# Parameter-tuning-free data entry error
unlearning with adaptive selective
synaptic dampening

Stefan Schoepf1, Jack Foster1,2 & Alexandra Brintrup1,2
1 University of Cambridge, Department of Engineering
2 The Alan Turing Institute
<EMAIL_ADDRESS>

###### Abstract

Data entry constitutes a fundamental component of the machine learning
pipeline, yet it frequently results in the introduction of labelling errors.
When a model has been trained on a dataset containing such errors its
performance is reduced. This leads to the challenge of efficiently unlearning
the influence of the erroneous data to improve the model performance without
needing to completely retrain the model. While model editing methods exist for
cases in which the correct label for a wrong entry is known, we focus on the
case of data entry errors where we do not know the correct labels for the
erroneous data. Our contribution is twofold. First, we introduce an extension
to the selective synaptic dampening unlearning method that removes the need
for parameter tuning, making unlearning accessible to practitioners. We
demonstrate the performance of this extension, adaptive selective synaptic
dampening (ASSD), on various ResNet18 and Vision Transformer unlearning tasks.
Second, we demonstrate the performance of ASSD in a supply chain delay
prediction problem with labelling errors using real-world data where we
randomly introduce various levels of labelling errors. The application of this
approach is particularly compelling in industrial settings, such as supply
chain management, where a significant portion of data entry occurs manually
through Excel sheets, rendering it error-prone. ASSD shows strong performance
on general unlearning benchmarks and on the error correction problem where it
outperforms fine-tuning for error correction.

Keywords: Machine unlearning, Supply Chain Management (SCM), error correction
Competing interests: No competing interests

##  1 Introduction

Data is essential for training machine learning models but as Northcutt et al.
(2021) investigated, even the ten most widely used datasets in the literature
contain an average of 3.3% label errors. When errors are detected after a
model has been trained, there are three options: Continue using a model that
makes predictions based on partially false data, retrain the model from
scratch, or attempt to fix the model post-hoc. Fully retraining and
redeploying a new model is not only time-intensive but also potentially costly
with large models that use significant compute resources for training. Fixing
an already deployed model is therefore often the preferable option.

Figure 1: Unlearning data entry errors from a model trained on data including
label errors can achieve model behaviour similar to that of a model trained
solely on the correct data.

Fixing a model can fall into two categories. When we know the correct labels,
model editing approaches can be used to re-guide the wrongly labelled
observations to the correct label (e.g., for LLMs (Hartvigsen et al., 2023),
classifiers (Wang et al., 2022), generalized additive models (Santurkar et
al., 2021)). If the correct labels are unknown, as is often the case in
practice, we want to remove the influence of these wrongly labelled
observations from the model to make it behave as if it was only trained on the
correctly labelled data as shown in Fig. 1. Removing data from an already
trained model, referred to as machine unlearning, is a non-trivial problem
that aims to balance retaining the accuracy of the model while removing the
influence of the to-be-forgotten data from the model (Cao & Yang, 2015).
Existing methods have two shortcomings for the task of data entry error
forgetting. First, multiple state-of-the-art methods use ’confusion’
approaches in which they assign random or deliberately wrong labels to the
observations that should be forgotten to make the model forget the observation
(Chundawat et al., 2023; Tarun et al., 2023; Kurmanji et al., 2023b; Kodge et
al., 2023). In our case, this is undesirable, as this can lead to further
wrong predictions given that the features are a real occurrence, only the
labels are wrong. Kodge et al. (2023) shows the effect of their unlearning
method in a confusion matrix before and after forgetting where in a 10 class
forgetting task after forgetting the class cat, cats go from a 0.3% chance of
being classified as a ship to 11.4% (versus 26.2% chance to be classified as a
dog). Cats are forgotten but the behaviour of the model when encountering a
cat seems highly undesirable. A state-of-the-art method that does not suffer
from this limitation is Selective Synaptic Dampening (SSD) (Foster et al.,
2023). But SSD shares the second shortcoming with the other state-of-the-art
methods, a reliance on correctly chosen parameters to balance the
aggressiveness of forgetting and the retaining of model performance.

We address this shortcoming with an extension to SSD that automatically
chooses a suitable aggressiveness/performance trade-off. This enables
practitioners to use unlearning for data entry error unlearning out of the box
without any parameter tuning.

We first show the performance of Adaptive Selective Synaptic Dampening (ASSD)
on unlearning benchmarks using Resnet18 (RN) and Vision Transformer (ViT)
before applying ASSD to a data entry error unlearning scenario using real-life
delivery delay data from an e-commerce company (Constante et al., 2019) where
we compare ASSD performance to retraining and fine-tuning. The model parameter
counts used across these tasks range from 4.500 (simple neural network) to
85.000.000 (ViT) combined with unlearning shares of $<$1%-10% of the full
dataset. This large spread showcases the robustness of our adaptive method.

We make the following key contributions:

  1. 1.

We develop an adaptive parameter selection method for the method of Foster et
al. (2023) to enable parameter-tuning-free usage of unlearning in practice.

  2. 2.

We demonstrate the performance of ASSD to unlearn data entry errors on a
supply chain delay prediction problem using real-life data.

##  2 Related Work

Tanno et al. (2022) have laid the groundwork for the problem of identifying
training samples that cause model failures (e.g., mislabeled data) and then
unlearning these datapoints to improve the model.

The framework of Tanno et al. (2022) uses a Bayesian view of continual
learning and Bayesian unlearning. Since then, new state-of-the-art methods in
machine unlearning have been added to the literature. Recent high-performing
methods include Chundawat et al. (2023), Tarun et al. (2023), Kurmanji et al.
(2023b), and Kodge et al. (2023). Kurmanji et al. (2023a) uses, amongst other
worse-performing methods, the method from Kurmanji et al. (2023b) to unlearn
outdated information from models as database data changes. The mentioned
methods have in common, that they aim to degrade the performance of the model
on $D_{f}$ using additional training epochs (e.g., by assigning purposefully
wrong labels to $D_{f}$) while retaining performance on $D_{r}$ to achieve
unlearning. In the task of wanting to unlearn mislabeled data, this can
possibly result in a critical problem. Given a supply chain example, we might
have an order that arrived early but was mislabeled as arriving on time. If an
unlearning method aims to degrade the performance of $D_{r}$, to which this
example belongs, and makes it predict late delivery, the resulting model would
behave in an undesirable way by mislabeling such an observation again, this
time to another wrong label. Kodge et al. (2023) shows this undesirable
behaviour of their unlearning method in a confusion matrix. After unlearning
the class cat in a ten-class dataset, cats go from a 0.3% chance of being
classified as a ship to 11.4% even though a much more similar class, namely
dogs, exists. A method that does not suffer from this limitation while being
competitive with the performance of the aforementioned methods is Selective
Synaptic Dampening (SSD) from Foster et al. (2023). SSD builds upon the work
of Golatkar et al. (2020) (Fisher forgetting) that uses the Fisher Information
Matrix (FIM) to determine how important each model parameter is to $D_{r}$ and
$D_{f}$. SSD achieves significant improvements compared to Fisher forgetting,
making it competitive with the aforementioned state-of-the-art methods both in
terms of speed as well as performance.

