Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancement

Authors: zhehao  huang
xinwen  cheng
jinghao  zheng
haoran  wang
zhengbao  he
tao  li
xiaolin  huang
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-14 08:44:46

Abstract: Machine unlearning (MU) has emerged to enhance the privacy and trustworthiness of deep neural networks. Approximate MU is a practical method for large-scale models. Our investigation into approximate MU starts with identifying the steepest descent direction, minimizing the output Kullback-Leibler divergence to exact MU inside a parameters' neighborhood. This probed direction decomposes into three components: weighted forgetting gradient ascent, fine-tuning retaining gradient descent, and a weight saliency matrix. Such decomposition derived from Euclidean metric encompasses most existing gradient-based MU methods. Nevertheless, adhering to Euclidean space may result in sub-optimal iterative trajectories due to the overlooked geometric structure of the output probability space. We suggest embedding the unlearning update into a manifold rendered by the remaining geometry, incorporating second-order Hessian from the remaining data. It helps prevent effective unlearning from interfering with the retained performance. However, computing the second-order Hessian for large-scale models is intractable. To efficiently leverage the benefits of Hessian modulation, we propose a fast-slow parameter update strategy to implicitly approximate the up-to-date salient unlearning direction.
Free from specific modal constraints, our approach is adaptable across computer vision unlearning tasks, including classification and generation. Extensive experiments validate our efficacy and efficiency. Notably, our method successfully performs class-forgetting on ImageNet using DiT and forgets a class on CIFAR-10 using DDPM in just 50 steps, compared to thousands of steps required by previous methods. Code is available at [Unified-Unlearning-w-Remain-Geometry](https://github.com/K1nght/Unified-Unlearning-w-Remain-Geometry).

