Towards Making Systems Forget with Machine Unlearning
Open accessAbstract
Today's systems produce a rapidly exploding amount of data, and the data further derives more data, forming a complex data propagation network that we call the data's lineage. There are many reasons that users want systems to forget certain data including its lineage. From a privacy perspective, users who become concerned with new privacy risks of a system often want the system to forget their data and lineage. From a security perspective, if an attacker pollutes an anomaly detector by injecting manually crafted data into the training data set, the detector must forget the injected data to regain security. From a usability perspective, a user can remove noise and incorrect entries so that a recommendation engine gives useful recommendations. Therefore, we envision forgetting systems, capable of forgetting certain data and their lineages, completely and quickly. This paper focuses on making learning systems forget, the process of which we call machine unlearning, or simply unlearning. We present a general, efficient unlearning approach by transforming learning algorithms used by a system into a summation form. To forget a training data sample, our approach simply updates a small number of summations -- asymptotically faster than retraining from scratch. Our approach is general, because the summation form is from the statistical query learning in which many machine learning algorithms can be implemented. Our approach also applies to all stages of machine learning, including feature selection and modeling. Our evaluation, on four diverse learning systems and real-world workloads, shows that our approach is general, effective, fast, and easy to use.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Cao et al.'s scheme has low applicability because only a few machine learning algorithms can be implemented as statistical query learning.
“However, since the summation form comes from statistical query (SQ) learning, and only a few machine learning algorithms can be implemented as SQ learning, such as naïve bayes classifiers [83], support vector machines [84], and k-means clustering [85], this scheme has low applicability.”
From Machine Unlearning: A Survey (2024) · cites this paper as [29]
The Machine Unlearning section says many algorithms—including naïve Bayes classifiers, support vector machines, and k-means clustering—can be implemented as SQ learning and describes the approach as general. The Adaptive SQ Learning section says very few practical learning algorithms cannot be converted to its adaptive SQ form. These passages contradict the claim that only a few can be implemented and that this makes the scheme minimally applicable. (LLM, conf=0.92)
Checked by a reasoning model — may be wrong.
Experimental — accuracy not yet measuredThe unlearning schemes proposed in References [29, 30, 33, 47, 68, 69] are essentially based on a retraining mechanism that naturally has a verifiability property.
“The unlearning schemes proposed in References [29, 30, 33, 47, 68, 69] are essentially based on a retraining mechanism that naturally has a verifiability property.”
From Machine Unlearning: A Survey (2024) · cites this paper as [29]
The “B. Machine Unlearning” section explicitly describes the proposed approach as unlearning “without retraining from scratch”: it subtracts the forgotten data from stored summations and updates the model. The “C. Empirical Results” section compares unlearning with retraining to evaluate completeness, but that does not make retraining the mechanism on which the scheme is based. No page numbers are available in our copy. (LLM, conf=0.88)
Checked by a reasoning model — may be wrong.
Experimental — accuracy not yet measuredBecause contexts are human-interpretable, ACE enables selective unlearning.
“because contexts are humaninterpretable, ACE enables selective unlearning”
From Agentic Context Engineering: Evolving Contexts for Self-Improving Language Models (2025) · cites this paper as Cao & Yang, 2015
In “The Need for Systems to Forget” (page unavailable), the paper describes forgetting select data and letting users specify data to forget at different levels of granularity. That supports selective forgetting in general, but our copy does not identify ACE or say that human-interpretable contexts enable its selective unlearning. (LLM, conf=0.78)
Experimental — accuracy not yet measuredData replacement methods can reduce computational overheads and make unlearning operations more efficient.
“Consequently, computational overheads are reduced, and unlearning operations are more efficient.”
From Machine Unlearning: A Survey (2024) · cites this paper as [29]
The Unlearning Work Flow section says the approach removes a sample’s contribution from stored summations and updates the model, making it faster than retraining. This supports the efficiency claim, but the paper does not describe the approach as a data replacement method. (LLM, conf=0.86)
Experimental — accuracy not yet measuredThe potential difficulty of removing memories that are tightly integrated into an LLM is demonstrated by the body of work done on 'machine unlearning'.
“The potential difficulty of removing memories that are tightly integrated into an LLM is demonstrated by the body of work done on 'machine unlearning' [114]-[116], [124][126].”
From Episodic Memory in AI Agents Poses Risks that Should be Studied and Mitigated (2025) · cites this paper as [124]
Section B, “Machine Unlearning,” calls making learning systems forget one of the most difficult challenges and explains that complete forgetting requires reversing a training sample’s effects on learned features and models. The paper does not address LLMs or memories tightly integrated into them, so that application is an extrapolation. (LLM, conf=0.86)
Experimental — accuracy not yet measured
Retraining is generally a computationally expensive process.
“Retraining is generally a computationally expensive process [29, 30].”
From Machine Unlearning: A Survey (2024) · cites this paper as [29]
Poisoned samples in training data may be removed via data sanitization processes or via machine unlearning.
“After a model has been trained, poisoned samples in training data may be removed via data sanitization processes outlined in [101], or via 'machine unlearning' to remove the effects of poisoned data as outlined in [142].”
