{"id":"9b36d598-d2da-435a-b8d3-70d86fff65a0","arxiv_id":"2506.20893","paper_version":5,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Class unlearning methods leak membership through neighbor-class output probabilities, and a tilted reweighting objective that mimics retrained models reduces this leakage.","lead":"A new attack shows that popular class-unlearning methods still leak information about deleted classes through the probabilities they assign to similar classes. A simple fix called Tilted ReWeighting fine-tunes the model so deleted samples are redistributed like they would be by a model retrained without that class, cutting the measured privacy gap on CIFAR-10 by 19 to 46 percent.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"MIA-NN in §3.3 is not a membership inference attack: it requires labeled test data and measures class-conditional logit alignment, not training membership; the claimed leakage therefore lacks a valid metric.","rationale":"The reader's weakest_assumption focused on the exponential-tilt approximation of the retrained distribution, specifically the parametric family and the global beta=10 choice. That is a reasonable and important concern, but I see an earlier and more load-bearing issue: the attack metric used to demonstrate the leakage that motivates TRW. If MIA-NN is not a valid membership inference attack, then the paper's central claim that existing methods 'leak membership through neighboring-class probabilities' is not supported, and the claimed necessity of output distribution reweighting rests on a weaker foundation. This concern is not an ad hominem or a disagreement with consensus; it is an internal-validity question about the evaluation instrument. The concrete test of measuring MIA-NN's discriminative power on models with and without the forget class would settle whether the metric tracks membership at all. I agree with the reader that the tilt assumption is also fragile, but it becomes secondary if the motivating evidence is itself invalid. The verdict should remain conditional rather than reject outright because the paper includes a real MIA evaluation (U-LiRA) and could be reframed around distribution matching; however, the current framing overstates the privacy finding.","tokens_in":18565,"tokens_out":7839,"duration_ms":96228,"concrete_test":"Train 10 ResNet-18 models on CIFAR-10 including the automobile class and 10 retrained models excluding it. For each model, compute the MIA-NN score defined in §3.3 for the forget class 'automobile.' Then measure the separation between the two score distributions (e.g., AUROC of a threshold classifier using MIA-NN score to distinguish member-models from non-member models). If the AUROC is near 50% or the distributions overlap substantially, MIA-NN does not measure membership leakage, and the paper's motivating claim fails. Additionally, re-run the U-LiRA evaluation in Table 3 with at least 10 seeds and report confidence intervals to test whether TRW's improvement over fine-tuning is statistically significant.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's central motivating claim is that existing unlearning methods 'leak membership of forgotten samples through the probabilities assigned to neighboring classes,' and that Tilted ReWeighting is necessary to close this leak. The evidence for this claim is the proposed MIA-NN metric in §3.3. But MIA-NN is not a membership inference attack: it trains binary classifiers h_i on ground-truth labeled test partitions (D_ri-test vs D_r̂i-test) and reports the fraction of forget-class test inputs classified as belonging to the nearest-neighbor class rn. This measures whether the unlearned model's rn-logit distribution for forget-class inputs resembles the retrained model's rn-logit distribution, not whether any particular sample was in the training set. An adversary in a membership inference setting is not given labeled test examples for every class; the attack requires exactly the class labels that a membership adversary would be trying to infer. The paper's own limitation statement (§6) calls MIA-NN 'heuristic,' but the issue is more fundamental: the metric conflates semantic class reassignment with membership leakage. A model that retains strong internal representations of the forget class but outputs logits tilted toward the neighbor class could score high on MIA-NN while still being a membership leak to a stronger adversary. The genuine MIA evaluation, U-LiRA (Table 3), does not isolate neighboring-class probabilities, and its reported differences are small (TRW 71.12 vs FT 72.57; TRW-2R 67.72) with no error bars or significance tests. Thus the paper's central 'necessity' claim is not established by its headline evidence.