arXiv CSopen access

Gradient Concentration, Not Weight Saliency, Explains Representation-Level Class Unlearning

Highlights Gradient Concentration, Not Weight Saliency, Explains RepresentationLevel Class Unlearning

arXiv:2607.21353v1 [cs.LG] 23 Jul 2026

Billel Habbati , Alessio Merlo , Luca Verderame , Meriem Guerar • A matched-compute ablation isolates the role of saliency-based masking. • Mask identity does not explain representation-level class recoverability. • Forget gradients carry ≈ 92% of their energy in late layers before masking. • Saliency masks exhibit weak class specificity (specificity index 0.09– 0.11). • Effective unlearning may require objectives acting directly on representations.

Gradient Concentration, Not Weight Saliency, Explains Representation-Level Class Unlearning Billel Habbati a,1 , Alessio Merlo b,2,∗, Luca Verderame a,1 , Meriem Guerar a,1 a

DIBRIS – Department of Informatics, Bioengineering, Robotics and Systems Engineering, University of Genova, Via Dodecaneso 35, 16146 Genova, Italy b Centre for Defense Higher Studies (CASD), Palazzo Salviati, Piazza della Rovere 83, 00165 Roma, Italy

Abstract Machine unlearning aims to remove the influence of specific training data while preserving model utility. Many state-of-the-art approaches pursue this goal by restricting the forgetting update to a subset of parameters selected through gradient-based saliency. Although such methods are widely adopted, the actual contribution of saliency-based weight selection to representationlevel forgetting remains unclear. In this work, we perform the first controlled ablation of the saliency masking mechanism used by SalUn. Using a matched-compute experimental design on CIFAR-10 and CIFAR-100 with ResNet-18, we compare saliency-based masking against random masks of equal sparsity and unconstrained updates, while keeping the unlearning objective, optimization schedule, and computational budget fixed. Across multiple representation-level evaluations, including linear probing, prototype recovery, and layer-wise CKA, the three configurations exhibit statistically ∗

Corresponding author. Email addresses: [email protected] (Billel Habbati ), [email protected] (Alessio Merlo ), [email protected] (Luca Verderame ), [email protected] (Meriem Guerar ) 1 B. Habbati, L. Verderame, and M. Guerar are with DIBRIS – Department of Informatics, Bioengineering, Robotics and Systems Engineering, University of Genova, Via Dodecaneso 35, 16146 Genova, Italy. B. Habbati is a Ph.D. student. E-mail: [email protected], [email protected], [email protected]. 2 A. Merlo is with the Centre for Defense Higher Studies (CASD), Palazzo Salviati, Piazza della Rovere 83, 00165 Roma, Italy. E-mail: [email protected]. Corresponding author: A. Merlo.

equivalent representation-level recoverability. We find that forget gradients are strongly concentrated in the final network layers (≈ 92% of the squared gradient energy on CIFAR-10) before any mask is applied, causing all masking strategies to operate within the same representational subspace. Furthermore, saliency masks show limited class specificity (specificity index 0.09– 0.11), selecting highly overlapping parameter subsets across different forget classes. Our findings suggest that, in the studied setting, representation-level forgetting is primarily governed by gradient concentration and representation geometry rather than by the specific identity of saliency-selected weights. More broadly, the results support a growing body of evidence indicating that effective representation-level unlearning requires objectives that act directly on latent representations rather than on increasingly sophisticated weightselection strategies. Keywords: Machine unlearning, Weight saliency, Class forgetting, Ablation study, Representation analysis, Centered kernel alignment 1. Introduction Machine unlearning seeks to remove the influence of specific training data from a learned model without requiring retraining from scratch. The problem has attracted significant attention because modern AI systems are increasingly expected to support data deletion requests, comply with privacy regulations such as the GDPR, and adapt to evolving legal and operational constraints. While exact retraining remains the gold standard for data removal, its computational cost is often prohibitive for large-scale models and frequent deletion requests. As a result, most practical approaches rely on approximate unlearning strategies that modify an already-trained model in place while attempting to preserve utility on the retained data (Bourtoule et al., 2021; Voigt and von dem Bussche, 2017; Xu et al., 2024). A growing body of evidence, however, suggests that evaluating unlearning solely through output behavior can be misleading. Several recent studies have shown that a model may achieve near-zero accuracy on forgotten data while still retaining substantial information about that data within its internal representations (Gao et al., 2026; Kim et al., 2025; Ha et al., 2025). In such cases, supposedly forgotten concepts can often be recovered through simple attacks such as linear probing or feature-space reconstruction. These findings have shifted attention from output-level forgetting toward representation2

level forgetting, raising a broader question: what mechanisms actually drive forgetting inside modern unlearning methods? One influential family of methods addresses forgetting through selective parameter updates. Rather than modifying all model weights during unlearning, these approaches first identify a subset of parameters relevant to the information to be forgotten and restrict optimization to that subset. SalUn (Fan et al., 2024), a representative example of this paradigm, computes a gradient-based saliency mask and updates only the weights selected by that mask. The underlying intuition is appealing: if forgetting-relevant parameters can be identified accurately, modifying only those parameters should improve both efficiency and deletion quality. Despite the widespread adoption of saliency-based masking, its actual role remains surprisingly unclear. Existing studies typically compare SalUn against alternative unlearning methods, but rarely isolate the masking mechanism itself. Consequently, the effect of weight selection remains confounded with the forgetting objective that operates on top of it. This leaves open a fundamental scientific question: Does saliency-based weight selection truly drive representation-level forgetting, or would any mask of comparable size produce the same outcome? In this paper, we answer this question through a controlled matchedcompute ablation. Starting from the same pretrained model, we evaluate three conditions that differ only in the identity of the updated parameters: (i) SalUn’s gradient-saliency mask, (ii) a random mask with identical sparsity, and (iii) unconstrained fine-tuning without masking. All other factors, including the unlearning objective, optimization schedule, and computational budget, are held constant. This design allows us to isolate the contribution of mask selection itself. Our analysis reveals three main findings. First, saliency-based masking, random masking, and unconstrained updates produce statistically equivalent representation-level recoverability on both CIFAR-10 and CIFAR-100 (Figure 1). Second, this equivalence is explained by the structure of the forgetting gradients: before any mask is applied, most gradient energy is already concentrated in the final layers of the network, causing all masking strategies to operate within essentially the same representational subspace. Third, saliency masks exhibit limited class specificity, selecting highly overlapping parameter subsets across different forget classes. Taken together, these results suggest that representation-level forgetting is governed primarily by gradient concentration and representation geometry rather than by the 3

Mean Prototype Recovery (%)

100

SalUn Random Mask RL-full Gold RandInit

80

60

40

20

0

CIFAR-10

CIFAR-100

Figure 1: The saliency mask does not change what survives. Mean forget-class prototype recovery (k=5) across ten classes. On CIFAR-10 all three conditions are equivalent (TOST, Table 2) and sit ≈52pp above Gold; on CIFAR-100 they cluster near Gold, which itself does little to erase fine-grained classes. RandInit: untrained network (texture floor). Higher = more recoverable.

precise identity of saliency-selected weights. Beyond the specific case of SalUn, our findings contribute to a broader discussion emerging in recent representation-level unlearning research. Contemporary methods increasingly achieve forgetting by manipulating latent representations directly rather than by refining parameter selection strategies. Our results provide a mechanistic explanation for this trend by showing that weight selection alone may be insufficient to alter the underlying geometry that encodes forgotten concepts. Unlike the large and growing body of work that proposes new unlearning methods, this paper provides a controlled mechanistic analysis of an existing and widely used one. To the best of our knowledge, this is the first study to isolate SalUn-style saliency masking under a matched-compute protocol and to trace its representation-level behavior to gradient concentration and the limited class specificity of the selected masks. Our aim is not to introduce another deletion algorithm, but to explain why a popular mechanism behaves as it does, a question with direct consequences for how future representationlevel unlearning methods are designed and evaluated. The main contributions of this paper are:

4

• We present the first controlled ablation of saliency-based masking in class unlearning, isolating the contribution of weight selection from that of the underlying unlearning objective. • We show that saliency masks, random masks of equal sparsity, and unconstrained updates yield statistically equivalent representation-level recoverability outcomes across multiple evaluation protocols. • We identify gradient concentration in late network layers as the primary mechanism explaining this equivalence: it is not tied to one selection rule (a diagonal-Fisher mask reproduces the result and selects nearly the same weights, Jaccard 0.83–0.94), and it is consistent with the saliency mask’s weak class specificity (index 0.09–0.11) and heavy overlap across different forgotten classes. • We run a causal placement intervention that forcibly excludes the late subspace and find that output-level forgetting does not require it, while linear separability of the forgotten class survives under every placement; late-subspace updates control only prototype geometry, not erasure. These findings bear directly on the design of future unlearning methods and on the evaluation of representation-level deletion guarantees. 2. Related Work 2.1. Machine Unlearning Beyond Output-Level Forgetting Machine unlearning aims to remove the influence of specific training data from a trained model while avoiding the cost of full retraining. The problem was first framed for statistical-query learners by Cao and Yang (Cao and Yang, 2015). Early work focused primarily on exact or certified removal mechanisms, including data sharding, efficient retraining procedures, influence-function-based approaches, and deletion guarantees for convex and smooth models (Bourtoule et al., 2021; Ginart et al., 2019; Guo et al., 2020; Koh and Liang, 2017; Sekhari et al., 2021; Neel et al., 2021; Izzo et al., 2021). Because these approaches remain difficult to apply to large deep neural networks, much of the recent literature has shifted toward approximate unlearning methods that modify an existing model directly (Nguyen et al., 2022; Xu et al., 2024), with the large-language-model setting surveyed separately (Li et al., 2025). 5

The effectiveness of approximate unlearning has traditionally been evaluated through output-level metrics, such as forget-set accuracy and membership inference attacks (Shokri et al., 2017; Yeom et al., 2018; Carlini et al., 2022). However, recent studies have questioned whether these metrics adequately capture information removal. Several studies have shown that models can achieve apparent forgetting while still retaining substantial information in their internal representations (Hayes et al., 2024; Gao et al., 2026; Kim et al., 2025; Ha et al., 2025). Beyond representation probing, apparent forgetting has also been shown to fail against data poisoning (Pawelczyk et al., 2024) and to be reversible from a few corrective samples (Goel et al., 2024), motivating more careful unlearning benchmarks (Grimes et al., 2024; Thudi et al., 2022). This observation has motivated growing interest in representation-level evaluation as a complementary perspective on unlearning. 2.2. Parameter Selection and Saliency-Based Unlearning A large family of approximate unlearning methods performs targeted modifications of model parameters rather than retraining the entire model. Existing approaches include gradient-based forgetting, amnesiac relabeling, decision-boundary modification, teacher–student distillation, selective synaptic dampening, error-maximizing noise, logit-based filtration, and featureoriented forgetting strategies (Golatkar et al., 2020; Graves et al., 2021; Chen et al., 2023; Kurmanji et al., 2023; Chundawat et al., 2023; Foster et al., 2024; Tarun et al., 2023; Baumhauer et al., 2022; Warnecke et al., 2023). Within this family, SalUn (Fan et al., 2024) introduced gradient-based weight saliency to identify parameters presumed most relevant to the information being forgotten. The central intuition is that restricting updates to a carefully selected subset of weights can improve the efficiency of forgetting while preserving model utility. Related ideas have also appeared in sparsityaware learning and pruning-inspired approaches, where only a subset of parameters is considered critical for adaptation or retention (Jia et al., 2023; Frankle and Carbin, 2019; Han et al., 2015; Mallya and Lazebnik, 2018). Despite their popularity, saliency-based strategies are typically evaluated within complete unlearning pipelines. As a consequence, the individual contribution of parameter selection remains difficult to separate from that of the optimization objective used during forgetting.

