How Does Overparameterization Affect Machine Unlearning of Deep Neural Networks?

Gal Alon; Yehuda Dar

arxiv: 2503.08633 · v2 · pith:PY7O64ZCnew · submitted 2025-03-11 · 💻 cs.LG

How Does Overparameterization Affect Machine Unlearning of Deep Neural Networks?

Gal Alon , Yehuda Dar This is my paper

Pith reviewed 2026-05-22 23:59 UTC · model grok-4.3

classification 💻 cs.LG

keywords machine unlearningoverparameterizationdeep neural networksprivacybias removaldecision regionsgeneralization

0 comments

The pith

Overparameterized deep neural networks enable more effective machine unlearning by allowing localized changes to decision regions.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper studies how the width of a deep neural network influences the performance of machine unlearning methods that remove specific training examples. It shows that wider, overparameterized networks generally deliver stronger privacy protection and bias removal, at only modest cost to overall accuracy, when the unlearning procedure is tuned on a validation set. This advantage appears because overparameterized models can adjust their output only in small neighborhoods around the forgotten examples while leaving distant regions of the input space unchanged. The benefit for bias removal holds only when the unlearning method is given access to the examples being removed.

Core claim

Machine unlearning succeeds more readily on overparameterized models because these models support delicate, spatially localized adjustments to classification decision regions near the unlearned examples while preserving functionality elsewhere, thereby improving privacy and bias metrics with limited generalization loss when the method uses the unlearned examples for bias tasks.

What carries the argument

Measurement of changes to classification decision regions in the input-space neighborhood of unlearned examples, together with validation-based tuning of unlearning methods across different network widths.

If this is right

Unlearning methods achieve larger privacy gains on wider networks than on narrower ones.
Bias removal via unlearning requires the method to receive the forgotten examples even when the network is overparameterized.
Utility loss stays modest while privacy and bias improve on overparameterized models.
Unlearning alters model behavior only near the forgotten examples and leaves distant input regions intact.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Architectural choices that increase width may be preferable when models must support repeated forgetting operations.
The localized-change property could extend to other tasks that require fine control over model behavior without global retraining.
If the localization property scales with width, very large models might support efficient incremental forgetting pipelines.

Load-bearing premise

Validation-based tuning of the unlearning methods produces fair and comparable results across different parameterization levels, unlearning goals, and whether the method uses the unlearned examples.

What would settle it

An experiment in which unlearning on wider networks fails to produce larger privacy or bias gains than on narrower networks, or in which decision-region changes are observed to spread far from the unlearned examples.

Figures

Figures reproduced from arXiv: 2503.08633 by Gal Alon, Yehuda Dar.

**Figure 2.** Figure 2: Unlearning for bias removal (ResNet-18, CIFAR-10, 200 [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Figure 3: Unlearning for privacy (ResNet-18, CIFAR-10, 200 unlearned examples) MIA accuracy results. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

**Figure 4.** Figure 4: Decision regions (ResNet-18, CIFAR-10, 200 unlearned examples), comparing an overparametrized model (DNN width scale = [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗

**Figure 5.** Figure 5: Similarity and change scores for unlearned models [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗

read the original abstract

Machine unlearning is the task of updating a trained model to forget specific training data without retraining from scratch. In this paper, we investigate how unlearning of deep neural networks (DNNs) is affected by the model parameterization level, which corresponds here to the DNN width. We define validation-based tuning for several unlearning methods from the recent literature, and show how these methods perform differently depending on (i) the DNN parameterization level, (ii) the unlearning goal (unlearned data privacy or bias removal), (iii) whether the unlearning method explicitly uses the unlearned examples. Our results show that unlearning usually excels on overparameterized models by significantly improving privacy/bias at a reasonable cost of utility (generalization) degradation; although for bias removal this requires the unlearning method to use the unlearned examples. Furthermore, we measure how much the unlearning changes the classification decision regions in the proximity of the unlearned examples, and avoids changing them elsewhere. By this we show that the unlearning success for overparameterized models stems from the ability to delicately change the model functionality in small regions in the input space while keeping much of the model functionality unchanged.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

