Conceptio › Archive › arXiv CS

arXiv CSopen access

SoK: Unlearnability and Unlearning for Model Dememorization

2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

cryptography cybersecurity privacy security

cryptography, security, privacy, cybersecurity

SoK: Unlearnability and Unlearning for Model Dememorization Mengying Zhang∗

Derui Wang∗

Ruoxi Sun

RMIT University Australia

CSIRO Australia

Xiaoyu Xia

Shuang Hao

Minhui Xue

RMIT University Australia

University of Texas at Dallas USA

CSIRO and Adelaide University Australia

arXiv:2605.11592v1 [cs.LG] 12 May 2026

Abstract Advanced model dememorization methods, including availability poisoning (unlearnability) and machine unlearning, are emerging as key safeguards against data misuse in machine learning (ML). At the training stage, unlearnability embeds imperceptible perturbations into data before release to reduce learnability. At the posttraining stage, unlearning removes previously acquired information from models to prevent unauthorized disclosure or use. While both defenses aim to preserve the right to withhold knowledge, their vulnerabilities and shared foundations remain unclear. Specifically, both unlearnability and unlearning suffer from issues such as shallow dememorization, leading to falsely claimed data learnability reduction or forgetting in the presence of weight perturbations. Moreover, input perturbations may affect the effectiveness of downstream unlearning, while unlearning may inadvertently recover domain knowledge hidden by unlearnability. This interplay calls for deeper investigation. Finally, there is a lack of formal guarantees to provide theoretical insights into current defenses against shallow dememorization. In this Systematization of Knowledge, we present the first integrated analysis of model dememorization approaches leveraging unlearnability and unlearning. Our contributions are threefold: (i) a unified taxonomy of unlearnability and scalable unlearning methods; (ii) an empirical evaluation revealing the robustness, interplay, and shallow dememorization of leading methods; and (iii) the first theoretical guarantee on dememorization depth for models processed through certified unlearning. These results lay the foundation for unifying dememorization mechanisms across the ML lifecycle to achieve a deeper immemor state for sensitive knowledge.

Introduction

Publicly available data fuels the rapid progress of machine learning (ML) models. From early breakthroughs in deep neural networks (DNNs) to recent advances in large language models (LLMs) and large vision models (LVMs), abundant training data has been a key driver of success [6, 45, 65, 81]. Yet a pressing need is emerging to safeguard sensitive knowledge from being learned illicitly and to erase mislearned knowledge from trained models. Regulations across jurisdictions increasingly recognize this. The EU’s GDPR [1] and AI Act [4] enforce data minimization and a “right to be forgotten”, while the United States’ CCPA [2]/CPRA [3] grant deletion and opt-out rights, supplemented by the NIST AI Risk Management Framework. These regimes highlight a common principle that knowledge associated with training data must be protected at release and deletable post hoc. To address this principle, censorship ∗ Both authors contributed equally to this research.

can be applied both in the input and the output of an ML model as a control mechanism. However, traditional censorship methods, such as content blocking, fall short when confronted with the complexity of high-dimensional data and large non-convex models [5, 56]. This fact directly motivates the need for advanced dememorization mechanisms such as data availability poison (referred to as unlearnability in this paper) and machine unlearning. In this Systematization of Knowledge (SoK), we examine how these advanced dememorization methods can jointly safeguard data-associated knowledge. Unlearnability. Motivated by the challenges posed by the learnability of public data, a line of work has emerged to render data unlearnable for ML models. Early efforts incorporated adversarial examples to disrupt learning [51, 198], while subsequent approaches introduced training-error-minimizing noise to conceal knowledge within datasets [74, 114, 171]. Concurrently, shortcut learning has been exploited for constructing unlearnable datasets [182, 195]. Throughout this paper, we refer to these methods collectively as unlearnability methods. The central idea is to drive models toward states that generalize poorly on clean data. However, these approaches are often fragile under commonly used learning algorithms and data augmentation techniques, and lack strong theoretical guarantees for quantifying data learnability. A recent line of work proposes certifiable frameworks for learnability [171], deriving quantile upper bounds (i.e., certified learnability) on achievable clean-domain utility for models trained on perturbed data within a specified hypothesis subspace. Nonetheless, key challenges remain. First, the certification may be loose, with certified learnability significantly underestimating achievable utility. Second, beyond identifying certifiable model sets, it remains unclear how to guide training dynamics to converge to these sets without explicit control over the training process. Unlearning. Machine unlearning can be performed either exactly or approximately. Exact unlearning typically requires retraining models from scratch [17], making it computationally expensive and often impractical in real-world settings. In contrast, approximate unlearning aims to remove learned information more efficiently through techniques such as fine-tuning [59, 178], pruning [79], or direct weight modification [29, 79]. Some approximate methods further provide certification guarantees, ensuring that the unlearned model is statistically indistinguishable from one never trained on the deleted data, typically via Newton updates combined with noisy fine-tuning [32, 64, 89, 202]. Nevertheless, unlearning remains vulnerable, as seemingly forgotten content can be recovered or unintentionally reproduced [72, 155, 193].

Challenges and motivations. The primary motivation of this study is to verify the immemor of a model with respect to restricted knowledge, rather than achieving a shallow form of dememorization that can be easily circumvented. Since knowledge memorization is encoded in the learned parameters, it is natural to link the refutation of memorization to analysis in parameter space. However, several non-negligible challenges must be addressed before a reliable verification framework for models “not learning” or “forgetting” becomes tangible. First, both unlearnability and unlearning suffer from robustness issues under adaptive attacks and even benign uncertainties. In particular, there are no formal guarantees that models do not implicitly retain knowledge from unlearnability-protected data, nor that the dememorization achieved through unlearning is genuine. Second, the interplay between unlearnability and unlearning, crucial to the effectiveness and robustness of dememorization, remains underexplored. As an upstream intervention in the ML lifecycle, unlearnability can influence downstream unlearning, as models trained on unlearnable data may exhibit distinct properties. This concern is reinforced by recent findings on the difficulty of unlearning poisoned samples or residual knowledge in large models [70, 131, 193], highlighting the need to understand how different unlearning methods respond to unlearnability approaches and their degree of compatibility. Third, both unlearnability and unlearning may yield only shallow dememorization, where success is measured by metrics tied to the current model state, without accounting for the potential recovery of memorized knowledge in nearby parameter regions. Such shallow dememorization contradicts the goal of achieving deep immemor state (i.e., a truly unremembering state) and therefore warrants further theoretical and empirical investigation. Guided by these challenges, we identify three central research questions (RQs):

• We systematically review 187 works on model dememorization based on unlearnability and unlearning, providing a comprehensive overview of the research landscape (RQ1). • Through large-scale experiments in vision and text domains, we show that both unlearnability and unlearning methods are prone to shallow dememorization (RQ2). • We establish non-vacuous formal guarantees on dememorization depth under certified unlearning, providing a principled foundation for achieving a deeper immemor state (RQ3). An overview of the model dememorization framework is presented in Figure 1.

2 Preliminaries 2.1 Concepts and Notations We begin by reviewing the key concepts and notations underlying both unlearnability and unlearning. 2.1.1 unlearnability. Given a protectee dataset D ∼ D sampled from a domain D, the defender computes a set of perturbations |D| |D| 𝛿 := {𝛿𝑖 }𝑖=1 and construct an unlearnable dataset D𝑢 := {D𝑖 ⊕𝛿𝑖 }𝑖=1 . Here, ⊕ denotes a perturbation operator. As most unlearnability methods employ additive perturbations, ⊕ typically corresponds to addition. Perturbative unlearnability methods aim to render D𝑢 unlearnable to unauthorized models and learning algorithms in the wild. Formally, let M (·) denote a utility metric and D𝑡 ∼ D a test dataset drawn from the same domain. A stochastic learning algorithm Γ(·) trains a 𝜃 -parameterized model 𝑓𝜃 on D𝑢 , yielding parameters 𝜃 ∈ Θ, where Θ denotes the parameter space. With high probability 1 − 𝛼, Pr[M (𝑓𝜃 ; D𝑡 ) ≤ 𝜏] ≥ 1 − 𝛼 s.t. 𝜃 = Γ(D𝑢 ),

(1)

where 𝜏 is a small scalar upper bounding the utility. The defender aims to minimize 𝛼 and 𝜏 across all Γ(·), thereby enforcing strong unlearnability of D𝑢 . These methods share similarities with clean-label poisoning attacks [147]. However, while clean-label poisoning targets instancelevel manipulation, unlearnability methods focuses on protecting datasets against unauthorized learners.

RQ1: What is the current research landscape of unlearnability and unlearning methods? RQ2: What synergistic effects arise between unlearnability and unlearning approaches toward dememorization? RQ3: How can we provide robustness guarantees against shallow unlearnability and shallow unlearning?

2.1.2 Unlearning. Unlearning can be formally defined in terms of (𝜖, 𝜁 )-unlearning. In this formulation, the desideratum is captured through the indistinguishability of model parameters.

We address these questions as follows. First, we present a systematic review of unlearnability and unlearning methods to organize the research landscape. We unify both paradigms within a model dememorization taxonomy and reveal their interconnections through empirical analysis and theoretical insights. We then assess whether an ML model is immemor with respect to censored knowledge using memory recovery mechanisms. Next, we derive formal guarantees against shallow dememorization by bounding model recoverability under weight perturbations. Finally, we show that these bounds extend to models statistically indistinguishable from the immemor model, enabling efficient application to models obtained via certified unlearning. Together, these findings provide a holistic perspective on unlearnability and unlearning, and offer guidance for future research. Contributions. The core contributions of this SoK paper are as follows:

Definition 1 (Indistinguishability between models). Given a model 𝑓𝜃 parameterized by 𝜃 , where 𝜃 is learned from a dataset D via a stochastic learning algorithm 𝜃 = Γ(D), an unlearning algorithm U aims to remove the information associated with a forgetting dataset D 𝑓 from 𝜃 , as if D 𝑓 had never been used in training. Let 𝑓𝜃ˆ denote the model trained on the retain set, where 𝜃ˆ = Γ(D \ D 𝑓 ). The models 𝑓𝜃 and 𝑓𝜃ˆ are said to be (𝜖, 𝜁 )–indistinguishable if, for any subset 𝑆 in the parameter space: ( Pr[U (Γ(D), D, D 𝑓 ) ∈ 𝑆] ≤ 𝑒 𝜖 Pr[Γ(D \ D 𝑓 ) ∈ 𝑆] + 𝜁 , Pr[Γ(D \ D 𝑓 ) ∈ 𝑆] ≤ 𝑒 𝜖 Pr[U (Γ(D), D, D 𝑓 ) ∈ 𝑆] + 𝜁 . When 𝜖 = 0 and 𝜁 = 0, (𝜖, 𝜁 )-unlearning reduces to exact unlearning, as Pr[U (Γ(D), D, D 𝑓 ) ∈ 𝑆] = Pr[Γ(D \ D 𝑓 ) ∈ 𝑆]. 2

Data Collection and Processing

Pre-training / Training

Inference

Post-training

Request to Delete Unauthorized Model

Unauthorized Model

Authorized Model

Low Performance

Authority / User

Learnability Locked

Surrogate

/ Learning Shortcut

High Performance

Unlocking

Forget Authorized Model

Compliance-aware Model Model Development Lifecycle

Memorization Prevention via Unlearnability

Dememorization via Unlearning

Unauthorized training on public data

Vulnerable to input processing techniques

Interaction with unlearnability methods

Shallow dememorization broken by weight perturbations

Data Misuse/Privacy Threats (e.g., membership inference attack, transferable adversarial attack, mimicry attack, ...)

Shallow dememorization broken by relearning

Clean Before

IF GA

FT RT

50 25 0

20 Epoch

Recovery ( =performance 0.8) Attack ( = 1.2) or onlyAttack current often resultsRecovery in shallow unlearnability

100

100 shallow unlearning. To illustrate this, we take models trained on unlearnability data, 75 apply standard unlearning methods to remove target knowledge, Clean IF FT 50 Before GA recovery RT and then perform attacks. Results (Figure 2) reveal several insights. First, models trained exhibit low 25 on UE-s (“Before”) Clean IF FT accuracy on clean data, indicating that unlearnability protection Before GA isRT 0 10 effective. 20 Second, 30 the performance 40 0 gap before 10 and20after unlearning 30 40 confirms leaked from unEpochthat unlearning can remove information Epoch learnability-protected data. However, under recovery attacks, all methods except fine-tuning deviate significantly from the retraining baseline, suggesting that many unlearning approaches remain shallow and vulnerable to recovery. These observations highlight that unlearning should be evaluated not only at a single post-unlearning state, but also across nearby parameter states. Since both unlearnability and unlearning share this underlying principle, we advocate for a unified analysis of these paradigms in parameter space. Clean Train Accuracy (%)

Recovery Attack ( = 0.4)

100

Clean Train Accuracy (%)

Figure 1: An overview of the model dememorization framework within the ML model development lifecycle. unlearnability and unlearning safeguard the upstream and downstream stages, respectively, yet each faces distinct robustness challenges, and their interaction remains insufficiently understood.

75 50 25 0

Figure 2: Shallow unlearnability and shallow unlearning revealed by recovery attacks under an ℓ2 parametric perturbation magnitude (𝜂) of 0.4. “Clean”: model trained on clean CIFAR-10. “Before”: pre-unlearning mode trained with class 0 replaced by UE-s [74]. “IF”, “GA”, “FT”, and “RT” represent the unlearned models obtained by applying influence function unlearning [77, 88], gradient ascent [62, 166], finetuning [59], and retraining methods, respectively, to unlearn the UE-s of Class 0. We measure the accuracy on the corresponding clean CIFAR-10 samples of Class 0 during recovery to assess knowledge recovery under hints.

2.3

Defender. In the unlearnability setting, the defender is responsible for applying unlearnability perturbations to the data prior to release. The defender’s objective is to minimize the utility upper bound 𝜏 over the protected dataset D𝑢 . In practice, 𝜏 can typically only be evaluated empirically over finite models and learning algorithms, as the functional spaces of Θ and 𝑓𝜃 are unknown. Nevertheless, the defender may seek to certify the learnability of unlearnabilityprotected data by deriving bounds on 𝜏 that hold with probability 1 − 𝛼. Downstream, since unlearnability may not fully suppress all domain knowledge associated with D, the defender may require, upon detecting misuse, that unauthorized learners remove any information of D leaked through D𝑢 . Adversary. The adversary aims to exploit the released data by modeling its distribution through training machine learning models. Specifically, the adversary collects D𝑢 , or a subset thereof, to train a model 𝑓𝜃 without authorization. The adversary has full control over the model architecture, initialization, and training procedure, and may employ standard techniques such as data augmentation. However, the presence of unlearnability perturbations may degrade performance. To mitigate this, the adversary may apply unlearning techniques to remove the influence of unlearnability-protected data

In practice, unlearning can be achieved either by retraining the model on D \ D 𝑓 or by approximating this effect through updates to 𝜃 . For non-convex models such as DNNs, certified unlearning can be obtained via noisy fine-tuning on the retain set D𝑟 := D \ D 𝑓 , which provides differential privacy (DP) guarantees for forgetting D𝑓 .

2.2

Threat Model for Dememorization Framework

Toward Deeper Immemor

Both unlearnability and unlearning are developed toward the resection of knowledge from the memory of ML models. Despite significant progress in each line of work, it remains unclear how interventions at different stages can be unified within a common analytical framework, and how to rigorously verify that undesired knowledge is not retained. Current evaluation practices predominantly assess performance on data drawn from the corresponding domain, showing degraded task accuracy as evidence of successful forgetting. However, the quality of forgetting should not be judged solely by the performance of the model in its current state, but also by its ability to relearn with minimal guidance during a recovery process. In practice, evaluating 3

function L (·), while a surrogate model 𝑓𝜃 minimizes this error by updating 𝜃 on the perturbed data. This yields the following bi-level optimization problem:

and recover performance. This makes it critical to design unlearnability methods that are unlearning-aware.

3 Taxonomy and Literature Collation 3.1 Unifying Taxonomy of unlearnability and Unlearning

𝛿 ∗ = max min 𝛿

Literature Collation

Memorization Prevention via unlearnability

Error-based unlearnability

The first prevailing category of unlearnability methods perturbs data samples based on training error (e.g., cross-entropy), which measures the discrepancy between the data distribution and the learned distribution. By maximizing or minimizing this error on a surrogate model, the defender can induce mislearning or suppress effective learning, thereby concealing information in the data. 4.1.1

(2)

Key literature. E-Max perturbations constitute the earliest line of work in unlearnability. TensorClog (TC) maximizes training loss by inducing gradient vanishing, thereby impeding effective training [152]. MetaPoison improves transferability across models and training settings by crafting perturbations with an ensemble of surrogate models [75]. Neural Tangent Generalization Attack (NTGA) applies E-Max perturbations to training data to degrade model generalization [198]. E-Max noise has also shown strong effectiveness in Targeted Adversarial Poisoning (TAP) [51]. Using a surrogate trained on public out-of-distribution (POOD) data, Narcissus generates E-Max perturbations as clean-label poisons against image classifiers [201]. AAP extends E-Max noise to make data unlearnable for contrastive learning [177], while GUE formulates unlearnable data generation as a game between a generator and a classifier, where the generator is optimized to maximize classification error [111]. Beyond classification, E-Max perturbations have been adopted to protect images against unauthorized text-to-image (T2I) personalization and mimicry. InMark uses influence functions to identify salient pixels and applies gradient ascent to make images unlearnable for T2I models [107]. MetaCloak maximizes denoising error in diffusion models to protect images from mimicry attacks [113]. Anti-DreamBooth maximizes the conditional diffusion loss so that protected images cannot be used for malicious T2I personalization [169]. Finally, Enhanced Unlearnable Diffusion Perturbation (EUDP) accounts for the varying importance of diffusion timesteps and adaptively optimizes E-Max noise on the most influential steps [213].

In this section, we delve into the detailed methods for generating unlearnability perturbations. For ease of comparison, we summarize the key properties of different unlearnability methods in Table 1.

4.1

L (𝜃 ; 𝑥𝑖 + 𝛿𝑖 , 𝑦𝑖 ),

(𝑥𝑖 ,𝑦𝑖 ) ∈D

where 𝐵 denotes the perturbation budget for preserving data utility. Some methods instead minimize an adversarial loss between 𝑓𝜃 (𝑥𝑖 + 𝛿𝑖 ) and an adversarial target [75, 201]. We also categorize them as E-Max, since minimizing such a loss effectively maximizes the classification error. E-Max noise is typically more effective when generated samplewise. Since Equation 2 relies on a surrogate model for gradient computation, its transferability to unseen models is crucial in practice. To date, E-Max noise has mainly been applied to protecting image data in classification [51, 111, 198] and image generation tasks [107, 113, 169].

To ensure this SoK covers representative literature, we conducted a comprehensive survey of peer-reviewed articles from leading AI, machine learning, and security venues. Papers were collected from major databases, including DBLP and Google Scholar, as well as official websites of leading venues such as ICML, ICLR, NeurIPS, CVPR, ICCV, IEEE S&P, USENIX Security, NDSS, ACM CCS, and other relevant conferences. We combined keyword-based searches using terms such as “unlearnable,” “shortcut,” “unlearning,” “forget,” “data deletion,” and “data removal” with GPT-5.4-assisted abstract analysis to identify relevant work. Starting from this core set, we performed manual title and abstract screening, together with citation chaining, to identify additional relevant papers that did not explicitly contain these keywords. We included only articles with publicly available full texts at the time of writing to ensure accurate assessment. From this pool, we manually reviewed and selected 187 highly relevant works, forming a comprehensive body of literature on scalable unlearnability and unlearning that reflects the state of the art. We further provide systematic reviews of unlearnability and unlearning methods in Section 4 and Section 5, respectively.

∑︁

s.t. ∥𝛿𝑖 ∥ 𝑝 ≤ 𝐵, ∀𝑖 ∈ {1, 2, ..., |D| },

Our taxonomy encompasses both unlearnability and unlearning methods, as illustrated in Figure 3. For unlearnability, we categorize existing approaches into three groups: error-based unlearnability, distribution-based unlearnability, and representation-based unlearnability. For unlearning, we classify prior work into exact and approximate methods. Exact unlearning is typically achieved via retraining, while approximate unlearning is further divided into non-certifiable, convex-certifiable, and non-convex-certifiable methods, based on the strength of their guarantees.

3.2

𝜃

4.1.2

Error-Minimizing Perturbations.

Mechanism. Compared with E-Max noise, error-minimizing (EMin) perturbations often provide stronger protection in class-wise settings, where all samples from the same class share a universal perturbation. Given perturbations 𝛿, E-Min noise is obtained by:

Error-Maximizing Perturbations.

Mechanism. Error-maximizing (E-Max) noise shares a similar objective with inference-time adversarial examples. Given the dataset |D| D, E-Max learns perturbations 𝛿 = {𝛿𝑖 }𝑖=1 that maximize an error

𝛿 ∗ = min min

∑︁

𝛿

(𝑥𝑖 ,𝑦𝑖 ) ∈D

𝜃

L (𝜃 ; 𝑥𝑖 + 𝛿𝑖 , 𝑦𝑖 ),

s.t. ∥𝛿𝑖 ∥ 𝑝 ≤ 𝐵, ∀𝑖 ∈ {1, 2, ..., |D| }. 4

(3)

Stage

Category

Mechanism E-Max [51, 75, 107, 111, 113, 152, 169, 177, 198, 201, 213]

Error

Unlearnability Upstream Prevention

E-Min [26, 49, 52, 68, 74, 114, 116, 136, 164, 171, 180, 204, 209] [61, 101, 103, 104, 108, 112, 119, 121, 133, 160, 161, 177, 181, 183, 190, 207, 208] Shortcut [57, 110, 140, 142, 148, 173, 182, 195]

Distribution

Feature Dissimilarization [22, 123, 180] Representation Feature Collision [149–151, 180, 219, 222]

Model Dememorization Exact Unlearning

Retraining [9, 17, 34, 42, 135, 167, 184, 185, 196] Non-certifiable [8, 12, 21, 30, 38, 59, 62, 76, 86, 91, 97, 98, 100, 105, 115, 118, 130, 146, 153, 163, 165, 166, 188, 194, 205, 212, 220, 223] [16, 23, 24, 27, 35–37, 39, 44, 47, 50, 53, 55, 70, 71, 83–85, 87, 92–95, 99, 137, 154, 156, 159, 162, 172, 176, 186, 197, 199, 214, 216, 218] [13, 15, 19, 25, 28, 29, 31, 40, 46, 48, 60, 63, 78–80, 96, 102, 106, 126, 132, 138, 143, 144, 158, 170, 174, 189, 200, 203, 206, 211, 215, 221]

Unlearning Downstream Intervention

Approximate Unlearning

Convex-certifiable [7, 10, 11, 14, 32, 64, 66, 109, 125, 127, 129, 145, 168, 178] Non-convex-certifiable [33, 58, 89, 122, 124, 134, 179, 187, 192, 202, 210]

Figure 3: The taxonomy of model dememorization. For samples 𝑥𝑖 from the same class, the corresponding 𝛿𝑖 can be shared, yielding class-wise unlearnability noise. Similar to E-Max, E-Min methods optimize perturbations through gradient-based procedures. However, they have been applied more broadly across data modalities, including images [52, 74], text [101, 217], and audio [121, 207], as well as across tasks such as classification [74, 180], question answering [101], speech synthesis [207, 208], and music synthesis [121].

