[1] Maini, Pratyush et al. “TOFU: A Task of Fictitious Unlearning for LLMs.” ArXiv. 2024.

[2] Liu, B. et al. “Continual Learning and Private Unlearning.” ArXiv. 2022.

[3] Zhang, Ruiqi et al. “Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning.” ArXiv. 2024.

[4] Fan, Chongyu, et al. "SalUn: Empowering Machine Unlearning via Gradient-Based Weight Saliency in Both Image Classification and Generation." ICLR. 2024.

[5] Liu, Jiancheng, et al. "Model sparsity can simplify machine unlearning." NIPS. 2023.

Thank you for your insightful comments, valuable feedback on our work, and constructive suggestions to help improve our presentation. We will address your concerns sequentially. Relevant tables and figures are included in the attached rebuttal PDF.

W1: Including results on other modalities.

Thank you for suggesting the addition of experiments on other modalities to demonstrate the broad applicability of our method. To verify the effectiveness of our method in the context of large language models (LLM) unlearning, we conduct experiments using the recently proposed TOFU[1] benchmark, compared with four baselines[2,3]. The TOFU dataset consists of fictional author biographies, along with questions and answers related to the authors' attributes. This dataset is instrumental in evaluating methods for forgetting data information in LLMs fine-tuned on it.

As shown in Tab.R1, our method achieves superior forgetting quality, making the unlearned model most indistinguishable from the retrained model based on the Truth Ratio distribution of the forget set while efficiently maintaining the model utility.

We will include this experiment of the NLP unlearning task in our Appendix, and we look forward to applying our method to more modalities, such as audio, in the future.

W2: Discussion on the metric (|FA-TA|).

We greatly appreciate your insightful observation that the results of the unlearned model on the 'forget' and 'test' sets should be very close. The metric |FA-TA| can indeed serve as an indicator of the effectiveness of forgetting in the random subset unlearning task of classification. Especially considering that |FA-TA| does not need to know the retrained model. However, |FA-TA| has certain limitations:

• It neglects the difference between the unlearned model and the retrained model.
• It has blind spots, as it might consider a randomly initialized model a good unlearned model because its |FA-TA|$\approx0$, despite the fact that such a model completely loses its utility.
• Narrowing it may not lead to Retrain in other unlearning tasks, such as class-wise or subclass forgetting, because |FA-TA| depends on the generalization capability to the unseen forget set.

Overall, we think |FA-TA| is a meaingful metric for MU but is not very distinguishable. To comprehensivly evaluate MU methods, we report the Avg.D and KL divergence in Tab.2, both of which compare with the retrained model. Our method is competitive or superior to previous methods in terms of |FA-TA| and constantly outperforms previous methods upon the overall difference and the output distribution KL divergence from the retrained model.

Minor W3: Comments on table presentation.

We sincerely appreciate Reviewer S1BA's meticulous review and constructive suggestions. We will add arrows to Tab.2 to enhance readability.

Q1: Considering the scenario of removing the influence of a single data point.

We do agree that the scenario of unlearning one data point is indeed practical. Our method can be directly applied to the task of forgetting a single data point without additional adaptation, as we do not make any assumptions to constrain the size of the forgetting set.

We did not consider 'removing one data point' in experiments because it is not a suitable setting for unlearning auditing:

• Previous literature[1,4] has shown that forgetting a single data point in deep models is a simple scenario to optimize, making it difficult to examine the performance differences of various unlearning methods.
• As the structure of datasets diversifies, a single sample may not be an appropriate granularity for unlearning.

Despite the above factors, following your suggestion, we conduct experiments under two setups to verify the effectiveness of our method in unlearning either a single data point or a task with suitable granularity:

• Randomly forgetting one sample in the classification task on CIFAR-10 (Tab.R3).
• Forgetting the relevant information of one author in TOFU benchmark (Tab.R1).

The results in Tab.R1 and Tab.R3 indicate that, under these two settings, our method and all baselines achieve effective forgetting while completely retaining general performance, making it challenging to demonstrate our improvements.

Q2: Discussion on the metric of accuracy disparities.

We do agree with your concern on 'accuracy disparity'. In fact, evaluating the effectiveness of an unlearning method remains an open question. Accuracy disparity used in previous literature [4,5], |FA-TA| as you suggested, and output KL divergence all can be used and also have their specific limitations. Although it is not easy to find a single metric, putting them all together, the advantage of our method is significant.

