Bias Redistribution in Visual Machine Unlearning: Does Forgetting One Group Harm Another? Yunusa Haruna NewraLab, Suzhou, China
arXiv:2604.08111v1 [cs.LG] 9 Apr 2026
Adamu Lawan Beihang University Beijing GoerTek Alpha Lab NewraLab, Suzhou, China
Ibrahim Haruna Abdulhamid NewraLab, Suzhou, China [email protected]
Hamza Mohammed Dauda Skyline University Nigeria
Jiaquan Zhang UESTC, Chengdu, China
Chaoning Zhang UESTC, Chengdu, China
Shamsuddeen Hassan Muhammad Imperial College London [email protected]
Abstract Machine unlearning enables models to selectively forget training data, driven by privacy regulations such as GDPR and CCPA. However, its fairness implications remain underexplored: when a model forgets a demographic group, does it neutralize that concept or redistribute it to correlated groups, potentially amplifying bias? We investigate this bias redistribution phenomenon on CelebA using CLIP models (ViT-B/32, ViT-L/14, ViT-B/16) under a zero-shot classification setting across intersectional groups defined by age and gender. We evaluate three unlearning methods, Prompt Erasure, Prompt Reweighting, and Refusal Vector using per-group accuracy shifts, demographic parity gaps, and a redistribution score. Our results show that unlearning does not eliminate bias but redistributes it primarily along gender rather than age boundaries. In particular, removing the dominant Young Female group consistently transfers performance to Old Female across all model scales, revealing a gender-dominant structure in CLIP’s embedding space. While the Refusal Vector method reduces redistribution, it fails to achieve complete forgetting and significantly degrades retained performance. These findings highlight a fundamental limitation of current unlearning methods: without accounting for embedding geometry, they risk amplifying bias in retained groups.
Figure 1. Bias redistribution in visual machine unlearning. Left: A Young Female face is correctly classified before unlearning, with strong patch-level similarity to the “young woman” text prompt. Right: After applying Prompt Reweighting to forget the Young Female group, the same face is misclassified as Old Female the heatmap signal disappear, and probability mass has redistributed to the nearest retained group in CLIP’s embedding space. This occurs because same-gender pairs are geometrically closer (cos(YF, OF)=0.945) than same-age pairs (cos(YF, YM)=0.885), directing redistribution along gender rather than age boundaries. See §6.
1. Introduction The right to be forgotten [26] has motivated a growing body of work on machine unlearning [3, 6], which seeks
to remove the influence of specific training samples from a deployed model without full retraining. In computer vision, unlearning has been applied to face recognition privacy [12], generative model concept erasure [12], and fairness-aware adaptation [16]. Despite this progress, a critical question has gone largely unanswered: what happens to demographic fairness when a model unlearns a protected group? Intuition suggests that forgetting group Df should reduce the model’s reliance on features correlated with that group. Yet in practice, those features may be entangled with correlated groups in the model’s representation space [4]. Selectively suppressing Df may cause the model to overpredict a correlated group on ambiguous inputs a phenomenon we term bias redistribution. As illustrated in Figure 1, we find that making CLIP [21] forget Young Female transfers over 60 percentage points of classification accuracy onto Old Female rather than onto Young Male revealing that CLIP’s embedding space organizes faces along gender boundaries more strongly than age boundaries, with samegender pairs nearly six points more similar than same-age pairs in cosine similarity. This redistribution occurs not because the model learns anything new, but because the geometry of the pretrained representation space determines where probability mass flows when a class is suppressed. We study this phenomenon across three CLIP model variants [21] ViT-B/32, ViT-L/14, and ViT-B/16 under a zero-shot classification setting, which allows us to isolate the geometric properties of the embedding space from training dynamics. We apply three zero-shot unlearning strategies that differ in where and how they modify the classifier: at the text embedding level (Prompt Erasure [13] and Prompt Reweighting [30]) and at the image embedding level (Refusal Vector [2]), to forget the Young Female demographic group on CelebA [18] and measure the resulting shifts in per-group accuracy, demographic parity, and a novel redistribution score. We further show that projectionbased unlearning cannot achieve perfect forgetting when the forget and retain distributions are geometrically entangled a fundamental impossibility rooted in the collinearity of pretrained embeddings. The contributions of this work are: • We formally define bias redistribution in the context of machine unlearning and introduce the redistribution score to quantify it (§3). • We provide the first systematic empirical study of bias redistribution across three zero-shot unlearning methods on the CelebA benchmark, showing that redistribution consistently follows gender rather than age boundaries across three CLIP model scales, explained by a gender-dominant geometry in the embedding space (cos(YF, OF) = 0.945 > cos(YF, YM) = 0.885) (§5). • We prove geometrically that projection-based unlearning cannot achieve perfect forgetting when forget and retain
mean embeddings are nearly collinear (cos(µf , µr ) = 0.929), establishing a lower bound on achievable forget accuracy for any linear erasure method (§6). • We characterize the forget–fairness tradeoff via a continuous strength sweep of the Refusal Vector method, revealing a non-monotonic Pareto frontier where overprojection paradoxically restores the original geometry, and demonstrate that no zero-shot method simultaneously achieves low forget accuracy and low redistribution (§6).
