DisCEdit: Model Editing by Identifying Discriminative Components

Authors: chaitanya  murti
chiranjib  bhattacharyya
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-14 21:45:31

Abstract: Model editing is a growing area of research that is particularly valuable in contexts where modifying key model components, like neurons or filters, can significantly impact the model’s performance. The key challenge lies in identifying important components useful to the model’s predictions. We apply model editing to address two active areas of research, Structured Pruning, and Selective Class Forgetting. In this work, we adopt a distributional approach to the problem of identifying important components, leveraging the recently proposed discriminative filters hypothesis, which states that well-trained (convolutional) models possess discriminative filters that are essential to prediction. To do so, we define discriminative ability in terms of the Bayes error rate associated with the feature distributions, which is equivalent to computing the Total Variation (TV) distance between the distributions. However, computing the TV distance is intractable, motivating us to derive novel witness function-based lower bounds on the TV distance that require no assumptions on the underlying distributions; using this bound generalizes prior work such as Murti et al. [39] that relied on unrealistic Gaussianity assumptions on the feature distributions. With these bounds, we are able to discover critical subnetworks responsible for classwise predictions, and derive DISCEDIT-SP and DISCEDIT-U , algorithms for structured pruning requiring no access to the training data and loss function, and selective forgetting respectively. We apply DISCEDIT-U to selective class forgetting on models trained on CIFAR10 and CIFAR100, and we show that on average, we can reduce accuracy on a single class by over 80% with a minimal reduction in test accuracy on the remaining classes. Similarly, on Structured pruning problems, we obtain 40.8% sparsity on ResNet50 on Imagenet, with only a 2.6% drop in accuracy with minimal fine-tuning.