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies class unlearning and argues that existing methods leak membership information through the probabilities they assign to classes semantically similar to the forgotten class. It introduces a metric called MIA-NN that measures how often an unlearned model maps forget-class test inputs to the nearest-neighbor retained class, and proposes a fine-tuning objective, Tilted ReWeighting (TRW), that tilts the renormalized output distribution toward classes similar to the forget class. The tilt uses cosine similarities between PCA-projected logit weight vectors, with a single scalar beta set to 10. The method is evaluated on MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet against ten baselines, using standard metrics, U-LiRA, and the proposed MIA-NN. The paper reports that TRW reduces the gap to retrained models relative to prior methods on CIFAR-10.","tokens_in":18938,"tokens_out":5949,"duration_ms":74401,"significance":"The paper identifies a plausible and previously underemphasized phenomenon: a model retrained without a class tends to redistribute that class's probability mass toward semantically similar classes, and approximate unlearning methods may fail to reproduce this behavior. If this is established with valid metrics, the proposed TRW objective is a simple, computationally cheap modification that could improve class unlearning in practice. The paper also provides broad comparisons, public code, and a short proof of the exponential-tilt form via information projection. However, the central privacy claim rests on MIA-NN, which is not a membership inference attack in the standard sense, and the U-LiRA results are reported without the essential Retrain baseline or error bars. The significance is therefore conditional on reframing and strengthening the evaluation.","major_comments":[{"comment":"MIA-NN is not a membership inference attack as described. The procedure trains binary classifiers on labeled test partitions (D_ri-test versus D_rhati-test) and reports the aggregate fraction of forget-class test inputs whose nearest-neighbor logit is classified as belonging to class r_i. It never makes a per-sample membership decision, and it assumes access to ground-truth labels for test data, including labels for the forget class, which a membership adversary would not have. The paper's central motivating claim that existing unlearning methods 'leak membership of forgotten samples' is supported only by this metric, and the own limitation statement in Section 6 calls it heuristic. This is not merely a presentation issue: the metric conflates semantic class reassignment with membership leakage. The authors should either reframe MIA-NN as a class-conditional distributional similarity metric (and adjust all privacy claims accordingly) or replace it with a genuine per-sample membership inference attack with a clearly specified adversary model.","section":"Section 3.3"},{"comment":"The direction of the reported MIA scores is unexplained and inconsistent with standard usage. In Table 2 the column is labeled MIA(up-arrow) and reports Original MIA=0, Retrain MIA=100, yet in the standard membership inference literature an original model that has memorized a class should have high attack success, while a retrained model that never saw the class should be near chance. If the score is instead a 'forgetting success' measure (e.g., the fraction of forget samples not predicted as the forget class), it should be defined explicitly and given a different name. Without this clarification, the reader cannot compare Table 2 to prior work, and the claim that TRW is 'competitive' on MIA is not interpretable.","section":"Table 2 and Section 4.3"},{"comment":"The U-LiRA evaluation is missing its two most important reference points. The text states that 50% accuracy is ideal unlearning and that a perfect unlearning method should be indistinguishable from a Retrain model, but the table does not report U-LiRA accuracy for Retrain or for the Original model. TRW-2R achieves 67.72% and TRW achieves 71.12%, both far from 50%, so the claim of 'strong resilience' and 'retraining-level performance' is not supported without knowing how far a true Retrain model is from 50% under this protocol. The table also reports no standard errors, despite the use of three shadow models, so the differences among methods near the top (TRW 71.12, SCRUB 71.91, TRW-2R 67.72, FT 72.57) may not be significant.","section":"Table 3 and Section 5.2"},{"comment":"The main evidence for the paper's motivating claim, Table 1, reports MIA-NN values for a single forget-class pair per dataset (e.g., CIFAR-10 automobile-to-truck) with no error bars or number of Retrain models n. The rest of the paper averages results over all forget classes or over ten selected classes, so it is unclear whether the Table 1 gaps generalize. The authors should report means and standard deviations over seeds and over all forget classes, and should state how the nearest-neighbor class r_n is selected and whether the same r_n is fixed when evaluating the unlearned model.","section":"Table 1 and Section 3.3"},{"comment":"The central hyperparameter