PaperlayerView exact revision on arXiv

Source-linked AI summary

Do Influence-Derived Data Perturbations Enable Machine Unlearning? A Controlled Study of Three Plausible Roles

Chenkai Wu, Chrispine Kambimbi, Qinyang Zeng, Jun Yan

arXiv:2609.12313v1cs.AI

TL;DR

Whether influence-derived perturbations support machine unlearning across direct deletion, utility preservation, and adversarial warm starts calls for role-specific evaluation against exact retraining. In matched CIFAR-10 tests, DPL fails the direct-deletion and warm-start criteria, while its utility results are inconsistent across seeds.

  • Problem

    Whether influence-derived perturbations support direct deletion, utility preservation, and adversarial warm starts requires separate evaluation; for random deletion, exact retraining is the relevant reference.

    Source: §1 · p. 1

  • Method

    The study evaluates DPL's influence-derived image and label perturbations using role-matched controls and gates for direct deletion, utility regularization, and adversarial-unlearning warm starts.

    Source: §1 · pp. 1, 3

  • Results

    Across three paired CIFAR-10 seeds, direct DPL fails the matched gate in every seed, utility regularization passes in one, and warm starting never beats both official and FGSM initialization after direction cost.

    Source: §9 · p. 16

  • Takeaways & Limitations

    For random instance deletion, lower forget-set accuracy can indicate greater deviation from retraining rather than better unlearning.

    Source: §1 · p. 1

    The negative findings concern the released solver's default-budget direction, not a converged influence direction, and the evaluations focus on random 10% image-instance deletion.

    Source: §8 · p. 15

Abstract

from arXiv · show

We evaluate Deep Perturbation Learning (DPL), which perturbs training images and labels along influence-derived directions, in three roles in which prior work has positioned it for machine unlearning: a direct deletion signal (the strongest claim), a utility-preserving regularizer, and a warm start for adversarial unlearning. Evidence for the weaker roles has been used to support the stronger one, so we test each role separately under a matched protocol with exact-seed retraining baselines. An audit of the public implementation identifies two correctness issues: image directions are computed on augmented, normalized tensors but applied to raw images, and the label perturbation falls below float32 resolution, leaving labels unchanged. After correcting the image-perturbation pipeline, DPL fails the direct-deletion criterion on CIFAR-10/ResNet-18 in all three paired seeds. Its utility effects are inconsistent in sign across seeds, and once direction-computation time is counted it underperforms simple warm-start baselines. A one-seed Tiny ImageNet check likewise does not favor DPL as a regularizer or warm start; preprocessing inconsistencies in the released code make the direct comparison there inconclusive. These results cover random instance deletion only and do not rule out influence-based methods in other deletion regimes. We release a role-matched evaluation protocol and an audit checklist for perturbation-based deletion claims.

1 Introduction

The paper tests whether influence-derived data perturbations can support three distinct unlearning roles, using matched controls and exact retraining as the reference. It audits the implementation and evaluates the corrected direction across paired CIFAR-10 seeds.

Evaluation premise

  • For random instance deletion, exact retraining is the reference, and high forget-set accuracy can reflect agreement with retraining rather than failed unlearning.Forgotten examples remain i.i.d. samples from the same distribution, so retraining may still predict them correctly.Source: §1 · p. 1

Motivation

  • DPL uses influence-derived image and label perturbations to approximate the parameter displacement associated with removing a forget set, but input perturbations may not span that direction.The target displacement contains an inverse Hessian.Source: §1 · p. 1

Three roles

  • The study separately asks whether perturbations can directly forget data, preserve utility alongside an explicit forgetting objective, or warm-start adversarial unlearning.Each role has its own matched control and predeclared pass/fail gate.Source: §1 · p. 1, Figure 1 · p. 2, Figure 2 · p. 2

Empirical results

  • Across three paired CIFAR-10 seeds, corrected DPL fails direct deletion, passes the utility gate once, and never beats both warm-start controls after direction cost.Warm-start behavior is almost identical to FGSM initialization while adding 47–66 seconds of direction-computation cost.Source: §1 · pp. 2–3

