Improved Localized Machine Unlearning Through the Lens of Memorization
Authors: Reihaneh Torkzadehmahani
Reza Nasirigerdeh
Georgios Kaissis
Daniel Rueckert
Gintare Karolina Dziugaite
Eleni Triantafillou
Venue: Accepted by TMLR ()

Abstract: Machine unlearning refers to removing the influence of a specified subset of training data from a model efficiently, after it has already been trained. This is important for key applications, including making the model more accurate by removing outdated, mislabeled, or poisoned data. In this paper, we draw inspiration from prior work that attempts to identify where in the network a given example is memorized, to propose a new "localized unlearning" algorithm, Deletion by Example Localization (DEL). DEL has two components: a localization strategy that identifies critical parameters for a given set of examples, and a simple unlearning algorithm that finetunes only the critical parameters on the data we want to retain. Through extensive experiments, we find that our localization strategy outperforms prior strategies in terms of metrics of interest for unlearning and test accuracy, and pairs well with various unlearning algorithms. Our experiments on different datasets, forget sets, and metrics reveal that DEL outperforms prior work in producing better trade-offs between unlearning performance and accuracy.

Published in Transactions on Machine Learning Research (10/2025)
Improved Localized Machine Unlearning Through the Lens of Memorization
Reihaneh Torkradehmmhanii Technical University of Munich.
reihaneh. haa.meddtorrraddeemmmooiseeddd
Reza Nasirigerdch
ves..wasiriierdehhhham..d
Technical Universiby of Munich
Georgios Kaissis
g. koissis Maaisis@@gmallcom com
Google Medd
Technical University of Munich
Daniel Rucckert
Technicul University of Munich Imperial College London
Gintare Karolina Dziugaite
gldz com
Google DeepMind
Mila
Eleni Triantafilluu Google Dind
etriontafillou@ggogle.com
Reviewed on OpenReview: https: openreview. net/ forun? id= 2XAVAHYРIB
Abstract
Machine unlearning refers to removing the influence of specified subset of training data from model efficiently, after it has already been trained. This important for key applications, including making the model more accurate by removing outdated, mislabeled, poisoned data. In this paper, we draw inspiration from prior work that allempts to identify where in the network a given example is memorized, to propose new "localized unlearning" algorithm, Delction by Example Localization (DEL). DEL has two components: localization strategy that identifies critical parameters for a given set of examples, and a simple unlearning algorithm that finetunes only the critical parameters on the data we want to retain. Through extensive experiments, we find that our localization strategy outperforms prior strategies in terms of metrics of interest for unlearning and test accuracy, and pairs well with various unlearning algorithms. Our experiments on different datasets, forget sets, and metrics reveal that DEL outperforms prior work in producing better trade-offs between unlearning performance and accuracy
1 Introduction
Machine unlearning, coined by Cao & Yang (2015), the problem of removing from a trained model (the influence of) a subset of its original training dataset. While unlearning is a young area of research, it has
"Corresponding author.
Work done during the author's research internship Google DeepMind. The code available https://github. com/reihaneh- wwweeeiannnnntttrddeeeaaaaa torkzaaehmmaaas /DDL/D/ELUUI earning/

---

Published in Transactions on Machine Learning Research (10/2025)
recently attracted lot of attention (Triantafillou et al., 2024). Example applications of unlearning include keeping models up-to-date or improving their quality by deleting training data that is identified post-training as being outdated, mislabeled or poisoned.
Unlearning is a challenging problem in deep neural networks since they are highly non-convex, preventing us from easily quantifying the influence of different training examples on the trained weights. As a straightforward solution unlearning given "forget set", one can retrain the model from scratch excluding that set. This approach implements eract unlearning, guaranteeing that the resulting model has inffuence from the forget set. However, this can be prohibitively computationally expensive. Instead, burgeoning area of research has emerged that designs methods to post-process the trained model to attempt to approzimately erase the influence of the forget set efficienlly. This introduces a challenging balancing act, as imperfect attempts at removing some training examples after the fact may accidentally damage the model and overly reduce its utility (e.g., accuracy on the remainder of the training data or generalization ability). Therefore, designing successful approximate unlearning methods involves navigating tradc-offs between i) unlcarning quality, ii) utility, and iii) efficiency.
We hypothesize that localized unlearning, where the unlearning algorithm operates only on (small) subset of parameters, is promising for striking good balance in the above trade-offs. Specifically, modifying a (appropriately chosen) small fraction of the weights may intuitively be less likely to overly damage the network's utility and more likely to be efficient, since fewer parameters are subject to modification. However, the success of such a localized approach hinges on the ability to identify the right subset of parameters to perform unlearning on. In this work, we take a deep dive into different localization strategies, drawing inspiration specifically from hypotheses formulated about where in the network training data is "memorized"?
Indeed, closely-related research communily has been studying memorizalion in neural networks. Informally, a training example is memorized by model if that model's predictions on that example would have been different had the example not been included in the training set (Feldman, 2020; Pruthi et al., 2020). As we discuss later, this notion is closely tied to unlearning.
Our contributions can be summarized as follows:
We leverage hypotheses for where examples are memorized to derive localization strategies for unlearning and investigate their strengths and weaknesses. We find that data-agnostic strategies perform poorly: they either achieve good unlearning performance at the expense of utility, or the other way around, but not both.
We propose practical localization strategy inspired by the memorization localization algorithm of Maini et al. (2023). Our strategy is more efficient than that algorithm and, when paired with various unlearning algorithms from the literature, outperforms prior work in terms of unlearning and utility metrics.
We propose new localized unlcarning algorithm, Deletion by Example Localization (DEL), by pairing our localization strategy with the simple approach of resetting the deemed-to-be critical parameters and then finetuning the newly reinitialized parameters.
DEL performs strongly on three datasets//rchittettte and ImageNet-100 with ResNet-50), different unlcarning scttings (subclass unlcarning, class unlcarning, and continual unlearning), and different forget sets (IID and non-III in subclass unlearning), against prior localized and full-parameter unlearning algorithms. Across the board, DEL is the best performer (or no worse) in terms of forgetting quality, while almost always outperorrmigg all localized methods in terms of test accuracy too.
(CIFAR-10 with ResNet-18, SVHN with VIT,
In addition, DEL is more robust. to the parameter budget, outperforming the previous state-of-thees method SalUn across different budgets.
We intend here very restricted definition of "memorization" in the context of classification models, which do not provide generative outputs. In this context, memorization relates data element contributing the model's ability accurately label imput data. Such models do not "contain" " bit-wise or code-wise copies of their training data.
2

---

Published in Transactions on Machine Learning Research (10/2025)
2 Background
We begin by introducing notation and defining key concepts.
Let Drman denote a training dataset and A (possibly randomized) training algorithm. We denote by 0 = ((Drran)) the parameters obtained by training on Durain using A. We refer to 0 as the "original model", i.c. before unlcarning takes place. We will study algorithms for "unlcarning" a subset S C Derain reforred to as the forget set. We refer to Dirain \ S, the remaining training data, as the retain set.
2.1 Unlearning
We define unlearning intuitively in way that reflects the standard metries used in the community that we also adopt for evaluation; see Section A.1 for additional discussion.
Definition 2.1. Unlearning. For a given algorithm A and dataset Dirain: an algorithm 14 is said to unlearn a forget set S if the unlearned model u(00, ,8, Derain ()) and the "retrained model" A(Drrain (S) have the same distribution of outputs on S.
The above compares the (distribution of) outputs of the models obtained by two different recipes. The first. recipe is t(Dirain \S) retraining "from scratch" on only the retain set, which is prohibitively expensive but idcal from the standpoint of climinating the inffuence of S on the model. The sccond is U(6 S, Dtrain \S), applying U to post-process the original model 0 in order to unlearn S. Note that, while different variations are possible, we assume that U has access to both the forget set and the retain set.
In the above, we refer to "distributions" of outputs since re-rumning either recipe with a diffcrent random seed, which controls, e.g., the initialization or the order of mini-batches, would yield slightly different model weights, thus possibly slightly different outputs too. In our experiments considering classífication tasks, the "outputs" are the vector of softmax probabilities, bilities, and different metrics consider different elements of that vector, e.g., the accuracy metric requires the argmax of that vector, whereas more sophisticated metrics consider the correct class probability (confidence).
A successful unlearning algorithms U is one that causes these two recipes to yield similar outputs, with the second recipe being substantially more conputattonall--effieent compared to the first, in order to justify paying the cost of approximate unlearning rather than simply retraining.
Unlearning evaluation. Evaluating unlearning rigorously is an ongoing area of research; current state-of- the-art evaluation methods (Hayes et al., 2024; Triantafillou et al., 2024) require training large number of models, which is very expensive. In this work, we leverage standard metrics in the research community, building on top of the evaluation procedure of Fan et al. (2023) that considers two metrics for unlcarning quality. The first is the accuracy of the unlearned model on the forget sel,, with the goal of matching the accuracy of the retrained model on the forget set, in line with Definition 2.1. The second is a Membership Inference Attack (MIA), which, given access to outputs ("predictions") of the unlearned model, aims to detect whether an example was used in training. Moreover, in Section A.5, we present evaluations using a stronger MIA that is based on the "confidence" of the unlearned model. We adopt the MTAscore of Fan et al. (2023)3 that measures the efficacy of defending against such an attack, as the portion of forget set examples that the attacker thinks were unseen. An ideal unlearning algorithm would have MIAscare matching that of the setrained-from-scoe scratch model; see Section A,4 for details. In addition, comprehensive evaluation of unlcarning also requires mcasuring utility, which we measure via test accuracy (and retain accuracy, in Section A.6), and efficiency.
In addition to the accuracy, we employ a more fine- -heened evaluation metric, where we compute the percentage of forget set samples that the oracle model misclassifies but the unlearned model classifies correctly. This metric is a better indicator of unlearning effectiveness than accuracy. This if oracle and unlearned models misclassify completely different subsets of the samples, and the size of the subsets are equal, the accuracy will report the same value for both oracle and unlearned models. The unlearning algorithm in this case is not
Departing from the terminology of Fan al. (2023), we refer to this metric as the "MIA score" instead of "MIA efficacy" to clarify that the metric measures the effectiveness of defending against the attack rather than the effectiveness of the attack itself.
3

