Pith. sign in

REVIEW 3 major objections 5 minor 47 references

Reminiscence Attack on Residuals: Exploiting Approximate Machine Unlearning for Privacy

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Approximate machine unlearning methods leave persistent latent residuals in the loss landscape that allow membership inference against unlearned classes and samples, and a two-phase orthogonal unlearning framework can scrub those residuals.

desk verdict The attack is the real contribution; the defense as written has a load-bearing contradiction that must be resolved before the mitigation claims are taken at face value. read the letter →

arxiv 2507.20573 v1 pith:52UVZFUD submitted 2025-07-28 cs.LG

Yaxin Xiao , Qingqing Ye , Li Hu , Huadi Zheng , Haibo Hu , Zi Liang , Haoyang Li , Yijie Jiao This is my paper · ORCID
classification cs.LG
keywords machineunlearningapproximatemembershipinferenceattackprivacyleakagelosslandscaperesidualsresonanceindexorthogonalconcept
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that approximate machine unlearning, though it makes a model's outputs resemble a fully retrained model, leaves latent residuals in the loss landscape that still encode the identity of deleted data. The authors call these implicit residuals and argue they persist across model architectures, training parameters, and unlearning algorithms, forming an attack surface that output-level privacy metrics miss. On that basis they introduce the Reminiscence Attack (ReA), which fine-tunes a model on candidate classes or samples and measures how quickly it 'remembers' them, and they propose Orthogonal Unlearning & Replay (OUR) to scrub the traces. A sympathetic reader would care because, if the claim holds, current approximate unlearning methods can be compliant-looking while still leaking membership privacy, and the paper's defense offers a way to close that gap at a fraction of retraining cost.

What carries the argument

The paper's central object is the residual $R(D_u)$, defined as the expected behavioral discrepancy between unlearned data and their non-training counterparts. The attack mechanism is the resonance index $\mathrm{Idx}_r$, the fine-tuning iterations a model needs to reach a convergence threshold on a candidate class or sample set; faster convergence means the candidate is likely unlearned, because the model still sits near a minimum for that data. The defense mechanism is the orthogonal unlearning loss $L_{\mathrm{orth}} = \sum_{(x,y)\in D_u}\sum_{l\in\{l\}_k}[F_l^T(x;\theta)F_l(x;\theta_0)]^2$, which pushes hidden representations of unlearned samples toward orthogonality with their original states, followed by a replay phase that fine-tunes on retained data to restore utility and genuine convergence. The two-phase structure is what separates scrubbing from merely masking outputs.

What would settle it

Take a model unlearned by any approximate unlearning method and measure the resonance index on a held-out set that was never in training, after matching the model's outputs to a retrained model on all legacy metrics. If convergence speed for unlearned candidates is indistinguishable from non-training candidates whenever output distributions match, the central claim of persistent loss-landscape residuals is falsified.

Watch

Extended reading notes

Core claim

Approximate unlearning methods that satisfy legacy accuracy-based unlearning metrics still leave measurable residuals: deep-layer hidden representations retain high intra-class correlation for unlearned classes, and unlearned models sit in 'pseudo-converged' states whose outputs mimic retrained models while preserving latent information. ReA exploits this by guided fine-tuning; its resonance index, the number of iterations needed to reach a convergence threshold on a candidate set, separates unlearned from non-training data because unlearned data converge markedly faster. The paper reports ReA reaching up to 1.90x and 1.12x the accuracy of prior output-based attacks (MIA-LiRA and MIA-UP) for class- and sample-wise membership inference, including over 90% attack accuracy for several class-wise unlearning methods. The companion claim is that residuals are scrubbable: OUR enforces orthogonality between hidden features of unlearned data and their pre-unlearning values, then replays the retained set to restore convergence, reducing ReA accuracy to near random guess while keeping unlearning efficacy comparable to retraining at 2-12% of retraining cost.

Load-bearing premise

ReA's success assumes the adversary can obtain a subset of the candidate class or sample data and can fine-tune the victim model, or a high-fidelity substitute, on that data; without this capability the attack's effectiveness is not established.