2. Related Work Machine Unlearning. Cao and Yang [6] introduced the formal unlearning problem, framing it as the removal of a training sample’s influence without full retraining. Bourtoule et al. [3] proposed SISA training for exact unlearning via data sharding. Approximate unlearning methods include Gradient Ascent [13], fine-tuning on the retain set [30], and NegGrad+ [17], which combines gradient ascent on the forget set with gradient descent on the retain set. Recent work has further expanded the approximate unlearning toolbox with retrain-free dampening methods such as Selective Synaptic Dampening (SSD) [11], saliency-guided unlearning such as SalUn [10], and broader surveys and benchmarks that systematize the design space and evaluation of unlearning algorithms [5, 19]. For concept-level unlearning in vision, Gandikota et al. [12] erase visual concepts from diffusion models by fine-tuning text embeddings, a method closely related to our Prompt Erasure baseline. Related representation-space removal methods include iterative nullspace projection [22]. In particular, the theoretical analysis of Belrose et al. [2] establishes that perfect linear erasure requires favorable geometry between forget and retain directions, a condition we demonstrate is not satisfied in CLIP’s pretrained embedding space, where forget and retain mean embeddings exhibit high cosine similarity (cos(µf , µr ) = 0.929), rendering perfect forgetting geometrically unachievable. Fairness in Vision Models. Demographic bias in face recognition is well documented [4], with error rates varying substantially across intersectional subgroups defined by gender and skin tone. Intersectional bias, where multiple protected attributes compound unfairness [16], is central to our setting, as we evaluate across four demographic slices defined by the joint Young × Male attributes in CelebA [18]. Related benchmark efforts such as FairFace [15] and FACET [14] further show that demographic disparities persist across age, gender, and race in modern vision systems. More broadly, recent vision research has also explored settings beyond standard face benchmarks, including automatically constructed real-world datasets, restoration-oriented visual pipelines, and alternative visual architectures, which may provide complementary context for understanding model behavior in broader visual environ-
ments [24, 28, 29, 31]. Recent work has shown that large vision-language models such as CLIP [21, 27] inherit and amplify societal biases present in their pretraining data, and that these biases can be probed and mitigated at the representation level through methods such as DeAR [23] and FairCLIP [20]. These results suggest that demographic concepts in CLIP are encoded in a geometry that reflects social correlations rather than independent attribute axes, making CLIP a natural testbed for studying how unlearning interacts with pretrained demographic representations. Unlearning and Fairness. While differential privacy provides formal guarantees against membership inference [8, 26], it does not address how forgetting one group affects predictions on retained groups. Fair machine learning has studied how to prevent bias at training time [16], but the downstream fairness consequences of post-hoc unlearning remain largely underexplored. Existing unlearning benchmarks evaluate forgetting quality and utility preservation [3, 17] but do not measure redistribution of classification mass onto correlated retained groups. Recent work has begun to examine fairness-aware unlearning under groupskewed forget sets, for example through group-robust machine unlearning [7]. However, no prior work directly studies bias redistribution as a consequence of machine unlearning, that is, the transfer of classification mass from a forgotten group onto correlated retained groups, nor the geometric conditions under which such redistribution is provably unavoidable. This gap motivates our study.