A further limitation that the mentioned unlearning methods share is the
reliance on correctly chosen parameters to balance the ”aggressiveness” of
unlearning with the retention of performance on $D_{r}$. In the case of SSD,
these are the parameters $\alpha$ and $\lambda$. Foster et al. (2024) shows
significant performance dips of SSD and other methods such as SCRUB from
Kurmanji et al. (2023b) when used without an extensive parameter search per
unlearning task.

Our method addresses this limitation of SSD to make it parameter-free and easy
to use in practice.

##  3 Preliminaries

Analogous to Foster et al. (2023), the full dataset
$\mathcal{D}=\\{x_{i},y_{i}\\}^{N}_{i=1}$ with training samples $x_{i}$ and
class labels $y_{i}\in\\{1,...,K\\}$ acts as the starting point on which we
train a baseline model. We then aim to remove the influence of the forget set
$\mathcal{D}_{f}\subset\mathcal{D}$ from the baseline model to make it behave
as if it were trained on the retain set only
$\mathcal{D}_{r}=\mathcal{D}\setminus\mathcal{D}_{f}$. $D_{r}$ for an error
correction scenario denotes the subset of the data without errors while
$D_{f}$ represents the data with label errors. The difficulty hereby is
keeping the model performance (e.g., accuracy) high in regards to $D_{r}$
while forgetting the information the model learned from $D_{f}$. The model
parameters are referred to as $\theta\in\mathbb{R}^{m}$.

Foster et al. (2023) calculate the model importances using FIM before
modifiying the baseline model via the selection of overly specialised
parameters in Eq. 1 and then dampening these parameters by $\beta$ as shown in
Eq. 2. The first requires the selection of an appropriate parameter $\alpha$,
the latter $\lambda$. Choosing unsuitable parameters either leads to a lack of
forgetting or overly aggressive forgetting leading to a drastic drop in model
performance.

$\theta_{i}=\begin{cases}\beta\theta_{i},&\text{if
}[]_{\mathcal{D}_{f,i}}>\alpha[]_{\mathcal{D},i}\\\ \theta_{i},&\text{if
}[]_{\mathcal{D}_{f,i}}\leq\alpha[]_{\mathcal{D},i}\end{cases}\quad\forall
i\in[0,|\theta|]\quad\quad$ (1)

$\text{where
}\beta=min(\frac{\lambda[]_{\mathcal{D},i}}{[]_{\mathcal{D}_{f,i}}},1)$ (2)

##  4 Proposed Method

Due to the sheer number of possible model architectures, training methods,
data types, etc., a universal theoretical guarantee for selecting good SSD
parameters to achieve unlearning is practically intractable. Therefore, we
create a general parameter selection approach building upon three key
assumptions and validating the performance experimentally across a range of
tasks, models, and datasets. The key assumptions for ASSD are:

Assumption 1:
The FIM-based selection and dampening process of SSD can be simplified to only
rely on $\alpha$, keeping $\lambda=1$ and thus reducing the problem complexity
significantly while not harming performance.

Assumption 2:
Class frequencies and subpopulation frequencies within classes have a long
tail and follow a power law, closely resembling a log-log distribution as
described by Feldman (2019).

Assumption 3:
With an increasing amount of data to be unlearned, overlaps in FIM parameter
importances occur and thus allow the removal of data with a sub-linearly
scaling increase in parameters to be modified.

(a)

(b)

Figure 2: SSD hyperparameter search on the CIFAR100 rocket fullclass
unlearning task on ResNet18 using Optuna highlights the high importance of
$\alpha$ whereas $\lambda$ values show little impact on the unlearning
performance as quantified by the MIA and retain accuracy values.

Assumption 1 acts as the foundation for ASSD by simplifying the problem to a
single parameter. Our assumption that the importance of $\alpha$ far outweighs
$\lambda$ to the degree that the latter can be kept constant without
performance deterioration of SSD is supported by the results shown in Fig. 2.
We observe that the magnitude of $\lambda$ does not have a notable influence
on either the used Membership Inference Attack (MIA), which is used to assess
the quality of unlearning, or the accuracy of the unlearned model. The only
notable exception is $\lambda=0$, where we can observe a significant drop in
model accuracy. This aligns with the method motivation of Foster et al. (2023)
that dampening leads to better performance than simply setting a parameter to
zero which can then act like a dead neuron destroying model performance. Due
to this behaviour, we set $\lambda=1$ for ASSD which simplifies equation 2 to
equation 3.

$\text{where }\beta=min(\frac{[]_{\mathcal{D},i}}{[]_{\mathcal{D}_{f,i}}},1)$
(3)

With equation 3 we observe the behaviour shown in Fig. 3. For each unlearning
task (e.g., unlearning the CIFAR100 class rocket from a ResNet18 model), we
assume there exists a plateau where MIA and retain accuracy are at a near-
optimal level with some fluctuation along the plateau. The accuracy plateau
can be explained by the fact that with a sufficiently high $\alpha$ no or
minimal changes to the model are performed and thus no performance degradation
takes place. Equally, no or minimal changes lead to a stable MIA while overly
aggressive unlearning also leads to a low MIA but at the cost of accuracy
(i.e., model loses all knowledge). The location and width of this plateau
changes not only with each task type (e.g., fullclass versus sub-class
unlearning) but also when unlearning different (sub)classes. When unlearning
rockets from CIFAR100, the MIA starts to increase after $\alpha=80$ while
unlearning the rocket sub-class from CIFAR20 leads to a MIA increase starting
at $\alpha=25$. In contrast, the accuracy plateau is reached at around
$\alpha=10$ for CIFAR100 rocket full-class and $\alpha=5$ for CIFAR20 rocket
sub-class. Even though we unlearn the same images in both cases, the plateau
is much smaller in the sub-class task (5-25) than in the full-class task
(10-80). We can even observe a shift of the plateau in the original method
paper of Foster et al. (2023) where they report that the class baby observes a
critical drop in performance when using the same $\alpha$ as the other classes
for the fullclass forgetting task. Due to this shifting nature of the plateau
from task to task, we need an adaptive approach for use in practice.