Main paper: 
 introduction: 
 The black-box nature of neural networks makes understanding the precise mechanism by which a neural network makes a prediction (in the classification or regression settings), or generates a sample (in the generative settings) an active area of research [44] , and relevant to several related problems, such as robustness, sparsity, and memorization. In particular, recent work aims to address this problem by identifying which components -such as neurons, convolutional filters, or attention heads -in the model contribute most significantly to predictions [44] . Prior work addressing this problem includes [2] , which identified important filters by using human-defined concepts, and aligning them with filter responses to those concepts, whereas more recent work [48] , uses an exhaustive regression-based approach. The field of structured pruning [19, 4] also provides a variety of heuristics for component importance, including first-and second-order derivative information [38, 37, 43] , feature map ranks [35, 52] , and layerwise reconstruction errors [59, 41] . Component attribution has also found attention in the fields of machine unlearning [58] , where class-wise important components can be identified and edited to remove information about a given class or group [48, 23, 33] .In this work, we address this problem from a distributional milieu: that is, by analyzing the distributions of feature maps for models trained on datasets with distinct classes or subgroups. Specifically, we use the discriminative filters hypothesis (DFH) stated in [39] , which states that well-trained models for classification possess a mix of discriminative filters -filters that yield feature maps with distinct class-conditional distributions -and non-discriminative filters and that the discriminative filters are important to model predictions. Discriminative filters can be used to identify which filters contribute to the prediction for samples from a given class. Under restrictive assumptions of Gaussianity, the DFH was used in [39] to derive a structured pruning algorithm that required only some form of distributional access, and no access to the loss function and training set. However, several key challenges remain. First, is it possible to identify discriminative filters without restrictive assumptions on the filter outputs? Second, can discriminative filters be used in settings other than structured pruning? Last, can the performance of algorithms leveraging the DFH be improved upon with better identification of discriminative filters? In this work, we answer each of the questions affirmatively.First, to identify discriminative filters without unrealistic assumptions on the feature map distributions, we derive tractable, witness function-based lower bounds on the Total Variation (TV) distance, with which we also reveal hitherto unknown ties between the TV distance and classical, discriminationbased classifiers. We then use our proposed methodology to identify discriminative filters for classwise model unlearning and structured pruning, which we call DISCEDIT: Discriminative Component identification for model Editing. Our methodology is simple -we first identify discriminative filters for a given class, and prune them (for class forgetting), called DISCEDIT-U, or in the case of structured pruning, prune filters that are non-discriminative for all classes, called DISCEDIT-SP. Note that our method for identifying discriminative filters requires only distributional access, and neither the training data nor the loss function. We illustrate our approach in Figure 1 , and formally state our contributions below.Discriminative ability of a filter: We quantify the discriminative ability of a filter in a neural network, as the worst possible Bayes error rate of binary classifiers trained upon the features it generates(See Section 3). Since, in general, computing the Bayes' error rate is intractable, we seek to approximate it using lower bounds on the TV distance.Witness function based Distribution Agnostic Lower bound on TV distance: In order to identify discriminative filters without distributional assumptions, we propose a novel witness function-based lower bound on the TV distance between distributions to address this gap in Theorem 1. We propose a lower bound that relies only on knowledge of finitely many moments(Theorem 2) and derive another lower bound accounting for moment measurement errors in Theorem 3. These bounds do not require distribution-specific assumptions and hence enable this work to generalize previous work [39] , which requires the distributions to be Gaussian( which is an unrealistic assumption). To be noted that these bounds are of independent interest as they are broadly applicable. Moreover, using a careful choice of witness function, our bounds reveal new connections between discriminant-based classifiers like the Fisher linear discriminant and the Minimax Probability Machine, and the TV distance, which we state in Corollary 2.Model Editing using Lower Bounds: We apply our lower bounds to the problem of identifying which components in a model contribute to predictions from certain classes.1. Class Unlearning: We identify components capable of discriminating each class, which we then prune in order to unlearn that class, requiring no access to the loss function, called DISCEDIT-U.2. Pruning without the training data or loss function: Next, we derive a family of algorithms for structured pruning requiring no access to the training data or loss function by identifying non-discriminative filters with our proposed lower bounds, called DISCEDIT-SP.Experimental Validation: We produce a slate of experiments to illustrate the efficacy of identifying discriminative components for structured pruning and machine unlearning/class forgetting. We compare the efficacy of DISCEDIT-SP for pruning VGG nets and ResNets trained on CIFAR10, and show that we achieve up to 76% sparsity with a .12% reduction in accuracy on VGG19, and on Imagenet, we achieve 40.8% sparsity with a 2.58% drop in accuracy with minimal fine-tuning.Similarly, for machine unlearning, we show that our method enables 83% drop in accuracy on the class to be forgotten, with a 1.2% increase in accuracy on the remaining classes, without any finetuning.In this section, we introduce a brief summary of related literature. We provide a more detailed discussion of the literature in Appendix A.Structured pruning Structured pruning reduces the inference time and power consumption of neural networks by removing entire filters or neurons, as opposed to unstructured pruning that removes individual weights [29, 18] . A variety of structured pruning methods require the loss function, and identify import components using gradient information [38, 30] , or approximations of the Hessian of [29, 18, 51, 36] .A variety of structured pruning methods that do not rely on the loss function have been proposed, which identify important components by norms of the weights [31, 32? ], bounds on the reconstruction error incurred by pruning a filter [41, 59] , the rank of the feature maps [35, 52] , and coresets of feature maps [34] . More recent approaches identify components based on the discriminative ability of the corresponding featuremaps, using metrics like the Hellinger distance between class-conditional feature maps [39] , or Fisher discriminant-based methods [20, 21] . In this work, we formalize the notion of discriminative ability in terms of the Bayes risk and derive novel lower bounds on the total variation distance to approximate it effectively. Unlike previous works, we make no assumptions about the class-conditional distributions, and our pruning algorithms require no access to the training data or loss function. For a more comprehensive discussion on structured pruning, we refer readers to Appendix A or the surveys [19, 4] .Machine unlearning Machine Unlearning has recently received significant attention due to concerns like data privacy and security [5, 42] . A variety of works propose methods to forget data points while maintaining model accuracy, even in adaptive settings [47, 16, 22, 14] . Selective forgetting, where classes or groups are forgotten, connects machine unlearning to continual learning [58, 57] . Model editing for unlearning, however, remains an underexplored area of research. Recent studies machine unlearning can be enhanced by sparsifying models [23, 46] , and discrimination-aware pruning has been used in federated settings [56] and for forgetting specific classes [48] . Our work differs by directly utilizing the discriminative ability of model components to identify and remove those responsible for a given class, enabling effective unlearning without access to the original training data. For a more detailed discussion, we refer readers to Appendix A. 
background and notation: 
 In this section, we introduce our notation and provide basic background definitions.Notation For an integer N > 0, let[N ] := {1, • • • , N }. Let 0 N be a vector of zeros of dimension N . Let sort B ({a 1 , • • • , a M }) be the set of the B largest elements of {a 1 , • • • , a M }.Suppose P, Q are two distributions supported on X , with densities given by p(x) and q(x). For a function f :X → R, let fp = E x∼P [f (x)], and let f (2) p = E x∼P f (x) 2 .Let D be a data distribution. Suppose the dataset has C classes, then let D c be the class-conditional distribution of the c-th class, and let D c be the distribution of the complement of c (that is, samples are drawn from all classes other than c).EQUATIONwhere N l is the number of filters in layer l. Since Y l is dependent on X, we assume that Y l (X) ∼ D l , and Y l j (X) ∼ D l j . Furthermore, let D l j,c and D l j,c be the class-conditional distributions and classcomplement distributions of Y l j (X) respectively.Background In this section, we provide relevant background for this work. First, let P and Q be distributions supported on X , with moments µ p , Σ p and µ q , Σ q . Then, recall thatEQUATION)where Fish denotes the Fisher discriminant [24] , and MPM denotes the Minimax probability machine [27, 28] . If we choose the optimal u, denoted by u * , we write max u Fish(P,Q; u) = Fish(P, Q; u * ) = Fish * (P, Q) and max u MPM(P, Q; u) = MPM(P, Q; u * ) = MPM(P, Q) * .We define the TV and Hellinger distances as follows. Definition 1. Let P and Q be two probability measures supported on X, and let p and q be the corresponding densities. Then, we define the Total Variation Distance TV asTV (P, Q) = sup A⊂X |P(A) -Q(A)| = 1 2 X |p(x) -q(x)| dxThe Bayes Optimal classifier, as given in [9, 8] , associated with distributions P and Q with labels -1 and 1 respectively is given by f(x) = arg max c∈{-1,1} Pr(c|x),and has the error rate R ⋆ (P, Q), called the Bayes Error Rate. Next, we relate the Bayes classifier and the Bayes error rate (as described in, say, Devroye et al. [8] ) of a classifier to the TV distance with the following identity. Consider a binary classification problem with instance x and labels c ∈ {-1, 1}, with class conditional distributions given by P and Q. The Bayes error rate satisfies the identityEQUATION 
