Efficient Machine Unlearning by Model Splitting and Core Sample Selection

Maximilian Egger; Rawad Bitar; R\"udiger Urbanke

REVIEW 3 major objections 5 minor 37 references

Efficient Machine Unlearning by Model Splitting and Core Sample Selection

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read MAXRR makes most unlearning requests exact by construction, with no retraining needed for samples outside the core set and the SVM support vectors.

desk verdict A genuinely new unlearning-aware training scheme with a useful core-set design principle, but the exact-unlearning guarantee fails as proved because the core set is selected from the full data and is therefore not independent of the forgotten points. read the letter →

arxiv 2505.07026 v1 pith:TA7PCW2Y submitted 2025-05-11 cs.LG stat.ML

Maximilian Egger , Rawad Bitar , Rüdiger Urbanke This is my paper · ORCID

classification cs.LGstat.ML

keywords machineunlearningrighttobeforgottensupportvectorcoresampleselectionmodelsplittingmembershipinferenceattackexactgeneralizeddefinition

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MAXRR makes unlearning a training-time design decision rather than a post-hoc repair. A classifier is split into a feature extractor and a linear support-vector machine head; the feature extractor is trained only on the most influential 'core' samples, while the SVM is trained on everything. Because an SVM's decision function is determined entirely by its support vectors, forgetting any sample that is neither a core sample nor a support vector requires no model change at all, and forgetting a support vector requires retraining only the cheap SVM head. Under the paper's generalized definition of exact unlearning—equivalence to any algorithm trained on any subset of the remaining data—these cases are exactly unlearned, and in experiments the remaining approximate cases behave like full retraining under membership-inference auditing.

What carries the argument

The load-bearing object is the dual soft-margin SVM, whose decision function is a weighted combination of training samples that have nonzero dual variables (the support vectors). Proposition 1 establishes that removing any non-support sample from the training set leaves the dual optimum feasible and optimal, so the model literally does not change. Model splitting turns this property into an architecture: the network's last layer is replaced by a linear SVM trained on the feature embeddings. Core sample selection ranks all training samples by how many times they become support vectors across multiple runs, defines $D_k$ as the top $k$, and trains the feature extractor only on $D_k$, making it structurally independent of all non-core samples. Definition 1 generalizes exact unlearning so that equality to any algorithm $A'$ trained on any remaining subset $D_p$ is sufficient; that generalization is what converts 'no retraining needed' into a formal exact-unlearning certificate.

What would settle it

A decisive calculation: take a non-core, non-support-vector sample, apply MAXRR's exact-unlearning protocol for it, and compute the divergence between the resulting distribution and the distribution of the original algorithm retrained on $D \setminus D_f$; a nonzero divergence shows the exactness certificate is an artifact of Definition 1 rather than of matching full retraining. A second check is whether $D_k$ remains unchanged when that sample is excluded from the ranking procedure—if not, the proof's $A'$ is not independent of $D_f$.

Watch

Extended reading notes

Core claim

The paper's central claim is that a large fraction of unlearning requests can be made exact by construction. With the MAXRR composition $w_{\mathrm{FE}} \circ w_{\mathrm{SVM}}$, the feature extractor $w_{\mathrm{FE}}$ is trained only on a core set $D_k$ of samples that are most frequently selected as support vectors across several initial runs, and the linear SVM $w_{\mathrm{SVM}}$ is trained on the full dataset's embeddings. Proposition 1 shows that deleting a non-support-vector sample leaves the SVM's optimum unchanged, and the FE is independent of every sample outside $D_k$ by design. Hence for any request $D_f \subseteq D \setminus (S \cup D_k)$ the stored checkpoint is already exactly unlearned in the sense of Definition 1, and for $D_f \subset S \setminus D_k$ only the SVM layer needs retraining, which is still exact. The reported Fashion-MNIST experiments put the exact-unlearning coverage at $|S \cup D_k| = 20.5 \cdot 10^3$ out of $60 \cdot 10^3$ training samples on average.

