trog
18
0
955
2
hosso
hors
hors
ship
053
ship
3
ship
17
0
66
truck
truc
airp
auto
11
bird
40
cat
deer
dog
0
hors
ship
truc
984
truc
airp
auto
11
bird
41
cat
deer
0
dog
frog
hors
ship
truc
13 334
airplane
butomobil
bird
deer
dog
frog
horse
dtpp
tru
Predicted Labels
Predicted Labels
Prodktedd Labels
(a) Original
(b) Unlearned
(c) Retrain
Figure 8: Confusion Matrix for original VGG1I model and model unlearning cat class, showing redistribution
cat samples other classes in proportion to the confusion in original model.
12

---

Published in Transactions on Machine Learning Research (07/202) 2024)
GPU- NVIDIA
Forget Acc
[Foster]
2.01
% of a Retrain (ochhlmmggNeet
80
Compute
% of a Retrain Epoch(ImageNee
Our
2.22
60
Accuracy
0.9
[Tarun]
4.93
NegGrad+
8.25
40
0.8
[kurmanji]
22.82
CPU- AMD EPYC 7502
20
Our
17.01
[Foster]
27.71
10"
10a
10"" 1000
# of Samples (log scale)
10a
10"
hidden Size
0 5 10 15 20 25 30 35
Time (min)
Figure 11: Change in Forget Ac-
Figure 10: Change compute with increase in hidden size for a ViT B 16 model on ImageNet dataset.
curacy and Compute with the ber of relain and forget samples Used for SVD ViT B 16 model on ImageNet dataset.
Figure 9: Runtime for different al- gorithms unlearning single class from VIT B 16 on ImageNet dalaset.
with the target cat class. Removal of cat class without access to the dog information (or confusing class information) catastrophically affects the model usability on dog class.
Runtime: We evaluate the runtime performance of different unlearning algorithms. Figure g presents the average runtime over three trials for unlcarning class 0 from ViT model trained on the ImageNet dataset. We utilize implementations from the algorithms"' official reposilories and assess their runtime on a single Nvidia A40 GPU. Our algorithm achieves favorable runtime compared to most iterative methods considered in this work. Notably, the method referenced in Foster et al. (2024) exhibits the fastest runtime in this setting. However, the runtime advantange of Foster et al. (2024) diminishes significantly when compared on an AMD EPYC 7502 32-core CPU. We observe that, Foster el al. 2024 approximately 60% slower than our algorithm.
Impact of increasing hidden size Compute: Since Singular Value Decomposition (SVD) is com- putationally expensive, increasing the hidden layer size of the network is likely to significantly impact the computational cost of our algorithm. We analytically calculate the computational cost for our algorithm (see Appendix A to investigate this relationship in Figure 10 The figure plots the normalized computational cost (relative to 1 epoch retraining) our approach on the y-axis, for different hidden layer sizes shown on the x-axis. As expected, the figure demonstrates a positive correlation between the computational cost and the hidden layer size. Impressively, even for a hidden layer size of 100, 000, our method's 's computational cost remains lower than that of a single retraining epoch. In practice, for the widest know vision transformer model, ViT G IZhai et al. (2022). with a hidden size of 1280, our method achieves computational cost of 1.17% of a single retraining epoch.
Number of Samples analysis: In Figure II we plot the change in in model performance with sample set size. The sample set size for Retain Set and the Forget Set kept the same in this experiment. We vary the number of samples as [90, 225, 450, 900, 2250, 4500] and present the accuracy on the forget set and the compute cost on We observe that we need around 900 samples of retain and forget set each to obtain ACC, = 0. This translates to around 100 samples pre retain class which is similar to what is used in Saha
ct al. 2021b.
One-Shot Multi Class Forgetting: The objective of Multiclass removal is to remove more than one class from the trained model. In multi task learning a deep learning model is trained to do multiple tasks where each of the tasks a group of classes. The scenario of One-Shot Multi-Class where the unlearning algorithm is expected to remove multiple classes in a single unlearning step has a practical use case in such task unlearning. Our algorithm estimates the Retain Space U, and the Forget Space U, based the samples from X, and X₁. It is straightforward to scale our approach to such a scenario by simply changing the retain sample X, and X, to represent the samples from class to be retained and forgotten respectively. We demonstrate multi class unlearning on removing 5 classes belonging to a superclass on CIFAR100 dataset in Figure I2
We observe our method is able to retain good accuracy on Retain samples and has above 95% MIA accuracy while maintaining a low accuracy on forget set under this scenario.
13

---

Published in Transactions on Machine Learning Research (07 (024)
100
100
120
Original Model
class removal
MIA Accuracy
80
Retain Acc.
Forget Acc.
100
class removal
40
40
20
20
VGG11
ResNet18
VGG11
ResNet18
VGG11 BN
ResNet18
(a) Retain Accuracy.
(b) Forget Accuracy
(c) MIA Accuracy
Figure 12: One-shot Multi-Class Unlearning for CIFAR100 dataset.
When compared with Tarun et al. [2023 under this unlearning set- ting (see Table 15 in Appendix A.14) we see our method has signifi- cantly better performance. We also present results of multiclass un- learning on CIFAR10 in Appendix A.14 which shows similar trends.
100
VGG1
Retain Set Acc.
96
94
This scenario of multiclass unlearning demonstrates another practical use case of our algorithm where different unlearning requests
Sequential Multi Class Forgetting:
92
at different instances of time. In our experiments, we sequentially unlearn classes 0 to 9 in order from the CIFARIO dataset on VGG11 and ResNet 18 model. The retain accuracy of the unlearned model is plotted in Figure 13 The forget accuracy for all the classes in the unlearning steps was zero. We observe an increasing trend the retain accuracy for both the VGG11 and ResNet18 models which is expected as the number of classes reduces the classification task simplifies.
90
2
# of Classes Unlearnt
Figure 13: Sequential class re-
moval on CIFAR10 dataset.
7 Conclusion
In this work, we present novel class and multi-class unlearning algorithm based on Singular Value Docom- position (SVD). This approach eliminates the need for computationally expensive and potentially unstable gradient-based methods, which are prevalent in existing unlearning techniques. We demonstrate the effec- tiveness of our SVD-based method across various image classification datasets and network architectures. Our analysis using saliency-based explanations confirms that no clas-ddssriminntory features are retained after unlearning. Additionally, confusion matrix analysis verifies the redistribution of unlearned samples based on their confusion with other classes
Traditional unlcarning methods rely heavily on gradicnts, leading to limitations in computational cost and sample size requirements, especially for large models and datasets. Our work addresses these limitations by introducing novel and demonstrably superior solution for class-wise unlearning, outperforming state-of-the- art basclines. Our approach is radically different for many of the current approaches as our algorithm (a) is Gradient-Free (b) uses Single-step weight update, (c) has novel weight update machanism and (d) is compute and sample efficient. Our in-depth analyses, including investigations into layer importance, hyperparameters, scalability, and output distributions, were driven by the novelty and potential our approach. We believe this work has the potential to revolutionize the field of efficient unlearning, inspiring future explorations across diverse domains and expanding the breadth of this research area.
8 Impact Statement
This research addresses crucial ethical aspects and socictal consequences the domain of machine learning, specifically focusing on the emerging need for unlearning algorithms in the context of data privacy. By using few samples for unlearning, the study not only pushes the boundaries of machine unlearning but also sticks
14