From Operationalising ethics in artificial intelligence for healthcare: a framework for AI developers (2023) · cites this paper as [142]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Quinlan, J. R. (1986) · Machine Learning · doi:10.1007/bf00116251 · Cited by 21,439 · see citing works
Item-based collaborative filtering recommendation algorithms
Sarwar, B., Karypis, G., Konstan, J., & Riedl, J. (2001) · Proceedings of the 10th international conference on World Wide Web · doi:10.1145/371920.372071 · Cited by 9,135 · see citing works
Support Vector Data Description
Tax, D. M. J., & Duin, R. P. W. (2003) · Machine Learning · doi:10.1023/b:mach.0000008084.60811.49 · Cited by 3,553 · see citing works
Shipp, M. A., Ross, K. N., Tamayo, P., Weng, A. P., Kutok, J. L., Aguiar, R. C. T., Gaasenbeek, M., Angelo, M., Reich, M. M., Pinkus, G. S., et al. (2002) · Nature Medicine · doi:10.1038/nm0102-68 · Cited by 2,431 · see citing works
TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones
Enck, W., Gilbert, P., Chun, B.-G., Cox, L. P., Jung, J., McDaniel, P. D., & Sheth, A. N. (2010) · doi:10.5555/1924943.1924971 · Cited by 2,259 · see citing works
Mining high-speed data streams
Domingos, P., & Hulten, G. (2000) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/347090.347107 · Cited by 2,213 · see citing works
Item-based top- N recommendation algorithms
Deshpande, M., & Karypis, G. (2004) · ACM Transactions on Information Systems · doi:10.1145/963770.963776 · Cited by 2,192 · see citing works
Syntactic clustering of the Web
Broder, A., Glassman, S. C., Manasse, M. S., & Zweig, G. (1997) · Computer Networks and ISDN Systems · doi:10.1016/s0169-7552(97)00031-7 · Cited by 1,348 · see citing works
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331 · see citing works
Map-Reduce for Machine Learning on Multicore
Chu, C.-T., Kim, S. K., Lin, Y.-A., Yu, Y., Bradski, G. R., Ng, A. Y., & Olukotun, K. (2007) · The MIT Press eBooks · doi:10.7551/mitpress/7503.003.0040 · Cited by 1,247 · see citing works
Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194 · see citing works
Incremental and Decremental Support Vector Machine Learning
Cauwenberghs, G., & Poggio, T. (2000) · Cited by 1,156 · see citing works
The security of machine learning
Barreno, M., Nelson, B. A., Joseph, A. D., & Tygar, J. D. (2010) · Machine Learning · doi:10.1007/s10994-010-5188-5 · Cited by 839 · see citing works
Incremental Induction of Decision Trees
Utgoff, P. E. (1989) · Machine Learning · doi:10.1023/a:1022699900025 · Cited by 793 · see citing works
Identifying Mislabeled Training Data
Brodley, C. E., & Friedl, M. A. (1999) · Cited by 718 · see citing works
Efficient noise-tolerant learning from statistical queries
Kearns, M. J. (1998) · Journal of the ACM · doi:10.1145/293347.293351 · Cited by 679 · see citing works
Differentially private recommender systems
McSherry, F., & Mironov, I. (2009) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1557019.1557090 · Cited by 676 · see citing works
Polygraph: Automatically Generating Signatures for Polymorphic Worms
Newsome, J., Karp, B., & Song, D. X. (2005) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2005.15 · Cited by 676 · see citing works
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658 · see citing works
Identifying Mislabeled Training Data
Brodley, C. E., & Friedl, M. A. (1999) · Journal of Artificial Intelligence Research · doi:10.1613/jair.606 · Cited by 612 · see citing works
Finding a needle in Haystack: facebook's photo storage
Beaver, D., Kumar, S., Li, H. C., Sobel, J., & Vajgel, P. (2010) · doi:10.5555/1924943.1924947 · Cited by 433 · see citing works
Security Evaluation of Pattern Classifiers under Attack
Biggio, B., Fumera, G., & Roli, F. (2013) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2013.57 · Cited by 412 · see citing works
Practical Evasion of a Learning-Based Classifier: A Case Study
Šrndić, N., & Laskov, P. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.20 · Cited by 351 · see citing works
Zhang, J., Zhang, Z., Xiao, X., Yang, Y., & Winslett, M. (2012) · Proceedings of the VLDB Endowment · doi:10.14778/2350229.2350253 · Cited by 346 · see citing works
Exploiting machine learning to subvert your spam filter
Nelson, B. A., Barreno, M., Chi, F. J., Joseph, A. D., Rubinstein, B. I. P., Saini, U., Sutton, C. A., Tygar, J. D., & Xia, K. (2008) · Cited by 322 · see citing works
"You Might Also Like:" Privacy Risks of Collaborative Filtering
Calandrino, J. A., Kilzer, A., Narayanan, A., Felten, E. W., & Shmatikov, V. (2011) · 2011 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2011.40 · Cited by 311 · see citing works
ZOZZLE: fast and precise in-browser JavaScript malware detection
Curtsinger, C., Livshits, B., Zorn, B. G., & Seifert, C. (2011) · Cited by 273 · see citing works
Malicious PDF detection using metadata and structural features
