Pith. sign in

REVIEW 5 major objections 5 minor 36 references

Realistic Image-to-Image Machine Unlearning via Decoupling and Knowledge Retention

T0 review · 5 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes and tests a two-step unlearning scheme: run gradient ascent on forgotten images until they are provably out-of-distribution, then fine-tune on retained images; if the convexity assumption holds, the forget set becomes…

desk verdict The OOD framing and the backdoor-injection audit are worth thinking about, but the core theoretical guarantees are invalid, and the empirical evaluation has too many internal inconsistencies to support the claims as written. read the letter →

arxiv 2502.04260 v2 pith:F2BMLF7Z submitted 2025-02-06 cs.LG

Ayush K. Varshney , Vicenç Torra This is my paper · ORCID
classification cs.LG
keywords machineunlearningimage-to-imagegenerativemodelsout-of-distributiondatagradientascentknowledgeretentionsample-levelpoisoningauditdiffusion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that existing unlearning for image-to-image (I2I) generative models, which minimizes the distance between generated outputs and Gaussian noise, is unrealistic: a model retrained without the forgotten samples would still capture generic patterns, so it would not turn them into noise. The paper instead defines effective unlearning as making the forget set out-of-distribution, meaning the unlearned model's outputs on those samples must move at least $\lambda$ away from its pre-unlearning outputs. It proves that $T$ gradient-ascent iterations on the forget loss, under convexity and bounded gradients, guarantee a loss increase of at least $\eta T g^2$, and that this makes the forget samples OOD when $\lambda \leq \eta T g^2$; the same update satisfies an $(\epsilon=0, \delta=\eta(T+1)G^2)$-unlearning guarantee. A second fine-tuning step on the retain set restores image quality, and experiments on autoencoders, VQ-GAN, and diffusion models over ImageNet-1K, Places365, and CIFAR-10 show the method removes an embedded poison pattern while staying close to a fully retrained model.

What carries the argument

The load-bearing mechanism is the gradient-ascent update $(\gamma_{t+1},\phi_{t+1})=(\gamma_t,\phi_t)+\eta\nabla L(\gamma_t,\phi_t)$ on the forget set, followed by the retain-set fine-tuning update with a minus sign. Under Assumption 1 (convex loss) and Assumption 2 (gradient norms bounded below by $g$ and above by $G$), convexity gives the lower bound $\|L(\gamma_T,\phi_T)-L(\gamma_0,\phi_0)\|\geq\eta T g^2$, which Theorem 1 compares with the OOD threshold $\lambda$, and the upper bound $L(\gamma_T,\phi_T)\leq L(\gamma_0,\phi_0)+\eta(T+1)G^2$ supplies the $\delta$ in the $(\epsilon,\delta)$ guarantee. The OOD criterion itself is equation (3), $\|\theta_{\gamma_0,\phi_0}(\tau(D_f))-\theta_{\gamma,\phi}(\tau(D_f))\|\geq\lambda$, which converts the loss-space bound into an output-space separation.

What would settle it

On a trained autoencoder, choose a forget image, record its pre-unlearning output $y_0$, run $T$ gradient-ascent steps that measurably increase the scalar loss by at least $\eta T g^2$, and compute $\|y_T-y_0\|$ in pixel or perceptual space. A single run with $\eta T g^2 > \lambda$ and $\|y_T-y_0\| < \lambda$ would show that the guaranteed loss increase does not force OOD separation.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that gradient ascent can serve as a certified decoupling step for I2I unlearning. Starting from a trained model $\theta_{\gamma_0,\phi_0}$, maximizing the loss on the forget set for $T$ steps produces updated weights whose outputs on $D_f$ are at least $\lambda$ away from the original outputs, provided $\lambda \leq \eta T g^2$ and Assumptions 1 and 2 hold. The paper states this as Theorem 1 (an if-and-only-if condition), and Theorem 2 attaches an $(\epsilon=0, \delta=\eta(T+1)G^2)$ unlearning guarantee to the same update. The retained-set fine-tuning that follows is presented as knowledge retention, not as part of the certified removal, and the paper argues the first-step guarantee remains valid for the final model. Empirically, the method is evaluated on AutoEncoder, VQ-GAN, and diffusion architectures with cropped-patch inpainting and outpainting, and on class-level and sample-level unlearning, always against noise-based baselines and, where feasible, against a fully retrained model.