Main paper: 
 introduction: 
 Machine Unlearning (MU) [1] [2] [3] aims to remove the influence of samples from a pre-trained model, ensuring the model behaves as if it has never encountered those samples. The significance of MU research has grown following data protection regulations [4, 5] . It has rapidly developed in recent years, becoming an important means to help pre-trained large-scale models adapt to various trustworthy challenges [6] in computer vision (CV). In general, MU aids in purging outdated knowledge [7, 8] , mitigating biases [9, 10] , and preventing large text-to-image models from generating not-safe-for-work (NSFW) images [11] [12] [13] [14] .Existing MU methods are mainly divided into two categories: exact (or certified) MU [15] and approximate MU [16] . For deep neural networks, achieving exact MU necessitates retraining on a dataset excluding forgetting samples. However, retraining is computationally prohibitive for recent large-scale deep networks. Thus, in MU for deep networks, this retrained model only serves as an aspirational standard to be approached [17] . We primarily focus on more efficient approximate MU.Approximate MU strives to align the output distribution of unlearned models with that of retrained models. We initially explore the vanilla gradient descent of minimizing the output Kullback-Leibler (KL) divergence between the current iteration and the retrained model. Our deduction reveals that this direction consists of three parts: a weighted gradient ascent to eliminate the influence of forgetting samples, a descent gradient for fine-tuning the remaining set, and a weight saliency matrix modulating the unlearning direction. Such decomposition provides a novel perspective that unifies previous MU approaches proposed in recent years [18] [19] [20] [21] [22] [23] [24] [25] , most of which only focus on one or two of these components. For example, SalUn [26] insightfully proposes saliency-based unlearning, which only optimizes the parameters important to forget, but lacks theoretical support. Our analysis fills this gap and provides new directions for further improvement.In fact, the vanilla gradient descent for approximate MU actually pursues the steepest descent under Euclidean distance [27] [28] [29] [30] . However, constraining parameter updates within an Euclidean region is arbitrary, as it treats the importance of all parameters equally. Recent research indicates deep models' parameters and training processes are embedded in a low-dimensional manifold [31, 32] . Thus, there exist manifolds where changes in Euclidean between parameters are drastic, yet the output space remains unchanged. In MU, it is evident that the importance of model parameters varies for forgetting and remaining [33, 26] , prompting the following question. Can model parameters be embedded in a manifold that allows effective forgetting while efficiently maintaining remaining performance?Figure 1 : Overview of our proposal vs. previous unlearning methods on erasing concept 'nudity' in diffusion models [11, 12] . Conventional methods seek the steepest descent within an Euclidean ball, often compromising general capabilities. In contrast, we reach the region around retraining along a remain-preserving manifold. To address the large cost of Hessian, we implicitly approximate the up-to-date salient unlearning direction.To achieve this goal, we propose to discover the descent direction under the KL divergence on the remaining output distribution. Using such a manifold metric, the forgetting direction can be amended by a second-order Hessian on the remaining set to prevent forgetting loss from harming retained performance. Such iterative direction is dominated by the unlearning function, allowing the optimization process to focus on efficient forgetting. However, computing the secondorder Hessian for large-scale models is computationally intensive, contradicting the need for efficiency in unlearning. Existing methods for estimating the second-order Hessian rely on initial parameters and keep them fixed thereafter [34, 35] . Therefore, we propose a fast-slow weight [36, 37] method (Fig. 1 ) to implicitly and dynamically approximate the salient forgetting direction with Hessian modulation, forming a unified MU approach for CV unlearning tasks including image classification and image generation. Key contributions of this paper include:• We provide a novel perspective to unify previous approaches by decomposing the vanilla gradient descent direction of approximate MU into three components: weighted forgetting gradient ascent, remaining gradient descent, and a weight saliency matrix.• We derive the steepest descent direction for approximate MU on the remain-preserved manifold.• We propose a fast-slow weight method to implicitly approximate online Hessian-modulated salient forgetting updates.• We conduct experiments on a wide range of CV unlearning tasks across multiple datasets and models of different architectures, verifying the effectiveness and efficiency of our method. 
preliminary: 
 Problem Setup. MU aims to help a well-trained model eliminate the influence of specific data points, categories, or high-level concepts and patterns [1, 38] . Let D = {z i } N i=1 represent a pretraining dataset of N data points, including z i = (x i , y i ) features and labels in supervised learning. The forgetting dataset, D f = {z f i } N f i=1 ⊂ D, is a subset of the pretrained dataset. Its complement, D r = {z r i } N r i=1 = D\D f , is the remaining dataset that we wish to retain. The learner is a model parameterized by θ. p z (θ) = p(z; θ) represents the model output probability. The pre-trained model is obtained by empirical risk minimization, i.e., θ 0 = arg min θ L(θ; D) = arg min θ i∈D ℓ(θ; z i ), as Pretrain. This empirical risk can be divided into two parts based on the forgetting and retaining datasets. L(θ; D) = i∈D f ε i ℓ(θ; z f i ) + j∈D r ℓ(θ; z r i ) = L f (θ; ε) + L r (θ), where ε = {ε i } N f i=1weight the former part [39, 38] . For the pre-trained model, the coefficients ε 0 = 1 are all ones. The following are the instantiations in CV unlearning tasks. In classification (Cls) problems, models output the class posterior probability p(z Cls ; θ) = p(y|x; θ) and the empirical risk for each sample is the cross-entropy (CE) loss ℓ Cls (θ; z) = ℓ CE (θ; x, y). In the image generation (Gen) task of conditional diffusion models [40] [41] [42] , the output is the conditional sampling probability p(z Gen ; θ) = p(x|y; θ), and the average loss function for each sample is the mean squared error (MSE) loss: ℓ Gen (θ; z) = ℓ MSE (θ; x, y) = E t,ϵ∼N (0,1) [∥ϵ -ϵ θ (x t |y)∥ 2 2 ], where t represents the diffusion step, ϵ is the random noise sampled from a Gaussian distribution N (0, 1), ϵ θ is the conditional denoising model, and x t is the noisy version of the input image. For a more detailed introduction to image generation using conditional diffusion models and latent diffusion models, please refer to Appendix B. 3 .Exact and Approximate Machine Unlearning. Exact MU [15, 43, 1] ensures that the parameter distribution of the unlearned model is identical to that of a model trained from scratch without seeing the forgetting samples. For large-scale models, exact unlearning can only be achieved by retraining (RT) on the remaining dataset θ * = arg min θ L r (θ). However, the computational cost of retraining in response to every forgetting request is prohibitive. Therefore, we regard RT as a gold standard to approximate rather than a competitor. A more practical approach is to guide the unlearned model output distribution to approximate the output distribution of RT, known as approximate MU [16] . If we use KL divergence to measure the difference in output distributions, the objective of approximate unlearning can be expressed as:min θ D KL (p z (θ * )||p z (θ)) = min θ p z (θ * ) log[p z (θ * )/p z (θ)]dD,starting from θ 0 . Therefore, a straight metric to approximate unlearning is the KL divergence from the retrained model's output distribution. In addition, we also investigate metrics related to forgetting efficacy, retained performance, and privacy protection for evaluation in image classification and generation tasks. For details of evaluation, please refer to Sec. 5 and Appendix D.Steepest Descent. Approximate MU methods are usually based on gradient updates to obtain the unlearned model [18, 21] . Let's first reinterpret the gradient with steepest descent [29, 27, 30] . The goal of steepest descent is to find the direction δθ = θ t+1 -θ t that drives the objective function F (θ) descent fastest within a ξ-neighborhood of the current parameters θ t . This can be formulated as the following optimization problem. (See Appendix A.1 for proof.) δθ := arg min ρ(θt,θt+δθ)≤ξEQUATIONwhere ρ(•, •) represents the manifold metric that renders the geometry of the parameter's neighborhood.To simplify the derivation, we rewrite it to the form on the right, where α t (ξ, θ t ) represents the learning rate required to move the distance ξ. In the following, we fix a small learning rate α t to approximate a search within a local neighborhood. The characterization ρ of the underlying coordinate space of the neighborhood will determine update directions, optimization paths, and the flatness of the minimum. Vanilla gradient descent is obtained using the Euclidean metric, Newton's direction is measured by the second-order expansion of the objective function [44] , and the KL divergence in the output space induces a natural gradient [30, 45] . Next, we will probe approximate MU through vanilla gradient descent and attempt to benefit from improved manifold metrics. 
approximate mu from perspective of steepest descent: 
 Revisit Approximate MU Methods via Vanilla Gradient Descent. We begin with the vanilla gradient descent direction to address approximate MU. This involves finding the steepest descent direction that minimizes the KL divergence with the retrained output within the vicinity of the current model θ t . The optimization problem can be formalized as follows:EQUATION= arg minθt+1 D KL (p z f (θ * )||p z f (θ t+1 )) (a) p f + D KL (p z r (θ * )||p z r (θ t+1 )) (b) p r + 1 α t ρ(θ t , θ t+1 ) (c), where p f = p(D f |D) and p r = p(D r |D) = 1 -p f denote the partition of forgetting and remaining dataset, respectively. Analyzing (2), (a) seeks to eliminate the influence of the target forgetting samples, (b) aims to maintain the performance on the remaining samples, and (c) employs the metric ρ to constrain the magnitude of each update, thereby identifying the direction of steepest descent on the manifold. To solve the optimization challenge outlined in (2), we posit that for the current model θ t , there exists a set of coefficients ε t = {ε t,i } N f i=1 that weights the forgetting loss, positioning θ t as the minimizer of the weighted loss for the original training set. The unlearning process necessitates adaptations in coefficients of forgetting loss. Then, we can determine the vanilla gradient descent for approximate MU by using Euclidean distance ℓ 2 as the manifold metric, as stated in Prop. 1. Proposition 1. Under the Euclidean manifold metric, ρ(θ t , θ t+1 ) = 1 2 ∥θ t -θ t+1 ∥ 2 . Assuming that the current modelθ t = arg min θ L f (θ; ε t ) + L r (θ). Let H f * = ∇ 2 L f (θ * ; 1)and H r * = ∇ 2 L r (θ * ) denote the Hessian of the retrained model on the forgetting set and the remaining set, respectively. Then, the steepest descent direction that minimizes (2) is