Similarity-Aware Machine Unlearning

Haripriya Harikumar; Madhavan Citalamangalam Kumaran; Midhun Parakkal Unni; Vicky Kouni

REVIEW 4 major objections 5 minor 27 references

Similarity-Aware Machine Unlearning

T0 review · 4 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Localization-based machine unlearning that scores parameters against both the forget set and the retain set reduces collateral damage to similar retained examples, cutting the retain-similar accuracy gap from 0.49 to 0.04 on CIFAR-10/ResNet

desk verdict Retain-aware localization is a plausible idea, but the 'consistent' claim does not survive its own Table 1, and the evidence is one run on one dataset. read the letter →

arxiv 2608.00246 v1 pith:3O2AMI4A submitted 2026-07-31 cs.LG

Madhavan Citalamangalam Kumaran , Midhun Parakkal Unni , Vicky Kouni , Haripriya Harikumar This is my paper · ORCID

classification cs.LG

keywords machineunlearninglocalizedretain-awarelocalizationcollateraldamagefeatureentanglementcriticalityscoreCIFAR-10ResNet-18

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Machine unlearning methods that localize edits to the most 'forget-important' parameters can degrade retained examples that are similar to the forgotten ones. This paper claims the fix is to make localization 'retain-aware': compute criticality scores on both the forget set and the retain set, then select parameters that are important to forgetting but not to retention. On CIFAR-10 with ResNet-18, the subsampled difference variant reduces the retain-similar accuracy gap from 0.49 to 0.04 while improving other unlearning metrics, with negligible added cost. If correct, this means similarity-aware parameter selection can make approximate unlearning considerably less destructive for semantically related data.

What carries the argument

The central object is the criticality score $s_j = |\theta_j \cdot g(\theta_j, D)|$, which measures how strongly a parameter's current value participates in the loss over a dataset D. The paper computes it on the forget set and on the retain set, then combines the two via three rules; the operative one is the difference rule $\tilde{s}_j = \max(s_{f_j} - s_{r_j}, 0)$, which zeros out any neuron whose retain importance matches or exceeds its forget importance. A binary mask selects the top-30% of parameters by this score, re-initializes them, and fine-tunes only that subset on the retain set. The second mechanism is the retain-similar set $D_{r,\text{sim}}$: for each forget example, its same-class nearest retain neighbor by co

What would settle it

Repeat the protocol on CIFAR-10/ResNet-18 but construct the retain-similar set from the held-out test set (nearest test example to each forget example) instead of the retain training set; if the difference method shows no improvement in retain-similar accuracy over the forget-only baseline on that test-derived set, the collateral-damage claim is limited to re-fitting the training set. Additionally, retrain the oracle with 50 epochs to see whether the reported gaps still hold.

Watch

Extended reading notes

Core claim

Working within the localized machine unlearning paradigm, the paper identifies feature entanglement as the cause of collateral damage: forget and retain samples that are close in the model's embedding space activate overlapping neurons, so resetting forget-important channels can also erase representations needed by similar retained examples. To counter this, the authors assign each parameter a criticality score computed separately on the forget and retain sets and combine them—most simply by subtracting retain importance from forget importance and clamping at zero—so that shared neurons are excluded from the reset mask. The paper's headline result is that this difference-based localization,

Load-bearing premise

The retain-similar evaluation set is built from retain training examples, so accuracy on it is partly a training-fit measure, and the oracle model used as the gold standard was trained with fewer epochs (35 vs 50) than the original model.