---

Published in Transactions on Machine Learning Research (10/2025)
effective in fact, but accuracy values indicate otherwise, which is misleading. The new metric does not suffer from this problem, implying that it better represents the performance of unlearning. Please see section A.8 for more details and evaluation results.
For compactness in tables, we sometimes report a difference obtained by subtracting the unlearned model's value for a given metric from the oracle's 's value for that metric, e-g. Aorget the forget set accuracy of the oracle model (retrained from scratch) minus that of the unlearned model. For each such A, the lower the absolute value, the better.
Retain set $
Pretrained modal
standard
Localization strategy 1
Uniearning algorithm
Retrain from scratch
Forget set
Forget
Retain set
set
How similar are the model outputs??
Initialized model
Figure 1: Localized unlearning consists of two parts: a loculization stralegy that identifies a set of "critical parameters" (dashed line circles) and an unlearning algorithm that aims to remove the influence of the forget set by modifying only the critical parameters (highlighted circles), keeping the rest unchanged. Idcally, the unlearned model should "behave" like the model retrained from scratch (oracle model), i.e., the two should produce the same (distribution of) outputs; see Definition 2.1
Localized unlearning. We focus on "localized unlearning" algorithms that modify only a (preferably small) subset of the parameters of 09, leaving the rest unchanged (see Figure 1). We view this as a promising direction as we hypothesize that can yicld better tradc-offs between unlcarning efficacy, utility, and efficiency, due modifying fewer parameters. Indeed, the current stale-of-the-arl unlearning algorithm is a localized one (Fan al., 2023).
A localized unlearning algorithm has two components. The first is localization strategy L that produces mask determining which subset of the parameters should be modified to carry out the unlearning request: m = C(00, S) where is a binary vector specifying whether each parameter will be updated. The second component is a unlearning strategy. This, in principle, can be any unlearning algorithm that, in this case, will operate on only the subset of the parameters indexed by m. Overall, a localized unlearning algorithm is instantiated via a (L) pair.
2.2 Memorization
An intriguing phenomenon is that, despite models exhibiting strong generalization properties, they still tend "memorize" some of their training data (Arpit et al., 2017; Zhang al., 2021). In fact, recent thcories argue that some forms of memorization are actually necessary for optimal generalization (Feldman, 2020; Brown et al., 2021; Attias et al., 2024). In the below, first present definition of memorization borrowed from (Feldman, 2020), and then discuss the connections with unlearning.
Definition 2.2. Label memorization. Assume dataset Duain ((,, w)) where I; and yi denote the imput and label for the i'th training example, and assume a training algorithm A and model fa; 0) parameterized by 0, mapping inputs to labels. Then, the memorization score for an example (I;, E D (with respect to Dirains A and f) is
Pr O~Daatrattt)
Pr (f(x;) vi] A (x)
[f va]-
(1)
Intuitively, an example highly memorized if the model can only predict its label correctly when that example is in the training set. This will be primarily the case for atypical, ambiguous mislabeled examples that would not be otherwise correctly predicted (Feldman & Zhang, 2020).
4

---

Published in Transactions on Machine Learning Research (10/2025)
Connections with unlearning. Some forms of memorization and unlearning are intimately connected: at the extreme where example isn't memorized at all, it can be thought of as being trivially "unlearned" according to some unlearning metrics of interest, because the model's predictions on that example aren't t different from what they would have been had that example not been included in the training set ("retrain from scratch"). Empirically, Zhao et al. (2024) showed that most approximate unlearning methods are more successful on forget sets that include examples that have lower memorization scores compared to those with higher memorization scores. Relatedly, Jagielski et al. (2022) study catastrophic forgetting during training; a phenomenon that can be characterized as reduced memorization of an example in later stages of training, that can be interpreted as passive form of unlearning. They find that, when training on large datasets, examples that were only seen early in training may be less memorized, which they quantify via the failure rates of privacy atlacks aiming lo extract examples or infer whether they were used for training. Toneva et al. (2018) find that examples with noisy labels witness a larger number of "forgetting events" during training, defined as an event where an example that was proviously correctly predicted becomes incorroctly prodicted later in training.
Based on these insights on the strong connection of memorization and unlearning, we ask: does knowledge (or assumptions) of where in the network a forget set is memorized give rise to improved unlearning for that forget set?
Localizing memorization. Investigating the above question is a challenging undertaking, as pinpointing where memorization occurs in and of itself a research problem. Baldock et al. (2021) define the "prediction depth" for an example to be the earliest layer in the network after which the example is correctly predicted. They find that mislabeled examples are only predicted correctly in the final few layers of the model, and conclude that "early layers generalize while later layers memorize". Stephenson et al. (2021) draw the same conclusion through a study of manifold complexity and shattering capability. However, Maini et al. (2023) found that the parameters that memorize specific examples are actually scattered throughout the network and not concentrated in any individual layer.
3 Related Work
Unlearning. Cao & Yang (2015) coined the term unlearning and proposed exact algorithms for statistical query learning. Bourtoule et al. (2021); Yan et al. (2022) propose frameworks that support exact unlearning in deep networks more efficiently by considering architectures with many components, where one only needs to retrain the affected parts of the model for each unlearning request. However, in the worst case, efficiency can be as poor as in naive retraining, and furthermore, these specialized architectures may have lower accuracy compared to state-of-the-art ones. Instead, plethora of approximate unlearning methods (Ginart et al., 2019; Guo et al., 2019; Golatkar et al., 2020a;b; Thudi et al., 2022; Seo et al., 2025) were developed that operate on an already-trained model to remove the influence of the forget set., Simple commonly-used baselines include finetuning the model on only the retain set ("Finetune"), or on only the forget set using the negated gradient ("NegGrad") or combining these two in a joint optimization "NegGrad+" (Kurmanji et al., 2024). One could also apply joint optimization using gradient descent both the retain and forget sets, after having first randomly relabelled the examples in the forget set ("Random Label") (Graves et al., 2021; Fan et al., 2023). SCRUB (Kurmanji et al., 2024) builds on NegGrad+ by casting unlearning as a teacher-student problem and using distillation. Liu et al. (2024) show that sparsity aids unlearning and that adding an L1-penalty to the Finetune baseline improves its performance (*LI-sparse"). One could also utilize influence function analysis (Koh & Liang, 2017) to mitigate the impact of the forget data by estimating the importance of the model weights (+IU") (Izzo et al., 2021).
Localized unlearning. Goel et al. (2022) propose baselines that perform unlearning only the k deepest (closest to the output) layers and either simply finetune them ("CF-k") or reinitialize them and then finetune them (*EU-k"). Foster et al. (2024) uses the Fisher information matrix to identify parameters that are disproportionately important to the forget set and apply unlearning on those ("SSD"). Fan et al. (2023) proposes Saliency Unlearning ("SalUn"), which seleets a subset of critical parameters by considering the gradients of the forget set and applies unlearning (by default using Random Label) on the identified parameters. We will later compare this state-of-the-art method to of her strategies inspired by the memorization literature.
5

---

Published in Transactions on Machine Learning Research (10/2025)
Related ideas have been proposed in the context of unlearning in LLMs (Hase et al., 2024; Guo et al., 2024), though the problem formulation of LLM unlearning as well as the architectures and algorithms used there are substantially different and out of the scope of this paper; see discussion in Section 7.
4 Localization via memorization hypotheses
In this section, we derive localization strategics from hypotheses in the memorization literature and investigate their performance in the context of localized unlearning compared to existing approaches. Based on Section 2.2, we consider two hypotheses for where memorization occurs, and we then turn each one of them into a localization strategy L(89, The two hypotheses arc: i) memorization happens in the "deepest layers", i.c. closest to the output, consistent with (Baldock et al., 2021; Stephenson et al., 2021), and ii) memorization of an example is confined to small set of channels, scattered across the network, whose location depends on the example (Maini et al., 2023).
We compare the unlearning performance of four localization strategies: i) Deepest and it) CritMem, derived based on the above two hypotheses, respectively, iii) selecting the shallowest layers ("Shallowest") as a control experiment for i, and iv) the localization strategy of SalUn (Fan et al., 2023) ("SalLoc") that is not motivated through the lens of memorization but is regarded as state-of-the-art in the unlearning literature. Note that we reserve the name "SalUn" for the pairing of SalLoc with the Random Label unlearning algorithm, which is the choice that Fan et al. (2023) found worked best (we unlearning algorithms in Section 5).
localization strategics with
Deepest returns a mask that allows only the & deepest (closest to the output) layers to be updated during unlcarning (first hypothesis). If paired with an unlcarning algorithm that resets the choson paramcters and then finetunes them, this corresponds to the EU-k method of (Goel et al., 2022).
CritMem is based on the second hypothesis and implemented via the algorithm of Maini et al. (2023). Given a training example, it iteratively finds the deemed-to-be most critical channel, resets its associated parameters and repeats, until the prediction on that example flips to an incorrect one. At each iteration, the criticality of a channel for an example is determined by multiplying its weights by their gradients on that example, and then taking the sum (over the individual channel parameters) of the magnitude of this quantity. We run this algorithm for each example in S independently, record the critical channels identified for each, take their union, and define mask that turns all parameters associated with the channels in that union.
Shallowest returns mask that allows only the k shallowest (closest to the input. layers to be updated during unlearning, as a control experiment for Deepest.
SalLoc (Fan et al., 2023) sorts all parameters based on the magnitude of gradicnts over S, in desconding order. Then, given a threshold a for the percentage of parameters that may be updated during unlearning, it returns a mask that turns on only the first a percent of elements of that list.
The above strategies differ along several axes. Firstly, Deepest and Shallowest are data-agnostic in that they do not use S to inform which parameters to choose, whereas CritMem and SalLoc are data-dependent and tailor the mask to S. Secondly, there are differences in granularity: Deepest and Shallowest, consider a layer as the unit (i.e. each layer is either included or excluded as a whole). CritMem's 's unit is a channel while SalLoc has the finest gramularity, considering each individual parameter as a unit. Finally, CritMem is substantially more computationally expensive than SalLoc. This is because for each example in S, it. applics an sterative approach that resets the next most critical channel, one at time, until the termination criterion. On the other hand, SalLoc chooses the critical parameters in "one-shot" rather than iteratively and, additionally, operates on batches of S.
Experimental sctup We conduct this investigation on CIFAR-10 using ResNet-18, and a forget set comprised of 10% of the training samples, randomly selected from two classes (2 and 5). We use a simple unlearning algorithm that resets the identified critical parameters (according to the given localization strategy), and then finetunes only those parameters and the classifier layer using the retain set ("Reset + Finctune"). Since each localization strategy chooses a different set and number of parameters, we compare them to one another for different. "budgets" of how many parameters are updated. For example, for Deepest, we select the k
6

