Forget the Data, Keep the Capability: Switchable Unlearning for Retrieval

Jingong Chen; Kyle Gao; Guangyuan Li; Chulwoo Pack; Sijia Liu; Kwanghee Won

cs.CVOct 27, 2026

Forget the Data, Keep the Capability: Switchable Unlearning for Retrieval

Authors: Jingong Chen, Kyle Gao, Guangyuan Li, Chulwoo Pack, Sijia Liu, Kwanghee Won

Organizations: South Dakota State University · Aalto University · ELLIS Institute Finland · Michigan State University

Abstract

Privacy compliance requires re-identification models to selectively forget individuals while preserving their ability to recognize others. For this, we present MoME, a switchable framework that can adapt pre-trained backbones for privacy compliance, allowing the same model to switch between Full mode for standard inference and Core mode for unlearned inference. MoME splits one backbone into core parameters that preserve retrieval and zero-initialized parasitic parameters that carry the full-data knowledge, and training them under gradient isolation so the core never receives a forget-set gradient. Disabling the branch yields Core, which satisfies a request to delete a person's training data, and enabling it yields Full, which retains what the deleted data taught, so honoring the request is a flag flip rather than a retraining run. We prove Core independent of the forget set up to an audited set of coupling channels and introduce the rank-based Forgetting-Rank statistic to audit that independence in a trained model. On Market-1501, VeRi-776 and RegDB, Core reads at a retrained reference under three membership attacks while retrieving above it, and the retrieval advantage carries to ResNet and CLIP backbones. Code and weights are available at https://github.com/Jingong-Chen/MoME.

Figures & tables

Figure 1: Other methods do not reach the utility and privacy frontier on ReID. RegDB from visible to thermal, with each method placed by retrieval mAP and by membership leak under RMIA. The dashed line is the retrained reference and the strip

\pm 0.05

around it is what identity-clustered intervals resolve here. Baselines are hollow circles and ours is the red star.

Figure 2: Forgetting the data and losing the capability coincide in classification but not in retrieval . Each mark reports what the metric reads after the request is honored. Forgetting ACC is accuracy on the forgotten class above and retrieval accuracy on the forgotten identity below. MIA, a membership inference attack, fails on both rows, the dog class is gone from the classifier, and the deleted identity is still retrieved, as it is by a model retrained without it. Performance on the forgotten data carries the forgetting signal in classification and carries none in retrieval.

Figure 3: Overview of the MoME training framework. Each iteration runs two flows through one shared backbone: Step 1 forwards the retain set $\mathcal{D}_{r}$ in Core mode, with the parasitic parameters $\bm{\theta}_{p}$ frozen, and updates the core parameters $\bm{\theta}_{c}$ ; Step 2 forwards the full set $\mathcal{D}_{f}$ in Full mode, with $\bm{\theta}_{c}$ frozen, and updates $\bm{\theta}_{p}$ ; the diagram draws the normalization shadows, and the branch also carries a zero-initialized low-rank pair beside every backbone attention and FFN projection; a single optimizer step applies both updates. A consolidation stage then initializes the parasitic payload at the parameter difference toward the original model and refines it, so toggling the branch on serves the Full mode and toggling it off yields Core, the parameters the guarantee is about.