beta=10 is selected on CIFAR-10 using the same MIA-NN metric for which the headline improvements are reported, making the CIFAR-10 result partially a fitted result rather than an independent test. The ablation in Table 7 has no error bars and shows that MIA-NN jumps from 47.2 at beta=0 to 76.1 at beta=5 and 82.1 at beta=10, while retained accuracy is nearly constant; this steep sensitivity should be reported for other datasets. Given that the title claims a 'necessity' for output reweighting, the authors should at least show that the chosen beta is not overfit to the benchmark, for example by reporting leave-one-dataset-out selection or a sensitivity table for all datasets.","section":"Section 3.4 and Section B.7"}],"minor_comments":[{"comment":"There is a typo in 'distirubution'; please correct it.","section":"Section A.2"},{"comment":"The text before Proposition 3.1 calls q* the 'maximum-entropy distribution' on the remaining classes, but the proposition minimizes KL(q || p), which is only equivalent to maximum entropy when p is uniform. Please rephrase to avoid this technical inaccuracy.","section":"Section 3.4"},{"comment":"The MIA score is defined only by reference to Kodge et al.; given the unusual direction observed in Table 2, the exact formula and its interpretation (higher is better for unlearning, presumably) should be stated in the main text.","section":"Section 4.3"},{"comment":"TRW-2R is used in all result tables but is never defined before Section 5. Please specify which two layers are fine-tuned and how they are selected.","section":"Section 5"},{"comment":"The number n of Retrain models used for Table 1 is never stated; if n=3 as in the U-LiRA protocol, the single-class-pair values should be accompanied by error bars, since the mean over three models will be noisy.","section":"Section 3.3"}],"recommendation":"major_revision","confidential_remarks":"The paper is potentially valuable, but the main privacy claim currently rests on a non-standard metric that is not a membership inference attack. I would be willing to accept a revised version that either provides a genuine per-sample MIA supporting the leakage claim or explicitly reframes the contribution as distributional matching to the retrained model. The U-LiRA evaluation needs the Retrain baseline and error bars, and the beta selection issue should be addressed. The title's 'necessity' claim should be softened unless the authors provide stronger, independently validated evidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know: this is an honest, well-scoped empirical paper about class unlearning, and the core trick is simple and plausible. The new bit is TRW, a one-line loss change that tilts the renormalized output distribution toward semantically similar classes using cosine similarities of logit-weight vectors. That turns out to close a good chunk of the gap to retrained models on standard MIA metrics, and it does so without hurting retained accuracy or adding compute. The other new bit is MIA-NN, which probes neighbor-class logits. Both are worth taking seriously.\n\nWhat's genuinely good: the method is lightweight, the experiments span four datasets and ten baselines, code is released, and the paper is candid about its own limits (Section 6 admits MIA-NN is heuristic and that the evidence is entirely empirical). The information-projection lemma in Proposition 3.1 is correct but standard; the real contribution is the empirical demonstration that exponential tilting with class-similarity scores is a better target distribution than plain renormalization.\n\nNow the soft spots. The stress-test is right: MIA-NN is not a membership inference attack. It requires labeled test examples for every class and then measures whether the unlearned model's neighbor-class logits align with the retrained model's. That is a distribution-matching metric, not a membership test. An adversary in the MIA setting doesn't get ground-truth labels for the very samples whose membership they're trying to infer. The paper's own framing overclaims by calling this leakage. That said, the MIA-NN results still show something real: existing unlearning methods fail to mimic the neighbor-class behavior of retrained models, and TRW gets much closer. Just don't call it membership inference.\n\nThe U-LiRA results give some independent support, but the differences are small: TRW 71.12 vs FT 72.57, with TRW-2R at 67.72, and no error bars or significance tests. On the standard MIA in Table 2, the direction is confusing (Retrain=100, Original=0, with no explanation of what the score means). That needs fixing. Also, beta=10 is fitted on CIFAR-10 and the ablation shows the method is sensitive to it; the transfer to other datasets is plausible but not deeply analyzed. The central 'necessity' claim is therefore somewhat overstated—what's really shown is that TRW helps on the metrics they propose and on U-LiRA, not that reweighting is strictly necessary.