Load-bearing premise

The load-bearing premise is that the generalized definition of exact unlearning—comparing the unlearned model with any algorithm trained on any subset of the remaining data, rather than with the original algorithm retrained on the full remaining set—is an acceptable operationalization, and that the core set used to train the feature extractor is fixed independently of the samples later requested for deletion; if either gives way, the exactness claim no longer holds.

Editorial extensions

If this is right

Deleting any sample outside $S \cup D_k$ is free: the stored checkpoint is already exactly unlearned under Definition 1 and no retraining is triggered.
When the forgotten sample lies in $S \setminus D_k$, the whole unlearning cost is one SVM retraining on the remaining embeddings; the feature extractor, usually the expensive part, is untouched.
The unlearned model can be more accurate than a fully retrained model, since the core samples that drive feature quality stay in the feature extractor (0.8798 vs 0.8625 average accuracy in the reported core-unlearning experiment).
Because the guarantee is structural, it transfers to any classifier whose final layer is a linear SVM, not just to the specific architecture tested.
MAXRR is compatible with stricter unlearning methods as a preprocessing step, so a provider can upgrade to stronger guarantees when needed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Implicit in the exactness proof is that the core set $D_k$ is chosen without using the samples that will later be forgotten; the paper's ranking procedure runs on the full dataset $D$, so unless $D_k$ is fixed externally or before any request, the $A'$ in Definition 1 may not actually be independent of $D_f$.
If a regulator adopts Definition 1, the right to be forgotten becomes an architectural property: compliance is achieved by how the model is built, not by post-hoc deletion. If not, MAXRR's contribution reduces to an efficient approximate-unlearning scheme with the same weak-verification caveats as other approaches.
The exact-unlearning coverage is governed by the overlap $S \cup D_k$; on datasets where support-vector membership is unstable across runs, the core set must grow to keep accuracy, shrinking the fraction of deletion requests that can be served for free. This is a testable prediction for other datasets.
Appendix B already shows confidence-based MIAs cannot verify genuinely exact unlearning of easy samples, so the approximate-mode verification results in Figs. 3-4 should be read as evidence of behavioral similarity, not as proof that residual information is gone.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: MAXRR is a genuinely new way to structure unlearning-aware training — train the feature extractor on a small core set, put an SVM head on the full dataset — and the SVM-only part is correct. But the exact-unlearning guarantee, the paper's main claim, does not survive contact with how the core set is chosen.

What's new and good. The combination of model splitting and core-sample selection is not in the earlier unlearning literature. Proposition 1 is just the standard property that a linear SVM is determined by its support vectors, but using that property inside a split architecture is a reasonable design move. The Fashion MNIST experiments are a credible proof of concept: training the FE on 20k of 60k samples and the SVM on all of them keeps accuracy near 0.88, and unlearning non-core points by retraining only the SVM is cheap. The authors also deserve credit for flagging in Appendix B that their MIA cannot detect even exact unlearning on non-core samples; that is the kind of honesty that makes the rest of the paper easier to trust.

Where it falls down. The exact-unlearning proof in Section IV-A rests on Definition 1, which replaces the standard benchmark A(D\D_f) with any algorithm A' on any subset D_p disjoint from D_f. That is a serious weakening. Under that definition, the unlearning procedure can be declared exact just because it matches an algorithm chosen after the fact. The abstract says "exact unlearning" without this caveat. I think the weaker notion can be defended, but only with an argument that it still means the deleted samples have no influence; the paper does not make that argument.

