Pith. sign in

REVIEW 3 major objections 5 minor 35 references

Recalling The Forgotten Class Memberships: Unlearned Models Can Be Noisy Labelers to Leak Privacy

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that unlearned models retain enough class-level knowledge for an attacker to recover the class memberships of supposedly forgotten data, using only the unlearned model and no original trained model.

desk verdict The ULM-only recall attack is a genuinely new scenario and the experiments are thorough, but the missing retrained-model baseline leaves the privacy-leak claim unproven. read the letter →

arxiv 2506.19486 v1 pith:N5JXMSEX submitted 2025-06-24 cs.LG cs.AIcs.CR

Zhihao Sui , Liang Hu , Jian Cao , Dora D. Liu , Usman Naseem , Zhongyuan Lai , Qi Zhang This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords machineunlearningmembershiprecallattackprivacyleakageknowledgedistillationlearningwithnoisylabelsinferenceimageclassificationmodelvulnerability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that machine unlearning leaks more than it appears to: a model that has supposedly forgotten certain training images can still be queried to recover which class those images came from, and the recovery needs no access to the original trained model. The authors propose a Membership Recall Attack (MRA) in which the unlearned model acts as a noisy labeler, a student model is trained on its pseudo-labels through mixup-based knowledge distillation, and the most confident teacher–student agreements are then selected to relabel the forgotten data. Across eight unlearning methods and four image datasets, the recalled model consistently improves accuracy on the forgetting set, with the largest gains on methods such as SalUn and UNSC that unlearn precisely rather than over-unlearn. The paper's central message is that precise instance-level unlearning can leave class-level knowledge intact, and an attacker can exploit that residual knowledge.

What carries the argument

The machinery is a two-stage alternating loop. In the denoising knowledge-distillation stage, the unlearned model (teacher) labels mixup-augmented images from the prediction set, the student model is trained on the mixed soft labels, and the student gradually stops trusting the teacher's noise. In the confident membership recall stage, both models score every prediction-set image, their smoothed probability vectors are multiplied elementwise, and the top-K highest joint-probability samples per class are treated as confidently recalled memberships and used to retrain the student (and, in the open-source case, also the teacher). The joint-probability agreement is the load-bearing filter: it assumes that a forgotten instance will still draw high probability from both models for its true class, while noise will not be consistently agreed upon.

What would settle it

A decisive check is to run MRA against SalUn or UNSC with a prediction set containing only forgotten images and no test-set anchors; if forgetting-set accuracy stays near the unlearned baseline instead of jumping, the reported recall is an artifact of anchor leakage. A second decisive check is to unlearn by removing the target classes from the output space entirely; if MRA then cannot assign the old class labels, the attack's success depends on the class remaining in the label space.

Watch

Extended reading notes

Core claim

The central discovery is that unlearned models retain enough class-level knowledge to act as noisy labelers for their own forgotten data. The paper demonstrates that a teacher–student distillation loop, combined with a balanced top-K selection of high-confidence teacher–student agreements, turns an unlearned model into a recalled model that assigns correct labels to forgotten instances. The effect is strongest for precisely unlearning methods: in the open-source case, MRA drives forgetting-set accuracy from 0.117 to 0.997 for SalUn on CIFAR-10 and from 0.209 to 0.985 for UNSC on CIFAR-100. Even in the closed-source case, where only black-box predictions are available, the recalled model beats the unlearned model on every dataset and every unlearning method tested.

Load-bearing premise

The attack depends on the forgotten classes still being among the model's possible answers and on the attacker holding some non-forgotten test images from those same classes to anchor confident label selection; without those anchors, the unlearned model's own guesses on forgotten data are too noisy for the agreement filter to start.

