pith. sign in

arxiv: 2604.08238 · v1 · submitted 2026-04-09 · 💻 cs.CV

oslash Source Models Leak What They Shouldn't nrightarrow: Unlearning Zero-Shot Transfer in Domain Adaptation Through Adversarial Optimization

Arnav Devalapally , Poornima Jain , Kartik Srinivas , Vineeth N. Balasubramanian This is my paper

Pith reviewed 2026-05-10 17:09 UTC · model grok-4.3

classification 💻 cs.CV
keywords source-free domain adaptationmachine unlearningadversarial optimizationprivacy leakagezero-shot transferdomain adaptationsource-exclusive classes
0
0 comments X

The pith

Source-free domain adaptation models leak knowledge of source-exclusive classes into the target domain even without those classes appearing in target data.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper shows that common source-free domain adaptation methods retain and transfer information about classes that exist only in the source data, creating a privacy risk when the adapted model is used on target samples. This leakage is revealed by strong zero-shot performance on those excluded classes. The authors define a new unlearning task, SCADA-UL, and introduce a technique that generates adversarial examples of the classes to forget, then applies a rescaled labeling strategy inside the adaptation process to remove the unwanted knowledge. Experiments indicate the method matches the effectiveness of retraining from scratch while surpassing prior unlearning approaches on standard benchmarks.

Core claim

Existing SFDA methods exhibit strong zero-shot performance on source-exclusive classes in the target domain, indicating they inadvertently leak knowledge of these classes into the target domain, even when they are not represented in the target data. The proposed method generates an adversarially optimized forget-class sample and applies rescaled labeling during adaptation to unlearn the source-exclusive classes, achieving retraining-level unlearning performance while handling the domain shift.

What carries the argument

Adversarially generated forget-class samples combined with a rescaled labeling strategy inside the SCADA-UL domain-adaptation procedure.

If this is right

  • The same adversarial optimization and rescaled labeling can be used in a continual setting where new classes must be forgotten over time.
  • The method still works when the specific classes to unlearn are not known in advance.
  • Target-domain accuracy is preserved at levels comparable to standard SFDA while source-exclusive knowledge is removed.
  • The approach reaches unlearning performance equivalent to retraining the model from scratch on the available data.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the leakage is as widespread as shown, privacy audits for adapted models should routinely test zero-shot behavior on source-only categories.
  • The adversarial-sample technique might extend to other adaptation pipelines that also face distribution shift, such as unsupervised domain adaptation with partial source access.
  • Deployments in medical or satellite imaging could adopt this style of unlearning to reduce the chance that source-patient or source-location details become inferable from the final model.

Load-bearing premise

Adversarially generated forget-class samples together with rescaled labeling can selectively remove source-exclusive class knowledge during adaptation without creating new distribution shifts or lowering target-domain accuracy.

What would settle it

After applying the method, check whether zero-shot accuracy on the source-exclusive classes falls to near-chance levels on target data while target-domain classification accuracy remains essentially unchanged; failure of either condition would falsify the central claim.

Figures

Figures reproduced from arXiv: 2604.08238 by Arnav Devalapally, Kartik Srinivas, Poornima Jain, Vineeth N. Balasubramanian.

Figure 1
Figure 1. Figure 1: Comparison of Conventional MU and Proposed SCADA-UL. Conventional class-wise machine unlearning focuses on forgetting a subset of classes from a trained model. On the other hand, the proposed SCADA￾UL aims to remove knowledge of source-exclusive classes (classes absent in target domain) while adapting a model to a new domain. For instance, if a land-use categorization model is adapted to a new geography, s… view at source ↗
Figure 2
Figure 2. Figure 2: Existing SFDA/PDA methods leak source-exclusive classes in the target domain. In this work, we propose a motivated methodology towards MU for source-free domain adaptation (SFDA) settings, where a model is adapted from a source domain to a target domain, and certain source-exclusive classes have to be unlearned, with no access to the source-domain data itself. This is a challenging, practical and new setti… view at source ↗
Figure 3
Figure 3. Figure 3: Our overall method. We adapt a source trained model wS to a target domain DT while forgetting classes cF . We first create an initial adversarial sample xˆ by maximizing its probability of belonging to the forget classes cF by optimizing LADV(wS , xˆ) (Eqn 3). In each subsequent iteration, the model wT minimizes: (i) LMU (5) using rescaled labels yˆ to encourage unlearning the forget classes cF ; and (ii) … view at source ↗
read the original abstract