Attack (SAPA) adopts a sharpness-aware loss to improve stability under training uncertainty [68]. Provably Unlearnable Examples (PUEs) instead strengthen robustness from a certification perspective by reducing the certified learnability of data [171]. Other methods address efficiency, reversibility, or broader deployment settings. LearnabilityLock uses an adversarial invertible transformation to generate reversible E-Min perturbations [133]. Ungeneralizable Examples (UGEs) leverage CLIP encoders to introduce feature-level contradictions, inducing misleading correlations that hinder generalization [190]. Sparsity-Aware Local Masking (SALM) improves efficiency with sparse E-Min noise [160], while Perturbation-Induced Linearization (PIL) accelerates perturbation generation using a linear surrogate classifier [108]. BAIT further targets pretrained classifiers by rendering images unlearnable under prior knowledge [104]. Beyond images, E-Min perturbations have been extended to speech audio (POP [208], SafeSpeech [207]), music (HarmonyCloak [121]), text (UT [101]), video (TempUE [181]), and multimodal data (MEM [112], T2UE [119]). They have also been applied beyond classification, including segmentation (Unseg [161]), contrastive learning (AUE [177]), and text-to-image generation (Myopia [183]).

Key literature. E-Min perturbations were first introduced for generating Unlearnable Examples (UEs) [74]. Subsequent work has mainly improved their robustness against input transformations, data augmentations, and alternative training paradigms. GrayAugs enhances robustness to grayscale filtering [116], while Hypocritical perturbations, also studied under delusive attacks, minimize classification loss on a static surrogate to evaluate defenses [164]. Unlearnable Cluster (UC) further constructs label-agnostic UEs by minimizing distances to incorrect cluster centers rather than labels [204]. To defend against adversarially trained learners, Robust Unlearnable Examples (RUEs) incorporate adversarial perturbations into the E-Min optimization, making the resulting noise more robust to adversarial training [52]. Similar objectives are pursued by the two-stage Min-Max-Min optimization framework (M3 ) [49], Segue [209], and Armor, which improves robustness against data augmentation [61]. Stable Error-Minimizing noise (SEM) further targets pixel corruptions by optimizing E-Min perturbations over random input perturbations within an adversarial training framework [114]. Another line of work improves transferability and stability. Transferable Unlearnable Examples (TUE) enhance the generalization of E-Min perturbations across training settings and datasets [136]. Segue employs a generator to produce UEs robust to adversarial training, JPEG compression, and data augmentations [209], while Versatile Transferable Generator (VTG) improves cross-domain transferability through adversarial domain augmentation [103]. To mitigate stochasticity in training, Self-Ensemble Protection (SEP) uses training checkpoints as an ensemble when generating unlearnability perturbations [26], and Sharpness-Aware Data Poisoning

4.2

Distribution-based unlearnability

Methods in this category generate unlearnability perturbations in a gradient-free manner. Instead of relying on surrogate models, they derive perturbations directly from the distribution of data features and their influence. Shortcuts constitute the main line of work under this category. 4.2.1

Shortcut.

Mechanism. Shortcuts are local data patterns that induce preferential learning in models trained on the protected data. In this SoK, we define shortcuts as gradient-free, data-centric unlearnability perturbations derived from the distributional information of the protectee dataset. Typically, a fitness function is used to identify patterns that are easily learned by models and exploit them as shortcut signals. 5

Table 1: Summary of the properties of major unlearnability methods (ranked within each category by year). indicates that a method is specifically designed to achieve the property, denotes partial capability without deliberate design for it, and signifies that the property does not apply. FR-Oriented refers to methods aimed at robustness in the feature space (e.g., against adversarial data augmentation or adversarial training), whereas PR-Oriented refers to methods designed to withstand parametric attacks, in which attackers directly manipulate model parameters. Scalability refers to the largest dataset to which a method can be applied. Method

Error-maximizing

TC (2019) [152] Metapoison (2020) [75] NTGA (2021) [198] TAP (2021) [51] Anti-DreamBooth (2023) [169] AAP (2024) [177] InMark (2024) [107] EUDP (2024) [213] MetaCloak (2024) [113] GUE (2024) [111]

Error

Perturbation Type

Representation

Distribution

Error-minimizing

UE (2021) [74] GrayAugs (2021) [116] Hypocritical (2021) [164] RUE (2022) [52] LearnabilityLock (2022) [133] UC (2023) [204] TUE (2023) [136] SEP (2023) [26] UT (2023) [101] M3 (2024) [49] SALM (2024) [160] SEM (2024) [114] SAPA (2024) [68] HarmonyCloak (2024) [121] POP (2024) [208] AUE (2024) [177] MEM (2024) [112] Unseg (2024) [161] UGE (2024) [190] Armor (2025) [61] Myopia (2025) [183] T2UE (2025) [119] Segue (2025) [209] PUE (2025) [171] SafeSpeech (2025) [207] TempUE (2025) [207] VTG (2025) [103] PIL (2026) [108] BAIT (2026) [104]

Shortcut

AR (2022) [142] LSP (2022) [195] OPS (2023) [182] CUDA (2023) [140] PosCUDA (2024) [57] UMT (2024) [173] RegText (2025) [148] ExpShield (2026) [110]

Feature Dissimilarization

EntF-push (2023) [180] 14A (2024) [22] DH (2024) [123]

Feature Collision

Fawkes (2020) [151] EntF-pull (2023) [180] GLAZE (2023) [149] NightShade (2024) [150] MI-UE (2026) [222]

Gradient-Free

Label-Free

Task

Data Modality

Sample-/Class-Wise

Classification Classification Classification Classification Text-to-Image Classification Text-to-Image Image Generation Text-to-Image Classification

Image Image Image Image Image Image Image Image Image Image

S S S S S S S S S S

ImageNet CIFAR-10 ImageNet ImageNet CelebA-HQ ImageNet WikiArt / VGGFace2 CIFAR-10 CelebA-HQ CIFAR-10/100

Classification Classification Classification Classification Classification Classification Classification Classification Classification/Question Answering Classification Classification Classification Classification Music Synthesis Speech Synthesis Classification Image/Text Retrieval Image Segmentation Classification Classification Text-to-Image Image/Text Retrieval Classification Classification Speech Synthesis Object Tracking Classification Classification Classification

Image Image Image Image Image Image Image Image Text Image Image Image Image Audio (MIDI) Audio (Waveform) Image Image Image Image Image Image Image Image Image Audio (Waveform) Video Image Image Image

S/C S/C S/C S C S/C S S S S S S S S S S S S S/C S S S C S S S S C

ImageNet ImageNet ImageNet ImageNet ImageNet ImageNet CIFAR-10/100 ImageNet AG-News / SQuAD ImageNet MedMNIST-v2 ImageNet CIFAR-10/100 Lakh MIDI LibriTTS ImageNet MSCOCO/Flickr30k Cityscapes / MSCOCO Tiny-ImageNet ImageNet CelebA-HQ Tiny-MSCOCO / Flickr30k VGGFace2 ImageNet LibriTTS YouTube-VOS 2019 PACS ImageNet ImageNet

Classification Classification Classification Classification Classification Classification/Segmentation Text Classification/Generation Text Generation/Vision-to-Language

Image Image Image Image Audio (Speech) Point Cloud Text Text

C C C C C C C S

CIFAR-10 ImageNet ImageNet ImageNet SpeechCommands S3DIS / KITTI Natural Instructions CC-News/IAPR-TC-12

Classification Classification Classification

Image Image Image

C S S

Tiny-ImageNet ImageNet ImageNet

Classification Classification Text-to-Image Text-to-Image Classification

Image Image Image Image Image

S C S S S

WebFace Tiny-ImageNet WikiArt / Original Art Conceptual Caption ImageNet

The key principle is that overparameterized models, such as DNNs, tend to memorize associations between simple, frequent, and label-consistent input patterns and their corresponding labels. Based on this observation, shortcut-based unlearnability methods have been developed for images [182], text [148], and audio [57], mainly in classification tasks. Extending such shortcuts to generative tasks remains challenging.

FR-Oriented

PR-Oriented

Scalability

or be deliberately engineered [18, 54]. Their model-agnostic and stealthy nature makes them effective for reducing data learnability. Auto-Regressive (AR) poisoning generates shortcuts in a dataand model-agnostic manner [142]. Linearly-Separable Perturbation (LSP) is based on the conjecture that unlearnability perturbations for different classes can be made linearly separable, thereby serving as effective shortcuts [195]. CUDA shows that convolution-induced blurring can act as a shortcut for learning [140], and PosCUDA extends this idea to audio protection [57]. One-Pixel Shortcut (OPS) uses limited pixel flipping to conceal domain knowledge [182]. It identifies pixels that induce the largest distributional drift and maximizes their values across the dataset to make the data unlearnable. Since OPS is model-agnostic, it is robust to variations in model architectures and parameters. For text data, RegText constructs textual shortcuts against LLMs in classification tasks [148], while

Key literature. Shortcuts between inputs and outputs can be established by inserting special patterns into data features. In our taxonomy, the defining property of shortcuts is that their construction is gradient-free. Unlike E-Max and E-Min perturbations, shortcuts exploit distributional learning preferences: models tend to capture correlations between certain input patterns and their associated outputs. These shortcuts may naturally occur in data 6

Key literature. Feature collision methods perturb protected images so that their latent features resemble those of target images. This idea was first proposed as a clean-label poisoning attack against classifiers [147] and later extended to Entangled Feature Pulling (EntF-pull) for crafting perturbations robust to adversarial training [180]. MI-UE further optimizes feature relations by minimizing inter-class cosine similarity while maximizing intra-class cosine similarity [222]. Several feature-collision methods have also been developed for generative settings. Fawkes protects online facial images from unauthorized face recognition by moving the features of cloaked photos toward those of target identities [151]. As a result, models trained on cloaked images fail to recognize clean images of the same users. GLAZE protects artistic styles from unauthorized T2I mimicry by selecting a public target style, stylizing the protected artwork accordingly, and optimizing a style cloak that aligns the original latent features with those of the stylized target [149]. Similarly, Nightshade defends against unauthorized T2I models by injecting prompt-specific poisoning through feature collision [150].

ExpShield inserts random tokens as shortcuts to maximize token generation error [110]. Beyond images and text, Unlearnable MultiTransformation (UMT) applies 3D transformations to convert point clouds into UEs [173].

4.3

Representation-based unlearnability

Latent representations can also guide the design of unlearnability perturbations. Methods in this category optimize perturbations by either separating the feature representations of protected data from those of the original data, or inducing feature collisions with a target sample in the latent space. 4.3.1

Feature Dissimilarization.

Mechanism. Given a protectee sample 𝑥𝑖 , feature dissimilarization perturbs it with 𝛿𝑖 to push its latent representation Φ(𝑥𝑖 + 𝛿𝑖 ) away from the original representation Φ(𝑥𝑖 ), where Φ(·) denotes a feature extractor. The general objective is: 𝛿 ∗ = max 𝛿

∑︁

Dist(Φ(𝑥𝑖 + 𝛿𝑖 ), Φ(𝑥𝑖 ) ),

𝑥𝑖 ∈D

(4)

s.t. ∥𝛿𝑖 ∥ 𝑝 ≤ 𝐵, ∀𝑖 ∈ {1, 2, ..., |D| },

Remark on unlearnability as an upstream defense.

where Dist(·) measures the distance between latent representations. Unlike E-Min and E-Max optimization, this objective can be label-free, making feature dissimilarization particularly suitable for unlabeled data protection. Existing methods have mainly focused on image classification tasks [22, 123].

Unlearnability acts as an upstream defense in the ML lifecycle and is therefore vulnerable to downstream data manipulations and variations in learning or unlearning algorithms. Its effectiveness can be weakened in both feature and parameter spaces: preprocessing defenses (e.g., Shortcut Squeezing [117], DiffPure [128], IMPRESS [20], IMPRESS++ [69]) and adversarial training [120] can remove or suppress protective perturbations, while Deep Feature Reweighting [141] and recovery attacks [171] can restore model performance. These limitations underscore the need for stronger robustness theory and more rigorous evaluation against downstream threats [171, 191].

Key literature. Feature dissimilarization reduces data learnability by manipulating representations rather than raw inputs. Specifically, it operates in the feature space of feature extractors instead of directly optimizing pixel-level losses. Entangled Feature (EntF-push) uses feature dissimilarization to improve the robustness of unlearnability noise against adversarial training [180]. 14A employs a generator to maximize the conceptual gap between perturbed and original images in the embedding space, producing semantically misaligned yet natural-looking samples [22]. Deep Hiding (DH) further embeds semantic images into protectee samples via invertible neural networks, concealing sensitive information while injecting structured feature-space noise [123]. 4.3.2

5.1

Feature Collision.

𝛿 ∗ = min 𝛿

5.1.1

Dist(Φ(𝑥𝑖 + 𝛿𝑖 ), Φ(𝑇 ) ),

𝑥𝑖 ∈D

Exact Unlearning

As the name suggests, exact unlearning removes the forget set by retraining the model solely on the retain set. Retraining is therefore the principal approach in this category.

Mechanism. In contrast to feature dissimilarization, feature collision minimizes the distance between the perturbed representation Φ(𝑥𝑖 + 𝛿𝑖 ) and the representation Φ(𝑇 ) of a target image 𝑇 . The target can be selected from an open domain where privacy or copyright concerns do not arise. The defender optimizes: ∑︁

Dememorization via Unlearning

This section systematically reviews unlearning methods as outputlevel dememorization. We focus on approaches that scale to models comparable to those addressed by unlearnability, such as DNNs, while also covering convex-certifiable unlearning methods for completeness.

Retraining.

Mechanism. Exact unlearning requires removing the forget set as if it had never participated in training. Formally, for any measurable subset 𝑆 of the hypothesis space, an unlearning algorithm U satisfies

(5)

s.t. ∥𝛿𝑖 ∥ 𝑝 ≤ 𝐵, ∀𝑖 ∈ {1, 2, ..., |D| }.

Feature collision was originally introduced for clean-label poisoning attacks [147, 219] and has later been adapted to protect image data, particularly in T2I tasks [149]. Unlike feature dissimilarization, this approach requires specifying a target class or target domain to induce the collision. Although precise labels are not always necessary, rough category knowledge is required. Hence, these methods are not label-free.

Pr[ U (Γ (D), D, D 𝑓 ) ∈ 𝑆 ] = Pr[Γ (D \ D 𝑓 ) ∈ 𝑆 ].

(6)

The most direct instantiation of U (·) is full retraining. Since this is computationally expensive, existing methods often adopt divideand-conquer strategies, partitioning the dataset into shards and training separate constituent models on them [17]. These models 7

are then aggregated at inference time. Subsequent work reduces unlearning cost through optimized partitioning [9, 185] or parameterefficient retraining [34, 42].

catastrophic forgetting of D 𝑓 while retaining knowledge from D𝑟 . We also include retain- or forget-set-free gradient descent methods in this category, as they similarly optimize heuristic unlearning objectives. FT has further been applied to remove environmental information from reinforcement learning agents [60, 189]. Beyond GA and FT, non-certifiable unlearning has explored influence functions [19], direct weight editing [13, 15, 29, 40, 48, 79, 80, 138, 143], reinforcement learning [200, 203], adversarial training [206], meta-unlearning [96, 102, 211], model-assisted unlearning [78, 215, 221], and output tempering [158]. For graph-structured data, partial retraining has been used as an approximate unlearning strategy [25, 170]. For LLMs, prompt engineering has also been studied as a lightweight mechanism for inducing unlearning-like behavior [28, 106, 132, 174].

Key literature. Retraining (RT ) is the most straightforward exactunlearning approach. The representative method is Sharded, Isolated, Sliced, and Aggregated (SISA) training [17], which partitions the training set into disjoint shards and trains independent constituent models on them. During inference, all constituents process the input and their outputs are aggregated. Since each constituent depends only on its own shard, unlearning a data point only requires retraining the constituent trained on the shard containing that point. SISA, however, faces an inherent scalability trade-off. Increasing the number of shards reduces the data per constituent and lowers the cost of each unlearning request, but it also increases the number of models that must be trained and maintained. Conversely, using fewer shards reduces the overall training and storage burden but increases the retraining cost for each deletion. This trade-off limits scalability as models and datasets grow. To mitigate this issue, later work improves shard partitioning [9, 167, 184, 185, 196] or uses adapters to reduce retraining cost [34, 42, 135]. Nevertheless, the fundamental cost–scalability dilemma remains, motivating approximate unlearning as a more practical alternative.

5.2

5.2.2

Mechanism. Convex-certifiable unlearning provides formal (𝜖, 𝜁 )unlearning guarantees, as in Definition 1, for models trained with convex losses. Most methods in this category use influence-functionbased Newton updates to remove the effect of D 𝑓 . Let 𝜃 ∗ = Γ(D) and 𝜃 𝑟∗ = Γ(D𝑟 ). Then, 𝜃 𝑟∗ ≈ 𝜃 ∗ − 𝐻 −1 ▽𝜃 L (𝜃 ∗ ; D 𝑓 ),

Approximate Unlearning

Key literature. Certified unlearning was introduced through (𝜖, 𝛿)– certified data removal [64], inspired by DP [43]. We denote this notion as (𝜖, 𝜁 )-unlearning to avoid notation conflict. Related formulations include total variation stability for measuring indistinguishability before and after unlearning [168], reservoir-sampling-based convex optimization for long sequences of deletion requests [125], and Bayesian unlearning for Gaussian processes and logistic regression [127]. Checkpointing has also been used to improve certified unlearning efficiency for convex objectives [145]. Feature–Label Unlearning (FLU) provides an efficient alternative to instance-level unlearning by perturbing features, modifying labels, and using influence functions to update model weights [178]. When the loss is strictly convex and twice differentiable, FLU achieves (𝜖, 𝜁 )–certified unlearning. Beyond standard deletion, certified methods have been extended to adaptive, data-free, and other complex settings [7, 14, 66, 109]. More recently, noisy gradient descent has been used to obtain certified unlearning under convexity assumptions [11, 32, 129], while distributional unlearning has been studied for selective data removal [10]. Despite their formal guarantees, convex-certifiable methods scale poorly to DNNs because their assumptions, especially convexity, do not hold for modern non-convex models.

Non-Certifiable Unlearning.

Mechanism. Many approximate unlearning methods improve scalability by forgoing formal deletion guarantees. This category includes most unlearning techniques for large-scale models, such as LLMs and LVMs. These methods are typically metric-driven. Given a performance metric M (·), the objective can be written as: max M ( U (Γ (D), D, D 𝑓 ); D𝑟 ) − M ( U (Γ (D), D, D 𝑓 ); D 𝑓 ), U

(8)

where L (𝜃 ∗ ; D 𝑓 ) denotes the loss on the forget set and 𝐻 is the Hessian of the training objective. These guarantees critically rely on convexity assumptions [64, 178]. Recent extensions address settings such as adaptive deletion [66] and data-free unlearning [7].

Approximate unlearning is generally more scalable than exact unlearning and has become the dominant paradigm for large models such as LLMs and LVMs. However, its scalability comes at the cost of weaker guarantees on deletion quality. In this section, we categorize approximate unlearning into three types: non-certifiable, convex-certifiable, and non-convex-certifiable unlearning. Given the breadth of this literature, we focus primarily on methods that are scalable to large models. 5.2.1

Convex-Certifiable Unlearning.

(7)

where D𝑟 = D \ D 𝑓 denotes the retain set. Existing methods rely on heuristic updates, such as reversing gradients on the forget set [62, 166], fine-tuning on the retain set [53, 97, 118], or directly modifying model weights [29, 79], to degrade performance on D 𝑓 while preserving performance on D𝑟 . Key literature. Gradient ascent (GA) is a widely used non-certifiable unlearning strategy [38, 62, 86, 146, 163, 166, 188, 212, 220]. It heuristically reverses learning on selected data by applying gradients that increase the forget-set loss. GA has also been extended to LLM and LVM unlearning [8, 12, 21, 30, 100, 105, 115, 205]. Fine-tuning (FT ) is another dominant scalable approach [16, 23, 24, 27, 31, 35–37, 39, 44, 46, 47, 50, 53, 55, 59, 63, 70, 71, 76, 83–85, 87, 91–95, 97–99, 118, 126, 130, 137, 144, 153, 154, 156, 159, 162, 165, 172, 176, 186, 194, 197, 199, 214, 216, 218, 223]. It induces

5.2.3

Non-Convex-Certifiable Unlearning.

Mechanism. Certifiable unlearning in non-convex settings is highly desirable, as non-convexity is a key barrier introduced by modern DNNs. Overcoming this barrier would make certified unlearning applicable to large-scale deep models in practical deployments. Existing methods typically use noisy fine-tuning to provide 8

Table 3: The test accuracy (%) of classifiers trained on unlearnability data.