	Market-1501						VeRi-776
	Utility		Privacy				Utility		Privacy
Method	R-1	mAP	$\mathcal{U}$ mAP	MIA ${}_{\text{ent}}$	RMIA	U-LiRA	R-1	mAP	$\mathcal{U}$ mAP	MIA ${}_{\text{ent}}$	RMIA	U-LiRA
Original	$94.8{\pm}0.0$	$88.0{\pm}0.0$	$99.9{\pm}0.0$	$1.00{\pm}.00$	$0.99{\pm}.00$	$0.98{\pm}.00$	$97.1{\pm}0.0$	$82.3{\pm}0.0$	$100.0{\pm}0.0$	$1.00{\pm}.00$	$0.89{\pm}.01$	$0.81{\pm}.02$
Fine-tune [ 46 ]	$94.5{\pm}0.2$	$86.9{\pm}0.2$	$99.7{\pm}0.1$	$0.98{\pm}.00$	$0.98{\pm}.00$	$0.97{\pm}.00$	$91.8{\pm}0.7$	$68.1{\pm}1.3$	$94.8{\pm}1.2$	$0.91{\pm}.02$	$0.88{\pm}.03$	$0.87{\pm}.03$
GA [ 44 ]	$93.8{\pm}0.9$	$85.2{\pm}1.6$	$99.3{\pm}0.6$	$0.91{\pm}.20$	$0.90{\pm}.19$	$0.88{\pm}.20$	$39.9{\pm}29.7$	$23.1{\pm}18.8$	$25.8{\pm}22.0$	$0.54{\pm}.08$	$0.55{\pm}.06$	$0.54{\pm}.05$
NegGrad+ [ 26 ]	$94.3{\pm}0.1$	$86.3{\pm}0.2$	$99.7{\pm}0.1$	$1.00{\pm}.00$	$0.99{\pm}.00$	$0.97{\pm}.00$	$34.0{\pm}7.5$	$18.0{\pm}3.4$	$13.6{\pm}3.0$	$0.51{\pm}.04$	$0.51{\pm}.03$	$0.51{\pm}.03$

Table 1: Market-1501 and VeRi-776 under identity-level deletion with a thin retain set. Half of the training identities are deleted, so

\mathcal{U}

contains all images of the deleted identities, while each retained identity contributes

k{=}4

images. Utility reports R-1 and mAP on the disjoint test set; privacy reports retrieval mAP on

\mathcal{U}

and three attacks, two calibrated against the same retrained reference family. The reference row is evaluated against the other four reference models. Full denotes the consolidated parasitic branch. Every cell is a mean over five deletion splits with the spread across them, each split drawing its own half of the identities and contributing one run. Attacks score each split against its own four retrained references, which share no checkpoint with the teachers; identity-level resampling within a split gives an interval of approximately

\pm 0.023

. Red : Core; blue : retrained reference; gray : Full.

Method	Utility				Privacy
Method	V $\rightarrow$ T R-1	V $\rightarrow$ T mAP	T $\rightarrow$ V R-1	T $\rightarrow$ V mAP	$\mathcal{U}$ mAP	MIA ${}_{\text{ent}}$	RMIA	U-LiRA
Original	$67.1{\pm}0.0$	$64.7{\pm}0.0$	$68.3{\pm}0.0$	$64.6{\pm}0.0$	$100.0{\pm}0.0$	$1.00{\pm}.00$	$0.86{\pm}.01$	$0.79{\pm}.01$
Fine-tune [ 46 ]	$54.9{\pm}2.2$	$53.2{\pm}1.4$	$52.1{\pm}2.7$	$51.3{\pm}1.9$	$100.0{\pm}0.0$	$0.91{\pm}.01$	$0.89{\pm}.02$	$0.87{\pm}.02$
GA [ 44 ]	$43.3{\pm}3.7$	$42.8{\pm}3.0$	$43.1{\pm}4.0$	$42.4{\pm}3.2$	$99.9{\pm}0.2$	$1.00{\pm}.00$	$0.92{\pm}.02$	$0.88{\pm}.03$
NegGrad+ [ 26 ]	$51.1{\pm}4.4$	$49.5{\pm}4.1$	$50.7{\pm}4.1$	$50.4{\pm}4.3$	$99.9{\pm}0.2$	$1.00{\pm}.00$	$0.86{\pm}.01$	$0.81{\pm}.01$
SalUn [ 11 ]	$26.4{\pm}1.1$	$26.1{\pm}1.5$	$27.0{\pm}1.5$	$27.4{\pm}1.5$	$97.3{\pm}0.9$	$0.93{\pm}.01$	$0.90{\pm}.01$	$0.87{\pm}.01$

Table 2: RegDB across modalities under identity-level deletion with a thin retain set . Columns follow Tab. 1 , with utility reported in both directions. The retrained reference uses AdamW, while the co-training recipe collapses on the

824

retained images. Every cell is a mean over five deletion splits with the spread across them, as in Tab. 1 , with attacks scored against each split’s own four retrained references. RegDB contains

103

deleted identities and

309

identity clusters across the two pools, giving an attack-AUC resolution of approximately

\pm 0.045

when identities are the statistical unit.

