CoUn: Empowering Machine Unlearning via Contrastive Learning

We thank the reviewer for their constructive comments and for noting that our work is novel, challenging, simple, well-motivated, implements extensive experiments, is efficient, and provides intuitive visualization demonstrating effectiveness. We appreciate the acknowledgment that the introduction, technical method and experiment are easy to follow and that our approach can be integrated with other baselines for enhanced unlearning performance. Below, we address their specific questions.

$\textcolor{white}{f^{*}}$

Authors' response to Q1: We appreciate the reviewer’s observation. While our intention was to define all notations, including $R[\epsilon]$, we acknowledge that defining them solely through mathematical expressions may not have been sufficiently explicit. To improve clarity and facilitate understanding of the theoretical analysis, we will revise the manuscript to clearly and formally define all variables at their first occurrence. Specifically, as shown in Eq. (5), $R[\epsilon]$ denotes the probability that, when a sample is drawn from the dataset, the distance between the encoder representations of its two augmented views exceeds $\epsilon$. Thus, a small value of $R[\epsilon]$ indicates good alignment in the representation space.

$\textcolor{white}{f^{*}}$

Authors' response to Q2: We thank the reviewer for pointing this out.

1. $\mu_l$ denotes the center of class $C_l$. It is defined in Line 240, and $\mu_l^T$ refers to its transpose.

2. $\rho^{\text{max}}$ is defined in Line 245 as a function of $(\sigma, \delta)$, which characterize the data augmentation, as well as the threshold $\epsilon$. Intuitively, better alignment (i.e., smaller $R[\epsilon]$) and a sharper concentration of augmented samples (i.e., larger $\sigma$ for a given $\delta$) result in a lower value of $\rho^{\text{max}}$.

3. Following the reviewer’s suggestion, we will include the full proof of Theorem 1 in the appendix and explicitly clarify how quantities such as $R[\epsilon]$, $\rho^{\text{max}}$, and class means interact in the derivation. This will enhance the clarity and self-containment of the theoretical analysis.

$\textcolor{white}{f^{*}}$

Authors' response to Q3.1: In Line 243, we state that the feature extractor $f_{\theta_u}$ is an $L$-Lipschitz function. That is, for any input sample (whether from the retain or forget data), the inequality in Eq. (8) holds. This implies that $f_{\theta_u}$ is globally Lipschitz with constant $L$, and therefore the Lipschitz constant over the forget data (i.e., $L_u$) must satisfy $L_u \leq L$.

Moreover, as noted in Lines 644-648, training $f_{\theta_u}$ exclusively on the retained data encourages the function to vary more smoothly on those data. This indicates that $f_{\theta_u}$ exhibits greater stability and lower sensitivity on the retained data compared to the forgotten data. This leads to the inequality $L_r \leq L_u$.

Taken together, these observations support the bound $L_r \leq L_u \leq L$.

$\textcolor{white}{f^{*}}$

Authors' response to Q3.2: Regarding the reviewers suggestion about having experiments with "more data drops", we would like to refer the reviewer to Table 3 in our paper, where we repeated all experiments in Table 2 but with a 50% forget data ratio. Additionally, Figures 4 and 5 also present results for both 10% (left) and 50% (right) forget ratios. Moreover, Figure 6 demonstrates a sequential data removal, where 10% of the data is removed initially, followed by an additional 10% every 10 epochs, reaching up to 50% (i.e., 10% $\rightarrow$ 20% $\rightarrow$ 30% $\rightarrow$ 40% $\rightarrow$ 50%).

$\textcolor{white}{f^{*}}$

Authors' response to Q3.3: Regarding experiments related to class-wise forgetting, we would like to refer the reviewer to Section E.2, where we discussed the class-wise forgetting. In Table 5, we compare our method, CoUn, with state-of-the-art baselines under class-wise forgetting. Results demonstrate CoUn's competitive performance under class-wise forgetting.

