Pith. sign in

REVIEW 3 major objections 4 minor 4 references

Certified unlearning can keep its formal guarantee and its accuracy by injecting noise into one orthogonal weight block at a time.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 11:46 UTC pith:3VW6GPYH

load-bearing objection Useful empirical trick and a real proof adaptation, but the certificate is conditional on an unmeasured Δ(ρ) and Theorem 2 omits the failure probability — the practical guarantee is weaker than the abstract claims. the 3 major comments →

arxiv 2601.05134 v2 pith:3VW6GPYH submitted 2026-01-08 cs.LG

Sequential Subspace Noise Injection Prevents Accuracy Collapse in Certified Unlearning

Polina Dolgova , Sebastian U. Stich This is my paper
classification cs.LG
keywords certified unlearningmachine unlearningdifferential privacynoisy fine-tuningorthogonal subspacesRényi differential privacymembership inference attackaccuracy preservation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Certified machine unlearning normally pays for its guarantee with destroyed accuracy: the calibrated Gaussian noise added while fine-tuning on retained data drowns the gradient in large networks. This paper claims that the same (ε,δ) guarantee survives if the weight space is split into k orthogonal subspaces and the noise budget is spent sequentially on one block at a time. Each step then perturbs only a 1/k fraction of coordinates, so the model does not take a single full-dimensional noise hit; the block-wise privacy-loss terms add, leaving the total budget unchanged. The paper also drops worst-case initial clipping in favour of a high-probability bound Δ(ρ) on the distance between the fully trained and the retrained models, which tightens the constants. If the claim is right, regulated forgetting requests can be served with formal guarantees without collapsing accuracy.

Core claim

The central claim is that noisy fine-tuning can be executed block-wise with no loss of certificate. Choose k orthogonal subspaces spanning the weight space; the algorithm runs clipped noisy gradient steps on one block at a time, cycling through all k blocks, then fine-tunes the full model. The proof shows the (ε,δ) unlearning budget is preserved: if the i-th block consumes a Rényi privacy budget ε_i, the total satisfies ε = Σ_i ε_i − (k−1) log(1/δ)/(q−1), so splitting into equal blocks keeps the same overall ε. Because the blocks are orthogonal, independent Gaussian noise per block is exactly equal in distribution to one isotropic Gaussian on the full vector, while the per-step perturbation

What carries the argument

The load-bearing object is the orthogonal decomposition W = Σ A_i B_i with A = [A1 ... Ak] orthonormal; the unlearning schedule freezes all blocks except the active one and adds Gaussian noise only there. The analytical engine is a block-adapted version of the shifted Rényi divergence and a decomposed Wasserstein distance: each step is compared against a reference run with the same noise coupling, and the divergence increment is charged to the active block. A decomposed Shift Reduction Lemma bounds how much one Gaussian step can increase the divergence when only one block is shifted, which lets the paper sum per-block privacy losses and conclude the standard (ε,δ) guarantee. The same equival

Load-bearing premise

The paper's certificate is conditional on the high-probability bound Δ(ρ) on the distance between the fully trained and retrained models; the paper treats Δ(ρ) as a tunable calibration hyperparameter (Appendix D.2) rather than measuring it, so if the true distance exceeds the chosen value, the stated (ε,δ) guarantee does not actually hold.

What would settle it

Run many random 10% deletions with the same coupled randomness used in the paper, record ∥x̂−x̂′∥ after training, and compare the empirical 95th percentile with Δ(ρ)=0.01; if the measured percentile is much larger than 0.01, then at the claimed noise levels the mechanism is not certified for those deletions, and the accuracy and MIA numbers would be empirical rather than guaranteed.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Over-parameterized models no longer hit the accuracy cliff during unlearning: with k blocks, each noise step disturbs only a 1/k fraction of coordinates, so the model spends less time in the low-accuracy regime.
  • The number of blocks k becomes a utility/privacy knob: the total (ε,δ) budget is unchanged as k grows, while per-step distortion shrinks, at the cost of up to k times as many unlearning steps.
  • Formal certificates can be issued without worst-case assumptions on initialization; conditioning on the actual coupled distance between full and retained training runs yields tighter constants and removes the initial clipping step.
  • On standard image benchmarks, the unlearned model matches retraining on forgetting metrics (UA=100, MIA=100 for random and class-wise deletion) while keeping retain and test accuracy close to retraining.
  • Because the block decomposition is computed once and reused, the approach carries over to different architectures, including transformer backbones, with the same stability gains.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to estimate the full distribution of ∥x̂−x̂′∥ and set Δ(ρ) to its empirical quantile; this would make the certificate self-contained rather than conditional on an unverified choice.
  • Adaptive block selection is the obvious next knob: allocating larger privacy sub-budgets to layers that tolerate noise, or smaller ones to the classification head, could further close the gap to retraining.
  • The sequential-subspace argument is not specific to unlearning: private fine-tuning or differentially private training of deep networks suffers the same noise-dominated updates, so the same budget-splitting could stabilize training there too.
  • The thought experiment implies a broader design principle for unlearning definitions: certificates that are uniform over all initializations cannot simultaneously promise speed and utility; future definitions may need to condition on the actual training distribution.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes block-wise noisy fine-tuning (Sequential Subspace Noise Injection) for certified unlearning. The parameter space is partitioned into k orthogonal subspaces, and noisy fine-tuning is applied sequentially to one block at a time, with the noise variance computed from the NFT analysis of Koloskova et al. after replacing the initial clipping radius C0 by a high-probability initial-discrepancy Δ(ρ)/2. Theorem 2 claims that the same (ε,δ) budget is retained via Rényi DP composition, and Corollary 1 states that equal-size blocks preserve the total budget with k times the step budget. Experiments on MNIST and CIFAR-10 with MLPs, ResNet-18, and ViT-Tiny report substantially improved post-unlearning accuracy and strong MIA robustness compared to NFT and several empirical baselines. The central theoretical claim is conditional on Definition 3, and the proof of Theorem 2 in Appendix F.2 is only a sketch.