Editorial extensions

If this is right

  • Black-box unlearning APIs are vulnerable: querying the unlearned model on a mixed prediction set and running the agreement loop can recover class membership of supposedly erased images.
  • Precise unlearning methods that preserve non-forgotten performance are the most exposed, because their pseudo-labels carry the least noise.
  • Unlearning evaluation should treat near-zero accuracy on the forgetting set as insufficient evidence of privacy; class-recall attacks like MRA measure a different residual.
  • Releasing unlearned model weights multiplies the risk, since updating the teacher during MRA produces the largest recovery gains.
  • MRA gives a model-agnostic benchmark for comparing MU methods on privacy leakage, applicable across low- and high-resolution image datasets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: MRA can be read as a measurement of residual class-level knowledge, so it could be repurposed as an auditing tool for unlearning, a use the paper does not develop.
  • Inference: A practical defense suggested by the attack's structure is to deny predictions on classes that have been forgotten, or to require that request sets contain no held-out images from those classes; the paper does not explore defenses.
  • Inference: The same agreement-selection mechanism should transfer to class-membership recall in other modalities, such as text or tabular data, whenever the label space is unchanged, but the paper only tests image classifiers.
  • Inference: An untested confound is whether recovered accuracy comes from genuinely recalling forgotten labels or from the student learning the anchor distribution; a permutation test on anchor labels would separate the two.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a Membership Recall Attack (MRA) framework that recovers the class memberships of forgotten samples from machine unlearning models (ULMs) without access to the original trained model. MRA uses the ULM as a noisy-label teacher in a teacher-student knowledge distillation setup, applies mixup augmentation, and then performs a confident membership recall step based on top-K agreement between the teacher and student models. The method is evaluated on four datasets (CIFAR-10, CIFAR-100, Pet-37, Flower-102) and eight unlearning methods, in both a closed-source (black-box ULM) and an open-source (white-box ULM) setting. The authors report substantial improvements in accuracy on the forgotten set after MRA, up to 0.997 D_f accuracy for SalUn on CIFAR-10 in the open-source case, and conclude that precise unlearning methods are particularly vulnerable to this recall attack.

Significance. If the ULM-specific interpretation is correct, this is a novel and practically relevant attack: it is the first to claim class-membership recovery from unlearned models without access to the original trained model. The paper has concrete strengths: a clearly described protocol, evaluation across eight MU methods and four datasets, separate closed- and open-source cases, an ablation study, and an anonymous code repository. However, the central privacy-leak claim is not yet established because the experimental design lacks an exact-unlearning control. Without a retrained-from-scratch baseline, the reported D_f accuracy gains may reflect class-level information that any model trained on the remaining data would retain, rather than residual memory of the forgotten samples in the ULM. The conclusions therefore hinge on a comparison that the paper does not perform.

major comments (3)
  1. [Section 5.1, Table 1; conclusion in Section 5.2 and Section 6] The experimental protocol sets D_p = D_ts ∪ D_f and constructs D_f as a 50% subsample of five classes, so D_r still contains the other half of the training images from those same classes. A model retrained from scratch on D_tr \ D_f would therefore retain class-level discriminative information and could label a large fraction of D_f correctly simply by class similarity. The reported D_f accuracies after MRA (e.g., 0.997 for SalUn on CIFAR-10 in Table 3) are interpreted as evidence that the ULM leaks the forgotten class memberships, but without an exact-unlearning control (a retrained or SISA model used as the teacher in the same MRA pipeline), the same numbers could be produced by any model trained on the remaining data. This control is necessary to support the paper's central claim 'precise forgetting, easy recalling' and the privacy-leak conclusion.
  2. [Section 5.1, Tables 2 and 3] All reported accuracies are single runs with no error bars, standard deviations, or number of seeds. Several deltas are small (e.g., ∆Acc = 0.005 for GA on CIFAR-10 D_ts in Table 2), and the claim that RCMs 'unexceptionally improve' accuracy across all settings cannot be assessed without variance estimates. The authors should report multiple seeds (at least three) and, ideally, statistical significance for the key comparisons.
  3. [Section 3.1 and Section 5.1, Eqs. (5)-(8)] The attack's operational requirement is under-specified: D_p is defined to include both the forgetting images and the test set D_ts, and the confident membership recall step uses top-K selection over the whole of X_p. This means the adversary needs non-forgotten samples from the same classes as the forgotten ones to bootstrap the prototypes. The paper does not state this auxiliary-data condition as part of the threat model, nor does it evaluate failure modes when D_p contains only the forgotten images or when unlearning removes whole classes from the label space. Without such an evaluation or a stated assumption, the practical scope of the attack is unclear.
minor comments (5)
  1. [Section 4.3, Eq. (7)] The text reads 'where Y^U_p , Y^U_p ∈ R^{N×C}' but the second matrix should be Y^S_p; please correct this typo.
  2. [Section 5.2, first paragraph] The sentence 'Table 2 show the accuracy (Acc) of prediction dataset D_p in terms of its subsets D_ts and D_ts respectively' should refer to D_ts and D_f; the same typo appears in the Table 2 caption.
  3. [Section 4.1, subsection heading] The heading 'Denosing Knowledge Distillation' should be 'Denoising Knowledge Distillation'.
  4. [Section 3.1] The formal definition allows X_u ⊆ X_f, but the experiments set X_u = X_f (D_p = D_ts ∪ D_f); please state this explicitly to avoid confusion between the general formulation and the evaluation setup.
  5. [Figures 7, 16-31] The confusion-matrix figures would be easier to read if the color scale were shared across all panels for a given dataset and configuration.

