{"id":"3194db91-02f0-455a-afac-ed077667c63d","arxiv_id":"2506.06985","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":8,"one_line_summary":"Noisy fine-tuning with gradient or model clipping on retained data provably removes the influence of forget data, with guarantees that need no smoothness or convexity assumptions.","lead":"The paper proposes a certified machine unlearning method that runs noisy, clipped fine-tuning on the retained data and uses privacy amplification by iteration to prove that the influence of the forgotten data is statistically erased. It claims the first unlearning guarantee that works for arbitrary non-convex networks without smoothness assumptions.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported noise levels are not certified: the σ values in Tables 5-8 follow the appendix's pre-conversion bound, which drops the log(1/δ) and Rényi-order factors; for Table 5 row 1 the resulting single-step hockey-stick divergence is ≈0.29 instead of 1e-5.","rationale":"The reader's weakest assumption identifies the same core issue: the experiments do not satisfy the paper's own certification conditions. My analysis strengthens this into a concrete accounting error: the table σ values coincide exactly with the appendix's intermediate bound before Rényi-to-DP conversion, which omits log(1/δ) and the Rényi order q. Executing that omission on Table 5 row 1 yields a single-step hockey-stick divergence of ≈0.29, three orders of magnitude above the claimed δ=1e-5. Because every gradient-clipping experiment is calibrated with this same incomplete formula, the headline claim that the method 'achieves formal unlearning guarantees' in practice is not established by the reported results. I am not claiming the theorems are false; the proof skeleton is coherent and the regularized bound in Theorem 4.1 may be correct once the conversion is done properly. But the paper presents empirical validation as a central contribution, and the reported noise levels do not certify (1,1e-5)-unlearning. Additionally, the model-clipping variant has an independent algorithmic mismatch: the displayed update (4) never applies ξ0, while the proof of Theorem 4.2 requires an initial Gaussian perturbation and initial clipping with parameters C0 and σ0 that are absent from Tables 6 and 8. This reinforces the conclusion that the paper as written should not be accepted as evidence for certified unlearning in neural networks; a corrected recalibration of the accountant and rerun experiments would be needed.","tokens_in":24620,"tokens_out":28542,"duration_ms":298432,"concrete_test":"Recompute the privacy guarantee for Table 5 row 1 using the exact hockey-stick formula (Eq. 9) with r=c/σ, c=0.03998, σ=0.02827: if E_1>1e-5 (it is ≈0.29), the reported certificate fails. Then re-derive σ for the same row from Theorem 4.1 Eq. (6) and from the correct Rényi-to-DP conversion of Theorem A.9; if the calibrated σ is more than 5× the table value (it is), all rows of Tables 5-8 using this accountant are not certified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing problem is the privacy accountant used to set σ in the experiments. Appendix A.2's displayed sufficient bound before Rényi-to-DP conversion is σ² ≥ γλ(2−γλ)/(2ε(1−ρ^{2T})) (2C0ρ^T + 2C1/λ(1−ρ^T))² with ρ=1−γλ. The tables report σ values that match this expression with ε=1, not the final theorem. For Table 5 row 1 (γ=1e-4, λ=10, C1=100, C0=0.01, T=1) this gives σ=0.02827, exactly the table. The worst-case one-step Gaussian with sensitivity c=2(C0ρ+C1/λ(1−ρ))=0.03998 and σ=0.02827 has hockey-stick divergence at ε=1 equal to Q(εσ/c−c/(2σ))−e^εQ(εσ/c+c/(2σ))≈0.29, so δ=0.29 rather than 1e-5. A correct conversion (which contributes log(1/δ) and an optimized Rényi order) requires σ≥0.16 for this row, and many rows require an order of magnitude more. The gradient-clipping experiments in Tables 5, 7, 12-14 are therefore not certified at (1,1e-5), and most rows also violate the theorem's γλ∈(1/2,1) condition. The model-clipping variant has a separate mismatch: Eq. (4) never adds ξ0, while Theorem 4.2's proof starts from Π_C0(A(·))+ξ0, and Tables 6/8 omit C0 and σ0. Thus the paper's central practical claim is unsupported, although the proof framework may be repairable.