Editorial extensions

If this is right

Retain-aware localization consistently reduces collateral damage on Dr,sim compared with forget-only localization across all 11 experimental settings.
The subsampled difference method improves standard unlearning metrics (Δtest, Δretain, Δforget, ΔMIA, KL) over the baseline, not just the new retain-similar metric.
Subsampling the retain set for scoring is both cheaper (2 seconds vs 6 seconds) and empirically better than using the full retain set for the difference rule.
The ratio method, which lacks an absolute forget-importance threshold, fails to unlearn (Δforget = -3.86), implying that retain-aware scoring must retain a forget-side component to avoid under-intervention.
Because this holds only on CIFAR-10/ResNet-18, the paper explicitly leaves generalization to larger datasets and architectures as future work.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The Dr,sim construction—nearest same-class neighbor from the retain training set—is specific to training data; an analogous 'test-similar' set built from held-out examples would test whether the collateral damage reduction generalizes outside the training distribution.
The subsampling-vs-full-retain result invites a sharper version: sample the retain set by similarity to the forget set rather than uniformly, potentially aligning the mask even better with the forget-similar boundary.
The difference rule effectively implements per-neuron 'specificity' filtering; a natural extension is to combine it with per-layer or per-block budget allocation to trade off utility per semantic region rather than globally.
A concrete downstream test: applying this localization before membership-inference attacks on larger models (e.g., transformers) would show whether embedding-space entanglement is a general failure mode of localization-based unlearning.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here is the quick read. The paper has a real idea worth keeping: when you localize unlearning to a parameter subset, you should look at importance to the retain set, not just the forget set. The difference scoring scheme makes sense, and the retain-similar evaluation set is a reasonable attempt to measure what people in this area actually worry about. The subsampled difference result is genuinely encouraging on the numbers: all retain-side deltas drop to near zero while forgetting stays close to oracle accuracy.

The problems are in the packaging. The abstract and the discussion keep saying "consistently reduces collateral damage," which is not what Table 1 shows. Four of the ten proposed variants have higher Δrs than the forget-only baseline, and the ratio variants under-forget badly. The only condition that cleanly supports the story is the subsampled difference, and the report singles it out after the fact. That is fine in an exploratory paper, but not as a blanket claim.

The empirics are also thin: one dataset (CIFAR-10), one model (ResNet-18), and no repeated seeds or error bars. For unlearning, where variance across runs is usually meaningful, that is a real limitation. The Dr,sim set is built from the same retain training set used for fine-tuning, so Δrs tells you about recovery of training examples, not about generalization to similar held-out data. That makes it a valid memorization/recovery metric, but the authors should not call it "collateral damage" in the broader sense without a held-out variant.

I also note the oracle is trained for 35 epochs versus 50 for the original. That may be fine (oracle accuracy is 85.91%, close to typical), but it should be justified. And the fine-tuning epoch count isn't reported except "same as [24]." That is a reproducibility gap.

What is genuinely good: the paper ablates subsampling, the weight parameter, and fine-tuning size; it reports runtimes; and it is honest that the ratio method fails. Those are signs of careful work, not sloppiness.

Bottom line: the core idea is worth a serious referee and likely worth retaining in the literature, but the paper overclaims. It deserves major revision with seeds, error bars, a toned-down abstract, and ideally a held-out similar test set.

Referee Report

4 major / 5 minor

Summary. The paper proposes a retain-aware localization method for machine unlearning. Unlike existing localization approaches that select parameters using forget-set importance only, it computes criticality scores on both the forget set and the retain set and combines them via difference, weighted-difference, or ratio scoring. A localization mask selects a 30% parameter budget, selected weights are reinitialized, and the model is fine-tuned on the retain set. The paper also introduces a retain-similar evaluation set Dr,sim, consisting of the nearest same-class retain-set neighbours of forget examples in the original model's embedding space. Experiments on CIFAR-10/ResNet-18 report that the proposed method reduces collateral damage while improving standard unlearning metrics compared to the forget-only DEL baseline.

Significance. If the results held, the retain-aware localization idea would be a useful extension of localization-based unlearning: it targets a real problem (feature entanglement between forget and retain data), has negligible computational overhead, and the retain-similar evaluation idea is worth exploring. The paper is clearly written, uses a public dataset and architecture, and reports wall-clock times and some sensitivity analysis. However, the headline claim of consistent improvement is contradicted by the paper's own Table 1, and the primary collateral-damage metric is constructed from the fine-tuning set, so the empirical evidence does not support the stated conclusions.

major comments (4)

