Pith. sign in

REVIEW 4 major objections 4 minor 19 references

Low-influence training samples can be dropped from machine-unlearning requests, cutting compute by about half without measurable harm to privacy.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 18:23 UTC pith:6SAHBDGA

load-bearing objection A useful empirical trick—filter low-influence points before unlearning to cut compute—but the privacy claim rests on MIA and conflates influence with privacy; deserves peer review with requested revisions. the 4 major comments →

arxiv 2512.05254 v2 pith:6SAHBDGA submitted 2025-12-04 cs.LG

When unlearning is free: leveraging low influence points to reduce computational costs

Anat Kleiman , Robert Fisher , Ben Deaner , Udi Wieder This is my paper
classification cs.LG
keywords machine unlearninginfluence functionslow-influence data pointsforget set reductionmembership inference attackscomputational efficiencydata deletionprivacy
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Machine unlearning—removing specific training points from a trained model—is expensive, and standard methods spend equal effort on every forgotten point. The paper's central claim is that many points have negligible influence on the model's outputs and can be dropped from both the forget set and the retain set before unlearning runs. Using influence scores to find these points, the authors report that removing up to 60% of the forget set leaves membership-inference-attack accuracy statistically unchanged while cutting execution time by up to about 50% on image and question-answering tasks. The load-bearing idea is that influence captures privacy risk: a point the model never relied on does not need to be unlearned. If that holds, unlearning can become much cheaper without weakening the guarantees users expect.

Core claim

The paper establishes that low-influence training points can be dropped from the forget and retain sets before unlearning, with no measurable loss of privacy or accuracy. Influence is the change in prediction accuracy from removing a point; self-influence measures a point's effect on its own output. Three approximations (Hessian-based influence, LESS gradient similarity, and a low-gradient heuristic) identify such points, and models retrained without them still classify them well. The paper's pre-filter scores all points, removes the bottom x% from both sets, and runs unlearning only on the high-influence remainder. On three top-ranked competition algorithms this keeps forget/retain accuracy

What carries the argument

The central object is the approximate influence function: the derivative of average test loss with respect to reweighting one training point, computed as -J_j' H^{-1} \tilde J (gradient of the point, inverse Hessian of training loss, average test gradient). Two scoring modes are used—test influence and self-influence—plus a cheapest heuristic, Lowest Gradients, which flags points whose gradient norm stays near zero during training. The carrying mechanism is the pre-unlearning filter that removes a bottom-x% of scored points from both forget and retain sets, so the unlearning algorithm touches only high-impact data. Theorem 3.2 gives the license: when the forget set is a small fraction of tra

Load-bearing premise

The load-bearing assumption is that a point's privacy risk is fully captured by its influence on model predictions—points that do not change model outputs are safe to leave in, with membership-inference accuracy as the witness that this carries over.

What would settle it

Run the reduced-set unlearning pipeline on a forget set whose excluded points are low-influence by score but individually unique, then mount a direct extraction or membership attack; if the reduced unlearned model leaks the excluded points at a rate measurably above a fully retrained model, the carry-over privacy claim collapses. A simpler check: remove 60% of the lowest-influence points and see whether forget-set accuracy rises above the original unlearned model by more than one standard error.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If correct, unlearning cost scales with the number of high-impact points rather than the raw size of the forget and retain sets.
  • Influence scores can be computed once after training and reused across many unlearning requests, since the low-influence set overlaps strongly across methods.
  • Savings are largest on redundant datasets with many easily learned examples and smaller on datasets where every point is individually impactful.
  • The cheapest estimator—lowest gradient norms—delivers most of the benefit when training checkpoints are available, making the shortcut accessible without expensive post-hoc computations.
  • The theoretical error bound means the approach is safest for small forget sets, precisely where approximation error is tiny relative to true influence.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because the paper's own appendix notes that low individual influence does not guarantee low collective influence, the shortcut is safest when forget sets contain few near-duplicates; scaling it would require group-influence checks.
  • The privacy claim is witnessed only by membership-inference accuracy, not by a formal privacy definition; a regulator who requires no trace of the data would still need full unlearning of low-influence points.
  • Influence rankings are tied to one training run; after retraining with different order or hyperparameters, a previously low-influence point could become high-influence, so scores would need recomputation.
  • A natural testable extension is pairing the filter with differentially private training, since DP already suppresses individual contributions; the two mechanisms might compound or reduce needed noise, but the paper does not explore this.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes an unlearning framework that identifies low-influence training points via influence-function approximations and removes them from the forget and retain sets before running an approximate unlearning algorithm. The authors claim that this reduces unlearning execution time by up to roughly 50% while preserving model accuracy and privacy, where privacy is assessed through membership-inference attack (MIA) accuracy. The framework is evaluated by integrating with the top three algorithms from the NeurIPS'23 unlearning competition on CIFAR-10 and CIFAR-100, with additional influence-method comparisons on SQuAD.