Editorial extensions

If this is right

  • Unlearning efficacy measured by test, unlearning, and retaining accuracy is insufficient: a model can pass those metrics while remaining susceptible to membership inference against deleted data.
  • Class membership, not just sample membership, is a practical privacy target: ReA infers whether an entire class or concept was unlearned, with over 90% attack accuracy on several approximate unlearning methods.
  • The residual signal transfers: class-wise ReA remains effective in black-box settings using a substitute model obtained by model extraction, so API-only access does not fully neutralize the attack.
  • OUR offers a concrete privacy-preserving alternative that approaches retrained-model privacy (ReA accuracy near random guess) at 2-12% of full-retraining cost, for both classification and image-generation concept unlearning.
  • Residual leakage is algorithm-independent in tendency: the paper finds vulnerabilities across fine-tuning, gradient ascent, random label, influence-based, boundary-based, SCRUB, l1-sparse, SalUn, SFRon, and RUM benchmarks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One extension the paper leaves implicit: the resonance-index signal is a generic convergence-speed probe, so similar fine-tuning-based membership tests could be run against large language models or federated clients where unlearning is performed by local fine-tuning rather than full retraining.
  • The measured correlation between representation misalignment and ReA accuracy suggests a cheap audit: inspecting intra-class variance, silhouette score, and overlap in hidden representations could flag which unlearned models are still leaky before an attack is run.
  • A testable boundary case: if an approximate unlearning method ever produces parameters genuinely identical to retrained parameters (not just similar outputs), resonance should vanish; ReA therefore doubles as a measure of how far an unlearning method is from exact unlearning.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper claims that approximate machine unlearning (AMU) methods leave persistent ``implicit residuals'' in the loss landscape that are invisible to output-level unlearning metrics, and that these residuals enable membership inference against unlearned classes and samples. To exploit this, the authors propose the Reminiscence Attack (ReA), which fine-tunes the unlearned model on inferred or pseudo-retained data and measures the speed of convergence (the ``resonance index'') as the membership signal. To mitigate the attack, they propose Orthogonal Unlearning & Replay (OUR), a two-phase method that first is supposed to enforce orthogonality between hidden features before and after unlearning on the forget set, and then replays the retained set with l1 regularization. The evaluation covers 11 unlearning baselines, three classification datasets, two architectures, and a Stable Diffusion concept-unlearning task, reporting that ReA outperforms MIA-LiRA and MIA-UP while OUR reduces adaptive attack accuracy to near random-chance levels.

Significance. If the attack-side claim holds, the paper makes a useful contribution: it demonstrates a version-independent attack surface that goes beyond output-distribution residuals, with the retrained-model control (ReA near 50%), the ROC analyses, and the representation-misalignment correlations in Figure 5 providing meaningful support. The breadth of the evaluation, the ablation studies, and the inclusion of diffusion-model experiments are also strengths, and the authors provide a code link. However, the defense-side evidence is currently not trustworthy because the pseudo-code for OUR contradicts the main-text loss formulation; the reported privacy improvement of OUR cannot be attributed to the claimed orthogonal-scrubbing mechanism until this inconsistency is resolved. The convergence-threshold inconsistency in ReA's pseudo-code similarly affects reproducibility of the attack numbers.