The increasing adaptation of vision models across domains, such as satellite imagery and medical scans, has raised an emerging privacy risk: models may inadvertently retain and leak sensitive source-domain specific information in the target domain. This creates a compelling use case for machine unlearning to protect the privacy of sensitive source-domain data. Among adaptation techniques, source-free domain adaptation (SFDA) calls for an urgent need for machine unlearning (MU), where the source data itself is protected, yet the source model exposed during adaptation encodes its influence. Our experiments reveal that existing SFDA methods exhibit strong zero-shot performance on source-exclusive classes in the target domain, indicating they inadvertently leak knowledge of these classes into the target domain, even when they are not represented in the target data. We identify and address this risk by proposing an MU setting called SCADA-UL: Unlearning Source-exclusive ClAsses in Domain Adaptation. Existing MU methods do not address this setting as they are not designed to handle data distribution shifts. We propose a new unlearning method, where an adversarially generated forget class sample is unlearned by the model during the domain adaptation process using a novel rescaled labeling strategy and adversarial optimization. We also extend our study to two variants: a continual version of this problem setting and to one where the specific source classes to be forgotten may be unknown. Alongside theoretical interpretations, our comprehensive empirical results show that our method consistently outperforms baselines in the proposed setting while achieving retraining-level unlearning performance on benchmark datasets. Our code is available at https://github.com/D-Arnav/SCADA

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 2 minor

Summary. The manuscript introduces the SCADA-UL setting for unlearning source-exclusive classes during source-free domain adaptation (SFDA). It empirically shows that existing SFDA methods leak knowledge of source-only classes via strong zero-shot performance on target-domain instances of those classes. The proposed method generates adversarial forget-class samples from the source model and applies a rescaled labeling strategy during adaptation to erase this influence, with extensions to continual unlearning and unknown forget-class scenarios. Claims include consistent outperformance over baselines and achievement of retraining-level unlearning performance on standard benchmarks, supported by code release.

Significance. If the central empirical claims hold after clarification, the work identifies a previously under-examined privacy leakage risk in SFDA and provides a practical heuristic for mitigation in sensitive domains such as medical imaging. The release of code is a positive contribution to reproducibility. The heuristic nature of the adversarial generation plus rescaling, however, limits immediate theoretical impact and requires stronger validation before the approach can be considered a general solution for unlearning under distribution shift.

major comments (3)
  1. [§3] §3 (Method description): The rescaled labeling strategy is presented at a high level without the explicit formulation (e.g., how scaling factors are derived from the adversarial samples or applied to the loss), making it impossible to verify whether it achieves global class erasure or merely local output suppression on the generated points.
  2. [§4] §4 (Experiments): The central claim of 'retraining-level unlearning performance' and consistent outperformance is reported, yet the section omits full details on data splits, number of random seeds, statistical significance tests, and exact protocol for post-hoc selection of forget classes; these omissions are load-bearing for assessing whether the results generalize beyond the chosen benchmarks.
  3. [§3 and §5] Theoretical interpretations (throughout §3 and §5): The paper invokes invariance to domain shift without providing an explicit derivation or proof that the adversarial optimization plus rescaling removes class representations globally in feature space rather than only on the crafted samples; this leaves the weakest assumption unaddressed.
minor comments (2)
  1. [Title] The title uses the non-standard symbol Ø without immediate definition; a brief clarification in the introduction would improve readability.
  2. [§4] Several figures in the experimental section would benefit from explicit legends and error bars to facilitate direct comparison of methods.

Simulated Author's Rebuttal

3 responses · 1 unresolved

We thank the referee for the constructive and detailed feedback on our manuscript. We address each major comment point by point below, indicating where revisions will be made to improve clarity, completeness, and transparency.

read point-by-point responses

  1. Referee: [§3] §3 (Method description): The rescaled labeling strategy is presented at a high level without the explicit formulation (e.g., how scaling factors are derived from the adversarial samples or applied to the loss), making it impossible to verify whether it achieves global class erasure or merely local output suppression on the generated points.

    Authors: We agree that the presentation in §3 was at too high a level and lacked the explicit equations needed for verification. In the revised manuscript we will add the full mathematical formulation of the rescaled labeling strategy, including the precise definition of the scaling factors (derived from the adversarial optimization objective on the generated forget-class samples) and their direct incorporation into the adaptation loss. This will make clear that the rescaling is applied to the class logits across the entire adaptation objective rather than being restricted to the generated points alone. revision: yes

  2. Referee: [§4] §4 (Experiments): The central claim of 'retraining-level unlearning performance' and consistent outperformance is reported, yet the section omits full details on data splits, number of random seeds, statistical significance tests, and exact protocol for post-hoc selection of forget classes; these omissions are load-bearing for assessing whether the results generalize beyond the chosen benchmarks.