Smutz, C., & Stavrou, A. (2012) · Proceedings of the 28th Annual Computer Security Applications Conference · doi:10.1145/2420950.2420987 · Cited by 271 · see citing works
Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems
Roberto Perdisci, A., Gu, G., & Wenke Lee, B. (2006) · Proceedings · doi:10.1109/icdm.2006.165 · Cited by 241 · see citing works
Secure Overlay Cloud Storage with Access Control and Assured Deletion
Tang, Y. S., Lee, P. P. C., Lui, J. C. S., & Perlman, R. (2012) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2012.49 · Cited by 233 · see citing works
Casting out Demons: Sanitizing Training Data for Anomaly Sensors
Cretu, G. F., Stavrou, A., Locasto, M. E., Stolfo, S. J., & Keromytis, A. D. (2008) · 2008 IEEE Symposium on Security and Privacy (sp 2008) · doi:10.1109/sp.2008.11 · Cited by 226 · see citing works
Learning your identity and disease from research papers
Wang, R., Li, Y. F., Wang, X., Tang, H., & Zhou, X. (2009) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1653662.1653726 · Cited by 206 · see citing works
NOZZLE: a defense against heap-spraying code injection attacks
Ratanaworabhan, P., Livshits, B., & Zorn, B. G. (2009) · Cited by 204 · see citing works
Towards Online Spam Filtering in Social Networks
Gao, H., Chen, Y., Lee, K., Palsetia, D., & Choudhary, A. (2012) · Cited by 199 · see citing works
Brennan, M., Afroz, S., & Greenstadt, R. (2012) · ACM Transactions on Information and System Security · doi:10.1145/2382448.2382450 · Cited by 194 · see citing works
Misleading worm signature generators using deliberate noise injection
Roberto Perdisci, A., Dagon, D., Lee, W., Fogla, P., & Sharif, M. (2006) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2006.26 · Cited by 189 · see citing works
Rethinking the recommender research ecosystem
Ekstrand, M. D., Ludwig, M. J., Konstan, J. A., & Riedl, J. (2011) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/2043932.2043958 · Cited by 169 · see citing works
Static detection of malicious JavaScript-bearing PDF documents
Laskov, P., & Šrndić, N. (2011) · Annual Computer Security Applications Conference · doi:10.1145/2076732.2076785 · Cited by 164 · see citing works
Static prediction games for adversarial learning problems
Brückner, M., Kanzow, C., & Scheffer, T. (2012) · publish.UP (University of Potsdam) · Cited by 163 · see citing works
Shredding your garbage: reducing data lifetime through secure deallocation
Chow, J., Pfaff, B., Garfinkel, T., & Rosenblum, M. (2005) · Cited by 162 · see citing works
Detection of Malicious PDF Files Based on Hierarchical Document Structure.
Šrndić, N., & Laskov, P. (2013) · Network and Distributed System Security Symposium · Cited by 147 · see citing works
Man vs. machine: practical adversarial detection of malicious crowdsourcing workers
Wang, G., Wang, T., Zhang, H., & Zhao, B. Y. (2014) · Cited by 142 · see citing works
Learning in the presence of malicious errors
Kearns, M. J., & Li, M. (1988) · doi:10.1145/62212.62238 · Cited by 127 · see citing works
Learning to classify with missing and corrupted features
Dekel, O., Shamir, O., & Xiao, L. (2009) · Machine Learning · doi:10.1007/s10994-009-5124-8 · Cited by 125 · see citing works
Riederer, C., Erramilli, V., Chaintreau, A., Krishnamurthy, B., & Rodríguez, P. (2011) · ACM Workshop on Hot Topics in Networks (HotNets) · doi:10.1145/2070562.2070575 · Cited by 107 · see citing works
Detecting adversarial advertisements in the wild
Sculley, D., Otey, M. E., Pohl, M., Spitznagel, B., Hainsworth, J., & Zhou, Y. (2011) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2020408.2020455 · Cited by 95 · see citing works
Incremental and decremental training for linear classification
Tsai, C.-H., Lin, C.-Y., & Lin, C.-J. (2014) · Knowledge Discovery and Data Mining · doi:10.1145/2623330.2623661 · Cited by 91 · see citing works
Data Node Encrypted File System: Efficient Secure Deletion for Flash Memory
Reardon, J., Čapkun, S., & Basin, D. (2013) · Repository for Publications and Research Data (ETH Zurich) · doi:10.3929/ethz-a-007593083 · Cited by 68 · see citing works
Incremental and Decremental Learning for Linear Support Vector Machines
Romero, E., Barrio, I., & Belanche, L. (2007) · International Conference on Artificial Neural Networks · doi:10.1007/978-3-540-74690-4_22 · Cited by 33 · see citing works
Pebbles: fine-grained data management abstractions for modern operating systems
Spahn, R., Bell, J., Lee, M. Z., Bhamidipati, S., Geambasu, R., & Kaiser, G. E. (2014) · doi:10.5555/2685048.2685058 · Cited by 30 · see citing works
Cao, Y., Pan, X., Chen, Y., & Zhuge, J. (2014) · Annual Computer Security Applications Conference · doi:10.1145/2664243.2664256 · Cited by 24 · see citing works
Self-citationDifferentially Private Projected Histograms: Construction and Use for Prediction
Vinterbo, S. A. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-33486-3_2 · Cited by 13 · see citing works
Flagged first, then by citations
2 of the 54 references couldn’t be matched to a known paper.