Circularity Check

0 steps flagged · score 1.0 of 10

No material circularity: RCM accuracy is measured against ground-truth labels, not against the pseudo-labels used for training; the few self-citations are non-load-bearing.

full rationale

The paper's derivation chain is: the ULM provides pseudo-labels on X_p (constructed as D_ts ∪ D_f), a student model (and optionally the ULM itself in the open-source case) is trained on confident-agreement subsets D_CF selected by Eqs. (5)-(8), and the resulting RCM is evaluated by accuracy on the true labels of D_f and D_ts. Nothing in Eqs. (1)-(12) assumes the target membership labels: Y_f never enters the training loop, and the reported D_f accuracy is an external comparison against ground truth rather than a comparison against the teacher's pseudo-labels. The open-source variant is self-training on the ULM's own confident predictions, but the final metric is true-label accuracy, so the observed improvement is an empirical finding, not an identity forced by construction. The self-citations ([Bao et al. 2023], [Miao et al. 2024], [Wu et al. 2024]) appear only as motivational or background references and are not load-bearing for the MRA derivation. The main validity weakness, namely the absence of a retrained-from-scratch or exact-unlearning control, is a threat-model and experimental-design concern: it bears on whether the recovered labels reflect residual memory in the ULM versus class-level information retained in D_r, but it does not make the derivation circular. No circular step can be quoted from the paper's equations or argument.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or conceptual entities; its output is an attack framework. The free parameters are the standard hyperparameters of the method, and the main burden is the auxiliary-data assumption. No new particles, forces, or conserved quantities are postulated.

free parameters (6)
  • tau (Top-K ratio) = 0.60 or 0.05 (closed-source per dataset), 0.05 (open-source)
    Controls K = ceil(tau*N/C), the size of the confident agreement set. Values differ across datasets and cases and are chosen by the authors; no sensitivity analysis is provided.
  • alpha_x (mixup image beta) = 0.20
    Beta distribution parameter for image mixup (Eq. 1). Fixed across all experiments, hand-chosen.
  • alpha_y (mixup label beta) = 0.75
    Beta parameter for mixing teacher/student soft labels (Eq. 3). Fixed across experiments, hand-chosen.
  • gamma_l (Laplace smoothing) = 0.01
    Smoothing of teacher soft labels (Eq. 6) to avoid zero probabilities. Fixed, hand-chosen.
  • gamma_s (label smoothing) = 0.05
    Smoothing of confident pseudo-labels (Eq. 8). Fixed, hand-chosen.
  • learning rates = LR_S 1e-4/2e-4, LR_U 5e-5/1e-4
    AdamW learning rates for student and ULM, chosen per dataset (Tables 6 and 7).
assumptions (4)
  • domain assumption The forgetting classes remain in the model's label space, and the prediction set D_p contains non-forgotten samples from those classes
    The experiments set D_p = D_ts ∪ D_f (Section 5.1, Table 1), so the teacher has anchor samples for each forgetting class. This is essential for bootstrapping but not stated as a threat-model condition.
  • domain assumption The ULM is accessible either as a black-box service or with released parameters
    The two cases in Section 3.3 define the attack surface. This is a reasonable threat model but an assumption about the deployment scenario.
  • standard math Mixup and confidence-based pseudo-label selection can bootstrap a student from a noisy teacher
    The method relies on LNL and self-training literature (Algan and Ulusoy 2021; Lukasik et al. 2020), which is standard in the field.
  • domain assumption The MU algorithms are correctly implemented as published
    The paper applies existing MU methods as black boxes; any implementation errors would affect the quality of the ULMs and therefore the attack results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Recalling The Forgotten Class Memberships: Unlearned Models Can Be Noisy Labelers to Leak Privacy." pith.science (2026). https://pith.science/paper/N5JXMSEX

