PaperlayerView exact revision on arXiv

Source-linked AI summary

Source-Free Class Relearning: Diagnosing Forgetting in Class Unlearning

Zahra Dehghani, Pablo Piantanida, Mohammadhadi Shateri

arXiv:2609.02018v1cs.LGcs.CV

TL;DR

Class unlearning can leave recoverable forget-class structure despite low forget accuracy, raising the question of whether recovery is possible without source data. The paper proposes a source-free audit and finds substantial recoverability for several methods, exceeding matched retrained references for some.

  • Problem

    Whether low forget-class accuracy durably erases forget-class structure remains unclear, while prior recovery approaches require data or reference checkpoints.

  • Method

    SFRA uses synthetic representation-space probes, confidence filtering, and a classifier-head update, motivated by an alignment condition for increasing forget-class margin.

  • Results

    Several unlearning methods show substantial source-free recoverability across CIFAR-10, CIFAR-100, TinyImageNet, and multiple backbones, with some exceeding matched retrained references.

  • Takeaways & Limitations

    Low forget-class accuracy alone does not establish that class structure has been erased; source-free relearning can reveal residual recoverable structure.

  • Takeaways & Limitations

    The alignment proposition gives a sufficient geometric mechanism for a synthetic-forget update, not a necessary-and-sufficient theory of final RS.

Abstract

from arXiv · show

Class unlearning aims to remove a model's ability to recognize designated forget classes while preserving performance on retain classes. However, low forget accuracy after unlearning does not necessarily mean the class structure has been erased. Approximate unlearning methods can alter classifier decision boundaries while leaving recoverable structure in the representation. Prior work has shown that forget classes can be recovered, but existing approaches require real forget or retain samples, auxiliary data, or reference checkpoints. We study class relearning in a strictly source-free setting, asking whether a forget class can be recovered through a classifier-head update using only the unlearned model. Our approach rests on a theoretical analysis establishing a sufficient alignment condition under which a single gradient step on a synthetic probe set increases the expected logit margin of the forget class. Building on this, we propose a white-box Source-Free Relearning Audit (SFRA), which generates candidate embeddings in representation space and uses model-guided confidence filtering to construct high-confidence retain probes and low-confidence boundary-adjacent probes that are relabelled as the forget class. Gaussian sampling and Softmax confidence are used by default, while ablations with alternative proposal distributions and uncertainty criteria show that recoverability is not specific to these choices. To quantify recoverability, we introduce the Relearning Score (RS), which jointly measures forget-class recovery and retain-accuracy preservation, and report class-matched $Δ$RS relative to a retrained reference. Experiments on CIFAR-10, CIFAR-100, and TinyImageNet with ResNet-18, ViT-B/16, and Swin-T show that several unlearning methods exhibit substantial source-free recoverability, and that for a subset of methods this recoverability exceeds the matched retrained reference.

1. Introduction

Class unlearning seeks to remove designated classes while preserving retain performance, but low forget accuracy may conceal recoverable representation structure. This paper develops a source-free audit and metrics to test such recoverability.

  • Motivation: Approximate unlearning can alter classifier decision boundaries without eliminating class-separable structure in representation space.Such residual structure can support forget-class relearning while retain performance remains nearly unchanged.
  • Research question: The paper studies whether forget classes can be recovered using only the unlearned model, without access to source data.The setting is strictly source-free and uses synthetic probes in classifier-input representation space.
  • Method: SFRA generates synthetic probes, assigns them to classifier-defined regions, and uses uncertain boundary probes relabelled as the forget class.The method tests whether recoverable decision structure remains after unlearning.
  • Evaluation: RS jointly measures retain stability and forget-class recoverability, while ΔRS compares excess recoverability against a matched retrained reference.Positive ΔRS indicates greater recoverability than a model that never observed the forget class.
  • Theory: A sufficient alignment condition provides theoretical motivation for increasing the expected forget-class margin with synthetic probes.The condition supplies a principled basis for source-free relearning.

2. Related Work

Prior audits and relearning methods have identified post-unlearning vulnerabilities but generally depend on data or reference models. SFRA instead evaluates recoverability using only the released unlearned model, strengthening the interpretation of successful recovery.

  • Prior work: Existing privacy and relearning approaches expose post-unlearning vulnerabilities but remain source-dependent or reference-dependent.The cited approaches require information beyond the released unlearned model.
  • Source-free audit: SFRA constructs synthetic probes without forget, retain, auxiliary, or surrogate data or the original checkpoint.This contrasts with source-dependent relearning and representation-level auditing methods.
  • Interpretation: Successful recognition of held-out forget samples indicates that the post-unlearning representation supports re-separation of the forget class.The interpretation concerns source-free recoverability rather than memorization of real training samples.

