pith. sign in

arxiv: 2605.15737 · v1 · pith:M3OTNHUSnew · submitted 2026-05-15 · 💻 cs.CV

BARRIER: Bounded Activation Regions for Robust Information Erasure

Jan Miksa , Patryk Krukowski , Przemys{\l}aw Spurek , Dawid Damian Rymarczyk , Marcin Sendera This is my paper

Pith reviewed 2026-05-20 19:09 UTC · model grok-4.3

classification 💻 cs.CV
keywords machine unlearningactivation spaceinterval arithmeticSVD projectionconcept erasureretain distributionfunctional driftneural network geometry
0
0 comments X

The pith

Restricting unlearning updates to a bounded interval in activation space and mathematically protecting the complement prevents collateral forgetting with formal guarantees.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper aims to solve the problem of unintended knowledge loss during machine unlearning by moving the intervention from weights to the geometry of hidden activations. It defines a specific forget region as a hypercube and applies changes only there while using interval arithmetic to bound responses outside it. A sympathetic reader would care because this turns preservation of neutral concepts from a trial-and-error process into a provable optimization goal that permits stronger erasure without side effects. If correct, models could erase targeted information more thoroughly while keeping accuracy on everything else intact.

Core claim

BARRIER encapsulates the target forget region within a bounding hypercube using SVD-based projections of the activation space and interval arithmetic. Unlearning updates are driven exclusively inside this forget interval while the model response on the complement is mathematically bounded, yielding a probabilistic tail bound on functional drift and rigorous protection of the retain distribution.

What carries the argument

The forget interval: a hypercube in SVD-projected activation space on which interval arithmetic separates updates from the retain region and produces a bound on functional drift.

If this is right

  • Unlearning can be made more aggressive inside the target region without risking damage to other representations.
  • Knowledge preservation becomes a formal target with a tail bound rather than an empirical check.
  • The same geometric construction applies to both classifiers and diffusion models while matching existing trade-offs.
  • Collateral damage is reduced because updates are confined and the complement is provably protected.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The bounding approach could be adapted to selective editing in reinforcement learning policies without affecting unrelated behaviors.
  • Similar interval constructions might stabilize continual learning by isolating task-specific activation regions.
  • If the hypercube bound scales to very large models, it could reduce the need for full retraining after data removal requests.

Load-bearing premise

SVD projections of the activation space can be enclosed in a hypercube tight enough that interval arithmetic on the complement stops any meaningful drift in behavior on retained data.

What would settle it

Run the unlearning procedure inside the defined interval on a trained model and check whether accuracy or output distribution on retain samples stays inside the predicted probabilistic bound.

Figures

Figures reproduced from arXiv: 2605.15737 by Dawid Damian Rymarczyk, Jan Miksa, Marcin Sendera, Patryk Krukowski, Przemys{\l}aw Spurek.

Figure 1
Figure 1. Figure 1: Although current leading unlearning methods [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: BARRIER can be integrated at arbitrary layers of a neural network to perform MU. Within [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Preprocessing stage for BARRIER. In this part, we identify forget subspaces which serves for unlearning and its compliment that assures preservation of other model’s capabilities. Note that, the low-rank projection is done via SVD. Subspace Extraction. Let Xf ∈ R N×D de￾note the matrix of activations produced by the forget set at a given layer. We first compute the empirical mean µ = 1 N PN i=1 xi , and ce… view at source ↗
Figure 5
Figure 5. Figure 5: Qualitative comparison of NSFW concept unlearning across different methods on Flux.1 [dev] using adversarial prompts from the I2P dataset. BARRIER successfully limits the generation of explicit content while maintaining overall visual fidelity. As shown in [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Impact of protected network layers on model behavior during unlearning on the CIFAR￾10 dataset using ResNet-18. Weight Manipulation and Gradient Trajec￾tories. Approximate unlearning bypasses re￾training by editing weights via distillation (SCRUB [32]), saliency (SalUn [11]), shadow classes (Boundary Unlearning [6]), gradient surgery (PGU [25], LUR [42], EUPMU [61]), and other regularizers or subspace proj… view at source ↗
Figure 7
Figure 7. Figure 7: Qualitative DDPM sam￾ples on CIFAR-10. The “airplane” class is overwritten by the “automo￾bile” class while preserving genera￾tion fidelity. BARRIER demonstrates extraordinary parameter efficiency by modifying a mere 0.46% of the network parameters. This sig￾nificantly outperforms standard baselines like SalUn (50%) and SEMU (1.18-1.44%). Notably, BARRIER secures the high￾est Test Accuracy (TA) across eval… view at source ↗
Figure 8
Figure 8. Figure 8: Extended qualitative comparison of NSFW concept unlearning across methods in Stable [PITH_FULL_IMAGE:figures/full_fig_p017_8.png] view at source ↗
read the original abstract