Our approach determines a viable $\alpha$ parameter using assumptions 2 and 3.
Feldman (2019), shows that for most datasets class frequencies and
subpopulation frequencies within classes have a long tail and follow a power
law, closely resembling a log-log distribution. We further assume that
forgetting multiple similar images in such a population at once can be
achieved with fewer parameters to be changed than the sum of each of them
individually (e.g., forgetting all rockets out of a dataset vs two specific
rockets). This means that with an increasing number of samples to be
forgotten, there will be some kind of overlap that can be used for more
efficient forgetting, thus not requiring as many parameters as forgetting each
sample individually. Putting our log-log distribution assumption together with
shared memorization parameters between similar images, we propose a two-step
selection process for $\alpha$.

Our method selects the x-th percentile of relative importance values as the
ones that are suspected to contain overly specialized information, i.e.
memorization of the forget samples. This is achieved by combining the log
assumption from assumption 1 with the unlearning synergy assumption from
assumption 2 in equation 5. Equation 1 then uses the calculated percentile $p$
to determine $\alpha$ from the distribution of relative FIM importances. This
adaptive parameter selection step is easily integrated in the SSD workflow as
shown in Algorithm 1. The calculations of $p$ and $\alpha$ take part after
$[]D_{f}$ and only adds the computational complexity of sorting the relative
importances in equation 5 for percentile selection which is far lower than the
compute time complexity of $[]D_{f}$ and $[]D$. As with the original SSD, the
computationally expensive $[]D$ only needs to be calculated once and can then
be stored.

Figure 3: A simplified visualization of the unlearning plateau where model
accuracy and MIA both are at near ideal values. Setting $\alpha$ above or
below the plateau leads to significant drops in the desired performance of MIA
or accuracy.

$\text{where
}\alpha=P_{p}(\frac{[]_{\mathcal{D}}}{[]_{\mathcal{D}_{f}}}),\quad
p\in[0,100]\quad\quad$ (4)

$\text{where }p=100-log\left(1+\frac{|D_{f}|}{|D|}\cdot 100\right)$ (5)

Algorithm 1 Adaptive Selective Synaptic Dampening

Input: $\phi_{\theta}$, $\mathcal{D}$, $\mathcal{D}_{f}$
Parameters: None
Output: $\phi_{\theta^{\prime}}$

1: Calculate and store $[]_{\mathcal{D}}$ once. Discard $\mathcal{D}$.

2: Calculate $[]_{\mathcal{D}_{f}}$

3: Calculate $p$

4: Calculate $\alpha$

5: for i in range $|\theta|$ do

6: if $[]_{\mathcal{D}_{f},i}>\alpha[]_{\mathcal{D},i}$ then

7:
$\theta^{\prime}_{i}=min(\frac{[]_{\mathcal{D},i}}{[]_{\mathcal{D}_{f,i}}}\theta_{i},\theta_{i})$

8: end if

9: end for

10: return $\phi_{\theta^{\prime}}$

##  5 Experimental Setup

We perform two types of experiments to empirically validate the performance of
ASSD. First, we benchmark ASSD against SSD to show that the automatic
parameter selection works across different unlearning tasks and model types.
Second, we show the applicability of ASSD for error unlearning on a real-life
tabular supply chain dataset.

###  5.1 Datasets

For the ASSD versus SSD benchmarking, we use the same benchmarks as Foster et
al. (2023) and Chundawat et al. (2023). These are the image classification
datasets CIFAR10, CIFAR20, CIFAR100 (Krizhevsky & Hinton, 2010) and
PinsFaceRecognition Burak (2020).

For the error unlearning task, we use the supply chain dataset of Constante et
al. (2019) which includes clothing, sports, and electronic part data from an
e-commerce company including delivery delay that we use as labels (i.e.,
early, on-time, delayed).

###  5.2 Models

For the unlearning benchmarks, we use ResNet18 (He et al., 2016) and Vision
Transformer (Dosovitskiy et al., 2020) as done in Chundawat et al. (2023) and
Foster et al. (2023). The training of the models is done as described in
Foster et al. (2023)

For the error unlearning task we use three different sizes of simple fully
connected neural networks to also showcase the performance of ASSD on much
smaller models with 4.500+ parameters versus the 85M of ViT. The three models
are two layers of 50 neurons, three layers of 100 neurons, and five layers of
250 neurons to show that results hold up across different network sizes. We
train the models with batch normalization (Ioffe & Szegedy, 2015), ReLu
activation (Agarap, 2018) and stochastic gradient descent (Amari, 1993). The
epochs are set to 25 with a learning rate decay of 0.95 and Optuna (Akiba et
al., 2019) is used to find an optimal learning rate and regularization on the
full dataset without any labelling errors. These parameters are then used to
train the models that contain label errors.

All models are trained on an NVIDIA RTX4090 with Intel Xeon processors.

###  5.3 Unlearning tasks

For the unlearning benchmarking task of ASSD versus SSD, we use the same three
unlearning scenarios as used by Foster et al. (2023) and Chundawat et al.
(2023): (i) Single-class forgetting, (ii) sub-class forgetting, and (iii)
random observations forgetting. In (i) we perform unlearning on CIFAR100,
CIFAR 20, and PinsFaceRecognition. We unlearn full classes of each (e.g.,
rockets out of CIFAR100, the face of a person out of PinsFaceRecognition). In
(ii) we forget a subclass from CIFAR20. CIFAR20 contains the same classes of
CIFAR100 grouped into 20 superclasses that share the same label in CIFAR20
(e.g., the rocket subclass gets labelled as part of vehicles). In (iii) we use
CIFAR10 and select samples randomly across all classes to be forgotten. Due to
the high similarity of CIFAR10 samples in the classes, unlearning in this
scenario is very minor as forgetting one image of an aeroplane highly likely
still leads to the correct classification of this image as an aeroplane due to
the numerous other remaining images of similar looking aeroplanes in the
dataset.

Our error unlearning task can also be seen as (iii) random unlearning. We use
the e-commerce dataset of Constante et al. (2019) to predict the expected
delivery time of an order (early, on-time, delayed). Depending on the error
amount we select a percentage of $D$ that we randomly mislabel (e.g., on-time
to delayed). The mislabeled data $D_{f}$ is then unlearned to improve model
performance.

