Benchmarking Unlearning for Vision Transformers

Kairan Zhao; Iurie Luca; Peter Triantafillou

cs.CVFeb 23, 2026

Benchmarking Unlearning for Vision Transformers

Authors: Kairan Zhao, Iurie Luca, Peter Triantafillou

Organizations: University of Warwick

Abstract

Machine unlearning (MU) refers to the post-training capability to remove (the influence of) training examples that are incorrect, biased, or leak sensitive/private information. MU is now widely regarded as critical for building safe and fair AI. In parallel, research into transformer architectures for computer vision has been highly successful: Vision Transformers (VTs) increasingly emerge as strong alternatives to CNNs. Yet, MU research for vision tasks has largely centered on CNNs, not VTs. While MU benchmarks have been developed for LLMs, diffusion models, and CNNs, none currently exist for VTs. This work is the first to attempt this, benchmarking MU algorithm performance across different VT families (ViT, Swin-T, and DINOv2) and at different capacities. The work employs (i) different datasets, selected to assess the impacts of dataset scale and complexity; (ii) different MU algorithms, selected to represent fundamentally different approaches for MU; and (iii) both single-shot and continual unlearning protocols. Additionally, it focuses on benchmarking MU algorithms that leverage training data memorization, since leveraging memorization has been recently discovered to significantly improve the performance of previously SOTA algorithms. En route, the work characterizes how VTs memorize training data relative to CNNs, and assesses the impact of different memorization proxies on performance. The benchmark uses unified evaluation metrics that capture two complementary notions of forget quality along with accuracy on unseen (test) data and on retained data. Overall, this work offers a benchmarking basis, enabling reproducible, fair, and comprehensive comparisons of existing (and future) MU algorithms on VTs. Importantly, for the first time, it sheds light on how well existing algorithms work in VT settings, establishing a promising reference performance baseline.

Figures & tables

	CIFAR-10			CIFAR-100
Proxy	ResNet-18	ViT-Small	Swin-Tiny	ResNet-50	ViT-Small	Swin-Tiny
Conf	-0.80	-0.79	-0.88	-0.91	-0.85	-0.90
MaxConf	-0.76	-0.77	-0.85	-0.87	-0.80	-0.86
Ent	-0.75	-0.78	-0.85	-0.80	-0.77	-0.82
BA	-0.71	-0.63	-0.79	-0.89	-0.69	-0.78
HR	+0.67	+0.45	+0.64	+0.62	+0.50	+0.52

Table 1: Spearman correlations between memorization scores and proxies across CNNs and VTs. CNN-derived memorization proxies remain informative for VTs and can support scalable memorization-based unlearning.