$\textcolor{white}{f^{*}}$

Authors' response to Q3.4: We thank the reviewer for pointing the following out: "Table 1 only implement on CIFAR-10 with FT and Retrain baseline".

Following the reviewer’s suggestion and to further validate the robustness of our findings, we conducted additional experiments to include the missing baselines and we also conducted new experiments with another model architecture and dataset. These comprehensive results are presented in the Table below. These extended results will be reflected in the paper. As expected, CoUn yields predictions more aligned with the Retrain model compared to other baselines, further demonstrating that it better mimics the Retrain model in terms of classifying the forget samples based on semantic similarity.

Table: Predictions of forget 'truck' samples based on most semantically similar classes. The difference ($\Delta$) and the (best) average difference between each method and Retrain are reported.

We thank the reviewer for their constructive comments and for highlighting that our idea is relatively new, eliminates the constraint for forget data access, achieves good model utility, and inspires future research in privacy and security within ML. Below, we address their specific comments and questions.

$\textcolor{white}{f^{*}}$

Authors' response to Q1 & W1: We thank the reviewer for their suggestion. Our CoUn's objective function, CE + λ·CL, is designed such that the cross-entropy (CE) term preserves retain representations within their clusters, while the contrastive learning (CL) component pushes forget representations toward semantically similar retain clusters. Extending training allows the model to further refine these adjustments, reducing the average gap and improving unlearning performance. In contrast, shorter training may result in insufficient refinement, leading to suboptimal unlearning. In both cases the clustering of the retain representations will be preserved due to CE.

In response to the reviewer’s suggestion, we provide experimental results in the Table below, which show that reducing training time increases the average gap, while longer training improves it.

Additionally, we would like to clarify that the terms "excessive" and "insufficient" perturbation were used in reference to related works that directly modify model weights, which can lead to excessive or insufficient weight perturbation if not carefully controlled. For example, NoT [8] applies layer-wise weight negation. In contrast, CoUn does not directly perturb weights; instead, the CL component operates on the data representations. In our revision, we will explicitly clarify this distinction by referring to perturbation specifically in the context of weight perturbation. Lastly, in Figures 7 and 8 of the paper, we demonstrate that tuning the hyperparameters will enhance the effectiveness of our proposed CoUn, thus controlling the indirect weight perturbation via learning the new forget representation adjustments toward semantically similar retain samples.

Table: Average gap for CIFAR-10 and CIFAR-100 using ResNet-18 at different training epochs.

$\textcolor{white}{f^{*}}$

Authors' response to Q2 & W2: We thank the reviewer for pointing this out. In Table 2 of our paper, we provide results with tuned $\lambda$ for each experiment. Similarly, for all other baselines we tuned their hyperparameters to get the best performance. This is consistent with widely adopted practice in the literature where they report the outcome of an experiment after fine-tuning its hyperparameters.

Following the reviewer’s suggestion, we present results using a fixed λ=0.5 in the Table below. Although performance decreases with a fixed λ, careful tuning is standard practice. Recommended tuning ranges are provided in Appendix C.

Table: Performance comparison of CoUn when $\lambda$ is tuned per experiment vs $\lambda$ is fixed for all experiments.

$\textcolor{white}{f^{*}}$

Authors' response to Q3 & W2: In our reported computational cost, we followed the baseline works that have been published in top-tier conferences [8,9,10,11], focusing solely on training costs under final tuned hyperparameters. Consistent with standard practice in machine unlearning literature, we did not include hyperparameter tuning costs for either CoUn or baseline methods, ensuring fair comparisons. Our goal was to provide a fair comparison of the training cost under the best-known or officially recommended hyperparameter settings, as commonly done in the baselines.

