cs.LGOct 3, 2024

Instance-Level Difficulty: A Missing Perspective in Machine Unlearning

Authors: Hammad Rizwan, Mahtab Sarvmaili, Hassan Sajjad, Ga Wu

Organizations: Department of Computer Science, Dalhousie University, Canada.

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Current research on deep machine unlearning primarily focuses on improving or evaluating the overall effectiveness of unlearning methods while overlooking the varying difficulty of unlearning individual training samples. As a result, the broader feasibility of machine unlearning remains under-explored. This paper studies the cruxes that make machine unlearning difficult through a thorough instance-level unlearning performance analysis over various unlearning algorithms and datasets. In particular, we summarize four factors that make unlearning a data point difficult, and we empirically show that these factors are independent of a specific unlearning algorithm but only relevant to the target model and its training data. Given these findings, we argue that machine unlearning research should pay attention to the instance-level difficulty of unlearning.

Figures & tables

Figure 1: Effectiveness of using Tolerance of Preference Shift (TPS) as an index of unlearning difficulty. For the four different unlearning algorithms, we note there is a consistent positive alignment between TPS and empirical unlearning outcome (GT). The experiments are conducted on ResNet-18 model trained on SVHN dataset.
Figure 2: Effectiveness of using Distance of Preference Shift (DPS) as an index of unlearning difficulty. For the tree out of four different unlearning algorithms, we observe a negative alignment between DPS and empirical unlearning outcome (GT). For SalUn, there is no clear correlation between DPS and GT. The experiments are conducted on ResNet-18 model trained on SVHN dataset.
Figure 3: Effectiveness of using Geometric Distance to Decision Boundary (GDDB) as an index of unlearning difficulty. (Top) Distance to decision boundary estimated through DeepFool in adversarial learning literature. (Bottom) Distance to the decision boundary is estimated by treating the last layer of a neural network as a linear classifier. There is no observable correlation between empirical unlearning difficulty and training data’s geometric distance to the decision boundary. The experiments is conducted on ResNet-18 model trained on SVHN dataset.
Figure 4: Effectiveness of using Number of Unlearning Epochs (NUE) as an index of unlearning difficulty. We observed noisy negative alignment between NUE and GT for gradient based approaches. For SCRUB and SalUn, there is no observable correlation. The experiments are conducted on ResNet-18 model trained on SVHN dataset.
Figure 5: Effectiveness of MIA as index of unlearning difficulty. A prediction of ”1” indicates successful unlearning, where the unlearned model no longer retains information about the data, while ”0” signifies failed unlearning, where the model still remembers the unlearned samples. We observed noisy positive alignment between MIA and GT for gradient based approaches. The larger the GT, the easier the data point for unlearning and this is positively associated with MIA=”1”. For SCRUB there is no observable correlation. The experiments are conducted on ResNet-18 model trained on SVHN dataset.
Figure 6: Effectiveness of Size of Unlearning Expansion (SUE) as an index of unlearning difficulty. The similarity each data point is measured by KDE at that point. Higher density values indicate that the data point lies in a region with many similar samples. From the obtained results there is no correlation between SUE and GT. The experiments are conducted on ResNet-18 model trained on SVHN dataset.
  SalUnNGSCRUBGA
 Factor/MetricCorrp-valueCorrp-valueCorrp-valueCorrp-value
SVHNTest Accuracy (TPS)0.25078.39×10−168.39\times 10^{-16}0.99810.00.98790.00.99960.0
Model Distance - KL (DPS)0.44146.29×10−496.29\times 10^{-49}-0.55488.84×10−828.84\times 10^{-82}-0.78204.09×10−2074.09\times 10^{-207}-0.79881.66×10−2221.66\times 10^{-222}
Model Distance - Absolute (DPS)0.36487.68×10−337.68\times 10^{-33}-0.57061.89×10−871.89\times 10^{-87}-0.81336.36×10−2376.36\times 10^{-237}-0.78983.92×10−2143.92\times 10^{-214}
Forget Predictive Probability Difference0.79744.06×10−2214.06\times 10^{-221}-0.12884.42×10−54.42\times 10^{-5}-0.61255.01×10−1045.01\times 10^{-104}0.36182.76×10−322.76\times 10^{-32}
Test Predictive Probability Difference-0.25472.87×10−162.87\times 10^{-16}-0.99990.0-0.99990.0-0.99980.0
Table 1: The correlation and p-value results between the GT score and various factors examined in this study for different unlearning methods. The term ”metrics” following the factor abbreviations indicates the specific measurements used in the empirical evaluation.
Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