(𝜖, 𝜁 )-unlearning guarantees for models with non-convex losses. Such guarantees are often derived from distribution-level bounds, such as Rényi DP [33, 89]. With probability at least 𝑝, one can bound 𝐷 [ U (Γ (D), D, D 𝑓 ) | | Γ (D \ D 𝑓 ) ] ≤ 𝜏𝑝 ,

(9)

where 𝐷 [·] denotes a divergence measure (e.g., Rényi divergence, Kullback–Leibler divergence, or total variation), and 𝜏𝑝 is the corresponding computable upper bound. Under suitable noise scales and gradient truncation mechanisms, this divergence can be bounded after sufficiently many noisy fine-tuning steps.

RN-18

CIFAR10 DN-121 ViT-Tiny

RN-18

CIFAR100 DN-121 ViT-Tiny

RN-18

ImageNet DN-121 ViT-Tiny

UE-c PUE OPS UE-s TUE TAP

13.27 10.02 32.88 20.61 10.07 9.10

17.18 10.01 33.37 18.29 10.18 9.86

23.41 75.33 22.93 25.37 35.09 35.13

3.84 2.52 14.02 9.07 1.00 7.05

5.14 2.10 15.27 9.14 1.03 6.73

13.00 23.72 29.12 20.25 31.52 20.41

47.26 14.52 56.86 17.70 56.16 6.38

46.70 16.58 59.20 20.96 59.62 6.80

29.64 16.90 30.14 19.42 31.46 17.80

Clean

94.50

95.35

77.57

70.86

74.02

45.53

63.42

67.10

37.52

a protected medical dataset may subsequently require unlearning under right-to-erasure obligations. Such cross-stage interactions can cause residual leakage and shallow dememorization. To answer RQ2, we evaluate the interplay between unlearnability and unlearning and reveal their shared vulnerabilities. In particular, we show that shallow dememorization is pervasive in both paradigms.

Key literature. Methods in this category primarily rely on DP techniques. Recent work extends inverse-Hessian approximation to compute approximate Newton updates for certified unlearning in DNNs [179, 202], and uses projected noisy gradient descent (PNGD) to obtain certified unlearning with DP guarantees [33]. Other approaches approximate Newton updates through sparse updates on salient parameters under second-order sufficiency conditions [122], or approximate non-convex losses via mixed linear approximations [58]. However, these methods often depend on smooth losses or positive-definite Hessians, assumptions that may be violated by modern activation functions and loss formulations. To relax these assumptions, recent studies introduce stochastic post-processing and privacy-amplification frameworks for DNN unlearning [89, 124]. These methods combine noisy fine-tuning with tailored gradient operations to enforce DP-style guarantees, avoiding restrictive smoothness assumptions and improving applicability to large-scale non-convex models. Further advances reduce the cost of Hessian estimation by attaching unlearning statistics to training samples and leveraging Hessian–vector products [134]. Certified unlearning has also been extended to graph-structured data [192], while connections between randomized smoothing and gradient quantization have been explored to support efficient certified deletion requests [210]. Beyond instance-level deletion, featurelevel certified unlearning has been studied by shuffling targeted features and fine-tuning on the modified dataset to remove their effects [187].

6 Experiments 6.1 Efficacy of unlearnability To evaluate the resistance of unlearnability methods to unauthorized learning, we apply six types of unlearnability noise on CIFAR10, CIFAR-100 [90], and ImageNet with 100 randomly selected classes [139]. These include sample-wise methods (UE-s, TUE, TAP) and class-wise methods (UE-c, PUE, OPS). We convert the full CIFAR-10/100 training sets into unlearnability-protected datasets and use 20% of ImageNet for efficiency. ResNet-18 [67], DenseNet121 [73], and ViT-Tiny [41] are trained as unauthorized classifiers with data augmentation and evaluated on clean test sets, with cleantrained models as baselines (see Appendix A for details). As shown in Table 3, existing methods provide limited resistance under certain conditions. OPS consistently allows substantial clean knowledge extraction across datasets and architectures. UE-s and TUE are effective on smaller datasets but degrade on larger ones such as ImageNet. Across architectures, resistance is weakest against ViT-Tiny. Figure 4 further shows that data augmentation enables models trained on unlearnability-protected datasets to retain high clean accuracy. PUE remains relatively robust on ResNet-18 and DenseNet-121, but is less effective on ViT-Tiny, while TAP is intrinsically ineffective against ViT even without augmentation. Additional results on poisoning ratios are reported in Figure 19 and Appendix B. Overall, current unlearnability methods do not reliably prevent unauthorized learning. Their effectiveness is sensitive to model architecture, image resolution, data augmentation, and poisoning ratio, leaving substantial clean knowledge retained in the trained model. This motivates a downstream unlearning stage to remove residual information and assess whether unlearning can complement unlearnability.

Remark on unlearning as a downstream defense. Table 2 summarizes the trends across unlearning paradigms. Finetuning (FT ) dominates approximate unlearning, whereas gradient ascent (GA) is mainly used in non-certifiable methods and influence functions (IF) are more common in certified unlearning. However, the interaction between unlearning and unlearnability remains largely underexplored, leaving open how they can be unified into a robust dememorization framework spanning both training and post-training stages.

Table 2: Number of papers in each unlearning category. Exact

Dataset Perturbation

Approximate Non-certifiable

Conv-certifiable

6.2

Non-conv-certifiable

Other

Unlearnability-Unlearning Interaction

This section investigates the interaction between unlearnability and unlearning. We examine how the two mechanisms affect each other when applied sequentially, and whether unlearning can effectively remove residual knowledge introduced by unlearnability-protected data.

In realistic ML lifecycles, models are not necessarily trained on clean data. Models trained on unlearnability-protected data may later receive deletion requests. For example, a model trained on

6.2.1 9

Experimental Design.

UE-c PUE OPS UE-s TUE TAP

40 20 0

UE-c PUE OPS UE-s TUE TAP

80 60

ImageNet

0.1

No Aug Aug

40 20 0

0.0 0.1 0.2

UE-c PUE OPS UE-s TUE TAP

Figure 4: The test accuracy (%) of ViT-Tiny trained on unlearnability data with and without augmentation.

0.0

MIA (Prob)

No Aug Aug

IF IF Before

FT FT

GA GA

0.1 0.2 0.3 0.4

Class 0 Class 1 Class 2 Class 3

IF IF Before

FT FT

GA GA

Class 0 Class 1 Class 2 Class 3

Figure 5: MIA on UE-s (left:class-level; right:subset-level).

MIA (Prob)

Forgetting targets. We evaluate five forgetting targets: 1) clean knowledge leaked from unlearnability-protected samples, 2) unlearnability-protected samples, 3) clean samples, 4) unlearnabilityprotected classes, and 5) clean classes. These targets cover both subset-level and class-level unlearning. In the subset-level setting, each target class contains 90% unlearnability-protected data and 10% clean data, and unlearning is evaluated on either subset. We denote the unlearnability training set, its clean counterpart, the clean training set, and the test set by 𝐷𝑢 , 𝐷𝑢𝑐 , 𝐷𝑐 , and 𝐷𝑡 , respectively. In the class-level setting, classes 0–3 are unlearnability-protected (𝐷𝑢 ), while classes 4–9 are clean (𝐷𝑐 ). We unlearn each class from classes 0–7 separately and use classes 8–9 as the observation set (𝐷𝑡𝑟 ). For a unlearnability-protected class, 𝐷𝑢 , 𝐷𝑢𝑐 , and 𝐷𝑢𝑡 denote the forget training set, its clean counterpart, and the corresponding test set, respectively. For a clean class, Acc𝐷𝑐 and Acc𝐷𝑐𝑡 denote the training and test accuracies after unlearning.

0.2 0.1 0.0 0.1 0.2 0.3

0.1

MIA (Prob)

CIFAR-100

IF IF Before

FT FT

0.0 0.1 0.2

GA GA

0.3

Class 0 Class 1 Class 2 Class 3

IF IF Before

FT FT

GA GA

Class 0 Class 1 Class 2 Class 3

MIA (Prob)

Figure 6: MIA on OPS (left:class-level; right:subset-level).

0.2

MIA (Prob)

No Aug Aug

Test Accuracy (%)

CIFAR-10 Test Accuracy (%)

Test Accuracy (%)

0.0 0.2

IF IF Before

FT FT

GA GA

0.0 0.1 0.2 0.3 0.4

FT FT

GA GA

Class 0 Class 1 Class 2 Class 3

Unlearning Methods. We compare three representative unlearning families: IF [77, 88], FT [59], and GA [62, 166]. FT is run for 10 epochs and GA for 5 epochs. Full retraining (RT) on the retain set is used as the baseline.

Figure 7: MIA on PUE (left:class-level; right:subset-level).

Evaluation Metrics. We evaluate unlearning effectiveness and privacy leakage using classification accuracy (Acc) and membership inference attack (MIA) success rate. Successful unlearning requires the accuracy on forgetting targets to be no higher than that of the retrained model, indicating removal of target knowledge, while maintaining accuracy on retained data and test data close to the retrained baseline. In addition, the MIA success rate on clean counterparts of unlearnability-protected data should be no higher than that of the retrained model after unlearning.

MIA (Prob)

Class 0 Class 1 Class 2 Class 3

IF IF Before

MIA (Prob)

0.1 0.0 0.1

IF IF Before

FT FT

GA GA

Class 0 Class 1 Class 2 Class 3

0.0 0.2 0.4

IF IF Before

FT FT

GA GA

Class 0 Class 1 Class 2 Class 3

Figure 8: MIA on TUE (left:class-level; right:subset-level). symbol ↑ indicates an increase in Acc𝐷𝑢𝑐 . The main findings are summarized below.

Experimental Settings. We apply unlearning to ResNet-18 models trained on CIFAR-10 with different unlearnability variants, including UE-s, TUE, OPS, and PUE. All models are trained for 100 epochs using SGD with learning rate 0.01, momentum 0.9, and weight decay 5 × 10−4 . Since exact Hessian inversion for IF is computationally expensive, we approximate 𝐻 −1 ∇𝜃 L (𝜃 ∗ ; D 𝑓 ) using first-order WoodFisher [157], with the update scale controlled by 𝛼. Results are reported under two hyperparameter scales, small (▽) and large (△). For IF, the scale is determined by 𝛼; for FT and GA, it is determined by the learning rate. Detailed hyperparameters are provided in Tables 8–9.

Finding I: Forgetting clean knowledge leaked through unlearnability. With properly chosen hyperparameters, IF and GA effectively remove leaked clean knowledge, as reflected by reduced Acc𝐷𝑢𝑐 , while preserving utility on 𝐷𝑐 and 𝐷𝑡 . In contrast, FT is highly sensitive to the learning rate. An improper choice may fail to forget, or even reinforce, the leaked knowledge by increasing Acc𝐷𝑢𝑐 . Finding II: Forgetting unlearnability-protected data. By examining Acc𝐷𝑢 , we find that none of the three unlearning methods removes unlearnability-protected data as effectively as RT without degrading performance on the remaining sets. Forgetting unlearnabilityprotected data requires stronger intervention than forgetting their leaked clean knowledge, leading to substantial class-wise variation and a challenging trade-off between unlearning effectiveness and model utility.

6.2.2 Empirical Findings and Analysis on Unlearning Effectiveness. For subset-level unlearning, results are reported in Tables 10–13. Due to space constraints, we report the first eight classes and highlight cases where unlearning matches the retraining baseline. The 10

Retrain

NPO

89.20 99.20 93.89

78.80 87.60 76.08

69.30 88.00 66.07

68.70 90.50↑ 79.58↑

65.10 91.20↑ 79.88↑

75.60 94.40↑ 80.68↑

80 60 40 20 0

Accuracy (%)

Regtext

Accuracy (%)

Task1 Task2 Task3

Clean

PUE

CIFAR10

0.0 0.4 0.8 1.2 1.6 2.0

Perturbation (X)

OPS 80 60 40 20 0

TAP

UE-s

CIFAR100 Accuracy (%)

UE-c

Table 4: The accuracy (%) of unlearned models trained on Regtext.

0.0 0.4 0.8 1.2 1.6 2.0

Perturbation (X)

80 60 40 20 0

TUE

ImageNet

0.0 0.4 0.8 1.2 1.6 2.0

Perturbation (X)

Figure 9: Parametric robustness of unlearnability perturbations gauged by recovery attacks. “Accuracy” denotes the clean test accuracy of recovered poisoned models whose weights have been perturbed within an ℓ2 norm bound of X.

Finding III: Forgetting clean data. IF and FT effectively remove 𝐷𝑐 while preserving test performance, whereas GA is less reliable and varies considerably across classes under the same learning rate. In particular, for most classes in TUE, UE and PUE, forgetting 𝐷𝑐 with IF also reduces Acc𝐷𝑢 , suggesting that the the injected perturbations overlap with the true class-discriminative features. In contrast, Acc𝐷𝑢 remains high for OPS, indicating that its pixel-level shortcut is more independent of class-discriminative features. For class-level unlearning, results are reported in Tables 14–17. We summarize the finding below.

Finding VIII: Mismatch between accuracy-based unlearning and privacy preservation. Combining the MIA results with the accuracybased analysis reveals a clear mismatch between unlearning effectiveness and privacy preservation. A model may appear to forget clean counterparts of unlearnability-protected data in terms of accuracy, yet still retain or even amplify membership leakage, particularly under IF. Thus, accuracy alone is insufficient for evaluating unlearning in the presence of unlearnability, and privacy-oriented metrics such as MIA are necessary for a comprehensive assessment.

Finding IV: Class-level unlearning differs between protected and clean classes. Protected classes generally require stronger intervention than clean classes for IF and GA, creating a trade-off between forgetting effectiveness and utility preservation. In contrast, FT shows more consistent behavior across both protected and clean classes. Overall, the results reveal a nuanced interaction between unlearnability and unlearning. When unlearnability-protected and clean data coexist within the same class, unlearning struggles to remove perturbation-induced features, as they may overlap with class-discriminative features. Regarding residual leakage of clean knowledge from unlearnability variants, Improper unlearning, such as poorly tuned FT, may even reinforce and further memorize residual knowledge and increase unauthorized exposure. At the class level, FT is more effective than IF and GA, consistently inducing stronger dememorization across both protected and clean classes under the same hyperparameter scale. For completeness, we provide a theoretical justification of the unlearnability–unlearning interplay in Appendix C.

6.3

Evaluation of Shallow Dememorization

This section examines the shallow nature of unlearnability and unlearning as dememorization techniques. Although these methods can partially mitigate unauthorized knowledge acquisition, the stability of the resulting immemor state remains unclear. We use recovery attacks [171], which apply projected stochastic gradient descent to perturb model weights, to assess the robustness of this state under parameter perturbations. Attack details are provided in Appendix A. 6.3.1 Model Recovery. We launch recovery attacks against six unlearnability noise variants, including class-wise methods (UE-c, PUE, OPS) and sample-wise methods (TAP, UE-s, TUE), to measure how much model utility can be restored. As shown in Figure 9, all unlearnability methods are more sensitive to weight perturbations on smaller datasets (CIFAR-10 and CIFAR-100), where recovery attacks substantially improve accuracy as the perturbation radius increases, especially for methods such as TAP. On ImageNet, some methods, such as OPS and TUE, appear more robust under the same perturbation budget. However, this apparent robustness coincides with weaker learnability reduction, as indicated by their higher baseline accuracies. Overall, although dataset scale affects recovery effectiveness, unlearnability methods consistently permit performance recovery across settings, suggesting that they impose only a shallow obstruction to clean knowledge acquisition.

6.2.3 Empirical Findings on Privacy Leakage of Clean Counterparts. We report the gap in probability-based MIA success rate between the unlearned model and the retrained baseline on clean counterparts of unlearnability-protected data (Figures 5–8); positive values indicate residual privacy leakage. We also report MIA results based on alternative signals, including correctness and entropy, as complementary metrics (Tables 18–25). The main findings are summarized below. Finding VI: Counterproductive privacy behavior under unlearning. Across both subset-level and class-level settings, none of the three unlearning methods consistently reduce MIA success rates to the retraining baseline. More concerningly, unlearning often exhibits counterproductive behavior: it can increase MIA success on clean counterparts, especially under FT and IF, making the samples more vulnerable to MIA. This suggests that removing unlearnabilityprotected data may unintentionally amplify the distinguishability of the corresponding clean samples, thereby exacerbating rather than mitigating privacy leakage.

6.3.2 Recovery after Unlearning. We conduct recovery attacks on classifiers trained with UE-s, TUE, PUE, and OPS after class-level unlearning, using the settings in Tables 14–17. We compare them with the RT baseline to assess the depth and stability of the resulting immemor state. Results are shown in Figures 10 and 13–15, where 𝜂 denotes the ℓ2 parameter perturbation magnitude. 11

FT RT

50 25 0

20 Epoch

Recovery Attack ( = 0.4) Before IF

GA FT

50 25 0

20 Epoch

100

Recovery Attack ( = 0.8)

75 Clean Before

IF GA

FT RT

25 0

20 Epoch

Recovery Attack ( = 0.8)

75 50 25

Before IF

20 Epoch

GA FT

Clean Train Accuracy (%)

IF GA

100

Clean Train Accuracy (%)

Clean Before

Clean Train Accuracy (%)

100

Recovery Attack ( = 0.4)

Clean Train Accuracy (%)

100

Recovery Attack ( = 1.2)

75 50 25 0

Clean Before

IF GA

20 Epoch

FT RT

Recovery Attack ( = 1.2)

75 50 25 0

Before IF

GA FT

20 Epoch

Recovery attack against FT ( = 0.4) class0 class4

class1 class5

class2 class6

class3 class7

50 25 0

20 Epoch

100

Recovery attack against FT ( = 0.8) class0 class4

class1 class5

class2 class6

class3 class7

50 25 0

20 Epoch

Clean Train Accuracy (%)

100

Clean Train Accuracy (%)

Figure 10: Recovery attack against unlearned classifiers trained on UE-s from Table 14. Top: Recovery attack against the unlearned model with class 0 (UE-s) removed, “‘clean” represents the pre-unlearning model where class 0 was trained with clean data. Bottom: Recovery attack against the unlearned model with class 5 (clean) removed.

100

Recovery attack against FT ( = 1.2)

75 50 25 0

class0 class4

class1 class5

class2 class6

class3 class7

20 Epoch

75 70 65 0

Before Retrain

FT GA

NPO

4 6 Epoch

Recovery Attack ( = 0.8)

80 75 70 65 0

Before Retrain

FT GA

NPO

4 6 Epoch

Clean Train Accuracy (%)

Recovery Attack ( = 0.4)

Clean Train Accuracy (%)

Figure 11: Recovery attack against unlearned classifiers using FT trained on UE-s from Table 14.

Recovery Attack ( = 1.2)

80 75 70 65 0

Before Retrain

FT GA

NPO

4 6 Epoch

Figure 12: Recovery attack against unlearned models trained on Regtext. The results show that IF and GA induce only shallow unlearning for unlearnability-protected classes: recovery attacks restore targetclass test accuracy close to the pre-unlearning state and near the level of clean models. In contrast, FT yields a deeper unlearning effect, with performance remaining close to the RT baseline at 𝜂 = 0.4 and even lower than RT at 𝜂 = 0.8. Similar trends are observed when recovering forgotten clean classes, as shown at the bottom of Figures 10 and 13–15. Overall, only FT consistently produces deeper forgetting. We further analyze FT-unlearned classifiers where classes 1–7 are forgotten individually. As shown in Figures 11 and 16–18, FT

maintains a deep unlearning effect across all categories, demonstrating stronger robustness to recovery attacks than GA or IF in class-level unlearning. This may be attributed to FT using more retain data and update steps, which stabilizes feature memory for remaining classes while inducing catastrophic forgetting of the target class. By contrast, the “negative” updates in GA and IF are more easily reversed by subsequent “positive” learning on target data. FT remains effective for class-level unlearning but may expose unauthorized knowledge in subset-level settings (Section 6.2.2). Moreover, unlearning a unlearnability-protected class yields deeper forgetting than unlearning a clean class, as most lighter curves fall 12

below darker ones at 𝜂 = 0.8. This suggests that combining unlearnability with unlearning can provide stronger protection than either alone.

Theorem 1 (Bounds of dememorization depth). Given a trained model 𝑓𝜃 with weights 𝜃 , let 𝐴D∗ (𝜃 ) be a metric indicating the performance of 𝑓𝜃 on a target dataset D∗ . For any 𝜃 ∗ drawn from the parameter set Θ̂ := {𝜃 | 𝜃 ∼ N (𝜃ˆ + 𝜐, 𝜎 2 𝐼 ), ∥𝜐 ∥ 2 ≤ 𝜂}, with probability no less than 𝑞, there is:

6.3.3 Shallow Dememorization in LLM. We adopt RegText [148] as the unlearnable-data generator and follow its Natural Instructions (NI) “Polarity” [175] setting, which is constructed from multiple sentiment- and toxicity-related tasks. We fine-tune a Mistral-v0.37b [82] model on the RegText-perturbed NI Polarity training set for 10 epochs, and then apply three representative unlearning methods, namely FT, GA, and NPO [205], to forget three target tasks. A retrained model on the retained data (RT) serves as the baseline for comparison. As summarized in Table 4, all three unlearning methods yield higher post-unlearning accuracy than their pre-unlearning counterparts on Tasks 2 and 3, indicating a “more memorized” effect. Although Task 1 appears dememorized initially, the recovery curves in Figure 12 show that the target information can be restored with modest weight perturbations, suggesting that the immemor state induced by unlearning on RegText data is shallow. Overall, this case study suggests that the interaction between unlearnability and unlearning is not specific to vision models. Even in the text domain, RegText can create residual learning signals that are difficult to eliminate, while standard unlearning methods may suffer from both counterproductive memorization and shallow forgetting. Based on our findings in Sections 6.2–6.3, we provide the following guidelines.

