Pith. sign in

REVIEW 4 major objections 4 minor 35 references

The paper proposes the first source-free unlearning method for linear classifiers that forgets arbitrary instances of any class by estimating the missing retain-set Hessian from the forget set alone, with provable bounds on the unlearned mo

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A Hessian estimation procedure using only the forget set enables instance-level source-free unlearning with claimed theoretical error bounds.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection The Hessian-estimation trick is genuinely new and the experiments are convincing for random forget sets, but the theoretical guarantee does not hold up: the SDP is effectively fitting the forget-set Hessian, and the proof has invalid steps. the 4 major comments →

arxiv 2508.15127 v1 pith:NCM46CE6 submitted 2025-08-20 cs.LG

Towards Source-Free Machine Unlearning

Sk Miraj Ahmed , Umit Yigit Basaran , Dripta S. Raychaudhuri , Arindam Dutta , Rohit Kundu , Fahim Faisal Niloy , Basak Guler , Amit K. Roy-Chowdhury This is my paper
classification cs.LG
keywords machine unlearningsource-free unlearningzero-shot unlearningHessian estimationsemidefinite programmingdata removalparameter indistinguishabilitylinear classifiers
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Machine unlearning asks how to remove the influence of specific training data from a trained model without retraining from scratch. Most existing methods need access to the original training set, which privacy rules and storage costs often make unavailable. This paper claims a method that works in that source-free setting for linear classifiers: given only the trained weights and the data to be forgotten, it estimates the Hessian of the unknown remaining data, the quantity a standard Newton-step unlearning update needs. The estimation is a semidefinite program built from random perturbations of the trained weights and loss differences computed on the forget set; the paper proves the estimate's error is bounded, shrinks with the feature dimension, and yields an unlearned model whose gradient on the retained data is correspondingly bounded. If correct, selective forgetting becomes possible even after the original data has been discarded.

Core claim

The central claim: the Hessian of the unknown retained data — which the unlearning update w_uf = w* + H_r^{-1}∇_f requires but cannot compute once the source data is gone — can be recovered from the forget data alone. Since training converges to a global optimum, the retain-set gradient equals the negative forget-set gradient, so the retained-data loss difference at a small perturbation follows a quadratic form in H_r. The method minimizes, over positive-semidefinite matrices, the squared mismatch between that form and the loss difference measured on the forget set at random perturbations; the minimizer is the retain-Hessian estimate. Lemma 1 bounds the estimation error by 2ε√d/(2+d); Theore

What carries the argument

The engine is the semidefinite program of Eq. (3): minimize the average squared residual (½δw_i^T X δw_i − ∇_f(w*)^T δw_i − δL_f(w_i))² over positive-semidefinite X, using random Gaussian perturbations δw_i, the forget-set gradient ∇_f at the optimum, and the forget-set loss difference δL_f. This substitutes forget-side quantities for the unobservable retain-side loss; Lemma 1 shows the minimizer Ĥ_r lies within 2ε√d/(2+d) of the true retain Hessian H_r in Frobenius norm. The estimate feeds the Newton-style unlearning step w_uf = w* + Ĥ_r^{-1}∇_f + σ²ε, and Theorem 1 bounds the updated model's gradient on the retained data.

Load-bearing premise

The method assumes that at every tiny random nudge of the trained weights, the change in loss on the data to be forgotten is nearly the same as the change in loss on the data that must be kept, with the gap ε small enough to keep the error bounds meaningful; for the quadratic loss used in the experiments this means the forget set's Hessian approximates the unseen retain set's Hessian, which is unproven when the forget set is not a random sample.