The deeper problem is the independence claim. MAXRR selects the core set D_k by ranking support-vector frequencies over multiple training runs on the entire dataset D. So D_k is a function of D, including every sample that will later appear in D_f. The proof's A' trains the FE on this fixed D_k and then retrains the SVM on D_p. The paper says A' is independent of D_f, but it is not, in the counterfactual sense that matters: if D_f had never been in the training data, a different D_k could have been chosen and a different FE trained. The unlearned model is therefore still shaped by the forgotten points, and the exact-unlearning guarantee is not established even for non-core, non-support requests. This is not a minor gap; it is the load-bearing part of the paper.

The approximate-unlearning evidence is also weaker than it looks, because the MIA used for verification is shown in Appendix B to fail on exact unlearning; similarity to retraining under such an attack does not demonstrate removal. Missing standard baselines and unstated hyperparameters (e.g., SVM regularization C) add noise.

Bottom line: the design principle — train the hard-to-update part on a deliberately small core set — is worth taking seriously, and the paper should go to peer review. But the revision needs to either fix the independence problem or reframe MAXRR as an approximate-unlearning method with a weaker, honestly labeled guarantee.

Referee Report

3 major / 5 minor

Summary. The paper proposes MAXRR, an unlearning-aware training procedure for SVM-headed classifiers. The model is split into a feature extractor (FE) and a linear SVM; the FE is trained on a core subset D_k of the most influential samples, determined by support-vector frequency over multiple runs on the full dataset, while the SVM is trained on all data. The authors introduce a generalized exact-unlearning definition (Definition 1) that allows comparison to any algorithm A' trained on any subset D_p of the remaining data, and they claim that for any request D_f disjoint from S ∪ D_k, the model is "per design exactly unlearned." When D_f intersects D_k, they fall back to approximate unlearning and verify it with a confidence-based membership inference attack. The paper reports Fashion MNIST experiments showing competitive accuracy and similar MIA verification results between MAXRR and full retraining.

Significance. If the exact-unlearning claim were correct, MAXRR would be a genuinely useful recipe: most deletion requests become free or cheap for SVM-headed classifiers, and the paper would contribute a clean decomposition of the training procedure into a reusable feature extractor and a retrainable last layer. The writing is clear, the algorithm is simple to implement, and the authors honestly acknowledge the limitations of MIA-based verification, including in Appendix B the fact that their MIA cannot detect even exact unlearning of non-core samples. However, the central claim rests on a weakened definition and on an independence argument that does not hold as written; the substantive exact-unlearning guarantee is therefore not established, and the approximate case is supported only by a verification method the paper itself shows to be unreliable. The contribution is potentially salvageable, but the current manuscript substantially overstates what is proven.

major comments (3)

[Section IV-B, exact unlearning paragraph] The proof that any D_f ⊆ D\(S∪D_k) is exactly unlearned asserts that "the feature extractor w_FE is entirely independent of D\D_k." This is not correct under the procedure described in Section IV: the core set D_k is selected by ranking support-vector frequencies computed over the full dataset D, so the identity of D_k and hence the trained w_FE are functions of D, including any later-requested D_f. The comparison algorithm A'(D_p) constructed in the next paragraph reuses the same D_k; because D_k was inferred from a dataset that contains D_f, that A' is not independent of D_f under the usual meaning of Definition 1. Removing D_f before the ranking stage could select a different core set and a different feature extractor, so U(A(D),D,D_f) is not generally equal to A(D\D_f) even when D_f contains no core samples and no support vectors. The authors need either to prove that the core-selection procedure is independent of every possible deletion request, e.g. by choosing D_k without using the deletable data, or to explicitly restrict the claim to a fixed precomputed D_k and explain what privacy guarantee that provides.
[Definition 1 and the abstract] The abstract states that MAXRR supports "exact unlearning" and that its properties "closely match" full retraining, without the crucial caveat that its exactness is relative to Definition 1, a substantial weakening of the standard notion. Definition 1 allows the unlearned model to be compared to any algorithm A' on any subset D_p of the remaining data, and Section IV-B then chooses A' and D_p so that U equals A'(D_p) by construction. This makes the exactness guarantee definitional rather than a property validated against an independent baseline, and it raises the question of what privacy property Definition 1 actually provides. The paper should either adopt the standard comparison A(D\D_f) (in which the core-selection dependence is fatal), or clearly motivate Definition 1 as a meaningful operationalization and advertise the guarantee as such in the abstract and introduction.
[Section IV-B(b) and Appendix B] The evidence for the approximate-unlearning claim is not load-bearing enough. For the case D_f ∩ D_k ≠ ∅, the paper verifies unlearning by showing that a confidence-based MIA yields similar classifications for MAXRR and for a fully retrained model (Figures 3 and 4). However, Appendix B shows that the same MIA cannot reliably detect whether non-core samples were unlearned even when the unlearning is exact. A verification method that fails to separate an exactly unlearned model from a non-unlearned one cannot support the claim that an approximate method "closely matches" full retraining. The authors should either provide a stronger verification argument (a different attack, a distributional distance, or a formal approximate-unlearning bound) or explicitly weaken the claim to an empirical utility comparison rather than an unlearning guarantee.

