Similarity-Aware Machine Unlearning

# Similarity-Aware Machine Unlearning
Source: [https://arxiv.org/html/2608.00246](https://arxiv.org/html/2608.00246)
11institutetext:Department of Computer Science, University of Manchester, UK22institutetext:Centre for Machine Intelligence, University of Sheffield, UK33institutetext:School of Computer Science, University of Sheffield, Sheffield, UK44institutetext:Paris Dauphine \- PSL University, Paris, France
44email:madhavan\.citalamangalamkumaran@student\.manchester\.ac\.uk, m\.parakkalunni@sheffield\.ac\.uk, vasiliki\.kouni@lamsade\.dauphine\.fr, haripriya\.harikumar@manchester\.ac\.uk###### Abstract

Machine unlearning removes the influence of user\-specified training examples from a trained model, avoiding the need to retrain it from scratch\. Localization\-based methods improve unlearning efficiency by identifying a subset of influential model parameters\. However, existing approaches select parameters based solely on forget\-set importance, neglecting their role in retained dataset and often causing collateral damage to semantically similar retained examples\. We address this limitation with a retain\-aware localization method that considers parameter importance to both forgotten and retained data\. We also introduce a retain\-similar evaluation set, constructed using cosine similarity in the model embedding space, to directly measure collateral damage\. Across eleven experimental settings on CIFAR\-10 dataset and ResNet18 model, our method consistently reduces collateral damage while improving standard unlearning metrics, demonstrating the effectiveness of retain\-aware localization for similarity\-aware machine unlearning\.

## 1Introduction

Machine learning models can memorize information about individual training examples to varying degrees\[[26](https://arxiv.org/html/2608.00246#bib.bib5)\], creating privacy risks even when the underlying training records are not directly accessible\. Membership\-inference attacks can reveal whether an example was used for training\[[23](https://arxiv.org/html/2608.00246#bib.bib8)\], model\-inversion attacks\[[11](https://arxiv.org/html/2608.00246#bib.bib61)\]can expose sensitive attributes\[[21](https://arxiv.org/html/2608.00246#bib.bib99)\], and generative models can reproduce passages from their training corpora verbatim\[[6](https://arxiv.org/html/2608.00246#bib.bib58)\]\. These risks are amplified when models are trained on personal or sensitive data\[[20](https://arxiv.org/html/2608.00246#bib.bib100),[21](https://arxiv.org/html/2608.00246#bib.bib99)\]\. Data\-protection frameworks such as the General Data Protection Regulation\[[25](https://arxiv.org/html/2608.00246#bib.bib52)\]and California Consumer Privacy Act\[[19](https://arxiv.org/html/2608.00246#bib.bib63)\]establish rights concerning the erasure or deletion of personal data\. Together, these privacy risks and data\-deletion rights motivate mechanisms for removing the residual influence from models\.

Machine unlearning\[[5](https://arxiv.org/html/2608.00246#bib.bib46),[2](https://arxiv.org/html/2608.00246#bib.bib2),[27](https://arxiv.org/html/2608.00246#bib.bib1)\]addresses this problem by modifying a trained model so that its behavior approximates that of an oracle model retrained without a user\-specified subset of training examples, referred to as the forget set\. Retraining from scratch on the remaining data provides the best solution, but can be computationally expensive, particularly when deletion requests are frequent\. Approximate unlearning\[[17](https://arxiv.org/html/2608.00246#bib.bib9)\]methods therefore seek to approximate the behavior of the retrained model at substantially lower computational cost\. Localized unlearning\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\]methods reduce this cost by restricting model modifications to a selected subset of parameters that are influential for the forget set\.

However, importance to the forget set does not imply specificity to the forget set\. A parameter may be highly influential for forgotten examples while also supporting retained examples\. This overlap is especially consequential when forgotten and retained examples occupy nearby regions of the learned representation space and may depend on shared features, as shown in Fig\.[1](https://arxiv.org/html/2608.00246#S1.F1)\(visually similar images in red and green boxes naturally cluster closely in their embedding space\)\.

![Refer to caption](https://arxiv.org/html/2608.00246v1/figs/Intuition_representation.png)Figure 1:Intermediate feature\-space visualization showing that semantically similar samples are embedded close to one another within class\-specific clusters\. The image to forget \(red\) and the image to retain \(green\) occupy very close neighboring regions of the feature manifold, indicating shared feature representations\.Consequently, forget\-only localization can modify parameters used by both sets, causing unintended degradation on representation\-similar retained examples\. We refer to this representational overlap asfeature entanglementand to the resulting degradation ascollateral damage\. Because such damage may be concentrated among a small subset of retained examples, aggregate test and retain\-set accuracy may fail to reveal it\.

To address this limitation, we propose a retain\-aware localization framework\. We compute criticality scores separately on the forget set and the retain set, and combine them to prioritize neurons that are important to the forget set but comparatively less important to the retain set\. To measure collateral damage directly, we also construct a retain\-similar evaluation set\. For each forgotten example, this set contains its nearest same\-class retained neighbor according to cosine similarity in the original model’s embedding space\. Our contributions are as follows\.

- •We identify collateral damage to semantically similar retained examples as a key limitation of existing localization\-based machine unlearning methods and relate this phenomenon to shared learned representations\.
- •We propose a retain\-aware localization framework that incorporates parameter importance with respect to both forgotten and retained data, enabling similarity\-aware unlearning\.
- •We introduce a retain\-similar evaluation protocol and demonstrate across eleven experimental settings that our approach consistently reduces collateral damage while improving standard unlearning metrics\.

## 2Background

We introduce the notation and definitions used throughout the paper before presenting our method\. Let𝒟:=⋃n≥1\(𝒳×𝒴\)n\\mathcal\{D\}:=\\bigcup\_\{n\\geq 1\}\(\\mathcal\{X\}\\times\\mathcal\{Y\}\)^\{n\}denote the set of all datasets and𝒜\\mathcal\{A\}a randomized training algorithm,𝒜:𝒟→Δ​\(ℋ\)\\mathcal\{A\}:\\mathcal\{D\}\\rightarrow\\Delta\(\\mathcal\{H\}\), whereΔ​\(ℋ\)\\Delta\(\\mathcal\{H\}\)denotes the set of all probability distributions over the hypothesis spaceℋ\\mathcal\{H\}\. The hypothesis spaceℋ:=\{fθ:𝒳→𝒴∣θ∈ℝd\}\\mathcal\{H\}:=\\\{f\_\{\\theta\}:\\mathcal\{X\}\\to\\mathcal\{Y\}\\mid\\theta\\in\\mathbb\{R\}^\{d\}\\\}is the set of all models that the learning algorithm𝒜\\mathcal\{A\}produces, parameterized by weight vectorsθ∈ℝd\\theta\\in\\mathbb\{R\}^\{d\}\. We denote byfθo∼𝒜​\(Dt​r​a​i​n⊂𝒟\)f\_\{\\theta^\{o\}\}\\sim\\mathcal\{A\}\(D\_\{train\}\\subset\\mathcal\{D\}\)the original model parameterised byθo\\theta^\{o\}when trained on the training setDt​r​a​i​n⊂𝒟D\_\{train\}\\subset\\mathcal\{D\}prior to unlearning\.