$\textcolor{white}{f^{*}}$

Authors' response to Q4 & W2: Thank you for raising this point. When training without supervision, retain samples fail to preserve cluster structure, leading to cluster overlap and notable performance degradation. Furthermore, if the classifier layer is not trained alongside the feature extractor, then relying solely on contrastive learning (CL) being applied to the feature extractor, the classifier will become misaligned with the learned features. This dramatically reduces overall performance. For instance, an experiment (CIFAR-100, ResNet-18, 10% forget ratio) without supervision resulted in an average gap of 70.56, compared to 1.39 when using CE+λ·CL.

$\textcolor{white}{f^{*}}$

Authors' response to Q5 & W2: We thank the reviewer for this observation. In the unlearning literature [8,9,10], the transformation used for training the Original and Retrain models is $CHN$, and the same transformation is also applied to the baselines. Following this convention, we used $CHN$ for training the Original, Retrain, and baseline models. Since our proposed approach incorporates contrastive learning (CL), we explored the possibility of adjusting the transformation distribution specifically for the CL component. The results presented in Figure 9 are based on the experimental setup where both the Original and Retrain models were trained using the $CHN$ transformation. Therefore, the statement in Line 362 holds only under that specific setup. In our paper revision, we will explicitly clarify that this finding is specific to that experimental configuration.

We thank the reviewer for their valuable feedback. We are pleased they find our proposed method simple yet effective, presenting a clear performance improvement, and that the experiments are comprehensive. We also appreciate the reviewer's acknowledgment of our clear notations, figures, tables, and theorems, and that the paper is well-organized. Below, we address their specific comments and questions.

$\textcolor{white}{f^{*}}$

Authors' response to W1: We thank the reviewer for their suggestion. Following the reviewer’s suggestion, we have generated the t-SNE visualization for the Original model trained on the complete dataset (retain + forget data). This Original model serves as a starting checkpoint for both class-wise and random data forgetting scenarios; thus, its the same for both scenarios. We will add the t-SNE visualization of the Original model in the paper. Visually, this plot resembles Figures 1 or 3 (left) but with 10 clusters and no misclassifications. From another perspective, it also resembles the random forgetting scenario plots (right), again without misclassifications.

In response to the reviewer’s suggestion to provide a more rigid statistical comparison between forget representations and retain clusters, we grouped the forget samples by their true class labels and, for each group, computed the average Euclidean distance (L2) from its samples to all retain class centroids. This yielded a per-class distance profile showing how far forget representations lie from each retain cluster. To enable comparison across different models, we then applied normalization on each group’s averaged distances. The Table below summarizes the results for CIFAR-10, ResNet-18, and the statistics for 'truck' forget samples in a 10% random forgetting (same setup as Table 1 in our paper). The findings show that forget representations in CoUn are consistently closer to semantically similar retain clusters, and more importantly, CoUn achieves distance statistics that are closer to those of the Retrain model compared to other baselines. The smaller the distance means higher semantic similarity. From the Table below, we can see that 'truck' samples have the highest semantic similarity with 'automobile'. These results will be reflected in the paper.

Table: L2 distances of forget 'truck' to retain centroids. The most semantically similar clusters to 'truck' samples are presented. Experiments conducted using CIFAR-10 and ResNet-18. The difference ($\Delta$) and the (best) average difference between each method and Retrain are reported.

Furthermore, we kindly refer the reviewer to Table 1 in our paper, which presents part of the confusion matrix for forget samples under both forgetting scenarios, comparing predictions by the Retrain model (oracle) and our CoUn method. We can see that the predictions are based on semantic similarity. Smaller differences between their prediction distributions indicate better forgetting quality by CoUn. For example, Table 1 shows the top-4 predictions for forget samples labeled 'truck'. While Table 1 does not include the Original model or other baselines, we have conducted those evaluations and will include them in the paper. Below we show the top-4 predictions for the forget 'truck' samples. The Original model classifies all 'truck' forget samples correctly (100%) as expected, as it was trained on them. In contrast, Retrain and other methods (FT, NegGrad+, $\ell_1$-sparse, SalUn, NoT, CoUn), under random forgetting, predict most forget samples as 'truck', 'automobile', 'airplane', and 'ship', based on semantic similarity with retain clusters. CoUn consistently shows the smallest deviation from Retrain's predictions, highlighting its superior imitation of the Retrain model. To clarity, if a 'truck' forget sample is predicted as another label, then it means its representation was pushed toward a semantically similar retain cluster that is different than the forget's sample cluster; yet, if it is still predicted as 'truck', then it means the forget representation was pushed to a retain representation within the same cluster.