minor comments (5)

[Section I, first paragraph] The phrase "theright to be forgotten" in the abstract and introduction is missing a space; this is a simple typographical error.
[Section II, decision function] The decision function uses "sgin(x)" where the text presumably means "sign(x)"; please correct this typo.
[Section III, Proposition 1 proof] The proof argues that after removing D_f, an improved solution on D\D_f would also be feasible for D and contradict optimality; this is correct for the objective value, but the argument should explicitly handle the case of multiple optimal dual solutions, since the decision boundary depends on b and the chosen support-vector set.
[Section IV-A] The text says "Assume access to a ranking" but does not specify whether the ranking is part of the training algorithm and whether it may access samples that will later be forgotten; clarifying this would make the exactness claim easier to evaluate.
[Figures 3 and 4] The axis label "Percentage of runs both algorithms output same verification result" is confusing because agreement between MAXRR and perfect unlearning is not the same as successful unlearning; please rephrase and clarify in the caption and text.

Circularity Check

2 steps flagged · score 8.0 of 10

Exact unlearning is defined into existence: Definition 1 allows any A' on any subset, and the exactness proof sets A' to MAXRR's own pipeline; core set D_k is fit on the full dataset, so independence from D_f is not established.

self definitional [Section II, Definition 1; Section IV-B (Exact Unlearning)]
"Definition 1 (Generalized exact unlearning). A model A(D) is said to unlearn D_f ⊂ D if there exists an algorithm A′ independent of D_f, and a data subset D_p ⊆ D\D_f such that D(P(U(A(D),D,D_f))∥P(A′(D_p))) = 0. ... Upon an unlearning request, the procedure reuses w_FE and retrains the SVM on the remaining data D_p = D\D_f. This is functionally equivalent to running A′(D_p), which applies Algorithm 1 on D_k ⊂ D_p to obtain w_FE, and then trains a new SVM w⋆_SVM on D_p."

The success criterion lets the paper choose A' and D_p freely, so the equality holds by construction once A' is defined to be the paper's own pipeline (Algorithm 1 on D_k plus SVM on D_p). The guarantee is not measured against A(D\D_f) or any fixed external retraining procedure; the definition itself creates the guarantee. The asserted independence of A' from D_f is load-bearing and is not established, since A' uses D_k, which was selected from the full dataset D.
fitted input called prediction [Section IV (Core Sample Selection) and Section IV-B (Exact Unlearning)]
"Using this insight, we rank samples by their frequency of being selected as support vectors. Let f_ℓ denote the frequency for each sample x_ℓ. Define D_k to be the subset of the k most frequently occurring support vectors (i.e., core samples)... For any unlearning request D_f ⊆ D\(S∪D_k), the model is per design exactly unlearned in the sense of Definition 1. This is because the feature extractor w_FE is entirely independent of D\D_k, and the SVM w⋆_SVM depends only on the support vectors S."