What would settle it

Run the method on a linear classifier in a controlled setting where the retained data is still available, and compare the SDP estimate Ĥ_r against the exact retain Hessian H_r computed from the data while making the forget set increasingly atypical (one class only, the hardest examples, or a tight feature cluster). If ||Ĥ_r − H_r||_F exceeds the Lemma 1 bound for the measured ε, or if the retained-data gradient fails to track Theorem 1's prediction, the ε-closeness assumption that carries the guarantees is violated.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Unlearning becomes possible when the original training data has been discarded: only the trained weights and the forget list are needed.
  • Forgetting is instance-wise and class-agnostic — any subset of samples across all classes can be removed, unlike earlier zero-shot methods that only dropped whole classes.
  • The bounds predict when unlearning works best: the retained-data gradient shrinks as the forget fraction shrinks and as the regularization strength or feature dimension grows, which the experiments confirm.
  • The guarantee carries over to deep networks by linearizing the last layers in the mixed-linear (neural-tangent-kernel) style, as demonstrated on CIFAR-10/100, Stanford Dogs, and Caltech-256.
  • Membership-inference scores of forgotten samples approach the 50% chance level, the same as for retrained models, indicating forgotten samples can no longer be distinguished from unseen ones.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the error scale ε is the gap between retain- and forget-set loss differences; for the quadratic loss used in the experiments this is essentially the gap between the two Hessians, so the guarantee is most credible for random forget samples and least credible for concentrated or adversarially chosen forget sets — a stress test the paper does not run.
  • Editorial inference: because the Lemma 1 error falls as 1/(2+d) in the feature dimension, the same estimator should be more accurate on high-dimensional features; combining it with diagonal or factored Hessian approximations could scale the approach to full networks, a direction the paper flags but leaves open.
  • Editorial inference: the proof uses a Gaussian expectation, while the implemented SDP uses m random perturbations, so the effective ε includes Monte-Carlo sampling error; the improvement in performance as m grows is consistent with that view.
  • Editorial inference: a direct test a practitioner could run is to compute the exact retain Hessian while data is still available, measure the actual Hessian gap on real features, and use it to decide which forget requests can be safely honored.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies source-free machine unlearning for ℓ2-regularized linear classifiers. It proposes estimating the retain-set Hessian Hr by solving an SDP (Eq. 3) that matches quadratic loss differences at random perturbations using only the forget set and the trained weights, then uses the estimate in a Newton-style unlearning update. The paper claims a bound on the Hessian estimation error (Lemma 1), a gradient-norm bound on the remaining data after unlearning (Theorem 1), and validates the method on CIFAR-10/100, Stanford Dogs, and Caltech-256 with linear and mixed-linear classifiers. Code is provided in the repository link.

Significance. If the theoretical guarantees were valid, the paper would make a useful contribution to source-free unlearning: it targets arbitrary instances rather than classes, provides an optimization-based Hessian estimator, and includes comparisons to several baselines. The release of code is also a strength. However, the advertised contribution rests on the theoretical bounds, and the core approximation and proof contain load-bearing gaps. The experimental results with random forget subsets are suggestive, but they do not establish the claims for the general arbitrary-instance setting stated in the paper.

major comments (4)
  1. [Section 4, Eq. (3)] The replacement of δLr(wi) by δLf(wi) is not justified. The text argues that both are bounded by L||δw||, but boundedness of each term does not imply that their difference is small. For quadratic loss, δLr(wi) − δLf(wi) includes the term −2∇f(w*)^T δw + (1/2)δw^T(Hr − Hf)δw, which can be large when the forget set is class-structured or otherwise non-i.i.d. In that case the SDP objective is fitted to the forget-set loss differences and its minimizer is approximately Hf, not Hr. The assumption |δLr − δLf| ≤ ε is essentially the closeness that the theorem set out to prove, and no evidence is given that it holds in the advertised arbitrary-instance setting.
  2. [Appendix 8, proof of Lemma 1] The proof contains an invalid interval-squaring step. From |fi(X) − f̃i(X)| ≤ ε, the text concludes (fi(X) − ε)^2 ≤ f̃i(X)^2 ≤ (fi(X) + ε)^2. This is false when fi(X) is negative or near zero; e.g., fi = 0, ε = 1, f̃i = 0.5 gives 1 ≤ 0.25. Consequently, the upper and lower bounds on Ψ̃(X), and hence the derived bound on the minimizer M, do not follow. Lemma 1 is therefore unproved, and Theorem 1 inherits the problem.
  3. [Theorem 1] The denominator λ(n − nf) − 2ε/(2+d) can be negative or zero, in which case the stated bound is undefined or vacuous. No condition is given to ensure positivity. Moreover, the proof uses the estimated Hessian Ĥr in place of the true Hr in the bound quoted from [15]; the update in Eq. (1) uses Ĥr, so the residual gradient on the remaining data includes an additional term involving Hr^{-1} − Ĥr^{-1} that is not tracked. Thus the theorem does not establish the claimed guarantee.
  4. [Section 4 / Section 5.3] The theory in Lemma 1 is derived for the expectation over δw ∼ N(0,I), but the implemented objective in Eq. (3) uses a finite average over m perturbations. No concentration bound or finite-sample error term is provided, so the lemma does not govern the implemented procedure. Section 5.3 empirically varies m, but the theoretical claim remains tied to the expectation version. The perturbation scale used in experiments is also not specified relative to the unit-variance assumption in the proof.
minor comments (4)
  1. [Section 2] Typo: 'allows access to access to all, or a subset of, the training data' should be 'requires access to all, or a subset of, the training data'.
  2. [Table 4] The table formatting is confusing: rows such as 'Unlearned (+) 20% 60.1% 63.4% 59.3% 50.4%' appear to mix a forget-size label (20%, 15%, 10%) with the metric columns, making the table hard to read.
  3. [Section 1 / Contributions] The claim of being 'the first zero-shot unlearning method for linear classifiers that can effectively forget arbitrary instances' should be reconciled with the existence of instance-wise methods such as [3]; the distinction appears to be the theoretical guarantees rather than the instance-wise capability itself.
  4. [Section 3.3] The mixed-linear setup is introduced briefly; the Jacobian notation ∇w f_{w_c}^* is not fully defined, and the reader must infer the linearization point. A precise definition would improve reproducibility.

