Equation gallery

Towards Making Systems Forget with Machine Unlearning 2015 · IEEE Symposium on Security and Privacy (S&P) 2015

\text{No numbered equations }\text{ in the sections read}; \text{ the core construct is the summation form of Figure }1, \text{ where the learning algorithm depends only on }a \text{ small number of sums of transformed samples }g_{i}(x). No numbered equations in the sections read; the core construct is the summation form of Figure 1, where the learning algorithm depends only on a small number of sums of transformed samples g_i(x).
Two evaluation metrics introduced
COMPLETENESS (how completely data is forgotten) and TIMELINESS (how quickly).

Making AI Forget You: Data Deletion in Machine Learning 2019 · NeurIPS 2019

Def 3.1 (Data Deletion Operation)
A(D_{-i}) =_{d} R_{A}(D, A(D), i) A(D_{-i}) =_d R_A(D, A(D), i)EQUALITY IN DISTRIBUTION, i.e. EXACT deletion
Remark 3.1
\Omega(n/m) \text{ asymptotic lower bound on amortised computation time for any sequential learning algorithm}, \text{ given }n \text{ datapoints and }m \text{ deletion requests} Omega(n/m) asymptotic lower bound on amortised computation time for any sequential learning algorithm, given n datapoints and m deletion requests

Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks 2020 · CVPR 2020

Def 1
\operatorname{KL}( P(f(S(w))|D) \| P(f(S_{0}(w))|D_{r}) ) = 0, \text{ with }S_{0} \text{ not depending on }D_{f} KL( P(f(S(w))|D) || P(f(S_0(w))|D_r) ) = 0, with S_0 not depending on D_f
Eq 4 (Forgetting Lagrangian)
L = E_{S(w)}[L_{D_{r}}(w)] + \lambda \operatorname{KL}( P(S(w)|D) \| P(S_{0}(w)|D_{r}) ) L = E_{S(w)}[L_{D_r}(w)] + lambda KL( P(S(w)|D) || P(S_0(w)|D_r) )
Prop 3
h(w) = w + e^{-\text{Bt}}e^{\text{At}}d + e^{-\text{Bt}}(d - d_{r}) - d_{r}; \text{ as }t \to \inf \text{ reduces to the Newton update }S(w) = w - B^{-1} \nabla L_{D_{r}}(w) h(w) = w + e^{-Bt}e^{At}d + e^{-Bt}(d - d_r) - d_r; as t -> inf reduces to the Newton update S(w) = w - B^{-1} grad L_{D_r}(w)
Eq 8 (Levenberg-Marquardt / FIM)
\nabla^{2} L_{D}(w) \approx E[ \nabla_{w} \log p_{w}(y|x) \nabla_{w} \log p_{w}(y|x)^{T} ] grad^2 L_D(w) ~= E[ grad_w log p_w(y|x) grad_w log p_w(y|x)^T ]
IMPLEMENTED (S4)
h(w) = w, \text{ so }S(w) = w + (\lambda \sigma_{h}^{2})^{1/4} F^{-1/4} [n] h(w) = w, so S(w) = w + (lambda sigma_h^2)^{1/4} F^{-1/4} [n]noise addition with FIM-shaped covariance and NO Newton step

Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observations 2020 · ECCV 2020

Eq 9
\text{NTK matrix }\Theta_{0} = \nabla f(D) \nabla f(D)^{T} \text{ of size }c|D| x c|D|, c = \text{ number of classes} NTK matrix Theta_0 = grad f(D) grad f(D)^T of size c|D| x c|D|, c = number of classes
Eq 10 (Prop 2)
h_{\text{NTK}}(w) = w + P \nabla f_{0}(D_{f})^{T} M V, \text{ with }P a \text{ projection onto the orthogonal complement of the retain gradients}, M = [\Theta_{\text{ff}} - \Theta_{\text{rf}}^{T} \Theta_{\text{rr}}^{-1} \Theta_{\text{rf}}]^{-1}, V a \text{ residual re}-\text{weighting} h_NTK(w) = w + P grad f_0(D_f)^T M V, with P a projection onto the orthogonal complement of the retain gradients, M = [Theta_ff - Theta_rf^T Theta_rr^{-1} Theta_rf]^{-1}, V a residual re-weighting
Eq 11
S_{\text{NTK}}(w) = h_{\text{NTK}}(w) + n, n \sim N(0, \lambda F^{-1}), F \text{ the FIM at }h_{\text{NTK}}(w) \text{ using }D_{r} S_NTK(w) = h_NTK(w) + n, n ~ N(0, lambda F^{-1}), F the FIM at h_NTK(w) using D_r
Eq 12
\text{Newton}-\text{update shift }h(w) = w - H(D_{r})^{-1} \nabla L_{D_{r}}(w), \text{ the Fisher}-\text{paper procedure} Newton-update shift h(w) = w - H(D_r)^{-1} grad L_{D_r}(w), the Fisher-paper procedure