[§4.4, Table 1] The abstract states that the method 'consistently reduces collateral damage while improving standard unlearning metrics' across eleven settings. Table 1 does not support this. For Δrs, four proposed variants exceed the forget_only baseline: w_diff/Yes/w=3 (0.35), w_diff/No/w=5 (0.33), w_diff/Yes/w=7 (0.33), and w_diff/No/w=7 (0.44), all above the baseline's 0.31. The two ratio variants have Δforget = −3.86/−3.74, indicating severe under-forgetting relative to the oracle, and KL divergence 0.479/0.482, above the baseline's 0.443. Only the two difference variants show both lower Δrs and acceptable forgetting. The paper itself acknowledges the ratio failure in §4.4. Thus the 'consistent' claim is post-hoc selection of the subsampled difference variant, not a general property of the proposed family.
[§4.1, Eq. (10)] Dr,sim is constructed as the nearest same-class retain-set neighbours under the original model's embeddings and is therefore a subset of Dr, the fine-tuning set. Consequently Δrs measures how accurately the unlearned model recovers specific training examples after fine-tuning, not damage to similar held-out examples. The metric may be artificially favourable because both the unlearned and oracle models are trained on the exact Dr,sim examples. To directly measure collateral damage, the evaluation set should use held-out similar examples (e.g., nearest test-set neighbours). The paper's assertion that Δrs 'directly measures collateral damage' is therefore not established.
[§4.4, Table 1] All results are single-run point estimates with no error bars, confidence intervals, or repeated-seed experiments. Several differences used to support the headline claim are small (e.g., Δrs 0.04 vs 0.11; Δretain 0.11 vs 0.20; KL 0.395 vs 0.413). Without variance information, it is impossible to assess whether these differences are meaningful. The lack of multiple runs is especially problematic because the paper's central claim is about consistent improvement across conditions.
[§4.2 and §4.4] The oracle model is trained for 35 epochs while the original model is trained for 50 epochs. Since the oracle is the reference for all deltas, this asymmetric training schedule may systematically bias the results: the oracle is less converged, which could inflate positive deltas. In particular, the oracle reports 100% retain accuracy despite being trained for fewer epochs, which is surprising and should be justified. The paper should either train the oracle for the same number of epochs (or use validation-based early stopping) and show sensitivity to this choice.

minor comments (5)

[§4.1, Eq. (10)] The text says that sim(xf, xr) is computed by (4), but Definition 4 is Equation (3). The equation reference should be corrected.
[§3.1] Definition 6 says the gradient g(θo_j, D) is computed over the forget set, but the method later computes criticality scores on the retain set as well. Clarify that Eq. (5) applies to any dataset D.
[§4.4] The phrase 'non-sampling is better at w=3' uses 'non-sampling' where 'non-subsampled' is meant. Please fix this wording.
[Table 1] The table caption says 'Bold letters indicate the best results,' but no bold formatting is visible in the table. Either render the bold in the final version or remove the caption sentence.
[§4.4 and Conclusion] The conclusion states that 'these results demonstrate that retain-aware localization preserves shared representations more effectively than forget-only localization,' but this is only shown for the subsampled difference variant, and with a single run. Please temper the wording to match the evidence.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the retain-aware localization results rest on ordinary empirical comparison, not on definitional identity.

full rationale

The paper's derivation chain is: define parameter and neuron criticality scores (Eqs. 5-6), combine forget- and retain-set scores via difference, weighted-difference, or ratio rules (Eqs. 7-9), build a mask, reinitialize and fine-tune on the retain set, and finally compare to an oracle using delta metrics (Eqs. 11-15). The central claimed quantity, Δrs, is measured on Dr,sim, a subset of the retain set Dr, but the method does not directly optimize Δrs: mask selection uses gradient criticality on Df and Dr, and fine-tuning is standard cross-entropy on Dr. Thus no equation or construction makes the reported result identical to an input. The forget-only baseline is also fine-tuned on Dr, and the oracle is trained on Dr, so comparing Δrs across conditions is an empirical test of the stated hypothesis rather than a formal reduction. The evaluation is self-referential in the sense that Dr,sim is defined using the original model's embeddings and is a subset of the fine-tuning data, so Δrs is partly a training-set accuracy metric; however, this is a benchmark-validity or fairness concern, not circularity. The headline claim of 'consistent' improvement is also not supported by Table 1 (several weighted-difference variants have higher Δrs than the forget-only baseline), but that is a correctness/reporting issue, not a circularity issue. No load-bearing self-citations appear: the localization and memorization definitions cite external prior work ([24], [26]), and no uniqueness theorem is imported from the present authors. The derivation is therefore self-contained and not circular.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities. It relies on a set of heuristic assumptions about neural network interpretability (gradient-weight product, embedding similarity) and on several undisclosed or partially disclosed free parameters, which together limit the strength of the empirical claims.