Circularity Check

2 steps flagged

The SDP objective is built from forget-set loss differences, so its minimizer is the forget Hessian; Lemma 1's guarantee is conditional on the very closeness it claims to establish, and the proof contains an invalid squaring step.

specific steps
  1. fitted input called prediction [Section 4, Eq. (3); paragraph starting 'However, since we do not have access to Dr']
    "However, since we do not have access to Dr, we can not explicitly compute δLr(wi). Instead, we can replace it with next best value which is δLf(wi)."

    The SDP objective replaces the retain-set loss difference δLr with the forget-set δLf. For quadratic loss (used in all linear experiments), δLr ≈ ½δwᵀHrδw + ∇rᵀδw and ∇r = −∇f, while δLf ≈ ½δwᵀHfδw + ∇fᵀδw. Hence the residual becomes ˜fi(X) = ½δwᵀ(X−Hf)δw, so the minimizer of Eq. (3) is Hf, not Hr. Calling the solution Ĥr and presenting it as an estimate of the retain Hessian relabels the forget Hessian; the connection to Hr is not derived but assumed.

  2. self definitional [Lemma 1 and Appendix 8, Eq. (22)-(30)]
    "Since we assume that |δLr(wi) − δLf(wi)| ≤ϵ ∀i, we can derive the following inequality: (fi(X) − ϵ) ≤ ˜fi(X) ≤ (fi(X) + ϵ)"

    The lemma's conclusion, ∥Ĥr−Hr∥F ≤ 2ε√d/(2+d), is obtained solely from the assumption |δLr−δLf|≤ε. For quadratic losses δLr−δLf ≈ ½δwᵀ(Hr−Hf)δw − 2∇fᵀδw, so the assumption is essentially a bound on Hr−Hf. Since the SDP minimizer is Hf (previous step), the 'bound' is a restatement of the input assumption, not an independent guarantee. Moreover, squaring the interval inequality is invalid when fi is negative, so the bound does not follow even conditionally; the claimed strong guarantee reduces to an unverified data-dependent assumption.

full rationale

No load-bearing self-citation issue is present: the method is compared against retrained and exact-Hessian baselines, and the experimental portion is independent evidence. However, the central theoretical claim — that Eq. (3) estimates the retain Hessian Hr from the forget set only — is circular in the sense that the objective is defined from δLf, so its minimizer is the forget Hessian Hf; calling it Ĥr is a relabeling unless Hf≈Hr is assumed. Lemma 1's bound is conditional on exactly that closeness (|δLr−δLf|≤ε), and the proof's interval-squaring step is invalid for negative values, so the bound is not established. Thus the 'strong robust guarantees' advertised in the abstract and contributions reduce to an unvalidated assumption about the input data, rather than a first-principles derivation. The experiments are real and show practical utility, but they do not repair the circular/conditional nature of the theoretical guarantee. Score 6: partial circularity — the central prediction (retain Hessian estimate) reduces by construction to a fit to the forget data.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The method rests on the assumption that loss differences on the forget set can stand in for those on the unknown retain set. This reduces to assuming the two Hessians are close, which is the actual condition for the method to work. Additional free parameters (epsilon, m, perturbation variance) are chosen without principled criteria. No new physical or conceptual entities are introduced.