Machine unlearning has reached a critical bottleneck. As traditional weight-space interventions focus primarily on erasing targeted concepts, they often fail to prevent the unintended suppression of other significant representations. This leads to substantial collateral damage, with essential knowledge being forgotten, because these methods lack formal mathematical guarantees for the preservation of neutral concepts. To avoid degradation, they are frequently forced into conservative updates. We propose BARRIER (Bounded Activation Regions for Robust Information Erasure), a paradigm-shifting framework that shifts the locus of intervention from static model weights to the dynamic geometry of hidden-layer activations. Unlike existing methods, BARRIER employs Interval Arithmetic (IA) on SVD-based projections of the activation space to encapsulate the specific target region within a bounding hypercube. By driving unlearning updates exclusively within this forget interval and mathematically bounding the model response on the complement, we ensure rigorous protection of the retain distribution. This geometric construction transforms the preservation of knowledge from an empirical heuristic into a formal optimization target with a probabilistic tail bound on functional drift. Crucially, this stability permits highly aggressive unlearning updates within the forget region. Empirical evaluations demonstrate that BARRIER matches state-of-the-art trade-offs across classifiers and diffusion models, maximizing targeted concept erasure while safeguarding the integrity of all other representations. Our code is available at https://github.com/OneAndZero24/BARRIER.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 0 minor

Summary. The paper proposes BARRIER, a framework for machine unlearning that shifts intervention to the geometry of hidden-layer activations. It uses SVD-based projections of the activation space, encapsulates the target forget region in a bounding hypercube via interval arithmetic (IA), restricts unlearning updates to this forget interval, and applies mathematical bounds on the complement to protect the retain distribution. The central claim is that this yields a probabilistic tail bound on functional drift, enabling aggressive unlearning while rigorously preserving neutral concepts, with empirical results matching SOTA trade-offs on classifiers and diffusion models.

Significance. If the geometric construction and tail bound hold with sufficient tightness, the work could meaningfully advance machine unlearning by converting preservation guarantees from empirical heuristics into a formal optimization target. The public code release at the cited GitHub repository is a clear strength supporting reproducibility.

major comments (2)
  1. Abstract (geometric construction paragraph): The claim that IA on SVD projections produces a 'probabilistic tail bound on functional drift' that 'rigorously' protects the retain distribution is load-bearing for the central contribution, yet the manuscript supplies no derivation of the tail bound, no explicit IA rules applied after the SVD projection, and no verification that the hypercube overapproximation remains tight enough to bound functional drift on retain data. Without these, the shift from heuristic to formal guarantee cannot be assessed.
  2. Abstract (SVD-based projections paragraph): The construction assumes that a linear orthogonal SVD projection followed by hypercube bounding via IA sufficiently captures the retain complement despite nonlinear channel dependencies in activations. This assumption is central to the claim of independence from the retain-data fit, but no analysis of wrapping-effect overestimation or cross-term loss is provided to confirm the bound supports the stated tail guarantee.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed and constructive feedback on our manuscript. We address each major comment below with clarifications drawn from the paper and indicate the specific revisions we will incorporate to strengthen the presentation of the formal guarantees.

read point-by-point responses

  1. Referee: Abstract (geometric construction paragraph): The claim that IA on SVD projections produces a 'probabilistic tail bound on functional drift' that 'rigorously' protects the retain distribution is load-bearing for the central contribution, yet the manuscript supplies no derivation of the tail bound, no explicit IA rules applied after the SVD projection, and no verification that the hypercube overapproximation remains tight enough to bound functional drift on retain data. Without these, the shift from heuristic to formal guarantee cannot be assessed.