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a certified unlearning method for neural networks based on noisy fine-tuning on the retain set. Two variants are analyzed: gradient clipping (Eq. 3) and model clipping (Eq. 4). Theorem 4.1 gives sufficient noise magnitudes for gradient clipping without smoothness or convexity assumptions, and Theorem 4.2 gives an iteration/noise condition for model clipping via contraction of the hockey-stick divergence. The paper reports experiments on MNIST, CIFAR-10, and transfer-learning settings, claiming that the methods achieve (1,1e-5)-unlearning and outperform retraining and output-perturbation baselines.","tokens_in":25086,"tokens_out":20372,"duration_ms":181406,"significance":"If the theoretical results are correct, the gradient-clipping theorem is a significant step: it extends certified unlearning to arbitrary non-convex networks without requiring smoothness knowledge. The proof machinery (shifted Rényi divergence applied to clipped maps) is elegant, and the model-clipping analysis via contraction coefficients is natural. The paper also releases code and detailed hyperparameter tables, which makes the empirical claims checkable. However, the present experimental validation does not instantiate the theorems: the reported noise levels and hyperparameters in Appendix B fall outside the certified regime, and the model-clipping algorithm statement is inconsistent with its proof. The empirical contribution is therefore not currently established, although the theoretical framework appears potentially repairable.","major_comments":[{"comment":"The reported σ values in the gradient-clipping experiments do not satisfy Theorem 4.1's sufficient condition. For Table 5 row 1 (γ=1e-4, λ=10, C1=100, C0=0.01, T=1), the listed σ=0.02827 matches the pre-conversion expression σ² = γλ(2−γλ)/(2ε(1−(1−γλ)^{2T})) · (2C0(1−γλ)^T + (2C1/λ)(1−(1−γλ)^T))² with ε=1, not Eq. (6). With this σ, the hockey-stick divergence between the two one-step Gaussian mechanisms with sensitivity c=2(C0(1−γλ)+C1/λ(1−(1−γλ))) ≈ 0.03998 is Q(εσ/c − c/(2σ)) − e^ε Q(εσ/c + c/(2σ)) ≈ 0.29, far above δ=1e-5; a valid certificate for this row requires σ roughly an order of magnitude larger. The same pattern occurs in Tables 7, 12, 13, and 14, so the statement in §5 that the privacy target is reached in under 100 unlearning steps is not supported by the reported configurations.","section":null},{"comment":"Nearly every gradient-clipping row violates the theorem's condition γλ∈(1/2,1). In Table 5, γλ is 0.001 or 0.075; in Table 7, γλ takes values such as 0.2, 0.05, and 0.5 (the last from γ=0.01, λ=50); Tables 12–13 contain similar values. Since the proof of Theorem 4.1 uses γλ>1/2 to upper-bound the noise expression, configurations with γλ≤1/2 are outside the certified regime. The experimental section should either restrict to γλ∈(1/2,1) or provide an additional analysis covering smaller γλ.","section":"Theorem 4.1; Appendix B"},{"comment":"Eq. (4) and Theorem 4.2 describe inconsistent algorithms. Eq. (4) sets x0=ˆx and never applies the initial clipping/noise, whereas the proof of Theorem 4.2 starts from x0 = Π_C0(A(D))+ξ0 and x'_0 = Π_C0(A(D\\Df))+ξ0. Because of this mismatch, the theorem does not certify the algorithm as written. Moreover, Tables 6 and 8 do not report C0 or σ0, so conditions (10) and (11) cannot be verified for the model-clipping experiments.","section":"Eq. (4); Theorem 4.2; Tables 6/8"},{"comment":"The transfer-learning comparison with DP-SGD appears to use different forget-set sizes: the proposed method forgets 10% of the data, while the DP-SGD row reports a forget-set size of 0.5%. If these are the actual removed sets, the comparison is not at equal unlearning workload; if the 0.5% refers to a group-privacy parameter, the relationship to the 10% forget set should be explained.","section":"§5.3; Table 11"}],"minor_comments":[{"comment":"Lemma A.3 defines Q(t) with prefactor 1/√π, while Theorem 4.2's Eq. (9) uses 1/√(2π); the standard normal survival function requires 1/√(2π), so the two definitions should be made consistent.","section":"Appendix A.1, Lemma A.3"},{"comment":"The expression T = 1/(ηλ) log(λC0/C1) uses an undefined symbol η; this should be γ (the learning rate).","section":"§4.2"},{"comment":"The Model Clipping entry reports only C2² log(1/δ) as the noise variance; since Eq. (11) also involves T, σ0, and C0, the table should state that this is the optimized/asymptotic value.","section":"Table 1"},{"comment":"Definition 2.1 writes probabilities of exact equality for continuous outputs; stating the condition for all measurable events (or using densities) would avoid measure-zero ambiguity.","section":"Definition 2.1"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern is valid: the reported noise levels are not certified, and the model-clipping theorem does not match the implemented algorithm. I chose major_revision rather than reject because the theoretical framework appears salvageable and the empirical issues are, in principle, fixable by rerunning with certified hyperparameters and correcting the algorithm