major comments (3)
  1. [§4.2, Eq. (7) vs. Appendix A, Algorithm 3] The main text defines the orthogonal-unlearning loss as Lorth = Σ [F_l^T(x;θ) F_l(x;θ0)]^2, which penalizes the squared dot product and therefore drives the current hidden features to be orthogonal to the pre-unlearning features. Appendix A, Algorithm 3, Phase 1, line 2 instead defines Lorth = Σ ||F_l(x;θ) − F_l(x;θ0)||^2_2, a squared Euclidean distance that drives the current features toward the original features, which is the opposite of orthogonal scrubbing. If the implementation follows the appendix, the paper's central defense mechanism was not actually tested, and the reported reduction in ReA accuracy could be caused by the replay phase, the l1 regularization, or ordinary feature-space perturbation rather than by the claimed orthogonality principle. This is a load-bearing internal inconsistency and must be corrected, with the affected experiments rerun or clearly reported under the objective that matches the paper's mechanism.
  2. [§5.1, Appendix A Algorithm 1, Appendix E.4] Algorithm 1, line 14 uses a convergence threshold of 0.9 (90%) on the fine-tuning accuracy, while Section 5.1 states that the convergence threshold is set to 75%, and Appendix E.4 reports that thresholds between 70% and 80% are optimal. Since the resonance index Idxr and hence every class-wise ReA score in Tables 2 and 6 depend directly on this threshold, the reported attack accuracies cannot be reproduced without knowing which threshold was actually used. The paper should state the implemented value explicitly and report whether any of the main-table results change under the stated 75% setting.
  3. [§5.3, Figure 5] The causal claim that representation residuals enable the privacy attack is based on Pearson correlations computed over the finite set of methods evaluated in Figure 5, with no confidence intervals or per-method variability shown. Given that the x-axis quantities and the ReA accuracies are derived from the same models, the correlation is suggestive but not by itself a proof of mechanism; the authors should strengthen this analysis or temper the wording from ``confirming'' to ``consistent with''.
minor comments (5)
  1. [§2.3] There is a typo: ``yeild'' should be ``yield''.
  2. [§3 title] The heading ``Reminisence Attack'' misspells ``Reminiscence''; the same misspelling appears at the top of Section 3.
  3. [Appendix A, Algorithm 3] The algorithm uses θ0 in the orthogonal loss but never assigns it; it stores θini at the start and then uses θini only for the Δmax check. The notation should be unified, either by setting θ0 ← θini or by using θini consistently in the loss.
  4. [§5.1, Privacy Attack Parameters] The text says the class-wise ReA adversary has access to 3% of unlearned data on CIFAR20 and 20% on CIFAR100, but the threat model in §2.3 does not state what data the adversary is assumed to hold; this assumption should be declared in the threat model before the attack is presented.
  5. [§5.4, Figure 6] The ablation labels ``Orth w/o Replay,'' ``RL w/ Replay,'' and ``FT w/ Sparsity'' are informative, but the text does not say whether the ablated variants use the Algorithm 3 objective or the Eq. (7) objective; resolving the main inconsistency will make these comparisons interpretable.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: ReA and OUR are empirically benchmarked against retrained models and prior attacks; a separate Algorithm 3 / Eq. 7 inconsistency affects the defense mechanism but is not circularity.

full rationale

ReA's resonance index (Eq. 5) is an empirically measured convergence speed after explicitly fine-tuning on candidate classes, benchmarked against retrained-model controls (ReA near 50% on retrained models) and against two prior output-based attacks (MIA-LiRA, MIA-UP). The residual claims are supported post hoc by representation-misalignment and UA-recovery correlations (Pearson 0.88 and 0.87, Figure 5), which are measurements of the proposed signal rather than fitted inputs that force the attack accuracy numbers. OUR's privacy and efficacy results are evaluated against external baselines (FT, GA, RL, IU, BU, FF, SCRUB, l1-sparse, SalUn, SFRon, RUM) and retrained models, and the hyperparameter choices are justified by ablations rather than by inserting the target conclusion. Self-citations ([3], [4], [28], [45]) are contextual prior work on membership inference and model inversion and do not carry the load-bearing residual argument. One internal inconsistency is worth flagging but is not circular: Section 4.2 Eq. 7 defines Lorth as the squared dot product [F_l^T(x;theta)F_l(x;theta0)]^2, while Appendix Algorithm 3 line 2 defines the same loss as the MSE ||F_l(x;theta)-F_l(x;theta0)||^2_2, which drives features toward, not orthogonal to, their pre-unlearning values. If the implementation follows the appendix, the experiments may validate only the replay/fine-tuning phase rather than the orthogonal-scrubbing mechanism. A smaller inconsistency exists in Algorithm 1's convergence threshold (0.9) versus the 75% stated in Section 5.1. These are correctness and reproducibility concerns, not self-referential derivations, so they do not change the circularity score.

