Machine unlearning poses challenges in removing mislabeled, contaminated, or problematic data from a pretrained model. Current unlearning approaches and evaluation metrics are solely focused on model predictions, which limits insight into the model's true underlying data characteristics. To address this issue, we introduce a new metric called relearning convergence delay, which captures both changes in weight space and prediction space, providing a more comprehensive assessment of the model's understanding of the forgotten dataset. This metric can be used to assess the risk of forgotten data being recovered from the unlearned model. Based on this, we propose the Influence Eliminating Unlearning framework, which removes the influence of the forgetting set by degrading its performance and incorporates weight decay and injecting noise into the model's weights, while maintaining accuracy on the retaining set. Extensive experiments show that our method outperforms existing metrics and our proposed relearning convergence delay metric, approaching ideal unlearning performance. We provide theoretical guarantees, including exponential convergence and upper bounds, as well as empirical evidence of strong retention and resistance to relearning in both classification and generative unlearning tasks.
Figures & tables
Table 1: Performance summary of various unlearning methods for the ResNet model trained on TinyImageNet in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Table 2: Performance summary of various unlearning methods for the ResNet model trained on TinyImageNet in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Figure 1: Relationship between Avg. Gap and RCDGD (step-size η=10−4 ) of ResNet model on the training-forgetting dataset Dftrain of TinyImageNet across diverse unlearning scenarios. Our methods consistently achieve a low Avg. Gap and a high RCDGD score across four forgetting scenarios, demonstrating efficacy in both model utility and privacy.
Figure 2: The RCDGD values of ResNet model on the training-forgetting set Dftrain of TinyImageNet for various step-sizes. With a small step-size, the RCDGD values of each unlearning method are less distinguishable, whereas an appropriate step-size enables a significant comparison.
Figure 3: Examples of generated images using various SD models from I2P prompts. The unlearning methods include ESD and SALUN, both with and without the use of Noisy . Each column presents images generated by different SD variants using the same prompt, denoted as Pi . Detailed descriptions of the prompts are provided in the Appendix section.
Table 3: Performance of unlearned approaches on ImageNette concepts using FID, I2P prompts using Nudity score, and relearning convergence delay of relearning harmful concepts from I2P prompts, measured as RCDAdam .
Figure 4: Image generation results for ImageNette classes using models unlearned from I2P harmful concepts. The generated images show that using the Noisy component helps the unlearned model better preserve its performance on unrelated concepts.
Figure 5: RCD vs. Relearning Difficulty correlation. Larger RCD values correspond to slower recovery when retraining on the forgotten data. Retraining yields the highest RCD (44.91) and the slowest convergence, whereas FT (4.32) recovers rapidly; RL (30.82) delays recovery, while SCRUB (8.37) relearns substantially faster.
Figure 6: Ablation studies about Noisy component hyperparameter. An appropriate α makes the unlearning effective in both forgetting and preserving.
Figure 7: RCD vs. Retention Accuracy on ViT– Cifar100 across Settings. IEU increases resistance with minimal accuracy loss, offering a better privacy–utility balance than others.
Figure 11
Table 4: Performance summary of various unlearning methods for the ViT model trained on TinyImageNet in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Table 5: Performance summary of various unlearning methods for the ViT model trained on TinyImageNet in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Figure 10: Relationship between Avg. Gap and RCDGD (step-size η=10−4 ) of ViT model on the training-forgetting dataset Dftrain of TinyImageNet across diverse unlearning scenarios.
Figure 11: The RCDGD values of ViT model on the training-forgetting set Dftrain of TinyImageNet for various step-sizes.
Table 6: Performance summary of various unlearning methods for the ResNet model trained on CIFAR-100 in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Table 7: Performance summary of various unlearning methods for the ResNet model trained on CIFAR-100 in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Figure 12: Relationship between Avg. Gap and RCDGD (step-size η=10−4 ) of ResNet model on the training-forgetting dataset Dftrain of CIFAR-100 across diverse unlearning scenarios.
Figure 13: The RCDGD values of ResNet model on the training-forgetting set Dftrain of CIFAR-100 for various step-sizes.
Table 8: Performance summary of various unlearning methods for the ViT model trained on CIFAR-100 in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Table 9: Performance summary of various unlearning methods for the ViT model trained on CIFAR-100 in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Figure 14: Relationship between Avg. Gap and RCDGD (step-size η=10−4 ) of ViT model on the training-forgetting dataset Dftrain of CIFAR-100 across diverse unlearning scenarios.
Figure 15: The RCDGD values of ViT model on the training-forgetting set Dftrain of CIFAR-100 for various step-sizes.
Table 10: Performance summary of various unlearning methods for the ResNet model trained on CIFAR-10 in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Table 11: Performance summary of various unlearning methods for the ResNet model trained on CIFAR-10 in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Figure 16: Relationship between Avg. Gap and RCDGD (step-size η=10−4 ) of ResNet model on the training-forgetting dataset Dftrain of CIFAR-10 across diverse unlearning scenarios.
Figure 17: The RCDGD values of ResNet model on the training-forgetting set Dftrain of CIFAR-10 for various step-sizes.
Table 12: Performance summary of various unlearning methods for the ViT model trained on CIFAR-10 in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Table 13: Performance summary of various unlearning methods for the ViT model trained on CIFAR-10 in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in ( ⋅ ) .
Figure 18: Relationship between Avg. Gap and RCDGD (step-size η=10−4 ) of ViT model on the training-forgetting dataset Dftrain of CIFAR-10 across diverse unlearning scenarios.
Figure 19: The RCDGD values of ViT model on the training-forgetting set Dftrain of CIFAR-10 for various step-sizes.
Table 14: Text prompts in I2P for SD to generate NSFW images.
Figure 20: Examples of generated images using various SD models from I2P prompts. Each column presents images generated by different SD variants using the same prompt, presented in Table 14 .
Figure 21: Image generation results for ImageNette classes using models unlearned from I2P harmful concepts.
Figure 22: We present images generated by the original SD and various relearned models. As the outputs from the relearned models are visually similar, we display them in a single row for illustration.
Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.
Department of Artificial Intelligence, Chung-Ang University · KT Corporation · Graduate School of Advanced Imaging Sciences, Multimedia and Film, Chung-Ang University