Wider networks support more localized unlearning changes, but the validation tuning across widths may not be comparable.

read the letter

The paper's central observation is that overparameterized DNNs let unlearning methods achieve better privacy or bias removal with smaller drops in generalization, because the updates stay confined to small regions around the forgotten examples. They back this with a measurement of decision-region shifts near those points versus elsewhere in input space. That measurement is a straightforward addition to existing unlearning work and gives a concrete handle on the localization claim. The experiments also vary the unlearning goal and whether the method sees the forgotten data, which shows the width advantage is not uniform. For bias removal the method must use the examples; for privacy it appears more robust. These comparisons are the useful part of the study. The work stays inside the current unlearning literature and does not introduce new algorithms or theory. The soft spot is the validation-based tuning. Wider models have higher capacity, so their validation objectives can reach lower values for the same hyperparameter ranges. The abstract does not state whether search ranges, early-stopping rules, or validation-set construction are held fixed across widths or re-optimized per model. If the latter, part of the reported advantage could be an artifact of the tuning procedure rather than a property of overparameterization. The results are presented qualitatively with no numbers or error bars in the summary, which makes the magnitude of the effects hard to judge. This paper is for researchers already working on machine unlearning or privacy mechanisms in neural nets. It offers some practical guidance on model-size choices but does not change the broader field. I would send it to peer review. The question is practical and the localized-change measurement is worth checking, but the authors need to document the tuning protocol clearly and add quantitative reporting.

Referee Report

1 major / 2 minor

Summary. The paper investigates the effect of DNN width (overparameterization) on machine unlearning for privacy and bias removal. Using validation-based tuning of multiple unlearning methods, it reports that unlearning typically performs better on wider models, yielding stronger privacy/bias gains at modest utility cost (especially when methods access the forgotten examples for bias tasks). It attributes this to the capacity for localized decision-region changes near forgotten points while preserving functionality elsewhere.

Significance. If the empirical comparisons hold under controlled tuning, the work provides evidence that overparameterized networks are more amenable to targeted unlearning due to their ability to make small, localized functional adjustments. This could guide architecture choices and method design for privacy-preserving or fair ML systems, with the decision-region analysis offering a mechanistic explanation beyond aggregate metrics.

major comments (1)

[Abstract / Experimental setup] Abstract and experimental setup: The validation-based tuning is introduced without specifying whether hyperparameter search ranges, validation-set construction, early-stopping criteria, or optimization budgets are held fixed across model widths. Because wider networks admit different (often lower) minima in the same hyperparameter space due to increased capacity, any reported advantage for overparameterized models may partly reflect tuning artifacts rather than intrinsic properties of overparameterization. This directly affects the central claim that unlearning 'excels' on overparameterized models.

minor comments (2)

[Abstract] Abstract: All performance claims are stated qualitatively ('significantly improving', 'reasonable cost') with no numerical values, effect sizes, or pointers to specific tables/figures, reducing verifiability of the reported differences.
[Results / Analysis section] The decision-region analysis is described only at a high level; additional detail on the metric used to quantify 'small regions' versus 'elsewhere' would strengthen the mechanistic explanation.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the careful reading and for identifying a point where the experimental controls require explicit clarification. We address the concern directly below.

read point-by-point responses

Referee: [Abstract / Experimental setup] Abstract and experimental setup: The validation-based tuning is introduced without specifying whether hyperparameter search ranges, validation-set construction, early-stopping criteria, or optimization budgets are held fixed across model widths. Because wider networks admit different (often lower) minima in the same hyperparameter space due to increased capacity, any reported advantage for overparameterized models may partly reflect tuning artifacts rather than intrinsic properties of overparameterization. This directly affects the central claim that unlearning 'excels' on overparameterized models.