@misc{pith2026250619486,
  author       = {Pith},
  title        = {Pith review of: Recalling The Forgotten Class Memberships: Unlearned Models Can Be Noisy Labelers to Leak Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N5JXMSEX}},
  note         = {Machine review of arXiv:2506.19486}
}
read the original abstract

Machine Unlearning (MU) technology facilitates the removal of the influence of specific data instances from trained models on request. Despite rapid advancements in MU technology, its vulnerabilities are still underexplored, posing potential risks of privacy breaches through leaks of ostensibly unlearned information. Current limited research on MU attacks requires access to original models containing privacy data, which violates the critical privacy-preserving objective of MU. To address this gap, we initiate an innovative study on recalling the forgotten class memberships from unlearned models (ULMs) without requiring access to the original one. Specifically, we implement a Membership Recall Attack (MRA) framework with a teacher-student knowledge distillation architecture, where ULMs serve as noisy labelers to transfer knowledge to student models. Then, it is translated into a Learning with Noisy Labels (LNL) problem for inferring the correct labels of the forgetting instances. Extensive experiments on state-of-the-art MU methods with multiple real datasets demonstrate that the proposed MRA strategy exhibits high efficacy in recovering class memberships of unlearned instances. As a result, our study and evaluation have established a benchmark for future research on MU vulnerabilities.

Figures

Figures reproduced from arXiv: 2506.19486 by the authors.