Table: Predictions of forget 'truck' samples based on most semantically similar classes. The difference ($\Delta$) and the (best) average difference between each method and Retrain are reported.

$\textcolor{white}{f^{*}}$

Authors' response to W2: We thank the reviewer for raising this point. Forget quality is typically assessed using forget accuracy: the drop in accuracy on forget data, and MIA (Membership Inference Attack) efficacy: how indistinguishable forget samples become from non-training samples.

In Figure 1 and Table 1, we showed that the Retrain model classifies forget samples into clusters of retain samples that exhibit the highest semantic similarity to them. Now, since in CoUn we push forget representations towards other retain representations that exhibit highest semantic similarity to them, this results in an unlearned model that imitates the behavior of Retrain model in classifying forget samples.

When forget samples are pushed into semantically similar retain clusters, this reduces their distinctiveness, making them behave more like non-training sample (improving MIA). At the same time, pushing forget samples away from their original clusters increases misclassification rates, thereby decreasing forget accuracy (or equivalently, increasing unlearn accuracy, defined as 1 - forget accuracy).

Therefore, improving forget quality involves increasing MIA efficacy and decreasing forget accuracy. Our CoUn method achieves this by imitating the Retrain model's semantic-based clustering of forget data, outperforming other methods without compromising utility.

$\textcolor{white}{f^{*}}$

Authors' response to W3: We thank the reviewer for the opportunity to clarify this point.

1. Our theoretical analysis aims to formally characterize this intuitive behavior and offer a provable foundation for reasoning about misclassification on forget data. Specifically, our analysis quantifies how feature representations learned from retain data fail to generalize to forget data. This helps ensure that forgetting is not only effective empirically but also theoretically justified.

2. We believe that theoretical analysis of the misclassification rate contributes to the overall assessment of unlearning performance. In particular, as mentioned in Lines 231–234, achieving a higher misclassification rate on forget data while maintaining a low misclassification rate on retain data supports both good forget quality and high model utility. A low misclassification rate on retain data indicates high retain accuracy, while a higher misclassification rate on forget data corresponds to lower forget accuracy and thus improved unlearn accuracy.

3. In fact, Table 2 does not indicate that "all other baseline methods have higher retain accuracy and lower forget accuracy" compared to CoUn. On the contrary, CoUn consistently achieves retain accuracy and unlearn accuracy (i.e., 1 - forget accuracy) closer to the Retrain model, which represents the ideal target performance.

$\textcolor{white}{f^{*}}$

Authors' response to W4: We acknowledge this variability, which aligns with results reported in [11] (NeurIPS 2024). For example, rankings among NegGrad+, $\ell_1$-sparse, and SalUn frequently shift across evaluations. In [11, Table 12] using CIFAR-10 and ResNet-18, the ranking based on average gap of methods differs across evaluations as follows:

• [11, Table 12a]: NegGrad+ < $\ell_1$-sparse < SalUn.
• [11, Table 12b]: $\ell_1$-sparse < NegGrad+ < SalUn.
• [11, Table 12c]: SalUn < NegGrad+ < $\ell_1$-sparse.

Similarly, [11, Table 10] shows:

• [11, Table 10a]: NegGrad+ < SalUn < $\ell_1$-sparse.
• [11, Table 10b]: NegGrad+ < SalUn < $\ell_1$-sparse.
• [11, Table 10c]: $\ell_1$-sparse < SalUn < NegGrad+.