free parameters (6)

α (mask budget) = 0.30
Fraction of parameters reinitialized; taken from DEL [24] but not varied or justified for this setting.
w (weighted-difference weight) = 3, 5, 7
Hand-chosen sweep values; the best result in the paper actually uses w=1 (unweighted difference), i.e., the weight is not tuned to a validation set.
h (top-h in neuron criticality) = not specified
Definition 7 averages top-h parameter criticality scores per neuron, but h is never given a value, so the method is underspecified.
Retain-set subsample size for criticality = 5000
A random subsample of 5,000 from Dr; no justification, no seed, no sensitivity analysis.
Fine-tuning epochs = not specified
The paper says 'same number of epochs as in [24]' but never states the count, leaving an unspecified free parameter.
ε in ratio method = 1e-8
Numerical stabilizer, but technically a free constant chosen by hand.

assumptions (4)

domain assumption The criticality score s_j = |θ_j · g_j| measures parameter importance for a dataset D.
The paper assumes gradient-weight product captures how much a parameter contributes to predictions on a dataset; no empirical or theoretical justification is given for this specific score.
domain assumption Cosine similarity in the original model's embedding space reflects semantic similarity between forget and retain examples.
Used to construct Dr,sim and to define feature entanglement; the learned embedding space of the model under test is assumed to be a faithful semantic space.
domain assumption Semantically similar examples share overlapping subsets of model parameters.
The paper motivates retain-aware localization by this overlap, but it is not directly verified, only illustrated with one Grad-CAM example.
domain assumption Reinitializing selected weights with Kaiming initialization followed by fine-tuning on the retain set produces a model close to the oracle.
The unlearning mechanism (reset + fine-tune) is assumed to approximate retraining from scratch; no convergence or guarantee is provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Similarity-Aware Machine Unlearning." pith.science (2026). https://pith.science/paper/3O2AMI4A

@misc{pith2026260800246,
  author       = {Pith},
  title        = {Pith review of: Similarity-Aware Machine Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3O2AMI4A}},
  note         = {Machine review of arXiv:2608.00246}
}

read the original abstract

Machine unlearning removes the influence of user-specified training examples from a trained model, avoiding the need to retrain it from scratch. Localization-based methods improve unlearning efficiency by identifying a subset of influential model parameters. However, existing approaches select parameters based solely on forget-set importance, neglecting their role in retained dataset and often causing collateral damage to semantically similar retained examples. We address this limitation with a retain-aware localization method that considers parameter importance to both forgotten and retained data. We also introduce a retain-similar evaluation set, constructed using cosine similarity in the model embedding space, to directly measure collateral damage. Across eleven experimental settings on CIFAR-10 dataset and ResNet18 model, our method consistently reduces collateral damage while improving standard unlearning metrics, demonstrating the effectiveness of retain-aware localization for similarity-aware machine unlearning.

Figures

Figures reproduced from arXiv: 2608.00246 by the authors.

**Figure 1.** Intermediate feature-space visualization showing that semantically similar samples are embedded close to one another within class-specific clusters. The image to forget (red) and the image to retain (green) occupy very close neighboring regions of the feature manifold, indicating shared feature representations. Consequently, forget-only localization can modify parameters used by both sets, causing unintended degrad… view at source ↗

**Figure 2.** Forget-set bird. Original (conf. 0.999): correctly classified with sparse scattered activations. Unlearned (conf. 0.901): misclassifies as cat; activation partially smeared, indicating loss of bird-discriminative features. Oracle (conf. 0.777): also misclassifies as cat, confirming the image sits near the bird/cat decision boundary [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗

**Figure 3.** Test-set automobile. Original (conf. 0.998): near-zero layer1 activation despite high confidence, indicating classification driven by deeper layers. Unlearned (conf. 0.672): strong structured activation along car edges and body lines. Oracle (conf. 0.991): similarly structured edge-following activation, closely resembling the unlearned model. Discussion of ∆rs metric Across conditions, ∆rs is generally smaller in m… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Forget/retain-similar ship pair (cosine similarity 0.998). Top: unlearning changes the forget-set activation from broad to sparse and localized. Bottom: the retain-similar image remains correctly classified with ship-focused attention, indicating limited collateral dam…