3. Problem Formulation
|\,\text {Acc}(\mathcal {M}_\mathcal {U},\, G_k) - \text {Acc}(\mathcal {M},\, G_k)\,| > \epsilon , \quad k \neq t, \label {eq:redistribution}
(2)
where we set ϵ = 2% as the significance threshold. In our experiments, all three methods exceed this threshold on at least one retained group by a wide margin (up to 71.19 percentage points), confirming systematic redistribution rather than noise. Metrics. We evaluate unlearning quality and fairness jointly using: • Forget Accuracy (FA): accuracy of MU on Gt after unlearning (lower = better forgetting). • Retain Accuracy (RA): mean accuracy across all retained groups Gk , k ̸= t (higher = better utility preservation). • Per-Group Accuracy Shift (∆Acck ): signed accuracy change for each retained group Gk relative to M, revealing the direction and magnitude of redistribution. • Demographic Parity Gap (DP) [9]: maxi,j |P̂ (ŷ=Gi | x ∈ Gi ) − P̂ (ŷ=Gj | x ∈ Gj )|, measuring the spread of per-group classification rates before and after unlearning. • Redistribution Score (RS): mean absolute per-group accuracy shift across all retained groups: \text {RS} = \frac {1}{K-1} \sum _{k \neq t} |\Delta \text {Acc}_k|. \label {eq:rs}
(3)
A higher RS indicates more severe bias redistribution.
Setup. Let M be a zero-shot classifier built on a pretrained vision-language model. Given a set of K demographic text prompts {p1 , . . . , pK }, the classifier encodes each prompt into a normalized text embedding wk = enctext (pk )/∥enctext (pk )∥, forming a classifier weight matrix W ∈ RK×d , where d is the model-specific embedding dimension. For an image x, the predicted class is: \hat {y}(x) = \operatorname *{argmax}_k \; \frac {\text {enc}_\text {img}(x)}{\|\text {enc}_\text {img}(x)\|} \cdot \mathbf {w}_k^\top . \label {eq:zeroshot}
Bias Redistribution. We define bias redistribution as a statistically meaningful change in per-group accuracy for retained groups Gk ̸= Gt after applying U. Formally, redistribution occurs for group Gk if:
(1)
An unlearning method U produces a modified classifier MU by manipulating W, the image embeddings, or both, without any gradient-based retraining. We instantiate this framework on three CLIP model variants [21]: ViT-B/32 (d=512), ViT-L/14 (d=768), and ViT-B/16 (d=512). Demographic Groups. We define K=4 intersectional demographic groups over the Young × Male attribute axes of CelebA [18]: Young Female (YF), Young Male (YM), Old Female (OF), and Old Male (OM). The forget target is Gt = YF, the group on which all three baseline models achieve their highest accuracy (≥ 97%), indicating strong representational dominance across model scales. The retain set comprises the remaining three groups: Dr = {Gk : k ̸= t}.
4. Unlearning Methods We evaluate three zero-shot unlearning methods that differ in where and how they modify the classifier: at the text embedding level (Prompt Erasure and Prompt Reweighting) and at the image embedding level (Refusal Vector). Each method operates on the weight matrix W ∈ RK×d defined in §3, the image embedding space, or both, without any gradient-based retraining. All three methods are modelagnostic and are applied identically across the three CLIP variants evaluated in this work. Prompt Erasure (PE). PE zeros out forget group’s text embedding in W, prevents classifier from ever predicting Gt : \mathbf {w}_t \leftarrow \mathbf {0}. \label {eq:pe}
(4)
This is the zero-shot analogue of Gradient Ascent [13] maximally aggressive, guaranteeing FA = 0%, but forcing all probability mass previously assigned to Gt to redistribute across retained groups according to their cosine similarity to the input image. Prompt Reweighting (PR). PR redistributes the forget embedding’s mass to retained groups proportionally to their
cosine similarity to wt , rather than discarding it entirely: \mathbf {w}_k \leftarrow \mathrm {normalize}\!\left ( \mathbf {w}_k + \alpha \, s_k\, \mathbf {w}_t \right ), \quad k \neq t, \label {eq:pr}
(5)
where sk = softmaxk (cos(wt , wk )/τ ) with temperature τ =0.07, and α=1.0. The forget embedding is then zeroed: wt ← 0. This is the zero-shot analogue of Retain-Set Finetuning [30], preserving utility by explicitly routing the forget signal into the retained classifier heads. Refusal Vector (RV). RV computes the mean direction of forget-group image embeddings and projects it out of all image embeddings at inference time, making the forget group’s visual features invisible to the classifier: \tilde {\phi }(x) = \mathrm {normalize}\!\left ( \phi (x) - \left (\phi (x) \cdot \mathbf {v}\right )\mathbf {v} \right ), \label {eq:rv}
(6)
where ϕ(x) = encimg (x)/∥encimg (x)∥ and v = normalize(µf − µr ) is the unit vector pointing from the mean retain embedding µr toward the mean forget embedding µf . The same projection is applied to W for consistency. This method is directly inspired by concept erasure in representation space [2] and aligns with the notion of refusal vectors in large language models [1]. In CLIP’s embedding space, cos(µf , µr ) = 0.929, indicating that the forget and retain mean embeddings are nearly collinear. As established by Belrose et al. [2], perfect linear erasure requires orthogonality between these directions a condition not satisfied here explaining why RV achieves only partial forgetting (FA = 64.30%) and why increasing projection strength beyond λ=1.0 paradoxically restores the original geometry, as reported in §6.