Figure 1
Figure 1. The demonstration of recall attack on the unlearned model [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The workflow of proposed MRA framework. It consists of [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Comparison of the Acc between ULM and RCM (closed-source case) after MRA w.r.t. each forgetting class on CIFAR-10 dataset. Due to space limit, LARGER figures can be found in the online extended version. C1 C8 C15 C21 C29 Forgetting Classes 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Acc 0.20 0.31 0.08 0.00 0.34 0.29 0.38 0.29 0.41 0.71 FF ULM RCM C1 C8 C15 C21 C29 Forgetting Classes 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1… view at source ↗
Figures from the paper (28 more)
Figure 4
Figure 4. Figure 4: Comparison of the Acc between ULM and RCM (closed-source case) w.r.t. each forgetting class on Pet-37 dataset. the Acc of ULM and RCM over four datasets and diverse con￾figurations of the MU model. From the point of view of this table, all of the Acc on Df of TRM are 1…
Figure 5
Figure 5. Figure 5: Comparison of the Acc between ULM and RCM (open-source case) after MRA w.r.t. each forgetting class on CIFAR-10 dataset. Due to space limit, LARGER figures can be found in the online extended version. C1 C8 C15 C21 C29 Forgetting Classes 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8…
Figure 6
Figure 6. Figure 6: Comparison of the Acc between ULM and RCM (open-source case) w.r.t. each forgetting class on Pet-37 dataset. Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 FF Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 BU Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 SalUn Othe…
Figure 7
Figure 7. Figure 7: Confusion matrices with different configurations of MRA components. (a) demonstrates the confusion matrices after unlearning [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Comparison of the Acc between ULM and RCM (closed-source case) w.r.t. each forgetting class on CIFAR-10 dataset [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: Comparison of the Acc between ULM and RCM (closed-source case) w.r.t. each forgetting class on CIFAR-100 dataset. C1 C8 C15 C21 C29 Forgetting Classes 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Acc 0.20 0.31 0.08 0.00 0.34 0.29 0.38 0.29 0.41 0.71 FF ULM RCM C1 C8 C15 C21…
Figure 10
Figure 10. Figure 10: Comparison of the Acc between ULM and RCM (closed-source case) w.r.t. each forgetting class on Pet-37 dataset. Component FF RL GA IU BU L1-SP SalUn UNSC DST STU TCH Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df ✓ 0.163 0.126 0.393 0.144 0.501 0.252 0.114 0.1…
Figure 11
Figure 11. Figure 11: Comparison of the Acc between ULM and RCM (closed-source case) w.r.t. each forgetting class on Flower-102 dataset. C1 C3 C5 C7 C9 Forgetting Classes 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Acc 0.01 0.19 0.13 0.02 0.32 0.72 0.56 0.54 0.67 0.75 FF ULM RCM C1 C3 C5 C7 C9…
Figure 12
Figure 12. Figure 12: Comparison of the Acc between ULM and RCM (open-source case) w.r.t. each forgetting class on CIFAR-10 dataset. Component FF RL GA IU BU L1-SP SalUn UNSC DST STU TCH Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df ✓ 0.173 0.103 0.594 0.015 0.528 0.180 0.135 0.1…
Figure 13
Figure 13. Figure 13: Comparison of the Acc between ULM and RCM (open-source case) w.r.t. each forgetting class on CIFAR-100 dataset. C1 C8 C15 C21 C29 Forgetting Classes 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Acc 0.20 0.31 0.08 0.00 0.34 0.60 0.78 0.88 0.73 0.99 FF ULM RCM C1 C8 C15 C21 …
Figure 14
Figure 14. Figure 14: Comparison of the Acc between ULM and RCM (open-source case) w.r.t. each forgetting class on Pet-37 dataset. Component FF RL GA IU BU L1-SP SalUn UNSC DST STU TCH Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df ✓ 0.223 0.168 0.766 0.364 0.739 0.176 0.576 0.144…
Figure 15
Figure 15. Figure 15: Comparison of the Acc between ULM and RCM (open-source case) w.r.t. each forgetting class on Flower-102 dataset. Other C1 C3 C5 C7 C9 Other C1 C3 C5 C7 C9 0.00 0.00 0.00 0.00 0.00 0.00 0.58 0.01 0.09 0.12 0.01 0.19 0.56 0.01 0.19 0.12 0.01 0.10 0.51 0.00 0.21 0.13 0.0…
Figure 16
Figure 16. Figure 16: Confusion matrices of ULM w.r.t. different MU methods Component FF RL GA IU BU L1-SP SalUn UNSC DST STU TCH Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df Dts Df ✓ 0.278 0.198 0.741 0.170 0.319 0.231 0.519 0.320 0.714 0.377 0.511 0.308 0.505 0.247 NA NA ✓ ✓ 0.376 0.…
Figure 17
Figure 17. Figure 17: Confusion matrices of DST w.r.t. different MU methods Other C1 C3 C5 C7 C9 Other C1 C3 C5 C7 C9 0.00 0.00 0.00 0.00 0.00 0.00 0.53 0.12 0.03 0.15 0.07 0.12 0.50 0.06 0.21 0.13 0.06 0.04 0.45 0.04 0.27 0.15 0.06 0.03 0.53 0.14 0.07 0.06 0.16 0.03 0.35 0.07 0.01 0.06 0.…
Figure 18
Figure 18. Figure 18: Confusion matrices of DST+STU w.r.t. different MU methods [PITH_FULL_IMAGE:figures/full_fig_p017_18.png]
Figure 19
Figure 19. Figure 19: Confusion matrices of the DST+STU+TCH w.r.t. different MU methods Other C10 C30 C50 C70 C90 Other C10 C30 C50 C70 C90 0.00 0.00 0.00 0.00 0.00 0.00 0.91 0.08 0.00 0.01 0.00 0.00 0.97 0.00 0.03 0.00 0.00 0.00 0.94 0.00 0.00 0.06 0.00 0.00 0.96 0.01 0.00 0.01 0.02 0.00 …
Figure 20
Figure 20. Figure 20: Confusion matrices of the UML w.r.t. different MU methods [PITH_FULL_IMAGE:figures/full_fig_p018_20.png]
Figure 21
Figure 21. Figure 21: Confusion matrices of the DST w.r.t. different MU methods Other C10 C30 C50 C70 C90 Other C10 C30 C50 C70 C90 0.00 0.00 0.00 0.00 0.00 0.00 0.77 0.21 0.00 0.00 0.02 0.00 0.84 0.00 0.15 0.01 0.00 0.00 0.83 0.00 0.01 0.16 0.00 0.00 0.85 0.00 0.00 0.00 0.15 0.00 0.71 0.0…
Figure 22
Figure 22. Figure 22: Confusion matrices of the DST+STU w.r.t. different MU methods [PITH_FULL_IMAGE:figures/full_fig_p019_22.png]
Figure 23
Figure 23. Figure 23: Confusion matrices of the DST+STU+TCH w.r.t. different MU methods Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 FF Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 RL Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 GA Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 I…
Figure 24
Figure 24. Figure 24: Confusion matrices of the UML w.r.t. different MU methods [PITH_FULL_IMAGE:figures/full_fig_p020_24.png]
Figure 25
Figure 25. Figure 25: Confusion matrices of the DST w.r.t. different MU methods Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 FF Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 RL Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 GA Other C1 C8 C15 C21 C29 Other C1 C8 C15 C21 C29 IU Other …
Figure 26
Figure 26. Figure 26: Confusion matrices of the DST+STU w.r.t. different MU methods [PITH_FULL_IMAGE:figures/full_fig_p021_26.png]
Figure 27
Figure 27. Figure 27: Confusion matrices of the DST+STU+TCH w.r.t. different MU methods Other C50 C72 C76 C88 C93 Other C50 C72 C76 C88 C93 0.00 0.00 0.00 0.00 0.00 0.00 0.90 0.10 0.00 0.00 0.00 0.00 0.90 0.00 0.10 0.00 0.00 0.00 0.40 0.00 0.00 0.60 0.00 0.00 1.00 0.00 0.00 0.00 0.00 0.00 …
Figure 28
Figure 28. Figure 28: Confusion matrices of the ULM w.r.t. different MU methods [PITH_FULL_IMAGE:figures/full_fig_p022_28.png]
Figure 29
Figure 29. Figure 29: Confusion matrices of the DST w.r.t. different MU methods Other C50 C72 C76 C88 C93 Other C50 C72 C76 C88 C93 0.00 0.00 0.00 0.00 0.00 0.00 0.80 0.20 0.00 0.00 0.00 0.00 0.80 0.00 0.20 0.00 0.00 0.00 0.20 0.00 0.00 0.80 0.00 0.00 1.00 0.00 0.00 0.00 0.00 0.00 1.00 0.0…
Figure 30
Figure 30. Figure 30: Confusion matrices of the DST+STU w.r.t. different MU methods [PITH_FULL_IMAGE:figures/full_fig_p023_30.png]
Figure 31
Figure 31. Figure 31: Confusion matrices of the DST+STU+TCH w.r.t. different MU methods [PITH_FULL_IMAGE:figures/full_fig_p024_31.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 33 canonical work pages