---

Published in Transactions on Machine Learning Research (10/2025)
deepest layers (for several different values of k), and compute the mumber of parameters that are selected each time to obtain the "budget". We report three metrics: Forget accuracy and MTA score for unlearning quality, and test accuracy for utility. For each metric, the ideal behaviour is to match the performance of the retrain-from-scratee "oracle" model. We tune hyperparameters separately for each budget and localization strategy; see details in Section A.3.
Oracle
Shallowest
Deepest
CritMem
SalLoc
Ours
100
40
Forget accuracy
84
90
30
83
80
82
MIA
20
81
70
80
10
79
60
78
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
0%
10%
20%
30%
40%
50%
60%
80%
90%
100%
0%4
10%
20%
30%
40%
50%
1409
760
80%
90%
100%
Parameter budget
Parameter budget
Parameter budget
Figure 2: Comparison of localization strategies combined with the Reset + Finetune (RFT) unlearning
algorithm. An idcal unlearning algorithm would match the "oracle" frrctriin-fomm-scracch"" cach metric, with the smallest possible parameter budget, for increased efficiency. The strategy we will propose later ("ours") yields the best trade-off, with near-perfect unlearning for several budgets.
Findings From Figure 2 observe the following. First, when updating (almost) all parameters, Deepest achieves strong results on all metrics, which is expected since, at that end of the spectrum, Decpest paired with Reset + Finel amounts to retraining (almost) the entire model. However, for smaller budgets, it performs very poorly in unlearning metries as resetting only deeper layers does not cause a sufficient accuracy drop on the forget set (though it at least preserves test accuracy). On the other hand, Shallowest much more effective unlearning compared to Deepest, perhaps due to resetting earlier layers causing larger "disruption" to the information flow in the network. Indeed, contrary to Deepest, this strategy leads to poor test accuracy for several budgets, which is the main downside of this approach. We hope that future research considers this baseline alongside EU-k of Goel el. al. (2022). CritMem is unable to reach good unlearning quality in this setup. Note that we can only evaluate CritMem for small budgets, as the algorithm of Maini et al. (2023) terminates once enough paramoters are reset such that the prediction is flipped to an incorrect one (so the max value of a we can consider capped). We find that resetting only those parameters is insufficient for achieving good unlearning results when paired with this unlearning algorithm. SalLoc has similar trend Shallowest in terms of unlearning metries but leads to higher test accuracy. It performs similarly CritMem in the range where we compare them.
Building on these findings, we also compare the computational times of four localization strategies (Shallowest, CritMem, SalLoc, and DEL) across three different forget sets of varying sizes. As shown in Table 17 in the Appendix, CritMem is the most computationally expensive strategy, whereas Shallowest (or Deepest) is the least demanding. Both SalLoc and DELlocalization strategies exhibit comparable computational times, requiring only few seconds to exccute.
Overall, observe that data-agnostic localization strategies perform poorly: each of Deepest and Shallowest either achieve good forgetting quality at the expense of utility, or the other way around, but not both. We hypothesize that a data-dependent approach with finer-grained control of which shallow or deep parameters to update in a way that is informed by the forget set, would yield better trade-ofTs, due lo causing minimal and targeted "disruption" that preserves utility. We have considered two such data-dependent strategies so far, CritMem and SalLoc. CritMem, directly borrowed from Maini al. 2023, results in updating only a small number of parameters (due to its termination criterion) and unable to achieve good forgetting quality within that budget (and in the context of this unlearning algorithm), while it is also computationally
7

---

Published in Transactions on Machine Learning Research (10/2025)
Table 1: Combining different granularity and criticality criteria a non-iterative localization algorithm. The leftmost cell corresponds SalLoc, and the rightmost cell corresponds to our proposed approach. Each A is the difference, in the specified metric, between the unlearned and retrained models (smaller is better).
Parameter
Channel
Grads
Weighted Grads
Grads
Weighted Grads
A Forget 2.-
10.01
12-33
1.5810.0r 10.01
AMIA
8.74
- 16.3221.30
15. 15.53+1.10
3. 3.33+1.2 28
ATest
3e-3
11.55=de-3
1. 1.55+2e-3
4.41=2e-3
expensive, discussed above. SalLoc, the other hand, is more efficient and causes smaller Lest. accuracy drop compared to Shallowest.
5 Improved localized unlearning
In this section, building CritMem and SalLoc and formulate and investigate hypotheses about their suitability for localized unlearning. Our findings give rise to an improved unlearning algorithm.
previous observations, take deeper dive into key design choices of
5.1 Dissecting building blocks of localization
Granularity. Because attempts to locate where memorization occurs rely on heuristics and are imperfect, it is easier to succeed making coarse-grained decisions (e.g. there is a critical parameter somewhere within a given channel) rather than individual parameter-level assessments. Then, could it be that coarser granularity (as in CritMem) provides useful "smoothing" identify critical 'regions' and is less prror-prone than finer gramularity (as in SalLoc), though potentially the cost of selecting more parameters than strictly necessary?
Criticality criteria. We hypothesize that using weighted gradients (as in CritMem) rather than simply considering the magnitude of gradients themselves (as in SalLoc) is also more suitable for localized unlearning. Intuitively, a weight with a small value can be seen as less critical overall (for the training set) which an important additional signal to consider in addition to the gradients on specific forget set examples, as it may also serve as an additional useful "regularizer" when making hcuristic assessments.
Table investigates the effect of the granularity and criticality criteria mentioned above, in the context of batched and non-iterative localization algorithms, on the same experimental setup (dataset, forget set, etc) in Section 4. We find that indeed the best choice is given by using the channel-wise granularity and weighted gradients.
While Table reveals that CritMem's gramularity and criticality criterion are more suitable than SalLoc's for localized unlcarning, rocall that CritMem is computationally expensive: for cach given example, it determines the next most critical channel one at a time, resets it and repeats find the next most critical one, until the label of the example flips. In the next section, we propose approach that incorporates CritMem's granularity and its criticality criterion into efficient algorithm that, like SalLoc, estimates the critical parameters for each batch in S in "one-shot", and additionally operates on batches of examples in S.
5.2 Introducing our localization strategy and DEL
Given a forget set S and a model 0 with p parameters, for j E [1,...,p), let 0g and (0", represent. the weight and gradient values on the forget set, respectively, for the parameter at index j. We define the criticality score 8, of the parameter index j as the magnitude of the weighted gradient over the forget set: 8, = 183 ()(,,)) this the same criticality criterion used in CritMem, whereas SalLoc simply considers the magnitude of the gradient for each parameter (9,(0% S)] for assessing its criticality.
8

---

Published in Transactions on Machine Learning Research (10/2025)
Oracle
Random Label
NegGrad+
Reset + Finetune
45
75
40
82-
Forget eccuraty
score
-5
78
65
-0
60
20
72-
50
15
70-
Shallwest- 14%
CriMem- 16%
Salloc Solloc.22 20%
Durs 20%
Shallowest 25%
Salt oc 30%
Ours 30%
Shallowest 144
ChiMeem116 16%
Salt 200
Ours Ours-20%
Shallowest 25%
Salt oetoc.al 30-3%
Ours 00rs-30%
Shallowest 14%
CriMem-165 16%
Saltac 200% 20%
Ours -urs-20%% 20%%
Shallowest 25%
-55%
Saitcc SalLoc. 30%
Ours 300%
Figure 3: Pairing localization strategies / budgets (e.g. Ours-30% denotes applying our localization strategy to select 30% of parameters) with three unlearning algorithms, on CIFAR-10 / ResNet (the ideal behaviour is to match the "Oracle"). Ours has the best unlearning efficacy, paired with any unlearning algorithm, and its performance degrades much less than SalLoc's when the budget reduces from 30% to 20%; meanwhile, its test accuracy is comparable to other methods (better for the pairing with Reset + Finctunc).
As discussed above, we choose to determine criticality in a coarser-grained way compared to individual parameters. To that end, for output "channel" o, (or "neuron" more broadly, encompassing non- convolutional architectures),
describe how to obtain its criticality score Co, based on the criticality score of its constituent parameters. Let & be list of the criticality scores for the paramcters belonging to neuron 0i, sorted in descending order. We set the neuron crilicality Co, to be the average of the top scores of its associated parameters: Co. = 1 =
Finally, having obtained the neuron criticality scores, we put togother the mask ma for parameter budget o, represented as binary vector of size p, where a indicates the corresponding parameter will be updated by the unlearning algorithm, whereas another sorted list that sorts the neurons in descending order of their criticality scores. We then pick the largest number of neurons from the start of the sorted list, such that the total selected parameters are within the budget. Then, we assign a 1 to all entries of m, for parameters belonging to the chosen critical neurons and 0 to the rest. We provide pscudocode in Scction A.2.
entry of 0 indicates it will be kept unchanged. To this end, form
Our localization strategy can, in principle, be paired with any unlearning algorithm, and it in fact pairs well with several of them (see Section 6). We obtain the best results by pairing it with the simple Reset Finctune (RFT) algorithm. We refer to the combination of our localization strategy with RFT as Deletion by Example Localization (DEL).
6 Comparison to state-of-the-arr art and analyses
We carry out comprehensive experiments on three datasets and architectures (CIFAR-10 10 with ResNet-18, SVHN with ViT and ImageNeet1100 with ResNet-50; see Section A.3 for details), to examine the performance of our localization strategy paired with various unlearning algorithms, on different forget sets. We also conduct analyses on the factors determining the success of localized unlearning.
Our strategy outperforms the rest paired with any unlearning algorithm considered. From Figure 3, we observe that i) for each considered unlearning algorithm, our method yields the best results on the unlearning metrics (Forget accuracy and MTA score), ii) at the same time, its test accuracy is comparable to others in general, and better than others when paired with the Reset + Finetune unlearning algorithm.
DEL is the most robust to the parameter budget. Figure 2 shows that DEL most consistently yields strong results across several budgets, compared to other strategies. Figure 3 corroborates this finding in
9