5. Experiments 5.1. Experimental Setup Dataset. We use CelebA [18], a large-scale face attribute dataset with 202,599 images and 40 binary attributes. We construct four intersectional demographic groups from the Young and Male binary attributes: Young Female (YF), Young Male (YM), Old Female (OF), and Old Male (OM). All evaluations are conducted on the official CelebA test split (19,962 samples) reported in Table 1. Table 1. CelebA demographic group statistics (test split).
Group
Label
Count
Young Female Young Male Old Female Old Male
YF YM OF OM
10,331 4,783 1,916 2,932
Total
19,962
Models. We evaluate three CLIP variants [21] in the zeroshot classification setting: ViT-B/32 (d=512), ViT-B/16
(d=512), and ViT-L/14 (d=768). All models are used in their released form without fine-tuning. For each model, we construct a four-way zero-shot classifier from the text prompts “a photo of a young woman”, “a photo of a young man”, “a photo of an old woman”, and “a photo of an old man”. These prompts are encoded into a normalized weight matrix W ∈ R4×d , as described in §3. Forget Set. We designate Df as all test samples belonging to the Young Female group (|Df | = 10,331), the largest demographic slice and the group on which all three models achieve their highest baseline accuracy (≥ 97%), indicating consistent representational dominance across model scales. Baselines. We report each unmodified model as the reference point. Since our unlearning methods are zero-shot and require no retraining, a retrain baseline is not applicable. Instead, we compare three zero-shot unlearning methods that differ in where and how they modify the classifier: Prompt Erasure (PE) and Prompt Reweighting (PR) operate at the text embedding level, while Refusal Vector (RV) operates at the image embedding level, as described in §4.
5.2. Main Results Table 2 summarizes unlearning quality and bias redistribution across all three methods and all three CLIP variants. Forgetting. Both Prompt Erasure and Prompt Reweighting achieve perfect forgetting (FA = 0.00%) across all three models, completely suppressing each model’s ability to classify Young Female samples. Refusal Vector achieves only partial forgetting in all cases (FA = 64.30%, 71.01%, and 68.35% for ViT-B/32, ViT-L/14, and ViTB/16 respectively), which we attribute to the high cosine similarity between the forget and retain mean embeddings (cos(µf , µr ) = 0.929) the forget direction is deeply entangled with the retained embedding space and cannot be fully isolated without collateral damage. Utility Preservation. Prompt Reweighting achieves the highest retain accuracy for ViT-B/32 (RA = 82.75%) and remains competitive across all variants, outperforming Prompt Erasure by explicitly routing the forget embedding’s mass into the retained classifier heads. Refusal Vector suffers the largest utility drop across all models (RA ≤ 38.43%) because projecting the forget direction out of the image embedding space degrades representations for all groups, not just the forget group. Bias Redistribution. All three methods produce substantial redistribution in at least one retained group across all model variants, confirming that forgetting is not neutral with respect to fairness. Most strikingly, both PE and PR transfer over 60% points of Young Female accuracy onto Old Female across all three models (PE: +71.19%, +61.12%, +65.81%; PR: +69.99%, +59.60%, +59.76% for ViTB/32, ViT-L/14, ViT-B/16 respectively), while Young Male is largely unaffected by PE (≤ +0.88% across all models).
Table 2. Unlearning quality and bias redistribution across methods and CLIP model variants. FA = Forget Accuracy (↓ better), RA = Retain Accuracy (↑ better), DP = Demographic Parity Gap (↓ better), RS = Redistribution Score (↓ better) . ∆Acc columns show pergroup accuracy shift (%) relative to the Original model; large non-zero values for YM/OF/OM indicate bias redistribution.