    Authors: We agree that the abstract would benefit from more explicit pointers to the supporting material. The probabilistic tail bound on functional drift is derived in Section 3.3 using the properties of interval arithmetic applied to the SVD-projected activations, combined with a concentration inequality over the retain complement. The specific IA rules (addition, multiplication, and enclosure operations) are defined immediately after the projection step in that section. To make this transparent, we will revise the abstract to reference Section 3.3 and expand the methods with a short verification subsection that reports empirical tightness checks on held-out retain samples. revision: yes

  2. Referee: Abstract (SVD-based projections paragraph): The construction assumes that a linear orthogonal SVD projection followed by hypercube bounding via IA sufficiently captures the retain complement despite nonlinear channel dependencies in activations. This assumption is central to the claim of independence from the retain-data fit, but no analysis of wrapping-effect overestimation or cross-term loss is provided to confirm the bound supports the stated tail guarantee.

    Authors: The referee correctly notes that nonlinear channel dependencies can induce wrapping effects and cross-term inflation in the hypercube enclosure. While the orthogonality of the SVD projection preserves Euclidean norms and the tail bound is formulated conservatively to absorb over-approximation error, the current manuscript does not quantify the wrapping contribution explicitly. In the revision we will add a short proposition in Section 3.4 that bounds the additional overestimation due to wrapping and cross-terms, showing that the probabilistic tail guarantee remains valid (though possibly looser). We will also include a brief empirical comparison of hypercube versus tighter zonotope enclosures on retain activations. revision: partial

Circularity Check

0 steps flagged

No significant circularity; geometric bounding construction presented as independent of retain-set fit

full rationale

The paper's derivation centers on applying SVD projections followed by interval arithmetic to define a forget hypercube, then bounding model responses on the complement to obtain a probabilistic tail bound on functional drift. No equations or steps are exhibited that reduce this tail bound or protection guarantee back to a fitted parameter or objective defined by the unlearning updates themselves. The construction is explicitly framed as transforming an empirical heuristic into a formal target, with the bounding step treated as an independent geometric property rather than a self-referential fit. Self-citations, if present, are not load-bearing for the core claim, and the paper remains self-contained against external benchmarks for the formal guarantee. This yields a minor score reflecting normal academic self-reference without definitional collapse.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The approach rests on standard properties of interval arithmetic and SVD being sufficient to isolate target activations without significant information loss outside the hypercube.

axioms (1)
  • standard math Interval arithmetic operations produce valid enclosures for the model response on the complement of the forget hypercube.
    Invoked when claiming mathematical bounding of the retain distribution.

pith-pipeline@v0.9.0 · 5787 in / 1184 out tokens · 44726 ms · 2026-05-20T19:09:43.791242+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

What do these tags mean?
matches
The paper's claim is directly supported by a theorem in the formal canon.
supports
The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends
The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses
The paper appears to rely on the theorem as machinery.
contradicts
The paper's claim conflicts with a theorem or certificate in the canon.
unclear
Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

62 extracted references · 62 canonical work pages · 3 internal anchors

  1. [1]

    M., Basaran, U

    Ahmed, S. M., Basaran, U. Y ., Raychaudhuri, D. S., Dutta, A., Kundu, R., Niloy, F. F., Guler, B., and Roy-Chowdhury, A. K. Towards source-free machine unlearning. InProceedings of the Computer Vision and Pattern Recognition Conference (CVPR), pp. 4948–4957, June 2025

    work page 2025

  2. [2]

    Now Next Later AI, 2024

    Almeida, I.Responsible AI in the Age of Generative Models: Governance, Ethics and Risk Management. Now Next Later AI, 2024

    work page 2024

  3. [3]

    Nudenet: Lightweight nudity detection

    Bedapudi, P. Nudenet: Lightweight nudity detection. https://github.com/notAI-tech/ NudeNet, 2022

    work page 2022

  4. [4]

    A., Jia, H., Travers, A., Zhang, B., Lie, D., and Papernot, N

    Bourtoule, L., Chandrasekaran, V ., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., and Papernot, N. Machine unlearning. In2021 IEEE symposium on security and privacy (SP), pp. 141–159. IEEE, 2021

    work page 2021

  5. [5]