approximately: EQUATION✓ ✓ ✓ ℓ2 GA [20, 21] ✓ ✓ ✓ ℓ2 BT [23] ✓ ✓ ✓ ℓ2 SalUn [26] ✓ ✓ ✓ ✓ ✓ ℓ2 SA [35] ✓ ✓ ✓ D r KL SFR-on ✓ ✓ ✓ ✓ ✓ D r KL ✓The proof can be found in Appendix A.2. To elucidate the effectiveness of gradient-based unlearning methods, we decompose the vanilla gradient descent direction in (3) into three components: (F), (R), and (S). (F) represents the gradient ascent direction of the weighted forgetting loss, which directs the model to discard the information of the forgetting samples. Fine-tuning (FT) [22, 19, 38] fails to guarantee MU due to the absence of (F). Current approximate MU methods such as Random Labeling (RL) [20] and BadTeacher knowledge distillation (BT) [23] are akin to weighted forgetting loss gradient ascent, uniformly leading to an increase in the loss on forgetting samples. The unlearning process often causes catastrophic forgetting of the retained knowledge. Thus, it is common to integrate (R) fine-tuning on the remaining set to sustain the model's general capabilities. Unlearned models via Gradient Ascent (GA) [20, 21] usually lose usability without (R). Furthermore, (S), ignored in most of the previous literature, involves two Hessian modulation parts. H f * amplifies the parameter updates crucial for forgetting, while (H r * ) -1 dampens those important for maintaining. The notion of (S) closely mirrors the Weight Saliency introduced in SalUn [26] . We provide theoretical support for this notion. Importantly, our framework makes no assumption regarding input modalities, allowing its flexible application across various CV unlearning tasks.Approximate MU in Remain-preserving Manifold. In fact, employing Euclidean distance as the manifold metric for parameter updates is arbitrary. It treats all coordinates as equally important because the local second-order expansion is identical ∇ 2 θt ( 1 2 ∥θ t -θ t+1 ∥ 2 ) = I. This uniform treatment overlooks the varying parameter significance for forgetting and remaining. Moreover, certain manifolds of parameter space can exhibit substantial variations in Euclidean metric, yet the induced model output remains almost unchanged [46] . Since the retrained model performance on forgetting is unpredictable, it is pragmatic to introduce manifolds related to the remaining. Therefore, a practical objective is to constrain parameter updates during unlearning within a manifold that minimally impacts the retained performance. An empirical characterization of such a manifold could be the KL divergence on the output distribution of the remaining set, D r KL . Given that the original well-trained and the retrained model output closely match the ground-truth remaining distribution, ∇L r (θ 0 ) ≈ ∇L r (θ * ) ≈ 0. By starting with θ 0 and limiting updates to this manifold, the maintained output distribution remains almost consistent throughout the unlearning iterations, ∇L r (θ t+1 ) ≈ ∇L r (θ t ) ≈ ∇L r (θ 0 ) ≈ 0. This consistency permits a second-order Taylor expansion at θ t to terms (b) and (c) in (2), providing crucial curvature information for unlearning to prevent deviations in the model output on the remaining set, leading to Prop. 2. Proposition 2. Using the model output KL divergence on the remaining set as the manifold metric, ρ(θ t , θ t+1 ) = D KL (p z r (θ t )||p z r (θ t+1 ))). Assuming that the current model θ t = arg min θ L r (θ) + L f (θ; ε t ). Let αt = α t p f /(α t p r + 1), and H r t = ∇ 2 L r (θ t ) represent the Hessian w.r.t. θ t on the remaining set, then the steepest descent direction that minimizes (2) is approximately:EQUATIONWe defer the proof to Appendix A.3. The unlearning updates in (4) incorporated second-order Hessian concerning remaining to guide the optimization direction. Specifically, the large curvature direction of H r t corresponds with the weights that encapsulate remaining knowledge, while the small curvature direction encourages model updates for effective unlearning. Furthermore, the update direction in (4) primarily follows the weighted gradient ascent (F) modulated by weight saliency (S). Such unlearning iterative updates in remain-preserving manifold focus on diminishing the distributional discrepancy with exact MU concerning forgetting output.Challenges in Hessian Approximation. To exploit the benefits of unlearning updates within the remain-preserving manifold, the key point is (H r t ) -1 . However, calculating the Hessian and its reverse for large-scale models is computationally demanding [47] . Consequently, many methods have been developed to estimate the Hessian, such as Fisher information [34] , Fisher diagonals [48] , and Kronecker factored Laplace approximation [49] . Regarding unlearning, Selective Amnesia (SA) [35] employs the initial model's remaining Fisher diagonals as the second-order Hessian constraint on parameter updates. However, the fixed Hessian in SA leads to progressively increasing estimation biases, exacerbated by cumulative errors in Taylor expansion, which harms the retained performance during unlearning. To address this issue, the subsequent Sec. 4 introduces an fast-slow weight update method that implicitly approximates the direction adjusted by the up-to-date Hessian. 
proposed method: 
 Implicit Online Hessian Approximation (R-on). Given that computing the inverse of even wellapproximated Hessian demands substantial computational resources, it is more practical to estimate the unlearning direction post-Hessian inversion modulation directly. Inspired by recent insights into the connection between Meta-Continual Learning and Hessian approximation [50] , we propose a fast-slow weight [36, 37] method for implicitly approximating the desired updates. The optimization problem for fast weight updates is formulated as follows: minEQUATIONwhere L u represents an arbitrary forgetting loss and β t is its learning rate. The iterative process is depicted in Fig. 1 . A step of forgetting is taken at the current model, resulting in θ f t . Several gradient descent updates on the remaining set follow to obtain the minimum point θ r t . This fine-tuning ensures that the updated model adheres to the remain-preserving manifold. The slow weight updates leverage the underlying connection between θ t and θ r t , as stated in Prop. 3. Proposition 3. For implicit online Hessian approximation in (5), suppose β t , δ t is small, β t < δ t /|∇L r (θ t ) -[∇L r (θ t )] 2 |, L r is µ-smooth, i.e., ∥∇L r (θ) -∇L r (θ ′ )∥ 2 ≤ µ∥θ -θ ′ ∥ 2 ,EQUATIONThe proof is in Appendix A.4. Prop. 3 indicates that the model θ r t , obtained after fine-tuning using the process described in (5) , is approximately equivalent to updating the current model θ t by one step in the Hessian-adjusted unlearning direction. We use this direction to update the outer loop.Comparison with the joint loss (R). We investigate the differences in the updates between our optimization in (5) (R-on) and the joint optimization of forgetting and remaining losses (R) [23, 25] . We take the checkpoint after the first step of fine-tuning the remaining set as an example and ignore the step size.LEQUATIONEQUATIONComparison of the updates in (7) and (8) reveals that the remaining gradient is the same. Our forgetting update in fast weight is adjusted by an additional term -H r t , which is absent in joint optimization. This modification weakens the directions that significantly impact the remain, thereby mitigating the damage of forgetting loss on the retained performance. Furthermore, certain methods [24] suggest two-stage unlearning that first impairs the model and then repairs it, actually paralleling a single fast-slow weight update of our method.Sample-wise Adaptive Coefficient for Gradient Ascent (F). Despite a variety of forgetting losses introduced in previous literature, we stick to our theoretical result in (4) and adopt the weighted forgetting loss. Due to intractable challenges in solving the inverse problem associated with the arg min condition for the gradient ascent coefficients, we explore the properties of these coefficients and propose a heuristic estimation. ε t,i satisfies: ① For the pretrained model, ε 0,i = 1. ② For the retrained model, ε T * ,i = 1, where T * is the optimal step to obtain RT. ③ Assuming homogeneity of samples, if ℓ(θ; z f i ) > ℓ(θ; z f j ), then ε t,i < ε t,j [51] . Moreover, considering the continuity in the model parameter space implies the continuity of ε t,i in the function space. Thus, our heuristic estimation consists of decreasing numerical values across steps and sample-wise adaptation based on loss magnitude,EQUATIONwhere T represents the outer loop iteration, λ is the temperature scalar to control the smoothness of coefficients, and [•] detach denotes the operation to detach a tensor from the computational graph, which means ℓ(θ t ; z f i ) in ( 9) only serves for weighting coefficients and does not contribute to the gradient. εt,i is employed to modulate the gradient ascent loss for forgetting samples, thereby preventing model explosion and reducing the contribution to updates from samples whose influence has already been ablated, while prioritizing those whose losses remain minimal and are not yet adequately forgotten. However, relying solely on empirical loss as an evaluation metric for sample contribution is limited and potentially biased. We believe that enhanced designs for coefficient estimation in future research could yield more accurate unlearning results.Forget-Remain Balanced Weight Saliency (S). Recall in the theoretical framework of (4), the steepest descent leverages H f * (H r * ) -1 as weight saliency to modify the forgetting gradient. However, computing both Hessians at RT is impractical, necessitating an estimation of weight saliency for both forgetting and remaining. Previous work like SalUn [26] considers only parameters that significantly affect the forgetting set, whereas these parameters might also critically impact the retained performance. To address this and align with our theoretical insights, we adopt techniques from SSD [33] to approximate H f * (H r * ) -1 using the diagonal of the initial model's Fisher information matrix. Through a hard thresholding operation, we obtain the weight saliency map:EQUATION)I[•] is an element-wise indicator function, and γ > 0 is a hard threshold used to control the Forget-Remain balance in selecting parameters. Guided by (4), we apply the weight saliency map exclusively to forgetting, in contrast to SalUn [26] which applies to both forgetting and remaining. The saliency map can enhance the unlearning process by directing updates to focus on the parameters that are crucial for erasing specific samples or concepts. More advanced weight saliency estimation is expected to improve outcomes in future work.Integrated Fast-slow Weight Update. By integrating the three designs into a single update scheme towards the Saliency Forgetting in the Remain-preserving manifold online, we develop our SFR-on method. Specifically, in the inner loop for fast weights, we use adaptive coefficients in (9) to weight the forgetting gradient ascent with the weight saliency map from (10) to serve as the unlearning update in (5) . Slow weights in outer loops update by linearly interpolating the fine-tuned θ r t and θ t in weight space, achieving an estimated steepest descent for approximate MU under the remaining output constraint in (4) . Then, we have the overall fast-slow weight update rule:EQUATIONOuter Loop :EQUATIONwhere α t represents the slow weights learning rate. Worth mentioning that our SFR-on does not require adaptation to specific application tasks, nor does it necessitate modifications to the task's inherent loss. Consequently, our approach can be seamlessly applied to various CV unlearning scenarios by simply substituting the loss in the weighted gradient ascent with either CE loss for image classification or MSE loss for image generation. Considering that calculating fine-tuning or the Fisher diagonal on the complete remaining dataset for large-scale image generation tasks, we randomly select an equivalent number of samples from the remaining as in the forgetting set for computation [35, 26] . We find that our method remains effective under such an inadequate setup, as detailed in Sec. 5. The complete algorithm is placed in Appendix C. Table 2 : Performance summary of MU methods for image classification (including RT, six baselines, our proposed SFR-on, and ablations on our designed components), assessing unlearning 10% random subset of CIFAR-10 using ResNet-18 and TinyImageNet using Swin-T. All results are presented as mean and standard deviation across 10 independent trials. Performance discrepancies from RT are indicated with (•), highlighting that more effective unlearning is reflected by performance closer to RT. The 'Averaging Disparity' (Avg.D) metric is calculated by the average of the gaps measured in accuracy-related metrics, including FA, RA, TA, and MIA. DKL denotes the KL divergence to RT. RTE is recorded in minutes.  
