Pith. sign in

REVIEW 3 major objections 4 minor 94 references

Machine unlearning can be steered from the data side: invisible watermarks, optimized through bi-level optimization, make specified examples easier to erase without changing the model's training objective.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Water4MU tunes an invisible watermark on data so that machine unlearning algorithms can remove requested images more effectively, beating prior methods on 'challenging forgets'.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Genuinely new data-level steering idea for machine unlearning, but the headline 'challenging forgets' gain is partly fitted to the same unlearning method and forget sets used in the BLO objective, so transfer is unverified. the 3 major comments →

arxiv 2508.10065 v1 pith:TO3WWBTC submitted 2025-08-13 cs.CR cs.CV

Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Design

Yuhao Sun , Yihua Zhang , Gaowen Liu , Hongtao Xie , Sijia Liu This is my paper
classification cs.CR cs.CV
keywords machine unlearningdigital watermarkingbi-level optimizationdata-level manipulationimage classificationdiffusion modelsconcept erasurechallenging forgets
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that machine unlearning can be steered from the data side: embedding an invisible watermark into the examples a model is later asked to forget makes those examples cleaner to remove, without altering the model's training loss or architecture. The approach, named WATER4MU, is a bi-level optimization in which an upper-level watermarking network is tuned to minimize a measure of unlearning difficulty on the watermarked forget set, while at the lower level the model trains as usual. The paper first establishes that unlearning algorithms generalize to watermarked data, then shows that optimized watermarks improve forgetting accuracy and retain model utility in both image classification and image generation. In the hardest version of the task — 'challenging forgets' engineered to defeat standard unlearning — WATER4MU is reported to outperform existing unlearning methods. The reason a sympathetic reader should care: if data-level forgettability is real, the right-to-be-forgotten becomes a property that can be engineered into data before the request arrives.

Core claim

The paper's central claim is that the difficulty of unlearning is not fixed by the model-update algorithm alone; it is partly written into the data, and an invisible, message-readable watermark can be optimized to rewrite that difficulty. WATER4MU couples a deep watermark encoder-decoder with a bi-level program: the upper level adjusts the watermark so that, after the unlearning algorithm runs, the watermarked forget set is easy to erase (the unlearning difficulty is low), while the lower level trains or updates the model independently of the watermark. On the paper's evidence, this makes multiple unlearning algorithms remove specified images or concepts more successfully, keeps utility on r

What carries the argument

The load-bearing mechanism is the WATER4MU bi-level optimization loop built on a deep watermark network. In the upper level, a watermarking network generates image perturbations that encode a chosen message and are optimized to minimize unlearning difficulty — measured through the behavior of the unlearned model on the forget set; in the lower level, the model itself is trained or updated without any watermark-related objective. A watermark decoder reads the embedded message back, which is how the forget set is later identified and verified. The bi-level coupling is what lets data-level changes do the steering: the watermark is the adjustable handle, the model training is the fixed environme

Load-bearing premise

The load-bearing premise is that the upper-level objective used to measure 'unlearning difficulty' during watermark design is a faithful stand-in for the final unlearning metrics used to report gains; if the two diverge, the improvement could be an artifact of optimizing the test rather than a genuine gain in forgetting.