    Authors: We acknowledge these omissions in the experimental reporting. The revised §4 will include: (i) explicit data-split protocols consistent with the cited SFDA benchmarks, (ii) results averaged over 5 random seeds with standard deviations, (iii) paired t-test p-values for all reported comparisons, and (iv) the precise post-hoc selection rule (source-only classes absent from the target split, chosen deterministically per dataset). These additions will allow readers to assess reproducibility and generalization. revision: yes

  3. Referee: [§3 and §5] Theoretical interpretations (throughout §3 and §5): The paper invokes invariance to domain shift without providing an explicit derivation or proof that the adversarial optimization plus rescaling removes class representations globally in feature space rather than only on the crafted samples; this leaves the weakest assumption unaddressed.

    Authors: We accept that the theoretical interpretations in §3 and §5 rest on empirical observations and an intuitive argument about domain-invariant feature suppression rather than a formal derivation. The revised text will explicitly label the core assumption as heuristic, state that global erasure is supported by the observed retraining-level metrics but not proven, and add a limitations paragraph discussing why the effect may extend beyond the crafted samples. We will not add a proof, as none is currently available. revision: partial

standing simulated objections not resolved
  • Providing an explicit derivation or proof that the adversarial optimization plus rescaling removes class representations globally in feature space rather than only on the crafted samples.

Circularity Check

0 steps flagged

Proposed SCADA-UL unlearning method is an independent optimization procedure with no reduction to inputs by construction

full rationale

The paper's chain begins with an empirical observation that existing SFDA methods show zero-shot leakage on source-exclusive classes, then introduces SCADA-UL as a new setting and a concrete method (adversarial generation of forget samples + rescaled labeling during adaptation). No equations, definitions, or claims are shown to reduce the unlearning outcome to a fitted parameter defined on the same data, a self-citation chain, or an ansatz smuggled from prior work. Performance is reported via direct comparison to baselines and retraining on benchmarks, rendering the contribution self-contained rather than tautological.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The approach rests on standard assumptions of adversarial training and domain adaptation plus the novel claim that generated forget samples can be treated as representative of source-exclusive classes.

axioms (1)
  • domain assumption Adversarial examples generated from the current model can serve as faithful proxies for source-exclusive class distributions during unlearning.
    Invoked to justify the forget-sample generation step in the proposed method.

pith-pipeline@v0.9.0 · 5613 in / 1211 out tokens · 30145 ms · 2026-05-10T17:09:15.551839+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

73 extracted references · 73 canonical work pages

  1. [1]

    Unsupervised robust domain adaptation without source data

    Peshal Agarwal, Danda Pani Paudel, Jan-Nico Zaech, and Luc Van Gool. Unsupervised robust domain adaptation without source data. InProceedings of the IEEE/CVF Winter Confer- ence on Applications of Computer Vision, pages 2009–2018,

    work page 2009

  2. [2]

    Raychaud- huri, Arindam Dutta, Rohit Kundu, Fahim Faisal Niloy, Basak Guler, and Amit K

    Sk Miraj Ahmed, Umit Yigit Basaran, Dripta S. Raychaud- huri, Arindam Dutta, Rohit Kundu, Fahim Faisal Niloy, Basak Guler, and Amit K. Roy-Chowdhury. Towards source-free machine unlearning. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition (CVPR), pages 4948–4957, 2025. 2, 3, 6, 7, 8, 20, 25, 26, 27, 28, 29, 30, 31, 32,...

    work page 2025

  3. [3]

    Elastic weight consolidation (ewc): Nuts and bolts.arXiv preprint arXiv:2105.04093, 2021

    Abhishek Aich. Elastic weight consolidation (ewc): Nuts and bolts.arXiv preprint arXiv:2105.04093, 2021. 6, 19

    work page arXiv 2021

  4. [4]

    Machine unlearning: Linear filtration for logit-based classifiers.Machine Learning, 111(9):3203–3226, 2022

    Thomas Baumhauer, Pascal Sch¨ottle, and Matthias Zeppelza- uer. Machine unlearning: Linear filtration for logit-based classifiers.Machine Learning, 111(9):3203–3226, 2022. 1

    work page 2022

  5. [5]

    Partial adversarial domain adaptation

    Zhangjie Cao, Lijia Ma, Mingsheng Long, and Jianmin Wang. Partial adversarial domain adaptation. InProceedings of the European conference on computer vision (ECCV), pages 135– 150, 2018. 2, 3, 6, 7, 8, 13, 20, 21, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36

    work page 2018

  6. [6]