Q3: Why does 'R-only' cost longer time compared to 'SFR-on'?

The comparison on RTE in Tab.2 between 'R-only' and 'R-on' is fairer than with 'SFR-on' because the only difference between 'R-only' and 'R-on' is how the loss is optimized. 'R-only' combines and optimizes both forget and retain losses simultaneously, while 'R-on' uses our fast-slow weight method to alternately optimize the forget and retain losses.

'R-on' is faster than 'R-only' for two reasons (batch size set to $bz$):

• In each step, 'R-on' feeds the model with $bz$ samples from either the forget or retain set, while 'R-only' combines both the forget and retain sets for a total of $2bz$ samples. Although both perform one backward operation per step, the forward operation in 'R-only' costs longer time than in 'R-on'.
• Empirically, 'R-on' requires fewer steps than 'R-only' to achieve effective forgetting.

'SFR-on' adds two additional components to 'R-on'. These components are also designed with the consideration of computational efficiency, thus only slightly increasing the running time per step, and overall still less than 'R-only' (Tab.R5).

Thanks to authors for adequately addressing all the issues, therefore, I am raising my score to 7. Hope, you will find a space for the new experiments in the final version as they significantly bolster the paper.

Thank you for your valuable comments and noting that our method is attractive. We will address your concerns sequentially. Relevant tables and figures are included in the attached rebuttal PDF.

W1: Addressing imbalance in layer-wise changes for enhanced information removal.

There are some arguments[1] regarding the parameter changes across different layers for various unlearning settings. We wish to clarify that our approach does not rely on heuristic strategies based on different layer-wise changes. Instead, our Balanced Saliency Mask can adaptively identify critical parameters for updating, aligning with SalUn[2] that has been verified effective for efficient information removal (Fig.R1). We hope that our theoretical foundation and approach could inspire further improvements to gradient-based unlearning.

W2: Clarification on the range of models used in experiments.

There appears to be a misunderstanding regarding the diversity of models used in our experiments. We have explicitly demonstrated in the paper that for classification tasks, both ResNet18 and Swin-T are employed (Tab.2). For generative tasks, our method extends beyond DDPM (Tab.3 & Fig.2), and also includes Stable Diffusion, which 'caters to practical scenarios' as mentioned by Reviewer HvBU (Tab.4). Moreover, we pioneer class-wise unlearning using DiT (Tab.3 & Fig.3). In response to the other two reviewers, we expand our experimental scope to include large language models in unlearning tasks (Review HvBU Q & Review S1BA W1) to further validate that our proposed method is a unified MU approach for general setups.

W3: Ablation studies on SFR-on without repairing.

We conduct ablation experiments to assess the performance of our 'Sample-wise Adaptive Coefficient' and 'Balanced Weight Saliency' in the absence of repairing.

The results in Tab.R2 affirm that these components alone can still enhance the baseline performance. We will include this ablation to support the effectiveness of our components.

W4: Clarification on main contributions and advantage analysis.

We apologize for any lack of clarity in our presentation. We summarize our main contributions as follows:

• We unify previous gradient-based unlearning methods from the perspective of the steepest gradient descent with three parts.
• We propose an improved approximate MU measured in a remain-preserving manifold.
• We introduce a fast-slow weight method to implicitly approximate the Hessian-modulated salient unlearning direction.

Additionally, we would like to highlight the advantage analysis of our proposed method:

• Following Proposition 2, our findings indicate that our method leverages retained curvature information and focuses more on forgetting, thereby ensuring efficient unlearning while preserving model performance.
• In 'Comparison with the joint loss' of Sec.4, we analysis the gradients of our method with those of the conventional joint loss and demonstrate that our method can prevent the forgetting direction from excessively affecting retained performance.

Furthermore, we acknowledge in limitations (Appendix G) the absence of asymptotic analysis for our method on deep models. We look forward to future analyses that may inspire the community.

Q1: Specification of remaining dataset size used in experiments.

In our formulation, we define the retain set as the complement of the forgetting set within the entire training dataset (Sec.2). For classification tasks, we set the retain set to align with our formalization, according to previous works[2]. However, as discussed in Sec.4 (lines 282-286), this may be impractical for generative tasks. Therefore, we randomly sample an equal number of samples from the remaining dataset as an insufficient retain set. Our experiments show that we still can achieve effective unlearning under such settings.