---

Published in Transactions on Machine Learning Research (07/2024)
to ethical principles about privacy and user rights. The proposed algorithm changes how we unlearn data from learned model, making it scalable, especially for huge datasets like ImageNet. This energy-efficient approach marks substantial step in minimizing overall environmental impacts, representing progress to- wards more sustainable machine learning practices. In essence, this work guides us toward responsible and privacy-conscious machine learning, making sure our futuristic technology respects both societal values and regulations.
Acknowledgement
This work was supported in part by, the Center for Brain-inspired Computing (C-BRIC), the Center for the Co-Design of Cognitive Systems (COCOSYS), DpoPo-sponsored JUMP center, the Semiconductor Research Corporation (SRC), the National Science Foundation, and DARPA ShELL
References
Devansh et. al. Arpit. A closer look at memorization in deep networks. In International conference on machine learning, pp. 233- 242. PMLR, 2017.
Ching-Yuai Yuan Bai, Hsuan-Tien Lin, Colin Raffel, and Wendy Chi-wen Kan. On training sample memorization: Lessons from benchmarking generative modeling with a large-scale competition. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 2534-2542 2021.
Thomas Baumhauer, Pascal Schöttle, and Matthias Zeppelzauer. Machine unlearning: Linear filtration for logit-based classifiers. Machine Learning, 111 0211332332226,, 2022.
Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Chor Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium Security and Privacy (SP), pp. 141-159. IEEE, 2021.
Jonathan Brophy and Daniel Lowd. Machine unlearning for random forests. In International Conference on Machine Learning, pp. 1092-1104) PMLR, 2021.
Cheng Chen, Ji Zhang, Jingkuan Song, and Lianli Gao. Class gradient projection for continual learning. Proceedings of the 30th ACM International Conference on Mullimedia, pp. 5575 5583, 2022.
Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. Zero-shot machine un- learning. IEEE Transactions on Information Forensics and Security, 2023.
Alan Kaylor Cline and Inderjit S Dhillon. Computation of the singular value decomposition. In Handbook of linear algebra, pp. 45 1. Chapman and Hall/CRC, 2006.
Mare Peter Deisenroth, A. Aldo Faisal, and Cheng Soon Ong. Mathematics for Machine Learning. Cambridge University Press, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image databasc. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248-255, 2009. doi: 10.1109/CVPR.20000 201.....0009..888.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words:
Transformers for image recognition at scale. arXiv preprint arXiv:2010. 11929, 2020.
Jack Foster, Stefan Schoepf, and Alexandra Brintrup. Fast machine unlearning without retraining through selective synaptic dampening. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38-11, pp. 12043-12051, 2024.
Antonio Ginart, Melody Guan, Gregory Valiant, and James Zou. Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems, 32, 2019.
15

---

Published in Transactions on Machine Learning Research (07/2024)
Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponmurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning. arXiv preprinl ar Xrx::2200 066440, 2022.
Shashwat Goel, Ameya Prabhu, Philip Torr, Ponnurangam Kumaraguru, and Amartya Sanyal. Corrective
machine unlearning, arXiv preprint (121:22022114155, 2024.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVE Conference Computer Vision and Pattern Recoguilion, pp. 9304-9301111 9312, 2020a.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In Computer Vision ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXIX 16, pp. 383-398. Springer, 2020b.
Aditya Golatkar, Alessandro Achille, Avinash Ravichandran, Marzia Polito, and Stefano Soatto. Mixed- privacy forgetting in deep networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 792 801, 2021.
Eric Goldman. An introduction to the california consumer privacy act (ccpa). Santa Clara Univ. Legal Studies Reseorch Paper, 2020.
Jamie Hayes, Ila Shumailov, Eleni Triantafillon, Amr Khalifa, and Nicolas Papernot. Inexact unlearning needs more careful evaluations to avoid false sense of privacy, 2024.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition.
Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770 778, 2016.
Marti A. Hearst, Susan T Dumais, Edgar Osuna, John Platt, and Bernhard Scholkopf. Support vector machines. IEEE Intelligent Systems and their applications, 13(4):18 28, 1998.
Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. Approximate data deletion from machine learning models. In International Conference on Artificial Intelligence and Statistics, pp. 2008- 2016. PMLR, 2021.
Dongiae Jeon, Wonje Jeung, Taeheon Kim, Albert No, and Jonghyun Choi. An information theoretic metric for evaluating unlearning models. XrXio preprind arXiv:2405.17877 2024.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. CIFAR, 2009.
Meghdad Kurmanji, Peter Triantafillou, and Eleni Triantafiloou. Towards unbounded machine unlearning. arXiv preprint Xrx:::2302.0099 09880, 2023.
Guanghao Li, Li Shen, Yan Sun, Yue Hu, Han Hu, and Dacheng Tao. Subspace based federated unlearning. arXiv preprint ar 2304.22022.2448... 2023.
Zhenhua Liu, Jizheng Xu, Xiulian Peng, and Ruiqin Xiong. Frequency-domain dynamic pruning for convo- lutional neural networks. Advances in neural information processing systems, 31, 2018.
Ananth Mahadevan and Michael Mathioudakis. Certifiable machine unlearning for linear models. arXiv preprint Xio::2100..1 15093, 2021.
Quoe Phong Nguyen, Bryan Kian Hsiang Low, and Patrick Jaillet. Variational bayesian unlearning. Advances in Neural Information Processing Systems, 33:16025-16036, 2020.
Chris Olah, Alexander Mordvintsev, and Ludwig Schubert. Feature visualization. Distill, 2(11):e7, 2017.
German I Parisi, Ronald Kemker, Jose Part, Christopher Kanan, and Stefan Wermter. Continual lifelong learning with neural networks: A review. Neural networks, 113:54-77 71, 2019.
16