Authors: We agree that the manuscript must make the fairness of the tuning procedure explicit. In the revised version we will expand the experimental-setup section to state that the hyperparameter search ranges, validation-set construction (including the split of the retained data), early-stopping criteria, and optimization budgets are identical for every model width. With these controls fixed, the observed advantages of wider networks cannot be attributed to differential tuning effort. We will also add a short paragraph confirming that the same validation-based selection rule is applied uniformly, thereby removing the possibility of tuning artifacts and reinforcing the claim that overparameterization itself facilitates more effective localized unlearning. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical study with direct experimental observations

full rationale

The paper is a purely empirical investigation that defines validation-based tuning for unlearning methods and reports performance differences across DNN widths, goals, and method variants as direct experimental results. No equations, derivations, fitted parameters renamed as predictions, or load-bearing self-citations appear in the provided text or abstract. The central claims rest on measured outcomes (privacy/bias improvement, decision-region changes) rather than any reduction to inputs by construction. This qualifies as self-contained against external benchmarks with no circular steps.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The paper is an empirical investigation relying on standard assumptions of DNN training and generalization; no new free parameters, axioms beyond domain standards, or invented entities are introduced.

axioms (1)

domain assumption Standard assumptions about DNN training dynamics and generalization hold across different widths.
Implicit in all comparisons of model parameterization levels.

pith-pipeline@v0.9.0 · 5736 in / 1327 out tokens · 41134 ms · 2026-05-22T23:59:55.165579+00:00 · methodology

discussion (0)

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

IndisputableMonolith/Foundation/AbsoluteFloorClosure.lean reality_from_one_distinction unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

unlearning success for overparameterized models stems from the ability to delicately change the model functionality in small regions in the input space while keeping much of the model functionality unchanged
IndisputableMonolith/Cost/FunctionalEquation.lean washburn_uniqueness_aczel unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

validation-based hyperparameter tuning ... SP(Ψ; w0, Dval, Df) = λ · |E(wΨ; Df) − E(wΨ; DvalF)| + (1−λ)·E(wΨ; Dval)

What do these tags mean?

matches: The paper's claim is directly supported by a theorem in the formal canon.
supports: The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends: The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses: The paper appears to rely on the theorem as machinery.
contradicts: The paper's claim conflicts with a theorem or certificate in the canon.
unclear: Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

28 extracted references · 28 canonical work pages · 1 internal anchor

[1]

Abitbul and Y

K. Abitbul and Y . Dar. How much training data is memo- rized in overparameterized autoencoders? an inverse prob- lem perspective on memorization evaluation. In Joint Euro- pean Conference on Machine Learning and Knowledge Dis- covery in Databases, pages 321–339, 2024. 1

work page 2024
[2]

Arpit, S

D. Arpit, S. Jastrzkebski, N. Ballas, D. Krueger, E. Bengio, M.S. Kanwal, T. Maharaj, A. Fischer, A. Courville, Y . Ben- gio, and S. Lacoste-Julien. A closer look at memorization in deep networks. In International Conference on Machine Learning (ICML), pages 233–242, 2017

work page 2017
[3]

Carlini, F

N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert- V oss, K. Lee, A. Roberts, T. Brown, D. Song, and U. Erlings- son. Extracting training data from large language models. In USENIX Security Symposium, pages 2633–2650, 2021. 1

work page 2021
[4]

Carlini, J

N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V . Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace. Extracting training data from diffusion models. In USENIX Security Symposium, pages 5253–5270, 2023. 1

work page 2023
[5]

S. Goel, A. Prabhu, A. Sanyal, S.-N. Lim, P. Torr, and P. Ku- maraguru. Towards adversarial evaluations for inexact ma- chine unlearning. arXiv preprint arXiv:2201.06640 , 2022. 5

work page arXiv 2022
[6]

Golatkar, A

A. Golatkar, A. Achille, and S. Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)), pages 9304–9312, 2020. 2, 3, 5

work page 2020
[7]

Golatkar, A

A. Golatkar, A. Achille, and S. Soatto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In European Conference on Computer Vision (ECCV), pages 383–398. Springer, 2020. 4, 5, 10

work page 2020
[8]

Krizhevsky and G

A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. 2009. 5

work page 2009
[9]

Kurmanji, P

M. Kurmanji, P. Triantafillou, J. Hayes, and E. Triantafillou. Towards unbounded machine unlearning. Advances in neu- ral information processing systems (NeurIPS), 2024. 2, 3, 4, 5, 10

work page 2024
[10]