Significance. If the central claim holds, the paper offers a practical, algorithm-agnostic way to reduce the cost of machine unlearning—a topic of growing regulatory and practical importance. The empirical work is extensive, including comparisons of several influence estimators, retraining-based accuracy checks, and integration with competition-grade unlearning algorithms. The paper also ships reproducible details (hyperparameters, links to starter kits) and explicitly discusses the computational costs of the influence methods. However, the privacy claim is the load-bearing part of the paper, and it rests on a heuristic validation (MIA) rather than a formal guarantee or a comparison with the true retrained model. The theoretical result that motivates the influence approximation has a denominator inconsistency in the proof, and the regimes in which the experiments operate are far outside the small-|S|/n_train condition of that theorem. These issues must be addressed before the central claim can be considered established.

major comments (4)
  1. [Section 3.3 and Appendix C] Theorem 3.2 states that the approximation error is O((|S|/n_train)^2), but the proof in Appendix C uses 1/n_test sums over S_test in the first-order conditions and derives a bound of O((|S|/n_test)^2). Assumption 1 bounds Hessian/Jacobian averages over n_train, not n_test. This mismatch makes the stated theorem unsupported as written. Please correct the denominators and reconcile the two rates, and ensure the proof uses the same normalization as the theorem statement. The reference to 'Theorem 1' in Theorem 3.2 should also be 'Theorem 3.1'.
  2. [Section 5.2.2] The central privacy claim—that removing low-influence points from the forget set 'does not compromise privacy guarantees'—is validated only through MIA accuracy on CIFAR-10 for the Rank 1 and Rank 2 algorithms. MIA accuracy near 0.5 can also arise if the attack is weak or the model is not distinguishable in the tested sense; it does not establish statistical indistinguishability from A(D\S). The paper never compares the unlearned model with an actual retrained model A(D\S) or a formal privacy criterion. The conclusion in Section 5.2.1 that the original unlearning method's privacy guarantee 'carries over' is therefore an inference, not a demonstrated result. Please add a gold-standard baseline or a formal privacy argument, or clearly reframe the claim as an empirical, attack-specific observation.
  3. [Sections 3.3 and 5.1] The theoretical guarantee in Theorem 3.2 requires |S|/n_train to be sufficiently small. The framework, however, removes up to 60% of the forget set (Table 1) and up to 50% of the retain set (Figure 5.1, right panel), which can correspond to a large fraction of the training data. Moreover, Appendix E admits that 'low individual influence does not guarantee that a group of such points will have low collective influence.' The theory therefore does not cover the operational regime of the proposed method. Either extend the analysis to sets of removed points or explicitly restrict the claimed scope to the empirically tested regime.
  4. [Section 5.2 and Section 4.2] The reported 'up to ~50%' reduction in execution time measures only the unlearning phase, not the end-to-end cost of the framework. The influence-score computation (e.g., Hessian approximations) can be substantial, as Section 4.2 acknowledges. Since the title and abstract frame the savings as effectively free, the paper should state clearly whether the savings are amortized over many unlearning requests and include a representative end-to-end comparison or a sensitivity analysis with respect to influence-computation cost.
minor comments (4)
  1. [References] References are duplicated: Xia et al. 2024a and 2024b cite the same paper, and Koh & Liang 2017 and 2020 also appear to be the same work. Please consolidate these entries.
  2. [Figure 4.1 and Section 4.1] The Figure 4.1 caption says all methods remove up to ~2,000 points with minimal accuracy loss, while the text in Section 4.1 states that LESS with self-influence removes approximately 5,000 CIFAR-10 points and 8,000 SQuAD points with negligible degradation. These numbers should be reconciled.
  3. [Section 3.4] The Lowest Gradients method is described as 'a heuristic based on low gradient norms' but also as measuring 'the extent to which the predicted soft logits on input x are unchanged.' Please clarify the exact criterion used, since these two descriptions seem to refer to different quantities.
  4. [Section 5.2.2] The MIA experiments are reported only for CIFAR-10 and for two of the three algorithms. For completeness, either report MIA results for CIFAR-100 and the Rank 3 algorithm or explicitly state why they are omitted.

