Pith. sign in

REVIEW 4 major objections 5 minor 35 references

Toward Efficient Data-Free Unlearning

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Two fixes lift data-free unlearning's retained accuracy.

desk verdict A credible engineering contribution that correctly diagnoses GKT's over-filtering and fixes it with two novel techniques, but the unlearning guarantee is only partially validated on ResNet18 and the theory is informal. read the letter →

arxiv 2412.13790 v1 pith:EPMIZADT submitted 2024-12-18 cs.LG

Chenhao Zhang , Shaofei Shen , Weitong Chen , Miao Xu This is my paper · ORCID
classification cs.LG
keywords machineunlearningdata-freeknowledgedistillationsyntheticdatalogitredistributionclassforgettingretainingaccuracyadversarialgenerator
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that GKT, the existing data-free unlearning method, is inefficient because it throws away too many synthetic samples before distillation. The adversarial generator used in data-free knowledge distillation naturally drifts toward producing forgetting-class images as the student learns to suppress that class, and GKT's threshold filter discards those images along with many retaining-class images. The paper proposes ISPF, which combines an Inhibited Synthesis loss that stops the generator from over-producing forgetting-class images and a PostFilter that rewrites the teacher's logits so every synthetic image can be used in distillation. In experiments, ISPF keeps forgetting accuracy at 0.0 while raising retaining accuracy substantially—for example from 55.23 to 92.68 on SVHN with AllCNN, and from 57.62 to 86.02 on CIFAR-10 with AllCNN. If correct, the result shows that enriching retaining-related information in the distillation signal is the key to efficient data-free unlearning.

What carries the argument

The load-bearing mechanism is the teacher–student logit pipeline in adversarial data-free distillation, modified at both ends. Inhibited Synthesis (IS) changes the generator objective: instead of the standard adversarial loss, the generator minimizes Eq. 7, which keeps the positive retaining-class terms but flips the forgetting-class terms so they actively push the teacher's forgetting-class logits down, suppressing synthesis of forgetting-class images. PostFilter (PF) changes the teacher's supervision: for every synthetic sample, Eq. 8 sums the logit mass by which each forgetting-class output exceeds the batch minimum, and Eq. 9 distributes that total evenly among the retaining classes while setting forgetting-class logits to the minimum; the student then distills from the redistributed softmax target via Eq. 10. Together they ensure that all synthetic samples enter the distillation and that the distillation signal carries retaining-class information without an explicit forgetting-class component.

What would settle it

Run GKT with a filter threshold relaxed to the point where almost no synthetic samples are discarded and compare retaining accuracy; if Ar does not rise toward the ISPF level, over-filtering is not the main cause of GKT's inefficiency. Separately, fine-tune an ISPF model on a small forgetting-class set and count steps to match the original model's forgetting accuracy: a relearning time much shorter than a retrained model's would show that the PostFilter's logit rewrite leaves latent forgetting information.

Watch

Extended reading notes

Core claim

The paper's central claim is that GKT's inefficiency stems from over-filtering: the generator increasingly synthesizes forgetting-class samples, and the PreFilter then discards them, which also removes retaining-class information from the distillation pool. The mechanism is analyzed from the adversarial DFKD objective: since the student's outputs on the forgetting class are near zero, maximizing the teacher–student divergence forces the teacher's forgetting-class logits up, driving the generator toward the forgetting distribution. To fix this, the paper introduces Inhibited Synthesis, which flips the sign of the forgetting-class terms in the generator loss (Eq. 7), and PostFilter, which redistributes the teacher's logits by moving the mass above the minimum from the forgetting classes to all retaining classes (Eqs. 8–9) before computing the student's KL loss (Eq. 10). With these two changes, ISPF reports Af = 0.0 across every setting it tests while improving retaining accuracy over GKT on all three datasets, including a multi-class CIFAR-100 setting where Ar rises from 49.86 to 62.58. The authors conclude that enriching retaining-related information in the distillation process significantly improves the student's acquisition of retaining-class knowledge.

Load-bearing premise

The load-bearing premise is that rewriting the teacher's logits—setting forgetting-class outputs to the minimum and spreading that mass evenly over retaining classes—removes all forgetting information from every synthetic image, even an image synthesized from the forgetting class, although the paper's own ResNet18 Anamnesis Index values below 1.0 suggest the removal may not be complete.