6

2.3. Representation-Level Unlearning Recent work has increasingly focused on removing information directly from learned representations rather than only modifying model outputs. Gao et al. (Gao et al., 2026) demonstrated that several state-of-the-art unlearning methods leave class information highly recoverable through linear probing, highlighting a gap between output-level forgetting and representation-level erasure. Similar observations have been reported by subsequent analyses of feature-space recoverability and representation memorization (Kim et al., 2025; Yong et al., 2026; Almudévar and Ortega, 2026), and informationtheoretic metrics have been proposed to quantify erasure strength (Jeon et al., 2026). Motivated by these findings, newer approaches have begun to optimize forgetting directly in latent space. Examples include projection-based methods derived from neural-collapse geometry (Papyan et al., 2020; Le et al., 2025), contrastive representation shaping (Tang and Khanna, 2026), and intermediate-layer representation editing (Lee et al., 2026). Other work has explored depth-aware identification and removal of forget-specific directions across network layers (Hatami et al., 2026). Representational similarity between networks is quantified with tools such as linear CKA (Kornblith et al., 2019), SVCCA (Raghu et al., 2017), and canonical-correlation variants (Morcos et al., 2018), which we use to localize where unlearning reshapes the representation. Collectively, these studies suggest that representation-level forgetting may depend more strongly on feature geometry than on output behavior alone. 2.4. Research Gap Although prior work has extensively compared alternative unlearning algorithms and increasingly investigated representation-level evaluation, one important question remains unanswered: What is the actual contribution of saliency-based parameter selection to representation-level forgetting? Existing studies evaluate saliency masks as components of complete unlearning methods, making it difficult to disentangle the effect of weight selection from that of the forgetting objective. Consequently, it remains unclear whether representation-level forgetting is primarily driven by the choice of masked parameters, by the optimization objective itself, or by structural properties of the underlying gradient dynamics. This paper addresses that gap through a controlled component-level ablation that isolates the role of 7

saliency-based masking while keeping all other aspects of the unlearning process fixed. 3. Methodology This section describes the experimental design used to isolate the role of saliency-based weight selection in class unlearning. We first introduce the unlearning setting and notation, then define the three matched-compute conditions used in the ablation, and finally describe the representation-level metrics and statistical protocol. 3.1. Problem setting and notation Let fθ be a classifier with parameters θ ∈ Rp , trained on a dataset D = D r ∪ Df , where Df is the forget set and Dr is the retain set. In this work, Df contains all samples from one target class, while Dr contains the remaining classes. The gold-standard unlearned model is obtained by retraining from scratch only on the retain set: θ ⋆ = arg min Lr (θ), θ

Lr (θ) =

X 1 ℓ(fθ (x), y) . |Dr |

(1)

(x,y)∈Dr

Approximate unlearning seeks a parameter vector θu that behaves like θ ⋆ with respect to the forgotten class, while preserving predictive utility on Dr . Since full retraining is expensive, practical methods instead modify the original trained model in place. 3.2. Random-label unlearning objective We focus on the random-label (RL) objective (Golatkar et al., 2020) used in SalUn-style class unlearning. The objective combines a forget term, which pushes samples in Df away from their original class, with a retain term, which preserves performance on Dr :

LRL (θ) =

1 |Df |

X

ℓ(fθ (x), ỹ) + λ

(x,y)∈Df

X 1 ℓ(fθ (x), y) , |Dr | (x,y)∈Dr

8

(2)

where ỹ is a randomly sampled incorrect label, i.e.,
ỹ ∼ Unif Y \ {y} , and λ > 0 controls the retain–forget trade-off. The first term reduces the model’s association between forgotten samples and their original class, while the second term discourages unnecessary degradation of retained classes. Importantly, this objective is kept fixed in all our experimental conditions. Therefore, any difference between conditions can be attributed to the parameter mask rather than to the loss being optimized. 3.3. Saliency mask and masked updates SalUn restricts the update to a subset of parameters selected by a gradient-based saliency mask. To define this mask rigorously, let gf (θ) = ∇θ Lf (θ) ∈ Rp be the gradient of the forget loss, where Lf (θ) =

1 |Df |

X

ℓ(fθ (x), y) .

(3)

(x,y)∈Df

For a target sparsity level s ∈ (0, 1], the saliency mask selects the k = ⌊sp⌋ parameters with largest absolute forget-gradient magnitude: mS,i = 1 [|gf,i (θ)| ≥ τs (|gf (θ)|)] ,

i = 1, . . . , p,

(4)

where τs (|gf (θ)|) denotes the threshold selecting the top k = ⌊sp⌋ entries of the coordinate-wise absolute gradient vector. Equivalently, ∥mS ∥0 = k. Given a binary mask m ∈ {0, 1}p , the masked unlearning update is θt+1 = θt − η (m ⊙ ∇θ LRL (θt )) ,

(5)

where η is the learning rate and ⊙ denotes element-wise multiplication. This formulation makes explicit that the mask does not change the loss function. It only determines which gradient coordinates are allowed to update the model parameters. 9

3.4. Matched-compute ablation The central goal of our study is to determine whether the identity of the saliency-selected weights is responsible for representation-level forgetting. To isolate this factor, we compare three conditions that differ only in the mask m used in Eq. 5: • Saliency mask: m = mS , where mS selects the parameters with largest forget-gradient magnitude, as in Eq. 4. • Random mask: m = mR , where mR is sampled uniformly among all binary masks with the same cardinality as the saliency mask: ∥mR ∥0 = ∥mS ∥0 . • RL-full: m = 1, corresponding to random-label unlearning without masking. All three conditions start from the same trained model and optimize the same objective in Eq. 2. They also use the same learning rate, number of repair epochs, retain regularization, and data splits. Thus, the only controlled variable is the choice of mask (Figure 2). This design separates the effect of saliency-based parameter selection from the effect of the random-label unlearning objective. If the saliency mask is the main driver of representationlevel forgetting, replacing it with a random mask or removing it should produce measurably different representation-level outcomes. If the three conditions behave similarly, then the results indicate that mask identity is not the dominant factor under this experimental setting. Two further conditions run under the identical protocol and sharpen the analysis. The Fisher mask replaces the saliency criterion with a second selection rule, the top-50% of weights by diagonal empirical Fisher importance (the second-moment statistic used by the SSD/EWC family (Foster et al., 2024; Kirkpatrick et al., 2017)), so the claim is not tied to one mask construction. The Early mask is a causal intervention on mask placement: every weight in the stem and the first three residual blocks is trainable and layer 4 plus the head are frozen exactly as masked-out weights are above, forcing the update into the subspace that no gradient-derived mask selects (§4.8); a forced variant repeats it at 3× the learning rate under gradient clipping.

10

SalUn Mask (Gradient Saliency) Trained Base Model

Random Mask (Equal Sparsity)

Matched-Compute Random-Label Fine-tuning

Prototype Recovery Linear CKA

No Mask (RL-full)

Figure 2: The matched-compute ablation. Three conditions branch from one base model and differ only in the weight mask; learning rate, epochs, and retain term are identical. Any difference in outcome is therefore attributable to mask selection alone.

3.5. Datasets, model, and reference conditions We evaluate single-class unlearning on CIFAR-10 and CIFAR-100 (Krizhevsky, 2009) using ResNet-18 (He et al., 2016), the benchmark used by the closest representation-level auditing work (Gao et al., 2026; Jung et al., 2025; Ha et al., 2025). For each dataset, one class is treated as Df , and all remaining classes form Dr . We use the same backbone, data splits, learning rate, repair epochs, and sparsity level across the matched conditions. In addition to the three unlearning conditions, we use two reference models: • Gold: a model retrained from scratch on Dr (Eq. 1), corresponding to exact class removal. • RandInit: an untrained network used as a lower-level feature baseline. This reference helps identify cases where prototype recovery reflects low-level visual or texture structure rather than retained class-specific knowledge. These references are not part of the matched-compute ablation. Instead, they provide context for interpreting how much information remains recoverable after unlearning. 3.6. Representation-level evaluation We evaluate unlearning at both the output and representation levels. Output-level forget accuracy verifies whether the model has stopped predicting the forgotten class. However, because low forget accuracy does not 11

necessarily imply removal of internal information, our main analysis focuses on representation-level recoverability. We use the following metrics: • Linear probe: a logistic regression classifier trained on frozen averagepooling features. This measures whether class information remains linearly accessible in the representation. • Prototype recovery (Ha et al., 2025): a few-shot nearest-centroid attack in the penultimate feature space. A centroid is built from k forget-class examples, and held-out forget examples are classified by proximity to that centroid. • Layer-wise CKA (Kornblith et al., 2019): linear centered kernel alignment between the original model and the unlearned model at each network depth. This measures which layers are most affected by unlearning. • Head-only relearning: a weaker attack that retrains only the final classifier head on a held-out retain subset (with no forget labels, so 0% recall is expected) and measures whether the forgotten class reappears. • Membership inference (Shokri et al., 2017): a permutation-test output-level sanity check based on standard membership-inference evaluation. Together, these metrics distinguish output-level forgetting from representationlevel erasure. In particular, the linear probe and prototype recovery directly test whether the forgotten class remains recoverable from internal features. 3.7. Statistical protocol The main empirical claim tested in this paper is one of equivalence rather than difference. A standard difference test can fail to reject the null hypothesis even when two methods are not meaningfully equivalent. Therefore, we use the two one-sided tests (TOST) procedure (Schuirmann, 1987; Lakens, 2017) to assess whether the differences between conditions fall within a pre-specified equivalence margin. TOST appears not to have been used for equivalence claims in the unlearning literature, where “similar” is typically asserted by inspection. For each paired comparison, we test equivalence at margin δ = ±5pp, 12

where pp denotes percentage points. We fix δ a priori, calibrated to the seed-noise floor: it sits at the level of the inter-seed standard deviation of recovery (≈ 3–4pp on CIFAR-10), so a difference inside the margin cannot be distinguished from run-to-run noise, while it remains below any difference meaningful to an attacker. A significant TOST result indicates that the observed difference is statistically contained within this margin. We also report paired t-tests to show whether any conventional difference is detected. For CIFAR-10, we evaluate all ten classes and replicate the full class sweep across three random seeds (42 primary, 1337, 999), yielding thirty class-seed runs per condition. We apply the same ten-class protocol to CIFAR-100. For each class, results are averaged over seeds before paired statistical testing, so that each class contributes one paired observation (n=10). The multiseed runs are used to assess stability and to distinguish systematic mask effects from seed-dependent variation. Where the few-shot prototype metric is high-variance (CIFAR-100, per-class SD ≈ 13pp), a standard TOST power calculation (α=0.05, power 0.8) indicates roughly n ≈ 40 classes would be needed to resolve the comparison, four times our census; the lower-variance linear probe is the decisive metric there. 4. Results We now evaluate whether saliency-based weight selection changes what the model encodes after class unlearning. The results are organized around the three questions introduced in Section 3. We first test whether the saliency mask produces different representation-level outcomes from random or unconstrained updates. We then analyze why the three conditions behave similarly by inspecting the geometry of the learned representations and the distribution of the forgetting gradients. Finally, we examine whether the saliency mask itself contains class-specific information. 4.1. Saliency-based masking does not yield distinguishable representationlevel forgetting We begin with CIFAR-10, where class boundaries are sufficiently separated for prototype recovery to provide a discriminative representation-level test. Table 1 reports the mean prototype recovery across all ten forget classes and three random seeds. The three matched conditions (SalUn, random mask, and RL-full) produce nearly identical recovery values: 93.2%, 93.9%,