free parameters (4)
  • epsilon (loss-difference bound) = unknown/assumed
    Assumed |δLr - δLf| ≤ epsilon for all perturbations; appears in Lemma 1 and Theorem 1 bounds but is never estimated or validated. The guarantees are vacuous unless epsilon is known and sufficiently small.
  • m (number of perturbations) = 500 in experiments
    Number of random perturbations used in the SDP objective; larger m improves approximation of the expectation, chosen by hand without sensitivity analysis.
  • perturbation variance = 1 (implicit, δw ~ N(0,I))
    The theory and experiments sample δw from N(0,1), but the argument justifying δLr ≈ δLf requires small perturbations; the variance is never tuned or reported as a hyperparameter.
  • lambda (l2 regularization) = 0 to 0.001 in experiments
    Regularization strength is a problem input but directly appears in Theorem 1's bound; experiments vary it (Table 3) and show it rescues performance.
axioms (4)
  • domain assumption Training converges to the global optimum, so ∇r(w*) = -∇f(w*)
    Used in Section 4 to eliminate the unknown retain gradient from the Hessian estimation objective.
  • domain assumption Loss is convex with gamma-Lipschitz second derivative, gradients bounded by C, and inputs bounded ||x|| <= 1
    Conditions for Theorem 1, inherited from Guo et al. [15]. Not checked in experiments.
  • ad hoc to paper Higher-order Taylor terms of the loss are negligible at the perturbations
    Used throughout Section 4 to write δL ≈ ½δw^T H δw + ∇^T δw, but perturbations are drawn from N(0,1), so δw can be large (||δw|| ~ sqrt(d)); this assumption is not valid in general.
  • standard math Fourth-moment identity for standard Gaussians (Wick formula)
    Used in the proof of Lemma 1 to compute E[(δw^T M δw)^2].

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Source-Free Machine Unlearning." pith.science (2026). https://pith.science/paper/NCM46CE6

@misc{pith2026250815127,
  author       = {Pith},
  title        = {Pith review of: Towards Source-Free Machine Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NCM46CE6}},
  note         = {Machine review of arXiv:2508.15127}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

As machine learning becomes more pervasive and data privacy regulations evolve, the ability to remove private or copyrighted information from trained models is becoming an increasingly critical requirement. Existing unlearning methods often rely on the assumption of having access to the entire training dataset during the forgetting process. However, this assumption may not hold true in practical scenarios where the original training data may not be accessible, i.e., the source-free setting. To address this challenge, we focus on the source-free unlearning scenario, where an unlearning algorithm must be capable of removing specific data from a trained model without requiring access to the original training dataset. Building on recent work, we present a method that can estimate the Hessian of the unknown remaining training data, a crucial component required for efficient unlearning. Leveraging this estimation technique, our method enables efficient zero-shot unlearning while providing robust theoretical guarantees on the unlearning performance, while maintaining performance on the remaining data. Extensive experiments over a wide range of datasets verify the efficacy of our method.

Figures

Figures reproduced from arXiv: 2508.15127 by Amit K. Roy-Chowdhury, Arindam Dutta, Basak Guler, Dripta S. Raychaudhuri, Fahim Faisal Niloy, Rohit Kundu, Sk Miraj Ahmed, Umit Yigit Basaran.

Figure 1
Figure 1. Figure 1: Performance comparison of the proposed methods across different datasets: CIFAR-10, CIFAR-100, StanfordDogs, and Cal [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

35 extracted references · 28 canonical work pages · 1 internal anchor

  1. [1]

    Machine unlearning

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 141–159. IEEE, 2021. 2

    work page 2021

  2. [2]

    Towards making systems for- get with machine unlearning

    Yinzhi Cao and Junfeng Yang. Towards making systems for- get with machine unlearning. In 2015 IEEE symposium on security and privacy, pages 463–480. IEEE, 2015. 2

    work page 2015

  3. [3]

    Learning to unlearn: Instance-wise unlearning for pre-trained classifiers

    Sungmin Cha, Sungjun Cho, Dasol Hwang, Honglak Lee, Taesup Moon, and Moontae Lee. Learning to unlearn: Instance-wise unlearning for pre-trained classifiers. In Pro- ceedings of the AAAI Conference on Artificial Intelligence , pages 11186–11194, 2024. 2, 3, 8

    work page 2024

  4. [4]