𝐴D∗ (𝜃 ∗ ) ≤ inf {𝑡 | Pr [𝐴D∗ (𝜃ˆ + 𝜅 ) ≤ 𝑡 ] ≥ 𝑞 } 𝑎𝑛𝑑, 𝜅

𝐴D∗ (𝜃 ∗ ) ≥ sup {𝑡 | Pr [𝐴D∗ (𝜃ˆ + 𝜅 ) ≤ 𝑡 ] ≤ 𝑞 }, ∀ ∥𝜐 ∥ ≤ 𝜂,

where 𝑞 := Φ(Φ−1 (𝑞) + 𝜎 ), 𝑞 := Φ(Φ−1 (𝑞) − 𝜎 ), and 𝜅 ∼ N (0, 𝜎 2 𝐼 ). Φ(·) is the standard Gaussian CDF and Φ−1 (·) is the inverse of the CDF. ∥𝜐 ∥ 2 is the ℓ2 norm of the parameter shift 𝜐 from 𝜃ˆ. 𝜂

Table 5: Unlearning-unlearnability synergy. P-DLC as Poison

IF GA FT

Theorem 2 (Transfer of dememorization bounds between indistinguishable models). If 𝜃 ′ and 𝜃ˆ are (𝜖, 𝜁 )–indistinguishable, then the following bounds transfer with probability at least max{0, 𝑒 −𝜖 (Pr𝜃 [∥𝜃 − 𝜃ˆ∥ 2 ≤ 𝜂] − 𝜁 )}:

Leaked Clean Knowledge Depth

Subset (Acc)

Class (Acc)

Subset (Acc)

Subset (MIA)

Class (Acc)

Class (MIA)

✗ ✗ ✗

✓ △ ✓

✓ ✓ ▲

✓ △ ✓

▲ ▲ ▲

𝜂

See Definition 2 and Theorem 1 in [171] for the proof. Theorem 1 states that any model with weights 𝜃 ∗ drawn from a univariate Gaussian centered at 𝜃ˆ + 𝜐 admits an upper bound on its performance 𝐴D∗ (𝜃 ∗ ) with probability at least 𝑞. This bound is obtained by specifying 𝑞 and 𝜂, and then computing the corresponding confidence interval of 𝐴D∗ (𝜃ˆ +𝜅) via Monte Carlo. This is a non-vacuous bound, and the resulting value quantifies the degree of shallow dememorization. A smaller upper bound indicates that the target knowledge is harder to recover, implying a deeper immemor state. We further consider the case where a model 𝜃 ′ is (𝜖, 𝜁 )–indistinguishable from 𝜃ˆ and analyze how the dememorization depth bounds transfer to 𝜃 ′ . This is especially important for certified unlearning, where stochastic learning algorithms yield distinct weight sets for each run. Certifying dememorization depth directly on every 𝜃 ′ is costly. Instead, certifying at 𝜃ˆ and transferring the bounds to all (𝜖, 𝜁 )–indistinguishable neighbors offers a tractable solution. The following main theorem shows that this transferability is achievable.

Guidelines for unlearning-unlearnability synergy.

Paradigm

(10)

𝜅

Shallow Shallow Deep (class)

𝐴D∗ (𝜃 ′∗ ) ≤ inf {𝑡 | Pr [𝐴D∗ (𝜃ˆ + 𝜅 ) ≤ 𝑡 ] ≥ 𝑞 } 𝑎𝑛𝑑, 𝜅

𝐴D∗ (𝜃 ′∗ ) ≥ sup {𝑡 | Pr [𝐴D∗ (𝜃ˆ + 𝜅 ) ≤ 𝑡 ] ≤ 𝑞 }, ∀ ∥𝜐 ∥ ≤ 𝜂,

Table 5 summarizes the unlearning effectiveness and privacy risk of three major unlearning paradigms on unlearnability-protected data. Here, ✓denotes effective and stable behavior; △ denotes hyperparameter-sensitive effectiveness; ✗denotes failure; and ▲ denotes counterproductive behavior, where accuracy or MIA increases after unlearning. Although each method addresses specific objectives, none is universally effective. FT generally achieves a deeper immemor state in class-level unlearning but remains problematic in subset-level settings involving unlearnability. The key takeaway is: there exists a structural dilemma between eliminating residual knowledge leaked from unlearnability-protected data and achieving a deep immemor state.

where ∥𝜃 − 𝜃ˆ∥ 2 ≤ 𝜂 and 𝜃 ′∗ ∼ N (𝜃 ′ + 𝜐, 𝜎 2 𝐼 ) with ∥𝜐 ∥ ≤ 𝜂. Proof. For any indistinguishable 𝜃 and 𝜃 ′ : Pr[𝜃 ∈ 𝑆 ] ≤ 𝑒 −𝜖 Pr[𝜃 ′ ∈ 𝑆 ] + 𝜁 .

(12)

Let 𝑆 := {𝜃 : ∥𝜃 − 𝜃ˆ∥ 2 ≤ 𝜂} be the ℓ2 norm ball centered at 𝜃ˆ. Substituting 𝑆 into Inequality 12, there is: Pr[ ∥𝜃 − 𝜃ˆ ∥ 2 ≤ 𝜂 ] ≤ 𝑒 𝜖 Pr[ ∥𝜃 ′ − 𝜃ˆ ∥ 2 ≤ 𝜂 ] + 𝜁 .

(13)

Rearranging the above inequality gives: Pr[ ∥𝜃 ′ − 𝜃ˆ ∥ 2 ≤ 𝜂 ] ≥ 𝑒 −𝜖 (Pr[ ∥𝜃 − 𝜃ˆ ∥ 2 ≤ 𝜂 ] − 𝜁 ).

(11)

𝜅

Guarantees against Shallow Dememorization

Note that if ∥𝜃 ′ − 𝜃ˆ∥

To better understand the salient signals underlying shallow dememorization and answer RQ3, we take a first step toward providing a guarantee for model dememorization under weight modifications. We study the impact of a weight perturbation 𝜐 on the effectiveness of dememorization. This connects naturally to certified learnability [171], leading to the following theorem.

(14)

≤ 𝜂, the Gaussian around 𝜃 ′ satisfies the

dememorization bounds of Equation 11 with probability at least 𝑞. This completes the proof. □ Theorem 2 supports the dememorization depth certification of any 𝜃 ′ from certified unlearning based on a fixed 𝜃ˆ, therefore significantly reducing the cost of shallow dememorization verification in certified unlearning. 13

Conclusion

[13] George-Octavian Bărbulescu and Peter Triantafillou. 2024. To each (textual sequence) its own: improving memorized-data unlearning in large language models. In ICML. [14] Umit Yigit Basaran, Sk Miraj Ahmed, Amit Roy-Chowdhury, and Basak Guler. 2025. A Certified Unlearning Approach without Access to Source Data. In ICML. [15] Shristi Das Biswas, Arani Roy, and Kaushik Roy. 2025. Cure: Concept unlearning via orthogonal representation editing in diffusion models. In NeurIPS. [16] Jacob L Block, Aryan Mokhtari, and Sanjay Shakkottai. 2025. Machine Unlearning under Overparameterization. In NeurIPS. [17] Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine unlearning. In IEEE SP. [18] Alexander Brown, Nenad Tomasev, Jan Freyberg, Yuan Liu, Alan Karthikesalingam, and Jessica Schrouff. 2023. Detecting shortcut learning for fair medical AI using shortcut testing. Nature communications 14, 1 (2023), 4314. [19] Nhung Bui, Xinyang Lu, Rachael Hwee Ling Sim, See-Kiong Ng, and Bryan Kian Hsiang Low. 2026. How to Cure Newton for Unlearning Neural Networks? An Empirical Study from the Hessian Perspective. In ICLR. [20] Bochuan Cao, Changjiang Li, Ting Wang, Jinyuan Jia, Bo Li, and Jinghui Chen. 2023. Impress: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-based generative ai. In NeurIPS. [21] Sungmin Cha, Sungjun Cho, Dasol Hwang, and Moontae Lee. 2025. Towards Robust and Parameter-Efficient Knowledge Unlearning for LLMs. In ICLR. [22] Chaochao Chen, Jiaming Zhang, Yuyuan Li, and Zhongxuan Han. 2024. One for all: A universal generator for concept unlearnability via multi-modal alignment. In ICML. [23] Hang Chen, Jiaying Zhu, Xinyu Yang, and Wenya Wang. 2026. CLUE: Conflictguided Localization for LLM Unlearning Framework. In ICLR. [24] Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. 2023. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In CVPR. [25] Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. 2022. Graph unlearning. In CCS. [26] Sizhe Chen, Geng Yuan, Xinwen Cheng, Yifan Gong, Minghai Qin, Yanzhi Wang, and Xiaolin Huang. 2023. Self-Ensemble Protection: Training Checkpoints Are Good Data Protectors. In ICLR. [27] Tianqi Chen, Shujian Zhang, and Mingyuan Zhou. 2025. Score Forgetting Distillation: A Swift, Data-Free Method for Machine Unlearning in Diffusion Models. In ICLR. [28] Xinrui Chen, Xu Cao, Jianhao Zhang, Pinlong Zhao, Di Gao, and Ou Wu. 2026. Robust LLM Unlearning via Post Judgment and Multi-round Thinking. In ICLR. [29] Jiali Cheng, George Dasoulas, Huan He, Chirag Agarwal, and Marinka Zitnik. 2023. GNNDelete: A General Strategy for Unlearning in Graph Neural Networks. In ICLR. [30] Jingpu Cheng, Ping Liu, Qianxiao Li, and CHI ZHANG. 2026. Machine Unlearning under Retain–Forget Entanglement. In ICLR. [31] Xinwen Cheng, Zhehao Huang, Wenxin Zhou, Zhengbao He, Ruikai Yang, Yingwen Wu, and Xiaolin Huang. 2026. Remaining-data-free machine unlearning by suppressing sample contribution. In ICLR. [32] Eli Chien, Haoyu Wang, Ziang Chen, and Pan Li. 2024. Certified machine unlearning via noisy stochastic gradient descent. In NeurIPS. [33] Eli Chien, Haoyu Wang, Ziang Chen, and Pan Li. 2024. Langevin unlearning: A new perspective of noisy gradient descent for machine unlearning. In NeurIPS. [34] Somnath Basu Roy Chowdhury, Krzysztof Marcin Choromanski, Arijit Sehanobish, Kumar Avinava Dubey, and Snigdha Chaturvedi. 2025. Towards Scalable Exact Machine Unlearning Using Parameter-Efficient Fine-Tuning. In ICLR. [35] Kaiyuan Deng, Gen Li, Yang Xiao, Bo Hui, and Xiaolong Ma. 2026. Forget Many, Forget Right: Scalable and Precise Concept Unlearning in Diffusion Models. In ICLR. [36] Zonglin Di, Sixie Yu, Yevgeniy Vorobeychik, and Yang Liu. 2025. Adversarial Machine Unlearning. In ICLR. [37] Zonglin Di, Zhaowei Zhu, Jinghan Jia, Jiancheng Liu, Zafar Takhirov, Bo Jiang, Yuanshun Yao, Sijia Liu, and Yang Liu. 2026. Label smoothing improves machine unlearning. In ICLR. [38] Jingfeng Zhang Di Zhao, Hongsheng Hu, Philippe Fournier-Viger, Gillian Dobbie, and Yun Sing Koh. 2026. UNLEARNING DURING TRAINING: DOMAINSPECIFIC GRADIENT ASCENT FOR DOMAIN GENERALIZATION. In ICLR. [39] Chenlu Ding, Jiancan Wu, Yancheng Yuan, Jinda Lu, Kai Zhang, Alex Su, Xiang Wang, and Xiangnan He. 2025. Unified Parameter-Efficient Unlearning for LLMs. In ICLR. [40] Junhao Dong, Hao Zhu, Yifei Zhang, Xinghua Qu, Yew-Soon Ong, and Piotr Koniusz. 2025. Machine unlearning via task simplex arithmetic. In NeurIPS. [41] Alexey Dosovitskiy. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 (2020). [42] Yonatan Dukler, Benjamin Bowman, Alessandro Achille, Aditya Golatkar, Ashwin Swaminathan, and Stefano Soatto. 2023. Safe: Machine unlearning with shard graphs. In ICCV.

In this paper, we present an SoK for both unlearnability and unlearning within a unified model dememorization framework. We examine the problem of shallow dememorization and connect upstream unlearnability defenses with downstream unlearning through empirical analysis and parameter-space theory. Our study reveals how unlearnability influences subsequent unlearning tasks, situating the current status of both fields and bridging two research areas that have thus far evolved largely in isolation. Ultimately, we aim to highlight future research directions that strengthen the right to withhold knowledge from unauthorized ML models.

Ethics Considerations This work considers the ethical implications of our research on model dememorization using the principles outlined in the Menlo Report: Beneficence, Respect for Persons, Justice, and Respect for Law and Public Interest. Beneficence. Our research aims to advance model dememorization studies, minimizing risks to users by identifying and categorizing potential threats. We carefully consider both positive and negative potential impacts, such as improving defense mechanisms while mitigating the risks of data misuse by adversaries. Respect for persons. We prioritize transparency and accountability, ensuring our findings serve to empower stakeholders while avoiding harm. No human subjects were involved in this work, and no deceptive practices were employed. Justice. Our methodology seeks to equitably benefit diverse stakeholders, including researchers, practitioners, and users. Respect for law and public interest. We adhere to all applicable laws and ethical standards in conducting our research, ensuring no violation of terms of service or legal frameworks. We disclose findings responsibly to avoid enabling adversarial actions.

References [1] 2016. GDPR Article 17: Right to Erasure. gdpr-info.eu. https://gdpr-info.eu/art17-gdpr/ [2] 2023. California Consumer Privacy Act (CCPA) & CPRA Overview. California Department of Justice. https://www.oag.ca.gov/privacy/ccpa [3] 2024. CCPA/CPRA Regulations. California Privacy Protection Agency. https://cppa.ca.gov/regulations/ [4] 2024. Regulation (EU) 2024/1689: Artificial Intelligence Act. Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng [5] Anna Ablove, Shreyas Chandrashekaran, Xiao Qiang, and Roya Ensafi. 2026. Characterizing the Implementation of Censorship Policies in Chinese LLM Services. In NDSS. [6] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 Technical Report. arXiv preprint arXiv:2303.08774 (2023). [7] Sk Miraj Ahmed, Umit Yigit Basaran, Dripta S Raychaudhuri, Arindam Dutta, Rohit Kundu, Fahim Faisal Niloy, Basak Guler, and Amit K Roy-Chowdhury. 2025. Towards Source-Free Machine Unlearning. In CVPR. [8] Silas Alberti, Kenan Hasanaliyev, Manav Shah, and Stefano Ermon. 2025. Data Unlearning in Diffusion Models. In ICLR. [9] Nasser Aldaghri, Hessam Mahdavifar, and Ahmad Beirami. 2021. Coded machine unlearning. IEEE Access 9 (2021), 88137–88150. [10] Youssef Allouah, Rachid Guerraoui, and Sanmi Koyejo. 2026. Distributional Machine Unlearning via Selective Data Removal. In ICLR. [11] Youssef Allouah, Joshua Kazdan, Rachid Guerraoui, and Sanmi Koyejo. 2025. The Utility and Complexity of In-and Out-of-Distribution Machine Unlearning. In ICLR. [12] Sadia Asif and Mohammad Mohammadi Amiri. 2026. OFMU: OptimizationDriven Framework for Machine Unlearning. In ICLR. 14

[43] Cynthia Dwork. 2006. Differential privacy. In International Colloquium on Automata, Languages, and Programming. [44] Taha Entesari, Arman Hatami, Rinat Khaziev, Anil Ramakrishna, and Mahyar Fazlyab. 2025. Constrained Entropic Unlearning: A Primal-Dual Framework for Large Language Models. In NeurIPS. [45] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. 2024. Scaling Rectified Flow Transformers for High-Resolution Image Synthesis. In ICML. [46] Simone Facchiano, Stefano Saravalle, Matteo Migliarini, Edoardo De Matteis, Alessio Sampieri, Andrea Pilzer, Emanuele Rodolà, Indro Spinelli, Luca Franco, and Fabio Galasso. 2026. Video unlearning via low-rank refusal vector. In ICLR. [47] Chongyu Fan, Jiancheng Liu, Licong Lin, Jinghan Jia, Ruiqi Zhang, Song Mei, and Sijia Liu. 2025. Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning. In NeurIPS. [48] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. 2024. SalUn: Empowering Machine Unlearning via Gradient-Based Weight Saliency in Both Image Classification and Generation. In International Conference on Learning Representations. [49] Bin Fang, Bo Li, Shuang Wu, Shouhong Ding, Ran Yi, and Lizhuang Ma. 2024. Re-thinking data availability attacks against deep neural networks. In CVPR. [50] XiaoHua Feng, Yuyuan Li, Chaochao Chen, Li Zhang, Longfei Li, JUN ZHOU, and Xiaolin Zheng. 2025. Controllable Unlearning for Image-to-Image Generative Models via 𝜖 -Constrained Optimization. In ICLR. [51] Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojciech Czaja, and Tom Goldstein. 2021. Adversarial examples make strong poisons. In NeurIPS. [52] Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. 2022. Robust Unlearnable Examples: Protecting Data Privacy Against Adversarial Learning. In ICLR. [53] Chongyang Gao, Lixu Wang, Kaize Ding, Chenkai Weng, Xiao Wang, and Qi Zhu. 2025. On Large Language Model Continual Unlearning. In ICLR. [54] Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. 2020. Shortcut learning in deep neural networks. Nature Machine Intelligence 2, 11 (2020), 665–673. [55] Kristian Georgiev, Roy Rinberg, Sung Min Park, Shivam Garg, Andrew Ilyas, Aleksander Madry, and Seth Neel. 2025. Attribute-to-delete: Machine unlearning via datamodel matching. In ICLR. [56] David Glukhov, Ilia Shumailov, Yarin Gal, Nicolas Papernot, and Vardan Papyan. 2024. Position: Fundamental Limitations of LLM Censorship Necessitate New Approaches. In ICML. [57] Vignesh Gokul and Shlomo Dubnov. 2024. Poscuda: Position based convolution for unlearnable audio datasets. arXiv preprint arXiv:2401.02135 (2024). [58] Aditya Golatkar, Alessandro Achille, Avinash Ravichandran, Marzia Polito, and Stefano Soatto. 2021. Mixed-privacy forgetting in deep networks. In CVPR. [59] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. 2020. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In CVPR. [60] Chen Gong, Kecen Li, Jin Yao, and Tianhao Wang. 2025. TrajDeleter: Enabling Trajectory Forgetting in Offline Reinforcement Learning Agents. In NDSS. [61] Xueluan Gong, Yuji Wang, Yanjiao Chen, Haocheng Dong, Yiming Li, Mengyuan Sun, Shuaike Li, Qian Wang, and Chen Chen. 2025. Armor: Shielding unlearnable examples against data augmentation. arXiv preprint arXiv:2501.08862 (2025). [62] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. 2021. Amnesiac machine learning. In AAAI. [63] Hanlin Gu, Hong Xi Tae, Lixin Fan, and Chee Seng Chan. 2026. Towards Privacy-Guaranteed Label Unlearning in Vertical Federated Learning: Few-Shot Forgetting Without Disclosure. In ICLR. [64] Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. 2020. Certified data removal from machine learning models. In ICML. [65] Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025. Deepseek-r1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning. arXiv preprint arXiv:2501.12948 (2025). [66] Varun Gupta, Christopher Jung, Seth Neel, Aaron Roth, Saeed Sharifi-Malvajerdi, and Chris Waites. 2021. Adaptive machine unlearning. In NeurIPS. [67] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition. 770–778. [68] Pengfei He, Han Xu, Jie Ren, Yingqian Cui, Shenglai Zeng, Hui Liu, Charu C Aggarwal, and Jiliang Tang. 2024. Sharpness-Aware Data Poisoning Attack. In ICLR. [69] Robert Hönig, Javier Rando, Nicholas Carlini, and Florian Tramèr. 2025. Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. In ICLR. [70] Hsiang Hsu, Pradeep Niroula, Zichang He, Ivan Brugere, Freddy Lecue, and Chun-Fu Chen. 2025. The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples. In NeurIPS.