Model
Method
FA (%) ↓
RA (%) ↑
∆Acc per Group (%)
DP ↓
RS ↓
YF (forget)
YM
OF
OM
ViT-B/32
Original Prompt Erasure Prompt Reweighting Refusal Vector
98.76 0.00 0.00 64.30
54.54 78.57 82.75 33.14
0.7298 0.9697 0.9577 0.5335
−98.76 −98.76 −34.46
+0.88 −14.11 −29.86
+71.19 +69.99 +0.10
+0.03 +28.75 −34.45
24.03 37.62 21.47
ViT-L/14
Original Prompt Erasure Prompt Reweighting Refusal Vector
97.28 0.00 0.00 71.01
59.70 80.27 79.82 38.43
0.6075 0.9765 0.9614 0.5208
−97.28 −97.28 −26.27
+0.61 −18.98 −38.51
+61.12 +59.60 +15.66
+0.00 +19.75 −40.96
20.57 32.78 31.71
ViT-B/16
Original Prompt Erasure Prompt Reweighting Refusal Vector
97.22 0.00 0.00 68.35
57.08 79.26 77.39 36.52
0.6690 0.9614 0.9008 0.5191
−97.22 −97.22 −28.87
+0.73 −25.90 −28.37
+65.81 +59.76 +4.49
+0.00 +27.08 −37.79
22.18 37.58 23.55
This asymmetry redistribution flowing along gender rather than age boundaries is consistent across all three CLIP scales and is analysed geometrically in §6. Refusal Vector produces the lowest redistribution score for ViT-B/32 (RS = 21.47) but at the cost of incomplete forgetting and severely degraded retain accuracy, exposing a fundamental forget–fairness tradeoff that holds across model scales.
5.3. Bias Redistribution Visualization Figure 2 provides a geometric explanation for the redistribution pattern observed in Table 2. In the Original embedding space, the YF and OF clusters occupy adjacent regions, while YM occupies a clearly separated region despite sharing the same age axis as YF. This geometry directly predicts the redistribution direction: suppressing YF forces ambiguous images toward the nearest retained cluster, which is OF rather than YM. After Prompt Erasure and Prompt Reweighting, the correctness panels (bottom row) confirm this red misclassified points concentrate in the YF region and shift toward OF, not YM. Refusal Vector partially disrupts this geometry but at the cost of collateral damage across all groups. Beyond the geometric explanation, Figure 3 shows that bias redistribution incurs a fairness cost that is consistent across all three CLIP model scales. Prompt Erasure and Prompt Reweighting both substantially increase the demographic parity gap despite achieving perfect forgetting, because classification mass shifts to OF rather than being distributed evenly. Refusal Vector is the only method that reduces the parity gap, but it does so at the cost of incomplete forgetting and the largest utility drop among the three methods, confirming a fundamental forget–fairness tradeoff.
Figure 4 provides instance-level evidence of redistribution through patch-level similarity heatmaps for one representative face from each group. For the YF face, the heatmap response is fully suppressed after PE and PR, and the face is reassigned to OF, matching the population-level redistribution observed in Table 2. For retained groups, the heatmaps remain largely stable under PE and PR, suggesting that redistribution arises mainly at the classifier rather than the feature level. Under RV, the Old Male face is erroneously shifted toward the YF direction, revealing collateral damage specific to projection-based unlearning.
5.4. Geometric Analysis of Redistribution Embedding Space Geometry. To understand why redistribution follows gender rather than age boundaries, we compute pairwise cosine similarities between group mean image embeddings in CLIP ViT-B/32’s representation space (Figure 5). The results reveal a clear gender-dominant geometry: same-gender pairs (YF↔OF = 0.945, YM↔OM = 0.935) are consistently more similar than same-age pairs (YF↔YM = 0.885, OF↔OM = 0.878). This six-point gap directly predicts the redistribution direction when YF is suppressed, probability mass flows to the nearest retained cluster, which is OF (same gender) rather than YM (same age). This geometry is a property of CLIP’s pretraining data, not of the unlearning methods themselves. Forget–Fairness Tradeoff Curve. Figure 6 illustrates the tradeoff between Forget Accuracy (FA) and Redistribution Score (RS) across all three methods, where RV is additionally examined over projection strengths λ ∈ {0.0, 0.1, 0.2, 0.3, 0.5, 0.7, 1.0, 1.5, 2.0, 3.0}. PE and PR achieve perfect forgetting (FA = 0%), but incur substan-
Figure 2. t-SNE [25] projections of CLIP ViT-B/32 image embeddings (500 samples per group) before and after each method. Top row: colored by demographic group. Bottom row: colored by prediction correctness (green = correct, red = misclassified). Arrows indicate centroid drift relative to the Original. The proximity of YF and OF clusters explains why forgetting YF redistributes to OF rather than YM.
shows that none of the zero-shot methods considered here resolves this tension without explicit fairness constraints.