statement. However, if such reruns do not preserve the claimed accuracy gains, the paper's central practical claim would fail and rejection would be appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The theoretical contribution here is real, but the empirical validation does not support the paper's headline. The main result — sufficient conditions for (ε,δ)-unlearning for non-smooth, non-convex objectives via clipped noisy fine-tuning — is new and non-trivial. The clipping is what lets the shifted Rényi analysis drop the smoothness assumption, and the proof framework in Appendix A looks internally coherent. The comparison with prior certified-unlearning work is also fair. If the theory alone were the paper, it would be a reasonable submission.\n\nThe problem is that the experiments don't actually certify anything. I checked the stress-test note against Table 5, row 1: the reported σ=0.02827 exactly matches the intermediate Rényi bound in Appendix A.2 with ε=1, before the log(1/δ) factor and the Rényi-to-DP conversion are applied. The theorem's sufficient σ for those hyperparameters is around 9, roughly 300 times larger. Moreover, the theorem requires γλ ∈ (1/2,1), and every row I looked at uses values like 0.001 or 0.2, far outside that range. The accuracy improvements in Figures 1–3 are therefore not certified at (1, 10⁻⁵). This is not a minor bookkeeping issue; it is the central practical claim of the paper.\n\nThe model clipping variant has a separate mismatch. The algorithm in Eq. (4) starts from x₀ = x̂ with no projection or added noise, while the proof of Theorem 4.2 analyzes a sequence initialized at Π_C0(A(D∖D_f))+ξ₀. The experiment tables don't list C₀ or σ₀, so the implemented procedure and the analyzed procedure are different objects.\n\nTo be fair, the theory is likely repairable. The shifted Rényi argument is standard and applied competently, and the theorems themselves look valid. The open question is whether the method retains its utility advantage once the noise is set to a level that actually provides (1,10⁻⁵)-unlearning. The current experiments do not answer that. The post-unlearning fine-tuning may be doing most of the work, but that is not what is advertised.\n\nThis paper deserves a serious referee because the theory is novel enough to merit engagement, and the experiment–theory gap is exactly what review is supposed to catch. As written, I would not accept it. If the authors rerun with a correct privacy accountant and the utility gains survive, it could become solid. For now, treat the empirical claims as unsupported.\n\nRecommendation: send to peer review with expectation of major revision. It would also make a good reading-group case study in how privacy accounting can silently go wrong.","headline":"The theory is a genuine step for certified unlearning, but the experimental noise levels do not satisfy the paper's own theorems, so the practical claims are unsupported.","tokens_in":25577,"tokens_out":3881,"would_cite":false,"duration_ms":40299,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A short run of clipped, noise-injected fine-tuning on the data that stays can certify the erasure of the data that goes, for arbitrary non-convex neural networks.","keywords":["machine unlearning","certified unlearning","differential privacy","privacy amplification","noisy fine-tuning","gradient clipping","non-convex optimization","right to be forgotten"],"falsifier":"A single calculation settles the matter: for the MNIST gradient-clipping run at compute budget 1, with $\\gamma=0.0001$, $\\lambda=10$, $C_0=0.01$, $C_1=100$, $T=1$, and $\\sigma=0.028270$, the one-step hockey-stick divergence between the unlearned and retained-data chains is about 0.29, whereas the claimed guarantee requires at most $\\delta=10^{-5}$; the same run has $\\gamma\\lambda=0.001$, far below the $\\gamma\\lambda > 1/2$ condition of Theorem 4.1. A reader could also verify whether any model-clipping run has the $C_0$ and $\\sigma_0$ values that Theorem 4.2's iteration bound requires.","tokens_in":24446,"feed_emoji":"🔒","tokens_out":7435,"duration_ms":67336,"temperature":0.7,"pith_summary":"This paper proposes a certified unlearning method that treats a few iterations of noisy fine-tuning on retained data as a stochastic post-processing step, so that each iteration provably shrinks the statistical distance between the unlearned model and a model that never saw the forget set. The central claim is that gradient clipping and model clipping, combined with Gaussian noise, give $(\\varepsilon,\\delta)$-unlearning with explicit noise bounds that hold for arbitrary loss functions, including non-convex neural networks, without requiring smoothness