Pith. sign in

REVIEW 3 major objections 5 minor 38 references

This paper shows that machine unlearning and continual learning can run on a resistive-memory compute-in-memory accelerator by updating only small digital low-rank adapter branches, leaving the analog backbone untouched.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Hybrid analog-digital LoRA mapping enables approximate machine unlearning and continual learning on a resistive-memory CIM accelerator with up to ~148x lower training/write overhead.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection Real chip, real co-design, but the machine-unlearning claim rests on t-SNE overlap rather than any direct erasure metric. the 3 major comments →

arxiv 2601.10037 v3 pith:NGMC6C4U submitted 2026-01-15 cs.ET

Parameter Efficient Machine Unlearning on Hybrid Resistive Memory based Compute-in-Memory Accelerators

Ning Lin , Jichang Yang , Yangu He , Zijian Ye , Kwun Hang Wong , Xinyuan Zhang , Songqi Wang , Zihao Li
show 12 more authors
Yuxi Chen Jiajia Zha Wenxing Li Yi Li Kemi Xu Leo Yu Zhang Xiaoming Chen Dashan Shang Chaoliang Tan Han Wang Xiaojuan Qi Zhongrui Wang
This is my paper
classification cs.ET
keywords machine unlearningresistive memorycompute-in-memorylow-rank adaptationcontinual learninganalog-digital co-designedge AIprivacy
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that machine unlearning and continual learning can be run efficiently on resistive-memory compute-in-memory (CIM) hardware by keeping pretrained weights frozen in analog memory and confining all updates to small low-rank (LoRA) adapter branches held in SRAM and executed digitally. The authors report the first experimental demonstration of approximate machine unlearning on a fabricated resistive-memory CIM macro, supported by circuit-accurate simulations for speaker authentication and stylized image generation. In their measurements, the hybrid mapping cuts analog training/update operations by up to about 148x, on-chip write/deployment energy by up to about 388x, and inference energy versus a GPU baseline by up to 59x while holding task accuracy. If correct, the claim matters because it points to a way to make edge accelerators privacy-responsive and continuously adaptive without paying the write-verify cost of repeated analog reprogramming. The authors are explicit that formal unlearning guarantees and large-scale system integration remain open.

Core claim

The paper's central claim is that the expensive part of adapting a resistive-memory neural network, repeatedly reprogramming analog conductances, can be bypassed entirely by a hardware-software co-design. A pretrained backbone is written once into the RM crossbar as conductances; all subsequent machine-unlearning or continual-learning updates happen in a digital compute unit with SRAM, adjusting only the low-rank matrices A and B of LoRA adapters. Approximate unlearning is performed by running gradient ascent or label obfuscation through the adapters, with a retain-set loss to preserve remaining knowledge, and continual learning by replay-based joint training, again only on the adapters. On

What carries the argument

The enabling mechanism is the hybrid analog-digital CIM mapping: frozen pretrained weights are stored as analog conductance values in resistive-memory crossbars, while trainable LoRA branches (low-rank matrices A and B, with rank r much smaller than the layer dimensions) reside in an SRAM-backed digital compute unit. Because the effective weight is W = W0 + BA, adaptation changes only the digital adapter parameters, so deployment never triggers the iterative write-and-verify cycles that make analog reprogramming expensive and noisy. The same small parameter footprint carries the unlearning objectives (gradient-ascent or label-obfuscation losses on the forget set plus a retention loss) and th

Load-bearing premise

The load-bearing premise is that approximate unlearning quality is adequately measured by the reported metrics, embedding-space overlap and classification or generation accuracy, rather than by direct evidence that the forgotten data's influence is gone; if a deleted identity can still be recognized or extracted, the central unlearning claim would fail even though task accuracy remains high.