Circularity Check

0 steps flagged

No significant circularity: influence-based filtering is empirically evaluated against retraining and MIA, and theoretical support is imported from independent external work.

full rationale

The paper's central chain is: define influence via prediction differences (Eqs. 1.1-1.2), argue heuristically that low-influence points need not be unlearned (Section 3.1), support the tractability of approximate influence using an external result from Broderick et al. (2023) and Giordano et al. (2020), then empirically measure whether removing low-influence points preserves accuracy, execution time, and MIA resistance (Sections 4-5). None of these steps reduces to its own input by construction. The hypothesis that low-influence points are safe to leave in the model is stated as a hypothesis and tested by retraining without those points and by membership-inference attacks; it is not derived solely from the definition of influence. The approximate-influence theorem (Theorem 3.2) is adopted from independent, non-overlapping authors, and a proof is included. The unlearning framework's pruning step is not a fitted parameter that is then renamed as a prediction: the bottom-x percentages are evaluation conditions, and MIA accuracy is measured, not constructed from influence scores. There are no self-citations by the current authors, and the prior-work citations are independent support. The paper even includes a caveat in Appendix E that low individual influence does not guarantee low group influence, which weakens the method but is not circular. One could question whether MIA is a sufficient privacy test or whether the Appendix C proof's use of n_test vs. the theorem's n_train is correct, but these are correctness/validity concerns, not circularity. Therefore the derivation is self-contained in the sense relevant to this pass.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 0 invented entities

The central contribution is algorithmic/empirical rather than a closed derivation. The main unstated inputs are the privacy proxy assumption and the convexity/smoothness assumptions carried over from prior influence-function theory. No invented entities.

free parameters (3)
  • bottom-x% removal threshold = 20%, 40%, 60% (forget); 1%, 4%, 7% (retain, CIFAR-100)
    The framework's hyperparameter x determines how many low-influence points are skipped; experiments sweep several values rather than fitting a single optimum.
  • Checkpoint 5 for Lowest Gradients = Checkpoint 5 of 12
    Selected empirically from the distribution of low-gradient points during training (Section G); affects which points are flagged as low-impact.
  • Number of test points for test influence = ~100
    Appendix B.3 uses average influence over about 100 test points; the choice is a computational accuracy/compute trade-off and affects rankings.
axioms (3)
  • domain assumption The training loss is strictly convex and twice differentiable with unique minimizers (Assumption 1.i-iii, Theorem 3.1).
    Used to derive the closed-form approximate influence and the O((|S|/n)^2) error bound; not satisfied by deep neural network training, as the paper acknowledges in Section 3.2.
  • domain assumption Low influence on model predictions implies low privacy risk, so such points need not be removed.
    Central to the claim that privacy is preserved when low-influence points are left in the model; only tested via MIA accuracy, not extraction or formal privacy.
  • domain assumption MIA accuracy on the forget set is a sufficient proxy for unlearning quality/privacy.
    Used in Section 5.2.2 to conclude privacy guarantees carry over; a single heuristic attack cannot certify privacy.

pith-pipeline@v1.3.0-alltime-deepseek · 19894 in / 11499 out tokens · 114350 ms · 2026-08-03T18:23:58.960077+00:00 · methodology

0 comments
read the original abstract

As concerns around data privacy in machine learning grow, the ability to unlearn, or remove, specific data points from trained models becomes increasingly important. While state of the art unlearning methods have emerged in response, they typically treat all points in the forget set equally. In this work, we challenge this approach by asking whether points that have a negligible impact on the model's learning need to be removed. Through a comparative analysis of influence functions across language and vision tasks, we identify subsets of training data with negligible impact on model outputs. Leveraging this insight, we propose an efficient unlearning framework that reduces the size of datasets before unlearning leading to significant computational savings (up to approximately 50 percent) on real world empirical examples.