Significance. If the certificate were established unconditionally, the paper would make an important practical contribution: it would mitigate the accuracy collapse that has limited DP-based certified unlearning in deep networks while retaining formal guarantees. The empirical study is broad, covering multiple architectures, deletion scenarios, block constructions, and privacy budgets, and the authors release code, which strengthens reproducibility. However, the certificate is conditional on an unmeasured quantity Δ(ρ), and the proof of the main theorem is not fully spelled out. As it stands, the utility results are credible empirical evidence, but the central claim of preserving the same (ε,δ) guarantee is not yet established.

major comments (3)
  1. [§3.2, Definition 3, Theorem 2, Algorithm 1 (Step 5)] The certificate is conditional on the event ∥x̂−x̂′∥≤Δ(ρ), but Theorem 2's formula (6) contains no ρ term and no conversion of the failure event into δ or ε is given. Section 5 sets Δ=0.01 (random 10%) and 0.05 (classwise) by hand, and Appendix D.2 describes Δ as a 'tunable calibration hyperparameter'; the actual coupled distance between the fully trained and retained models is never measured or bounded. Thus the reported (ε,δ) may not apply to the models actually used. The authors should measure or upper-bound the empirical quantile of ∥x̂−x̂′∥ for the exact coupling used in experiments, and then either absorb the failure probability ρ into the stated (ε,δ) guarantee or clearly present the result as a conditional guarantee that is not Definition 1.
  2. [Appendix F.2, Theorem 2 and Corollary 1] The proof of Theorem 2 is only a sketch. The text says that by 'zeroing out the coordinates sequentially' the Rényi increments can be summed, but the induction, the per-block conditioning events, and the interaction with the decomposed Shift Reduction Lemma are not formally spelled out. Corollary 1 additionally relies on the claim that group norms are 'approximately equal' to justify treating C0/√k and C1/√k as per-block clipping bounds, which is a heuristic rather than a proof. Since the same-(ε,δ)-budget claim is the core theoretical contribution, a complete proof with explicit assumptions on block sizes, step counts, and noise schedule is needed.
  3. [§5.2 and Appendix D.2] There is a circularity in the empirical validation: MIA is used both as the auditing metric for successful unlearning and as the heuristic for calibrating Δ(ρ), with Appendix D.2 stating that 'overly small values of Δ(ρ) lead to detectable leakage, while conservative values suppress the signal.' Table 1's MIA=100 is therefore not an independent confirmation of the certificate. The authors should report MIA results for a pre-registered or conservatively chosen Δ, or use a separate auditing procedure that is not part of the calibration loop.
minor comments (4)
  1. [§4.2, Theorem 2] The notation ε_i in Eq. (6) is used before it is defined; the definition 'ε_i := ε_i^{rényi} + log(1/δ)/(q−1)' appears only after the equation. Please define it before the theorem or state it in the theorem.
  2. [Figures 1 and 3] Several figure captions show missing ε and δ labels, e.g., 'CIFAR10: = 5.0, = 1e 05'. Please insert the symbols.
  3. [Remark 4] The text says 'the per-step perturbation is smaller' and the abstract/reader summary describes it as 'k-fold smaller.' Since the per-step noise vector has ℓ2-norm σ√(d/k), the reduction is by a factor of √k, not k. Please correct the wording.
  4. [§3.2, Proposition 1 and Appendix C] Proposition 1 establishes an inequality about NFT started from a random initialization, but the jump to 'retraining from scratch can reach accuracy close to α in T steps' is not a formal implication. The limitations paragraph in Appendix C is helpful; please mark the inference as heuristic in the main text as well.