13

and 93.6%, respectively. In contrast, the Gold retrain reaches 41.5%, while RandInit (the untrained texture floor) reaches 25.5%. This pattern has two implications. First, all three approximate unlearning conditions leave the forgotten class substantially more recoverable than exact retraining. Second, and more importantly for our ablation, the saliency mask does not produce a representation-level outcome distinguishable from either a random mask of equal sparsity or an unconstrained update. The paired equivalence tests in Table 2 confirm this interpretation. At the prototype recovery level, all three pairwise comparisons on CIFAR-10 fall within the pre-specified ±5 percentage-point equivalence margin, with TOST p < 0.001. The same conclusion holds for the linear-probe metric: all pairwise differences are at most 0.2 percentage points and are statistically equivalent at the same margin. Thus, under the controlled conditions of our experiment, the specific identity of the saliency-selected weights does not explain representation-level class recoverability. Importantly, this result does not arise because the unlearning objective failed at the output level. In all three conditions, forget accuracy drops to 0.0%, meaning that the model no longer predicts the forgotten class as its original label. The residual information is therefore not visible from output accuracy alone; it remains accessible through internal representations. The result is also not specific to SalUn’s selection rule. The Fisher-mask condition, which ranks weights by a second-moment importance statistic instead of gradient magnitude, lands at 93.4% recovery on CIFAR-10 and 25.6% on CIFAR-100, statistically equivalent to SalUn on both datasets (TOST p<0.001 and p=0.01 respectively; Table 2) and to the random mask and RLfull on CIFAR-10 (p<0.001), with the same inconclusive prototype pattern on CIFAR-100 that §4.2 documents for the other pairs. On the linear probe it is equivalent to all three conditions on both datasets (p<0.001). §4.7 shows why: the two criteria select nearly the same weights. 4.2. CIFAR-100: fine-grained structure limits prototype-based conclusions CIFAR-100 presents a different evaluation regime. Because classes are finer-grained and more visually overlapping, prototype recovery is less discriminative than on CIFAR-10. This is visible in Table 1: the Gold retrain itself reaches 25.5% prototype recovery, essentially tied with the three approximate unlearning conditions (25.5–27.4%) and only modestly above the RandInit texture floor (22.4%). In other words, even a model retrained with14

Table 1: Representation-level recovery after unlearning. Mean prototype recovery (k=5) on CIFAR-10 and CIFAR-100: mean over 10 classes, each class averaged over 3 seeds; ± is the SD of that 10-class mean across the three seeds (per-class spreads are given in Table C.2). Higher values indicate that the forgotten class remains more recoverable from internal features. Reference rows are shown in grey.

Condition

CIFAR-10

CIFAR-100

SalUn (saliency mask) Random mask (same sparsity) RL-full (no mask) Fisher mask (2nd criterion)

93.2 ± 0.3 93.9 ± 0.5 93.6 ± 0.8 93.4 ± 0.2

25.5 ± 5.4 26.7 ± 4.8 27.4 ± 4.2 25.6 ± 2.4

Gold (retrain) RandInit (texture floor)

41.5 ± 0.1 25.5 ± 1.2

25.5 ± 0.2 22.4 ± 1.5

out the forgotten class can still yield features from which that class is partially recoverable. This observation should not be interpreted as evidence that approximate unlearning is as effective as exact retraining on CIFAR-100. Rather, it indicates that few-shot prototype recovery is strongly influenced by the geometry of fine-grained visual classes. When classes share low-level or semantic structure, a nearest-centroid attack can recover part of the forgotten class even from features that were never trained on that class. For this reason, prototype recovery does not provide a high-powered equivalence test on CIFAR-100. As shown in Table 2, none of the prototypebased mask comparisons is statistically equivalent or significantly different. The observed differences are small in magnitude, but the per-class variance is too large for the test to resolve them reliably. The linear probe provides a more stable representation-level comparison. On CIFAR-100, all three mask conditions are statistically equivalent under linear-probe recall, with pairwise differences of at most 0.6 percentage points and TOST p < 0.001. Thus, while prototype recovery is limited by the fine-grained structure of CIFAR-100, the lower-variance linear-probe metric supports the same conclusion obtained on CIFAR-10: saliency-based masking 15

Table 2: Paired equivalence and difference tests with equivalence margin δ = ±5 percentage points. Each paired observation corresponds to one forget class, averaged over three seeds. For TOST, p < 0.05 indicates statistical equivalence within the pre-specified margin. Prototype recovery resolves the comparison clearly on CIFAR-10 but is high-variance on CIFAR-100. Linear-probe recall provides a lower-variance representation-level test and confirms equivalence across all mask conditions on both datasets.

CIFAR-10

CIFAR-100

diff (pp) TOST p diff (pp) TOST p

Comparison Prototype recovery (k=5) SalUn vs. RL-full (mask vs. no mask) Random mask vs. RL-full SalUn vs. Random mask Fisher mask vs. SalUn (2nd criterion)

−0.4 +0.3 −0.6 +0.2

< 0.001 < 0.001 < 0.001 < 0.001

−1.9 −0.7 −1.2 +0.1

0.20 0.17 0.08 0.01

Linear-probe recall (avgpool) SalUn vs. RL-full Random mask vs. RL-full SalUn vs. Random mask Fisher mask vs. SalUn

+0.1 +0.1 −0.0 −0.0

< 0.001 < 0.001 < 0.001 < 0.001

−0.6 −0.1 −0.4 +0.1

< 0.001 < 0.001 < 0.001 < 0.001

vs. Gold (paired difference test) SalUn vs. Gold RL-full vs. Gold Random mask vs. Gold

+51.7pp, p < 0.001 +52.1pp, p < 0.001 +52.4pp, p < 0.001

+0.0pp, n.s. +1.9pp, n.s. +1.2pp, n.s.

does not yield a distinguishable representation-level advantage over random or unconstrained updates. The multi-seed analysis further supports this interpretation. Prototype recovery varies substantially across seeds on CIFAR-100, with several classes showing large seed-dependent swings. These fluctuations do not follow a consistent direction in favor of either the saliency mask or the random mask. We therefore interpret CIFAR-100 as evidence that fine-grained datasets require care in representation-level auditing: prototype recovery can expose residual structure, but it may not always provide a sufficiently stable test for comparing closely related unlearning mechanisms.

16

4.3. Random masks behave like saliency masks across classes and sparsity levels The most direct test of the saliency hypothesis is the comparison between the SalUn mask and a random mask with the same sparsity. If the saliency criterion identifies parameters that are specifically responsible for forgetting a class, then replacing those parameters with a random subset of equal size should degrade representation-level forgetting. This is not what we observe. On CIFAR-10, SalUn and random masking are statistically equivalent under prototype recovery, with a mean difference of −0.6 percentage points and TOST p < 0.001. They are also equivalent under linear-probe recall, where the difference is effectively zero. On CIFAR100, the prototype comparison remains statistically indeterminate because of the high per-class variance discussed above, but the linear probe again shows equivalence, with a difference of −0.4 percentage points and TOST p < 0.001. Figure 3 shows the class-level comparison. On CIFAR-10, nine of ten classes fall within the ±5 percentage-point equivalence band. The only marginal outlier is frog, where the saliency mask trails the random mask by 5.7 percentage points at the primary seed. This deviation does not generalize across the remaining classes or seeds. On CIFAR-100, individual class differences are larger, but their signs change across seeds, indicating seeddependent variability rather than a systematic advantage of one mask over the other. We also test whether this conclusion depends on the sparsity level. A sweep over sparsity ratios in {0.1, 0.3, 0.5, 0.7} on three representative classes shows that, on CIFAR-10, the SalUn and random-mask outcomes remain close across sparsity levels, with small differences of mixed sign; on CIFAR100 the variability is larger, but no sparsity level yields a consistent advantage for the saliency mask. Table C.5(b) in Appendix C extends this check from three classes to the full ten-class census at every ratio, using the mask’s raw overlap with an independent random mask rather than the noisier downstream recovery outcome: the overlap matches the analytic chance-level null r/(2 − r) to within 0.0005 at every ratio on both datasets, confirming the same conclusion with a cleaner, complete measurement. Together, these results suggest that the representation-level behavior of SalUn is not explained by the specific identity of the saliency-selected weights. The outcome is instead consistent with a setting in which the objective and the gradient structure already constrain where the update can act, leaving 17

CIFAR-10

CIFAR-100

SalUn Saliency Recovery (%)

100.0

50

97.5 40 95.0 92.5

30

90.0 20

87.5 85.0

10 82.5 ±5pp Equivalence 80.0

80

85

90

95

100

Random Mask Recovery (%)

0

0

10

20

30

40

50

Random Mask Recovery (%)

Figure 3: Saliency and random masks yield similar class-level recovery. Prototype recovery under the SalUn saliency mask and a random mask of equal sparsity. Each point corresponds to one forget class; the shaded region denotes the ±5 percentage-point equivalence band. On CIFAR-10, nearly all classes fall within the equivalence region. On CIFAR-100, per-class differences are larger but do not show a consistent direction across seeds.

limited room for the precise mask identity to change the recovered representation. 4.4. Mask identity does not change the redirection pattern The previous results show that the amount of recoverable class information is similar across masks. A remaining possibility is that different masks preserve the same amount of information but redirect forgotten samples toward different retained classes. To test this, we record the most frequent top-1 prediction assigned to held-out forget-class samples after unlearning. Table C.7 in Appendix C summarizes this analysis. On CIFAR-10, all three unlearning conditions redirect each forgotten class toward the same dominant wrong class. On CIFAR-100, the agreement is slightly weaker, as expected from the finer-grained class structure, but the three conditions still agree for most classes and differ mainly when multiple candidate classes receive similar fractions of predictions. This result complements the recovery analysis. The saliency mask not only preserves a similar amount of representation-level information as the random and full-update baselines, but it also tends to move forgotten samples 18

Linear CKA to Original (mean over classes)

CIFAR-10 (n=10 classes, ±1 SD band)

CIFAR-100 (n=10 classes, ±1 SD band)

1.0

0.8

0.6

0.4 Baseline SalUn Random Mask RL-full Gold

0.2

0.0

L1

L2

L3

L4

AvgPool

L1

L2

L3

L4

AvgPool

Figure 4: All matched conditions reshape the same late representation. Layerwise linear CKA between each unlearned model and the original model, averaged over ten classes. Early and intermediate layers remain close to the original representation, while the final residual block changes substantially. The SalUn, random-mask, and RL-full profiles are closely aligned, indicating that the three updates affect similar representational regions.

toward the same neighboring classes. The redirection pattern appears to be governed more by the geometry of the learned feature space than by maskspecific parameter selection. 4.5. Gradient concentration explains the equivalence between masks The matched ablation shows that saliency, random, and unconstrained updates produce similar representation-level outcomes. We now ask why. The central observation is that the unlearning gradients are already highly localized before any mask is applied. Figure 4 reports the layer-wise CKA between the original model and the unlearned models. Across both datasets, the early and intermediate layers remain largely unchanged after unlearning. Layers 1 through 3 maintain high similarity to the original model, while most of the representational change is concentrated in the final residual block. This pattern is nearly identical for the SalUn mask, the random mask, and the unconstrained update. The gradient-energy analysis in Figure 5 explains this behavior. Before any mask is applied, the forget-loss gradient is already concentrated in the later parts of the network. On CIFAR-10, layer 3, layer 4, and the classifier head together account for approximately 92% of the squared gradient norm (three-seed mean; per-seed range ≈87–99%). On CIFAR-100, they account for approximately 81% (range ≈77–88%). Within this late region the energy is dominated by layer 4 and the head, while layer 3 contributes only 19