	ViT-Small		Swin-Tiny		DINOv2-Small
Method	Within RUM ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )	Vanilla ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )	Within RUM ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )	Vanilla ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )	Within RUM ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )	Vanilla ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )
Original	$0.619{{\scriptstyle\pm 0.040}}$ / $0.538{{\scriptstyle\pm 0.023}}$	Same as left	$0.670{{\scriptstyle\pm 0.027}}$ / $0.586{{\scriptstyle\pm 0.025}}$	Same as left	$0.555{{\scriptstyle\pm 0.112}}$ / $0.425{{\scriptstyle\pm 0.080}}$	Same as left
Fine-tune	$\mathbf{0.855}{{\scriptstyle\pm 0.036}}$ / $\mathbf{0.889}{{\scriptstyle\pm 0.008}}$	$0.807{{\scriptstyle\pm 0.025}}$ / $0.844{{\scriptstyle\pm 0.023}}$	$\mathbf{0.822}{{\scriptstyle\pm 0.034}}$ / $\mathbf{0.839}{{\scriptstyle\pm 0.032}}$	$0.774{{\scriptstyle\pm 0.006}}$ / $0.781{{\scriptstyle\pm 0.020}}$	$\mathbf{0.846}{{\scriptstyle\pm 0.038}}$ / $\mathbf{0.824}{{\scriptstyle\pm 0.070}}$	$0.796{{\scriptstyle\pm 0.061}}$ / $0.768{{\scriptstyle\pm 0.064}}$
NegGrad+	$\mathbf{0.931}{{\scriptstyle\pm 0.039}}$ / $0.838{{\scriptstyle\pm 0.024}}$	$0.888{{\scriptstyle\pm 0.022}}$ / $\mathbf{0.845}{{\scriptstyle\pm 0.026}}$	$\mathbf{0.975}{{\scriptstyle\pm 0.027}}$ / $\mathbf{0.902}{{\scriptstyle\pm 0.035}}$	$0.851{{\scriptstyle\pm 0.018}}$ / $0.831{{\scriptstyle\pm 0.012}}$	$\mathbf{0.937}{{\scriptstyle\pm 0.044}}$ / $\mathbf{0.896}{{\scriptstyle\pm 0.032}}$	$0.827{{\scriptstyle\pm 0.064}}$ / $0.762{{\scriptstyle\pm 0.044}}$
SalUn	$\mathbf{0.903}{{\scriptstyle\pm 0.049}}$ / $\mathbf{0.709}{{\scriptstyle\pm 0.085}}$	$0.884{{\scriptstyle\pm 0.046}}$ / $0.686{{\scriptstyle\pm 0.047}}$	$\mathbf{0.870}{{\scriptstyle\pm 0.039}}$ / $\mathbf{0.751}{{\scriptstyle\pm 0.043}}$	$0.833{{\scriptstyle\pm 0.093}}$ / $0.640{{\scriptstyle\pm 0.109}}$	$\mathbf{0.831}{{\scriptstyle\pm 0.121}}$ / $\mathbf{0.840}{{\scriptstyle\pm 0.125}}$	$0.736{{\scriptstyle\pm 0.146}}$ / $0.662{{\scriptstyle\pm 0.155}}$
LetheViT	$\mathbf{0.848}{{\scriptstyle\pm 0.007}}$ / $\mathbf{0.879}{{\scriptstyle\pm 0.028}}$	$0.808{{\scriptstyle\pm 0.047}}$ / $0.839{{\scriptstyle\pm 0.045}}$	$\mathbf{0.815}{{\scriptstyle\pm 0.018}}$ / $\mathbf{0.851}{{\scriptstyle\pm 0.032}}$	$0.773{{\scriptstyle\pm 0.014}}$ / $0.780{{\scriptstyle\pm 0.024}}$	$\mathbf{0.784}{{\scriptstyle\pm 0.047}}$ / $\mathbf{0.743}{{\scriptstyle\pm 0.047}}$	$0.727{{\scriptstyle\pm 0.030}}$ / $0.681{{\scriptstyle\pm 0.011}}$

Table 2: Comparison of RUM-integrated and vanilla unlearning methods on CIFAR-100 using the Holdout Retraining proxy. Each entry reports ToW (

\uparrow

) / ToW-MIA (

\uparrow

) as mean

\pm

95% confidence interval, with best results for each entry shown in bold. Across all architectures, RUM generally improves the base unlearning algorithms.

Panel of Figure 1 — Figure 1: Unlearning performance comparison on CIFAR-100, measured by ToW and ToW-MIA (higher is better), reported as mean with 95% confidence interval. NegGrad+ is consistently strong, especially when paired with Holdout Retraining, while SalUn often achieves competitive ToW but weaker ToW-MIA. ViT favors fine-tuning-based methods (Fine-tune, L1-Sparse), whereas Swin-T favors gradient-based methods (NegGrad+, NegGrad).

Architecture	CIFAR-10		CIFAR-100
Architecture	Confidence	Holdout Retraining	Confidence	Holdout Retraining
ResNet-18	$50.433{\scriptstyle\pm 6.808}$	$62.922{\scriptstyle\pm 4.681}$	–	–
ResNet-50	–	–	$64.267{\scriptstyle\pm 0.504}$	$69.856{\scriptstyle\pm 2.620}$
ViT-Small	$94.089{\scriptstyle\pm 0.456}$	$89.244{\scriptstyle\pm 1.321}$	$69.322{\scriptstyle\pm 1.788}$	$68.767{\scriptstyle\pm 3.828}$
Swin-Tiny	$91.867{\scriptstyle\pm 1.711}$	$86.389{\scriptstyle\pm 1.246}$	$69.833{\scriptstyle\pm 1.242}$	$70.267{\scriptstyle\pm 2.848}$
DINOv2-Small	$88.529{\scriptstyle\pm 2.101}$	$92.333{\scriptstyle\pm 3.234}$	$58.267{\scriptstyle\pm 3.770}$	$58.778{\scriptstyle\pm 4.944}$

Table 3:

D_{f}

accuracies of the retrained reference model

\theta_{r}

across architectures. VTs show much higher

D_{f}

accuracy than ResNet-18 on CIFAR-10, but this gap largely disappears on the more complex CIFAR-100 setting.