3. Methodology

SFRA audits source-free class relearning by updating only the classifier head with synthetic representation-space probes, grounded in a sufficient margin-alignment condition. It measures whether the frozen post-unlearning representation retains structure supporting forget-class recovery while preserving retain performance.

  • Problem setup: SFRA assumes white-box access to the unlearned model and forget-class identity, without real, auxiliary, surrogate, or pre-unlearning data.Real labeled samples are used only for post-hoc evaluation.
  • Probe construction: Synthetic embeddings are sampled in classifier-input space, then labeled by classifier predictions to form confident retain probes and low-confidence probes relabeled as the forget class.The feature extractor remains frozen while only the classifier head is updated.
  • Audit objective: The audit tests whether the post-unlearning feature space still supports forget-class recovery through a lightweight classifier-head update.Boundary-adjacent probes are selected because uncertainty concentrates near decision surfaces.
  • Theoretical basis: A sufficient condition for increasing the expected forget-class margin is positive alignment between the synthetic forget mean and real forget mean that dominates the approximation residual.The condition concerns the synthetic-forget loss contribution to a single classifier-head gradient step.
  • Theoretical scope: The proposition is local and sufficient rather than necessary-and-sufficient because the complete SFRA update also includes synthetic-retain loss and iterative optimization.Non-positive alignment removes the guarantee but does not imply relearning is impossible.
  • Design robustness: Softmax confidence and Gaussian sampling are defaults, while alternative uncertainty criteria and proposal distributions preserve recoverability trends.This indicates model-guided probe selection, rather than either default choice, is central to the audit.

4. Experiments

Experiments evaluate SFRA across datasets, architectures, and unlearning methods, using RS to jointly assess forget-class recovery and retain preservation. Results show substantial method- and class-dependent source-free recoverability, including cases exceeding matched retrained references.

  • Experimental Setup: Experiments cover CIFAR-10, CIFAR-100, and TinyImageNet with ResNet-18, ViT-B/16, and Swin-T models.The main setup reports ResNet-18 results, with ViT-B/16 and Swin-T results provided in the appendix.
  • Evaluation Metrics: RS rewards forget-class recovery only when retain-class performance remains stable, using a harmonic mean of retain preservation and forget recovery.Retain preservation receives no extra credit for improvement, while unchanged or decreased forget accuracy receives no recovery credit.
  • Evaluation Metrics: Table 1 reports maximum RS and maximum ΔRS independently across forget classes, so the two maxima may correspond to different classes.Positive ΔRS indicates greater recoverability than the matched retrained reference, whereas high RS with ΔRS near zero may reflect generic relearnability.
  • Aggregate Results: Bad Teacher and DELETE achieve the highest RS on CIFAR-10 with ResNet-18, while SCRUB and Negative Gradient+ show among the lowest RS and ΔRS values.The reported comparison identifies stronger and weaker source-free relearning across methods without providing the corresponding table values here.
  • Geometric Evidence: For class 7, Bad Teacher increases forget accuracy from 0.0% to 99.8% with RS 0.95, whereas Negative Gradient+ rises from 0.1% to 11.0% with RS 0.11.Bad Teacher preserves a compact forget-class cluster, while Negative Gradient+ disperses forget samples across clusters and disrupts feature geometry.

5. Conclusion

SFRA audits whether unlearned models retain source-free recoverable forget-class structure, using RS for absolute recoverability and ΔRS for excess recoverability relative to retraining. The audit shows that low forget accuracy can coexist with relearning, while recoverability does not by itself establish memorized training information.

  • Low forget-class accuracy can coexist with substantial source-free relearning across datasets, backbones, and unlearning methods.
  • RS jointly measures forget-class recovery and retain-class preservation, while ΔRS measures excess recoverability relative to a matched retrained reference.
  • A high RS shows that a class can be re-separated under the audit but does not establish memorized training information or forget-specific residual structure.
  • Positive ΔRS indicates that the released unlearned model is more recoverable than a model that never observed the forget class.

A. Proof of proposition 1

The proposition analyzes how synthetic forget probes affect expected real forget-class margins after a classifier-head gradient step. SFRA approximates this mechanism with Gaussian candidate generation, confidence filtering, and selected synthetic probes, while retaining an exact residual-based condition.