[71] Jinwei Hu, Zhenglin Huang, Xiangyu Yin, Wenjie Ruan, Guangliang Cheng, Yi Dong, and Xiaowei Huang. 2025. FALCON: Fine-grained Activation Manipulation by Contrastive Orthogonal Unalignment for Large Language Model. In NeurIPS. [72] Shengyuan Hu, Yiwei Fu, Steven Wu, and Virginia Smith. 2025. Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning. In ICLR. [73] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. 2017. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition. 4700–4708. [74] Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. 2021. Unlearnable Examples: Making Personal Data Unexploitable. In ICLR. [75] W Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. 2020. Metapoison: Practical general-purpose clean-label data poisoning. In NeurIPS. [76] Zhehao Huang, Xinwen Cheng, JingHao Zheng, Haoran Wang, Zhengbao He, Tao Li, and Xiaolin Huang. 2024. Unified gradient-based machine unlearning with remain geometry enhancement. In NeurIPS. [77] Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. 2021. Approximate data deletion from machine learning models. In International conference on artificial intelligence and statistics. PMLR, 2008–2016. [78] Jiabao Ji, Yujian Liu, Yang Zhang, Gaowen Liu, Ramana R Kompella, Sijia Liu, and Shiyu Chang. 2024. Reversing the forget-retain objectives: An efficient llm unlearning framework from logit difference. In NeurIPS. [79] Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. 2023. Model sparsity can simplify machine unlearning. In NeurIPS. [80] Jinghan Jia, Jiancheng Liu, Yihua Zhang, Parikshit Ram, Nathalie Baracaldo, and Sijia Liu. 2024. Wagle: Strategic weight attribution for effective and modular unlearning in large language models. In NeurIPS. [81] Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7B. arXiv preprint arXiv:2310.06825 (2023). [82] Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. 2023. Mistral 7B. arXiv:2310.06825 [cs.CL] https: //arxiv.org/abs/2310.06825 [83] Kodai Kawamura, Yuta Goto, Rintaro Yanagi, Hirokatsu Kataoka, and Go Irie. 2025. Approximate Domain Unlearning for Vision-Language Models. In NeurIPS. [84] Yasser H Khalil, Leo Brunswic, Soufiane Lamghari, Xu Li, Mahdi Beitollahi, and Xi Chen. 2025. NoT: Federated Unlearning via Weight Negation. In CVPR. [85] Yasser H Khalil, Mehdi Setayesh, and Hongliang Li. 2025. CoUn: Empowering Machine Unlearning via Contrastive Learning. In NeurIPS. [86] Hoki Kim, Keonwoo Kim, Sungwon Chae, and Sangwon Yoon. 2025. UnlearningAware Minimization. In NeurIPS. [87] Miso Kim, Georu Lee, Yunji Kim, Hoki Kim, Jinseong Park, and Woojin Lee. 2026. Co-occurring Associated REtained concepts in Diffusion Unlearning. In ICLR. [88] Pang Wei Koh and Percy Liang. 2017. Understanding black-box predictions via influence functions. In International conference on machine learning. PMLR, 1885–1894. [89] Anastasia Koloskova, Youssef Allouah, Animesh Jha, Rachid Guerraoui, and Sanmi Koyejo. 2025. Certified unlearning for neural networks. In ICML. [90] Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009). [91] Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. 2023. Towards unbounded machine unlearning. In NeurIPS. [92] Yicheng Lang, Yihua Zhang, Chongyu Fan, Changsheng Wang, Jinghan Jia, and Sijia Liu. 2026. Downgrade to Upgrade: Optimizer Simplification Enhances Robustness in LLM Unlearning. In ICLR. [93] Bruce W Lee, Addie Foote, Alex Infanger, Leni Shor, Harish K Kamath, Jacob Goldman-Wetzler, Bryce Woodworth, Alex Cloud, and Alexander Matt Turner. 2025. Distillation Robustifies Unlearning. In NeurIPS. [94] Justin Lee, Zheda Mai, Jinsu Yoo, Chongyu Fan, Cheng Zhang, and Wei-Lun Chao. 2026. Continual Unlearning for Text-to-Image Diffusion Models: A Regularization Perspective. In ICLR. [95] SangYong Lee, Sangjun Chung, and Simon S Woo. 2025. RUAGO: Effective and Practical Retain-Free Unlearning via Adversarial Attack and OOD Generator. In NeurIPS. [96] Boheng Li, Renjie Gu, Junjie Wang, Leyi Qi, Yiming Li, Run Wang, Zhan Qin, and Tianwei Zhang. 2025. Towards Resilient Safety-driven Unlearning for Diffusion Models against Downstream Fine-tuning. In NeurIPS. [97] Guihong Li, Hsiang Hsu, Chun-Fu Chen, and Radu Marculescu. 2024. Machine Unlearning for Image-to-Image Generative Models. In ICLR. 15

[128] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. 2022. Diffusion Models for Adversarial Purification. In ICML. [129] Aaradhya Pandey, Arnab Auddy, Haolin Zou, Arian Maleki, and Sanjeev Kulkarni. 2025. Gaussian Certified Unlearning in High Dimensions: A Hypothesis Testing Approach. In NeurIPS. [130] Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. 2024. Direct unlearning optimization for robust and safe text-to-image models. In NeurIPS. [131] Martin Pawelczyk, Jimmy Z Di, Yiwei Lu, Gautam Kamath, Ayush Sekhari, and Seth Neel. 2025. Machine Unlearning Fails to Remove Data Poisoning Attacks. In ICLR. [132] Martin Pawelczyk, Seth Neel, and Himabindu Lakkaraju. 2024. In-Context Unlearning: Language Models as Few-Shot Unlearners. In ICML. [133] Weiqi Peng and Jinghui Chen. 2022. Learnability Lock: Authorized Learnability Control Through Adversarial Invertible Transformations. In ICLR. [134] Xinbao Qiao, Meng Zhang, Ming Tang, and Ermin Wei. 2025. Hessian-Free Online Certified Unlearning. In ICML. [135] Yijun Quan, Zushu Li, and Giovanni Montana. 2025. Efficient Verified Machine Unlearning For Distillation. In NeurIPS. [136] Jie Ren, Han Xu, Yuxuan Wan, Xingjun Ma, Lichao Sun, and Jiliang Tang. 2023. Transferable Unlearnable Examples. In ICLR. [137] Jie Ren, DAI Zhenwei, Xianfeng Tang, Yue Xing, Shenglai Zeng, Hui Liu, Jingying Zeng, Qiankun Peng, Samarth Varshney, Suhang Wang, et al. 2025. Keeping an Eye on LLM Unlearning: The Hidden Risk and Remedy. In NeurIPS. [138] Keivan Rezaei, Mehrdad Saberi, Abhilasha Ravichander, and Soheil Feizi. 2026. Revisiting the Past: Data Unlearning with Model State History. In ICLR. [139] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. 2015. Imagenet large scale visual recognition challenge. International journal of computer vision 115, 3 (2015), 211–252. [140] Vinu Sankar Sadasivan, Mahdi Soltanolkotabi, and Soheil Feizi. 2023. Cuda: Convolution-based unlearnable datasets. In CVPR. [141] Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, and Tom Goldstein. 2023. What can we learn from unlearnable datasets?. In NeurIPS. [142] Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, Tom Goldstein, and David Jacobs. 2022. Autoregressive perturbations for data poisoning. NeurIPS (2022). [143] Stefan Schoepf, Michael Curtis Mozer, Nicole Elyse Mitchell, Alexandra Brintrup, Georgios Kaissis, Peter Kairouz, and Eleni Triantafillou. 2026. Redirection for erasing memory (rem): Towards a universal unlearning method for corrupted data. In ICLR. [144] Yan Scholten, Sophie Xhonneux, Leo Schwinn, and Stephan Günnemann. 2026. Model collapse is not a bug but a feature in machine unlearning for llms. In ICLR. [145] Ayush Sekhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. 2021. Remember what you want to forget: Algorithms for machine unlearning. In NeurIPS. [146] Nazanin Mohammadi Sepahvand, Eleni Triantafillou, Hugo Larochelle, Doina Precup, James J Clark, Daniel M Roy, and Gintare Karolina Dziugaite. 2025. Selective unlearning via representation erasure using domain adversarial training. In ICLR. [147] Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison frogs! targeted clean-label poisoning attacks on neural networks. In NeurIPS. [148] Simra Shahid, Abhinav Java, and Chirag Agarwal. 2025. Towards Operationalizing Right to Data Protection. In NAACL. [149] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. 2023. Glaze: Protecting artists from style mimicry by { Text-toImage } models. In USENIX Security. [150] Shawn Shan, Wenxin Ding, Josephine Passananti, Stanley Wu, Haitao Zheng, and Ben Y Zhao. 2024. Nightshade: Prompt-specific poisoning attacks on textto-image generative models. In SP. [151] Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. 2020. Fawkes: Protecting Personal Privacy against Unauthorized Deep Learning Models. In USENIX Security. [152] Juncheng Shen, Xiaolei Zhu, and De Ma. 2019. TensorClog: An imperceptible poisoning attack on deep neural network applications. IEEE Access 7 (2019), 41498–41506. [153] Shaofei Shen, Chenhao Zhang, Yawen Zhao, Alina Bialkowski, Weitong Tony Chen, and Miao Xu. 2024. Label-Agnostic Forgetting: A Supervision-Free Unlearning in Deep Models. In ICLR. [154] William F Shen, Xinchi Qiu, Meghdad Kurmanji, Alex Iacob, Lorenzo Sani, Yihong Chen, Nicola Cancedda, and Nicholas D Lane. 2025. LLM Unlearning via Neural Activation Redirection. In NeurIPS. [155] Ilia Shumailov, Jamie Hayes, Eleni Triantafillou, Guillermo Ortiz-Jimenez, Nicolas Papernot, Matthew Jagielski, Itay Yona, Heidi Howard, and Eugene Bagdasaryan. 2024. Ununlearning: Unlearning is not sufficient for content regulation

[98] Jiaqi Li, Qianshan Wei, Chuanyi Zhang, Guilin Qi, Miaozeng Du, Yongrui Chen, Sheng Bi, and Fan Liu. 2024. Single image unlearning: Efficient machine unlearning in multimodal large language models. In NeurIPS. [99] Jiaqi Li, Zihan You, Ruoyan Shen, Shenyu Zhang, Songlin Zhai, Yongrui Chen, Chuanyi Zhang, Jiahui Geng, Fakhri Karray, Sheng Bi, et al. 2026. Knowledge Externalization: Reversible Unlearning and Modular Retrieval in Multimodal Large Language Models. In ICLR. [100] Kemou Li, Qizhou Wang, Yue Wang, Fengpeng Li, Jun Liu, Bo Han, and Jiantao Zhou. 2026. Llm unlearning with llm beliefs. In ICLR. [101] Xinzhe Li, Ming Liu, and Shang Gao. 2023. Make Text Unlearnable: Exploiting Effective Patterns to Protect Personal Data. In TrustNLP 2023. [102] Yuyuan Li, Chaochao Chen, Yizhao Zhang, Weiming Liu, Lingjuan Lyu, Xiaolin Zheng, Dan Meng, and Jun Wang. 2023. Ultrare: Enhancing receraser for recommendation unlearning via error decomposition. In NeurIPS. [103] Zhihao Li, Jiale Cai, Gezheng Xu, Hao Zheng, Qiuyue Li, Fan Zhou, Shichun Yang, Charles Ling, and Boyu Wang. 2025. Versatile Transferable Unlearnable Example Generator. In NeurIPS. [104] Zhihao Li, Gezheng Xu, Jiale Cai, Ruiyi Fang, Di Wu, Qicheng Lao, Charles Ling, and Boyu Wang. 2026. When Priors Backfire: On the Vulnerability of Unlearnable Examples to Pretraining. In ICLR. [105] Junfeng Liao, Qizhou Wang, Shanshan Ye, Xin Yu, Ling Chen, and Zhen Fang. 2026. Explainable LLM Unlearning through Reasoning. In ICLR. [106] Chris Liu, Yaxuan Wang, Jeffrey Flanigan, and Yang Liu. 2024. Large language model unlearning via embedding-corrupted prompts. In NeurIPS. [107] Hanwen Liu, Zhicheng Sun, and Yadong Mu. 2024. Countering personalized text-to-image generation with influence watermarks. In CVPR. [108] Jinlin Liu, Wei Chen, and Xiaojin Zhang. 2026. Perturbation-Induced Linearization: Constructing Unlearnable Data with Solely Linear Classifiers. In ICLR. [109] Jiaqi Liu, Jian Lou, Zhan Qin, and Kui Ren. 2023. Certified minimax unlearning with generalization rates and deletion capacity. In NeurIPS. [110] Ruixuan Liu, Toan Tran, Tianhao Wang, Hongsheng Hu, Shuo Wang, and Li Xiong. 2026. Expshield: Safeguarding web text from unauthorized crawling and language modeling exploitation. In NDSS. [111] Shuang Liu, Yihan Wang, and Xiao-Shan Gao. 2024. Game-theoretic unlearnable example generator. In AAAI. [112] Xinwei Liu, Xiaojun Jia, Yuan Xun, Siyuan Liang, and Xiaochun Cao. 2024. Multimodal unlearnable examples: Protecting data against multimodal contrastive learning. In ACM MM. [113] Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. 2024. Metacloak: Preventing unauthorized subject-driven text-to-image diffusionbased synthesis via meta-learning. In CVPR. [114] Yixin Liu, Kaidi Xu, Xun Chen, and Lichao Sun. 2024. Stable unlearnable example: Enhancing the robustness of unlearnable examples via stable error-minimizing noise. In AAAI. [115] Ziwen Liu, Huawei Lin, Yide Ran, Denghui Zhang, Jianwen Xie, Chuan Li, Weijie Zhao, and Zhaozhuo Xu. 2026. Randomized Antipodal Search Done Right for Data Pareto Improvement of LLM Unlearning. In ICLR. [116] Zhuoran Liu, Zhengyu Zhao, Alex Kolmus, Tijn Berns, Twan van Laarhoven, Tom Heskes, and Martha Larson. 2021. Going grayscale: The road to understanding and improving unlearnable examples. arXiv preprint arXiv:2111.13244 (2021). [117] Zhuoran Liu, Zhengyu Zhao, and Martha Larson. 2023. Image shortcut squeezing: Countering perturbative availability poisons with compression. In ICML. [118] Ximing Lu, Sean Welleck, Jack Hessel, Liwei Jiang, Lianhui Qin, Peter West, Prithviraj Ammanabrolu, and Yejin Choi. 2022. Quark: Controllable text generation with reinforced unlearning. In NeurIPS. [119] Xingjun Ma, Hanxun Huang, Tianwei Song, Ye Sun, Yifeng Gao, and Yu-Gang Jiang. 2025. T2UE: Generating Unlearnable Examples from Text Descriptions. In ACM MM. [120] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In ICLR. [121] Syed Irfan Ali Meerza, Jian Liu, and Lichao Sun. 2024. Harmonycloak: Making music unlearnable for generative ai. In IEEE SP. [122] Ronak Mehta, Sourav Pal, Vikas Singh, and Sathya N Ravi. 2022. Deep unlearning via randomized conditionally independent hessians. In CVPR. [123] Ruohan Meng, Chenyu Yi, Yi Yu, Siyuan Yang, Bingquan Shen, and Alex C Kot. 2024. Semantic deep hiding for robust unlearnable examples. IEEE Transactions on Information Forensics and Security 19 (2024), 6545–6558. [124] Siqiao Mu and Diego Klabjan. 2025. Rewind-to-Delete: Certified Machine Unlearning for Nonconvex Functions. In NeurIPS. [125] Seth Neel, Aaron Roth, and Saeed Sharifi-Malvajerdi. 2021. Descent-to-delete: Gradient-based methods for machine unlearning. In ALT. [126] Aviraj Newatia, Michael Cooper, Viet Nguyen, and Rahul G Krishnan. 2026. Mitigating Privacy Risk via Forget Set-Free Unlearning. In ICLR. [127] Quoc Phong Nguyen, Bryan Kian Hsiang Low, and Patrick Jaillet. 2020. Variational bayesian unlearning. In NeurIPS. 16

in advanced generative ai. arXiv preprint arXiv:2407.00106 (2024). [156] Shoaib Ahmed Siddiqui, Adrian Weller, David Krueger, Gintare Karolina Dziugaite, Michael Curtis Mozer, and Eleni Triantafillou. 2025. From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization. In NeurIPS. [157] Sidak Pal Singh and Dan Alistarh. 2020. Woodfisher: Efficient second-order approximation for neural network compression. Advances in Neural Information Processing Systems 33 (2020), 18098–18109. [158] Christoforos N Spartalis, Theodoros Semertzidis, Efstratios Gavves, and Petros Daras. 2025. LoTUS: Large-Scale Machine Unlearning with a Taste of Uncertainty. In CVPR. [159] Yize Sui, Jing Ren, Wenjing Yang, Ruochun Jin, Liyang Xu, Xiyao Liu, and Ji Wang. 2025. Elastic Robust Unlearning of Specific Knowledge in Large Language Models. In NeurIPS. [160] Weixiang Sun, Yixin Liu, Zhiling Yan, Kaidi Xu, and Lichao Sun. 2024. Medical Unlearnable Examples: Securing Medical Data from Unauthorized Training via Sparsity-Aware Local Masking. In ICML Workshop on Next Generation of AI Safety. [161] Ye Sun, Hao Zhang, Tiehua Zhang, Xingjun Ma, and Yu-Gang Jiang. 2024. Unseg: One universal unlearnable example generator is enough against all image segmentation. In NeurIPS. [162] Chenchen Tan, Youyang Qu, Xinghao Li, Hui Zhang, Shujie Cui, Cunjian Chen, and Longxiang Gao. 2025. Wisdom is Knowing What not to Say: HallucinationFree LLMs Unlearning via Attention Shifting. In NeurIPS. [163] Haoran Tang and Rajiv Khanna. 2026. Sharpness-Aware Machine Unlearning. In ICLR. [164] Lue Tao, Lei Feng, Jinfeng Yi, Sheng-Jun Huang, and Songcan Chen. 2021. Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training. In NeurIPS. [165] Ayush Kumar Tarun, Vikram Singh Chundawat, Murari Mandal, and Mohan Kankanhalli. 2023. Deep regression unlearning. In ICML. [166] Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. 2022. Unrolling SGD: Understanding factors influencing machine unlearning. In EuroS&P. [167] Enayat Ullah and Raman Arora. 2023. From adaptive query release to machine unlearning. In ICML. [168] Enayat Ullah, Tung Mai, Anup Rao, Ryan A Rossi, and Raman Arora. 2021. Machine unlearning via algorithmic stability. In COLT. [169] Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. 2023. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In ICCV. [170] Cheng-Long Wang, Mengdi Huai, and Di Wang. 2023. Inductive graph unlearning. In USENIX Security Symposium. [171] Derui Wang, Minhui Xue, Bo Li, Seyit Camtepe, and Liming Zhu. 2025. Provably Unlearnable Data Examples. In NDSS Symposium. [172] Shixuan Wang, Jingwen Ye, and Xinchao Wang. 2025. Machine Unlearning in 3D Generation: A Perspective-Coherent Acceleration Framework. In NeurIPS. [173] Xianlong Wang, Minghui Li, Wei Liu, Hangtao Zhang, Shengshan Hu, Yechao Zhang, Ziqi Zhou, and Hai Jin. 2024. Unlearnable 3D point clouds: Class-wise transformation is all you need. In NeurIPS. [174] Yaxuan Wang, Quan Liu, Chris Yuhao Liu, Jinlong Pang, Wei Wei, Yujia Bao, and Yang Liu. 2026. DRAGON: Guard LLM Unlearning in Context via Negative Detection and Reasoning. In ICLR. [175] Yizhong Wang, Swaroop Mishra, Pegah Alipoormolabashi, Yeganeh Kordi, Amirreza Mirzaei, Atharva Naik, Arjun Ashok, Arut Selvan Dhanasekaran, Anjana Arunkumar, David Stap, et al. 2022. Super-naturalinstructions: Generalization via declarative instructions on 1600+ nlp tasks. In Proceedings of the 2022 conference on empirical methods in natural language processing. 5085–5109. [176] Yaxuan Wang, Jiaheng Wei, Chris Yuhao Liu, Jinlong Pang, Quan Liu, Ankit Shah, Yujia Bao, Yang Liu, and Wei Wei. 2025. LLM Unlearning via Loss Adjustment with Only Forget Data. In ICLR. [177] Yihan Wang, Yifan Zhu, and Xiao-Shan Gao. 2024. Efficient availability attacks against supervised and contrastive learning simultaneously. In NeurIPS. [178] Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. 2023. Machine unlearning of features and labels. In NDSS Symposium. [179] Stanley Wei, Sadhika Malladi, Sanjeev Arora, and Amartya Sanyal. 2025. Provable unlearning in topic modeling and downstream tasks. In ICLR. [180] Rui Wen, Zhengyu Zhao, Zhuoran Liu, Michael Backes, Tianhao Wang, and Yang Zhang. 2023. Is Adversarial Training Really a Silver Bullet for Mitigating Data Poisoning?. In ICLR. [181] Qiangqiang Wu, Yi Yu, Chenqi Kong, Ziquan Liu, Jia Wan, Haoliang Li, Alex C Kot, and Antoni B Chan. 2025. Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Tracking. In ICCV. [182] Shutong Wu, Sizhe Chen, Cihang Xie, and Xiaolin Huang. 2023. One-Pixel Shortcut: On the Learning Preference of Deep Neural Networks. In ICLR. [183] Zhihao Wu, Yushi Cheng, Tianyang Sun, Xiaoyu Ji, and Wenyuan Xu. 2025. MYOPIA: Protecting Face Privacy from Malicious Personalized Text-to-Image

Synthesis via Unlearnable Examples. In AAAI. [184] Xiaoyu Xia, Ziqi Wang, Ruoxi Sun, Bowen Liu, Ibrahim Khalil, and Minhui Xue. 2025. Edge Unlearning is Not “on Edge”! An Adaptive Exact Unlearning System on Resource-Constrained Devices. In SP. [185] Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, and Xiaodong Lin. 2022. ARCANE: An Efficient Architecture for Exact Machine Unlearning.. In IJCAI. [186] Nakyeong Yang, Dong-Kyum Kim, Jea Kwon, Minsung Kim, Kyomin Jung, and Meeyoung Cha. 2026. Erase or Hide? Suppressing Spurious Unlearning Neurons for Robust Unlearning. In ICLR. [187] Yue Yang, Jinhao Li, and Hao Wang. 2025. Feature Unlearning: Theoretical Foundations and Practical Applications with Shuffling. In NeurIPS. [188] Yuanshun Yao, Xiaojun Xu, and Yang Liu. 2024. Large language model unlearning. In NeurIPS. [189] Dayong Ye, Tianqing Zhu, Congcong Zhu, Derui Wang, Kun Gao, Zewei Shi, Sheng Shen, Wanlei Zhou, and Minhui Xue. 2025. Reinforcement Unlearning. In NDSS. [190] Jingwen Ye and Xinchao Wang. 2024. Ungeneralizable examples. In CVPR. [191] Kai Ye, Liangcai Su, and Chenxiong Qian. 2025. How far are we from true unlearnability?. In ICLR. [192] Lu Yi and Zhewei Wei. 2025. Scalable and Certifiable Graph Unlearning: Overcoming the Approximation Error Barrier. In ICLR. [193] Sangyeon Yoon, Hyesoo Hong, Wonje Jeung, and Albert No. 2026. Rethinking Benign Relearning: Syntax as the Hidden Driver of Unlearning Failures. In ICLR. [194] Youngsik Yoon, Jinhwan Nam, Hyojeong Yun, Jaeho Lee, Dongwoo Kim, and Jungseul Ok. 2024. Few-shot Unlearning. In SP. [195] Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu. 2022. Availability attacks create shortcuts. In KDD. [196] Guangsheng Yu, Yanna Jiang, Qin Wang, Xu Wang, Baihe Ma, Caijun Sun, Wei Ni, and Ren Ping Liu. 2025. Split unlearning. In CCS. [197] Liheng Yu, Zhe Zhao, Yuxuan Wang, Pengkun Wang, Xiaofeng Cao, Binwu Wang, and Yang Wang. 2026. FaLW: A Forgetting-aware Loss Reweighting for Long-tailed Unlearning. In ICLR. [198] Chia-Hung Yuan and Shan-Hung Wu. 2021. Neural Tangent Generalization Attacks. In ICML. [199] Saleh Zare Zade, Xiangyu Zhou, Sijia Liu, and Dongxiao Zhu. 2026. Attention Smoothing Is All You Need For Unlearning. In ICLR. [200] Efstratios Zaradoukas, Bardh Prenkaj, and Gjergji Kasneci. 2026. Reinforcement Unlearning via Group Relative Policy Optimization. In ICLR. [201] Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. 2023. Narcissus: A practical clean-label backdoor attack with limited information. In CCS. [202] Binchi Zhang, Yushun Dong, Tianhao Wang, and Jundong Li. 2024. Towards certified unlearning for deep neural networks. In ICML. [203] Chenlong Zhang, Zhuoran Jin, Hongbang Yuan, Jiaheng Wei, Tong Zhou, Kang Liu, Jun Zhao, and Yubo Chen. 2025. RULE: Reinforcement UnLEarning Achieves Forget-retain Pareto Optimality. In NeurIPS. [204] Jiaming Zhang, Xingjun Ma, Qi Yi, Jitao Sang, Yu-Gang Jiang, Yaowei Wang, and Changsheng Xu. 2023. Unlearnable clusters: Towards label-agnostic unlearnable examples. In CVPR. [205] Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. 2024. Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning. In COLM. [206] Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. 2024. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. In NeurIPS. [207] Zhisheng Zhang, Derui Wang, Qianyi Yang, Pengyang Huang, Junhan Pu, Yuxin Cao, Kai Ye, Jie Hao, and Yixian Yang. 2025. SafeSpeech: Robust and Universal Voice Protection Against Malicious Speech Synthesis. In USENIX Security. [208] Zhisheng Zhang, Qianyi Yang, Derui Wang, Pengyang Huang, Yuxin Cao, Kai Ye, and Jie Hao. 2024. Mitigating unauthorized speech synthesis for voice protection. In ACM CCS Workshop on Large AI Systems and Models with Privacy and Safety Analysis. [209] Zhiling Zhang, Jie Zhang, Kui Zhang, Wenbo Zhou, Ting Xu, Daiheng Gao, Zixian Guo, Qinglang Guo, Weiming Zhang, and Nenghai Yu. 2025. Segue: Side-information guided generative unlearnable examples for facial privacy protection in real world. In ICASSP. [210] Zijie Zhang, Yang Zhou, Xin Zhao, Tianshi Che, and Lingjuan Lyu. 2022. Prompt certified machine unlearning with randomized gradient smoothing and quantization. In NeurIPS. [211] Kairan Zhao, Meghdad Kurmanji, George-Octavian Bărbulescu, Eleni Triantafillou, and Peter Triantafillou. 2024. What makes unlearning hard and what to do about it. In NeurIPS. [212] Xingyi Zhao, Tian Xie, Xiaojun Qi, Depeng Xu, and Shuhan Yuan. 2026. Don’t Shift the Trigger: Robust Gradient Ascent for Backdoor Unlearning. In ICLR. [213] Zhengyue Zhao, Jinhao Duan, Xing Hu, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Yunji Chen. 2024. Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitation. In ICLR Workshop on Reliable and Responsible Foundation Models. 17

Table 7: Experimental settings for the recovery of P-DLCtrained models.