Editorial extensions

If this is right

  • Retaining accuracy after data-free unlearning can approach retrained-model levels while forgetting accuracy stays at 0.0; e.g., on SVHN-AllCNN Ar goes from 55.23 (GKT) to 92.68, and on CIFAR-10-AllCNN from 57.62 to 86.02.
  • Wall-clock time to reach a given Ar is reduced, because no synthetic samples are discarded and each distillation batch carries more retaining-class information, as shown by the higher batch entropy in Figure 2.
  • The two components are separable and complementary: Inhibited Synthesis alone suppresses forgetting-class synthesis, PostFilter alone raises usable retaining information, and their combination gives the best Ar in the ablation.
  • The approach transfers to multi-class unlearning: on CIFAR-100 with ten distributed forgetting classes, ISPF raises Ar to 62.58 versus 49.86 for GKT.
  • The method is not tied to one base distillation framework; replacing DFQ with ZSKT still yields large Ar gains over GKT (Appendix H).

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's experiments, the over-filtering diagnosis should apply to any data-free unlearning built on adversarial distillation, so the sign-flip generator loss could be grafted onto other DFKD generators beyond DFQ and ZSKT.
  • PostFilter's uniform redistribution is one choice among many; spreading the deleted logit mass proportionally to the retaining-class logits, or with a temperature, might better preserve the teacher's ranking and yield different Ar/AIN trade-offs that the paper does not explore.
  • The paper's own ResNet18 AIN values (0.28 on CIFAR-10, 0.45 on SVHN) are below the retrained model's 1.0, which leaves open whether a latent forgetting signal survives the logit rewrite; a relearning-speed probe or representation-level test after full fine-tuning would settle that.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes ISPF, a data-free unlearning method built on data-free knowledge distillation. It argues that the existing GKT method is inefficient because its PreFilter over-filters synthetic samples, and proposes two components: Inhibited Synthesis (IS), which adds a generator loss term to suppress synthesis of forgetting-class samples, and PostFilter (PF), which keeps all synthetic samples but redistributes the teacher logits by setting forgetting-class logits to the minimum value and spreading the removed mass over retaining classes. The student is trained against the redistributed softmax target. Experiments on SVHN, CIFAR-10, and CIFAR-100 with AllCNN and ResNet18 report Af=0.0 in all settings and substantial gains in Ar over GKT (e.g., SVHN-AllCNN Ar from 55.23 to 92.68, CIFAR-10-AllCNN from 57.62 to 86.02), plus comparisons of MIA, AIN, wall-clock efficiency, and ablations of the two components.

Significance. If the central claim is correct, ISPF would be a clear improvement over the existing data-free unlearning method GKT, with a simple and reproducible recipe. The paper's strengths include extensive experiments (multiple datasets, architectures, per-class and multi-class forgetting, three seeds), public code, and a concrete diagnosis of GKT's inefficiency that is partially supported by the synthetic-sample statistics in Figures 2 and 3. However, the significance is limited by the fact that the load-bearing claim about the unlearning guarantee is not established: the PostFilter operation removes explicit forgetting-class logit signals but does not remove pixel-level forgetting features, and the paper's own AIN results on ResNet18 (0.45 on SVHN, 0.28 on CIFAR-10, versus 1.0 for Retrain) indicate residual forgetting information in the unlearned model. The theoretical analysis in Section 3.1 is informal and relies on an unproven assumption about the student's outputs. These issues do not invalidate the empirical efficiency gains, but they do require that the central claim be narrowed or the guarantee be verified with additional evidence.