experiments: 
 Datasets, Models, and Settings. In image classification, we primarily focus on the random subset unlearning task. Evaluations are conducted using ResNet-18 [52] on CIFAR10 [53] and Swin-T [54] on TinyImageNet [55] , with additional tests on random subset and class-wise forgetting tasks involving CIFAR100 [53] and SVHN [56] , detailed in Appendix F.2. In image generation, our main interest lies in class-wise forgetting tasks. Following [35, 26] , we unlearn conditional DDPM [40] with the UNet architecture [57] on CIFAR10. Moreover, for the first time, we explore the latent diffusion model [42] equipped with Diffusion Transformer (DiT) [58] on ImageNet [59] , which demonstrates superior scalability in learning large-scale data generation tasks. Finally, we perform concept forgetting tasks using the open-source Stable Diffusion (SD) V1.4 [42] to inhibit the generation of NSFW content, specifically by targeting the prevention of nude images. Further details on unlearning setups and training are available in Appendix E.Baselines and Evaluation. We regard RT as an oracle of approximate MU and compare our proposal with eight MU methods, including six gradient-based MU approaches outlined in Sec. 3: FT [19] , GA [21] , BT [23] , RL [20] , SalUn [26] , and SA [35] . We also consider SCRUB [25] , an enhanced variant of BT, for image classification, and ESD [11] for removing concepts in SD. For the evaluation of random subset unlearning tasks, we measure the output KL divergence D KL between the unlearned and retrained models, which is the direct target of approximate MU. Besides, we assess the accuracy on the forgetting set (FA) for unlearning efficacy, and the accuracy on the remaining (RA) and test (TA) sets for preserved generalization ability. We also consider the success rate of membership inference attack (MIA) [60, 38] on the forgetting set as a privacy metric. Note that the smaller the disparity in these metrics against RT, the more effective the unlearning. Run-time efficiency (RTE) is also reported. For class-wise forgetting tasks in image generation, we evaluate the accuracy of the unlearned model's generated images on forgetting classes (FA) by a pre-trained classifier. The Fréchet Inception Distance (FID) [61] metric assesses the retained generative capability for remaining classes.For ablating the 'nudity' concept in SD, we employ the NudeNet [62] detector to identify and count nude body parts in generated NSFW images. For further introduction to the baselines and detailed evaluation metrics, please refer to Appendix E.1 and D.To assess the unlearning effectiveness and efficiency of SFR-on, we perform comprehensive experiments and conduct ablation studies to address the following four key questions:Q1: How does SFR-on perform on unlearning in image classification? We first evaluate the performance of our method, SFR-on, against existing gradient-based MU methods on the image classification random subset unlearning task. In this scenario, the forgetting set, remaining, and test sets all originate from the same distribution. Consequently, even if the model undergoes unlearning on the random subset, it may still generalize to these samples. To avoid potential biases from only using FA as an unlearning metric, we incorporate MIA to assess the privacy retention of the forgetting set, enhancing the robustness of assessments. As detailed in Tab. 2, for forgetting 10% random subset on CIFAR-10 and TinyImageNet, SFR-on not only most closely aligns with RT in the averaging metric disparity but also exhibits the smallest output KL divergences w.r.t. RT. This performance underscores our effectiveness and efficiency in achieving the objective of approximate MU. The results of the increased 50% random subset unlearning task are included in Appendix F.2. Q3: What is the impact of each component of SFR-on on forgetting performance? To investigate the efficacy of each component we developed for the decomposition of approximate MU, we perform ablation studies. We build on the joint training of GA and FT as our baseline (R) and incorporate our proposed implicit online hessian approximation (R-on), adaptive coefficients (F), and forget-retain balanced weight saliency (S). As demonstrated in the last four rows of Tab. 2, the addition of our (R-on) allows models to effectively forget while sustaining performance on the remaining set. Both (F) and (S), crafted to approach the steepest descent for approximate MU, enhance the unlearning efficacy. In image generation, as depicted in the last three rows of Fig. 2 , although the joint training (R) is capable of completely forgetting targeted classes, it results in distorted images for remaining. Replacing (R) with our (R-on) remarkably improves the image fidelity of the remaining classes, but the forgetting class images still show low-quality textures. Further, our (F) and (S) effectively direct the unlearning process towards the approximate MU, ensuring that the performance of the unlearned models closely mirrors that of RT. More ablations on hyperparameters are provided in Appendix F.1. Q4: How effective is SFR-on in NSFW content removal for SD? We finally assess the efficacy of our method in removing the 'nudity' concept from the open-source SD to prevent the generation of NSFW content. Given that SD V1.4 is trained on the LAION dataset [63] , purging all images depicting nudity and retraining the model would be prohibitively time-consuming and resource-intensive. In this unlearning task, we designate 'nudity' as the forgetting set and generate a set of clothed individuals as remaining to preserve SD's generalization capability across non-nudity themes. We utilize the inappropriate image prompts (I2P) [12] to query potentially NSFW content from the unlearned SD and employ NudeNet to detect exposed body parts in these images. The results in Tab. 4 demonstrate that our method significantly prevents the generation of culturally sensitive body parts, such as breasts and genitalia, highlighting our strength to enhance the trustworthiness of machine learning applications.↓ FID ↓ FA ↓ FID ↓ FA ↓ FID ↓ FA ↓ FID ↓ FA ↓ FID ↓ FA ↓ FID ↓ FA ↓ FID ↓ FA ↓ FID ↓ FA ↓ FID ↓ FA ↓ FID ↓ SA 0. 
conclusion: 
 This paper revisits gradient-based approximate MU methods from the perspective of the steepest descent. The descent direction under an Euclidean manifold metric can be divided into three integral components: weighted forgetting gradient ascent, fine-tuning remaining gradient descent, and weight saliency matrix. Our approach advances beyond the Euclidean constraints by embedding the unlearning update within a remain-preserving manifold. This novel strategy incorporates the second-order Hessian of the current model on remaining, safeguarding against detrimental impacts on retained performance. To circumvent the prohibitive computational demands of the Hessian in large-scale models, we introduce an efficient fast-slow weight update method to approximate the Hessian-adjusted direction. Furthermore, our innovative adaptive coefficient for weight forgetting loss and a forget-remain balanced weight saliency map facilitate near-retraining unlearning. Our method can be applied to popular CV unlearning tasks with empirically verified unlearning efficacy.Proof. We can decompose the original optimization problem into three parts: F (θ t+1 ), R(θ t+1 ), and C(θ t+1 ).EQUATION(Part I) First, we solve the forgetting part F (θ t+1 ) by taking the first-order approximation at θ t :EQUATIONWe denote ∇F (θ t ) = -E p(z f ;θ * ) ∇ log p(z f ; θ t ) = G(θ t ), and then expand G(θ t ) at θ * :EQUATIONwhereH f * = -E p(z f ;θ * ) ∇ 2 log p(z f ; θ * )is the Hessian w.r.t. the retrained model θ * at forgetting set, and ∆ t = θ t -θ * is the difference between the current model θ t and the retrained model θ * . We cannot directly obtain the parameter difference ∆ t and need to estimate it. Recalling the assumption that θ t = arg min θ L r (θ) + L f (θ; ε t ) and θ * = arg min θ L r (θ). We can utilize the optimality of θ t on the weighted function to take the derivative w.r.t. θ t and set it to zero:EQUATION)Since θ * minimizes L r , ∇L r (θ * ) = 0. By performing the Taylor expansion and dropping o(∆ t ) terms, we haveEQUATION)By plugging (A12) into (A10), we can get∇F (θ t ) = G(θ t ) ≈ -H f * (H r * ) -1 ∇L f (θ t ; ε t ). (A13)Bringing (A13) into (A9), we can getEQUATIONB Related Works B.1 Related Works on Machine Unlearning Data Forgetting. MU is driven by the imperative to remove the influence of specific data from pre-trained models [2, 3, 18, 64] , intrinsically linked to differential privacy [18, 64, 65, 15, 66] , which aims to enhance the privacy protection of training data. Exact MU, which is approached from a parameter probability perspective, has been thoroughly explored within convex optimization problems and linear models [18, 15, 39, 67, 16] . These studies have established methods allowing models to forget data exactly while adhering to a specified privacy budget, thus significantly reducing the risk of privacy attacks [68] [69] [70] [71] [72] . However, in deep learning models, exact data forgetting typically requires retraining from scratch [1] , a process whose computational intensity makes it impractical for routine application. This challenge underscores an urgent need for developing more efficient unlearning techniques that do not compromise the model's utility.Gradient-based Approximate Machine Unlearning. To enhance data forgetting efficiency, research has honed in on aligning the forgetting objective with the model's output probability distribution, termed approximate MU [3, 21] . Numerous studies [22, 19, 38, 20, 21, 23, 26, 73] have developed specialized loss functions to prompt the model to expunge specific data, aiming to mitigate the risks of privacy breaches such as membership inference [74, [68] [69] [70] [71] [72] and data reconstruction attacks [75, 76] .Echoing the phenomenon of catastrophic forgetting observed in continual learning [77] [78] [79] , training on forgetting data has precipitated significant declines in overall performance on remaining data.Various strategies [26, 24, 25] have emerged to uphold the model's original generalization capabilities, predominantly through fine-tuning the remaining set. Our approach provides a comprehensive analysis of iterative strategies employed in gradient-based approximate MU methods and introduces curvature information from the remaining set to better preserve the model's generalization capabilities.Machine Unlearning for Generative Models. Recent advancements in text-conditional image generation models have demonstrated remarkable capability in producing images that accurately reflect textual descriptions [40, 42, 41, 58] . Despite these achievements, extensive research [6, 12, 80] has underscored significant security and privacy concerns associated with these technologies. The mechanisms underlying these issues are not yet fully understood. In response, there is a critical demand for the development of MU methods to bolster the trustworthiness of these models, facilitating their wider adoption. While pioneering studies [12, 14, 11, 13] have begun to address concept deletion within diffusion models, the dual objectives of maintaining generalization and ensuring efficient data forgetting continue to pose significant challenges. 