Let the forget set be denoted byDf⊂Dt​r​a​i​nD\_\{f\}\\subset D\_\{train\}, consisting of the data requested for removal\. The retain set is defined as,Dr=Dt​r​a​i​n∖DfD\_\{r\}=D\_\{train\}\\setminus D\_\{f\}representing the remaining training data\. We denotefθr∼𝒜​\(Dr\)f\_\{\\theta^\{r\}\}\\sim\\mathcal\{A\}\(D\_\{r\}\)as oracle model andθr\\theta^\{r\}as the associated parameters by training from scratch only on the retain set alone\. Machine unlearning is defined as the process of modifying the parameters of a model from𝒜​\(Dt​r​a​i​n\)\\mathcal\{A\}\(D\_\{train\}\), in order to remove the influence ofDfD\_\{f\}without compromising performance on the retain setDrD\_\{r\}\. Formally,

###### Definition 1\(Unlearning\[[3](https://arxiv.org/html/2608.00246#bib.bib13)\]\)

An unlearning algorithm𝒰\\mathcal\{U\}is said to unlearn a forget setDf⊂DtrainD\_\{f\}\\subset D\_\{\\text\{train\}\}if the unlearned modelfθu∼𝒰​\(fθo,Df,Dr\)f\_\{\\theta^\{u\}\}\\sim\\mathcal\{U\}\(f\_\{\\theta^\{o\}\},D\_\{f\},D\_\{r\}\)is indistinguishable from the retrained modelfθr∼𝒜​\(Dr\)f\_\{\\theta^\{r\}\}\\sim\\mathcal\{A\}\(D\_\{r\}\), whereDr=Dtrain∖DfD\_\{r\}=D\_\{\\text\{train\}\}\\setminus D\_\{f\}\. Formally, the output distributions offθuf\_\{\\theta^\{u\}\}andfθrf\_\{\\theta^\{r\}\}are identical on the evaluation distribution\.

Definition 1 characterizes the goal of machine unlearning where the unlearned modelfθuf\_\{\\theta^\{u\}\}should behave indistinguishably from a model retrained from scratch on the retain setDrD\_\{r\}\. One way to satisfy this definition is exact unlearning, where the model is retrained from scratch using onlyDrD\_\{r\}, to producefθr∼𝒜​\(Dr\)f\_\{\\theta^\{r\}\}\\sim\\mathcal\{A\}\(D\_\{r\}\)\. Although exact unlearning directly satisfies the definition, retraining with large models and datasets can be computationally expensive\. Therefore, practical approaches often employ approximate unlearning, where an unlearning algorithm𝒰\\mathcal\{U\}modifies the original modelfθof\_\{\\theta^\{o\}\}to obtainfθu∼𝒰​\(fθo,Df,Dr\)f\_\{\\theta^\{u\}\}\\sim\\mathcal\{U\}\(f\_\{\\theta^\{o\}\},D\_\{f\},D\_\{r\}\)\. The objective is to have an unlearned modelfθuf\_\{\\theta^\{u\}\}that produces outputs closely matched to those of the retrained modelfθrf\_\{\\theta^\{r\}\}, while requiring significantly less computation\. More precisely, machine unlearning approach aims for the following:

t​\(𝒰​\(fθo,Df,Dr\)\)\\displaystyle t\\bigl\(\\mathcal\{U\}\(f\_\{\\theta^\{o\}\},\\,D\_\{f\},D\_\{r\}\)\\bigr\)≪t​\(𝒜​\(Dr\)\),\\displaystyle\\ll t\\bigl\(\\mathcal\{A\}\(D\_\{r\}\)\\bigr\),\(1\)𝒰​\(fθo,Df,Dr\)\\displaystyle\\mathcal\{U\}\(f\_\{\\theta^\{o\}\},\\,D\_\{f\},D\_\{r\}\)≈𝒜​\(Dr\),\\displaystyle\\approx\\mathcal\{A\}\(D\_\{r\}\),\(2\)wheret​\(⋅\)t\(\\cdot\)denotes the execution time of the unlearning or training process\. We use the following definition to operationalise evaluation of unlearning in line with Torkzadehmahani et al\.\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\]\.

###### Definition 2\(Localized Machine Unlearning\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\]\)

Letθo=\{θk\}k=1N\\theta^\{o\}=\\\{\\theta\_\{k\}\\\}\_\{k=1\}^\{N\}denote the parameters of the original model, whereNNis the total number of trainable parameters\. An unlearning algorithm𝒰\\mathcal\{U\}is said to perform localized machine unlearning if, given a forget setDfD\_\{f\}, it identifies and modifies only a subset of parametersθs⊂θo,\|θs\|=n<N,\\theta\_\{s\}\\subset\\theta^\{o\},\|\\theta\_\{s\}\|=n<N,while leaving the remaining parameters unchanged during unlearning\. The resulting unlearned model is from𝒰​\(fθo,Df,Dr\),\\mathcal\{U\}\(f\_\{\\theta^\{o\}\},D\_\{f\},D\_\{r\}\),where updates are restricted to the selected parameter subsetθs\\theta\_\{s\}\.

###### Definition 3\(Memorization Score\[[26](https://arxiv.org/html/2608.00246#bib.bib5)\]\)

Memorization score for a data pointxix\_\{i\}with labelyiy\_\{i\}in a training setDt​r​a​i​nD\_\{train\},\(xi,yi\)∈Dt​r​a​i​n\(x\_\{i\},y\_\{i\}\)\\in D\_\{train\}with a randomized training algorithm𝒜\\mathcal\{A\}is given as follows,

mem​\(𝒜,D,xi\)=Prfθ∼𝒜​\(Dt​r​a​i​n\)⁡\(fθ​\(xi\)=yi\)−Prfθ′∼𝒜​\(Dt​r​a​i​n∖\(xi,yi\)\)⁡\(fθ′​\(xi\)=yi\),\\text\{mem\}\(\\mathcal\{A\},D,x\_\{i\}\)=\\Pr\_\{f\_\{\\theta\}\\sim\\mathcal\{A\}\(D\_\{train\}\)\}\(f\_\{\\theta\}\(x\_\{i\}\)=y\_\{i\}\)\-\\Pr\_\{f\_\{\\theta^\{\\prime\}\}\\sim\\mathcal\{A\}\(D\_\{train\}\\setminus\(x\_\{i\},y\_\{i\}\)\)\}\(f\_\{\\theta^\{\\prime\}\}\(x\_\{i\}\)=y\_\{i\}\),wherefθf\_\{\\theta\}is a model parameterized byθ\\thetasampled from the distribution𝒜​\(Dt​r​a​i​n\)\\mathcal\{A\}\(D\_\{train\}\), andfθ′f\_\{\\theta^\{\\prime\}\}is a model parameterized byθ′\\theta^\{\\prime\}sampled from the distribution𝒜​\(Dt​r​a​i​n\)∖\(xi,yi\)\\mathcal\{A\}\(D\_\{train\}\)\\setminus\(x\_\{i\},y\_\{i\}\)\. The first term considers model parameters trained on the entire dataset, while the second is the model parameters trained without the example\(xi,yi\)\(x\_\{i\},y\_\{i\}\)\. A high memorization score indicates that excluding the example causes a significant change in the performance of the model for that example\.

## 3Proposed Similarity Aware Localized Unlearning

We propose a Similarity\-Aware Localized Unlearning framework that extends the Deletion by Example Localization \(DEL\)\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\], by explicitly incorporating intermediate feature\-space similarity between forget and retain set images into the unlearning process\. Existing localization\-based unlearning methods\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\]identify influential layers and neurons primarily from the forget set\(Df\)\(D\_\{f\}\), without considering whether these parameters also contribute to semantically similar samples in the retain set\(Dr\)\(D\_\{r\}\)\. As a result, modifying localized parameters may affect learned representation from the retain set\.

Our key observation is that semantically similar forget and retain samples are embedded in nearby regions of the intermediate feature space \(in Fig\.[1](https://arxiv.org/html/2608.00246#S1.F1)\) and therefore tend to activate overlapping subsets of neurons\. Motivated by this observation, we perform localization using information from both the forget and retain sets\. To address this limitation, our method uses forget samples and constrains the unlearning process with the retain set to preserve their representations\. By jointly considering parameter localization and sample similarity, we selectively modify forget\-specific knowledge while minimizing collateral damage to theDrD\_\{r\}\. By jointly analyzing neuron importance acrossDfD\_\{f\}andDrD\_\{r\}, our proposed method identifies parameters that are strongly associated with the forget set while accounting for their contribution to similar retain samples\. This similarity\-aware localization enables targeted removal of forget\-specific knowledge while reducing collateral damage to retained knowledge and preserving overall model performance\.