Load-bearing premise

The load-bearing premise is that the loss is convex and that a guaranteed rise in the scalar loss forces a guaranteed separation of the output images; the paper asserts the loss-to-output transfer without proving a Lipschitz or norm relationship between them.

Editorial extensions

If this is right

  • Sample-level unlearning becomes feasible for I2I models: a specific subset of a class can be forgotten while the model treats those exact images as out-of-distribution rather than as noise.
  • The $(\epsilon=0,\delta=\eta(T+1)G^2)$ guarantee attaches to the gradient-ascent update before retain fine-tuning, so the removal step is certified independently of the restoration step.
  • After fine-tuning on the retain set, the model preserves output quality on retain and unseen samples while no longer regenerating the embedded poison marker.
  • The OOD threshold $\lambda$ is tuned through the number of ascent steps $T$ and the learning rate $\eta$, giving a practical knob for how aggressively to forget.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's experiments, the same output-distance criterion could be repurposed as an OOD detector on the unlearned model itself, since forget outputs are pushed beyond a known threshold.
  • The paper states that the first-step guarantee remains valid after fine-tuning; a deployment version would measure the final $\delta$ explicitly after the retain step rather than relying on the pre-fine-tuning bound alone.
  • Membership-inference and reconstruction attacks, which the paper names as future work, would probe the same removal from an adversary's viewpoint and could replace the '+' backdoor audit.
  • A testable transfer is to apply the same decouple-then-fine-tune recipe to text-to-image models by using a semantic embedding distance in place of pixel output distance; the paper does not claim this.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes a two-stage unlearning algorithm for image-to-image (I2I) generative models: first, maximize the training loss on the forget set via gradient ascent (GA) to make forget samples out-of-distribution (OOD); second, fine-tune on the retain set to preserve generation quality. The manuscript claims two theoretical results: Theorem 1 states that after T GA iterations the model is OOD on the forget set iff the OOD threshold λ satisfies λ ≤ ηTg², and Theorem 2 states that GA provides an (ε=0, δ=η(T+1)G²)-unlearning guarantee. It also introduces a data-poisoning attack as an auditing mechanism and reports experiments on ImageNet-1K, Places365, and CIFAR-10 using autoencoders, VQ-GAN, and diffusion models.

Significance. The conceptual target of the paper is valuable: replacing the prevailing Gaussian-noise objective for I2I unlearning with an OOD-based criterion is a sensible direction, and the proposed poisoning-based audit is a practical idea. The experimental scope is broad, covering three architectures and two large-scale datasets. However, the paper's main selling point is its theoretical guarantee, and the proofs of both theorems contain load-bearing errors: Assumption 1 is misstated, Eq. (9) uses an invalid inequality, Eq. (10) bounds a scalar loss rather than the output-space distance required by Eq. (3), and Theorem 2 attaches an (ε,δ) label to a deterministic, non-probabilistic bound. Section 4.4 further admits that the final fine-tuned model may make forget samples in-distribution again, so the guarantee does not apply to the model returned by Algorithm 1. The empirical evaluation also lacks error bars and uses inconsistent FID conventions across tables. If the theoretical claims were repaired, the framework would be a useful baseline, but as presented the central claim is not established.