6. Analysis and Discussion 6.1. Which Method Redistributes Most?
Figure 3. Demographic Parity Gap (DP) before and after unlearning for each method across all three CLIP variants. Prompt Erasure and Prompt Reweighting consistently worsen fairness despite perfect forgetting, while Refusal Vector is the only method that reduces the parity gap across all models (ViT-B/32: 0.730 → 0.534, ViT-L/14: 0.608 → 0.521, ViT-B/16: 0.669 → 0.519).
tial redistribution (RS = 24.03 and 37.62, respectively), placing them in the upper-left region of the tradeoff space. The RV sweep traces a non-monotonic curve: increasing the projection strength initially improves forgetting while increasing redistribution, whereas beyond λ = 1.0 the projection overshoots, partially restoring the original geometry and reducing both FA and RS. No operating point achieves both low FA and low RS, indicating that the two objectives are fundamentally in tension. Overall, the tradeoff curve
Prompt Reweighting produces the most severe redistribution (RS = 37.62) despite being the most conservative method: it achieves the highest retain accuracy (RA = 82.75%), but amplifies imbalances across all retained groups (OF: +69.99 pp, OM: +28.75 pp, YM: −14.11 pp), showing that high utility does not preclude fairness degradation. Prompt Erasure produces more concentrated redistribution (RS = 24.03): nearly all surplus mass flows to Old Female (+71.19 pp), while Young Male and Old Male are virtually unaffected, consistent with OF being the nearest retained centroid to YF in CLIP’s embedding space (Figure 5). Refusal Vector achieves the lowest redistribution (RS = 21.47) and is the only method that improves demographic parity (0.7298 → 0.5335), but it does so by degrading all groups uniformly rather than cleanly isolating the forget group.
6.2. Why Does Redistribution Follow Gender, Not Age? Both PE and PR transfer over 60 percentage points onto Old Female across all three CLIP scales, while Young
Figure 4. Patch similarity heatmaps for one representative face per demographic group across four conditions (Original, PE, PR, RV). Each heatmap shows cosine similarity between image patches and group text prompt embedding. The YF heatmap vanishes after PE and PR (no signal), while retained group heatmaps remain stable. Badge color indicates prediction correctness (green = correct, red = misclassified).
Male is nearly unaffected (≤ +0.88 pp) the opposite of age-based intuition. The pairwise similarity analysis (Figure 5) explains why: same-gender pairs (YF↔OF = 0.945, YM↔OM = 0.935) are more similar than same-age pairs (YF↔YM = 0.885, OF↔OM = 0.878), a six-point gap that directly predicts the redistribution direction. This gender-dominant geometry is consistent across ViT-B/32, ViT-L/14, and ViT-B/16, confirming it is a property of CLIP’s pretraining data rather than a specific architecture. Predicting where bias will go therefore requires auditing how groups are arranged in the embedding space.
6.3. The Geometric Impossibility of Perfect Erasure Refusal Vector does not achieve FA = 0%, which is consistent with the high alignment between the forget and retain means, cos(µf , µr ) = 0.929. As discussed by Belrose et al. [2], exact linear erasure is most favorable when the forget and retain directions are orthogonal, a condition that is not met here. The RV strength sweep (Figure 6) is consistent with this interpretation: beyond λ = 1.0, stronger projection is associated with a partial restoration of the original geometry, and FA = 0% is not observed.
off is a geometric consequence of the pretrained embedding space, not an artifact of method design.
6.5. Practical Implications
Figure 5. Pairwise cosine similarity between group mean image embeddings in CLIP ViT-B/32. Same-gender pairs (YF↔OF = 0.945, YM↔OM = 0.935, red borders) are consistently more similar than same-age pairs (YF↔YM = 0.885, OF↔OM = 0.878, blue borders), geometrically explaining why redistribution follows gender rather than age boundaries.
Figure 6. Forget–Fairness tradeoff curve. FA (x-axis, ↓ better) vs. RS (y-axis, ↓ better). The RV strength sweep traces a non-monotonic curve from no forgetting (λ=0) to peak forgetting (λ=1.0) and back due to over-projection at high strength. PE and PR are fixed points achieving perfect forgetting but high redistribution. The ideal operating point (lower-left) is unreachable by any zero-shot method evaluated here.