D_k is a fitted artifact of the full dataset D: the ranking of support-vector frequencies comes from multiple training runs on D. A later request D_f is part of that same D, so w_FE (trained on D_k) is not independent of D_f; if D_f had been absent during core selection, a different D_k' could have been chosen. The 'prediction' that non-core requests leave w_FE unchanged is therefore forced by a core set that was itself fit to data containing the forgotten samples. The exactness claim is conditional on a D_k whose identity the request helped determine.

full rationale

MAXRR's empirical accuracy comparisons against a fully retrained baseline (Table I, Figs. 3-6) are genuine external evaluations and are not circular. However, the formal exact-unlearning claim is circular. Definition 1 weakens the standard requirement by allowing any algorithm A' and any subset D_p of the remaining data; the proof in Section IV-B then exhibits A'(D_p) as exactly the output of MAXRR's own training/unlearning composition. Since the definition asks only for existence of such an A', the equality is true by construction. The additional assertion that A' is independent of D_f fails for the full training procedure because D_k is selected from D via repeated SVM training on all of D, so D_f can influence which samples become core samples. Appendix B confirms that the MIA verification cannot even certify the exact case, which is consistent with a guarantee that is definitional rather than externally testable. No self-citation chain is present; the circularity is in the definition and in the fitted core set.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central exact-unlearning result depends on the SVM support-vector property and on the paper's own Definition 1. Core sample selection introduces free parameters k and the number of runs; SVM regularization C is unreported. No new physical or model entities are introduced.

free parameters (3)

Core set size k = 20,000
Chosen for the main experiments in Section IV-A; the paper gives no principled rule and Table I shows accuracy depends on k.
Number of runs for support-vector frequency = 100
The ranking of core samples is estimated from 100 independent training runs in Section IV; the choice is arbitrary.
SVM regularization C = not reported
The linear SVM in Algorithm 1 requires a regularization parameter; it is never stated, so the experiments are under-specified.

assumptions (4)

standard math Removing non-support-vector samples from an SVM training set leaves the optimal dual solution unchanged, as stated in Proposition 1.
This standard SVM property is proved in the paper and is the basis for exact unlearning of non-support-vector samples.
ad hoc to paper The generalized exact unlearning definition, Definition 1, allowing any algorithm A' and any subset D_p, is an acceptable operationalization of unlearning.
The paper introduces this definition and all exact unlearning claims are stated relative to it; it is weaker than the standard definition.
domain assumption Support-vector frequency across runs identifies the most important samples for the feature extractor.
Empirical observation in Section IV, Fig. 2, used to define core samples; no theoretical justification is given.
domain assumption Fashion MNIST and LeNet-5 are representative of practical machine learning deployments.
All experiments use one dataset and one architecture; the paper extrapolates general efficiency and utility claims from this.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Efficient Machine Unlearning by Model Splitting and Core Sample Selection." pith.science (2026). https://pith.science/paper/TA7PCW2Y

@misc{pith2026250507026,
  author       = {Pith},
  title        = {Pith review of: Efficient Machine Unlearning by Model Splitting and Core Sample Selection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TA7PCW2Y}},
  note         = {Machine review of arXiv:2505.07026}
}

read the original abstract

Machine unlearning is essential for meeting legal obligations such as the right to be forgotten, which requires the removal of specific data from machine learning models upon request. While several approaches to unlearning have been proposed, existing solutions often struggle with efficiency and, more critically, with the verification of unlearning - particularly in the case of weak unlearning guarantees, where verification remains an open challenge. We introduce a generalized variant of the standard unlearning metric that enables more efficient and precise unlearning strategies. We also present an unlearning-aware training procedure that, in many cases, allows for exact unlearning. We term our approach MaxRR. When exact unlearning is not feasible, MaxRR still supports efficient unlearning with properties closely matching those achieved through full retraining.

