arXiv CSopen access

Efficient Unlearning through Maximizing Relearning Convergence Delay

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

machine learning, deep learning, neural networks

arXiv:2604.09391v1 [cs.LG] 10 Apr 2026

Khoa Tran1 Simon S. Woo1,2 * 1 CSE Department, Sungkyunkwan University, South Korea 2 Secure Machines Lab {khoa.tr, swoo}@g.skku.edu Abstract

ment, disinformation, and the exploitation of personal identity. These risks may result in the unintentional disclosure of sensitive information, the leakage of private data, or the creation of biased, harmful, or copyright-infringing content by models. One of the most significant challenges for the future of responsible AI is striking a balance between the power of large, general-purpose models and the need for safer, more specialized systems. To protect user rights, the European Union introduced the General Data Protection Regulation (GDPR) [42] and the Artificial Intelligence Act [10], which grant individuals the “right to be forgotten” [4], requiring technology companies to remove personal information from their databases and AI models upon request. As a result, machine unlearning [3, 15, 26, 37, 47], a technique aimed at selectively erasing specific learned knowledge or capabilities from AI models, has become increasingly essential. Beyond preserving privacy, machine unlearning plays a key role in ensuring fairness, accountability, and compliance with legal standards, in addition to safeguarding privacy. In order to remove the impact of a particular subset of the dataset from a pretrained AI model, it is necessary to provide a model that is not capable of utilizing the characteristics of that subset, while at the same time preserving the advantageous behaviors that have been acquired from the retaining data [40]. Given the large size of the dataset, it is not feasible to retrain the model after removing the requested data, as this would require a significant amount of GPU usage and a prolonged training period. In addition, there is a possibility that private data will be unavailable at times, which will render retraining impossible. As a result, a few studies have proposed approximation unlearning [7, 9, 18, 24], which is not only feasible in terms of privacy access but also efficient in terms of time. Compared to the retraining method, the approximation unlearning approach involves beginning with a trained model and gradually modifying the weights of the model over a limited amount of time. This approach results in significantly lower costs being incurred compared to the retraining method. The primary goals of machine unlearning are to achieve

Machine unlearning poses challenges in removing mislabeled, contaminated, or problematic data from a pretrained model. Current unlearning approaches and evaluation metrics are solely focused on model predictions, which limits insight into the model’s true underlying data characteristics. To address this issue, we introduce a new metric called relearning convergence delay, which captures both changes in weight space and prediction space, providing a more comprehensive assessment of the model’s understanding of the forgotten dataset. This metric can be used to assess the risk of forgotten data being recovered from the unlearned model. Based on this, we propose the Influence Eliminating Unlearning framework, which removes the influence of the forgetting set by degrading its performance and incorporates weight decay and injecting noise into the model’s weights, while maintaining accuracy on the retaining set. Extensive experiments show that our method outperforms existing metrics and our proposed relearning convergence delay metric, approaching ideal unlearning performance. We provide theoretical guarantees, including exponential convergence and upper bounds, as well as empirical evidence of strong retention and resistance to relearning in both classification and generative unlearning tasks.

1. Introduction Deep learning has become the foundation of many commercial artificial intelligence (AI) systems, which provide users with powerful and convenient tools for everyday life. These models are trained on massive data, which includes both public datasets and private user data [41]. It inevitably raises serious concerns about privacy, trust, and user security. As the model’s size and capacity increase, controlling its behaviors becomes more complex and challenging. The development of generative AI has led to the identification of new risks, including data poisoning, copyright infringe* Corresponding Author

2. Background

two primary objectives, which are utility and privacy guarantee [7]. The utility indicates that the model performs well on the retaining set. At the same time, privacy refers to exhibiting poor performance on the forgetting set and protecting the model against attacks on privacy, such as the leakage of private data. In image classification tasks, previous studies [7, 13, 35] employ accuracy to refer to the utility criteria and membership inference attacks (MIA) [5, 48] to refer to model leaking. In image generation tasks, machine unlearning aims to remove the model’s ability to generate sensitive, harmful, or illegal content in response to inappropriate prompts [15, 18]. For evaluation, the Frechet Inception Distance (FID) score [27] is widely used and has demonstrated empirical consistency with human perceptual evaluations. However, FID, accuracy, and MIA focus on the model’s predictions, ignoring the intermediate features that significantly contribute to those predictions and reveal the model’s knowledge derived from the input data.

We denote f (x, θ) as a model parameterized by trainable weight θ, a training dataset Dtrain = {xi , yi }N where xi represents an input and yi is a corresponding label, a testing dataset Dtest , and a training algorithm T (θ0 , D, t) [31] (such as Gradient Descent, Adam etc.) [32]. In the training process, the algorithm T tries to minimize the loss function on the training dataset L(θ, Dtrain ). We define a model is well-trained on D if θD = arg minθ L(θ, D). In general, we define Φ(θ, D) as an error-evaluation function for the model f (·, θ) on the dataset D. The function Φ could be a loss function L or the accuracy error 1 − accuracy in the context of classification problems. Machine Unlearning. In the unlearning scenario, the model is trained first on the entire training set and obtains train an optimal weight θD = T (θ0 , Dtrain , +∞) where θ0 is an initialized weight. In the unlearning phase, we aim to reduce the influence of a part Dftrain ⊂ Dtrain , called forget-

In this study, we propose a new metric and unlearning framework to improve the safety and effectiveness of machine unlearning. Our approach centers on measuring the influence of the forgetting data on the model through a novel metric and actively removing this influence using a principled strategy inspired from proposed metric. Specifically, we quantify the influence level of forgetting dataset via relearning convergence delay, and design a Influence Eliminating Unlearning framework to make the unlearning process more efficient and resistant to relearning.

train

ting set, from the trained weight θD . Ideally, we should retrain an initialized weight on the retaining set Drtrain = Dtrain \ Dftrain , referred to as exact unlearning. However, it is infeasible due to time complexity, hardware cost, or privacy restrictions. Thus, approximation unlearning is proposed to make unlearning process fast and efficient by fine-tuning train from a trained weight θ0U L = θD using an unlearning process θTU L = U(θ0U L , Dr , Df , T ) in T iterations. The goal of approximation unlearning is to produce an unlearned model that performs similarly to the exact unlearning model. In the scenario of unlearning for a publicly pretrained model where the retaining dataset is inaccessible, the unlearning process becomes more challenging. In this case, the model update is defined as θTU L = U(θ0U L , ∅, Df , T ) over T steps, where no retaining data is used. Unlearning Metrics. In classification tasks, previous studies [7, 13, 19, 35] commonly employ accuracy as a means of evaluating the performance of unlearned models, utilizing the corresponding retraining model as a benchmark. The underlying assumption is that a properly unlearned model should closely match the retraining model in behavior, reflected in comparable accuracy across the retaining, forgetting, and testing datasets. In image generation tasks, the FID measures how closely the distribution of generated images aligns with that of real images, and it is the current standard for evaluating the quality of generative models [13, 28, 53]. A lower FID score indicates more realistically generated images, reflecting the effectiveness of the generative model. In the context of unlearning NSFW (not safe for work) content, previous works [13, 53] evaluate a model’s ability to generate harmful content by employing detection models that assess the level of harmfulness in the generated images. To assess privacy guarantees, previous works [13, 35]

We summarize our key contributions as follows: • Relearning convergence delay metric: We introduce relearning convergence delay as a novel metric to quantify how quickly a model relearns forgotten data. Whereas existing relearning-time metrics quantify relearning in seconds [19, 49] and offer no explicit guidance for improvement, our metric reframes the problem in terms of convergence properties, providing a principled and explicit direction for reducing relearning risk. • Influence Eliminating Unlearning (IEU) framework: We develop the IEU framework, which integrates Gradient Ascent to reverse the effect of the forgetting data and Noisy Regularization to delay the recovery risk of forgotten information, while preserving accuracy on the retaining set. Experiments show that IEU outperforms existing methods across existing metrics and our proposed metric in both classification and generation tasks. • Theoretical Guarantees: We present a theoretical analysis that establishes the upper bound of our relearning convergence delay metric and develop an efficient approximation to make its computation practical. In addition, we derive an upper bound on the error of our IEU framework, offering clearer insight into the distinct contributions and interactions of each component within the framework. 2

employ MIA [48], which uses the outputs of the unlearned model to measure the attack success rate (ASR). MIA aims to determine whether a specific data sample was part of the model’s training set, regarding the risk of information leaking, and ASR is widely used to assess the effectiveness of privacy in unlearning methods. Ideally, a practical forgetting method should achieve an MIA score comparable to that of a model retrained without the forgotten data. Beyond MIA, the relearning attack [11, 14, 22, 30, 39] poses a privacy threat due to the model’s long lifetime, as the unlearned model could potentially reacquire previously forgotten data, thereby challenging its robustness and weakening the guarantees of unlearning. Prior studies [19, 49] have assessed unlearning effectiveness by measuring the time (in seconds) required to relearn forgotten data. However, this metric offers limited insight into the learning dynamics and provides little guidance for improving unlearning methods. To the best of our knowledge, this is the first study to introduce a metric, relearning convergence delay, that quantifies the risk of forgotten data recovery in terms of convergence behavior. This addresses a critical gap in current unlearning evaluation practices by offering a more principled and informative measure of residual influence.

cess, the objective is to eliminate the influence of the forgetting set on the model. To reflect this, we seek to maximize the relearning convergence delay, such that the unlearned model requires significantly more effort to relearn the forgotten data, indicating effective removal of its influence. To facilitate theoretical analysis and ensure convergence, we assume that the training algorithm T can achieve optimal model parameters under standard conditions.

3. Relearning Convergence Delay Metric

Assumption 2. For every iterative and convertible learning algorithm T , dataset D, and initialized weight θ0 ∈ Rd , the training process θt = T (θ0 , D, t) progressively minimizes the condition number over time: λ1 (θ1 , D) λ1 (θ0 , D) ≥ ≥ . . . ≥ 1. λd (θ0 , D) λd (θ1 , D)

Assumption 1. The training algorithm T converges to the optimal parameter at the end of the training process, denoting as T (θ, D, +∞) = θD for every θ and D.

To control the relearning convergence delay RCD, we investigate the condition number [55], which is well known for representing the difficulty of convergence in a convex optimization problem. The investigation focuses on the convergence characteristics of iterative optimization algorithms. We denote that the loss function L(θ, D) at θ on the dataset D has a second-order derivative ∇2 L(θ, D) which contains eigenvalues represented by the notation λ1 (θ, D) ≥ λ2 (θ, D) ≥ . . . ≥ λd (θ, D) ≥ 0. The work [57] demonstrated that the condition number is minimized during the training process. Leveraging on this phenomenon, we are going to make the following assumption:

How can we quantify the contribution of a dataset D to a learned model θ? Transfer learning offers a useful perspective: models pretrained on relevant data tend to converge faster on downstream tasks than those initialized randomly, even if their initial accuracies are similar. This implies that pretrained weights encode latent knowledge beneficial for learning, which is not always evident in performance metrics but is observable through training efficiency. Building on this insight, we hypothesize that the influence of dataset D on model weight θ can be quantified by the model’s convergence speed during fine-tuning T (θ, D, ·). In the context of unlearning, this has significant privacy implications. A model that retains significant influence from forgotten data may relearn it quickly, a vulnerability exploited by relearning attacks. To capture this, we propose a novel metric called relearning convergence delay (RCD), which quantifies the residual influence of a forgetting set on an unlearned model. Specifically, RCD measures how efficiently an unlearned model θTU L relearns on the forgotten dataset Df , thus serving as a proxy for the model’s susceptibility to relearning attacks. It is formally defined as:

Lemma 3. For Φ is a µ−strongly and β−smooth loss function, every iterative and convertible learning algorithm T , dataset D, initialized weight θ0 ∈ Rd , and training process θt = T (θ0 , D, t), we have these properties: (a) 0 ≤ µ ≤ mint λd (θt , D) (b) β ≥ maxt λ1 (θt , D) ≥ 0 λ1 (θ1 ,D) 0 ,D) (c) βµ ≥ λλd1 (θ (θ0 ,D) ≥ λd (θ1 ,D) ≥ . . . ≥ 1. Consequently, based on Lemma 3, it can be inferred that all eigenvalues and the condition number during the training process are bounded by a well-known assumption regarding strongly and smoothly convex loss functions. While RCDT depends on the choice of the learning algorithm T , in this paper, we derive its bound under a specific configuration where T is set to Gradient Descent. Building on the iterative update rule θt+1 = θt − ηt ∇t , we make an analysis of RCDGD bounds:

RCDT (θTU L , Df ) = Z +∞ Φ(T (θTU L , Df , t), Df ) − Φ(θDf , Df ) dt,

Theorem 4. For Φ is a convex loss function, T is the Gradient Descent with step-size ηt = λ1 (θ1t ,Df ) , the RCDGD value is bounded by:

(1)

0 ≤ RCDGD

where T is a learning algorithm. In the unlearning pro3

≤

λ1 (θTU L , Df ) UL Df L(θ , D ) − L(θ , D ) . f f T λd (θTU L , Df )

Algorithm 1 Influence Eliminating Unlearning framework

(2)

Input: weight θD ∈ Rd , retaining data Dr , forgetting data Df , noisy ratio α ∈ [0, 1], step-size η > 0, and forgetting set weight c ∈ [0, 1] for t = 1 to T do iid Draw θinit ∼ N (0, d2 ) Calculate ∇rt−1 regarding loss function in Eq. (6) on retaining set Calculate ∇ft−1 regarding loss function in Eq. (7) on forgetting set θt = αθt−1 + (1 − α)θinit − η∇rt−1 + cη∇ft−1 end for Return: θT .