###### Definition 4\(Semantic Similarity\)

Letϕ​\(⋅\)\\phi\(\\cdot\)denote the embedding representation produced by a model\. For two samplesxix\_\{i\}andxjx\_\{j\}, the semantic similarity between their learned representations is defined using cosine similarity as

sim​\(xi,xj\)=ϕ​\(xi\)⊤​ϕ​\(xj\)‖ϕ​\(xi\)‖​‖ϕ​\(xj\)‖\.\\mathrm\{sim\}\(x\_\{i\},x\_\{j\}\)=\\frac\{\\phi\(x\_\{i\}\)^\{\\top\}\\phi\(x\_\{j\}\)\}\{\\\|\\phi\(x\_\{i\}\)\\\|\\,\\\|\\phi\(x\_\{j\}\)\\\|\}\.\(3\)

Two examples are considered semantically similar when their embedding representations exhibit high cosine similarity in the learned feature space\. Consider a forget\-set example\(xi,yi\)∈Df\(x\_\{i\},y\_\{i\}\)\\in D\_\{f\}and a retain\-set example\(xj,yj\)∈Dr\(x\_\{j\},y\_\{j\}\)\\in D\_\{r\}, such thatsim​\(xi,xj\)\\mathrm\{sim\}\(x\_\{i\},x\_\{j\}\)is high\. Since both examples occupy nearby regions in the learned representation space, they are likely to share intermediate feature representations and depend on overlapping subsets of model parameters\.

###### Definition 5\(Similarity\-Aware Localized Unlearning\)

Considerθo=\{θk\}k=1N\\theta^\{o\}=\\\{\\theta\_\{k\}\\\}\_\{k=1\}^\{N\}denote the parameters of the original modelfθof\_\{\\theta^\{o\}\}andmem​\(θk,xi\)\\text\{mem\}\(\\theta\_\{k\},x\_\{i\}\)quantify the contribution of parameterθk\\theta\_\{k\}to the memorization of examplexix\_\{i\}\. An unlearning algorithm𝒰\\mathcal\{U\}is said to perform similarity\-aware localized unlearning if it selects a subset of parametersθs⊂θo,\|θs\|=n<N,\\theta\_\{s\}\\subset\\theta^\{o\},\|\\theta\_\{s\}\|=n<N,such that the selected parameters have high memorization contribution to the forget\-set data while minimizing disruption to semantically similar retain\-set data\. Formally, the selected subset should satisfy the following,

mem​\(θs,xi\)≫mem​\(θs,xj\),\\text\{mem\}\(\\theta\_\{s\},x\_\{i\}\)\\gg\\text\{mem\}\(\\theta\_\{s\},x\_\{j\}\),\(4\)for semantically similar pairs\(xi,xj\)\(x\_\{i\},x\_\{j\}\)wherexi∈Dfx\_\{i\}\\in D\_\{f\}andxj∈Drx\_\{j\}\\in D\_\{r\}\.

### 3\.1Criticality scores

###### Definition 6\(\(Parameter\) criticality score\)

The\(parameter\) criticality scoresjs\_\{j\}of thejthj^\{\\text\{th\}\}parameterθo\\theta^\{o\}denoted asθjo\\theta\_\{j\}^\{o\}, wherej∈\{1,…,N\}j\\in\\\{1,\\dots,N\\\}andNNis the total number of parameters, is defined as

sj=\|θjo⋅g​\(θjo,D\)\|\.s\_\{j\}=\\left\|\\theta\_\{j\}^\{o\}\\cdot g\(\\theta\_\{j\}^\{o\},D\)\\right\|\.\(5\)

The \(parameter\) criticality score measures the importance of the parameterθjo\\theta\_\{j\}^\{o\}with respect to a given datasetDD\. Letg​\(θjo,D\)g\(\\theta\_\{j\}^\{o\},D\)denote the gradient of the loss with respect toθjo\\theta\_\{j\}^\{o\}computed over the forget set\. This identifies parameters whose current values are both large and strongly implicated in the model’s predictions on the dataset\. Each layer of the model consists of a set ofMMneurons\. We aim to identify the neurons with the highest \(parameter\) criticality scores; to that end, we introduce the following definition\.

###### Definition 7\(Neuron criticality score\)

Lets~i\\tilde\{s\}\_\{i\}denote the sequence of \(parameter\) criticality scores corresponding to the parameters associated with neuronoio\_\{i\}, sorted in descending order\. We compute theneuron criticality scorec​oico\_\{i\}for neuronoio\_\{i\}, by averaging the top\-hhparameter criticality scores:

c​oi=1h​∑j=1hs~i​\[j\]\.co\_\{i\}=\\frac\{1\}\{h\}\\sum\_\{j=1\}^\{h\}\\tilde\{s\}\_\{i\}\[j\]\.\(6\)

Without loss of generality, in the remainder of this work we will refer to the \(parameter\) criticality scores simply as criticality scores\.

### 3\.2Criticality score of similarity aware localized unlearning

We compute two sets of criticality scores for our localized unlearning framework\. The first set is computed on the forget setDfD\_\{f\}, denoted assfs^\{f\}, and the second set is computed on the retain setDrD\_\{r\}denoted assrs^\{r\}\. The neuron criticality scores are then used to identify the neurons that should be finetuned for unlearning\. We propose three methods of localization strategies by considering the forget set and retain set: \(1\) thedifferencemethod, \(2\) theweighted\_differencemethod, and \(3\) theratiomethod\. The methods are outlined below\.

#### 3\.2\.1Difference method

In thedifferencemethod, we used the difference between the forget set and the retain set criticality score of a neuron to identify its relevance and later for unlearning\. So, the criticality score is:

s~j=max⁡\(sjf−sjr,0\),\\tilde\{s\}\_\{j\}=\\max\\\!\\left\(s\_\{j\}^\{f\}\-s\_\{j\}^\{r\},\\;0\\right\),\(7\)
wheresjfs\_\{j\}^\{f\}andsjrs\_\{j\}^\{r\}are the forget\-set and retain\-set parameter criticality scores, respectively\. The clamp at zero ensures that parameters more important for the retain set than the forget set receive a score of zero and are excluded from the localization mask entirely\.

#### 3\.2\.2Weighted Difference method

In theweighted\_differencemethod, we introduce a scalar weightwwon the forget set criticality score as follows:

s~j=max⁡\(w⋅sjf−sjr,0\)\.\\tilde\{s\}\_\{j\}=\\max\\\!\\left\(w\\cdot s\_\{j\}^\{f\}\-s\_\{j\}^\{r\},\\;0\\right\)\.\(8\)The scalar weightwwallows the balance between forget\-set specificity and retain\-set protection to be tuned continuously\. Aswwincreases, the scoring criterion converges toward the forget\-only baseline; aswwapproaches 1, the scoring criterion converges to the unweighted difference\.

#### 3\.2\.3Ratio method

In theratiomethod, we propose a ratio between the criticality score of the forget set and retain set:

s~j=sjfsjr\+ε,\\tilde\{s\}\_\{j\}=\\frac\{s\_\{j\}^\{f\}\}\{s\_\{j\}^\{r\}\+\\varepsilon\},\(9\)whereε=10−8\\varepsilon=10^\{\-8\}ensures numerical stability, favoring forget\-specific parameters\.

### 3\.3Masking with criticality score

A binary localization maskm∈\{0,1\}pm\\in\\\{0,1\\\}^\{p\}over allppmillion trainable parameters is constructed by ranking neurons across all layers, in descending order of criticality score based on our three proposed methods, and greedily selecting neurons until the cumulative parameter count of selected channels meets a budgetα=30%\\alpha=30\\%of total parameters, similarly to\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\]\. The budget is applied globally, thus the mask is not constrained to act uniformly across layers, so that layers with higher aggregate criticality naturally contribute more selected channels\.

### 3\.4Reinitialization based on criticality score and unlearning

After constructing the mask, we re\-initialise each selected weightθj\\theta\_\{j\}using Kaiming normal initialization\[[13](https://arxiv.org/html/2608.00246#bib.bib90)\],2/nin​\(j\)2/n\_\{\\text\{in\}\}\(j\), wherenin​\(j\)n\_\{\\text\{in\}\}\(j\)is the number of input connections to the layer containingθj\\theta\_\{j\}\[[13](https://arxiv.org/html/2608.00246#bib.bib90)\]\. This matches the initialization used to train the original model and preserves activation variance during the forward pass; unselected weights remain unchanged during re\-initialization\. The model is then fine\-tuned on the retain setDrD\_\{r\}for the same number of epochs as in\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\]\. During fine\-tuning, gradients of unselected weights are masked, restricting updates to the re\-initialised parameter subset\.