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines?Answer: [Yes] Justification: Our submission preserves anonymity.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: We discuss the broader impacts in Appendix G.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [Yes]Justification: We have safeguarded the potentially unsafe images appearing in the paper.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: All original papers and codebases are appropriately cited in this paper.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.• If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?Answer: [NA]Justification: The paper does not release new assets.Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 
crowdsourcing and research with human subjects: 
 Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?Answer: [NA]Justification: The paper does not involve crowdsourcing nor research with human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector. 
institutional review board (irb) approvals or equivalent for research with human subjects: 
 Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?Answer: [NA]Justification: The paper does not involve crowdsourcing nor research with human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.• We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: Steepest Descent and Natural Gradient. Steepest Descent [81, 29, 27, 30, 82] is one of the foundational algorithms in optimization, particularly in the context of machine learning and neural networks. Despite its simplicity and widespread use, Steepest Descent can suffer from slow convergence, especially in ill-conditioned problems where the objective function's curvature varies significantly across different dimensions [29] . Natural Gradient [83, 30, 84] is proposed as an enhancement of the standard gradient descent that addresses some of its limitations by considering the underlying geometry of the parameter space. Natural Gradient employs the Fisher Information Matrix to scale the gradient adaptively, leading to more efficient optimization. Natural Gradient has been shown to significantly accelerate convergence and improve optimization performance in various applications, including deep learning [30, 27] and continual learning [28] . We get inspiration from these techniques and try to improve MU update direction with preserved set curvature information.Hessian Approximation. Computing the exact Hessian matrix is often impractical for large-scale problems due to its computational and memory requirements. To address this, various Hessian Approximation methods have been developed. Notable approaches include Diagonal and Low-rank Approximations [34, 85, 86] , Stochastic Approximation [87] [88] [89] , and Quasi-Newton Methods [90, 91] . [50] reveals that the regularization-based method is an explicit approximation of the Hessian, while the meta-learning method is an implicit estimation of it. By leveraging second-order information in a computationally feasible manner, these techniques strike a balance between accuracy and efficiency, facilitating the optimization of large-scale problems.Conditional Diffusion Models and Classifier-free guidance. Diffusion models [40] have gained prominence in the field of generative modeling, particularly for their effectiveness in generating high-quality images. A sample x T is sampled from a Gaussian distribution and gradually denoised for T time steps, finally recovering a clean sample x 0 . Conditional Diffusion Model [40] is a variant that conditions the generation process on additional information c such as class labels, text descriptions, or other modalities. In practice, the conditional diffusion model is trained to predict the noise ϵ θ (x t |c) to form the denoising process p θ (x t-1 |x t , c), where x t is a noisy version of the input x. The corresponding objective of the conditional diffusion model is typically formulated as:EQUATION)with t uniformly sampled from {1, . . . , T }. In this setting, classifier-free guidance [41] is proposed to encourage the sampling procedure to find x with high log p(c|x). Then diffusion process is given by εθ (x t |c) = (1 -w)ϵ θ (x t |∅) + wϵ θ (x t |c), where εθ (x t |c) represents the noise estimation obtained by the conditional diffusion model given c, w ∈ [0, 1] is the guidance weight, ∅ denotes the 'null' condition. The generation process initiates with Gaussian noise xT ∼ N (0, 1) and repeats denoising the data by εθ (x t |c) to obtain xt-1 until t = 0, producing the authentic data conditioned on c.Latent Diffusion Models. Direct training of conditional diffusion models in high-resolution pixel space is often computationally prohibitive. Latent diffusion models (LDMs) [42, 58] address this challenge with an image compression approach. Specifically, an autoencoder is trained using perceptual loss and a patch-based adversarial objective to master the process of perceptual image compression. The input images can be embedded into smaller latent representations with the learned encoder E. The trained autoencoder facilitates the transition to a low-dimensional latent space where the diffusion model is more efficiently trained on the representations z = E(x) rather than on high-resolution images x. Authentic images can then be generated by sampling a representation z from the diffusion model and subsequently reconstructed into an image with the learned decoder x = D(z).We present the algorithm of our proposed SFR-on in Alg. A1. In steps 3-4, we first calculate the forget-remain balanced weight saliency mask. In steps 6-8, we compute the adaptive coefficients to weight the forgetting gradient ascent, followed by one step of forgetting update within the inner loop.In steps 9-13, we fine-tune the model on the remaining set. In step 14, we perform the slow weight update for the model in the outer loop.• Forgetting accuracy (FA): FA is the accuracy of the unlearned model on the forgetting dataset D f . A favorable approximate MU method should reduce the disparity of FA with the retrained model.• Remaining accuracy (RA): RA is the accuracy of the unlearned model on the remaining dataset D r .A favorable approximate MU method should reduce the disparity of RA with the retrained model.• Testing accuracy (TA): TA is the accuracy of the unlearned model on the testing dataset D t . D t in random subset forgetting is sampled from the same distribution as the remaining dataset, while in class-wise forgetting D t excludes the samples from the forgetting class. A favorable approximate MU method should reduce the disparity of TA with the retrained model.• Membership inference attack success rate on D f (MIA): Following [33] , we use a prediction entropy-based membership inference attack to evaluate the privacy preservation of the unlearned model. We first need to train an adversarial classifier to predict whether or not a particular example was contained in the training dataset. The prediction of the remaining dataset and the testing dataset by the unlearned model is collected to compute the label-agnostic prediction entropy for the attack classifier training. Specifically, a Logistic Regression classifier is trained on the remaining prediction entropy labeled as '1' and the testing prediction entropy labeled as '0'. Then, this attack classifier is Algorithm A1 The Algorithm of Proposed SFR-on Compute adaptive coefficients εt-1 by ( 9).8:θ f t-1 = θ t-1 -β f ∇L f (θ t-1 ; εt-1 ) 9: θ r 0 = θ f t-110:for t ′ = 1 to T in do 11:Sample remaining sample batch B r t from D r 12:θ r t ′ = θ r t ′ -1 -β r ∇L r (θ r t ′ -1 )13:end for 14:θ t = θ t-1 -α(θ t-1 -θ r Tin ) 15: end for applied to the forgetting prediction entropy to predict the membership of these forgetting samples. The success rate of membership inference attack on D f is quantified by the true positive rate predicted by our classifier, MIA = T P/N f , where T P represents the count of forgetting samples still identified as training samples and N f is the size of the forgetting dataset. Due to the limitations of the membership inference attack, the attack based on a linear classifier is weak and fails to distinguish all forgetting samples predicted by the retrained model as test samples. The more advanced shadow model-based sample-wise attack is too time-consuming to evaluate the MU method. Therefore, we only regard MIA as a readout function of the forgetting effect and advocate for the development of more precise and efficient membership inference attack techniques to enhance MU method evaluation. Note that a favorable approximate MU method also should reduce the disparity of MIA with the retrained model.• Output KL divergence with the retrained model (D KL ): Given that it is impractical to traverse all sample spaces, we actually calculate the empirical output KL divergence with RT θ * . We first collect the predicted class probabilities from both the unlearned and retrained models across the remaining and forgetting datasets. Then, we empirically compute the output KL divergence as follows:EQUATIONA40) where C denotes the set of the prediction classes, θ u is the unlearned model parameter, and z r i,c and z f j,c represent the i-th remaining sample posterior of the class c and the j-th forgetting sample posterior of the class c, respectively. Note that even the output KL divergence between retrained models is not zero due to the randomness of the training algorithm. A favorable approximate MU method is hoped to display as low output KL divergence with RT as possible.• Run-time efficiency (RTE): This measures the computation efficiency of an MU method. We record RTE in minutes. MU methods are more efficient the lower their RTE are. Clearly, RT is not an efficient MU method.• Forgetting accuracy (FA): We additionally train models to classify the images generated by the unlearned generative model. For CIFAR-10, following [35] , we use ResNet-34 from torchvision pre-trained on ImageNet and fine-tune it on CIFAR-10 for 20 epochs. For ImageNet, we directly use pre-trained ViT-L [92] from torchvision as the classifier. We compute the classification accuracy of 500 images generated by the unlearned model on each forgetting category as FA. A favorable approximate MU method is hoped to exhibit as low FA as possible.