Figure 4: The branch moves the deleted identities between two geometries. Seven deleted identities in color over a gray sample of retained images.

	CIFAR-10			CIFAR-100			TinyImageNet
Method	retain	$\mathcal{U}$	MIA	retain	$\mathcal{U}$	MIA	retain	$\mathcal{U}$	MIA
Original	94.2	100.0	0.44	76.4	100.0	0.68	65.0	99.9	0.70
Fine-tune	94.3	79.3	0.07	77.4	91.3	0.32	65.4	8.0	0.20
GA	11.1	0.0	0.50	1.1	0.0	0.50	0.6	0.0	0.50
NegGrad+	12.7	0.0	0.50	2.5	0.0	0.53	0.6	0.0	0.47
SalUn	94.4	10.0	0.01	76.6	63.8	0.07	65.0	95.6	0.44

Table 3: Class deletion on image-classification benchmarks. A tenth of the classes is deleted and

\mathcal{U}

is every image of those classes. Accuracy in %, entropy-MIA of

\mathcal{U}

against the test split, read as distance to the retrained reference. MIA below

\tfrac{1}{2}

reflects a train and test difficulty gap, not stronger privacy. Single runs at seed

42

Backbone	Norm	Pretrain	Task	Core	Retr.	Core	Retr.	Full
				Utility		Privacy, $\rho_{\mathcal{U}}$
ViT-B/16	LN	ImageNet	ReID, Mkt	74.2	70.5	$0.500\pm.023$	$0.500\pm.085$	$0.100\pm.000$
ResNet-50 AGW	BN	ImageNet	ReID, Mkt	47.5	33.3	$0.500\pm.254$	$0.500\pm.241$	$0.880\pm.015$
CLIP ViT-B/16	LN	contrastive	ReID, Mkt	77.7	67.6	$0.500\pm.128$	$0.500\pm.232$	$0.896\pm.005$
ResNet-18	BN	scratch	CIFAR-10	47.8	47.8	$0.502\pm.056$	$0.501\pm.050$	$0.152\pm.005$

Table 4: Generality across backbones, pretraining, and tasks. MoME-Core against a matched reference retrained on

\mathcal{D}_{r}

. Utility is mAP for ReID and top-1 accuracy over all ten CIFAR-10 classes; the five-class deletion here is not comparable to the one-class setting in Tab. 3 . Privacy is

\rho_{\mathcal{U}}

from Eq. 4 , each column ranked against shadows from its own procedure. Five seeds on the deployed deletion split, which is why the ViT row differs from Tab. 1 .

Variant	Core mAP	Full mAP	MIA ${}_{\text{ent}}$
w/o Gradient Isolation	85.1	88.3	0.995
w/o Step 2	74.3	74.3	0.491
Frozen backbone	2.4	73.7	0.506
Parasitic $\gamma$ only	75.4	78.1	0.487
Parasitic $\beta$ only	75.4	77.8	0.487
Ours $\gamma{+}\beta$ co-trained	74.4	81.5	0.493

Table 5: Ablation of necessary components on Market-1501. MIA

{}_{\text{ent}}

is the entropy attack on

\mathcal{U}

. Without Step 2 the branch stays at initialization, so Full equals Core and the row is a retrain on

\mathcal{D}_{r}

. Full is the co-trained branch before consolidation; the consolidated payload is in Tab. 1 .