###  5.4 Evaluation and baselines

We use two different ways to evaluate the performance of ASSD. In the general
unlearning benchmark, we compare ASSD against SSD, and model retraining (i.e.,
training the model again on only $D_{r}$). The baseline values reported are
from the original model trained on $D$. Evaluation is performed using the
model accuracy on $D_{r}$ and $D_{f}$ as well as the forgetting performance
using a Membership Inference Attack (MIA). MIA aims to determine if a sample
of the dataset was in the training data or not. We use the logistic regression
MIA implementation used in Chundawat et al. (2023) and Foster et al. (2023)
for comparability. While $D_{r}$ should remain as high as possible to retain
performance on the remaining data, $D_{f}$ and MIA are more difficult to
evaluate. As described in Chundawat et al. (2023), an unlearned model that
behaves similarly to a retrained model that has never seen the to-be-forgotten
data would be ideal. Due to generalization (e.g., other cars in a dataset
allow the model to correctly classify a forgotten car as a car) $D_{f}$ and
MIA do not necessarily need to be zero or close to zero to behave as desired.
Chundawat et al. (2023) even highlights the danger of the Streisand effect
when lowering $D_{f}$ or MIA far below what a retrained model would do.

In the error unlearning task we report the model accuracy of a baseline model
trained on $D$ including the label errors, a retrained model only trained on
$D_{r}$, a fine-tuned model (i.e., baseline model with one additional fine-
tuning epoch on $D_{r}$), and ASSD. Unlike the unlearning tasks, the
performance on future unseen data is essential for this application.
Therefore, we exclude the last 20% of the full dataset (by timestamps of the
data) from the baseline training data. $D$ denotes the training data with
$D_{r}\subset D$ and $D_{f}=D\backslash D_{r}$. A higher accuracy on $D_{r}$
(train data excluding errors) and the test data is desired. As retraining is
significantly more time intensive, the comparison focuses on fine-tuning for
real-life application. We use one fine-tuning epoch with a learning rate
further decreased beyond the learning rate of the last training epoch by the
learning rate decay parameter $\gamma=0.95$. This resembles a simple yet
effective approach in practice and as shown in the results section, and does
not overfit on the train data.

##  6 Results and Discussion

We first compare ASSD and SSD on the unlearning benchmarks used in Foster et
al. (2023) and Chundawat et al. (2023) before applying ASSD to an error
unlearning task on e-commerce delay prediction. The first part focuses on the
ability to remove information from a model so that an attacker cannot
determine if certain data was used in the training process (e.g., data privacy
applications) while preserving model performance. The second part focuses on
the ability to remove erroneous data from a model that can lead to wrong
predictions. The focus hereby is on improved model prediction performance.

|  | ResNet18 | Vision Transformer
---|---|---|---
Class | metric | baseline | retrain | ASSD | SSD | baseline | retrain | ASSD | SSD
baby | $\mathcal{D}_{r}$ | 76.38$\pm$0.00 | 73.10$\pm$0.55 | 76.10$\pm$0.00 | 44.05$\pm$0.00 | 88.93$\pm$0.00 | 90.27$\pm$0.15 | 88.31$\pm$0.00 | 88.59$\pm$0.00
| $\mathcal{D}_{f}$ | 72.48$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 90.19$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00
| MIA | 92.60$\pm$0.00 | 2.44$\pm$0.01 | 0.2$\pm$0.00 | 5.40$\pm$0.00 | 75.60$\pm$0.00 | 21.53$\pm$0.03 | 2.4$\pm$0.00 | 0.60$\pm$0.00
lamp | $\mathcal{D}_{r}$ | 76.39$\pm$0.00 | 72.89$\pm$0.34 | 76.36$\pm$0.00 | 76.08$\pm$0.00 | 88.84$\pm$0.00 | 90.10$\pm$0.19 | 88.64$\pm$0.00 | 89.06$\pm$0.00
| $\mathcal{D}_{f}$ | 70.49$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 97.22$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 36.89$\pm$0.00
| MIA | 92.40$\pm$0.00 | 0.32$\pm$0.00 | 0$\pm$0.00 | 0.20$\pm$0.00 | 95.60$\pm$0.00 | 2.27$\pm$0.01 | 1.4$\pm$0.00 | 0.40$\pm$0.00
MR | $\mathcal{D}_{r}$ | 76.28$\pm$0.00 | 72.90$\pm$0.45 | 76.12$\pm$0.00 | 75.59$\pm$0.00 | 88.87$\pm$0.00 | 90.02$\pm$0.22 | 88.07$\pm$0.00 | 88.82$\pm$0.00
| $\mathcal{D}_{f}$ | 80.12$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 94.88$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00
| MIA | 95.20$\pm$0.00 | 0.22$\pm$0.00 | 0.6$\pm$0.00 | 0.20$\pm$0.00 | 92.80$\pm$0.00 | 0.70$\pm$0.00 | 2.2$\pm$0.00 | 3.80$\pm$0.00
Rkt | $\mathcal{D}_{r}$ | 76.27$\pm$0.00 | 72.83$\pm$0.42 | 75.12$\pm$0.00 | 74.54$\pm$0.00 | 88.88$\pm$0.00 | 90.07$\pm$0.09 | 88.39$\pm$0.00 | 88.90$\pm$0.00
| $\mathcal{D}_{f}$ | 80.90$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 94.70$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00
| MIA | 93.40$\pm$0.00 | 1.04$\pm$0.00 | 0$\pm$0.00 | 2.20$\pm$0.00 | 94.40$\pm$0.00 | 3.23$\pm$0.00 | 1.4$\pm$0.00 | 1.80$\pm$0.00
sea | $\mathcal{D}_{r}$ | 76.23$\pm$0.00 | 72.83$\pm$0.54 | 75.55$\pm$0.00 | 73.56$\pm$0.00 | 88.91$\pm$0.00 | 90.27$\pm$0.21 | 86.98$\pm$0.00 | 87.95$\pm$0.00
| $\mathcal{D}_{f}$ | 85.85$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 90.54$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00
| MIA | 93.40$\pm$0.00 | 5.84$\pm$0.02 | 0.2$\pm$0.00 | 0.60$\pm$0.00 | 80.40$\pm$0.00 | 8.43$\pm$0.02 | 4.4$\pm$0.00 | 3.20$\pm$0.00
ED | $\mathcal{D}_{r}$ | 82.56$\pm$0.00 | 82.13$\pm$0.23 | 82.92$\pm$0.00 | 83.15$\pm$0.00 | 95.73$\pm$0.00 | 94.71$\pm$0.14 | 95.40$\pm$0.00 | 95.82$\pm$0.00
| $\mathcal{D}_{f}$ | 82.26$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 1.76$\pm$0.00 | 95.03$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 53.53$\pm$0.00
| MIA | 89.56$\pm$0.00 | 8.91$\pm$0.01 | 5.60$\pm$0.00 | 4.16$\pm$0.00 | 91.60$\pm$0.00 | 9.82$\pm$0.01 | 5.72$\pm$0.00 | 1.32$\pm$0.00
NS | $\mathcal{D}_{r}$ | 82.10$\pm$0.00 | 81.33$\pm$0.22 | 79.32$\pm$0.00 | 82.33$\pm$0.00 | 95.71$\pm$0.00 | 94.79$\pm$0.11 | 95.30$\pm$0.00 | 93.63$\pm$0.00
| $\mathcal{D}_{f}$ | 91.08$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 95.37$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00
| MIA | 88.68$\pm$0.00 | 3.77$\pm$0.01 | 2.88$\pm$0.00 | 3.28$\pm$0.00 | 85.04$\pm$0.00 | 4.70$\pm$0.01 | 2$\pm$0.00 | 1.88$\pm$0.00
people | $\mathcal{D}_{r}$ | 82.11$\pm$0.00 | 81.20$\pm$0.19 | 82.13$\pm$0.00 | 82.31$\pm$0.00 | 95.54$\pm$0.00 | 94.54$\pm$0.14 | 95.11$\pm$0.00 | 95.33$\pm$0.00
| $\mathcal{D}_{f}$ | 90.70$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 98.54$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00
| MIA | 91.72$\pm$0.00 | 1.36$\pm$0.00 | 2.24$\pm$0.00 | 1.12$\pm$0.00 | 89.48$\pm$0.00 | 1.56$\pm$0.00 | 1.48$\pm$0.00 | 1.20$\pm$0.00
veg | $\mathcal{D}_{r}$ | 82.31$\pm$0.00 | 81.39$\pm$0.21 | 82.20$\pm$0.00 | 82.38$\pm$0.00 | 95.59$\pm$0.00 | 94.54$\pm$0.21 | 95.07$\pm$0.00 | 95.71$\pm$0.00
| $\mathcal{D}_{f}$ | 86.90$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 97.57$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00
| MIA | 89.52$\pm$0.00 | 9.74$\pm$0.01 | 13.52$\pm$0.00 | 16.96$\pm$0.00 | 91.32$\pm$0.00 | 4.41$\pm$0.01 | 2.96$\pm$0.00 | 1.88$\pm$0.00
Veh2 | $\mathcal{D}_{r}$ | 82.69$\pm$0.00 | 82.11$\pm$0.19 | 82.56$\pm$0.00 | 82.97$\pm$0.00 | 95.73$\pm$0.00 | 94.85$\pm$0.13 | 93.93$\pm$0.00 | 93.12$\pm$0.00
| $\mathcal{D}_{f}$ | 80.41$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00 | 95.22$\pm$0.00 | 0.00$\pm$0.00 | 0$\pm$0.00 | 0.00$\pm$0.00
| MIA | 82.56$\pm$0.00 | 13.54$\pm$0.01 | 5.16$\pm$0.00 | 6.68$\pm$0.00 | 84.04$\pm$0.00 | 22.96$\pm$0.03 | 6.04$\pm$0.00 | 7.04$\pm$0.00
Faces | $\mathcal{D}_{r}$ | 98.52$\pm$0.02 | 100.00$\pm$0.00 | 98.16$\pm$0.25 | 98.42$\pm$0.13 |  |  |  |
| $\mathcal{D}_{f}$ | 97.84$\pm$1.99 | 0.00$\pm$0.00 | 0.00$\pm$0.00 | 0.00$\pm$0.00 |  |  |  |
| MIA | 34.38$\pm$0.23 | 0.00$\pm$0.00 | 0.74$\pm$1.01 | 1.11$\pm$0.01 |  |  |  |
Table 1: Fullclass unlearning on Cifar100 (baby-sea), Cifar20 (ED-Veh2), and
Face unlearning. Bold highlights instances where ASSD and SSD differ
significantly. While SSD generally performs slightly better due to
hyperparameter search for the ResNet18 and Vision Transformer tasks, ASSD is
more reliable and does not experience the highlighted performance outliers of
SSD.