    California consumer privacy act, 2018

    CCPA. California consumer privacy act, 2018. 1

    work page 2018

  7. [7]

    Learning to unlearn: Instance- wise unlearning for pre-trained classifiers

    Sungmin Cha, Sungjun Cho, Dasol Hwang, Honglak Lee, Tae- sup Moon, and Moontae Lee. Learning to unlearn: Instance- wise unlearning for pre-trained classifiers. InProceedings of the AAAI Conference on Artificial Intelligence, pages 11186– 11194, 2024. 3

    work page 2024

  8. [8]

    Graph unlearning

    Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. Graph unlearning. In Proceedings of the 2022 ACM SIGSAC conference on com- puter and communications security, pages 499–513, 2022. 3

    work page 2022

  9. [9]

    Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher

    Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 7210–7217, 2023. 3

    work page 2023

  10. [10]

    Zero-shot machine unlearning.IEEE Transactions on Information Forensics and Security, 18:2345– 2354, 2023

    Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. Zero-shot machine unlearning.IEEE Transactions on Information Forensics and Security, 18:2345– 2354, 2023. 1, 2, 3, 5, 6, 7, 8, 15, 16, 20, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37

    work page 2023

  11. [11]

    A simple machine unlearning approach using elastic weight consolidation

    Arnav Devalapally and Gowtham Valluri. A simple machine unlearning approach using elastic weight consolidation. In International Conference on Recent Trends in AI Enabled Technologies, pages 1–10. Springer, 2023. 7

    work page 2023

  12. [12]

    Source-free adaptation to measurement shift via bottom-up feature restoration

    Cian Eastwood, Ian Mason, Chris Williams, and Bernhard Sch¨olkopf. Source-free adaptation to measurement shift via bottom-up feature restoration. InInternational Conference on Learning Representations, 2022. 3

    work page 2022

  13. [13]

    Not all wrong is bad: Using adversarial examples for unlearning

    Ali Ebrahimpour-Boroojeny, Hari Sundaram, and Varun Chandrasekaran. Not all wrong is bad: Using adversarial examples for unlearning. InProceedings of the 42nd Inter- national Conference on Machine Learning (ICML), pages 14950–14971. Proceedings of Machine Learning Research (PMLR), 2025. 3

    work page 2025

  14. [14]

    Source-free unsupervised domain adaptation: A survey.Neural Networks, 174:106230, 2024

    Yuqi Fang, Pew-Thian Yap, Weili Lin, Hongtu Zhu, and Mingxia Liu. Source-free unsupervised domain adaptation: A survey.Neural Networks, 174:106230, 2024. 3

    work page 2024

  15. [15]

    An information theoretic approach to machine unlearning,

    Jack Foster, Kyle Fogarty, Stefan Schoepf, Cengiz ¨Oztireli, and Alexandra Brintrup. Zero-shot machine unlearn- ing at scale via lipschitz regularization.arXiv preprint arXiv:2402.01401, 2024. 1, 2, 6, 7, 8, 20, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37

    work page arXiv 2024

  16. [16]

    Fast ma- chine unlearning without retraining through selective synaptic dampening

    Jack Foster, Stefan Schoepf, and Alexandra Brintrup. Fast ma- chine unlearning without retraining through selective synaptic dampening. InProceedings of the AAAI Conference on Artifi- cial Intelligence, pages 12043–12051, 2024. 3

    work page 2024

  17. [17]

    Model inversion attacks that exploit confidence information and basic countermeasures

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. InProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, page 1322–1333, New York, NY , USA, 2015. Association for Com- puting Machinery. 2

    work page 2015

  18. [18]

    General data protection regulation, 2016

    GDPR. General data protection regulation, 2016. 1

    work page 2016

  19. [19]

    A comprehensive survey of machine unlearning techniques for large language models,

    Jiahui Geng, Qing Li, Herbert Woisetschlaeger, Zongxiong Chen, Fengyu Cai, Yuxia Wang, Preslav Nakov, Hans-Arno Jacobsen, and Fakhri Karray. A comprehensive survey of machine unlearning techniques for large language models,

    work page

  20. [20]

    Zero-shot machine un- learning using generative adversarial network

    Ali Ghazal and Radwa El Shawi. Zero-shot machine un- learning using generative adversarial network. InAdvances in Knowledge Discovery and Data Mining: 29th Pacific- Asia Conference on Knowledge Discovery and Data Mining, PAKDD 2025, Sydney, NSW, Australia, June 10–13, 2025, Proceedings, Part IV, page 65–77, Berlin, Heidelberg, 2025. Springer-Verlag. 3

    work page 2025

  21. [21]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks

    Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9304– 9312, 2020. 1, 2, 3

    work page 2020

  22. [22]