[214] Xuyang Zhong, Haochen Luo, and Chen Liu. 2025. DualOptim: Enhancing Efficacy and Stability in Machine Unlearning with Dual Optimizers. In NeurIPS. [215] Zhengyi Zhong, Weidong Bao, Ji Wang, Shuai Zhang, Jingxuan Zhou, Lingjuan Lyu, and Wei Yang Bryan Lim. 2025. Unlearning through knowledge overwriting: Reversible federated unlearning via selective sparse adapter. In CVPR. [216] Shiji Zhou, Tianbai Yu, Zhi Zhang, Heng Chang, Xiao Zhou, Dong Wu, and Han Zhao. 2025. Efficient Utility-Preserving Machine Unlearning with Implicit Gradient Surgery. In NeurIPS. [217] Xin Zhou, Yi Lu, Ruotian Ma, Yujian Wei, Tao Gui, Qi Zhang, and Xuan-Jing Huang. 2024. Making Harmful Behaviors Unlearnable for Large Language Models. In Findings of ACL. [218] Yu Zhou, Dian Zheng, Qijie Mo, Renjie Lu, Kun-Yu Lin, and Wei-Shi Zheng. 2025. Decoupled distillation to erase: A general unlearning method for any class-centric tasks. In CVPR. [219] Chen Zhu, W Ronny Huang, Hengduo Li, Gavin Taylor, Christoph Studer, and Tom Goldstein. 2019. Transferable clean-label poisoning attacks on deep neural nets. In ICML. [220] Jianing Zhu, Bo Han, Jiangchao Yao, Jianliang Xu, Gang Niu, and Masashi Sugiyama. 2026. Decoupling the class label and the target concept in machine unlearning. In ICLR. [221] Xiaoyuan Zhu, Muru Zhang, Ollie Liu, Robin Jia, and Willie Neiswanger. 2025. LLM Unlearning Without an Expert Curated Dataset. In COLM. [222] Yifan Zhu, Yibo Miao, Yinpeng Dong, and Xiao-Shan Gao. 2026. Why Do Unlearnable Examples Work: A Novel Perspective of Mutual Information. In ICLR. [223] PENG Zhuoyi, Yixuan Tang, and Yi Yang. 2025. Adversarial Mixup Unlearning. In ICLR.

recovery

epochs

weight decay

momentum

augment

CIFAR-10 CIFAR-100 ImageNet

60 100 100

0.1 0.1 0.1

5 × 10−4 5 × 10−5 5 × 10−5

0.9 0.9 0.9

RandomCrop, RandomHorizontalFlip RandomCrop,RandomHorizontalFlip,RandomRotation RandomResizedCrop,RandomHorizontalFlip,ColorJitter

DenseNet-121

CIFAR-10 CIFAR-100 ImageNet

60 100 100

0.1 0.1 0.1

5 × 10−4 5 × 10−5 5 × 10−5

0.9 0.9 0.9

RandomCrop, RandomHorizontalFlip RandomCrop,RandomHorizontalFlip,RandomRotation RandomResizedCrop,RandomHorizontalFlip,ColorJitter

ViT-Tiny

CIFAR-10 CIFAR-100 ImageNet

60 100 150

3 × 10−4 3 × 10−4 1 × 10−3

0.05 0.05 0.1

RandomCrop, RandomHorizontalFlip RandomCrop,RandomHorizontalFlip,RandomRotation RandomResizedCrop,RandomHorizontalFlip,ColorJitter

weight decay

momentum

augment

0.01 0.01 0.1

5 × 10−4 5 × 10−5 5 × 10−5

0.9 0.9 0.9

RandomCrop, RandomHorizontalFlip RandomCrop,RandomHorizontalFlip,RandomRotation RandomResizedCrop,RandomHorizontalFlip,ColorJitter

IF (𝛼) P-DLC

TUE

FT (lr)

𝐷𝑢 ▽ 0.5

𝐷𝑐 △ 5

▽ 0.5

GA (lr)

𝐷𝑢

𝐷𝑐

𝐷𝑢

𝐷𝑐

△

▽

△

▽

△

▽

△

▽

△

5 × 10 −3

6 × 10 −2

5 × 10 −3

2.5 × 10 −2

3 × 10 −5

6 × 10 −5

3 × 10 −5

1.5 × 10 −4

6 × 10 −2

5 × 10 −3

2 × 10 −2

3 × 10 −5

3.5 × 10 −5

3 × 10 −5

8 × 10 −5

UE-s

0.3

5 × 10 −3

PUE

0.6

5 × 10 −3

6 × 10 −2

5 × 10 −3

2.5 × 10 −2

3 × 10 −5

8 × 10 −5

3 × 10 −5

2 × 10 −4

OPS

0.3

5 × 10 −3

6 × 10 −2

5 × 10 −3

2.5 × 10 −2

3 × 10 −5

1 × 10 −4

3 × 10 −5

1.5 × 10 −4

Table 9: Experimental settings for class-level unlearning. IF (𝛼)

FT (lr)

GA (lr)

P-DLC

Table 6: Experimental training settings. ResNet-18

60 100 100

Table 8: Experimental settings for subset-level unlearning.

Experiment Settings

train Set

epochs

Recovery of unlearned models. The recovery attack experiments are conducted on unlearned models obtained from the classlevel unlearning experiments described in Section ??. We select classes for which the IF, RT, and FT methods all achieve effective forgetting while preserving model utility as recovery targets. The corresponding unlearned models serve as the attack targets. Recovery attacks are performed using 10% of clean training data from the target class. For detailed parameters, see Table 7.

Unlearnable data generation. In our experiments, we adopt CIFAR-10, CIFAR-100, and ImageNet with 100 randomly selected categories as the datasets in our evaluation. We adopt the default settings from the original papers to generate PUE, OPS (2 pixel), UE-c (class-wise), TUE, UE-s (sample-wise), and TAP noises. Assessing unlearnability efficacy against unauthorized learning. We employ ResNet-18, DenseNet-121, and ViT-Tiny as unauthorized classifiers. ResNet-18 and DenseNet-121 are trained using the SGD optimizer, while ViT-Tiny is trained using AdamW. Except for the experiment in Figure 4, which evaluates the test accuracy of ViT-Tiny trained on P-DLC data both with and without augmentation, all other training settings use data augmentation by default. The detailed training settings are summarized in Table 6, which are kept consistent for both the clean and P-DLC training setups.

Model

train Set CIFAR-10 CIFAR-100 ImageNet

Recovery of models trained on unlearnability-protected data. We evaluate the empirical robustness of PUE, OPS, UE-c, TUE, UE-s, and TAP on ResNet-18 using recovery attacks across CIFAR-10, CIFAR100, and ImageNet. For ImageNet training with P-DLC noise, we use 100% of the first 100 classes as the class-wise P-DLC training set, and 20% of the first 100 classes as the sample-wise P-DLC training set (for efficiency). For CIFAR-10, CIFAR-100, and ImageNet, we conduct recovery attacks using 10% of their training sets. Attack effectiveness is then evaluated on the corresponding test sets of the three datasets. The detailed experimental settings and parameters are shown in Table 7. 18

▽

△

▽

△

▽

△

TUE

1.5 × 10 −2

3 × 10 −2

1.5 × 10 −5

1.1 × 10 −4

UE-s

1.5 × 10 −2

3 × 10 −2

1.1 × 10 −5

2.6 × 10 −5

PUE

1.5 × 10 −2

3 × 10 −2

1.7 × 10 −5

4.8 × 10 −5

OPS

1.5 × 10 −2

3 × 10 −2

1.7 × 10 −5

6.7 × 10 −5

Additional Experiment Results

This section presents additional experimental results. The impact of poisoning ratio. We test the impact of poisoning ratio on the effectiveness of unlearnability. For class-wise unlearnability method, applying a single perturbation per class is appealing for practical deployment. However, Figure 19 shows that the amount of unlearnability data may affect unlearnability. For example, UE-c requires sufficient coverage of perturbed ImageNet data to achieve adequate protection, while PUE remains more robust under reduced perturbation coverage. In contrast, unauthorized models can absorb more clean knowledge during training as more OPS-protected data are included, since pixel-level perturbations on high-resolution images are easily weakened by data augmentation, such as random cropping. Unlearnability-unlearning interaction. Class-level unlearning results on models trained with UE-s, TUE, PUE,and OPS are shown in Tables 14– 17, respectively. The corresponding subset-level unlearning results are reported in Tables 10– 13. Evaluation of shallow dememorization. Additional results of recovery attacks on unlearned classifiers trained on TUE, PUE, and OPS are shown in Figures 13– 15, respectively. Figures 16– 18 report the results of recovery attacks against unlearned classifiers using FT across classes 1–7.

FT RT

50 25 0

20 Epoch

Recovery Attack ( = 0.4) Before IF

GA FT

50 25 0

20 Epoch

100

Recovery Attack ( = 0.8)

75 50 25 0

Clean Before

20 Epoch

IF GA

FT RT

Recovery Attack ( = 0.8)

75 50 25 0

Before IF

20 Epoch

GA FT

Clean Train Accuracy (%)

IF GA

100

Clean Train Accuracy (%)

Clean Before

Clean Train Accuracy (%)

100

Recovery Attack ( = 0.4)

Clean Train Accuracy (%)

100

Recovery Attack ( = 1.2)

75 50 25 0

Clean Before

20 Epoch

IF GA

FT RT

Recovery Attack ( = 1.2)

75 50 25 0

Before IF

20 Epoch

GA FT

FT RT

50 25 0

20 Epoch

Recovery Attack ( = 0.4) Before IF

GA FT

50 25 0

20 Epoch

100

Recovery Attack ( = 0.8)

75 Clean Before

IF GA

FT RT

25 0

20 Epoch

Recovery Attack ( = 0.8)

75 50 25 0

Before IF

20 Epoch

GA FT

Clean Train Accuracy (%)

IF GA

100

Clean Train Accuracy (%)

Clean Before

Clean Train Accuracy (%)

100

Recovery Attack ( = 0.4)

Clean Train Accuracy (%)

100

Clean Train Accuracy (%)

Figure 13: Recovery attacks against unlearned classifiers trained on TUE from Table 15. Top: Recovery attack against the unlearned model with class 0 (TUE) removed. “‘clean” represents the pre-unlearning model where class 0 was trained with clean data. Bottom: Recovery attack against the unlearned model with class 5 (clean) removed.

100

Recovery Attack ( = 1.2)

75 50 25 0

Clean Before

20 Epoch

IF GA

FT RT

Recovery Attack ( = 1.2)

75 50 25 0

Before IF

20 Epoch

GA FT

Figure 14: Recovery attacks against unlearned classifiers trained on PUE from Table 16. Top: Recovery attack against the unlearned model with class 3 (PUE) removed. “‘clean” represents the pre-unlearning model where class 3 was trained with clean data. Bottom: Recovery attack against the unlearned model with class 6 (clean) removed. Table 10: The accuracy (%) of unlearned classifiers trained on UE-s (subset-level). Class 0 Forgetting Set

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method 𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

8.79

72.70

100

74.59

2.70

83.88

100

72.87

13.14

60.99

100

73.79

0.03

58.67

99.78

74.07

29.70

64.99

99.78

72.26

9.68

63.48

99.78

73.49

8.69

75.93

100

72.39

2.79

73.06

100

72.70

IF▽ IF△

100 72.86

71.78 25.11

100 50.67

74.29 67.14

100 15.28

82.35 34.30

99.33 45.33

74.37 63.17

99.93 0.42

53.16 0

98 0

74.18 65.63

100 81.06

52.72 15.58

100 52.67

74.41 69.59

99.90 1.80

61.43 0.05

99.50 0

73.98 56.38

99.90 2.42

52.54 0.07

97.78 0

74.24 62.41

99.98 11.83

72.30 2.42

99.78 2.22

73.94 63.07

100 91.95

73.06 35.09

100 67.56

74.50 68.72

𝐷𝑢 FT▽ FT△

99.93 2.91

74.47 59.11

100 70.89

73.89 64.40

99.95 21.75

85.31 89.16↑

100 93.33

73.70 64.13

99.98 13.26

66.57 40.07

99.78 41.56

74.11 62.71

99.98 0.03

58.32 47.24

100 57.11

73.86 66.99

100 27.06

72.40 43.01

99.78 52.44

73.53 61.70

99.85 0.15

60.44 0.30

98.89 0.44

74.02 56.85

99.98 16.17

83.26↑ 73.98

100 83.11

73.83 65.68

99.98 7.65

77.04↑ 72.82

100 82.22

74.19 67.98

GA▽ GA△

99.98 99.93

70.49 68.82

100 100

74.31 74.31

99.85 99.95

78.15 69.68

99.11 96.89

74.07 73.39

91.98 0

25.58 0

58 0

72.02 19.21

100 100

51.26 49.38

100 99.33

74.44 74.46

98.12 0

43.11 0

88.67 0

71.73 17.28

95.28 0

28.1 0

74.67 0

71.78 32.55

99.93 98.84

67.19 55.85

98.44 93.11

73.57 72.44

100 100

73.98 73.11

100 100

74.55 74.48

100

5.36

7.11

67.12

99.95

3.31

3.56

63.88

99.95

3.65

3.55

68.28

99.93

0.17

0.22

68.98

99.95

3.58

66.22

100

0.49

0.44

67.47

100

6.54

5.78

65.40

99.98

0.35

64.44

IF▽ IF△

100 76.44

67.85 3.85

100 5.56

74.19 62.13

100 15.28

82.35 34.3

99.33 45.33

74.37 63.17

99.88 0.12

45.26 0

93.78 0

73.74 63.05

99.98 1.95

15.09 0

49.78 0

70.77 13.17

99.88 0.32

55.90 0

98.22 0

73.76 57.27

99.58 0

27.43 0

72 0

72.09 33.01

99.98 57.7

67.85 0

99.33 0

73.61 60.84

100 86.05

62.12 0.03

98.89 0

73.67 61.13

FT▽ FT△

100 99.46

42.32 7.78

70.67 11.56

69.02 64.06

100 99.06

61.58 6.96

78.22 7.56

70.16 61.07

99.93 99.56

37.48 5.65

56.44 3.78

69.59 63.57

99.61 97.95

1.73 0.07

3.78 0.44

65.94 58.73

99.98 99.36

44.32 8.25

72.22 9.56

70.66 64.29

99.53 99.38

8.15 1.11

15.78 1.78

67.21 63.89

99.98 99.90

45.16 12.64

58.67 12.89

70.07 63.05

100 99.68

27.51 0.62

37.33 0.67

67.49 51.94

GA▽ GA△

100 99.93

72.62 61.41

100 99.56

74.45 73.47

100 100

84.54 81.33

99.78 99.33

74.60 74.48

99.98 78.22

57.78 4.89

98.89 7.11

74.34 66.54

100 0

20.20 0

68.22 0

71.78 10

99.98 94.74

65.53 23.16

99.78 51.78

74.52 70.47

99.90 0

41.11 0

91.56 0

73.22 20.22

100 98.62

72.94 18.35

100 28.22

74.02 68.17

100 95.93

66.67 0.79

99.56 0.44

74.02 63.24

100

76.99

100

74.59

100

85.93

100

74.59

100

68.42

99.56

74.59

100

58.15

100

74.59

100

74.62

100

74.59

99.98

67.78

100

74.59

100

80.52

100

74.59

100

76.69

100

74.59

A unified view of unlearnability and unlearning can be approached through analysis in the hypothesis (parameter) space. The learnability of unlearnability can be interpreted in terms of where models

𝐷𝑐

Before

Bridging unlearnability and Unlearning

FT RT

50 25 0

20 Epoch

Recovery Attack ( = 0.4) Before IF

GA FT

50 25 0

20 Epoch

100

Recovery Attack ( = 0.8)

75 Clean Before

IF GA

FT RT

25 0

20 Epoch

Recovery Attack ( = 0.8)

75 50 25 0

Before IF

20 Epoch

GA FT

Clean Train Accuracy (%)

IF GA

100

Clean Train Accuracy (%)

Clean Before

Clean Train Accuracy (%)

100

Recovery Attack ( = 0.4)

Clean Train Accuracy (%)

100

Recovery Attack ( = 1.2)

75 50 25 0

Clean Before

20 Epoch

IF GA

FT RT

Recovery Attack ( = 1.2)

75 50 25 0

Before IF

20 Epoch

GA FT

Recovery attack against FT ( = 0.4) class0 class4

class1 class5

class2 class6

class3 class7

50 25 0

20 Epoch

100

Recovery attack against FT ( = 0.8) class0 class4

class1 class5

class2 class6

class3 class7

50 25 0

20 Epoch

Clean Train Accuracy (%)

100

Clean Train Accuracy (%)

Figure 15: Recovery attacks against unlearned classifiers trained on OPS from Table 17. Top: Recovery attack against the unlearned model with class 3 (OPS) removed. “‘clean” represents the pre-unlearning model where class 3 was trained with clean data. Bottom: Recovery attack against the unlearned model with class 6 (clean) removed.

100

Recovery attack against FT ( = 1.2)

75 50 25 0

class0 class4

class1 class5

class2 class6

class3 class7

20 Epoch

Recovery attack against FT ( = 0.4) class0 class4

class1 class5

class2 class6

class3 class7

50 25 0

20 Epoch

100

Recovery attack against FT ( = 0.8) class0 class4

class1 class5

class2 class6

class3 class7

50 25 0

20 Epoch

Clean Train Accuracy (%)

100

Clean Train Accuracy (%)

Figure 16: Recovery attack against unlearned classifiers using FT trained on TUE from Table 15.

100

Recovery attack against FT ( = 1.2)

75 50 25 0

class0 class4

class1 class5

class2 class6

class3 class7

20 Epoch

Recovery attack against FT ( = 0.4) class0 class4

class1 class5

class2 class6

50 25 0

20 Epoch

class3 class7

100

Recovery attack against FT ( = 0.8) class0 class4

class1 class5

class2 class6

50 25 0

20 Epoch

class3 class7

Clean Train Accuracy (%)

100

Clean Train Accuracy (%)

Figure 17: Recovery attack against unlearned classifiers using FT trained on PUE from Table 16.

100

Recovery attack against FT ( = 1.2)

75 50 25 0

class0 class4

class1 class5

class2 class6

class3 class7

20 Epoch

Figure 18: Recovery attack against unlearned classifiers using FT trained on OPS from Table 17. converge in this space. According to Equation 1, a high probability of converging to parameters 𝜃 that yield low performance on D𝑡 corresponds to low learnability. Conversely, unlearning can be viewed as reducing M (D 𝑓 ) while maintaining M (D\D 𝑓 ) (or M (D𝑢 \D 𝑓 ))

with high probability. This connection suggests that analysis in the hypothesis space may be key to bridging unlearnability and unlearning.