What would settle it

Take one forget set and build two watermark versions: one produced by WATER4MU's bi-level objective and one with random perturbations matched for invisibility and decoder accuracy. Run the same set of unlearning algorithms and the same 'challenging forgets' metrics on both; if unlearning success is indistinguishable, the bi-level optimization is not what delivers the reported gains.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If WATER4MU is right, unlearning performance can be improved before any unlearning happens: data owners or curators can watermark data at training time so later erasure requests are easier to satisfy.
  • The same data-level watermarking transfers across multiple unlearning algorithms, meaning the gains are not tied to one weight-update recipe.
  • In image generation, WATER4MU-style watermarking can reduce unwanted outputs, such as nudity, more effectively than unlearning the original unprotected prompts, as measured by detector counts.
  • Challenging-forget scenarios — the cases where standard unlearning fails most — are exactly where the watermarking design pays off most, according to the paper.
  • Watermarking complements rather than replaces model-level unlearning; existing unlearning algorithms can be run unchanged on watermarked data.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If data-side forgettability is real, unlearning could become a planned property of datasets, selected at curation time, rather than a post-hoc repair; the paper does not yet show how to choose watermarks before knowing the requests.
  • Because the watermark is decoder-readable, the same pipeline could double as an audit tool: after unlearning, decoding the watermark from model outputs or gradients could certify whether the data influence is gone, a use the paper does not develop.
  • The bi-level recipe should transfer to other modalities — text, audio, video — as long as a differentiable hidden-embedding operator exists; that extension is not tested here.
  • The challenging-forget improvements hint that watermarks may reshape the geometry of the forget set relative to the model's learned representation; if that mechanism is isolated, watermark design could be targeted at specific failure modes rather than optimized end-to-end.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes WATER4MU, a data-level watermarking framework for machine unlearning (MU). It first observes that standard MU generalizes to watermarked data, then introduces a bi-level optimization (BLO) in which the upper level optimizes a watermarking network to minimize unlearning difficulty (using a specific unlearning method, GA) and the lower level trains the model independently of the watermarking procedure. Experiments on image classification and image generation, including the 'challenging forgets' benchmark, report that WATER4MU improves unlearning effectiveness and outperforms existing methods. The paper includes ablations comparing optimized vs. random watermark messages and qualitative results for concept erasure in diffusion models.

Significance. If the central claim is validated, WATER4MU offers a genuinely new data-level control mechanism for MU that is orthogonal to in-training weight-modification methods. The paper is clearly written, the BLO formulation is principled, and the experiments cover two important domains (classification and generation). The use of the 'challenging forgets' benchmark is appropriate and the ablation with optimized vs. random messages helps isolate the effect of the optimization. However, as argued below, the current evaluation protocol leaves a load-bearing generalization question open: the upper-level objective is optimized on the same unlearning algorithm and the same difficult forget sets used for evaluation, so the reported gains may be partly an artifact of fitting. I do not see an internal inconsistency, but the external validity of the headline claim requires additional evidence.

major comments (3)
  1. [Section 5 (BLO formulation) and Section 6/7 (experiments)] The upper-level objective in WATER4MU minimizes unlearning difficulty on a specific unlearning algorithm (GA, see Fig. A2 caption) and on the same 'challenging forgets' sets that are used to measure the headline results. Appendix Figures A2 and A3 explicitly show that the optimized message improves over a random message, confirming that the watermark is being fitted to the protocol. Without a held-out unlearning algorithm or a disjoint forget set used only for evaluation, the reported outperformance over baselines is consistent with overfitting to one unlearning trajectory and one set of worst-case samples. I would like to see either (a) evaluation under unlearning methods not used in the upper level, (b) evaluation on forget sets constructed independently of the BLO loop, or (c) an explicit measure of how well the optimized watermark transfers across algorithms and forget-set selections
  2. [Section 5.1 (upper-level objective) versus Tables 1-4 (metrics)] The relation between the differentiable 'unlearning difficulty' minimized in the upper level and the metrics reported in the experiments (e.g., forget accuracy, retention, or generation-specific scores) is never stated precisely. If the two coincide, the gain is partly baked in by construction; if they differ, no evidence is presented that the surrogate tracks the evaluation metric. The authors should state the exact form of the upper-level objective in equations, show how it relates to the reported metrics, and ideally report the correlation between the surrogate and the final metrics across runs. At minimum, the paper should clarify whether the upper-level objective is the same as the evaluation metric or a proxy.
  3. [Reproducibility / appendices] The paper does not provide code, hyperparameter details, or random-seed information, and the appendix material is limited to a few figures and a limitations paragraph. Given that the method's contribution is a new optimization procedure, the absence of code or a detailed algorithm listing makes it difficult to verify the experiments or to test the generalization concern above. I would request release of code, exact BLO algorithm (including how gradients propagate through the lower-level unlearning step), and the full hyperparameter settings.
minor comments (4)
  1. [Throughout] The method name appears inconsistently as 'Water4MU' in the abstract and 'WATER4MU' elsewhere; please unify.
  2. [Appendix A.4 (nudity removal)] 'Nudenet' should be formatted as 'NudeNet'; also, please cite the NudeNet model when it is first used.
  3. [Section 6 (challenging forgets)] The paper should describe more concretely how the 'challenging forgets' sets are constructed from [93] and whether those sets are fixed across all experiments or re-computed for each trial; this is important for interpreting the results.
  4. [Appendix D (Limitations)] The limitations paragraph mentions training overhead and scalability, but does not mention the potential overfitting issue discussed above. Please add a sentence acknowledging that the current experiments do not evaluate transfer to unlearning methods or forget sets not seen during watermark optimization.