major comments (5)
  1. [Sec. 4.1, Eq. (7)] Assumption 1 is stated as L(a) ≥ L(b) + ⟨∇L(a), a−b⟩ for all a,b. This is not the gradient inequality for convex functions; convexity implies L(a) ≥ L(b) + ⟨∇L(b), a−b⟩. The stated inequality fails even for L(x)=x², with a=2, b=1 giving 4 ≥ 5. Since Eq. (9) is derived from this inequality, the loss-increase bound in Eq. (10) is not established.
  2. [Sec. 4.1, Eq. (9)] The proof lower-bounds the inner product ⟨∇L(γ_{t+1},φ_{t+1}), (γ_{t+1},φ_{t+1})−(γ_t,φ_t)⟩ by η‖∇L_{t+1}‖‖∇L_t‖. This is the reverse of Cauchy-Schwarz; an inner product cannot be bounded below by the product of the norms, and consecutive gradients during gradient ascent can be anti-aligned. Hence the telescoped bound leading to Eq. (10) does not follow.
  3. [Theorem 1, Sec. 4.1] Theorem 1 claims an 'iff' characterization of output-space OOD. The only quantity bounded in the proof is the absolute loss gap ‖L(γ_T,φ_T)−L(γ_0,φ_0)‖ in Eq. (10), which is a scalar loss value, not the output-space distance ∥θ_{γ_T,φ_T}(τ(D_f))−θ_{γ_0,φ_0}(τ(D_f))∥ used in the OOD definition Eq. (3). No Lipschitz or other norm-transfer result connects these quantities, so the theorem does not establish that the outputs on D_f are OOD.
  4. [Theorem 2, Sec. 4.1] Theorem 2 labels the bound L(γ_T,φ_T) ≤ L(γ_0,φ_0)+η(T+1)G² from Eq. (12) as an (ε=0, δ=η(T+1)G²)-unlearning guarantee. An (ε,δ)-unlearning guarantee requires a definition of adjacent datasets or models and a probabilistic statement about the divergence of the unlearned model from the retrained model. A deterministic bound on the loss value provides neither, and δ, which has units of loss, cannot be interpreted as a probability.
  5. [Algorithm 1 and Sec. 4.4] Algorithm 1 returns the model after fine-tuning on D_r (lines 9-13), but Theorem 1 guarantees OOD behavior only for the intermediate gradient-ascent model. Section 4.4 explicitly concedes that fine-tuning on retain samples can make the forget samples appear in-distribution again. Moreover, the stopping criterion in line 5 of Algorithm 1 uses the parameter-space distance ∥θ_{γ_{t+1},φ_{t+1}}−θ_{γ_0,φ_0}∥, not the output-space distance in Eq. (3). Thus the final model output by the algorithm is not covered by the stated guarantee.
minor comments (5)
  1. [Abstract and throughout] The dataset is typeset as 'CIF AR-10' in the abstract and many body locations; it should be 'CIFAR-10'.
  2. [Table 5] The caption states '70%' for the right-hand columns, while the table header and the text in Section 5.2 say '75%'.
  3. [Tables 2 and 3] Table 2 uses 'FID D_f ↑ is better' (reference: attack model), whereas Table 3 uses 'FID D_f ↓ is better' (reference: original model). The text should explain why opposite directions are appropriate and why the same method is consistently better under both references.
  4. [Sec. 4, first paragraph] The definition of L(x; τ(x), (γ,ϕ)) and the update rule in Eq. (4) are duplicated verbatim on page 7; one copy should be deleted.
  5. [Algorithm 2, Sec. 4.3] The operation 'Append xf ⇐ xf ∪ '+' is notationally unclear; appending a string to an image tensor is not a well-defined operation and should be specified as inserting a marker at a particular image location.

Circularity Check

2 steps flagged · score 6.0 of 10

The central OOD theorem substitutes the scalar loss-increase bound for the output-space OOD threshold, and the (ε,δ) theorem names its own bound as δ.

  1. self definitional [Section 3.2 / Section 4.1, Eq. (3), Eq. (10), Theorem 1]
    "argγ,ϕ ∥θγ0,ϕ0 (τ (Df )) − θγ,ϕ(τ (Df ))∥ ≥λ (3) ... Then we can rewrite Eq. (9) as: ∥L(γT , ϕT ) − L(γ0, ϕ0)∥ ≥ηT g2 (10) ... Theorem 1. Under the Assumptions 1, and 2, the model weights ( γ, ϕ) trained with gradient ascent for T iterations are out-of-distribution for the initial trained model γ0, ϕ0 on forget set iff λ ≤ ηT g2."