  1. [1]

    Image classification with deep learning in the presence of noisy labels: A survey.Knowledge-Based Systems, 215:106771,

    [Algan and Ulusoy, 2021] G¨orkem Algan and Ilkay Ulusoy. Image classification with deep learning in the presence of noisy labels: A survey.Knowledge-Based Systems, 215:106771,

    work page 2021

  2. [5]

    To- wards making systems forget with machine unlearning

    [Cao and Yang, 2015] Yinzhi Cao and Junfeng Yang. To- wards making systems forget with machine unlearning. IEEE Symposium on Security and Privacy, pages 463– 480,

    work page 2015

  3. [7]

    When machine unlearning jeopardizes privacy

    [Chenet al., 2021 ] Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When machine unlearning jeopardizes privacy. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, CCS ’21, page 896–911, New York, NY , USA,

    work page 2021

  4. [8]

    [Chenet al., 2023 ] Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang

    Association for Computing Machinery. [Chenet al., 2023 ] Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In2023 IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pages 7766–7775,

    work page 2023

  5. [9]

    Machine unlearning via null space cali- bration

    [Chenet al., 2024 ] Huiqiang Chen, Tianqing Zhu, Xin Yu, and Wanlei Zhou. Machine unlearning via null space cali- bration. In Kate Larson, editor,Proceedings of the Thirty- Third International Joint Conference on Artificial Intelli- gence, IJCAI-24, pages 358–366. International Joint Con- ferences on Artificial Intelligence Organization, 8

    work page 2024

  6. [11]

    Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation

    [Fanet al., 2024 ] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation. In The Twelfth International Conference on Learning Repre- sentations,

    work page 2024

  7. [12]

    Model inversion attacks that exploit confidence information and basic countermeasures

    [Fredriksonet al., 2015 ] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In ACM SIGSAC Conference on Computer and Communica- tions Security, pages 1322–1333,

    work page 2015

  8. [13]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks

    [Golatkaret al., 2020 ] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9304–9312,

    work page 2020

Show all 35 references
  1. [15]