Certified Data Removal from Machine Learning Models 2020 · ICML 2020

(eps,delta)-CR
P(M(A(D),D,x) \in T) \le e^{\varepsilon} P(A(D \setminus x) \in T) + \delta, \text{ and symmetrically} P(M(A(D),D,x) in T) <= e^eps P(A(D \ x) in T) + delta, and symmetrically
Eq 3 (Newton update)
w^{-} = w^{*} + H_{w^{*}}^{-1} \Delta, \text{ with }\Delta = \lambda w^{*} + \nabla l((w^{*})^{T} x_{n}, y_{n}); H^{-1}\Delta \text{ is the influence function} w^- = w* + H_{w*}^{-1} Delta, with Delta = lambda w* + grad l((w*)^T x_n, y_n); H^{-1}Delta is the influence function
Thm 1
\| \nabla L(w^{-}; D')\| \le \gamma(n-1) \| H^{-1}\Delta\|^{2} \le 4 \gamma C^{2} / (\lambda^{2} (n-1)) ||grad L(w^-; D')|| <= gamma(n-1) ||H^{-1}Delta||^2 <= 4 gamma C^2 / (lambda^2 (n-1))
Loss perturbation
L_{b}(w;D) = \sum l + (\lambda n/2)\| w\|^{2} + b^{T} w L_b(w;D) = sum l + (lambda n/2)||w||^2 + b^T w
Thm 3
b \sim \exp(-(\varepsilon/\varepsilon')\| b\|) \text{ gives }\varepsilon-\text{CR}; b \sim N(0, c \varepsilon'/\varepsilon)^{d} \text{ gives }(\varepsilon,\delta)-\text{CR with }\delta = 1.5 e^{-c^{2}/2} b ~ exp(-(eps/eps')||b||) gives eps-CR; b ~ N(0, c eps'/eps)^d gives (eps,delta)-CR with delta = 1.5 e^{-c^2/2}
Thm 4 (batch)
\text{bound }\le 4 \gamma m^{2} C^{2} / (\lambda^{2} (n-m)) bound <= 4 gamma m^2 C^2 / (lambda^2 (n-m))QUADRATIC in batch size m

Machine Unlearning 2021 · IEEE Symposium on Security and Privacy (S&P) 2021

Def III.1
\text{mechanism }M \text{ facilitates unlearning when the distribution of models learned on }D' \text{ then unlearning }d_{u} \text{ is IDENTICAL to the distribution of models learned on }D. A \text{ statement about distributions}, \text{ not parameters}. mechanism M facilitates unlearning when the distribution of models learned on D' then unlearning d_u is IDENTICAL to the distribution of models learned on D. A statement about distributions, not parameters.
Eq 1
e'D = \sum_{i=1\dots R} e_{i} (\text{iD}/R) \implies e = (2R/(R+1)) e' e'D = sum_{i=1..R} e_i (iD/R) ==> e = (2R/(R+1)) e'the epoch accounting that makes the sliced/unsliced comparison fair
Best-case speed-up
((R+1)S)/2 x \text{ in retraining time}, \text{ for }a \text{ single unlearning request} ((R+1)S)/2 x in retraining time, for a single unlearning request

When Machine Unlearning Jeopardizes Privacy 2021 · ACM Conference on Computer and Communications Security (CCS) 2021

Three-phase pipeline
\text{posteriors generation }(\text{query }M_{o} \text{ and }M_{u} \text{ for }P_{o}, P_{u}), \text{ feature construction }(e.g. \text{ concatenation }P_{o} \| P_{u}), \text{ inference }(\text{binary classifier }M_{A}) posteriors generation (query M_o and M_u for P_o, P_u), feature construction (e.g. concatenation P_o || P_u), inference (binary classifier M_A)
\text{Target case is }<\in, \text{ out}>: \text{ in the original}'s \text{ training set}, \text{ out of the unlearned model}'s. \text{ Other cases }<\text{out},\text{out}>, <\in,\in>, <\text{out},\in> \text{ are negatives or handled by classical MIA}. Target case is <in, out>: in the original's training set, out of the unlearned model's. Other cases <out,out>, <in,in>, <out,in> are negatives or handled by classical MIA.