Circularity Check

1 steps flagged

WATER4MU's upper-level objective is minimized on the same unlearning algorithm and forget sets used for evaluation, so the reported gains over baselines are partly baked into the fitted watermark rather than independently tested.

specific steps
  1. fitted input called prediction [Abstract; Appendix Figures A2 and A3 captions]
    "at the upper level, the watermarking network is optimized to minimize unlearning difficulty, while at the lower level, the model itself is trained independently of watermarking. ... We choose GA as the unlearning method and compare the unlearning performance among MU without WATER4MU, MU with WATER4MU and MU with WATER4MU and optimized watermark message."

    The upper-level BLO optimizes the watermark message specifically to minimize unlearning difficulty, and the reported effectiveness is then measured using the same unlearning method (GA) and, per the paper's 'challenging forgets' framing, the same kind of forget sets. Figure A2 explicitly compares the optimized message against a random message under GA, showing that the optimization improves the metric that it was fitted to reduce. Without evaluation on a held-out unlearning algorithm or disjoint forget sets, the 'prediction' that WATER4MU outperforms existing methods is largely a report of the fitting objective. If the upper-level 'unlearning difficulty' is instead a surrogate for the evaluation metric, the paper supplies no evidence that gains transfer from that surrogate to the metric.

full rationale

The central circular concern is that the watermarking network is explicitly optimized to minimize unlearning difficulty, and the experimental demonstration relies on the same unlearning algorithm (GA) and the same 'challenging forgets' benchmark. This is pattern 2 (fitted input called prediction): the optimized watermark is a fitted quantity, and the reported improvement is measured on the very objective that was minimized. The appendix's comparison between random and optimized messages confirms that the optimization moves the metric, but that movement is expected and does not by itself establish generalization to other unlearning methods or forget sets. The paper does include independent elements: the lower-level model is trained independently of the watermarking objective, utility on unrelated tasks is evaluated, and image-generation experiments provide some external grounding. However, the strongest headline claim—'outperforms existing methods in challenging MU scenarios'—is not separated from the fitting protocol. The 'challenging forgets' benchmark also originates from a same-group citation (Fan, Liu, Hero, Liu), which reinforces the need for independent evaluation but is not in itself the main circular step. Overall, the central claim is partially forced by construction: the improvement is real but is not shown to transfer beyond the exact BLO protocol.

Axiom & Free-Parameter Ledger

2 free parameters · 3 axioms · 0 invented entities

The central claim rests on two fitted quantities (watermark message and watermarking network weights) and on the assumption that the BLO surrogate for unlearning difficulty matches the evaluation metric. No new physical entities are introduced; the watermarking network is a learned method component, not a postulated entity.

free parameters (2)
  • watermark message = optimized (exact value not reported in provided text)
    A learned vector added to data; Appendix Figure A2 compares optimized message vs random message, showing it is fitted to improve unlearning.
  • watermarking network weights = trained during BLO upper level
    The watermarking network is optimized to minimize unlearning difficulty, so its parameters are fitted to the unlearning objective.
axioms (3)
  • standard math Implicit function theorem and differentiable bi-level optimization are applicable to the WATER4MU formulation.
    The paper cites the implicit function theorem (ref [91]) to justify computing higher-order derivatives for the BLO update.
  • domain assumption Unlearning difficulty can be represented by a differentiable surrogate loss on watermarked forget data.
    The upper-level objective minimizes unlearning difficulty; if this surrogate does not track true forgetting, optimizing it would not produce the claimed gains.
  • domain assumption Machine unlearning methods trained on watermarked data generalize to original (unwatermarked) data.
    The abstract states the authors 'find that MU effectively generalizes to watermarked data'; this generalization is a premise for using watermarked data as the unlearning vehicle.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Design." pith.science (2026). https://pith.science/paper/TO3WWBTC

@misc{pith2026250810065,
  author       = {Pith},
  title        = {Pith review of: Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Design},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TO3WWBTC}},
  note         = {Machine review of arXiv:2508.10065}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