###  6.1 Unlearning benchmarks

In the (i) fullclass unlearning tasks shown in Table 1, SSD and ASSD perform
similarly. One difference is the slightly better accuracy of SSD on $D_{r}$
which is an expected result of parameters chosen for exactly these benchmarks.
ASSD, which is parameter-free and automatically chooses its parameters, does
not exhibit the performance drops of SSD on various subtasks (highlighted bold
in Table 1). A minor drop in accuracy for increased reliability is a desirable
outcome.

In the (ii) subclass unlearning task shown in Table 2, results are similar to
the fullclass task with the main difference being that ASSD performs stronger
unlearning on the sea subclass.

In the (iii) random unlearning task ASSD and SSD once again perform similarly.
ASSD achieves higher accuracy on $D_{r}$ and a closer match on average MIA to
the retrained model. It is important to consider that in a random unlearning
scenario, similar images can lead to correct classification of forgotten
images due to their similarity (e.g., forgetting one rocket but still having
other rockets in the data). Thus, MIA remains high even on a retrained model
that has never seen $D_{r}$

ASSD shares the limitation of SSD in regards to no mathematical guarantees or
certifications to unlearn which extends to the automatic selection of $\alpha$
that is based on the assumptions outlined in 4.

Across all three tasks, ASSD performs similarly to the state-of-the-art method
SSD while removing the need for parameter search to find a good balance of
unlearning and retained model performance.