    Erasing undesirable concepts in diffusion models with adversarial preservation

    Bui, A., Vuong, L., Doan, K., Le, T., Montague, P., Abraham, T., and Phung, D. Erasing undesirable concepts in diffusion models with adversarial preservation. 2024

    work page 2024

  6. [6]

    Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary

    Chen, M., Gao, W., Liu, G., Peng, K., and Wang, C. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7766–7775, June 2023

    work page 2023

  7. [7]

    Score forgetting distillation: A swift, data-free method for machine unlearning in diffusion models

    Chen, T., Zhang, S., and Zhou, M. Score forgetting distillation: A swift, data-free method for machine unlearning in diffusion models. InThe Thirteenth International Conference on Learning Representations, 2025

    work page 2025

  8. [8]

    and Deja, K

    Cywi´nski, B. and Deja, K. Saeuron: Interpretable concept unlearning in diffusion models with sparse autoencoders.arXiv preprint arXiv:2501.18052, 2025

    work page arXiv 2025

  9. [9]

    On effects of steering latent representation for large language model unlearning

    Dang, H.-T., Pham, T., Thanh-Tung, H., and Inoue, N. On effects of steering latent representation for large language model unlearning. InProceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 23733–23742, 2025

    work page 2025

  10. [10]

    Forget Many, Forget Right: Scalable and Precise Concept Unlearning in Diffusion Models

    Deng, K., Li, G., Xiao, Y ., Hui, B., and Ma, X. Forget many, forget right: Scalable and precise concept unlearning in diffusion models.arXiv preprint arXiv:2601.06162, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  11. [11]

    SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation

    Fan, C., Liu, J., Zhang, Y ., Wong, E., Wei, D., and Liu, S. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  12. [12]

    Towards llm unlearning resilient to relearning attacks: A sharpness-aware minimization perspective and beyond.arXiv preprint arXiv:2502.05374, 2025

    Fan, C., Jia, J., Zhang, Y ., Ramakrishna, A., Hong, M., and Liu, S. Towards llm unlearning resilient to relearning attacks: A sharpness-aware minimization perspective and beyond.arXiv preprint arXiv:2502.05374, 2025. 10

    work page arXiv 2025

  13. [13]

    Casteer: Cross-attention steering for controllable concept erasure.arXiv preprint arXiv:2503.09630, 2025

    Gaintseva, T., Oncescu, A.-M., Ma, C., Liu, Z., Benning, M., Slabaugh, G., Deng, J., and Elezi, I. Casteer: Cross-attention steering for controllable concept erasure.arXiv preprint arXiv:2503.09630, 2025

    work page arXiv 2025

  14. [14]

    Erasing concepts from diffusion models

    Gandikota, R., Materzynska, J., Fiotto-Kaufman, J., and Bau, D. Erasing concepts from diffusion models. InProceedings of the IEEE/CVF international conference on computer vision, pp. 2426–2436, 2023

    work page 2023

  15. [15]

    Unified concept editing in diffusion models

    Gandikota, R., Orgad, H., Belinkov, Y ., Materzy´nska, J., and Bau, D. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF winter conference on applications of computer vision, pp. 5111–5120, 2024

    work page 2024

  16. [16]

    Eraseanything: Enabling concept erasure in rectified flow transformers.ICML 2025, 2024

    Gao, D., Lu, S., Walters, S., Zhou, W., Chu, J., Zhang, J., Zhang, B., Jia, M., Zhao, J., Fan, Z., et al. Eraseanything: Enabling concept erasure in rectified flow transformers.ICML 2025, 2024

    work page 2025

  17. [17]

    Meta-unlearning on diffusion models: Preventing relearning unlearned concepts

    Gao, H., Pang, T., Du, C., Hu, T., Deng, Z., and Lin, M. Meta-unlearning on diffusion models: Preventing relearning unlearned concepts. InProceedings of the IEEE/CVF International Conference on Computer Vision, pp. 2131–2141, 2025

    work page 2025

  18. [18]

    N., Chittepu, R

    George, N., Dasaraju, K. N., Chittepu, R. R., and Mopuri, K. R. The illusion of unlearning: The unstable nature of machine unlearning in text-to-image diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 13393–13402, June 2025

    work page 2025

  19. [19]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks

    Golatkar, A., Achille, A., and Soatto, S. Eternal sunshine of the spotless net: Selective forgetting in deep networks. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 9304–9312, 2020

    work page 2020

  20. [20]