or convexity. If true, this makes formal deletion guarantees practical for deep networks, and the paper reports that the method reaches target accuracy up to 50% faster than retraining from scratch.","feed_headline":"Noisy fine-tuning certifies unlearning for any neural network","feed_subtitle":"Clipped, noisy SGD on retained data provably erases forgotten samples—no smoothness or convexity assumptions needed.","key_machinery":"The load-bearing object is the shifted R\\'enyi divergence $D_q^{(z)}(\\mu\\|\\nu)$, which measures divergence after allowing a worst-case shift $z$ between two distributions. The update map $\\psi(x) = x - \\gamma(\\Pi_{C_1}(G(x)) + \\lambda x)$ satisfies $\\|\\psi(x') - \\psi(x)\\| \\le |1-\\gamma\\lambda|\\,\\|x'-x\\| + 2\\gamma C_1$, and a shift-reduction lemma converts that bound into a per-step decay of the shifted divergence. Model clipping instead uses the hockey-stick divergence $E_\\varepsilon$ together with the Gaussian contraction bound $\\theta_\\varepsilon(2C_2/\\sigma)$; both variants are assembled under the privacy-amplification-by-stochastic-post-processing principle, so the added noise never touches the forget data and each step improves the guarantee.","core_discovery":"The paper's central discovery is that clipping turns each unlearning step into a Markov kernel with controlled output sensitivity, so the privacy-amplification-by-iteration analysis can be extended from convex losses to arbitrary functions. Theorem 4.1 states that $T$ steps of gradient clipping with Gaussian noise of variance $\\sigma^2 = \\frac{72\\gamma\\lambda\\log(1/\\delta)}{\\varepsilon^2}\\left(C_0(1-\\gamma\\lambda)^T + \\frac{C_1}{\\lambda}\\right)^2$ yield $(\\varepsilon,\\delta)$-unlearning whenever $\\gamma\\lambda \\in (1/2,1)$, with no assumption on the loss beyond the ability to clip its stochastic gradients; Theorem 4.2 gives an analogous guarantee for model clipping through a per-step amplification factor $\\theta_\\varepsilon(r)$ derived from the hockey-stick divergence between Gaussians. The proof tracks the shifted R\\'enyi divergence between two chains, one initialized from the full-data model and one from the retained-data model, and shows the divergence shrinks because the clipping bound replaces smoothness with a contraction of the update map. The practical claim is that certified unlearning for deep networks can be achieved by redistributing noise across fine-tuning iterations instead of paying the full privacy noise in one shot.","pith_inferences":["The empirical sections should not be read as certified unless the exact hyperparameter tables satisfy the theorem conditions; several reported runs, such as MNIST gradient clipping at budget 1 with $\\gamma\\lambda=0.001$ and $\\sigma\\approx 0.028$, lie far outside the $\\gamma\\lambda > 1/2$ regime and give a one-step hockey-stick divergence around 0.29 rather than the claimed $\\delta=10^{-5}$, so tho","A natural, testable strengthening would be to re-run the same experiments inside the theorem's valid region, for instance choosing $\\gamma\\lambda$ just above $1/2$ with the correspondingly larger noise, to see whether the reported utility gains survive; the paper's own hyperparameter grid suggests such valid configurations may be rare for small models.","The certificate covers the unlearning stage only: once the privacy target is reached, the protocol switches to ordinary fine-tuning on retained data, and the final guarantee depends on that fine-tuning being a post-processing step that also never touches forget data, so practitioners should audit the whole pipeline, including the switch, rather than just the noisy iterations."],"forward_implications":["Certified unlearning becomes applicable to arbitrary non-convex models trained by any base algorithm, as long as the unlearning stage itself runs clipped, noisy SGD on retained data.","The noise required per iteration can shrink with more iterations, with $\\sigma^2$ decreasing like $1/T$ in the unregularized case or acquiring an exponential-in-$T$ factor under regularization, so utility can be preserved by spending more compute on unlearning.","The transfer-learning experiments report that the method reaches target accuracy faster than retraining from scratch and much faster than DP-SGD with group privacy, which pays noise that is at least quadratic in the forget-set size.","The framework supports non-adaptive sequential unlearning requests, because each request can be treated as another stochastic post-processing step on the retained data.","Prior non-convex certified unlearning methods required knowing the loss's smoothness constant or Hessian spectral information; this approach removes those