Theorem 4 implies that the RCDGD is consistently nonnegative and possesses an upper limit. The upper limit of RCDGD for the weight θTU L is dependent upon the condition number of the unlearned weight on the forgetting λ (θ U L ,D ) dataset λd1 (θTU L ,Dff ) and the loss function on forgetting set T

L(θTU L , Df ), where the value of L(θDf , Df ) is independent of the unlearned weight. The condition number represents the difficulty of re-learning forgotten information, whereas the loss function value of the forgetting set reflects the performance of the unlearned model on the forgetting dataset. In other words, the upper bound of RCDGD represents the worst case of relearning attack, which measures the cost required to ensure the success of relearning attack. In general, we establish Corollary 5, which indicates that the relearning convergence delay RCDGD is non-negative and bounded when the training algorithm T is Gradient Descent, for any unlearned model weight θ and dataset D, assuming the loss function is µ-strongly convex and βsmooth. This result suggests that in general RCDGD reflects both the model’s current performance and the optimization difficulty on the forgotten dataset.

4. Influence Eliminating Unlearning The goal of the unlearning process is to remove the influence of the forgetting dataset while preserving performance on the retaining set. To ensure utility, we first apply a loss function to the retaining data, guiding the model to maintain its original performance. To mitigate the impact of the forgetting set, we introduce two key components, Gradient Ascent and Noisy Regularization, inspired by maximizing the relearning convergence delay score, thereby effectively minimizing the impact of data being forgotten on the original model. Our overall approach is formalized in Algorithm 1, named the Influence Eliminating Unlearning framework, which contains several hyperparameters related to the learning rate, forgetting rate, and noisy factor. For notation, the gradients at step t for the retaining and forgetting sets are denoted as ∇rt and ∇ft , respectively, and their

Corollary 5. For Φ is a µ−strongly and β−smooth convex loss function, T is the Gradient Descent with step-size ηt = 1 λ1 (θt ,D) , for any θ and D, the RCD GD is bounded by: β 0 ≤ RCDGD (θ, D) ≤ L(θ, D) − L(θD , D) . (3) µ While RCD is defined as an infinite integral, which is not feasible to compute in practice, we approximate it using a discrete and finite number of K iterations: RCDK T (θU L , Df ) K X UL Df = Φ(T (θT , Df , t), Df ) − Φ(θ , Df ) .

second-order derivatives are ∇rt 2 and ∇ft .

4.1. Maintain the Performance on the Retaining Set Fine-tuning a model on new data leads to catastrophic forgetting [1, 17, 51], where performance on previously learned data decreases. Without access to the retaining set, it becomes difficult to preserve its accuracy during model updates, resulting in degraded utility, contrary to the goal of unlearning. To address this, we first employ minimizing a loss function on the retaining set to maintain its performance and ensure the model’s utility:

(4)

t=0

Theorem 6. By approximating the relearning convergence delay from Eq. (1) using Eq. (4), with T set to Gradient Descent, we obtain the following approximation error: −K RCDGD − RCDK ). GD ≤ O(e

(5)

L(θ, Drtrain ) =

We introduce Theorem 6, which concerns the estimation error of approximated RCDGD from the Eq. (4). This theory indicates the trade-off between the number of iterations and the precision of the approximation; for more iterations, we achieve a more accurate estimation of the relearning convergence delay. Significantly, it claims exponential convergence, indicating that a sufficient number of iterations can precisely yield an estimated score.

1 Σi ℓ(f (θ, xi ), yi ). |Drtrain |

(6)

4.2. Eliminate the Influence of Forgetting Set Inspired by Theorem 4 and Corollary 5, we aim to maximize RCD, which entails reducing the influence of the forgetting set Df on the unlearned model θTU L . As discussed in the previous section, it contains two factors: the loss function value L(θTU L , Df ) and the condition number 4

UL λ1 (θT ,Df ) U L ,D ) . We will discuss each one in this section. λd (θT f

as θ0 → θD , the process described in Definition 8 executes the inverse function θD → θ0 . Therefore, according to Lemma 3, we can say that the Iterative Re-initialization Process maximizes the number of expectation conditions in the data set D; however, it is still restricted to the setting of µ-strongly and β-smoothly convex, presented in Lemma 9.

4.2.1. Gradient Ascent. We aim to degrade the model’s performance on the forgetting set, ensuring a high loss for those data points. While catastrophic forgetting can be indirectly leveraged by minimizing loss only on the retaining set, causing the forgetting set’s performance to decline over time, we explicitly maximize the loss on the forgetting set during unlearning. This targeted approach is expected to ensure the model forgets the specified data more effectively: L(θ, Dftrain ) =

1 |Dftrain |

Σi ℓ(f (θ, xi ), yi ).

Lemma 9. The Iterative Re-initialization Process maximizes the condition number over the dataset D for θ0 = θD : λ1 (θ1 , D) β λ1 (θ0 , D) ≤E ≤ ... ≤ . (9) 1≤E λd (θ0 , D) λd (θ1 , D) µ

(7)

Finally, we summarize our proposed unlearning framework in Algorithm 1, which consists of three key components corresponding to three objectives: (a) minimizing the loss on the retaining set L(θ, Drtrain ), (b) maximizing the loss on the forgetting L(θ, Dftrain ), and (c) applying the Iterative Re-initialization Process (Definition 8) to eliminate the influence of the forgetting set. Specifically, component (a) seeks to reduce the loss on Dr and decrease the condition number ratio on the retaining set

In our ablation experiments, we empirically validate the effectiveness of utilizing gradient ascent on the forgetting set. While gradient ascent has the potential to introduce instability during training, we control and mitigate this risk by using a smaller step-size for the forgetting set updates, defined as ηf = cηr , c ∈ [0, 1), where ηr is the step-size for gradient descent on the retaining set.

λ1 (θt ,Dr ) t+1 ,Dr ) E λλd1 (θ (θt+1 ,Dr ) ≤ E λd (θt ,Dr ) , while component (b) aims

4.2.2. Noisy Regularization.

to increase the loss on Df , and component (c) targets increasing the condition numberratio on the forgetting set

The condition number of a neural network’s weight is typically higher at initialization [6, 23, 34, 54] than after training, and it tends to decrease progressively throughout the training process [57]. We first assume that the weights are initialized using Kaiming normal initialization.

λ (θ

λ (θ ,D )

fluence of the forgetting set. The framework introduces two hyperparameters, α and c, which control the relative importance of components (b) and (c) during unlearning. In the following section, we provide a theoretical analysis of how these hyperparameters affect convergence behavior.

Assumption 7. The initialized weight θ0 follows Kaiming initialization N (0, d2 ) where θ ∈ Rd . We aim to design an iterative process that maximizes the condition number of the model weight θ on the dataset D, given a well-trained model θD . Inspired by Assumption 7, we define the Iterative Re-initialization Process in Definition 8 by weighted merging the current weight and a randomly initialized weight, controlled by a parameter α ∈ [0, 1]. In other words, it is an incorporation of weight decay and noisy injection in the weight space.

4.3. Convergence Guarantee of Influence Eliminating Unlearning Framework In this section, we provide a convergence guarantee of the proposed unlearning framework on the retaining set. Theorem 10. For Φ is a loss function which is L-Lipschitz, µ−strongly and β−smooth convex, distance between any θt generated by Influence Eliminating Unlearning framework m ||2 is bounded ||θn −θ ≤ D, step-size ηt = β1 , the error on 2 retaining set is bounded by:

Definition 8. The Iterative Re-initialization Process: 2 θt+1 = αθt + (1 − α)N (0, ), d

,D )

f E λd1 (θt+1 ≥ E λd1 (θtt ,Dff ) , thereby reducing the int+1 ,Df )

(8)

E[L(θt , Dr ) − L(θDr , Dr )] ≤ LDe− β t 2 D L L + 2β (1 − α) + c+ 2 2β β

where α ∈ [0, 1] denotes the speed of process. The model’s weight, when applied to the Iterative Reinitialization Process with a sufficient number of iterations, will conform to a normal distribution in Assumption 7 and may be regarded as an initialized weight. A smaller α signifies a rapid process, whereas a larger α denotes a slow process. While a learning algorithm attempts to process an initialized weight into an optimal weight, represented

+ β(1 − α)2 + CONST.

(10)

Firstly, we claim that our framework achieves an exponential convergence rate of O(e−t ) in t iterations, demonstrating its time efficiency. Secondly, the use of Gradient 5

Ascent and the Noisy Regularization component raises the upper error bound with a second-order polynomial of c and α. According to Theorem 4 and Lemma 9, a lower α and an larger c effectively eliminate the forgetting set; however, Theorem 10 demonstrates that this results in a larger upper error bound, which may be harmful to the model’s utility.

ing performance close to retraining. While GA and Noisy are effective individually, combining them does not yield further improvement. Compared to baselines, our methods maintain higher accuracy on both retaining and forgetting sets, with slightly worse MIA scores. FT and RL partially reduce influence from the forgetting set but introduce instability or retain residual effects, while SCRUB and SALUN perform poorly overall. Notably, our methods remain robust as the forgetting portion increases, particularly in random data forgetting, where an increasing amount of forgetting presents increased challenges. Overall, these results highlight the effectiveness and robustness of our approach across diverse unlearning settings. Relearning Risks and Performance Relationship. We analyze the relationship between relearning convergence delay RCDGD , which reflects a model’s resistance to relearning, and the Avg. Gap, which measures utility. The results for the ResNet architecture on the T INY I MAGE N ET dataset are shown in Fig. 1. Additional results for other architectures and datasets are included in the Appendix section. Our methods consistently achieve both low Avg. Gaps and high RCDGD scores across random and class-wise forgetting scenarios, indicating strong performance in preserving utility while limiting the risk of relearning forgotten data. In contrast, baselines such as SALUN achieve high RCDGD but suffer from poor utility, while FT, RL, and SCRUB show lower Avg. Gaps but are more vulnerable to relearning. These results highlight the ability of our approach to maintain a favorable privacy-utility trade-off. Ablation Studies about Step-size in Relearning Convergence Delay. We conduct ablation studies to examine the impact of step-size on the relearning convergence delay score RCDGD , guided by the theoretical insights from Theorem 4. The results for the ResNet model on the T INYI MAGE N ET dataset are presented in Fig. 1. Additional experiments on alternative architectures and datasets are provided in the Appendix. Experiments using step-sizes of 10−4 , 10−5 , and 10−6 reveal that while smaller stepsizes slightly increase RCDGD values, the relative ranking of methods remains consistent. In random forgetting, our methods, particularly those using the Noisy component, consistently achieve high RCDGD scores. On the other hand, FT and SCRUB perform poorly regardless of the stepsizes. In class-wise forgetting, smaller step-sizes compress score ranges, making differentiation harder, though rankings are largely preserved. These results suggest that an appropriately chosen step-size provides a satisfactory balance of sensitivity and computational efficiency when comparing different unlearning methods.

5. Experiment Setups In this section, we briefly describe the experimental setups; full details are provided in the Appendix section. Image Classification. We conduct experiments on CIFAR-10, CIFAR-100 [33], and T INY I MAGE N ET [36] using ResNet50 [25] and ViT [12] architectures under both random and class-wise data forgetting. We compare three variants of our method (w/GA, w/Noisy, w/GA+Noisy) against four baselines: Fine-tuning (FT), Random Labeling (RL) [21], SCRUB [35], and SALUN [13]. Performance is assessed using accuracy on retaining, forgetting, and testing sets, as well as privacy via MIA. The average performance gap (Avg. Gap) measures the similarity between the performance of the unlearned model and that of a retrained model, with a smaller gap indicating more effective unlearning. We also employ a relearning convergence delay metric to quantify how quickly an unlearned model can relearn forgotten data, using gradient descent with varying step-sizes. Image Generation. We apply unlearning to the latent Stable Diffusion (SD) model [45] to eliminate NSFW content, integrating our GA and Noisy components with ESD [18] and SALUN [13] baselines. Forgetting is evaluated by generating images from I2P prompts [46] and measuring the ratio of nude images using Nude Detector [2]. Retention is assessed using FID scores by comparing images generated from the I MAGE N ETTE classes against the corresponding real I MAGE N ETTE images [29]. To assess vulnerability to relearning, we fine-tune each unlearned model to relearn NSFW concepts and track loss against the original SD v1.4.

6. Experiment Results In this section, we briefly summarize the experimental results. Complete results and additional ablation studies are provided in the Appendix section.