Algorithm	ViT-Small ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )	ViT-Tiny ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )	Swin-Small ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )	Swin-Tiny ToW ( $\uparrow$ ) / ToW-MIA ( $\uparrow$ )
Original	$\mathbf{0.891}{{\scriptstyle\pm 0.016}}$ / $\mathbf{0.831}{{\scriptstyle\pm 0.014}}$	$0.773{{\scriptstyle\pm 0.020}}$ / $0.699{{\scriptstyle\pm 0.020}}$	$\mathbf{0.886}{{\scriptstyle\pm 0.013}}$ / $\mathbf{0.832}{{\scriptstyle\pm 0.020}}$	$0.862{{\scriptstyle\pm 0.008}}$ / $0.811{{\scriptstyle\pm 0.018}}$
Fine-tune	$\mathbf{0.928}{{\scriptstyle\pm 0.013}}$ / $\mathbf{0.913}{{\scriptstyle\pm 0.008}}$	$0.862{{\scriptstyle\pm 0.060}}$ / $0.854{{\scriptstyle\pm 0.060}}$	$0.921{{\scriptstyle\pm 0.005}}$ / $0.924{{\scriptstyle\pm 0.010}}$	$\mathbf{0.923}{{\scriptstyle\pm 0.021}}$ / $\mathbf{0.931}{{\scriptstyle\pm 0.021}}$
NegGrad+	$0.916{{\scriptstyle\pm 0.016}}$ / $\mathbf{0.968}{{\scriptstyle\pm 0.015}}$	$\mathbf{0.957}{{\scriptstyle\pm 0.011}}$ / $0.869{{\scriptstyle\pm 0.011}}$	$0.944{{\scriptstyle\pm 0.028}}$ / $0.888{{\scriptstyle\pm 0.021}}$	$\mathbf{0.977}{{\scriptstyle\pm 0.023}}$ / $\mathbf{0.924}{{\scriptstyle\pm 0.028}}$
SalUn	$\mathbf{0.956}{{\scriptstyle\pm 0.003}}$ / $\mathbf{0.766}{{\scriptstyle\pm 0.039}}$	$0.846{{\scriptstyle\pm 0.043}}$ / $0.640{{\scriptstyle\pm 0.043}}$	$0.950{{\scriptstyle\pm 0.031}}$ / $0.568{{\scriptstyle\pm 0.093}}$	$\mathbf{0.961}{{\scriptstyle\pm 0.048}}$ / $\mathbf{0.834}{{\scriptstyle\pm 0.022}}$

Table 4: Effect of VT capacity on CIFAR-10 using the HR proxy. Results are reported as mean

\pm

95% confidence interval for ToW (

\uparrow

) and ToW-MIA (

\uparrow

). ViT-Small and Swin-Tiny provide the best overall balance, suggesting a capacity “sweet spot” for unlearning.

Method	Swin-Small (49M)	Swin-Base (88M)	ViT-Base/16 (85M)
Fine-tune	$0.780{{\scriptstyle\pm 0.023}}$	$0.808{{\scriptstyle\pm 0.007}}$	$0.843{{\scriptstyle\pm 0.016}}$
NegGrad+	$0.819{{\scriptstyle\pm 0.018}}$	$0.837{{\scriptstyle\pm 0.004}}$	$0.842{{\scriptstyle\pm 0.005}}$
SalUn	$0.743{{\scriptstyle\pm 0.027}}$	$0.746{{\scriptstyle\pm 0.013}}$	$0.773{{\scriptstyle\pm 0.027}}$
LetheViT	$0.733{{\scriptstyle\pm 0.017}}$	$0.752{{\scriptstyle\pm 0.026}}$	$0.773{{\scriptstyle\pm 0.030}}$

Table 5: Unlearning performance measured by ToW (

\uparrow

) on ImageNet-1K validation set with HR proxy, comparing larger VT variants. The method-level trends observed on CIFAR-100 persist in larger and more complex settings.