    The OOD criterion in Eq. (3) is a distance between model outputs, with λ a predefined output-space threshold. Eq. (10) is a lower bound on the scalar loss gap L(γT,φT)−L(γ0,φ0). Theorem 1 then states the model is OOD iff λ ≤ ηTg², i.e. it replaces the output-space condition with the loss-gap lower bound. No Lipschitz, norm, or distributional link between loss gap and output distance is given, so the 'if and only if' reduces to the bound itself: the derived lower bound is used as the OOD threshold. The central guarantee therefore has no content beyond Eq. (10).

  2. self definitional [Section 4.1, Eq. (12), Theorem 2]
    "L(γT , ϕT ) ≤ L(γ0, ϕ0) + η(T + 1)G2 (12) ... Theorem 2. Under the Assumptions 1, and 2, the gradient ascent provides (ϵ = 0, δ= η(T + 1)G2)-unlearning guarantee for model weight ( γ, ϕ) after T iterations."

    The δ in Theorem 2 is exactly the increment appearing in Eq. (12). The paper never defines (ε,δ)-unlearning as a distributional or probabilistic property for I2I models in this section; the guarantee is a relabeling of the preceding deterministic bound. If δ is defined by the bound itself, the claim is true by construction; if (ε,δ)-unlearning is intended in the standard distributional sense, no argument connects the scalar loss bound to such a definition. Either way, the theorem imports its own quantity as the guarantee parameter.

full rationale

The paper is not circular in the self-citation sense: it cites prior unlearning work but does not rest its claims on self-authored uniqueness theorems, and the empirical comparison against retrained models and baselines is external and independently meaningful. The circularity is in the two theoretical guarantees. Theorem 1's OOD conclusion is derived by treating the lower bound on the scalar loss increase, Eq. (10), as if it were the output-space OOD condition of Eq. (3); the iff condition λ ≤ ηTg² is the bound itself, so the theorem reduces to its own derivation. Theorem 2 likewise sets δ equal to the upper bound it derives, making the (ε,δ) guarantee a restatement rather than an independent probabilistic statement. These are load-bearing defects because the paper's advertised contribution is 'theoretical guarantee' that forget samples become OOD. The additional mathematical errors noted by a proof check (Assumption 1 is not convexity as stated, and Eq. (9) uses Cauchy-Schwarz in the wrong direction) compound the problem, but they are correctness issues rather than circularity. The paper's own Section 4.4 further concedes that fine-tuning on retain data may render forget samples in-distribution again, undercutting the final-model OOD claim. On balance, the central derivation is partially circular: the predicted OOD status is equivalent, in the proof, to the loss bound the proof computes.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on two formal assumptions (convexity and gradient norm bounds) that do not hold or are not measured for deep I2I models, plus an unstated bridge between loss increase and output-space OOD distance. The only hand-tuned numeric inputs are λ, learning rate, and iteration counts. No new physical or model entities are introduced.