    For- getting outside the box: Scrubbing deep networks of informa- tion accessible from input-output observations

    Aditya Golatkar, Alessandro Achille, and Stefano Soatto. For- getting outside the box: Scrubbing deep networks of informa- tion accessible from input-output observations. InComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXIX 16, pages 383–398. Springer, 2020. 7, 23

    work page 2020

  23. [23]

    Adversarial reweighting for partial domain adaptation

    Xiaojin Gu, Xing Yu, Yan Yang, Jian Sun, and Zongben Xu. Adversarial reweighting for partial domain adaptation. In Advances in Neural Information Processing Systems, pages 14860–14872, 2021. 3

    work page 2021

  24. [24]

    Hannun, and Laurens van der Maaten

    Chuan Guo, Tom Goldstein, Awni Y . Hannun, and Laurens van der Maaten. Certified data removal from machine learning models. InProceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, pages 3832–3842. PMLR, 2020. 3

    work page 2020

  25. [25]

    Selective partial domain adaptation

    Peng Guo, Jun Zhu, and Yu Zhang. Selective partial domain adaptation. In33rd British Machine Vision Conference 2022, BMVC 2022, London, UK, 2022. 3

    work page 2022

  26. [26]

    Reconstructing training data from trained neu- ral networks.Advances in Neural Information Processing Systems, 35:22911–22924, 2022

    Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. Reconstructing training data from trained neu- ral networks.Advances in Neural Information Processing Systems, 35:22911–22924, 2022. 1

    work page 2022

  27. [27]

    Domain adaptation via wasserstein distance and discrepancy metric for chest x-ray image classification.Scientific Reports, 14(1): 2690, 2024

    Bishi He, Yuanjiao Chen, Darong Zhu, and Zhe Xu. Domain adaptation via wasserstein distance and discrepancy metric for chest x-ray image classification.Scientific Reports, 14(1): 2690, 2024. 7, 24

    work page 2024

  28. [28]

    SF(DA) 2: Source-free domain adaptation through the lens of data augmentation

    Uiwon Hwang, Jonghyun Lee, Juhyeon Shin, and Sungroh Yoon. SF(DA) 2: Source-free domain adaptation through the lens of data augmentation. InThe Twelfth International Conference on Learning Representations, 2024. 2, 3, 5, 6, 7, 8, 16, 20, 21, 22, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36

    work page 2024

  29. [29]

    Chexpert: A large chest radiograph dataset with uncertainty labels and expert comparison

    Jeremy Irvin, Pranav Rajpurkar, Michael Ko, Yifan Yu, Sil- viana Ciurea-Ilcus, Chris Chute, Henrik Marklund, Behzad Haghgoo, Robyn Ball, Katie Shpanskaya, et al. Chexpert: A large chest radiograph dataset with uncertainty labels and expert comparison. InProceedings of the AAAI conference on artificial intelligence, pages 590–597, 2019. 7

    work page 2019

  30. [30]

    Source-free domain adaptation via distributional alignment by matching batch normalization statistics, 2021

    Masato Ishii and Masashi Sugiyama. Source-free domain adaptation via distributional alignment by matching batch normalization statistics, 2021. 3

    work page 2021

  31. [31]

    Unsupervised BatchNorm Adaptation (UBNA): A Domain Adaptation Method for Semantic Seg- mentation Without Using Source Domain Representations

    Marvin Klingner, Jan-Aike Termohlen, Jacob Ritterbach, and Tim Fingscheidt. Unsupervised BatchNorm Adaptation (UBNA): A Domain Adaptation Method for Semantic Seg- mentation Without Using Source Domain Representations . In2022 IEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACVW), pages 210–220, Los Alamitos, CA, USA, 2022. IEEE C...

    work page 2022

  32. [32]

    Confidence score for source-free unsupervised domain adaptation

    Jonghyun Lee, Dahuin Jung, Junho Yim, and Sung-Hoon Yoon. Confidence score for source-free unsupervised domain adaptation. InInternational Conference on Machine Learning,

    work page

  33. [33]

    Machine unlearning: Taxonomy, metrics, applications, challenges, and prospects.IEEE Trans- actions on Neural Networks and Learning Systems, 2025

    Na Li, Chunyi Zhou, Yansong Gao, Hui Chen, Zhi Zhang, Boyu Kuang, and Anmin Fu. Machine unlearning: Taxonomy, metrics, applications, challenges, and prospects.IEEE Trans- actions on Neural Networks and Learning Systems, 2025. 3

    work page 2025

  34. [34]