Research works printed but not linked: 3
- [27]27. Y. Cao, X. Pan, Y. Chen, and J. Zhuge. JShield: Towards real-time and vulnerability-based detection of polluted drive-by download attacks. In Proceedings of the 30th Annual Computer Security Applications Conference, ACSAC, 2014.
- [49]49. F. McSherry and I. Mironov. Differentially private recommender sys- tems: Building privacy into the netflix prize contenders. In Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD, 2009.
- [50]50. S. Muralidhar, W. Lloyd, S. Roy, C. Hill, E. Lin, W. Liu, S. Pan, S. Shankar, V. Sivakumar, L. Tang, and S. Kumar. F4: Facebook's warm blob storage system. In Proceedings of the 11th USENIX Conference on Operating Systems Design and Implementation, OSDI, 2014.
Cited by
Sorted by citations
On the Opportunities and Risks of Foundation Models
Bommasani, R., Hudson, D. A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M. S., Bohg, J., Bosselut, A., Brunskill, E., et al. (2021) · arXiv · doi:10.48550/arxiv.2108.07258 · Cited by 2,676 · see citing works
Pei, K., Cao, Y., Yang, J., & Jana, S. (2017) · ACM SIGOPS Symposium on Operating Systems Principles (SOSP) · doi:10.1145/3132747.3132785 · Cited by 1,296 · see citing works
“Recently, the security and privacy aspects of machine learning have drawn significant attention from the researchers in both machine learning [26, 49, 72] and security [12, 21, 22, 55, 63, 74, 82] communities.”
BackgroundSelf-citationTrojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., & Papernot, N. (2021) · 2021 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40001.2021.00019 · Cited by 810 · see citing works
Trustworthy Artificial Intelligence: A Review
Kaur, D., Uslu, S., Rittichier, K. J., & Durresi, A. (2023) · ACM Computing Surveys · doi:10.1145/3491209 · Cited by 709 · see citing works
“3 Federated Learning [76, 85, 133, 194] 3 Machine Unlearning [22, 35]”
BackgroundMethodPrivacy-Preserving Machine Learning: Threats and Solutions
Al-Rubaie, M., & Chang, J. M. (2019) · IEEE Security & Privacy · doi:10.1109/msec.2018.2888775 · Cited by 444 · see citing works
Zhang, W., Deng, L., Zhang, L., & Wu, D. (2022) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2022.106004 · Cited by 457 · see citing works
“For instance, a feature adaptation-based TL strategy with support vector machine (SVM) [32] as the classifier should be compared with the original SVM algorithm to judge whether NT occurs.”
MethodInfluentialEternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks
Golatkar, A., Achille, A., & Soatto, S. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00932 · Cited by 394 · see citing works
Model inversion attacks against collaborative inference
He, Z., Zhang, T., & Lee, R. B. (2019) · Proceedings of the 35th Annual Computer Security Applications Conference · doi:10.1145/3359789.3359824 · Cited by 313 · see citing works
“[5] proposed a methodology to remove the effects of sensitive training samples on the models.”
MethodGuo, W., Mu, D., Xu, J., Su, P., Wang, G., & Xing, X. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243792 · Cited by 286 · see citing works
“A representative method is “machine unlearning” [10], which is to remove the influence of certain training data by transforming the standard training algorithms into a summation form.”
BackgroundMethodAlgorithms that remember: model inversion attacks and data protection law
Veale, M., Binns, R., & Edwards, L. (2018) · Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences · doi:10.1098/rsta.2018.0083 · Cited by 278 · see citing works
“currently possible in modern systems. Approaches for quick and easy ‘machine unlearning’ are only beginning to be proposed and are still largely unexplored, let alone at a stage ready for deployment [38,39]. Methods currently on the table cannot be retrofitted onto existing systems, and would require entire model pipel…”
BackgroundChen, S., Xue, M., Fan, L., Hao, S., Xu, L., Zhu, H., & Li, B. (2017) · Computers & Security · doi:10.1016/j.cose.2017.11.007 · Cited by 240 · see citing works
“For the general defense, Cao et al. (Cao and Yang, 2015) presented a proof-of-concept machine unlearning prototype that can rapidly forget data to regain privacy, security, and usability.”
BackgroundA <scp>uror</scp>: defending against poisoning attacks in collaborative deep learning systems
Shen, S., Tople, S., & Saxena, P. (2016) · Proceedings of the 32nd Annual Conference on Computer Security Applications · doi:10.1145/2991079.2991125 · Cited by 228 · see citing works
“Defenses against poisoning attacks are known in the area of collaborative recommendation systems using machine learning techniques [15,19,36].”