free parameters (4)
  • OOD threshold λ = not specified (application dependent)
    Used as the stopping criterion in Algorithm 1 (line 5) and as the condition in Theorem 1. There is no procedure to set it from data; it is chosen by hand.
  • Unlearning iterations T_u = not specified per dataset
    The number of gradient ascent steps controls the claimed bound ηTg^2; the conclusion calls T 'application dependent'. Not reported across architectures and datasets.
  • Fine-tuning iterations T_f = not specified
    Fine-tuning on retain samples is needed for knowledge retention, but no epoch count or stopping rule is given.
  • Learning rate η = not specified
    Appears linearly in both the bound ηTg^2 and δ=η(T+1)G^2. The paper does not report the values used.
assumptions (4)
  • ad hoc to paper L is convex and differentiable (Assumption 1).
    Used to derive Eqs. (9) through (12). Deep I2I models are non-convex; the paper cites other unlearning works that make the same assumption, but provides no evidence it holds for the trained models.
  • ad hoc to paper Expected gradient norm is bounded as g ≤ E∥∇f∥ ≤ G with g>0 (Assumption 2).
    The lower bound ensures the starting model is not at an optimum and generates the ηTg^2 term; the upper bound is used to define δ in Theorem 2. Neither g nor G is measured or estimated for the experiments.
  • domain assumption SGD converges for the loss L (paragraph before Eq. 5).
    Assumed so that the output error decreases over training; it is not used directly in the gradient ascent proof.
  • ad hoc to paper (ε,δ)-unlearning can be certified by bounding the loss increase (Theorem 2).
    The paper never defines adjacent datasets, a randomized mechanism, or a distributional divergence; δ is set to the derived gradient bound, so the theorem does not connect to the standard unlearning-guarantee definition in [20].

how reviews work

0 comments
Cite this review

Pith. "Pith review of Realistic Image-to-Image Machine Unlearning via Decoupling and Knowledge Retention." pith.science (2026). https://pith.science/paper/F2BMLF7Z

@misc{pith2026250204260,
  author       = {Pith},
  title        = {Pith review of: Realistic Image-to-Image Machine Unlearning via Decoupling and Knowledge Retention},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/F2BMLF7Z}},
  note         = {Machine review of arXiv:2502.04260}
}
abstract

Machine Unlearning allows participants to remove their data from a trained machine learning model in order to preserve their privacy, and security. However, the machine unlearning literature for generative models is rather limited. The literature for image-to-image generative model (I2I model) considers minimizing the distance between Gaussian noise and the output of I2I model for forget samples as machine unlearning. However, we argue that the machine learning model performs fairly well on unseen data i.e., a retrained model will be able to catch generic patterns in the data and hence will not generate an output which is equivalent to Gaussian noise. In this paper, we consider that the model after unlearning should treat forget samples as out-of-distribution (OOD) data, i.e., the unlearned model should no longer recognize or encode the specific patterns found in the forget samples. To achieve this, we propose a framework which decouples the model parameters with gradient ascent, ensuring that forget samples are OOD for unlearned model with theoretical guarantee. We also provide $(\epsilon, \delta)$-unlearning guarantee for model updates with gradient ascent. The unlearned model is further fine-tuned on the remaining samples to maintain its performance. We also propose an attack model to ensure that the unlearned model has effectively removed the influence of forget samples. Extensive empirical evaluation on two large-scale datasets, ImageNet-1K and Places365 highlights the superiority of our approach. To show comparable performance with retrained model, we also show the comparison of a simple AutoEncoder on various baselines on CIFAR-10 dataset.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 19 canonical work pages

  1. [1]

    Advances in neural information processing systems 34, 8780–8794 (2021)

    Dhariwal, P., Nichol, A.: Diffusion models beat gans on image synthesis. Advances in neural information processing systems 34, 8780–8794 (2021)

    2021

  2. [2]

    arXiv preprint arXiv:2303.08774 (2023)

    Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

    arXiv 2023

  3. [3]

    In: 2015 IEEE Symposium on Security and Privacy, pp

    Cao, Y., Yang, J.: Towards making systems forget with machine unlearning. In: 2015 IEEE Symposium on Security and Privacy, pp. 463–480 (2015). IEEE

    2015

  4. [4]

    In: 2021 IEEE Symposium on Security and Privacy (SP), pp

    Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C.A., Jia, H., Travers, A., Zhang, B., Lie, D., Papernot, N.: Machine unlearning. In: 2021 IEEE Symposium on Security and Privacy (SP), pp. 141–159 (2021). IEEE 19

    work page 2021

  5. [5]

    IEEE Transactions on Neural Networks and Learning Systems (2023)

    Tarun, A.K., Chundawat, V.S., Mandal, M., Kankanhalli, M.: Fast yet effec- tive machine unlearning. IEEE Transactions on Neural Networks and Learning Systems (2023)

    work page 2023

  6. [6]