• Fréchet Inception Distance (FID): We evaluate the remaining image fidelity of the unlearned model by assessing the standard image generation metrics FID. The model performed class-wise forgetting of CIFAR-10 generates 1000 images for each remaining class for FID. We sample 10000 images from the unlearned DiT on ImageNet by randomly selecting the remaining classes to calculate FID. A favorable approximate MU method is expected to achieve as high FID as possible.• FT [22, 19, 38] : It fine-tunes the pre-trained model only on the remaining dataset to obtain the unlearned model. The code source is https://github.com/OPTML-Group/ Unlearn-Sparse.• GA [20, 21] : It conducts gradient ascent for the pre-trained model only on the forgetting dataset to obtain the unlearned model. The code source is https://github.com/ OPTML-Group/Unlearn-Sparse.• RL [20] : It replaces the forgotten set label with a random label that is not the same as the original label. Then, the modified forgetting set and the retained set are combined for fine-tuning the pre-trained model with the cross-entropy loss. The code source is https://github.com/OPTML-Group/Unlearn-Saliency.• SalUn [26] : It first obtained the top-k% large salient weight mask sorted by the absolute value of parameter gradient to the forgetting set loss. The pre-trained model is then finetuned using the same pipeline as for RL, and the gradient is modified using the weight saliency mask so that only the top-k% significant parameters are optimized. The code source is https://github.com/OPTML-Group/Unlearn-Saliency.• BT [23] : It stores pre-trained and randomly initialized models as competent and incompetent teachers, respectively. The unlearned model is acquired by minimizing the output KL divergence of the pre-trained model with the incompetent teacher on the forgetting set and with the competent teacher on the remaining set. The code source is https://github. com/vikram2000b/bad-teaching-unlearning.• SCRUB [25] : It only saves the pre-trained model as the teacher model. Then, it optimizes the pre-trained model to minimize the KL divergence with the teacher on the remaining set and maximize the KL divergence with the teacher on the forgetting set. The cross-entropy loss of the remaining set is added to further maintain the performance. The code source is https://github.com/meghdadk/SCRUB.• SA [35] : It needs to generate replaying remaining samples using pre-trained models in advance and calculate fisher diagonal on the replaying remaining samples for modulating parameter regularization terms. Its unlearning loss is composed of three components: the MSE loss to make the output generated by the pre-trained model for forgetting classes or concepts close to random noise, the generative model MSE loss optimized on the replaying remaining samples, and a parameter regularization term to maintain the pre-trained model parameters with second-order curvature modulation of Fisher diagonal. The code source is https://github.com/clear-nus/selective-amnesia.• ESD [11] : It saves a frozen SD as a copy. The SD model is then optimized so as to push the condition score for the erasing concept far away from the corresponding condition score generated by the frozen SD, and align with the unconditioned score generated by the copy. The code source is https://github.com/rohitgandikota/erasing. with T in = 1, α = 1.0, β f = 10 -3 , β r = 10 -4 , λ = 0.5, γ = 3. Experiments are run on 2 RTX 4090s.For ImageNet, we use pre-trained DiT-XL/22 with 256 × 256 resolution. All methods use AdamW optimizer with a constant learning rate of 10 -4 and batch size of 1. SA calculates the Fisher diagonal on randomly sampled 2000 remaining data, and trains for 10K steps with λ = 10 for the regularization term. SalUn obtains top-50% salient weight mask and trains for 10K steps with α = 10 -3 to balance the optimization of forgetting and remaining. Our SFR-on trains for 500 steps with T in = 1, α = 1.0, β f = 10 -7 , β r = 10 -4 , γ = 3. Since the batch size is 1, we ignore λ in adaptive coefficients. Experiments are run on 1 RTX 4090.For concept forgetting of 'nudity', following [26] , we use SD V1.4 3 to generate 1K images with the prompt 'a photo of a nude person' as the forgetting set and additional 1K images with the prompt 'a photo of a person wearing clothes' as the remaining set. All methods use Adam optimizer with a constant learning rate of 10 -5 and batch size of 1. ESD trains for 1K steps with negative guidance of 1.0. SalUn trains for 1K steps with 50% sparsity weight saliency and α = 0.1. Our SFR-on trains for 200 steps with T in = 1, α = 1.0, β f = 10 -6 , β r = 10 -5 , γ = 3. Since the batch size is 1, we ignore λ in adaptive coefficients. Experiments are run on 1 RTX 4090.F.1 Ablation Study on Temperature Scalar λ and Threshold γIn our SFR-on method, we investigate the impact of two key hyperparameters, temperature scalar λ for adaptive coefficients and threshold γ for the weight saliency mask, on the unlearning performance in image classification. We vary λ within the range [0, 1] and γ within [0, 2]. The results in Fig. A1 and A2 indicate that increasing γ and λ enhances model retention capabilities, but it could adversely affect both the forgetting performance and privacy protection. Therefore, we select the hyperparameters for our method based on the goal of minimizing the output KL divergence from Retrain, aligning with the objectives of approximate MU. We conducted experiments to assess the performance of unlearning a 50% random subset of CIFAR-10 and a 10% random subset on two additional datasets, CIFAR-100 and SVHN. The results in Tab. A3, A4, and A5 demonstrate that our SFR-on method consistently achieves the closest average metric disparity and the smallest KL divergence relative to Retrain across all three scenarios. These findings emphasize the broad unlearning efficacy of our approach.The input modality of the model does not constrain our analysis or methods. Therefore, our method can seamlessly extend to other modalities beyond images, such as natural language processing using large language models (LLMs), to achieve efficient forgetting. We conduct experiments using the recently proposed benchmark of TOFU [94] fine-tuned Phi-1.5 [95] to evaluate the effectiveness of our method in the LLM unlearning task, compared with four LLM unlearning baselines: gradient descent(GA), gradient difference(GradDiff [96] ), negative preference optimization(NPO [97] ), and its enhanced version. The TOFU dataset comprises fictional author biographies, along with questions and answers related to the authors' attributes, which helps assess methods of data forgetting on fine-tuned LLMs.As shown in Tab. A6, our method achieves superior forgetting quality, making the unlearned model almost indistinguishable from the retrained model based on the Truth Ratio distribution of the forget set. Additionally, our method efficiently preserves model utility.We conduct ablation experiments to assess the performance of our 'Sample-wise Adaptive Coefficient for Gradient Ascent (F)' and 'Forget-Remain Balanced Weight Saliency (S)' in the absence of repairing with the remaining set. The results in Tab. A7 affirm that these components, when used independently, can still enhance baseline performance.Our method can be directly applied to the task of forgetting a single data point without additional adaptation, as we impose no assumptions to constrain the size of the forgetting set. We conduct experiments under two setups to validate the effectiveness of our method in unlearning either a single The results in Tab. A8 and A6 indicate that, under these two settings, our method and all baselines achieve effective forgetting while fully retaining general performance.Given that the approximation in the theoretical analysis may not hold in practical implementation, verifying the approximation of the formula in the actual operation is necessary. In the proofs of Prop. 1 and 2, considering the approximations of ∇L r (θ 0 ), ∇L r (θ * ), and ∇R(θ t ), we demonstrate in Fig. A3 their gradient norms under practical unlearning settings, which are consistent with our theoretical assumptions. In our method, ∇L r (θ 0 ) ≈ ∇L r (θ * ) ≈ ∇R(θ t ) ≈ 0, allowing us to incorporate second-order information on the retain set.The additional results of class-wise forgetting across all CIFAR-10 classes are presented in Fig. A4 , A5, and A6. Our method successfully removes the semantics of the target classes without reducing the forgetting images to low-quality noise. Additionally, SFR-on maintains the generation fidelity of the remaining categories.Fig. A7 and A8 display the additional outcomes of class-wise forgetting on ImageNet using DiT by our SFR-on method. The diagonal images within these figures depict the targeted forgetting classes, demonstrating the unlearning efficacy of our method. Conversely, the images off the diagonal represent various non-forgetting categories, showcasing the unlearned DiT's generalization capability preserved across extensive class conditions.Broader Impacts. SFR-on can enhance trustworthy deep learning and is broadly applicable across various scenarios, aligning machine learning applications with ethical human standards. SFR-on can potentially increase the fairness of machine learning systems, mitigate biases against minority groups, and promote equitable decision-making processes. Moreover, SFR-on bolsters privacy protections 100.00±0.00 (0.00) 100.00±0.00 (0.00) 95.31±0.02 (0.22) 0.00±0.00 (0.00) 0.0553 0.0003 0.05 SalUn 100.00±0.00 (0.00) 100.00±0.00 (0.00) 95.47±0.00 (0.06) 0.00±0.00 (0.00) 0.0154 0.0002 0.12 SCRUB 100.00±0.00 (0.00) 100.00±0.00 (0.00) 95.64±0.03 (0.11) 0.00±0.00 (0.00) 0.0276 0.0002 0.11 SFR-on 100.00±0.00 (0.00) 100.00±0.00 (0.00) 95.60±0.05 (0.07) 0.00±0.00 (0.00) 0.0175 0.0002 0.10 within deep models and fortifies the security of these systems against potential privacy attacks. When deployed on public networks, our approach facilitates the continuous update of knowledge, enabling models to catch new developments without losing performance. In the case of generative models, implementing SFR-on reduces the likelihood of generating improper content and limits the possibility of infringing on intellectual property rights. This helps to enhance public confidence in machine learning technologies and encourages their broader acceptance and use.Limitations. We acknowledge the limitations of our study and encourage further exploration. While the theoretical framework of SFR-on accommodates various input modalities, this paper does not extend evaluations to include language models or graph neural networks. Consequently, we cannot ascertain the direct applicability of our method to these modalities without adaptation. Furthermore, the absence of an asymptotic analysis for the steepest descent in machine unlearning hinders our ability to determine the disparity between our approximation method and the optimal direction, which is crucial for refining the approach. We advocate for research to address these gaps in the future. Justification: The computational resources used in the experiments are indicated in Appendix E and the computational time overhead is given.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).https://github.com/ermongroup/ddimhttps://github.com/facebookresearch/DiThttps://huggingface.co/CompVis/stable-diffusion-v1-4 