    Do we really need to access the source data? source hypothesis transfer for unsupervised domain adaptation

    Jian Liang, Dapeng Hu, and Jiashi Feng. Do we really need to access the source data? source hypothesis transfer for unsupervised domain adaptation. InInternational conference on machine learning, pages 6028–6039. PMLR, 2020. 2, 3, 5, 6, 7, 8, 20, 21, 22, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37

    work page 2020

  35. [35]

    Continual learning and private unlearning

    Bo Liu, Qiang Liu, and Peter Stone. Continual learning and private unlearning. InConference on Lifelong Learning Agents, pages 243–254. PMLR, 2022. 3

    work page 2022

  36. [36]

    Hengzhu Liu, Ping Xiong, Tianqing Zhu, and Philip S. Yu. A survey on machine unlearning: Techniques and new emerged privacy risks.J. Inf. Secur. Appl., 90(C), 2025. 2

    work page 2025

  37. [37]

    Efficient machine unlearning via influence approximation

    Jiawei Liu, Chenwang Wu, Defu Lian, and Enhong Chen. Efficient machine unlearning via influence approximation. arXiv preprint arXiv:2507.23257, 2025. 3

    work page arXiv 2025

  38. [38]

    Source-free domain adap- tation with contrastive domain alignment and self-supervised exploration for face anti-spoofing

    Yuchen Liu, Yabo Chen, Wenrui Dai, Mengran Gou, Chun- Ting Huang, and Hongkai Xiong. Source-free domain adap- tation with contrastive domain alignment and self-supervised exploration for face anti-spoofing. InEuropean Conference on Computer Vision, pages 511–528. Springer, 2022. 3

    work page 2022

  39. [39]

    The right to be forgotten in federated learning: An efficient realization with rapid retraining

    Yi Liu, Lei Xu, Xingliang Yuan, Cong Wang, and Bo Li. The right to be forgotten in federated learning: An efficient realization with rapid retraining. InIEEE INFOCOM 2022- IEEE Conference on Computer Communications, pages 1749–

    work page 2022

  40. [40]

    Machine unlearning in generative ai: A survey

    Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. Machine unlearning in generative ai: A survey. CoRR, 2024. 3

    work page 2024

  41. [41]

    Spatio-temporal pixel- level contrastive learning-based source-free domain adapta- tion for video semantic segmentation

    Shao-Yuan Lo, Poojan Oza, Sumanth Chennupati, Alejan- dro Galindo, and Vishal M Patel. Spatio-temporal pixel- level contrastive learning-based source-free domain adapta- tion for video semantic segmentation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10534–10543, 2023. 3

    work page 2023

  42. [42]

    Descent-to-delete: Gradient-based methods for machine un- learning

    Seth Neel, Aaron Roth, and Saeed Sharifi-Malvajerdi. Descent-to-delete: Gradient-based methods for machine un- learning. InAlgorithmic Learning Theory, 16-19 March 2021, Virtual Conference, Worldwide, pages 931–962. PMLR, 2021. 3

    work page 2021

  43. [43]

    A survey of machine unlearning.ACM Trans

    Thanh Tam Nguyen, Thanh Trung Huynh, Zhao Ren, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. A survey of machine unlearning.ACM Trans. Intell. Syst. Technol., 16(5), 2025. 3

    work page 2025

  44. [44]

    Partially blinded un- learning: Class unlearning for deep networks from bayesian perspective

    Subhodip Panda, Shashwat Sourav, et al. Partially blinded un- learning: Class unlearning for deep networks from bayesian perspective. InProceedings of the AAAI Conference on Artifi- cial Intelligence, pages 6372–6380, 2025. 1, 4, 6

    work page 2025

  45. [45]

    Moment matching for multi-source domain adaptation

    Xingchao Peng, Qinxun Bai, Xide Xia, Zijun Huang, Kate Saenko, and Bo Wang. Moment matching for multi-source domain adaptation. InProceedings of the IEEE/CVF inter- national conference on computer vision, pages 1406–1415,

    work page

  46. [46]

    On- line structured laplace approximations for overcoming catas- trophic forgetting.Advances in Neural Information Process- ing Systems, 31, 2018

    Hippolyt Ritter, Aleksandar Botev, and David Barber. On- line structured laplace approximations for overcoming catas- trophic forgetting.Advances in Neural Information Process- ing Systems, 31, 2018. 4, 6, 19

    work page 2018

  47. [47]