---

Published in Transactions on Machine Learning Research (07/2024)
Gobinda Saha and Kaushik Roy. Continual learning with scaled gradient projection. Proceedingss of the AAAT Conference Arlificial Intelligence, 37(8):9677-9685, Jun. 2023. doi: 10.1609 v.ai.v337..2611. URL https://ojs.aaal wtg.aargaaaaaaaaaaaaa....
www./idex....iioooooo iidexx.ddxxx/////e///////iiiie pptp/AAA//arrricce//is/////111
Gobinda Saha, Isha Garg, and Kaushik Roy. Gradient, projection memory for continual learning. In In-
ternational Conference Learning Representations, 2021. URL sttrs://oopameerrieennnoooooooo
3300ORRNN2
Scbastian Schelter. Amnesia-a selection of machine learning models that can forget user data very fast. suicide, 836-((40035)446992, 2020.
Stefan Schoepl, Jack Foster, and Alexandra Brintrup. Parameler-tuuning-fee data entry error unlearning with adaptive selective synaptic dampening, arXiv preprint arXiv:2402.10099, 2024.
Ravid Shwartz-Ziv and Naftali Tishby. Opening the black box of deep neural networks via information. arXiv preprint XrXie:1703.00 00810, 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXic: 1556, 2014.
lly Sutskever, James Martens, George Dahl, and Geoffrey Hinton. On the importance of initialization and momentum deep learning. In International conference on machine learning, pp. 1139 1147. PMLR, 2013.
Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unlearning. IEEE Transactions on Neural Networks and Learning Systems, 2023.
Naftali Tishby and Noga Zaslavsky. Deep learning and the information bottleneck principle. In 2015 ieee information theory workshop (itw), pp. 1-5. IEEE, 2015.
Paul Voigt and Axel Von dem Bussche. The eu general data protection regulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10(3152676) 2017.
Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Ricck. Machine unlearning of features and labels. Xiv preprint arXiv:2108. 111577778,,, 2021.
Youngsik Yoon, Jinhwan Nam, Hyojeong Yun, Jacho Lee, Dongwoo Kim, and Jungsoul Ok. Few-shot unlearning by model inversion. arXiv preprint arXiv:2205.13 15567, 2022.
Xiaohua Zhai, Alexander Kolesnikov, Neil Houlsby, and Lucas Beyer. Scaling vision transformers. In Proceedings of the IEEE/CVE conference computer vision and pattern recognàtion, pp. 12104-12113, 2022.
17

---

Published in Transactions on Machine Learning Research (07 (07/2024) 2024)
A
Appendix
A.1
Demonstration with Toy Example
Feature 2
Feature
Feature
-.5
-3.0
1.0 3.0
-3.0
3.0
-1.8 Feature
Feature
Feature
(a) original model
(b) model forgetting Red Class
[c] Retrained model
Illustration the unlearning algorithm on a simple class classification problem. Figure shows the decision boundary for (a) original model, (b) our unlearned model redistributing the space to nearby classes and (c) Retrained model without red class. Note This figure is same as Figure ! and duplicated here for case of reference.
Figure 14:
In Figure [4 we demonstrate our unlearning algorithm on a 4 way classification problem, where the original model trained detect samples from different 2-dimensional Gaussian's centered around (1,1), (-1,1), (-1,-1) and -1) respectively with a standard of (0.5,0.5). The training dataset has 10000 samples per class and the test dataset has 1000 samples per class. The test data is shown with dark points in the decision boundaries in Figure [4 We use a simple 5-layer linear model with ReLU activation functions. All the intermediate layers have 5 neurons and each layer excluding the final layer is followed by BatchNorm. We train this network with stochastic gradient descent for 10 epochs with a learning rate of 0.1 and Nestrove momentum of 0.9. The decision boundary learned by the original model trained on complete data is shown in Figure [4] and the accuracy of this model on test data is 95. 95.60%. In Figure [4(b) we plot the decision boundary for the model obtained by unlearning the class with mean (1,1) with our algorithm. This decision boundary is observed to be close to the decision boundary of the model retrained without the data points from class with mean (1,1) shown in Figure [4(c] The accuracy of the unlearned model is 97.43% and ret retrained model is 97.33%. This illustration shows that the proposed algorithm redistributes the input space of the class to be unlearned to the closest classes.
A.2 Parameters in different layers
The majority of trainable parameters in CNNs (e.g., VGG, ResNets) and the key components of transformer architectures like ViTs reside within lincar and convolutional layers (see Table 5 We focus on these layers for unlearning as they likely hold the most significant. memorized information. *Other model parameters such as the normalization layers and the positional embeddings (in ViTs) are not updated in our algorithm.
A.3 Training Details for CIFAR10/100 Models
All CIFAR1O and CIFAR100 models are trained for 350 epochs using Stochastic Gradient Descent (SGD) with the learning rate of 0.01. We use Nesterov (Sutskever et al. 2013) accelerated momentum with a value of 0.9 and the weight decay set 5c-4.
Type of Layer Conv Linear
VGGII BN (CIFARIO)
CosNNet1(CIFAARII
VIT B 16(ImageNet1k) 86377192 (99.78%) 190464 (0.22%)
9750922 (99.94%)
11164362 (99.91%)
Others Total Parameters
5504 (0.06%)
9600 (0.09%
9756426
11173962
86567656
Table 5: Fraction of parameters in Linear and Convolutional layers.
18