AlgorithUnlearning rateUnlearning steps 
Gradient Ascent (GA)1e-420 
NegGrad1e-420 
SCRUB1e-320 
SalUn0.0120 
Fine Tune (FT)1e-420 
Appendix
Table 8
DatasetModelLayersBatch SizeNumber of ClassesLearning RateSamples
MNISTResNet1818150100.00154000
CIFAR10ResNet1818150100.0145000
SVHNResNet181864100.00158000
Appendix
Table 2: This table details the datasets and models used in evaluating unlearning algorithms, specifying the models applied to each dataset, including the number of layers, batch sizes, number of classes, learning rates, and sample sizes. The information presented provides insight into the computational frameworks employed to analyze MNIST, CIFAR-10, and SVHN datasets, demonstrating the diversity of approaches used in the study.
Figure 7: Accuracy of the remaining data ( DrD_{r} ) post-unlearning, presented consecutively from top to bottom for the SVHN, CIFAR-10, and MNIST datasets. For the four different unlearning algorithms, we note there is a consistent positive alignment between accuracy of remaining data and empirical unlearning outcome (GT).
Figure 8: Effectiveness of using Distance of Preference Shift (DPS) as index of unlearning difficulty. (Top) Absolute average layer-wise distance of the model’s weights pre- and post-unlearning. (Bottom) KL-divergence of model’s parameters before and after unlearning. The experiments is conducted on ResNet-18 model trained on CIFAR10 dataset.
Figure 9: Effectiveness of using Distance of Preference Shift (DPS) as index of unlearning difficulty. (Top) Absolute average layer-wise distance of the model’s weights pre- and post-unlearning. (Bottom) KL-divergence of model’s parameters before and after unlearning.
Figure 10: Effectiveness of using Geometric Distance to Decision Boundary (GDDB) as index of unlearning difficulty. (Top) Distance to decision boundary estimated through DeepFool in adversarial learning literature. (Bottom) Distance to decision boundary estimated by treating the last layer of neural network as linear classifier. The experiments is conducted on ResNet-18 model trained on CIFAR10 dataset.
Figure 11: Effectiveness of using Geometric Distance to Decision Boundary (GDDB) as index of unlearning difficulty. (Top) Distance to decision boundary estimated through DeepFool in adversarial learning literature. (Bottom) Distance to decision boundary estimated by treating the last layer of neural network as linear classifier. The experiments is conducted on ResNet-18 model trained on MNIST dataset.
Figure 12: Effectiveness of using Number of Unlearning Epochs (NUE) as index of unlearning difficulty. (Top) Number of epochs used to achieve guaranteed unlearning (flip of decision). (Bottom) Wall clock time elapsed to achive guaranteed unlearning. The experiments is conducted on ResNet-18 model trained on CIFAR10 dataset.
Figure 13: Effectiveness of using Number of Unlearning Epochs (NUE) as index of unlearning difficulty. (Top) Number of epochs used to achieve guaranteed unlearning (flip of decision). (Bottom) Wall clock time elapsed to achieve guaranteed unlearning. The experiments is conducted on ResNet-18 model trained on MNIST dataset.
Figure 14: Effectiveness of MIA as index of unlearning difficulty. A prediction of ”1” indicates successful unlearning, where the unlearned model no longer retains information about the data, while ”0” signifies failed unlearning, where the model still remembers the unlearned samples. The experiments is conducted on ResNet-18 model trained on (from top to bottom) CIFAR10 and MNIST datasets.
Figure 15: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Test Accuracy” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 16: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Test Loss Difference” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 17: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Forget Loss Difference” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 18: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Model Distance - Absolute” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 19: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Model Distance - KL” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 20: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Epoch Elapsed” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 21: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”Time Elapsed” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The presence of similar samples suggests that this factor identifies the easiest and most difficult cases independently of the unlearning algorithm. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
Figure 22: Top-3 easiest and and most difficult samples unlearned by GA, NegGrad, SCRUB and SalUn for machine unlearning flagged by ”MIA” presented in section 3.3 . In every picture, the top row (”Top Performing Samples”) is associated to easy samples and the bottom row (”Bottom Performing Samples”) for the difficult samples. The datasets shown (from top to bottom) are SVHN, CIFAR10, and MNIST, respectively.
More in this topic

Machine Unlearning

Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.