Figures

Figures reproduced from arXiv: 2505.07026 by the authors.

**Figure 2.** Comparison of empirical support vector frequency [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 4.** Comparison of verification results for samples [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗

Figures from the paper (2 more)

**Figure 5.** Figure 5: To improve the MIA, we use only the samples D \ D20·103 \ Df to construct the membership dataset to find the optimal threshold τ ⋆ . That is, we exclude the core samples from optimizing the MIA, since they are not representative of the samples Df . The set D \ D20·103 …

**Figure 6.** Figure 6: Comparison of verification results for samples [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 26 canonical work pages

[1]

General data protection regulation,

European Parliament and Council of the European Union, “General data protection regulation,” https://eur-lex.europa.eu/eli/reg/2016/679/oj/, april 2016

work page 2016
[2]

California consumer privacy act of 2018,

State of California Department of Justice, “California consumer privacy act of 2018,” https://oag.ca.gov/privacy/ccpa/, updated on March 13, 2024

work page 2018
[3]

Machine unlearning,

L. Bourtoule, V . Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, “Machine unlearning,” inIEEE symposium on security and privacy, 2021, pp. 141–159

work page 2021
[4]

Graph unlearning,

M. Chen, Z. Zhang, T. Wang, M. Backes, M. Humbert, and Y . Zhang, “Graph unlearning,” inACM SIGSAC conference on computer and communications security, 2022, pp. 499–513

work page 2022
[5]

Making AI forget you: Data deletion in machine learning,

A. Ginart, M. Guan, G. Valiant, and J. Y . Zou, “Making AI forget you: Data deletion in machine learning,”Advances in neural information processing systems, vol. 32, 2019

work page 2019
[6]

Towards making systems forget with machine unlearning,

Y . Cao and J. Yang, “Towards making systems forget with machine unlearning,” inIEEE symposium on security and privacy, 2015, pp. 463– 480

work page 2015
[7]

Certified data removal from machine learning models,

C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten, “Certified data removal from machine learning models,” inInternational Conference on Machine Learning, 2020, pp. 3832–3842

work page 2020
[8]

Machine un- learning of features and labels,

A. Warnecke, L. Pirch, C. Wressnegger, and K. Rieck, “Machine un- learning of features and labels,”arXiv preprint arXiv:2108.11577, 2021

arXiv 2021

Show all 37 references

[9]

Algorithms that approximate data removal: New results and limitations,

V . Suriyakumar and A. C. Wilson, “Algorithms that approximate data removal: New results and limitations,”Advances in Neural Information Processing Systems, vol. 35, pp. 18 892–18 903, 2022

2022
[10]

Deep unlearning via ran- domized conditionally independent hessians,

R. Mehta, S. Pal, V . Singh, and S. N. Ravi, “Deep unlearning via ran- domized conditionally independent hessians,” inIEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 10 422–10 431

2022
[11]

Eternal sunshine of the spotless net: Selective forgetting in deep networks,

A. Golatkar, A. Achille, and S. Soatto, “Eternal sunshine of the spotless net: Selective forgetting in deep networks,” inIEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 9304–9312

2020
[12]

Deltagrad: Rapid retraining of machine learning models,

Y . Wu, E. Dobriban, and S. Davidson, “Deltagrad: Rapid retraining of machine learning models,” inInternational Conference on Machine Learning, 2020, pp. 10 355–10 366

2020
[13]

Fedrecover: Recovering from poisoning attacks in federated learning using historical information,

X. Cao, J. Jia, Z. Zhang, and N. Z. Gong, “Fedrecover: Recovering from poisoning attacks in federated learning using historical information,” in IEEE Symposium on Security and Privacy (SP), 2023, pp. 1366–1383

2023
[14]

A survey of machine unlearning,

T. T. Nguyen, T. T. Huynh, Z. Ren, P. L. Nguyen, A. W.-C. Liew, H. Yin, and Q. V . H. Nguyen, “A survey of machine unlearning,”arXiv preprint arXiv:2209.02299, 2022

