Sharpness-Aware Machine Unlearning

Haoran Tang; Rajiv Khanna

Source-linked AI summary

Sharpness-Aware Machine Unlearning

Haoran Tang, Rajiv Khanna

arXiv:2506.13715v3Jun 16, 2025cs.LG

TL;DR

Machine unlearning must remove designated training examples without sacrificing retain and test performance, but SAM’s usual noise suppression may fail when forget samples are intentionally fitted. The paper characterizes this retain-forget trade-off, introduces Sharp MinMax, and finds that SAM-based methods improve unlearning across difficulty levels and evaluation axes.

Problem
Machine unlearning must remove specific training examples efficiently while preserving performance on retained data, yet SAM’s denoising behavior under mixed retain-forget objectives is not fully characterized.
Method
The paper analyzes SGD and SAM through signal-noise decomposition, derives retain-weighting guidelines, and proposes Sharp MinMax with separate SAM retain learning and sharpness-maximizing forget learning.
Results
SAM improves unlearning while preserving retain performance, and Sharp MinMax achieves state-of-the-art performance, especially on high-memorization forget sets.
Takeaways & Limitations
Controlled overfitting can strengthen stringent sample-specific unlearning, while SAM provides a broadly useful enhancement across unlearning methods and forget-set difficulties.
Takeaways & Limitations
The framework does not characterize behavior when retain signals are weak and may be limited by interference from overlap between retain and forget sets.

Abstract

from arXiv · show

We characterize the effectiveness of Sharpness-aware minimization (SAM) under machine unlearning scheme, where unlearning forget signals interferes with learning retain signals. While previous work prove that SAM improves generalization with noise memorization prevention, we show that SAM abandons such denoising property when fitting the forget set, leading to altered generalization depending on signal strength. We further characterize the signal surplus of SAM in the order of signal strength, which enables learning from less retain signals to maintain model performance and putting more weight on unlearning the forget set. Empirical studies show that SAM outperforms SGD with relaxed requirement for retain signals and can enhance various unlearning methods either as pretrain or unlearn algorithm. Motivated by our refined characterization of SAM unlearning and observing that overfitting can benefit more stringent sample-specific unlearning, we propose Sharp MinMax, which splits the model into two to learn retain signals with SAM and unlearn forget signals with sharpness maximization, achieving best performance. Extensive experiments show that SAM enhances unlearning across varying difficulties measured by memorization, yielding decreased feature entanglement between retain and forget sets, stronger resistance to membership inference attacks, and a flatter loss landscape. Our observations generalize to more noised data, different optimizers, and different architectures.

1 INTRODUCTION

This paper studies how SAM behaves when unlearning forget samples while preserving retain performance, showing that its usual noise suppression can fail on forget data. It derives weighting guidelines, validates SAM empirically, and proposes Sharp MinMax for stronger sample-specific unlearning.

Theoretical Findings: Controlled overfitting can improve complete removal of forget samples when stringent privacy or copyright requirements demand sample-specific unlearning.The paper argues that avoiding overfitting is not always optimal when its impact on other data is limited.
Theoretical Framework: SAM’s denoising advantage shuts off on forget data, causing it to overfit labeled forget noise almost as much as SGD.The paper’s signal-noise framework models the interaction between retain and forget signals and analyzes both optimizers.
Balancing Retain vs. Forget Objectives: SAM requires a strictly smaller retain-weighting factor α than SGD for effective unlearning, with the benign-overfitting gap bounded on the order of O(d/n).This relaxes the retain-signal requirement while allowing more weight on unlearning the forget set.
Empirical Validation: Experiments on CIFAR-100 and ImageNet show that SAM improves forgetting while preserving retain accuracy, producing flatter loss landscapes, lower retain-forget entanglement, and reduced membership-inference vulnerability.SAM also enhances existing unlearning methods as either a pretraining or unlearning optimizer.
Novel Unlearning Algorithm: Sharp MinMax splits retain and forget objectives, using SAM for retained data and sharpness maximization for forget data to mitigate signal interference.The method intentionally overfits forget samples and achieves state-of-the-art unlearning performance, especially on high-memorization forget sets.

2 PRELIMINARIES

The preliminaries define a signal-noise framework for machine unlearning, model retain and forget updates, and compare SGD with SAM. They explain how SAM normally suppresses noise but can instead learn forget noise during gradient-ascent unlearning.