Decision: The paper studies an important problem of machine unlearning, i.e. forgetting the influence of some data points, while preserving the remain geometry. The paper introduces a perspective to unify previous machine unlearning approaches by decomposing the gradient descent direction into three components: forgetting gradient ascent, remaining gradient descent, and weight saliency matrix. Then the steepest descent direction is derived based on the remain-preserving manifold geometry. Moreover, to overcome the computationally-intensive inverse Hessian calculation, a fast-slow weight method is proposed to implicitly approximate the Hessian-adjusted direction. The efficacy of the proposed methodology is demonstrated by some image classification (ResNet and DiT), image generation by DDPM, and LLM as well during rebuttal. 

After rebuttal, all the reviewers agree to accept the paper, so is the final decision, provided that the authors could reflect those discussions in the final version properly.

Reviews: review: paper_summary: paper_summary: This work introduces a perspective to unify previous machine unlearning approaches by decomposing the gradient descent direction into three components including forgetting gradient ascent, remaining gradient descent, and weight saliency matrix. The steepest descent direction is derived on the remain-preserved manifold, and a fast-slow weight method is proposed to implicitly approximate online Hessian-modulated salient forgetting updates.
strength_weakness: strength_weakness: I am not familiar with the concept of machine unlearning. It seems like this work is rigorous and comprehensive. From my perspective, there are no obvious weaknesses.
questions: questions: Is the proposed method available for models in other modalities, apart from images? Including experiments on other modalities such as large language models could further broaden the scope of this work.
limitations: limitations: Please refer to the "Weaknesses" and "Questions" sections.
paper_summary: paper_summary: This paper summarizes the previous gradient-based unlearning methods and proposes three essential components for unlearning: weighted forgetting gradient ascent, remaining gradient descent, and a weight saliency matrix. Then, this paper derives the steepest descent direction and proposes a fast-slow weight method to update the model parameters. The experiments in both image classification and image generation shows the effectiveness of the proposed method.
strength_weakness: strength_weakness: 1. The gradient-based unlearning methods usually make more changes to the latter layers than the previous layers, which leads to inefficient information removal. This paper does not consider the drawbacks of such unlearning methods.
2. For the image classification task, this paper only tries the ResNet18 model. Then, for the image generation, this paper only tries DDPM. It might not be enough to claim to ''form a unified MU approach for all CV unlearning tasks, including image classification and image generation.''
3. This paper lacks more ablation studies to prove how SFR affect the unlearning results compared with other methods without the repairing stage on the updated model.
4. The main contributions of this paper are not clear. This paper claims to derive the steepest descent direction and proposes a fast-slow weight method. However, this paper still lacks a thorough advantage analysis of the steepest descent direction and the proposed update method.
questions: questions: 1. How many remaining data does the proposed method require, and how many remaining data is actually used in experiments?
2. The calculation of Hessian matrix $(H_t^r)^{-1}$ still demands large computational resources. Does the proposed method have any approximation on it?
3. Although this paper claims the proposed methods can significantly reduce the optimization steps in unlearning, why does the RTE not show significant reductions compared with SCRUB and SalUn?
4. In the implementations, $\nabla\mathcal{L}^r(\theta_*)$, $\nabla C(\theta_t)$, and $\nabla R(\theta_t)$ may not be zero. Thus, how large are the influences of the three approximation operations in eqs 3,4,6.
limitations: limitations: No further potential negative societal impact.
paper_summary: paper_summary: The paper tackles the problem of machine unlearning, i.e. forgetting the influence of some data points, with remain-preserving manifold geometry. Authors dig deep into the gradient based approximate unlearning methods from the perspective of steepest descent and come up with a method beyond Euclidean constraints. To overcome computationally-intensive inverse Hessian calculation, authors proposed an efficient fast-slow weight update method to approximate the Hessian-adjusted direction. The theoretical findings are experimentally validated on CIFAR and TinyImagenet image classification problem and CIFAR and ImageNet image generation problems.
strength_weakness: strength_weakness: 1) Only CV unlearning is presented. If your method works on ML algorithms in general, it would be nice to present some results on other tasks such as NLP, Audio, etc.
2) One interesting observation is that machine unlearning should make the model such that "forget" and "test" set results as close as possible, meaning FA and TA should be really close like in gold-standard RT model. However the proposed method performs not really the best in terms of this metric (|FA-TA|) compared to previous approaches on TinyImageNet. I genuinely don't know if it is a good metric, I might be wrong. 