We carefully tuned the hyperparameters for all baseline methods, including CoUn, to ensure they yield the best performance. Further, we compared all methods under equal computational budgets to ensure experimental fairness (see Figure 5).

$\textcolor{white}{f^{*}}$

Authors' response to W5: We kindly refer the reviewer to Figure 5 in our paper, where we demonstrated that CoUn consistently outperforms baseline methods under equal computational budgets. For clarity, we also include the Table below, which presents the exact percentage improvements from Figure 5 (at 50% forget ratio) under matched computational cost. This highlights that the contrastive learning component substantially improves performance without additional computational cost.

Table: Percentage improvement in Avg. Gap of CoUn and baselines relative to FT, under matched computational cost.

We thank the reviewer for their constructive feedback. We are pleased the reviewer finds our paper simple, supported by theoretical analysis, demonstrating effectiveness through experimental results, and acknowledges that our work advances an important topic. Below, we address their specific comments and questions.

$\textcolor{white}{f^{*}}$

Authors' response to W1: We thank the reviewer for the opportunity to clarify this point.

1. Indeed, evaluating machine unlearning methods requires metrics beyond accuracy alone, as accuracy matching alone does not guarantee genuine forgetting or GDPR compliance. We would like to emphasize that our evaluation follows standard practices established in recent machine unlearning literature (e.g., [8] @ CVPR 2025, [9] @ ICLR 2024, [11] @ NeurIPS 2024, [10] @ NeurIPS 2023). Consistent with these studies, we report Membership Inference Attack (MIA) alongside retain accuracy, unlearn accuracy, and test accuracy. The MIA success rate specifically measures how effectively forget data samples are identified as non-training in the unlearned model. Note: unlearn accuracy = 1 - forget accuracy. Importantly, our dataset is explicitly partitioned into retain and forget subsets. Since, we evaluate both retain and forget accuracies then accuracy matching can not happen due to unintended loss of retain data (i.e., "losing other information"), as this would lead to a drop in retain accuracy. However, our results show that retain accuracy is maintained, while forget accuracy drops, indicating that the loss of information is localized to the forget data. This pattern is further confirmed by the MIA scores, which consistently show reduced influence of the forget data post-unlearning.

2. We also concur that prediction-level comparison offers a finer-grained assessment of model behavior. Accordingly, please refer to Table 1 in our paper, where we incorporated prediction-level comparison metrics to evaluate alignment with the gold-standard Retrain and FT baseline. Additionally, we provide extended results in the Table below showing prediction-level comparisons for a single forget class across additional baselines and datasets. These results consistently demonstrate that CoUn achieves the lowest average prediction divergence compared to the gold-standard Retrain model. This supports our claim that CoUn effectively mimics the clustering behavior of the Retrain model with respect to forget data based on semantic similarity better than the baselines.

Table: Predictions of forget 'truck' samples based on most semantically similar classes. The difference ($\Delta$) and the (best) average difference between each method and Retrain are reported.

$\textcolor{white}{f^{*}}$

Authors' response to W2: We thank the reviewer for suggesting this potential area for exploration. While we agree that reconstruction-based evaluations may provide additional insights into data-specific forgetting, classification remains widely adopted in the top-tier machine unlearning literature [8,9,10,11].

Importantly, proper unlearning should not result in improved generalization (i.e., higher classification test accuracy). Although not explicitly reported in the main results, we confirm that the test accuracy of the Original model is higher than that of the Retrain model, as expected. This drop reflects the reduced training set used by the Retrain model (i.e., retain data only), which naturally leads to a decrease in accuracy. Moreover, even if removing some data allows a model to better utilize its capacity and improve performance on the remaining data, this benefit would apply equally to both the Retrain and the unlearned models—since both are trained without access to the forget data. Also, in unlearning evaluations, we focus on the relative difference between the unlearned model and the Retrain model, rather than absolute improvements in classification accuracy.

Introducing reconstruction-based metrics targeting specific samples could offer a complementary view of forgetting and is an interesting direction. Due to time constraint, we will explore and discuss this direction in future work.