Assumptions & free parameters 9 free parameters · 4 assumptions · 1 invented entities

The paper contributes an empirical attack and defense; most of the load is carried by a handful of domain assumptions about residual leakage, fine-tuning convergence, and the validity of MIA-LiRA scores. No formal proof of residual persistence is provided, and the hyperparameters that make the defense work are fitted via ablations.

free parameters (9)
  • ReA convergence threshold = 0.75 (main text), 0.9 (Algorithm 1)
    Sets the accuracy at which the resonance index is recorded; chosen via ablation in E.4.
  • ReA multi-lr set = {0.001, 0.005, 0.007, 0.01}
    Multi-lr aggregation to stabilize class-wise ReA; selected in E.3.
  • Sample-wise ReA learning rate = 0.01 (CIFAR10, SGD), 5e-5 (CIFAR20, Adam)
    Set to 0.1x training lr, determined by sensitivity analysis.
  • OUR phases epochs e1/e2 = e.g., CIFAR20 ViT: e1=7, e2=11 (class/sample); CIFAR10 ResNet18: e1=8, e2=8
    Chosen from ablation in E.2 to maximize ToW and ReA resistance.
  • OUR learning rates = 0.0008/0.0004 (ViT), 0.0018/0.005 (ResNet18)
    Tuned for each architecture and dataset.
  • OUR layer selection {l}_k = first, middle, last block outputs
    Span 3 configuration beats First 3 and Last 3 in E.1.
  • Orthogonal loss factor scaling (diffusion) = [5e-9, 5e-8]
    Scaled to avoid gradient explosion in Stable Diffusion fine-tuning.
  • l1 regularization factor = 1e-5
    Enhances sparsity; taken from [24] with minor tuning.
  • Delta threshold delta_thr = 5e-3
    Early stopping on max parameter change; set as max distance between two random models.
assumptions (4)
  • domain assumption Approximate unlearning leaves measurable residuals in the loss landscape (defined in Eq. 4) that persist across architectures.
    Central premise of the paper; supported empirically in Section 5.3 and Appendix C but not proven formally. Invoked in Section 3.
  • domain assumption Fine-tuning an unlearned model on a candidate class converges faster if that class was unlearned, because residuals align with the class.
    Mechanism behind ReA's resonance index; asserted via loss landscape visualization (Figure 2) and used in Eq. 5.
  • domain assumption MIA-LiRA confidence scores provide a valid membership signal before and after fine-tuning.
    Used as the attack model in sample-wise ReA (Section 3.1).
  • domain assumption Standard SGD/Adam convergence and model extraction fidelity are sufficient for the attack.
    White-box and black-box variants rely on gradient-based fine-tuning and DFME transferability (Section 3.1, E.8).
invented entities (1)
  • Implicit residual in the loss landscape independent evidence
    purpose: Explains why approximate unlearning leaks membership; motivates ReA and OUR.
    Operationalized via resonance index and representation metrics; correlation with attack accuracy (Pearson 0.88) provides empirical support beyond the paper's own framework.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Reminiscence Attack on Residuals: Exploiting Approximate Machine Unlearning for Privacy." pith.science (2026). https://pith.science/paper/52UVZFUD

@misc{pith2026250720573,
  author       = {Pith},
  title        = {Pith review of: Reminiscence Attack on Residuals: Exploiting Approximate Machine Unlearning for Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/52UVZFUD}},
  note         = {Machine review of arXiv:2507.20573}
}
read the original abstract