Amnesiac Machine Learning 2021 · AAAI 2021

\theta_{M} = \theta_{\text{initial}} + \sum_{e=1\dots E} \sum_{b=1\dots B} \delta \theta_{e,b} theta_M = theta_initial + sum_{e=1..E} sum_{b=1..B} delta theta_{e,b}
\theta_{M}' = \theta_{M} - \sum_{\text{sb}=1\dots \text{SB}} \delta \theta_{e,\text{sb}} theta_M' = theta_M - sum_{sb=1..SB} delta theta_{e,sb}subtract updates from batches containing sensitive data

Approximate Data Deletion from Machine Learning Models 2021 · AISTATS 2021

Eq 2 (influence method)
\theta_{\inf} = \theta_{\text{full}} - [\nabla^{2} L_{\text{full}}(\theta_{\text{full}})]^{-1} \nabla L_{\setminus k}(\theta_{\text{full}}) theta_inf = theta_full - [grad^2 L_full(theta_full)]^{-1} grad L_{\k}(theta_full)
Hat matrix
H = X(X^{T} X + \lambda I)^{-1} X^{T} H = X(X^T X + lambda I)^{-1} X^T
Thm 1
\text{PRU computes }\theta_{\text{res}} = \theta_{\text{full}} + \text{ proj}_{\text{span}(x_{1}\dots x_{k})}(\theta_{\setminus k} - \theta_{\text{full}}) \in O(k^{2} d) PRU computes theta_res = theta_full + proj_{span(x_1..x_k)}(theta_{\k} - theta_full) in O(k^2 d)
Cor 3 (optimality)
\text{for any gradient}-\text{based update using only the deleted points}, \| \theta_{\setminus k} - \theta_{\text{res}}\| \le \| \theta_{\setminus k} - \theta_{\text{approx}}\| for any gradient-based update using only the deleted points, ||theta_{\k} - theta_res|| <= ||theta_{\k} - theta_approx||
Thm 5 (outliers)
\text{with }D_{\text{full}} = \{(\lambda x_{1}, \lambda y_{1})\} \cup D_{\setminus1}, \theta_{\inf} \to \theta_{\text{full}} \text{ as }\lambda \to \infty with D_full = {(lambda x_1, lambda y_1)} union D_{\1}, theta_inf -> theta_full as lambda -> infinity

Descent-to-Delete: Gradient-Based Methods for Machine Unlearning 2021 · Algorithmic Learning Theory (ALT) 2021

Def 2.1 (Update)
u = (z, \text{ bullet}), \text{ bullet }\in \{\text{add}, \text{ delete}\}; D o u \text{ adds or removes }z u = (z, bullet), bullet in {add, delete}; D o u adds or removes z
Def 2.4 ((eps,delta)-unlearning)
f_{\text{publish}}(R_{A}(D_{i-1}, u_{i}, \theta_{i})) \approx_{\varepsilon,\delta} f_{\text{publish}}(A(D_{i})); \text{ PERFECT unlearning if this holds chaining from the PUBLISHED model rather than the secret one} f_publish(R_A(D_{i-1}, u_i, theta_i)) ~=_{eps,delta} f_publish(A(D_i)); PERFECT unlearning if this holds chaining from the PUBLISHED model rather than the secret one
Def 2.8 (strong vs weak)
\text{strong requires }\alpha, \beta \text{ independent of update}-\text{sequence length AND }C_{i}/C_{1} = O(\log i); \text{ weak allows }C_{i}/C_{1} = \Omega(\operatorname{poly}(i)) strong requires alpha, beta independent of update-sequence length AND C_i/C_1 = O(log i); weak allows C_i/C_1 = Omega(poly(i))
Lemma 2.12 (sensitivity)
\text{for }L-\text{Lipschitz }m-\text{strongly convex }f_{z}, \| \theta^{*}_{D} - \theta^{*}_{D o u}\| \le 2L/(\text{mn}) for L-Lipschitz m-strongly convex f_z, ||theta*_D - theta*_{D o u}|| <= 2L/(mn)
Thm 2.13
\text{after }T \text{ GD steps with }\eta = 2/(m+M), \| \theta_{T} - \theta^{*}\| \le ((M-m)/(M+m))^{T} \| \theta_{0} - \theta^{*}\| after T GD steps with eta = 2/(m+M), ||theta_T - theta*|| <= ((M-m)/(M+m))^T ||theta_0 - theta*||

Remember What You Want to Forget: Algorithms for Machine Unlearning 2021 · NeurIPS 2021