Data and Model Construction: The theoretical setup represents each image as one label-aligned signal patch surrounded by Gaussian noise patches in a two-class ReLU CNN.The CNN uses m convolutional filters, fixed second-layer weights, and cross-entropy loss.
Signal-to-Noise Unlearning: Machine unlearning removes the influence of F while preserving generalization and performance on R, typically with |F| < |R| and fewer unlearning than pretraining epochs.The unlearned model is initialized from a pretrained model and updated for T2 epochs rather than retrained from scratch.
Signal-to-Noise Unlearning: NegGrad uses gradient ascent on F and gradient descent on R, with α balancing competing objectives and accounting for retain-forget size imbalance.Batches draw samples from both subsets, causing forget signals to be relatively enlarged through repetition.
Sharpness-Aware Minimization: SAM minimizes perturbed empirical loss to seek uniformly low-loss, flatter solutions and normally suppresses noise more strongly than SGD.SAM bounds noise learning by O(1), whereas SGD’s corresponding bound is dimension-dependent O(log d).
Sharpness-Aware Minimization: During unlearning, SAM’s perturbation can cancel the signal that would deactivate noise, so gradient ascent on F makes SAM learn activated noise products nearly as much as SGD.This differs from SAM’s behavior when learning retain data, where its perturbation prevents harmful noise memorization.

3 SHARPNESS-AWARE UNLEARNING

Under NegGrad, SAM preserves noise suppression on retain data but becomes SGD-like on forget data, while still requiring less retain weighting because it learns retain signals faster. These results motivate separating retain learning from forget overfitting in Sharp MinMax.

3 SHARPNESS-AWARE UNLEARNING: SAM suppresses noise on retain samples but overfits forget signals as much as SGD under NegGrad, producing divergent behaviors on R and F.The altered activation patterns yield separate bounds for retain and forget data.
3.1 NEGGRAD REVISITED: Under weak signal strength, SGD can retain nonzero test error, whereas SAM achieves bounded test error when retain weighting dominates and signal strength is sufficient.For SGD, the supplied theorem gives lower bounds on test error in the weak-signal regime; SAM retains bounded test error under the corresponding condition.
3.1 NEGGRAD REVISITED: SAM limits noise accumulation on R to O(1), while SGD accumulates noise at O(log d) under the stated retain-dominant condition.Both optimizers continue growing their signal coefficient, but their noise behavior differs across retain and forget sets.
3.1 NEGGRAD REVISITED: SAM learns retain signals faster than SGD, so it can use a smaller α threshold; matching SAM’s signal learning requires scaling α_SGD relative to α_SAM by the signal-strength factor.The required weighting depends on signal strength and problem dimensionality, not only on the forget-to-retain size ratio.
3.2 SHARP MINMAX: SAM+NegGrad achieves higher forget accuracy than SGD+NegGrad, indicating less effective forgetting despite better out-of-sample behavior.This empirical observation motivates algorithms that deliberately sharpen the forget component.
3.2 SHARP MINMAX: Sharp MinMax splits the model into retain and forget components, applying SAM to the retain model and sharpness maximization to the forget model.Weight masking based on gradient magnitudes creates W_R and W_F during optimization.
3.3 QUANTIFYING UNLEARNING DIFFICULTY WITH MEMORIZATION: Memorization scores define unlearning difficulty: highly memorized samples are harder to forget and may require more unlearning iterations, risking retain-performance degradation.Samples with low memorization scores are correspondingly easier to unlearn.

4 EMPIRICAL STUDY

Across CIFAR-100 and ImageNet-1K, SAM consistently improves unlearning tradeoffs across methods and settings, while reducing entanglement and preserving flatter loss landscapes. Sharp MinMax further improves unlearning, especially for high-memorization forget sets.