    Deep residual learning for image recog- nition

    [Heet al., 2016 ] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. InIEEE Conference on Computer Vision and Pat- tern Recognition, pages 770–778,

    2016

  2. [18]

    Learn what you want to unlearn: Un- learning inversion attacks against machine unlearning

    [Huet al., 2024 ] Hongsheng Hu, Shuo Wang, Tian Dong, and Minhui Xue. Learn what you want to unlearn: Un- learning inversion attacks against machine unlearning. In IEEE Symposium on Security and Privacy,

    2024

  3. [19]

    The significance and context of the establishment of california consumer privacy act of

    [Itakura and Terada, 2018] Yoichiro Itakura and Mayu Ter- ada. The significance and context of the establishment of california consumer privacy act of

    2018

  4. [21]

    Model sparsity can simplify machine unlearning

    [Jiaet al., 2023 ] Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsity can simplify machine unlearning. InNeural Information Processing Systems,

    2023

  5. [22]

    Un- derstanding black-box predictions via influence functions

    [Koh and Liang, 2017] Pang Wei Koh and Percy Liang. Un- derstanding black-box predictions via influence functions. InInternational Conference on Machine Learning, pages 1885–1894. PMLR,

    2017

  6. [25]

    Does label smoothing mitigate label noise? InInternational Con- ference on Machine Learning, pages 6448–6458

    [Lukasiket al., 2020 ] Michal Lukasik, Srinadh Bhojana- palli, Aditya Menon, and Sanjiv Kumar. Does label smoothing mitigate label noise? InInternational Con- ference on Machine Learning, pages 6448–6458. PMLR,

    2020

  7. [26]

    Marchant, Benjamin I

    [Marchantet al., 2022 ] Neil G. Marchant, Benjamin I. P. Ru- binstein, and Scott Alfeld. Hard to forget: Poisoning at- tacks on certified machine unlearning. InAAAI Conference on Artificial Intelligence, volume 36, pages 7691–7700,

    2022

  8. [27]

    Graph memory learning: Imitating lifelong remembering and forgetting of brain networks.CoRR, abs/2407.19183,

    [Miaoet al., 2024 ] Jiaxing Miao, Liang Hu, Qi Zhang, and Longbing Cao. Graph memory learning: Imitating lifelong remembering and forgetting of brain networks.CoRR, abs/2407.19183,

    2024 arXiv

  9. [28]

    Automated flower classification over a large number of classes

    [Nilsback and Zisserman, 2008] Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. InICVGIP,

    2008

  10. [31]

    Efficient- net: Rethinking model scaling for convolutional neural networks

    [Tan and Le, 2019] Mingxing Tan and Quoc Le. Efficient- net: Rethinking model scaling for convolutional neural networks. InInternational conference on machine learn- ing, pages 6105–6114. PMLR,

    2019

  11. [32]

    Unrolling sgd: Understanding factors influencing machine unlearning

    [Thudiet al., 2022 ] Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling sgd: Understanding factors influencing machine unlearning. InIEEE European Symposium on Security and Privacy, pages 303–319,

    2022

  12. [33]

    Hydiscgan: A hybrid dis- tributed cgan for audio-visual privacy preservation in mul- timodal sentiment analysis

    [Wuet al., 2024 ] Zhuojia Wu, Qi Zhang, Duoqian Miao, Kun Yi, Wei Fan, and Liang Hu. Hydiscgan: A hybrid dis- tributed cgan for audio-visual privacy preservation in mul- timodal sentiment analysis. InIJCAI, pages 6550–6558. ijcai.org,

    2024

  13. [34]

    Dauphin, and David Lopez-Paz

    [Zhanget al., 2018 ] Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization.International Conference on Learning Representations,

    2018

  14. [35]

    An MU method with more precise unlearning may lead to higher success rate of MRA to recall the forgotten class memberships

    Appendix A Source Code To ensure a clear and concise code structure, we provide only the core implementation in the supplementary materials. Experimental datasets, trained model checkpoints, and other auxiliary files are excluded. The source code is available for review in the...