2022 arXiv
[15]

Machine unlearning: A survey,

H. Xu, T. Zhu, L. Zhang, W. Zhou, and P. S. Yu, “Machine unlearning: A survey,”ACM Comput. Surv., vol. 56, no. 1, 2023

2023
[16]

Machine unlearning: A comprehensive survey,

W. Wang, Z. Tian, C. Zhang, and S. Yu, “Machine unlearning: A comprehensive survey,”arXiv preprint arXiv:2405.07406, 2024

2024 arXiv
[17]

A survey on machine unlearning: Techniques and new emerged privacy risks,

H. Liu, P. Xiong, T. Zhu, and P. S. Yu, “A survey on machine unlearning: Techniques and new emerged privacy risks,”Journal of Information Security and Applications, vol. 90, p. 104010, 2025

2025
[18]

Threats, attacks, and defenses in machine unlearning: A survey,

Z. Liu, H. Ye, C. Chen, Y . Zheng, and K.-Y . Lam, “Threats, attacks, and defenses in machine unlearning: A survey,”IEEE Open Journal of the Computer Society, 2025

2025
[19]

Machine un- learning of federated clusters,

C. Pan, J. Sima, S. Prakash, V . Rana, and O. Milenkovic, “Machine un- learning of federated clusters,” inInternational Conference on Learning Representations, 2023

2023
[20]

An information theoretic approach to machine unlearning,

J. Foster, K. Fogarty, S. Schoepf, Z. Dugue, C. Oztireli, and A. Brintrup, “An information theoretic approach to machine unlearning,”Transactions on Machine Learning Research, 2025

2025
[21]

Model sparsity can simplify machine unlearning,

J. Jia, J. Liu, P. Ram, Y . Yao, G. Liu, Y . Liu, P. Sharma, and S. Liu, “Model sparsity can simplify machine unlearning,”Advances in Neural Information Processing Systems, vol. 36, pp. 51 584–51 605, 2023

2023
[22]

Fast yet effective machine unlearning,

A. K. Tarun, V . S. Chundawat, M. Mandal, and M. Kankanhalli, “Fast yet effective machine unlearning,”IEEE Transactions on Neural Networks and Learning Systems, vol. 35, no. 9, pp. 13 046–13 055, 2024

2024
[23]

Cer- tified data removal from machine learning models,

C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten, “Cer- tified data removal from machine learning models,”arXiv preprint arXiv:1911.03030, 2019

1911 arXiv
[24]

Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

A. Salem, Y . Zhang, M. Humbert, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” 2019

2019
[25]

En- hanced membership inference attacks against machine learning models,

J. Ye, A. Maddi, S. K. Murakonda, V . Bindschaedler, and R. Shokri, “En- hanced membership inference attacks against machine learning models,” inACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 3093–3106

2022
[26]

A survey on membership inference attacks and defenses in machine learning,

J. Niu, P. Liu, X. Zhu, K. Shen, Y . Wang, H. Chi, Y . Shen, X. Jiang, J. Ma, and Y . Zhang, “A survey on membership inference attacks and defenses in machine learning,”Journal of Information and Intelligence, 2024

2024
[27]

Towards probabilistic verification of machine unlearning,

D. M. Sommer, L. Song, S. Wagh, and P. Mittal, “Towards probabilistic verification of machine unlearning,”arXiv preprint arXiv:2003.04247, 2020

2003 arXiv
[28]

An informa- tion theoretic evaluation metric for strong unlearning,

D. Jeon, W. Jeung, T. Kim, A. No, and J. Choi, “An informa- tion theoretic evaluation metric for strong unlearning,”arXiv preprint arXiv:2405.17878, 2024

2024
[29]