What would settle it

Run a membership-inference attack or a model-inversion probe on the RM-DLoRA macro after unlearning a specific face or speaker; if the erased identity is still identified at a rate clearly above chance, the paper's claim that LoRA updates enable machine unlearning on resistive-memory CIM is falsified. A simpler check is to measure forget-set accuracy directly: it should drop toward chance for the erased class while retain-set accuracy holds.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A fabricated resistive-memory accelerator can perform approximate machine unlearning and continual learning on-device, moving beyond inference-only operation.
  • Adapting a deployed model costs only the update of small digital adapter matrices, avoiding analog write-verify overhead and cumulative programming noise.
  • Reported efficiency gains are large: up to ~148x fewer training/update operations, up to ~388x lower write energy, and up to ~59x lower inference energy than the compared baselines.
  • The approach extends across face recognition, speaker authentication, and style-based generative unlearning, suggesting broad applicability to privacy-sensitive edge tasks.
  • Formal unlearning guarantees are not provided; the paper positions the result as approximate unlearning with open questions about guarantees and system scaling.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the hybrid mapping generalizes to larger models and arrays, the marginal cost of a data-deletion request becomes proportional to the adapter rank rather than the model size, changing the economics of on-device right-to-be-forgotten compliance.
  • The same LoRA-on-digital mechanism could support other post-deployment parameter edits, such as personalization, domain adaptation, or safety patching on resistive-memory CIM hardware, without altering the core architecture.
  • A natural next experiment is to measure forgetting directly: after unlearning, check that the deleted identity is classified at chance level and resists membership-inference attacks; the paper's t-SNE overlap and accuracy metrics suggest but do not establish this.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a hardware-software co-design for machine unlearning and continual learning on resistive-memory compute-in-memory (RM-CIM) accelerators. Pretrained weights are stored in analog RM arrays, while low-rank adaptation (LoRA) branches are kept in SRAM and updated digitally, avoiding costly analog reprogramming. The authors report results on Olivetti face recognition using a fabricated 180-nm 1T1R macro, and circuit-accurate simulations for speaker authentication (Spiking Speech Commands) and stylized image generation (UnlearnCanvas). Compared with full-parameter analog RM reprogramming, they report large reductions in training/update cost, deployment write energy, and inference energy while preserving task performance.

Significance. If the central claims are established, this is a meaningful step toward practical post-deployment adaptation on RM-CIM hardware: it directly attacks the dominant cost of iterative analog write-verify by keeping the backbone static and confining updates to digital LoRA branches. The paper includes a fabricated chip with device characterization, a cross-task demonstration, and public code, which are positive features. However, the 'machine unlearning' claim currently rests on weak validation, and several headline efficiency numbers are largely arithmetic consequences of LoRA's parameter count and the avoidance of analog reprogramming rather than direct chip measurements. The contribution would be strengthened substantially by rigorous forget-set/privacy metrics and by clearly separating measured from simulated results.