4.1 SAM CONSISTENTLY OUTPERFORMS WITH BETTER TRADEOFF: SAM consistently improves existing unlearning methods across CIFAR-100 and ImageNet-1K, although SGD can sometimes achieve lower forget accuracy.NegGrad provides a better balance across high-, mid-, and low-memorization forget sets than the other evaluated methods.
4.1 SAM CONSISTENTLY OUTPERFORMS WITH BETTER TRADEOFF: SAM-enhanced methods improve privacy against membership inference and resist relearning attacks more effectively.SCRUB with SAM achieves the best MIA performance, while SAM-enhanced methods show smaller increases under relearning attacks.
4.1 SAM CONSISTENTLY OUTPERFORMS WITH BETTER TRADEOFF: SAM achieves better output-space closeness overall than SGD on KLoM and lower 95th-percentile variance, despite SGD sometimes performing better on forget-set means.These results suggest improved stability and reduced data-dependency effects under SAM’s geometric properties.
4.2 CONSTRAINED OVERFITTING BENEFITS UNLEARNING: Sharp MinMax achieves new best ToW performance across ImageNet-1K and CIFAR-100, with SAM 0.1 exceeding 0.9 in most CIFAR-100 settings.Its constrained overfitting separates retain and forget models geometrically while limiting relearning-attack impact.
4.3 QUANTITATIVE ANALYSIS AND VISUALIZATIONS: SAM better preserves class clusters and pushes away forget features, whereas SGD scatters retain features further, suggesting overfitting.The feature-space comparison is shown for mid-memorization forget data, with additional level-specific observations for Fhigh and Flow.
4.3 QUANTITATIVE ANALYSIS AND VISUALIZATIONS: SAM shows lower Wasserstein-based entanglement between retain and forget features than SGD before and after unlearning.Variance-based entanglement does not consistently distinguish the optimizers, while EWp does.
4.3 QUANTITATIVE ANALYSIS AND VISUALIZATIONS: As α decreases, SGD collapses fastest while SAM tolerates insufficient retain signals better, and failure begins before the retain-forget ratio threshold.This supports the claim that α depends on more than the retain-to-total sample ratio.
4.3 QUANTITATIVE ANALYSIS AND VISUALIZATIONS: Unlearning generally increases sharpness, but SAM-unlearned models retain flatter loss landscapes than SGD models on Dtest and Fmid.An exception is SGD+NegGrad on Fhigh, which produces a flatter landscape in that setting.

5 CONCLUSION

The paper concludes that SAM’s refined behavior under unlearning yields theoretical guidance and empirical improvements, while Sharp MinMax extends sample-specific unlearning through controlled overfitting.

5 CONCLUSION: The study characterizes SAM under NegGrad and derives insights for choosing the weight factor that balances retain and forget signals.Extensive experiments support the analysis and reveal additional properties of SAM that are useful for unlearning.
5 CONCLUSION: Sharp MinMax further advances sample-specific unlearning by exploiting controlled overfitting.The method is presented as a new algorithm motivated by the paper’s rethinking of overfitting.
5 CONCLUSION: Prior unlearning work includes fine-tuning, random-label approaches, gradient ascent, and methods that identify difficult forget sets.The paper positions its analysis within this broader family of approaches.
5 CONCLUSION: The paper’s related-work context includes SAM’s flatness-based generalization rationale and prior adaptive variants such as ASAM and GA-SAM.SAM perturbs parameters within a neighborhood to avoid sharp landscapes and improve generalization.

A.3 DATA MEMORIZATION

Forget-set difficulty is linked to memorization: highly memorized samples are harder to unlearn, motivating evaluation across memorization levels. The experimental setup emphasizes reproducibility, while the theory relies on explicit architectural and data assumptions.

A.3 DATA MEMORIZATION: Higher-memorization samples are atypical and harder to unlearn, whereas lower-memorization samples are easier and may require fewer unlearning iterations.Memorization scores are therefore used to construct forget sets with varying unlearning difficulty.
A.3 DATA MEMORIZATION: Experiments use fixed random seeds for data processing, pretraining, retraining, model splitting, and saved precomputations, with multiple seeds for unlearning settings.The implementation runs on a single NVIDIA A100/H100 and reports statistical-significance details separately.
A.3 DATA MEMORIZATION: The theoretical framework assumes standard model-size, data-size, signal, and Gaussian-noise conditions, plus cross-entropy, ReLU activations, clean labels, and a forget set smaller than half the training set.These assumptions are stated as extensions of conditions used in prior theoretical work.
A.3 DATA MEMORIZATION: The paper uses GPT for grammar polishing and literature-search assistance but not for core theory, implementation, experiments, or mathematical derivations.The authors state that no core component was developed or guided by the language model.

B.3 LIMITATIONS AND FUTURE WORK

The limitations section identifies unmodeled interference, uncertain behavior with weak retain signals, and limitations of ascent-based unlearning objectives. The appendix also specifies the framework’s notation and assumptions.