Contributions and scope

  • The paper contributes role-specific controls and local analysis, a matched empirical evaluation, and an audit checklist for perturbation-based deletion claims.Its claims are limited to the studied random-instance-deletion protocols.Source: §1 · p. 3

Implementation audit

  • The implementation audit found an image-coordinate mismatch, an inactive label perturbation, and a Tiny ImageNet preprocessing defect that makes its direct comparison inconclusive.The paper also identifies a normalization/clamp inconsistency in the matched adversarial pipeline.Source: §1 · p. 3

2 Related Work

Related work establishes exact retraining as a reference for deletion, surveys approximate deep-network methods and privacy measures, and situates DPL among influence-based and input-space approaches. It also motivates auditing the implemented perturbation rather than only its mathematical direction.

Exact retraining and certified removal

  • Exact retraining provides an empirical reference for approximate deep-classifier unlearning, while certified removal requires a distributional relation between released and retrained models.SISA reduces deletion-time retraining through sharding, slicing, and aggregation.Source: §2 · p. 3

Approximate unlearning for deep networks

  • Approximate methods include retained-set fine-tuning, forget-loss ascent, parameter suppression, and teacher-student objectives; method rankings vary with datasets, forget sets, initializations, metrics, and tuning.Weak evaluations can produce a false sense of privacy.Source: §2 · pp. 3–4

Privacy evaluation

  • Low forget-set accuracy is neither necessary nor sufficient for random deletion, so privacy audits also use membership inference and likelihood-ratio attacks.The paper reports SVC-based confidence and RMIA FT-AUC relative to exact retraining when available.Source: §2 · p. 4

Perturbation learning and adversarial unlearning

  • Influence methods use inverse-Hessian information, while DPL learns image and label perturbations; this study asks whether its direction helps as a standalone update, utility term, or adversarial initialization.AMUN instead generates nearby adversarial examples and updates toward deliberately incorrect targets.Source: §2 · p. 4

Implementation-sensitive evaluation

  • Coordinate, normalization, projection, and precision choices can change the realized perturbation, motivating end-to-end evaluation of implemented unlearning outcomes.The cited work argues deletion claims should be auditable at the implemented-algorithm level.Source: §2 · p. 4

3 Problem Setup and Three Perturbation Roles

The setup compares three roles for a shared influence-derived direction, each against a role-specific control and with exact retraining as the behavioral reference. The gates require role-relevant outcomes rather than isolated metric gains.

Evaluation measure

  • Avg. Diff. is the average discrepancy between an approximate unlearned model and exact retraining, computed from behavioral statistics whose components are reported separately.Computational cost is recorded separately and enters role-specific gates.Source: §3 · p. 5

Role I: direct forgetting

  • For direct forgetting, a damped-Hessian influence vector informs an input perturbation that is applied in deterministic raw-image coordinates before a short post-hoc update.Success requires lower Avg. Diff. to exact retraining than simple post-hoc controls.Source: §3 · p. 5

Role II: utility regularization

  • For utility regularization, an explicit adversarial-example objective supplies forgetting pressure while a weighted DPL term replaces clean retained examples with influence-perturbed examples.The matched control is ordinary clean retained-data cross-entropy.Source: §3 · p. 5

Role III: adversarial warm start

  • For adversarial warm starting, corrected normalized DPL initialization is compared with official and FGSM initialization at one, three, and five refinement steps, including direction cost.Success requires comparable quality faster than the official initialization and meaningful improvement over FGSM at the same step count.Source: §3 · p. 5

Gate principle

  • Each role is judged against a simpler control selected before its final comparison, and a gain on one metric does not count if another required metric degrades.The concrete gates and full decision tables are specified elsewhere in the paper.Source: §3 · p. 5

4 Theoretical Analysis

The analysis derives local conditions for what influence-derived data directions can support, from expected behavior under random deletion to one-step parameter matching. It also identifies limits from coordinate errors and from treating parameter alignment as behavioral agreement.