major comments (3)
  1. [Face Recognition (Figs. 3d–3g); Stylized Image Generation (Figs. 5d–5e)] The evidence that the model actually forgets the target identity or style is limited to t-SNE cluster overlap and retain-set accuracy/LPIPS. t-SNE is a nonlinear 2-D projection; overlap in that projection does not imply the erased identity is unrecognizable, and no forget-set accuracy, membership-inference resistance, or other direct privacy metric is reported. For the generative task, the claim that removed styles 'no longer appear' is not quantified by any style classifier or CLIP-based metric; LPIPS only measures perceptual similarity. Please add forget-set accuracy/confidence, MIA AUC, distance-to-retrained-model, or an established approximate-unlearning metric for the discriminative tasks, and a quantitative style-erasure metric for the generative task. Without these, the central 'approximate machine unlearning' claim is not established.
  2. [Abstract; Fig. 2a; Methods (Fabrication of RM Chips)] The abstract states validation on a '180 nm 128×128 1T1R resistive-memory macro', but the Results and Methods consistently describe a '32×32 1T1R chip/array'. The abstract and Introduction also imply the prototype was validated across all three tasks, whereas the Results states that speaker authentication and stylized image generation are circuit-accurate simulations due to model sizes. Please reconcile these statements and clearly delineate measured (chip) versus simulated results. This is essential for assessing the 'first experimental demonstration' claim and for avoiding overstatement of the hardware evidence.
  3. [Eq. (5); Figs. 3h–3j, 4h–4j, 5f–5h] The headline reductions (e.g., 147.76× training cost, 387.95× write energy) are largely definitional: LoRA trains (d+k)r parameters instead of dk, and avoiding analog reprogramming eliminates iterative write-verify overhead (Fig. 2h). These ratios are therefore analytical estimates given the chosen rank and programming model, not independent experimental findings. The paper should present them as derived consequences, state the rank r, loss weights λ and γ, write-verify tolerance, and energy-model assumptions, and explicitly separate measured inference energy from simulated/estimated costs. This will prevent readers from over-interpreting the efficiency claims.
minor comments (5)
  1. [Abstract; Fig. 2a; Methods] The macro size is given as 128×128 in the abstract but 32×32 in Fig. 2a and Methods. Please correct this inconsistency and use the same number throughout.
  2. [Fig. 3h and caption] The reduction factor for continual learning is stated as 27.51× in the main text and 27.15× in the caption; align the numbers.
  3. [Methods / Supplementary] Training details are missing: LoRA rank r, λ and γ values, write-verify tolerance, number of epochs, and dataset splits are not reported. Please provide these in Methods or Supplementary for reproducibility.
  4. [Figs. 3d–3f, 4d–4f, 5d] The t-SNE plots are qualitative. If kept, add quantitative cluster metrics (e.g., silhouette score or linear-separability of the embeddings) to support claims of overlap/separation.
  5. [Methods, Fabrication of RM Chips] Typo: 'comprise a32×32 1T1R array' should be 'comprise a 32×32 1T1R array'.

Circularity Check

0 steps flagged

No significant circularity: the hardware demonstration is self-contained; efficiency ratios are accounting consequences of LoRA, and the unlearning caveats are evidence-quality limitations, not circular steps.

full rationale

The paper's derivation chain is: (i) adopt standard LoRA (Eq. 5, ref 26); (ii) insert LoRA into standard gradient-ascent, label-obfuscation, and replay objectives (Eqs. 6-9); (iii) map frozen pretrained weights to analog RM crossbars and LoRA branches to SRAM/digital units; and (iv) measure accuracy, t-SNE overlap, LPIPS, and parameter/write-energy counts. None of these steps presupposes the conclusion. The efficiency reductions (e.g., 147.76x training, 387.95x write energy) are computed from the number of trainable parameters and the avoidance of analog reprogramming; they are definitional accounting for LoRA's smaller parameter budget rather than a fitted prediction, but the paper presents them as engineering measurements, not as evidence that unlearning succeeds. The unlearning claim is supported by t-SNE overlap and retained-task accuracy; these are weaker than forget-set accuracy, membership-inference resistance, or other direct privacy metrics, and the abstract itself notes that formal guarantees remain open. That weakness is an evidence-quality/validation limitation, not a circular derivation. The only apparent self-citation is ref 29 (prior liquid-state-machine RSNN architecture by the same group), used to motivate the RSNN backbone; it is not load-bearing for the machine-unlearning or efficiency claims. No equation in the paper reduces to its own input, and no fitted parameter is renamed as a prediction. Therefore no significant circularity is found.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

No new physical entities are postulated; the contribution is a system architecture (hybrid analog/digital storage with LoRA adapters), not a new force, particle, mediator, or conserved quantity.

