Risk-Aware Output Control Should be the Focus of Machine Unlearning

1 Introduction

• Harmful or sensitive training content can lead deployed models to reproduce those pathologies in their outputs, motivating machine unlearning.The paper notes that broad web scraping by large generative models has increased the inadvertent collection of private and sensitive information.Source: §1 · p. 1
• Full retraining is often computationally prohibitive, and owners may no longer have access to the original corpus, prompting efficient deletion procedures without retraining.The paper identifies these constraints as the reason for formalizing machine unlearning.Source: §1 · p. 1
• The paper argues that unlearning should be defined and certified by statistical guarantees on deployed-model outputs, not parameter-space indistinguishability from a retrained reference.Deployed models operate as input–output systems, while internal states provide limited evidence about user risk without output-level analysis [30] [15].Source: §1 · p. 2
• Parameter-level guarantees do not ensure desired behavior, so methods often benchmark against a retrained model—the computation unlearning was meant to avoid.The paper calls instead for interpretable, quantifiable statements about risks such as harmful outputs or private-information leakage.Source: §1 · p. 2
• Indistinguishability certificates can be fabricated even when no unlearning occurred, and matching a retrained model does not guarantee harmful or forgotten outputs are absent.The cited examples include copyrighted content reproduced without explicit training and forgotten points appearing in conformal prediction sets [22], [1, 53].Source: §1 · p. 2
• The paper advocates output-control frameworks that avoid reliance on retrained baselines and provide precise, interpretable, operationally meaningful guarantees.It does not claim to offer a comprehensive redefinition of unlearning.Source: §1 · p. 2

2 Preliminaries

• The paper adopts supervised learning for exposition, using scalar labels while noting that the discussion extends to vector-valued or structured outputs.The setup defines data, models, and training algorithms; for the non-convex losses and deep architectures considered, the trained parameter estimate is an approximate stationary point.Source: §2 · p. 3
• Split conformal prediction partitions labeled data into proper training and calibration sets, then uses calibration scores to form a prediction set with finite-sample coverage.The method is presented as model-agnostic and distribution-free, with coverage at a user-chosen level [2] [28].Source: §2 · p. 3
• The coverage guarantee holds when the test pair is exchangeable with the calibration data conditional on the training set.The stated probability includes randomness in calibration data, the test pair, and any stochasticity in the model and score.Source: §2 · pp. 3–4
• The paper presents split conformal prediction’s user-tunable probability of a desired event as a template for output-level unlearning guarantees.This template is proposed as an alternative target to parameter-level indistinguishability.Source: §2 · p. 4

3 Machine Unlearning Problem Definition

• The training set is partitioned into retain and forget sets; for an identifiable subpopulation, the forget distribution is the corresponding conditional distribution.The paper uses these distributions to describe retained and forgotten regions of the input-label space.Source: §3 · p. 4
• An unlearning algorithm maps the original model, retain and forget sets, and algorithm-specific hyperparameters to a model that preserves retain influence while suppressing forget influence.The chosen unlearning criterion specifies what that behavioral requirement means.Source: §3 · p. 4
• The retraining baseline reinitializes training using only retained data, discarding the original model and forgotten data, and is treated as the de facto gold standard.By construction, the resulting model is independent of both the original model and the forget set.Source: §3 · p. 4
• A dominant criterion requires the unlearned model and retraining algorithm to be indistinguishable, bounding their probabilities of returning any measurable model-set outcome in both directions.The inequalities include additive δ and multiplicative e^ϵ terms, with probabilities over algorithm randomness.Source: §3 · p. 4
• The paper argues that making the retrained model the unquestioned target reduces unlearning to approximating that baseline and is limiting and ill-posed.A cited variant instead bounds information carried by inputs about model outputs relative to the retrained model [62].Source: §3 · p. 4

• Gradient-clipping’s certified proximity to RT still yields a different forgotten-image saliency map; small weight perturbations also change accuracy and predictions.Source: Figure 1 · p. 5, §4 · p. 5, Table 1 · p. 6
• Parameter-space proximity is neither necessary nor sufficient for behavioral equivalence, even in smooth, practical architectures.Source: §4 · p. 5
• An owner can forge an unlearning proof by presenting an update history identical to one produced using the supposedly forgotten data [58].Source: §4 · p. 6
• Improving indistinguishability or using a trusted certifier cannot repair the flaw that the retrained reference itself may exhibit undesired behavior.Source: §4 · p. 6
• Retrained models can still generate copyrighted imagery or produce conformal prediction sets covering points excluded from training [29] [22].Source: §4 · p. 6
• The proposed pivot is output control with statistical guarantees, alongside a separate line of work on parameter-level robustness against sample reconstruction.Source: §4 · p. 7