With the increasing demand for the right to be forgotten, machine unlearning (MU) has emerged as a vital tool for enhancing trust and regulatory compliance by enabling the removal of sensitive data influences from machine learning (ML) models. However, most MU algorithms primarily rely on in-training methods to adjust model weights, with limited exploration of the benefits that data-level adjustments could bring to the unlearning process. To address this gap, we propose a novel approach that leverages digital watermarking to facilitate MU by strategically modifying data content. By integrating watermarking, we establish a controlled unlearning mechanism that enables precise removal of specified data while maintaining model utility for unrelated tasks. We first examine the impact of watermarked data on MU, finding that MU effectively generalizes to watermarked data. Building on this, we introduce an unlearning-friendly watermarking framework, termed Water4MU, to enhance unlearning effectiveness. The core of Water4MU is a bi-level optimization (BLO) framework: at the upper level, the watermarking network is optimized to minimize unlearning difficulty, while at the lower level, the model itself is trained independently of watermarking. Experimental results demonstrate that Water4MU is effective in MU across both image classification and image generation tasks. Notably, it outperforms existing methods in challenging MU scenarios, known as "challenging forgets".

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

94 extracted references · 50 canonical work pages · 4 internal anchors

  1. [1]

    Machine unlearning

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pages 141–159. IEEE, 2021. 1

    2021

  2. [2]

    A survey of machine unlearning

    Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. A survey of machine unlearning. arXiv preprint arXiv:2209.02299, 2022

    Pith/arXiv arXiv 2022

  3. [3]

    Are we making progress in unlearning? findings from the first neurips unlearning competition

    Eleni Triantafillou, Peter Kairouz, Fabian Pedregosa, Jamie Hayes, Meghdad Kurmanji, Kairan Zhao, Vincent Dumoulin, Julio Jacques Junior, Ioannis Mitliagkas, Jun Wan, et al. Are we making progress in unlearning? findings from the first neurips unlearning competition. arXiv preprint arXiv:2406.09073, 2024. 3

    Pith/arXiv arXiv 2024

  4. [4]

    Rethinking ma- chine unlearning for large language models

    Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Xiaojun Xu, Yuguang Yao, Hang Li, Kush R Varshney, et al. Rethinking ma- chine unlearning for large language models. arXiv preprint arXiv:2402.08787, 2024. 1, 5

    Pith/arXiv arXiv 2024

  5. [5]

    The right to delete

    Chris Conley. The right to delete. In 2010 AAAI Spring Symposium Series, 2010. 1

    2010

  6. [6]

    Towards making systems forget with machine unlearning

    Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE Symposium on Security and Privacy, pages 463–480. IEEE, 2015. 2

    2015

  7. [7]

    Ensuring user privacy and model security via machine unlearning: A review

    Yonghao Tang, Zhiping Cai, Qiang Liu, Tongqing Zhou, and Qiang Ni. Ensuring user privacy and model security via machine unlearning: A review. Computers, Materials & Continua, 77(2), 2023

    2023

  8. [8]

    Avoiding copyright infringement via machine unlearning

    Guangyao Dou, Zheyuan Liu, Qing Lyu, Kaize Ding, and Eric Wong. Avoiding copyright infringement via machine unlearning. arXiv preprint arXiv:2406.10952, 2024

    Pith/arXiv arXiv 2024

  9. [9]

    Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models

    Yihua Zhang, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Xiaoming Liu, and Sijia Liu. Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models. NeurIPS, 2024. 1, 2, 6, 8

    2024

  10. [10]

    A data-based perspec- tive on transfer learning

    Saachi Jain, Hadi Salman, Alaa Khaddaj, Eric Wong, Sung Min Park, and Aleksander Madry. A data-based perspec- tive on transfer learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 3613–3622, 2023. 1

    2023

  11. [11]

    Model sparsity can simplify machine unlearning

    Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsity can simplify machine unlearning. Advances in neural information processing systems, 36, 2023. 1, 2, 3, 4, 6, 7

    2023

  12. [12]

    Backdoor defense with machine unlearning

    Yang Liu, Mingyuan Fan, Cen Chen, Ximeng Liu, Zhuo Ma, Li Wang, and Jianfeng Ma. Backdoor defense with machine unlearning. arXiv preprint arXiv:2201.09538, 2022. 1

    Pith/arXiv arXiv 2022

  13. [13]

    Un- learning backdoor attacks in federated learning

    Chen Wu, Sencun Zhu, Prasenjit Mitra, and Wei Wang. Un- learning backdoor attacks in federated learning. In2024 IEEE Conference on Communications and Network Security (CNS), pages 1–9. IEEE, 2024. 1

