Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Mixup Unlearning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MixUnlearn, an adversarially trained mixup generator plus contrastive unlearning losses that regularize approximate machine unlearning against catastrophic forgetting of retained knowledge.
Problem
Approximate machine unlearning suffers from catastrophic unlearning, where forgetting specific data also erases essential knowledge and drives the model away from a retrained model, especially for samples near the forgotten data in feature space.
Approach
A generator with a learnable MixBlock produces hard mixup samples from Forgetting and Remaining data, trained adversarially with a contrastive loss to reverse the unlearning direction; the unlearner is then regularized with contrastive losses on these mixed samples and on real samples, working with or without labels.
Key results
- On CIFAR-10 class-level label-aware unlearning, MixUnlearn reaches Test_r 87.10% vs Retrain 86.80% and LAF+R 87.20%, with Test_f 0%.
- Label-agnostic MixUnlearn on CIFAR-10 class-level achieves Test_r 86.32% vs L-Mix 82.34% and LAF 82.01%.
- On FASHION-MNIST data-level unlearning, the MixBlock variant reaches Train_f 91.99% vs Retrain 92.15% while the w/o MB variant reaches 95.68%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use MixUnlearn instead of L-Mix | label-agnostic class-level unlearning · CIFAR-10 | Test_r: 82.34±0.99 -> 86.32±0.56 | Helped |
| use MixUnlearn instead of LAF+R | label-aware class-level unlearning · CIFAR-10 | Test_r: 87.20±0.69 -> 87.10±0.78 | No clear effect |
| use MixUnlearn instead of Retrain | label-aware class-level unlearning · SVHN | Test_r: 94.20±0.78 -> 93.95±0.69 | No clear effect |
| replace hard generator samples with vanilla mixup (α=0.35) (ablation) | MixUnlearn · CIFAR-10 class-level, label-agnostic | Test_r: 86.32±0.56 -> 85.01±0.53 | Hurt |
| replace hard generator samples with vanilla mixup (α=0.75) (ablation) | MixUnlearn · CIFAR-10 class-level, label-agnostic | Test_r: 86.32±0.56 -> 85.42±0.32 | Hurt |
| replace hard generator samples with vanilla mixup (α=1.5) (ablation) | MixUnlearn · CIFAR-10 class-level, label-agnostic | Test_r: 86.32±0.56 -> 84.96±0.69 | Hurt |
| add L_real (ablation) | MixUnlearn · CIFAR-10 class-level, label-agnostic | Test_r: 29.30±1.80 -> 86.32±0.56 | Helped |
| add L_mix (ablation) | MixUnlearn · CIFAR-10 class-level, label-agnostic | Test_r: 82.15±1.69 -> 86.32±0.56 | Helped |
| add sharpening (ablation) | MixUnlearn · CIFAR-10 class-level, label-agnostic | Test_r: 85.83±0.89 -> 86.32±0.56 | Helped |
| add MixBlock (ablation) | MixUnlearn · FASHION-MNIST data-level basic, label-agnostic | Train_f: 95.68±1.32 -> 91.99±2.01 | Helped |
| use MixUnlearn instead of Retrain | label-aware data-level unlearning · CIFAR-10 | Test: 86.99±0.78 -> 85.99±1.15 | No clear effect |
| use MixUnlearn instead of LAF+R | label-aware data-level unlearning · SVHN | Test: 93.68±0.77 -> 93.31±0.55 | No clear effect |
Surprising findings
- Removing the MixBlock generator (vanilla mixup with alpha 0.75) and removing sharpening sometimes gives higher ASR than the full method on CIFAR-10 class-level, e.g., w/o Sharpen ASR 70.27 vs 68.48 in the aware ablation.
Limitations
- Termination of unlearning relies on a fixed epoch budget with no principled stopping criterion, as the authors acknowledge.
- Hyperparameters (tau, omega, alpha, sharpening temperature) are tuned per setting with a search grid, and the label-agnostic setting is much harder than label-aware.
- Experiments on ImageNet use only the ImageNet-1K validation set split due to computational cost, so large-scale validation is missing.
Experimental setup
Datasets: CIFAR-10 SVHN MNIST Fashion-MNIST ImageNet-1K
Benchmarks: CIFAR-10 SVHN MNIST Fashion-MNIST ImageNet-1K
Metrics: Test_r Test_f ASR Train_r Train_f Test accuracy loss distribution KDE
Baselines: Retrain NegGrad Boundary SISA Unrolling T-S SCRUB DSMixup GLI LAF+R LAF RandLabel
Builds on: mixup MixBlock (AutoMix) LAF SCRUB SISA
Closest papers by meaning
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.91)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.91)
- Not All Wrong is Bad: Using Adversarial Examples for Unlearning (ICML 2025 · similarity 0.90)
- The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples (NeurIPS 2025 · similarity 0.90)
- Efficient Source-free Unlearning via Energy-Guided Data Synthesis and Discrimination-Aware Multitask Optimization (ICML 2025 · similarity 0.90)
- Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models (NeurIPS 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.