---

Published in Transactions on Machine Learning Research (07/2024)
is the subset of the Algorithm 2
NegGrad Algorithm
Input: the parameters of the original model, L the loss function, D Dtrain sub Dtrain_sub_1 forget partition of the train datasct; and y is the learning rate
1. procedure Unlearn( 0, L. Dtrain sub fo 6,9)
2. 0; --=0
3. for step = I...... 500 do
4. input, target = get batch sub g get gradients(0), L, input, target) g gradient clip(g.1.0)
5.
6.
7.
0- = 0j + 7g
8.
if step multiple of 100 do
9.
accs loo__cccuracy000 Derain_an sub sub_
10.
breakif acc, < 0.1
11. return 07
Algorithm + Algorithm
Input: f is the parameters of the original model; L is the loss function; Dtrain sub and D sub f are the subset of the retain and forget partition of the train dataset respectively; and is the learning rate.
1. procedure Unlearn( 0, L, Dtrain_suth Derain sub f: 17
2. accy lergggtt_auuaaa accuracy(f,, Derain sub f); 87
3. for step ,.... 500 do
4. if accy 0.1 do
5.
input, target get batch(Dtrain aub get goo___rddieet((_, L. input, target) = gradient_ (0l
6.
7.
8.
else fn
9.
10.
input, target get__atch__
batch (Ptrain sab sab_r) Ia get gradiendstttt L. input, target)
11.
12.
0- = 0j 19h. 79a
13.
if step multiple of 100 do
14.
accy get accuracy(0,, D Dirain sub
15.
return 87
A.4 NegGrad Algorithm
In the NegGrad approach, we finetune the model for few steps using gradient ascent on the forget partition of the train set Dirain_ with a gradient clipping threshold set at 1.0. Pseudocode for NegGrad is presented in Algorithm 2 The algorithm initialized the unlearn parameters 07 to the original parameters and does 500 steps of gradient ascent on the forget subset of the training data. After every 100 steps, we evaluate the model accuracy on Deraén and exit ascent when accf becomes lower than 0.1. This restricts the gradient ascent from catastrophically forgetting the samples in the retain partition.
A.5 NegGrad+ Algorithm
This algorithm does gradient ascent on the forget samples and gradient descent on the retain samples for 500 sleps. NegGrad+ a superior gradient ascent unlearning algorithum as compared to the NegGrad. Algorithm 3 outlines the pseudocode for the NegGrad+ unlearning approach. The algorithm initializes the unlearn parameters 07 the original paramcters 0 and gets the model accuracy on the forget partition acc,- The gradients Ja are computed on the forget partition if the accy is greater than 0.1 otherwise Ia is set 0. The gradient the retain batch denoted by ga computed at every step and the unlearn parameters
19

---

Published in Transactions on Machine Learning Research (07/2024)
Table Hyperparameters for our approach with single class unlearning or sequential multi- unlearning.
samples/ /class in X,
samples/clas /class class
Dataset
alpha r list
alpha list.
in X,
CIFARIO
[10, 30, 100, 300, 1000]
100
900
CIFARI00
[100, 300, 1000]
[3, 10, 30, 100)
10
990
ImageNet
330. 100, 300, 1000, 3000)
[3, 10, 30, 100, 300]
500
Table 7: Best
for our algorithm.
Dataset
Architecture
alpha_
alpha in X
in X,
CIFARIO
VGG11 BN/ ResNett8 VGGI1 N8ee
100
3
CIFAR100
1000
30
ImageNet
VGG11 BN
3000
30
ImageNet
VIT B 16/VIT 16
100
10
ImageNet
VIT H 16/VIT B 32 / VIT L 32
300
30
Table 8: Hyperparameter tuning space for NegGrad, NegGrad + and Tarun et al.
2023
benchmarks.
Method
1 or Trepair or Timpair
NegGrad
1e.4, 3e-44,5e-,1e-3,2e--,,33
NegGrad+
1e-4,
Tarun et al. (0223
[1c4,
Table 9: Hyperparameters ranges for Kurmanji et al.
2023
Dataset
Learning-rate
forget-set batch size retain-set batch size
CUPARI/CGAARII///aaas/
[0 5x 10 "]
32, 64, 128, 256]
32, 64, 128, 256]
Table 10: Hyperparameters ranges for Foster et al.
2021
Dataset
30.1,0.3.1.33555
are updated in the descent direction for the retain samples and ascent direction for the forget samples. The values of acty is updated after every 100 steps. This algorithm mitigates the adverse effect of Naive descent on the retain accuracy. Once the model achieves the forget accuracy less than 0.1 the algorithm tries to recover the retain accuracy by finetuning on the retain samples.
A.6 Hyperparameter Discussion
Our approach introduces four key hyperparameters: the list of a, values (alpha r list), the list of a values (alpha f list), and the number of samples used to estimate the Retain Space and Forget Space. The values for these hyperparameters are dependent on the dataset and are presented in Table 6 of Appendix A Best hyperparameters for the results of Table D Table 2 and Table 11 are presented in Table 7 The NegGrad and NegGrad+ require tuning of the learning rate 77 for atleast unlearning class and list of the learning rates is presented in Table & in Appendix A We tune this hyperparameter for unlearning the first class on each model-dataset pair. Once determined, these hyperparameters remain fixed for unlearning all other classes. The SoTA TTaun et al.) 2023) bascling introduces 2 learning rates for the impair and the repair stages represented by Vimpair and Vieepair. Similar to the other baselines these hyperparameters are only tuned on one class for each poodllddtasee pair. For (Kurmanji et al. 2023) we use all the suggested hyperparameters (not explicitly mentioned) given in the work for Large scale experiments on CIFAR10 for class unlcarning- type (Table 3). We tune the batch sizes (forget set bs and retain set bs) and learning rate as given in Table g We restrict the number of minimization steps to 3 and maximization steps to 2, in order to align the compute
20

