No Training Data, No Cry: Model Editing  without Training Data or Fine-tuning

Authors: Dhruva Kashyap, Tanay Narshana, Chaitanya Murti, Chiranjib Bhattacharyya
Primary area: other topics in machine learning (i.e., none of the above)
Keywords: pruning, model editing, classwise unlearning

Abstract:
Model Editing(ME)--such as classwise unlearning and structured pruning--is a nascent field that deals with identifying editable components that, when modified, significantly change the model's behaviour, typically requiring fine-tuning to regain performance.
The challenge of model editing increases when dealing with multi-branch networks(e.g. ResNets) in the data-free regime, where the training data and the loss function are not available.
Identifying editable components is more difficult in multi-branch networks due to the coupling of individual components across layers through skip connections. 
This paper addresses these issues through the following contributions.
First, we hypothesize that in a well-trained model, there exists a small set of channels, which we call HiFi channels, whose input contributions strongly correlate with the output feature map of that layer.
Finding such subsets can be naturally posed as an expected reconstruction error problem. To solve this, we provide an efficient heuristic called RowSum.
Second, to understand how to regain accuracy after editing, we prove, for the first time, an upper bound on the loss function post-editing in terms of the change in the stored BatchNorm(BN) statistics.  With this result, we derive BNFix, a simple algorithm to restore accuracy by updating the BN statistics using distributional access to the data distribution.
With these insights, we propose retraining free algorithms for structured pruning and classwise unlearning, CoBRA-P and CoBRA-U, that identify HiFi components and retains(structured pruning) or discards(classwise unlearning) them. CoBRA-P achieves at least 50% larger reduction in FLOPS and at least 10% larger reduction in parameters for similar drop in accuracy in the training free regime. In the training regime, for ImageNet, it achieves 60% larger parameter reduction. CoBRA-U achieves, on average, a 94% reduction in forget-class accuracy with a minimal drop in remaining class accuracy.

Decision: reject
Reviewer scores: 3, 3, 6

Reviews and discussion:
<thread>
creation date:
1730354312931

thread_type:
official_review

<thread_object>
creator: reviewer_d7ey

<content>
summary:
This paper deals with the finetuning-free model editing of ResNet models without accessing the original training data. The authors hypothesize that High Fidelity (HiFi) components of the model take charge of overall performance retainment and propose determining the pruning parts from a model based on the reconstruction score. The authors further provide a novel theoretical analysis of the batch normalization statistic to characterize the model performance after editing. Evaluation was performed over model pruning and class-level unlearning tasks.

strengths:
* This paper provide a novel theoretical analysis on batch normalization statistics to discuss post-edited model performance

weaknesses:
* **Limited applicability of the proposed method**
  * Although ResNet models are still popular in some cases, given that Vision Transformer (ViT) or other transformer-based models are dominant in many applications, the aim of this study limits its impact compared to previous work on model editing [1].
  * Could the insights provided in this work have some implications for the transformer-style models?
* **Limited validation scope**
  * Although this paper provides some theoretical insights, the empirical validation is too weak in terms of 
 the number of baseline methods, datasets, and experimental settings.
  * Could more baseline methods for the unlearning task be considered? Either data-free [2] or not [3].
  * Could more datasets be considered here for the unlearning task?
* **Insufficient empirical advantage**
  * The authors claim that the proposed method achieves a good trade-off between accuracy and efficiency. However, the proposed method actually could not achieve good accuracy compared to baseline methods, and the benefits of enhanced efficiency are also not so strong on both pruning and unlearning tasks.
* **Reliance on external data (through distributional access)**
  * Although the proposed method does not use an explicit training dataset on which the mode is trained, it still requires some samples from a similar distribution. This weakens the practical usefulness of the proposed method compared with truly data-free methods such as task arithmetic-based unlearning [2]
  * Could the authors provide an ablation study for the size of the external dataset used for proposals?
* **Bad presentation quality**
  * In the introduction and experiment section, the author does not insert space between paragraphs, which makes the reading hard.
  * The quality of the figure and table is so bad in terms of font size and resolution.
  * There is incorrect labeling of assumption 5 in line 328
  * Notations are complex beyond need and somewhat unclear. One example is lines 177-178.