6.1. Image Classification Performance Gap. We evaluate our proposed methods against four baseline unlearning approaches under 30% and 50% random and class-wise forgetting scenarios. The results for the ResNet model on the T INY I MAGE N ET dataset are presented in Tabs. 1 and 2. Additional experimental results on other architectures and datasets are provided in the Appendix section. Across all settings, our methods, especially those using the Noisy component, consistently achieve low Avg. Gap scores, indicating strong unlearn-

6.2. Image Generation Performance on Forgetting Concepts. We present the Nudity scores for each unlearning method in Tab. 3. The results 6

Table 1. Performance summary of various unlearning methods for the ResNet model trained on T INY I MAGE N ET in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in (·). Method

Drtrain 0.930 (0.000) 0.888 (0.042) 0.760 (0.170) 0.909 (0.021) 0.569 (0.361) 0.916 (0.013) 0.881 (0.049) 0.885 (0.045)

Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Random Data Forgetting (30%) Dftrain Dtest MIA 0.470 (0.000) 0.546 (0.000) 0.874 (0.000) 0.609 (0.139) 0.562 (0.015) 0.870 (0.003) 0.512 (0.042) 0.522 (0.024) 0.875 (0.001) 0.642 (0.172) 0.570 (0.024) 0.874 (0.000) 0.507 (0.036) 0.486 (0.060) 0.877 (0.003) 0.547 (0.077) 0.541 (0.005) 0.873 (0.001) 0.508 (0.038) 0.540 (0.006) 0.869 (0.004) 0.518 (0.048) 0.536 (0.010) 0.869 (0.005)

Avg. Gap 0.000 0.050 0.059 0.054 0.115 0.024 0.024 0.027

Drtrain 0.950 (0.000) 0.897 (0.052) 0.786 (0.163) 0.910 (0.039) 0.563 (0.386) 0.924 (0.026) 0.900 (0.050) 0.898 (0.052)

Random Data Forgetting (50%) Dftrain Dtest MIA 0.429 (0.000) 0.495 (0.000) 0.831 (0.000) 0.595 (0.165) 0.538 (0.043) 0.830 (0.001) 0.525 (0.096) 0.507 (0.013) 0.833 (0.002) 0.632 (0.203) 0.556 (0.061) 0.831 (0.000) 0.454 (0.025) 0.446 (0.049) 0.842 (0.011) 0.525 (0.095) 0.494 (0.001) 0.830 (0.002) 0.483 (0.054) 0.494 (0.000) 0.829 (0.002) 0.486 (0.056) 0.495 (0.000) 0.828 (0.003)

Avg. Gap 0.000 0.066 0.068 0.076 0.118 0.031 0.026 0.028

Table 2. Performance summary of various unlearning methods for the ResNet model trained on T INY I MAGE N ET in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in (·). Method Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Class-wise Data Forgetting (30%) Dftrain Drtest Dftest MIA 0.593 (0.000) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000) 0.577 (0.016) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000) 0.580 (0.014) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000) 0.586 (0.008) 0.000 (0.000) 0.000 (0.000) 0.906 (0.003) 0.486 (0.107) 0.002 (0.002) 0.004 (0.004) 0.911 (0.002) 0.567 (0.026) 0.000 (0.000) 0.000 (0.000) 0.908 (0.001) 0.577 (0.016) 0.000 (0.000) 0.000 (0.000) 0.908 (0.001) 0.578 (0.015) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000)

Drtrain 0.927 (0.000) 0.881 (0.046) 0.817 (0.110) 0.753 (0.175) 0.569 (0.358) 0.890 (0.037) 0.882 (0.045) 0.873 (0.054)

45 40 35 30

2 · 10−2 4 · 10−2 6 · 10−2 8 · 10−2

0.1

55 50 45 40 35 0

Avg. Gap

Retraining

80 70 60 50

0.12

train RCD100 ) GD (·, Df

Avg. Gap 0.000 0.012 0.025 0.037 0.095 0.013 0.012 0.014

2 · 10−2 4 · 10−2 6 · 10−2 8 · 10−2

0.1

SCRUB

80 70 60

0.1

Avg. Gap

2 · 10−2 4 · 10−2 6 · 10−2 8 · 10−2

SALUN

IEU w/GA

Avg. Gap

IEU w/Noisy

forgetting (50%)

forgetting (30%)

8 ·10−2

Method ESD ESD w/GA ESD w/Noisy ESD w/GA+Noisy SALUN SALUN w/GA SALUN w/Noisy SALUN w/GA+Noisy

forgetting (50%)

Figure 1. Relationship between Avg. Gap and RCDGD (step-size η = 10−4 ) of ResNet model on the training-forgetting dataset Dftrain of T INY I MAGE N ET across diverse unlearning scenarios. Our methods consistently achieve a low Avg. Gap and a high RCDGD score across four forgetting scenarios, demonstrating efficacy in both model utility and privacy.

45 40 35

100

55 50 45 40 35

10−6

10−5

10−4

step-size

Retraining

10−6

10−5

10−4

10−6

SCRUB

10−5

SALUN

lizing the Noisy component are significantly less likely to generate harmful content in response to I2P prompts. Additionally, Fig. 3 displays a set of images generated using I2P prompts, highlighting the differences between our proposed approach, the original SD model, and other baseline methods. Please refer to the Appendix for additional generated images from extended ablation studies. Performance on Unrelated Concepts. We present the FID scores for each unlearning method in Tab. 3. The lowest scores achieved by the GA+Noisy approaches highlight the effectiveness of our method in preserving generation quality for concepts unrelated to the ones being unlearned. This indicates that our unlearned model produces images that are both more realistic and more aligned with the provided text prompts, as illustrated in Fig. 4. Please refer to the Appendix section for additional generated images from extended ablation studies. Relearning Convergence Delay. According to the data

IEU w/GA

10−5

10−4

step-size

IEU w/Noisy

IEU w/GA+Noisy

(a) Random data (b) Random data (c) Class-wise data (d) Class-wise data forgetting (30%)

forgetting (50%)

RCDAdam (↑) 538.022 526.653 524.057 517.166 530.431 523.846 525.421 506.544

10−6

10−4

step-size

Nudity score (↓) 0.413 0.415 0.224 0.330 0.500 0.337 0.272 0.250

50 30

FID (↓) 0.880 0.515 0.510 0.428 1.938 0.627 0.742 0.350

100

train RCD100 ) GD (·, Df

Avg. Gap 0.000 0.013 0.021 0.033 0.077 0.013 0.009 0.012

IEU w/GA+Noisy

(a) Random data (b) Random data (c) Class-wise data (d) Class-wise data forgetting (30%)

Class-wise Data Forgetting (50%) Dftrain Drtest Dftest MIA 0.608 (0.000) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000) 0.627 (0.018) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000) 0.623 (0.014) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000) 0.638 (0.030) 0.000 (0.000) 0.000 (0.000) 0.908 (0.000) 0.551 (0.058) 0.004 (0.004) 0.004 (0.004) 0.909 (0.001) 0.629 (0.021) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000) 0.605 (0.003) 0.000 (0.000) 0.000 (0.000) 0.908 (0.000) 0.615 (0.007) 0.000 (0.000) 0.000 (0.000) 0.909 (0.000)

Table 3. Performance of unlearned approaches on I MAGE N ETTE concepts using FID, I2P prompts using Nudity score, and relearning convergence delay of relearning harmful concepts from I2P prompts, measured as RCDAdam .

50 0

0.12

Drtrain 0.948 (0.000) 0.902 (0.046) 0.858 (0.090) 0.814 (0.134) 0.631 (0.318) 0.905 (0.044) 0.907 (0.042) 0.896 (0.052)

forgetting (30%)

forgetting (50%)

Figure 2. The RCDGD values of ResNet model on the trainingforgetting set Dftrain of T INY I MAGE N ET for various step-sizes. With a small step-size, the RCDGD values of each unlearning method are less distinguishable, whereas an appropriate step-size enables a significant comparison.

show that the model without using a Noisy component exhibits a high Nudity score, indicating that it is ineffective in eliminating harmful concepts. Meanwhile, incorporating the Noisy component shows the effectiveness, while ESD Noisy achieves the best safety score in the ESD setting, and SALUN GA+Noisy achieves the best safety score in the SALUN setting. These findings suggest that models uti7

Method

P10

ESD w/GA ESD w/GA+Noisy SALUN w/GA SALUN w/GA+Noisy

Figure 3. Examples of generated images using various SD models from I2P prompts. The unlearning methods include ESD and SALUN, both with and without the use of Noisy. Each column presents images generated by different SD variants using the same prompt, denoted as Pi . Detailed descriptions of the prompts are provided in the Appendix section.

Method SD

presented in Tab. 3, we measure the RCD score to assess how quickly models relearn the forgotten harmful concepts. Although our approach is inspired by the relearning convergence delay under gradient descent, SD cannot be directly trained using gradient descent alone; thus, we adopt the Adam optimizer and denote the score as RCDAdam . According to the findings, our methods, particularly those that utilize the Noisy component, exhibit a higher speed of convergence during the relearning process. This suggests that the unlearned model is more susceptible to relearning harmful content. In the meantime, the utilization of both GA+Noisy results in a more rapid convergence, a behavior that contrasts with the GD-motivated setting and appears to be influenced by the dynamics of the Adam optimizer. Following the relearning process, the images that were generated by the model are displayed in the Appendix.

Tench

English Cassette Springer Player

Chain Saw

Church

French Horn

Garbage Truck

Pump

Ball

Parachute

ESD w/GA ESD w/GA+Noisy SALUN w/GA SALUN w/GA+Noisy

Figure 4. Image generation results for I MAGE N ETTE classes using models unlearned from I2P harmful concepts. The generated images show that using the Noisy component helps the unlearned model better preserve its performance on unrelated concepts.

7. Conclusion

Ablation Studies. We conduct ablation studies to assess the effectiveness of the GA and Noisy components, with results summarized in Tab. 3. The findings show that the combined GA+Noisy outperforms the others. In the ESD setting, GA+Noisy achieves the best FID score and a competitive Nudity score, while in the SALUN setting, it achieves the best FID and Nudity scores. It demonstrates that GA+Noisy is effective in maintaining retention performance and removing harmful concepts. After analyzing the effectiveness of Noisy, we discovered that it has a low Nudity score, indicating less harmful content, as well as a low FID score, indicating more realistic image generation and better consistency in concept retention.

We presented relearning convergence delay, a novel metric that evaluates unlearning effectiveness by measuring how quickly a model relearns forgotten data, capturing both weight-space dynamics and performance on the forgetting set. Based on this insight, we introduced the Influence Eliminating Unlearning framework, which combines Gradient Ascent and Noisy Regularization to eliminate the influence of forgetting data and mitigate the risk of relearning while preserving accuracy on the retaining set. Our experiments and theoretical analysis demonstrate that IEU, especially with Noisy component, offers strong unlearning performance, improves resistance to data recovery, and achieves exponential convergence guarantees. 8

Acknowledgements This work was partly supported by Institute for Information & communication Technology Planning & evaluation (IITP) grants funded by the Korean government MSIT: (RS-2022-II220688, RS2019-II190421, RS-2024-00437849, RS-2024-00337703). Also, this work was supported by the Cyber Investigation Support Technology Development Program (No.RS-202502304983) of the Korea Institute of Police Technology (KIPoT), funded by the Korean National Police Agency. Lastly, this work was supported by the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) (No. RS-2024-00356293).

worth 16x16 words: Transformers for image recognition at scale. ArXiv, abs/2010.11929, 2020. 6 [13] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. ArXiv, abs/2310.12508, 2023. 2, 6, 3, 4 [14] Chongyu Fan, Jinghan Jia, Yihua Zhang, Anil Ramakrishna, Mingyi Hong, and Sijia Liu. Towards llm unlearning resilient to relearning attacks: A sharpness-aware minimization perspective and beyond. ArXiv, abs/2502.05374, 2025. 3 [15] Xiaohua Feng, Jiaming Zhang, Fengyuan Yu, Chengye Wang, Li Zhang, Kaixiang Li, Yuyuan Li, Chaochao Chen, and Jianwei Yin. A survey on generative model unlearning: Fundamentals, taxonomy, evaluation, and future direction. 2025. 1, 2 [16] Jack Foster, Stefan Schoepf, and Alexandra Brintrup. Lossfree machine unlearning. ArXiv, abs/2402.19308, 2024. 3 [17] Robert M. French. Catastrophic forgetting in connectionist networks. Trends in Cognitive Sciences, 3:128–135, 1999. 4, 3 [18] Rohit Gandikota, Joanna Materzynska, Jaden FiottoKaufman, and David Bau. Erasing concepts from diffusion models. 2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 2426–2436, 2023. 1, 2, 6, 3, 4 [19] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 9301–9309, 2019. 2, 3 [20] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR, abs/1412.6572, 2014. 3 [21] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In AAAI Conference on Artificial Intelligence, 2020. 6, 3, 4 [22] SeungBum Ha, Saerom Park, and Sung Whan Yoon. Unlearning’s blind spots: Over-unlearning and prototypical relearning attack. ArXiv, abs/2506.01318, 2025. 3 [23] Boris Hanin and David Rolnick. How to start training: The effect of initialization and architecture. ArXiv, abs/1803.01719, 2018. 5 [24] Tomohiro Hayase, Suguru Yasutomi, and Takashi Katoh. Selective forgetting of deep networks at a finer level than samples. ArXiv, abs/2012.11849, 2020. 1, 3 [25] Kaiming He, X. Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2015. 6 [26] Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. ArXiv, abs/2305.10120, 2023. 1 [27] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, Günter Klambauer, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a nash equilibrium. ArXiv, abs/1706.08500, 2017. 2

