Adversarial Mixup Unlearning

Q2: Ablation in Controlling the Mixup Ratio

In the w/o MB ablation, we replace the hard mixup samples with vanilla mixup samples and control the mix ratio with different values of $\alpha$:

• $\alpha=0.35$: Produces mixup ratios skewed close to 1 (minimal mixing).
• $\alpha=1.5$: Generates mixup ratios centered near 0.5 (equal mixing).
• $\alpha=0.75$: Produces a broader range of ratios.

Among these, $\alpha=0.75$ consistently yields better results, likely due to its ability to generate diverse mixup samples. Here is the results:

We are glad to discuss more to address your concerns.

We appreciate the time invested in reviewing this paper, and thank you for the acknowledgment of the paper's novelty.

---

Q1: More Advanced Dataset and Model

• Experiments on ImageNet and ViT:

  • Additional experiments were conducted using the ImageNet dataset and the ViT architecture to evaluate performance under more challenging scenarios, including more classes and higher-resolution images.

  • These experiments included:

    • Quantitative results
    • KDE plot visualizations
    • Comprehensive time-cost analyses

  • The findings demonstrated that our model remains robust and highly efficient even with advanced datasets and models.

  • Quantitative Results for ImageNet and ViT: | Class-Level Unlearning | | | | Data-Level Unlearning | | | | | |--------------------------------------------|-------|-------|-------|-------------------------------------------|-------|-------|-------|-------| | Method | Test-r | Test-f | ASR | Method | Train-r | Train-f | Test | ASR | | Retrain | 78.17±1.88 | 0.00±0.00 | 35.66±2.13 | Retrain | 94.24±1.24 | 58.63±3.12 | 72.58±2.18 | 19.68±2.10 | | NegGrad | 67.24±1.49 | 2.01±0.42 | 28.46±1.99 | NegGrad | 73.82±2.01 | 28.75±1.45 | 35.97±2.13 | 16.34±1.45 | | SISA | 70.50±2.09 | 0.00±0.00 | 32.23±1.34 | SISA | 91.41±1.02 | 38.24±2.14 | 68.14±2.56 | 18.24±2.45 | | T-S | 76.88±1.98 | 25.90±2.45 | 30.46±1.01 | T-S | 92.52±1.34 | 75.77±2.09 | 70.09±1.42 | 16.96±2.34 | | DSMixup | 68.88±3.02 | 0.00±0.00 | 25.41±2.23 | DSMixup | 89.45±1.86 | 76.14±2.67 | 65.14±1.46 | 17.42±2.34 | | GLI | 74.78±2.14 | 30.41±3.14 | 31.69±2.31 | GLI | 90.78±1.44 | 69.24±1.64 | 68.14±1.75 | 17.89±1.34 | | SCRUB | 76.45±0.96 | 24.08±2.97 | 29.06±3.67 | SCRUB | 92.67±1.35 | 76.41±2.13 | 69.31±2.64 | 17.24±2.14 | | LAF+R | 76.47±1.67 | 23.25±3.98 | 30.18±1.23 | LAF+R | 91.01±1.71 | 87.13±0.97 | 75.64±3.67 | 17.97±1.96 | | Ours | 76.91±1.84 | 1.51±0.37 | 33.12±1.57 | Ours | 92.89±1.11 | 68.27±2.13 | 74.23±0.75 | 18.98±1.75 |

  • Further visualizations and time-cost analyses can be found in Section A11 of the revised paper.

---

• Computational Cost Analysis:
  • Our method maintains a superior rank while delivering better performance compared to state-of-the-art methods.
  • Key aspects of computational efficiency:
    • The number of outer iterations for unlearning remains fixed, regardless of model size or image resolution.
    • Increasing model size or image resolution only impacts per-image processing time, not the total iteration count.
  • This ensures scalability, as computational overhead grows primarily with individual image complexity rather than iteration counts. It underscores our model's scalability and efficiency, securing its superior rank among unlearning solutions.