> Reference
1. Decomposing and Editing Predictions by Modeling Model Computation, Shah et al. 2024
2. Editing Models with Task Arithmetic, Ilharco et al. 2024
3. Decoupling the Class Label and the Target Concept in Machine Unlearning, Zhu et al. 2024

questions:
See the weakness section.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730640878176

thread_type:
official_review

<thread_object>
creator: reviewer_zvul

<content>
summary:
This paper mainly focuses on the model editing task, emphasizing the setting without training data or loss functions.
To detour access to the data or loss functions, the authors investigate the 'distributional' behavior of network layer outputs, which is not a 'sample-wise' behavior. Based on the finding that a very limited number of components of networks contribute to the learned outputs (called **HiFi** components), the authors have proposed to freeze the HiFi components and adjust the batch normalization to compensate for the changes in the distributional behavior. To verify their approaches, they have provided two types of tasks, i.e., pruning and unlearning.

strengths:
**Strength 1:** The main strength of this paper is that the authors' viewpoint to scrutinize the distributional behavior of networks rather than the sample-wise network sensitivity can be a key strategy to control or edit the learned models.
- The strategy seems to be widely applied to various long-aged problems across multiple related societies, e.g., continual learning, explainability, and pruning or unlearning, which are tested in this paper.

weaknesses:
**Weakness 1:** Limited understanding of how the learned knowledge relates to the distributional behaviors of models
- The main weakness of this paper is the limited understanding of how keeping the HiFi part results in keeping the knowledge of learned models. Otherwise, how tuning the HiFi part results in forgetting the specific learned knowledge.
- At the conceptual level of understanding, it is quite convincing that the components showing similar distributional behaviors with the layer outputs are probably the crucial parts of the knowledge. However, it is not guaranteed theoretically. 

**Weakness 2:** Insufficient quality of presentation and writing
- I strongly believe this venue requires the highest presentation and writing quality. However, the submitted version contains too many grammar errors, unpolished sentences, and low-clarity visualizations, as follows:
- At line 47: a missing full name of 'CNN'
- At many parts: add a whitespace between text and '('
- At many parts: for citations, the form is inconsistent, e.g., at line 166, "behavior (Jia...; Shah et al., (2024))." is correct.
- At line 178: missing comma after i.e.
- At line 185: missing whitespace before "While"
- Figure 2: The size is too small to recognize the plots, formulations, and texts.
- Equation 3: it is better to keep the length within the text width of the page.
- At line 269: keep the name "HiFi"
- At line 328: It seems "Assumption 5" means A1 and A2 at the right upper part. The labeling of assumptions is not matched.
- At line 469: missing punctuation after "Training Details"
- At line 529: "loss" rather than "Loss"
- Figure 5 (in Appendix): The size is too small to recognize the contents.
- I strongly feel that the level of presentations and writing is not reaching the level of this venue.

**Weakness 3:** Limited comparison with other related works
- Although the authors have provided the 'Related Work' part in the Appendix, it seems insufficient to provide deep insights into this work beyond others.
- For instance, beyond the technically similar model editing methods, in-depth analysis of the prior works investigating the importance of weights or sensitivity measures of weights should be considered. I think that HiFi is another viewpoint to measure the importance of weights so that it has the potential to show further impact on continual learning (also without data of the past tasks) and explainability.

questions:
**Question 1:** unclear notations in equations
- In the "What is Model Editing" part on line 176, to my understanding, 'B' is the number of components (not an individual weight, but a group of weights) in the model. Therefore, the equation, $\|\theta\|-B$, looks wrong because $\|\theta\|$ is commonly used for the number of weights, not components. Would you clarify the equations?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730680993389

thread_type:
official_review

<thread_object>
creator: reviewer_gwp1

<content>
summary:
This paper addresses the problem of model editing (specifically, structured pruning and class unlearning) for deep neural networks when training data is not inaccessible. The authors propose the concept of "HiFi components", which are identified as a small subset of channels in each layer being responsible for the model's output. Detecting "HiFi components" could be solved by measuring the reconstruction error of these channels. However, due to the unavailable training data, the authors propose a heuristic "RowSum" to identify the similarity between distributions of input contribution and output feature map in a layer. Then HiFi components are the components having a high correlation(/similarity) between input channel contributions and the output feature map. To restore the model's accuracy after editing, the authors derive an algorithm called "BNFix" to update BN's statistics using only distributional access to the data distribution. Two algorithms COBRA-P and COBRA-U are proposed to find whether retaining or discarding HiFi components in pruning and unlearning, respectively. Empirical evaluations on CIFAR-10/100 and ImageNet datasets show the effectiveness of their approach in maintaining competitive accuracy.

strengths:
1. The paper tackles the problem of model editing without accessible training data for the circumstances of structure pruning and class unlearning. 

2. Identifying the HiFi component with the proposed correlation measure is interesting to me.

weaknesses:
1. While the concept of HiFi components is interesting, the technical novelty of the RowSum heuristic and BNFix algorithm appears limited. There are many papers proposing to update BN's parameters, a similar strategy to the one in this paper. 

2. The theoretical analysis focuses on providing upper bounds on the loss function, however, K is the largest eigenvalue of the hessian, which might not be tight enough as a guarantee. 

3. The overall writing and organization of the paper could be improved significantly. The presentation of the main framework and the transition between different concepts in sections should be intuitive.

questions:
1. In Section Introduction, How do photos from a personal device constitute samples of a large collection of photos having similar distributions?