editing models by identifying discriminative components: 
 There are three central questions addressed in this work:1. Model Unlearning: How do we edit components in order to reduce accuracy on certain groups or classes only? 2. Structured pruning: How do we remove components to ensure that the accuracy of all classes is minimally affected? 3. Determining the Discrimination Ability of a Model Component: How do we assess the Discrimination ability of filters without access to the training data or loss function, and without making any assumptions about the class-conditional feature distributions?Inspired by Murti et al. [39] , the key idea in this work for addressing each of the questions raised above is to identify discriminative components, that yield feature maps upon which accurate classifiers can be trained, and thus with distinct class-conditional distributions. A heuristic to address this problem would be to train a classifier upon the feature map; those features upon which accurate classifiers can be trained are generated by discriminative filters; however, this is highly impractical. Thus, as with [39] , we address this problem by identifying filters for which the class-conditional distributions of the feature maps are distinct, which are identified based on estimates of the total variation distance between the class-conditional distributions of the associated feature maps. In this work, we formalize discriminative ability of a component in terms of the best possible classifier that can be trained on the features generated by it. In the sequel, we illustrate similar but distinct notions of discriminative ability important for classwise unlearning, and structured pruning. We first formally define discriminative ability and the class-c discriminative ability as follows.Definition 2 (Discriminative Ability). Consider a CNN with L layers trained on a dataset with C classes, and consider the jth filter in the lth layer. The class-c discriminative ability η c l,j , and the discriminative ability η l,j of the filter are given byEQUATIONClasswise Unlearning For classwise unlearning, we aim to identify those components that are responsible for predictions of a selected class or group within the dataset. Thus, we aim to identify those components that are able to discriminate between the given class, say with label c, and others.As with Wang et al. [58] , we say D c is the Forget Set, and D c is the Remain Set. As noted in Shah et al. [48] , Jia et al. [23] , our aim is to minimize the test accuracy of the model on D c , while maintaining the test accuracy on D c. Thus, to unlearn class c, we edit those components for which the class-c discriminative ability, η c l,j is low. An interesting point to note is that some components may be discriminative only for class c, which we call class-selective components, whereas others may be discriminative for multiple classes. Note that when the dataset has a large number of classes, our experiments indicate that class-specific components generally can't be found.Structured Pruning: Identifying discriminative components (specifically filters in convolutional networks) for structured pruning was first introduced in Murti et al. [39] . Structured pruning involves removing components for a network while maintaining the accuracy of the classifier. Following Murti et al. [39] , we aim to retain components that are discriminative for multiple classes. Our goal is to remove components from the model while maintaining the model's accuracy on each class conditional D c . Thus, Definition 2 gives us a means by which we can identify discriminative components based on the worst Bayes error rate for discriminating the class conditional distributions of the given feature map. Filters for which η l,j is small are considered discriminative, as the best possible classifier that can be trained on those features will be highly accurate.Assessing the Discriminative Ability: In general, the Bayes error rate cannot be computed. However, since the TV distance and the Bayes error rate are connected by the identity (3), which states that for two distributions P, Q, the Bayes risk is given by 1 2 (1 -TV(P, Q)), we can reformulate our distributional pruning strategy as identifying those filters that generate features for which classconditional distributions are well-separated in the Total Variation sense, and prune them. In [39] , this was achieved by making the strong assumption that the distributions of the class-conditional feature maps were spherical Gaussian. In the sequel, we propose novel lower bounds on the total variation distance that require no restrictive Gaussianity assumptions, thereby enabling us to effectively identify discriminative components. 
witness function-based lower bounds for the total variation distance: 
 In this section, we derive lower bounds on the Total Variation Distance that rely on the moments of a witness function, a scalar-valued function whose moments can be used to derive bounds on divergences between distributions. More formally, we write f : X → R, where X is the support of the distribution(s) in question. We then adapt our lower bound to a variety of scenarios, depending on the extent of the information about the distributions available to us. When access to only the first two moments is available, we derive lower bounds on the total variation distance based on the Fisher linear discriminant and the minimax probability machine.Estimating the Total Variation distance is known to be #P complete [3] . Estimating lower bounds on the TV distance is an active area of research (see Davies et al. [7] and the references within), with a variety of applications from clustering [1, 17] to analyzing neural networks [59] . However, most bounds such as those presented in Davies et al. [7] require prior knowledge about the distributions, and tractable estimation of lower bounds given access to collections of moments or samples, without assumptions on the distributions themselves, remains an open problem.In this section, we propose lower bounds on the TV distance that only requires access to the moments of a witness function, as described in Gretton et al. [15] , Kübler et al. [25] . Theorem 1. Let P, Q be two probability measures supported on X ⊆ R d , and let p and q be the corresponding densities. Let F be the set of functions with bounded first and second moments defined on X . Then,EQUATIONProof Sketch. We provide a sketch of the proof. We express the quantity f p -f q in terms of the densities p(X) and q(X). We then isolate the integral of |p(x) -q(x)|. After rearranging terms, we obtain the result. For the full proof, we refer readers to Appendix B.Motivated by the need to identify discriminative filters when we only have access to the moments of feature map distributions, we propose worst-case lower bounds on the TV distance given access to finitely many moments of the distributions P and Q.Let S k (P) := {P : E X∼P [X d1 1 • • • X dn n ] = P d1•••dn , i d i ≤k} be the set of probability measures whose moments are given by P, whereE X∼P X d1 1 • • • X dn n = P d1•••dn ; similarly, let S k (Q) bethe set of measures whose moments are given by Q. For any random variable X ∈ R d supported on X , suppose φ : R d → R n for which there exist functions g and G such that E X [φ(X)] = g(P) and E φ(X)φ(X) ⊤ = G(P). Given two collections of moments of the same order, we want to measure the worst-case TV separation between all distributions possessing the moments given in P and Q. We define this asEQUATIONFor the sake of brevity, we write D TV (S k (P), S k (Q)) = D TV (P, Q; k).Theorem 2. Suppose P and Q are sets of moments of two probability measures supported on X . Let φ(X) be a vector of polynomials such that EP [φ(X)] = g(P), E Q [φ(X)] = g(Q), E P [φ(X)φ(X) ⊤ ] = G(P), and E Q [φ(X)φ(X) ⊤ ] = G(Q), and let f = u ⊤ (φ(X) -g(P)+g(Q) 2), be a witness function. Then, for anyP ∈ S k (P), Q ∈ S k (Q), supported on a set X ⊆ R d , we have D TV (P, Q; k) ≥ S * TV (P, Q) (2 + S * TV (P, Q)) -1 ≥ S * H (P, Q) 2 √ 2 + S * H (P, Q) -2, where:S * TV (P, Q) = (∆g) ⊤ ( G(P) + G(Q)) -1 (∆g) and S * H (P, Q) = max u |u ⊤ (g(P) -g(Q))| u ⊤ G(P)u + u ⊤ G(Q)u)and ∆g = g(P) -g(Q) and G(P) = G(P) -g(P)g(P) ⊤ . Proof Sketch. We apply Theorem 1 with the given witness function, and obtain an expression in terms of S * TV (P, Q). Since the bound holds for any distributions that yield the given moments of the witness function, the statement holds. The full proof is provided in Appendix B.Theorem 2 is a worst-case lower bound on the TV distance between distributions with given truncated moment sequences. While we focus our results on the case where f (x) = u ⊤ φ(x), where φ(x) is a vector of monomials, this bound is valid for any choice of f with bounded first and second moments.In general, the bounds proposed in Theorem 1 are not tight. However, an interesting observation is that the lower bound proposed in Theorem 1 can, in certain cases, be used to compute the Bayes optimal classifier, and thus the true TV distance. Specifically, if the Bayes optimal classifier lies in a given set of functions F, the bound can be used to