    2024

  14. [14]

    Towards safer large language models through machine unlearning

    Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. Towards safer large language models through machine unlearning. arXiv preprint arXiv:2402.10058, 2024. 1

    Pith/arXiv arXiv 2024

  15. [15]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. arXiv preprint arXiv:2303.07345, 2023. 2, 6

    Pith/arXiv arXiv 2023

  16. [16]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. NeurIPS, 2024. 1

    2024

  17. [17]

    Machine unlearning: Solutions and challenges

    Jie Xu, Zihan Wu, Cong Wang, and Xiaohua Jia. Machine unlearning: Solutions and challenges. IEEE Transactions on Emerging Topics in Computational Intelligence, 2024. 1

    2024

  18. [18]

    Machine unlearning in generative ai: A survey

    Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. Machine unlearning in generative ai: A survey. arXiv preprint arXiv:2407.20516, 2024. 1

    Pith/arXiv arXiv 2024

  19. [19]

    Approximate data deletion from machine learning models

    Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. Approximate data deletion from machine learning models. In International Conference on Artificial Intelligence and Statistics, pages 2008–2016. PMLR, 2021. 2, 6

    2008

  20. [20]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks

    Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9304– 9312, 2020. 2, 3, 6

    2020

  21. [21]

    Evaluating ma- chine unlearning via epistemic uncertainty

    Alexander Becker and Thomas Liebig. Evaluating ma- chine unlearning via epistemic uncertainty. arXiv preprint arXiv:2208.10836, 2022. 3

    Pith/arXiv arXiv 2022

  22. [22]

    Unrolling sgd: Understanding factors in- fluencing machine unlearning

    Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling sgd: Understanding factors in- fluencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 303–

    2022

  23. [23]

    Machine unlearning of features and labels

    Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and labels. arXiv preprint arXiv:2108.11577, 2021. 2, 3

    Pith/arXiv arXiv 2021

  24. [24]

    Towards unbounded machine unlearning

    Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning. Advances in neural information processing systems, 36, 2024

    2024

  25. [25]

    Salun: Empowering machine unlearning via gradient-based weight saliency in both image classifica- tion and generation

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classifica- tion and generation. arXiv preprint arXiv:2310.12508, 2023. 2

    Pith/arXiv arXiv 2023

  26. [26]

    Digital watermarking and its application in image copyright protection

    Jiang Xuehua. Digital watermarking and its application in image copyright protection. In 2010 International Confer- ence on Intelligent Computation Technology and Automation, volume 2, pages 114–117. IEEE, 2010. 2, 3

    work page 2010

  27. [27]

    Editguard: Versatile image watermarking for tamper localization and copyright protection

    Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11964–11974, 2024

    work page 2024

  28. [28]

    Digital image watermarking using deep learning: A survey

    Khalid M Hosny, Amal Magdi, Osama ElKomy, and Hanaa M Hamza. Digital image watermarking using deep learning: A survey. Computer Science Review, 53:100662, 2024. 2, 3

    work page 2024

  29. [29]

    Combinational image wa- termarking in the spatial and frequency domains

    Frank Y Shih and Scott YT Wu. Combinational image wa- termarking in the spatial and frequency domains. Pattern Recognition, 36(4):969–975, 2003. 2 9

    work page 2003

  30. [30]

    Visual attention-based image watermarking

    Deepayan Bhowmik, Matthew Oakes, and Charith Abha- yaratne. Visual attention-based image watermarking. IEEE Access, 4:8002–8018, 2016

    work page 2016

  31. [31]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pages 657–672, 2018. 2, 3, 6

    work page 2018

  32. [32]

    Distortion agnostic deep watermarking

    Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13548–13557, 2020

    work page 2020

  33. [33]

    Digital image watermarking using deep learning

    Himanshu Kumar Singh and Amit Kumar Singh. Digital image watermarking using deep learning. Multimedia Tools and Applications, 83(1):2979–2994, 2024. 2

    work page 2024

  34. [34]

    A Brief Yet In-Depth Survey of Deep Learning-Based Image Watermarking

    Xin Zhong, Arjon Das, Fahad Alrasheedi, and Abdullah Tan- vir. A brief yet in-depth survey of deep learning-based image watermarking. arXiv preprint arXiv:2308.04603, 2023. 2