≈9% (CIFAR-10); this is why layer 3 can carry gradient energy yet retain CKA≥0.9 to the original. The random-label gradient that SalUn actually optimizes is even more concentrated in the late layers (≈99% on CIFAR-10, ≈89% on CIFAR-100). We measure this concentration directly rather than assume it: the retain-set gradient shows the same late concentration (≈95% / ≈79%), confirming it is a generic property of the converged network’s loss geometry rather than something the forget set induces. It is consistent with the broader finding that parameter importance is highly non-uniform (Frankle and Carbin, 2019; Han et al., 2015; Hoefler et al., 2021) and with the geometry of neural collapse (Papyan et al., 2020) invoked by Gao et al. (Gao et al., 2026), though the late-layer localization is a property of class-forget gradients that we establish empirically here. This provides a mechanistic explanation for the equivalence observed above. The mask determines which coordinates of the gradient are allowed to update the model, but the gradient itself already determines where most update energy lies. Therefore, different masks are applied to update directions that are structurally concentrated in the same late network regions. This limits the ability of mask identity alone to produce substantially different representation-level outcomes. This finding should be interpreted as an empirical mechanism rather than a general theorem. We do not claim that gradient concentration must occur in all architectures, datasets, or unlearning settings. Rather, in the ResNet18 class-unlearning setting studied here, the observed gradient distribution provides a direct explanation for why SalUn, random masking, and unconstrained random-label updates reshape similar parts of the representation and leave similar amounts of class information recoverable. 4.6. The forgotten class remains geometrically coherent CKA identifies where the representation changes, but it does not directly indicate whether the forgotten class remains organized as a coherent group in feature space. To assess this, we measure the cosine silhouette of the forget class in the penultimate representation. Table C.6 in Appendix C shows that the SalUn, random-mask, RL-full, and Fisher conditions all preserve a high forget-class silhouette on CIFAR-10, in the same range as the original trained model (≈0.6–0.7). In contrast, the Gold retrain pushes the silhouette toward zero, indicating that the forgotten class no longer forms the same coherent cluster in the feature space of a model trained without that class. 20

The same qualitative pattern is visible in the t-SNE visualization in Figure 6. For the representative CIFAR-10 class cat, the forget-class samples remain compact and visually separated after SalUn, random masking, and unconstrained random-label updates. Under Gold, the cluster becomes less compact and partially overlaps with neighboring retained classes. These results clarify the difference between output-level forgetting and representation-level erasure. Although all unlearning conditions suppress the forgotten class at the classifier output, they do not dissolve the internal feature-space structure that makes the class recoverable. 4.7. Saliency masks show limited class specificity The previous analysis shows that different masks act on gradients concentrated in similar late-layer regions. We now examine whether the saliency masks themselves encode class-specific information. If SalUn identifies parameters that are specific to a particular forgotten class, masks computed for different forget classes should exhibit substantially lower overlap than masks computed from the same or related data distributions. For each dataset, class, and seed, we compute the SalUn forget-class mask and compare it with three alternatives: masks computed from other forget classes, masks computed from the retain set, and masks computed from random labels on the same forget images. We measure overlap using the Jaccard index. Table 3 and Figure 7 show that masks computed from other classes overlap with the forget-class mask almost as much as masks computed from the retain set. On CIFAR-10, the mean Jaccard overlap is 0.397 for other-class masks and 0.395 for retain-set masks. On CIFAR-100, the corresponding values are 0.405 and 0.400. This indicates limited class specificity: the saliency mask is not substantially more aligned with the forgotten class than with gradients computed from retained data. We summarize this as a specificity index, (Jother −J0 )/(1−J0 ): the mask’s excess overlap above the permutation null J0 =1/3 (for 50%-sparsity masks), expressed as a fraction of the maximum possible excess. It is 0.096 on CIFAR10 and 0.107 on CIFAR-100, with per-seed values spanning 0.09–0.11 (the index quoted in the abstract and conclusion). Because the other-class overlap is indistinguishable from the retain-set overlap, the mask carries essentially zero forget-specific signal beyond what the architecture forces. This is the upstream reason a random mask of equal sparsity matches SalUn (§4.1, §4.3): the weights SalUn selects to forget a class are largely those it would select 21

for any class, or from no particular class at all. The practical implication is that SalUn’s weight selection is effectively class-agnostic at the representation level, so privacy guarantees attributed to the saliency mechanism should not be assumed to follow from it. The random-label comparator has higher overlap, with mean Jaccard values of 0.674 on CIFAR-10 and 0.727 on CIFAR-100. This comparison must be interpreted carefully because it reuses the same input images and therefore mixes label effects with shared activation patterns. We therefore do not treat it as a clean label-only ablation. Nevertheless, the result is consistent with the broader picture that saliency masks are strongly influenced by input-induced gradient structure. The Fisher-mask condition closes the loop between mask geometry and outcome. Although it ranks weights by a different statistic (second moment rather than magnitude of the mean gradient), its mask overlaps SalUn’s at J=0.83 (CIFAR-10) and J=0.94 (CIFAR-100) against the 1/3 chance null, with ≈89% of its budget in layer 3+4+head on both datasets (Table C.5(c)). Gradient-derived selection rules do not merely produce the same unlearning outcome (Table 1); they select nearly the same weights, because both statistics inherit the same late-concentrated gradient (§4.5). The class-agnosticism finding therefore covers the rule family, not one instance of it. Table 3: Mask overlap across ten forget classes and three seeds per dataset. The retain-set row provides an empirical baseline for non-forget-specific gradient structure. The randomlabel row reuses the same forget images with scrambled labels and should therefore be interpreted as reflecting both label and input-activation effects.

Comparator

CIFAR-10 mean J

CIFAR-100 mean J

Other class Retain set Random label

0.397 0.395 0.674

0.405 0.400 0.727

As a preliminary diagnostic, we also tested a contrastive mask based on the difference between average forget and retain gradients for one class and one seed. This construction did not materially increase class specificity and further concentrated the selected parameters in the final residual block. Because this analysis is not replicated across all classes and seeds, we treat it only as a supporting diagnostic rather than as a main result. 22

Overall, the mask-overlap analysis supports the interpretation developed above. Saliency-based masking does not appear to isolate a strongly classspecific subset of parameters in this setting. Instead, the selected coordinates largely reflect gradient structures that are shared across classes and concentrated in the same late network regions. 4.8. Causal test: forgetting without the late subspace The mechanism account of §4.5 is correlational: every gradient-derived mask lands in the late subspace, and every one produces the same outcome. To test the account causally, the early-mask condition (§3) inverts the placement: all of stem+layers 1–3 is trainable (24.8% of parameters) and layer 4 plus the head are held bit-exact frozen, so the update is confined to the subspace that no gradient-derived rule selects. A forced variant repeats this at 3× the learning rate under gradient clipping. Both run the identical objective, schedule, and protocol. Output-level forgetting does not need the late subspace. Across all 60 classseed runs on the two datasets, the early mask drives forget accuracy to 0–4%, with retain accuracy at the Gold level (72–74% on CIFAR-100). Updating early weights changes late-layer activations without touching late weights, and the random-label objective exploits this route without difficulty. The forget loss can therefore be satisfied from essentially anywhere in the network; reaching the late subspace is not the binding constraint on outputlevel forgetting. Notably, the early mask needs more optimization to get there (median 2–3 repair epochs to convergence on CIFAR-100, against 1 for the saliency-family masks), which rules out under-training as an explanation for the representational differences below. What placement does control: prototype geometry, not separability. The two representation metrics dissociate cleanly. On the linear probe, the early mask is statistically equivalent to SalUn on both datasets (recall 96.8 vs. 98.0% on CIFAR-10, 92.2 vs. 92.5% on CIFAR-100; TOST p<0.001 for both) and sits ≈5pp above Gold (t-test p<10−4 on both datasets): linear separability of the forget class survives regardless of where the update lands, extending the equivalence result of §4.1–§4.3 causally. On prototype recovery, placement matters where the metric has room to move: on CIFAR-100 the early mask leaves recovery at 59.0 ± 1.4%, close to the base model’s 67.9% and +33.5pp above SalUn (paired t-test p<10−5 ; TOST p≈1), while every late-subspace 23

condition sits at the Gold floor (25–27%). On CIFAR-10 the prototype metric is ceiling-saturated (base 94.3%) and the early mask is TOST-equivalent to SalUn (92.1 vs. 93.2%, p=0.003). The forget-class silhouette completes the picture: under the early mask it drops to 0.56 (forced: 0.53) against 0.61– 0.68 for the late masks, yet remains far above Gold’s −0.09; early updates distort the cluster’s geometry more while dissolving it less. Table 4: The causal placement test. Forget accuracy, linear-probe recall, prototype recovery (k=5), and CIFAR-10 forget-class silhouette for the early-only mask (layer 4+head frozen) and its forced (3× LR) variant, against SalUn and Gold. All values seed-averaged over the 10-class census. Late updates move the geometry-sensitive prototype metric to the Gold floor on CIFAR-100 without reducing probe recall; early updates achieve the same output-level forgetting while moving neither.

Probe recall (%)

Recovery (%)

Silh.

Condition

fa (%) C-10

C-100

C-10

C-100

C-10

Early mask Early mask, 3×

0–4 0–4

96.8 96.4

92.2 91.2

92.1 90.4

59.0 59.4

0.56 0.53

SalUn Gold

0 0

98.0 91.8

92.5 87.4

93.2 41.5

25.5 25.4

0.62 −0.09

Reading. The intervention refines the mechanism account in one direction and falsifies it in another. Falsified: the late subspace is not necessary for output-level forgetting, so gradient concentration does not gate whether a mask can forget. Refined: what late-subspace updates specifically produce is the displacement of prototype geometry toward Gold-like values, and this displacement is achievable only from the late subspace, without ever constituting erasure, since the linear probe stays at base level under every condition. Geometry-sensitive scores can therefore be driven toward the exact-retrain reference by any late-subspace update while the class remains fully separable, and a placement that avoids the late subspace forgoes even that appearance. Two caveats: the forced variant pays 3–6pp of retain accuracy on CIFAR-100 (below our utility gate on all 30 runs), so we treat it as supporting evidence only; and 2 of 30 forced runs did not reach the forget-accuracy criterion.

24

stem

Share of forget-gradient L2-energy by region (%)

layer2

layer3

layer4

head

CIFAR-10 (layer3+layer4+head mean = 92% of energy)

100

80

60

40

20

0

ne

pla

air

le

obi

om

aut

bir

d

cat

r

dee

dog

fro

g

se

hor

ck

p

tru

e

tan

shi

CIFAR-100 (layer3+layer4+head mean = 81% of energy)

100

Share of forget-gradient L2-energy by region (%)

layer1

80

60

40

20

0

le

app

e

ycl

bic

bus

clo

ud

n

phi

dol

lio

ee

n

_tr ple

ma

r

pea

ros

k

Figure 5: Forget gradients are concentrated in late network regions before masking. Share of the forget-loss gradient’s squared ℓ2 -norm by network region, measured before any unlearning step. Layer 3, layer 4, and the classifier head account for most of the gradient energy on both datasets. As a result, different masks are applied to gradients that already concentrate their update direction in the same late subspace.

25

Base

SalUn

Random mask

RL-full

Gold

forget (cat) retain forget (cat)

Figure 6: Feature-space visualization of class survival. t-SNE of penultimate features for CIFAR-10 class 3 (cat) against all retained classes. Under SalUn, random mask, and RL-full, the forget-class samples remain compact and separated from most retained samples. Under Gold, the cluster is less coherent and partially dispersed among neighboring retained classes. CIFAR-10

CIFAR-100

Jaccard overlap with SalUn forget mask

mean

0.8

0.7

0.6

0.5

0.4 null = 1/3

vs. retain-set mask

vs. other-class mask

vs. random-label mask

vs. retain-set mask

vs. other-class mask

vs. random-label mask

Figure 7: Saliency masks show limited class specificity. Jaccard overlap between the forget-class SalUn mask and three comparator masks over class-seed combinations. Other-class and retain-set masks exhibit very similar overlap with the forget-class mask, suggesting that the selected parameters are not strongly specific to the forgotten class.