Def 2 ((eps,delta)-unlearning)
\operatorname{Pr}(\bar{A}(U, A(S), T(S)) \in W) \le e^{\varepsilon} \operatorname{Pr}(\bar{A}(\emptyset, A(S\setminus U), T(S\setminus U)) \in W) + \delta, \text{ and symmetrically} Pr(Abar(U, A(S), T(S)) in W) <= e^eps Pr(Abar(empty, A(S\U), T(S\U)) in W) + delta, and symmetrically
Def 3 (deletion capacity)
m = \max\{ m | E[\max_{|U|\le m} F(\bar{A}(U,A(S),T(S))) - F^{*}] \le 0.01 \} m = max{ m | E[max_{|U|<=m} F(Abar(U,A(S),T(S))) - F*] <= 0.01 }
Thm 1
\text{there is }a 4-\text{Lipschitz }1-\text{strongly convex loss where deletion capacity }\le \text{ cn with }c < 1, \text{ even for an unlearner with access to }S \setminus U there is a 4-Lipschitz 1-strongly convex loss where deletion capacity <= cn with c < 1, even for an unlearner with access to S \ U
Lemma 1 (via DP)
m \ge \Omega\sim( n \varepsilon / \sqrt{d \log(e^{\varepsilon}/\delta)} ) m >= Omega~( n eps / sqrt(d log(e^eps/delta)) )
Thm 2
m \ge c n \sqrt{\varepsilon} / (d \log(1/\delta))^{1/4}, \text{ running time }O(d^{\omega}), \text{ space }|T(S)| = O(d^{2}) m >= c n sqrt(eps) / (d log(1/delta))^{1/4}, running time O(d^omega), space |T(S)| = O(d^2)
Alg 1
\hat{H} = (1/(n-m))(n \nabla^{2} \hat{F}(\hat{w}) - \sum_{z \in U} \nabla^{2} f(\hat{w},z)); \bar{w} = \hat{w} + (1/(n-m)) \hat{H}^{-1} \sum_{z \in U} \nabla f(\hat{w},z); \text{ return }\bar{w} + \text{ noise} Hhat = (1/(n-m))(n grad^2 Fhat(what) - sum_{z in U} grad^2 f(what,z)); wbar = what + (1/(n-m)) Hhat^{-1} sum_{z in U} grad f(what,z); return wbar + noise

Membership Inference Attacks From First Principles 2022 · IEEE Symposium on Security and Privacy (S&P) 2022

Def 1
the membership inference security game between challenger and adversary
Def 2 (balanced attack accuracy)
\operatorname{Pr}_{x,y,f,b}[A(x,y) = b] Pr_{x,y,f,b}[A(x,y) = b]the metric they argue is inadequate
LOSS attack (Yeom et al.)
A_{\text{loss}}(x,y) = 1[-l(f(x),y) > \tau] A_loss(x,y) = 1[-l(f(x),y) > tau]

Towards Adversarial Evaluations for Inexact Machine Unlearning 2022 · arXiv preprint (listed as Tech Report; no journal-ref, no dblp venue entry found)

EU-k
\text{retrain the last }k \text{ layers of }M \text{ FROM SCRATCH using training procedure }T \text{ on }S \setminus S_{f}, \text{ freezing prior layers} retrain the last k layers of M FROM SCRATCH using training procedure T on S \ S_f, freezing prior layers
CF-k
\text{finetune the last }k \text{ layers of }M \text{ on }S \setminus S_{f} \text{ using }T, \text{ freezing prior layers}, \text{ no re}-\text{initialisation} finetune the last k layers of M on S \ S_f using T, freezing prior layers, no re-initialisationhence far fewer epochs
Thm 1
\text{exist two }l-\text{layer linear NNs simultaneously close }\text{ in weights }(\| W1-W2\|_{F} \le \varepsilon), \text{ close }\text{ in test error }(+\alpha), \text{ far }\text{ in robustness }(R_{\text{adv}}(f_{W}1) \ge R_{\text{adv}}(f_{W}2) + 1 - 2\alpha) \text{ and far }\text{ in fairness} exist two l-layer linear NNs simultaneously close in weights (||W1-W2||_F <= eps), close in test error (+alpha), far in robustness (R_adv(f_W1) >= R_adv(f_W2) + 1 - 2alpha) and far in fairness
Error vs Targeted Error
Error counts any misclassification; Targeted Error counts only misclassification INTO the targeted class

On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning 2022 · USENIX Security Symposium 2022, pp. 4007-4022