---

Published in Transactions on Machine Learning Research (10/2025)
Oracle
Ll-sparse
N
Random Label
SaFLoc-RFT
DEL (Ours)
AIIA
AIIA
5
Aorget
Afoggtt
Drest (a) SVHN/VVI /VIT
Arest
(b) ImageNet-100/ReeNe..e
Figure 4: On SVHN / ViT and ImageNet100 ResNet-50, DEL outperforms full-parameter and localized methods in terms of unlearning quality. For each of the three axes(A forget, Atests AMTA), values closer to the center represent better performance as they are closer to the Oracle (red point at the center). L1-sparse has better test accuracy than DEL but has poor unlearning performance. This is for non-IID and ITD forget sets on SVHN VIT and ImageNet100 respectively, and a 30% for localized methods; see Tables 12 and 13 for full results.
the context of different unlearning algorithms too, showing that our localization method experiences much lower performance degradation compared to SalLoc, when the budget is reduced: we significantly outperform SalLoc when the budget is 20%.
Table 2: Subclass unlearning CIFAR-10 ResNet-18. DEL outperforms the state-of-the-an localized and full-parameter unlearning on CIFAR-10 / ResNet-18 on two forget sets in the subclass unlearning setting. For each metric m, Am moracle Manlearn lower absolute value is better. Note that SalLoc-RL corresponds to "SalUn" which uses Random Label, regarded as state-of-the-ar..
Non-IID Forget Set
IID Forget Set
Atoget
AMiA
Atost
forget
AMIA
Acest +
Retraining (Oracle)
0.00
0.00
0.00
0.00
0.00
0.00-0.00
Full- tall-parameter Unlearning
Fine-tuning
10.0
6.07 11.10
-.341_033 0.34
-1.98
1.9611.11
-2.0010.72
NegGrad+
4.44
4.92 14
4.61
1.87
1.89
4.21_0.07
NegGrad
00.30
3.76+0.94
4o.0
15.0440.40
15.39 _0.39_..39
-1.1 111611
Random Label
-1.6440.98
2.07
4.33.10.19
1.69
1. 1.6910.47
4.93_0.47
Ll-sparse 1t/
1.50
- -1.01
2.0740.61
1.80
1.80
0.62
5..0
5.04
4.18 4.1840.19
2.20
2. 29.93.
10.94
Unlearning
SSD)
11.1646.28
11.1846.29
2.68
1.60
1.59 1.98
11.58
Localized
CritMem-RL. RL (a 16%)
-1.82
1.87
4.86
2.03
2.05
4.36_0.37
Shallowest-RD RL (a 25%)
1.29
-0.00
3,8840.18
3. 3.41
3. 3.43
6.43-0.52
SalLoc-RR RL. (a = 30%)
-2.80
3.30
4.63
-3.81
3.80+0.30
4 4.29
DEL (a 30%)
0.43+1.0
0.64+1.23
2.23
0.97
0.97
1.87 .0.7
DEL performs strongly across datasets / architectures, unlearning settings, and forget set types. We compare DEL to state-of-the-an methods for unlearning, including ones that update all parameters, on different datasets. We also consider three different unlearning settings: subclass unlearning, class unlearning, and continual unlearning, as well as two forget set types in subclass unlearning setting: IID and non-IID forget
4The code adapted from https://gghhab..om//OPPMM.... Thineeerroonnnlllaaaalaeeey
10

---

Published in Transactions on Machine Learning Research (10/2025)
Table 3: Class Unlearning on CIFAR-10 / ResNet-18. DEL outperforms the state-of-the-art methods in class unlearning sctting (specifically for classes and 5) on CIFAR-10 / ResNet-11.
Class Unlearning (class 2)
Class Unlearning (class 5)
Method
A forget
Atest +
A forget
Atest
Retraining (Oracle)
0.00
1.00
0.00
0.00
Fine-tuning
0.05
1.63
3.78+1.19
1.4640.13
NegGrad+
3.70+0.13
0.75+0.18
-6.92=0.13
1.95
NegGrad
3.30
0.92
-6.73+0.06
2.09+0.08
Random Label
-11.25+0.44
0.64
-11.93
0.04
1.I-sparse
0.00
-1.78 1..88
0.00
-1.8610.23
Shallowest-Ri RL (a= 25%)
4.02+0.62
6.63
-2.27=0.10
6.59
SalLoc-RL (a = 30%)
-12.7220.12
2.07
-10.97
1.17
DEL (a = 30%)
0.00=0.00
0.79
0.00+0.00
0.76+0.25
Table Continual Unlearning, on CTFAR-10 / ResNet-18. DEL outperforms the state-of-the-art methods in a continual unlearning setting (specifically, unlearning classes followed by class 5) on CIFAR-10 ResNet-18.
Retraining (Oracle)
Fine-tuning
L1-sparse
Shallowest-RFT
SalLoc-RFT
DEL
(a = 25%)
(a 30%)
(a = =0%)
Aooget
0.00_a.00
1..9
3..6
-...9 10.76
3.80
10.49
Ates
0.00=a.00
-1.7340.19
20.77
5.71
4.03
0. 0.76
AMIA 4
0.00=g.00
9.96
3.67
4.40g0.75
3..83
0.84=20.4
sets (details in Section A.3). An IID forget set comprised of 10% of randomly-chosen training samples, and non-IID forget set of the same size, but choosing samples belonging to a subset of the classes. We present the results in Table 2, Table 3, Table 4, Figure 4 as well as in Table 12, Table 13 and Table 18. For each localized unlearning strategy and on each dataset, budget and its best-paired unlearning algorithm for that setting. We find that DEL is the most consistent mothod in delivering strong results across the board. On all settings considered in CIFAR-10 / RcsNet-18 and ReeeeeeeetO//RReeeeeeee
report results using its best identified parameter
it sets a new stale-of-the-arl in terms of both unlearning metrics, while also outperforming all localized methods in terms of test accuracy too. The same true for SVHN's Non-TID forget set, while on the I1D forget set, we observe that exceptionally, some full-parameter methods outperform DEL (and other localized methods) in one unlearning metric (but not the other). We later investigate why localized unlearning yields less pronounced gains on IID forget sets. Overall, DEL is the most consistent. approach in achieving the strongest unlearning results, with the smallest test accuracy drop compared to localized methods.
Furthermore, we investigate the scalability of DEL by introducing two additional forget set sizes, comprising 30% and 60% of randomly selected samples from the training set of the CIFAR-10 CTFAR-10/ResNNtt (e/eeeeet-118 experiment. As presented in Table 16 in the Appendix, DEL consistently demonstrrats robustness across varying forget. set sizes and achieves higher performance than the competitors in all settings.
Localized unlcarning succeeds due to selecting critical parameters, not just a smaller number of them. We design a control experiment to investigate to what extent the success of localized unlearning depends on which parameters are chosen (rather than simply how many). To this end, we compare the mask produced by each localization stratogy to a "random mask" that constructed to follow the same structure and distribution of the number of chosen parameters per layer as the corresponding non-random mask. For example, to create the random mask that CritMem will be compared with, we randomly select a number of
11

---

Published in Transactions on Machine Learning Research (10/2025)
channels for each layer equal (but randomly selected this time) to the number of channels that CritMem selects for that layer. Table 5 indicates that success in unlearning metrics is indeed due to pinpointing critical parameters but interestingly, a random selection of parameters is better for the test accuracy metric. This is likely due to the fact that parameters that are critical for the forget set are generally important (for all examples), so resetting them causes a drop test accuracy too. This highlights a fundamental tension in unlearning (unlcarning some examples while preserving performance).
Table 5: Control experiment:
comparison to a random mask on CIFAR-10 / ResNet-18 (RFT unlearning, a = 16%) Lower absolute values of A indicate better performance.
Standard Masking
Random Masking
CritMem
SalLoc
Ours
CritMen
SalLoc
Ours
A forget
13.25
8.26
-.866_1.99
18.60
13.26
8.58
AMIA $
1..73
8.75+1.09
3.36+1.27
19.09
1..78=1002
9.07
Ause +
2.85
3.50
2.62+0.22
1.99
1.97
1.89
Is localized unlearning better due to tailoring to S? We design a set of experiments to investigate this by changing the criticality criterion. Specifically, we choose two criteria that are not specific to the forget set S: the first uses only the magnitude of the weights ("wcights"), and the second uses weighted gradients, but where the gradients this time are over all of Drrain rather than just S ("Weighted gradients (train sct)"). Our rationale is that, if either of these forget-set-agnostic criteria works equally well as our method's criterion ("Weighted gradients (forget set)"), this would suggest that the success of our method is not due to specialization to but rather finding parameters that are "generally critical" for the training data. We observe from Table 6 that, for the IID forget set, the above two criteria that depend on Dirain rather than S specifically, yield more similar results to our criterion. This is reasonable since the forget and train follow the same distribution in the IID forget set case. On the other hand, for the non-IID forget set, we do observe that tailoring the criticality criterion specifically to S yields better unlearning performance. We take away that i) the success of different localization strategies is dependent on the distribution of the forget set, ii) our method (shaded gray area in the table) is a top performer in all cases.
7 Discussion and Conclusion
We investigated localized unlearning informed by hypotheses for where memorization happens, leading to a new localization strategy that is more efficient than the algorithm from the memorization literature that it builds upon, while outperforming prior work on several metrics, when paired with different unlcarning algorithms. DEL (the pairing our localization stralegy with reset-and-finetune unlearning), a top performer on different forget sets, datasets and architectures and parameter budgets. We find that the success of localized unlearning in terms of forgetting quality is indeed due to pinpointing critical paramcters to act on, rather than smaller number. But our results also suggest that parameters that are critical for the forget set may be critical overall, leading to fundamental tensions between unlearning while preserving utility. We also find that for non-lll forget sets, tailoring the parameter selection to the specific forget set (rather than the training set more broadly) is more important than it is for IID forget sets. DEL is a top performer in all scenarios.
So, does locating memorization inform unlearning? Hase al. (2024) find that, for model editing in LLMs, the "causal tracing" method (Meng et al., 2022) for knowledge localization, surprisingly, does not indicate which layer modify in order to most successfully rewrite stored fact with new one. That is, they find that success in editing tasks is generally unrelated to localization results based on causal tracing. Guo el al. (2024) study whether mechanistic interpretability insights improve unlearning of "factual associations" in LLMs. They also find that localization techniques based on preserving outputs (such as causal tracing) yield performance that no better, or even worse, than non-localized unlearning. However, they come up with a mechanistic unlearning method that does outperform both output- based localization and non-localizod unlearning, showing that some form of localization is useful. Our results, in the very different context of
12

---

Published in Transactions on Machine Learning Research (10/2025)
Table 6: Investigation of different granularity and criticality criteria in a non-iterative localization algorithm (a=15%) on IID and Non-IID forget set. The shaded region corresponds to our method.
Non-IID forget set
forget set
Weighted gradients (train set)
Weighted gradients (forget set)
Weighted gradients (train set)
Weighted gradients (forget set)
Gradients (forget set)
Gradients (forget set)
Granularity
Weights
Weights
Individual
Arsegst
se-8
16.50
24.03
15.07 11-55
6.7220.41
11.67
11. 21.19
11.15 g1.05
Arest
3. 24-3
10.80
10-30
2.
11.11
g0.90
parameter
Amn
8.74
14..73
13.89
16.32241.0
6.81
11.6820.00
-11.21
-11.13
Oulput channel
Aorgot
-12.33
6.02
2..02
1.08
-5.18.0.4
1.33
1.69_0.6
0. 0.65:0.00 0..5
Atent
1.55 22-5
3.61
3.52
=2--
1.26:0.54
2 2.86:045
2.27
3.05
Asna 4
15.58
-1.02
6.73
3.33
5.16
-1.40
1.67=0.68
0.69
unlearning a subset of data in vision classifiers, offer an important data point in this ongoing discussion. In line with Hase et al. (2024), we find that directly translating memorization hypotheses into localization strategies does not help unlearning: Deepest led to very poor unlearning results (demonstrating either its weakness as a memorization locator, or the disconnect between memorization localization and unlearning performance), and CritMem, while showing more promise, did not perform better than simple baselines, while being significantly more expensive than them. However, insights from Maini et al. (2023), in particular regarding the gramularity and criticality criterion used during localization led to improve upon the state-of seate-of-the-att localized and full-paramcter unlcarning methods, renewing hopes that, while memorization localization and unlcarning may be separale research questions, progress in the former may guide progress in the latter.
Acknowledgments
This work was supported by Google Ph.D. Fellowship to Reihanch Torkzadehmahani. The authors of this work take full responsibility for its content
References
Devansh Arpit, Stanistaw Jastrzebski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxinder S Kanwal, Tegan Maharaj, Asja Fischer, Aaron Courville, Yoshua Bengio, et al. A closer look at memorization in deep networks. In International conference on machine learning, pp. 233 242. PMLR, 2017.
Idan Attias, Gintare Karolina Dziugaite, Mahdi Haghifam, Roi Livni, and Daniel M Roy. Information complexity of stochastic convex optimization: Applications to generalization and memorization. arXív preprint Krv:24200 09327, 2024.
Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton. 1XXiv:667.006500 2016.
Layer normalization. arXiv preprinl
Robert Baldock, Hartmut Maennel, and Behnam Neyshabur. Deep learning through the lens of example difficulty. Advances in Neural Information Processing Systems, 34:10876-10888 2021.
Lucas Bourtoule, Varun Chandrasckaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernol. Machine unlearning. In 2021 IEEE Symposium on Securily and Privacy (SP), pp. 141-159 IEFE, 2021.
Gavin Brown, Mark Bun, Vitaly Feldman, Adam Smith, and Kunal Talwar. When is memorization of irrelevant training data necessary for high-accuracy learning? In Proceedings of the 53rd ansuual ACM SIGACT symposium on theory of computing, pp. 132-1 2021.
Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE symposium securily and privacy, pp. 463 480. TEEE, 2015.
13