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Rate	test mAP	$\mathcal{U}$ mAP	RMIA
SCRUB	$10^{-3}$	31.3	45.6	0.560
	$5\times 10^{-4}$	43.9	65.2	0.709
	$10^{-4}$	85.4	99.7	0.987
NegGrad+	$8\times 10^{-3}$	28.2	31.7	0.494
	$10^{-3}$	86.2	99.7	0.990
	$5\times 10^{-4}$	86.4	99.7	0.990

Appendix

Table 6: Learning rate traces the trade-off within a method on Market-1501, seed

42

, identity-level deletion. Each row is the same algorithm at a different rate. The retrained reference and Core are repeated for scale, on the deployed split like every other row here, which is why Core reads

74.3

and

80.1

and the reference

70.5

and

77.3

, against the five-split

75.3

80.5

71.4

and

77.3

of Tab. 1 . RMIA is the calibrated attack on

\mathcal{U}

; the reference reads

0.51

	Row	AUC	$95\%$ int.	difference, $90\%$ int.
Market	Retrain	0.511	$[.491,.529]$	–
	Core-only	0.511	$[.490,.534]$	$+.001\ [-.021,+.023]$
	Core s42	0.511	$[.488,.533]$	$+.000\ [-.022,+.023]$
	Core s123	0.505	$[.484,.527]$	$-.005\ [-.027,+.017]$
	Core s456	0.513	$[.492,.535]$	$+.003\ [-.019,+.026]$
	Core s789	0.507	$[.485,.529]$	$-.003\ [-.025,+.020]$

Appendix

Table 7: Attack AUC with the identity as the resampling unit. RMIA on the label-free statistic against the disjoint reference family,

95\%

interval from a bootstrap over identities at

2000

resamples, and the difference from the retrained reference with its

90\%

interval, which is the interval form of the two one-sided tests. A difference whose interval contains zero is not resolved by the data; it is not thereby shown to be zero.

		teacher refs		disjoint refs
Row	ent	RMIA	U-LiRA	RMIA	U-LiRA
Original	0.999	0.991	0.979	0.991	0.979
Fine-tune	0.982	0.984	0.975	0.984	0.974
Retrain	0.493	0.511	0.514	0.511	0.511
Core-only	0.491	–	–	0.511	0.515
Core s42	0.492	0.510	0.503	0.511	0.513

Appendix

Table 8: Rescored against references that share no checkpoint with the teachers. Market-1501, identity-level deletion, members

\mathcal{U}

against the query split. The first pair of columns scores against the four retrains that Step 1 also distilled from; the second scores against four fresh retrains on the same split. Entropy uses no references and is given once.

	Statistic	Retrain band	MoME-Core	distance
Market	MIA ${}_{\text{ent}}$	$.4866{\pm}.0032$	$.4914{\pm}.0015$	$+1.5$
	RMIA	$.5000{\pm}.0132$	$.5096{\pm}.0033$	$+0.7$
	U-LiRA	$.4998{\pm}.0131$	$.5135{\pm}.0021$	$+1.0$
	TPR@ $1\%$	$.0112{\pm}.0014$	$.0090{\pm}.0009$	$-1.7$
VeRi	MIA ${}_{\text{ent}}$	$.5110{\pm}.0072$	$.5195{\pm}.0043$	$+1.2$
	RMIA	$.4994{\pm}.0141$	$.5078{\pm}.0076$	$+0.6$

Appendix

Table 9: Core against the spread retrains have among themselves. Each disjoint family has five members, each ranked against the other four, so the band is measured the way a target row is. Every spread is a sample standard deviation over the five members of the family or the five seeds of Core. The last column is Core’s distance from the band’s centre in units of the band’s own standard deviation, and the one cell set in bold is the only one that falls outside

1.5

of them in the direction that would mean a leak.

Figure 5: The parasitic gate

\bm{\gamma}_{m}

is low-rank across normalization sites. Panel a: cumulative spectral energy of the stacked per-channel parasitic scales

\bm{\gamma}_{m}

for the MoME model on Market-1501 at seed

42

and epoch

120

, formed over

36

normalization sites and

768

channels, where

95\%

of the energy lies in the top

22

components, well above the uniform spectrum reference. Panel b: within the backbone the parasitic energy favors the normalization that precedes the MLP over the one that precedes attention,

54

against

46\%

, in every block from

0

8

, while blocks

9

and

10

invert it and the largest backbone site is the pre-attention norm of block

10

. The two largest single sites are not in the backbone at all but are the final LayerNorms of the two JPM branches, ticked b1 and b2, at

7.7\%

and

7.9\%

against a backbone maximum of

5.5\%

. Block

11

, the final norm and the five bottleneck sites are bypassed and carry exactly zero.