requirements entirely."],"supporting_citations":[{"why":"Supplies the privacy-amplification-by-stochastic-post-processing theorem used to show each noisy fine-tuning step improves the unlearning guarantee.","marker":"Balle et al., 2019"},{"why":"Supplies the shifted R\\'enyi divergence and the shift-reduction lemma that the gradient-clipping proof extends from convex to non-convex losses.","marker":"Feldman et al., 2018"},{"why":"Supplies the contraction coefficient for Gaussian mechanisms that drives the per-step amplification factor in the model-clipping proof.","marker":"Asoodeh et al., 2020"},{"why":"Provides the Gaussian mechanism and the output-perturbation baseline, as well as the standard $(\\varepsilon,\\delta)$-DP conversion used in the comparison.","marker":"Dwork & Roth, 2014"},{"why":"Provides the R\\'enyi-to-DP conversion used to turn the divergence bounds in Theorem 4.1 into $(\\varepsilon,\\delta)$-unlearning guarantees.","marker":"Mironov, 2017"},{"why":"Supplies the data-processing inequality for R\\'enyi divergence used in the shift-reduction lemma.","marker":"Van Erven & Harremos, 2014"}],"fun_headline_variants":["Clipped noisy fine-tuning gives certified unlearning for any model","Provable unlearning without loss assumptions: clip and add noise","Certified unlearning via noisy fine-tuning, no smoothness needed","Gradient clipping turns fine-tuning into certifiable unlearning","Unlearning guarantees for neural nets via clipped noisy SGD"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central guarantee depends on the unlearning step running with parameters that actually satisfy the paper's sufficient noise conditions; the experimental appendices list configurations such as $\\gamma\\lambda = 0.001$ on MNIST that are far outside the theorem's required $\\gamma\\lambda > 1/2$ regime, and the model-clipping runs do not specify the initial noise and clipping constants that Theorem 4.2 requires, so if those conditions are genuinely necessary the reported accuracy gains are not certified unlearning.","fun_headline_variants_meta":{"raw":{"variants":["Clipped noisy fine-tuning gives certified unlearning for any model","Provable unlearning without loss assumptions: clip and add noise","Certified unlearning via noisy fine-tuning, no smoothness needed","Gradient clipping turns fine-tuning into certifiable unlearning","Unlearning guarantees for neural nets via clipped noisy SGD"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000262,"raw_usage":{"total_tokens":1608,"prompt_tokens":969,"completion_tokens":639,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":585,"completion_tokens_details":{"reasoning_tokens":555}},"tokens_in":585,"tokens_out":639,"duration_ms":5459,"temperature":1.0,"reasoning_tokens":555,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T05:48:09.226643+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A single calculation settles the matter: for the MNIST gradient-clipping run at compute budget 1, with $\\gamma=0.0001$, $\\lambda=10$, $C_0=0.01$, $C_1=100$, $T=1$, and $\\sigma=0.028270$, the one-step hockey-stick divergence between the unlearned and retained-data chains is about 0.29, whereas the claimed guarantee requires at most $\\delta=10^{-5}$; the same run has $\\gamma\\lambda=0.001$, far below the $\\gamma\\lambda > 1/2$ condition of Theorem 4.1. A reader could also verify whether any model-clipping run has the $C_0$ and $\\sigma_0$ values that Theorem 4.2's iteration bound requires.","supporting_citations":[{"cited_title":"Privacy amplification by mixing and diffusion mechanisms","cited_arxiv_id":null,"evidence_quote":"Supplies the privacy-amplification-by-stochastic-post-processing theorem used to show each noisy fine-tuning step improves the unlearning guarantee."},{"cited_title":"Privacy amplification by iteration","cited_arxiv_id":null,"evidence_quote":"Supplies the shifted R\\'enyi divergence and the shift-reduction lemma that the gradient-clipping proof extends from convex to non-convex losses."},{"cited_title":"Contraction of E _ -divergence and its applications to privacy","cited_arxiv_id":null,"evidence_quote":"Supplies the contraction coefficient for Gaussian mechanisms that drives the per-step amplification factor in the model-clipping proof."},{"cited_title":"and Roth, A","cited_arxiv_id":null,"evidence_quote":"Provides the Gaussian mechanism and the output-perturbation baseline, as well as the standard $(\\varepsilon,\\delta)$-DP conversion used in the comparison."},{"cited_title":"and Harremos, P","cited_arxiv_id":null,"evidence_quote":"Supplies the data-processing inequality for R\\'enyi divergence used in the shift-reduction lemma."}],"review_version":1}