major comments (4)
  1. [Section 3.1, Eq. (6)] The analysis of why DFKD leads to over-filtering rests on Eq. (6), which asserts that for every synthetic sample, the student's forgetting-class output satisfies 0 < S_f(x) < epsilon. This is assumed rather than derived, and it cannot hold early in training when the student is randomly initialized; at that stage the adversarial generator can push S_f high. The subsequent conclusion that maximizing Eq. (5) forces T_f up is therefore not a rigorous consequence. The paper should either provide a derivation with explicit conditions, or clearly label this as a heuristic motivation rather than a theoretical analysis. This matters because the claim of 'strictly analyzing' the inefficiency, stated in the Introduction and Conclusion, is load-bearing for the IS design.
  2. [Section 3.3, Eqs. (8)-(10), Table 1] PostFilter removes direct logit supervision for the forgetting class, but the input pixels of a synthetic image that the teacher classifies as f still contain f-discriminative features, and ISPF deliberately trains on all such images. The student can therefore encode forgetting-class features in intermediate representations while producing near-zero output for class f. The reported Af=0.0 and MIA I=100% only test the output layer; they do not test feature-level leakage. The ResNet18 AIN values in Table 1 (0.45 for SVHN, 0.28 for CIFAR-10, versus 1.0 for Retrain) show that the ISPF-unlearned models relearn the forgetting class substantially faster than a retrained model, which is direct evidence that residual forgetting information survives. To support the unlearning guarantee, the paper should add an internal-representation or feature-level evaluation (e.g., linear probing on penultimate features, or comparison of neuron activations against the Retrain model), or state a precise condition under which the redistributed target is independent of forgetting-class information.
  3. [Section 3.2, Eq. (7)] The IS loss is designed so that minimizing the added term reduces T_f given small S_f, but the behavior of the loss is not analyzed when S_f is not uniformly small, which is the regime early in training and for classes the generator has not yet mastered. The claim that IS 'reduces the synthesis of forgetting-class information' is partly a consequence of the objective construction, which is fine as a design, but the paper should not present the observed reduction in forgetting-class sample counts as an empirical discovery without also reporting the dynamics of T_f and S_f over training for the IS variant.
  4. [Section 4.2, Baselines] The comparison includes only GKT as a data-free unlearning baseline (plus BlockF). This is acceptable if GKT is the only prior fully data-free method, but the paper should state this explicitly and note that the claimed advantage may not transfer to other DFKD foundations or to approximate-unlearning methods that use limited real data. Appendix H addresses one DFKD variant, which is helpful, but the main text should acknowledge this scope limitation.
minor comments (5)
  1. [Abstract and Section 1] There is a typo, 'Unlearinng' in the Preliminaries heading; the phrase 'the the' also appears in the introduction of the filter concept. These should be corrected.
  2. [Introduction, Extended version link] The footnote on the first page cites an extended version at arxiv.org/abs/0000.00000, which is a placeholder. This should be either filled in or removed before publication.
  3. [Section 3.3, Eq. (9)] The notation for the redistributed logits is not fully specified: after Eq. (9), the student is trained with DKL(softmax(hat_t) || S(x)), but it is not stated whether hat_t is also temperature-scaled or used directly as a soft target. Clarifying this would improve reproducibility.
  4. [Section 4.3, Figure 2] The fourth column of Figure 2 reports average batch entropy, but the text says 'information entropy of the retaining classes' while Eq. (11) sums over k not in Yf. This is consistent only if the entropy is computed over the teacher's retaining-class distribution; please state this explicitly in the caption and text.
  5. [Appendix D and Table 9] Table 9 shows large per-class variance for several methods, especially GKT. The main-text claim that ISPF is 'consistent across classes' would be better supported by reporting the per-class ranges or a statistical comparison, not just the averaged means in Table 1.

Circularity Check

2 steps flagged · score 2.0 of 10

Central benchmark results are independent, but two internal mechanism validations reduce to the method's own objective definitions.

  1. self definitional [Section 3.2 (Eq. 7); Section 4.3 ablation (Figure 2)]
    "To minimize the number of samples generated by G that contain information about the forgetting class, it is necessary to reduce the value of Tf (ex). ... Therefore, we propose the inhibited synthesis loss for the generator’s learning, i.e., LIS (exi) = − P k∈Yr Tk·[log Tk − log Sk] + P f∈Yf Tf·[log Tf − log Sf]."

    The added term for f∈Yf is minimized by driving Tf down whenever Sf is small; the paper explicitly assumes Sf(ex)<ε, so −Tf log Sf is large and increasing in Tf. The ablation's evidence is the count of synthetic samples 'classified as forgetting classes by the original model,' i.e., samples with high Tf. The observed reduction is therefore the direct optimization target of Eq. 7 rather than an independent confirmation of the claimed mechanism. The headline Ar/Af numbers are measured on real test data, so this is a partial and non-central circularity.

  2. self definitional [Section 3.3 (Eqs. 8-9) and Section 4.3 (Eq. 11, Figure 2)]
    "This is achieved by setting the forgetting classes’ value in the teacher’s output logits to the lowest value and distributing the sum of the subtracted logits evenly to the logits of the retaining classes. ... As shown in the figure, PF can provide a considerably greater quantity of information to the student in each training step when compared to the GKT."