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  35. [35]

    Making ai forget you: Data deletion in machine learning

    Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems, 32, 2019. 2

    work page 2019

  36. [36]

    Descent-to-delete: Gradient-based methods for machine un- learning

    Seth Neel, Aaron Roth, and Saeed Sharifi-Malvajerdi. Descent-to-delete: Gradient-based methods for machine un- learning. In Algorithmic Learning Theory, pages 931–962. PMLR, 2021

    work page 2021

  37. [37]

    Remember what you want to for- get: Algorithms for machine unlearning

    Ayush Sekhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. Remember what you want to for- get: Algorithms for machine unlearning. Advances in Neural Information Processing Systems, 34:18075–18086, 2021

    work page 2021

  38. [38]

    Machine unlearning via algorithmic stability

    Enayat Ullah, Tung Mai, Anup Rao, Ryan A Rossi, and Raman Arora. Machine unlearning via algorithmic stability. In Conference on Learning Theory, pages 4126–4142. PMLR,

    work page

  39. [39]

    On the necessity of auditable algorithmic definitions for machine unlearning

    Anvith Thudi, Hengrui Jia, Ilia Shumailov, and Nicolas Pa- pernot. On the necessity of auditable algorithmic definitions for machine unlearning. In 31st USENIX Security Symposium (USENIX Security 22), pages 4007–4022, 2022. 2

    work page 2022

  40. [40]

    Our data, ourselves: Privacy via distributed noise generation

    Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Annual international conference on the theory and applications of cryptographic techniques, pages 486–503. Springer, 2006. 2

    work page 2006

  41. [41]

    Amnesiac machine learning

    Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 11516–11524, 2021. 2

    work page 2021

  42. [42]

    Certified data removal from machine learning models

    Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. arXiv preprint arXiv:1911.03030, 2019. 2

    Pith/arXiv arXiv 1911

  43. [43]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 5111– 5120, 2024. 2, 6

    work page 2024

  44. [44]

    Selective amnesia: A continual learning approach to forgetting in deep generative models, 2023

    Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models, 2023

    2023

  45. [45]

    Ablating concepts in text-to-image diffusion models, 2023

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shecht- man, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models, 2023

    work page 2023

  46. [46]

    Forget-me-not: Learning to forget in text-to- image diffusion models

    Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to- image diffusion models. arXiv preprint arXiv:2303.17591,

    Pith/arXiv arXiv

  47. [47]

    Fast federated machine unlearning with nonlinear functional theory

    Tianshi Che, Yang Zhou, Zijie Zhang, Lingjuan Lyu, Ji Liu, Da Yan, Dejing Dou, and Jun Huan. Fast federated machine unlearning with nonlinear functional theory. 2023. 2

    work page 2023

  48. [48]

    Federated unlearning via class-discriminative pruning

    Junxiao Wang, Song Guo, Xin Xie, and Heng Qi. Federated unlearning via class-discriminative pruning. In Proceedings of the ACM Web Conference 2022, pages 622–632, 2022

    2022

  49. [49]

    Federated unlearning: Guarantee the right of clients to forget

    Leijie Wu, Song Guo, Junxiao Wang, Zicong Hong, Jie Zhang, and Yaohong Ding. Federated unlearning: Guarantee the right of clients to forget. IEEE Network, 36(5):129–135, 2022. 2

    work page 2022

  50. [50]

    Who’s harry potter? approximate unlearning in llms, 2023

    Ronen Eldan and Mark Russinovich. Who’s harry potter? approximate unlearning in llms, 2023. 2

    work page 2023

  51. [51]

    Depn: De- tecting and editing privacy neurons in pretrained language models

    Xinwei Wu, Junzhuo Li, Minghui Xu, Weilong Dong, Shuangzhi Wu, Chao Bian, and Deyi Xiong. Depn: De- tecting and editing privacy neurons in pretrained language models. arXiv preprint arXiv:2310.20138, 2023

    Pith/arXiv arXiv 2023

  52. [52]

    Large language model unlearning

    Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning. arXiv preprint arXiv:2310.10683, 2023

    Pith/arXiv arXiv 2023

  53. [53]

    Unlearning bias in language models by partitioning gradients

    Charles Yu, Sullam Jeoung, Anish Kasi, Pengfei Yu, and Heng Ji. Unlearning bias in language models by partitioning gradients. In Findings of the Association for Computational Linguistics: ACL 2023, pages 6032–6048, 2023. 2

    work page 2023

  54. [54]