Le and X

Y . Le and X. Yang. Tiny imagenet visual recognition chal- lenge. CS 231N, 7(7):3, 2015. 5

work page 2015
[11]

J. Liu, P. Ram, Y . Yao, G. Liu, Y . Liu, P. Sharma, and S. Liu. Model sparsity can simplify machine unlearning. Advances in Neural Information Processing Systems (NeurIPS), 2024. 2, 3, 10

work page 2024
[12]

Maini, M

P. Maini, M. C. Mozer, H. Sedghi, Z. C. Lipton, J. Z. Kolter, and C. Zhang. Can neural network memorization be local- ized? In International Conference on Machine Learning (ICML), pages 23536–23557, 2023. 1

work page 2023
[13]

Mantelero

A. Mantelero. The EU proposal for a general data protec- tion regulation and the roots of the ‘right to be forgotten’. Computer Law & Security Review, 29(3):229–235, 2013. 1

work page 2013
[14]

Nakkiran, G

P. Nakkiran, G. Kaplun, Y . Bansal, T. Yang, B. Barak, and I. Sutskever. Deep double descent: Where bigger models and more data hurt. In International Conference on Learning Representations (ICLR), 2020. 5, 10

work page 2020
[15]

Radhakrishnan, M

A. Radhakrishnan, M. Belkin, and C. Uhler. Overparameter- ized neural networks implement associative memory. Pro- ceedings of the National Academy of Sciences , 117(44): 27162–27170, 2020. 1

work page 2020
[16]

Shokri, M

R. Shokri, M. Stronati, C. Song, and V . Shmatikov. Member- ship inference attacks against machine learning models. In IEEE symposium on security and privacy, pages 3–18. IEEE,

work page
[17]

Somepalli, L

G. Somepalli, L. Fowl, A. Bansal, P. Yeh-Chiang, Y . Dar, R. Baraniuk, M. Goldblum, and T. Goldstein. Can neural nets learn the same model twice? investigating reproducibility and double descent from the decision boundary perspective. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 2, 5, 7, 10, 11

work page 2022
[18]

J. T. Springenberg, A. Dosovitskiy, T. Brox, and M. Ried- miller. Striving for simplicity: The all convolutional net. arXiv preprint arXiv:1412.6806, 2014. 5, 10

work page internal anchor Pith review Pith/arXiv arXiv 2014
[19]

J. Tan, B. Mason, H. Javadi, and R. Baraniuk. Parameters or privacy: A provable tradeoff between overparameterization and membership inference. Advances in Neural Information Processing Systems (NeurIPS) , pages 17488–17500, 2022. 1, 2

work page 2022
[20]

Zhang, S

C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals. Understanding deep learning requires rethinking generaliza- tion. In International Conference on Learning Representa- tions (ICLR), 2017. 1 9 Appendices A. Additional Experimental Details All experiments were conducted using internal computational re- sources, which primarily consisted of NVIDIA RTX...

work page 2017
[21]

member” (if the corresponding sample was part of the training set) or “non- member

Dataset creation: We constructed a dataset consisting of loss values, where each entry was labeled as either a “member” (if the corresponding sample was part of the training set) or “non- member” (if it was not part of the training set)

work page
[22]

Model training: Using this dataset, we trained multiple logistic regression models with cross-validation to ensure robustness and avoid overfitting

work page
[23]

This measures the extent to which the forget set examples can be identified as members or non-members of the training set based on their loss values

MIA accuracy calculation : The MIA accuracy represents the success rate of the attack, evaluated specifically on the forget set. This measures the extent to which the forget set examples can be identified as members or non-members of the training set based on their loss values. Best privacy corresponds to MIA accuracy of 0.5. 10 Figure B.1. Unlearning for...

work page
[24]

Image selection: For each plane, we randomly selected three images: one from the forget set and two from the retain set (composed of the remaining images)

work page
[25]

The construction of the plane given three images is as explained in [17]