    Reliable and efficient concept erasure of text-to-image diffusion models

    Gong, C., Chen, K., Wei, Z., Chen, J., and Jiang, Y .-G. Reliable and efficient concept erasure of text-to-image diffusion models. InEuropean Conference on Computer Vision, pp. 73–88. Springer, 2024

    work page 2024

  21. [21]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778, 2016

    work page 2016

  22. [22]

    and Soh, H

    Heng, A. and Soh, H. Selective amnesia: A continual learning approach to forgetting in deep generative models.Advances in Neural Information Processing Systems, 36:17170–17194, 2023

    work page 2023

  23. [23]

    Clipscore: A reference-free evaluation metric for image captioning

    Hessel, J., Holtzman, A., Forbes, M., Le Bras, R., and Choi, Y . Clipscore: A reference-free evaluation metric for image captioning. InProceedings of the 2021 conference on empirical methods in natural language processing, pp. 7514–7528, 2021

    work page 2021

  24. [24]

    Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    Ho, J., Jain, A., and Abbeel, P. Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    work page 2020

  25. [25]

    Learn to unlearn for deep neural networks: Minimizing unlearning interference with gradient projection

    Hoang, T., Rana, S., Gupta, S., and Venkatesh, S. Learn to unlearn for deep neural networks: Minimizing unlearning interference with gradient projection. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 4819–4828, January 2024

    work page 2024

  26. [26]

    J., Shen, Y ., Wallis, P., Allen-Zhu, Z., Li, Y ., Wang, S., Wang, L., Chen, W., et al

    Hu, E. J., Shen, Y ., Wallis, P., Allen-Zhu, Z., Li, Y ., Wang, S., Wang, L., Chen, W., et al. Lora: Low-rank adaptation of large language models.Iclr, 1(2):3, 2022

    work page 2022

  27. [27]

    A., Chaudhuri, K., and Zou, J

    Izzo, Z., Smart, M. A., Chaudhuri, K., and Zou, J. Approximate data deletion from machine learning models. InInternational conference on artificial intelligence and statistics, pp. 2008–

    work page 2008

  28. [28]

    Model sparsity can simplify machine unlearning.Advances in Neural Information Processing Systems, 36: 51584–51605, 2023

    Jia, J., Liu, J., Ram, P., Yao, Y ., Liu, G., Liu, Y ., Sharma, P., and Liu, S. Model sparsity can simplify machine unlearning.Advances in Neural Information Processing Systems, 36: 51584–51605, 2023

    work page 2023

  29. [29]

    Learning multiple layers of features from tiny images

    Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. 2009. 11

    work page 2009

  30. [30]

    Intact: Interval- based task activation consolidation for continual learning, 2025

    Krukowski, P., Miksa, J., Helm, P., Tabor, J., Wawrzy´nski, P., and Spurek, P. Intact: Interval- based task activation consolidation for continual learning, 2025. URL https://arxiv.org/ abs/2511.17439

    work page arXiv 2025

  31. [31]

    Ablating concepts in text-to-image diffusion models

    Kumari, N., Zhang, B., Wang, S.-Y ., Shechtman, E., Zhang, R., and Zhu, J.-Y . Ablating concepts in text-to-image diffusion models. InProceedings of the IEEE/CVF international conference on computer vision, pp. 22691–22702, 2023

    work page 2023

  32. [32]

    Towards unbounded machine unlearning

    Kurmanji, M., Triantafillou, P., Hayes, J., and Triantafillou, E. Towards unbounded machine unlearning. InAdvances in neural information processing systems, volume 36, pp. 1957–1987, 2023

    work page 1957

  33. [33]

    Labs, B. F. Flux.https://github.com/black-forest-labs/flux, 2024

    work page 2024

  34. [34]

    H., Lim, S., and Chun, S

    Lee, B. H., Lim, S., and Chun, S. Y . Localized concept erasure for text-to-image diffusion models using training-free gated low-rank adaptation. InProceedings of the Computer Vision and Pattern Recognition Conference, pp. 18596–18606, 2025

    work page 2025

  35. [35]

