Research map / Adversarial robustness and security / Attacks on text and graphs
Learning to Unlearn: Instance-Wise Unlearning for Pre-trained Classifiers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes instance-wise unlearning that misclassifies or relabels a set of instances in a pre-trained classifier using only the model and forget data, with adversarial-example and MAS weight-importance regularizers to limit forgetting on remaining data.
Problem
Deleting information about specific instances (mixed labels) from a pre-trained classifier without access to the full training set, while preserving accuracy on remaining data.
Approach
Replace undo-style unlearning with intentional misclassification/relabeling of forget instances, regularized by targeted L2-PGD adversarial examples of forget data (to preserve the decision boundary) and MAS-based weight importance (to restrict changes to parameters less important for remaining data).
Key results
- On CIFAR-10 with k=128, Adv+Imp reaches 54.51% remaining-data accuracy vs 7.11% for NegGrad, with 0% forget-set accuracy.
- On ImageNet-1K with k=16, Adv+Imp retains 81.43% remaining-data accuracy vs 65.02% for NegGrad, with 0% forget-set accuracy.
- In continual unlearning on CIFAR-100 (k=128), Adv+Imp keeps 48.04% remaining-data accuracy vs 1.51% for NegGrad.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add adversarial-example regularization to NegGrad unlearning (ablation) | Instance-wise unlearning · CIFAR-10 test (k=16) | accuracy: 15.87 -> 65.14 | Helped |
| Add adversarial-example regularization to NegGrad unlearning (ablation) | Instance-wise unlearning · CIFAR-100 test (k=16) | accuracy: 48.07 -> 63.17 | Helped |
| Add adversarial-example regularization to NegGrad unlearning (ablation) | Instance-wise unlearning · ImageNet-1K test (k=16) | accuracy: 56.70 -> 70.36 | Helped |
| Add weight-importance regularization to Adv (ablation) | Instance-wise unlearning · CIFAR-10 test (k=16) | accuracy: 65.14 -> 79.65 | Helped |
| Add weight-importance regularization to Adv (ablation) | Instance-wise unlearning · CIFAR-100 test (k=16) | accuracy: 63.17 -> 63.69 | Helped |
| Add weight-importance regularization to Adv (ablation) | Instance-wise unlearning · ImageNet-1K test (k=16) | accuracy: 70.36 -> 70.77 | Helped |
| Add weight-importance regularization when correcting ImageNet-A predictions (ablation) | Adv correction · ImageNet-A corrected instances (k=64) | accuracy: 95.31 -> 10.94 | Hurt |
| Add weight-importance regularization when correcting ImageNet-A predictions (ablation) | Adv correction · ImageNet-A test (k=64) | accuracy: 72.68 -> 72.39 | No clear effect |
| Increase RAWP gamma from 0.001 to 0.01 (ablation) | RAWP · CIFAR-10 D_r (k=16) | accuracy: 88.31 -> 67.15 | Hurt |
| Increase RAWP gamma from 0.001 to 0.01 (ablation) | RAWP · CIFAR-10 D_f (k=128) | accuracy: 0.0 -> 4.06 | Hurt |
Surprising findings
- Weight-importance regularization hurts when correcting ImageNet-A adversarial images with large k, causing forget-set accuracy to drop to about 10%.
- Adv+Imp fails to relabel forget data well in the relabeling setting, showing the regularization over-prioritizes retention.
Limitations
- Relabeling large forget sets degrades forget-set accuracy under the importance regularizer.
- Weight-importance regularization can be too strong for large k, limiting unlearning of natural adversarial examples.
- Evaluation limited to image classification with small forget sets (up to 256 images).
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet-1K UTKFace ImageNet-A
Benchmarks: CIFAR-10 CIFAR-100 ImageNet-1K UTKFace ImageNet-A
Metrics: accuracy on forget set accuracy on remaining set accuracy on test set CKA similarity t-SNE visualization
Baselines: Oracle NegGrad RAWP Amnesiac Correct
Builds on: MAS AWP NegGrad Amnesiac unlearning L2-PGD
Closest papers by meaning
- Not All Wrong is Bad: Using Adversarial Examples for Unlearning (ICML 2025 · similarity 0.92)
- The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples (NeurIPS 2025 · similarity 0.90)
- From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization (NeurIPS 2025 · similarity 0.90)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.89)
- Partially Blinded Unlearning: Class Unlearning for Deep Networks from Bayesian Perspective (AAAI 2025 · similarity 0.89)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.