---

Published in Transactions on Machine Learning Research (10/2025)
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 TEFE conference computer vision and pollern recognation, pp. 248 255. leee, 2009.
Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. ar preprint arXiv:2010. 11929, 2020.
Cyuthia Dwork, Differential privacy. In International colloquium on automato, languages, and programming, pp. 1-12. Springer, 2006.
Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. arxiv preprint 2rXit:2310.1185 12508, 2023.
Vitaly Feldman. Does learning require memorization? a short tale about long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, pp. 954-959, 2020.
Vitaly Feldman and Chiyuan Zhang, What neural networks memorize and why: Discovering the long tail via influence estimation. Advonces in Neural Information Processing Systems, 33:2881-2891, 2020.
Jack Foster, Stefan Schoopf, and Alexandra Brintrup. Fast machine unlcarning without retraining through selective synaptic dampening. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 12043 12051, 2024.
Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems, 32, 2019.
Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponmurangam Kumaraguu. Towards adversarial evaluations for inexact machine unlearning. arXie preprint Nii:22011006440 2022.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1804-9312, 2020a.
Aditya Golatkar, Alcssandro Achille, and Stefano Soatto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In Compuler Vision MECC 2020: 16th Furopean Conference, Glasgow, UK, August 23 28, 2020, Proceedings, Part XXIX 16, pp. 383 398. Springer, 2020b.
Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 11516-11524, 2021.
Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. arXiv preprint arXiv: 1ttt:9911.0000 2019.
Phillip Huang Guo, Aaquib Syed, Abhay Sheshadri, Aidan Ewart, and Gintare Karolina Dziugaite. Robust knowledge unlearning via mechanistic localizations. In ICML 2024 Nexl Generalion of AI Safely Workshop, 2024.
Peter Hase, Mohit Bansal, Been Kim, and Asma Ghandeharioun, Does localization inform editing? surprising differences in nausality-based localization vs. knowledge editing in language models. Advances in Neural Information Processing Systems, 36, 2024.
Jamie Hayes, Ila Shumailov, Eleni Triantafilou,, Amr Khalifa, and Nicolas Papernot Inexact unlearning needs more careful ovaluations to avoid a false sense of privacy. arXiv preprint MiX.:2443.00215 2024.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pottern recognition, pp. 770-778, 2016.
Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning, pp. 448-456. PMLR, 2015.
14

---

Published in Transactions on Machine Learning Research (10/2025)
Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. Approximate data deletion from machine learning models. In International Conference on Artificial Intelligence and Statistics, pp. 2008 2016. PMLR, 2021.
Matthow Jagiclski, Om Thakkar, Florian Tramer, Daphne Ippolito, Katherine Lec, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, et al. Measuring forgetting of memorized training examples. arXiv preprint arXiv:2207.0 20000909000009, 2022.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International conference machine learning, pp. 1885 1894. PMLR, 2017.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Meghdad Kurmanji, Peter Triantafilouu, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning. Advances in neural information processing systems, 36, 2024.
Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, PRANAY SHARMA, Sijia Liu, et al. Model sparsity can simplify machine unlearning. Advances in Neural Information Processing Systems, 36, 2024.
Pratyush Maini, Michael C Mozer, Hanie Sedghi, Zachary C Lipton, J Zico Kolter, and Chiyuan Zhang. Can neural network memorization be localized? In International Conference on Machine Learning, 2023.
Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in gpt. Advances in Newral Information Processing Systems, 35:17359-17372, 2022.
Seth Neel, Aaron Roth, and Saeed Sharif--Malvajerd: Descent-to-delete: Gradient- methods for machine unlearning. In Algorithmic Learning Theory, pp. 931-962, PMLR, 2021.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop deep learning and unsupercised feature learning, volume 2011, pp. 4. Granada, 2011.
Garima Pruthi, Frederick Liu, Satyen Kale, and Mukund Sundararajan. Estimating training data influence by tracing gradient descent. Advonces in Neural Information Processing Systems, 11-19920-19930 2020.
Seonguk Seo, Dongwan Kim, and Rohyung Han. Revisiting machine unlearning with dimensional alignment. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 3206 3215. IEEE, 2025.
Cory Stephenson, Suchismita Padhy, Abhinav Ganesh, Yue Hui, Hanlin Tang, and Yeon Chung. On the geometry of generalization and memorization in deep neural networks. arXiv preprint arXiv:2105. 11211055140000 14602, 2021.
Anvith Thudi, Gabriel Deza, Varun Chandrasckaran, and Nicolas Papernot. Unrolling sgd: Understanding factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Securily and Prinacy (EuroS&P), pp. 303 319. IEEE, 2022.
Mariya Toneva, Alessandro Sordoni, Remi Tachet des Combes, Adam Trischler, Yoshua Bengio, and Geoffrey J Gordon. An empirical study of example forgetting during deep neural network learning, or preprint 1xXiu:1812.051 2018.
Fleni Triantafilou, Peter Kairouz, Fabian Pedregosa, Jamie Hayes, Meghdad Kurmanji, Kairan Zhao, Vincent. Dumoulin, Julio Jacques Junior, Ioannis Mitliagkas, Jun Wan, et al. Are we making progress in unlcarning? findings from the first neurips unlearning competition. arXiv preprint arXiv:2 09073, 2024.
Phil Wang. Vit for small datasets. http::///tttoooooo/ccceeeetssssp pytorch/vit, for small dataset.py. 2021.
15

---

Published in Transactions on Machine Learning Research (10/2025)
Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, and Xiaodong Lin. Arcane: An efficient architecture for exact machine unlearning. In IJCAT, volume 6, pp. 19, 2022.
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Commumications of the ACM, 64(3):107 115, 2021.
Kairan Zhao, Meghdad Kurmanji,
Bärbulescu, Eleni Triantafillou, and Peter Triantafilou. What makes unlearning hard and what to do about it. ar preprint orX:::2406.01257, 2024.
A Appendix
A.1 Unlearning definition
In this section, we discuss an alternative formal definition of unlearning, proposed in Ginart et al. (2019); Neel et al. (2021), using a notion closely related to Differential Privacy (Dwork, 2006).
Definition A.1. Unlearning-2. For a training algorithm A, an algorithm U is an (e. (.ll-nnlrrnerr if, for any training dataset Dtrain and forget set S, the distributions of t(Dtrain SS) and U(80, S. Durain \ (S) are (e, 8)-close, where we say two distributions μ, v are (e, cclose if μ(B) S eBv(B) + and v(B) S e u((( for all events B.
Intuitively, the above compares (the distribution of) models that are obtained by two different recipes to one another:
A(Dtrain \ [), retraining "from scratch" on only the retain set, which is prohibitively expensive but ideal from the standpoint of eliminating the influence of on the model, and
=1000, , Durain \ S), applying U to post-process the original model 0 in order to unlearn S.
A successful unlearning algorithm U is one that causes these two recipes to yield similar models, with the second recipe being substantially more computationally-effcionn compared the first, in order to justify paying the cost of approximate unlcarning rather than simply using the first recipe directly.
Note that refer to distributions here since re-running either of the two recipes with different random seed, that controls the initialization the order of mini-batches, for example, would yield slightly different model weights in each case. The above definition therefore measures unlcarning quality based on the notion of (e, -cclosenessss between the two distributions. The smaller e and d are, indicating increased closeness, the better the unlearning algorithm.
Relationship and differences our definition This definition compares distributions in weight space, whereas our Definition 2.1 compares distributions of oulpuls of models on the forget set. We opted for the latter in the main paper as it more closely reflects the metrics use for evaluation (which are the standard metrics used in unlearning papers). Note that, even works that adopt definitions in weight-space end up operationalizing them using outputs of models (Triantafillou et al., 2024) instead of performing weight-space comparisons. This is for several reasons: comparing weights of models directly may be inappropriate since Weight space is also much higher dimensional, posing challenges
neural networks are permutation-invarian in creating the right metrics, and, finally, ultimately what we may care about for various applications of interest the "behaviours" (e.g. predictions) of models, rather than their weights. Definition 2.1 captures this more dircetly.
A.2 Pseudocode
A.3 Experimental Setup
Datasets The CIFAR-10 dataset (Krizhevsky et al., 2009) consists of 50, 000 train and 10, 000 testt images of shape 32x32 from 10 classes. The SVHN dataset (Netzer al., 2011) includes 73, 257 train and 26, 032
16