    Adapting visual category models to new domains

    Kate Saenko, Brian Kulis, Mario Fritz, and Trevor Darrell. Adapting visual category models to new domains. InCom- puter Vision–ECCV 2010: 11th European Conference on Computer Vision, Heraklion, Crete, Greece, September 5- 11, 2010, Proceedings, Part IV 11, pages 213–226. Springer,

    work page 2010

  48. [48]

    Bobev, A

    Kaichao Sheng, Ke Li, Xiaobo Zheng, Jian Liang, Weijie Dong, Fei Huang, Rongrong Ji, and Xiaoshuai Sun. On evolving attention towards domain adaptation, 2021. arXiv preprint arXiv:2106.04581. 3

    work page arXiv 2021

  49. [49]

    Domain adaptation for convo- lutional neural networks-based remote sensing scene classifi- cation.IEEE Geoscience and Remote Sensing Letters, 16(8): 1324–1328, 2019

    Shaoyue Song, Hongkai Yu, Zhenjiang Miao, Qiang Zhang, Yuewei Lin, and Song Wang. Domain adaptation for convo- lutional neural networks-based remote sensing scene classifi- cation.IEEE Geoscience and Remote Sensing Letters, 16(8): 1324–1328, 2019. 20, 23

    work page 2019

  50. [50]

    Repairing neural networks by leaving the right past be- hind.Advances in Neural Information Processing Systems, 35:13132–13145, 2022

    Ryutaro Tanno, Melanie F Pradier, Aditya Nori, and Yingzhen Li. Repairing neural networks by leaving the right past be- hind.Advances in Neural Information Processing Systems, 35:13132–13145, 2022. 3

    work page 2022

  51. [51]

    Fast yet effective machine unlearning

    Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unlearning. IEEE Transactions on Neural Networks and Learning Sys- tems, 2023. 1, 2, 3, 6, 7, 8, 15, 16, 20, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37

    work page 2023

  52. [52]

    Source-free unsupervised domain adaptation through trust-guided partitioning and worst-case aligning.Know.-Based Syst., 318(C), 2025

    Qing Tian and Lulu Kang. Source-free unsupervised domain adaptation through trust-guided partitioning and worst-case aligning.Know.-Based Syst., 318(C), 2025. 3

    work page 2025

  53. [53]

    ∇τ : Gradient- based and task-agnostic machine unlearning.CoRR, 2024

    Daniel Trippa, Cesare Campagnano, Maria Sofia Bucarelli, Gabriele Tolomei, and Fabrizio Silvestri. ∇τ : Gradient- based and task-agnostic machine unlearning.CoRR, 2024. 6, 7, 8, 15, 16, 20, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37

    work page 2024

  54. [54]

    Deep hashing network for unsupervised domain adaptation

    Hemanth Venkateswara, Jose Eusebio, Shayok Chakraborty, and Sethuraman Panchanathan. Deep hashing network for unsupervised domain adaptation. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 5018–5027, 2017. 7

    work page 2017

  55. [55]

    Cross-domain contrastive learning for unsupervised domain adaptation.IEEE Transactions on Multimedia, PP:1–1, 2022

    Rui Wang, Zuxuan Wu, Zejia Weng, Jingjing Chen, Guo-Jun Qi, and Yu-Gang Jiang. Cross-domain contrastive learning for unsupervised domain adaptation.IEEE Transactions on Multimedia, PP:1–1, 2022. 3

    work page 2022

  56. [56]

    Ma- chine unlearning via representation forgetting with parameter self-sharing.IEEE Transactions on Information Forensics and Security, 19:1099–1111, 2024

    Weiqi Wang, Chenhan Zhang, Zhiyi Tian, and Shui Yu. Ma- chine unlearning via representation forgetting with parameter self-sharing.IEEE Transactions on Information Forensics and Security, 19:1099–1111, 2024. 3

    work page 2024

  57. [57]

    Chestx- ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases

    Xiaosong Wang, Yifan Peng, Le Lu, Zhiyong Lu, Mo- hammadhadi Bagheri, and Ronald M Summers. Chestx- ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 2097–2106,

    work page 2097

  58. [58]

    Machine unlearning of features and la- bels

    Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and la- bels. InNetwork and Distributed System Security Symposium (NDSS) 2023, 2023. 3

    work page 2023

  59. [59]

    DeltaGrad: Rapid retraining of machine learning models

    Yinjun Wu, Edgar Dobriban, and Susan Davidson. DeltaGrad: Rapid retraining of machine learning models. InProceedings of the 37th International Conference on Machine Learning, pages 10355–10366. PMLR, 2020. 3

    work page 2020

  60. [60]