  • The sufficient condition links expected forget-class margin increase to alignment between synthetic probes and real forget-class representations, plus a residual term.
  • In the evaluated setting, the unweighted approximation closely tracks the exact probability-weighted expression in aggregate.
  • The exact condition is μ_Sf^Tμ_Ef + r_j > 0 for each retain-class competitor j.
  • When r_j is approximately zero, the condition reduces to positive mean alignment between synthetic and real forget embeddings.
  • SFRA samples N Gaussian embeddings per retain class, selecting M high-confidence retain probes and M low-confidence boundary probes relabeled as the forget class.
  • Probe construction uses batched classifier-space operations without image generation or full-encoder forward passes.

D. Post-hoc Synthetic–Real Alignment

The post-hoc analysis evaluates synthetic–real alignment, its relation to RS, and the confidence rationale for boundary-probe selection. Results support the approximation in one setting but show that alignment alone is not a standalone predictor of final recoverability.

  • Per-class analysis finds consistently negative synthetic–real alignment for retrained references, while unlearned models are generally closer to zero or positive.
  • Alignment magnitude is not monotonic with final RS: Negative Gradient+ can align positively yet achieve relatively low RS, whereas Negative Gradient attains higher RS near-zero alignment.
  • The proposition depends on μ_Sf^Tμ_Ef + r_j, but the experiment directly measures only the principal alignment term.
  • Positive alignment alone does not establish the complete sufficient condition without estimating r_j.
  • For CIFAR-10 class 7, α_j(s) has mean 1.013, while exact and approximate expressions show Pearson r = 0.939, Spearman ρ = 0.934, slope 1.005, and 88.9% sign agreement.
  • Correctly classified retain samples receive high confidence, whereas forget samples assigned to retain classes receive substantially lower confidence, motivating low-confidence boundary probes.

H. Sensitivity to the Number of Synthetic Probs

Probe-count sensitivity is architecture-dependent: ViT-B/16 remains stable across probe settings, with retain accuracy largely preserved and forget accuracy saturating at smaller selected-probe counts. Larger candidate pools can improve boundary-probe mining, while recoverability–utility trade-offs remain method-dependent.

  • ViT-B/16 is less sensitive than ResNet-18 to both the number of selected embeddings M and generated embeddings N.
  • With N fixed, retain accuracy remains within ±1%, while forget accuracy increases and saturates at smaller M.
  • With M fixed, increasing N yields more consistent gains in forget accuracy by improving the chance of mining useful boundary probes.
  • Overall, ViT-B/16 relearning is stable and does not require aggressive tuning of M or N.
  • For several methods, RS increases substantially while retain-accuracy degradation remains close to zero, but other methods require larger utility losses.
  • Relearning trajectories tend to saturate, with limited additional RS improvement as retain accuracy continues to decrease.

J. Additional Results and Details for Single-Class and Multi-Class SFRA

Additional experiments extend SFRA across architectures, datasets, and multiple forget classes, while geometric analyses relate recoverability to residual representation structure. The audit remains source-free and updates only the classifier head.

  • Additional single-class results: SFRA evaluates single-class unlearning across CIFAR-10, CIFAR-100, and TinyImageNet with ResNet-18, ViT-B/16, and Swin-T.CIFAR-10 uses all classes; CIFAR-100 and TinyImageNet use ten designated classes per backbone.
  • Multi-class SFRA: Multi-class SFRA partitions boundary-adjacent probes among forget classes using the unlearned classifier, freezes the encoder, and updates only the classifier head.The procedure uses no real data and assigns low-confidence probes to forget-class subsets.
  • Multi-class SFRA: Additional experiments test simultaneous forgetting with 2-, 5-, and 10-class settings on CIFAR-10 and CIFAR-100 using ResNet-18.CIFAR-10 uses forget set {1, 6}; CIFAR-100 uses specified sets of 2, 5, and 10 classes.
  • Multi-class SFRA: Multi-class recoverability is not monotone in the number of forget classes because changing the forget set alters residual geometry and boundary-probe assignment.The paper identifies assignment sensitivity as a limitation rather than evidence that more forgotten classes necessarily weaken unlearning.
  • Geometric analysis: High-recoverability methods retain more coherent residual forget structure, allowing synthetic probes and a lightweight head update to reform a forget-class decision region.The geometric comparison includes Bad Teacher, DELETE, SalUn, Negative Gradient+, SCRUB, and a retrained reference.
  • Recoverability comparisons: Many method–forget-class pairs show high RS with positive ΔRS, indicating recoverability beyond matched retrained references.Figure N.1 uses ΔRS = 0 to distinguish pairs exceeding their retrained references and RS = 0.5 only as a visual guide.