Architecture	$D_{f}$ accuracy ( $\%$ )
ResNet-50	$69.139{\scriptstyle\pm 1.722}$
Swin-Small	$69.433{\scriptstyle\pm 2.246}$

Table 6:

D_{f}

accuracies of the retrained model

\theta_{r}

(with HR) on ImageNet-1K validation setting. Similar accuracy suggests that VT pretraining advantages diminish on more complex data.

Panel of Figure 2 — Figure 2: Continual unlearning performance across 5/10 Steps on CIFAR-100 using ViT-Small, reported with 95% confidence intervals. Performance remains stable across 5/10 steps; results for Swin-Tiny and additional datasets are reported in Figure 9 in Appendix A.5 .

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

	ResNet-18	Transformers
Optimizer	SGD	AdamW
Base learning rate	0.01	0.0001
Loss	Cross-Entropy	Cross-Entropy
Learning rate scheduler	Step decay	CosineAnnealingLR
Batch size	512	128
Epochs	30	30

Appendix

Table 7: Training configurations along with hyper-parameters of the models used to compute memorization scores shown in Figures 3 . The “Transformers” column represents the configuration for both ViT-Small and Swin-Tiny across CIFAR-10 and CIFAR-100.

Table 8: Training configurations and hyperparameter used for the original models (

\theta_{o}

) and the retrained models (

\theta_{r}

), using ViT-Small and Swin-Tiny architectures on CIFAR-10, CIFAR-100, and SVHN datasets.

Algorithm	Architecture	Unlearn Epochs	Unlearn LR	$\beta$	$\alpha$	$\gamma$
Fine-tune	ViT-Small	5,5,10	0.0001	–	–	–
Fine-tune	Swin-Tiny	5,5,10	0.0001	–	–	–
NegGrad+	ViT-Small	5,5,10	0.00002	0.97	–	–
NegGrad+	Swin-Tiny	5,5,10	0.00002	0.97	–	–
SalUn	ViT-Small	5,5,10	0.00005	–	1	0.1
SalUn	Swin-Tiny	5,5,10	0.0002	–	1	0.3

Appendix

Table 9: Hyper-parameters across all unlearn methods within the RUM F meta-algorithm on both Confidence and Holdout Retraining proxies to derive the unlearn models

\theta_{u}

. “Unlearn Epochs” column refers to the performed number of epochs each algorithm performed for the three memorization partitions (low

\rightarrow

medium

\rightarrow

high) respectively.

Unlearn Epochs	Unlearn LR	$\beta$
1,1,1	0.00002	0.97

Appendix

Table 10: Hyper-parameters at each sequential unlearning step for the NegGrad+ and Holdout Retraining configuration utilized. “Unlearn Epochs” are reduced to 1 for partition (low

\rightarrow

medium

\rightarrow

high) due to the smaller forget set size(

|D_{f}|=600

) at each step. All other settings remain consistent with the primary experiments.

Panel of Figure 3 — Figure 3: Memorization histograms across architectures on CIFAR-100 (top) and CIFAR-10 (bottom). Across both datasets, the distributions are similarly skewed, consistent with the long-tail phenomenon in memorization. Memorization distributions on CIFAR-100 (top) and CIFAR-10 (bottom) for ResNet-50, ViT-Small, and Swin-Tiny. $\mu$ denotes the mean memorization score. All three architectures show a skewed, long-tailed distribution, suggesting that VTs, like CNNs, contain a small subset of highly memorized examples. This supports the use of memorization-based unlearning for VTs.

	CIFAR-10			CIFAR-100
Proxy	ResNet-18	ViT-Small	Swin-Tiny	ResNet-50	ViT-Small	Swin-Tiny
Conf	-0.80	-0.79	-0.88	-0.91	-0.85	-0.90
MaxConf	-0.76	-0.77	-0.85	-0.87	-0.80	-0.86
Ent	-0.75	-0.78	-0.85	-0.80	-0.77	-0.82
BA	-0.71	-0.63	-0.79	-0.89	-0.69	-0.78
HR	+0.67	+0.45	+0.64	+0.62	+0.50	+0.52

Appendix

Table 11: Spearman correlation coefficients between memorization and proxies (duplicate of Table 1 , included here for completeness)

Panel of Figure 4 — Figure 4: Representation visualization before vs after unlearning for ViT-Small and Swin-Tiny

Panel of Figure 5 — Figure 5: Layer-wise CKA similarity on CIFAR-100 for ViT-Small and Swin-Tiny under Fine-tune and NegGrad+. Rows compare model pairs, columns correspond to layers, and higher values indicate more similar representations. Early layers remain highly stable, while larger changes occur in later blocks and the final normalization layer.