4.1 Random deletion should resemble population prediction

  • Under random deletion, exact retraining retains population-like forget behavior, so lowering forget accuracy can move a model farther from the deletion target.The expected-loss identity also holds for bounded prediction statistics such as accuracy.Source: §4.1 · pp. 5–6

4.2 First-order parameter displacement from deletion

  • The first-order retraining displacement is a local inverse-retained-Hessian transform of the positive forget gradient, not a step along the negative forget gradient.With a singular or indefinite Hessian, a damped inverse gives a regularized surrogate rather than the exact retraining displacement.Source: §4.2 · p. 6

4.3 The input direction that matches a desired update

  • Under the stated approximations, the derived input direction best matches one parameter update, but does not establish a match for signed perturbations, repeated nonlinear updates, accuracy, or membership behavior.The analysis assumes differentiability and local regularity for the candidate loss.Source: §4.3 · pp. 6–7

4.4 Coordinate errors can invalidate the local guarantee

  • The intended first-order decrease occurs exactly when the implemented direction has positive inner product with the ideal direction; coordinate errors can violate this condition.Crops, flips, and normalization-unit mismatches can invalidate the match even when tensor shapes agree.Source: §4.4 · p. 7

4.5 Parameter alignment is only a surrogate

  • Local parameter alignment is only a surrogate for behavioral agreement because accuracy and thresholded membership decisions are not globally Lipschitz.End-to-end behavioral evaluation remains necessary even when the influence calculation is mathematically correct.Source: §4.5 · pp. 7–8

5 Implementation and Numerical Audit

The implementation audit finds that the original image direction was computed on augmented, normalized tensors but applied to raw images, and that label perturbations made no measurable change in float32. The audit also identifies a distinct Tiny ImageNet preprocessing inconsistency and specifies the corrected raw-space image path.

5 Implementation and Numerical Audit

  • The audit traced actual tensors, transforms, signs, projection steps, and output files across the DPL and AMUN codebases rather than relying on code comments.The direct path reuses public DPL components within a deletion-specific guide and candidate-selection wrapper.Source: §5 · p. 8
  • The original direct path computed directions on augmented, normalized tensors but applied them to unaugmented raw images; the corrected mode differentiates and applies directions to the same raw tensor.The corrected mode disables stochastic spatial transforms during direction construction, applies normalization before the model forward pass, and clamps in raw-image space.Source: §5 · p. 8
  • On 1,024 diagnostic examples, corrected normalized and signed directions had mean per-sample cosine similarity 0.653, with 99.7% above 0.5; legacy-to-corrected cosine was undefined.The original stochastic path did not preserve crop offsets and flip decisions needed to align its directions to raw coordinates.Source: §5 · p. 8
  • At β = 0.007, both label-direction signs produced zero measurable target-space change, KL divergence, or argmax changes in float32, so label perturbation was disabled in utility and warm-start studies.The implementation already included one unlearning sign reversal, but both signs were evaluated because the proposition is local and training uses normalization, projection, and multiple updates.Source: §5 · p. 8
  • The AMUN attack path combines a normalized clean-tensor initialization with an internal [0, 1] clamp, so its perturbations are not a strict raw-image ℓ2 threat set; the issue affects FGSM and DPL alike.The comparison retains this behavior so initialization is the only changed factor.Source: §5 · p. 9
  • Tiny ImageNet's VGG-19 checkpoint scored 57.59% with its training normalization but 12.28% under the raw-tensor evaluator, leaving the direct-role comparison inconclusive.Applying differentiable normalization before the attack forward pass changed full-AMUN forget, retain, and test accuracy by 57.42, 50.25, and 28.95 percentage points, respectively.Source: §5 · p. 9

6 Experiments

Across three paired CIFAR-10 seeds, DPL fails the direct-deletion and warm-start gates and passes the utility gate only once. A one-seed Tiny ImageNet check does not favor DPL for utility or warm starting, while preprocessing inconsistency makes its direct comparison inconclusive.