**Figure 5.** Figure 5: Training and validation loss (left) and accuracy (right) for the original model M(D) over 50 epochs. Training loss decreases monotonically to near-zero while validation loss stabilises around 0.33, reflecting the growing train-validation gap characteristic of overfitt…

**Figure 6.** Figure 6: Metric deltas as a function of weight w for subsampled and non-subsampled conditions. The difference method is treated as w = 1 (marked 1 ∗ on the x-axis). The black dotted horizontal line marks the forget_only baseline score on each metric as a reference. Each metric …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

27 extracted references · 1 linked inside Pith

[24]

Torkzadehmahani, R., Nasirigerdeh, R., Kaissis, G., Rueckert, D., Dziugaite, G.K., Triantafillou, E.: Improved Localized Machine Unlearning Through the Lens of Memorization (2024), https://arxiv.org/abs/2412.02432

arXiv 2024
[1]

In: Neural networks: tricks of the trade: second edition (2012)

Bottou, L.: Stochastic Gradient Descent Tricks. In: Neural networks: tricks of the trade: second edition (2012)

2012
[2]

In: 2021 IEEE symposium on security and privacy (SP) (2021)

Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C.A., Jia, H., Travers, A., Zhang, B., Lie, D., Papernot, N.: Machine Unlearning. In: 2021 IEEE symposium on security and privacy (SP) (2021)

2021
[3]

In: 2021 IEEE symposium on security and privacy (SP)

Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C.A., Jia, H., Travers, A., Zhang, B., Lie, D., Papernot, N.: Machine unlearning. In: 2021 IEEE symposium on security and privacy (SP). pp. 141–159. IEEE (2021)

2021
[4]

Broomhead, D.S., Lowe, D.: Radial Basis Functions, Multi-Variable Functional Interpolation and Adaptive Networks. Tech. rep. (1988)

1988
[5]

In: IEEE Symposium on Security and Privacy (2015)

Cao, Y., Yang, J.: Towards making systems forget with machine unlearning. In: IEEE Symposium on Security and Privacy (2015)

2015
[6]

In: 30th USENIX Security Symposium (2021)

Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., et al.: Extracting Training Data from Large Language Models. In: 30th USENIX Security Symposium (2021)

2021
[7]

Machine Learning (1995)

Cortes, C., Vapnik, V.: Support-vector networks. Machine Learning (1995)

1995

Show all 27 references

[8]

In: International Conference on Learning Representations (2024)

Fan, C., Liu, J., Zhang, Y., Wong, E., Wei, D., Liu, S.: SalUN: Empowering Ma- chine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation. In: International Conference on Learning Representations (2024)

2024
[9]

In: Proceedings of the 52nd annual ACM SIGACT symposium on theory of computing (2020)

Feldman, V.: Does learning require memorization? a short tale about a long tail. In: Proceedings of the 52nd annual ACM SIGACT symposium on theory of computing (2020)

2020
[10]

Advances in Neural Information Processing Systems (2020)

Feldman, V., Zhang, C.: What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimation. Advances in Neural Information Processing Systems (2020)

2020
[11]

In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (2015)

Fredrikson, M., Jha, S., Ristenpart, T.: Model Inversion Attacks that Exploit Con- fidence Information and Basic Countermeasures. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (2015)

2015
[12]

In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2020)

Golatkar, A., Achille, A., Soatto, S.: Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2020)

2020
[13]

In: Proceedings of the IEEE International Conference on Computer Vision (2015)

He, K., Zhang, X., Ren, S., Sun, J.: Delving Deep into Rectifiers: Surpassing Human-level Performance on ImageNet Classification. In: Proceedings of the IEEE International Conference on Computer Vision (2015)

2015
[14]

In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (2016)

He, K., Zhang, X., Ren, S., Sun, J.: Deep Residual Learning for Image Recogni- tion. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (2016)

2016
[15]

Krizhevsky, A., Hinton, G., et al.: Learning Multiple Layers of Features from Tiny Images (2009)

2009
[16]

In: International Conference on Learning Representations (2017)

Loshchilov, I., Hutter, F.: SGDR: Stochastic gradient descent with warm restarts. In: International Conference on Learning Representations (2017)