26

5. Discussion The results provide a consistent answer to the question posed in this paper: in the class-unlearning setting studied here, the identity of the saliencyselected weights does not explain representation-level forgetting. Saliency masking, random masking, and unconstrained random-label updates lead to statistically equivalent representation-level outcomes under the most stable metrics. The mechanism behind this equivalence is not that masks have no effect in general, but that the gradients used for unlearning are already strongly concentrated in late network regions before masking is applied. As a result, different masks operate on update directions that are structurally biased toward the same representational subspace. This interpretation reframes the role of saliency-based masking. SalUnstyle masks may still provide computational or optimization advantages in some settings, and our results do not challenge their reported output-level or generative behavior. However, for representation-level class forgetting on CIFAR-10/100 with ResNet-18, the saliency criterion does not appear to isolate a class-specific subset of parameters that determines whether the forgotten class remains recoverable. Instead, recoverability is better explained by the geometry of the learned representation and by the concentration of the unlearning gradient. 5.1. Implications for unlearning evaluation A central implication is that output-level forgetting is not sufficient to assess deletion quality. In our experiments, all three unlearning conditions reduce forget accuracy to zero, yet the forgotten class remains highly recoverable from internal features on CIFAR-10. This gap illustrates why representation-level auditing is necessary when unlearning is used to support privacy, deletion, or compliance claims. The results also suggest that different representation-level metrics should be interpreted with care. Prototype recovery is useful because it directly tests whether a class remains clustered in feature space. However, on fine-grained datasets such as CIFAR-100, prototype recovery can be strongly affected by shared visual structure among classes. In this setting, even the Gold retrain can yield non-trivial prototype recovery, meaning that the metric reflects both residual model information and the intrinsic geometry of the dataset. Linear probing provides a lower-variance complementary test and, in our experiments, gives the clearest comparison between masking conditions. 27

Taken together, these findings support a broader evaluation principle: unlearning should be audited at multiple levels. Output accuracy verifies whether the classifier still predicts the forgotten label; representation-level metrics test whether the information remains accessible inside the model; and reference models such as Gold and RandInit help separate retained class information from dataset-level visual structure. 5.2. Implications for method design The main design implication is that better weight selection alone may not be sufficient for representation-level forgetting. If the objective produces gradients concentrated in late layers, then any binary mask applied to those gradients will inherit the same structural bias. Under this condition, changing the identity of selected weights can have limited effect on the geometry of earlier or intermediate representations, where class information may still remain organized. This interpretation is aligned with recent representation-level unlearning methods that operate directly in latent space. Projection-based (Le et al., 2025), contrastive (Tang and Khanna, 2026), and intermediate-layer (Lee et al., 2026) objectives explicitly target the structure of learned representations rather than relying only on parameter selection. Our results provide a mechanistic motivation for this direction: if the goal is to dissolve the internal structure that makes a forgotten class recoverable, then the objective should act on that structure directly. This does not imply that masking is useless. A mask can still constrain optimization, reduce computational cost, or protect parts of the model from unnecessary updates. The narrower conclusion is that, in our experiments, the SalUn saliency mask is not the factor that determines representation-level class erasure. Future unlearning methods may need to combine parameterefficient updates with explicit representation-level objectives if they aim to provide stronger deletion semantics. The causal placement test (§4.8) sharpens this principle into a stronger form. A mask that excludes the late subspace entirely still drives forget accuracy to zero, so gradient concentration does not gate whether a masked update can forget; what it gates is the displacement of prototype geometry toward Gold-like values, which only late-subspace updates produce and which never amounts to erasure, since linear separability survives at base level under every placement. No placement of a logit-level update erases the class; late placements merely make geometry-sensitive metrics look more 28

like exact retraining. A weight-space route to representation-level forgetting would therefore have to change what the objective optimizes, not where the update lands. 5.3. Limitations Our conclusions are bounded by the experimental setting. We study class unlearning on CIFAR-10 and CIFAR-100 using ResNet-18. This setting is important because it matches the closest representation-level auditing literature and allows controlled class-wise evaluation, but it does not cover all unlearning regimes. In particular, we do not study random data-point forgetting, large-scale datasets, transformer architectures, multimodal models, large language models, or diffusion models (Gandikota et al., 2023). The interpretation of CIFAR-100 also requires caution. Because CIFAR100 contains fine-grained and visually related classes, prototype recovery is less discriminative than on CIFAR-10. The fact that Gold and RandInit can exhibit non-trivial recovery does not mean that exact retraining fails in a general sense. Rather, it indicates that nearest-centroid recovery can exploit shared visual structure even when the target class was not present during training. For this reason, our strongest CIFAR-100 conclusions rely on the lower-variance linear-probe comparisons. Another limitation concerns the mask-specificity analysis. We use Jaccard overlap to quantify whether masks computed from different classes select similar parameter subsets. This is an informative structural diagnostic, but it is not a complete measure of functional equivalence. Two masks can have similar overlap yet still interact differently with the gradient magnitudes or with the local loss landscape. Our functional ablation addresses this point empirically, but a more complete theory of mask function remains open. Finally, the gradient-concentration mechanism is empirical. We show that it explains the behavior observed in the studied setting, but we do not prove that such concentration must arise in all architectures or datasets. Architectures with different inductive biases, such as vision transformers or large foundation models, may distribute forget-gradient energy differently. Testing whether the same mechanism holds at scale is an important direction for future work. 5.4. Future directions A first direction is to replicate the matched-compute ablation beyond CIFAR-scale convolutional networks. ImageNet-scale classifiers, vision trans29

formers, and multimodal encoders would clarify whether late-layer gradient concentration is a general phenomenon or a property of the ResNet-18 classunlearning setting. A second direction is to develop stronger representation-level objectives. The present results suggest that objectives acting only through output labels may fail to dissolve class structure in feature space. Future methods should therefore explore losses that explicitly reduce forget-class separability, reshape class prototypes, or align forgotten samples with semantically related retained classes while preserving utility. A third direction is methodological. Representation-level unlearning evaluation would benefit from standardized protocols combining linear probes, prototype recovery, CKA-style similarity analysis, membership inference, and carefully designed reference models. Such protocols would make it easier to distinguish genuine deletion from superficial output forgetting and to compare results across datasets with different geometric properties. Overall, our findings suggest that the next step for machine unlearning is not simply to design more selective masks, but to understand and control the representation geometry that makes forgotten information recoverable. 6. Conclusion This paper investigated the role of saliency-based weight selection in representation-level class unlearning. Using a matched-compute ablation, we isolated the masking mechanism used by SalUn from the random-label objective on which it operates. Across CIFAR-10 and CIFAR-100 with ResNet-18, we found that saliency masks, random masks of equal sparsity, a diagonalFisher mask, and unconstrained random-label updates produce statistically equivalent representation-level behavior under the most stable evaluation metrics. The main conclusion is not that masking is irrelevant in all unlearning settings. Rather, in the setting studied here, the specific identity of the saliency-selected weights does not appear to determine whether the forgotten class remains recoverable from internal representations. The observed equivalence is better explained by two empirical mechanisms: the unlearning gradients are already strongly concentrated in late network regions before masking is applied (≈92% of the squared gradient energy on CIFAR-10), and the resulting saliency masks show limited class specificity across forget classes (specificity index 0.09–0.11; the two gradient-derived criteria we test 30

overlap at Jaccard 0.83–0.94). A causal placement intervention completes the picture: a mask forcibly excluded from the late subspace still drives forget accuracy to zero on every run, while linear separability of the class survives at base level under every placement, so what late-subspace updates uniquely produce is Gold-like prototype geometry, not erasure. These findings help clarify why output-level forgetting can be misleading. All matched unlearning conditions successfully suppress the forgotten class at the classifier output, yet the class remains recoverable from internal features. This indicates that reducing forget accuracy is not sufficient to establish representation-level erasure. Reliable unlearning evaluation should therefore combine output metrics with representation-level probes, featurespace analyses, and appropriate reference models such as exact retraining and random initialization. More broadly, the results support a growing shift in machine unlearning research from parameter selection toward representation-level objectives, and concurrent work (Le et al., 2025; Tang and Khanna, 2026; Lee et al., 2026) points the same way, consistent with the geometry of neural collapse (Papyan et al., 2020). If forgotten information remains encoded as a coherent structure in feature space, then stronger deletion semantics may require objectives that act directly on that structure rather than relying only on increasingly selective masks. Future work should test whether the gradient-concentration mechanism observed here extends to larger datasets, transformer architectures, multimodal models, and other unlearning regimes. Broader Impact Statement Machine unlearning is increasingly discussed as a technical mechanism for supporting data deletion, privacy, and regulatory compliance. Our results highlight a potential gap between apparent output-level forgetting and deeper representation-level removal. A method may stop predicting the forgotten class while still retaining internal features from which that class can be recovered. This does not introduce a new attack capability against deployed systems; rather, it provides a diagnostic perspective for evaluating claims about unlearning effectiveness. The broader implication is that practitioners should be cautious when interpreting low forget accuracy as evidence of deletion. For applications where unlearning is used to support privacy-sensitive or compliance-critical decisions, representation-level auditing should complement standard outputlevel metrics. The causal test sharpens this warning: geometry-sensitive 31

scores can be driven toward retrain-like values by any late-subspace update without any loss of class separability (§4.8), so audits that rely on them can be satisfied by updates that erase nothing. At the same time, the scope of our findings is limited to controlled class-unlearning experiments on CIFARscale vision models, and they should not be generalized to all architectures or domains without further validation. CRediT authorship contribution statement Billel Habbati: Conceptualization, Methodology, Software, Formal analysis, Investigation, Data curation, Writing – original draft, Visualization. Alessio Merlo: Project administration, Validation, Writing – review & editing. Luca Verderame: Supervision, Validation, Writing – review & editing. Meriem Guerar: Supervision, Validation, Writing – review & editing. Declaration of generative AI and AI-assisted technologies in the manuscript preparation process During the preparation of this work the authors used Claude by Anthropic in order to improve the language and readability of selected passages. After using this tool, the authors reviewed and edited the content as needed and take full responsibility for the content of the published article. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Data availability The code and experimental results needed to reproduce our findings are archived on Zenodo (Habbati et al., 2026) at https://doi.org/10.5281/ zenodo.21507241 and are maintained at https://github.com/neparino/ Salun-Unlearning-Studies. CIFAR-10 and CIFAR-100 are publicly available benchmark datasets.

32

Funding This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors. Computational resources were provided by the Computer Security Laboratory servers at DIBRIS, University of Genova.

33

References Almudévar, A., Ortega, A., 2026. Representation unlearning: Forgetting through information compression. arXiv preprint arXiv:2601.21564 . Baumhauer, T., Schöttle, P., Zeppelzauer, M., 2022. Machine unlearning: Linear filtration for logit-based classifiers. Machine Learning 111, 3203– 3226. Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C.A., Jia, H., Travers, A., Zhang, B., Lie, D., Papernot, N., 2021. Machine unlearning, in: IEEE Symposium on Security and Privacy (S&P), pp. 141–159. Cao, Y., Yang, J., 2015. Towards making systems forget with machine unlearning, in: IEEE Symposium on Security and Privacy (S&P), pp. 463– 480. Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., Tramer, F., 2022. Membership inference attacks from first principles, in: IEEE Symposium on Security and Privacy (S&P), pp. 1897–1914. Chen, M., Gao, W., Liu, G., Peng, K., Wang, C., 2023. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary, in: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7766–7775. Chundawat, V.S., Tarun, A.K., Mandal, M., Kankanhalli, M., 2023. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher, in: AAAI Conference on Artificial Intelligence. Fan, C., Liu, J., Zhang, Y., Wei, D., Wong, E., Liu, S., 2024. SalUn: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation, in: International Conference on Learning Representations (ICLR). ArXiv:2310.12508. Foster, J., Schoepf, S., Brintrup, A., 2024. Fast machine unlearning without retraining through selective synaptic dampening, in: AAAI Conference on Artificial Intelligence. Frankle, J., Carbin, M., 2019. The lottery ticket hypothesis: Finding sparse, trainable neural networks, in: International Conference on Learning Representations (ICLR). 34

Gandikota, R., Materzynska, J., Fiotto-Kaufman, J., Bau, D., 2023. Erasing concepts from diffusion models, in: IEEE/CVF International Conference on Computer Vision (ICCV). Gao, Y., Unal, A., Rangamani, A., Zhu, Z., 2026. An illusion of unlearning? assessing machine unlearning through internal representations, in: International Conference on Artificial Intelligence and Statistics (AISTATS). ArXiv:2604.08271. Ginart, A., Guan, M.Y., Valiant, G., Zou, J., 2019. Making AI forget you: Data deletion in machine learning, in: Advances in Neural Information Processing Systems (NeurIPS). ArXiv:1907.05012. Goel, S., Prabhu, A., Torr, P., Kumaraguru, P., Sanyal, A., 2024. Corrective machine unlearning. arXiv preprint arXiv:2402.14015 . Golatkar, A., Achille, A., Soatto, S., 2020. Eternal sunshine of the spotless net: Selective forgetting in deep networks, in: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Graves, L., Nagisetty, V., Ganesh, V., 2021. Amnesiac machine learning, in: AAAI Conference on Artificial Intelligence. Grimes, K., Abidi, C., Frank, C., Gallagher, S., 2024. Gone but not forgotten: Improved benchmarks for machine unlearning. arXiv preprint arXiv:2405.19211 . Guo, C., Goldstein, T., Hannun, A., van der Maaten, L., 2020. Certified data removal from machine learning models, in: International Conference on Machine Learning (ICML). Ha, S., Park, S., Yoon, S.W., 2025. Unlearning’s blind spots: Over-unlearning and prototypical relearning attack. arXiv preprint arXiv:2506.01318 . Habbati, B., Merlo, A., Verderame, L., Guerar, M., 2026. Salun-unlearningstudies: code for “gradient concentration, not weight saliency, explains representation-level class unlearning”. URL: https://doi.org/10.5281/ zenodo.21507241, doi:10.5281/zenodo.21507241. [Computer software]. Zenodo. Version 1.0.0.