6.1 Protocol and baselines

  • The protocol freezes role-specific configurations across three paired CIFAR-10 seeds, uses matched controls and exact-seed retraining, and reports task metrics and computational cost.In baseline screening, GA’s 20.02% forget accuracy coincided with retain and test accuracy collapsing to about 20%.Source: §6.1 · p. 9, Table 1 · p. 10

6.2 Role I: direct forgetting does not approach retraining

  • The optimistically selected direct checkpoint retains 100% forget accuracy and remains farther from retraining than SalUn and AMUN, despite 94.53% test accuracy.Its average discrepancy is 4.366, compared with 1.745 for SalUn and 3.935 for AMUN.Source: §6.2 · p. 10, Table 2 · p. 10

6.3 Role II: DPL utility does not reliably beat clean retain CE

  • In seed 1, DPL utility’s 0.03-point test gain came with lower retain accuracy and higher retain loss, so it failed the utility gate.Retain accuracy was 0.0178 points lower than with clean retain CE.Source: §6.3 · pp. 10–11

6.4 Role III: warm starting adds cost without distinct convergence

  • DPL and FGSM maintain nearly identical 56.9% attack success across one, three, and five steps, while DPL’s direction-construction cost leaves it slower than simple warm-start controls.DPL one-step takes 248.4 seconds, including 65.99 seconds for direction construction.Source: §6.4 · p. 11, Figure 5 · p. 12

6.5 Cross-seed validation with frozen configurations

  • Across three paired seeds, direct DPL passes no gates, utility passes one, and warm starting passes none against both simple initializations.The configurations are frozen and each run is compared with its exact-seed retraining reference.Source: §6.5 · pp. 12–13

6.6 Tiny ImageNet: bounded external check and preprocessing insight

  • On Tiny ImageNet, DPL utility and warm starting do not fare better, while the direct comparison is inconclusive because preprocessing leaves both methods in a low-accuracy regime.This one-seed check is treated as an external implementation audit, not a second decisive test.Source: §6.6 · p. 14, Table 6 · p. 14

7 Takeaways and Recommendations

The recommendations emphasize role-matched controls, behavior relative to retraining, perturbation implementation audits, and complete procedure and cost reporting.

7 Takeaways and Recommendations

  • Match each proposed role to appropriate controls and align step counts, gradient evaluations, and total runtime.Examples include comparing direct forgetting with retraining and attack initialization with official, zero, random, or FGSM initialization when appropriate.Source: §7 · p. 14
  • Evaluate final behavior against retraining because forgotten examples under random deletion can remain predictable; treat immediate loss separation as diagnostic, not sufficient.Report absolute gaps in forget, retain, test, and membership-inference statistics, and use intermediate checkpoints to detect effects erased by later updates.Source: §7 · p. 14
  • Audit perturbation coordinates and transforms from gradient computation through application, and report label-target changes and numerical precision.Treat preprocessing as part of the predictor and keep transforms compatible across training, unlearning, retraining, and evaluation.Source: §7 · p. 15
  • Include influence-direction construction in runtime and report the checkpoints, data splits, direction settings, controls, metrics, and predeclared improvement threshold.The procedure should also identify membership-inference configuration and raw and applied perturbation norms.Source: §7 · p. 15

8 Limitations and Broader Impact

The study’s conclusions are bounded by approximate methods, a finite and potentially unstable influence solve, and a narrow evaluation scope. The reported results do not establish certified deletion or generalize beyond the tested settings.