|  | ResNet18 | Vision Transformer
---|---|---|---
Class | metric | baseline | retrain | ASSD | SSD | baseline | retrain | ASSD | SSD
baby | $\mathcal{D}_{r}$ | 82.45$\pm$0.00 | 81.45$\pm$0.3 | 78.84$\pm$0.00 | 79.25$\pm$0.00 | 95.69$\pm$0.00 | 94.50$\pm$0.19 | 94.21$\pm$0.00 | 95.54$\pm$0.00
| $\mathcal{D}_{f}$ | 86.98$\pm$0.00 | 80.03$\pm$3.4 | 0.00$\pm$0.00 | 8.85$\pm$0.00 | 96.44$\pm$0.00 | 93.23$\pm$1.09 | 40.71$\pm$0.00 | 94.10$\pm$0.00
| MIA | 90.40$\pm$0.00 | 44.82$\pm$0.02 | 2.60$\pm$0.00 | 1.40$\pm$0.00 | 91.60$\pm$0.00 | 77.37$\pm$0.03 | 80.00$\pm$0.00 | 77.20$\pm$0.00
lamp | $\mathcal{D}_{r}$ | 82.61$\pm$0.00 | 81.81$\pm$0.19 | 79.69$\pm$0.00 | 79.58$\pm$0.00 | 95.77$\pm$0.00 | 94.69$\pm$0.13 | 95.00$\pm$0.00 | 95.54$\pm$0.00
| $\mathcal{D}_{f}$ | 72.66$\pm$0.00 | 22.95$\pm$4.72 | 0.00$\pm$0.00 | 0.00$\pm$0.00 | 89.58$\pm$0.00 | 34.55$\pm$8.62 | 3.56$\pm$0.00 | 14.58$\pm$0.00
| MIA | 83.40$\pm$0.00 | 4.29$\pm$0.01 | 1.40$\pm$0.00 | 2.00$\pm$0.00 | 81.00$\pm$0.00 | 5.60$\pm$0.02 | 5.60$\pm$0.00 | 3.2$\pm$0.00
MR | $\mathcal{D}_{r}$ | 82.60$\pm$0.00 | 81.66$\pm$0.21 | 80.40$\pm$0.00 | 80.05$\pm$0.00 | 95.69$\pm$0.00 | 94.60$\pm$0.13 | 92.13$\pm$0.00 | 95.51$\pm$0.00
| $\mathcal{D}_{f}$ | 72.22$\pm$0.00 | 10.48$\pm$2.02 | 0.78$\pm$0.00 | 0.78$\pm$0.00 | 97.05$\pm$0.00 | 26.57$\pm$6.41 | 0.00$\pm$0.00 | 6.68$\pm$0.00
| MIA | 86.80$\pm$0.00 | 2.27$\pm$0.00 | 4.40$\pm$0.00 | 4.00$\pm$0.00 | 77.80$\pm$0.00 | 2.34$\pm$0.01 | 0.60$\pm$0.00 | 0.40$\pm$0.00
Rkt | $\mathcal{D}_{r}$ | 82.54$\pm$0.00 | 81.54$\pm$0.24 | 82.37$\pm$0.00 | 82.43$\pm$0.00 | 95.73$\pm$0.00 | 94.61$\pm$0.13 | 95.22$\pm$0.00 | 95.13$\pm$0.00
| $\mathcal{D}_{f}$ | 79.34$\pm$0.00 | 10.74$\pm$3.4 | 2.17$\pm$0.00 | 2.17$\pm$0.00 | 94.53$\pm$0.00 | 22.26$\pm$8.34 | 5.90$\pm$0.00 | 5.12$\pm$0.00
| MIA | 89.40$\pm$0.00 | 3.85$\pm$0.01 | 9.40$\pm$0.00 | 10.80$\pm$0.00 | 80.40$\pm$0.00 | 3.44$\pm$0.01 | 3.80$\pm$0.00 | 5.40$\pm$0.00
sea | $\mathcal{D}_{r}$ | 82.37$\pm$0.00 | 81.30$\pm$0.27 | 80.60$\pm$0.00 | 81.72$\pm$0.00 | 95.67$\pm$0.00 | 94.55$\pm$0.22 | 94.89$\pm$0.00 | 95.57$\pm$0.00
| $\mathcal{D}_{f}$ | 96.27$\pm$0.00 | 91.47$\pm$1.92 | 34.20$\pm$0.00 | 75.35$\pm$0.00 | 99.22$\pm$0.00 | 95.12$\pm$0.81 | 84.81$\pm$0.00 | 97.05$\pm$0.00
| MIA | 90.80$\pm$0.00 | 52.09$\pm$0.03 | 2.60$\pm$0.00 | 21.80$\pm$0.00 | 88.40$\pm$0.00 | 65.96$\pm$0.04 | 38.20$\pm$0.00 | 82.20$\pm$0.00
Table 2: Subclass unlearning on Cifar20. Bold highlights instances where ASSD and SSD differ significantly. ASSD performs significantly stronger unlearning on the sea (ViT) instances. | ResNet18 | Vision Transformer
---|---|---
metric | baseline | retrain | ASSD | SSD | baseline | retrain | ASSD | SSD
$\mathcal{D}_{r}$ | 90.71$\pm$0.00 | 91.45$\pm$0.11 | 90.67$\pm$0.07 | 88.68$\pm$3.36 | 98.88$\pm$0.00 | 98.61$\pm$0.08 | 98.85$\pm$0.04 | 98.01$\pm$1.56
$\mathcal{D}_{f}$ | 95.30$\pm$2.08 | 94.10$\pm$2.00 | 95.30$\pm$2.16 | 93.61$\pm$4.99 | 100.00$\pm$0.00 | 98.80$\pm$0.76 | 99.64$\pm$0.58 | 98.07$\pm$2.35
MIA | 75.78$\pm$0.04 | 74.22$\pm$0.04 | 75.54$\pm$4.17 | 72.65$\pm$0.05 | 90.76$\pm$0.03 | 91.77$\pm$0.02 | 92.89$\pm$4.11 | 85.54$\pm$0.11
Table 3: Random unlearning on Cifar 10. Due to a large number of similar
images in the retain data out of which we forget random observations, values
hardly change as generalization covers nearly all forgotten cases (e.g.,
retrain MIA for ViT even increases).

###  6.2 Model improvement via error unlearning

Figure 4: Model accuracy improvement due to unlearning compared with the
baseline model trained on data with random errors for 100 random scenarios
using a neural network with three layers of 100 neurons each.

In the error unlearning task we compare unlearning using ASSD to fine-tuning
of the baseline model and retraining on $D_{r}$. Table 4 shows the accuracy of
each model on the train and test data for three different model sizes (shown
as layers $\cdot$ neurons per layer) and six different random error amounts
ranging from 0.25% to 10%. The best-performing model amongst baseline, fine-
tuning and ASSD is highlighted in bold. Retraining is not highlighted, as full
retraining is much more resource and time-intensive compared to the other
approaches and acts as a reference for what a model trained on $D_{r}$ would
achieve. It is notable, that while retraining outperforms the other methods on
low error percentages ($\leq 1\%$), fine-tuning and ASSD tend to achieve
similar or better results at higher error percentages. A possible explanation
for this is that removing a significant percentage of training data from $D$
(e.g., 5% $D_{f}$) for retraining hurts performance more than learning the
errors in the first place and then unlearning them by fine-tuning or
unlearning. The error data in the training might help the model to be more
robust and thus allow for better performance combined with fine-tuning or
unlearning. As we start to go beyond 5% errors in the training data, the
performance of ASSD starts to deteriorate with significant dips in accuracy.
This is expected as ASSD performs unlearning without any kind of repair steps
(i.e., additional training epochs to increase accuracy after unlearning). With
error rates of 7.5% and 10% the amount of changes needed in the model to
remove this information becomes significant and accuracy dips occur. Such high
error rates likely indicate another systematic problem in data collection or
preparation that should be corrected instead. Fig. 4 shows the performance
gain as additional correct classifications on the test data. While unlearning
still presents a net gain on 10% error data in Fig. 4, a clear downward trend
after 5% can be observed due to the mentioned large changes to the model
without a repair step.