---

Published in Transactions on Machine Learning Research (07 (07/2024)
budget with that of our algorithm. We were unable train satisfactory model with Kurmanji et al. (2023) algorithm for VIT under the above constaints and hence had to increase the minimization steps to 10 and maximization steps to 5 (only of ViT B __)). Lastly, for Foster et al. (2024) we tuned the hyperparameter À in ranges given in Table 10 for all the experiments.
The Retraining method does not add any additional hyperparameters and trained with the same hyper- parameters as the original model.
A.7 MIA Attack Details
The goal of the MIA experiment was to demonstrate how the unlearned models behave as compared to the Retrained model and the original model. Below we mention the details of MIA experiments.
Training- We train a Support Vector Machine (SVM) classifier as a MIA model distinguish between Dirain_r(at class member class) and Dreat_r class or nonmember class).
Testing We show this SVM model Dirain_f to check if the MIA model classifies it member nonmember. When the MIA model classifies it class 0 (Nonmember) then the MIA model believes that the samples from Deroin / do not belong to the Train set. This is what is meant by having a high accuracy on Dirain
Interpretations of MIA scores- We use the training and testing procedures mentioned above for all the models. Below we present interpretation for different models
Original model We that the original model has low MTA score (nearly 0) which means the SVM model classifies Dtrain f member samples. This is expected Dtrain belonged to the Iraining samples.
Retrained model We see that the Retrained model has a high MIA score (100%) which means the SVM model classifies Dirain_f as nonmembers. This is expected as Drroin does not belong to the training samples.
Unlearned model By these experiments of MIA we wanted to how MIA scores of unlearned models perform. We observe the model unlearned with our algorithm consistently performs close to the retrained model as compared to other baselines.
A.8 Experiments on Variants of ViT
Table 11 shows the results for our algorithm for different versions of VIT model from the pytorch library. The experimental setup is identical to the one presented Table 2
Table 11: Single class forgetting with our algorithm ImageNet-Ik dataset for variants of VIT.
Method
Original Accuracy
ACC,(t)
ACC,(L)
MIA(1)
ViT B 16
80.01
78.47 + 0.84
0.2 122 0.63
99.98 + 0.05
VIT L 16
78.83
78.48 .26
0.22 + 0.67
99.78 + 0.01
VIT H 14
85.48
84.35 + 0.40
0.2 0.63
97.0 = 0.05
VIT B 32
73.48
71.02 0.77
0.84
98.0 = 0.02
VIT L 32
75.00
73.64 + 0.36
0.2 0.63
97.4 = 0.03
A.9 Variants of Our algorithm
This section presents two variants of the algorithm depending on the location of the activation suppression. Consider the linear layer a a, 8T, where a and a; are the input activation and output activations of linear layer. The algorithm presented in the main paper focuses activations before the linear layer,
21

---

Published in Transactions on Machine Learning Research (07/2024)
Table Location of Projection. Experiments on CIFARIO dataset similar to Table
VGGI1 BN
ResNet18
Method
0,0,
accs
acc+
a0e
Original
91.58
94.89
imput activation suppression (main paper)
91.77 + 0.69
0
94.19 + 0.50
0.03 + 0.09
output activation suppression both
90.73 + 1.28
0.15 0.38
91.44 + 1.22
1.05 1.13
91.51 + 0.68
93.96 + 0.60
0.21 0.45
i.e. the input activations 0;- We could also suppress the output activations. This activation suppression meant projecting the parameters on the orthogonal discriminatory projection space (1- Pais,, which is post multiplying the parameters with Pds)) Now if we were to suppress the output activations a would be the same as pre-multiplying the parameters with activations are used to compute Pasa). This variant of our approach is capable of removing the information in the bias and normalization parameters of the nelwork. The other varianl suppresses both the input and output activations using their respective projection matrices. The results for these variants are presented in Table 12 We observe that the performance of these two variants lower than the algorithm in the main paper and hence do not analyze it further.
Pass)" (Note, for suppressing a the output
A.10 Explaining Trends in Hyperparameter Variation
Equation in the paper helps understand how directly controls the importance of basis vectors. In- creasing amplifies their significance while decreasing alpha diminishes it. The overall update equation of our algorithm for layer weights 0 can presented in Equation 4
We explain the conclusions of Figure 4 in
this Subsection.
A.10.1 Trends in Figure (a) (varying (x))
Retrain Accuracy: we assume Py is Identity when we are studying the effect of ar in Equation 4 simplifies to 0, P.O. Now, decreasing a, weakens( scales down basis vectors in Ur. This translates to reduced retrain accuracy P. shrinks towards zero, leading to catastrophic unlearning of the retain partition.
Forget Accuracy: Expanding Equation we get, 0, = (I - Pý + PyP.)O. Inereasing o, amplifies all basis vectors, including those overlapping between U, and Uy (due to PyP.). This effectively boosts forget accuracy for high enough a,.
A.10.2 Trends Figure 4bb (varying a;)
we get, 0, (I Py PfP.).. A decrease in ay decreases all the basis vectors in Uy, including the ones overlapping with U, (due to PyP.). This effectively reduces retain accuracy for high enough ay-
Retrain Accuracy: Expanding Equation 4
Forget Accuracy: we assume that P, zero matrix for studying the effect of a Equation would simplify to 02 = Py)O. Increasing ay diminishes the importance of basis vectors within the forget datasel (due 1 p resulting in the observed decrease in forget accuracy.
A.11
Saliency Maps for CIFAR10 on VGG Dataset
Table 13 shows the Saliency maps for all the classes that are not presented in the main paper (Figure 7
A.12 Effect of Inter- Class Confusion for variants of ViT
Table 14 shows the drop accuracy of top-5 confusing classes for unlearning 'Tibetan Terrier' for the ViT model trained on ImageNet dataset.
22

---

Published in Transactions on Machine Learning Research (07 (07/2024)
Class
Original
Unlearnt
Retrained
Airplane
Automobile
Bird
Deer
Dog
Frog
Horse
Ship
Truck
Table 13: Saliency map for CIFAR10 dataset on VGG11 Network. Similar Figure
23