BackgroundScope of machine learning in materials research—A review
Mobarak, M. H., Mimona, M. A., Islam, M. A., Hossain, N., Zohura, F. T., Imtiaz, I., & Rimon, M. I. H. (2023) · Applied Surface Science Advances · doi:10.1016/j.apsadv.2023.100523 · Cited by 243 · see citing works
FedEraser: Enabling Efficient Client-Level Data Removal from Federated Learning Models
Liu, G., Ma, X., Yang, Y., Wang, C., & Liu, J. (2021) · 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS) · doi:10.1109/iwqos52092.2021.9521274 · Cited by 248 · see citing works
“The term “machine unlearning” is introduced by Cao et al. [14], where an efficient forgetting algorithm in the restricted context of statistical query learning is proposed.”
BackgroundA Survey of Machine Unlearning
Nguyên, T. T., Huynh, T. T., Ren, Z. X., Nguyen, P. L., Liew, A. W., Yin, H., & Nguyen, Q. V. H. (2025) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3749987 · Cited by 303 · see citing works
Fast Yet Effective Machine Unlearning
Tarun, A. K., Chundawat, V. S., Mandal, M., & Kankanhalli, M. (2023) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2023.3266233 · Cited by 203 · see citing works
“Machine unlearning was formulated as a data forgetting algorithm in statistical query learning [8].”
BackgroundFast Yet Effective Machine Unlearning
Tarun, A. K., Chundawat, V. S., Mandal, M., & Kankanhalli, M. (2021) · arXiv · doi:10.48550/arxiv.2111.08947 · Cited by 190 · see citing works
“Machine unlearning was formulated as a data forgetting algorithm in statistical query learning [8].”
BackgroundWhen Machine Unlearning Jeopardizes Privacy
Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., & Zhang, Y. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3484756 · Cited by 195 · see citing works
Making AI Forget You: Data Deletion in Machine Learning
Ginart, A., Guan, M. Y., Valiant, G., & Zou, J. (2019) · arXiv · doi:10.48550/arxiv.1907.05012 · Cited by 175 · see citing works
“They include linear models [55, 27, 83, 81, 18, 74], certain types of lazy learning [88, 6, 11] techniques such as non-parametric Nadaraya-Watson kernel regressions [61] or nearest-neighbors methods [22, 74], recursive support vector machines [19, 81], and co-occurrence based collaborative filtering [74].”
MethodOperationalising ethics in artificial intelligence for healthcare: a framework for AI developers
Solanki, P., Grundy, J., & Hussain, W. (2023) · AI and Ethics · doi:10.1007/s43681-022-00195-z · Cited by 157 · see citing works
“Use post-hoc techniques and auditing to identify under-preforming groups and address racial bias [140-143]”
BackgroundMethodAdversarial machine learning :
Vassilev, A., Oprea, A., Fordyce, A. J., & Anderson, H. S. (2024) · doi:10.6028/nist.ai.100-2e2023 · Cited by 193 · see citing works
Chundawat, V. S., Tarun, A. K., Mandal, M., & Kankanhalli, M. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3265506 · Cited by 162 · see citing works
“The concept of unlearning was introduced in [12] to eliminate the effect of data point(s) on the already trained model.”
Xu, H., Zhu, T., Zhang, L., Zhou, W., & Yu, P. S. (2024) · ACM Computing Surveys · doi:10.1145/3603620 · Cited by 164 · see citing works
“Based on Data Pruning.”
BackgroundMethodInfluentialFederated Unlearning via Class-Discriminative Pruning
Wang, J., Guo, S., Xie, X., & Qi, H. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512222 · Cited by 157 · see citing works
“[33] in the context of statistical query learning.”
BackgroundMethodInfluentialAblating Concepts in Text-to-Image Diffusion Models
Kumari, N., Zhang, B., Wang, S.-Y., Shechtman, E., Zhang, R., & Zhu, J.-Y. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.02074 · Cited by 150 · see citing works
“Another line of work in machine unlearning [9, 21, 23, 22, 42, 8, 67, 60] explores data deletion at user’s request after model training.”
BackgroundUnrolling SGD: Understanding Factors Influencing Machine Unlearning
Thudi, A., Deza, G., Chandrasekaran, V., & Papernot, N. (2022) · 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp53844.2022.00027 · Cited by 135 · see citing works
“[6] to unlearn datapoints for simple hypothesis spaces which have known SQ learning algorithms.”
BackgroundChen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., & Zhang, Y. (2022) · Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3548606.3559352 · Cited by 133 · see citing works
On the Security of Machine Learning in Malware C&C Detection
Gardiner, J., & Nagaraja, S. (2016) · ACM Computing Surveys · doi:10.1145/3003816 · Cited by 126 · see citing works
Lifelong Anomaly Detection Through Unlearning
Du, M., Chen, Z., Liu, C., Oak, R., & Song, D. X. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363226 · Cited by 125 · see citing works
Attacking and Protecting Data Privacy in Edge–Cloud Collaborative Inference Systems
He, Z., Zhang, T., & Lee, R. B.-L. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3022358 · Cited by 126 · see citing works
“Cao and Yang [45] proposed a methodology to remove the effects of sensitive training samples on the models.”
MethodMixed-Privacy Forgetting in Deep Networks
Golatkar, A., Achille, A., Ravichandran, A., Polito, M., & Soatto, S. (2021) · 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr46437.2021.00085 · Cited by 125 · see citing works
FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information
Cao, X., Jia, J., Zhang, Z., & Gong, N. Z. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179336 · Cited by 126 · see citing works
“Multiple methods [9], [14], [34] have been proposed for efficient machine unlearning.”