Dear Reviewer KJXn,

We sincerely appreciate the time and effort you have invested in reviewing our work. If there are any specific areas where further clarification or additional details would enhance your understanding, please do not hesitate to let us know.

Thank you once again. We wish you all the best!

Sincerely,

The Authors

Q5: Convergence of the Model? Why is the Testing Accuracy of the Model Higher Than the Training Accuracy?

These questions are centered around model convergence. Below are our explanations and clarifications:

1. We prove Model Convergence

   • We assign different numbers of epochs to the initial model and the retrained model to ensure convergence. Our hypothesis is that the initial model, having more data points for gradient calculation, converges more robustly and faster. To account for this, we assign fewer epochs to the initial model.
   • The corresponding learning curves are included in Appendices A2 and A3.

2. Testing Accuracy Higher Than Training Accuracy is possible

   • Observing higher testing accuracy compared to training accuracy is not uncommon, especially when data augmentation and regularization methods (e.g., dropout) are applied.
   • In our case, we use data augmentation for CIFAR and SVHN datasets, which prevents overfitting to the training data. Consequently, the testing accuracy is consistently higher than the training accuracy.
   • This explanation is included in Appendix A2. Additional evidence supporting this phenomenon can be found in the following references:
     • Official Reply in Google Research
     • Stack Overflow Discussion
   • To further validate, we tested the impact of removing data augmentation, which resulted in training accuracy exceeding testing accuracy but poorer overall model performance.

3. Regarding the Question on Convergence and Fine-Tuning

   • We have demonstrated model convergence; hence, this is no longer a concern. All unlearning methods begin with a "well-trained" model, ensuring a fair starting point.

---

We are confident in addressing your comments and are happy to discuss further to resolve any additional concerns.

Q4: Lack sufficient explanation of hyperparameters? Experimental workload is low? The setup of the T-S model?

• Reproduced Results:
  We have utilized our reproduced results for evaluation. Significant efforts were made to ensure critical evaluation of the open benchmark. Before the initial submission, we reproduced all benchmark results rather than solely relying on cited experimental results from the existing benchmarking in the ICLR 24' paper [3]. In the revised paper, we now use all our reproduced results (which only affect some baselines but retain similar findings). These reproduced results closely match open benchmarks, except under noisy label conditions, where we provided specific findings. The steps taken during the initial submission and this revision include:

  1. Reproducing open benchmark results with thorough parameter tuning before the initial submission.
  2. Reporting results from reproduced noisy label setups, noting observed differences.
  3. Introducing stronger baselines, such as RandLabel and L-Mix, for robust comparisons.
  4. Extending evaluations to include methods like DSMixup and GLI.
  5. Incorporating additional evaluation settings, such as semi-supervised scenarios.

  Full details of the parameter search for baselines and reproduced results are available in Section 5.4.

• Setup of T-S Model (Note that We use Extended One):
  The original T-S paper [1] has discussed using an additional trained model as a teacher (e.g., using a partially re-trained model as a teacher). The ICLR 24' paper [3] extends this concept by using a trained model to explore forgetting and retention. We tested both the simplest setup of T-S and the advanced setup in the ICLR 24' paper. Our findings show that the latter performs better, and we aligned our experiments accordingly. The revised paper now includes more detailed discussions about this extension. Additionally, we are willing to release our implementations for clarity.

• Code Release:
  We are glad to release our code to ensure transparency in evaluation.

Reference:

[1] Chundawat V S, Tarun A K, Mandal M, et al. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2023, 37(6): 7210-7217.

[3] Shen, Shaofei, et al. "Label-Agnostic Forgetting: A Supervision-Free Unlearning in Deep Models." The Twelfth International Conference on Learning Representations.

Q3: Description of Epochs for Unlearning? How to Terminate Unlearning?

• We have included the number of unlearning epoch in the revised paper. Thank you for your suggestion.

• How to terminate unlearning remains an open question as future research, and is out of the scope of our work. In our work, we employ the common practice [1][2][3] of terminating the unlearning process with a fixed epoch number. Each method is allocated the same unlearning epoch budget, and we verify that the training loss has converged during this process. In our experiments, baseline methods are allocated a total of 40 unlearning epochs. Additionally, we monitor the training loss to track the progression of unlearning.