    The 'quantity of information' is measured by HB in Eq. 11, the entropy over retaining-class teacher probabilities. PostFilter (Eq. 9) is defined as moving the entire discarded forgetting-class logit mass Δ onto the retaining classes and clamping the forgetting logits at min(t), so the retaining-class probabilities, and hence HB, are increased by construction. The claim that PF works because it supplies more retaining information therefore restates the PF definition instead of providing independent evidence. The central Ar improvements are still measured on real test data, which keeps the headline comparison non-circular.

full rationale

The paper's central claim is benchmarked externally: ISPF is compared against the GKT baseline on real SVHN, CIFAR-10, and CIFAR-100 test sets, and the headline gains in Ar and AIN are not constructed from the method's own outputs. There are no self-citations that carry a load-bearing argument, no imported uniqueness theorem, and no fitted parameter renamed as a prediction. The unlearning metrics Af=0 and MIA I=100% are training targets for the synthetic distillation distribution rather than guaranteed properties on real forgetting-class data, but the paper actually evaluates them on real test data, so they are empirical results, not circular ones. Two internal explanations are mildly self-confirming: the IS ablation demonstrates fewer teacher-classified forgetting-class samples, which is exactly what the L_IS objective penalizes, and the PF explanation cites increased retaining-class entropy, which the PF logit redistribution increases by definition. These are supporting narratives, not the load-bearing evidence for the paper's main efficiency and accuracy claims. The paper's own ResNet18 AIN values (0.28 for CIFAR-10, 0.45 for SVHN, versus 1.0 for Retrain) indicate a possible residual-knowledge concern, but that is a correctness and robustness caveat, not a circularity of the derivation. Overall, the derivation chain is substantially independent, with only minor definitional self-confirmation in the mechanism analysis.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

ISPF introduces no new physical entities. Its only explicit hand-set free parameter is the PreFilter threshold inherited from GKT. The main epistemic load is carried by assumptions about teacher reliability, generator coverage, and the logit-redistribution step preserving forgetting removal.

free parameters (1)
  • PreFilter threshold delta = 0.01 for SVHN/CIFAR-10, 0.001 for CIFAR-100
    Inherited from GKT and set by hand; used only in ablations that use PreFilter (IS alone), not in the final ISPF which relies on PostFilter.
assumptions (5)
  • domain assumption The pretrained teacher's softmax outputs are meaningful estimates of class membership for synthetic samples.
    The whole DFKD framework and PF rely on treating teacher logits as distillation targets; miscalibrated or overconfident teachers would distort the redistributed targets.
  • ad hoc to paper For every synthetic sample, the student's forgetting-class output S_f is bounded above by a small epsilon.
    Section 3.1 assumes this to argue the generator must raise T_f; it is not guaranteed during early training and is part of the motivation for IS, not a proven fact.
  • domain assumption Synthetic samples generated by the adversarial generator cover the retaining classes well enough that distillation transfers to real test data.
    All evaluations of Ar require that the generator samples the retaining distribution; class-specific synthesis difficulty is acknowledged in Appendix D.
  • ad hoc to paper Zeroing and redistributing the forgetting-class logits removes forgetting information while preserving retaining information.
    PF's core design assumption; no proof is given, and the ResNet18 AIN values indicate residual relearning capacity.
  • domain assumption The retrained model is the correct gold-standard target for unlearned-model behavior.
    Metrics Af, Ar, AIN, and MIA II all compare closeness to retrain; this is standard in the unlearning literature but is a target assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Toward Efficient Data-Free Unlearning." pith.science (2026). https://pith.science/paper/EPMIZADT

@misc{pith2026241213790,
  author       = {Pith},
  title        = {Pith review of: Toward Efficient Data-Free Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EPMIZADT}},
  note         = {Machine review of arXiv:2412.13790}
}
read the original abstract

Machine unlearning without access to real data distribution is challenging. The existing method based on data-free distillation achieved unlearning by filtering out synthetic samples containing forgetting information but struggled to distill the retaining-related knowledge efficiently. In this work, we analyze that such a problem is due to over-filtering, which reduces the synthesized retaining-related information. We propose a novel method, Inhibited Synthetic PostFilter (ISPF), to tackle this challenge from two perspectives: First, the Inhibited Synthetic, by reducing the synthesized forgetting information; Second, the PostFilter, by fully utilizing the retaining-related information in synthesized samples. Experimental results demonstrate that the proposed ISPF effectively tackles the challenge and outperforms existing methods.

Figures

Figures reproduced from arXiv: 2412.13790 by the authors.