    Morgan kaufmann, 2007

    Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker.Digital watermarking and steganog- raphy. Morgan kaufmann, 2007. 2

    work page 2007

  55. [55]

    Informed embedding: exploiting image and detector infor- mation during watermark insertion

    Matthew L Miller, Ingemar J Cox, and Jeffrey A Bloom. Informed embedding: exploiting image and detector infor- mation during watermark insertion. In Proceedings 2000 International Conference on Image Processing (Cat. No. 00CH37101), volume 3, pages 1–4. IEEE, 2000

    work page 2000

  56. [56]

    Attacks on digital wa- termarks: classification, estimation based attacks, and bench- marks

    Sviatoslav V oloshynovskiy, Shelby Pereira, Thierry Pun, Joachim J Eggers, and Jonathan K Su. Attacks on digital wa- termarks: classification, estimation based attacks, and bench- marks. IEEE communications Magazine , 39(8):118–126,

    work page

  57. [57]

    Dct-based watermark recovering without resort- ing to the uncorrupted original image

    Alessandro Piva, Mauro Barni, Franco Bartolini, and Vito Cappellini. Dct-based watermark recovering without resort- ing to the uncorrupted original image. In Proceedings of in- ternational conference on image processing, volume 1, pages 520–523. IEEE, 1997. 2

    work page 1997

  58. [58]

    A dct-domain system for robust image watermark- ing

    Mauro Barni, Franco Bartolini, Vito Cappellini, and Alessan- dro Piva. A dct-domain system for robust image watermark- ing. Signal processing, 66(3):357–372, 1998. 2

    work page 1998

  59. [59]

    A multiresolution watermark for digital images

    Xiang-Gen Xia, Charles G Boncelet, and Gonzalo R Arce. A multiresolution watermark for digital images. In Proceedings of international conference on image processing, volume 1, pages 548–551. IEEE, 1997. 2

    work page 1997

  60. [60]

    An svd-based watermarking scheme for protecting rightful ownership

    Ruizhen Liu and Tieniu Tan. An svd-based watermarking scheme for protecting rightful ownership. IEEE transactions on multimedia, 4(1):121–128, 2002. 2 10

    work page 2002

  61. [61]

    Steganogan: High capacity image steganography with gans

    Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans. arXiv preprint arXiv:1901.03892,

    Pith/arXiv arXiv 1901

  62. [62]

    Are watermarks bugs for deepfake detectors? rethinking proactive forensics

    Xiaoshuai Wu, Xin Liao, Bo Ou, Yuling Liu, and Zheng Qin. Are watermarks bugs for deepfake detectors? rethinking proactive forensics. arXiv preprint arXiv:2404.17867, 2024. 2

    Pith/arXiv arXiv 2024

  63. [63]

    Hide and Seek: How Does Watermarking Impact Face Recognition?

    Yuguang Yao, Steven Grosz, Sijia Liu, and Anil Jain. Hide and seek: How does watermarking impact face recognition? arXiv preprint arXiv:2404.18890, 2024. 2

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  64. [64]

    Exploring visual prompts for adapting large- scale models

    Hyojin Bahng, Ali Jahanian, Swami Sankaranarayanan, and Phillip Isola. Exploring visual prompts for adapting large- scale models. arXiv preprint arXiv:2203.17274, 1(3):4, 2022. 3

    Pith/arXiv arXiv 2022

  65. [65]

    Visual prompt tuning

    Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim. Visual prompt tuning. arXiv preprint arXiv:2203.12119, 2022. 3

    Pith/arXiv arXiv 2022

  66. [66]

    Adversarial reprogramming of neural networks

    Gamaleldin F Elsayed, Ian Goodfellow, and Jascha Sohl- Dickstein. Adversarial reprogramming of neural networks. arXiv preprint arXiv:1806.11146, 2018. 3

    Pith/arXiv arXiv 2018

  67. [67]

    Model reprogramming: Resource- efficient cross-domain machine learning

    Pin-Yu Chen. Model reprogramming: Resource- efficient cross-domain machine learning. arXiv preprint arXiv:2202.10629, 2022

    Pith/arXiv arXiv 2022

  68. [68]