free parameters (5)
  • LoRA rank r = not reported in main text
    Controls the number of trainable parameters and directly sets the claimed update-cost reduction factors; chosen per layer/task without stated justification.
  • Unlearning loss weight lambda = not reported
    Balances gradient ascent on the forget set and gradient descent on the retain set in Eqs. 1/6/7; tuning affects both forgetting quality and retained accuracy.
  • Replay loss weight gamma = not reported
    Balances new data and replay buffer in Eqs. 4/9; controls catastrophic forgetting and continual-learning quality.
  • Write-verify tolerance = 2 µS (Fig. 2g)
    Halting criterion for RM programming; tighter tolerance increases programming cycles and cost, so it directly affects the deployment-cost comparisons.
  • Optimization hyperparameters = not reported
    Learning rates, step counts, and optimizer settings for the LoRA update objectives are not stated; these determine whether unlearning is actually effective in the experiments.
axioms (4)
  • domain assumption Pretrained backbone weights can be programmed into the analogue RM array with sufficient precision for the task.
    Fig. 2 shows >128 conductance levels and 2 µS tolerance, but the main text does not report end-to-end accuracy after real programming for all tasks; speaker and generation tasks are simulations.
  • domain assumption Programmed conductances remain stable during inference without significant drift or read noise.
    Supported only by 10^6 s retention data from 17 cells (Fig. 2e); full-system inference assumes this extrapolates to the operating array.
  • domain assumption Circuit-accurate simulation for speaker authentication and stylized image generation faithfully captures the fabricated macro behavior.
    Two of the three application studies are not run on the chip; the energy and accuracy results depend on the simulator's RM device and peripheral models.
  • ad hoc to paper Approximate unlearning can be validated by classification accuracy and t-SNE cluster overlap rather than direct privacy or forget-set metrics.
    No membership-inference or forget-set accuracy is reported; the paper itself concedes formal guarantees are open.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Parameter Efficient Machine Unlearning on Hybrid Resistive Memory based Compute-in-Memory Accelerators." pith.science (2026). https://pith.science/paper/NGMC6C4U

@misc{pith2026260110037,
  author       = {Pith},
  title        = {Pith review of: Parameter Efficient Machine Unlearning on Hybrid Resistive Memory based Compute-in-Memory Accelerators},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NGMC6C4U}},
  note         = {Machine review of arXiv:2601.10037}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Resistive memory compute-in-memory accelerators provide energy efficient analogue matrix vector multiplication for neural network inference, but frequent reprogramming of analogue weights remains costly because of device variability and iterative write and verify operations. This limitation hinders their use in edge model adaptation, including approximate machine unlearning and continual learning, where model parameters may need to be updated repeatedly in response to data deletion requests or newly arriving tasks. Here we present a co-design approach across hardware and software that maps frozen pretrained weights to analogue resistive memory arrays while placing trainable low rank adaptation branches in SRAM connected digital compute. By using LoRA style parameter efficient updates, the proposed scheme confines adaptation to a small set of digital parameters and avoids repeated reprogramming of the analogue backbone. To our knowledge, this work provides the first experimental demonstration of approximate machine unlearning on a fabricated resistive memory CIM accelerator. We validate the framework on a 180 nm 128x128 1T1R resistive-memory macro for face recognition, and through circuit-accurate simulations for speaker authentication and stylized image generation tasks, owing to the substantial model sizes involved. Compared with a baseline that directly updates analog weights, our hybrid mapping reduces analog training/update cost by up to 148x, on-chip deployment overhead by up to 388x, and inference energy by up to 59x, while preserving competitive task performance. These results show that hybrid analogue-digital LoRA mapping can enable efficient post-deployment adaptation on RM-CIM hardware, although formal machine-unlearning guarantees and large-scale system integration remain open challenges.

Figures

Figures reproduced from arXiv: 2601.10037 by Chaoliang Tan, Dashan Shang, Han Wang, Jiajia Zha, Jichang Yang, Kemi Xu, Kwun Hang Wong, Leo Yu Zhang, Ning Lin, Songqi Wang, Wenxing Li, Xiaojuan Qi, Xiaoming Chen, Xinyuan Zhang, Yangu He, Yi Li, Yuxi Chen, Zhongrui Wang, Zihao Li, Zijian Ye.