---

Published in Transactions on Machine Learning Research (10/2025)
Algorithm 1: Our localization strategy
Input: Original model 8 with p parameters, forget set S, parameter budget Output: Localization mask ma
// Compute criticality score for each parameter
for j +-1 1 to p do
$/ 0;
for Mini-batch B E S do
4
for j + to do L 8j - 8 + 0j 9, ())
5
// Consider only the magnitude of each weighted gradient for j +--11 to p do
8/ - |syl;
1/ Compute criticality score for each output channe I/neuron 3 4 Ssr;
for a E f do
Co + n Σ -
10
// Construct localization mask
ē Sort(c);
12 Ma < Ei Ko,1 S (p a)):
test samples. The samples are shape 32x32 pixel, and from 10 classes. The ImageNet-100 (Hugging Face version) dataset is subset of ImageNet (Deng et al., 2009), containing 126, 689 train and 000 test samples from 100 classes, randomly selected from the original ImageNet classes. The resolution of the images on the shortest side is 160 pixels.
We perform no preprocessing or augmentation on the images of CIFAR-10 and SVHN, except dividing the feature values by 255. For ImageNet-100, on the other hand, we randomly crop the train images to size 128 x 128, and horizontally flip them. Moreover, we first resize the test images to 160x and then center-crop them to 128x128, We normalize the features of both train and test images with the mean and variance of TmageNett
For the unlearning experiments, we employ three different unlearning settings: (1) sublcalss unlearning, (2) class unlearning, and (3) continual unlearning. For subclass unlearning, we consider two different forget sets: (1) IID, where we uniformly select approximately 10 percent the images from the train set, and (2) NonIID, in which we randomly select half of the samples from two classes (2 and 5 in CIFAR-10, and and 6 in SVHN) so that the size of the forget set is almost 10 percent of the train set. Note that in the former, the distributions of the samples in the forget and retain sets are highly similar, whereas in the latter, the sample distribution of the forget set is very different from that of the retain set. In class unlearning, the forget set comprises all training samples from the target class (e.g., class 2 and class 5 in CIFAR-10). However, continual unlearning involves scquentially adding randomly selected half of the samples from each target class to the forget set. More specifically, for the first unlearning task unlearning class 2 from the pretrained model the forget set consists of a randomly selected half of the samples from class 2 in CIFAR-10. For the second unlearning mask-unlerrning classes 2 and 5 from the model, already unlearned class 2 2-the forget set includes randomly selected half of the samples from both classes 2 and in CIFAR-10. We further extended our continual unlearning experiments on the CIFAR-10 ResNet-18 setting by adopting longer forgetting sequence (class + class 5 class 3- - class 4).
We capitalize on the original implementation of ResNet-18 and ResNet-50 (He et al., 2016) from PyTTrch and the implementation of Vision Transformer (ViT) (Dosovitskiy, 2020) from Wang (2021). ResNet- 18 and ViT contain around 11 million parameters, whereas ResNet-50 has approximately 25 million parameters.
Models
17

---

Published in Transactions on Machine Learning Research (10/2025)
Due to the low-resolution nature of CIFAR-10, we replace the first convolutional layer of ResNet-18 with new convolutional layer with kernel size of 3x3, and remove the max-pooling layer.
Note that the architectures of the considered models are very different from each other. MeesNet-18/50 are convolutional (Conv) networks with an imput Conv layer, multiple residual blocks, and a final classifier layer. The normalization layer of ResNet-18/s5 18/50 is batch normalization (Toffe Szegedy, 2015). In ResNet-18/55 the input images are downsampled multiple times so that deeper layers operate on smaller input tensors. However, deeper layers have more filters (and thus, more trainable parameters) than shallower layers.
The VIT architecture, on the other hand, employs linear (fully-connected) and multi-head attention layers as its main building blocks. It first divides the input images into square patches (e.g., of shape 8x8) and gives them as tokens (after some preprocessing, including positional encoding) to the encoder blocks. No downsampling is performed on the input tensors by the encoder blocks. Moreover, all (i.e., both deeper and shallower) encoder blocks have an identical number of trainable paramcters. The normalization layer of ViT architectures is layer normalization (Ba et al., 2016).
In more detail, our VIT model employs patch size of 8x8 and contains 4 transformer layers with hidden size of 512. Each layer consists of a multi-head attention block and a projection block. The number of heads and the head size in the attention blocks are and 64, respectively. The multilayer perceptron (MLP) size of the project blocks is 1536. The dropout probability of the dropout layers is zero. The CLS token is used for the classification. The model size is around 11 million parameters. Note that we used the terminogly (e.g. hidden size and MLP size) from Table 1 of the original ViT paper (Dosovitskiy, 2020) in our model description.
Training For the original (pretrained) models, train ResNet-18 on CIFAR-10 and ViT on SVHN (i.e. the training set of the datasets) for 50 epochs using the SGD optimizer with momentum of 0.9, cross-cntropy loss function, and batch size of 128. The base learning rate values are 0.1 and 0.05 for CIFAR-10 / ResNet-11 and SVHN / ViT, respectively, which are gradually decayed by a factor of 0.01 using the Cosine Annealing scheduler. For the oracle model (gold standard), we train the model from scratch only on the retain set, following the same procedure employed for the pretrained model, except the number of epochs, which we set to 20, and the learning rate, which is half of that in the original training. In the tables below, provide the hyper-pee pprr-par values for the approximate unlearning algorithms. We repeat each experiment three times and report the average values along with 95% confidence interval.
Table 7: Learning rate tuning.
Scheduler
Parameters
Finetuning/ 11-sparse
CosineAmeelliggl.RR
Tmii 0.01 * Iranit
Random Label
CosineAmea
Tmii 0.5 Irentt
EeGGradd/Negrree
Constant
Non-IID IID forget set
IID Forget set
[Tbest
candidate values
Irbest
Candidate values
Finetuning
1.25
[0.5, 1.5]
1.25
[0.5, 1.5]
11-sparse
0.5
10.1, !]
0.5
[0.1, 1]
Random Label
7
[5e-3, 1c-2
6e-3
[5e-3, 1e-2]
NegGrad+
7c-4
[5c-4, 1c-3
0.14
[0.1, 1]
NegGrad
7
[5--6, 1e-5
4e-3
[1e-3, 5e-3]
CritMem-RL (a 16%)
0.02
[0.01, 0.1]
0.02
[0.01, 0.1]
Shallowest-RL (a 25%)
7c-3
[5-3, 1o-2
7c-3
[5e-3, 1o-2
RalLoc-RI. (ax = 30%)
0.012
[5-3, le-2
0.012
[5e-3, 1e-2]
DEL (a 30%)
0.015
[5e-3, 1c-2
0.015
[5e-3, 1e-2]
18

---

Published in Transactions on Machine Learning Research (10/2025)
The SSD algorithm incorporates two key hyperparameters: a, which governs parameter selection, and X, which controls weight dampening. Table 8 summarizes the best hyper-parameter tuned for each setting, along with the resulting parameter budgets.
Table 8: Hyper-parameles luning of the SSD algorithm and the corresponding parameter budgets.
Non-IID forget set
IID Forget set
dataset/model
Obest
Abest
parameter budget
Orbest
Abest
parameter budget
MIFAR-10/ResNetaa
16
1
0.5%
1
28%
SVHN/ViT
5
3
0.1%
5
3
33%
SaggeeNeet-00/ReNetttt
2
2%
A.4 Metrics
Following Fan et al. (2023), we employ accuracy and membership inference attack (MIA) score to evaluate the effectiveness of different unlearning algorithms.
To compute MIA score, a support vector classifier (SVC) is trained on top of outputs coming from the unlearned model for the task of predicting whether an example was used in training or not. This is performed through supervised learning where the test set is used as "unseen data" and subset of retain set (with the same size and similar label distribution to the test set) as "seen data". Specifically, the SVC is trained the "prediction" outputs (i.e. the integers representing the index of the predicted class), aiming to distinguish predictions from seen versus unseen data. Then, the trained classifier is utilized to predict if each sample in the forget set belongs to the seen or unseen data on the unlearned model. Given that, MTA score is computed as follows:
TN
MIAgcore score
[8]
where TN is the number of true negatives, i.e. forget samples that the classifier recognizes as likely unseen data for the unlearned model, and |S] is the size of the forget set.
Intuitively, a higher value of MIA means that the unlearned model has been more successful in "fooling" the SVC classifier (i.e. the "membership inference attacker") into thinking that the forget set was not used in training. However, to interpret how high we expect MTAscore to be for an unlearned model, we must consult. the reference point of how high this quantity would be for model retrained from scratch without the forget set. Note that, even in that case of "ideal unlearning", MIA,core is not necessarily 100%, and in fact it can be much lower than this. This is because, some examples in the forget set might be so "easy" Chat, even without ever seeing them, the retrained model can still be equally accurate on those examples as it would have been if they were actually included in training. This would lead to its MIAscore being lower, since some forget set examples would be classified as "seen" " by the SVC. For this reason, in our experiments, we use the reference point as the MTA obtained from pdtrain-from-scratchl as the optimal value for this metric. An ideal unlearning algorithm would, therefore, match that value.
A.5 MIA Evaluation
In this section, present MIA evaluation results using various MIAs for each model-dataset combination.
We compare two MIAs that leverage the model's (i) correctness (Table 10) and (ii) confidence (Table 9). Specifically, we train an SVC to distinguish between the seen (train) and unseen (test) data using cither (i) the predictions (i.e. the integers representing the index of the predicted class) of the unlearned model on retain and test examples or (ii) the confidences (i.e. the Softmax values associated with these predicted labels) of the unlearned model on these examples. The results for the first variant (correctness based MIA) are already presented in Tables and 12, with summary provided in Table 10 in this section. Here, we expand the MIA evaluations by incorporating the second variant. beonfidence-based MTA).
19

---

Published in Transactions on Machine Learning Research (10/2025)
According to Table 9 and 10, the absolute value of AMIA values are larger when using the confidence-baseee MIA compared to the correctness-baxe MTA. Since the model's confidence retain and test samples provides more information than its predictions on these samples, providing the SVC with confidence values results in a stronger MIA than using the predictions.
Additionally, in the CIFAR-10 / ResNet-18 setting, we observe that our localized unlearning algorithm significantly outperforms the other comparison methods across all evaluated MIÁs for both IID and non- forget sets. Similarly, in the ViT-SVHN setting with non-IID forget sets, method outperforms the other methods in both correctness-basee and confidence-baset MIA evaluations. However, when the forget set is IID in SVHN / ViT setting, for both MIA variants there exists a full-parameter unlcarning algorithm (sometimes multiple, depending on the type of MIA) that outperforms all the localized unlearning algorithms, including our method, terms of MIA evaluation. For example, Fine-tuning yields a more effective confidence based MTA, while Fine-tuning, Random Label, and L1-sparse demonstrate enhanced performance correctness- based MIA compared to the localized unlcarning algorithms. This is an interesting observation that we hope future work will investigate further.
Table 9: Confidencc-basedd MIA evaluation (AMIA)
CIFAR-10
ResNet-18
SVHN / VIT
IID
Non-IID
IID
Non-IID
Full- Full-parameteo Unlcarning
Retraining(Oracle)
0.00
0.00
0.00
0.00
Fine-tuning
6.24
6.23
11.97 10.32
13.85
N
3.60
11.27+1.19
19.40
3.75
NegGrad
28. 28.1810.87
10.4420.83
12.4740.25
29.02=1.03
Random Label
-3 31.55
- -19.9641.40
15.56-2.45
-6.4443.68
L1-sparse
4.35
10.4912.17
-7.74_0.58
7.62.0.75
RL (a 16%, 1%)
31.5611104
14.0812.58
13.1210.24
32.80
Localizod Unlearning
Shallowest-Rl./RFT
25.87
18.39
16.8341.05
2.518.54
(a= 30%)
Sall.o-RRI/RFFT (a 30%)
-0..24.0.80
-14.1511.76
17.77710.2
1.67 10.92
DEL (a 30%)
0..9
-0.90+1.20
-5.48
1.12
Table 10: Correctness- MIA evaluation (AMIa)
CIFAR-10
ResNet-18
SVHN / VIT
IID
Non-lII
IID
Non-IID
Full- cill-paramttor Unlearning
(etraining(Oraccle)
0.00
0.00
0.00
0.00
Fine-tuning
1.9641.11
6.07+1.10
1.05
11.22+4.65
NegGrad+
1.89
4.92
6.99
1.86
NegGrad
15.30=n.39
3.76+0.94
8.00
19.70+
Random Label
1.69
2.07
-2.82
5.13
L1-sparse
-1.80
-1.01
2.43
8.66
CritMem--Rl RL (ar 16%, 1%)
2.05
1.87
8. 1.166.222
20.71
Localized Unlcarning
Shallowest-RL/RFZ (a= 20%,
3 3.43
0.80
6.80
-5.24
SalLoo-RI/RFT (ar 30%)
3.8040.39
3.30
4.55+0.32
-1.71
DEL (a 30%)
-0.97
0.64+1.23
-4.66
-0.78
20