Verification of machine unlearning is fragile,

B. Zhang, Z. Chen, C. Shen, and J. Li, “Verification of machine unlearning is fragile,” inInternational Conference on Machine Learning, 2024

2024
[30]

Membership inference attacks cannot prove that a model was trained on your data,

J. Zhang, D. Das, G. Kamath, and F. Tramèr, “Membership inference attacks cannot prove that a model was trained on your data,”arXiv preprint arXiv:2409.19798, 2024

2024 arXiv
[31]

Privacy auditing of large language models,

A. Panda, X. Tang, M. Nasr, C. A. Choquette-Choo, and P. Mit- tal, “Privacy auditing of large language models,”arXiv preprint arXiv:2503.06808, 2025

2025 arXiv
[32]

Membership inference attacks and defenses in classification models,

J. Li, N. Li, and B. Ribeiro, “Membership inference attacks and defenses in classification models,” inACM Conference on Data and Application Security and Privacy, 2021, pp. 5–16

2021
[33]

Towards deep learning models resistant to adversarial attacks,

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

2018
[34]

Regularization mixup adversarial training: A defense strategy for membership privacy with model availability assurance,

Z. Ding, Y . Tian, G. Wang, and J. Xiong, “Regularization mixup adversarial training: A defense strategy for membership privacy with model availability assurance,” inInternational Conference on Big Data and Privacy Computing (BDPC), 2024, pp. 206–212

2024
[35]

Membership inference attacks against adversarially robust deep learning models,

L. Song, R. Shokri, and P. Mittal, “Membership inference attacks against adversarially robust deep learning models,” inIEEE Security and Privacy Workshops (SPW), 2019, pp. 50–56

2019
[36]

Unrolling sgd: Understanding factors influencing machine unlearning,

A. Thudi, G. Deza, V . Chandrasekaran, and N. Papernot, “Unrolling sgd: Understanding factors influencing machine unlearning,” inIEEE European Symposium on Security and Privacy, 2022, pp. 303–319

2022
[37]

Gradient-based learning applied to document recognition,

Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,”Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998. APPENDIX We provide a brief outline for the appendix. In Section A, we provide a study on the sensitivity ...

1998

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

General data protection regulation,

European Parliament and Council of the European Union, “General data protection regulation,” https://eur-lex.europa.eu/eli/reg/2016/679/oj/, april 2016

work page 2016

[2] [2]

California consumer privacy act of 2018,

State of California Department of Justice, “California consumer privacy act of 2018,” https://oag.ca.gov/privacy/ccpa/, updated on March 13, 2024

work page 2018

[3] [3]

Machine unlearning,

L. Bourtoule, V . Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, “Machine unlearning,” inIEEE symposium on security and privacy, 2021, pp. 141–159

work page 2021

[4] [4]

Graph unlearning,

M. Chen, Z. Zhang, T. Wang, M. Backes, M. Humbert, and Y . Zhang, “Graph unlearning,” inACM SIGSAC conference on computer and communications security, 2022, pp. 499–513

work page 2022

[5] [5]

Making AI forget you: Data deletion in machine learning,

A. Ginart, M. Guan, G. Valiant, and J. Y . Zou, “Making AI forget you: Data deletion in machine learning,”Advances in neural information processing systems, vol. 32, 2019

work page 2019

[6] [6]

Towards making systems forget with machine unlearning,

Y . Cao and J. Yang, “Towards making systems forget with machine unlearning,” inIEEE symposium on security and privacy, 2015, pp. 463– 480

work page 2015

[7] [7]

Certified data removal from machine learning models,

C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten, “Certified data removal from machine learning models,” inInternational Conference on Machine Learning, 2020, pp. 3832–3842

work page 2020

[8] [8]

Machine un- learning of features and labels,

A. Warnecke, L. Pirch, C. Wressnegger, and K. Rieck, “Machine un- learning of features and labels,”arXiv preprint arXiv:2108.11577, 2021

arXiv 2021