Machine unlearning enables the removal of specific data from ML models to uphold the right to be forgotten. While approximate unlearning algorithms offer efficient alternatives to full retraining, this work reveals that they fail to adequately protect the privacy of unlearned data. In particular, these algorithms introduce implicit residuals which facilitate privacy attacks targeting at unlearned data. We observe that these residuals persist regardless of model architectures, parameters, and unlearning algorithms, exposing a new attack surface beyond conventional output-based leakage. Based on this insight, we propose the Reminiscence Attack (ReA), which amplifies the correlation between residuals and membership privacy through targeted fine-tuning processes. ReA achieves up to 1.90x and 1.12x higher accuracy than prior attacks when inferring class-wise and sample-wise membership, respectively. To mitigate such residual-induced privacy risk, we develop a dual-phase approximate unlearning framework that first eliminates deep-layer unlearned data traces and then enforces convergence stability to prevent models from "pseudo-convergence", where their outputs are similar to retrained models but still preserve unlearned residuals. Our framework works for both classification and generation tasks. Experimental evaluations confirm that our approach maintains high unlearning efficacy, while reducing the adaptive privacy attack accuracy to nearly random guess, at the computational cost of 2-12% of full retraining from scratch.

Figures

Figures reproduced from arXiv: 2507.20573 by the authors.

Figure 1
Figure 1. Comparison of unlearning efficacy (Tug-of-War metric, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Visualized loss landscapes around unlearned models in [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. ROC Analysis of MIA (Selected Methods). indicate that ReA achieves substantially higher AUC values (up to 1.78 × /1.55×) than MIA-LiRA/UP, demonstrating superior membership inference capability. Notably, OUR’s curves align closely with retrained models (AUC difference < 0.11), suggesting better privacy preservation. Complete ROC analyses of all AMU appear in Appendix E.5. 5.3. Quantified Analysis of Unlearning Resid… view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Representation space visualization of the unlearned [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 6
Figure 6. Figure 6: Unlearning performance of OUR variants versus their [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Histograms of Parameter Changes. 0.001 0.002 Average Parameter Change 10 1 10 2 The Replay Epochs [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Parameter Changes versus The replay speed measured [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Visualized loss landscapes of unlearned data and non [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: OUR performance with different {l}k settings: first 3 / last 3 / span 3 denote the output layers of the first 3 blocks, last 3 blocks, and first, middle, and last blocks, respectively. E.2. Ablation Study of Number of Epochs in OUR To optimize the training efficiency …
Figure 13
Figure 13. Figure 13: ReA Attack Accuracy versus Convergence Threshold [PITH_FULL_IMAGE:figures/full_fig_p015_13.png]
Figure 11
Figure 11. Figure 11: Ablation study of e1 and e2 in OUR. Gray vertical bars indicate error bars. Class-wise ReA is evaluated 10 times for both unlearn and OOD classes per experiment. Results are averaged over 5 independent trials. 0.001 0.01 0.05 0.1 ReA Learning Rate 60 40 20 0 20 40 60 …
Figure 12
Figure 12. Figure 12: Resonance difference (Idxr of OOD classes minus that of unlearned classes) and ReA attack accuracy across learn￾ing rates in ReA. Gray bars represent error bars. the multi-lr aggregation strategy achieves superior results without method-specific tuning. Notably, our O…
Figure 15
Figure 15. Figure 15: ROC of sample-wise MIA. ders the reconstruction of unlearned concepts from related concepts during unlearning, which is described by “this is a photo of a woman”. In terms of parameter configuration, SalUn and SFRon adopt identical hyper-parameters with learning rates…
Figure 16
Figure 16. Figure 16: Representation space visualization of the class-wise [PITH_FULL_IMAGE:figures/full_fig_p017_16.png]
Figure 17
Figure 17. Figure 17: Training trajectories in the Reminiscence Attack under black-box scenarios. 3% of each type of data is available. The light-colored areas represent the error bars at different learning rates. E.7.3. Experimental Results on an Additional Concept Unlearning Benchmark: S…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 44 canonical work pages

  1. [1]

    https : / / www

    Bill text. https : / / www . priv . gc . ca / en/privacy- topics/privacy- laws- in- canada/. 1

    work page

  2. [2]

    Nonparametric estimation and inference about the overlap of two distributions

    Gordon Anderson, Oliver Linton, and Yoon-Jae Whang. Nonparametric estimation and inference about the overlap of two distributions. Journal of Econometrics, 171(1):1–23, 2012. 15

    work page 2012

  3. [3]