## 4Experiments

### 4\.1Dataset

We use the CIFAR\-10 dataset\[[15](https://arxiv.org/html/2608.00246#bib.bib57)\], which contains 60,000 colour images \(32×3232\\times 32\) from 10 classes, split into 50,000 training and 10,000 test images\. The training set is further divided into 40,000 training and 10,000 validation images, where the validation set is used only for model selection\. For the unlearning task, the 40,000 training images are partitioned into a forget setDfD\_\{f\}of 5,000 images and a retain setDrD\_\{r\}of 35,000 images using a fixed random seed\. The forget set comprises 12\.5% of the training data and is sampled uniformly at random, preserving the class distribution of the original dataset\.

#### 4\.1\.1Retain\-similar evaluation dataset:

A key component of the evaluation strategy is the construction of aretain\-similar setDr,simD\_\{r,\\text\{sim\}\}: a subset of the retain set consisting of the retain\-set examples most semantically similar to the forget\-set examples under the original model’s learned representations\. Semantic similarity is measured using cosine similarity between 512\-dimensional embeddings from the original modelfθof\_\{\\theta^\{o\}\}\. Embeddings are computed in a single forward pass for all 5,000 forget\-set and 35,000 retain\-set samples\. For each forget\-set samplexf∈Dfx\_\{f\}\\in D\_\{f\}, the nearest neighbour is selected from retain\-set samplesxr∈Drx\_\{r\}\\in D\_\{r\}of the same class \(yf=yry\_\{f\}=y\_\{r\}\):

xr∗=arg⁡maxxr∈𝒟r:yr=yf​sim​\(xf,xr\),x\_\{r\}^\{\*\}=\\underset\{x\_\{r\}\\in\\mathcal\{D\}\_\{r\}:y\_\{r\}=y\_\{f\}\}\{\\arg\\max\}\\;\\text\{sim\}\(x\_\{f\},x\_\{r\}\),\(10\)wheresim​\(xf,xr\)\\text\{sim\}\(x\_\{f\},x\_\{r\}\)is computed by \([3](https://arxiv.org/html/2608.00246#S3.E3)\)\. The retain\-similar setDr,simD\_\{r,\\text\{sim\}\}is formed by collecting the unique nearest neighbours\{xr∗\}xr∗∈Dr\\\{x\_\{r\}^\{\*\}\\\}\_\{x\_\{r\}^\{\*\}\\in D\_\{r\}\}, deduplicated, so that each retain example appears at most once\. In practice, the resulting set contains a slightly smaller number of examples than the forget set, since multiple forget\-set examples share a nearest neighbour\. We used 4,575 samples fromDr,simD\_\{r,\\text\{sim\}\}\.

### 4\.2Model architecture

We use a modified ResNet\-18\[[14](https://arxiv.org/html/2608.00246#bib.bib24)\]for all experiments\. Because the standard ImageNet configuration aggressively downsamples CIFAR\-10 images \(32×3232\\times 32\), we replace the initial7×77\\times 7stride\-2 convolution with a3×33\\times 3stride\-1 convolution and remove the first max\-pooling layer\. We have two models for experiments and for evaluating our proposed method,

- •Original Model\- The original modelfθof\_\{\\theta^\{o\}\}was trained on the full training set using SGD\[[1](https://arxiv.org/html/2608.00246#bib.bib31)\]with a learning rate of 0\.1, momentum of 0\.9, weight decay of5×10−45\\times 10^\{\-4\}, batch size of 128, and 50 epochs\. The learning rate followed a cosine annealing schedule\[[16](https://arxiv.org/html/2608.00246#bib.bib91)\]with a minimum of 0\.001 similar to\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\]\. The model achieved 89\.87% test accuracy\. As expected for CIFAR\-10, automobile \(96\.20%\) and ship \(94\.90%\) had the highest accuracy, whereas cat \(78\.30%\), dog \(84\.10%\), and bird \(85\.50%\) had the lowest\[[15](https://arxiv.org/html/2608.00246#bib.bib57)\]\.
- •Oracle Model\- The oracle modelfθrf\_\{\\theta^\{r\}\}is trained with all the data except the forget setDfD\_\{f\}\. We use the hyperparameter similar to the original model for training except the number of epochs as 35\. The oracle model achieved a test set accuracy of 85\.91%, a retain set accuracy of 100%, and a forget set accuracy of 86\.32%\.

### 4\.3Evaluation measures

Unlearning quality is evaluated against an oracle model retrained from scratch onDrD\_\{r\}, which serves as the gold standard\[[2](https://arxiv.org/html/2608.00246#bib.bib2)\]\. We report six metrics: test accuracy, retain accuracy, forget accuracy, retain\-similar accuracy, membership inference attack \(MIA\) score\[[23](https://arxiv.org/html/2608.00246#bib.bib8)\], and KL divergence\[[12](https://arxiv.org/html/2608.00246#bib.bib53)\]\. Metrics are reported for the original modelfθof\_\{\\theta^\{o\}\}, the unlearned modelfθuf\_\{\\theta^\{u\}\}, and the oracle modelfθrf\_\{\\theta^\{r\}\}\. Except for KL divergence, performance is summarized by the delta as follows,

Δmetric=metric​\(fθr\)−metric​\(fθu\),\\Delta\_\{\\text\{metric\}\}=\\text\{metric\}\(f\_\{\\theta^\{r\}\}\)\-\\text\{metric\}\(f\_\{\\theta^\{u\}\}\),\(11\)where values closer to zero indicate better agreement with the oracle\. Positive values indicate that the unlearned model underperforms the oracle, while negative values indicate over\-correction\. The retain\-similar accuracy delta measures collateral damage to semantically similar retained examples\.

Test accuracymeasures generalisation to the held\-out test set:

Δtest=acctest​\(fθr\)−acctest​\(fθu\)\\Delta\_\{\\text\{test\}\}=\\text\{acc\}\_\{\\text\{test\}\}\(f\_\{\\theta^\{r\}\}\)\-\\text\{acc\}\_\{\\text\{test\}\}\(f\_\{\\theta^\{u\}\}\)\(12\)A large positive delta indicates collateral damage to the model’s general representations\.

Retain accuracymeasures performance on the full retain set𝒟r\\mathcal\{D\}\_\{r\}:

Δretain=accretain​\(fθr\)−accretain​\(fθu\)\\Delta\_\{\\text\{retain\}\}=\\text\{acc\}\_\{\\text\{retain\}\}\(f\_\{\\theta^\{r\}\}\)\-\\text\{acc\}\_\{\\text\{retain\}\}\(f\_\{\\theta^\{u\}\}\)\(13\)A significant positive delta indicates that the unlearning procedure has perturbed parameters important for examples that should be preserved\.

Forget accuracymeasures whether the model has ceased to correctly classify the forgotten examples:

Δforget=accforget​\(fθr\)−accforget​\(fθu\)\\Delta\_\{\\text\{forget\}\}=\\text\{acc\}\_\{\\text\{forget\}\}\(f\_\{\\theta^\{r\}\}\)\-\\text\{acc\}\_\{\\text\{forget\}\}\(f\_\{\\theta^\{u\}\}\)\(14\)Following\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\], the target is a forget\-set accuracy matching the oracle’s: too high indicates insufficient forgetting; too low indicates over\-forgetting, itself a detectable deviation from the oracle\.