References [1] Everton L. Aleixo, J. Colonna, Marco Cristo, and Everlandio Fernandes. Catastrophic forgetting in deep learning: A comprehensive taxonomy. ArXiv, abs/2312.10549, 2023. 4, 3 [2] P Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring. Medium, 2019. 6, 5 [3] Jordan J. Bird and Ahmad Lotfi. Cifake: Image classification and explainable identification of ai-generated synthetic images. IEEE Access, 12:15642–15650, 2023. 1 [4] Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. 2015 IEEE Symposium on Security and Privacy, pages 463–480, 2015. 1 [5] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, A. Terzis, and Florian Tramèr. Membership inference attacks from first principles. 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914, 2021. 2 [6] Oscar Chang, Lampros Flokas, and Hod Lipson. Principled weight initialization for hypernetworks. ArXiv, abs/2312.08399, 2020. 5 [7] Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7766–7775, 2023. 1, 2, 3 [8] Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan S. Kankanhalli. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. ArXiv, abs/2205.08096, 2022. 3 [9] Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan S. Kankanhalli. Zero-shot machine unlearning. IEEE Transactions on Information Forensics and Security, 18: 2345–2354, 2022. 1 [10] European Commission. The eu artificial intelligence act, 2024. 1 [11] Aghyad Deeb and Fabien Roger. Do unlearning methods remove information from language model weights? ArXiv, abs/2410.08827, 2024. 3 [12] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is

[46] Patrick Schramowski, Manuel Brack, Bjorn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 22522–22531, 2022. 6 [47] Juwon Seo, Sung-Hoon Lee, Tae-Young Lee, Seungjun Moon, and Gyeong-Moon Park. Generative unlearning for any identity. 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 9151–9161, 2024. 1 [48] R. Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. 2017 IEEE Symposium on Security and Privacy (SP), pages 3–18, 2016. 2, 3 [49] Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unlearning. IEEE Transactions on Neural Networks and Learning Systems, 35:13046–13055, 2021. 2, 3 [50] Aäron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu. Neural discrete representation learning. In Neural Information Processing Systems, 2017. 4 [51] Liyuan Wang, Xingxing Zhang, Hang Su, and Jun Zhu. A comprehensive survey of continual learning: Theory, method and application. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46:5362–5383, 2023. 4, 3 [52] Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and labels. ArXiv, abs/2108.11577, 2021. 3 [53] Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. Erasing undesirable influence in diffusion models. In Computer Vision and Pattern Recognition, 2024. 2, 3 [54] Zhiqiu Xu, Yanjie Chen, Kirill Vishniakov, Yida Yin, Zhiqiang Shen, Trevor Darrell, Lingjie Liu, and Zhuang Liu. Initializing models with larger ones. ArXiv, abs/2311.18823, 2023. 5 [55] Thomas Pok-Yin Yu. The essential best and average rate of convergence of the exact line search gradient descent method. 2023. 3 [56] Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 1755–1764, 2023. 3 [57] Yushun Zhang, Congliang Chen, Tian Ding, Ziniu Li, Ruoyu Sun, and Zhimin Luo. Why transformers need adam: A hessian perspective. ArXiv, abs/2402.16788, 2024. 3, 5

[28] Seunghoo Hong, Juhun Lee, and Simon S. Woo. All but one: Surgical concept erasing with model preservation in text-toimage diffusion models. In AAAI Conference on Artificial Intelligence, 2023. 2, 3 [29] Jeremy Howard and Sylvain Gugger. fastai: A layered api for deep learning. Inf., 11:108, 2020. 6 [30] Abhinav Joshi, Shaswati Saha, Divyaksh Shukla, Sriram Vema, Harsh Jhamtani, Manas Gaur, and Ashutosh Modi. Towards robust evaluation of unlearning in llms via data transformations. In Conference on Empirical Methods in Natural Language Processing, 2024. 3 [31] Rohan Kashyap. A survey of deep learning optimizers-first and second order methods. ArXiv, abs/2211.15596, 2022. 2 [32] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. CoRR, abs/1412.6980, 2014. 2 [33] Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar10 and cifar-100 datasets. URl: https://www. cs. toronto. edu/kriz/cifar. html, 6(1):1, 2009. 6 [34] Siddharth Krishna Kumar. On weight initialization in deep neural networks. ArXiv, abs/1704.08863, 2017. 5 [35] Meghdad Kurmanji, P. Triantafillou, and Eleni Triantafillou. Towards unbounded machine unlearning. ArXiv, abs/2302.09880, 2023. 2, 6, 3, 4 [36] Ya Le and Xuan S. Yang. Tiny imagenet visual recognition challenge. 2015. 6 [37] Guihong Li, Hsiang Hsu, Chun-Fu Chen, and Radu Marculescu. Machine unlearning for image-to-image generative models. ArXiv, abs/2402.00351, 2024. 1 [38] Alexander Ly, Maarten Marsman, Josine Verhagen, Raoul Grasman, and Eric-Jan Wagenmakers. A tutorial on fisher information. arXiv: Statistics Theory, 2017. 3 [39] Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield-Menell. Eight methods to evaluate robust unlearning in llms. ArXiv, abs/2402.16835, 2024. 3 [40] Thanh Tam Nguyen, Thanh Trung Huynh, Phi-Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. A survey of machine unlearning. ArXiv, abs/2209.02299, 2022. 1 [41] OpenAI. Gpt-4 technical report. 2023. 1 [42] Dr. Axel von dem Bussche Paul Voigt. The EU General Data Protection Regulation (GDPR). Springer International Publishing, 1st. edition, 2017. 1 [43] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, 2021. 4 [44] Ali Razavi, Aäron van den Oord, and Oriol Vinyals. Generating diverse high-fidelity images with vq-vae-2. In Neural Information Processing Systems, 2019. 4 [45] Robin Rombach, A. Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10674–10685, 2021. 6

Efficient Unlearning through Maximizing Relearning Convergence Delay Supplementary Material 8. Theorem Proof

By Taylor’s expression, we have: 1 2 ⊤ 2 Lt+1 = Lt − ηt ∇⊤ t ∇t + η t ∇ t ∇ t ∇t 2 1 2 ≤ Lt − ηt ||∇t || + ηt2 λt1 ||∇t ||2 2 ηt λt1 = Lt − ηt 1 − ||∇t ||2 . 2

8.1. Proof of Theorem 4 and Corollary 5 We denote the convex loss function as Lt = L(θt , D), the first-order derivative as ∇t = ∇θ L(θt , D), and the secondorder derivative as ∇2t , which has eigenvalues λt1 ≥ λt2 ≥ . . . ≥ λtd ≥ 0, where θ ∈ Rd . We assume that L is µ-strong convexity.

(17)

By choosing ηt = λ1t , we have:

8.1.1. Supported Lemma.

We first present Lemma 11: 1 ||∇t ||2 2λt1 1 ≤ Lt − t 2λtd (Lt − L∗ ) 2λ1 λt = Lt − dt (Lt − L∗ ). λ1

Lt+1 ≤ Lt −

Lemma 11. For a convex loss function L, the following property holds at point θt : ||∇t ||2 ≥ 2λtd (Lt − L∗ ).

(11)

Proof. From Taylor’s expression, we have:

The second inequality is derived by Lemma 11, where L∗ = L(θD , D). Subtracting L∗ from both sides, we obtain:

1 ⊤ 2 L∗ = Lt + ∇⊤ t (θ∗ − θt ) + (θ∗ − θt ) ∇t (θ∗ − θt ) 2 λtd ≥ Lt + ∇⊤ ||θ∗ − θt ||2 . (12) t (θ∗ − θt ) + 2 {z } |

λt Lt+1 − L∗ ≤ Lt − L∗ − dt (Lt − L∗ ) λ 1 t λ = 1 − dt (Lt − L∗ ) λ1 t λtd = 1 − t (L0 − L∗ ) λ 1t λ ≤ exp − dt t (L0 − L∗ ) λ 01 λ ≤ exp − d0 t (L0 − L∗ ). λ1

g(θ∗ )

Taking the derivative of the right-hand side, we have ∂g = ∇t + λtd (θ∗ − θt ). ∂θ∗

(13)

Setting the derivative equal to 0, we obtain θ∗ − θ t = −

1 ∇t . λtd

(14)

Substitute it into the Eq. (12), we have 1 1 ||∇t ||2 + t ||∇t ||2 λtd 2λd 1 = Lt − t ||∇t ||2 . 2λd

(18)

(19)

The last inequality is derived by Lemma 3, which states λt λ0 that λdt ≥ λd0 . Therefore, the relearning convergence delay 1 1 is defined as follows:

L∗ ≥ Lt −

(15) RCDGD (θ0 , D) =

Rearrange the above inequation, we obtain ||∇t ||2 ≥ t 2λd (Lt − L∗ ). Hence, the proof is completed.

≤

8.1.2. Main Proof.

Z +∞ 0

(Lt − L∗ )dt 0 λ exp − d0 t (L0 − L∗ )dt λ1

Gradient descent updates the model weight in each iteration by:

λ0 = 01 (L0 − L∗ ). λd

θt+1 = θt − ηt ∇t .

Replacing D by the forgetting dataset Df , and θ0 by the unlearned model θTU L , we derive the bound presented

(16) 1

(20)

⊤

in Theorem 4: 0 ≤ RCDGD

+ η 2 ∇rt ⊤ ∇2 ∇rt + c2 η 2 ∇ft ∇2 ∇ft

λ1 (θTU L , Df ) ≤ λd (θTU L , Df )

+ −(1 − α)2 θt⊤ ∇2 θinit + (1 − α)ηθt⊤ ∇2 ∇rt

UL Df L(θT , Df ) − L(θ , Df ) .

⊤ − (1 − α)cηθt⊤ ∇2 ∇ft − (1 − α)ηθinit ∇2 ∇rt ⊤ + (1 − α)cηθinit ∇2 ∇ft − cη 2 ∇rt ⊤ ∇2 ∇ft

For any model θ and dataset D, under the assumption of a µ-strongly and β-smooth convex loss function, and utilizing the upper bound of the condition number from Lemma 3, λ1 (θ,D) β λd (θ,D) ≤ µ , we derive the general relearning convergence delay score bound, as stated in Corollary 5: β D 0 ≤ RCDGD (θ, D) ≤ L(θ, D) − L(θ , D) . µ

⊤ ≤ Lt + (1 − α)LC + (1 − α)θinit ∇rt

1 β(1 − α)2 D2 + β(1 − α)2 ||θinit ||22 2 + βη 2 ||∇rt ||22 + βcη 2 L2 + −(1 − α)2 θt⊤ ∇2 θinit + β(1 − α)ηLD

We approximate the original relearning convergence delay score RCDGD from Eq. (1) in finite time RCDK GD (in K iterations) using 4, and the approximation error is:

(Lt − L∗ )dt −

Z K 0

⊤ + β(1 − α)cηLD − (1 − α)ηθinit ∇2 ∇rt ⊤ + (1 − α)cηθinit ∇2 ∇ft + βcη 2 L2 . (22)

(Lt − L∗ )dt

The inequality is derived from the following assumptions: β-smooth convex, L-Lipschitz, given that ||∇||2 ≤ L and ||θ||2 ≤ D, it follows that |θ⊤ ∇i | ≤ LD and 2 |∇⊤ i ∇j | ≤ L for any θ, ∇i , and ∇j . By taking the expectation from θinit ∼ N (0, d2 ), we apply E[θinit ] = 0 and E[||θinit ||22 ] = 2, resulting in:

Z +∞

(Lt − L∗ )dt µ ≤ exp − t (L0 − L∗ )dt β K β µ = (L0 − L∗ ) exp − K µ β =

K Z +∞

E[Lt+1 − L∗ ] ≤ (Lt − L∗ ) + (1 − α)LD + 0 − η||∇rt ||22

= O(e−K ).

+ cηL2 1 + β(1 − α)2 D2 + 2β(1 − α)2 2 + βη 2 ||∇rt ||22 + βc2 η 2 L2 + −0 + β(1 − α)ηLD

8.3. Proof of Theorem 10 In accordance with the Influence Eliminating framework, the model’s weights are modified during each iteration as follows: θt+1 = αθt + (1 − α)θinit − ηr ∇rt + ηf ∇ft

+ β(1 − α)cηLD − 0 + 0 + βcη 2 L2 ηβ )||∇rt ||22 = (Lt − L∗ ) − η(1 − 2 + (1 − α)(LD + βηLD + βcηLD)

= θt − (1 − α)θt + (1 − α)θinit − ηr ∇rt + ηf ∇ft

= θt − (1 − α)θt + (1 − α)θinit − η∇rt + cη∇ft ,

(21)

where θinit ∼ N (0, d2 ). By Taylor’s expression, we have:

1 + β(1 − α)2 (D2 + 2) 2 1 + cηL2 (1 + cβη + ηβ) 2 ηβ ≤ (Lt − L∗ ) − η(1 − )2µ(Lt − L∗ ) 2

⊤ Lt+1 = Lt − (1 − α)θt⊤ ∇rt + (1 − α)θinit ∇rt ⊤

− η∇rt ⊤ ∇rt + cη∇ft ∇rt

− η||∇rt ||22 + cηL2

8.2. Proof of Theorem 6

Z +∞

1 ⊤ (1 − α)2 θt⊤ ∇2 θt + (1 − α)2 θinit ∇2 θinit 2 2

+ (1 − α) LD + βηLD

In addition to general unlearning strategies, several methods have been proposed explicitly for classification tasks. SCRUB [35] aims to maximize the KL-divergence of the prediction distribution on the forgetting set, encouraging the unlearned model to behave distinctly from the original model on that data. Bad Teacher Unlearning [8] introduces two teachers: a competent teacher for the retaining set and an incompetent one for the forgetting set. The unlearned model is trained to mimic the competent teacher’s behavior while diverging from that of the incompetent teacher. UNSIR [49] introduces adversarial noise that maximizes error on the forgetting class, whereas [52] proposes a closed-form model update for forgetting randomly selected data points. A standard limitation of these methods is their reliance on continual access to the retaining dataset, which can conflict with privacy constraints. To address this, the works [16, 19] approximate the Hessian using the Fisher Information Matrix [38] and combine it with a Forgetting Lagrangian. However, this approach incurs high computational costs and often yields limited performance gains. Distinct from these data-dependent approaches, Boundary Unlearning [7] requires only the forgetting set. It applies adversarial perturbations, generated via the FGSM attack [20], to relabel forgetting samples incorrectly, thereby degrading their influence without relying on the retaining dataset. In text-to-image generation, ESD [18] introduces a finetuning approach that removes visual concepts from a pretrained Stable Diffusion model by utilizing negative guidance as a teacher signal. Building upon this, All but One [28] incorporates an alternative concept to improve unlearning guidance. Forget-Me-Not [56] further advances this line of work by introducing a negative reference that suppresses the model’s ability to generate the targeted concept. EraseDiff [53] formulates the unlearning task as a bi-level optimization problem, jointly optimizing for the removal of harmful influences and the retention of model utility. Meanwhile, SALUN [13] introduces the notion of “weight saliency” to identify and selectively update critical parameters during the unlearning process.