Lemma 1
D \text{ and }D' \text{ forgeable with }\varepsilon = 0 \text{ implies }H_{D}(w) = H_{D'}(w) D and D' forgeable with eps = 0 implies H_D(w) = H_{D'}(w)
Lemma 2
\varepsilon = 0 \text{ forgeability is an equivalence relation} eps = 0 forgeability is an equivalence relation
Thm 1
D \text{ and }D' \text{ are }\varepsilon = 0 \text{ forgeable IFF }H_{D}(W) = H_{D'}(W) D and D' are eps = 0 forgeable IFF H_D(W) = H_{D'}(W)
Thm 2 (probabilistic forging, minibatch SGD)
D' \text{ forges }D \text{ with probability at least }((1 - s2\max/(b \varepsilon^{2}))(1 - (s2\max/(b \varepsilon^{2}))^{n}))^{m \alpha} D' forges D with probability at least ((1 - s2max/(b eps^2))(1 - (s2max/(b eps^2))^n))^{m alpha}
Cor 1
\text{as minibatch size }b \to \infty, \text{ forgeable for all }\varepsilon > 0 \text{ with probability }\to 1 as minibatch size b -> infinity, forgeable for all eps > 0 with probability -> 1
Cor 2 (MAIN RESULT)
unlearning on minibatch SGD is NOT WELL-DEFINED over the logs, and thus the models, of finite datasets from any distribution

Unrolling SGD: Understanding Factors Influencing Machine Unlearning 2022 · IEEE European Symposium on Security and Privacy (EuroS&P) 2022, pp. 303-319

Mini-batch SGD
w_{t+1} = w_{t} - \eta \cdot \text{ dL}/\text{dw }|_{w_{t}, \hat{x}_{t}} w_{t+1} = w_t - eta * dL/dw |_{w_t, xhat_t}
Eq 1
\text{cross}-\text{entropy loss }L_{\text{CE}}(M(x), y) = - \sum_{i} y_{i} \log(M(x)_{i}) cross-entropy loss L_CE(M(x), y) = - sum_i y_i log(M(x)_i)

Can Bad Teaching Induce Forgetting? Unlearning in Deep Networks Using an Incompetent Teacher 2023 · AAAI 2023

Eq 1
\operatorname{KL}(T_{d}(x) \| S(x)) = \sum_{i} t_{d}^{(}i) \log(t_{d}^{(}i)/s^{(}i)) KL(T_d(x) || S(x)) = sum_i t_d^(i) log(t_d^(i)/s^(i))incompetent teacher
Eq 2
\operatorname{KL}(T_{s}(x) \| S(x)) = \sum_{i} t_{s}^{(}i) \log(t_{s}^{(}i)/s^{(}i)) KL(T_s(x) || S(x)) = sum_i t_s^(i) log(t_s^(i)/s^(i))competent teacher
Eq 3 (objective)
L(x, l_{u}) = (1 - l_{u}) \cdot \operatorname{KL}(T_{s}(x)\| S(x)) + l_{u} \cdot (\operatorname{KL}(T_{d}(x)\| S(x))), \text{ with }l_{u} \text{ the unlearning label}: 1 \text{ for forget}, 0 \text{ for retain} L(x, l_u) = (1 - l_u) * KL(T_s(x)||S(x)) + l_u * (KL(T_d(x)||S(x))), with l_u the unlearning label: 1 for forget, 0 for retain
Eq 4
\text{JS}(M(x), T_{d}(x)) = 0.5 \operatorname{KL}(M(x)\| m) + 0.5 \operatorname{KL}(T_{d}(x)\| m), m = (M(x)+T_{d}(x))/2 JS(M(x), T_d(x)) = 0.5 KL(M(x)||m) + 0.5 KL(T_d(x)||m), m = (M(x)+T_d(x))/2
Eq 5 (ZRF)
\text{ZRF }= 1 - (1/n_{f}) \sum_{i} \text{ JS}(M(x_{i}), T_{d}(x_{i})) \text{ over the forget set}; \in [0,1] ZRF = 1 - (1/n_f) sum_i JS(M(x_i), T_d(x_i)) over the forget set; in [0,1]

Model Sparsity Can Simplify Machine Unlearning 2023 · NeurIPS 2023

Prop 2
e(m) = O(\eta^{2} t \| m . (\theta_{t} - \theta_{0})\|_{2} \sigma(m)), \sigma(m) \text{ the largest Hessian singular value among unmasked dimensions}; \text{ error shrinks as sparsity grows} e(m) = O(eta^2 t ||m . (theta_t - theta_0)||_2 sigma(m)), sigma(m) the largest Hessian singular value among unmasked dimensions; error shrinks as sparsity grows
Eq 3 (l1-sparse MU)
\theta_{u} = \operatorname*{arg\,min}_{\theta} L_{u}(\theta; \theta_{o}, D_{r}) + \gamma \| \theta\|_{1}, \text{ with }L_{u} \text{ the FINE}-\text{TUNING objective} theta_u = argmin_theta L_u(theta; theta_o, D_r) + gamma ||theta||_1, with L_u the FINE-TUNING objective

Towards Unbounded Machine Unlearning 2023 · Advances in Neural Information Processing Systems 36 (NeurIPS 2023), Main Conference Track