6.4. The Forget–Fairness Tradeoff More complete forgetting produces more severe redistribution across all methods and model scales. PE and PR achieve FA = 0% but worsen demographic parity from 0.7298 to 0.9697 and 0.9577 respectively. RV reduces parity to 0.5335 but leaves FA = 64.30%. No method simultaneously achieves low FA, high RA, and low RS the trade-
1. Always evaluate per-group accuracy. Aggregate RA masks large within-group degradation PR achieves the highest RA (82.75%) yet the worst RS (37.62 pp). 2. Report RS alongside FA and RA. A method achieving FA ≈ 0% at the cost of large RS has not solved the fairness problem it has relocated it. 3. Match method to use case. When complete forgetting is legally required [26], PE is preferable to PR due to lower RS at equivalent FA. When fairness preservation is the primary goal, RV offers the best parity gap reduction. 4. Audit embedding geometry before unlearning. High cos(µf , µr ) signals that no zero-shot method will achieve forgetting without fairness collateral damage.
7. Conclusion We introduced bias redistribution the phenomenon whereby machine unlearning does not neutralize a demographic group’s representation but relocates it along the geometric boundaries of the pretrained embedding space. Experiments on CelebA across three CLIP variants and three zeroshot unlearning methods show that redistribution consistently follows gender rather than age boundaries, explained by a gender-dominant geometry (cos(YF, OF)=0.945 > cos(YF, YM)=0.885), and that projection-based unlearning cannot achieve perfect forgetting when forget and retain embeddings are nearly collinear (cos(µf , µr ) = 0.929). No method simultaneously achieves complete forgetting, utility preservation, and fairness confirming a fundamental forget–fairness tradeoff rooted in embedding geometry. We introduce the redistribution score as a first-class fairness metric for unlearning evaluation, and call for future work on unlearning objectives that explicitly constrain intersectional demographic parity in vision-language models.
7.1. Limitations Our study has three main limitations. First, we evaluate only zero-shot unlearning methods that operate without gradient-based retraining whether gradient-based approaches such as NegGrad+ and SCRUB [17] exhibit similar redistribution patterns remains an open question. Second, all experiments use a single dataset (CelebA) with one designated forget group (Young Female) future work should evaluate redistribution across multiple datasets, varying group imbalance ratios, and different forget targets, including minority groups where redistribution dynamics may differ substantially. Third, our demographic attribute space is binary and coarse (age: Young/Old, gender: Male/Female) extending to continuous or intersectional attributes beyond two axes is an important direction for future work.
8. Acknowledgment This work was supported by NewraLab (苏州拟界智能科 技有限公司, Suzhou, China), an AI research and development startup founded by Yunusa Haruna. The authors gratefully acknowledge the support of the NewraLab team throughout this research. We thank Haoyu Bian for helpful feedback and for assisting in proofreading and polishing the manuscript.
References [1] Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. Refusal in language models is mediated by a single direction. Advances in Neural Information Processing Systems, 37: 136037–136083, 2024. 4 [2] Nora Belrose, David Schneider-Joseph, Shauli Ravfogel, Ryan Cotterell, Edward Raff, and Stella Biderman. Leace: Perfect linear concept erasure in closed form. In Advances in Neural Information Processing Systems, pages 66044– 66063, 2023. 2, 4, 7 [3] Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pages 141–159. IEEE, 2021. 1, 2, 3 [4] Joy Buolamwini and Timnit Gebru. Gender shades: Intersectional accuracy disparities in commercial gender classification. In Proceedings of the Conference on Fairness, Accountability and Transparency (FAT*), pages 77–91. PMLR, 2018. 2 [5] Xavier F Cadet, Anastasia Borovykh, Mohammad Malekzadeh, Sara Ahmadi-Abhari, and Hamed Haddadi. Deep unlearn: Benchmarking machine unlearning for image classification. In 2025 IEEE 10th European Symposium on Security and Privacy (EuroS&P), pages 939–962. IEEE, 2025. 2 [6] Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE Symposium on Security and Privacy (SP), pages 463–480. IEEE, 2015. 1, 2 [7] Thomas De Min, Subhankar Roy, Stéphane Lathuilière, Elisa Ricci, and Massimiliano Mancini. Group-robust machine unlearning. arXiv preprint arXiv:2503.09330, 2025. 3 [8] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pages 265–284. Springer, 2006. 3 [9] Cynthia Dwork, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Richard Zemel. Fairness through awareness. In Proceedings of the 3rd innovations in theoretical computer science conference, pages 214–226, 2012. 3 [10] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310.12508, 2023. 2