compute the Bayes classifier. We state one such case below in Corollary 1.Corollary 1. Suppose P ≡ N (µ p , Σ) and Q ≡ N (µ q , Σ) Let f (x; u) = u ⊤ (x -1 2 (µ p -µ q)) be a witness function. Then,u ⋆ = arg max u (E x∼P [f (x; u)] -E x∼Q [f (x; u)]) 2 E x∼P [f (x; u) 2 ] + E x∼Q [f (x; u) 2 ] = Σ -1 (µ p -µ q )is the weight vector of the Bayes optimal classifier f Bayes (x) = sign u ⋆⊤ x + b , andTV(P, Q) = 2Φ (u ⋆ ) ⊤ (µ p -µ q )/2 -1.Proof Sketch. We find the u ⋆ that maximizes the the TV lower bound given in Theorem 1, and then apply the same to the exact expression of the TV distance between Gaussian measures with the same covariance. The full proof is provided in Appendix B.Remark 4.1. This result illustrates the case where the Bayes' classifier lies in the set of functionsF := {f (x) : f (x) = u ⊤ φ(x)} for a given function φ(x). In this case, if φ(x) = x -1 2 (µ p -µ q ), and P and Q are Gaussian with the same variance, the Bayes classifier is equivalent to the Fisher discriminant.In this section, we exploit the bound stated in Theorem 1 to reveal extensive connections between the total variation distance and discriminant-based linear classifiers, specifically the Fisher Linear Discriminant and the Minimax Probability Machine, that are of independent interest to readers. Specifically, we show that the TV distance is lower-bounded by monotonic functions of the Fisher Discriminant and the Minimax Probability Machine. We state this result formally in Corollary 2. Corollary 2. Let P, Q be two probability measures supported on X ⊆ R d , let p and q be the corresponding densities, and let µ p , µ q and Σ p , Σ q be the means and variances of P and Q respectively. Then,TV(P, Q) ≥ Fish * (P, Q) 2 + Fish * (P, Q) ≥ MPM * (P, Q) √ 2 + MPM * (P, Q) 2 .Proof. Choose φ(x) = x. Thus, g(P) = µ p , and G(P) = Σ p + µ p µ ⊤ p . Substitute these into Theorem 2 to complete the proof. This lower bound can be improved upon by selecting a witness function of the form f (x; u) = u ⊤ φ(x) where φ(x) is a vector of basis functions (such as monomials, if f (x; u) is a polynomial). Moreover, lower bounds that are robust to estimation error, based on the Fisher Discriminant and Minimax Probability Machines, can be derived by directly applying the techniques proposed in [24] (for the Fisher discriminant case) and [28] (for the Minimax Probability Machine case). We discuss this in Section 6.2.The lower bounds derived in Theorems 1 and 2 are functions of moments of the distributions, which must typically be estimated from samples. In practice, we use plug-in estimators for g(P), g(Q), G(P) and G(Q). Since these estimators are computed using samples, errors in estimation arise, which in turn creates errors in computing the lower bound. This estimation error is a particularly challenging issue in high dimensions, where 'high dimensions' refers to the setting where the number of samples n is significantly less than the dimension of the data, d. However, in typical neural networks such as VGG-nets and ResNets, the feature maps, particularly of the layers close to the output that can be effectively pruned (see, for instance, [34, 39] ), have low dimensional feature maps. For instance, on VGG16 trained on CIFAR10, the feature maps generated by the 5th layer are of dimension 64; thus, for a relatively small number of samples n, the dimension is less than n.In this section, we present robust lower bounds for the case when f (x) = u ⊤ x, and the moments being estimated are µ p = E P [x] and C p = E P [xx ⊤ ] using plug-in estimators of the formμp = 1 N N i=1x i and Cp = 1N N i=1 x i x ⊤ i (7)where x i are drawn iid from P. We assume that we can quantify the estimation error for the above moments, and can apply lower bounds as proposed in Kim et al. [24] accordingly. Theorem 3. Suppose P, Q be two probability measures supported on X ⊆ R d , with densities p and q, and letµ p = E P [x], µ q = E Q [x] and C p = E P [xx ⊤ ], C q = E Q [xx ⊤ ].Suppose we have plug-in estimates μp , Cp , μq , Cq as defined in (7) , that satisfy∥µ p -μp ∥ 2 ≤ δ p and ∥µ q -μq ∥ 2 ≤ δ q . ∥C p -Cp ∥ F ≤ ρ p and ∥C q -Cq ∥ F ≤ ρ q .Then, with a witness function of the formEQUATIONwhere M = {(µ p , µ q ) : ∥µ p -μp ∥ 2 ≤ δ p , ∥µ q -μq ∥ 2 ≤ δ q }, ∆µ = µ p -µ q , and ρ = ρ p + ρ q .Proof Sketch. The proof is similar to the derivation of of ( 15) in Kim et al. [24] . A full proof is provided in Appendix BThis result can also be applied to the estimation error of functions of x, such as a vector of monomials φ(x), provided the estimation error of each moment can be bounded. 
discedit: distributional algorithms for model editing: 
 In this section, we leverage the lower bounds proposed in Theorems 1 and 2, and Corollary 2 to develop one-shot algorithms for model editing that require no access to the training data or loss function, but only access to the data distributions. We propose two algorithms, DISCEDIT-SPand DISCEDIT-U, that identify discriminative components (filters in CNNs), and prunes them to either unlearn a class (DISCEDIT-U) or to sparsify the model with minimal loss of accuracy (DISCEDIT-SP). A variety of variants of these algorithms based on different witness functions are provided in Appendix D.In this section, we propose DISCEDIT-SP, an algorithm for structured pruning that identifies filters (in convolutional networks) that are discriminative for multiple classes, and retains them. Unlike the approach proposed in Murti et al. [39] , no restrictive assumptions on the Gaussianity of classconditional feature distributions is needed. Furthermore, by assuming the distributions are Gaussian and using the closed-form Hellinger lower bound, C 2 pairwise TV distances need to be computed for each filter. We now state the DISCEDIT-SPalgorithm.Let Y l (X) be the features generated by layer l of a neural network as defined in (1) . We choose a witness function f = u ⊤ φ(Y l j (X)) = φ l j (X), and let fl,j,c (u) = E X∼Dc [u ⊤ φ l j (X)], fl,j,c (u) = E X∼Dc [u ⊤ φ l j (X)], f (2) l,j,c (u) = E X∼Dc [(u ⊤ φ l j (X)) 2 ] and f (2) l,j,c (u) = E X∼Dc [(u ⊤ φ l j (X)) 2 .Next, define r l j to be the saliency score for the jth filter in the lth layer asEQUATIONWe use the lower bound established in Theorem 1 on the TV distances between the class conditional distributions to measure the saliency or importance of a given filter. With this, we formally state DISCEDIT-SP in Algorithm 1. Pretrained CNN with parametersW = (W1, • • • , W L ), layerwise sparsity budgets B l , witness function f for l ∈ [L] do Set S l = [s l 1 , • • • , s l N l ] = 0 N l if X is SP thenFor each j, compute r l j using (9) .if j ∈ sort B l ({r l j } N l j=1 ) then Set s l j = 1 if X is U and Forget Class is c thenFor each j, compute r l j using (10) .if j ∈ sort B l ({r l j } N l j=1 ) then Set s l j = 0 Output: Binary masks S 1 , • • • , S L return ŴThe DISCEDIT-SP algorithm has several advantages. First, as compared to TVSPrune, it requires that only C TV distances be computed at each step. Second, by varying the choice of witness function, we obtain new algorithms for structured pruning; we can choose different witness functions for each class as well.We now state an algorithm for classwise unlearning based on model editing, called DISCEDIT-U. Motivated by works such as Shah et al. [48] , our algorithm requires identifying and editing (specifically pruning) classselective components for the class which is to be unlearned. DISCEDIT-Uuses the same setup as DISCEDIT-SP. However, DISCEDIT-Uonly requires identifying discriminative filters for a single class, we haveEQUATIONWe formally state DISCEDIT-U in Algorithm 1. The DISCEDIT-U algorithm has several advantages. As we show in our experiments in Appendix E, few samples are required to effectively compute the witness functions. 
empirical evaluations: 
 In this section, we empirically study the effectiveness of identifying discriminative filters for model editing tasks, specifically structured pruning and class unlearning. Additional experimental details are given in Appendix E. Experiments showing that class-conditional feature map distributions are non-gaussian, the effectiveness of variants of witness functions, the effectiveness of sparsity in class forgetting, and other ablations, are provided in Appendix E. Our experiment setup is provided in Appendix F, along with baseline accuracies of all models, shown in Table 11 .In this section, we investigate the utility of the lower bounds given in Theorems 1-3 in identifying discriminative subnetworks and for class unlearning.Experiment Setup: We investigate VGG16, Resnet56, ResNet20, and a custom ViT (details given in Appendix F) trained on CIFAR10, and VGG16 and ResNet56 models trained on CIFAR100, and identify subnetworks responsible for predictions from each class. We use the witness function f (x) = exp(∥x∥ 2 ) in our experiments, using 256 samples from the Forget class, and 1024 samples for the Remain class, from the training sets of CIFAR10 and CIFAR100's, for computing r c l,j for each filter. For VGG-16, we only consider the last 8 layers, and for ResNet56, we only consider the final layerblock. We then select the sparsity budgets B l , and prune the most discriminative filters for that layer. We also fine-tune the models for 1 epochs. We measure the accuracy on the class test set, and the class complement test sets both before and after fine-tuning, and we compare against models trained from scratch on the retain set (the class complement). Results: We present a summary of our results in Table 1 . In particular, we highlight that on CIFAR10 models, particularly VGG16, the performance is comparable to or outperforms baselines with minimal fine-tuning. There are two interesting observations: first, as the number of classes exceeds the width of the network (as was the case with ResNet56 trained on CIFAR100), the efficacy of our method is drastically affected. Second, fine-tuning models on the remain set still raises the accuracy on the forget set unless dramatically more filters are pruned. The reasons for this will be the focus of future work.This set of experiments highlights the fact that for classifier models, it is possible to identify subnetworks responsible for predictions for each class. Identifying these subnetworks then facilitates classwise unlearning.Table 2 : DISCEDIT-SP performance on CIFAR10 and ImageNet models with fine-tuning. TVSPrune refers to [39] , and CHIP refers to [52] . 'Sparsity' refers to parametric sparsity. In this section, we investigate the ability for DISCEDIT-SP to sparsify models effectively both with and without fine-tuning.Experiment Setup: We prune VGG16, VGG19, and ResNet56 models trained on CIFAR10 with two sets of fixed sparsity budgets, and then finetune them for 50 epochs. We repeat the experiment for a ResNet50 trained on Imagenet, and fine-tune the pruned models for 100 epochs. We choose f (x) = u ⊤ φ(x), where φ(x) = [1 ⊤ x, (1 ⊤ x) 2 ] ⊤ as our witness function in each of the experiments. For details about the pretrained models used, refer to Appendix F.We show that models pruned with DISCEDIT-SP without fine-tuning retain high accuracies, particularly on the CIFAR10 dataset. Moreover, after fine-tuning, DISCEDIT-SPis able to almost fully recover the accuracy of the original models. Our results are summarized in Table 2 , which shows the drop in accuracy achieved by the different pruning algorithms compared after fine-tuning. 