Retain\-similar accuracymeasures performance onDr,simD\_\{r,\\text\{sim\}\}:

Δrs=accr,sim​\(fθr\)−accr,sim​\(fθu\)\\Delta\_\{\\text\{rs\}\}=\\text\{acc\}\_\{r,\\text\{sim\}\}\(f\_\{\\theta^\{r\}\}\)\-\\text\{acc\}\_\{r,\\text\{sim\}\}\(f\_\{\\theta^\{u\}\}\)\(15\)This is the primary metric for the central hypothesis of our proposal\. If retain\-aware criticality scoring is effective,Δrs\\Delta\_\{\\text\{rs\}\}should be smaller than the corresponding delta produced by the forget\-only baseline, indicating that the more conservative channel selection has reduced collateral damage to the retained examples most semantically proximate to the forgotten data\.

KL divergenceprovides a distributional measure of the similarity between the unlearned model and the oracle on the forget set\[[12](https://arxiv.org/html/2608.00246#bib.bib53),[18](https://arxiv.org/html/2608.00246#bib.bib3)\]:

DKL​\(pfθu∥pfθr\)=1\|Df\|​∑x∈Df∑y∈Ypfθu​\(y∣x\)​log⁡pfθu​\(y∣x\)pfθr​\(y∣x\)D\_\{\\text\{KL\}\}\\\!\\left\(p\_\{f\_\{\\theta^\{u\}\}\}\\;\\\|\\;p\_\{f\_\{\\theta^\{r\}\}\}\\right\)=\\frac\{1\}\{\|D\_\{f\}\|\}\\sum\_\{x\\in D\_\{f\}\}\\sum\_\{y\\in Y\}p\_\{f\_\{\\theta^\{u\}\}\}\(y\\mid x\)\\log\\frac\{p\_\{f\_\{\\theta^\{u\}\}\}\(y\\mid x\)\}\{p\_\{f\_\{\\theta^\{r\}\}\}\(y\\mid x\)\}\(16\)wherepfθu​\(y∣x\)p\_\{f\_\{\\theta^\{u\}\}\}\(y\\mid x\)andpfθr​\(y∣x\)p\_\{f\_\{\\theta^\{r\}\}\}\(y\\mid x\)are the softmax output distributions of the unlearned and oracle models respectively\. A value of zero indicates that the two models are behaviourally indistinguishable onDfD\_\{f\}\. Unlike accuracy\-based metrics, KL divergence captures differences in the full output distribution rather than just the predicted class, providing sensitivity to subtle residual memorization that accuracy\-based metrics may miss\[[12](https://arxiv.org/html/2608.00246#bib.bib53)\]\.

MIA scoremeasures forgetting quality using the confidence\-based membership inference attack of\[[8](https://arxiv.org/html/2608.00246#bib.bib6)\]\. Following their protocol, an RBF\-kernel SVC\[[4](https://arxiv.org/html/2608.00246#bib.bib98),[7](https://arxiv.org/html/2608.00246#bib.bib94)\]is trained to distinguish retain\-set samples \(members\) from test\-set samples \(non\-members\) using the maximum softmax probability as the attack feature\. The trained classifier is then applied to the forget set, whose examples are treated as non\-members\. The MIA score is defined as follows,

MIAscore=\|\{xf∈Df:y^​\(xf\)=non\-member\}\|\|Df\|\.\\text\{MIA\}\_\{\\text\{score\}\}=\\frac\{\|\\\{x\_\{f\}\\in D\_\{f\}:\\hat\{y\}\(x\_\{f\}\)=\\text\{non\-member\}\\\}\|\}\{\|D\_\{f\}\|\}\.\(17\)

### 4\.4Results and Discussion

Table[1](https://arxiv.org/html/2608.00246#S4.T1)summarizes the delta metrics for the baseline\[[24](https://arxiv.org/html/2608.00246#bib.bib7)\]and our proposed method\. We subsample data from retain setDrD\_\{r\}to compute the criticality score for the retain set\.

Table 1:Unlearning results across baseline and our proposed method: Delta metrics for all eleven experimental conditions\.Subdenotes subsampled retain set used for criticality computation,Δrs\\Delta\_\{\\text\{rs\}\}denotes retain\-similar accuracy delta\. Positive values indicate the unlearned model performs worse than the oracle, negative values indicate over\-correction beyond the oracle, and zero indicates perfect oracle\-matching\.Bold lettersindicate the best results\.A random subsample \(indicated as column headerSub\) of 5,000 examples drawn fromDrD\_\{r\}, while non\-subsampled used all 35,000 data inDrD\_\{r\}\. For our weighted difference method, we choose three values:w∈\{3,5,7\}w\\in\\\{3,5,7\\\}, each in both subsampled and non\-subsampled variants\. A value ofw=1w=1imposes the strictest retain\-set protection; largewwreduces to the forget\-only baseline\. The three values tested span a range that is expected to capture the transition between these behaviours:w=3w=3imposes moderate retain\-set protection,w=7w=7approaches the forget\-only regime, andw=5w=5falls between them\.

#### 4\.4\.1Discussion of forget\-only baseline

Theforget\_onlybaseline hasΔforget=\+2\.70\\Delta\_\{\\text\{forget\}\}=\+2\.70, indicating mild over\-forgetting relative to the oracle, andΔtest=\+2\.58\\Delta\_\{\\text\{test\}\}=\+2\.58, showing utility loss\. ItsΔrs=\+0\.49\\Delta\_\{\\text\{rs\}\}=\+0\.49supports the feature\-entanglement hypothesis: forget\-only localization selects channels also used by visually similar retain examples, causing collateral damage onDr,simD\_\{r,\\text\{sim\}\}\. The largeΔMIA=\+5\.48\\Delta\_\{\\text\{MIA\}\}=\+5\.48and KL divergence of0\.3950\.395further show stronger residual membership signal and poorer oracle alignment than retain\-aware methods\. Overall,forget\_onlydamages retain performance while failing to match the oracle distributionally\.

#### 4\.4\.2Discussion of similarity aware localized unlearning

##### Difference method

The subsampleddifferencemethod produces the notable result among our proposed approaches\. It achieves aΔforget\\Delta\_\{\\text\{forget\}\}of \+0\.56, aΔtest\\Delta\_\{\\text\{test\}\}of \+0\.64, aΔretain\\Delta\_\{\\text\{retain\}\}\+0\.11, and criticallyΔrs\\Delta\_\{\\text\{rs\}\}of \+0\.04 — the smallest among all conditions that achieves confirms true forgetting\. TheΔMIA\\Delta\_\{\\text\{MIA\}\}of \+4\.98 indicating that the unlearned model most closely resembles the oracle from the adversary’s perspective\. The KL divergence of 0\.395 is the second lowest among valid conditions, confirming that the subsampled difference method produces the output distribution on the forget set that is very close to the oracle’s — a result that complements and extends the accuracy\-based findings\.

The non\-subsampled difference method remains valid, but itsΔrs=\+0\.11\\Delta\_\{\\text\{rs\}\}=\+0\.11is higher than the subsampled variant\. This may reflect the retain set’s long\-tail structure\[[10](https://arxiv.org/html/2608.00246#bib.bib59)\]: full retain aggregation includes atypical examples whose channel usage overlaps with the forget set, shifting the mask away from the forget\-similar boundary region\. In contrast, subsampling emphasizes denser head\-region examples, yielding retain scores better aligned withDr,simD\_\{r,\\text\{sim\}\}and therefore lower collateral damage\.

##### Weighted difference method

The weighted\-difference variants are valid across all values ofww, but largerwwmainly makes the intervention more aggressive\. In the subsampled setting,Δtest\\Delta\_\{\\text\{test\}\}increases from\+1\.49\+1\.49to\+2\.42\+2\.42, whileΔMIA\\Delta\_\{\\text\{MIA\}\}increases from\+4\.30\+4\.30to\+5\.80\+5\.80, suggesting greater utility loss and residual membership signal as forget\-set weighting increases\. Subsampling usually improvesΔforget\\Delta\_\{\\text\{forget\}\}, except atw=5w=5, but its effect onDr,simD\_\{r,\\text\{sim\}\}is mixed: non\-sampling is better atw=3w=3, while subsampling is better atw=5w=5andw=7w=7\. The KL values remain close overall, indicating similar forget\-set distributional alignment\. Overall, subsampledw=3w=3gives the best balance acrossΔtest\\Delta\_\{\\text\{test\}\},Δforget\\Delta\_\{\\text\{forget\}\}, andΔMIA\\Delta\_\{\\text\{MIA\}\}\.