    Fast model debias with machine un- learning

    Ruizhe Chen, Jianfei Yang, Huimin Xiong, Jianhong Bai, Tianxiang Hu, Jin Hao, Yang Feng, Joey Tianyi Zhou, Jian Wu, and Zuozhu Liu. Fast model debias with machine un- learning. Advances in Neural Information Processing Sys- tems, 36, 2024. 2

    work page 2024

  5. [5]

    Zero-shot machine unlearning

    Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. Zero-shot machine unlearning. IEEE Transactions on Information Forensics and Security , 2023. 1, 2

    work page 2023

  6. [6]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 6

    2009

  7. [7]

    Safe: Machine unlearning with shard graphs

    Yonatan Dukler, Benjamin Bowman, Alessandro Achille, Aditya Golatkar, Ashwin Swaminathan, and Stefano Soatto. Safe: Machine unlearning with shard graphs. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 17108–17118, 2023. 2

    work page 2023

  8. [8]

    The algorithmic foun- dations of differential privacy

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foun- dations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3–4):211–407, 2014. 2

    work page 2014

  9. [9]

    Zero-shot machine unlearn- ing at scale via lipschitz regularization

    Jack Foster, Kyle Fogarty, Stefan Schoepf, Cengiz ¨Oztireli, and Alexandra Brintrup. Zero-shot machine unlearn- ing at scale via lipschitz regularization. arXiv preprint arXiv:2402.01401, 2024. 3, 8

    Pith/arXiv arXiv 2024

  10. [10]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 2426–2436, 2023. 2

    work page 2023

  11. [11]

    General data protection regulation

    General Data Protection Regulation GDPR. General data protection regulation. URL: https://gdpr-info. eu/[accessed 2020-11-21], 2018. 2

    work page 2020

  12. [12]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks

    Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9304– 9312, 2020. 1, 2, 8

    work page 2020

  13. [13]

    Mixed-privacy for- getting in deep networks

    Aditya Golatkar, Alessandro Achille, Avinash Ravichan- dran, Marzia Polito, and Stefano Soatto. Mixed-privacy for- getting in deep networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 792–801, 2021. 2, 3, 5, 6, 7

    work page 2021

  14. [14]

    Caltech-256 object category dataset

    Gregory Griffin, Alex Holub, and Pietro Perona. Caltech-256 object category dataset. Technical report, California Institute of Technology, 2007. 6

    work page 2007

  15. [15]

    Certified data removal from machine learning models

    Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. In Proceedings of the 37th International Conference on Machine Learning. JMLR.org, 2020. 1, 2, 3, 5, 6

    work page 2020

  16. [16]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 6

    2016

  17. [17]

    Neu- ral tangent kernel: Convergence and generalization in neural networks

    Arthur Jacot, Franck Gabriel, and Cl ´ement Hongler. Neu- ral tangent kernel: Convergence and generalization in neural networks. Advances in neural information processing sys- tems, 31, 2018. 3

    work page 2018

  18. [18]

    Novel dataset for fine-grained image categorization

    Aditya Khosla, Nityananda Jayadevaprakash, Bangpeng Yao, and Li Fei-Fei. Novel dataset for fine-grained image categorization. In First Workshop on Fine-Grained Visual Categorization, IEEE Conference on Computer Vision and Pattern Recognition, Colorado Springs, CO, 2011. 6

    work page 2011

  19. [19]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, Uni- versity of Toronto, Toronto, ON, Canada, 2009. 6

    work page 2009

  20. [20]

    Towards unbounded machine unlearn- ing

    Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearn- ing. Advances in Neural Information Processing Systems , 36, 2024. 1, 6

    work page 2024

  21. [21]

    Machine unlearning for image-to-image generative models

    Guihong Li, Hsiang Hsu, Radu Marculescu, et al. Machine unlearning for image-to-image generative models. arXiv preprint arXiv:2402.00351, 2024. 2

    Pith/arXiv arXiv 2024

  22. [22]

    Enhanced Convolutional Neural Tangent Kernels

    Zhiyuan Li, Ruosong Wang, Dingli Yu, Simon S Du, Wei Hu, Ruslan Salakhutdinov, and Sanjeev Arora. En- hanced convolutional neural tangent kernels. arXiv preprint arXiv:1911.00809, 2019. 3

    work page internal anchor Pith review Pith/arXiv arXiv 1911

  23. [23]

    Do we really need to access the source data? source hypothesis transfer for un- supervised domain adaptation