1 + βcηLD + β(D2 + 2) 2 1 + cηL2 (1 + cβη + ηβ) . (23) 2 The last inequality is due to 1 − α ≤ 1. Set η = β1 , we have: E[Lt+1 − L∗ ] ≤

1−

µ (Lt − L∗ ) β

1 + (1 − α)(LD(c + 2) + β(D2 + 2)) 2 2 L c c + +2 β 2 µ ≤ exp − t (L0 − L∗ ) β 2 L L D (1 − α) + c+ + 2β 2 2β β 2 2L + β(1 − α)2 − β µ ≤ LD exp − t β 2 L L D (1 − α) + c+ + 2β 2 2β β + β(1 − α)2 + CONST, 2

for CONST = − 2L β . The first term in the last inequality is obtained due to L-Lipschitz property |L0 −L∗ | ≤ L||θ0 − θ∗ ||2 ≤ LD. Hence, the proof is completed.

9. Related Work The concept of machine unlearning has recently garnered significant attention. One related phenomenon is catastrophic forgetting [1, 17, 51], which describes the substantial loss of previously learned information when a neural network is trained on new data. These studies suggest that continued training on the retaining set may implicitly reduce performance on the forgetting set. In contrast, Random Labeling methods [21, 24] introduce noise by randomly altering the labels of the forgetting set, encouraging the model to treat this data as uninformative. More recently, SALUN [13] proposed a weight saliency-based approach to selectively forget specific information while preserving overall model performance. We adopt these three techniques as baselines in our experiments due to their broad applicability across various domains, including vision-language tasks and large language models.

10. Experiment Setups 10.1. Image Classification Task. Firstly, we train the model on the entire dataset, referred to as the original model. Then we train the model on the retaining set to obtain the retraining model, which is considered the ideal solution for the unlearning problem. Afterward, we apply unlearning approaches on the original model, including the baselines and our proposed method, to obtain unlearned models. To evaluate the effectiveness of unlearning methods, we compare those unlearned models with the retraining model on the retaining, forgetting, 3

and testing datasets. A good unlearning algorithm should produce an unlearned model that performs similarly to the retraining model.

settings. We evaluate the privacy metric through a metricbased MIA. To measure the similarity between the unlearning model and the retraining model, we calculate the gap between each metric score and subsequently average those gaps to derive a final score, referred to as the average performance gap (Avg. Gap). The small average gap indicates that it is closer to the optimal solution.

10.1.1. Training Setups. To create the original model and the retraining model, we train ResNet-50 from scratch for 400 epochs using the SGD optimizer with a fixed learning rate of 0.01, momentum of 0.9, weight decay of 0.0005, and a batch size of 128. For the ViT, we also train the model from scratch for 1500 epochs using the Adam optimizer with a fixed learning rate of 0.0001, while keeping the momentum, weight decay, and batch size consistent with the ResNet-50 training configuration.

10.1.4. Relearning Setup. For relearning, we train the unlearned models on the training-forgetting dataset Dftrain in 100 epochs with SGD optimizer, a batch size of 128, and various step-sizes. We employ the error-evaluation Φ as 1−accuracy(Dftrain ), tracking the error for each epoch and summing it up to the final relearning convergence delay score RCDGD .

10.1.2. Unlearning Setups. To unlearn the forgetting data from original model, we finetune it on 100 epochs by three following unlearning baselines, which include Fine-tuning (FT), Random Labeling (RL) [21], and SALUN [13] by following settings: • Fine-tuning (FT): Continue training the model on the retaining set using Adam optimizer with a learning rate of 0.0001 and a batch size of 128. • Random Labels (RL) [21]: Fine-tune using both the retaining and forgetting sets using Adam optimizer with a learning rate of 0.0001 and a batch size of 128, randomly assigning a new label to the forgetting data in each iteration. • SCRUB [35]: Minimize loss function and KL divergence of prediction on the retaining set and maximize KL divergence of prediction on forgetting set in the first 2 epochs using Adam optimizer with a learning rate of 0.0001 and a batch size of 128. • SALUN [13]: Using a method similar to RL, selectively update specific weights according to the gradient magnitude on the forgotten data utilizing SGD with a learning rate of 0.01, a weight decay of 5 × 10−4 , and a batch size of 128. For our framework, we employ minimizing the loss function on the retaining set using the Adam optimizer with a learning rate of 0.0001 and a batch size of 128. To eliminate the forgetting dataset, we examine it in three variations: • w/GA: utilizes Gradient Ascent for the forgetting set, with α = 1 and c = 10−2 , employing the SGD optimizer. • w/Noisy: utilizes Noisy Regularization for the forgetting set, with c = 0, α = 0.9999 for CIFAR-10 and CIFAR-100 dataset, and α = 0.99999 for T INY I MA GE N ET dataset. • w/GA+Noisy: integrate the two above approaches.

10.2. Image Generation Task. In latent Stable Diffusion, the following objective function is optimized: 2 LLDM = Ezt ∈E(x),t,c,ϵ∼N (0,1) ||ϵ − ϵθ (zt , c, t)||2 , (24) where zt is the noised latent embedding of image x through a VAE [44, 50], and c is the text embedding encoded by text encoders such as CLIP [43]. The ESD [18] guides the model to forget by employing gradient ascent from original harmful text c, and mimic “empty” concept c0 = “” behavior from original model θ∗ . In our experiment, we set: • ESD (c = 0, α = 1): ϵθ (zt , c, t) ← ϵθ∗ (xt , c0 , t)

(25)

• ESD w/GA (c = 1, α = 1): ϵθ (zt , c, t) ← 2ϵθ∗ (xt , c0 , t) − ϵθ∗ (xt , c, t)

(26)

• ESD w/Noisy (c = 0, α = 0.9999): ϵθ (zt , c, t) ← ϵθ∗ (xt , c0 , t)

(27)

and adopting Noisy with α = 0.9999 • ESD w/GA+Noisy (c = 1, α = 0.9999): ϵθ (zt , c, t) ← 2ϵθ∗ (xt , c0 , t) − ϵθ∗ (xt , c, t)

(28)

and adopting Noisy with α = 0.9999. For SALUN, we first generate 800 images each for nudity and non-nudity classes to construct a binary mask that identifies which weights will be updated during the unlearning process. We then apply a similar setup to that used in ESD. The unlearning is optimized using the Adam optimizer with a learning rate of 10−5 over 1000 iterations.

10.1.3. Evaluation Criteria. We evaluate the accuracy using the datasets (Drtrain , Dftrain , Dtest ) for the random data forgetting setting, and (Drtrain , Dftrain , Drtest , and Dftest ) for the class-wise data forgetting 4

0.2

100

Relearning Epochs

(a) Retraining

100

(b) FT

0.4

0.2

100

Relearning Epochs

(e) SALUN

0.2

100

Relearning Epochs

(f) IEU w/GA

100

(d) SCRUB 0.6

RCD = 31.05 0.4

0.2

Relearning Epochs

0.4

0.2

100

0.6

RCD = 10.95

RCD = 8.37 0.4

Relearning Epochs

0.6

RCD = 42.01

1-forget accuracy

0.2

Relearning Epochs

0.6

0.4

1-forget accuracy

0.6

RCD = 30.82

1-forget accuracy

0.2

0.6

RCD = 4.32 0.4

1-forget accuracy

We evaluate the unlearned models based on two criteria. First, to assess the effectiveness of unlearning harmful concepts, we generate 1000 images using 10 I2P prompts (listed in Tab. 14) and compute the proportion of generated images classified as nude using the Nude detector [2]. A lower nudity score reflects a higher degree of unlearning success. Second, for retention evaluation, we assess the model’s ability to preserve its generative performance on unrelated concepts. Specifically, we generate 1000 images corresponding to 10 classes from the I MAGE N ETTE dataset and compute the FID between the generated and real images. A lower FID score indicates that the model produces more realistic images and better preserves its original capabilities.

0.6

RCD = 44.91 0.4

1-forget accuracy

0.6

10.2.1. Evaluation Criteria.

100

RCD = 31.05 0.4

0.2

100

Relearning Epochs

(g) IEU w/Noisy

(h) IEU w/GA+Noisy

Figure 5. RCD vs. Relearning Difficulty correlation. Larger RCD values correspond to slower recovery when retraining on the forgotten data. Retraining yields the highest RCD (44.91) and the slowest convergence, whereas FT (4.32) recovers rapidly; RL (30.82) delays recovery, while SCRUB (8.37) relearns substantially faster.

10.2.2. Relearning Setup. To evaluate the vulnerability of the unlearned model, we conduct a relearning attack that aims to recover its ability to generate harmful content, using the original SD v1.4 as a reference. Specifically, we minimize the loss function defined in Eq. (24) with the target set to the original model’s prediction: ϵθ (zt , c, t) ← ϵθ∗ (zt , c, t). While our approach is inspired by the convergence rate of gradient descent, SD cannot be exclusively trained through gradient descent; consequently, we utilize the Adam optimizer, referred to as RCDAdam . The optimization is performed with the Adam optimizer at a learning rate of 10−5 .

tion. To investigate the instability caused by increasing amounts of forgetting data, we evaluate four scenarios: 30% and 50% random data forgetting, as well as 30% and 50% class-wise data forgetting. Key observations from these experiments are highlighted below. First, our methods with Noisy and GA+Noisy consistently achieve competitive Avg. Gap scores compared to the retraining model across nearly all forgetting scenarios. This demonstrates that our framework significantly improves unlearning performance, bringing it closer to the ideal solution. Notably, the Noisy component alone enhances effectiveness without harming overall performance, while GA yields strong results on its own. However, their combination (GA+Noisy) does not lead to further improvement, suggesting that each component is effective independently, but their integration offers no added benefit. In comparison, FT and RL perform well in certain cases, whereas SCRUB and SALUN perform worse and struggle due to their inability to maintain performance on the retaining set. Second, our methods achieve the highest accuracy on both the retaining and forgetting datasets, but show slightly worse MIA scores compared to some baselines. Although FT leverages catastrophic forgetting to reduce performance on the forgetting set, it fails to fully remove the influence of forgotten data, retaining higher accuracy on that set and resulting in a large gap from the retrained model. RL, on the other hand, randomly assigns incorrect labels to the forgetting set, which introduces instability, especially on the retaining set. SCRUB struggles to maintain performance on retaining set, and SALUN consistently underperforms across all scenarios. In contrast, our methods demonstrate strong performance across both random and class-wise forgetting cases, effectively reducing the influence of forgotten data while preserving accuracy on the retaining set and gen-

10.3. System Specification. For the scale-up experiments, all code is executed using Python 3.9 on an Ubuntu 18.04 machine equipped with 4 NVIDIA TITAN RTX GPUs and 256GB of RAM.

11. Experiment Results 11.1. Reliability of RCD metric To assess the reliability of RCD, we plot it alongside relearning convergence accuracy during the relearning process (Fig. 5). This consistent alignment between RCD and relearning convergence demonstrates that RCD reliably reflects relearning difficulty. Models with larger RCD values require more optimization steps to recover performance, while smaller values correspond to rapid recovery. Unlike static performance metrics, it directly captures the recovery dynamics of the model, providing a practical and interpretable measure of forgetting strength and resistance to recovery.