B.3 LIMITATIONS AND FUTURE WORK: Overlap between retain and forget samples can introduce unmodeled interference, especially when hard cutoffs or random sampling split similar examples across subsets.The authors hypothesize that less overlap improves unlearning effectiveness, while more overlap harms it.
B.3 LIMITATIONS AND FUTURE WORK: The framework does not characterize SAM’s behavior when retain signals are weak beyond the analyzed upper bound.Future theory and experiments would need to model interactions among multiple signal and noise sources.
B.3 LIMITATIONS AND FUTURE WORK: Ascent-based unlearning may encourage misclassification rather than making forget samples resemble data the retrained model has never seen.This limitation is discussed for methods such as NegGrad.
B.3 LIMITATIONS AND FUTURE WORK: The framework defines forget difficulty using memorization scores and represents inputs with one signal-bearing patch alongside noisy patches.The notation includes sample noise vectors, convolutional filters, model parameters, and retain-forget weighting variables.
B.3 LIMITATIONS AND FUTURE WORK: ToW combines retain, forget, and test accuracies, while Fhigh, Fmid, and Flow denote forget sets with different memorization difficulties.The notation also distinguishes training and unlearning algorithms and defines feature embeddings for entanglement analysis.
B.3 LIMITATIONS AND FUTURE WORK: The analysis assumes cross-entropy loss, ReLU activations, clean labels, and α at least |R|/(|F| + |R|) with this ratio greater than 0.5.The theoretical derivation builds on pretraining quantities and an expanded NegGrad update rule.

D.1 PROOF TO THEOREM 3.2

This proof analyzes test error when retain and forget samples are jointly optimized, decomposing predictions into signal and noise contributions. The resulting bounds vary with the retain/forget mixture and can approach either a small error level or the minimally PAC-learnable threshold.

Jointly updating on retain and forget samples measures test error through correct retain predictions and intentionally incorrect forget predictions, so fitting forget samples can reduce generalization.
The proof decomposes the classifier margin into signal and noise learning for both positive and negative classes before bounding retain and forget errors.
The proof uses concentration, norm, inner-product, and total-variation bounds to establish error bounds for both retain and forget distributions.
As β approaches 0.5, the test-error upper bound becomes 0.5 + 0.5ϵR − 0.5ϵF = ϵ, while another bound gives a lower limit of 0.05.
The resulting test-error range depends on the retain/forget size ratio, moving from a small retain-error level toward the minimally PAC-learnable threshold as β decreases.

D.2.1 PROOF TO LEMMA 3.1

This proof characterizes how SAM behaves when gradient ascent fits the forget set. It separates regimes where unlearning has benign overfitting on both sets from regimes where forget-set overfitting is harmful.

SAM loses its noise-denoising advantage on the forget set under gradient ascent, learning activated noise products as much as SGD while retaining denoising on retain samples.
When the unified signal is sufficiently strong, both retain and forget sets exhibit benign overfitting under the derived bounds.
As β approaches 1, the forget fraction decreases and performance can approach the small retain error ϵ; near β = 0.5, the bound can approach 0.5.
For intermediate signal strength, retain samples have benign overfitting while forget samples have harmful overfitting.
The proof accounts for synchronous cycling of the forget set, which scales forget updates by |R| and constrains the retain/forget weighting ratio α.

D.4 PROOF TO LEMMA 3.4

This proof compares the signal requirements of SAM and SGD for retain-signal learning during unlearning. SAM reaches benign retain-set overfitting with a weaker signal requirement and therefore learns retain signals faster.

SAM’s advantage applies specifically to retain-signal learning: under Theorem 3.3, it has the same forget-set signal-strength requirement as SGD because noise-memorization prevention is disabled there.
SAM requires ∥φ∥2 = Ω(1) for benign overfitting on R, whereas SGD requires ∥φ∥2 = Ω(d1/4|R|−1/4Pσp).
Because SAM learns retain signals more effectively, SGD must increase αSGD to match SAM’s retain-signal learning performance.
The proof characterizes the gap between the required SGD and SAM weighting ratios when |R| = Θ(n).