35

Han, S., Pool, J., Tran, J., Dally, W.J., 2015. Learning both weights and connections for efficient neural networks, in: Advances in Neural Information Processing Systems (NeurIPS), pp. 1135–1143. Hatami, A., Aalishah, R., Monosov, I.E., 2026. Class unlearning via depthaware removal of forget-specific directions, in: CVPR Workshop on Machine Unlearning for Vision (MUV). ArXiv:2604.15166. Hayes, J., Shumailov, I., Triantafillou, E., Khalifa, A., Papernot, N., 2024. Inexact unlearning needs more careful evaluations to avoid a false sense of privacy. arXiv preprint arXiv:2403.01218 . He, K., Zhang, X., Ren, S., Sun, J., 2016. Deep residual learning for image recognition, in: IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Hoefler, T., Alistarh, D., Ben-Nun, T., Dryden, N., Peste, A., 2021. Sparsity in deep learning: Pruning and growth for efficient inference and training in neural networks. Journal of Machine Learning Research 22, 1–124. Izzo, Z., Smart, M.A., Chaudhuri, K., Zou, J., 2021. Approximate data deletion from machine learning models, in: International Conference on Artificial Intelligence and Statistics (AISTATS). Jeon, D., Jeung, W., Kim, T., No, A., Choi, J., 2026. An information theoretic evaluation metric for strong unlearning, in: AAAI Conference on Artificial Intelligence, pp. 22173–22181. Jia, J., Liu, J., Ram, P., Yao, Y., Liu, G., Liu, Y., Sharma, P., Liu, S., 2023. Model sparsity can simplify machine unlearning, in: Advances in Neural Information Processing Systems (NeurIPS). Jung, J., Jung, B., Bae, S., Lee, D., 2025. OPC: One-point-contraction unlearning toward deep feature forgetting, in: ICCV Workshop on Unlearning and Model Editing (U&ME). ArXiv:2507.07754. Kim, Y., Cha, S., Kim, D., 2025. Are we truly forgetting? a critical reexamination of machine unlearning evaluation protocols. arXiv preprint arXiv:2503.06991 .

36

Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Desjardins, G., Rusu, A.A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., Hassabis, D., Clopath, C., Kumaran, D., Hadsell, R., 2017. Overcoming catastrophic forgetting in neural networks. Proceedings of the National Academy of Sciences 114, 3521–3526. Koh, P.W., Liang, P., 2017. Understanding black-box predictions via influence functions, in: International Conference on Machine Learning (ICML). Kornblith, S., Norouzi, M., Lee, H., Hinton, G., 2019. Similarity of neural network representations revisited, in: International Conference on Machine Learning (ICML). Krizhevsky, A., 2009. Learning Multiple Layers of Features from Tiny Images. Technical Report. University of Toronto. Kurmanji, M., Triantafillou, P., Hayes, J., Triantafillou, E., 2023. Towards unbounded machine unlearning, in: Advances in Neural Information Processing Systems (NeurIPS). Lakens, D., 2017. Equivalence tests: A practical primer for t tests, correlations, and meta-analyses. Social Psychological and Personality Science 8, 355–362. Le, A., Peng, C., Liu, Y., Noble, J.A., 2025. POUR: A provably optimal method for unlearning representations via neural collapse. arXiv preprint arXiv:2511.19339 ArXiv:2511.19339. Lee, J., Kim, Y., Kim, D., 2026. Erase at the core: Representation unlearning for machine unlearning. arXiv preprint arXiv:2602.05375 . Li, Q., Geng, J., Woisetschläger, H., Chen, Z., Cai, F., Wang, Y., Nakov, P., Jacobsen, H.A., Karray, F., 2025. A survey of machine unlearning in large language models: Methods, challenges and future directions. arXiv preprint arXiv:2503.01854 . Mallya, A., Lazebnik, S., 2018. PackNet: Adding multiple tasks to a single network by iterative pruning, in: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7765–7773.

37

Morcos, A.S., Raghu, M., Bengio, S., 2018. Insights on representational similarity in neural networks with canonical correlation, in: Advances in Neural Information Processing Systems (NeurIPS). Neel, S., Roth, A., Sharifi-Malvajerdi, S., 2021. Descent-to-delete: Gradientbased methods for machine unlearning, in: International Conference on Algorithmic Learning Theory (ALT), pp. 931–962. Nguyen, T.T., Huynh, T.T., Ren, Z., Nguyen, P.L., Liew, A.W.C., Yin, H., Nguyen, Q.V.H., 2022. A survey of machine unlearning. arXiv preprint arXiv:2209.02299 . Papyan, V., Han, X.Y., Donoho, D.L., 2020. Prevalence of neural collapse during the terminal phase of deep learning training. Proceedings of the National Academy of Sciences 117, 24652–24663. Pawelczyk, M., Di, J.Z., Lu, Y., Kamath, G., Sekhari, A., Neel, S., 2024. Machine unlearning fails to remove data poisoning attacks. arXiv preprint arXiv:2406.17216 . Raghu, M., Gilmer, J., Yosinski, J., Sohl-Dickstein, J., 2017. SVCCA: Singular vector canonical correlation analysis for deep learning dynamics and interpretability, in: Advances in Neural Information Processing Systems (NeurIPS). Schuirmann, D.J., 1987. A comparison of the two one-sided tests procedure and the power approach for assessing the equivalence of average bioavailability. Journal of Pharmacokinetics and Biopharmaceutics 15, 657–680. Sekhari, A., Acharya, J., Kamath, G., Suresh, A.T., 2021. Remember what you want to forget: Algorithms for machine unlearning, in: Advances in Neural Information Processing Systems (NeurIPS). Shokri, R., Stronati, M., Song, C., Shmatikov, V., 2017. Membership inference attacks against machine learning models, in: IEEE Symposium on Security and Privacy (S&P). Tang, H., Khanna, R., 2026. From logits to latents: Contrastive representation shaping for LLM unlearning. arXiv preprint arXiv:2601.22028 .

38

Tarun, A.K., Chundawat, V.S., Mandal, M., Kankanhalli, M., 2023. Fast yet effective machine unlearning. IEEE Transactions on Neural Networks and Learning Systems . Thudi, A., Deza, G., Chandrasekaran, V., Papernot, N., 2022. Unrolling SGD: Understanding factors influencing machine unlearning, in: IEEE European Symposium on Security and Privacy (EuroS&P). Voigt, P., von dem Bussche, A., 2017. The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer. Warnecke, A., Pirch, L., Wressnegger, C., Rieck, K., 2023. Machine unlearning of features and labels, in: Network and Distributed System Security Symposium (NDSS). Xu, H., Zhu, T., Zhang, L., Zhou, W., Yu, P.S., 2024. Machine unlearning: A survey. ACM Computing Surveys 56, 9:1–9:36. Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S., 2018. Privacy risk in machine learning: Analyzing the connection to overfitting, in: IEEE Computer Security Foundations Symposium (CSF), pp. 268–282. Yong, T.P.Y., Ong, W.K., Chan, C.S., 2026. Erased, but not gone: Output forgetting is not true forgetting. arXiv preprint arXiv:2606.25001 .

39

This appendix has one purpose: to let every quantitative claim in §4.1– §4.7 be checked against the exact configuration and data that produced it, rather than taken on trust. It follows the paper’s own logic rather than a generic template. Appendix A gives the configuration needed to reproduce any single run. Appendix B gives the complete data behind every reported average: full per-class, per-seed recovery, CKA, and specificity numbers underlying RQ1 (§4.1–§4.3), and the mask’s own depth profile and overlap with an independent random mask underlying RQ2–RQ3 (§4.5–§4.7). Appendix C collects every supplementary figure and table named above; all floats are grouped at the end so none of them interrupts the running text or strands a stub of text in an otherwise empty column. Appendix A. Implementation and Reproducibility Details All three unlearning conditions share one base model and one evaluation pipeline; only the mask m in Eq. 5 varies. The five subsections below give the choices that carry the claim: how the base and reference models are trained (§A.1), why the three conditions differ only in the mask (§A.2), how representation survival is attacked and measured (§A.3), how equivalence is tested and what statistical power that test has (§A.4), and the compute and software needed to regenerate every number (§A.5). A.1 Base and reference models. Each forget class gets its own base model, an original network trained on the full dataset D for 182 epochs, and its own Gold retrain on Dr (the same class removed) for 40 epochs. Both use AdamW with a cosine schedule; the base warms up over five epochs, Gold over three. RandInit is an untrained network with the same architecture, providing the per-class texture floor. Because Gold and RandInit are computed per class, every recovery number in Table 1 and Table C.2 is referenced against a matched exact-unlearning baseline rather than a single global one. A.2 The three conditions differ only in m. All three unlearning conditions start from the same base checkpoint and run the identical random-label objective (Eq. 2) with SGD (momentum 0.9, learning rate 0.013, weight decay 5×10−4 ) for ten repair epochs. SalUn applies the saliency mask mS (top-50% weights by forget-gradient magnitude); Random mask applies mR of equal ℓ0 ; RL-full sets m = 1. To keep the mask faithful, masked-out coordinates are held at their base value and their momentum buffer is zeroed each step, preventing momentum from re-introducing updates the mask is meant to 40

block. We adopt SalUn’s released CIFAR-10 hyperparameters unchanged on both datasets, so no value is tuned to our result. The two diagnostic conditions reuse this exact loop and differ only in mask construction: the Fisher mask ranks weights by diagonal empirical Fisher importance (mean over batches of the squared forget-CE gradient) and applies the same global top50% threshold; the Early mask sets m=1 on the stem and residual blocks 1–3 and m=0 on block 4 and the head (24.8% of parameters trainable), with the frozen coordinates pinned identically. Its forced variant multiplies the learning rate by 3 under a global gradient-norm clip of 5. A.3 Attacks and metrics. Representation survival is measured with the five tools of §3. Prototype recovery builds a forget-class centroid from k=5 shots in penultimate space and classifies held-out forget images by nearest centroid (no weight update), averaged over five attack seeds. The linear probe fits logistic regression on avgpool features across all classes, a lower-variance summary independent of the centroid. Per-layer linear CKA is computed between each unlearned model and its base on n=200 forget images. Headonly relearning re-fits only the final linear layer on a held-out retain subset (no forget labels, so 0% recall is expected). Membership inference is a 103 permutation test used only as an output-level sanity check. A.4 Equivalence testing and power. We assess “the mask does nothing” with the two one-sided tests procedure (TOST) (Schuirmann, 1987; Lakens, 2017) at the pre-registered margin δ= ± 5pp, fixed a priori at the level of the inter-seed SD of recovery (≈ 3–4pp on CIFAR-10), so a difference inside the margin is indistinguishable from seed noise. Each paired observation is one class, seed-averaged over three seeds, so n=10. A TOST p < 0.05 certifies equivalence at the margin; we report the paired t-test p alongside so magnitude and equivalence can be read together. On CIFAR-100 the fewshot prototype metric carries per-class SD ≈ 13pp; a standard TOST power calculation (α=0.05, power 0.8) then requires n ≈ 40 classes to resolve the comparison, four times our census, which is why the lower-variance linear probe is the decisive metric there (§4.2). A.5 Compute, software, and availability. The pipeline is implemented in PyTorch with torchvision models and data, scikit-learn for the probe, silhouette, and t-SNE, and SciPy for the statistical tests. Base and Gold training use a single CUDA GPU on the DIBRIS laboratory server; the maskgeometry and mask-specificity diagnostics (§4.5–§4.7) are pure analysis on a 41