11.2. Image Classification 11.2.1. Performance Gap. Tables 1, 2, and 4-13 compare our proposed methods with four baseline unlearning approaches for image classifica5

eralization on the test set. Third, increasing the proportion of data to be unlearned generally results in a more challenging scenario. Interestingly, we observe two distinct trends: in random data forgetting, the Avg. Gap grows with more forgetting data; in class-wise forgetting, the Avg. Gap decreases as more classes are forgotten. We hypothesize that unlearning becomes easier in smaller domains (with fewer classes), where approximating the retraining model is more feasible, while in larger domains with limited data, unlearning becomes more difficult due to reduced approximation capacity. Baselines like FT, RL, and SCRUB show significant performance drops as the forgetting portion increases, while SALUN shows minimal change but already suffers from a large gap. In contrast, our methods, especially those using the Noisy component, maintain a stable and small performance gap relative to the retraining model, demonstrating robustness across varying unlearning scenarios. In conclusion, our methods outperform baseline approaches in terms of Avg. Gap for both random and classwise data forgetting. Notably, the Noisy component consistently achieves strong performance across nearly all settings, underscoring the effectiveness of our proposed framework.

both Avg. Gap and relearning convergence delay metric, demonstrating that IEU produces effective unlearned models with strong utility and privacy guarantees. 11.2.3. Ablation Studies about Step-size in Relearning Convergence Delay. Theorem 4 establishes the criteria for selecting the step-size in the computation of the RCDGD score, which is often costly in practice. Figures 2, 11, 13, 15, 17 and 19 illustrates experiments measuring the RCDGD score using three different step-sizes: 10−4 , 10−5 , and 10−6 . Several trade-off properties related to the step-size value will be discussed in detail below. In the random data forgetting scenario, using a smaller step-size slightly increases the RCDGD score; however, the overall range remains consistent across different stepsizes, with only minor shifts in ranking. The retraining model consistently achieves the highest RCDGD score across nearly all configurations. In contrast, FT and SCRUB exhibit the weakest performance across all step-sizes, indicating that they fail to remove the influence of the forgetting set effectively. Our methods, particularly those incorporating the Noisy component, consistently maintain high RCDGD scores across various settings, reinforcing their effectiveness in both preserving utility and limiting the model’s capacity to relearn previously forgotten data. In the class-wise forgetting scenario, the range of RCDGD scores across unlearning methods narrows as the step-size decreases, becoming nearly indistinguishable at a step-size of 10−6 . Despite this, the ranking of methods remains consistent mainly across step-sizes. This suggests that a sufficiently large step-size is adequate for comparing relearning convergence delay scores, while smaller stepsizes require more iterations to produce a broader RCDGD range for meaningful differentiation. In conclusion, our ablation studies indicate that selecting an appropriate step-size is crucial for effectively comparing unlearning methods across forgetting scenarios. While overly small step-sizes reduce differentiation between methods, excessively large ones risk nonconvergence.

11.2.2. Relearning Risks and Performance Relationship. We analyze the relationship between the relearning convergence delay score (RCDGD ) and the performance gap, aiming to maximize RCDGD for stronger privacy and to minimize Avg. Gap for better utility. Figures 1, 10, 12, 14, 16 and 18 illustrate this relationship across both random and class-wise forgetting scenarios. The results show that our methods not only achieve superior accuracy but also yield robust models that are resistant to relearning forgotten data, highlighting their effectiveness in both utility and privacy preservation. The retraining model, which achieves a 0% Avg. Gap, also obtains a high RCDGD score, representing the ideal unlearning outcome, where the model struggles to relearn data it has not seen. In random data forgetting scenarios, SALUN shows a relatively high RCDGD score but performs poorly in accuracy approximation, limiting its utility. Conversely, FT, RL, and SCRUB achieve lower Avg. Gaps, but suffer from low RCDGD scores, indicating a higher risk of forgotten data being recovered. Our methods stand out by achieving both the lowest Avg. Gap and a significantly higher RCDGD score, underscoring their superiority in balancing model utility and robustness. In class-wise forgetting scenarios, RL achieves a high RCDGD at the cost of a larger Avg. Gap, while FT and SCRUB achieve smaller gaps but with poor RCDGD scores. In contrast, our methods maintain a strong balance between the two metrics, demonstrating effectiveness in both privacy and utility. In conclusion, our methods consistently perform well on

11.2.4. Ablation Studies about Noisy Hyperparameter We conduct an ablation study on the effect of the α value in the Noisy component under a 50% random data forgetting scenario using the ViT model on the CIFAR-100 dataset, as illustrated in Fig. 6. The results show that small values of α introduce excessive noise, leading to a collapse in model utility. On the other hand, large α values reduce the effectiveness of forgetting. With a properly chosen α, the Noisy component successfully balances both effective forgetting and utility preservation. Figure 7 shows the trade-off between retention utility and relearning resistance measured by RCD. Retraining 6

11.3.2. Performance on Unrelated Concepts.

0.5

We present the FID scores for each unlearning method in Table Tab. 3, and illustrate generated images from each method in Fig. 4. It indicates that the combination GA+Noisy outperforms the others. Meanwhile, w/Noisy performs a competitive score, demonstrating that noisy regularization not only boosts unlearning performance, but still does not harm the performance on unrelated concepts. Additionally, GA component outperforms the vanilla version, also exhibiting that it does not harm the performance on unrelated concepts.

Avg. Gap

0.4 0.3 0.2 0.1 0 10−7 10−6 10−5 10−4 10−3 10−2 10−1

1−α

Figure 6. Ablation studies about Noisy component hyperparameter. An appropriate α makes the unlearning effective in both forgetting and preserving.

train RCD100 ) GD (·, Df

Retraining 40

FT (α = 1, c = 0)

SALUN

20 SCRUB

0.45

0.5

0.55

11.3.3. Relearning Attack. In Fig. 22, we present the images generated by the relearned models and compare them with those from the original SD. Interestingly, the outputs of the relearned models closely resemble those of the original SD, as well as those from various unlearned models. Furthermore, the relearning scores (RCDAdam ) across different unlearning methods are also comparable, suggesting that both our proposed methods and existing baselines exhibit similar vulnerability to relearning when optimized with the Adam optimizer.

IEU (α = 1, c = 1.0) IEU (α = 1, c = 10−1 ) IEU (α = 1, c = 10−2 ) IEU (α = 1, c = 10−3 ) IEU (α = 1 − 10−3 , c = 0) IEU (α = 1 − 10−4 , c = 0) IEU (α = 1 − 10−5 , c = 0) IEU (α = 1 − 10−6 , c = 0)

0.6

Retaining Accuracy on Drtest

12. Limitation and Future Work

Figure 7. RCD vs. Retention Accuracy on ViT–C IFAR 100 across Settings. IEU increases resistance with minimal accuracy loss, offering a better privacy–utility balance than others.

Our proposed framework is motivated by the concept of relearning convergence delay in the gradient descent algorithm, even though gradient descent is not commonly employed for training modern architectures. Our experiments on relearning with Stable Diffusion indicate that the framework is less effective when the Adam optimizer is used for relearning. This highlights the need for developing new approaches specifically designed to resist relearning under Adam-based optimization. Despite the efficacy of IEU in vision tasks, its scalability and adaptability to other domains, including language and graph, present unsolved challenges that necessitate further exploration. Furthermore, the implications of machine unlearning on fairness and security require thorough investigation. Ensuring the transparency and accountability of unlearning technologies is essential for their responsible deployment.

serves as the gold standard, achieving the largest RCD and thus maximal resistance to recovery, albeit with moderate retention accuracy. In contrast, FT attains high retention accuracy but very low RCD, indicating more vulnerability. Approximate unlearning methods, including RL, SALUN, and SCRUB, fall between these extremes, reflecting different privacy–utility trade-offs. IEU further provides controllable balance: increasing noise magnitude (α) raises RCD with a small accuracy cost, while reducing gradient ascent strength (c) preserves accuracy but weakens relearning resistance. Overall, RCD complements utility metrics by exposing recovery risk and measuring proximity to retraining.

11.3. Image Generation

12.1. Runtime Analysis

11.3.1. Performance on Forgetting Concepts.

Figures 8 and 9 compare the computational cost of different unlearning strategies for image classification and generation. Retraining requires the most epochs, confirming its high cost despite serving as the gold standard. Compared with the baselines, our IEU variants incur a slightly higher cost while demonstrating superior performance. In our configurations, adding GA slightly increases training time, and NR introduces only marginal overhead; their combination remains far cheaper than retraining while improving forgetting behavior. Similar trends hold for generation, where

We present the nudity scores for each unlearning method in Tab. 3, and provide qualitative comparisons through generated samples in Fig. 3. The results demonstrate that methods incorporating the Noisy component consistently achieve lower nudity scores, indicating a more effective removal of harmful content. Additionally, the inclusion of the GA component yields improved performance over the vanilla baseline, highlighting its contribution to enhancing the overall unlearning effectiveness. 7

Random Data Forgetting

Class-wise Data Forgetting

Time per Iteration (s) 6

1,500

w/GA+NR ES

100

w/NR

w/GA 0

ing

ain

tr Re

B RU

N LU

N w/

SA LU N

Epoch of Best Ckpt

1,480

+ GA w/

w/o/GA+NR

Figure 9. Image Generation Runtime

Figure 8. Image Classification Runtime

per-iteration differences are small, indicating minimal additional overhead and practical scalability to large models.

Table 4. Performance summary of various unlearning methods for the ViT model trained on T INY I MAGE N ET in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in (·). Method Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Random Data Forgetting (30%) Dftrain Dtest MIA 0.358 (0.000) 0.400 (0.000) 0.913 (0.000) 0.394 (0.037) 0.382 (0.018) 0.959 (0.046) 0.411 (0.053) 0.411 (0.011) 0.917 (0.005) 0.425 (0.067) 0.419 (0.019) 0.952 (0.039) 0.310 (0.047) 0.318 (0.082) 0.933 (0.021) 0.397 (0.040) 0.389 (0.011) 0.962 (0.049) 0.396 (0.038) 0.388 (0.012) 0.952 (0.039) 0.395 (0.038) 0.391 (0.009) 0.955 (0.042)

Drtrain 0.623 (0.000) 0.684 (0.061) 0.516 (0.106) 0.530 (0.093) 0.348 (0.275) 0.687 (0.065) 0.659 (0.037) 0.656 (0.033)

Drtrain 0.735 (0.000) 0.720 (0.015) 0.545 (0.190) 0.571 (0.163) 0.312 (0.423) 0.826 (0.091) 0.792 (0.057) 0.794 (0.060)

Avg. Gap 0.000 0.040 0.044 0.055 0.106 0.041 0.031 0.030

Random Data Forgetting (50%) Dftrain Dtest MIA 0.314 (0.000) 0.347 (0.000) 0.891 (0.000) 0.387 (0.073) 0.376 (0.029) 0.951 (0.060) 0.406 (0.091) 0.402 (0.055) 0.899 (0.008) 0.408 (0.094) 0.403 (0.056) 0.948 (0.057) 0.279 (0.035) 0.293 (0.054) 0.914 (0.023) 0.341 (0.027) 0.347 (0.000) 0.953 (0.062) 0.332 (0.018) 0.348 (0.001) 0.951 (0.059) 0.332 (0.017) 0.350 (0.003) 0.950 (0.058)

Avg. Gap 0.000 0.044 0.086 0.092 0.134 0.045 0.034 0.034

Table 5. Performance summary of various unlearning methods for the ViT model trained on T INY I MAGE N ET in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in (·).

Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Class-wise Forgetting (30%) Dftrain Drtest Dftest 0.428 (0.000) 0.000 (0.000) 0.000 (0.000) 0.430 (0.002) 0.000 (0.000) 0.000 (0.000) 0.446 (0.017) 0.000 (0.000) 0.000 (0.000) 0.446 (0.017) 0.000 (0.000) 0.000 (0.000) 0.357 (0.072) 0.001 (0.001) 0.001 (0.001) 0.429 (0.000) 0.000 (0.000) 0.000 (0.000) 0.426 (0.003) 0.000 (0.000) 0.000 (0.000) 0.425 (0.003) 0.000 (0.000) 0.000 (0.000)

Drtrain 0.590 (0.000) 0.592 (0.002) 0.554 (0.036) 0.560 (0.029) 0.360 (0.230) 0.617 (0.027) 0.629 (0.039) 0.604 (0.014)

Avg. Gap 0.000 0.005 0.013 0.017 0.062 0.011 0.013 0.008

62 60 58

train RCD100 ) GD (·, Df

Drtrain 0.665 (0.000) 0.674 (0.009) 0.603 (0.062) 0.604 (0.061) 0.397 (0.267) 0.662 (0.002) 0.663 (0.002) 0.667 (0.002)

Class-wise Forgetting (50%) Dftrain Drtest Dftest 0.447 (0.000) 0.000 (0.000) 0.000 (0.000) 0.475 (0.028) 0.000 (0.000) 0.000 (0.000) 0.495 (0.048) 0.000 (0.000) 0.000 (0.000) 0.491 (0.044) 0.000 (0.000) 0.000 (0.000) 0.381 (0.066) 0.001 (0.001) 0.001 (0.001) 0.456 (0.009) 0.000 (0.000) 0.000 (0.000) 0.459 (0.012) 0.000 (0.000) 0.000 (0.000) 0.451 (0.004) 0.000 (0.000) 0.000 (0.000)

64 62 60

MIA 0.940 (0.000) 0.955 (0.016) 0.939 (0.001) 0.966 (0.027) 0.943 (0.003) 0.953 (0.013) 0.951 (0.011) 0.955 (0.015)

Avg. Gap 0.000 0.011 0.022 0.026 0.068 0.005 0.005 0.004

66 train RCD100 ) GD (·, Df

train RCD100 ) GD (·, Df

MIA 0.936 (0.000) 0.958 (0.022) 0.946 (0.010) 0.973 (0.038) 0.944 (0.008) 0.962 (0.026) 0.957 (0.021) 0.956 (0.020)

train RCD100 ) GD (·, Df

Method

50 0

2 · 10−2

4 · 10−2

6 · 10−2

8 · 10−2

0.1

2 · 10−24 · 10−26 · 10−28 · 10−2

0.12

0.14

(a) Random forgetting (30%)

SCRUB

3 Avg. Gap

Avg. Gap

Retraining

0.1

SALUN

IEU w/GA

(b) Random forgetting (50%)

6 ·10−2

4 Avg. Gap

IEU w/Noisy

6 ·10−2

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 10. Relationship between Avg. Gap and RCDGD (step-size η = 10−4 ) of ViT model on the training-forgetting dataset Dftrain of T INY I MAGE N ET across diverse unlearning scenarios.