Eq. 1
\min_{\text{wu}} -(1/N_{f}) \cdot \sum_{x_{f} \in D_{f}} d(x_{f}; w^{u}) min_wu -(1/N_f) * sum_{x_f in D_f} d(x_f; w^u)pure max-step; degrades retain performance
Eq. 2
\min_{\text{wu}} (1/N_{r}) \sum_{x_{r} \in D_{r}} d(x_{r};w^{u}) - (1/N_{f}) \sum_{x_{f} \in D_{f}} d(x_{f};w^{u}) min_wu (1/N_r) sum_{x_r in D_r} d(x_r;w^u) - (1/N_f) sum_{x_f in D_f} d(x_f;w^u)contrastive
Eq. 3
\min_{\text{wu}} (\alpha/N_{r}) \sum d(x_{r};w^{u}) + (\gamma/N_{r}) \sum l(f(x_{r};w^{u}), y_{r}) - (1/N_{f}) \sum d(x_{f};w^{u}) min_wu (alpha/N_r) sum d(x_r;w^u) + (gamma/N_r) sum l(f(x_r;w^u), y_r) - (1/N_f) sum d(x_f;w^u)final objective
d(x; w^{u}) = \operatorname{KL}( p(f(x; w^{o})) \| p(f(x; w^{u})) ) d(x; w^u) = KL( p(f(x; w^o)) || p(f(x; w^u)) )teacher weights w^o frozen
Eq. 5
\operatorname{Err}(D) = 1 - (1/|D|) \sum 1[\operatorname*{arg\,max} f(x_{i};w) = y_{i}] Err(D) = 1 - (1/|D|) sum 1[argmax f(x_i;w) == y_i]

SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation 2024 · ICLR 2024

Eq 3 (saliency map)
m_{S} = 1( |\nabla_{\theta} l_{f}(\theta; D_{f})|_{\theta=\theta_{o}}| \ge \gamma ), \text{ element}-\text{wise indicator}, \text{ hard threshold }\gamma m_S = 1( |grad_theta l_f(theta; D_f)|_{theta=theta_o}| >= gamma ), element-wise indicator, hard threshold gamma
Eq 4 (masked update)
\theta_{u} = m_{S} . (\delta \theta + \theta_{o}) + (1 - m_{S}) . \theta_{o}, \text{ element}-\text{wise product}; \text{ non}-\text{salient weights frozen at original values} theta_u = m_S . (delta theta + theta_o) + (1 - m_S) . theta_o, element-wise product; non-salient weights frozen at original values
Eq 5 (forgetting loss, classification)
l_{f}(\theta; D_{f}) = E_{(x,y)\sim D_{f}}[l_{\text{CE}}(\theta; x, y)] l_f(theta; D_f) = E_{(x,y)~D_f}[l_CE(theta; x, y)]the gradient-ascent loss attributed to Thudi 2022a
Eq 6 (SalUn classification objective, IN SCOPE)
\min_{\delta \theta} E_{(x,y)\sim D_{f}, y'\ne y}[l_{\text{CE}}(\theta_{u}; x, y')] + \alpha E_{(x,y)\sim D_{r}}[l_{\text{CE}}(\theta_{u}; x, y)] min_{delta theta} E_{(x,y)~D_f, y'!=y}[l_CE(theta_u; x, y')] + alpha E_{(x,y)~D_r}[l_CE(theta_u; x, y)]
\text{Eq }7 (\text{SalUn for image generation}) Eq 7 (SalUn for image generation)OUT OF SCOPE, recorded only so the spec does not implement it

Fast Machine Unlearning without Retraining through Selective Synaptic Dampening 2024 · AAAI 2024

Eq 1 (FIM)
[]_{D} = E[-d^{2} \ln p(D|\theta)/\text{dtheta}^{2}] = E[(d \ln p(D|\theta)/\text{dtheta})(\dots.)^{T}] []_D = E[-d^2 ln p(D|theta)/dtheta^2] = E[(d ln p(D|theta)/dtheta)(...)^T]
Eq 2 (naive pruning, rejected)
\text{zero every parameter with non}-\text{zero forget}-\text{set importance} zero every parameter with non-zero forget-set importance
Eq 3 (stricter selection, still binary)
\theta_{i} = 0 \text{ if }[]_{D_{f},i} > \alpha []_{D_{r},i} theta_i = 0 if []_{D_f,i} > alpha []_{D_r,i}
Eq 4 (THE METHOD)
\beta_{i} = \min(\lambda []_{D,i} / []_{D_{f},i}, 1); \theta_{i} = \beta_{i} \theta_{i} \text{ if }[]_{D_{f},i} > \alpha []_{D,i}, \text{ else unchanged} beta_i = min(lambda []_{D,i} / []_{D_f,i}, 1); theta_i = beta_i theta_i if []_{D_f,i} > alpha []_{D,i}, else unchanged

Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy 2024 · arXiv preprint (no journal-ref as of verification)

Def 3.1
the membership inference game adapted to unlearning; the adversary is given the unlearning algorithm U, not merely the model
Eq 1 (LiRA)
P(\theta | Q_{1}) / P(\theta | Q_{0}), Q_{1} \text{ and }Q_{0} \text{ the worlds where }z \text{ was and was not }\text{ in training}; \text{ uniformly most powerful by Neyman}-\text{Pearson} P(theta | Q_1) / P(theta | Q_0), Q_1 and Q_0 the worlds where z was and was not in training; uniformly most powerful by Neyman-Pearson
Eq 3
\text{tractable form}, \text{ Gaussians fit to logit}-\text{rescaled shadow output distributions}, \phi(w) = \log(w/(1-w)) tractable form, Gaussians fit to logit-rescaled shadow output distributions, phi(w) = log(w/(1-w))

Fast Yet Effective Machine Unlearning 2024 · IEEE Transactions on Neural Networks and Learning Systems (TNNLS)

Eq 1
\text{arg }\min_{N} E_{\theta}[ -L(f, y) + \lambda \| w_{\text{noise}}\| ], \text{ with }L \text{ the classification loss for the class to unlearn}; \text{ cross}-\text{entropy with }L2 \text{ normalisation}; \text{ model weights FROZEN during noise generation}; N \text{ same size as model input}, \text{ initialised }N(0,1) arg min_N E_theta[ -L(f, y) + lambda ||w_noise|| ], with L the classification loss for the class to unlearn; cross-entropy with L2 normalisation; model weights FROZEN during noise generation; N same size as model input, initialised N(0,1)
Impair
1 \text{ epoch on }D_{\text{r\_sub}} \cup N \text{ at high learning rate}. \text{ Repair}: 1 \text{ epoch on }D_{\text{r\_sub}} \text{ only}. 1 epoch on D_r_sub union N at high learning rate. Repair: 1 epoch on D_r_sub only.

Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition 2024 · arXiv preprint (no journal-ref as of verification)

Eq 1
\varepsilon_{\text{hat}} = \max\{ \log((1 - \delta - \text{ FPR})/\text{FNR}), \log((1 - \delta - \text{ FNR})/\text{FPR}) \} eps_hat = max{ log((1 - delta - FPR)/FNR), log((1 - delta - FNR)/FPR) }
Eq 2
\text{Final score }= F \cdot [\text{Acc}(D\setminus S, \theta_{u})/\text{Acc}(D\setminus S, \theta_{r})] \cdot [\text{Acc}(D_{\text{test}}, \theta_{u})/\text{Acc}(D_{\text{test}}, \theta_{r})] Final score = F * [Acc(D\S, theta_u)/Acc(D\S, theta_r)] * [Acc(D_test, theta_u)/Acc(D_test, theta_r)]
F = (1/|S|) \sum_{s} H(\varepsilon^{s}), H(\varepsilon) = 2 / 2^{n(\varepsilon)}, n(\varepsilon) = \text{ floor}(\varepsilon / \text{ bin}-\text{width}), \text{ bin}-\text{width }= 0.5 F = (1/|S|) sum_s H(eps^s), H(eps) = 2 / 2^{n(eps)}, n(eps) = floor(eps / bin-width), bin-width = 0.5
Per-example scalar is h(f(s; theta)) with h the logit-scaling of the correct-class probability Carlini's phi(w) = log(w/(1-w))

When to Forget? Complexity Trade-offs in Machine Unlearning 2025 · Proceedings of the 42nd International Conference on Machine Learning (ICML 2025), PMLR 267:60816-60832

Def 2 ((eps,delta)-Unlearning)
P[U(D_{r},D_{f}) \in S] \le e^{\varepsilon} P[U(D_{r},D_{f}') \in S] + \delta P[U(D_r,D_f) in S] <= e^eps P[U(D_r,D_f') in S] + deltareference-free, DP-like but protecting only the forget set
\kappa_{\varepsilon,\delta} := \varepsilon^{-1} \sqrt{2 \ln(1.25/\delta)}; e_{0} := L^{2}/(8 \mu); r_{f} = \text{ forget ratio} kappa_{eps,delta} := eps^{-1} sqrt(2 ln(1.25/delta)); e_0 := L^2/(8 mu); r_f = forget ratio
Thm 1 (Trivial)
e \in [r_{f}/(1-r_{f})(r_{f}/(1-r_{f}) + \sqrt{d} \kappa) e_{0}, e_{0}) \Rightarrow T^{U}/T^{S} = 0 e in [r_f/(1-r_f)(r_f/(1-r_f) + sqrt(d) kappa) e_0, e_0) => T^U/T^S = 0
Thm 2 (Inefficient)
e < \min\{1, c (r_{f}/(1-r_{f}))^{2} (1+\kappa^{2})\} e_{0} \Rightarrow T^{U}/T^{S} = \Omega(1) e < min{1, c (r_f/(1-r_f))^2 (1+kappa^2)} e_0 => T^U/T^S = Omega(1)
Thm 3 (Noise and Fine-Tune)
T^{U}/T^{S} = O((r_{f}/(1-r_{f}))^{2} (1 + d \kappa^{2}) e_{0}/e) T^U/T^S = O((r_f/(1-r_f))^2 (1 + d kappa^2) e_0/e)