Panel of Figure 17 — (e) ToW with Confidence

Panel of Figure 7 — Figure 7: MU performance comparison on SVHN

Panel of Figure 8 — Figure 8: Continual unlearning performance across 5 steps on CIFAR-10 and SVHN datasets using NegGrad+ and the HR proxy.

Panel of Figure 9 — Figure 9: Continual unlearning performance across 5/10 steps on CIFAR-100 using NegGrad+ and the HR proxy.

	CIFAR-10				CIFAR-100
	ViT-Small		Swin-Tiny		ViT-Small		Swin-Tiny
Step	ToW $(\uparrow)$	ToW-MIA $(\uparrow)$	ToW $(\uparrow)$	ToW-MIA $(\uparrow)$	ToW $(\uparrow)$	ToW-MIA $(\uparrow)$	ToW $(\uparrow)$	ToW-MIA $(\uparrow)$
1	$0.907\pm 0.030$	$0.960\pm 0.017$	$0.966\pm 0.016$	$0.933\pm 0.082$	$0.891\pm 0.065$	$0.816\pm 0.051$	$0.906\pm 0.039$	$0.823\pm 0.023$
2	$0.936\pm 0.063$	$0.944\pm 0.029$	$0.957\pm 0.016$	$0.917\pm 0.030$	$0.868\pm 0.031$	$0.770\pm 0.015$	$0.840\pm 0.064$	$0.764\pm 0.085$
3	$0.929\pm 0.044$	$0.948\pm 0.023$	$0.954\pm 0.054$	$0.909\pm 0.096$	$0.857\pm 0.049$	$0.764\pm 0.047$	$0.853\pm 0.052$	$0.776\pm 0.055$
4	$0.943\pm 0.010$	$0.942\pm 0.028$	$0.947\pm 0.058$	$0.899\pm 0.058$	$0.858\pm 0.053$	$0.760\pm 0.040$	$0.843\pm 0.021$	$0.746\pm 0.035$

Appendix

Table 12: Detailed unlearning performance at each of the 5 sequential steps for the NegGrad+ and Holdout Retraining configuration discussed in Section 4.6 and displayed in Figures 2 and 8 .

Step	ViT-Small		Swin-Tiny
	ToW ( $\uparrow$ )	ToW-MIA ( $\uparrow$ )	ToW ( $\uparrow$ )	ToW-MIA ( $\uparrow$ )
1	$0.947\pm 0.043$	$0.889\pm 0.108$	$0.947\pm 0.035$	$0.860\pm 0.082$
2	$0.971\pm 0.033$	$0.828\pm 0.040$	$0.900\pm 0.104$	$0.786\pm 0.064$
3	$0.973\pm 0.019$	$0.845\pm 0.034$	$0.953\pm 0.021$	$0.850\pm 0.024$
4	$0.918\pm 0.053$	$0.840\pm 0.244$	$0.940\pm 0.081$	$0.816\pm 0.094$
5	$0.921\pm 0.046$	$0.769\pm 0.020$	$0.958\pm 0.079$	$0.834\pm 0.138$

Appendix

Table 13: Continual unlearning over 10 sequential steps on CIFAR-100 using NegGrad+ with the Holdout Retraining proxy (configuration discussed in Section 4.6 ). Results are reported as mean

\pm

95% confidence interval.

Table 14: Detailed performance results for the VTs (ViT, Swin-T, DINOv2) across both the CIFAR datasets.

Table 15: Detailed performance result metrics for ResNet-18 and ResNet-50 on the CIFAR-10 and CIFAR-100 datasets respectively.

Table 16: Accuracies on

D_{r}

D_{f}

and

D_{test}

for the “Retrain” models

\theta_{r}

as well as the respective “Unlearned” models

\theta_{u}

, evaluated across all unlearning algorithms within the RUM F framework. MIA performance is also reported. Results are averaged over 3 runs, with 95% confidence intervals.