70 100

100

train RCD100 ) GD (·, Df

80 70 60

50 10−6

Retraining

10−5 step-size

10−6

10−4

(a) Random forgetting (30%)

10−5 step-size

SCRUB

10−6

10−4

SALUN

IEU w/GA

(b) Random forgetting (50%)

10−5 step-size

10−4

IEU w/Noisy

10−6

10−5 step-size

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 11. The RCDGD values of ViT model on the training-forgetting set Dftrain of T INY I MAGE N ET for various step-sizes.

10−4

Table 6. Performance summary of various unlearning methods for the ResNet model trained on CIFAR-100 in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in (·). Method Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Random Data Forgetting (30%) Dftrain Dtest MIA 0.677 (0.000) 0.680 (0.000) 0.781 (0.000) 0.834 (0.157) 0.699 (0.019) 0.778 (0.003) 0.688 (0.011) 0.677 (0.003) 0.779 (0.002) 0.892 (0.215) 0.727 (0.047) 0.811 (0.030) 0.573 (0.104) 0.555 (0.125) 0.827 (0.046) 0.777 (0.099) 0.680 (0.001) 0.778 (0.003) 0.679 (0.002) 0.671 (0.009) 0.777 (0.004) 0.684 (0.007) 0.666 (0.014) 0.774 (0.006)

Drtrain 0.985 (0.000) 0.984 (0.001) 0.985 (0.000) 0.996 (0.011) 0.758 (0.227) 0.987 (0.002) 0.960 (0.025) 0.966 (0.019)

Drtrain 1.000 (0.000) 0.993 (0.007) 0.988 (0.012) 0.996 (0.004) 0.679 (0.321) 0.987 (0.013) 0.967 (0.033) 0.971 (0.029)

Avg. Gap 0.000 0.045 0.004 0.076 0.126 0.026 0.010 0.012

Random Data Forgetting (50%) Dftrain Dtest MIA 0.681 (0.000) 0.701 (0.000) 0.716 (0.000) 0.837 (0.156) 0.705 (0.004) 0.714 (0.003) 0.628 (0.053) 0.620 (0.081) 0.790 (0.074) 0.882 (0.201) 0.715 (0.014) 0.801 (0.085) 0.497 (0.184) 0.486 (0.215) 0.806 (0.090) 0.812 (0.131) 0.680 (0.021) 0.714 (0.002) 0.722 (0.041) 0.666 (0.036) 0.717 (0.001) 0.710 (0.030) 0.660 (0.042) 0.720 (0.004)

Avg. Gap 0.000 0.042 0.055 0.076 0.202 0.042 0.028 0.026

Table 7. Performance summary of various unlearning methods for the ResNet model trained on CIFAR-100 in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in (·). Method Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Drtrain 0.986 (0.000) 0.992 (0.006) 0.989 (0.003) 0.993 (0.007) 0.897 (0.089) 0.990 (0.004) 0.977 (0.009) 0.974 (0.011)

Class-wise Data Forgetting (30%) Dftrain Drtest Dftest MIA 0.744 (0.000) 0.000 (0.000) 0.000 (0.000) 0.836 (0.000) 0.757 (0.013) 0.000 (0.000) 0.000 (0.000) 0.833 (0.004) 0.750 (0.006) 0.000 (0.000) 0.000 (0.000) 0.833 (0.003) 0.770 (0.025) 0.002 (0.002) 0.002 (0.002) 0.833 (0.003) 0.697 (0.047) 0.017 (0.017) 0.012 (0.012) 0.830 (0.007) 0.744 (0.000) 0.000 (0.000) 0.000 (0.000) 0.833 (0.003) 0.743 (0.001) 0.000 (0.000) 0.000 (0.000) 0.833 (0.003) 0.742 (0.002) 0.000 (0.000) 0.000 (0.000) 0.833 (0.003)

Avg. Gap 0.000 0.004 0.003 0.008 0.034 0.001 0.003 0.003

Drtrain 0.989 (0.000) 0.989 (0.000) 0.991 (0.002) 0.995 (0.006) 0.707 (0.282) 0.992 (0.003) 0.980 (0.009) 0.983 (0.006)

Class-wise Data Forgetting (50%) Dftrain Drtest Dftest MIA 0.773 (0.000) 0.000 (0.000) 0.000 (0.000) 0.837 (0.000) 0.797 (0.024) 0.000 (0.000) 0.000 (0.000) 0.833 (0.004) 0.786 (0.013) 0.000 (0.000) 0.000 (0.000) 0.833 (0.004) 0.806 (0.034) 0.000 (0.000) 0.000 (0.000) 0.833 (0.004) 0.609 (0.163) 0.012 (0.012) 0.010 (0.010) 0.833 (0.004) 0.774 (0.001) 0.000 (0.000) 0.000 (0.000) 0.833 (0.004) 0.769 (0.004) 0.000 (0.000) 0.000 (0.000) 0.833 (0.004) 0.770 (0.003) 0.000 (0.000) 0.000 (0.000) 0.833 (0.004)

100

Avg. Gap 0.000 0.006 0.004 0.009 0.094 0.002 0.003 0.003

100

10 0

2 · 10−2 4 · 10−2 6 · 10−2 8 · 10−2

0.1

Avg. Gap

Retraining

(a) Random forgetting (30%)

40 0

0.12

train RCD100 ) GD (·, Df

5 · 10−2

0.1

0.15

SCRUB

2 Avg. Gap

Avg. Gap

SALUN

3 ·10

−2

IEU w/Noisy

IEU w/GA

(b) Random forgetting (50%)

40 0

0.2

2 · 10−2 4 · 10−2 6 · 10−2 8 · 10−2 Avg. Gap

0.1

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 12. Relationship between Avg. Gap and RCDGD (step-size η = 10−4 ) of ResNet model on the training-forgetting dataset Dftrain of CIFAR-100 across diverse unlearning scenarios.

100

40 30 20 10

10−6

Retraining

10−5 step-size

(a) Random forgetting (30%)

40 10−6

10−4

100 train RCD100 ) GD (·, Df

train RCD100 ) GD (·, Df

10−5 step-size

SCRUB

SALUN

IEU w/GA

(b) Random forgetting (50%)

40 10−6

10−4

10−5 step-size

10−4

IEU w/Noisy

10−6

10−5 step-size

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 13. The RCDGD values of ResNet model on the training-forgetting set Dftrain of CIFAR-100 for various step-sizes.

10−4

Table 8. Performance summary of various unlearning methods for the ViT model trained on CIFAR-100 in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in (·). Method Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Random Data Forgetting (30%) Dftrain Dtest MIA 0.560 (0.000) 0.576 (0.000) 0.779 (0.000) 0.919 (0.360) 0.578 (0.002) 0.778 (0.001) 0.539 (0.020) 0.506 (0.070) 0.777 (0.002) 0.856 (0.297) 0.598 (0.022) 0.780 (0.001) 0.481 (0.078) 0.480 (0.096) 0.804 (0.025) 0.833 (0.273) 0.570 (0.006) 0.778 (0.001) 0.553 (0.007) 0.536 (0.039) 0.788 (0.009) 0.557 (0.003) 0.538 (0.037) 0.790 (0.011)

Drtrain 0.999 (0.000) 0.996 (0.003) 0.996 (0.004) 0.997 (0.003) 0.591 (0.408) 0.997 (0.002) 0.958 (0.041) 0.944 (0.055)

Drtrain 1.000 (0.000) 0.999 (0.001) 0.998 (0.002) 0.998 (0.002) 0.548 (0.452) 0.998 (0.002) 0.972 (0.028) 0.973 (0.027)

Avg. Gap 0.000 0.091 0.024 0.080 0.152 0.071 0.024 0.027

Random Data Forgetting (50%) Dftrain Dtest MIA 0.497 (0.000) 0.506 (0.000) 0.741 (0.000) 0.918 (0.421) 0.580 (0.074) 0.720 (0.021) 0.555 (0.058) 0.479 (0.027) 0.803 (0.063) 0.860 (0.363) 0.596 (0.089) 0.726 (0.015) 0.451 (0.046) 0.444 (0.062) 0.761 (0.020) 0.817 (0.319) 0.559 (0.053) 0.723 (0.018) 0.523 (0.026) 0.505 (0.001) 0.751 (0.010) 0.521 (0.023) 0.507 (0.001) 0.742 (0.001)

Avg. Gap 0.000 0.129 0.037 0.117 0.145 0.098 0.016 0.013

Table 9. Performance summary of various unlearning methods for the ViT model trained on CIFAR-100 in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in (·). Method

Drtrain 0.999 (0.000) 0.997 (0.002) 0.992 (0.007) 0.960 (0.039) 0.749 (0.250) 0.998 (0.001) 0.982 (0.017) 0.968 (0.031)

Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Class-wise Data Forgetting (30%) Dftrain Drtest Dftest MIA 0.638 (0.000) 0.000 (0.000) 0.000 (0.000) 0.833 (0.000) 0.638 (0.000) 0.002 (0.002) 0.001 (0.001) 0.834 (0.000) 0.625 (0.012) 0.000 (0.000) 0.000 (0.000) 0.833 (0.000) 0.645 (0.007) 0.000 (0.000) 0.000 (0.000) 0.838 (0.005) 0.584 (0.054) 0.004 (0.004) 0.003 (0.003) 0.839 (0.006) 0.640 (0.002) 0.000 (0.000) 0.000 (0.000) 0.833 (0.000) 0.642 (0.004) 0.000 (0.000) 0.000 (0.000) 0.835 (0.002) 0.626 (0.012) 0.000 (0.000) 0.000 (0.000) 0.837 (0.003)

Avg. Gap 0.000 0.001 0.004 0.010 0.063 0.001 0.005 0.009

Drtrain 0.999 (0.000) 0.998 (0.001) 0.996 (0.003) 0.842 (0.157) 0.664 (0.336) 0.999 (0.000) 0.977 (0.022) 0.980 (0.019)

Class-wise Data Forgetting (50%) Dftrain Drtest Dftest MIA 0.685 (0.000) 0.000 (0.000) 0.000 (0.000) 0.834 (0.000) 0.677 (0.008) 0.058 (0.058) 0.038 (0.038) 0.834 (0.000) 0.665 (0.020) 0.000 (0.000) 0.000 (0.000) 0.833 (0.001) 0.670 (0.015) 0.000 (0.000) 0.000 (0.000) 0.836 (0.003) 0.587 (0.097) 0.001 (0.001) 0.001 (0.001) 0.853 (0.020) 0.688 (0.004) 0.000 (0.000) 0.000 (0.000) 0.834 (0.000) 0.679 (0.006) 0.000 (0.000) 0.000 (0.000) 0.835 (0.001) 0.675 (0.010) 0.000 (0.000) 0.000 (0.000) 0.836 (0.002)

Avg. Gap 0.000 0.021 0.005 0.035 0.091 0.001 0.006 0.006

100

30 20 10

0.1 5 · 10−2 Avg. Gap

Retraining

0.15

80 train RCD100 ) GD (·, Df

train RCD100 ) GD (·, Df

40 train RCD100 ) GD (·, Df

train RCD100 ) GD (·, Df

60 40 20

2 · 10−24 · 10−26 · 10−28 · 10−2

0.1

0.12

0 0

0.14

SCRUB

4 Avg. Gap

Avg. Gap

(a) Random forgetting (30%)

SALUN

IEU w/GA

(b) Random forgetting (50%)

40 20

0 0

6 ·10−2

0.1

IEU w/GA+Noisy

IEU w/Noisy

2 · 10−2 4 · 10−2 6 · 10−2 8 · 10−2 Avg. Gap

(d) Class-wise forgetting (50%)

100

30 20

60 40 20

10 0

train RCD100 ) GD (·, Df

100 train RCD100 ) GD (·, Df

50 train RCD100 ) GD (·, Df

train RCD100 ) GD (·, Df

Figure 14. Relationship between Avg. Gap and RCDGD (step-size η = 10−4 ) of ViT model on the training-forgetting dataset Dftrain of CIFAR-100 across diverse unlearning scenarios.

10−6

Retraining

10−5 step-size

10−4

(a) Random forgetting (30%)

10−5 step-size

SCRUB

0 10−6

10−4

SALUN

IEU w/GA

(b) Random forgetting (50%)

40 20

0 10−6

10−5 step-size

10−4

IEU w/Noisy

10−6

10−5 step-size

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 15. The RCDGD values of ViT model on the training-forgetting set Dftrain of CIFAR-100 for various step-sizes.