Plane construction: Using the three selected images, we con- structed a (truncated) plane that is spanned and contain the three images. The construction of the plane given three images is as explained in [17]

work page
[26]

Grid sampling: From the constructed plane, we sampled 75 × 75 uniformly-spaced points that form a 2D discrete grid on the plane to create new images and evaluating decision regions

work page
[27]

(9)-(10) for unlearning of spe- cific examples

Unlearning similarity calculation : Unlearning similarity scores were computed using Eq. (9)-(10) for unlearning of spe- cific examples. See the detailed explanations in Section 6.1

work page
[28]

The similarity scores were averaged across these planes to obtain stable and reliable metrics for similarity and change

Plane averaging : We repeated the above process for 300 planes. The similarity scores were averaged across these planes to obtain stable and reliable metrics for similarity and change. This method provides a comprehensive evaluation of decision regions, enabling us to analyze the effects of unlearning methods. D.2. Additional Decision Regions Results In t...

work page

[1] [1]

Abitbul and Y

K. Abitbul and Y . Dar. How much training data is memo- rized in overparameterized autoencoders? an inverse prob- lem perspective on memorization evaluation. In Joint Euro- pean Conference on Machine Learning and Knowledge Dis- covery in Databases, pages 321–339, 2024. 1

work page 2024

[2] [2]

Arpit, S

D. Arpit, S. Jastrzkebski, N. Ballas, D. Krueger, E. Bengio, M.S. Kanwal, T. Maharaj, A. Fischer, A. Courville, Y . Ben- gio, and S. Lacoste-Julien. A closer look at memorization in deep networks. In International Conference on Machine Learning (ICML), pages 233–242, 2017

work page 2017

[3] [3]

Carlini, F

N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert- V oss, K. Lee, A. Roberts, T. Brown, D. Song, and U. Erlings- son. Extracting training data from large language models. In USENIX Security Symposium, pages 2633–2650, 2021. 1

work page 2021

[4] [4]

Carlini, J

N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V . Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace. Extracting training data from diffusion models. In USENIX Security Symposium, pages 5253–5270, 2023. 1

work page 2023

[5] [5]

S. Goel, A. Prabhu, A. Sanyal, S.-N. Lim, P. Torr, and P. Ku- maraguru. Towards adversarial evaluations for inexact ma- chine unlearning. arXiv preprint arXiv:2201.06640 , 2022. 5

work page arXiv 2022

[6] [6]

Golatkar, A

A. Golatkar, A. Achille, and S. Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)), pages 9304–9312, 2020. 2, 3, 5

work page 2020

[7] [7]

Golatkar, A

A. Golatkar, A. Achille, and S. Soatto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In European Conference on Computer Vision (ECCV), pages 383–398. Springer, 2020. 4, 5, 10

work page 2020

[8] [8]

Krizhevsky and G

A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. 2009. 5

work page 2009

[9] [9]

Kurmanji, P

M. Kurmanji, P. Triantafillou, J. Hayes, and E. Triantafillou. Towards unbounded machine unlearning. Advances in neu- ral information processing systems (NeurIPS), 2024. 2, 3, 4, 5, 10

work page 2024

[10] [10]

Le and X

Y . Le and X. Yang. Tiny imagenet visual recognition chal- lenge. CS 231N, 7(7):3, 2015. 5

work page 2015

[11] [11]

J. Liu, P. Ram, Y . Yao, G. Liu, Y . Liu, P. Sharma, and S. Liu. Model sparsity can simplify machine unlearning. Advances in Neural Information Processing Systems (NeurIPS), 2024. 2, 3, 10

work page 2024

[12] [12]

Maini, M

P. Maini, M. C. Mozer, H. Sedghi, Z. C. Lipton, J. Z. Kolter, and C. Zhang. Can neural network memorization be local- ized? In International Conference on Machine Learning (ICML), pages 23536–23557, 2023. 1

work page 2023

[13] [13]

Mantelero

A. Mantelero. The EU proposal for a general data protec- tion regulation and the roots of the ‘right to be forgotten’. Computer Law & Security Review, 29(3):229–235, 2013. 1

work page 2013

[14] [14]