    Membership inference at- tacks and defenses in federated learning: A survey

    Li Bai, Haibo Hu, Qingqing Ye, Haoyang Li, Leixia Wang, and Jianliang Xu. Membership inference at- tacks and defenses in federated learning: A survey. ACM Comput. Surv., 57(4), 2025. 3

    work page 2025

  4. [4]

    Rmr: A relative membership risk measure for machine learning mod- els

    Li Bai, Haibo Hu, Qingqing Ye, Jianliang Xu, Jin Li, Chengfang Fang, and Jie Shi. Rmr: A relative membership risk measure for machine learning mod- els. IEEE Transactions on Dependable and Secure Computing, 2025. 3

    work page 2025

  5. [5]

    Recon- struction attacks on machine unlearning: Simple mod- els are vulnerable

    Martin Bertran, Shuai Tang, Michael Kearns, Jamie H Morgenstern, Aaron Roth, and Steven Z Wu. Recon- struction attacks on machine unlearning: Simple mod- els are vulnerable. Advances in Neural Information Processing Systems, 37:104995–105016, 2025. 2, 3, 8

    work page 2025

  6. [6]

    Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot

    Lucas Bourtoule, Varun Chandrasekaran, Christo- pher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Ma- chine unlearning. In 42nd IEEE Symposium on Secu- rity and Privacy, SP 2021, San Francisco, CA, USA, 24-27 May 2021, pages 141–159. IEEE, 2021. 1

    work page 2021

  7. [7]

    Member- ship inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Member- ship inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE, 2022. 2, 3, 4, 5, 6

    work page 2022

  8. [8]

    Boundary unlearning: Rapid forget- ting of deep networks via shifting the decision bound- ary

    Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forget- ting of deep networks via shifting the decision bound- ary. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023 , pages 7766–7775. IEEE,

    work page 2023

Show all 47 references
  1. [9]

    When machine unlearning jeopardizes privacy

    Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When machine unlearning jeopardizes privacy. In Yong- dae Kim, Jong Kim, Giovanni Vigna, and Elaine Shi, editors, CCS ’21: 2021 ACM SIGSAC Conference on Computer and Communications Security,...

    2021

  2. [10]

    Chundawat, Ayush K

    Vikram S. Chundawat, Ayush K. Tarun, Murari Man- dal, and Mohan S. Kankanhalli. Can bad teach- ing induce forgetting? unlearning in deep networks using an incompetent teacher. In Brian Williams, Yiling Chen, and Jennifer Neville, editors, Thirty- Seventh AAAI Conference on Art...

    2023

  3. [11]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4690–4699, 2019. 16

    2019

  4. [12]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at...

    2021

  5. [13]

    Salun: Empow- ering machine unlearning via gradient-based weight saliency in both image classification and generation

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Empow- ering machine unlearning via gradient-based weight saliency in both image classification and generation. In International Conference on Learning Representa- tions, 2024. 2, 6, 7, 8, 14, 16, 17

    2024

  6. [14]

    Meta-unlearning on dif- fusion models: Preventing relearning unlearned con- cepts

    Hongcheng Gao, Tianyu Pang, Chao Du, Taihang Hu, Zhijie Deng, and Min Lin. Meta-unlearning on dif- fusion models: Preventing relearning unlearned con- cepts. CoRR, abs/2410.12777, 2024. 2, 8, 16

    2024 arXiv

  7. [15]

    Ethos: Rectifying language models in orthogonal parameter space

    Lei Gao, Yue Niu, Tingting Tang, Salman Avestimehr, and Murali Annavaram. Ethos: Rectifying language models in orthogonal parameter space. In NAACL- HLT (Findings), 2024. 5

    2024

  8. [16]

    Eternal sunshine of the spotless net: Selec- tive forgetting in deep networks

    Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selec- tive forgetting in deep networks. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recog- nition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pages 9301–9309. Com...