Retain set skew	$\|\mathcal{D}_{r}\|$	Core		Full	Core MIA, AUC
		mAP	R-1	mAP	MIA H	RMIA	U-LiRA
Uniform $\mathcal{D}_{r}$ , identity-level	1,491	74.3	88.2	82.0	0.492	0.511	0.513
Camera skew, delete cam-0	2,954	76.2	88.3	83.6	0.872	0.559	0.652
Identity skew, delete 50 PIDs	12,025	87.5	94.5	86.0	0.541	0.517	0.518
Imbalanced $k\!\in\![1,8]$	3,222	81.3	91.8	84.1	0.917	0.548	0.711

Appendix

Table 10: What a membership attack can and cannot verify on Market-1501 at seed

42

. Three deletion requests with different units, each trained from scratch, against the identity-level protocol above the rule. The three skew rows run the base configuration, with no distillation ensemble and no low-rank pairs, while the row above the rule is the deployed recipe, so the comparison isolates the deletion unit only up to that difference. Only identity skew removes whole identities, and it is the only row whose attack approaches the exchangeable value. Camera skew and the imbalanced draw leave every identity in

\mathcal{D}_{r}

, so an attack asking whether an identity was trained on is answered yes however well those particular images were forgotten. Each skew has its own forget set, so each row is scored against a reference family of four models retrained on that row’s own

\mathcal{D}_{r}

, twelve retrainings in all. All three attacks come from one evaluation per row against that family.

Identities named	Core	Retrain	Full	half-width
5	0.518	0.534	0.926	0.153
10	0.510	0.522	0.937	0.092
25	0.504	0.518	0.943	0.067
50	0.519	0.507	0.944	0.046
100	0.511	0.509	0.944	0.036
200	0.515	0.515	0.939	0.028

Appendix

Table 11: What the audit can resolve as the request shrinks. RMIA on Market-1501 with the deployed models fixed, the audit restricted to a random subset of the requested identities, twenty redraws per size and

600

resamples per draw. The last row names all

376

, where the subset is the whole set and one draw is all there is. The last column is the half-width of the identity-clustered

95\%

interval on the Core row, which is the wider of the two rows near the null at every size.

Method	Core		Full	Core MIA, AUC
	mAP	R-1	mAP	MIA H	RMIA	U-LiRA
Original, trained on $\mathcal{D}_{\mathrm{full}}$	88.0	94.8	–	0.999	0.991	0.979
Retrained reference: retrain on $\mathcal{D}_{r}$	70.5	86.9	–	0.493	0.511	0.511
MoME-Core, by design	74.3	88.2	82.0	0.492	0.511	0.513
Naive post-hoc, no isolation	88.5	95.2	88.8	0.997	0.967	0.909
PH1: freeze backbone	88.0	94.8	88.4	0.999	0.991	0.979

Appendix

Table 12: Applying isolation after training does not unlearn. Post-hoc adaptation of the deployed checkpoint, Market-1501 at seed

42

30

epochs, with the three reference rows above the rule. The original here is the checkpoint these variants adapt, the one Tab. 1 also reports. Attacks are read in Core mode against the same four disjoint references as the main tables. Every variant keeps the full-data accuracy and stays identifiable at close to the original’s level whether or not gradient isolation is applied, because isolation withholds new gradients and cannot remove what the weights already carry. PH1 freezes the backbone, so its Core is the original model and it reproduces the original’s three scores exactly.

Family	sd	p99	max	above $3.8$
Retrain	2.68	6.30	9.63	137
MoME-Core	3.15	7.19	10.23	220
Full vs Core	1.80	10.86	12.00	1520

Appendix

Table 13: The analytic null is wrong, and the clean family says by how much. Distribution of Eq. 11 over the

1880

cells of each Market-1501 family. The first two rows are leave-one-out within their own family, the third reads the consolidated payload against the Core references. Exact exchangeability predicts unit variance, and that prediction assumes the ranks are independent across the images of one identity, which they are not. A family of genuine retrains already reads

2.68

, so a rejection against the analytic null is not evidence of retained data, which is why every reading in this paper is calibrated against the retrained family rather than against