BackgroundMethodMachine Unlearning of Features and Labels
Warnecke, A., Pirch, L., Wressnegger, C., & Rieck, K. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.23087 · Cited by 166 · see citing works
Golatkar, A., Achille, A., & Soatto, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58526-6_23 · Cited by 122 · see citing works
FedRecovery: Differentially Private Machine Unlearning for Federated Learning Frameworks
Zhang, L., Zhu, T., Zhang, H., Xiong, P., & Zhou, W. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3297905 · Cited by 118 · see citing works
“The demand for machine unlearning generally stems from real-world situations where data owners need to revoke their contributions to a learned model due to privacy or security issues [30].”
BackgroundAddressing Adversarial Attacks Against Security Systems Based on Machine Learning
Apruzzese, G., Colajanni, M., Ferretti, L., & Marchetti, M. (2019) · doi:10.23919/cycon.2019.8756865 · Cited by 114 · see citing works
“Other solutions [51] leverage the machine unlearning concept that allows the effects of poisoned data to be cancelled without the need to retrain the machine-learning model.”
BackgroundMachine Unlearning: Solutions and Challenges
Xu, J., Wu, Z., Wang, C., & Jia, X. (2024) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2024.3379240 · Cited by 114 · see citing works
“It is important to note that approximate unlearning represents a tradeoff between unlearning completeness and unlearning efficiency [16].”
BackgroundMethodInfluentialChen, C., Sun, F., Zhang, M., & Ding, B. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3511997 · Cited by 110 · see citing works
Machine unlearning: linear filtration for logit-based classifiers
Baumhauer, T., Schöttle, P., & Zeppelzauer, M. (2022) · Machine Learning · doi:10.1007/s10994-022-06178-9 · Cited by 123 · see citing works
“The term machine unlearning first appears in [9].”
BackgroundMethodInfluentialRethinking machine unlearning for large language models
Liu, S., Yao, Y., Jia, J., Casper, S., Baracaldo, N., Hase, P., Yao, Y., Liu, C. Y., Xu, X., Li, H., et al. (2025) · Nature Machine Intelligence · doi:10.1038/s42256-025-00985-0 · Cited by 173 · see citing works
“The study of MU can be traced back to non-LLMs in response to data protection regulations such as ‘the right to be forgotten’ Cao & Yang (2015); Hoofnagle et al. (2019); Bourtoule et al. (2021); Nguyen et al. (2022).”
InfluentialTowards Security Threats of Deep Learning Systems: A Survey
He, Y., Meng, G., Chen, K., Hu, X., & He, J. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3034721 · Cited by 114 · see citing works
“[42] put forward machine”
VeriFi: Towards Verifiable Federated Unlearning
Gao, X., Ma, X., Wang, J., Sun, Y., Li, B., Ji, S., Cheng, P., & Chen, J. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3382321 · Cited by 111 · see citing works
“It can be made more efficient if the model is trained on summarized (e.g., aggregates of summations) or partitioned subsets rather than individual training samples, in which case, the model only needs to be updated on the subset(s) associated with the requestedsamples[9],[10].”
InfluentialRemember What You Want to Forget: Algorithms for Machine Unlearning
Sekhari, A., Acharya, J., Kamath, G., & Suresh, A. T. (2021) · arXiv · doi:10.48550/arxiv.2103.03279 · Cited by 99 · see citing works
“1.1 Related work Cao and Yang (2015) introduced the term “machine unlearning,” and gave efficient deterministic algorithms for exact unlearning in certain settings.”
BackgroundInfluentialARCANE: An Efficient Architecture for Exact Machine Unlearning
Yan, H., Li, X., Guo, Z., Li, H., Li, F., & Lin, X. (2022) · Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/556 · Cited by 97 · see citing works
“Subsequent re-searches follow this line and try to optimize model retraining to reduce the cost of retraining [Cao and Yang, 2015; Ginart et al. , 2019; Bourtoule et al. , 2021].”
MethodPractical Blind Membership Inference Attack via Differential Comparisons
Hui, B., Yang, Y., Yuan, H., Burlina, P., Gong, N. Z., & Cao, Y. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24293 · Cited by 102 · see citing works
“[7] showed that privacy-related data samples can be unlearned to improve model privacy.”
BackgroundSelf-citationBoundary Unlearning: Rapid Forgetting of Deep Networks via Shifting the Decision Boundary
Chen, M., Gao, W., Liu, G., Peng, K., & Wang, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00750 · Cited by 95 · see citing works
A Comprehensive Survey of Forgetting in Deep Learning Beyond Continual Learning
Wang, Z., Yang, E., Shen, L., & Huang, H. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3498346 · Cited by 101 · see citing works
“This challenge is central to machine unlearning, which aims to effectively remove training data traces from machine learning models [13].”
Backdoor Defense with Machine Unlearning
Liu, Y., Fan, M., Chen, C., Liu, X., Ma, Z., Wang, L., & Ma, J. (2022) · IEEE INFOCOM 2022 - IEEE Conference on Computer Communications · doi:10.1109/infocom48880.2022.9796974 · Cited by 95 · see citing works
“Machine unlearning [11]–[13] is an emerging technique motivated by the data privacy rules and regulations, such as General Data Protection Regulation in the European Union (GDPR) that specifies the data revocation right for users.”