cached checkpoint and run on CPU in minutes. Checkpoints are cached per class so every derived figure and table can be regenerated without repeating the 182-epoch base training. A self-contained audit script recomputes every reported value from the bundled result files. Code and result data are available at the repository given in the Data Availability statement. Table C.1 in Appendix C collects every hyperparameter in one place. Appendix B. Data Behind the Main-Text Claims The main text reports seed-averaged, class-averaged summaries (Tables 1–3, Figures 4–5). This section gives the complete data those averages are built from, split by what each half of the diagnosis needs: per-class outcomes for RQ1, and the mask’s own geometry, independent of any downstream outcome, for RQ2–RQ3. Per-class outcomes (RQ1). Table C.2 and Table C.4 in Appendix C give every number behind Tables 1–3, with no averaging of their own: all ten classes, all three seeds, both datasets, thirty rows per table. Reading down the recovery columns shows directly what §4.2 states in aggregate, that CIFAR-10 seeds agree to within a few points per class while CIFAR-100 seeds swing by 20–44pp on the same class (e.g. maple_tree under SalUn; pear and cloud under RL-full); reading across shows that the late-layer gradient share, the SalUn/Gold CKA gap, and the near-0.333 specificity Jaccard already visible in Figures 5–4 and Table 3 hold on every individual run, not only on average. Table C.3 there reports the stability of the internal genuine-forgetting gate used as an output-level sanity check throughout (§3). Mask geometry (RQ2–RQ3). Two further checks isolate the mask itself, independent of any recovery outcome. Table C.5(a) in Appendix C reports, for the realized SalUn mask at the default sparsity, what fraction of its weight budget sits in each network region: layer 3, layer 4, and the head together account for ≈92% of the mask on CIFAR-10, matching the gradient-energy share behind Figure 5 almost exactly, and ≈91% on CIFAR-100, somewhat more concentrated than the gradient’s ≈81% because the mask applies one global magnitude threshold rather than preserving the energy share exactly. This confirms directly, on the mask rather than the gradient, that every condition is confined to the same late subspace before any unlearning step runs. Table C.5(b) complements the sparsity sweep of §4.3 (three replicated classes there): here, over the full ten-class census at every swept ratio, the 42

raw Jaccard overlap between SalUn’s mask and an independently-drawn random mask of equal sparsity matches the analytic chance-level null r/(2−r) to within 0.0005, on both datasets, at every ratio. The saliency mask is therefore not only equivalent in outcome (§4.3) and weakly class-specific (§4.7); at the level of raw weight identity it is statistically indistinguishable from an independently drawn random mask, at every sparsity we tested. Appendix C. Supplementary Tables Every table named in Appendix A and Appendix B is collected below, together with two further tables that give the per-class data behind two claims the main text states only in prose. Cluster coherence (Table C.6). §4.5 reports that the forget-class silhouette stays “in the same range as the original trained model (≈0.6–0.7)” under every mask, and collapses only under Gold. Table C.6 gives the value behind that range for all ten CIFAR-10 classes at the primary seed, plus two replicate seeds for three of them, so the ≈0.6–0.7 claim can be checked against every individual class and seed rather than an average that could hide a classspecific exception. Error redirection (Table C.7). §4.3 reports that on CIFAR-10 “every one of the ten classes resolves to the same consensus wrong class under SalUn, RL-full, and the random mask alike,” and that on CIFAR-100 “the three conditions agree on the dominant wrong class for most classes and disagree only where a second candidate is close behind.” Table C.7 gives the full perclass top-1 wrong-label census this claim is drawn from, on both datasets at the primary seed.

43

Table C.1: Full experimental configuration (§A.1–A.4). Every value is held identical across the three unlearning conditions and both datasets; only the mask m (Eq. 5) changes between conditions. Setting

Value

Architecture & data Backbone ResNet-18 (He et al., 2016) Penultimate dim. 512 Datasets CIFAR-10, CIFAR-100 (Krizhevsky, 2009) Input 32 × 32 RGB Augmentation RandomCrop(32,pad 4), HFlip, AutoAugment (C10), RandomErasing (p=0.2) Base model (original) Optimizer AdamW, wd 5 × 10−4 Learning rate 1 × 10−3 , cosine, 5-epoch warmup Epochs / batch 182 / 128, mixed precision Gold retrain (exact unlearning) Data retain set Dr only Optimizer AdamW, lr 1 × 10−3 , cosine Epochs 40, 3-epoch warmup Unlearning update (all three conditions) Objective random-label RL + retain CE (Eq. 2) Optimizer SGD, momentum 0.9, wd 5 × 10−4 Learning rate 0.013 (SalUn default) Repair epochs 10 Mask sparsity 0.5; swept {0.1, 0.3, 0.5, 0.7} Forget set one class (5000 / 500 imgs, C10 / C100) Evaluation Prototype recovery k=5, mean over 5 attack seeds Linear probe logistic reg. on avgpool features Per-layer CKA linear CKA (Kornblith et al., 2019), n=200 Membership inference permutation test, 103 perms Equivalence test paired TOST, δ= ± 5pp, α=0.05 Protocol Seeds 42 (primary), 1337, 999 Runs 10 classes × 3 seeds × 3 cond. per dataset

44

Table C.2: Complete per-class, per-seed data behind every average in Tables 1–3, Table 4, and Figures 3–5 (see Appendix B for how to read this table): CIFAR-10, all 10 classes × 3 seeds, no averaging. Recovery (%)

Grad.

CKA-L4

Specificity J

Class airplane

Seed SalUn Random RL-full Fisher Early E-3× Gold Late-% SalUn Gold Other Retain 42 92.0 95.3 96.5 97.0 93.0 92.5 38.6 98.7 0.571 0.209 0.391 0.398 1337 96.4 96.6 95.8 95.0 95.1 94.0 38.5 83.5 0.624 0.209 0.410 0.377 999 94.2 95.0 95.6 97.2 95.1 92.1 38.7 89.4 0.596 0.209 0.401 0.383 automobile 42 98.0 97.1 98.4 96.0 98.2 98.0 34.1 99.8 0.569 0.102 0.403 0.430 1337 98.0 97.2 97.3 97.4 96.3 94.7 33.8 96.9 0.587 0.102 0.395 0.381 999 96.6 97.7 98.8 97.4 97.9 96.2 33.2 98.2 0.555 0.102 0.385 0.375 bird 42 93.1 93.7 91.6 92.3 87.2 86.9 39.9 99.6 0.819 0.110 0.396 0.426 1337 88.2 93.4 89.2 91.4 85.3 82.6 39.7 85.7 0.756 0.110 0.411 0.393 999 93.5 93.0 94.4 89.7 88.8 85.2 39.6 89.7 0.808 0.110 0.401 0.395 cat 42 89.0 85.6 90.3 86.5 87.3 87.5 37.1 99.5 0.687 0.143 0.398 0.411 1337 81.0 83.1 83.7 83.6 80.0 83.3 37.0 73.2 0.625 0.143 0.436 0.403 999 84.1 83.0 84.1 84.9 80.9 86.4 37.1 77.5 0.616 0.143 0.424 0.382 deer 42 92.3 97.1 95.8 94.2 88.1 94.1 45.5 99.5 0.757 0.120 0.394 0.415 1337 91.4 94.7 94.2 96.3 89.5 94.4 45.4 91.0 0.702 0.120 0.397 0.395 999 93.0 94.1 94.2 93.7 89.5 93.3 45.6 91.5 0.647 0.120 0.384 0.381 dog 42 91.2 88.9 89.5 91.5 84.3 80.4 37.1 98.7 0.620 0.061 0.376 0.402 1337 92.4 89.3 87.9 87.5 85.8 82.6 37.1 73.6 0.545 0.061 0.384 0.403 999 94.1 89.6 80.8 92.6 82.8 73.7 36.8 76.2 0.517 0.061 0.380 0.388 frog 42 89.2 94.9 94.1 96.8 91.6 92.0 48.6 99.6 0.676 0.094 0.399 0.418 1337 97.4 95.9 96.5 94.2 94.7 90.2 48.5 86.8 0.567 0.094 0.411 0.392 999 89.9 94.3 95.3 96.7 97.7 77.8 48.8 85.9 0.649 0.094 0.403 0.389 horse 42 96.4 97.4 93.9 88.8 97.3 94.4 44.6 99.8 0.640 0.182 0.396 0.419 1337 93.1 97.0 92.8 96.0 92.0 93.2 44.5 92.0 0.619 0.182 0.400 0.381 999 96.6 94.9 96.7 90.1 97.1 95.2 44.6 91.1 0.583 0.182 0.392 0.367 ship 42 94.5 95.8 96.6 96.1 97.3 96.2 38.8 99.7 0.652 0.090 0.390 0.422 1337 96.0 96.0 95.9 94.5 97.0 93.5 38.5 94.4 0.583 0.090 0.394 0.379 999 97.4 96.3 97.1 95.9 97.1 94.9 38.9 92.8 0.426 0.090 0.383 0.376 truck 42 94.5 97.8 97.4 96.6 98.8 96.7 51.8 99.8 0.453 0.103 0.400 0.411 1337 97.0 96.2 95.7 96.5 97.7 95.6 51.8 95.9 0.458 0.103 0.397 0.385 999 96.6 94.8 97.7 97.0 99.2 95.1 51.7 95.6 0.612 0.103 0.390 0.379

Fisher/Early/E-3×: the second selection criterion and the causal placement conditions of §4.8. CKA-L4: SalUn/Gold vs. original, layer 4. Other/Retain J: mask Jaccard vs. other-class / retain-set gradients (null ≈ 0.333).

Table C.3: Robustness of the genuine-forgetting decision rule used as an output-level sanity check: a run is flagged as genuine forgetting only if all three Gold-normalized residual scores (noise-corrected membership inference, probe-recall excess over Gold, and penultimate-CKA excess over Gold, each clipped to [0, 1]) fall below τ =0.20. Across the 30 class-seed combinations per dataset: fraction where the τ =0.20 threshold separates conditions cleanly, where the flag’s bootstrap CI is stable (B=500), and where the flag is unchanged under ±0.05 noise-floor perturbation. Dataset

τ =0.20 usable

Bootstrap stable

Noise-floor robust

CIFAR-10 CIFAR-100

27/30 (90%) 27/30 (90%)

149/150 (99%) 52/150 (35%)

90/90 (100%) 67/90 (74%)

The CIFAR-100 bootstrap instability (52/150) mirrors the high per-class variance of the few-shot prototype metric already discussed in §4.2: Gold’s own CI is unstable just as often as the three unlearning conditions’, so this is a property of the dataset’s fine-grained geometry, not a mask-specific weakness.

45

Table C.4: Same as Table C.2, for CIFAR-100. Recovery (%)

Grad.