Table 11: The accuracy (%) of unlearned classifiers trained on TUE (subset-level). Class 0 Forgetting Set

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method 𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

2.00

78.84

100

80.68

30.91

85.63

100

80.49

8.69

70.94

100

81.64

6.72

69.68

100

81.93

3.78

76.37

100

80.91

9.26

71.70

100

80.78

8.22

81.19

100

81.54

26.37

80.62

100

80.86

IF▽ IF△

99.93 21.19

75.78 21.19

99.78 32

81.37 75.21

100 7.95

88.54 13.28

99.78 16.22

81.39 70.24

99.95 43.46

66.35 12.99

99.78 19.11

81.29 74.39

100 4.17

59.63 2.30

100 4

81.39 73.08

100 18.40

74.37 3.14

99.78 1.78

81.50 71.41

100 77.19

66.74 11.14

100 17.33

81.43 75.54

99.98 0

77.85 0

99.78 0

81.15 66.52

99.98 2.77

79.33 2.35

99.78 2.44

81.43 67.88

𝐷𝑢 FT▽ FT△

100 3.11

86.91↑ 74

100 83.78

81.72 70.09

100 69.48

94.25↑ 96.07↑

100 99.11

81.33 67.58

100 25.11

74.94↑ 69.95

100 81.78

81.67 69.69

100 2.27

69.93↑ 76.42↑

100 83.11

81.92 67.14

100 0.22

81.61 42.32

100 53.33

81.64↑ 67.39

100 0

74.12 18.64

100 23.56

81.72 64.18

100 18

86.59 59.06

100 67.56

81.81 71.90

100 57.63

85.06 80.99

100 89.11

81.88 72.28

GA▽ GA△

100 0

78.42 0

100 0

81.61 25.97

100 86.47

91.41 61.75

99.78 78

81.38 78.44

99.98 99.04

70.54 52.89

99.78 94.89

81.51 80.08

100 99.14

62.35 45.41

100 96.44

81.38 79.98

100 99.93

76.40 64.99

100 98.22

81.51 80.76

100 100

69.95 56.84

100 98.89

81.58 80.84

100 0

80.74 0

100 0

81.36 65.16

99.98 0

80.12 0

99.78 0

81.46 61.31

100

2.59

2.67

73.96

100

11.56

72.03

100

0.57

0.22

75.38

100

0.49

0.22

75.91

100

0.67

72.02

100

0.32

0.22

74.70

100

0.86

0.89

73.07

99.95

9.33

10.22

72.44

IF▽ IF△

99.93 0.10

73.33 0.62

99.78 0.44

81.24 70.26

100 19.95

88.86 7.73

99.78 10.67

81.30 70.28

99.88 0

58.44 0.03

98.44 0

80.54 65.87

99.93 0

38.07 0

92 0

80.01 48.20

99.98 0.40

66.77 0

98.44 0

81.11 67.97

99.83 0

37.21 0

79.78 0

79.23 53.60

100 22

79.28 1.19

100 0.89

81.37 71.85

99.98 0.10

76.22 0.47

99.56 0.22

81.17 67.79

𝐷𝑐 FT▽ FT△

100 100

71.51 4.12

99.11 5.56

80.79 66.84

100 99.95

71.24 2.35

82 2.44

77.83 64.01

100 99.80

23.43 1.36

38.44 0.67

75.98 68.49

100 99.68

40.82 0.20

88.89 0.22

78.92 68.44

100 100

62.77 0.27

97.56 0

80.39 65.87

100 99.98

49.33 0.30

84.67 0.44

77.07 65.99

100 99.93

54.35 0.54

70.89 0.44

77.56 64.69

99.95 99.80

63.75 12.59

89.11 12.89

77.87 68.29

GA▽ GA△

100 79.38

81.41 31.98

100 50

81.63 76.70

100 99.83

92.91 80.32

99.78 96.22

81.56 80.55

100 0.05

68.94 0.10

99.78 0.22

81.39 61.02

100 0

58.30 0

100 0

81.38 10

100 83.38

76.15 8.03

100 11.78

81.53 73.29

100 0

68.77 0

100 0

81.50 18.97

100 88.07

84.44 22.32

100 27.78

81.57 75.12

100 58.47

83.63 14.32

100 18

81.58 73.14

Before

100

84.10

100

81.59

100

93.98

100

81.59

100

74.20

100

81.59

100

67.73

100

81.59

100

81.36

100

81.59

100

74.30

100

81.59

100

86.72

100

81.59

100

86.07

100

81.59

Forgetting Set

Method

Table 12: The accuracy (%) of unlearned classifiers trained on PUE (subset-level). Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

2.86

77.56

100

80.73

3.75

88.47

100

81.49

0.05

70.96

100

81.79

0.25

66.89

100

83.71

0.07

77.51

100

84.37

0.03

72.40

100

82.28

82.84

99.78

81.78

75.26

83.98

100

82.32

IF▽ IF△

100 42.30

80.17 32.42

99.78 49.78

82.61 72.61

100 26.96

90.4 44.49

100 48.22

82.67 71.28

100 87.80

72.35 39.80

99.78 74

82.57 75.84

100 0.03

66.52 10.77

100 21.56

82.62 71.35

100 17.01

74.1 28.49

99.33 47.11

82.45 72.29

100 0.67

68.67 15.53

99.56 24.22

82.75 73.47

100 0.25

81.98 8.40

100 9.11

82.42 70.35

100 93.38

84.47 34.47

99.78 50.22

82.74 72.72

FT▽ FT△

100 1.73

85.38↑ 74.74

100 79.33

82.33 62.40

100 3.04

92.27 88.59

100 92

82.67 63.58

100 0.25

73.70 51.63

100 58.22

82.44 67.13

100 0.15

74.07↑ 41.58

100 46.67

82.40 69.02

100 0

80.79↑ 43.01

100 54

82.53 69.19

100 0

70.07 29.24

100 28.22

81.82 66.54

100 8.57

87.95↑ 70.89

100 77.56

82.57 68.78

100 91.88

85.93 73.21

100 81.78

82.23 70.84

GA▽ GA△

100 88.37

81.24 49.46

99.78 82

82.70 78.71

100 95.70

90.96 66.62

100 84.89

82.71 80.33

100 100

73.83 68.64

100 99.78

82.67 82.30

100 0

68.59 12.30

100 23.78

82.79 68.90

100 99.93

76.35 67.11

99.78 98.89

82.62 81.78

100 99.98

71.53 63.28

100 99.33

82.85 82.50

100 0

83.56 0

100 0

82.36 10

100 100

86.99 85.98

100 100

82.76 82.79

100

4.32

4.89

75.30

100

4.72

5.78

72.84

100

0.07

74.72

99.95

74.05

100

74.13

100

74.49

100

0.35

72.91

100

0.10

0.22

72.55

IF▽ IF△

100 10.84

75.31 2.40

99.11 2.67

82.36 70.79

100 14.35

87.80 5.73

100 6.89

82.56 66.83

100 0

62.25 0.64

98.67 0.22

81.98 71.88

99.70 0

30.86 0

78 0

79.86 52.22

99.98 1.19

63.73 0.05

98.89 0

81.70 66.89

100 0

51.65 0

96.67 0

81.84 64.37

100 76.69

79.88 1.93

99.78 2.44

82.37 70.40

100 37.31

79.58 1.68

99.56 2.89

82.37 71.87

𝐷𝑢

𝐷𝑐

Before

FT▽ FT△

100 99.88

61.80 12.32

88 14.67

79.99 65.73

99.88 99.58

87.24 37.21

97.11 38

76.29 63.86

100 99.93

9.04 0.03

14.44 0

74.20 53.49

99.95 99.31

28.82 0

60 0

79.21 64.64

100 99.19

31.63 0.03

51.56 0

76.87 65.95

99.51 99.85

7.21 0.59

12.67 0

73.94 62.24

99.98 99.98

42.82 1.68

54.44 0.89

76.08 62.77

100 100

62.99 0.07

89.33 0

79.65 61.10

GA▽ GA△

100 0.17

81.63 1.06

100 1.33

82.71 65.27

100 99.63

91.93 75.98

100 94.44

82.68 81.11

100 0

71.78 0

99.78 0

82.59 62.81

100 0

58.44 0

100 0

81.97 9.84

100 0

74.27 0

99.56 0

82.56 10.12

100 0

69.78 0

100 0

82.75 10.62

100 99.8

85.38 39.31

100 57.56

82.62 77.34

100 73.65

85.65 7.06

100 8.67

82.81 72.33

100

84.15

100

82.76

100

92.72

100

82.76

100

75.46

100

82.76

100

71.11

100

82.76

100

78.44

99.78

82.76

100

73.53

100

82.76

100

86.86

100

82.76

100

87.46

100

82.76

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

Table 13: The accuracy (%) of unlearned classifiers trained on OPS (subset-level). Class 0 Forgetting Set

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method 𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑐

𝐷𝑡

60.96

71.14

100

76.88

4.89

84.86

100

76.59

5.61

68.89

100

78.06

10.22

59.53

100

79.1

7.06

71.31

100

79.12

43.04

66.07

99.78

77.58

39.95

79.58

100

79.29

23.75

79.51

100

79.16

IF▽ IF△

100 99.38

77.06 52.35

100 92.67

78.54 76.6

88.99 0

82.30 0

91.78 0

76.79 13.68

100 99.63

62.72 33.93

100 82.89

78.78 75.45

100 99.14

58.79 22

100 74.67

78.77 76.64

100 99.73

68.10 40.2

100 92.89

78.48 74.84

100 52.47

61.90 1.85

99.78 3.33

78.28 64.56

100 100

80.10 66.67

100 98

78.56 76.74

100 98.96

78.67 42.64

100 75.11

78.39 73.47

𝐷𝑢 FT▽ FT△

100 74.94

76.12 79.48

100 90.44

77.68 68.43

98.91 36.49

96.37 89.61

100 94.67

77.98 64.88

100 1.93

67.04 40.15

100 46.44

78.23 69.48

100 56.57

59.95 62.12

100 76.22

78.27 67.79

100 7.31

70.89 65.28

100 78.67

78.41 71.82

100 45.68

70.49↑ 44.05

100 56.67

78.69 71.21

100 29.46

82.59↑ 46.22

100 50.44

78.50 70.29

100 40.05

78.4 82.05↑

100 90.67

78.23 72.67

GA▽ GA△

100 99.63

77.68 54.57

100 93.56

78.72 76.77

0 0

10 10

100 99.93

63.43 44.84

100 96.44

78.82 77.8

100 98.96

58.37 20.42

100 70.89

78.84 76.65

100 99.98

68.62 56.35

100 99.11

78.56 77.51

100 0

62.30 0

99.78 0

78.44 10

100 100

80.96 79.21

100 100

78.64 78.61

100 99.16

78.74 48.4

100 84.22

78.48 74.81

100

2.20

71.71

99.85

70.64

69.33

75.67

100

1.53

1.56

73.74

100

3.88

2.44

74.21

100

2.07

3.78

70.42

100

7.63

5.78

73.04

100

0.22

71.28

99.98

4.27

4.44

70.65

IF▽ IF△

100 71.58

70.99 3.11

99.78 5.56

78.24 64.72

100 96.72

96.30 85.70

100 97.11

78.76 77.8

100 56.89

54.69 0.27

99.78 0.44

78.37 64.33

100 10.57

42.91 0

98.44 0

78.24 71.77

100 94.64

63.93 6.59

100 16.44

78.20 71.22

100 48.07

57.16 0.15

99.56 0.44

78.01 66.22

100 96.86

76.62 12.25

100 14.89

78.49 70.73

100 90.17

73.75 2.59

99.78 4.22

78.08 68.08

FT▽ FT△

100 99.93

63.36 9.48

98.22 11.56

77.45 65.31

99.98 99.68

92.37 85.95

99.11 85.33

77.78 74.07

99.98 99.48

25.14 2.59

42.89 2

74.09 67.10

99.98 99.80

15.68 6.86

27.56 6.89

71.90 65.21

100 99.88

43.21 5.68

86.44 7.56

75.55 66.68

99.95 99.75

39.46 12.91

73.56 12

75.37 65.29

100 100

3.80 0

5.33 0

68.50 65.42

100 99.31

37.85 5.14

54 5.33

72.96 68.10

GA▽ GA△

100 93.46

76.79 12.27

100 22.89

78.62 68.25

100 99.80

96.44 93.10

100 100

78.75 78.68

100 77.90

61.51 0.89

100 0.89

78.79 68.16

100 0

49.16 0

99.78 0

78.44 10

100 99.95

68.25 40.10

100 93.33

78.46 75.77

100 0

63.41 0

99.78 0

78.37 33.35

100 99.70

79.24 29.38

100 46

78.47 73.31

100 13

77.63 0

100 0

78.39 58.14

100

80.37

100

78.68

100

96.77

100

78.68

100

66.47

100

78.68

100

62.52

100

78.68

100

70.64

100

78.68

100

69.61

100

78.68

100

81.65

100

78.68

100

81.56

100

78.68

𝐷𝑐

Before

Table 14: The accuracy (%) of unlearned classifiers trained on UE-s (class-level). Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method 𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

97.35

97.70

97.05

97.20

97.15

96.85

97.20

IF▽ IF△

39.22 0

0.04 0

0.20 0

96.35 79.60

85.67 0

0 0

97.05 89.15

5.29 0

0 0

96.05 45.60

98.33 0.31

0 0

97.35 95.80

0 0

36.05 10

0 0

78.50 0

0 0

95.10 13.75

0 0

93.50 18.55

FT▽ FT△

8.44 0

0 0

95.50 92.55

16.22 0

0 0

95.85 88.80

24.76 0

0 0

97.55 96.80

0.38 0

0 0

96.25 93.25

3.36 0

2.70 0

96.25 96.10

2.80 0

3.40 0

96.45 93.80

0.80 0

1 0

94.95 93.75

3.53 0

3.90 0

95.80 95.75

GA▽ GA△

100 1.24

8 0

8.70 0

97.55 83.20

100 100

1.89 1.24

1.60 1.10

97.50 97.50

99.98 0

3.98 0

3.20 0

97.55 10

100 100

0.33 0.27

0.20 0.20

97.55 97.55

24.76 0

23 0

94.50 10

0 0

90.25 10

98.98 0

89.60 0

97.70 10

97.56 0

83.40 0

97.55 10

Before

100

9.80

9.90

97.55

100

2.40

97.55

100

5.93

5.30

97.55

100

0.36

0.20

97.55

100

97.55

99.98

92.80

97.55

100

96.30

97.55

99.98

94.20

97.55

C.1

parameter set Θ̂ := {𝜃 | 𝜃 ∼ N (𝜃ˆ + 𝜐, 𝜎 2 𝐼 ), ∥𝜐 ∥ 2 ≤ 𝜂}, with probability no less than 𝑞, there is:

From Learnability to Unlearning

In this section, we show how this bound characterizes intrinsic model behaviors during the unlearning process. The bounds are restated as follows.

𝐴D∗ (𝜃 ∗ ) ≤ inf {𝑡 | Pr [𝐴D∗ (𝜃ˆ + 𝜅 ) ≤ 𝑡 ] ≥ 𝑞 } 𝑎𝑛𝑑, 𝜅

𝐴D∗ (𝜃 ∗ ) ≥ sup {𝑡 | Pr [𝐴D∗ (𝜃ˆ + 𝜅 ) ≤ 𝑡 ] ≤ 𝑞 }, ∀ ∥𝜐 ∥ ≤ 𝜂,

(10)

𝜅

𝜂

Table 15: The accuracy (%) of unlearned classifiers trained on TUE (class-level). Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method 𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

97.75

97.65

97.60

97.35

97.40

97.50

97.70

97.05

IF▽ IF△

99.80 0.18

0 0

97.20 91.55

99.93 3.53

0.02 0

0.10 0

97.25 89.20

99.09 0

0 0

97.65 97.40

99.27 0.07

0 0

97.56 95.90

0 0

78.80 10

0 0

87.9 46.50

0.93 0

0.40 0

97.50 94.90

2.11 0

2.50 0

91.55 0.50

FT▽ FT△

28.71 0

0 0

97.20 96.60

59.89 0

0 0

93.40 96.65

11.49 0

0 0

96.65 94.05

36.71 0

0 0

90.65 95.20

15.56 0

12.50 0

96.45 96.95

9.11 0

8.80 0

96.95 96.20

6.22 0

6.50 0

97.55 97.20

5.20 0

4.40 0

95.90 96.50

GA▽ GA△

100 0

0 0

97.75 95.85

100 0

0.11 0

0.30 0

97.75 50

100 0

0.02 0

0 0

97.75 10

100 0

0.02 0

0 0

97.75 10

0 0

10 10

0 0

92 10

35.02 0

34.20 0

97.55 10

99.58 0

89.90 0

97.80 10

Before

100

0.02

97.75

100

0.13

0.30

97.75

100

0.02

97.75

100

0.04

97.75

100

93.40

97.75

100

93.60

97.75

100

96.20

97.75

100

95.20

97.75

Table 16: The accuracy (%) of unlearned classifiers trained on PUE (class-level). Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method 𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

97.70

97.85

97.65

97.80

97.95

97.80

IF▽ IF△

70.60 0

0.42 0

0.60 0

97.25 84.85

76.87 0

0.20 0

0.10 0

95.95 72.15

98.93 0.02

0.02 0

0.10 0

97.55 91.80

98.64 0

0 0

97.65 95.80

0.07 0

0 0

90.10 0

0 0

86.65 2.90

0.16 0

0.10 0

96.40 62.90

0 0

97.15 63.90

FT▽ FT△

0.07 0

0 0

96.40 97.10

1.31 0

0 0

94 95.45

0 0

94.15 97.85

18.62 0

0 0

97.35 92.35

7.51 0

8 0

96.70 96.45

4.93 0

4.30 0

96.70 96.20

5.67 0

4.70 0

97.60 96.85

6.96 0

7.40 0

97.05 96.55

GA▽ GA△

99.98 94.69

5.69 2.36

4.90 2.30

97.95 97.85

100 0

6.80 0

6.70 0

97.90 10

100 100

0.07 0.04

0.30 0.30

97.95 98

100 0

0.13 0

0 0

97.95 95.85

26.58 0

26.40 0

96.15 10

0 0

10 10

0 0

95.75 10

0 0

10 10

Before

99.98

6.67

5.40

97.95

100

8.44

8.40

97.95

100

0.09

0.30

97.95

100

0.13

97.95

100

94.60

97.95

100

97.95

100

95.40

97.95

100

94.70

97.95

Table 17: The accuracy (%) of unlearned classifiers trained on OPS (class-level). Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method 𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑢

𝐷𝑢𝑐

𝐷𝑢𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

𝐷𝑐

𝐷𝑐𝑡

𝐷𝑡𝑟

97.30

97.40

97.35

97.30

97.35

97.30

97.45

97.35

IF▽ IF△

98.58 0

0.56 0

0.10 0

96.55 87.30

96.38 0

0.22 0

0.10 0

96.50 86.90

97.11 0

0.11 0

0 0

96 79.95

96.40 0

0.33 0

0 0

97 91.45

2.58 0

3.10 0

97 42.65

0 0

79.90 0

0.64 0

0.40 0

97.15 88.15

0 0

92.25 1.90

FT▽ FT△

40.33 0

0 0

95.30 94.45

64 2.04

0 0

96.25 95.50

15.64 0

0 0

95.30 96.55

7.24 0

0 0

95.70 89.40

12.33 0

11.40 0

96.05 94.80

3.98 0

5.10 0

95.25 96.25

6.04 0

5.40 0

94.95 95.80

13.82 0

14.50 0

95.95 95.70

GA▽ GA△

100 96.71

2.20 0.44

1.30 0

97.50 97.25

100 48.71

5.13 0

5 0

97.45 97

100 99.98

2.56 1.07

1.30 0.50

97.45 97.50

100 0

2.71 0

1.30 0

97.45 95.45

5.87 0

6.80 0

92.95 10

0 0

10 10

0 0

93.95 10

0 0

10 10

Before

100

2.71

1.50

97.45

100

6.27

7.40

97.45

100

3.02

1.80

97.45

100

3.09

1.60

97.45

100

94.50

97.45

100

92.80

97.45

99.98

96.80

97.45

99.98

94.70

97.45

Table 18: The MIA success rate of unlearned classifiers trained on UE-s (subset-level). “–” indicates cases where the corresponding model in Table 10 exhibits extremely low 𝐷𝑐 and 𝐷𝑡 accuracy, suggesting that the model has been severely damaged; in such cases, the MIA results are not meaningful and are thus omitted. The red upward arrow (↑) denotes that the post-unlearning model achieves a higher MIA success rate than both the model before unlearning and the retrained model. Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method RT

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

0.6721

0.7198

0.4916

0.8388

0.8217

0.6519

0.6099

0.6469

0.3950

0.5867

0.3121

0.6499

0.6662

0.4156

0.6348

0.6674

0.4188

0.7593

0.7511

0.5556

0.7306

0.7281

0.5138

IF▽ IF△

0.7178 -

0.7272 -

0.5012 -

0.8235 -

0.8319 -

0.6862 -

0.5316 -

0.6069 -

0.3454 -

0.5272 -

0.5427 -

0.2607 -

0.6143 -

0.6212 -

0.3494 -

0.5254 -

0.5854 -

0.3133 -

0.7230 -

0.7299 -

0.4936 -

0.7306 -

0.7136 -

0.5074 -

FT▽ FT△

0.7447 0.5911

0.7733↑ 0.3121

0.5709↑ 0.0321

0.8531 0.8916↑

0.8546 0.7420

0.7156 0.4756

0.6657 -

0.7133↑ -

0.4877↑ -

0.5832 -

0.6289↑ -

0.3491↑ -

0.7240 -

0.7242↑ -

0.4933↑ -

0.6044 -

0.6916↑ -

0.4600↑ -

0.8326↑ 0.7398

0.8341↑ 0.4316

0.6800↑ 0.1457

0.7704↑ 0.7281

0.7627↑ 0.4565

0.5694↑ 0.1481

GA▽ GA△

0.7049 0.6881

0.7210 0.7094

0.4874 0.4743

0.7815 0.6896

0.8062 0.7612

0.6412 0.5573

0.2558 -

0.5385 -

0.2640 -

0.5126 0.4938

0.5363 0.5294

0.2514 0.2484

0.4311 -

0.5422 -

0.2533 -

0.2810 -

0.5136 -

0.2306 -

0.6719 0.5585

0.6877 0.6252

0.4365 0.3521

0.7398 0.7311

0.7188 0.7121

0.5128 0.5057

Before

0.7699

0.7585

0.5531

0.8593

0.8610

0.7281

0.6842

0.6822

0.4467

0.5815

0.5746

0.2830

0.7462

0.7052

0.4723

0.6778

0.6706

0.4168

0.8052

0.7869

0.5923

0.7669

0.7437

0.5383

Test Accuracy (%)