\n\nBottom line: this paper deserves a serious referee. It's a solid empirical contribution with a simple, reproducible loss modification and a new evaluation angle, but the authors should be pushed to reframe MIA-NN as a distribution-matching diagnostic, add error bars to the key tables, and tone down the 'necessity' language. I'd accept it for review and expect a revision.","headline":"A useful empirical paper on class unlearning with a new tilted-reweighting loss and a neighbor-logit evaluation, but the headline attack is not really a membership inference attack and the main gains are modest.","tokens_in":19463,"tokens_out":2746,"would_cite":false,"duration_ms":30851,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Standard class unlearning leaks membership through probabilities assigned to similar classes; a tilted reweighting of the output distribution suppresses the leak.","keywords":["class unlearning","membership inference attack","nearest-neighbor attack","output distribution reweighting","tilted reweighting","fine-tuning objective","privacy leakage","class geometry"],"falsifier":"Train a classifier to tell apart forget-class test samples using the output logits of a true retrained model versus those of a TRW-unlearned model; if the classifier exceeds chance significantly on more than a handful of classes, the tilted family is not faithfully reproducing the retrained distribution. A cheaper check: measure the KL divergence between the retrained model's forget-class output distribution and $q^*$ at $\\beta=10$; if it is not consistently smaller than the divergence for $\\beta=0$ across classes and datasets, the tilt assumption fails.","tokens_in":18375,"feed_emoji":"🔒","tokens_out":9918,"duration_ms":89200,"temperature":0.7,"pith_summary":"The paper claims that class-unlearning methods leak membership of forgotten samples through the probabilities they assign to classes similar to the forgotten class, a leak that standard evaluation metrics miss. The authors build a nearest-neighbor membership attack (MIA-NN) that reads the output probability for the closest remaining class and show that ten existing unlearning baselines are vulnerable to it across MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet. They then propose Tilted ReWeighting (TRW), a fine-tuning loss that, for forget-class inputs, renormalizes the output distribution over remaining classes and tilts it exponentially toward classes judged similar to the forgotten class, so that it matches how a retrained-from-scratch model would behave. On CIFAR-10, TRW cuts the gap to retrained models by 19% under U-LiRA and by 46% under MIA-NN relative to the best baseline per metric, while matching or beating prior methods on standard unlearning metrics.","feed_headline":"Neighbor-class odds leak forgotten data; reweighting stops it","feed_subtitle":"A new attack finds residual membership leakage; a tilted reweighting closes the gap to retraining.","key_machinery":"The load-bearing object is the tilted distribution $q^*(y|x) = \\tilde{p}(y|x) e^{\\beta s_y} / Z$ over retained classes, with $\\tilde{p}$ the original model's output distribution renormalized to zero out the forget class, $s_y$ a cosine similarity between PCA-projected logit weight vectors of the forget and retained classes, and $\\beta$ a fixed scalar set to $10$ in all experiments. Proposition 3.1 shows this is the unique information projection of the original distribution onto the retained-class simplex under the first-moment constraint $\\sum_{y\\ne f} q(y) s_y = c$, so it is the minimal modification that introduces the retrained model's systematic bias toward similar classes. The TRW loss uses $q^*$ as the target for forget-class samples while keeping standard cross-entropy on retained-class samples.","core_discovery":"The central discovery is that a model retrained without the forgotten class does not spread the forgotten class's probability mass evenly over the remaining classes; it concentrates it on visually or semantically similar classes, so a model that merely zeroes out the forget label leaves a detectable trace. The paper proves that the distribution family that stays closest to the original model in KL divergence subject to a linear constraint on expected similarity has the exponential-tilt form $q^*(y|x) = \\tilde{p}(y|x) e^{\\beta s_y} / Z$, where $\\tilde{p}$ is the renormalized distribution without the forget class, $s_y$ measures cosine similarity between PCA-projected logit weight vectors, and $\\beta$ controls tilt strength. Using $q^*$ as the fine-tuning target for forget-class samples makes the unlearned model behave on those inputs like a retrained model, eliminating the neighbor-class leakage.","pith_inferences":["The exponential-tilt family is a Gibbs tilting of the renormalized distribution; if the true retrained distribution lies outside this one-parameter family, higher-order moment constraints or per-class, per-sample tilt