Figure 1
Figure 1. Figure 1: Hardware-software co-design for LoRA-based machine unlearning and continual learning on a hybrid analogue-digital system. a, Machine learning models deployed on edge devices (for example, smart cameras) must support machine unlearning and continual learning to remove the influence of sensitive information contained in deleted data and to continually acquire knowledge from new data over time. b, Schematic o… view at source ↗
Figure 2
Figure 2. Figure 2: Hybrid analogue-digital architecture and RM device characteristics for programming. a, Photograph of a 32 × 32 1T1R chip, optical micrograph of the RM array, and cross-sectional transmission electron microscopy (TEM) images of a 1-transistor-1-resistor (1T1R) cell and the RM stack. b, Quasi-static I-V sweeps of an RM cell over 50 cycles, showing repeatable bipolar resistive switching. c, Endurance of an RM… view at source ↗
Figure 3
Figure 3. Figure 3: Learning, machine unlearning (UL) and continual learning (CL) for face classification on the Olivetti faces dataset. a, Schematic of the MLP-Mixer architecture mapped onto RM array for initial learning. b, Machine unlearning of face ID 2 using exemplar LoRA encoder and decoder modules. c, Continual learning of face ID 5 using exemplar LoRA encoder and decoder modules. d-f, Two-dimensional t-distributed sto… view at source ↗
Figure 4
Figure 4. Figure 4: Learning, machine unlearning and continual learning in an RSNN for speaker-authentication system on the Spiking Speech Commands dataset. a, Schematic of the recurrent spiking neural network (RSNN) architecture. Audio signals from the Spiking Speech Commands dataset are converted into spike trains, accumulated over ten time windows and fed into the recurrent hidden layer of RSNN. b, Distributions of LoRA en… view at source ↗
Figure 5
Figure 5. Figure 5: Learning, machine unlearning and continual learning in a conditional diffusion model on the UnlearnCanvas dataset. a, Architecture of the latent diffusion model. RGB images of size 128×128×3 are encoded by a variational autoencoder (VAE) into 16×16×4 latent representations, which are partitioned into 2×2 patches and fed as latent sequences to a DiT-B/2 backbone. Standard attention layers are replaced by de… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

38 extracted references · 2 linked inside Pith

  1. [1]

    Can neuromorphic computing help reduce ai’s high energy cost?Proc

    Ornes, S. Can neuromorphic computing help reduce ai’s high energy cost?Proc. Natl. Acad. Sci.122, e2528654122 (2025). 2.Indiveri, G. Neuromorphic is dead. long live neuromorphic.Neuron(2025)

    2025

  2. [3]

    Electron

    Zhao, R.et al.A spiking artificial neuron based on one diffusive memristor, one transistor and one resistor.Nat. Electron. 1–11 (2025). 4.Strukov, D. B., Snider, G. S., Stewart, D. R. & Williams, R. S. The missing memristor found.nature453, 80–83 (2008)

    2025

  3. [5]

    Microsystems105240 (2025)

    Gebregiorgis, A.et al.Spike-based neuromorphic computing: An overview from bio-inspiration to hardware architectures and learning mechanisms.Microprocess. Microsystems105240 (2025)

    2025

  4. [6]

    T., Balles, L

    Wistuba, M., Sivaprasad, P. T., Balles, L. & Zappella, G. Continual learning with low rank adaptation.arXiv preprint arXiv:2311.17601(2023)

    Pith/arXiv arXiv 2023

  5. [7]

    InProceedings of the 50th annual international symposium on computer architecture, 1–14 (2023)

    Jouppi, N.et al.Tpu v4: An optically reconfigurable supercomputer for machine learning with hardware support for embeddings. InProceedings of the 50th annual international symposium on computer architecture, 1–14 (2023)

    2023

  6. [8]

    & Wang, Y

    Chen, X., Han, Y . & Wang, Y . Communication lower bound in convolution accelerators. In2020 IEEE International Symposium on High Performance Computer Architecture (HPCA), 529–541 (IEEE, 2020). 9.Lanza, M.et al.The growing memristor industry.Nature640, 613–622 (2025). 10.Wan, W.et al.A compute-in-memory chip based on resistive random-access memory.Nature6...