\tfrac{1}{2}

Family	leave-one-out $\rho_{\mathcal{U}}$					sd
Market retrain	0.603	0.525	0.400	0.427	0.544	.085
Market Core	0.538	0.480	0.486	0.501	0.495	.023
VeRi retrain	0.559	0.354	0.553	0.437	0.597	.101
VeRi Core	0.487	0.522	0.440	0.544	0.507	.040
RegDB retrain	0.611	0.392	0.582	0.487	0.428	.095
RegDB Core	0.494	0.539	0.520	0.509	0.437	.039

Appendix

Table 14: Forgetting-Rank families on all three benchmarks. Each row gives the five leave-one-out readings of one family, deployed seed first, and their sample standard deviation. Every family averages

0.5000

by the counting identity, so the spread is the informative quantity. Red : the deployed Core, whose own reading is in bold.

Dataset	Method	$\mathcal{D}_{r}$	retained, held out	$\mathcal{U}$
Market	Retrain	99.8	86.4	77.3
	MoME-Core	100.0	90.3	80.1
	MoME-Full	99.8	99.8	99.8
VeRi	Retrain	56.0	47.7	35.5
	MoME-Core	99.9	52.1	40.8
	MoME-Full	100.0	100.0	100.0

Appendix

Table 15: Retrieval mAP on the three parts of the training set at seed

42

, under identity-level deletion. The retained, held out column holds images of retained identities that were never in

\mathcal{D}_{r}

, so high values there are generalization rather than leakage. Full is the consolidated payload, the artifact reported in Tab. 1 , not the parasitic branch as trained. Every row here is one run on the deployed split, where Tab. 1 averages five splits, which is why Core reads

80.1

\mathcal{U}

here against

80.5

there while the Market reference reads

77.3

in both. The same gap is larger on VeRi-776,

35.5

here against

32.2

there for the reference, because that reference is the unstable one: its five seeds span

27.6

39.5

mAP.

Method	$\mathcal{D}_{f}$	$\mathcal{U}$	$\mathcal{D}_{r}$	retained, held out
Original	0.996	0.996	0.996	0.997
Fine-tune	0.990	0.982	0.999	0.998
GA	0.994	0.994	0.991	0.996
Retrain	0.722	0.493	1.000	0.938
Core	0.725	0.493	1.000	0.945
Full	0.998	0.998	0.997	0.999

Appendix

Table 16: Membership inference AUC by member pool on Market-1501 , the entropy attack of Eq. 8 , under identity-level deletion at seed

42

. The last three pools partition the training set and the first is their union:

\mathcal{D}_{f}

is all

12936

images,

\mathcal{U}

the

6473

images of the deleted identities,

\mathcal{D}_{r}

the

1491

images kept from the retained ones, and the last column the

4972

images of retained identities that

\mathcal{D}_{r}

did not keep. The query split is the non-member set throughout. Only the

\mathcal{U}

column asks about removal. The reference reads

1.000

on the images it trained on and

0.938

on retained identities it never trained on, so a pool that mixes them certifies nothing; it is at chance only on

\mathcal{U}

. Red : Core; blue : retrained reference; gray : the consolidated Full payload.

Setting	Core mAP	Full mAP	MIA ${}_{\text{ent}}$ on $\mathcal{U}$
Default	74.34	81.99	0.493
BN freeze	75.12	80.07	0.487

Appendix

Table 17: Effect of freezing BN running statistics during Step 2 on Market-1501, under identity-level deletion. Freezing trades Full capacity for Core accuracy,

-1.9

and

+0.8

mAP, and moves the membership attack on

\mathcal{U}

0.006

, so the running statistics are not a leakage channel here. Default is the deployed setting.