##### Ratio method

The ratio conditions preserve utility but fail to forget\. Both variants have strongly negativeΔforget\\Delta\_\{\\text\{forget\}\}values,−3\.86\-3\.86and−3\.74\-3\.74, showing substantial under\-forgetting relative to the oracle\. Meanwhile,Δtest\\Delta\_\{\\text\{test\}\},Δretain\\Delta\_\{\\text\{retain\}\}, andΔrs\\Delta\_\{\\text\{rs\}\}remain close to zero or negative, indicating little collateral damage\. This is not a favourable trade\-off, since the retained utility comes from an insufficiently effective intervention\. The likely cause is the ratio criterionsjf/\(sjr\+ϵ\)s^\{f\}\_\{j\}/\(s^\{r\}\_\{j\}\+\\epsilon\), which can over\-prioritise channels with small retain scores even when their absolute forget importance is weak, while downweighting entangled channels that are important to both forget and retain examples\. The similar results for subsampled and non\-subsampled variants suggest that the failure is intrinsic to the ratio formulation rather than the retain\-set size\. The elevated KL values further indicate poor oracle alignment on the forget set\.

![Refer to caption](https://arxiv.org/html/2608.00246v1/figs/differencesubforgetset7.png)Figure 2:Forget\-set bird\. Original \(conf\. 0\.999\): correctly classified with sparse scattered activations\. Unlearned \(conf\. 0\.901\): misclassifies as cat; activation partially smeared, indicating loss of bird\-discriminative features\. Oracle \(conf\. 0\.777\): also misclassifies as cat, confirming the image sits near the bird/cat decision boundary\.![Refer to caption](https://arxiv.org/html/2608.00246v1/figs/differencesubtestset6.png)Figure 3:Test\-set automobile\. Original \(conf\. 0\.998\): near\-zerolayer1activation despite high confidence, indicating classification driven by deeper layers\. Unlearned \(conf\. 0\.672\): strong structured activation along car edges and body lines\. Oracle \(conf\. 0\.991\): similarly structured edge\-following activation, closely resembling the unlearned model\.![Refer to caption](https://arxiv.org/html/2608.00246v1/figs/rank39ship.png)Figure 4:Forget/retain\-similar ship pair \(cosine similarity 0\.998\)\. Top: unlearning changes the forget\-set activation from broad to sparse and localized\. Bottom: the retain\-similar image remains correctly classified with ship\-focused attention, indicating limited collateral damage\.

#### 4\.4\.3Discussion ofΔrs\\Delta\_\{\\text\{rs\}\}metric

Across conditions,Δrs\\Delta\_\{\\text\{rs\}\}is generally smaller in magnitude thanΔretain\\Delta\_\{\\text\{retain\}\}\. This can be explained by the construction ofDr,simD\_\{r,\\text\{sim\}\}, which selects retain examples closest to the forget set in embedding space\. In our setting, these examples are likely to lie in relatively dense regions with many similar training neighbours, whereas the full retain set also contains rarer, more atypical long\-tail examples\. Prior work by Feldman et al\.\[[10](https://arxiv.org/html/2608.00246#bib.bib59),[9](https://arxiv.org/html/2608.00246#bib.bib60)\]shows that memorization is especially important for such rare examples, while high\-frequency examples can often be recovered from shared, generalizable features\. Consequently, after a partial reset and fine\-tuning, examples inDr,simD\_\{r,\\text\{sim\}\}may be easier to recover than long\-tail retain examples, leading to smallerΔrs\\Delta\_\{\\text\{rs\}\}thanΔretain\\Delta\_\{\\text\{retain\}\}\. The key point is therefore not that forget\-only localization causes large absolute damage toDr,simD\_\{r,\\text\{sim\}\}, but that it causes more collateral damage than retain\-aware methods\. The purpose ofΔrs\\Delta\_\{\\text\{rs\}\}is to measure this excess damage on the retain examples most similar to the forgotten data\.

### 4\.5GradCAM\-based Visual analysis

We use Grad\-CAM\[[22](https://arxiv.org/html/2608.00246#bib.bib88)\]to compare the original, unlearned, and oracle models\. We analyze three examples in total: one each from the forget set, test set, and retain\-similar set\.

##### Forget\-set examples

The forget\-set bird in Fig\.[2](https://arxiv.org/html/2608.00246#S4.F2)is correctly classified by the original model, which shows broad, scattered activations\. Both the unlearned and oracle models predict cat, while the unlearned activation is more diffuse, suggesting disruption of bird\-specific features\. Its agreement with the oracle indicates oracle\-aligned forgetting rather than an unlearning failure\.

##### Test\-set examples\.

The test\-set automobile in Fig\.[3](https://arxiv.org/html/2608.00246#S4.F3)is correctly classified by the original model with high confidence \(0\.998\), despite weak Grad\-CAM activation at the selected layer\. After unlearning, activation becomes more structured along the vehicle’s edges and contours, closely resembling the oracle and suggesting recovery of an oracle\-like feature representation during retain\-set fine\-tuning\.

##### Retain\-similar examples\.

Fig\.[4](https://arxiv.org/html/2608.00246#S4.F4)shows a forget\-set example and its nearest retain\-set neighbour \(cosine similarity 0\.998\)\. For the forget\-set image, the original model exhibits broad activations across the hull and surrounding structure, whereas the unlearned model produces sparser, more localized activations with lower confidence, even than the oracle model\. This suggests that unlearning has altered the original representation and reduced reliance on features previously used for classification\. For the retain\-similar image, the unlearned model still attends to the ship hull and classifies it correctly, indicating that the retained representation is largely preserved\. However, its more diffuse activations indicate only partial preservation of the original feature representation\.

##### Computational time

Experiments were run on NVIDIA A100 and L40 GPUs, with runtimes reported in MM:SS\. Training the original and oracle models took 07:46 and 04:46, respectively\. The forget\-only baseline required 02:57 in total \(00:02 for criticality computation and 02:54 for fine\-tuning\), while the difference method required 02:59 \(00:02 and 02:57\), indicating negligible overhead\.

## 5Conclusion

We introduced a similarity\-aware localized unlearning framework that considers parameter importance for both forgotten and retained data\. A retain\-similar evaluation set was also proposed to measure collateral damage directly\. Experiments on CIFAR\-10 with ResNet\-18 showed that the subsampled difference method achieved the best balance between effective forgetting and retained utility\. These results demonstrate that retain\-aware localization preserves shared representations more effectively than forget\-only localization, with negligible computational overhead\. Future work should evaluate the method on larger datasets, architectures, and unlearning settings\.

## Acknowledgments

M\. Kumaran was supported by The University of Manchester and the Manchester Unit of the European Laboratory for Learning and Intelligent Systems \(ELLIS\)\. The research of V\. Kouni was supported in part by the French National Research Agency under the France 2030 program, reference ANR\-23\-PEIA\-0003\. H\. Harikumar was supported by the UKRI Turing AI World\-Leading Researcher Fellowship \(EP/W002973/1\), UKRI AI Hub in Generative Models \(EP/Y028805/1\), European Lighthouse of AI for Sustainability \(ELIAS, 10080425\), and Laboratory for AI Security Research \(LASR\)\. The views expressed in this paper are those of the authors and do not necessarily reflect the position of LASR or His Majesty’s Government\. The authors would like to acknowledge the assistance by Research IT and the use of the Computational Shared Facility at The University of Manchester\.