    2020

  7. [12]

    Electron.5, 761–773 (2022)

    Liu, K.et al.An optoelectronic synapse based on α-in2se3 with controllable temporal dynamics for multimode and multiscale reservoir computing.Nat. Electron.5, 761–773 (2022). 13.Rao, M.et al.Thousands of conductance levels in memristors integrated on cmos.Nature615, 823–829 (2023)

    2022

  8. [14]

    Song, W.et al.Programming memristor arrays with arbitrarily high precision for analog computing.Science383, 903–910 (2024)

    2024

  9. [15]

    Electron.1–12 (2025)

    Zuo, P.et al.Precise and scalable analogue matrix equation solving using resistive random-access memory chips.Nat. Electron.1–12 (2025). 16.Yangdong, X.-J.et al.Ultrahigh-precision analog computing using memory-switching geometric ratio of transistors.Sci. Adv.11, eady4798 (2025). 17.Bourtoule, L.et al.Machine unlearning. In2021 IEEE symposium on security...

    2025

  10. [20]

    In Proceedings of the AAAI Conference on Artificial Intelligence, 8496–8504 (2025)

    Wu, Y .et al.Unlearning concepts in diffusion model via concept domain correction and concept preserving gradient. In Proceedings of the AAAI Conference on Artificial Intelligence, 8496–8504 (2025)

    2025

  11. [21]

    Neural Inf

    Park, Y .-H.et al.Direct unlearning optimization for robust and safe text-to-image models.Adv. Neural Inf. Process. Syst. 37, 80244–80267 (2024). 22.Kudithipudi, D.et al.Design principles for lifelong learning ai accelerators.Nat. electronics6, 807–822 (2023). 23.Kudithipudi, D.et al.Biological underpinnings for lifelong learning machines.Nat. Mach. Intel...

    2024

  12. [24]

    Wang, L.et al.Incorporating neuro-inspired adaptability for continual learning in artificial intelligence.Nat. Mach. Intell. 5, 1356–1368 (2023)

    2023

  13. [25]

    M., Tuytelaars, T

    Van de Ven, G. M., Tuytelaars, T. & Tolias, A. S. Three types of incremental learning.Nat. Mach. Intell.4, 1185–1197 (2022)

    2022

  14. [26]

    J.et al.Lora: Low-rank adaptation of large language models

    Hu, E. J.et al.Lora: Low-rank adaptation of large language models. InInternational Conference on Learning Representa- tions(2022). 12/13

    2022

  15. [27]

    Samaria, F. S. & Harter, A. C. Parameterisation of a stochastic model for human face identification. InProceedings of 1994 IEEE workshop on applications of computer vision, 138–142 (IEEE, 1994)

    1994

  16. [28]

    O.et al.Mlp-mixer: An all-mlp architecture for vision.Adv

    Tolstikhin, I. O.et al.Mlp-mixer: An all-mlp architecture for vision.Adv. neural information processing systems34, 24261–24272 (2021)

    2021

  17. [29]

    Lin, N.et al.Resistive memory-based zero-shot liquid state machine for multimodal event data learning.Nat. Comput. Sci. 5, 37–47 (2025)

    2025

  18. [30]

    & Zenke, F

    Cramer, B., Stradmann, Y ., Schemmel, J. & Zenke, F. The heidelberg spiking data sets for the systematic evaluation of spiking neural networks.IEEE Transactions on Neural Networks Learn. Syst.33, 2744–2757 (2020)

    2020

  19. [31]

    Tsai, Y .-L.et al.Ring-a-bell! how reliable are concept removal methods for diffusion models?arXiv preprint arXiv:2310.10012(2023)

    Pith/arXiv arXiv 2023

  20. [32]

    Zhang, Y .et al.Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models.CoRR (2024)

    2024

  21. [33]

    & Xie, S

    Peebles, W. & Xie, S. Scalable diffusion models with transformers. InProceedings of the IEEE/CVF international conference on computer vision, 4195–4205 (2023)