O. Sampling Distribution Ablation

The sampling ablation tests whether SFRA depends on Gaussian proposals. Alternative distributions preserve relative recoverability patterns, indicating that model-guided filtering is more consequential than the proposal family itself.

  • Sampling design: SFRA samples candidate embeddings from a standard Gaussian, s ∼ N(0, I_d), as a broad proposal pool for classifier-guided probe selection.The candidates are directions in representation space, not reconstructions of natural features.
  • Sampling ablation: Uniform and Laplace proposals generally preserve the relative recoverability patterns observed with Gaussian sampling, despite differences in absolute RS.The comparison uses CIFAR-10 with ResNet-18 and keeps other components unchanged.
  • Sampling ablation: Model-guided partitioning and confidence-based selection of boundary-adjacent forget probes and high-confidence retain probes more strongly determine relearning outcomes than the proposal distribution.This finding shifts emphasis from approximating the unknown feature distribution to selecting useful directions from a candidate pool.

P. Uncertainty-Score Ablation

The uncertainty-score ablation replaces Softmax confidence with entropy and energy while holding the audit pipeline fixed. All three criteria can support substantial recoverability, but their effectiveness varies by architecture and checkpoint.

  • Ablation design: Entropy and energy replace Softmax confidence for ranking candidates from the same Gaussian pool, with the highest-uncertainty candidates relabeled as forget probes.The lowest-uncertainty remaining candidates form the synthetic retain set, and the two subsets are disjoint.
  • Results: Entropy- and energy-based selection also produce substantial RS across numerous methods, forget classes, and architectures, showing SFRA is not tied to Softmax confidence.The evaluation reports per-class RS across CIFAR-10 backbones and multiple audit seeds.
  • Seed variability: Most measurements are stable across audit seeds: 99.7% of ResNet-18 entries have RS standard deviation no greater than 0.05.The corresponding within-0.05 fractions are 85.7% for ViT-B/16 and 95.9% for Swin-T.

Q. Effect of Gaussian Support on SFRA

The Gaussian-support ablation separates signed, ReLU-constrained, and absolute proposals to test whether negative coordinates or probe norm explain SFRA recovery. Signed probes perform best, but ReLU-constrained probes still recover the class substantially.

  • Experimental setup: The ablation compares signed Gaussian probes, ReLU-Gaussian probes, and absolute Gaussian probes under the same Bad Teacher CIFAR-10 ResNet-18 checkpoint.The absolute condition preserves the norm of each corresponding signed sample, while ReLU constrains coordinates to the non-negative orthant.
  • Results: Signed Gaussian probes provide the strongest and most efficient recovery, while ReLU-Gaussian probes still achieve substantial recovery with RS = 0.94.The result shows that negative coordinates are not required for SFRA to succeed.
  • Results: Absolute Gaussian probes produce almost no recovery despite preserving signed Gaussian norms, ruling out norm alone as the explanation for the signed-versus-ReLU difference.The comparison isolates coordinate support from probe norm.
  • Support diagnostics: Selected retain and forget sets retain roughly half negative coordinates, with 49.93% and 49.98%, respectively.The accepted pools show the same sign pattern, indicating rejection sampling does not implicitly remove negative coordinates.

R. Detailed Per-Class Results and Linear Separability

The section reports per-class unlearning and relearning results across datasets and backbones, alongside a frozen-encoder test of whether forget information remains linearly accessible. It distinguishes source-dependent representation accessibility from source-free recoverability and finds class-specific differences.

  • Detailed Per-Class Results: Per-class experiments report unlearned performance, source-dependent PRA, SFRA results, and frozen-encoder linear-probe accuracy.
  • Linear Separability: Frozen-encoder linear probing tests whether forget-class information remains linearly accessible independently of the released classifier head.
  • Linear Separability: High ALP_f indicates that the forget class remains linearly separable in the post-unlearning representation.
  • Linear Separability: ALP_f measures supervised, source-dependent representation accessibility, whereas RS measures source-free recoverability using only the released model and synthetic probes.
  • Detailed Per-Class Results: Results span CIFAR-10, CIFAR-100, and TinyImageNet with ResNet-18, ViT-B/16, and Swin-T, revealing class-specific differences in recoverability.
Loading 2609.02018v1…