Machine Unlearning via Information Theoretic Regularization 2025 · arXiv preprint (no journal-ref as of verification)

Def 2.3 (eps-marginal unlearning)
\sup_{D} |\log( P(Z=0 | \hat{Y}_{\text{margin}} \in D) / P(Z=1 | \hat{Y}_{\text{margin}} \in D) )| \le \varepsilon sup_D |log( P(Z=0 | Yhat_margin in D) / P(Z=1 | Yhat_margin in D) )| <= eps
Def 2.5 (MI marginal unlearning with utility budget)
I(\hat{Y}_{\text{margin}}; Z) \le \mu \text{ and }L(f) - L^{*} \le \rho I(Yhat_margin; Z) <= mu and L(f) - L* <= rho
Lemma 2.1
\operatorname{TV}(\mu^{p^{d}}, \mu^{p^{r}}) \le \sqrt{ I(\hat{Y}_{\text{margin}};Z) / (2 \pi (1-\pi)) } TV(mu^{p^d}, mu^{p^r}) <= sqrt( I(Yhat_margin;Z) / (2 pi (1-pi)) )
Thm 2.1
\operatorname{TV}(\mu^{p^{d}}_{\Theta_{u}}, \mu^{p^{d}}_{\Theta_{r}}) \le \sqrt{1/2}(\sqrt{\delta}+\sqrt{\delta_{g}}) + \sqrt{\varepsilon_{u}/(2 \pi(1-\pi))} + \operatorname{TV}(\mu^{p^{r}}_{\Theta_{u}}, \mu^{p^{r}}_{\Theta_{r}}) TV(mu^{p^d}_{Theta_u}, mu^{p^d}_{Theta_r}) <= sqrt(1/2)(sqrt(delta)+sqrt(delta_g)) + sqrt(eps_u/(2 pi(1-pi))) + TV(mu^{p^r}_{Theta_u}, mu^{p^r}_{Theta_r})
Binary Fano (Eq 3)
H_{2}(P_{e}) \ge H_{2}(\pi) - I(\hat{Y};Z), \text{ bounding the best possible inference of }Z H_2(P_e) >= H_2(pi) - I(Yhat;Z), bounding the best possible inference of Z

Near-Optimal Pure Machine Unlearning for Smooth Strongly Convex Losses 2026 · arXiv preprint (no journal-ref as of verification)

Def 1 (approximate eps-unlearning)
\tilde{A}(U, Z) \approx_{\varepsilon,0} \tilde{A}(\emptyset, Z \setminus U). \delta = 0 \text{ makes it PURE}. Atilde(U, Z) ~=_{eps,0} Atilde(empty, Z \ U). delta = 0 makes it PURE.
Thm 1 (upper)
\alpha = O( \kappa (L^{2}/\mu) ( 1/n + (m/n)^{2} e^{-2 \varepsilon/(d+2)} ) ) alpha = O( kappa (L^2/mu) ( 1/n + (m/n)^2 e^{-2 eps/(d+2)} ) )
Thm 2 (lower, mean estimation)
\alpha = \Omega( 1/n + (m/n)^{2} e^{-2 \varepsilon/(d+2)} ) alpha = Omega( 1/n + (m/n)^2 e^{-2 eps/(d+2)} )
Cor 1 (SCO lower)
\alpha \ge \Omega( (L^{2}/\mu)( 1/n + (m/n)^{2} e^{-2 \varepsilon/(d+2)} ) ) alpha >= Omega( (L^2/mu)( 1/n + (m/n)^2 e^{-2 eps/(d+2)} ) )
Stability bound used
\| w_{Z} - w_{Z\setminus U}\| \le 2L|U|/(\mu |Z\setminus U|) \le 2\text{Lm}/(\mu(n-m)) =: r ||w_Z - w_{Z\U}|| <= 2L|U|/(mu |Z\U|) <= 2Lm/(mu(n-m)) =: r