    2020

  9. [17]

    Amnesiac machine learning

    Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence , vol- ume 35, pages 11516–11524, 2021. 4, 5, 6, 7, 13, 17

    2021

  10. [18]

    The elements of statistical learning: data mining, inference, and prediction, vol- ume 2

    Trevor Hastie, Robert Tibshirani, Jerome H Friedman, and Jerome H Friedman. The elements of statistical learning: data mining, inference, and prediction, vol- ume 2. Springer, 2009. 15

    2009

  11. [19]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pat- tern Recognition, CVPR 2016, Las Vegas, NV , USA, June 27-30, 2016 , pages 770–778. IEEE Computer Society, 2016. 5

    2016

  12. [20]

    Learn to unlearn for deep neural networks: Minimizing unlearning interference with gradient pro- jection

    Tuan Hoang, Santu Rana, Sunil Gupta, and Svetha Venkatesh. Learn to unlearn for deep neural networks: Minimizing unlearning interference with gradient pro- jection. In Proceedings of the IEEE/CVF Winter Con- ference on Applications of Computer Vision , pages 4819–4828, 2024. 5

    2024

  13. [21]

    Learn what you want to unlearn: Unlearning in- version attacks against machine unlearning

    Hongsheng Hu, Shuo Wang, Tian Dong, and Minhui Xue. Learn what you want to unlearn: Unlearning in- version attacks against machine unlearning. In IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024 , pages 3257–

    2024

  14. [22]

    Jogging the memory of unlearned llms through targeted relearning attacks

    Shengyuan Hu, Yiwei Fu, Zhiwei Steven Wu, and Vir- ginia Smith. Jogging the memory of unlearned llms through targeted relearning attacks. arXiv preprint arXiv:2406.13356, 2024. 8

    2024 arXiv

  15. [23]

    Unified gradient-based machine unlearning with re- main geometry enhancement

    Zhehao Huang, Xinwen Cheng, JingHao Zheng, Hao- ran Wang, Zhengbao He, Tao Li, and Xiaolin Huang. Unified gradient-based machine unlearning with re- main geometry enhancement. In Amir Globersons, Lester Mackey, Danielle Belgrave, Angela Fan, Ulrich Paquet, Jakub M. Tomczak, an...

    2024

  16. [24]

    Model sparsity can simplify machine unlearning

    Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsity can simplify machine unlearning. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors,Ad- vances in Neural ...

    2023

  17. [25]

    F? d: On under- standing the role of deep feature spaces on face gen- eration evaluation

    Krish Kabra and Guha Balakrishnan. F? d: On under- standing the role of deep feature spaces on face gen- eration evaluation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, pages 8327–8332, 2024. 17

    2024

  18. [26]

    Progressive growing of gans for improved quality, stability, and variation

    Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Con- ference Track Proc...

    2018

  19. [27]

    Towards unbounded machine unlearning

    Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning. Advances in neural information process- ing systems, 36:1957–1987, 2023. 2, 3, 5, 6, 8, 14, 17

    1957

  20. [28]

    A sample-level evaluation and generative framework for model inver- sion attacks

    Haoyang Li, Li Bai, Qingqing Ye, Haibo Hu, Yaxin Xiao, Huadi Zheng, and Jianliang Xu. A sample-level evaluation and generative framework for model inver- sion attacks. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 39, pages 18287– 18295, 2025. 1

    2025

  21. [29]

    FUNU: boosting machine unlearning efficiency by filtering unnecessary unlearning

    Zitong Li, Qingqing Ye, and Haibo Hu. FUNU: boosting machine unlearning efficiency by filtering unnecessary unlearning. In Guodong Long, Michale Blumestein, Yi Chang, Liane Lewin-Eytan, Zi Helen Huang, and Elad Yom-Tov, editors,Proceedings of the ACM on Web Conference 2025, WW...

    2025

  22. [30]

    A data- free backdoor injection approach in neural networks

    Peizhuo Lv, Chang Yue, Ruigang Liang, Yunfei Yang, Shengzhi Zhang, Hualong Ma, and Kai Chen. A data- free backdoor injection approach in neural networks. In Joseph A. Calandrino and Carmela Troncoso, edi- tors, 32nd USENIX Security Symposium, USENIX Se- curity 2023, Anaheim, C...