The bounds characterize the collective change in model performance for models in the neighborhood of a model with weights 𝜃ˆ when perturbed by 𝜐. Suppose 𝜃ˆ denotes the weights of the model prior to unlearning. Unlearning involves adjusting the weights from 𝜃ˆ to a new set of parameters 𝜃 ∗ in the vicinity. Successful unlearning requires that 𝐴D 𝑓 (𝜃 ∗ ) → 0 and 𝐴D𝑟 (𝜃 ∗ ) remains largely unaffected. Translated to the learnability bound, this means that 𝜃ˆ having a higher bound sup {𝑡 | Pr𝜅 [𝐴D (𝜃ˆ +𝜅) ≤ 𝑡] ≤ 𝑞} but lower

60 UE-c PUE OPS

40 20 0

20%

40%

60%

80%

100%

Percentage of P-DLC Data Utilized for Training

𝑟

Figure 19: The test accuracy (%) of ResNet-18 trained on varying amounts of ImageNet-based classwise P-DLC data.

inf {𝑡 | Pr𝜅 [𝐴D 𝑓 (𝜃ˆ + 𝜅) ≤ 𝑡] ≥ 𝑞} are more unlearning-friendly. In this light, since models trained on different unlearnability variants may exhibit varying levels of learnability as quantified by the 22

Table 19: The MIA success rate of unlearned classifiers trained on UE-s (class-level). “–” indicates cases where the corresponding model in Table 14 exhibits extremely low 𝐷𝑡𝑟 accuracy, suggesting that the model has been severely damaged; in such cases, the MIA results are not meaningful and are thus omitted. The red upward arrow (↑) denotes that the post-unlearning model achieves a higher MIA success rate than both the model before unlearning and the retrained model. Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

0.6271

0.3387

0.8664

0.7156

0.6351

0.3633

0.7380

0.4984

0.6753

0.3920

0.7216

0.4671

0.7000

0.4444

0.7138

0.4558

IF▽ IF△

0.0004 0

0.6207 0.7377↑

0.3316 0.4987↑

0 0

0.8502 0.7607

0.6978 0.5489

0 -

0.6780↑ -

0.4036↑ -

0 0

0.7378 0.7673↑

0.4987 0.5478↑

0 -

0.6484 -

0.3318 -

0 -

0.4289 -

0.1302 -

0 -

0.6158 -

0.2993 -

FT▽ FT△

0 0

0.5451 0.5120

0.2389 0.2053

0 0

0.8742↑ 0.9588↑

0.7273↑ 0.8960↑

0 0

0.5951 0.4956

0.2962 0.1980

0 0

0.7542 0.5427

0.5315 0.2360

0.0336 0

0.5144 0.4449

0.2031 0.1413

0.0280 0

0.4822 0.5529

0.1711 0.2340

0.0080 0

0.5229 0.4667

0.1944 0.1782

0.0353 0

0.5351 0.5427

0.2218 0.2129

GA▽ GA△

0.0800 0

0.5964 0.5893

0.3031 0.3004

0.0189 0.0124

0.8309 0.8407

0.6427 0.6616

0.0398 -

0.6007 -

0.3256 -

0.0033 0.0027

0.7082 0.7058

0.4578 0.4540

0.2476 -

0.6596 -

0.3893 -

0 -

0.5824 -

0.2696 -

0.9898 -

0.9540 -

0.8480 -

0.9756 -

0.9162 -

0.7653 -

Before

0.0980

0.5973

0.2989

0.0240

0.8222

0.6324

0.0593

0.5973

0.3142

0.0036

0.7064

0.4607

1.0

0.9969

0.9749

0.9998

0.9976

0.9738

1.0

0.9984

0.9847

0.9998

0.9987

0.9791

Table 20: The MIA success rate of unlearned classifiers trained on TUE (subset-level). “–” indicates cases where the corresponding model in Table 11 exhibits extremely low 𝐷𝑐 and 𝐷𝑡 accuracy, suggesting that the model has been severely damaged; in such cases, the MIA results are not meaningful and are thus omitted. The red upward arrow (↑) denotes that the post-unlearning model achieves a higher MIA success rate than both the model before unlearning and the retrained model. Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method RT

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

0.7883

0.7743

0.5698

0.8562

0.8276

0.6762

0.7093

0.7308

0.5192

0.6967

0.6755

0.4404

0.7637

0.7451

0.5353

0.7170

0.7165

0.4933

0.8118

0.7933

0.6148

0.8061

0.8009

0.6372

IF▽ IF△

0.7577 -

0.7296 -

0.5311 -

0.8854 -

0.8614 -

0.7177 -

0.6634 -

0.6854 -

0.4649 -

0.5962 -

0.6032 -

0.3553 -

0.7437 -

0.7224 -

0.4955 -

0.6674 -

0.6819 -

0.4567 -

0.7785 -

0.7612 -

0.5570 -

0.7933 -

0.7666 -

0.5738 -

FT▽ FT△

0.8691↑ 0.7400

0.8434↑ 0.4081

0.6903↑ 0.0362

0.9424↑ 0.9607

0.9261↑ 0.8962

0.8296↑ 0.7358

0.7493↑ 0.6995

0.7558↑ 0.4039

0.5590↑ 0.0925

0.6992↑ 0.7641

0.7012↑ 0.2281

0.4730↑ 0.0054

0.8160↑ -

0.8039↑ -

0.6111↑ -

0.7412 -

0.7449↑ -

0.5479↑ -

0.8659 0.5906

0.8503↑ 0.2651

0.7066↑ 0.0353

0.8506 0.8098

0.8214 0.5446

0.6634 0.2195

GA▽ GA△

0.7841 -

0.7567 -

0.5560 -

0.9140 0.6175

0.8814 0.6627

0.7545 0.4054

0.7054 0.5288

0.7106 0.5896

0.4980 0.3496

0.6234 0.4540

0.6150 0.5019

0.3745 0.2316

0.7639 0.6498

0.7350 0.6303

0.5158 0.3683

0.6995 0.5683

0.6985 0.6101

0.4812 0.3639

0.8074 -

0.7837 -

0.5980 -

0.8012 -

0.7666 -

0.5720 -

Before

0.8409

0.8044

0.6281

0.9397

0.9096

0.8039

0.7419

0.7407

0.5333

0.6772

0.6548

0.4224

0.8135

0.7767

0.5854

0.7429

0.7318

0.5264

0.8671

0.8382

0.6972

0.8607

0.8234

0.6723

Table 21: The MIA success rate of unlearned classifiers trained on TUE (class-level). “–” indicates cases where the corresponding model in Table 15 exhibits extremely low 𝐷𝑡𝑟 accuracy, suggesting that the model has been severely damaged; in such cases, the MIA results are not meaningful and are thus omitted. The red upward arrow (↑) denotes that the post-unlearning model achieves a higher MIA success rate than both the model before unlearning and the retrained model. Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

0.6315

0.3517

0.8620

0.7077

0.6460

0.3686

0.7166

0.4706

0.6851

0.4122

0.6953

0.4335

0.7264

0.4760

0.7253

0.4713

IF▽ IF△

0 0

0.6391 0.6475↑

0.3551 0.3657↑

0.0002 0

0.8171 0.6860

0.6197 0.4177

0 0

0.6471↑ 0.7062↑

0.3822↑ 0.4508↑

0 0

0.7017 0.7124

0.4457 0.4626

0 -

0.9315 -

0.7966 -

0 -

0.5451 -

0.2466 -

0.0093 0

0.5380 0.5504

0.2351 0.1940

0.0211 -

0.7264 -

0.4624 -

FT▽ FT△

0 0

0.6071 0.7706 ↑

0.2848 0.5242↑

0 0

0.9542↑ 0.9064↑

0.8824↑ 0.7795↑

0 0

0.5524 0.5013

0.2597 0.2044

0 0

0.7608↑ 0.7706↑

0.5391↑ 0.5242↑

0.1555 0

0.3613 0.4551

0.0871 0.1304

0.0911 0

0.4493 0.5200

0.1724 0.1955

0.0622 0

0.4002 0.4991

0.1277 0.1911

0.052 0

0.5655 0.4871

0.2433 0.1608

GA▽ GA△

0 0

0.6451 0.5562

0.3640↑ 0.2646

0.0011 -

0.8444 -

0.6602 -

0.0002 -

0.6342 -

0.3400 -

0.0002 -

0.7106 -

0.4660 -

0 -

0.6320 -

0.3477

0.3502 -

0.6262 -

0.3395 -

0.9957 -

0.9737 -

0.8808 -

Before

0.0002

0.6455

0.3633

0.0013

0.8455

0.6602

0.0002

0.6340

0.3404

0.0004

0.7095

0.4671

1.0

0.9964

0.9708

1.0

0.9984

0.9826

1.0

0.9991

0.9828

1.0

0.9988

0.9842

Table 22: The MIA success rate of unlearned classifiers trained on PUE (subset-level). “–” indicates cases where the corresponding model in Table 12 exhibits extremely low 𝐷𝑐 and 𝐷𝑡 accuracy, suggesting that the model has been severely damaged; in such cases, the MIA results are not meaningful and are thus omitted. The red upward arrow (↑) denotes that the post-unlearning model achieves a higher MIA success rate than both the model before unlearning and the retrained model. Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

0.7755

0.7730

0.5639

0.8846

0.8728

0.7395

0.7096

0.7187

0.5069

0.6688

0.6659

0.4111

0.7750

0.7449

0.5362

0.7239

0.7441

0.5392

0.8283

0.8096

0.6293

0.8397

0.8187

0.6602

IF▽ IF△

0.8017 -

0.7740 -

0.5856 -

0.9039 -

0.8883 -

0.7669 -

0.7234 0.3980

0.7286 0.6338

0.5133 0.3644

0.6651 -

0.6427 -

0.3997 -

0.7409 -

0.7101 -

0.5 -

0.6866 -

0.7128 -

0.5014 -

0.8197 -

0.7938 -

0.6212 -

0.8446 -

0.7886 -

0.6049 -

FT▽ FT△

0.8538↑ 0.7474

0.8355↑ 0.3395

0.6800↑ 0.0056

0.9227 0.8859

0.9061 0.6918

0.8019 0.3735

0.7370 -

0.7491↑ -

0.5429 -

0.7407↑ -

0.7348↑ -

0.5261↑ -

0.8079↑ -

0.7792↑ -

0.5903↑ -

0.7007 -

0.7651↑ -

0.5782↑ -

0.8795↑ 0.7088

0.8582↑ 0.4464

0.7274↑ 0.1632

0.8592 0.7320

0.8360↑ 0.4933

0.6785↑ 0.2004

GA▽ GA△

0.8123 0.4945

0.7844 0.6108

0.6000 0.3451

0.9096 0.6661

0.8950 0.7291

0.7792 0.5037

0.7382 0.6864

0.7271 0.7012

0.5274 0.4780

0.6859 -

0.6624 -

0.4261 -

0.7634 0.6711

0.7271 0.6587

0.5182 0.4237

0.7153 0.6328

0.7283 0.6767

0.5234 0.4434

0.8355 -

0.8024 -

0.6417 -

0.8698 0.8597

0.8135 0.7982

0.6412 0.6192

Before

0.8414

0.8096

0.6335

0.9271

0.9106

0.8106

0.7545

0.7437

0.5444

0.7111

0.6883

0.4565

0.7844

0.7427

0.5412

0.7353

0.7407

0.5441

0.8686

0.8355

0.6879

0.8745

0.8237

0.6518

C.2

learnability bound, their synergy in supporting unlearning may also differ.

From Unlearning to Learnability

(𝜖, 𝜁 )-certified unlearning supplies unlearning guarantees by stochastic postprocessing via noisy finetuning on D𝑟 . The core idea is that, after 𝑇 steps of Gaussian-perturbed and clipped gradient updates based on D𝑟 , the model parameter distribution will be 23

Table 23: The MIA success rate of unlearned classifiers trained on PUE (class-level). “–” indicates cases where the corresponding model in Table 16 exhibits extremely low 𝐷𝑡𝑟 accuracy, suggesting that the model has been severely damaged; in such cases, the MIA results are not meaningful and are thus omitted. The red upward arrow (↑) denotes that the post-unlearning model achieves a higher MIA success rate than both the model before unlearning and the retrained model. Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

0.3266

0.0511

0.8644

0.7104

0.6251

0.3393

0.7097

0.4526

0.6891

0.4240

0.7082

0.4382

0.7013

0.4562

0.0

0.7160

0.4548

IF▽ IF△

0.0042 0

0.5920↑ 0.6406↑

0.2984↑ 0.3708↑

0.0020 0

0.7897 0.6324

0.5877 0.3408

0.0002 0

0.6548↑ 0.7782↑

0.3906↑ 0.5648↑

0.0002 0

0.7615↑ 0.8475↑

0.5320↑ 0.6891↑

0.0006 -

0.7513 -

0.4877 -

0 -

0.5835 -

0.2486 -

0.0015 0

0.5057 0.7048

0.2128 0.3564

0 0

0.5626 0.4597

0.2408 0.1168

FT▽ FT△

0 0

0.6195↑ 0.5237

0.3140↑ 0.2095

0 0

0.7868 0.8953↑

0.5597 0.7702↑

0 0

0.5340 0.4771

0.2471 0.1813

0 0

0.7362↑ 0.6042

0.4962↑ 0.3048

0.0751 0

0.4760 0.5068

0.1591 0.1842

0.0493 0

0.5255 0.5562

0.2200 0.2408

0.0566 0

0.3535 0.5802

0.0893 0.2626

0.0695 0

0.5246 0.5573

0.2191 0.2026

GA▽ GA△

0.0568 0.0235

0.5760 0.5780↑

0.2815↑ 0.2895↑

0.068 -

0.7857 -

0.5502 -

0.0006 0.0004

0.6000 0.6028

0.3202 0.3260

0.0013 0

0.7004 0.4037

0.4435 0.1384

0.2657 -

0.6604 -

0.3766 -

0 -

0.7526 -

0.5028 -

Before

0.0666

0.5766

0.2795

0.0844

0.7815

0.5404

0.0008

0.5984

0.3197

0.0013

0.7024

0.4453

1.0

0.9984

0.9828

1.0

0.9993

0.9817

1.0

0.9982

0.9853

1.0

0.9977

0.9828

Table 24: The MIA success rate of unlearned classifiers trained on OPS (subset-level). “–” indicates cases where the corresponding model in Table 13 exhibits extremely low 𝐷𝑐 and 𝐷𝑡 accuracy, suggesting that the model has been severely damaged; in such cases, the MIA results are not meaningful and are thus omitted. The red upward arrow (↑) denotes that the post-unlearning model achieves a higher MIA success rate than both the model before unlearning and the retrained model. Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

0.7114

0.7190

0.4978

0.8486

0.8244

0.6454

0.6889

0.6938

0.4541

0.5953

0.5852

0.3202

0.7131

0.6958

0.4588

0.6607

0.6736

0.4279

0.7958

0.7704

0.5758

0.7951

0.7773

0.6069

IF▽ IF△

0.7706 0.5235

0.7343 0.5891

0.5188 0.3141

0.8230 -

0.7931 -

0.6116 -

0.6272 0.3393

0.6442 0.5111

0.3951 0.2452

0.5879 0.2200

0.5647 0.4509

0.2923 0.1793

0.6810 0.4020

0.6743 0.5388

0.4311 0.2583

0.6190 -

0.6173 -

0.3635 -

0.8010 0.6667

0.7862 0.6837

0.5849 0.4427

0.7867 0.4264

0.7407 0.5109

0.5533 0.2484

FT▽ FT△

0.7612 0.7948

0.7459 0.5635

0.5523 0.1393

0.9637 0.8960

0.9314 0.7894

0.8373 0.5783

0.6704 -

0.6857 -

0.4484 -

0.5995 0.6212

0.6057↑ 0.2990

0.3432 0.0459

0.7089 0.6528

0.7012↑ 0.3612

0.4743↑ 0.0531

0.7049↑ -

0.7054↑ -

0.4795↑ -

0.8259↑ -

0.8188↑ -

0.6469↑ -

0.7840 0.8205↑

0.7627 0.5906

0.5583 0.2469

GA▽ GA△

0.7768 0.5457

0.7402 0.5914

0.5227 0.3232

0.6343 0.4484

0.6439 0.5402

0.4007 0.2807

0.5837 0.2042

0.5610 0.4333

0.2881 0.1526

0.6862 0.5635

0.6781 0.6141

0.4353 0.3326

0.6230 -

0.6200 -

0.3657 -

0.8096 0.7921

0.7879 0.7716

0.5962 0.5644

0.7874 0.4840

0.7402 0.5165

0.5516 0.2546

Before

0.8037

0.7610

0.5523

0.9677

0.9358

0.8560

0.6647

0.6696

0.4281

0.6252

0.5909

0.3220

0.7064

0.6931

0.4612

0.6960

0.6672

0.4301

0.8165

0.7946

0.6080

0.8156

0.7731

0.5958

Table 25: The MIA success rate of unlearned classifiers trained on OPS (class-level). “–” indicates cases where the corresponding model in Table 17 exhibits extremely low 𝐷𝑡𝑟 accuracy, suggesting that the model has been severely damaged; in such cases, the MIA results are not meaningful and are thus omitted. The red upward arrow (↑) denotes that the post-unlearning model achieves a higher MIA success rate than both the model before unlearning and the retrained model. Class 0

Class 1

Class 2

Class 3

Class 4

Class 5

Class 6

Class 7

Method corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

corr

prob

entro

0.5982

0.3242

0.8573

0.7020

0.6102

0.3284

0.7084

0.4582

0.6767

0.3929

0.6622

0.3831

0.7124

0.4762

0.7231

0.4593

IF▽ IF△

0.0056 0

0.6091 0.5833

0.3262 0.2858

0.0022 0

0.8391 0.7124

0.6556 0.4702

0.0011 0

0.6622↑ 0.7971↑

0.3922↑ 0.6058↑

0.0033 0

0.7496↑ 0.8504↑

0.5356↑ 0.6831↑

0.0258 -

0.6204 -

0.3133 -

0 -

0.6784 -

0.3744 -

0.0064 0

0.5449 0.4887

0.2511 0.1449

0 -

0.6642 -

0.3509 -

FT▽ FT△

0 0

0.5513 0.5520

0.2571 0.2522

0 0

0.9218↑ 0.8680↑

0.8151↑ 0.7193↑

0 0

0.5602 0.5482

0.2544 0.2580

0 0

0.6310 0.6687

0.3600 0.3593

0.1233 0

0.4389 0.5220

0.1602 0.2164

0.0398 0

0.4587 0.5073

0.1758 0.1976

0.0604 0

0.4391 0.5953

0.1731 0.2880

0.1382 0

0.4122 0.5376

0.1267 0.2176

GA▽ GA△

0.0224 0.0044

0.6262 0.6336↑

0.3313 0.3511↑

0.0538 0

0.7887 0.9316↑

0.5293 0.8569↑

0.0260 0.0107

0.6080 0.6142↑

0.3196 0.3344↑

0.0273 0

0.6873 0.3796

0.4367 0.1120

0.0587 -

0.7289 -

0.4704 -

0 -

0.8253 -

0.6060 -

0 -

1.0000 -

Before

0.0271

0.6249

0.3271

0.0627

0.7731

0.5020

0.0302

0.6053

0.3162

0.0309

0.6864

0.4389

1.0

0.9987

0.9862

1.0

0.9989

0.9731

0.9998

0.9987

0.9816

0.9998

0.9993

0.9842

(𝜖, 𝜁 )-indistinguishable to the distribution by training on D𝑟 from scratch. Specifically, a recent analysis states that

fixing 𝜎, 𝛾, 𝐶 0 , 𝜖, and 𝜁 , we obtain the proportional relationship 𝑇 ∝ 𝐶11 . This implies that a smaller 𝐶 1 requires more training steps. At the same time, to avoid excessive performance degradation, 𝐶 1 should approximately match the gradient magnitude. If D𝑢 is less robust in the parameter space, the unlearning gradients 𝑔𝑡 will be large, allowing the model to forget D𝑢 with fewer updates. However, large local gradients 𝑔𝑡 also make recovery attacks more effective. Conversely, unlearning tests with varying 𝑇 values can serve as a probe of the parametric robustness of unlearnability.

Theorem 3 ((𝜖, 𝜁 )-certified unlearning guarantee). Given Î the clipped initial parameter 𝜃 0 = 𝐶0 (𝜃ˆ), let the training update at Î step 𝑡 be 𝜃 𝑡 +1 = 𝜃 𝑡 − 𝛾 ( 𝐶1 (𝑔𝑡 )) + 𝜙, where 𝑔𝑡 is the set of gradients Î Î computed on D𝑟 , 𝜙 ∼ N (0, 𝜎 2 𝐼 ), and 𝐶0 and 𝐶1 denote clipping projections with radii 𝐶 0 > 0 and 𝐶 1 > 0, respectively. Consider 𝑇 ≥ 1 update steps with 𝛾, 𝜎 > 0. Suppose the privacy budgets are 𝜁 ∈ (0, 1) and 𝜖 ∈ 0, 3 log(1/𝜁 ) . Then an (𝜖, 𝜁 )-unlearning guarantee is achieved if 𝜎2 =

9 log(1/𝜁 ) (𝐶 0 + 𝐶 1𝛾𝑇 ) 2 . 𝜖 2𝑇

(15)

Please refer to the proof in the original paper [89]. To tie this to the learnability of unlearnability, consider a case where a unlearnability-protected dataset D𝑢 should be unlearned such that Pr[U (Γ(D𝑢 ∪ D∗ ), D𝑢 ∪ D∗, D𝑢 ) ∈ 𝑆] and Pr[Γ(D∗ ) ∈ 𝑆], with D∗ denoting a clean dataset, become indistinguishable. By 24

Record · ID 178812 · SHA-256 d5594871dff8d6ee
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.