---

Published in Transactions on Machine Learning Research (10/2025)
A.6 Measuring utility via retain Accuracy
Table 11 presents the retain performance when pairing various localization strategies and unlearning algorithms. The retain performance is mcasured as the difference between the accuracy of the oracle and unlearned models the retain set (Aretain Oracleretain Unlearm The experiments are conducted using the ResNet-18 model on the CIFAR-10 dataset with a non-llD forget set consisting of 10% of randomly selected training samples. This table provides an extension of the evaluation metrics shown in Figure 3.
In terms of retain accuracy, the performance our method is comparable to, or sometimes exceeds, the other methods of comparison. By updating only a small portion of parameters (20% or 30%) as suggested by our localization strategy, unlearning algorithms such as Random Labeling and Reset + Finetuning can achieve the Oracle retain accuracy.
Table 11: Retain performance (Aretain) of combining different localization strategies and unlearning algorithms. The retain accuracy values from the unlearned models are provided in (-).
Localization
Unlearning Algorithm
Strategy
(a parameter%)
Random Label
NegGrad+
Reset + Fineture
CritMem(a 16%)
7.36_0.01
(9..6320.09)
0.01
(99.98.0.o05)
0.02 (99.97.0.0z)
Shallowest(a - 14%)
7.63_o.02
(92.36.0.04)
0.02
(99.98.0.02)
0.013 00000 g0004)
Shallowest(a = 25%)
7.41
(9..58
0.000
(99.96.0.04)
0.007
(99.99+0.006)
SalUn(( 20%)
(92.23 7.76
0.05
(99.94.0.oz)
0.001
(99.99
SalUn(a 30%)
6.94_0.04
(93.06+0.04)
0.05
(90.94_0.00o)
0.00 (100.00go.oo)
Ours(a 20%)
6.97_0.02 (93.0240.05)
00.007
(99.95...oo)
0.00
(100.00+0.00)
Ours(a 30%)
6.03 (93.1610.06)
0..0s (99.95
0.00 (100.00
A.7 SVHN / ViT and ImageNet-100/ / ResNet-50 Experimental Results
The full results corresponding to Figure 4 are detailed in Tables 12 and 13.
Table 12: Comparison to statc-of-tho-art, including algorithms that update all paramcters ("Full-Paramoter") on Non-IID and IID forget set when training a VIT model on SVHN dataset.
Non-IID Forget Set.
IID Forget Set
A forget
AMra
Atsat
A forget
Aura
Arsat
Full- pallamrtretrr Unlearaing
Retraining( (Oracle)
0.00
0.00
0.00
0.00
0.00
0.00
Fine-tuning
11.27 es
11.22 85
0.76
2. 2073
1.05
0.91
NegGrad+
3.45
3.38
2.32+0.27
3.22+4.58
6.90
3.75
NegGrad
19.75
19.70go.53
0.10
11.781a36
8.00
0.58
Random Label
5.20
5.13
3.22+0.07
0.96
2.822=046
3.69
L.1-paase
1..721034
8.66
0.24
1.36
-
1.52
IU
1.57
5.04g0m1
3.11
1.45go
-5.25
12.41gom
Localized Unicarning
SSD
2.83
22.95
3.30
7.26
- -1..09+0.5
13.26
CritMem- RL. (a = 1%)
20.77.022
20.71
-0.4510.11
-11.941935
8.1610.22
0.08
Shallowest-RFFT
5.20
-3.24
3.78
3.09
-6.8920.66
3.56
(a 30%)
SalLocRRFT (a = 30%)
1.71
-1.712031
2.55
0.78
4.55
3.68
DEL (o = 30%)
0.75
-0.78
0.78
0.46
-4.26
0.89 10.9
21

---

Published in Transactions on Machine Learning Research (10/2025)
Table 13: Comparison to state-of-the-art, including algorithms that update all parameters ("Full-Parameter" and "Localized" unlcarning on the IID forget set when training on ImageNet-100 with ResNet-50. DEL outperforms the state-of-the-art across all unlearning metrics while having the best test accuracy among all localized unlearning methods.
A forget +
AMIA +
Atsst
Retraining (Oracle)
0.00
0.00
0.00
Full-Parameter Unlearning
Fine-tuning
6..6
6.34
0.54..10.95
Full-Paranne
NegGrad+
-3.18
2.54
5.09
NegGrad
5.13
-5.65.8.14
19.68.16.60
Random Label
5.18+1.69
-5.4941.03
5.96
Ll-sparse
-5.58 11.32
4.7610.94
1.06
Localized Unlearning
SSD
14.111+1.96
13.71=1.80
5.44
Shallowest-RFT (a = 30%)
-1.69
2.36
11.72
SalLoc-RFT (a 30%)
1.36
-2.1941.78
6.09 20.98
DEL (a 30%)
0. 0.78+1.55
-1.7441.85
5. 5.20+1.08 1.00
A.8 New evaluation metric
We employ a new metric to enable more fine fin-graiied comparison of unlearning methods. This metric is defined as the proportion of samples that are misclassified by the oracle model but correctly classified by the unlearned model, normalized by the total number samples. Consider the following example: the ground-truth [1, 0, 0, 1, 1], an oracle predicts [1, 0, O, 0, and the unlearned model predicts [0, 0, 1, Il, the value of the new evaluation metric is 2/5-0.4 while the difference between the oracle accuracy and unlearning accuracy is O. The accuracy metric in this example is mislcading because the oracle and unlcarning models misclassily lotally different subsets of samples, but the new metric does not suffer from this issue.
As shown in the following Table 14 and Table 15, DEL outperforms the baseline methods across different datasets (CIFAR10, SVHN and ImageNet100), models (ResNet18, ResNet50, and ViT), forget set types (IID and Non-IID), and forget set sizes (10%, 30,, and 60% of the training set) according to this metric as well. A lower value for this metric indicates better performance, as an effective unlearning algorithm should forget. the correct labels of samples that the oracle model has also forgotten.
Table 14: New evaluation metric on CIFARIO/ResNell IID and Non-IID seltings (lower is better)
Method
IID-10%
ITD-30%
IID-60%
Non-IID
Retraining (Oracle)
00.00
00.00
00.00
00.00
Fine-tuning
6.35
8.29
9.93
13.60
L1-sparse
6.85
8.51
10.90
11.73
Relabel
12.31
15.83
18.39
22.29
TU
11.61
15.35
17.02
19.41
NegGrad+
8.09
7.58
9.97
19.65
Shallowest-RL
12.62
14.66
18.00
23.31
CritMem-RI.
12.94
15.82
18.73
22.85
Saloc-RL
13.28
15.65
18.85
21.89
DEL
5.46
6.90
8.97
10.55
22

---

Published in Transactions on Machine Learning Research (10/2025)
Table 15: New evaluation metric on SVHN/ViT and InaggeVee100/Reeeeee550 settings (lower better)
Method
SVHN VIT (Non-IID)
ImageNet100 / ResNet50 (IID)
Retraining (Oracle)
00.00
00.00
Fine-tuning
13.17
12.70
Ll-sparse
11.81
12.25
Relabel
12.50
9.90
GA
20.69
15.44
NegGrad+
9.18
11.76
SSD
11.82
19.41
Shallowest-RFT/RI
6.15
14.50
Saloc-RL/RR RL/RFT
7.26
9.88
DEL
7.08
8.56
Table 16: Comparison of methods on Subclass Unlearning with different forget sot sizes (CIFAR-10/ResNet-))
Subclass Unlearning (forget set: 60%)
Subclass Unlearning (forget set: 30%)
Method
forget
Atest
Amia 1
forget 4
Atest J
Amia
Retraining (Oracle)
0.00
0.00
0.00
0.00
0.00_a.00
0.00
Full- coll-prrmette Unlcarning
Fine-tuming
1..63
-3.39
3.21
-2.11_126
-2.2
1.55
Ll-sparse
2.70
-2.40
1.80
-1.79900.4
-1.5020.30
1.34
Relabel
10.7610:50
10.3210.54
2.20
-2.45
7.70_0.82
1.63
-0.47
7.96
3.50
-9.30
7.20=
7.45
NegGrad+
2.19
3.43
3. 3,033.1..
1.28_0.30
2.39-2.62
2.05
Localized Unlearning
Shallowest-BH (a 25%)
50.0
8.93
5.17
1.71=0.54
10.8440.40
2.1540.46
CritMem-RL 23%, 20%)
-2.87
10.66
2.46.11000
-2.19
7.79_0.26
1.34
Saloc-RL (a 30%)
-3 13.10
10.48
2.68
-2.5120.02
7.85_0.29
1.33
DEL (a 30%)
-..181..e
0.93
0.35
-0.2910.39
1.50
0.29
Table 17: Computational time of localization strategies (CLFAR-10/Ress)
5k 15k 30k)
Strategy / Forget size
10% (5000 samples)
30% (15000 samples)
60% (30000 samples)
CritMem
21.33 hours
62.40 hours
125.33 33 hours
SalLoc
2.05 seconds
4.82 seconds
9.31 seconds
Shallowest
0.56 milliseconds
0.56 milliseconds
0.56 milliseconds
DEL
2.19 seconds
5.71 seconds
10.09 seconds
Table 18: Continual unlcarning on CIFAR-10 RosNet-18(class - - + 4)
Method
forget +
Atest +
A Amia +
Retraining (Oracle)
0.0040.00
0.00
0.00+0.00
Fine-tuning
- -10.80+0.1
-2.1440.26
6.0940.30
L1-sparse
2..66+0.51
-2.27
-2.6440.28
Shallowest-RFT (a 25%)
2.40+0.77
5.7440.32
-13.4441.48
Saloc-RFT (a 30%)
5.71
4.92+0.50
-4.8840.85
DEL(a 30%)
0.73+0.0 25
1.33
0.14
23