    Jian Liang, Dapeng Hu, and Jiashi Feng. Do we really need to access the source data? source hypothesis transfer for un- supervised domain adaptation. In International conference on machine learning, pages 6028–6039. PMLR, 2020. 2

    2020

  24. [24]

    The eu proposal for a general data protection regulation and the roots of the ‘right to be for- gotten’

    Alessandro Mantelero. The eu proposal for a general data protection regulation and the roots of the ‘right to be for- gotten’. Computer Law & Security Review , 29(3):229–235,

    work page

  25. [25]

    Descent-to-delete: Gradient-based methods for machine un- learning

    Seth Neel, Aaron Roth, and Saeed Sharifi-Malvajerdi. Descent-to-delete: Gradient-based methods for machine un- learning. In Algorithmic Learning Theory , pages 931–962. PMLR, 2021. 2

    work page 2021

  26. [26]

    Fast yet effective machine unlearning

    Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unlearning. IEEE Transactions on Neural Networks and Learning Sys- tems, 2023. 1

    work page 2023

  27. [27]

    The eu general data protection regulation (gdpr)

    Paul V oigt and Axel V on dem Bussche. The eu general data protection regulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10(3152676):10– 5555, 2017. 1

    work page 2017

  28. [28]

    Machine unlearning of features and la- bels

    Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and la- bels. arXiv preprint arXiv:2108.11577, 2021. 3

    Pith/arXiv arXiv 2021

  29. [29]

    Puma: Performance unchanged model augmentation for training data removal

    Ga Wu, Masoud Hashemi, and Christopher Srinivasa. Puma: Performance unchanged model augmentation for training data removal. In Proceedings of the AAAI conference on ar- tificial intelligence, pages 8675–8682, 2022. 2

    work page 2022

  30. [30]

    Delta- grad: Rapid retraining of machine learning models

    Yinjun Wu, Edgar Dobriban, and Susan Davidson. Delta- grad: Rapid retraining of machine learning models. In In- ternational Conference on Machine Learning, pages 10355– 10366. PMLR, 2020. 2

    work page 2020

  31. [31]

    Large language model unlearning

    Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning. arXiv preprint arXiv:2310.10683, 2023. 2

    Pith/arXiv arXiv 2023

  32. [32]

    Adahessian: An adap- tive second order optimizer for machine learning

    Zhewei Yao, Amir Gholami, Sheng Shen, Mustafa Mustafa, Kurt Keutzer, and Michael Mahoney. Adahessian: An adap- tive second order optimizer for machine learning. In pro- ceedings of the AAAI conference on artificial intelligence , pages 10665–10673, 2021. 5

    work page 2021

  33. [33]

    Learning with re- coverable forgetting

    Jingwen Ye, Yifang Fu, Jie Song, Xingyi Yang, Songhua Liu, Xin Jin, Mingli Song, and Xinchao Wang. Learning with re- coverable forgetting. In European Conference on Computer Vision, pages 87–103. Springer, 2022. 1 Towards Source-Free Machine Unlearning Supplementary Material Supplementary Overview: Contents 8 . Proof for Lemma 1 in more details 2 9 . Addi...

    work page 2022

  34. [34]

    1 2 δw⊤Mδw 2# = 1 4 E[X 2] = 1 4 2trace(M2) + trace(M)2 . (20) Simplify to obtain: E

    Proof for Lemma 1 in more details Proof. From the definition of Ψ(H): Ψ(X) = Eδw∼N (0,I) ( 1 2 δw⊤Xδw + ∇⊤ r δw − δLr)2 (5) By neglecting higher order terms in the taylor approximation we can say,δLr ≈ 1 2 δw⊤Hrδw + ∇⊤ r δw. Substituting δLr from Equation 5: Ψ(X) = Eδw∼N (0,I) ( 1 2 δw⊤Xδw − 1 2 δw⊤Hrδw)2 (6) = Eδw∼N (0,I) ( 1 2 δw⊤(X − Hr)δw)2 (7) = Eδw∼...

    work page

  35. [35]

    Performance Gap

    Additional Experiments We conducted experiments on the CIFAR-10, CIFAR-100, StanfordDogs, and Caltech-256 datasets using our proposed method for both linear classifier and mixed linear network cases. For all experiments, 500 perturbations were applied. The “Performance Gap” row represents the difference in performance between the methods Unlearned (+) and...

    work page

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.