    In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Somepalli, G., Singla, V., Goldblum, M., Geiping, J., Goldstein, T.: Diffusion art or digital forgery? investigating data replication in diffusion models. In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6048–6058 (2023)

    work page 2023

  7. [7]

    In: 32nd USENIX Security Symposium (USENIX Security 23), pp

    Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramer, F., Balle, B., Ippolito, D., Wallace, E.: Extracting training data from diffusion models. In: 32nd USENIX Security Symposium (USENIX Security 23), pp. 5253–5270 (2023)

    work page 2023

  8. [8]

    arXiv preprint arXiv:2402.00351 (2024)

    Li, G., Hsu, H., Marculescu, R., et al.: Machine unlearning for image-to-image generative models. arXiv preprint arXiv:2402.00351 (2024)

    arXiv 2024

Show all 36 references
  1. [9]

    arXiv preprint arXiv:2408.01689 (2024)

    Feng, X., Chen, C., Li, Y., Zhang, L.: Controllable unlearning for image- to-image generative models via ε-constrained optimization. arXiv preprint arXiv:2408.01689 (2024)

    2024 arXiv

  2. [10]

    Halimi, A., Kadhe, S., Rawat, A., Baracaldo, N.: Federated unlearning: How to efficiently erase a client in fl? arXiv preprint arXiv:2207.05521 (2022)

    2022 arXiv

  3. [11]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Li, T., Chang, H., Mishra, S., Zhang, H., Katabi, D., Krishnan, D.: Mage: Masked generative encoder to unify representation learning and image synthesis. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2142–2152 (2023)

    2023

  4. [12]

    In: ACM SIGGRAPH 2022 Conference Proceedings, pp

    Saharia, C., Chan, W., Chang, H., Lee, C., Ho, J., Salimans, T., Fleet, D., Norouzi, M.: Palette: Image-to-image diffusion models. In: ACM SIGGRAPH 2022 Conference Proceedings, pp. 1–10 (2022)

    2022

  5. [13]

    In: Proceedings of the European Conference on Computer Vision (ECCV), pp

    Bulat, A., Yang, J., Tzimiropoulos, G.: To learn image super-resolution, use a gan to learn how to do image degradation first. In: Proceedings of the European Conference on Computer Vision (ECCV), pp. 185–200 (2018)

    2018

  6. [14]

    In: 2019 IEEE/CVF International Conference on Computer Vision (ICCV), pp

    Krishnan, D., Teterwak, P., Sarna, A., Maschinot, A., Liu, C., Belanger, D., Freeman, W.: Boundless: Generative adversarial networks for image extension. In: 2019 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 10520–10529 (2019). IEEE

    2019

  7. [15]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Chang, H., Zhang, H., Jiang, L., Liu, C., Freeman, W.T.: Maskgit: Masked gen- erative image transformer. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11315–11325 (2022)

    2022

  8. [16]

    The Journal of Machine Learning Research 15(1), 20 3563–3593 (2014)

    Alain, G., Bengio, Y.: What regularized auto-encoders learn from the data- generating distribution. The Journal of Machine Learning Research 15(1), 20 3563–3593 (2014)

    2014

  9. [17]

    Communications of the ACM 63(11), 139–144 (2020)

    Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial networks. Communications of the ACM 63(11), 139–144 (2020)

    2020

  10. [18]

    Advances in neural information processing systems 33, 6840–6851 (2020)

    Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. Advances in neural information processing systems 33, 6840–6851 (2020)

    2020

  11. [19]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Golatkar, A., Achille, A., Soatto, S.: Eternal sunshine of the spotless net: Selective forgetting in deep networks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9304–9312 (2020)

    2020

  12. [20]

    arXiv preprint arXiv:1911.03030 (2019)

    Guo, C., Goldstein, T., Hannun, A., Van Der Maaten, L.: Certified data removal from machine learning models. arXiv preprint arXiv:1911.03030 (2019)

    2019 arXiv

  13. [21]