Fig. 5(a), 5(b), and 5(c) shows a detailed view of the unlearning improvement
on the test data in the 1% label error scenario for all three model sizes. The
baseline model accuracies for 100 random scenarios with 1% mislabeled data
each are plotted in increasing order. We can observe that unlearning increases
the performance on the large model more than on the small model. A possible
hypothesis for this is that larger (overparameterized) models have a greater
ability to memorize wrong data compared to a smaller model that is forced to
generalize more due to its limited parameter count. This observation is in
line with the findings of Feldman (2019) on memorization of information in
deep learning models.

Overall, ASSD reliably increases model performance by unlearning small errors
on the shown test scenarios and outperforms fine-tuning.

(a) Large model with 5x250 layers and neurons.

(b) Medium model with 3x100 layers and neurons.

(c) Small model with 2x50 layers and neurons.

Figure 5: Model accuracy improvement due to unlearning compared with the baseline model trained on data with 1% random errors and a retrained model on data excluding the errors. 100 error scenarios with randomly chosen observations to be mislabeled are shown ordered by the accuracy of the baseline model on the test data. Model size | Data | Error | Baseline Accuracy | Retrain Accuracy | Finetune Accuracy | Unlearn Accuracy | p-value*
---|---|---|---|---|---|---|---
5x250 | Test | 0.25% | 85.95 ± 0.06 | 86.19 ± 0.10 | 85.94 ± 0.07 | 85.98 ± 0.09 | <0.05
3x100 | 86.34 ± 0.18 | 86.62 ± 0.14 | 86.32 ± 0.13 | 86.35 ± 0.18 | 0.92
2x50 | 86.72 ± 0.03 | 86.96 ± 0.03 | 86.72 ± 0.03 | 86.76 ± 0.04 | <0.05
5x250 | 1.0% | 86.00 ± 0.12 | 86.77 ± 0.05 | 86.21 ± 0.14 | 86.61 ± 0.24 | <0.05
3x100 | 86.38 ± 0.22 | 87.24 ± 0.04 | 86.87 ± 0.16 | 86.96 ± 0.23 | <0.05
2x50 | 86.76 ± 0.09 | 87.21 ± 0.03 | 86.85 ± 0.08 | 86.88 ± 0.13 | <0.05
5x250 | 2.5% | 86.18 ± 0.21 | 86.48 ± 0.11 | 86.11 ± 0.18 | 87.10 ± 0.25 | <0.05
3x100 | 86.54 ± 0.25 | 86.76 ± 0.07 | 86.48 ± 0.23 | 87.10 ± 0.25 | <0.05
2x50 | 86.92 ± 0.11 | 87.02 ± 0.05 | 86.89 ± 0.11 | 87.05 ± 0.16 | <0.05
5x250 | 5.0% | 86.39 ± 0.24 | 86.64 ± 0.08 | 86.34 ± 0.20 | 86.86 ± 0.46 | <0.05
3x100 | 86.70 ± 0.30 | 86.69 ± 0.09 | 86.68 ± 0.24 | 87.42 ± 0.17 | <0.05
2x50 | 87.07 ± 0.11 | 87.24 ± 0.07 | 87.06 ± 0.11 | 87.47 ± 0.19 | <0.05
5x250 | 7.5% | 86.51 ± 0.23 | 86.85 ± 0.08 | 86.60 ± 0.20 | 85.36 ± 1.38 | <0.05
3x100 | 86.84 ± 0.26 | 86.40 ± 0.21 | 86.53 ± 0.33 | 87.14 ± 0.36 | <0.05
2x50 | 87.16 ± 0.11 | 86.79 ± 0.10 | 87.02 ± 0.11 | 87.10 ± 0.72 | 0.46
5x250 | 10% | 86.56 ± 0.28 | 86.73 ± 0.11 | 86.54 ± 0.25 | 82.53 ± 2.03 | <0.05
3x100 | 86.92 ± 0.31 | 86.62 ± 0.21 | 86.57 ± 0.36 | 87.04 ± 0.40 | <0.05
2x50 | 87.25 ± 0.12 | 87.01 ± 0.10 | 87.06 ± 0.12 | 87.13 ± 0.57 | <0.05
5x250 | Train | 0.25% | 86.49 ± 0.05 | 86.62 ± 0.05 | 86.47 ± 0.05 | 86.52 ± 0.07 | <0.05
3x100 | 87.23 ± 0.05 | 87.38 ± 0.06 | 87.25 ± 0.04 | 87.24 ± 0.05 | 0.13
2x50 | 87.08 ± 0.02 | 87.19 ± 0.02 | 87.09 ± 0.03 | 87.10 ± 0.04 | <0.05
5x250 | 1.0% | 86.50 ± 0.07 | 87.07 ± 0.05 | 86.72 ± 0.08 | 86.94 ± 0.14 | <0.05
3x100 | 87.23 ± 0.07 | 87.57 ± 0.05 | 87.57 ± 0.07 | 87.35 ± 0.08 | <0.05
2x50 | 87.16 ± 0.06 | 87.54 ± 0.03 | 87.27 ± 0.05 | 87.21 ± 0.10 | <0.05
5x250 | 2.5% | 86.62 ± 0.10 | 86.86 ± 0.06 | 86.57 ± 0.09 | 87.48 ± 0.20 | <0.05
3x100 | 87.28 ± 0.08 | 87.16 ± 0.06 | 87.25 ± 0.08 | 87.53 ± 0.12 | <0.05
2x50 | 87.31 ± 0.08 | 87.35 ± 0.04 | 87.28 ± 0.08 | 87.44 ± 0.12 | <0.05
5x250 | 5.0% | 86.79 ± 0.14 | 87.06 ± 0.10 | 86.76 ± 0.13 | 87.28 ± 0.37 | <0.05
3x100 | 87.35 ± 0.10 | 87.19 ± 0.08 | 87.33 ± 0.10 | 87.71 ± 0.18 | <0.05
2x50 | 87.45 ± 0.08 | 87.51 ± 0.06 | 87.45 ± 0.08 | 87.82 ± 0.17 | <0.05
5x250 | 7.5% | 86.91 ± 0.14 | 87.21 ± 0.10 | 86.92 ± 0.12 | 85.77 ± 1.14 | <0.05
3x100 | 87.39 ± 0.12 | 86.95 ± 0.11 | 87.07 ± 0.14 | 87.41 ± 0.29 | 0.59
2x50 | 87.54 ± 0.10 | 87.26 ± 0.08 | 87.42 ± 0.08 | 87.56 ± 0.60 | 0.83
5x250 | 10% | 87.01 ± 0.17 | 86.84 ± 0.09 | 86.93 ± 0.15 | 82.90 ± 2.00 | <0.05
3x100 | 87.42 ± 0.12 | 87.25 ± 0.10 | 87.11 ± 0.14 | 87.24 ± 0.37 | <0.05
2x50 | 87.65 ± 0.11 | 87.33 ± 0.09 | 87.47 ± 0.10 | 87.53 ± 0.49 | <0.05
Table 4: Model unlearning performance for 100 random error scenarios with
three different model sizes and 5 different error percentages. Best performing
model by mean value (excluding. retraining) in bold. Baseline model trained on
data with errors, retain model trained on data excluding the errors, fine-tune
accuracy for a fine-tuned model starting from the baseline model, and
unlearned model based on the baseline model with ASSD. *Statistical
significance test for Baseline and Unlearning accuracy