Figure 6: Calibration and power of the Forgetting-Rank on Market-1501 under identity-level deletion, over five shadows sharing one split,

|\mathcal{U}|{=}6473

forgotten images and

32365

scored ranks per series. In red, the deployed Core ranked among the shadows that also forgot

x

: every level carries exactly

0.200

of the mass, the dashed rule, at

\chi^{2}

p{=}1.0

and

\bar{\rho}_{\mathcal{U}}{=}0.500

. This is the null being exactly calibrated. Because the ranks of one family are a permutation across its targets, that uniformity follows from a counting identity whatever the model did, so it certifies the reference rather than the forgetting. In grey, the same network read in Full mode and scored against the other seeds’ Core, a comparison across families that the identity does not constrain: it sits at the floor of the rank scale for

99.98\%

of forgotten samples,

\bar{\rho}_{\mathcal{U}}{=}0.100

. The reading does not depend on treating images of one identity as independent: with the identity as the unit, every one of the

1880

identity readings the five models give falls below the null and

1877

sit at the floor. The test’s power is located there.

	RMIA			U-LiRA
Method	AUC	TPR@1%	[email protected]%	AUC	TPR@1%
Original	0.99	0.784	0.358	0.98	0.356
Fine-tune	0.98	0.805	0.485	0.97	0.525
GA	0.98	0.744	0.381	0.97	0.327
NegGrad+	0.99	0.773	0.400	0.98	0.342
SalUn	0.88	0.302	0.122	0.87	0.200

Appendix

Table 18: Attacks in the low false positive region on Market-1501 under identity-level deletion, members

\mathcal{U}

against the query split, deployed seed, four retrained references. TPR columns are the true positive rate at the stated false positive rate, so

0.010

1\%

is chance. Red : Core; blue : retrained reference; gray : the consolidated Full payload.

Method	Market-1501	VeRi-776	RegDB
Original	0.784	0.254	0.169
Fine-tune	0.805	0.321	0.391
GA	0.744	0.088	0.347
NegGrad+	0.773	0.004	0.155
SalUn	0.302	0.061	0.293
Bad Teacher	0.311	0.023	0.348

Appendix

Table 19: True positive rate at

1\%

false positives across the three benchmarks , RMIA on

\mathcal{U}

against the query split, deployed seed. Chance is

0.010

. The reference sits on it everywhere and Core within a factor of two, the consolidated payload is detected everywhere, and the baselines that keep their retrieval are detected on at least one benchmark each. Red : Core; blue : retrained reference; gray : the consolidated Full payload.

Violation	Kept	$\rho_{\mathcal{U}}$	$\sigma$	Identity AUC	Clean at floor	AUC	$95\%$ int.
		Forgetting-Rank				RMIA
$2\%$	14	0.5102	$+1.3$	0.9995	2.0%	0.531	$[.512,.550]$
$5\%$	34	0.4793	$-2.6$	0.9973	5.5%	0.542	$[.522,.562]$
$10\%$	68	0.4820	$-2.3$	0.9921	7.2%	0.562	$[.541,.585]$
$25\%$	169	0.4645	$-4.5$	0.9940	7.3%	0.635	$[.611,.659]$

Appendix

Table 20: Detection power of the Forgetting-Rank against planted violations on Market-1501, five clean shadows, split seed

42

. A violation of

f

keeps

f

of the requested identities in the core update. The clean leave-one-out readings are

0.4946

0.5140

0.4999

0.4908

and

0.5006

, a spread of

0.0079

that sets the

\sigma

column, which counts standard deviations from the null. The clean-at-floor column is the fraction of genuinely forgotten identities that also reach it, which is the false positive rate of the identity-level reading. Bold marks the

2\%

violation, the one neither the aggregate nor the attacks can see and the identity-level reading still localizes. The RMIA columns score the same models against the four disjoint references the main tables use, identity-clustered; a control trained by the same recipe with the violation set to nothing reads

0.499

there, with an interval of

[.482,.517]

Machine Unlearning

Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.