## References

- \[1\]L\. Bottou\(2012\)Stochastic Gradient Descent Tricks\.InNeural networks: tricks of the trade: second edition,Cited by:[1st item](https://arxiv.org/html/2608.00246#S4.I1.i1.p1.2)\.
- \[2\]L\. Bourtoule, V\. Chandrasekaran, C\. A\. Choquette\-Choo, H\. Jia, A\. Travers, B\. Zhang, D\. Lie, and N\. Papernot\(2021\)Machine Unlearning\.In2021 IEEE symposium on security and privacy \(SP\),Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p2.1),[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p1.4)\.
- \[3\]L\. Bourtoule, V\. Chandrasekaran, C\. A\. Choquette\-Choo, H\. Jia, A\. Travers, B\. Zhang, D\. Lie, and N\. Papernot\(2021\)Machine unlearning\.In2021 IEEE symposium on security and privacy \(SP\),pp\. 141–159\.Cited by:[Definition 1](https://arxiv.org/html/2608.00246#Thmdefinition1)\.
- \[4\]D\. S\. Broomhead and D\. Lowe\(1988\)Radial Basis Functions, Multi\-Variable Functional Interpolation and Adaptive Networks\.Technical reportCited by:[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p7.1)\.
- \[5\]Y\. Cao and J\. Yang\(2015\)Towards making systems forget with machine unlearning\.InIEEE Symposium on Security and Privacy,Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p2.1)\.
- \[6\]N\. Carlini, F\. Tramer, E\. Wallace, M\. Jagielski, A\. Herbert\-Voss, K\. Lee, A\. Roberts, T\. Brown, D\. Song, U\. Erlingsson,et al\.\(2021\)Extracting Training Data from Large Language Models\.In30th USENIX Security Symposium,Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p1.1)\.
- \[7\]C\. Cortes and V\. Vapnik\(1995\)Support\-vector networks\.Machine Learning\.Cited by:[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p7.1)\.
- \[8\]C\. Fan, J\. Liu, Y\. Zhang, E\. Wong, D\. Wei, and S\. Liu\(2024\)SalUN: Empowering Machine Unlearning via Gradient\-based Weight Saliency in Both Image Classification and Generation\.InInternational Conference on Learning Representations,Cited by:[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p7.1)\.
- \[9\]V\. Feldman and C\. Zhang\(2020\)What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimation\.Advances in Neural Information Processing Systems\.Cited by:[§4\.4\.3](https://arxiv.org/html/2608.00246#S4.SS4.SSS3.p1.8)\.
- \[10\]V\. Feldman\(2020\)Does learning require memorization? a short tale about a long tail\.InProceedings of the 52nd annual ACM SIGACT symposium on theory of computing,Cited by:[§4\.4\.2](https://arxiv.org/html/2608.00246#S4.SS4.SSS2.Px1.p2.2),[§4\.4\.3](https://arxiv.org/html/2608.00246#S4.SS4.SSS3.p1.8)\.
- \[11\]M\. Fredrikson, S\. Jha, and T\. Ristenpart\(2015\)Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures\.InProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security,Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p1.1)\.
- \[12\]A\. Golatkar, A\. Achille, and S\. Soatto\(2020\)Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,Cited by:[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p1.4),[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p6.3),[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p6.4)\.
- \[13\]K\. He, X\. Zhang, S\. Ren, and J\. Sun\(2015\)Delving Deep into Rectifiers: Surpassing Human\-level Performance on ImageNet Classification\.InProceedings of the IEEE International Conference on Computer Vision,Cited by:[§3\.4](https://arxiv.org/html/2608.00246#S3.SS4.p1.5)\.
- \[14\]K\. He, X\. Zhang, S\. Ren, and J\. Sun\(2016\)Deep Residual Learning for Image Recognition\.InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition,Cited by:[§4\.2](https://arxiv.org/html/2608.00246#S4.SS2.p1.3),[Appendix](https://arxiv.org/html/2608.00246#Sx2.p1.1)\.
- \[15\]A\. Krizhevsky, G\. Hinton,et al\.\(2009\)Learning Multiple Layers of Features from Tiny Images\.Cited by:[1st item](https://arxiv.org/html/2608.00246#S4.I1.i1.p1.2),[§4\.1](https://arxiv.org/html/2608.00246#S4.SS1.p1.3),[Appendix](https://arxiv.org/html/2608.00246#Sx2.p2.4)\.
- \[16\]I\. Loshchilov and F\. Hutter\(2017\)SGDR: stochastic gradient descent with warm restarts\.InInternational Conference on Learning Representations,Cited by:[1st item](https://arxiv.org/html/2608.00246#S4.I1.i1.p1.2)\.
- \[17\]Q\. P\. Nguyen, B\. K\. H\. Low, and P\. Jaillet\(2020\)Variational Bayesian Unlearning\.Advances in Neural Information Processing Systems\.Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p2.1)\.
- \[18\]T\. T\. Nguyen, T\. T\. Huynh, Z\. Ren, P\. L\. Nguyen, A\. W\. Liew, H\. Yin, and Q\. V\. H\. Nguyen\(2025\)A survey of machine unlearning\.ACM Transactions on Intelligent Systems and Technology\.Cited by:[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p6.4)\.
- \[19\]S\. L\. Pardau\(2018\)The California Consumer Privacy Act: Towards a European\-Style Privacy Regime in the United States\.Journal of Technology Law & Policy\.Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p1.1)\.
- \[20\]C\. D\. Raab\(1998\)The Distribution of Privacy Risks: Who Needs Protection?\.The information society\.Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p1.1)\.
- \[21\]P\. M\. Schwartz\(2004\)Property, Privacy, and Personal Data\.Harvard law review\.Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p1.1)\.
- \[22\]R\. R\. Selvaraju, M\. Cogswell, A\. Das, R\. Vedantam, D\. Parikh, and D\. Batra\(2017\)Grad\-CAM: Visual Explanations from Deep Networks via Gradient\-based Localization\.InProceedings of the IEEE International Conference on Computer Vision,Cited by:[§4\.5](https://arxiv.org/html/2608.00246#S4.SS5.p1.1)\.
- \[23\]R\. Shokri, M\. Stronati, C\. Song, and V\. Shmatikov\(2017\)Membership Inference Attacks Against Machine Learning Models\.In2017 IEEE symposium on security and privacy \(SP\),Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p1.1),[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p1.4)\.
- \[24\]R\. Torkzadehmahani, R\. Nasirigerdeh, G\. Kaissis, D\. Rueckert, G\. K\. Dziugaite, and E\. Triantafillou\(2024\)Improved Localized Machine Unlearning Through the Lens of Memorization\.External Links:2412\.02432,[Link](https://arxiv.org/abs/2412.02432)Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p2.1),[§2](https://arxiv.org/html/2608.00246#S2.p3.10),[§3\.3](https://arxiv.org/html/2608.00246#S3.SS3.p1.3),[§3\.4](https://arxiv.org/html/2608.00246#S3.SS4.p1.5),[§3](https://arxiv.org/html/2608.00246#S3.p1.2),[1st item](https://arxiv.org/html/2608.00246#S4.I1.i1.p1.2),[§4\.3](https://arxiv.org/html/2608.00246#S4.SS3.p4.2),[§4\.4](https://arxiv.org/html/2608.00246#S4.SS4.p1.1),[Definition 2](https://arxiv.org/html/2608.00246#Thmdefinition2)\.
- \[25\]P\. Voigt and A\. Von dem Bussche\(2017\)The EU general data protection regulation \(GDPR\): a practical guide\.Springer,Cham\.Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p1.1)\.
- \[26\]J\. Wei, Y\. Zhang, L\. Y\. Zhang, M\. Ding, C\. Chen, K\. Ong, J\. Zhang, and Y\. Xiang\(2025\)Memorization in Deep Learning: A Survey\.ACM Computing Surveys\.Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p1.1),[Definition 3](https://arxiv.org/html/2608.00246#Thmdefinition3)\.
- \[27\]J\. Xu, Z\. Wu, C\. Wang, and X\. Jia\(2024\)Machine Unlearning: Solutions and Challenges\.IEEE Transactions on Emerging Topics in Computational Intelligence\.Cited by:[§1](https://arxiv.org/html/2608.00246#S1.p2.1)\.