Figures

Figures reproduced from arXiv: 2512.05254 by Anat Kleiman, Ben Deaner, Robert Fisher, Udi Wieder.

Figure 4.1
Figure 4.1. Figure 4.1: The model is retrained on all but the n lowest influence points (x-axis) from image datasets [PITH_FULL_IMAGE:figures/full_fig_p008_4_1.png] view at source ↗
Figure 4.2
Figure 4.2. Figure 4.2: Using a setup similar to Figure 4.1, the model is now retrained on all but the n lowest influence [PITH_FULL_IMAGE:figures/full_fig_p009_4_2.png] view at source ↗
Figure 5.1
Figure 5.1. Figure 5.1: Proportions of low influence points are removed from the CIFAR-10 forget ( [PITH_FULL_IMAGE:figures/full_fig_p012_5_1.png] view at source ↗
Figure 5.2
Figure 5.2. Figure 5.2: Proportions of low influence points are removed from the CIFAR-100 forget and retain sets before [PITH_FULL_IMAGE:figures/full_fig_p012_5_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

19 extracted references · 14 linked inside Pith

  1. [1]

    Deep learning with differential privacy

    MartinAbadi, AndyChu, IanGoodfellow, H.BrendanMcMahan, IlyaMironov, KunalTalwar, andLiZhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS’16. ACM, October

    2016

  2. [8]

    Ryan Giordano, Will Stephenson, Runjing Liu, Michael I

    URLhttps://arxiv.org/abs/2008.03703. Ryan Giordano, Will Stephenson, Runjing Liu, Michael I. Jordan, and Tamara Broderick. A swiss army infinitesimal jackknife,

    Pith/arXiv arXiv 2008

  3. [9]

    URLhttps://arxiv.org/abs/1806.00550. 13 Roger Grosse, Juhan Bae, Cem Anil, Nelson Elhage, Alex Tamkin, Amirhossein Tajdini, Benoit Steiner, Dustin Li, Esin Durmus, Ethan Perez, Evan Hubinger, Kamil˙ e Lukoši¯ ut˙ e, Karina Nguyen, Nicholas Joseph, Sam McCandlish, Jared Kaplan, and Samuel R. Bowman. Studying large language model generalization with influen...

    Pith/arXiv arXiv

  4. [10]

    URLhttps://arxiv.org/abs/2308.03296. Frank R. Hampel. The influence curve and its role in robust estimation.Journal of the American Statistical Association, 69(346):383–393,

    Pith/arXiv arXiv

  5. [12]

    Alex Krizhevsky, Geoffrey Hinton, et al

    URL https://arxiv.org/abs/1703.04730. Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images

    Pith/arXiv arXiv

  6. [14]

    P Rajpurkar

    URLhttps://arxiv.org/abs/2002.08484. P Rajpurkar. Squad: 100,000+ questions for machine comprehension of text.arXiv preprint arXiv:1606.05250,

    Pith/arXiv arXiv 2002

  7. [17]

    URLhttps://doi.org/10

    doi: 10.48550/ARXIV.2307.03941. URLhttps://doi.org/10. 48550/arXiv.2307.03941. Shifeng Zhang, Ajian Liu, Jun Wan, Yanyan Liang, Guogong Guo, Sergio Escalera, Hugo Jair Escalante, and Stan Z. Li. Casia-surf: A large-scale multi-modal benchmark for face anti-spoofing,

    Pith/arXiv arXiv doi:10.48550/arxiv.2307.03941

  8. [18]

    URL https://arxiv.org/abs/1908.10654. 14 A Appendix B Cosine similarity of nearest neighbors B.1 Description We explore using cosine similarity of nearest neighbors to find minimal impact points by making the following assumption: training points with existing similar points in the training data, are more likely to have lower impact on learning, because t...