conclusions: 
 In this work, we address the problem of model editing by analyzing discriminative properties of the feature maps. We leverage the notion of discriminative components to derive algorithms for two relevant tasks: structured pruning and class unlearning. Additionally, in order to identify discriminative components, we derive new lower bounds on the TV distance. These lower bounds also elucidate previously unknown connections between the Total Variation distance and discriminative classifiers, specifically the Fisher discriminant and the Minimax Probability Machine. Our experiments show that the model editing algorithms derived by our methods are highly effective, and match or outperform current state of the art in structured pruning, and can reduce accuracy almost completely on a given class, while maintaining accuracy on the remaining classes. This work, however, currently analyzes discriminative components (and thus, subnetworks responsible for classwise predictions) in classifier models. Current avenues of research include extending these results to unlearning and pruning of generative models as well. Lastly, the techniques proposed in this work can be extended to other editing tasks as well, such as debiasing. 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: See impact statement Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.• The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA]Justification: standard datasets/models used Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: Source of models listed in Appendix F Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.• If this information is not available online, the authors are encouraged to reach out to the asset's creators. Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: In this section, we provide a detailed literature survey on machine unlearning, both with and without model editing.Machine unlearning has gained importance in recent years owing to data privacy and security concerns [5, 42] . A wide variety of works exist to address this problem. Several works aim to forget data points, even in the adaptive setting, while maintaining the accuracy of the model, such as [47, 16, 22, 14] . The work in [47] also provides bounds on the number of samples that a model can be allowed to forget before accuracy degradation. Machine unlearning is also a significant area of research in the space of large language models, as noted in [26, 10] , and generative models [13] .Another aspect of machine unlearning is selective forgetting, wherein classes, groups, or sets of samples are forgotten from the network, as described in [58] and the references therein. This connects machine unlearning to the continual learning setting as well, as described in [57] and the references cited there.While there has been significant research into selective forgetting and model unlearning, facilitating selective forgetting and machine unlearning by editing models remains an underexplored field. Recent works such as [23, 46] explore the effect of sparsity on machine unlearning and continual learning; in particular, [23] shows that sparsifying models prior to unlearning can increase the effectiveness of it. However, recent work such as [56] investigates using pruning for model unlearning in the federated setting. More recently, [48] uses pruning to selectively forget a single class from a ResNet50 imagenet model with minimal loss in accuracy. Our work differs from prior work in this space since we directly use the discriminative ability of model components to identify which components to remove to forget a given class.In this section, we provide the proofs for the main theoretical results proposed in the paper. Specifically, we provide proofs for Theorems 1-3 and Corollary 1.In this section, we provide the proofs for Theorem 1. In particular, we split the theorem into two parts -we provide a separate proof for the Total Variation distance lower bound and the Hellinger lower bound.Theorem. Let P, Q be two probability measures supported on X ⊆ R d , and let p and q be the corresponding densities. Let F be the set of functions with bounded first and second moments defined on X. Then,EQUATIONProof. Choose an arbitrary f ∈ F. Then, we havefp -fq 2 = X (p(x) -q(x)) f (x)dx 2 = X |p(x) -q(x)| |p(x) -q(x)| f (x)dx 2 ≤ X |p(x) -q(x)|dx 2 X |p(x) -q(x)|f (x) 2 dx 2 (by Cauchy-Schwarz) = 2TV(P, Q) X |p(x) -q(x)|f (x) 2 dx (by Definition 1) ≤ 2TV(P, Q) X (p(x) + q(x)) f (x) 2 dx = 2TV(P, Q) f (2) p + f (2) q .Thus, for any arbitrary f ∈ F, we haveEQUATIONq , from which it follows thatEQUATION)The proof of Theorem 1 follows from the fact that we can choose f (x) = u ⊤ φ(x), and apply the formula for the expectation. Then, maximizing over F is equivalent to maximizing over u. Thus, the proof is completed.First, we restate the Theorem for clarity.Theorem. Suppose P and Q are sets of moments of two probability measures supported on X . Let φ(X) be a vector of polynomials such that EP [φ(X)] = g(P), E Q [φ(X)] = g(Q), E P [φ(X)φ(X) ⊤ ] = G(P), and E Q [φ(X)φ(X) ⊤ ] = G(Q), and let f = u ⊤ (φ(X) -g(P)-g(Q)2), be a witness function. Then, for any P ∈ S k (P), Q ∈ S k (Q), supported on a set X ⊆ R d , we haveEQUATIONwhereEQUATIONand ∆g = g(P) -g(Q) and G(P) = G(P) -g(P)g(P) ⊤ .Proof. First, recall that Theorem 1 provides lower bounds for all distributions for which the moments of the witness function are given by fp ,EQUATIONq . Begin by choosingEQUATIONf (2) p = u ⊤ E P φ(x) - g(P) + g(Q) 2 φ(x) - g(P) + g(Q) 2 ⊤ u = u ⊤ E P (φ(x) -∆) (φ(x) -∆) ⊤ u (setting ∆ = g(P) + g(Q) 2 )= u ⊤ E P (φ(x) -g(P) + g(P) -∆) (φ(x) -g(P) + g(P) -∆)⊤ u = u ⊤ G(P) -g(P)g(P) ⊤ + 1 4 (g(P) -g(Q))(g(P) -g(Q)) ⊤ u.Similarly, we havef (2) q = u ⊤ G(Q) -g(Q)g(Q) ⊤ + 1 4 (g(P) -g(Q))(g(P) -g(Q)) ⊤ u.Substituting this into (11), we getTV(P, Q) ≥ sup u∈R d 1 2 u ⊤ (g(P) -g(Q)) 2 u ⊤ (G(P) -g(P)g(P) ⊤ + G(Q) -g(Q)g(Q) ⊤ )u + 1 2 (u ⊤ (g(P) -g(Q))) 2 = sup u∈R d 1 2 2 u ⊤ (g(P) -g(Q)) 2 2u ⊤ (G(P) -g(P)g(P) ⊤ + G(Q) -g(Q)g(Q) ⊤ )u + (u ⊤ (g(P) -g(Q))) 2 = sup u∈R d (u ⊤ (g(P)-g(Q))) 2 u ⊤ ( G(P)+ G(Q))u 2 + (u ⊤ (g(P)-g(Q))) 2 u ⊤ ( G(P)+ G(Q))u = sup u∈R d (u ⊤ (g(P)-g(Q))) 2 u ⊤ ( G(P)+ G(Q))u 2 + (u ⊤ (g(P)-g(Q))) 2 u ⊤ ( G(P)+ G(Q))u Let S TV (P, Q; u) = u ⊤ (g(P) -g(Q)) 2 u ⊤ ( G(P) + G(Q))u .Then,S * TV = max u S TV (P, Q; u) = u ⊤ (g(P) -g(Q)) 2 u ⊤ ( G(P) + G(Q))u = (∆g) ⊤ ( G(P) + G(Q)) -1 (∆g)Thus, we haveEQUATIONTo show the second inequality, we first state the following Lemma.Lemma 1. Suppose P and Q are sets of moments of two probability measures supported on X . Let φ(X) be a vector of polynomials such that EP [φ(X)] = g(P), E Q [φ(X)] = g(Q), E P [φ(X)φ(X) ⊤ ] = G(P), and E Q [φ(X)φ(X) ⊤ ] = G(Q), and let S H (P, Q; u) = |u ⊤ (g(P) -g(Q))| u ⊤ G(P)u + u ⊤ G(Q)u) and S TV (P, Q; u) = u ⊤ (g(P) -g(Q)) 2 u ⊤ (G(P)u + G(Q)) u ,and letS ⋆ H (P, Q) = arg max u S H (P, Q; u) and S ⋆ TV (P, Q) = arg max u S TV (P, Q; u).Then,EQUATION)Proof. To prove this statement, we first show that S * H(P, Q) 2 ≤ S * TV (P, Q). Fix û = arg max u S ⋆ H (P, Q; u).From this, we see thatS * H (P, Q) 2 = (û ⊤ (g(P) -g(Q))) 2 û⊤ G(P)û + û⊤ G(Q)û) 2 = (û ⊤ (g(P) -g(Q))) 2 û⊤ G(P)û + û⊤ G(Q)û + 2 û⊤ G(P)û û⊤ G(Q)û ≤ û⊤ (g(P) -g(Q)) 2 û⊤ (G(P)u + G(Q)) û ≤ S * TV (P, Q).Next, letd 1 = S * TV (P, Q) 2 + S * TV (P, Q) and 2d 2 = S * H (P, Q) √ 2 + S * H (P, Q) 2 .We haved 2 = S * H (P, Q) 2 2 + S * H (P, Q) 2 + 2 √ 2S * H (P, Q) ≤ S * H (P, Q) 2 2 + S * H (P, Q) 2Since x x+2 is monotonically increasing for positive x, we prove the statement by the fact thatS * TV ≥ S * H 2 .With these results, the Theorem is proved.In this section, we prove Corollary 1. Recall that the lower bound proposed in Theorem 1 is not tight, as the Cauchy-Schwarz inequality used in the derivation of the bound is only not strict when the witness function f is a constant. However, there are cases where the bound can be used to compute the true TV distance. We show this case in Corollary 1, which we restate and prove in the sequel.Corollary. Suppose P ≡ N (µ p , Σ) and Q ≡ N (µ q , Σ) Let f (x; u) = u ⊤ (x -1 2 (µ p -µ q )) be a witness function. Then,TV(P, Q) = 2Φ (u * ) ⊤ (µ p -µ q )/2 -1,whereu * = arg max u (E x∼P [f (x; u)] -E x∼Q [f (x; u)]) 2 E x∼P [f (x; u) 2 ] + E x∼Q [f (x; u) 2 ]Proof. First, following the proof of Corollary 2, we have u * = Σ -1 (µ p -µ q ). Note that this is identical to the weights of the Gaussian discriminant classifier discussed in, say, [9] . Substituting u * into the expressionTV(P, Q) = 2Φ (u * ) ⊤ (µ p -µ q )/2 -1, we get TV(P, Q) = 2Φ (µ p -µ q ) ⊤ Σ -1 (µ p -µ q )/2 -1.The risk of the Bayes classifier, as given in [45] , isR * (P, Q) = Φ(-(µ p -µ q ) ⊤ Σ -1 (µ p -µ q )/2), where Φ(x) is the Gaussian cdf. Using the fact that Φ(x) = 1 -Φ(-x), and the identity 2R * (P, Q) = 1 -TV(P, Q), we get TV(P, Q) = 2Φ (µ p -µ q ) ⊤ Σ -1 (µ p -µ q )/2 -1. Note that with this choice