See all 343 papers

Explore similar work

CardsList
Jun 1, 2026

How Hard Can It Be? Hardness-Aware Multi-Objective Unlearning

Machine unlearning aims to remove the influence of specific forget training data due to privacy, copyright or bias concerns while maintaining the model performance on the remaining retain data. Existing unlearning algorithms, such as optimizing a weighted combination of losses, have tried to achieve these objectives of improving forget quality and maintaining retain utility. However, they do not guarantee that these objectives can be improved by a specified extent for all forget and retain data. In this work, we address this limitation with a novel and theoretically-grounded approach from a constrained optimization perspective. Firstly, we identify that the hardness of reconciling both objectives can be quantified by the similarity between the forget data and the retain data. Next, we derive an unlearning algorithm (HAMU) with the overall goal of guaranteeing a specified improvement in forget quality while minimizing the retain utility cost/degradation by updating the model weights based on our hardness measure. Our hardness measure also informs users when retain utility degradation is unavoidable, i.e., both objectives cannot be improved simultaneously, and stopping should be considered. Our algorithm is applicable to non-convex models and is easily parallelizable, making it readily deployable in real-world scenarios. We empirically demonstrate HAMU's superior performance over baselines on both image and text datasets using large models. Our code is available at https://github.com/aoi3142/HAMU.

Jiangwei Chen, Xinyuan Niu, Rachael Hwee Ling Sim +3

Department of Computer Science, National University of Singapore, Singapore · Institute for Infocomm Research, Agency for Science, Technology and Research, Singapore · Centre for Frontier AI Research, Agency for Science, Technology and Research, Singapore

Machine UnlearningLLM Unlearning
AskPDF
Apr 9, 2026

Is your algorithm unlearning or untraining?

As models are getting larger and are trained on increasing amounts of data, there has been an explosion of interest into how we can delete'' specific data points or behaviours from a trained model, after the fact. This goal has been referred to as machine unlearning''. In this note, we argue that the term unlearning'' has been overloaded, with different research efforts spanning two distinct problem formulations, but without that distinction having been observed or acknowledged in the literature. This causes various issues, including ambiguity around when an algorithm is expected to work, use of inappropriate metrics and baselines when comparing different algorithms to one another, difficulty in interpreting results, as well as missed opportunities for pursuing critical research directions. In this note, we address this issue by establishing a fundamental distinction between two notions that we identify as \unlearning and \untraining, illustrated in Figure 1. In short, \untraining aims to reverse the effect of having trained on a given forget set, i.e. to remove the influence that that specific forget set examples had on the model during training. On the other hand, the goal of \unlearning is not just to remove the influence of those given examples, but to use those examples for the purpose of more broadly removing the entire underlying distribution from which those examples were sampled (e.g. the concept or behaviour that those examples represent). We discuss technical definitions of these problems and map problem settings studied in the literature to each. We hope to initiate discussions on disambiguating technical definitions and identify a set of overlooked research questions, as we believe that this a key missing step for accelerating progress in the field of unlearning''.

Eleni Triantafillou, Ahmed Imtiaz Humayun, Monica Ribero +3

Google · Hasso Plattner Institute

Machine UnlearningMachine Unlearning EvaluationConcept Erasure
AskPDF
Jun 24, 2026

DFMU: Data-Frugal Machine Unlearning

Machine unlearning is an emerging domain that ensures the safe removal of elements (includes concepts, attributes, entity and class) from the trained model along with least drop in model performance. The domain of machine unlearning brings its own indigenous challenges since the removal of pre-trained elements from model will always degrade the model performance on remaining elements. The existing methods basically rely on retraining for removal of elements from the pre-trained model, which is compute extensive. In this work, we propose a machine unlearning method which helps to reduce the computational requirement for faster retain-dataset accuracy convergence which also does not require extensive retraining of the pre-trained model. The proposed method, Data-Frugal Machine Unlearning (DFMU) requires only a single forward and backward pass for computing the importance score of various computational blocks of a model. The importance score computation is based on knowledge preserving pruning which helps to converge faster and requires far less data as compared to the existing methods. Experimentally, it achieves 40% more retain-accuracy with just 13% of data samples in comparison with SOTA method on various public datasets and also averages 88% faster processing time for forgetting a given class.

Sajith U, Prateek Keserwani

Samsung R&D Institute India-Bangalore, India

Machine Unlearning
AskPDF