    Revisiting source-free domain adaptation: a new perspective via uncertainty control

    Gezheng Xu, Hui Guo, Li Yi, Charles Ling, Boyu Wang, and Grace Yi. Revisiting source-free domain adaptation: a new perspective via uncertainty control. InThe Thirteenth International Conference on Learning Representations, 2025. 3, 20, 21

    work page 2025

  61. [61]

    Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and P. Yu. Machine unlearning: A survey.ACM Computing Surveys, 56:1 – 36, 2023. 3

    work page 2023

  62. [62]

    One-shot machine unlearning with mnemonic code

    Tomoya Yamashita, Masanori Yamada, and Takashi Shibata. One-shot machine unlearning with mnemonic code. InThe 16th Asian Conference on Machine Learning (Conference Track), 2024. 1

    work page 2024

  63. [63]

    Arcane: An efficient architecture for exact machine unlearning

    Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, and Xiaodong Lin. Arcane: An efficient architecture for exact machine unlearning. InIJCAI, page 19, 2022. 3

    work page 2022

  64. [64]

    Onering: A simple method for source-free open-partial domain adaptation.arXiv preprint arXiv:2206.03600, 2022

    Shiqi Yang, Yaxing Wang, Kai Wang, Shangling Jui, and Joost van de Weijer. Onering: A simple method for source-free open-partial domain adaptation.arXiv preprint arXiv:2206.03600, 2022. 3

    work page arXiv 2022

  65. [65]

    Bag-of-visual-words and spatial extensions for land-use classification

    Yi Yang and Shawn Newsam. Bag-of-visual-words and spatial extensions for land-use classification. InProceedings of the 18th SIGSPATIAL international conference on advances in geographic information systems, pages 270–279, 2010. 7, 20

    work page 2010

  66. [66]

    Machine unlearning of pre- trained large language models

    Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. Machine unlearning of pre- trained large language models. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguis- tics (Volume 1: Long Papers), pages 8403–8419, Bangkok, Thailand, 2024. Association for Computational Linguistics. 3

    work page 2024

  67. [67]

    Source-free partial domain adaptation in rotating machin- ery fault diagnosis using deep hypothesis domain adaptation network

    Kai Yue, Wenhao Li, Jing Li, Zhen Chen, and Rui Huang. Source-free partial domain adaptation in rotating machin- ery fault diagnosis using deep hypothesis domain adaptation network. In2022 International Conference on Sensing, Mea- surement & Data Analytics in the era of Artificial Intelligence (ICSMD), pages 1–6. IEEE, 2022. 3

    work page 2022

  68. [68]

    Machine unlearning method- ology based on stochastic teacher network

    Xulong Zhang, Jianzong Wang, Ning Cheng, Yifu Sun, Chuanyao Zhang, and Jing Xiao. Machine unlearning method- ology based on stochastic teacher network. In19th Interna- tional Conference on Advanced Data Mining and Applica- tions. (ADMA 2023), pages 250–261, 2023. 3

    work page 2023

  69. [69]

    Unlearn- ing through knowledge overwriting: Reversible federated unlearning via selective sparse adapter, 2025

    Zhengyi Zhong, Weidong Bao, Ji Wang, Shuai Zhang, Jingx- uan Zhou, Lingjuan Lyu, and Wei Yang Bryan Lim. Unlearn- ing through knowledge overwriting: Reversible federated unlearning via selective sparse adapter, 2025. 3

    work page 2025

  70. [70]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. InAdvances in Neural Information Processing Systems. Curran Associates, Inc., 2019. 2

    work page 2019

  71. [71]

    continual

    Qin Zou, Lihao Ni, Tong Zhang, and Qian Wang. Deep learning based feature selection for remote sensing scene classification.IEEE Geoscience and remote sensing letters, 12(11):2321–2325, 2015. 7, 20 Appendix Contents A.1. Proof of Theorem 4.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....

    work page 2015

  72. [72]

    Low γ values for retain classes due to domain shift or inherent difficulty.For example, classes like Compass, Cow, and Pencil exhibit 0% accuracy on the target domain and correspondingly low γ values (see Tab. A.9). This misleads our algorithm into detecting them as forget classes even though they are actually retain classes

    work page

  73. [73]

    before DA

    Semantic or visual similarity between retain and forget classes.Forget classes such as Great Wall of China receive higher γ values due to contributions from semantically similar classes like castle and streetlight (see Tab. A.10), making them harder to identify correctly as forget classes A.4.6. Additional Ablation Studies Table A.11. Initializing adv sam...

    work page