---

Published in Transactions on Machine Learning Research (07/2024)
Table 14: Effect of unlearning on the confusing classes for ImageNet dataset for variants of VTT.
Original Accuracy
Top-5 Confusing Classes
Model
ACC-(1)
ACC2(L)
MTA(t)
Before Unlearning
After Unlearning
VIT 16
50.01
78.92
100
80.8
51.4
VIT I
78.83
78.61
68.0
VIT
85.48
83.91
25.6
32
73.48
70.25
100
67.6
30.4
VIT
32
75.00
73.47
0
98.0
79.2
54.0
A.13
Compute Analysis for Single Layer of ViT ImageNet dataset.
A.13.1 Linear Layer Compute Equations
Here we analyze the compute required for linear layer. Say we have a linear layer of size sin Sout, where fin the imput features and fout is the output features. Let the retain set have ny samples. The input activation for this layer will hence be of size n, fin. Below we analyze the compute required by various algorithms in this setting. We substitute all the parameters in the equation to obtain the compute in terms of fin and fout-
Retraining: The compute required for this method will be fon for forward pass and 2n, Jin Jour for backward resulting in total compute given by Equation 5 For the ImageNet experiments, n, is approximately 128000. Note this is the compute for the single epoch.
Clinear (fins fout) 3n.finfout 3840000f in
(5)
Analytical compute for our algorithm: We have access to Rour_r and Dour retain and forget samples in our algorithm and for ImageNet these are 999 and 500 respectively. Our approach can be broken into compute steps, namely representation collection, SVD, Space Fstimation, and weight, projection. Representation collection requires forward pass on a few samples and can be compute cost can be computed as mentioned before. For a matrix of size X n SVD has compute of mn² Cline & Dhillon (2006) where Space Estimation and weight projection steps involve matrix multiplication. For matrix A of size m X and matrix B of size p the compute costs of matrix multiplication A x B is mnp.
CLinear (fins Fout) = (Nour + nour fnnfout + (nour + nour 1) + our
2 Pate Computation
Representation Matrix
SVD
SonSout Weight Projection
(6)
1449ffmfoo + 1499 + 2f + Ponoot
A.13.2 Compute for layer of ViT
A layer of VaTe has 4 layers of size 768, namely Key weights, Query weights, value weights, and output weights in the Attention layer. The MLP layer consists of layer of size 768 x 3072 and 3072 x 768. The total compute for layer of Vit would be given by Equation 7 Note this is a simplified model and ignores the compute of the attention and normalization layers. Adding compute for the attention mechanism would only benefit our method as we only compute this for representation collection, whereas the baseline methods would have this computation at every forward and backward pass. These equations used to obtain the numbers for each of the methods in Figure 10 and Figure
VIT Layer
Limima (768, 768) + CLineur (768, 3072) + Liinear (3072,
(7)
A.14 Multi class Unlearning
We run experiments for this scenario on the CIFAR10 dataset with VGG11 and ResNet18 models. Figure 15 presents the mean and standard deviations for retain accuracy and the forget accuracy for 5 runs each
24

---

Published in Transactions on Machine Learning Research (07 (07/2024)
102
2.00
Original Model
class removal
1.75
100
1 class removal
class removal
2 closs removal
1.50
class removal
Retain Acc.
98
class
Forge Parger. Ace
1.25
96
1.00
0.75
94
0.50
92
0.25
90
0.00
VGG11 BN
ResNet18
VGG11_Br BN
ResNet18
(a) Retain Accuracy.
(b) Forget Accuracy
Figure 15: One-Shot Multi-Class Unlearning for CIFAR10 dataset.
configuration. The set of classes to be removed randomly selected for cach of these 5 runs. These results show our algorithun scales to this scenario without losing ellicacy. Additionally we present the comparisons with baselines on the CIFAR100 dataset for unlearning superclass in Table 15
Table Results for Multi class Forgetting on CIFAR100 dataset.
VGGII BN
ResNet18
Method
ACC,(t)
ACC,(L)
MIA(1)
ACC,(t)
ACC,(1)
MIA(t)
NegGrad+
57.75 1.40
0.2+0.2
70.55 + 1.045
0.7 + 0.12
99.86 + 0.11
Tarun et al. 2023
54.31
1.09
0
0
64.16 - 1.18
60.14 1.34 4.333
Ours
65.94 1.89
1.44
94.8 2.2
69.74 3.12
2.33 1.61
95.7 2.67
25