    H., Lim, S., Lee, S., Kang, D

    Lee, B. H., Lim, S., Lee, S., Kang, D. U., and Chun, S. Y . Concept pinpoint eraser for text-to-image diffusion models via residual attention gate.arXiv preprint arXiv:2506.22806, 2025

    work page arXiv 2025

  36. [36]

    The Illusion of Forgetting: Attack Unlearned Diffusion via Initial Latent Variable Optimization

    Li, M., Liu, Y ., Jiang, L., Li, B., Li, Y ., and Hu, W. The illusion of forgetting: Attack unlearned diffusion via initial latent variable optimization.arXiv preprint arXiv:2602.00175, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  37. [37]

    Cat: Cross attention in vision transformer

    Lin, H., Cheng, X., Wu, X., and Shen, D. Cat: Cross attention in vision transformer. In2022 IEEE international conference on multimedia and expo (ICME), pp. 1–6. IEEE, 2022

    work page 2022

  38. [38]

    Lin, T.-Y ., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., and Zitnick, C. L. Microsoft coco: Common objects in context. InEuropean conference on computer vision, pp. 740–755. Springer, 2014

    work page 2014

  39. [39]

    Lu, S., Wang, Z., Li, L., Liu, Y ., and Kong, A. W.-K. Mace: Mass concept erasure in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6430–6440, 2024

    work page 2024

  40. [40]

    Suma: A subspace mapping approach for robust and effective concept erasure in text-to-image diffusion models

    Nguyen, K., Tran, A., and Pham, C. Suma: A subspace mapping approach for robust and effective concept erasure in text-to-image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pp. 19587–19596, 2025

    work page 2025

  41. [41]

    Re-thinking model inversion attacks against deep neural networks

    Nguyen, N.-B., Chandrasegaran, K., Abdollahzadeh, M., and Cheung, N.-M. Re-thinking model inversion attacks against deep neural networks. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 16384–16393, 2023

    work page 2023

  42. [42]

    and Qiu, Q

    Patel, G. and Qiu, Q. Learning to unlearn while retaining: Combating gradient conflicts in machine unlearning. InProceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4211–4221, 2025

    work page 2025

  43. [43]

    Unguide: Learning to forget with lora-guided diffusion models.arXiv preprint arXiv:2508.05755, 2025

    Polowczyk, A., Polowczyk, A., Malarz, D., Kasymov, A., Mazur, M., Tabor, J., and Spurek, P. Unguide: Learning to forget with lora-guided diffusion models.arXiv preprint arXiv:2508.05755, 2025

    work page arXiv 2025

  44. [44]

    High-resolution image synthesis with latent diffusion models

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10684–10695, 2022

    work page 2022

  45. [45]

    U-net: Convolutional networks for biomedical image segmentation

    Ronneberger, O., Fischer, P., and Brox, T. U-net: Convolutional networks for biomedical image segmentation. InInternational Conference on Medical image computing and computer-assisted intervention, pp. 234–241. Springer, 2015

    work page 2015

  46. [46]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models

    Schramowski, P., Brack, M., Deiseroth, B., and Kersting, K. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22522–22531, 2023. 12

    work page 2023

  47. [47]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models, 2023

    Schramowski, P., Brack, M., Deiseroth, B., and Kersting, K. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models, 2023. URL https://arxiv.org/abs/2211. 05105

    work page 2023

  48. [48]

    Sendera, M., Struski, Ł., Ksi ˛ a˙zek, K., Musiol, K., Tabor, J., and Rymarczyk, D. D. Semu: Singular value decomposition for efficient machine unlearning. InInternational Conference on Machine Learning, pp. 53843–53866. PMLR, 2025

    work page 2025

  49. [49]

    Revisiting machine unlearning with dimensional alignment

    Seo, S., Kim, D., and Han, B. Revisiting machine unlearning with dimensional alignment. InProceedings of the Winter Conference on Applications of Computer Vision (WACV), pp. 3206–3215, February 2025

    work page 2025

  50. [50]

    Shen and Xinchi Qiu and Meghdad Kurmanji and Alex Iacob and Lorenzo Sani and Yihong Chen and Nicola Cancedda and Nicholas D

    Shen, W. F., Qiu, X., Kurmanji, M., Iacob, A., Sani, L., Chen, Y ., Cancedda, N., and Lane, N. D. Llm unlearning via neural activation redirection.arXiv preprint arXiv:2502.07218, 2025

    work page arXiv 2025

  51. [51]