Nakkiran, G

P. Nakkiran, G. Kaplun, Y . Bansal, T. Yang, B. Barak, and I. Sutskever. Deep double descent: Where bigger models and more data hurt. In International Conference on Learning Representations (ICLR), 2020. 5, 10

work page 2020

[15] [15]

Radhakrishnan, M

A. Radhakrishnan, M. Belkin, and C. Uhler. Overparameter- ized neural networks implement associative memory. Pro- ceedings of the National Academy of Sciences , 117(44): 27162–27170, 2020. 1

work page 2020

[16] [16]

Shokri, M

R. Shokri, M. Stronati, C. Song, and V . Shmatikov. Member- ship inference attacks against machine learning models. In IEEE symposium on security and privacy, pages 3–18. IEEE,

work page

[17] [17]

Somepalli, L

G. Somepalli, L. Fowl, A. Bansal, P. Yeh-Chiang, Y . Dar, R. Baraniuk, M. Goldblum, and T. Goldstein. Can neural nets learn the same model twice? investigating reproducibility and double descent from the decision boundary perspective. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 2, 5, 7, 10, 11

work page 2022

[18] [18]

J. T. Springenberg, A. Dosovitskiy, T. Brox, and M. Ried- miller. Striving for simplicity: The all convolutional net. arXiv preprint arXiv:1412.6806, 2014. 5, 10

work page internal anchor Pith review Pith/arXiv arXiv 2014

[19] [19]

J. Tan, B. Mason, H. Javadi, and R. Baraniuk. Parameters or privacy: A provable tradeoff between overparameterization and membership inference. Advances in Neural Information Processing Systems (NeurIPS) , pages 17488–17500, 2022. 1, 2

work page 2022

[20] [20]

Zhang, S

C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals. Understanding deep learning requires rethinking generaliza- tion. In International Conference on Learning Representa- tions (ICLR), 2017. 1 9 Appendices A. Additional Experimental Details All experiments were conducted using internal computational re- sources, which primarily consisted of NVIDIA RTX...

work page 2017

[21] [21]

member” (if the corresponding sample was part of the training set) or “non- member

Dataset creation: We constructed a dataset consisting of loss values, where each entry was labeled as either a “member” (if the corresponding sample was part of the training set) or “non- member” (if it was not part of the training set)

work page

[22] [22]

Model training: Using this dataset, we trained multiple logistic regression models with cross-validation to ensure robustness and avoid overfitting

work page

[23] [23]

This measures the extent to which the forget set examples can be identified as members or non-members of the training set based on their loss values

MIA accuracy calculation : The MIA accuracy represents the success rate of the attack, evaluated specifically on the forget set. This measures the extent to which the forget set examples can be identified as members or non-members of the training set based on their loss values. Best privacy corresponds to MIA accuracy of 0.5. 10 Figure B.1. Unlearning for...

work page

[24] [24]

Image selection: For each plane, we randomly selected three images: one from the forget set and two from the retain set (composed of the remaining images)

work page

[25] [25]

The construction of the plane given three images is as explained in [17]

Plane construction: Using the three selected images, we con- structed a (truncated) plane that is spanned and contain the three images. The construction of the plane given three images is as explained in [17]

work page

[26] [26]

Grid sampling: From the constructed plane, we sampled 75 × 75 uniformly-spaced points that form a 2D discrete grid on the plane to create new images and evaluating decision regions

work page

[27] [27]

(9)-(10) for unlearning of spe- cific examples

Unlearning similarity calculation : Unlearning similarity scores were computed using Eq. (9)-(10) for unlearning of spe- cific examples. See the detailed explanations in Section 6.1

work page

[28] [28]

The similarity scores were averaged across these planes to obtain stable and reliable metrics for similarity and change

Plane averaging : We repeated the above process for 300 planes. The similarity scores were averaged across these planes to obtain stable and reliable metrics for similarity and change. This method provides a comprehensive evaluation of decision regions, enabling us to analyze the effects of unlearning methods. D.2. Additional Decision Regions Results In t...

work page