Class apple

CKA-L4

Specificity J

Seed SalUn Random RL-full Fisher Early E-3× Gold Late-% SalUn Gold Other Retain 42 53.1 58.1 56.0 65.3 78.7 72.6 59.4 90.4 0.457 0.627 0.408 0.405 1337 38.7 58.9 52.8 44.6 82.3 70.5 59.4 82.3 0.318 0.627 0.406 0.403 999 59.6 41.5 64.6 60.0 82.1 79.6 58.9 83.1 0.275 0.627 0.401 0.398 bus 42 6.5 11.8 14.3 11.2 31.8 30.3 15.6 90.0 0.596 0.662 0.410 0.398 1337 6.9 7.6 7.6 17.1 31.4 40.8 16.2 84.1 0.563 0.662 0.404 0.407 999 9.5 18.9 12.0 13.1 26.7 34.3 16.2 84.5 0.541 0.662 0.404 0.409 cloud 42 22.9 16.8 12.0 21.3 57.3 63.6 25.5 90.4 0.368 0.479 0.393 0.391 1337 38.1 33.3 23.2 32.8 74.7 58.7 25.7 73.9 0.437 0.479 0.393 0.379 999 39.2 26.1 53.9 38.5 65.3 53.9 25.5 66.9 0.412 0.479 0.398 0.386 dolphin 42 27.8 12.0 14.3 17.1 62.3 57.9 17.7 86.1 0.472 0.546 0.411 0.389 1337 25.5 15.4 13.1 21.3 66.1 52.4 18.1 78.3 0.387 0.546 0.410 0.394 999 33.7 27.2 19.4 27.6 66.3 55.2 17.9 73.0 0.367 0.546 0.407 0.394 lion 42 29.7 54.5 49.9 16.6 78.1 69.5 28.0 84.5 0.387 0.438 0.417 0.410 1337 17.9 17.7 32.2 35.8 63.4 69.7 28.4 73.7 0.439 0.438 0.410 0.414 999 29.1 25.3 53.9 10.7 69.7 73.7 28.2 76.8 0.537 0.438 0.410 0.413 maple_tree 42 20.6 12.8 26.7 22.5 38.3 37.9 15.4 75.2 0.530 0.541 0.411 0.391 1337 14.5 16.6 56.8 20.0 26.7 50.1 14.9 60.0 0.454 0.541 0.411 0.397 999 42.3 18.5 12.8 10.1 44.2 50.9 15.4 66.0 0.302 0.541 0.409 0.390 pear 42 15.2 19.6 3.8 20.4 41.7 38.7 21.5 91.9 0.383 0.464 0.399 0.404 1337 10.7 15.4 5.1 15.6 41.5 43.6 21.7 79.3 0.372 0.464 0.403 0.397 999 14.5 14.7 48.2 12.8 47.6 28.6 21.7 79.6 0.409 0.464 0.401 0.391 rose 42 3.6 11.6 24.6 10.3 60.6 77.3 9.7 90.8 0.508 0.524 0.406 0.396 1337 13.7 17.1 17.5 24.8 58.7 54.3 10.1 79.3 0.527 0.524 0.412 0.402 999 20.8 13.5 32.0 24.2 61.1 78.9 9.5 79.0 0.540 0.524 0.413 0.404 tank 42 17.1 54.5 18.9 11.6 67.4 67.4 18.9 85.0 0.314 0.433 0.396 0.411 1337 17.3 13.1 29.3 20.2 68.4 79.8 18.7 80.3 0.386 0.433 0.395 0.403 999 36.4 29.9 14.1 39.8 70.5 78.3 18.5 79.9 0.280 0.433 0.399 0.403 bicycle 42 33.9 68.6 30.7 32.2 67.4 69.7 42.1 90.9 0.380 0.508 0.404 0.408 1337 34.7 33.3 10.7 39.2 66.7 59.6 41.7 84.4 0.386 0.508 0.400 0.411 999 32.8 36.4 11.2 31.2 73.1 84.8 41.9 81.5 0.383 0.508 0.400 0.407

Column definitions as in Table C.2.

46

Table C.5: Mask geometry (Appendix B): receipts for §4.5 and §4.7, measured on the mask itself, not on outcomes. (a) Depth profile of the default-sparsity SalUn mask. (b) Saliency-mask vs. random-mask Jaccard overlap, excess above the analytic null r/(2 − r) (units of 10−3 ). (c) Saliency-mask vs. diagonal-Fisher-mask overlap: the second selection criterion picks nearly the same weights. All panels: 10 classes × 3 seeds per dataset. (a) Mask weight-budget share by network region.

CIFAR-10 Region stem layer1 layer2 layer3 layer4 head

CIFAR-100

Share (%) Region kept (%) 0.03 [0.03, 0.03] 1.79 [1.0, 2.2] 6.09 [3.4, 7.8] 20.54 [11.7, 28.9] 71.47 [61.0, 83.2] 0.09 [0.09, 0.09]

92.11 67.48 64.69 54.65 47.57 99.18

Share (%)

Region kept (%)

0.03 [0.03, 0.03] 2.10 [1.9, 2.4] 7.14 [6.6, 7.9] 24.36 [22.3, 27.1] 66.12 [62.7, 68.7] 0.25 [0.11, 0.44]

96.23 79.52 76.25 65.08 44.19 27.75

(b) Saliency mask vs. an independent random mask of equal sparsity.

CIFAR-10 Sparsity r 0.10 0.30 0.50 0.70

CIFAR-100

Mean excess

Max |excess|

+0.01 +0.02 −0.07 +0.00

0.3 0.3 0.5 0.2

Mean excess Max |excess| +0.05 +0.03 −0.01 −0.03

0.3 0.4 0.3 0.3

(c) Saliency mask vs. the diagonal-Fisher mask at equal sparsity (r=0.5).

CIFAR-10 CIFAR-100

J(Fisher, SalUn)

Fisher late share (%)

0.832 0.937

89.4 89.8

(a) Layer3+layer4+head sums to 92.10% (C10) / 90.73% (C100); region-kept does not sum to 100%. (b) excess = Jaccard − r/(2 − r), one random draw per class-seed-ratio, 30 draws/cell. (c) 10 classes × 3 seeds per dataset; null = 1/3: the two selection criteria pick nearly the same weights, and both place ≈89% of their budget in layer3+layer4+head.

47

Table C.6: The forget class stays a coherent cluster under every mask. Cosine silhouette of the forget class in raw 512-d penultimate features, CIFAR-10, primary seed (42) for all ten classes plus two replicate seeds for three of them (airplane, automobile, cat). SalUn, RL-full, Random Mask, and the Fisher mask all stay near the base model’s silhouette; the early mask (and its forced variant) sits visibly lower, distorting the cluster’s geometry more, yet remains far above Gold, which alone collapses it toward (and below) 0. Class

Seed

Base

Gold

SalUn-RL

RL-full

Random Mask

42 1337 999 automobile 42 1337 999 bird 42 cat 42 1337 999 deer 42 dog 42 frog 42 horse 42 ship 42 truck 42

0.644 0.644 0.644 0.749 0.749 0.749 0.605 0.499 0.499 0.499 0.702 0.546 0.666 0.707 0.749 0.724

−0.114 −0.114 −0.114 −0.078 −0.078 −0.078 −0.153 −0.161 −0.161 −0.161 −0.038 −0.049 0.019 −0.052 −0.032 −0.195

0.541 0.684 0.602 0.722 0.734 0.654 0.599 0.507 0.320 0.400 0.650 0.639 0.512 0.674 0.680 0.630

0.679 0.711 0.630 0.782 0.758 0.775 0.571 0.629 0.442 0.426 0.737 0.624 0.661 0.675 0.693 0.751

0.689 0.738 0.610 0.709 0.718 0.700 0.620 0.460 0.370 0.401 0.747 0.601 0.675 0.764 0.690 0.764

airplane

Fisher Early 0.651 0.628 0.670 0.648 0.740 0.644 0.525 0.472 0.398 0.464 0.647 0.594 0.729 0.503 0.624 0.680

0.458 0.481 0.514 0.756 0.628 0.718 0.317 0.393 0.323 0.295 0.503 0.401 0.465 0.748 0.682 0.835

Early 3× 0.479 0.535 0.445 0.772 0.661 0.736 0.341 0.331 0.292 0.342 0.567 0.400 0.476 0.551 0.702 0.679

Base and Gold are a single per-class model (not reseeded), so their values repeat across the extra-seed rows; only the unlearning conditions vary with seed. Ten-class means at the primary seed: Base 0.66, Gold −0.09, SalUn 0.62, RL-full 0.68, Random 0.67, Fisher 0.61, Early 0.56, Early 3× 0.53.

48

Table C.7: Where does the forgotten class go? Most common (top-1) wrong label assigned to held-out forget-class images, primary seed, by condition; baseline is the class’s own correct-classification rate before unlearning. Bold wrong-class names mark full threeway consensus. Class CIFAR-10 airplane automobile bird cat deer dog frog horse ship truck CIFAR-100 apple bicycle bus cloud dolphin lion maple_tree pear rose tank

Baseline correct SalUn

RL-full

Random Mask

automobile (0.91) bird (0.96) cat (0.65) deer (0.87) dog (0.93) frog (0.88) horse (0.90) ship (0.90) truck (0.96) airplane (0.95)

automobile (0.89) bird (0.94) cat (0.84) deer (0.66) dog (0.93) frog (0.70) horse (0.88) ship (0.92) truck (0.94) airplane (0.94)

0.95 0.98 0.93 0.87 0.95 0.91 0.97 0.97 0.97 0.97

automobile (0.83) bird (0.96) cat (0.88) deer (0.84) dog (0.87) frog (0.86) horse (0.81) ship (0.95) truck (0.93) airplane (0.93)

0.88 0.93 0.69 0.87 0.71 0.85 0.67 0.80 0.82 0.86

aquarium_fish (0.54) aquarium_fish (0.72) bottle (0.54) bottle (0.70) streetcar (0.37) butterfly (0.39) cockroach (0.50) cockroach (0.64) whale (0.26) whale (0.31) lizard (0.64) lizard (0.74) willow_tree (0.30) motorcycle (0.42) pickup_truck (0.56) pickup_truck (0.67) sea (0.31) sea (0.42) telephone (0.70) telephone (0.50)

aquarium_fish (0.71) bottle (0.48) butterfly (0.24)† shrew (0.21) elephant (0.42) lizard (0.36) oak_tree (0.32)† pickup_truck (0.52) sea (0.32) telephone (0.56)

All ten CIFAR-10 classes reach full three-way consensus; on CIFAR-100 six of ten do (bus, cloud, dolphin, maple_tree do not: the runner-up label is close enough behind that different conditions land on different top-1 labels). † bus and maple_tree, Random Mask: 2-decimal tie in the source log (butterfly/streetcar 0.24/0.24; oak_tree/motorcycle 0.32/0.32); the listed label is the first-parsed, not a resolved winner.

49

Author biographies Billel Habbati received the M.Sc. degree in Networks and Telecommunications from the University of Mentouri 1, Constantine, Algeria, in 2025. He is currently a Ph.D. student at the University of Genova, Italy. His research interests include machine unlearning, representation-level analysis of deep networks, and the security and verifiability of federated learning systems. Alessio Merlo received the Ph.D. degree in Computer Science from the University of Genova in 2010. He is currently a Professor in Computer Engineering and the Director of the Centre for Defense Higher Studies (CASD), Rome, Italy. He has published more than 120 scientific papers in international conferences and journals. His research interests include mobile security, the Internet of Things, and cyber-physical systems security. Luca Verderame received the M.Sc. degree (cum laude) in 2011 and the Ph.D. degree in Electronic and Computer Engineering, Robotics and Telecommunications in 2016, both from the University of Genova, Italy, with a focus on mobile security. He is currently an Associate Professor at DIBRIS, University of Genova, and co-founder and CEO of Talos, a cybersecurity spin-off of the University of Genova. His research interests include Android and mobile security, software security, and the security of machine learning systems. Meriem Guerar received the M.Sc. degree in Information Systems and Networks in 2011 and the Ph.D. degree in Computer Science in 2017, both from the University of Sciences and Technology of Oran, Algeria. She is currently an Assistant Professor at the University of Genova, Italy, and previously held postdoctoral positions at the University of Genova and the University of Padova. Her research interests include mobile and IoT security, privacy, identity management, blockchain, and federated learning.

50