Reviews:
[{"review_id": "CjGCuYuFgr", "reviewer": "Reviewer_gSKS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "# Strengths\n\n1. The paper is nicely structured, with an interesting and novel method.\n2. Performance across multiple datasets (CIFAR-10, CIFAR-100, ImageNet) and different architectures (VGG11, ResNet-18, ViT-B/16) is reported, this paper’s method works well in all settings. **Specifically, the paper mentions one setup with a Vision Transformer (though more examples here would be nice), where many other baselines fail, but this paper’s method works well**. This is a big strength of this paper in my opinion.\n3. Nice set of ablations and analysis are presented.\n\n# Weaknesses\n\nI would list the following weaknesses/questions:\n\n**(About figure 1)**\n\nFigure 1 is pretty nice, illustrating the behavior of the algorithm. Is this just an illustration, or the actual effect of running the algorithm on a 4-class classification problem on a 2D space? If so, what underlying network is used for this task?\n\n**(About preliminaries)**\n\n> Mathematically, these parameters must satisfy $f(x_i, \\theta^*) = f(x_i , \\theta^*_f )$ for $(x_i , y_i) \\in D_{test}$.\n\nThe above requirement for the class unlearning problem seems a bit too strict for me. Specifically, it makes sense that the two parameters behave the same on the retain set, i.e.,  $D_{test, r}$, but why do they need to behave the same on the forget set, $D_{test, f}$? As long as the accuracy on forget classes is low, I don’t see why $$f(x_i, \\theta^*) \\approx f(x_i , \\theta^*_f )$$ has to hold for $(x_i , y_i) ∈ D_{test, f}$.  Also why use sampled datasets here for the problem definition and not distributions?\n\n**(About Table 1)**\n\nWhy does the method Kurmanji et al. show such high standard deviations on CIFAR-10 for VGG11? Also why is there such a big performance difference between the two architectures on the retain classes?\n\nI also don’t agree with the bolding: the bolding should be done according to the best number in each column, not according to some other metric that is not even presented in the main table directly. We understand each algorithm comes with a different tradeoff between accuracy on retain classes vs forget classes. Bolding each column separately makes it easier for the practitioners to choose their algorithms based on if they care about accuracy more for the retain classes vs forget classes. The retraining method can be put in a different color and mentioned that it is an upper bound.\n\n**(About ViTs)**\n\nOne interesting other thing I notice: Tarun et al. and Kurmanji et al. does so much worse in terms of accuracy on forget classes for the ViTs. Is there anything specific about these algorithms that make them particularly bad for ViTs? This paper’s method seems to work with both ViTs and more traditional ResNets, which is a positive point for this paper. But more variants of ViTs/combination of more pre-trained variations would be great to establish this point.\n\n**(Choice of alpha)**\n\nChoosing $\\alpha_f$ and $\\alpha_r$ based on grid-search, despite working well, seems unsatisfactory. Could the authors report these hyper-param values on each (dataset, architecture) pair? How much do they vary?\n\n**(More saliency-based analysis figures like Figure 6)**\n\nOnly a single qualitative analysis is given in Figure 6. Can at least a couple more be included in the Appendix?\n\n**(Effect of having incomplete retain set)**\n\nImagine we want to forget 1 class, and remember the 9 other classes for CIFAR-10. However, the retain set only contains examples from 8 classes. How would this affect the performance of this paper’s method in terms of retain accuracy?\n\n**(Inter-dependency of classes)**\n\nDifferent classes of images might be related to each other (eg., different breed of dogs), and trying to unlearn one class might harm another class which is in the retain set. Do the authors have any qualitative/quantitative analysis on this? Datasets where class inter-dependency is easily defined (BREEDS [1]) can be an interesting place to test this.\n\n# References\n\n[1] BREEDS: Benchmarks for Subpopulation Shift, https://arxiv.org/abs/2008.04859", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Large pre-trained machine learning models are increasingly popular today. However, a lot of these models are capable of memorizing their training datasets, which creates safety and privacy related issues. Particularly, if any entity wants to remove their personal data from the training dataset of a model, merely removing it is not enough since the model might still remember the information from those data-points. On the other hand, computational costs are prohibitive enough that one cannot simply retrain these models from scratch on the left-over dataset. Hence, an increasingly important field of research is machine unlearning — where the goal is to make the model forget particular information without retraining and without destroying the model’s capacity on other tasks.\n\nThis paper studies machine unlearning and provides an effective algorithm for this task — the core contribution is to take a pretrained model and few examples for tasks the model needs to forget vs few examples for tasks the model needs to remember, uses SVD on layerwise activations to figure out features that are specific to the tasks that need to be forgotten, and use them to unlearn particular classes.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The paper contains multiple typos that should be corrected. I would request the authors to answer my questions above, and also fix the following typos.\n\n(Typo) Page 7, We can readily extended → we can readily extend\n\nOur code available --> Our code is available", "broader_impact_concerns": "No concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "X0HcC6UzER", "reviewer": "Reviewer_d7Sc", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\n1. Propose a novel SVD based unlearning method\n2. Scale class-level unlearning experiments to ImageNet and Vision Transformers.\n3. A commendable effort to analyze the effect of the method was made in Figures 3-12.\n4. The paper is written clearly.\n\n**Weaknesses**\n\n1. **Constraint not motivated**: “Moreover, these unlearning algorithms may only have access to a fraction of the original training data, further complicating the unlearning process.”\n\nThe paper does not keep in mind the motivations for class-level unlearning, which leads to the addition of a seemingly arbitrary constraint of having access to only a fraction of original training data. Class-level unlearning is motivated by facial recognition/biometric systems, where a user is an entire class [1]. The user requests deletion of their entire data (the class), and its unclear why model developers would only have access to a fraction. Knowing partial deletion sets has been previously motivated for corrective unlearning [2], which also discusses why this is not really necessary for privacy oriented unlearning. The only provided motivation for this constraint is that using fewer samples leads to computational efficiency, but that’s an incorrect claim, as efficient algorithms can be designed while using the full forget set. See the next two points below. \n\n2. **Overclaimed novelty**: “Our approach is radically different for the current approaches in the following ways:\na) Training-Free: We eliminate the computational burden and potential instability of gradient based unlearning.\nb) Single-Step Weight Update: Our method achieves unlearning in a single update, surpassing the iterative nature of many baselines.”\n\nThis claim is incorrect. Training-free, single-step weight update unlearning methods have been proposed before, see SSD [3]. \n\n3. **Overclaimed efficiency**: “We achieve exceptional sample and compute efficiency as compared to SoTA approaches while improving the unlearning efficacy.”\n\nInsufficient evidence is presented for this claim. First, the empirical unlearning times are not provided. Instead “analytical” times are provided in Figure 8, and it’s unclear how this analysis was done. For example, the proposed method’s time is taken as the same as 1 retain epoch. This seems incorrect, as apart from a forward pass, the method also requires SVD, an O(mn^2) operation. Overall, the efficiency claims would be less confusing if empirical unlearning times were provided instead. Further, please provide comparisons with SSD [3], which is a fast, retraining-free unlearing method that works with partial deletion sets. Please also provide comparisons with EU-1 and CF-1 that have shown 0 drop in Acc_r, and 0 Acc_f and are efficient as they only operate on a single layer [4]. Please also compare/cite few-shot unlearning by model inversion [5], though I guess that might not work well for large-scale datasets like ImageNet. Please also test how Scrub performs when a fraction of forget/retain set samples are known, and see how it works when the number of epochs is reduced (which would make it more efficient) \n\n4. **Weak Evaluations**: “The unlearning algorithm should produce parameters that are functionally indistinguishable from those of a model retrained without the target class”\n\nEmpirically, the paper only looks at output-level evaluation metrics like accuracy on retain classes (Acc_r) and accuracy on forget classes (Acc_f), instead of evaluating whether the parameters are functionally indistinguishable. The MIA setup is not sufficient to indicate privacy protection. Please use sample-level MIA for evaluation, along with other recommendations in [6]. Why can’t output-level indistinguishability be achieved by a trivial baseline: Let D be the set of classes to be removed, in decoding the logits, ignore the class D probabilities. This would lead to no drop in Acc_r and 0 Acc_f, perfectly achieving the paper’s goals at 0 cost. This makes me believe that the evaluation setup in the paper is insufficient for measuring its goal, and the current setup allows for trivial baselines to achieve better results, making it hard to evaluate the efficacy of the method. Please add results for this baseline if you think this claim is not true. The main tables which compare prior methods are reported only on a single class. Since the improvements over existing methods are marginal, they may not be robust across different classes. Could you please report averaged results over 5-10 randomly sampled classes?