    Pith/arXiv arXiv 1908

  9. [128]

    epochs" and the learning rate of

    For the purposes of the Lowest Gradients influence estimation, as described in Section 3, we identify datapoints that achieve a lowL2norm after checkpoint 5 (out of 12), and remain low for the duration of training. In this instance, we treat all datapoints in the lowest 5% of the training set as low influence. For all datasets, we use the standardly presc...

    2024

  10. [1974]

    URLhttps: //www.tandfonline.com/doi/abs/10.1080/01621459.1974.10482962

    doi: 10.1080/01621459.1974.10482962. URLhttps: //www.tandfonline.com/doi/abs/10.1080/01621459.1974.10482962. Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778,

    arXiv 1974

  11. [2014]

    doi: 10.1561/0400000042

    ISSN 1551-305X. doi: 10.1561/0400000042. URLhttps: //doi.org/10.1561/0400000042. Vitaly Feldman. Does learning require memorization? a short tale about a long tail,

    doi:10.1561/0400000042

  12. [2015]

    Jacob Devlin

    doi: 10.1109/SP.2015.35. Jacob Devlin. Bert: Pre-training of deep bidirectional transformers for language understanding.arXiv preprint arXiv:1810.04805,

    Pith/arXiv arXiv 2015

  13. [2016]

    URLhttp: //dx.doi.org/10.1145/2976749.2978318

    doi: 10.1145/2976749.2978318. URLhttp: //dx.doi.org/10.1145/2976749.2978318. Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101 – mining discriminative components with random forests. InEuropean Conference on Computer Vision,

    arXiv

  14. [2017]

    URLhttps://arxiv.org/abs/1610.05820. Eleni Triantafillou, Peter Kairouz, Fabian Pedregosa, Jamie Hayes, Meghdad Kurmanji, Kairan Zhao, Vin- cent Dumoulin, Julio Jacques Junior, Ioannis Mitliagkas, Jun Wan, Lisheng Sun Hosoya, Sergio Escalera, GintareKarolinaDziugaite, PeterTriantafillou, andIsabelleGuyon. Arewemakingprogressinunlearning? findings from the...

    Pith/arXiv arXiv

  15. [2020]

    Tamara Broderick, Ryan Giordano, and Rachael Meager

    URLhttps://arxiv.org/ abs/1912.03817. Tamara Broderick, Ryan Giordano, and Rachael Meager. An automatic finite-sample robustness metric: When can dropping a little data make a big difference?,

    Pith/arXiv arXiv 1912

  16. [2021]

    Vitaly Feldman and Chiyuan Zhang

    URLhttps: //arxiv.org/abs/1906.05271. Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation,

    Pith/arXiv arXiv 1906

  17. [2023]

    Yinzhi Cao and Junfeng Yang

    URLhttps://arxiv.org/abs/2011.14999. Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In2015 IEEE Symposium on Security and Privacy, pp. 463–480,

    Pith/arXiv arXiv 2011

  18. [2024]

    Mengzhou Xia, Sadhika Malladi, Suchin Gururangan, Sanjeev Arora, and Danqi Chen

    URLhttps://arxiv.org/abs/2406.09073. Mengzhou Xia, Sadhika Malladi, Suchin Gururangan, Sanjeev Arora, and Danqi Chen. Less: Selecting influential data for targeted instruction tuning.arXiv preprint arXiv:2402.04333, 2024a. Mengzhou Xia, Sadhika Malladi, Suchin Gururangan, Sanjeev Arora, and Danqi Chen. Less: Selecting influential data for targeted instruc...

    Pith/arXiv arXiv

  19. [2025]

    Ken Ziyu Liu

    URLhttps://arxiv.org/abs/2501.16614. Ken Ziyu Liu. Machine unlearning in 2024, May

    Pith/arXiv arXiv 2024