## Appendix

![Refer to caption](https://arxiv.org/html/2608.00246v1/figs/original_training_curves.png)Figure 5:Training and validation loss \(left\) and accuracy \(right\) for the original modelℳ​\(D\)\\mathcal\{M\}\(D\)over 50 epochs\. Training loss decreases monotonically to near\-zero while validation loss stabilises around 0\.33, reflecting the growing train\-validation gap characteristic of overfitting to training examples including𝒟f\\mathcal\{D\}\_\{f\}\. Validation accuracy plateaus around 90% from epoch 35 onward with minor fluctuations\. The dashed line marks the best checkpoint \(model\) at epoch 46\.Fig\.[5](https://arxiv.org/html/2608.00246#Sx2.F5)shows the training and validation curves for the original model\. The original modelℳ​\(D\)\\mathcal\{M\}\(D\)was trained for 50 epochs in the entire 40 , 000 sample training subset and achieved a test set accuracy of 89\.87%, consistent with expected performance for a well\-tuned ResNet\-18 in CIFAR\-10\[[14](https://arxiv.org/html/2608.00246#bib.bib24)\]\. The training trajectory followed the expected pattern: rapid initial learning in the first ten epochs, a slower refinement phase as the cosine learning rate schedule decayed, and training accuracy saturating near 100% by epoch 39 while validation accuracy continued to improve gradually\. The best model was saved at epoch 46\. The original model achieves 100% accuracy on both the retain and forget sets, as expected for a fully converged model evaluated on its own training data\.

Table 2:Per\-class test set accuracy for the original model, the subsampleddifferenceunlearned model, and the oracle model\.Δorg,unlearn\\Delta\_\{\\text\{org,unlearn\}\}\(pp\) denotes the difference in percentage points between the original and unlearned model\.Δoracle,unlearn\\Delta\_\{\\text\{oracle,unlearn\}\}\(pp\) denotes the difference in percentage points between the oracle and unlearned model\. The difference is largest for cat and bird between the unlearned model and original model; the unlearned model closely tracks the oracle, suggesting effective unlearning\.Table[2](https://arxiv.org/html/2608.00246#Sx2.T2)shows the per\-class test accuracy for the original model, oracle model, and our unlearned model \(based on subsampleddifference\)\. The largest drops are in cat \(9\.49\.4pp\) and bird \(7\.77\.7pp\) — the two most visually similar and hardest CIFAR\-10 classes\[[15](https://arxiv.org/html/2608.00246#bib.bib57)\]— suggesting the unlearning intervention disproportionately disrupts discriminative features near class boundaries\. Visually distinctive classes such as automobile \(2\.12\.1pp\) and ship \(1\.51\.5pp\) suffer the smallest drops, consistent with their features being more separable and therefore less affected by the channel reset\.

Table 3:Wall\-clock time \(MM:SS, minutes and seconds, rounded to the nearest second\) taken per pipeline stage for all eleven experimental conditions\. Sub denotes whether a subsampled retain set was used for criticality computation\. Original is the from\-scratch training of the base model; Oracle is the retain\-only retraining used as the gold\-standard reference; Crit is the criticality\-scoring step alone; and Finetune is the subsequent finetuning stage\. Original and Oracle have no unlearning pipeline, so only total training time is shown\.Table[3](https://arxiv.org/html/2608.00246#Sx2.T3)reports wall\-clock times for all experimental conditions\. The criticality\-scoring step is negligible in all cases, taking at most six seconds even without subsampling, meaning the total pipeline cost is dominated almost entirely by finetuning\. All unlearning methods complete in under three minutes and five seconds, compared to seven minutes and forty\-six seconds for original training and four minutes and forty\-six seconds for oracle retraining\. Subsampling reduces criticality computation time from roughly five–six seconds to two seconds across all variants, with no meaningful effect on finetuning time, making it a cost\-free efficiency gain\.

Table 4:Effect of finetuning retain set size on unlearning quality\. Sub denotes subsampled retain set used for criticality computation, Finetuning size denotes the size of the retain set used for finetuningTable[4](https://arxiv.org/html/2608.00246#Sx2.T4)examines how the size of the retain set used during finetuning affects unlearning quality, comparing theforget\_onlybaseline against the subsampleddifferencemethod\. Both methods exhibit a consistent trend: smaller finetuning sets yield larger deviations from the oracle across all metrics, with deltas decreasing monotonically as retain set size grows toward 35,000\. At 35,000 samples, thedifferencemethod achieves the smallest overall deltas, withΔtest=0\.64\\Delta\_\{\\text\{test\}\}=0\.64,Δforget=0\.56\\Delta\_\{\\text\{forget\}\}=0\.56, andΔrs=0\.04\\Delta\_\{\\text\{rs\}\}=0\.04, closely tracking the oracle on all retain\-side metrics\. These results indicate that finetuning set size is a key determinant of unlearning quality, and that the full retain set of 35,000 samples is necessary to achieve oracle\-level performance\.

Table 5:Channels selected per layer under the subsampleddifferencemethod withα=30%\\alpha=30\\%parameter budget\. Selection is highest in layer3 \(up to 89\.5%\) where forget\-set criticality is concentrated, and unevenly distributed in layer4:layer4\.0\.downsample\.0has 72\.5% of channels selected whilelayer4\.1\.conv2has none, reflecting the differential criterion zeroing out channels whose retain\-set importance meets or exceeds their forget\-set importance\. The fully connected layer is selected in its entirety, indicating that all output logit weights are implicated in the forget\-set predictions\.Table[5](https://arxiv.org/html/2608.00246#Sx2.T5)shows the channel selection produced by our subsampleddifferencemethod, which is used as the representative condition\. The selection is markedly non\-uniform across layers: layer3 has the majority of its channels selected \(up to 229/256 inlayer3\.0\.downsample\.0\), reflecting the criticality scoring concentrating forget\-set importance in the deeper, more class\-specific residual stages\. By contrast,layer4\.1\.conv2contributes zero selected channels despite its depth — a consequence of the differential criterion: its parameters are sufficiently important to the retain set that the difference score is zeroed out entirely\. Earlier layers show moderate, more evenly distributed selection, consistent with their role in encoding lower\-level features shared across both forget and retain examples\.

1∗1^\{\*\}3571122w=1w\{=\}1\(diff\)WeightwwΔ\\Delta\(pp\)Δtest\\Delta\_\{\\text\{test\}\}\(lower is better\)1∗1^\{\*\}357112233w=1w\{=\}1\(diff\)WeightwwΔ\\Delta\(pp\)Δforget\\Delta\_\{\\text\{forget\}\}\(lower is better\)1∗1^\{\*\}35700\.20\.20\.40\.4w=1w\{=\}1\(diff\)WeightwwΔ\\Delta\(pp\)Δrs\\Delta\_\{\\text\{rs\}\}\(lower is better\)1∗1^\{\*\}357445566w=1w\{=\}1\(diff\)WeightwwΔ\\Delta\(pp\)ΔMIA\\Delta\_\{\\text\{MIA\}\}\(lower is better\)

Figure 6:Metric deltas as a function of weightwwfor subsampled and non\-subsampled conditions\. Thedifferencemethod is treated asw=1w=1\(marked1∗1^\{\*\}on thexx\-axis\)\. The black dotted horizontal line marks theforget\_onlybaseline score on each metric as a reference\. Each metric is reported asΔ=oracle−unlearned\\Delta=\\text\{oracle\}\-\\text\{unlearned\}; lower values indicate closer oracle\-matching\. The dotted vertical segment atw=1w=1highlights the gap between the two subsampling conditions at the unweighted case\.Fig\.[6](https://arxiv.org/html/2608.00246#Sx2.F6)visualises how each metric varies withwwacross both subsampled and non\-subsampled conditions, treating the unweighteddifferencemethod asw=1w=1\. The figure reveals several consistent patterns\. On the retain\-similar metric, the subsampleddifferencemethod atw=1w=1achieves the lowest delta of all conditions, and performance degrades aswwincreases toward the baseline, confirming that stronger forget\-set weighting erodes retain\-set protection\. The non\-subsampled variant consistently underperforms its subsampled counterpart onΔrs\\Delta\_\{\\text\{rs\}\}\. The test accuracy panel shows a similar ordering atw=1w=1, with the subsampleddifferencemethod achieving the best scores before degrading aswwincreases\.