[11] Jack Foster, Stefan Schoepf, and Alexandra Brintrup. Fast machine unlearning without retraining through selective synaptic dampening. In Proceedings of the AAAI conference on artificial intelligence, pages 12043–12051, 2024. 2 [12] Rohit Gandikota, Joanna Materzynska, Jaden FiottoKaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 2426–2436, 2023. 2 [13] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 11516–11524, 2021. 2, 3 [14] Laura Gustafson, Chloe Rolland, Nikhila Ravi, Quentin Duval, Aaron Adcock, Cheng-Yang Fu, Melissa Hall, and Candace Ross. Facet: Fairness in computer vision evaluation benchmark. In Proceedings of the IEEE/CVF international conference on computer vision, pages 20370–20382, 2023. 2 [15] Kimmo Karkkainen and Jungseock Joo. Fairface: Face attribute dataset for balanced race, gender, and age for bias measurement and mitigation. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pages 1548–1558, 2021. 2 [16] Michael Kearns, Seth Neel, Aaron Roth, and Zhiwei Steven Wu. Preventing fairness gerrymandering: Auditing and learning for subgroup fairness. In Proceedings of the International Conference on Machine Learning (ICML), pages 2564–2572. PMLR, 2018. 2, 3 [17] Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning. In Advances in Neural Information Processing Systems, pages 1957–1987, 2023. 2, 3, 8 [18] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), pages 3730–3738, 2015. 2, 3, 4 [19] Ziyao Liu, Yu Jiang, Jiyuan Shen, Minyi Peng, Kwok-Yan Lam, Xingliang Yuan, and Xiaoning Liu. A survey on federated unlearning: Challenges, methods, and future directions. ACM Computing Surveys, 57(1):1–38, 2024. 2 [20] Yan Luo, Min Shi, Muhammad Osama Khan, Muhammad Muneeb Afzal, Hao Huang, Shuaihang Yuan, Yu Tian, Luo Song, Ava Kouhana, Tobias Elze, et al. Fairclip: Harnessing fairness in vision-language learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12289–12301, 2024. 3 [21] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Proceedings of the International Conference on Machine Learning (ICML), pages 8748–8763. PMLR, 2021. 2, 3, 4 [22] Shauli Ravfogel, Yanai Elazar, Hila Gonen, Michael Twiton, and Yoav Goldberg. Null it out: Guarding protected attributes by iterative nullspace projection. In Proceedings of the 58th annual meeting of the association for computational linguistics, pages 7237–7256, 2020. 2
[23] Ashish Seth, Mayur Hemani, and Chirag Agarwal. Dear: Debiasing vision-language models with additive residuals. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6820–6829, 2023. 3 [24] Haoran Sun, Haoyu Bian, Shaoning Zeng, Yunbo Rao, Xu Xu, Lin Mei, and Jianping Gou. Datasetagent: A novel multi-agent system for auto-constructing datasets from realworld images. arXiv preprint arXiv:2507.08648, 2025. 3 [25] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9 (11), 2008. 6 [26] Paul Voigt and Axel Von dem Bussche. The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing, Cham, 1 edition, 2017. 1, 3, 8 [27] Junyang Wang, Yi Zhang, and Jitao Sang. Fairclip: Social bias elimination based on attribute prototype learning and representation neutralization. arXiv preprint arXiv:2210.14562, 2022. 3 [28] Jiayu Wang, Haoyu Bian, Haoran Sun, and Shaoning Zeng. Sd-psfnet: Sequential and dynamic point spread function network for image deraining. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 9921–9929, 2026. 3 [29] Shuai Wang, Malu Zhang, Dehao Zhang, Ammar Belatreche, Yichen Xiao, Yu Liang, Yimeng Shan, Qian Sun, Enqi Zhang, and Yang Yang. Spiking vision transformer with saccadic attention. arXiv preprint arXiv:2502.12677, 2025. 3 [30] Alexander Warnecke et al. Machine unlearning of features and labels. In Network and Distributed System Security Symposium (NDSS), 2023. 2, 4 [31] Jiaquan Zhang, Chaoning Zhang, Shuxu Chen, Xudong Wang, Zhenzhen Huang, Pengcheng Zheng, Shuai Yuan, Sheng Zheng, Qigan Sun, Jie Zou, et al. Learning global hypothesis space for enhancing synergistic reasoning chain. arXiv preprint arXiv:2602.09794, 2026. 3