Q2: Solution to the problem of demanding resources for calculating $(H_t^r)^{-1}$.

We agree with your concern regarding the substantial computational resources required to compute the Hessian inverse. To reduce this burden, we introduce fast-slow weight updates to directly approximate $(H_t^r)^{-1}\nabla\mathcal{L}^u(\theta_t)$, i.e., the Hessian-modulated unlearning direction (Proposition 3), which is actually one of our key contributions.

Q3: Little reductions in RTE compared with baselines in the classification task.

In Tab.2, our method does not show significantly lower RTE compared to baseline methods because the efficiency improvement for well-studied image classification tasks is marginal. However, in the more challenging generative forgetting tasks, our method exhibits a substantial reduction in RTE compared to SA and SalUn (Tab.R4).

Q4: The influences of approximation on practical implementations of Eqs.3,4,6.

We appreciate your attention to the influence of various approximations in practice. Next, we will illustrate these impacts on our propositions separately.

• Eqs.3,4:

  • Considering the approximations of $\nabla \mathcal{L}^r(\theta_0)$, $\nabla \mathcal{L}^r(\theta_*)$, and $\nabla R(\theta_t)$, we demonstrate in Fig.R2 their gradient norms under practical unlearning settings, which are consistent with our theoretical assumptions. In our method, $\nabla \mathcal{L}^r(\theta_0) \approx \nabla \mathcal{L}^r(\theta_*) \approx \nabla R(\theta_t) \approx 0$, allowing us to incorporate second-order information on the retain set. - For $\nabla C(\theta_t)$, the derivative of the Euclidean distance metric in Eq.3 is generally non-zero, while the derivative of the output KL distance in Eq.4 is strict zero rather than approximation[3].

• Eq.6:

  • We employ the proximal assumption of parameters near each updated model, verified by previous empirical observations[4].

We will include these observations in our Appendix to bolster our analysis.

[1] Goel, Shashwat, et al. "Towards adversarial evaluations for inexact machine unlearning." ArXiv. 2022.

[2] Fan, Chongyu, et al. "SalUn: Empowering Machine Unlearning via Gradient-Based Weight Saliency in Both Image Classification and Generation." ICLR. 2024.

[3] Martens, James. "New insights and perspectives on the natural gradient method." JMLR. 2020.

[4] Wu, Yichen, et al. "Meta Continual Learning Revisited: Implicitly Enhancing Online Hessian Approximation via Variance Reduction." ICLR. 2024.

Thank you for your positive feedback and valuable comments on our presentation and extensive experiments. In Appendix B, we have included Related Works to help readers understand the concept of Machine Unlearning and to introduce some previous unlearning methods. The relevant Tab.R1 is included in the attached rebuttal PDF. Below, we address your request to add experiments on large language models (LLMs):

Q: Adding experiments on more modalities such as LLMs.

As stated in Sec.4, our analysis and method are not limited by the model input modality. Therefore, our method can be seamlessly extended to other modalities beyond images, such as LLMs, to achieve efficient forgetting.

We conduct experiments using the recently proposed benchmark of TOFU[1] fine-tuned Phi-1.5[2] to evaluate the effectiveness of our method in the LLM unlearning task, compared with four LLM unlearning baselines: gradient descent(GA), gradient difference(GradDiff[3]), negative preference optimization(NPO[4]), and its enhanced version. The TOFU dataset comprises fictional author biographies, along with questions and answers related to the authors' attributes, which helps assess methods of data forgetting on fine-tuned LLMs.

As shown in Tab.R1, our method achieves superior forgetting quality, making the unlearned model most indistinguishable from the retrained model based on the Truth Ratio distribution of the forget set. Additionally, our method efficiently maintains the model utility.

We greatly appreciate your suggestion to include experiments on modalities beyond images. We will incorporate this experiment and details of the LLM unlearning task in our Appendix to broaden the scope of our work.

Reference:

[1] Maini, Pratyush et al. “TOFU: A Task of Fictitious Unlearning for LLMs.” ArXiv. 2024.

[2] Li, Yuan-Fang et al. “Textbooks Are All You Need II: phi-1.5 technical report.” ArXiv. 2023.

[3] Liu, B. et al. “Continual Learning and Private Unlearning.” ArXiv. 2022.

[4] Zhang, Ruiqi et al. “Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning.” ArXiv. 2024.