BackgroundMethodHedgeCut: Maintaining Randomised Trees for Low-Latency Machine Unlearning
Schelter, S., Grafberger, S., & Dunning, T. (2021) · Proceedings of the 2021 International Conference on Management of Data · doi:10.1145/3448016.3457239 · Cited by 89 · see citing works
Knowledge Unlearning for Mitigating Privacy Risks in Language Models
Jang, J., Yoon, D., Yang, S., Cha, S., Lee, M., Logeswaran, L., & Seo, M. (2023) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2023.acl-long.805 · Cited by 135 · see citing works
Fast Machine Unlearning without Retraining through Selective Synaptic Dampening
Foster, J. D., Schoepf, S., & Brintrup, A. M. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i11.29092 · Cited by 91 · see citing works
A System-Driven Taxonomy of Attacks and Defenses in Adversarial Machine Learning
Sadeghi, K., Banerjee, A., & Gupta, S. K. S. (2020) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2020.2968933 · Cited by 83 · see citing works
“Machine unlearning [267] as a recoverymethod after poisoning attacks, in order to reduce its effects on a trained”
BackgroundA Review on Machine Unlearning
Zhang, H., Nakamura, T., Isohara, T., & Sakurai, K. (2023) · SN Computer Science · doi:10.1007/s42979-023-01767-4 · Cited by 81 · see citing works
“Cao & Yang 2015 ✓ Summations following SQ learning [24]”
BackgroundMethodMenard, P., & Bott, G. J. (2024) · Information Systems Journal · doi:10.1111/isj.12544 · Cited by 86 · see citing works
“Recent research has examined the concept of ‘ machine unlearning ’ , which uses data abstraction to extract specific data points from ML processing while preserving the algorithm's optimised model (Cao & Yang, 2015; Ginart et al., 2019).”
Model Inversion Attacks for Prediction Systems: Without Knowledge of Non-Sensitive Attributes
Hidano, S., Murakami, T., Katsumata, S., Kiyomoto, S., & Hanaoka, G. (2017) · Conference on Privacy, Security and Trust · doi:10.1109/pst.2017.00023 · Cited by 75 · see citing works
“[26] proposed a poisoning approach on ML models, where data are not maliciously injected, but rather intendedly removed from the training data.”
BackgroundFormalizing Data Deletion in the Context of the Right to Be ForgottenPreprint
Goldwasser, S., & Vasudevan, P. N. (2020) · DSpace@MIT (Massachusetts Institute of Technology) · Cited by 75 · see citing works
Heterogeneous Federated Knowledge Graph Embedding Learning and Unlearning
Zhu, X., Li, G., & Hu, W. P. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583305 · Cited by 75 · see citing works
“The work in [9] further leverages k-means clustering to make the unlearning algorithm in [4] more deletionefficient.”
BackgroundMethodImplicit Smartphone User Authentication with Sensors and Contextual Machine Learning
Lee, W., & Lee, R. B.-L. (2017) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2017.24 · Cited by 74 · see citing works
“Advanced approaches in machine unlearning [46] can be explored to update the authentication models asymptotically faster than retraining from scratch.”
Federated Unlearning: A Survey on Methods, Design Guidelines, and Evaluation Metrics
Romandini, N., Mora, A., Mazzocca, C., Montanari, R., & Bellavista, P. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3478334 · Cited by 76 · see citing works
“Data owners may want to withdraw their contributions to a trained model due to privacy or security concerns [7].”
Asynchronous Federated Unlearning
Su, N., & Li, B. (2023) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom53939.2023.10229075 · Cited by 70 · see citing works
“[10], which was asymptotically faster than retraining from scratch by transforming learning algorithms into a summation form.”
BackgroundSurvey: Leakage and Privacy at Inference Time
Jegorova, M., Kaul, C., Mayor, C., O'Neil, A. Q., Weir, A., Murray-Smith, R., & Tsaftaris, S. A. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3229593 · Cited by 77 · see citing works
A Survey on All-in-One Image Restoration: Taxonomy, Evaluation and Future Trends
Jiang, J., Zuo, Z., Wu, G., Jiang, K., & Liu, X. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3598132 · Cited by 77 · see citing works
“Machine unlearning [136] offers a way to remove the influence of private data from trained models, enabling them to behave as if such data were never used.”
Federated Unlearning With Momentum Degradation
Zhao, Y., Wang, P., Qi, H., Huang, J., Wei, Z., & Zhang, Q. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3321594 · Cited by 67 · see citing works
“The concept of machine unlearning was first proposed in [15], with the intent to forget a subset of data samples from a learning system.”
BackgroundPoisoning attacks and countermeasures in intelligent networks: Status quo and prospects
Wang, C., Chen, J., Yang, Y., Ma, X., & Liu, J. (2021) · Digital Communications and Networks · doi:10.1016/j.dcan.2021.07.009 · Cited by 66 · see citing works
Privacy-preserving Machine Learning through Data ObfuscationPreprint
Zhang, T., He, Z., & Lee, R. B.-L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.01860 · Cited by 72 · see citing works
“[7] proposed a methodology to modify the training algorithms to remove the effects of sensitive training samples on the models.”