$\textcolor{white}{f^{*}}$

Authors' response to W3: Even though contrastive learning (CL) is widely adopted, its application to machine unlearning remains novel. Our contribution lies in strategically integrating CL with supervised learning, utilizing only retain data to guide the unlearned model toward the behavior of the Retrain model through the lens of semantic similarity. Furthermore, our modular CL design allows easy incorporation into existing and future unlearning methods, enhancing alignment fidelity broadly.

$\textcolor{white}{f^{*}}$

Authors' response to W4: We thank the reviewer for raising this point. It is true that Theorem 1 is derived under the assumption that the feature extractor is trained using contrastive learning, and the classifier head is fine-tuned on a downstream task. However, when the feature extractor is trained using a combination of contrastive and supervised learning, the misclassification rate bound provided in Theorem 1 can still serve as a valid upper bound. Therefore, the inequality stated in Line 258 continues to hold, and our justification in Lines 257–262 remains applicable.

$\textcolor{white}{f^{*}}$

Authors' response to W5: We evaluate forgetting using two widely adopted metrics: unlearn accuracy: indicating model performance on forget data, and MIA: reflecting how effectively forget data is excluded from training. These metrics align with what recent top-tier unlearning literature [8,9,10,11] have used in their empirical evaluation. Detailed explanations of these metrics appear in Lines 48–52 and the Evaluation Metrics section.

$\textcolor{white}{f^{*}}$

Authors' response to W6: We would like to refer the reviewer to Figure 5 in our paper, demonstrating that under equal computational budgets, our CoUn method consistently and significantly outperforms baseline methods. The Table below provides exact improvements from Figure 5 (50% forget ratio) under matched computational costs, emphasizing CoUn's superior performance without additional computational expense.

Table: Improvement in average gap of CoUn and baselines relative to FT, under matched computational cost.

$\textcolor{white}{f^{*}}$

Authors' response to W7: We acknowledged this limitation explicitly in Appendix G (Limitations) of our paper. We stated that "our evaluation is limited to relatively small datasets (CIFAR-10/100, TinyImageNet). Future work could explore larger datasets like ImageNet." Additionally, [8] @ CVPR 2025 mentioned in their Limitations section that they evaluated on small datasets.

Moreover, our current experimental setup on CIFAR-10/100 and TinyImageNet aligns with [11] @ NeurIPS 2024, which used the same datasets (CIFAR-10/100 and TinyImageNet) for their experiments. Lastly, these datasets align to some degree with [8,10], which also evaluated on CIFAR-10/100. Thus, our dataset selection ensures that our evaluation setup is consistent with established benchmarks, enabling meaningful comparisons with state-of-the-art methods.

$\textcolor{white}{f^{*}}$

Authors' response to W8: We thank the reviewer for identifying this. We would like to note that the complete ViT model configuration is provided in our supplementary code (utils/model.py, Line 15): "patch_size=(4, 4), num_classes=num_classes, dim=512, mlp_dim=1024, dim_head=64, depth=6, heads=12, dropout=0.1, emb_dropout=0.1".

We acknowledge this omission in the paper and we will update it accordingly. Full training details appear in Lines 283-288 and in Appendix C. ViT-specific configurations for baselines, such as NoT, are mentioned explicitly (see Line 621). The ViT architecture file is included in our supplementary code, and we also cited the ViT paper (see Line 266).

$\textcolor{white}{f^{*}}$

Authors' response to W9: We would like to clarify that the work by [Lee et al.] is indeed cited in our paper as Reference [32]. We discussed, compared, and contrasted their approach in the Related Work section, with further detail provided in Appendix A. Moreover, we present in Table 4 a direct experimental comparison between CU [32] and our method CoUn, demonstrating that CoUn significantly outperforms CU.

$\textcolor{white}{f^{*}}$

Authors' response to W10: Thank you for highlighting this typo. We will correct it.