    Adversarial Reprogramming of Text Classification Neural Networks

    Paarth Neekhara, Shehzeen Hussain, Shlomo Dubnov, and Farinaz Koushanfar. Adversarial reprogramming of text clas- sification neural networks. arXiv preprint arXiv:1809.01829, 2018

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  69. [69]

    Cross- modal adversarial reprogramming

    Paarth Neekhara, Shehzeen Hussain, Jinglong Du, Shlomo Dubnov, Farinaz Koushanfar, and Julian McAuley. Cross- modal adversarial reprogramming. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 2427–2435, 2022

    work page 2022

  70. [70]

    Adversarial repro- gramming of pretrained neural networks for fraud detection

    Lingwei Chen, Yujie Fan, and Yanfang Ye. Adversarial repro- gramming of pretrained neural networks for fraud detection. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management, pages 2935–2939,

    work page

  71. [71]

    Fairness reprogramming

    Guanhua Zhang, Yihua Zhang, Yang Zhang, Wenqi Fan, Qing Li, Sijia Liu, and Shiyu Chang. Fairness reprogramming. Ad- vances in Neural Information Processing Systems, 35:34347– 34362, 2022

    work page 2022

  72. [72]

    Visual prompting for adversarial robustness

    Aochuan Chen, Peter Lorenz, Yuguang Yao, Pin-Yu Chen, and Sijia Liu. Visual prompting for adversarial robustness. arXiv preprint arXiv:2210.06284, 2022

    Pith/arXiv arXiv 2022

  73. [73]

    Showmaker: Creating high-fidelity 2d human video via fine-grained diffu- sion modeling

    Quanwei Yang, Jiazhi Guan, Kaisiyuan Wang, Lingyun Yu, Wenqing Chu, Hang Zhou, ZhiQiang Feng, Haocheng Feng, Errui Ding, Jingdong Wang, and Hongtao Xie. Showmaker: Creating high-fidelity 2d human video via fine-grained diffu- sion modeling. In NeurIPS, 2024. 3

    work page 2024

  74. [74]

    From visual prompt learning to zero-shot transfer: Mapping is all you need

    Ziqing Yang, Zeyang Sha, Michael Backes, and Yang Zhang. From visual prompt learning to zero-shot transfer: Mapping is all you need. arXiv preprint arXiv:2303.05266, 2023. 3

    Pith/arXiv arXiv 2023

  75. [75]

    Unleashing the power of visual prompting at the pixel level

    Junyang Wu, Xianhang Li, Chen Wei, Huiyu Wang, Alan Yuille, Yuyin Zhou, and Cihang Xie. Unleashing the power of visual prompting at the pixel level. arXiv preprint arXiv:2212.10556, 2022. 3

    Pith/arXiv arXiv 2022

  76. [76]

    Visual prompting for adversarial robustness

    Aochuan Chen, Peter Lorenz, Yuguang Yao, Pin-Yu Chen, and Sijia Liu. Visual prompting for adversarial robustness. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 1–5. IEEE, 2023. 3

    work page 2023

  77. [77]

    Understanding zero-shot adversarial robust- ness for large-scale models

    Chengzhi Mao, Scott Geng, Junfeng Yang, Xin Wang, and Carl V ondrick. Understanding zero-shot adversarial robust- ness for large-scale models. arXiv preprint arXiv:2212.07016,

    Pith/arXiv arXiv

  78. [78]

    Exploring the benefits of visual prompting in differen- tial privacy

    Yizhe Li, Yu-Lin Tsai, Chia-Mu Yu, Pin-Yu Chen, and Xuebin Ren. Exploring the benefits of visual prompting in differen- tial privacy. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 5158–5167, 2023. 3

    work page 2023

  79. [79]

    Visual Prompting Upgrades Neural Network Sparsification: A Data-Model Perspective

    Can Jin, Tianjin Huang, Yihua Zhang, Mykola Pechenizkiy, Sijia Liu, Shiwei Liu, and Tianlong Chen. Visual prompt- ing upgrades neural network sparsification: A data-model perspective. arXiv preprint arXiv:2312.01397, 2023. 3

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  80. [80]

    When visual prompt tuning meets source-free domain adaptive semantic segmentation

    Xinhong Ma, Yiming Wang, Hao Liu, Tianyu Guo, and Yunhe Wang. When visual prompt tuning meets source-free domain adaptive semantic segmentation. Advances in Neural Infor- mation Processing Systems, 36, 2024. 3

    work page 2024

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.