    N., Semertzidis, T., Gavves, E., and Daras, P

    Spartalis, C. N., Semertzidis, T., Gavves, E., and Daras, P. Lotus: Large-scale machine unlearning with a taste of uncertainty. InProceedings of the Computer Vision and Pattern Recognition Conference, pp. 10046–10055, 2025

    work page 2025

  52. [52]

    M., and Nandakumar, K

    Srivatsan, K., Shamshad, F., Naseer, M., Patel, V . M., and Nandakumar, K. Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 23765–23774, 2025

    work page 2025

  53. [53]

    Acterase: A training-free paradigm for precise concept erasure via activation patching.arXiv preprint arXiv:2601.00267, 2026

    Sun, Y ., Zhong, X., Li, H., Zhou, Y ., Li, J., Chen, B., and Wang, X. Acterase: A training-free paradigm for precise concept erasure via activation patching.arXiv preprint arXiv:2601.00267, 2026

    work page arXiv 2026

  54. [54]

    Fine-grained erasure in text-to- image diffusion-based foundation models

    Thakral, K., Glaser, T., Hassner, T., Vatsa, M., and Singh, R. Fine-grained erasure in text-to- image diffusion-based foundation models. InProceedings of the Computer Vision and Pattern Recognition Conference (CVPR), pp. 9121–9130, June 2025

    work page 2025

  55. [55]

    Unrolling sgd: Understanding factors influencing machine unlearning

    Thudi, A., Deza, G., Chandrasekaran, V ., and Papernot, N. Unrolling sgd: Understanding factors influencing machine unlearning. In2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pp. 303–319. IEEE, 2022

    work page 2022

  56. [56]

    Mass concept erasure in diffusion models with concept hierarchy.arXiv preprint arXiv:2601.03305, 2026

    Tu, J., Li, Y ., Wu, Y ., Zhao, H., Zhang, C., and Qian, H. Mass concept erasure in diffusion models with concept hierarchy.arXiv preprint arXiv:2601.03305, 2026

    work page arXiv 2026

  57. [57]

    Machine unlearning of features and labels.arXiv preprint arXiv:2108.11577, 2021

    Warnecke, A., Pirch, L., Wressnegger, C., and Rieck, K. Machine unlearning of features and labels.arXiv preprint arXiv:2108.11577, 2021

    work page arXiv 2021

  58. [58]

    Unhype: Clip-guided hypernetworks for dynamic lora unlearning.arXiv preprint arXiv:2602.03410, 2026

    Wójcik, P., Petrenko, M., Gromski, W., Spurek, P., and Zieba, M. Unhype: Clip-guided hypernetworks for dynamic lora unlearning.arXiv preprint arXiv:2602.03410, 2026

    work page arXiv 2026

  59. [59]

    Semantic surgery: Zero-shot concept erasure in diffusion models.arXiv preprint arXiv:2510.22851, 2025

    Xiong, L., Liu, C., Ye, J., Liu, Y ., and Xu, Y . Semantic surgery: Zero-shot concept erasure in diffusion models.arXiv preprint arXiv:2510.22851, 2025

    work page arXiv 2025

  60. [60]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Zhang, G., Wang, K., Xu, X., Wang, Z., and Shi, H. Forget-me-not: Learning to forget in text-to-image diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 1755–1764, 2024

    work page 2024

  61. [61]

    Efficient utility- preserving machine unlearning with implicit gradient surgery.arXiv preprint arXiv:2510.22124, 2025

    Zhou, S., Yu, T., Zhang, Z., Chang, H., Zhou, X., Wu, D., and Zhao, H. Efficient utility- preserving machine unlearning with implicit gradient surgery.arXiv preprint arXiv:2510.22124, 2025

    work page arXiv 2025

  62. [62]

    right to be forgotten

    Zhou, Y ., Zheng, D., Mo, Q., Lu, R., Lin, K.-Y ., and Zheng, W.-S. Decoupled distillation to erase: A general unlearning method for any class-centric tasks. InProceedings of the Computer Vision and Pattern Recognition Conference, pp. 20350–20359, 2025. 13 A Limitations, Impact, Reproducibility and LLMs usage Limitations.While our experiments show that pr...

    work page 2025