Figure 1
Figure 1. Comparative Visualization of Synthetic Samples [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The colors in all figures are used to distinguish the different methods. The top row shows the results under the SVHN [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. The symbols in Figure 3 are consistent with those [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Difficulty of synthesizing samples for each class [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: The colors in all figures are used to distinguish the different methods, and each method is shown with its corresponding [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Figure 6(a) shows the unlearned model’s predictive label distribution for [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Results on the SVHN dataset using ZSKT as the fundamental DFKD. [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Synthetic samples visualization. Unlearning “1” of SVHN with AllCNN as the network. [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 9
Figure 9. Figure 9: Synthetic samples visualization. Unlearning “1” of SVHN with ResNet18 as the network. It is demonstrated that IS contributes to generating less data for forgetting classes [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 30 canonical work pages

  1. [1]

    A.; Jia, H.; Travers, A.; Zhang, B.; Lie, D.; and Papernot, N

    Bourtoule, L.; Chandrasekaran, V.; Choquette - Choo, C. A.; Jia, H.; Travers, A.; Zhang, B.; Lie, D.; and Papernot, N. 2021. Machine Unlearning. In SP 2021

    work page 2021

  2. [2]

    BUKATY, P. 2019. The California Consumer Privacy Act (CCPA): An implementation guide. IT Governance Publishing. ISBN 9781787781320

    work page 2019

  3. [3]

    Cao, Y.; and Yang, J. 2015. Towards Making Systems Forget with Machine Unlearning. In SP 2015

    work page 2015

  4. [4]

    Chen, H.; Wang, Y.; Xu, C.; Yang, Z.; Liu, C.; Shi, B.; Xu, C.; Xu, C.; and Tian, Q. 2019. Data-Free Learning of Student Networks. In ICCV 2019

    work page 2019

  5. [5]

    Chen, H.; Zhu, T.; Yu, X.; and Zhou, W. 2024. Machine Unlearning via Null Space Calibration. In IJCAI 2024

    work page 2024

  6. [6]

    Chen, M.; Gao, W.; Liu, G.; Peng, K.; and Wang, C. 2023. Boundary Unlearning: Rapid Forgetting of Deep Networks via Shifting the Decision Boundary. In CVPR 2023

    work page 2023

  7. [7]

    P.; El - Khamy, M.; and Lee, J

    Choi, Y.; Choi, J. P.; El - Khamy, M.; and Lee, J. 2020. Data-Free Network Quantization With Adversarial Knowledge Distillation. In CVPR 2020

    work page 2020

  8. [8]

    S.; Tarun, A

    Chundawat, V. S.; Tarun, A. K.; Mandal, M.; and Kankanhalli, M. S. 2023. Zero-Shot Machine Unlearning. IEEE Trans. Inf. Forensics Secur. , 18: 2345--2354

    work page 2023

Show all 35 references
  1. [9]

    Do, K.; Le, H.; Nguyen, D.; Nguyen, D.; Harikumar, H.; Tran, T.; Rana, S.; and Venkatesh, S. 2022. Momentum Adversarial Distillation: Handling Large Distribution Shifts in Data-Free Knowledge Distillation. In NeurIPS 2022

    2022

  2. [10]

    Fan, C.; Liu, J.; Zhang, Y.; Wei, D.; Wong, E.; and Liu, S. 2023. SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation. CoRR

    2023

  3. [11]

    Fang, G.; Mo, K.; Wang, X.; Song, J.; Bei, S.; Zhang, H.; and Song, M. 2021. Contrastive Model Inversion for Data-Free Knowledge Distillation. In IJCAI 2021

    2021

  4. [12]

    Fang, G.; Mo, K.; Wang, X.; Song, J.; Bei, S.; Zhang, H.; and Song, M. 2022. Up to 100x Faster Data-Free Knowledge Distillation. In AAAI 2022

    2022

  5. [13]

    Fang, G.; Song, J.; Shen, C.; Wang, X.; Chen, D.; and Song, M. 2019. Data-Free Adversarial Distillation. CoRR, abs/1912.11006

    2019 arXiv

  6. [14]

    Foster, J.; Schoepf, S.; and Brintrup, A. 2024. Fast Machine Unlearning without Retraining through Selective Synaptic Dampening. In AAAI 2024

    2024

  7. [15]

    Garg, S.; Goldwasser, S.; and Vasudevan, P. N. 2020. Formalizing Data Deletion in the Context of the Right to Be Forgotten. In Canteaut, A.; and Ishai, Y., eds., EUROCRYPT 2020