##  7 Conclusion

We present a novel parameter selection method for SSD to allow for parameter-
free unlearning in practice. Our method uses insights on information
memorization in overparameterized neural networks to automatically unlearn
undesired information while preserving model performance on the remaining
data. We evaluate ASSD against SSD on its original benchmarks and show that
ASSD achieves similar performance with increased reliability and no need to
choose parameters. This enables practitioners to use unlearning without
requiring expert knowledge. We then apply ASSD to error unlearning scenarios,
experimentally demonstrating the viability of our method to remove the
influence of wrongfully labelled data from an already trained model to
increase model performance on future data.

## References

  * Agarap (2018) Abien Fred Agarap.  Deep learning using rectified linear units (relu).  _arXiv preprint arXiv:1803.08375_ , 2018.
  * Akiba et al. (2019) Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama.  Optuna: A next-generation hyperparameter optimization framework.  In _Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining_, pp. 2623–2631, 2019.
  * Amari (1993) Shun-ichi Amari.  Backpropagation and stochastic gradient descent method.  _Neurocomputing_ , 5(4-5):185–196, 1993.
  * Burak (2020) Burak.  Pinterest face recognition dataset.  www.kaggle.com/datasets/hereisburak/pins-face-recognition, 2020.
  * Cao & Yang (2015) Yinzhi Cao and Junfeng Yang.  Towards making systems forget with machine unlearning.  In _2015 IEEE symposium on security and privacy_ , pp. 463–480. IEEE, 2015.
  * Chundawat et al. (2023) Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli.  Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 37, pp. 7210–7217, 2023.
  * Constante et al. (2019) Fabian Constante, Fernando Silvia, and Antonio Pereira.  Dataco smart supply chain for big data analysis, 2019.
  * Dosovitskiy et al. (2020) Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al.  An image is worth 16x16 words: Transformers for image recognition at scale.  _arXiv preprint arXiv:2010.11929_ , 2020.
  * Feldman (2019) Vitaly Feldman.  Does learning require memorization? A short tale about a long tail.  _arXiv preprint arXiv:1906.05271_ , 2019.
  * Foster et al. (2023) Jack Foster, Stefan Schoepf, and Alexandra Brintrup.  Fast machine unlearning without retraining through selective synaptic dampening.  _arXiv preprint arXiv:2308.07707_ , 2023.
  * Foster et al. (2024) Jack Foster, Kyle Fogarty, Stefan Schoepf, Cengiz Öztireli, and Alexandra Brintrup.  Zero-shot machine unlearning at scale via lipschitz regularization.  _arXiv preprint arXiv:2402.01401_ , 2024.
  * Golatkar et al. (2020) Aditya Golatkar, Alessandro Achille, and Stefano Soatto.  Eternal sunshine of the spotless net: Selective forgetting in deep networks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 9304–9312, 2020.
  * Hartvigsen et al. (2023) Thomas Hartvigsen, Swami Sankaranarayanan, Hamid Palangi, Yoon Kim, and Marzyeh Ghassemi.  Aging with grace: Lifelong model editing with discrete key-value adaptors.  _arXiv preprint arXiv:2211.11031_ , 2023.
  * He et al. (2016) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 770–778, 2016.
  * Ioffe & Szegedy (2015) Sergey Ioffe and Christian Szegedy.  Batch normalization: Accelerating deep network training by reducing internal covariate shift.  In _International conference on machine learning_ , pp. 448–456. pmlr, 2015.
  * Kodge et al. (2023) Sangamesh Kodge, Gobinda Saha, and Kaushik Roy.  Deep unlearning: Fast and efficient training-free approach to controlled forgetting.  _arXiv preprint arXiv:2312.00761_ , 2023.
  * Krizhevsky & Hinton (2010) Alex Krizhevsky and Geoff Hinton.  Convolutional deep belief networks on cifar-10.  _Unpublished manuscript_ , 40(7):1–9, 2010.
  * Kurmanji et al. (2023a) Meghdad Kurmanji, Eleni Triantafillou, and Peter Triantafillou.  Machine unlearning in learned databases: An experimental analysis.  _arXiv preprint arXiv:2311.17276_ , 2023a.
  * Kurmanji et al. (2023b) Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou.  Towards unbounded machine unlearning.  _arXiv preprint arXiv:2302.09880_ , 2023b.
  * Northcutt et al. (2021) Curtis G. Northcutt, Anish Athalye, and Jonas Mueller.  Pervasive label errors in test sets destabilize machine learning benchmarks.  _arXiv preprint arXiv:2103.14749_ , 2021.
  * Santurkar et al. (2021) Shibani Santurkar, Dimitris Tsipras, Mahalaxmi Elango, David Bau, Antonio Torralba, and Aleksander Madry.  Editing a classifier by rewriting its prediction rules.  _arXiv preprint arXiv:2112.01008_ , 2021.
  * Tanno et al. (2022) Ryutaro Tanno, Melanie F Pradier, Aditya Nori, and Yingzhen Li.  Repairing neural networks by leaving the right past behind.  _Advances in Neural Information Processing Systems_ , 35:13132–13145, 2022.
  * Tarun et al. (2023) Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli.  Fast yet effective machine unlearning.  _IEEE Transactions on Neural Networks and Learning Systems_ , 2023.
  * Wang et al. (2022) Zijie J. Wang, Alex Kale, Harsha Nori, Peter Stella, Mark E. Nunnally, Duen Horng Chau, Mihaela Vorvoreanu, Jennifer Wortman Vaughan, and Rich Caruana.  Interpretability, then what? editing machine learning models to reflect human knowledge and values.  In _Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining_ , KDD ’22. ACM, August 2022.  doi: 10.1145/3534678.3539074.