Reviews:
[{"review_id": "IW8IS11TvT", "reviewer": "Reviewer_Pnqw", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "## Summary\n\nThe paper focuses on the task of **machine unlearning**, specifically on **localization-based strategies** due to their empirical effectiveness.\n\n### Main Contributions\n\n- Development of a novel localization methodology  \n- Providing analysis on the connection between memorization and unlearning methodologies  \n- A budget-based investigation on several localization strategies to be combined with unlearning methods  \n- A state-of-the-art unlearning methodology built on empirical cues (provided in the paper)\n\n---\n\n## Strengths\n\n- The paper tackles an **important aspect of machine unlearning**\n- The **“preliminary” investigation** is particularly interesting in its linkage with memorization, and the writing is **clear and engaging**\n- The authors' **budget analysis** results represent an interesting aspect, which is often overlooked\n\n---\n\n## Weaknesses\n\n- The paper **lacks a discussion on the size of the forget set**. Previous work on model editing (such as **MEND** [1] or **MEMIT** [2]) showed poor results when scaling the number of updates. Since the update appears to be **sample-wise**, how does the number of updates affect (and potentially disrupt) model performance?\n\nWhile I found **no major methodological weaknesses**, since the experiments are well-designed and the method is sound, I would like to raise some points that may be helpful to either **strengthen the paper** or **inform future work** in this line of research. Explicit suggestions are highlighted below.\n\n---\n\n## Suggestions for Improvement\n\n- While DEL is a localization-based methodology, **how robust is it to adversarial unlearning strategies**, such as those proposed in [3]?\n- **How is model utility impacted in transfer learning settings** — for example, when further finetuning the ImageNet pre-trained model on a downstream task?\n- While the **parameter budget** discussion is appreciated, it would be valuable to include a **compute-wise analysis**, i.e., a comparison of **FLOPs overhead** required for each localization strategy.\n\n---\n\n## References\n\n[1] MEND: Model Editing via Gradient Descent  \n[2] MEMIT: Memory-Efficient Mechanisms for Iterative Tuning", "claims_and_evidence_yn": "Yes", "claims_explanation": "The paper flows naturally and provides convincing evidence to support the authors' assumptions and claims. Each research question is addressed through well-designed experiments, which collectively build the overall contribution of the work.\n\nNotably, the paper also tests claims from prior literature [1] in controlled settings, which adds substantial value beyond simply proposing a new method.\n\n[1] Can Neural Network Memorization Be Localized?", "audience_yn": "Yes", "audience_explanation": "The topic of **machine unlearning** has gained increasing attention, especially in the context of privacy, robustness, and data management. The proposed method, DEL, not only presents a **new localization-based unlearning algorithm**, but also provides **insightful analysis connecting memorization and unlearning**, a connection that remains underexplored in the literature, which I particularly appreciate.\n\nIn my view, the paper is particularly interesting in its way to explore the problem. It offers **preliminary yet meaningful connections** between ideas from **memorization, model editing, and unlearning**, which makes it more than just a method paper. Moreover, some of the analysis presented may inspire or directly benefit future work aimed at **improving the empirical rigor** of unlearning methodologies.\n\nResearchers working on **model editing*** will likely benefit from the findings and methodology. The **experimental rigor** and clear articulation of trade-offs (e.g., budget vs. utility) make this contribution valuable beyond its core technical novelty.", "requested_changes": "1. **Typo** on the last contribution in the introduction: \"`DELis`\" should be \"`DEL is`\".\n\n2. **Table formatting**: It would be helpful to **bold the best values** in the tables and **explicitly indicate which direction is better for each metric** (e.g., higher is better for test accuracy and MIA score, lower is better for ∆forget). This would improve readability, especially for non-experts in the field.\n\n3. **Figure 4 clarity**: The caption states that \"*L1-sparse has better test accuracy than DEL but has poor unlearning performance.*\" However, from the figure, it seems that the L1-sparse point is simply **closer to the center**, which (to my understanding) should indicate **closeness to the oracle**. This is **confusing** and could benefit from clarification either in the figure design or caption wording.\n\n4. **Additional experiment suggestion**: I would like to see a **scaling-style analysis** showing model behavior under **varying ratios of forget set to retain set size**. This could help demonstrate how the method **scales with the portion of unlearning data**, even if at some point unlearning becomes inherently disruptive.", "broader_impact_concerns": "*No broader impact concern that requires a Broader Impact Statement*", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "vkGT43bl2n", "reviewer": "Reviewer_UGBr", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper analyzes existing unlearning methods, especially focusing on localized unlearning. And then propose a method that selects learnable parameter sets based on weighted gradients. The authors compared and applied this with other methods, showing that the proposed method helps improve unlearning. In the paper, the authors explained existing literature on unlearning, which might be helpful for people who do not know about unlearning.", "claims_and_evidence_yn": "No", "claims_explanation": "1. First of all, I am concerned about the metrics. The authors reported the difference of forget, MIA, and test between the retrained model and the unlearned model. If I understand correctly, these metrics are once calculated in each model separately (i.e., $Acc_{forget} (oracle)$, $Acc_{forget} (unlearned)$), and then the difference is calculated. This leads to a problem that although the unlearned model performs totally differently, the performance can be the same. For example, in binary classification with four examples in the forget set, where the ground-truth is 0, 0, 1,1, respectively, if an oracle predicts [1, 1, 1, 0] and the unlearned model predicts [0, 1, 1, 1], delta forget accuracy becomes 0.\n\n2. Moreover, accuracy is a highly abstract level of metrics without even considering the logit distribution. Although MIA is a standard metric in unlearning, more fine-grained analysis is needed (e.g., Dimensional Alignment [1], layer-level similarity using CKA or cosine similarity, or logit-level KL-divergence).\n\n3. The authors start from the definition label memorization, but in detail, they simply choose channel-level fixed parameters based on the existing method (weighted gradient). Considering TMLR criteria that do not count on the novelty but soundness, I do not devalue the paper because of it. However, punishment is needed.\n\n4. In Table 1, the authors mentioned that the top-left cell corresponds to SalLoc and the bottom-right to the proposed method. Then, what are other parts (e.g., top-right, center, bottom-left)? \n\n5. In Section 5.1, the authors hypothesized regarding granularity and criticality. However, these hypotheses are not addressed well. For example, the authors mentioned that coarser granularity serves as useful smoothing. However, there is no feature analysis, loss landscape analysis, or something equivalent.\nThe authors argue that they compared with the state-of-the-art methods in Table 2. However, other methods such as EU-k, CF-k (Goel et al., 2022), and MUDA [1] are not used. Moreover, each model are not properly cited, which hinders the reader from finding their origin.\n\n[1] Seo, Seonguk, Dongwan Kim, and Bohyung Han. \"Revisiting machine unlearning with dimensional alignment.\" WACV. 2025.\n\n[minor]\n\n1. There are too many terms that are only used once. For example, $\\tilde{c}$ is not important in the main paper but is only used in Algorithm 1. I would recommend using these variables only in Algorithm 1 with a comment, not in the main paper.\n\n2. Which ViT model is used? The authors simply mentioned that they used ViT (e.g., Figure 3), but there are various ViT depending on the number of parameters and patch size. It is not even specified in Appendix A.3 (Experimental Setup).\n\n3. It seems like mentioning unlearning in LLM in Section 7 is not well aligned.  Could you please elaborate more on it?", "audience_yn": "Yes", "audience_explanation": "Unlearning is an emerging field, and it is important. The paper is generally well-written and easy to understand. Hence, I believe that TMLR's audience will be interested in the paper.", "requested_changes": "In page 2, DELis -> DEL is\n\nIn page 3, procedure of (Fan et al., 2023) -> change to \\citet.\n\nIn page 12, (Maini et al., 2023) -> \\citet", "broader_impact_concerns": "I do not have concerns regarding the potential negative impact. I believe unlearning is important, especially as large-scale pretrained models are widely used these days.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "hiJkbjc5uf", "reviewer": "Reviewer_QeJL", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a novel localized unlearning framework, Deletion by Example Localization, which includes a localization method to identify critical parameters for the forget set and a simple unlearning algorithm that resets and finetunes those critical parameters found by the localization strategy. The experiments across three datasets with three models show that the proposed localized unlearning framework achieves superior forgetting quality while outperforming baselines in test accuracy.", "claims_and_evidence_yn": "No", "claims_explanation": "1. The paper is mainly built on empirical findings without any theoretical analysis. In particular, the evaluation of localization strategies in section 4 is limited to CIFAR-10 with ResNet-18, which raises concerns about the generalizability of the findings to other model architectures and datasets.\n\n2. Although the paper claims that data-agnostic localization strategies perform poorly, in practical scenarios, the training dataset may not be available for unlearning. This data dependency limits the practical applicability and generalizability of the proposed method.\n\n\n3. The experiments lack ablation studies. For example, the experiments do not show the impact of the forget set size. For example, if the size of the forget set is larger than half of the training dataset, what is the performance of the proposed method? It’s unclear how the proposed method performs when the forget set constitutes a large portion of the training data.", "audience_yn": "No", "audience_explanation": "1. The paper proposes a practical and intuitive localization strategy to identify the critical parameters for the forget set.\n\n2. The experiments show that the proposed localized unlearning framework outperforms other existing methods and demonstrates robustness to variations in the parameter budget.", "requested_changes": "1. On page 1, toward the end, could you please add some supporting citations for the statement: “We hypothesize that localized unlearning.....since fewer parameters are subject to modification”?\n\n2. Could authors please compare the specific computational time or space complexity of the four localization strategies: Deepest, CritMem, Shalloest, and SalLoc? Providing a table would be helpful to understand the difference between these four methods.\n\n3. In section 5.2, the criticality score is defined based on channel or neuron. How would this be adapted to transformer-based architectures where the notion of neurons or channels may not directly apply? Please clarify or extend the definition accordingly.\n\n4. In Table 4, the authors only report the results for a two-class forget set sequence (class 2 followed by class 5), but how does the proposed method perform when there is a longer sequence, for example, class 2 followed by class 5 followed by class 3 followed by class 4? It would evaluate the scalability and robustness of the proposed method.\n\n5. The evaluation of localization strategies in section 4 is limited to CIFAR-10 with ResNet-18, which raises concerns about the generalizability of the findings to other model architectures and datasets. Can authors provide a more solid explanation for choosing the localization strategy?\n\n6. The experiments do not show the impact of the forget set size. For example, if the size of the forget set is larger than half of the training dataset, what is the performance of the proposed method? Could authors provide the experiment results on varying the size of the forget set?", "broader_impact_concerns": "No broader impact concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)