    2020

  8. [16]

    He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep Residual Learning for Image Recognition. In CVPR 2016

    2016

  9. [17]

    Kim, J.; and Woo, S. S. 2022. Efficient Two-stage Model Retraining for Machine Unlearning. In CVPR 2022

    2022

  10. [18]

    Krizhevsky, A.; Hinton, G.; et al. 2009. Learning multiple layers of features from tiny images

    2009

  11. [19]

    Kullback, S.; and Leibler, R. A. 1951. On information and sufficiency. The annals of mathematical statistics, 22: 79--86

    1951

  12. [20]

    Kurmanji, M.; Triantafillou, P.; Hayes, J.; and Triantafillou, E. 2023. Towards Unbounded Machine Unlearning. In Oh, A.; Naumann, T.; Globerson, A.; Saenko, K.; Hardt, M.; and Levine, S., eds., NeurIPS 2023

    2023

  13. [21]

    Liu, H.; Wang, Y.; Liu, H.; Sun, F.; and Yao, A. 2024. Small Scale Data-Free Knowledge Distillation. In CVPR 2024

    2024

  14. [22]

    G.; Rubinstein, B

    Marchant, N. G.; Rubinstein, B. I. P.; and Alfeld, S. 2022. Hard to Forget: Poisoning Attacks on Certified Machine Unlearning. In AAAI 2022

    2022

  15. [23]

    Micaelli, P.; and Storkey, A. J. 2019. Zero-shot Knowledge Transfer via Adversarial Belief Matching. In NeurIPS 2019

    2019

  16. [24]

    K.; Mopuri, K

    Nayak, G. K.; Mopuri, K. R.; Shaj, V.; Radhakrishnan, V. B.; and Chakraborty, A. 2019. Zero-Shot Knowledge Distillation in Deep Networks. In Chaudhuri, K.; and Salakhutdinov, R., eds., ICML 2019

    2019

  17. [25]

    Y.; et al

    Netzer, Y.; Wang, T.; Coates, A.; Bissacco, A.; Wu, B.; Ng, A. Y.; et al. 2011. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning

    2011

  18. [26]

    T.; Huynh, T

    Nguyen, T. T.; Huynh, T. T.; Nguyen, P. L.; Liew, A. W.; Yin, H.; and Nguyen, Q. V. H. 2022. A Survey of Machine Unlearning. CoRR, abs/2209.02299

    2022 arXiv

  19. [27]

    Shokri, R.; Stronati, M.; Song, C.; and Shmatikov, V. 2017. Membership Inference Attacks Against Machine Learning Models. In SP 2017

    2017

  20. [28]

    T.; Dosovitskiy, A.; Brox, T.; and Riedmiller, M

    Springenberg, J. T.; Dosovitskiy, A.; Brox, T.; and Riedmiller, M. A. 2015. Striving for Simplicity: The All Convolutional Net. In Bengio, Y.; and LeCun, Y., eds., ICLR 2015

    2015

  21. [29]

    K.; Chundawat, V

    Tarun, A. K.; Chundawat, V. S.; Mandal, M.; and Kankanhalli, M. 2023. Fast yet effective machine unlearning. IEEE Transactions on Neural Networks and Learning Systems

    2023

  22. [30]

    Thudi, A.; Deza, G.; Chandrasekaran, V.; and Papernot, N. 2022. Unrolling SGD: Understanding Factors Influencing Machine Unlearning. In EuroS & P 2022

    2022

  23. [31]

    Xu, J.; Wu, Z.; Wang, C.; and Jia, X. 2024. Machine Unlearning: Solutions and Challenges. IEEE Trans. Emerg. Top. Comput. Intell

    2024

  24. [32]

    Yan, H.; Li, X.; Guo, Z.; Li, H.; Li, F.; and Lin, X. 2022. ARCANE: An Efficient Architecture for Exact Machine Unlearning. In IJCAI 2022

    2022

  25. [33]

    M.; Li, Z.; Mallya, A.; Hoiem, D.; Jha, N

    Yin, H.; Molchanov, P.; \' A lvarez, J. M.; Li, Z.; Mallya, A.; Hoiem, D.; Jha, N. K.; and Kautz, J. 2020. Dreaming to Distill: Data-Free Knowledge Transfer via DeepInversion. In CVPR 2020

    2020

  26. [34]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...

  27. [35]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.