    2023

  23. [31]

    To- wards deep learning models resistant to adversarial at- tacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial at- tacks. arXiv preprint arXiv:1706.06083, 2017. 8

    2017 arXiv

  24. [32]

    The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’

    Alessandro Mantelero. The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’. Computer Law & Security Review , 29(3):229–235, 2013. 1

    2013

  25. [33]

    No-reference image quality assessment in the spatial domain

    Anish Mittal, Anush Krishna Moorthy, and Alan Con- rad Bovik. No-reference image quality assessment in the spatial domain. IEEE Trans. Image Process. , 21(12):4695–4708, 2012. 17

    2012

  26. [34]

    Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine- tuning aligned language models compromises safety, even when users do not intend to! In The Twelfth In- ternational Conference on Learning Representations, ICLR 2024, Vienna, A...

    2024

  27. [35]

    High- resolution image synthesis with latent diffusion mod- els

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High- resolution image synthesis with latent diffusion mod- els. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022 , pages 106...

    2022

  28. [36]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, CVPR 2023, Vancouver, BC, Ca...

    2023

  29. [37]

    Cluster quality analysis using silhouette score

    Ketan Rajshekhar Shahapure and Charles Nicholas. Cluster quality analysis using silhouette score. In 2020 IEEE 7th international conference on data sci- ence and advanced analytics (DSAA), pages 747–748. IEEE, 2020. 15

    2020

  30. [38]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Sym- posium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017 , pages 3–18. IEEE Com- puter Society, 2017. 1, 3

    2017

  31. [39]

    Unrolling sgd: Understand- ing factors influencing machine unlearning

    Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling sgd: Understand- ing factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Pri- vacy (EuroS&P), pages 303–319. IEEE, 2022. 6, 7, 13, 14

    2022

  32. [40]

    Data-free model extraction

    Jean-Baptiste Truong, Pratyush Maini, Robert J Walls, and Nicolas Papernot. Data-free model extraction. In Proceedings of the IEEE/CVF conference on com- puter vision and pattern recognition , pages 4771– 4780, 2021. 4, 18

    2021

  33. [41]

    Visu- alizing data using t-sne

    Laurens Van der Maaten and Geoffrey Hinton. Visu- alizing data using t-sne. Journal of machine learning research, 9(11), 2008. 7

    2008

  34. [42]

    Anti- dreambooth: Protecting users from personalized text- to-image synthesis

    Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti- dreambooth: Protecting users from personalized text- to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 2116–2127, 2023. 7, 16

    2023

  35. [43]

    Precise, fast, and low-cost concept erasure in value space: Or- thogonal complement matters

    Yuan Wang, Ouxiang Li, Tingting Mu, Yanbin Hao, Kuien Liu, Xiang Wang, and Xiangnan He. Precise, fast, and low-cost concept erasure in value space: Or- thogonal complement matters. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 28759–28768, 2025. 5

    2025

  36. [44]

    Machine unlearning of features and labels

    Alexander Warnecke, Lukas Pirch, Christian Wress- negger, and Konrad Rieck. Machine unlearning of features and labels. In 30th Annual Network and Dis- tributed System Security Symposium, NDSS 2023, San Diego, California, USA, February 27 - March 3, 2023. The Internet Society, ...

    2023

  37. [45]

    Mexmi: Pool-based active model extraction crossover membership infer- ence

    Yaxin Xiao, Qingqing Ye, Haibo Hu, Huadi Zheng, Chengfang Fang, and Jie Shi. Mexmi: Pool-based active model extraction crossover membership infer- ence. In Advances in Neural Information Processing Systems, 2022. 1

    2022

  38. [46]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe im- ages

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Si- jia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe im- ages... for now. In European Conference on Computer Vision, pages 385–403...

    2024

  39. [47]

    unlearning-by-disobedience

    Kairan Zhao, Meghdad Kurmanji, George-Octavian Barbulescu, Eleni Triantafillou, and Peter Triantafil- lou. What makes unlearning hard and what to do about it. In Amir Globersons, Lester Mackey, Danielle Belgrave, Angela Fan, Ulrich Paquet, Jakub M. Tom- czak, and Cheng Zhang, ...

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.