E.1 EXPERIMENT SETUP

The experiments evaluate SAM-based unlearning on CIFAR-100 and ImageNet-1K using ResNet-50, with forget sets selected by memorization difficulty. They compare optimizers and unlearning methods, including the proposed Sharp MinMax model split.

Experiment setup: Experiments use CIFAR-100 and ImageNet-1K with ResNet-50, selecting forget sets of about 5% of training data at high, medium, and low memorization levels.
Pretraining and retraining: Table 6 reports pretraining settings and test accuracies for different methods, plus retrained-model performance across forget-set choices.
Sharp MinMax: Sharp MinMax splits parameters into retain and forget models, using SAM for retain learning and sharpness maximization for forget learning.
Optimizer comparisons: The study compares SGD, SAM, and ASAM during pretraining and unlearning while matching optimal hyperparameters within comparable optimizer pairs.
Evaluation metrics: The evaluation measures membership-inference resistance and retain–forget feature entanglement in addition to accuracy-based unlearning performance.

F DETAILED EMPIRICAL RESULTS

Across repeated ImageNet and CIFAR-100 experiments, SAM consistently improves unlearning methods and generally provides more stable performance than SGD. Detailed accuracy results indicate that SAM’s advantage comes from better retain and test accuracy, although SGD can sometimes achieve lower forget accuracy.

Statistical significance: SAM consistently improves base unlearning methods across seeds, with higher means and generally smaller variances than SGD.The experiments use three random seeds; improvements are more noticeable on CIFAR-100, where SGD-based unlearning often has greater variance.
Detailed accuracies: SAM outperforms SGD in retain and test accuracy, producing better overall ToW even when SGD attains lower forget accuracy.This pattern motivates reconsidering controlled overfitting for sample-specific unlearning.
Additional datasets: SAM-enhanced unlearning remains effective in additional CIFAR-10 and Tiny-ImageNet experiments with randomly sampled forget sets.The experiments use ImageNet-pretrained ResNet-34 weights for Tiny-ImageNet and report detailed results in the accompanying tables.

G.1 CIFAR-10

Additional experiments show that SAM improves unlearning across corrupted data, architectures, optimizers, and attack settings, while its benefits vary by method and dataset. Sharp MinMax can be overly aggressive for small-scale unlearning, whereas SAM stabilizes otherwise variable procedures and improves robustness measures.

CIFAR-10 and Tiny-ImageNet: SAM improves unlearning across CIFAR-10 and Tiny-ImageNet, but Sharp MinMax is not best on CIFAR-10 and may be too aggressive for small-scale unlearning.SCRUB is also unstable with SGD on CIFAR-10, while SAM reduces its variance and stabilizes unlearning across pretrained models.
Noisy unlearning: SAM continues to improve base unlearning methods under glass-blur and snow corruptions on CIFAR-100, with clearer margins than on clean data.The corruptions reduce the initial signal-to-noise ratio, while the update dynamics remain compatible with the theoretical framework.
SAM with Adam and ViT: SAM generalizes to ViT-Small with AdamW, although ViTs perform worse than ResNets on smaller datasets and are more sensitive to unlearning learning-rate tuning.The pretrained ViT models have 57% test accuracy in this setting.
Robustness evaluation: SAM-enhanced models are more resilient to relearning attacks, showing smaller increases in forget accuracy after relearning the forget set for one epoch.The comparison averages increases across high-, medium-, and low-difficulty forget sets.
Runtime and efficient SAMs: MSAM reduces computation overhead relative to vanilla SAM and can outperform it on ToW for some methods, but its interactions with ASAM and weight masking remain unresolved.The paper leaves deeper theoretical and empirical analysis of efficient SAM variants for future work.
KLoM scores: SAM-enhanced unlearning improves KLoM on retain and test data across forget-set difficulties, often halving KL divergence on the retain set and improving tail stability.SAM does not improve KLoM closeness on the forget set, but it reduces distance to retrained references on retain and test data.
Loss landscape: SAM produces flatter loss landscapes than SGD before unlearning and after Sharp MinMax unlearning, although SGD can become flatter after unlearning.Flatness is measured using basin ratio, defined as the percentage of perturbed losses whose deviation from the original loss is at most 0.5 · stddev.
Statistical comparisons: Across ImageNet, SAM consistently improves unlearning methods, while ASAM 1.0 provides the largest steady improvement in the reported confidence-interval comparison.The figure summarizes three-seed runs with 95% confidence intervals.