    In: International Conference on Machine Learning, pp

    Tarun, A.K., Chundawat, V.S., Mandal, M., Kankanhalli, M.: Deep regression unlearning. In: International Conference on Machine Learning, pp. 33921–33939 (2023). PMLR

    2023

  14. [22]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Chen, M., Gao, W., Liu, G., Peng, K., Wang, C.: Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7766–7775 (2023)

    2023

  15. [23]

    arXiv preprint arXiv:2407.20516 (2024)

    Liu, Z., Dou, G., Tan, Z., Tian, Y., Jiang, M.: Machine unlearning in generative ai: A survey. arXiv preprint arXiv:2407.20516 (2024)

    2024 arXiv

  16. [24]

    arXiv preprint arXiv:2307.04550 (2023)

    Bae, S., Kim, S., Jung, H., Lim, W.: Gradient surgery for one-shot unlearning on generative model. arXiv preprint arXiv:2307.04550 (2023)

    2023 arXiv

  17. [25]

    arXiv preprint arXiv:2303.05699 2(3) (2023)

    Moon, S., Cho, S., Kim, D.: Feature unlearning for generative models via implicit feedback. arXiv preprint arXiv:2303.05699 2(3) (2023)

    2023 arXiv

  18. [26]

    In: International Conference on Machine Learning, pp

    Sun, Y., Ming, Y., Zhu, X., Li, Y.: Out-of-distribution detection with deep nearest neighbors. In: International Conference on Machine Learning, pp. 20827–20840 (2022). PMLR

    2022

  19. [27]

    arXiv preprint arXiv:2107.05680 (2021)

    Sahiner, A., Ergen, T., Ozturkler, B., Bartan, B., Pauly, J., Mardani, M., Pilanci, M.: Hidden convexity of wasserstein gans: Interpretable generative models with closed-form solutions. arXiv preprint arXiv:2107.05680 (2021)

    2021 arXiv

  20. [28]

    arXiv preprint arXiv:2208.05314 (2022)

    De Bortoli, V.: Convergence of denoising diffusion models under the manifold hypothesis. arXiv preprint arXiv:2208.05314 (2022)

    2022 arXiv

  21. [29]

    arXiv preprint arXiv:2402.01965 (2024) 21

    Zhang, F., Pilanci, M.: Analyzing neural network-based generative diffusion models through convex optimization. arXiv preprint arXiv:2402.01965 (2024) 21

    2024 arXiv

  22. [30]

    Warnecke, A., Pirch, L., Wressnegger, C., Rieck, K.: Machine unlearning of features and labels

  23. [31]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp

    Gandikota, R., Materzynska, J., Fiotto-Kaufman, J., Bau, D.: Erasing con- cepts from diffusion models. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 2426–2436 (2023)

    2023

  24. [32]

    Advances in neural information processing systems 29 (2016)

    Salimans, T., Goodfellow, I., Zaremba, W., Cheung, V., Radford, A., Chen, X.: Improved techniques for training gans. Advances in neural information processing systems 29 (2016)

    2016

  25. [33]

    Advances in neural information processing systems 30 (2017)

    Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., Hochreiter, S.: Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems 30 (2017)

    2017

  26. [34]

    In: International Conference on Machine Learning, pp

    Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.: Learning transferable visual models from natural language supervision. In: International Conference on Machine Learning, pp. 8748–8763 (2021). PMLR

    2021

  27. [35]

    8717–8730 (2023)

    Duan, J., Kong, F., Wang, S., Shi, X., Xu, K.: Are diffusion models vulnerable to membership inference attacks? In: International Conference on Machine Learning, pp. 8717–8730 (2023). PMLR

    2023

  28. [36]

    Li, Z., Yang, M., Liu, Y., Wang, J., Hu, H., Yi, W., Xu, X.: Gan you see me? enhanced data reconstruction attacks against split inference. Advances in Neural Information Processing Systems 36 (2024) Appendix A Further Experiments In this section, we present additional results ...

    2024

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.