of u * , the square root term remains well-defined. This matches the well-known result for the TV distance between Gaussian measures with the same variance. Thus, we prove the statement.Remark: This result also illustrates the case where the Bayes' classifier lies in the set of functions F := {f (x) : f (x) = u ⊤ φ(x)} for a given function φ(x). In this case, if φ(x) = x -1 2 (µ p -µ q ), and P and Q are Gaussian with the same variant, the Bayes classifier is equivalent to the Fisher discriminant.In this section, we prove Theorem 3. We restate the result for convenience, and prove the Theorem thereafter. Theorem. Suppose P, Q be two probability measures supported on X ⊆ R d , with densities p and q, and letµ p = E P [x], µ q = E Q [x] and C p = E P [xx ⊤ ], C q = E Q [xx ⊤ ].Suppose we have plug-in estimates μp , Cp , μq , Cq as defined in (7) , that satisfy ∥µ p -μp ∥ 2 ≤ δ p and ∥µ q -μq ∥ 2 ≤ δ q ∥C p -Cp ∥ F ≤ ρ p and ∥C q -Cq ∥ F ≤ ρ q .Then, with a witness function of the formEQUATIONwhere M = {(µ p , µ q ) : ∥µ p -μp ∥ 2 ≤ δ p , ∥µ q -μq ∥ 2 ≤ δ q }, ∆µ = µ p -µ q , and ρ = ρ p + ρ q .Proof. First, note that f (x) = u ⊤ x. Thus, fp = u ⊤ µ p and fq = u ⊤ µ q f (2) p = u ⊤ C p u and f(q) = u ⊤ C q u. Thus, for exact values, we haveTV(P, Q) ≥ D TV (P, Q; 2) = (u ⊤ (µ p -µ q )) 2 u ⊤ (C p + C q )u = (µ p -µ q ) ⊤ (C p + C q ) -1 (µ p -µ q ).However, there are errors that arise from using plug-in estimators (defined in (7) . To handle the estimation error for C p and C q , we rely on ( 23) in Lanckriet et al. [28] . That is,max Cp:∥ Cp-Cp∥F ≤ρ u ⊤ C p u = u ⊤ ( Cp + ρI)u.We substitute these values back into the lower bound, and impose the constraints on the µ p and µ q . Thus, we prove the theorem.Remark B.1. The proof follows a similar logic to that of the derivation of (15) in Kim et al. [24] .C Additional Results: Computational Complexity of r l,j scores with Different Witness functionsIn this section, we detail the computational cost of computing the r l,j scores needed for DISCEDIT-SP and DISCEDIT-U. We tabulate our results in Table 3 .Explanation for Storage Complexity For a fixed witness function, for each filter, we only need to store 4 real numbers per class (that is, for a distribution P , we store fc , f (2) c , fc , and f (2) c . For Fisher and MPM type witness functions, we need to store the class-conditional and class-complement means and covariances of φ(X) for each class, in total requiring the storage of O(n 2 ) values. For DISCEDIT-U, since we only need to compute scores for a single class, the dependence on C vanishes.The computational complexity of one-shot pruning of a given layer using DISCEDIT-SPdepends on the number of filters L, the number of classes in the dataset C, and the witness function itself. If the Witness function is fixed a priori, the cost of computing each TV distance is O(1). Thus, in this case, the complexity is O(LC) to compute all the pairwise TV distance lower bounds, and O(LC) to find the minimum for each filter. For Fisher discriminant-type scores (such as are used in DISCEDIT-SP-F, or the witness function used in Section 7.3), given that φ(X) is a vector of length n, this requires the inversion of a matrix, which requires O(n 2 ) iterations. Thus, in this case, the cost is O(LCn 2 ) iterations (this subsumes the cost of finding the minimum). For MPM based witness functions (such as those used in DISCEDIT-SP-Q), this requires solving an SOCP ( Õ(n 3 ) complexity, Õ(•) suppresses ϵ accuracy terms). Thus, the cost is Õ(LCn 3 ). For DISCEDIT-U, since we only need to compute scores for a single class, the dependence on C vanishes. Cost (P)Storage (P) Cost (U) Storage (U) Fixed (a priori) O(LC) O(LC) O(L) O(L) Fisher-type Witness Function O(LCn 2 ) O(LCn 2 ) O(Ln 2 ) O(Ln 2 ) MPM-type Witness Function O(LCn 3 ) O(LCn 2 ) O(Ln 3 ) O(Ln 2 )for some γ ∈ (0, 1). We can now find a relation between γ and η. First, note that if 1 -e-∆ 4 ≤ η, then ∆ ≤ 4(1 -η). Similarly, if we prune ∆ 2+∆ ≤ γ, then ∆ ≤ 2γ 1-γ .Equating the two gives us the expressionη = 3γ -2 2γ -2 .Thus, both TVSPrune and a variant of DISCEDIT-SP-F where the TV distance is measured pairwise, and which prunes at a threshold are equivalent, as they require pruning the jth filter if∆ ≤ 4 -4η = 3γ -2 2γ -2 .The BatchNorm random variables for this layer are given byEQUATIONAs stated earlier, our goal is to minimize the TV distance between the distributions of the pruned and unpruned features; we use the BatchNorm random variables as a proxy for the features Y l (X). Next, the moments of BN l (X) are given byEQUATIONSuppose BN l (X) is drawn from the distribution D BN,l In this section, we detail additional experiments conducted in the course of this investigation. In particular, we provide experimental results highlighting the utility of our lower bound on synthetic datasets, and provide expanded results for the Gaussianity tests provided in Section 6.1.In this section, we use the bounds proposed in Corollary 2 to bound the TV distance between poorly separated datasets. We choose the 'Two Spirals' Dataset, and a dataset consisting of two zero-mean Gaussians with different variances. We choose f (x) = u ⊤ (φ(X) -( φ1 -φ0 )/2), where ϕ(X), when chosen to be of degree d ≥ 1, is given by φ(X) = 1 + (1 ⊤ X) + • • • + (1 ⊤ X) d .We present our results in Figure 2 . We observe that using the lower bound for Fisher outperforms the MPM lower bound on both toy datasets. However, the choice of polynomial witness functions clearly outperforms lower degree choices, such as using the Hellinger lower bound, particularly in the 'Two Gaussians' case.In this section, we utilize the lower bounds provided in this paper to prune hard-to-prune layers in neural networks. As noted in Murti et al. [39] , Liebenwein et al. [34] , some layers, in particular the initial layers in the case of VGG-nets, are difficult to effectively sparsify. In this set of experiments, we aim to show that using the lower bounds proposed in this work, we are able to better identify discriminative filters in hard-to-prune layers, and therefore prune those layers more effectively. Experiment Setup: We select a VGG16 model trained on CIFAR10. We fix pruning budgets of 40%, 50%, 60%, 70%, 80%. For each model, we then prune three hard-to-prune layers in isolation, and measure the impact on accuracy. We compare the following methods: TVSPrune: We modify TVSPrune to prune a fixed budget, and using the BatchNorm random variables as described in Appendix D. DISCEDIT-SP-EQ: We apply Algorithm 5 as presented in Appendix D using the features φ(1 ⊤ X) = [1 ⊤ X, (1 ⊤ X) 2 ]. Thus, for each c, f (c) (X) = u ⊤ (φ(X) -( φc + φc )/2)).L 1 -based Pruning: We use the L 1 norms of the filter weights, as proposed in [32] .We present our results in Figure 3 The experiments show that DISCEDIT-SP variants using quadratic features (using algorithms outperform both TVSPrune and the L 1 -normbased pruning strategy. In particular, we see that at 70% sparsity in Layers 1-3, the models obtained by DISCEDIT-SP-EQ are 6.6% more accurate than those obtained using TVSPrune.In this section, we attempt to validate the assumptions made in Murti et al. [39] about the normality of the class-conditional feature distributions. To do so, we apply the Shapiro-Wilks test [49] , a standard test for Normality. Experiment Setup: We consider a VGG16 model trained on CIFAR10. Let BN l j (X) = 1 ⊤ Y l j (X). For each l, j, we collect 100 samples from each class c ∈ [10] . We then apply the Shapiro-Wilk normality test [49] , and we compute p l j,c values, which are the minimum p-values from the Shapiro-Wilks test computed for the features of the jth filter in layer l conditioned on class c. We consider that a filter's features are unlikely to be Gaussian if p l j,c < 0.1. We plot the heatmaps of p l j = min c∈[C] p l j,c values for 15 randomly selected filters in Figure 4 , to indicate the normality of the least Gaussian class-conditional features.Results: We observe that for most layers, particularly those close to the output, the class-conditional feature distributions are highly unlikely to have been drawn from a Gaussian, with p l j,c values for layers 10-12 in VGG16 typically being below 1e -5. For layers with filters that yield likely-Gaussian features, we observe that for the majority of filters, at least one feature output is likely to be non-Gaussian. We present this data in Figure 4 . In this section, we conduct a slate of experiments aimed at demonstrating that the effectiveness of DISCEDIT-SP is not dependent on particular instantiations of models. Specifically, we apply DISCEDIT-SP to multiple instances of models trained on CIFAR10, CIFAR100, and Imagenet. We present specific results in the subsequent subsections. We consider the following models.• VGG16/19 trained on CIFAR10 and CIFAR100: We use the pre-trained VGG11/16/19 models trained on CIFAR10 and CIFAR100. The models achieve accuracies greater than 90% on both datasets.• ResNet56 trained on CIFAR10: We consider a ResNet56 model trained on CIFAR10. We do not prune layers that are part of complex interconnections (such as the final layer in each BasicBlock). • ResNet50 trained in Imagenet: We consider a ResNet50 model trained on Imagenet. We do not prune layers that are part of complex interconnections, as was the case in ResNet56. • ViT trained on CIFAR10 We trained a custom ViT on CIFAR10. The details of the model are given below in Table 9 : The accuracies of this models are given in Table 10 The accuracies of all models are given in Table 11 below: For Pruning Since we assume that the training dataset is unavailable to us, we utilize the validation set as a proxy for the data-distribution. We detail our dataset splits in Table 12 . Note: the subset In this section, we detail the hyperparameters used when fine-tuning pruned models. We present the hyperparameters for CIFAR10 and Imagenet models only, as we did not fine-tune models that used CIFAR100.CIFAR10 Fine-tuning We detail the hyperparameters used in our CIFAR10 experiments below. Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).Our code is available at: https://github.com/chaimurti/DisCEdit 