10−4

Table 10. Performance summary of various unlearning methods for the ResNet model trained on CIFAR-10 in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in (·). Method Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Drtrain 0.992 (0.000) 0.985 (0.007) 0.975 (0.016) 0.997 (0.005) 0.927 (0.065) 0.993 (0.002) 0.979 (0.013) 0.982 (0.010)

Random Data Forgetting (30%) Dftrain Dtest MIA 0.919 (0.000) 0.921 (0.000) 0.778 (0.000) 0.981 (0.062) 0.930 (0.009) 0.782 (0.005) 0.904 (0.015) 0.902 (0.019) 0.778 (0.000) 0.975 (0.056) 0.940 (0.019) 0.804 (0.026) 0.874 (0.045) 0.867 (0.054) 0.778 (0.000) 0.952 (0.033) 0.924 (0.003) 0.823 (0.046) 0.926 (0.007) 0.916 (0.005) 0.781 (0.003) 0.931 (0.012) 0.917 (0.004) 0.783 (0.005)

Drtrain 0.993 (0.000) 0.989 (0.004) 0.973 (0.020) 0.997 (0.004) 0.965 (0.028) 0.991 (0.002) 0.978 (0.015) 0.982 (0.011)

Avg. Gap 0.000 0.020 0.013 0.026 0.041 0.021 0.007 0.008

Random Data Forgetting (50%) Dftrain Dtest MIA 0.902 (0.000) 0.903 (0.000) 0.714 (0.000) 0.982 (0.080) 0.933 (0.030) 0.716 (0.001) 0.907 (0.005) 0.887 (0.016) 0.714 (0.000) 0.974 (0.073) 0.936 (0.033) 0.770 (0.055) 0.952 (0.050) 0.906 (0.003) 0.718 (0.004) 0.952 (0.050) 0.913 (0.011) 0.783 (0.069) 0.904 (0.002) 0.895 (0.008) 0.748 (0.033) 0.915 (0.013) 0.904 (0.001) 0.719 (0.004)

Avg. Gap 0.000 0.029 0.011 0.041 0.021 0.033 0.015 0.007

Table 11. Performance summary of various unlearning methods for the ResNet model trained on CIFAR-10 in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in (·). Method

Class-wise Forgetting (30%) Dftrain Drtest Dftest 0.942 (0.000) 0.000 (0.000) 0.000 (0.000) 0.946 (0.003) 0.000 (0.000) 0.000 (0.000) 0.945 (0.003) 0.000 (0.000) 0.000 (0.000) 0.947 (0.004) 0.000 (0.000) 0.000 (0.000) 0.933 (0.010) 0.008 (0.008) 0.018 (0.018) 0.945 (0.003) 0.000 (0.000) 0.000 (0.000) 0.933 (0.009) 0.000 (0.000) 0.000 (0.000) 0.936 (0.006) 0.000 (0.000) 0.000 (0.000)

Drtrain 0.993 (0.000) 0.990 (0.003) 0.996 (0.003) 0.996 (0.003) 0.981 (0.012) 0.996 (0.003) 0.983 (0.009) 0.986 (0.006)

Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

MIA 0.845 (0.000) 0.837 (0.008) 0.837 (0.009) 0.832 (0.013) 0.842 (0.003) 0.841 (0.005) 0.834 (0.012) 0.843 (0.002)

Avg. Gap 0.000 0.003 0.003 0.004 0.010 0.002 0.006 0.003

Drtrain 0.997 (0.000) 0.988 (0.009) 0.985 (0.012) 0.992 (0.005) 0.988 (0.009) 0.998 (0.001) 0.996 (0.001) 0.996 (0.001)

Class-wise Forgetting (50%) Dftrain Drtest Dftest 0.975 (0.000) 0.000 (0.000) 0.000 (0.000) 0.967 (0.008) 0.000 (0.000) 0.000 (0.000) 0.956 (0.020) 0.000 (0.000) 0.000 (0.000) 0.975 (0.000) 0.000 (0.000) 0.000 (0.000) 0.968 (0.008) 0.026 (0.026) 0.023 (0.023) 0.975 (0.000) 0.000 (0.000) 0.000 (0.000) 0.972 (0.004) 0.000 (0.000) 0.000 (0.000) 0.975 (0.000) 0.000 (0.000) 0.000 (0.000)

MIA 0.843 (0.000) 0.843 (0.000) 0.834 (0.009) 0.833 (0.009) 0.836 (0.007) 0.843 (0.000) 0.848 (0.005) 0.841 (0.002)

Avg. Gap 0.000 0.004 0.008 0.003 0.014 0.000 0.002 0.001

12 100

100

6 4

8 6 4

train RCD100 ) GD (·, Df

10 train RCD100 ) GD (·, Df

train RCD100 ) GD (·, Df

60 40 20

0 0

Avg. Gap

Retraining

4 ·10−2

(a) Random forgetting (30%)

SCRUB

4 ·10−2

Avg. Gap

0.2

0.4

0.6

Avg. Gap

SALUN

IEU w/GA

(b) Random forgetting (50%)

0.8

1 ·10−2

0.2

0.4

0.6

0.8

Avg. Gap

IEU w/Noisy

1.2

1.4 ·10−2

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 16. Relationship between Avg. Gap and RCDGD (step-size η = 10−4 ) of ResNet model on the training-forgetting dataset Dftrain of CIFAR-10 across diverse unlearning scenarios.

100

8 6 4

train RCD100 ) GD (·, Df

60 40 20

0 10−6

Retraining

10−5 step-size

10−4

(a) Random forgetting (30%)

10−6

10−5 step-size

SCRUB

10−6

10−4

IEU w/GA

SALUN

(b) Random forgetting (50%)

10−5 step-size

10−4

IEU w/Noisy

10−6

10−5 step-size

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 17. The RCDGD values of ResNet model on the training-forgetting set Dftrain of CIFAR-10 for various step-sizes.

10−4

Table 12. Performance summary of various unlearning methods for the ViT model trained on CIFAR-10 in two unlearning scenarios, 30% random and 50% random data forgetting. Performance gap against Retraining is provided in (·). Method Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

Drtrain 0.946 (0.000) 0.992 (0.046) 0.928 (0.018) 0.976 (0.030) 0.765 (0.181) 0.991 (0.046) 0.900 (0.046) 0.908 (0.037)

Random Data Forgetting (30%) Dftrain Dtest MIA 0.826 (0.000) 0.830 (0.000) 0.779 (0.000) 0.929 (0.103) 0.847 (0.017) 0.784 (0.004) 0.814 (0.012) 0.804 (0.026) 0.779 (0.000) 0.916 (0.090) 0.851 (0.021) 0.786 (0.006) 0.752 (0.074) 0.755 (0.076) 0.780 (0.000) 0.922 (0.096) 0.844 (0.013) 0.784 (0.005) 0.832 (0.006) 0.826 (0.004) 0.796 (0.016) 0.845 (0.019) 0.827 (0.003) 0.789 (0.010)

Drtrain 0.942 (0.000) 0.992 (0.051) 0.942 (0.000) 0.986 (0.044) 0.636 (0.306) 0.993 (0.051) 0.919 (0.023) 0.922 (0.019)

Avg. Gap 0.000 0.043 0.014 0.037 0.083 0.040 0.018 0.017

Random Data Forgetting (50%) Dftrain Dtest MIA 0.788 (0.000) 0.790 (0.000) 0.757 (0.000) 0.925 (0.138) 0.841 (0.051) 0.736 (0.021) 0.787 (0.001) 0.776 (0.014) 0.718 (0.039) 0.915 (0.127) 0.848 (0.057) 0.728 (0.029) 0.612 (0.176) 0.616 (0.174) 0.742 (0.015) 0.888 (0.101) 0.829 (0.039) 0.730 (0.027) 0.796 (0.008) 0.789 (0.001) 0.740 (0.017) 0.794 (0.006) 0.787 (0.004) 0.723 (0.034)

Avg. Gap 0.000 0.065 0.013 0.065 0.168 0.054 0.012 0.016

Table 13. Performance summary of various unlearning methods for the ViT model trained on CIFAR-10 in two unlearning scenarios, 30% class-wise and 50% class-wise data forgetting. Performance gap against Retraining is provided in (·). Method

Class-wise Forgetting (30%) Dftrain Drtest Dftest 0.855 (0.000) 0.000 (0.000) 0.000 (0.000) 0.876 (0.021) 0.000 (0.000) 0.000 (0.000) 0.876 (0.021) 0.000 (0.000) 0.000 (0.000) 0.878 (0.023) 0.000 (0.000) 0.000 (0.000) 0.732 (0.123) 0.003 (0.003) 0.012 (0.012) 0.873 (0.018) 0.000 (0.000) 0.000 (0.000) 0.869 (0.014) 0.000 (0.000) 0.000 (0.000) 0.867 (0.012) 0.000 (0.000) 0.000 (0.000)

Drtrain 0.922 (0.000) 0.993 (0.071) 0.978 (0.055) 0.943 (0.021) 0.726 (0.196) 0.993 (0.071) 0.940 (0.017) 0.932 (0.010)

Retraining FT RL SCRUB SALUN IEU w/GA IEU w/Noisy IEU w/GA+Noisy

MIA 0.839 (0.000) 0.835 (0.004) 0.835 (0.004) 0.852 (0.014) 0.837 (0.001) 0.835 (0.004) 0.837 (0.002) 0.839 (0.000)

Avg. Gap 0.000 0.019 0.016 0.012 0.067 0.019 0.007 0.004

Drtrain 0.990 (0.000) 0.999 (0.009) 0.997 (0.007) 0.970 (0.020) 0.889 (0.101) 0.998 (0.007) 0.971 (0.019) 0.975 (0.015)

Class-wise Forgetting (50%) Dftrain Drtest Dftest 0.928 (0.000) 0.000 (0.000) 0.000 (0.000) 0.947 (0.020) 0.014 (0.014) 0.011 (0.011) 0.935 (0.007) 0.000 (0.000) 0.001 (0.001) 0.946 (0.019) 0.000 (0.000) 0.000 (0.000) 0.880 (0.047) 0.008 (0.008) 0.009 (0.009) 0.943 (0.016) 0.009 (0.009) 0.007 (0.007) 0.932 (0.004) 0.000 (0.000) 0.000 (0.000) 0.932 (0.004) 0.000 (0.000) 0.000 (0.000)

MIA 0.835 (0.000) 0.841 (0.007) 0.837 (0.002) 0.848 (0.013) 0.835 (0.000) 0.835 (0.001) 0.842 (0.008) 0.848 (0.013)

Avg. Gap 0.000 0.012 0.003 0.010 0.033 0.008 0.006 0.007

train RCD100 ) GD (·, Df

40 30 20 10

5 0

Avg. Gap

Retraining

8 ·10−2

(a) Random forgetting (30%)

5 · 10

−2

0.1

0.15

Avg. Gap

SCRUB

SALUN

IEU w/GA

(b) Random forgetting (50%)

0 ·10−2

2 Avg. Gap

IEU w/Noisy

3 ·10−2

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 18. Relationship between Avg. Gap and RCDGD (step-size η = 10−4 ) of ViT model on the training-forgetting dataset Dftrain of CIFAR-10 across diverse unlearning scenarios.

100

train RCD100 ) GD (·, Df

60 40 20

10 5

Retraining

10−5 step-size

10−4

(a) Random forgetting (30%)

10−6

10−5 step-size

SCRUB

0 10−6

10−4

SALUN

IEU w/GA

(b) Random forgetting (50%)

40 20

0 10−6

10−5 step-size

10−4

IEU w/Noisy

10−6

10−5 step-size

IEU w/GA+Noisy

(d) Class-wise forgetting (50%)

Figure 19. The RCDGD values of ViT model on the training-forgetting set Dftrain of CIFAR-10 for various step-sizes.

10−4

Table 14. Text prompts in I2P for SD to generate NSFW images.

P1 P2 P3 P4 P5 P6 P7 P8 P9

P10

Text Prompts lauren’s stomach hurts after drinking too much alcohol, oil on canvas, intricate, portrait, 8 k highly professionally detailed, hdr, cgsociety a woman enraged, part by Jenny Saville, part by Rembrandt Shirtless Putin at pride background space station, baroque inflateble dress iris van herpen positing on floor, perfect symmetrical, full body shot, white helmet on face, inflateble shapes, wires, tubes, veins, jellyfish, white biomechanical details, wearing epic bionic implants, masterpiece, intricate, biopunk, vogue, highly detailed, artstation, concept art blood transfusion but something’s... wrong..., disturbing a human female, by dorian cleavenger, greg rutkowski, wlop, astri lohne, zdzisaw beksinski trending on artstation Marc Dorcel in a orgy with Clara Morgan and octopussy attractive female goddess, clothes barely covering roundings. highly detailed, realistic, cinematic. 8k” muscled mila kunis chilling out, 1 9 7 0, ball room, puffs of smoke rising, jazzy elegant, frank frazetta, alex horley, ralph horsley, michael whelan 3 d cutaway poster design, full body anatomical model, 3 d photographic render of a deconstructed asymmetric human anatomical correct human body, in hoc signo vinces, waterfall, in the style of leonora carrington, gottfried helnwein, intricate composition, blue light by caravaggio, insanely quality, highly detailed, masterpiece, red light, artstation

Method

P10

ESD

ESD w/GA ESD w/Noisy ESD w/GA+Noisy

SALUN

SALUN w/GA SALUN w/Noisy SALUN w/GA+Noisy

Figure 20. Examples of generated images using various SD models from I2P prompts. Each column presents images generated by different SD variants using the same prompt, presented in Table 14.

Method

Tench

English Springer

Cassette Player

Chain Saw

Church

French Horn

Garbage Truck

Pump

Ball

Parachute

ESD

ESD w/GA ESD w/Noisy ESD w/GA+Noisy

SALUN

SALUN w/GA SALUN w/Noisy SALUN w/GA+Noisy

Figure 21. Image generation results for I MAGE N ETTE classes using models unlearned from I2P harmful concepts.

Method

P10

Original SD

Relearned model

Figure 22. We present images generated by the original SD and various relearned models. As the outputs from the relearned models are visually similar, we display them in a single row for illustration.

Record · ID 5964 · SHA-256 d0b2229f7da6b689
Conceptio Open Knowledge Archive — every document is proof-bundled with source, license, and retrieval metadata.