    2019

  15. [2008]

    Parkhi, Andrea Vedaldi, An- drew Zisserman, and C

    [Parkhiet al., 2012 ] Omkar M. Parkhi, Andrea Vedaldi, An- drew Zisserman, and C. V . Jawahar. Cats and dogs. In CVPR,

    2012

  16. [2009]

    Swin trans- former v2: Scaling up capacity and resolution

    [Liuet al., 2022 ] Ze Liu, Han Hu, Yutong Lin, Zhuliang Yao, Zhenda Xie, Yixuan Wei, Jia Ning, Yue Cao, Zheng Zhang, Li Dong, Furu Wei, and Baining Guo. Swin trans- former v2: Scaling up capacity and resolution. In2022 IEEE/CVF Conference on Computer Vision and Pattern Recogni...

    2022

  17. [2012]

    Membership infer- ence attacks against machine learning models

    [Shokriet al., 2017 ] Reza Shokri, Marco Stronati, Con- gzheng Song, and Vitaly Shmatikov. Membership infer- ence attacks against machine learning models. InIEEE Symposium on Security and Privacy, pages 3–18,

    2017

  18. [2015]

    On mixup regularization.Journal of Machine Learning Research, 23(325):1–31,

    [Carratinoet al., 2022 ] Luigi Carratino, Moustapha Ciss ´e, Rodolphe Jenatton, and Jean-Philippe Vert. On mixup regularization.Journal of Machine Learning Research, 23(325):1–31,

    2022

  19. [2016]

    Zuiderveen Borgesius

    [Hoofnagleet al., 2019 ] Chris Jay Hoofnagle, Bart van der Sloot, and Frederik J. Zuiderveen Borgesius. The euro- pean union general data protection regulation: what it is and what it means*.Information & Communications Tech- nology Law, 28:65 – 98,

    2019

  20. [2017]

    Learning multiple layers of features from tiny im- ages.Master’s Thesis,

    [Krizhevskyet al., 2009 ] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny im- ages.Master’s Thesis,

    2009

  21. [2018]

    Approximate data dele- tion from machine learning models

    [Izzoet al., 2021 ] Zachary Izzo, Mary Anne Smart, Kama- lika Chaudhuri, and James Zou. Approximate data dele- tion from machine learning models. InInternational Conference on Artificial Intelligence and Statistics, pages 2008–2016. PMLR,

    2021

  22. [2019]

    A duty to forget, a right to be assured? expos- ing vulnerabilities in machine unlearning services.ArXiv preprint arXiv:2309.08230,

    [Huet al., 2023 ] Hongsheng Hu, Shuo Wang, Jiamin Chang, Haonan Zhong, Ruoxi Sun, Shuang Hao, Haojin Zhu, and Minhui Xue. A duty to forget, a right to be assured? expos- ing vulnerabilities in machine unlearning services.ArXiv preprint arXiv:2309.08230,

    2023 arXiv

  23. [2020]

    Amnesiac machine learning

    [Graveset al., 2021 ] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. InAAAI Conference on Artificial Intelligence, volume 35, pages 11516–11524,

    2021

  24. [2021]

    Multimodal federated learn- ing with missing modality via prototype mask and con- trast.CoRR, abs/2312.13508,

    [Baoet al., 2023 ] Guangyin Bao, Qi Zhang, Duoqian Miao, Zixuan Gong, and Liang Hu. Multimodal federated learn- ing with missing modality via prototype mask and con- trast.CoRR, abs/2312.13508,

    2023 arXiv

  25. [2022]

    Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot

    [Bourtouleet al., 2021 ] Lucas Bourtoule, Varun Chan- drasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. InIEEE Symposium on Security and Privacy, pages 141–159,

    2021

  26. [2023]

    Evaluating machine unlearning via epistemic un- certainty.ArXiv preprint arXiv:2208.10836,

    [Becker and Liebig, 2022] Alexander Becker and Thomas Liebig. Evaluating machine unlearning via epistemic un- certainty.ArXiv preprint arXiv:2208.10836,

    2022 arXiv

  27. [2024]

    [Diet al., 2022 ] Jimmy Z

    Main Track. [Diet al., 2022 ] Jimmy Z. Di, Jack Douglas, Jayadev Acharya, Gautam Kamath, and Ayush Sekhari. Hidden poison: Machine unlearning enables camouflaged poison- ing attacks. InNeurIPS ML Safety Workshop,

    2022

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.