Decision: The reviewers acknowledge the soundness and the technical novelty of the paper. The rebuttal has a positive impact on the final ratings and the reviewers scored 2 accepts, 1 weak accept, and 1 borderline reject. The ACs followed the reviewers' recommendation.

Reviews: review: paper_summary: paper_summary: This paper proposes a method for model editing of convolutional classifier networks. The proposed approach assess the class-discriminative ability of convolutional filters by looking at the distribution of their produced feature maps. Specifically, by comparing the class conditional feature distribution to the marginal feature distribution (which is related to the Bayes error rate of the filter), this work is able to produce a saliency score for each filter that determines its importance for classifying a specific class.  For model pruning, the least discriminative filters are pruned, whereas for class forgetting, the most discriminative filters for the forget class are removed.

This work involves several technical innovations; primarily,  they approximate computation of the TV distance between the class conditional and marginal feature distributions by proposing a moment-based lower bound, which does not make assumptions about the feature distributions, such as Gaussianity.

Numerical results reported for model pruning and class forgetting using ResNets and VGG nets on ImageNet, CIFAR10, CIFR100. Results demonstrate compelling performance. Interesting additional results in the appendix, e.g., analyzing the distribution of the feature maps.

The contribution of this work is both theoretical and empirical.
strength_weakness: strength_weakness: * Numerical results both in the main paper and the appendix do not report the actual accuracies of any of the models. Instead, they only report relative drops in performance on forget and non-forget classes. The link provided for the ImageNet classifier in line 910 in the appendix does not work.
* Computational complexity of the approach compared to related works is not clear; specifically, what is the cost of computing the saliency scores for each filter in your experiments, and how does it compare to those of related methods.
* Motivation for the choice of witness functions in numerical results is not well motivated, where do these choices of functions come from?
* Minor issue in Fisher discriminant eq. (2)... should be $\Sigma_q$ not $\Sigma_2$.
* Minor issue in algorithm description for class unlearning; the filter saliency scores should be class labeled $r^c_{\ell, j}$ and should be computed using equation (10) not equation (9).
* Applicability: method is currently restricted to image classification with convolutional networks.
questions: questions: * Please fix the minor issues described above.
* Consider reporting computational performance of proposed method compared to baselines.
* Motivate the choice of witness functions in numerical results, and provide any ablations where applicable.
* Report model accuracies in all tables, and not just relative performance drops.
* Minor; consider adding figures to summarize performance and confidence intervals across all classes.
* Please consider elaborating and including numerical results indicating the impact of the number of classes on the ability to find class discriminative filters. These can be conducted on ImageNet by training models on subsets of the classes; e.g., 10 classes, 100 classes, 500 classes, 1000 classes. 
* Please consider including experiments with a small vision transformer (e.g., ViT-Tiny) and discuss how the approach might extend beyond convolutional networks.
limitations: limitations: N.A.
paper_summary: paper_summary: The paper addresses the task of model editing that focuses on modifying critical components within neural networks to improve performance. One of the cornerstone steps is to first identify these components. The authors adopt an approach based on recently proposed discriminative filters hypothesis. Instead of using a Total Variation distance (which is intractable in this case), the authors derive a lower bound on the TV that is subsequently used to discover critical subnetworks responsible for classwise predictions.
The authors introduce algorithms for structured pruning and selective class forgetting and experimentally show its performance.
strength_weakness: strength_weakness: - It is quite challenging to evaluate the performance of the propose solution due to the absence of comparison to other methods. While it is possible to see that the method is capable of preserving the overall test accuracy almost unchanged while reducing the quality of predictions on a chosen class by ~80%, it is still challenging to interpret these values. It looks to me that the methods listed in A.4 can be relevant and included into comparison.
- Related work is moved to Appendix. In my opinion, it would be better to include at least a shortened version into the main part of the paper so that the readers can easier understand the relations of the proposed method to the existing literature.
questions: questions: NA
limitations: limitations: The authors has adequately addressed the limitations.
paper_summary: paper_summary: In this work, the authors propose to tackle two problems at once, class unlearning and structured pruning. To do so, they propose a novel way to compute a lower bound on the total variation distance between distributions of features.
In practice, this distance is approximated using the first and second order moments of a transformation of intermediate features generated from samples of specific classes. The aforementioned transformations are specific to the task of class unlearning or structured pruning.
The resulting method comes with a strong theoretical background, completed by convincing empirical evidence regarding.
strength_weakness: strength_weakness: I have one minor concern regarding the evaluation of the method:
In the main paper, the authors insist on the ability of the proposed method to better discriminate important filters in the case of pruning and selective class forgetting. However, the experiments all include fine-tuning and a quite extensive one on pruning with up to 100 epochs. In my understanding, this empirically validates that the filter selection leads to a selection that can be better fine-tuned, not necessarily that the selection alone better preserves the performance.
I think that some experiments in that regard were conducted and discussed in the appendices, but they should be moved to the main paper if possible. Also, they should be extended to ImageNet, also, if possible.
questions: questions: I have three questions:
1. (main point from weaknesses) can the author provide results on ImageNet without fine-tuning to highlight the better selection of filters from their method in the main paper?
2. It is now standard to include transformers when evaluating pruning techniques. If the authors could provide results on Bert, that would benefit the scope of the paper.
3. In the article, it is claimed that the method can perform structured pruning with no access to the data. However, from my understanding, the saliency score from equation 9 uses Y(X) which is computed with some data. Could the authors elaborate on this point, please?
limitations: limitations: The authors have adequately addressed the limitations of their work.
paper_summary: paper_summary: This paper applies model editing to address two active areas of research, Structured Pruning and Selective Class Forgetting.
Specifically, it adopts a distributional approach to identify important components useful to the model's predictions.
With the witness function-based lower bounds on the TV distance, it is able to discover critical subnetworks responsible for classwise predictions, thus achieving Structured Pruning and Selective Class Forgetting.
strength_weakness: strength_weakness: 1. The code provided by the authors redirects to an empty GitHub repository, lacking reproducibility.

2. This paper focuses on the well-established research areas of machine unlearning and structured pruning. 
However, the authors fail to provide an introduction to the field or an overview of the current state of existing research.