2. "In Figure 2, we show the relative reconstruction error after removing filters from a selection of layers of a ResNet50 trained on CIFAR10". Could you explain how to get Fig. 2 in detail, which is a key assumption in this paper? 

3. The introduction of HiFi components and the section of BN fix seem disjointed. Could you provide a clearer connection between these two concepts and explain why only BN's statistics are fixed?
 
4. Is there anything additional information that needs to be stored during training time for the proposed methods to work? 
 
5. The empirical evidence is primarily based on CIFAR-10/100 and ImageNet datasets, and it would be beneficial to evaluate the methods on more datasets and tasks.

6. There are many citation errors in the text. Please carefully check. The font of the figures is really tiny,  making them very difficult to read.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732557796091

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Response to reviewers

comment:
We thank the reviewers for their detailed feedback, and offer the following clarifications.


## Clarifications and Overlooked aspects of our work 


We take this opportunity to provide clarity on some points that reviewer's may have overlooked, potentially leading to negative appraisals of our work. In particular:

- We wish to highlight that the CoBRA framework is among the first to address **both structured pruning and classwise unlearning** without requiring either the training data or the loss function, and without requiring retraining. We use the local similarities between input contributions of feature maps as a proxy for the loss function.
- In our framework, both pruning and unlearning can be addressed using only distributional information in the form of feature map statistics, specifically the correlations between feature maps.  
- In Section 7, we highlight the remarkable recovery of accuracy just by adjusting BatchNorm statistics. Notably, for classwise unlearning, the **forget class accuracy increases by over 90%** without fine-tuning, simply by adjusting BatchNorm statistics **using only remain class samples**.  Moreover, the BNFix algorithm is formally derived (section 5), with a rigorous guarantee on the change in the loss function's value.
- To further address the inability to fine-tune models after editing, we derive a **weight compensation scheme with a formal guarantee on expected reconstruction error** in Theorem 2. Our method ensures that the **distribution of the edited features** is similar to the unedited ones, upto a factor dependent on the covariance of the feature distribution. 

To offer further clarification, we summarize the critical aspects of our work below.

**Our work focuses on model editing in the under-researched setting where the training data and loss function are not available, which makes identifying components that are necessary for predictions challenging. We clarify this in detail in the sequel.**

- **Problem Setting**: This work addresses **model editing** - specifically pruning and unlearning - for models with complex interconnections, in the challenging and under-researched setting where the **training data and loss function are not available.** Addressing these problems requires identifying **which components in a network contribute to the model's predictions**.  
- **Challenge - Editing Models without Training Data or Loss Functions:**  The lack of the loss function and the training data creates three challenges. 
   - **Identifying Important Components without the loss function:** This necessitates identifying components based on **local information**,  as without access to the loss function, global phenomena cannot be measured. In this work, we identify important components as those that generate features that are distributionally similar to aggregate feature maps, called **HiFi components**. We identify them using  **correlations between output features**, specifically with Equation 3. 
   - **No training data:** This requires us to leverage **distributional information** instead of training data. In this work, the **distributional approach** we use access to **samples drawn from the same/similar distribution**. Specifically, we use synthetic data as this proxy. 
   - **No Fine-Tuning:** As we have no access the loss function, we cannot fine-tune the model after editing, motivating our Fidelity Compensation (Theorem 2) and BNFix (Algorithm 2).

- **Analysis of BatchNorm:** Our theoretical analysis (Theorem 1), which helps explain both these phenomena, is the **first that connects the BatchNorm statistics to the generalization ability of the network**. This provides a principled way to derive the BNFix algorithm, and offers an explanation for the remarkable accuracy recovery after adjusting BatchNorm statistics. 


## Weaknesses pointed out by reviewers

To address the concerns raised by the reviewers, we provide the following response. 

- All three reviewers expressed concerns with the presentation of our work. To that end, we have incorporated the feedback from all three reviewers into the amended manuscript. 

**We address specific concerns in the individual responses to the reviewers.**
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper tackles the challenge of model editing, specifically structured pruning and class unlearning, for deep neural networks when the training data is inaccessible and the loss function is unknown. The authors introduce the concept of "HiFi components," a small subset of channels within each layer identified as being crucial to the model's output. Their approach involves freezing the HiFi components and adjusting batch normalization to compensate for changes in distributional behavior. To validate their method, the authors present two use cases: pruning and unlearning.

The paper's strengths lie in the novel setup and the introduction of HiFi components, which offer an intriguing perspective. However, the work has notable weaknesses, including limited empirical validation. Specifically, (1) the effectiveness of the learned importance weights compared to prior methods is not sufficiently demonstrated or interpreted, and (2) the proposed method's performance is not adequately benchmarked against baselines in contemporary Transformer-based architectures.

Given these limitations, I recommend rejecting this submission.