  Determining an optimal strategy for terminating unlearning is an unresolved challenge in the field. Unlike traditional learning processes, which often rely on validation sets for early stopping, unlearning lacks a standardized approach for effective termination. Key questions include:

  • Should termination depend on metrics like training loss before unlearning ($Train_r$), training loss after unlearning ($Train_f$), test loss, or the attack success rate?
  • Could a weighted combination of these metrics provide a more robust criterion?

  For now, we adopt the straightforward approach of setting a fixed unlearning epoch budget. Addressing the broader question of effective termination strategies in unlearning processes remains a promising avenue for future research. The discussion for criteria for terminating has been included in Appendix A3.

  Note: We do monitor the model's loss curve as a basic manner to ensure convergence during unlearning.

---

References

[1] Chundawat, V. S., Tarun, A. K., Mandal, M., et al. Can bad teaching induce forgetting? Unlearning in deep networks using an incompetent teacher. Proceedings of the AAAI Conference on Artificial Intelligence, 2023, 37(6): 7210-7217.

[2] Choi, D., Choi, S., Lee, E., et al. Towards Efficient Machine Unlearning with Data Augmentation: Guided Loss-Increasing (GLI) to Prevent the Catastrophic Model Utility Drop. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024: 93-102.

[3] Shen, S., et al. Label-Agnostic Forgetting: A Supervision-Free Unlearning in Deep Models. The Twelfth International Conference on Learning Representations.

Q2: The Experiments Are Not Sufficient? Now We Have More Evaluation Results.

Thank you for your constructive suggestions. We have incorporated more thorough experiments to evaluate our method. Specifically, we have:

• Expanded data ratio setups: We evaluated our method under varying data ratio setups. The takeaway is that our method is robust across these setups. Appendix A 10 presents a series of experiments about data ratio.

• Experiments on ImageNet and ViT:

  • Additional experiments were conducted using the ImageNet dataset and the ViT architecture to evaluate performance under more challenging scenarios, including more classes and higher-resolution images.
  • These experiments included:
    • Quantitative results
    • KDE plot visualizations
    • Comprehensive time-cost analyses
  • The findings demonstrated that our model remains robust and highly efficient even with advanced datasets and models.

Quantitative Results for ImageNet with ViT

Further visualization and time-cost analyses can be found in Section A11 of the revised paper.

We thank you for your comments and interest in our work. We have taken your suggestion into account when revising our paper. However, we must clarify some misunderstandings that may affect the scoring of our paper.

Q1: Can our method assure precise unlearning? (We avoid using "complete unlearning" as we cannot clearly define its meaning and it is not a widely-used term)

There is a misunderstanding here. Let us clarify two points:

1. Our method does not violate the principles of approximate unlearning
   Our paper focuses on approximate unlearning, which aims to forget data from a well-trained model. Leveraging forgetting information to facilitate unlearning is a common practice in this domain (leveraging forgetting data does not necessarily mean embedding them into the model). For example, approximate unlearning methods like NegGrad, Boundary, and T-S all require the forgetting data as input. Therefore, our method does not violate the principles of approximate unlearning.

2. MixUnlearn advances approximate unlearning towards more precise unlearning
   Contrary to your point about "undermining complete unlearning", MixUnlearn enhances approximate unlearning by achieving a higher degree of precision.

   Let's consider the example from our motivation: What would an ideal solution look like for unseen data?

For an unseen sample, the ideal outcome is for it to retain only the knowledge derived from the remaining data while forgetting what it should forget from the removed (or forgetting) data. This aligns with the notion of "complete unlearning" you referenced.
The goal of MixUnlearn is precisely this: ensuring that an unseen sample forgets information tied to forgetting data while preserving generalizability based on the remaining data. Please refer to Figure 1 (where unseen samples only benefit from the remaining data) and Eq. 5 for a clearer understanding of the aim and mechanisms of MixUnlearn.