2017
[17]

Advances in Neural Information Processing Systems (2020)

Nguyen, Q.P., Low, B.K.H., Jaillet, P.: Variational Bayesian Unlearning. Advances in Neural Information Processing Systems (2020)

2020
[18]

ACM Transactions on Intelligent Systems and Technology (2025)

Nguyen,T.T.,Huynh,T.T.,Ren,Z.,Nguyen,P.L.,Liew,A.W.C.,Yin,H.,Nguyen, Q.V.H.: A survey of machine unlearning. ACM Transactions on Intelligent Systems and Technology (2025)

2025
[19]

Journal of Technology Law & Policy (2018) 16 Madhavan Citalamangalam Kumaran et al

Pardau, S.L.: The California Consumer Privacy Act: Towards a European-Style Privacy Regime in the United States. Journal of Technology Law & Policy (2018) 16 Madhavan Citalamangalam Kumaran et al

2018
[20]

Raab, C.D.: The Distribution of Privacy Risks: Who Needs Protection? The infor- mation society (1998)

1998
[21]

Harvard law review (2004)

Schwartz, P.M.: Property, Privacy, and Personal Data. Harvard law review (2004)

2004
[22]

In: Proceedings of the IEEE International Conference on Computer Vision (2017)

Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., Batra, D.: Grad- CAM: Visual Explanations from Deep Networks via Gradient-based Localization. In: Proceedings of the IEEE International Conference on Computer Vision (2017)

2017
[23]

In: 2017 IEEE symposium on security and privacy (SP) (2017)

Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership Inference Attacks Against Machine Learning Models. In: 2017 IEEE symposium on security and privacy (SP) (2017)

2017
[25]

Springer, Cham (2017)

Voigt, P., Von dem Bussche, A.: The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer, Cham (2017)

2017
[26]

ACM Computing Surveys (2025)

Wei, J., Zhang, Y., Zhang, L.Y., Ding, M., Chen, C., Ong, K.L., Zhang, J., Xiang, Y.: Memorization in Deep Learning: A Survey. ACM Computing Surveys (2025)

2025
[27]

Xu, J., Wu, Z., Wang, C., Jia, X.: Machine Unlearning: Solutions and Challenges. IEEE Transactions on Emerging Topics in Computational Intelligence (2024) Similarity-Aware Machine Unlearning 17 Appendix Fig.5.Training and validation loss (left) and accuracy (right) for the ori...

2024

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.

[1] [24]

Torkzadehmahani, R., Nasirigerdeh, R., Kaissis, G., Rueckert, D., Dziugaite, G.K., Triantafillou, E.: Improved Localized Machine Unlearning Through the Lens of Memorization (2024), https://arxiv.org/abs/2412.02432

arXiv 2024

[2] [1]

In: Neural networks: tricks of the trade: second edition (2012)

Bottou, L.: Stochastic Gradient Descent Tricks. In: Neural networks: tricks of the trade: second edition (2012)

2012

[3] [2]

In: 2021 IEEE symposium on security and privacy (SP) (2021)

Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C.A., Jia, H., Travers, A., Zhang, B., Lie, D., Papernot, N.: Machine Unlearning. In: 2021 IEEE symposium on security and privacy (SP) (2021)

2021

[4] [3]

In: 2021 IEEE symposium on security and privacy (SP)

Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C.A., Jia, H., Travers, A., Zhang, B., Lie, D., Papernot, N.: Machine unlearning. In: 2021 IEEE symposium on security and privacy (SP). pp. 141–159. IEEE (2021)

2021

[5] [4]

Broomhead, D.S., Lowe, D.: Radial Basis Functions, Multi-Variable Functional Interpolation and Adaptive Networks. Tech. rep. (1988)

1988

[6] [5]

In: IEEE Symposium on Security and Privacy (2015)

Cao, Y., Yang, J.: Towards making systems forget with machine unlearning. In: IEEE Symposium on Security and Privacy (2015)

2015

[7] [6]

In: 30th USENIX Security Symposium (2021)

Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., et al.: Extracting Training Data from Large Language Models. In: 30th USENIX Security Symposium (2021)

2021

[8] [7]

Machine Learning (1995)

Cortes, C., Vapnik, V.: Support-vector networks. Machine Learning (1995)

1995