Explore similar work

Mar 16, 2026

Models Designed to Forget: Machine Unlearning via Key Deletion

Machine unlearning for vision models is rapidly becoming a practical requirement, driven by privacy regulations, data errors, and the need to remove harmful or corrupted training images. Despite this, most existing approximate unlearning methods tackle the problem from a post-hoc perspective. They attempt to erase the influence of targeted samples through parameter updates that typically require access to the full training data. This creates a mismatch with real deployment scenarios where unlearning requests can be anticipated, revealing a fundamental limitation of post-hoc approaches. We motivate unlearning by design, a novel paradigm for approximate methods in which models are directly trained to support forgetting as an inherent architectural capability. We instantiate this idea with Machine UNlearning via KEY deletion (MUNKEY), a memory-augmented transformer that decouples instance-specific memorization from model weights. Here, unlearning corresponds to removing the instance-identifying key, enabling zero-shot forgetting without weight updates or access to the original samples or labels. Across natural image benchmarks, fine-grained visual recognition, and medical datasets, MUNKEY outperforms all post-hoc baselines. Our results establish that unlearning by design enables fast, deployment-oriented unlearning while preserving predictive performance.

Sonia Laguna, Jorge da Silva Goncalves, Moritz Vandenhirtz +3

Department of Computer Science, ETH Zurich, Switzerland

Machine Unlearning

Ask PDF

May 5, 2026

Before Forgetting, Learn to Remember: Revisiting Foundational Learning Failures in LVLM Unlearning Benchmarks

While Large Vision-Language Models (LVLMs) offer powerful capabilities, they pose privacy risks by unintentionally memorizing sensitive personal information. Current unlearning benchmarks attempt to mitigate this using fictitious identities but overlook a critical stage 1 failure: models fail to effectively memorize target information initially, rendering subsequent unlearning evaluations unreliable. Diagnosing under-memorization and the multi-hop curse as root causes, we introduce ReMem, a Reliable Multi-hop and Multi-image Memorization Benchmark. ReMem ensures robust foundational learning through principled data scaling, reasoning-aware QA pairs, and diverse visual contexts. Additionally, we propose a novel Exposure metric to quantify the depth of information erasure from the model's internal probability distribution. Extensive experiments demonstrate that ReMem provides a rigorous and trustworthy framework for diagnosing both learning and unlearning behaviors in LVLMs.

JuneHyoung Kwon, MiHyeon Kim, Eunju Lee +3

Department of Artificial Intelligence, Chung-Ang University · KT Corporation · Graduate School of Advanced Imaging Sciences, Multimedia and Film, Chung-Ang University

VLM Evaluation VLM Unlearning Vision-Language Models Memorization in Language Models Large Vision-Language Models Memorization in Generative Models+4

Ask PDF

Sep 30, 2026

Unmerge: Efficient Machine Unlearning via Task Arithmetic

Approximate machine unlearning seeks to remove the influence of a forget set from a trained model without full retraining. Existing gradient-based methods require data-dependent hyperparameter search, struggle when forget and retain knowledge are entangled, and offer little insight into where unlearning actually happens inside the network. We recast unlearning through the lens of task arithmetic: if finetuning produces a merged task vector

τ_m

that combines learning on forget and retain sets, unlearning is the inverse operation that subtracts a learned forget component

τ_F

to recover the retain task vector

τ_R

. The forget signal is concentrated: at every layer, forget activations lie in a subspace spanned by a handful of dominant directions, so we factorize

τ_F

in a low-rank forget basis, which is faithful up to a small tail-eigenvalue residual and limits how far the correction can perturb retain. We then optimize three intuitive goals (match the merged vector inside the forget span, suppress leakage into the retain span, and bound the correction size) that provably bound forget leakage and retain damage in activation space. The resulting algorithm, Unmerge, is fast and powerful: on class-level unlearning with ResNet-50 on CIFAR-100 and Tiny ImageNet, it improves Tug-of-War by up to ~24% over a baseline of comparable runtime and by up to ~18% over stronger baselines that run ~5x slower, keeps membership-inference exposure at the level of retraining, and shrinks the feature-distribution gap to the retrained model, where relabeling methods leave forget features cleanly separable. Further studies show that Unmerge also applies to ViT-S/16 and scales to Llama-3.2-3B. The per-layer basis geometry that drives the algorithm also serves as a layerwise diagnostic for when and where unlearning becomes structurally hard.

Haoran Tang, Andrew Tan, Rajiv Khanna

Department of Computer Science Purdue University

Machine Unlearning

Ask PDF