Experimental scope

  • The experiments cover image classification with random 10% instance deletion; other deletion regimes and model types may behave differently.The Tiny ImageNet experiment uses a single source–forget pair, and a broader study is needed to characterize variability across initializations and deletion requests.Source: §8 · p. 15

Approximate unlearning

  • The accuracy and membership audits measure agreement with retraining but cannot establish complete removal of information associated with forgotten samples.Applications requiring formal deletion guarantees would need stronger auditing or certified mechanisms.Source: §8 · p. 15

Influence approximation

  • The tested influence solve is far from convergence, so the negative results apply to the released solver’s default direction, not necessarily a converged influence direction.The 20- and 80-iteration input directions have cosine 0.219, and three tested budgets are insufficient to draw conclusions about the converged limit.Source: §8 · p. 15

Tuning breadth

  • A wider search could favor DPL in utility and warm-start roles, where observed differences are small, but the direct-role gap to SalUn and AMUN is large.Several utility, warm-start, guide, candidate-set, and Tiny ImageNet hyperparameters were fixed rather than tuned for DPL.Source: §8 · p. 15

Implementation-specific evaluation details

  • Tiny ImageNet’s official evaluation omits source-training normalization, making its direct-role comparison inconclusive; exact online RMIA was also unavailable.The raw-forward-fixed variant applies source-training normalization before model forward, while exact online RMIA could not be reproduced without the 128-model reference matrix.Source: §8 · pp. 15–16

Broader impact

  • The experiments use standard image-classification benchmarks without newly collected personal data or human participants, and empirical scores should not be presented as proof of legal or semantic erasure.The authors recommend distinguishing deletion guarantees from behavioral audits and avoiding privacy claims based on implementation artifacts.Source: §8 · p. 16

9 Conclusion

The paper evaluates influence-derived data perturbations as a direct forgetting mechanism, a utility regularizer, and an adversarial-unlearning initialization. Across the reported tests, DPL does not reliably meet the matched role criteria, with conclusions bounded to the tested random-instance-deletion settings.

9 Conclusion

  • A mixed input-parameter derivative gives a local first-order direction for matching approximate retraining displacement, contingent on consistent perturbation coordinates.The study evaluates that direction in three roles: direct forgetting, retained-utility regularization, and adversarial-unlearning initialization.Source: §9 · p. 16
  • Direct DPL fails the matched direct-role gate in all three paired CIFAR-10 seeds, while utility regularization passes in one seed and warm starting beats neither simple initialization in any seed.The warm-start comparison includes direction-construction cost; the tested label perturbation produces no measurable float32 target change.Source: §9 · p. 16
  • The one-seed Tiny ImageNet check finds no advantage for utility regularization or warm starting, and inconsistent preprocessing makes its direct-role comparison inconclusive.The experiments concern random instance deletion and do not establish failure in other deletion regimes.Source: §9 · p. 16

A Additional Experimental Details

The appendix details matched baselines, diagnostic and external-check protocols, membership statistics, and the role-specific criteria and outcomes. The final role decisions use paired-seed validation and matched comparisons.

A.1 Baseline output organization

  • The matched codebase uses the same checkpoints, forget-index files, data splits, and evaluation entry points; each CIFAR-10 deletion request removes 5,000 of 50,000 training examples.The detailed mechanistic setting uses seed 1, with additional frozen validation at paired seeds (10, 10) and (100, 100); the wider aggregate lacks standard errors because combinations share checkpoints.Source: §A.1 · p. 19

A.2 Direct diagnostic configurations

  • The direct diagnostic sweep tested image-only, label-only, combined, and iterative perturbations, selecting the lowest-discrepancy completed checkpoint optimistically rather than as a held-out choice.Candidate and guide caps were 5,000, maximum CG iterations were 20, and the short-update learning rate was 0.003.Source: §A.2 · p. 19

A.3 Direction validation subsets

  • Immediate and short-update direction checks use fixed 1,024-example forget, retain, and test subsets, while direction construction uses the full 5,000-example guide and candidate sets.Positive and negative directions use the same saved diagnostic examples.Source: §A.3 · p. 19

A.4 Tiny ImageNet external-check protocol

  • The Tiny ImageNet check uses one source–forget pair and fixed DPL settings; its raw-forward-fixed AMUN arm adds source-training normalization before model forward.The official downstream path uses raw tensors, and exact online RMIA is omitted because the required 128-model reference matrix is unavailable.Source: §A.4 · p. 19