Circularity Check

1 steps flagged

Core RDP derivation is self-contained; partial circularity in using MIA-calibrated Δ(ρ) as both certificate input and evidence of successful unlearning.

specific steps
  1. fitted input called prediction [Appendix D.2 (Practical estimation and calibration of Δ(ρ)); Section 5 (Hyperparameters); Table 1 / §5.2]
    "In practice, Δ(ρ) can be treated as a tunable calibration hyperparameter. Membership-inference attacks (MIA) can be used as an auditing heuristic to check whether a chosen value leaves any detectable influence from the forget set. Overly small values of Δ(ρ) lead to detectable leakage, while conservative values suppress the signal. Thus, MIA provides a practical sanity check for selecting a safe Δ(ρ) for deployment. ... We set Δ(ρ) = 0.01 for random 10% deletion and Δ(ρ) = 0.05 for classwise deletion. In our auditing experiments (MIA and accuracy on D_f), these values were sufficient to remove"

    The same MIA audit both selects the conditioning parameter Δ(ρ)—which determines the noise schedule and hence the strength of forgetting—and is later reported as the success metric (MIA=100 in Table 1). Because Δ was chosen to be 'sufficient to remove an identifiable signal' using this exact audit, the reported MIA robustness is not an independent prediction; it is a property selected for by calibration. The certified guarantee remains conditional on the unmeasured bound ∥x̂−x̂′∥≤Δ(ρ), so the MIA score is doing the evidential work for a condition it was itself used to tune.

full rationale

The main derivation chain—Theorem 1, the decomposed Shift Reduction Lemma, Theorem 2, and Corollary 1—is not circular: it adapts an external RDP proof (Koloskova et al., 2025) to block-wise updates, and the budget identity ε=Σε_i−(k−1)log(1/δ)/(q−1) is an algebraic summation of per-block Rényi terms. There is no load-bearing self-citation, no imported uniqueness/ansatz, and no renaming of a known result as a new prediction. The one partial circularity is the Δ(ρ) loop: the proximity parameter that sets the noise schedule is described as a tunable calibration hyperparameter and selected using the MIA audit, and the same MIA metric is then reported as evidence of forgetting. This makes the empirical MIA validation selected-for rather than predicted. Separately, the certificate is stated as conditional on the high-probability discrepancy ∥x̂−x̂′∥≤Δ(ρ), which is never measured or bounded for the actual models; that is an evidence/correctness gap rather than a circularity, but it compounds the loop because Δ was not verified independently of the audit. Overall, the central RDP proof retains independent content, so the score is modest.

Axiom & Free-Parameter Ledger

1 free parameters · 3 axioms · 0 invented entities

The central proof is a standard RDP composition over block-wise noisy updates. The one nonstandard, load-bearing input is the proximity condition Δ(ρ): it is the mechanism by which the paper converts a worst-case guarantee into a conditional one, and its value is chosen by hand rather than derived. Everything else (orthogonality, clipping sensitivity) is routine.

free parameters (1)
  • Δ(ρ) (initial discrepancy bound) = 0.01 (random 10%), 0.05 (classwise)
    Set by hand in Section 5; Appendix D.2 calls it a tunable calibration hyperparameter; the certificate (Theorem 2 via Algorithm 1 step 5) is only valid if actual ||xhat−xhat'|| ≤ Δ(ρ), which is never measured.
axioms (3)
  • standard math RDP composition and RDP→(ε,δ) conversion (Mironov 2017; Balle et al. 2020).
    Used in Theorem 2 to sum block Rényi budgets and convert to (ε,δ); not in dispute.
  • standard math Orthogonal block decomposition with A^T A=I_d and coordinate-wise update (Proposition 2).
    Ensures noise per block is independent and the decomposition is unique; straightforward linear algebra.
  • ad hoc to paper Proximity condition: Pr[||xhat−xhat'||≤Δ(ρ)]≥1−ρ (Definition 3), with Δ chosen ad hoc.
    This is the load-bearing unverified premise: the certificate holds only under this event, and the paper's chosen values are not tied to any measurement of the actual training distribution.

pith-pipeline@v1.3.0-alltime-deepseek · 22535 in / 16216 out tokens · 165920 ms · 2026-08-03T11:46:10.400619+00:00 · methodology

0 comments
read the original abstract

Certified unlearning based on differential privacy offers strong guarantees but remains largely impractical: the noisy fine-tuning approaches proposed so far achieve these guarantees but severely reduce model accuracy. We propose sequential noise scheduling, which distributes the noise budget across orthogonal subspaces of the parameter space, rather than injecting it all at once. This simple modification mitigates the destructive effect of noise while preserving the original certification guarantees. We extend the analysis of noisy fine-tuning to the subspace setting, proving that the same $(\varepsilon,\delta)$ privacy budget is retained. Empirical results on image classification benchmarks show that our approach substantially improves accuracy after unlearning while remaining robust to membership inference attacks. These results show that certified unlearning can achieve both rigorous guarantees and practical utility.