strengths would be the natural generalizations to test.","MIA-NN, which needs no access to training data, could serve as a standardized privacy probe for class unlearning, complementing U-LiRA by measuring leakage through class geometry rather than per-example likelihood.","The same output-reweighting recipe should transfer to non-image domains (language models, tabular classifiers) whenever a similarity score between classes can be defined from embeddings or logits, since the mechanism is about class geometry, not pixels.","The ablation shows $\\beta$ trades retained accuracy against attack resistance; per-class or per-dataset tuning of $\\beta$ could preserve the privacy gain at $\\beta=20$ without the retained-accuracy drop, and is a directly testable extension."],"forward_implications":["Standard unlearning evaluations that report only forget-class accuracy and conventional MIA scores overstate privacy; neighbor-probing attacks such as MIA-NN should become part of the evaluation suite.","TRW is a drop-in loss replacement for fine-tuning-based unlearning: it changes only the forget-sample loss term, so it can be combined with weight-saliency or sparse-update methods without added cost.","With TRW, ten epochs of fine-tuning achieves zero forget-class accuracy and retained accuracy close to retrained models on CIFAR-10, CIFAR-100, and Tiny-ImageNet, including multi-class forgetting settings.","Because the tilt transfers across four datasets and two architectures, the leak-and-fix pattern is a general property of learned class geometry rather than an artifact of one model."],"supporting_citations":[{"why":"Supplies the U-LiRA evaluation framework used to test TRW and to motivate stronger membership-inference testing in unlearning.","marker":"Hayes et al. [2024]"},{"why":"Defines the original membership inference attack whose accuracy serves as a standard unlearning evaluation metric.","marker":"Shokri et al. [2017]"},{"why":"Provides the SVD unlearning baseline and the MIA score implementation used in the paper's comparisons.","marker":"Kodge et al. [2024]"},{"why":"Introduces the fine-tuning (FT) baseline that TRW extends and that is a principal point of comparison.","marker":"Warnecke et al. [2021]"},{"why":"Presents boundary unlearning, a decision-boundary approach that the paper shows leaks under MIA-NN.","marker":"Chen et al. [2023]"},{"why":"SCRUB, a teacher-student unlearning baseline compared across all datasets.","marker":"Kurmanji et al. [2023]"},{"why":"SCAR, a retain-set-free baseline that performs well on standard metrics but leaks under MIA-NN.","marker":"Bonato et al. [2024]"},{"why":"Provides the l1-sparse unlearning baseline and supports the claim that TRW can be combined with sparsification.","marker":"Jia et al. [2023]"}],"fun_headline_variants":["Similar-class logit odds expose forgotten data; tilt fixes it","Class unlearning leaks through neighbor classes; reweighting blocks it","Reweighted output distribution prevents class membership inference","TREW: tilted reweighting closes leak in class unlearning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The retrained model's behavior on forgotten-class inputs is accurately described by an exponential tilt of the original model's renormalized probabilities, using a single global tilt strength and similarity scores computed from the original model's logit weight vectors.","fun_headline_variants_meta":{"raw":{"variants":["Similar-class logit odds expose forgotten data; tilt fixes it","Class unlearning leaks through neighbor classes; reweighting blocks it","Reweighted output distribution prevents class membership inference","TREW: tilted reweighting closes leak in class unlearning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000252,"raw_usage":{"total_tokens":1569,"prompt_tokens":962,"completion_tokens":607,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":578,"completion_tokens_details":{"reasoning_tokens":536}},"tokens_in":578,"tokens_out":607,"duration_ms":7455,"temperature":1.0,"reasoning_tokens":536,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T22:39:18.530603+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a classifier to tell apart forget-class test samples using the output logits of a true retrained model versus those of a TRW-unlearned model; if the classifier exceeds chance significantly on more than a handful of classes, the tilted family is not faithfully reproducing the retrained distribution. A cheaper check: measure the KL divergence between the retrained model's forget-class output distribution and $q^*$ at $\\beta=10$; if it is not consistently smaller than the divergence for $\\beta=0$ across classes and datasets, the tilt assumption fails.","supporting_citations":[{"cited_title":"[2024], and SCRUB Kurmanji et al","cited_arxiv_id":null,"evidence_quote":"Provides the SVD unlearning baseline and the MIA score implementation used in the paper's comparisons."}],"review_version":1}