Suppression or Deletion: A Restoration-Based Representation-Level Analysis of Machine Unlearning
Authors: Yurim Jang, Jaeung Lee, Dohyun Kim, Jaemin Jo, Simon S. Woo
Organizations: Department of Artificial Intelligence, Sungkyunkwan University, Suwon, Republic of Korea · Department of Computer Science and Engineering, Sungkyunkwan University, Suwon, Republic of Korea
As pretrained models are increasingly shared on the web, ensuring that models can forget or delete sensitive, copyrighted, or private information upon request has become crucial. Machine unlearning has been proposed to address this challenge. However, current evaluations for unlearning methods rely on output-based metrics, which cannot verify whether information is completely deleted or merely suppressed at the representation level, where suppression is insufficient for true unlearning. To address this gap, we propose a novel restoration-based analysis framework that uses Sparse Autoencoders to identify class-specific expert features in intermediate layers and applies inference-time steering to quantitatively distinguish between suppression and deletion. Applying our framework to 12 major unlearning methods in image classification tasks, we find that most methods achieve high restoration rates of unlearned information, indicating that they only suppress information at the decision-boundary level, while preserving semantic features in intermediate representations. Notably, even retraining from pretrained checkpoints shows high restoration, revealing that robust semantic features inherited from pretraining are not removed by retraining. These results demonstrate that representation-level retention poses significant risks overlooked by output-based metrics, highlighting the need for new unlearning evaluation criteria. We propose new evaluation guidelines that prioritize representation-level verification, especially for privacy-critical applications in the era of pre-trained models.
Figures & tables
Dataset
Class
Layer 8
Layer 9
Layer 10
CIFAR-10
Forget
-95.00
-98.60
-99.00
Retain
+0.10
+0.18
+0.24
ImageNette
Forget
-82.80
-96.44
-98.80
Retain
+0.50
+0.52
+0.52
Table 1. SAE ablation study on CIFAR-10 (Class 2, 20 features) and ImageNette (Class 7, 40 features). Ablating the expert features causes substantial forget class accuracy drops while maintaining retain class accuracy, validating class-specificity.
Figure 1. Overview of the Suppression or Deletion framework. Top: Class-specific expert features are selected from SAE activations. Middle: Activations from the original and unlearned models are encoded via SAE and steered at these expert features to restore the representations. Bottom: The steered representations are decoded and propagated through the remaining layers; restoration of forget class predictions indicates suppression rather than deletion .
Method
CIFAR-10 (bird, Class 2)
ImageNette (gas pump, Class 7)
Unlearned Accuracy
Restored Accuracy
Unlearned Accuracy
Restored Accuracy
Layer 8
Layer 9
Layer 10
Layer 8
Layer 9
Layer 10
Retrain
0.00%
95.70% (+95.70)
99.60% (+99.60)
99.40% (+99.40)
0.00%
43.44% (+43.44)
84.83% (+84.83)
98.97% (+98.97)
Finetune
46.90%
45.90% (-1.00)
51.30% (+4.40)
94.00% (+47.10)
0.00%
0.72% (+0.72)
0.72% (+0.72)
84.73% (+84.73)
AdvNegGrad
0.00%
100.00% (+100.00)
100.00% (+100.00)
100.00% (+100.00)
0.00%
1.03% (+1.03)
21.08% (+21.08)
82.01% (+82.01)
RandomLabel
0.00%
100.00% (+100.00)
100.00% (+100.00)
100.00% (+100.00)
0.00%
4.30% (+4.30)
82.82% (+82.82)
99.76% (+99.76)
Table 2. Our framework evaluates 12 major unlearning methods on CIFAR-10 and ImageNette, by measuring forget class accuracy before and after restoration across layers. Red cells indicate forget class accuracy over 80% after restoration.
Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.
While numerous machine unlearning (MU) methods have recently been developed with promising results in erasing the influence of forgotten data, classes, or concepts, they are also highly vulnerable-for example, simple fine-tuning can inadvertently reintroduce erased concepts. In this paper, we address this contradiction by examining the internal representations of unlearned models, in contrast to prior work that focuses primarily on output-level behavior. Our analysis shows that many state-of-the-art MU methods appear successful mainly due to a misalignment between last-layer features and the classifier, a phenomenon we call feature-classifier misalignment. In fact, hidden features remain highly discriminative, and simple linear probing can recover near-original accuracy. Assuming neural collapse in the original model, we further demonstrate that adjusting only the classifier can achieve negligible forget accuracy while preserving retain accuracy, and we corroborate this with experiments using classifier-only fine-tuning. Motivated by these findings, we propose MU methods based on a class-mean features (CMF) classifier, which explicitly enforces alignment between features and classifiers. Experiments on standard benchmarks show that CMF-based unlearning reduces forgotten information in representations while maintaining high retain accuracy, highlighting the need for faithful representation-level evaluation of MU.
Yichen Gao, Altay Unal, Akshay Rangamani +1
Department of Computer Science & Engineering, The Ohio State University · Department of Data Science, New Jersey Institute of Technology
Machine unlearning aims to remove the influence of specific training records from a deployed model without retraining from scratch. Current protocols verify this at the output level through membership inference, retain accuracy, and forget-set accuracy, but a model can satisfy all three whilst still encoding forgotten records in its intermediate representations. We introduce RULER, a set of representation-level verification metrics. The oracle-comparative metric M2 measures whether forget-set records occupy the same representational position as in a model retrained without them. The oracle-free metric M4 detects residuals from the unlearned model's internal similarity structure alone, without retraining. Four approximate unlearning methods all pass output-level evaluation, yet under a linear mixed-effects model M2 detects significant residuals in 10 of 12 conditions (p<0.05), with effect sizes growing as the forget fraction increases. A fifth method, Bad Teacher, shows the same residuals despite a different forgetting mechanism. M4 acts as a pre-unlearning diagnostic across tabular, image, clinical text, and face-identity settings: it detects identity-level memorisation in face recognition models where no tested method fully erases the signal.
Georgina Cosma, Axel Finke
Department of Computer Science, Loughborough University, UK · School of Mathematics, Statistics and Physics, Newcastle University, UK
Machine unlearning (MU) addresses privacy risks in pretrained models. The main goal of MU is to remove the influence of designated data while preserving the utility of retained knowledge. Achieving this goal requires preserving semantic relations among retained instances, which existing studies often overlook. We observe that without such preservation, models suffer from progressive structural collapse, undermining both the deletion-retention balance. In this work, we propose a novel structure-faithful framework that introduces stakes, i.e., semantic anchors that serve as reference points to maintain the knowledge structure. By leveraging these anchors, our framework captures and stabilizes the semantic organization of knowledge. Specifically, we instantiate the anchors from language-driven attribute descriptions encoded by a semantic encoder (e.g., CLIP). We enforce preservation of the knowledge structure via structure-aware alignment and regularization: the former aligns the organization of retained knowledge before and after unlearning around anchors, while the latter regulates updates to structure-critical parameters. Results from image classification, retrieval, and face recognition show average gains of 32.9%, 22.5%, and 19.3% in performance, balancing the deletion-retention trade-off and enhancing generalization.