See all 354 papers

Jul 7, 2025

Efficient Unlearning with Privacy Guarantees

Privacy protection laws, such as the GDPR, grant individuals the right to request the forgetting of their personal data not only from databases but also from machine learning (ML) models trained on them. Machine unlearning has emerged as a practical means to facilitate model forgetting of data instances seen during training. Although some existing machine unlearning methods guarantee exact forgetting, they are typically costly in computational terms. On the other hand, more affordable methods do not offer forgetting guarantees and are applicable only to specific ML models. In this paper, we present efficient unlearning with privacy guarantees (EUPG), a novel machine unlearning framework that offers formal privacy guarantees to individuals whose data are being unlearned. EUPG involves pre-training ML models on data protected using privacy models, and it enables {\em efficient unlearning with the privacy guarantees offered by the privacy models in use}. Through empirical evaluation on four heterogeneous data sets protected with

k

-anonymity and

ε

-differential privacy as privacy models, our approach demonstrates utility and forgetting effectiveness comparable to those of exact unlearning methods, while significantly reducing computational and storage costs. Our code is available at https://github.com/najeebjebreel/EUPG.

Josep Domingo-Ferrer, Najeeb Jebreel, David Sánchez

1CYBERCAT (Center for Cybersecurity Research of2026 Catalonia), ComSCIAM-Center for Computational Science and Applied Mathematics, Department of Computer EngineeringJun and Mathematics, Universitat Rovira i Virgili, Av. Pa¨ısos26 Catalans 26, E-43007 Tarragona, Catalonia

Privacy-Preserving ML Machine Unlearning

Ask PDF

Apr 12, 2026

Mitigating Privacy Risk via Forget Set-Free Unlearning

Training machine learning models requires the storage of large datasets, which often contain sensitive or private data. Storing data is associated with a number of potential risks which increase over time, such as database breaches and malicious adversaries. Machine unlearning is the study of methods to efficiently remove the influence of training data subsets from previously-trained models. Existing unlearning methods typically require direct access to the "forget set" -- the data to be forgotten-and organisations must retain this data for unlearning rather than deleting it immediately upon request, increasing risks associated with the forget set. We introduce partially-blind unlearning -- utilizing auxiliary information to unlearn without explicit access to the forget set. We also propose a practical framework Reload, a partially-blind method based on gradient optimization and structured weight sparsification to operationalize partially-blind unlearning. We show that Reload efficiently unlearns, approximating models retrained from scratch, and outperforms several forget set-dependent approaches. On language models, Reload unlearns entities using <0.025% of the retain set and <7% of model weights in <8 minutes on Llama2-7B. In the corrective case, Reload achieves unlearning even when only 10% of corrupted data is identified.

Aviraj Newatia, Michael Cooper, Viet Nguyen +1

University of Toronto, Vector Institute, Toronto, ON, Canada

Machine Unlearning Privacy-Preserving ML LLM Unlearning

Ask PDF

Apr 15, 2026

WIN-U: Woodbury-Informed Newton-Unlearning as a retain-free Machine Unlearning Framework

Privacy concerns in LLMs have led to the rapidly growing need to enforce a data's "right to be forgotten". Machine unlearning addresses precisely this task, namely the removal of the influence of some specific data, i.e., the forget set, from a trained model. The gold standard for unlearning is to produce the model that would have been learned on only the rest of the training data, i.e., the retain set. Most existing unlearning methods rely on direct access to the retained data, which may not be practical due to privacy or cost constraints. We propose WIN-U, a retained-data free unlearning framework that requires only second order information for the originally trained model on the full data. The unlearning is performed using a single Newton-style step. Using the Woodbury matrix identity and a generalized Gauss-Newton approximation for the forget set curvature, the WIN-U update recovers the closed-form linear solution and serves as a local second-order approximation to the gold-standard retraining optimum. Extensive experiments on various vision and language benchmarks demonstrate that WIN-U achieves SOTA performance in terms of unlearning efficacy and utility preservation, while being more robust against relearning attacks compared to existing methods. Importantly, WIN-U does not require access to the retained data.

Xingjian Zhao, Mohammad Mohammadi Amiri, Malik Magdon-Ismail

Department of Computer Science, Rensselaer Polytechnic Institute, Troy, NY 12180, USA

Machine Unlearning LLM Unlearning

Ask PDF

Abstract

Machine Unlearning

Explore similar work

Efficient Unlearning with Privacy Guarantees

Mitigating Privacy Risk via Forget Set-Free Unlearning

WIN-U: Woodbury-Informed Newton-Unlearning as a retain-free Machine Unlearning Framework