5 Our Position: Output Control Yields Operationally Meaningful Machine Unlearning

• Learn-then-test provides model-agnostic, distribution-free control of user-chosen risks, supporting statistical guarantees beyond any single output metric.False-discovery-rate control, risk control, and conformal coverage are cited as templates for probabilistic guarantees.Source: §5 · p. 7
• Output-control unlearning requires high admission on retained data and low admission on forgotten data, without requiring proximity to a retrained model.The grading function can encode application-specific risks, including bias, toxicity, hallucination, copyright infringement, and privacy leakage.Source: §5 · pp. 7–8
• Conformal unlearning specializes output control to prediction-set coverage, requiring controlled coverage on retained and forgotten data.The paper identifies this as a canonical instance, building on prior conformal-unlearning work.Source: §5 · p. 8
• With only a finite sample from the forget distribution, jointly meeting retain and forget requirements is non-trivial; mapping every forget input to a fixed output can also make those inputs identifiable.The paper notes that a retrained model can show essentially no coverage change on the forget set despite a significant accuracy drop.Source: §5 · p. 8, Table 2 · p. 8
• Membership inference can be treated as a binary-label risk and controlled at a user-specified level.The MIA conformal ratio measures the fraction of forgotten points whose membership is miscovered by a binary conformal prediction set [53].Source: §5 · p. 8
• The framework makes its targets actionable through user-readable retain and forget admission-rate bounds rather than distance from a reference model.The stated targets are a retain admission rate of at least 1 − α and a forget admission rate of at most 1 − β.Source: §5 · p. 8

6 The Picture that Emerges

• Output-level guarantees target predictive behavior directly, avoiding the mismatch between parameter-space distance and model outputs.The guarantees can be audited using a labelled test stream from retain and forget distributions, rather than a training-trajectory proof.Source: §6 · p. 9
• Output-control definitions avoid retrained references, so a model fails if it admits forbidden outputs too often, regardless of a retrained model’s behavior.This also removes reliance on a reference whose behavior may not reliably indicate the absence of undesired outputs.Source: §6 · p. 9
• Output control and parameter-level robustness address different goals: deployed behavior on one side, and preventing reconstruction or inference of training samples from weights on the other.The paper describes the two lines of work as necessary and complementary.Source: §6 · p. 9

7 Objections to Output Control

• Output-level guarantees alone may not meet legal standards that require personal-data non-use, so parameter-level robustness remains relevant to provenance requirements.The paper frames provenance as a complementary concern, not a replacement for output control.Source: §7 · p. 9
• Output control requires specifying a grading function in advance, making the target harm explicit and allowing guarantees to be tailored to the application.The paper contrasts explicit risk specification with indistinguishability’s purported risk-agnosticism.Source: §7 · p. 9
• Exchangeability between calibration and deployment data can fail under adversarial probing of the forget set.The paper describes this limitation as methodologically manageable using shift-robust, non-exchangeable conformal prediction, or conformal risk control under distribution shift [48] [59] [28] [25].Source: §7 · p. 9

8 Conclusion

• The paper concludes that output control with actionable statistical guarantees should replace retrained-model indistinguishability as the focus of machine unlearning.It presents Definition 2 and conformal prediction as evidence that output-level guarantees are achievable.Source: §8 · p. 9

A Related Work

• Exact methods include shard-based retraining such as SISA and rollback of training updates, but typically require a specific training procedure and do not apply to pretrained foundation models.Related work also describes a similar shard-based approach for random forests [13] and exact k-means unlearning [31].Source: A Related Work · p. 14
• Approximate methods seek to mimic retraining, but most use heuristic proxies rather than certified indistinguishability guarantees.Some certified methods exist, including approaches for non-convex losses [39], strongly convex losses [36] [18] [7], and controlled additional training steps [45].Source: A Related Work · p. 14
• Prior conformal work defines unlearning through prediction-set coverage and miscoverage, while identifying fake unlearning in which forgotten points remain covered after retraining.The paper positions its broader output-level reformulation as a call to make such objectives a starting point for the field.Source: A Related Work · p. 14

B.1 First-layer sign-flip perturbations

• Five pretrained vision models were tested on 5,000 ImageNet validation images with sign flips confined to first-layer parameters, selecting the largest relative distance ≤2%.The sweep varied the sign-flip probability; accuracy drop compares original and perturbed top-1 accuracy, while disagreement measures changed top-1 predictions.Source: §B.1 · pp. 14–15

B.2 Copyright-infringing SpongeBob images

• CommonCanvas-XL-C, trained on licensed photographs without SpongeBob imagery, still reconstructs signature features, plausibly through generalization from shared visual features in licensed images.The examples use 512×512 images generated with DPMSolverMultistep for 35 steps.Source: §B.2 · p. 15

B.3 Harry Potter prompts

• Two oblique prompts elicited Harry Potter-specific knowledge: the model recovered Quidditch and Quaffle but misattributed the sport, then supplied Beauxbatons instead of declining.Both responses were produced by greedy decoding with seed 42.Source: §B.3 · p. 15

C.1 Extra results: noise perturbation

• At a decrease of at least ten percentage points, the smallest σ was 10−3 for ResNet-50, 2×10−3 for RepVGG-A2, 10−2 for ViT-B/16 and ConvNeXt-T, and 2×10−2 for EffNet-B0.Table 4 reports top-1 accuracy before and after i.i.d. Gaussian noise, with σ ≤0.02.Source: Table 4 · p. 16, §C.1 · p. 16

C.2 Extra generative examples

• CommonCanvas-XL-C produces recognizable Spider-Man, Mickey Mouse, Darth Vader, and Iron Man depictions despite its corpus containing no copyrighted imagery of those characters.Generations use DPMSolverMultistep for 35 steps; Fig. 6c is 768×768, while the others are 512×512.Source: §C.2 · p. 16, Figure 3 · p. 16, Figure 4 · p. 17