3. In the experiments of DISCEDIT-U, the authors do not compare its results with other existing unlearning methods, making it difficult to ascertain whether it outperforms the current baselines.

4. The experimental results of DISCEDIT-SP show no significant improvement over the compared baselines, especially when evaluated against CHIP on ImageNet.
questions: questions: 1. The authors should provide a more detailed description of machine unlearning and structured pruning, along with a comprehensive introduction to the current research landscape in these areas.

2. To demonstrate the effectiveness of the proposed DISCEDIT-U, the authors should compare its performance against other works within the field.

3. The authors should incorporate a more detailed introduction of the experimental setup and the results into the main text, rather than relegating them to the appendix without sufficient description.
limitations: limitations: n/a

Comments: title: Thanks!
Gentle Reminder about approaching Auhor-Reviewer discussion deadline
Gentle Reminder about Author-Reviewer Discussion Deadline
Gentle Reminder about upcoming deadline
Rebuttal
Response to Reviewer
Response to Reviewer
Response to Reviewer
Response to Reviewer
Additional Experimental Results - ViT pruning/unlearning
Response to rebuttal
comment: We thank the reviewer for the engagement! As the author-reviewer discussion period comes to a close in the next 36 hours, we're eager to continue to engage with you, particularly if there are any other unaddressed concerns you might have, and what we might do to improve your appraisal of our work.
We'd like to provide a gentle reminder that the author-reviewer discussion period ends in 36 hours. We hope that we've addressed the concerns raised in your review in our previous responses, and we are very eager to engage with you further if you have additional concerns, and what we might do to improve your evaluation of our work.
We'd like to gently remind the reviewer that the Author-Reviewer discussion period ends in 36 hours. We sincerely hope that we've addressed the concerns you expressed, and we're eager to engage further with you, and identify how we might improve your rating of our work.
We would like to gently remind the reviewer that the author-reviewer discussion period ends in less than 48 hours. We hope we've addressed the concerns you raised in your detailed review of our work. We would really to engage with you further, and in particular, address any additional concerns you may have.
Thank you for your answers! I decided to keep my rating unchanged.
We have responded to the concerns raised by the reviewer in our previous response. In particular,  we have 
- addressed the empty github link
- highlighted our related works section in Appendix A
- shown the comparison of our models as compared to baselines *without fine-tuning*
- given formalizations of unlearning and pruning in addition to what we presented in Section 3 of the main document. 
- Comparisons with baselines for model unlearning have been presented in the general rebuttal [**here**](https://openreview.net/forum?id=tuiqq1G8I5&noteId=8sBlgK4EB5).
- Moreover, we have added the requested ViT experiments (by reviewers YbA1 and FULk) as a response to the General Rebuttal [**here**](https://openreview.net/forum?id=tuiqq1G8I5&noteId=MiXju1ozmG). 

We hope that we have adequately addressed your concerns, and are eager to find out what we might do to improve your appraisal of our work.  We would like to gently remind the reviewer that the author-reviewer discussion period ends in 3 days, and we are eager to engage further with you.
We thank the Reviewer for engaging with us so clearly early on, as well as the patience shown! We hope that this adequately addresses the reviewer's concerns. 

As regards Table 7, we thank you for the suggestion, and will incorporate Table 7 into the main document

We have presented the requested experiments on ViTs as a response to the general Rebuttal [**here**](https://openreview.net/forum?id=tuiqq1G8I5&noteId=MiXju1ozmG). Our experimental results highlight the fact that the proposed approaches for model editing (pruning and classwise unlearning) are effective when used with Vision Transformers as well.

As the author-reviewer discussion period ends in 3 days, we are eager to engage further and would like to know what we might do to improve the reviewer's appraisal of our work.
We hope we have adequately addressed the reviewer's concerns, and thank you for your positive review of our work. 

In response to the concerns you raised, we would like to point out that we have:
- provided comparisons with additional baselines in the general rebuttal [**here**](https://openreview.net/forum?id=tuiqq1G8I5&noteId=8sBlgK4EB5), as requested by the reviewer. 
- we will add at least a truncated version of the related works section into the main manuscript
- We have presented experimental results on a simple ViT as asked by reviewers crkh, FULk, and YbA1 as an additional comment to the General Rebuttal [**here**](https://openreview.net/forum?id=tuiqq1G8I5&noteId=MiXju1ozmG). 


We would like to gently remind you that the author-reviewer discussion period ends in 3 days, and we are eager to engage further, and to find out what we might do to improve your appraisal of our work.
We thank you for your patience, and have provided the requested ViT experiments as a response to the General Rebuttal [**here**](https://openreview.net/forum?id=tuiqq1G8I5&noteId=MiXju1ozmG). We see that our proposed approaches for model editing (specifically structured pruning and model editing) are effective when applied on vision transformers as well.

In our previous response, we have addressed the following points:
- addressed various typos pointed out by the reviewer
- discussed the motivation for the choice of witness function
- discussed the applicability of work beyond CNNs, as well as the broad applicability of our key theoretical results 
- discussed how difficult it is to identify discriminative filters in different networks/different datasets
- discussed the computational cost of our approach against common baselines and provided clock times for our method compared to baselines.

We hope that we have adequately addressed your concerns, and are eager for further engagement. Given that the rebuttal period ends in 3 days, we would be grateful to know what we might do to improve your appraisal of our work.
As requested by the reviewers, we present showcasing our pruning results on ViTs. 

We describe the model below:

|  |  |
|--|--|
| Context Length | 65 |
| Embedding dim. | 384 |
| Transformer Encoders | 7 |
| MLP layers to be pruned | 14 |
| Total params. | 6.27m |

We reduce the embedding dimension by pruning the MLP and Layernorm layers. 

We use the same architecture for CIFAR10 and CIFAR100 datasets, and we detail the test accuracies below.

| Dataset | Test Acc. |
|--|--|
| CIFAR10 | 88.2% |
| CIFAR100 | 69.5% |


### Pruning
We prune the model by a fixed percentage without pruning the Attention heads - we prune the weights and biases of the MLP- and LayerNorm layers, without fine-tuning the model. Fully pruning attention heads is the focus of our ongoing research.

**CIFAR10**

| MLP Sparsity Ratio | Params Pruned | Test Acc (ours)| Relative Accuracy (w.r.t. unpruned model) |
|--|--|--|--|
| 30% | 1.24M | 82.7% | 94% |
| 50% | 2.08M | 74.8% | 85% |
| 70% | 3.12M  | 28.5% | 32% |

**CIFAR100**

| Sparsity Ratio | Params Pruned | Test Acc (ours)| Relative Drop |
|--|--|--|--|--|
| 30% | 1.24M | 60.3% | 87% | 
| 50% | 2.08M | 42.8% | 62%  | 
| 70% | 3.12M  | 5.2% | 8% | 


**Takeaway: our method achieves 50% sparsity on MLP layers while retaining 85% of the original accuracy on CIFAR10 *without any fine-tuning of the model*.**

### Class Unlearning

We prune a small fraction of the rows of the MLP weight matrices and the layer norm weights.  We present the average Forget Class (FC) and Remain Class (RC) test accuracies over all classes. 

**CIFAR10**
| Sparsity | Avg. FC acc. | Avg. RC acc. |
|--|--|--|
| 5.2%  | 16.5% | 66.3% |

**CIFAR100**
| Sparsity | Avg. FC acc. | Avg. RC acc. |
|--|--|--|
| 5.2%  | 13.1% | 54.2% |

We also provide an additional experiment wherein we only prune the initial embedding layer and the LayerNorm layers, allowing us to achieve significant forgetting by editing fewer than 1% of parameters (approximately 40000 parameters).

**CIFAR10**
| Sparsity | Avg. FC acc. | Avg. RC acc. |
|--|--|--|
| 0.4%  | 7.3% | 40.6% |


**Takeaway: Our method achieves significant reductions in forget class accuracy with minimal model edits *without fine-tuning*.**

Note that our code base has been updated as well.
I would like to thank the authors for their response. I would recommend moving Table 7 from the appendix to the main paper since it appears to answer many concerns from several reviewers. I consider that most of my points have been addressed, and I am looking forward to seeing your results on ViT.