    2023

  22. [34]

    InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 11976–11986 (2022)

    Liu, Z.et al.A convnet for the 2020s. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 11976–11986 (2022)

    2022

  23. [35]

    A., Shechtman, E

    Zhang, R., Isola, P., Efros, A. A., Shechtman, E. & Wang, O. The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition, 586–595 (2018)

    2018

  24. [36]

    & Ristenpart, T

    Fredrikson, M., Jha, S. & Ristenpart, T. Model inversion attacks that exploit confidence information and basic counter- measures. InProceedings of the 22nd ACM SIGSAC conference on computer and communications security, 1322–1333 (2015)

    2015

  25. [37]

    & Song, D

    Carlini, N., Liu, C., Erlingsson, Ú., Kos, J. & Song, D. The secret sharer: Evaluating and testing unintended memorization in neural networks. In28th USENIX security symposium (USENIX security 19), 267–284 (2019)

    2019

  26. [38]

    In30th USENIX security symposium (USENIX Security 21), 2633–2650 (2021)

    Carlini, N.et al.Extracting training data from large language models. In30th USENIX security symposium (USENIX Security 21), 2633–2650 (2021)

    2021

  27. [39]

    InProceedings of the IEEE/CVF International Conference on Computer Vision, 22691–22702 (2023)

    Kumari, N.et al.Ablating concepts in text-to-image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, 22691–22702 (2023)

    2023

  28. [40]

    Zhang, Y .et al.To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Conference on Computer Vision, 385–403 (Springer, 2024)

    2024

  29. [41]

    neural information processing systems37, 36748–36776 (2024)

    Zhang, Y .et al.Defensive unlearning with adversarial training for robust concept erasure in diffusion models.Adv. neural information processing systems37, 36748–36776 (2024)

    2024

  30. [42]

    The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’.Comput

    Mantelero, A. The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’.Comput. Law & Secur. Rev.29, 229–235 (2013)

    2013

  31. [43]

    Assembly bill no

    Chau. Assembly bill no. 375: An act to add title 1.81.5 (commencing with section 1798.100) to part 4 of division 3 of the civil code, relating to privacy (2018). California Consumer Privacy Act of 2018 (Chapter 55, Statutes of 2018)

    2018

  32. [44]

    Xu, H., Zhu, T., Zhang, L., Zhou, W. & Yu, P. S. Machine unlearning: A survey.ACM Comput. Surv.56, DOI: 10.1145/3603620 (2023)

    doi:10.1145/3603620 2023

  33. [45]

    InIEEE INFOCOM 2022-IEEE conference on computer communications, 280–289 (IEEE, 2022)

    Liu, Y .et al.Backdoor defense with machine unlearning. InIEEE INFOCOM 2022-IEEE conference on computer communications, 280–289 (IEEE, 2022)

    2022

  34. [46]

    & Ganesh, V

    Graves, L., Nagisetty, V . & Ganesh, V . Amnesiac machine learning. InProceedings of the AAAI Conference on Artificial Intelligence, 11516–11524 (2021)

    2021

  35. [47]

    De Lange, M.et al.A continual learning survey: Defying forgetting in classification tasks.IEEE transactions on pattern analysis machine intelligence44, 3366–3385 (2021)

    2021

  36. [48]

    M., Siegelmann, H

    Van de Ven, G. M., Siegelmann, H. T. & Tolias, A. S. Brain-inspired replay for continual learning with artificial neural networks.Nat. communications11, 4069 (2020)

    2020

  37. [49]

    & Lampert, C

    Rebuffi, S.-A., Kolesnikov, A., Sperl, G. & Lampert, C. H. icarl: Incremental classifier and representation learning. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, 2001–2010 (2017)

    2001

  38. [50]

    K., Kim, J

    Shin, H., Lee, J. K., Kim, J. & Kim, J. Continual learning with deep generative replay.Adv. neural information processing systems30(2017). 13/13

    2017

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.