\n\n5. **Unfair comparisons wrt hyperparameters**:  “Further, our approach has fewer hyperparameters in comparison to the gradient-based baselines which are sensitive to the choices of optimizer, learning rate, batch size, learning rate scheduler, weight decay, etc.”\n\nThis statement is incorrect. For the gradient-based baselines, it is usually enough to use the same choices of the mentioned hyperparameters as the original training procedure. If anything, the method proposed requires 4 hyperparameters (alpha and no. of samples for both forget and retain set) which gradient-based approaches do not.\n\nScrub (Kurmanji et al.) shows better results than the proposed method in the ImageNet setting. In some other tables, it shows worse results, but I believe this is because hyperparameter tuning was not performed on Scrub (as is mentioned in the appendix, the suggested hyperparams in the original paper were taken). Please perform proper hyperparameter tuning on Scrub and report the best possible results that can be obtained with it, to have a fair comparison with the proposed method.\n\n6. **Analysis claims not supported with sufficient evidence**: “We observe that the weight change is larger for the later layers. This suggests that the class discriminatory features are more prominent in the later layers of the network.”\n\nThis claim could be wrong, as its possible later layer weights just change more in the measured metric for all types of samples (instead of class discriminatory ones). A carefully designed control experiment would be needed to prove this claim.\n\n**References**\n\n[1] Machine Unlearning: Linear Filtration for Logit-based Classifiers, Springer Machine Learning 2022\n\n[2] Corrective Machine Unlearning, ICLR DMLR Workshop 2024\n\n[3] Fast Machine Unlearning without Retraining through Selective Synaptic Dampening, AAAI 2024\n\n[4] Towards Adversarial Evaluations for Inexact Machine Unlearning, ArXiv 2023\n\n[5] Few-Shot Unlearning by Model Inversion, ArXiv 2023\n\n[6] Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy, ArXiv 2024", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper studies the setting of class-level unlearning using only a fraction of deleted/retain class samples, claiming this constraint allows more computational efficiency. They claim to propose the first retraining-free unlearning method, using SVD on the hidden layer activations, which they claim is state-of-the-art. Results are reported for VGG11, and ResNet on CIFAR10, CIFAR100 and VGG11, ViT on ImageNet. The method leads to good scores on their metrics for forgetting and maintaining utility. The paper also analyzes: the effect of hyperparameters, layer-level effects, gradcam visualizations, confusion matrices, and sequential, one-shot multi-class removal.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. **Baselines**: Please add stronger baselines mentioned in the Weaknesses Section: SSD, EU-1, CF-1, Scrub with hyperparameter tuning\n2. **Evaluations**: Please report a stronger MIA, and not just output metrics that can be tricked without parameter-level unlearning as highlighted in Weaknesses. Please add empirical unlearning times instead of analytical.\n3. **Motivation**: Please motivate why unlearning with a few samples is important better.\n4. **Related Work**: The paper misses a lot of prior work, some of which is highlighted in the Weaknesses, please include it in the discussion.\n5. **Claims in Writing**: The writing currently makes claims bigger than the ones supported by the evidence, some of which is pointed out in the Weaknesses section, please fix this.\n\n**Minor Issues**\n\n“Three of these approaches…are the baselines used in the literature” - The citations here can be misleading. I guess you are trying to say the cited papers use the methods as baselines. But this is unconventional and thus confusing, as typically people cite the papers that proposed the methods/baselines.\n\nThe figure explaining MIA is hard to understand.\n\nFigure 8-10 are underspecified. It’s not clear what dataset this analysis is done on.\n\nQuestion: In one-shot multi-class removal, we saw a drop in retain accuracy. However it increases in sequential class removal. Why does this discrepancy exist, as the task should become easier even in the one-shot multi-class removal case.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "YiYOusHgdX", "reviewer": "Reviewer_6825", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The paper proposes a method that is light-weighted to some extent and works well on image classification tasks.\n\nWeaknesses:\n1. I don't agree with the setting of the problem, even though there have been some papers published in such a field. Basically, for the class unlearning problem, if we want to completely forget a certain class, we can just change the weights of the forget class in the final classification layer (e.g., set the bias term to be a large negative number) or just simply hard-code that if the network's prediction is the forget class, we will output nothing (or any random class). Even though the method and its behaviors in the paper are interesting, given that there is such a simple solution, the good performance, as well as the purpose of studying this problem, are not that meaningful.\n\n2. I don't agree with the point that the method does not require training. The tuning of the alpha list hyperparameters is essentially a form of training.\n\n3. For the convolutional layer, I think the resulting equivalent linear matrix is typically very large (and also very sparse). I might not understand this point completely, but it seems to me that the projection matrix for convolutional layers could be very large, and using it as a matrix multiplication also makes the computation a lot slower than using the convolution operation.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper studies the class machine unlearning problem where the target is to change a trained model's weights so that the model cannot make correct predictions for a certain forget class while retaining the performance on the rest of the classes. The paper proposes to use an SVD-based approach to modify the linear weights of a network by projecting them into a subspace so that the forget class will be unlearned. The paper shows good performance on image classification tasks on CIFAR and imagenet datasets.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Minor:\n1. Page 4 bottom: \" Post multiplying the parameters with (I − Pdis)\", missing l for Pdiss\n2. Algorithm 1 input: \"are is list\"", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The reviewers found the proposed method novel (Reviewer gSKS, Reviewer d7Sc), the paper well-written (Reviewer d7Sc) and the results show strong performance over class unlearning baselines in several settings ("works well on image classification tasks", Reviewer 6825), including a setting using a Vision Transformer where this method produces impressive results over baselines (Reviewer gSKS), scaling class-level unlearning to ImageNet and Vision Transformers (Reviewer d7Sc). The paper also presents nice ablations and analyses (Reviewer gSKS), makes "a commendable effort to analyze the effect of the method" (Reviewer d7Sc).

During the rebuttal, the authors have adjusted claims to address reviewer feedback on overclaimed novelty and overclaimed efficiency, and added several new experiments and analyses to address feedback (more thorough tuning of hyperparameters in some cases, investigating an incomplete retain set, inter-dependency of classes, more saliency-based analyses). They have also added to the discussion of limitations to address concerns raised by reviewers of trivial baselines for unlearning for some of the metrics used in this work. 

Minor revisions:
1) "A strong MIA attack is proposed by Hayes et al. (2024), however, this attack requires substantial computational resources and are not practical for evaluating large datasets on large models hence we evalutated the unlearning on simple MIA." -- this comment seems outdated since the authors have added results with the attack from Hayes et al. now if I understand correctly. Please remove or adjust accordingly.

2) "In some of our experiments, we observe that the NegGrad+ approach outperforms the SoTA benchmarks" -- please relax the claim that "Our algorithm demonstrates SOTA performance in class unlearning setup with access to very few samples from the training dataset" (in the Introduction), to make it more specific by stating which settings SOTA is obtained (as it's not always the case).

3) Finally, please adjust the limitations section to explicitly mention the existence of the baseline suggested by Reviewer 6825 and Reviewer d7Sc, and the associated discussion.
Decision: Accept (poster)