Minor:

3. it would be nice to show with arrows ($\uparrow$ and $\downarrow$) in table 2 which metrics are the greater the better and which are the lesser the better.
questions: questions: 1) How does your model remove the influence of one data point, when there's a request to delete one sample from the training dataset? This might be a practical scenario.
2) Are accuracy disparities actually good measure for unlearning comparison? It might be possible that two different models predicted right different samples, thus their accuracies are the same, while they are not close to each other.
3) Why does "R-only" models have greater RTE (longer time) compared to the "full SFR" model?
limitations: limitations: Authors clearly defined the paper's broader impact and limitations in the appendix G.

Comments: title: Response to additional questions
Thanks for your rebuttal.
Looking forward to further discussions (one day left before rebuttal ends)
Thank you!
Thank you!
Rebuttal Reference
Rebuttal Reference
comment: Additional **Q1**: Clarification on applicability to 'all CV unlearning tasks'

> We apologize for any confusion caused by our unclear wording. As you have noticed that currently 'classification and generation are two major computer vision tasks for unlearning', our phrase 'all computer vision unlearning tasks' is intended to refer specifically to widely studied unlearning settings, including class-wise and random subset forgetting. We fully acknowledge that segmentation and object detection are also crucial and popular areas in CV, and MU should not exclude them. We believe that the progress of MU on classification and generation may spread to other CV tasks. **To avoid any future misunderstandings, we will refrain from making broad claims on 'all computer vision unlearning tasks' and instead use more precise and accurate descriptions of the task scope**.
>
> Furthermore, it is important to note that our method is not constrained by input modalities or loss forms. We are eager to explore the potential of our approach for unlearning tasks in image segmentation and object detection in future research.

Additional **Q2**: Reducing the usage of training data in unlearning

>We agree that employing limited training data presents a more realistic scenario, and we appreciate your insights on reducing training data usage. MU is still in its preliminary stages. Thus, the standard configuration of previous baseline methods uses all the remaining data. Our study adheres to this setting to ensure fair comparisons.
>
>Notably, our variant without using retain data (Tab.R2 in response to your W3) has outperformed previous baseline methods (Avg.D$\downarrow$: 2.37(SF) < 3.03(SalUn)). **This indicates that our proposed components are capable of efficiently forgetting even in scenarios devoid of retain data.**
>
> Your suggestion to reduce the training data also hits the essence: using retain data inherently involves a trade-off between remaining data performance and forgetting efficiency. We look forward to contributing to future research that aims to pursue better a trade-off with limited or even no retain data.

Thank you for your detailed review and valuable comments. We notice that you mentioned there are three addition questions, but it appears we may have only received two. To ensure we can comprehensively address all concerns and refine our manuscript, could you please provide the details of the third question? Additionally, if there are any other concerns or suggestions that require further discussion, we warmly welcome your feedback!
Thanks for the authors' rebuttal. The rebuttal has solved my concerns on weaknesses 1, 3, and 4, and also on questions 2, 3, and 4.

However, I still have the following three questions (not requiring extra experiments)

1. I acknowledge that currently, classification and generation are two major computer vision tasks for unlearning. Still, it does not mean all CV tasks consider the importance of image segmentation, object detection, etc. Although there are few works towards the unlearning on such tasks, they should also be considered if the paper wants to claim to work on all CV tasks.

2. Access to all the training data may not be practical, even in classification tasks. Then, I suggest that this paper can reduce the usage of training data or use a small public training data during unlearning, and it might also improve the time efficiency.
We sincerely appreciate the time and effort you've invested in reviewing our manuscript. We hope that our responses have adequately addressed your concerns. As the discussion phase draws to a close in just one day, we kindly request your feedback on our rebuttal. If there are any remaining questions or concerns, we are looking forward to further discussions!
We deeply appreciate your kind appraisal and positive feedback. We will incorporate additional experiments on NLP in our final version. 

Thank you again for your helpful comments and dedicated effort in reviewing our manuscript.
I thank the authors for their response. I've read the related work section in Appendix B to learn more about the concept of Machine Unlearning, and I appreciate that the authors have included additional experimental results in the attached rebuttal PDF. I have accordingly increased my confidence score.
We deeply appreciate your kind appraisal and positive feedback. We will carefully plan the final version of our paper to incorporate additional experiments. 

Thank you again for your valuable insights and dedicated effort in reviewing our manuscript.
Thanks to authors for adequately addressing all the issues, therefore, I am raising my score to 7. Hope, you will find a space for the new experiments in the final version as they significantly bolster the paper.
> [1] Maini, Pratyush et al. “TOFU: A Task of Fictitious Unlearning for LLMs.” ArXiv. 2024.
>
> [2] Liu, B. et al. “Continual Learning and Private Unlearning.” ArXiv. 2022.
>
> [3] Zhang, Ruiqi et al. “Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning.” ArXiv. 2024.
>
> [4] Fan, Chongyu, et al. "SalUn: Empowering Machine Unlearning via Gradient-Based Weight Saliency in Both Image Classification and Generation." ICLR. 2024.
>
> [5] Liu, Jiancheng, et al. "Model sparsity can simplify machine unlearning." NIPS. 2023.
> [1] Goel, Shashwat, et al. "Towards adversarial evaluations for inexact machine unlearning." ArXiv. 2022.
>
> [2] Fan, Chongyu, et al. "SalUn: Empowering Machine Unlearning via Gradient-Based Weight Saliency in Both Image Classification and Generation." ICLR. 2024.
>
> [3] Martens, James. "New insights and perspectives on the natural gradient method." JMLR. 2020.
>
> [4] Wu, Yichen, et al. "Meta Continual Learning Revisited: Implicitly Enhancing Online Hessian Approximation via Variance Reduction." ICLR. 2024.