Dear Reviewer zx2Z,

We sincerely appreciate your insightful comments on MixUnlearn and are grateful for the opportunity to address your concerns. We understand that our rebuttal may require some of your valuable time, so we have provided a brief summary of the key points addressed in our response:

1. Clarification of MixUnlearn’s Contribution: We illustrate that MixUnlearn effectively advances approximate unlearning toward a more precise unlearning solution.
2. Additional Experiments: We have added data ratio experiments, as well as new experiments on ImageNet using the Vision Transformer (ViT), including not only quantitative results but also visualizations and efficiency analysis.
3. Unlearning Termination Process: We clarify the methodology used to determine when unlearning is complete.
4. Reproducibility of Results: We have revisited our results back to our reproduced ones, and clarified how the T-S baseline was set up in our experiments.
5. Convergence Evidence: We provide additional evidence demonstrating the convergence behavior of both the initial and retrained models.

We hope these updates address your previous concerns effectively. Please let us know if any points still require further clarification or if you would like more detailed information.

Thank you once again for your thoughtful feedback.

Kind regards,
The Authors

As we approach the final day of the discussion phase, we would like to make one last effort to address the misunderstandings raised regarding our paper. Below, we provide clarifications on several key points:

• Clarification on the Common Practice of Unlearning:
  The incorporation of "forget" data to facilitate unlearning (without embedding them into the model), such as in the well-established NegGrad method, is a standard practice. Our method does not violate the principles of unlearning. In fact, it achieves more precise unlearning by ensuring that unseen samples retain generalizability from the remaining data, while not benefiting from the "forgotten" data.

• Clarification on Model Convergence:
  The initial model used in our evaluation was validated for convergence. The observation that "test accuracy exceeds train accuracy" is a common phenomenon in datasets such as CIFAR-10 and SVHN.

• Clarification on Workload:
  We have provided reproduced results from our own experiments. Our intention was to avoid any potential discrepancies between our benchmarking results and previous ones, although the differences are minimal. Additionally, the use of T-S is simply an extension of the methodology discussed in the original paper.

• Clarification on Unlearning Termination:
  We adhere to standard practices for unlearning progression. However, we also introduce a new discussion on the termination of unlearning. This is still an open question, and while relevant, it lies outside the scope of our paper.

• Incorporation of Additional Experiments:

  1. We present results demonstrating the performance of our method across different data ratios.
  2. We also provide new experiments on more complex datasets and models, such as ImageNet and Vision Transformers (ViT).

We still want your valuable response for this rebuttal. We hope these clarifications help you reconsider the contributions and validity of our paper. We sincerely appreciate the time and effort you have dedicated to reviewing our work.

Thank you for your appreciation in the novelty our MixUnlearn. We deeply appreciate your constructive feedback, which has helped us enhance the quality of our work.

Q1: More Advanced Dataset and Model

We conducted additional experiments using the ImageNet dataset and the ViT architecture, targeting more challenging scenarios with more classes and higher image resolutions. These experiments include quantitative results, KDE plot visualizations, and comprehensive time-cost analyses. The findings demonstrate that our model remains robust and highly efficient, even with a more advanced model and a challenging dataset.

Quantitative Results

We recommend referring to Section A11 in the revised paper for further visualisation and time cost analysis.

---

Q2: Why MixUnlearn Sometimes Demonstrates Better Performance than Retrain (e.g., on CIFAR-10)?

This arises from the fact that the unlearning algorithm starts from a well-trained model with better generalizability compared to the retrained model. For instance, a well-trained CIFAR-10 classifier typically outperforms a retrained model trained on a smaller dataset (due to the removal of forgetting data).

Considering the transition from high to low generalizability during unlearning, the algorithm may retain better generalizability than a retrained model due to imperfect forgetting. This underpins our claim that "Close to Retrain is Better." Importantly, our model exhibits behavior that is closest to retraining among existing solutions.

We are glad to provide more results to address your concerns.