A.5 Membership statistics

  • SVC confidence and RMIA FT-AUC are compared with the exact retrained reference and included in average discrepancy, rather than interpreted monotonically in isolation.Source: §A.5 · p. 19

B.1 Direct role

  • No corrected direct-role configuration meets the gate requiring movement toward retraining while preserving accuracy and beating the matched AMUN discrepancy.The gate also requires positive forget-retain separation, retain accuracy of at least 99%, and test accuracy of at least 93.5%.Source: §B.1 · p. 20

B.2 Utility role

  • Utility regularization passes its frozen validation gate only for seed 10; seeds 1 and 100 fail, and the detailed seed-1 comparison loses retain accuracy and increases retain loss.The gate compares DPL with clean retained-data cross-entropy across forget accuracy, retain and test accuracy, a utility metric, and SVC confidence gap.Source: §B.2 · p. 20

B.3 Warm-start role

  • No DPL warm-start arm passes all original-sweep quality conditions, and no final-validation seed beats both official and FGSM initializations at the same step count.The final three-seed comparison uses strict raw-image coordinates; total runtime must include direction construction.Source: §B.3 · p. 20

C.1 Strict raw-space warm-start metrics

The strict raw-space table reports the three-step warm-start validation, with total time accounting for DPL direction construction.

C.1 Strict raw-space warm-start metrics

  • Table 7 compares three-step warm-start results in raw space; total time includes DPL direction construction, and RMIA FT-AUC is judged against the matched exact-seed reference.The statistic is reported directly rather than interpreted monotonically in isolation.Source: Table 7 · p. 20, §C.1 · p. 20

C.2 Direction alignment

The corrected directions align strongly across samples, but the fixed CG solve is not numerically converged. The diagnostics also show that label changes are below float32 resolution and that the warm-start comparison is not a strict raw-space threat-set study.

C.2 Direction alignment

  • Mean and median per-sample cosine were 0.653 and 0.659, respectively, and 99.7% of 1,024 corrected directions exceeded 0.5; the legacy comparison was unreconstructable.The legacy direction tensor and per-sample crop/flip metadata needed for a raw-coordinate pullback were not persisted.Source: §C.2 · p. 20, Table 8 · p. 21

C.3 CG stability

  • The fixed 20-iteration CG solve was not numerically converged; larger budgets changed the recovered direction without monotonically strengthening immediate forget-minus-retain loss separation.Longer-run cosines are diagnostics against the 80-iteration solution and were not used to reselect the final DPL configuration.Source: §C.3 · p. 21, Table 9 · p. 21

C.4 Reproducibility records

  • The manuscript archive records paired seeds, hashes, commands, and result files, but does not duplicate raw model checkpoints or the reference-model bank.The archived records include final-validation summary CSVs and audit, runner, status, and artifact-manifest files.Source: §C.4 · p. 21

D.1 Label direction statistics

  • At β = 0.007, the label perturbation produced zero measured target-coordinate change and zero target KL; at 4β, the largest change was approximately 1.06 × 10−8 and KL was no larger than 1.03 × 10−11.The full candidate label direction had ℓ2 norm 5.85818 × 10−4 and ℓ∞ norm 3.266986 × 10−5.Source: §D.1 · p. 21

D.2 Utility direction statistics

  • After normalization and raw-space application, the utility direction’s aggregate perturbation norms were ℓ1 = 1362.45, ℓ2 = 0.554, and ℓ∞ = 0.00273.It used 5,000 nonzero candidate perturbations; 0.118% of pixels were clipped below zero and 0.493% above one.Source: §D.2 · p. 21

D.3 Warm-start coordinate diagnostic

  • The DPL raw initialization had mean per-sample ℓ2 norm 2/255 = 0.007843, but normalized-tensor clamping inflated apparent post-projection distance, so the warm-start comparison is not a strict raw-space threat-set study.The same issue affected the FGSM path.Source: §D.3 · p. 21
Loading 2609.12313v1…