Figures

Figures reproduced from arXiv: 2601.05134 by Polina Dolgova, Sebastian U. Stich.

Figure 1
Figure 1. Figure 1: Severe accuracy drop under noisy fine-tuning. On CIFAR-10 with ResNet-18, standard noisy fine-tuning (NFT, Koloskova et al., 2025) test accuracy drops sharply from 98% to below 20% once the unlearning begins, and does not recover even after 1000 subsequent fine-tuning steps. cability of the method. For example, on CIFAR-10 with ResNet-18, NFT shows a significant drop in test accuracy during the unlearning … view at source ↗
Figure 2
Figure 2. Figure 2: Illustration of the intuition behind the negative result for Noisy Fine-Tuning. The illustration shows fully-trained model x0, retrained model x ′ 0 and xinit after model clipping. Unlearning trajectories require T < Tretrain steps. However, we need at least Tretrain steps of unlearning on the xinit to reach good quality (the green region). Therefore, results of unlearning (T steps from xinit) cannot obtai… view at source ↗
Figure 3
Figure 3. Figure 3: Random 10% deletion on MNIST and CIFAR-10. We compare standard Noisy Fine-Tuning (NFT) with Block-wise NFT (k=2,4,10) with the final retrain accuracy shown for reference. Across privacy budgets Block-wise NFT shows smoother, more stable unlearning and better post–fine-tuning recovery; increasing k further reduces early accuracy loss. Procedure. For NFT-based methods, we fix (ε, δ) per plot with δ = 10−5 an… view at source ↗
Figure 4
Figure 4. Figure 4: Block-construction schemes for Block-wise NFT on MNIST at ε ∈ {0.5, 1.0} and δ = 10−5 . Results on CIFAR-10 [PITH_FULL_IMAGE:figures/full_fig_p029_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Block-construction schemes for Block-wise NFT on [PITH_FULL_IMAGE:figures/full_fig_p030_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: MNIST, class-wise forgetting. Evaluating unlearning metrics for NFT and Block-wise NFT across ε ∈ {3.0, 1.0} for unlearning class 5 [PITH_FULL_IMAGE:figures/full_fig_p031_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Random 50% deletion. We compare standard NFT with Block-wise NFT with two blocks, and show the final accuracy of retraining from scratch for reference. Despite the larger forget set, Block-wise NFT maintains greater stability (smaller initial drop, smoother curves) and achieves stronger recovery. G.6 Extended experiments for CIFAR-10 In this section we provide the full per-class unlearning results for CIFA… view at source ↗
Figure 8
Figure 8. Figure 8: ViT-Tiny unlearning on CIFAR-10 with 10% forget set. Test accuracy vs. training steps for different noise budgets. NFT becomes unstable and consistently underperforms full retraining for both ε = 5 and ε = 7. Block-wise NFT significantly stabilizes training and stays much closer to the retrain curve and final retrain accuracy. Hyperparameters. We use the standard ViT-Tiny architecture with classification h… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

4 extracted references · 1 linked inside Pith

  1. [1]

    If the minibatches coincide: δt+1 ≤(1−αγ)δ t

  2. [2]

    Tongliang Liu, G´ abor Lugosi, Gergely Neu, and Dacheng Tao

    URLhttps://openreview.net/forum?id=6H8Md75kAw. Tongliang Liu, G´ abor Lugosi, Gergely Neu, and Dacheng Tao. Algorithmic stability and hypothesis complexity. In Doina Precup and Yee Whye Teh (eds.),Proceedings of the 34th International Conference on Machine Learning, volume 70 ofProceedings of Machine Learning Research, pp. 2159–2167. PMLR, 06–11 Aug 2017....

    Pith/arXiv arXiv 2017

  3. [4]

    vit tiny patch16 224

    If the minibatches differ: δt+1 ≤(1−αγ)δ t + 2αL. Unrolling this recursion yields the explicit bound δT ≤2αL X k∈B (1−αγ) k, whereBis the set of iteration indices for which the minibatches differ. This provides a closed-form upper bound onδ T , and therefore on ∆(ρ) in this regime. Nonsmooth convex losses.Bassily et al. (2020) prove argument stability for...

    2020

  4. [2023]

    14 Yann LeCun, Corinna Cortes, and Christopher JC Burges

    URLhttps://openreview.net/forum?id=OveBaTtUAT. 14 Yann LeCun, Corinna Cortes, and Christopher JC Burges. The mnist database of handwritten digits.http://yann.lecun.com/exdb/mnist, 1998. Yunwen Lei, Rong Jin, and Yiming Ying. Stability and generalization analysis of gradient methods for shallow neural networks. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belg...

    1998