MethodHard to Forget: Poisoning Attacks on Certified Machine Unlearning
Marchant, N. G., Rubinstein, B. I. P., & Alfeld, S. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i7.20736 · Cited by 64 · see citing works
“Recent interest in efficient data erasure for learned models was spawned by Cao and Yang (2015), who were motivated by privacy and security applications.”
A Survey of Machine Unlearning
Nguyen, T. T., Huynh, T. T., Ren, Z., Nguyen, P. L., Liew, A. W.-C., Yin, H., & Nguyen, Q. V. H. (2022) · arXiv · doi:10.48550/arxiv.2209.02299 · Cited by 193 · see citing works
Deep Unlearning via Randomized Conditionally Independent Hessians
Mehta, R., Pal, S., Singh, V. P., & Ravi, S. N. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01017 · Cited by 62 · see citing works
“SVMs by [25,34], Na ¨ ıve Bayes Classifiers by [5], and k -means methods by [14] have all been studied.”
MethodZhang, Y., Jia, J., Chen, X., Chen, A., Zhang, Y., Liu, S., Ding, K., & Liu, S. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72998-0_22 · Cited by 68 · see citing works
Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomy
Shaik, T., Tao, X., Xie, H., Li, L., Zhu, X., & Li, Q. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3486109 · Cited by 78 · see citing works
“literature, including the studies in [6], [8], [18]–[22]:”
Learn to Forget: Machine Unlearning via Neuron Masking
Ma, Z., Liu, Y., Liu, X., Liu, J., Ma, J., & Ren, K. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3194884 · Cited by 68 · see citing works
“For machine unlearning, prior work mainly explores two ways, summation-based MU [9] and retraining-based MU [10], [11].”
BackgroundMethodResultInfluentialRecent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Survey
Demelius, L., Kern, R., & Trügler, A. (2025) · ACM Computing Surveys · doi:10.1145/3712000 · Cited by 76 · see citing works
“Machine unlearning [28, 125] is the process of removing the impact one or more datapoints have on a trained model.”
GIF: A General Graph Unlearning Strategy via Influence Function
Wu, J., Yang, Y., Qian, Y., Sui, Y., Wang, X., & He, X. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583521 · Cited by 58 · see citing works
“Ever since Cao & Yang [4] first introduced the concept, several methods are proposed to address the unlearning tasks, which can be classified into two branches: exact approaches and approximate approaches.”
BackgroundInfluentialSysDroid: a dynamic ML-based android malware analyzer using system call traces
Ananya, A., Aswathy, A., Amal, T., Swathy, P., Vinod, P., & Shojafar, M. (2020) · Cluster Computing · doi:10.1007/s10586-019-03045-6 · Cited by 57 · see citing works
“The authors in [10] introduced an ML approach that helped in increasing the user effectiveness in handling system data to improve security and privacy.”
BackgroundTrustworthy AI in the Age of Pervasive Computing and Big Data
Kumar, A., Braud, T., Tarkoma, S., & Hui, P. (2020) · 2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops) · doi:10.1109/percomworkshops48775.2020.9156127 · Cited by 68 · see citing works
Requirements for Trustworthy Artificial Intelligence – A Review
Kaur, D., Uslu, S., & Arjan Durresi, A. (2020) · Advances in intelligent systems and computing · doi:10.1007/978-3-030-57811-4_11 · Cited by 56 · see citing works
Big data in cybersecurity: a survey of applications and future trends
Alani, M. M. (2021) · Journal of Reliable Intelligent Environments · doi:10.1007/s40860-020-00120-3 · Cited by 54 · see citing works
“A technique such as ’Machine Unlearning’ introduced by Cao and Young [119] can be of vital importance for future applications of big data.”
MethodAdvancing Differential Privacy: Where We Are Now and Future Directions for Real-World Deployment
Cummings, R., Desfontaines, D., Evans, D., Geambasu, R., Huang, Y., Jagielski, M., Kairouz, P., Kamath, G., Oh, S., Ohrimenko, O., et al. (2024) · Harvard Data Science Review · doi:10.1162/99608f92.d3197524 · Cited by 71 · see citing works
Athena: Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0072 · Cited by 51 · see citing works
“Therefore, Cao and Yang [7] train conventional models based on intermediate summations of training data [65] and update summations upon deletion request.”
MethodA review on machine learning applications in hydrogen energy systems
Allal, Z., Noura, H., Salman, O., Vernier, F., & Chahine, K. (2025) · International Journal of Thermofluids · doi:10.1016/j.ijft.2025.101119 · Cited by 50 · see citing works
A collective AI via lifelong learning and sharing at the edge
Soltoggio, A., Ben-Iwhiwhu, E., Braverman, V., Eaton, E., Epstein, B., Ge, Y., Halperin, L., How, J., Itti, L., Jacobs, M. A., et al. (2024) · Nature Machine Intelligence · doi:10.1038/s42256-024-00800-2 · Cited by 51 · see citing works
“In addition, the processes used by LL agents when integrating new knowledge in their models may be difficult to reverse, that is, to unlearn 203 .”
On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning
Thudi, A., Jia, H., Shumailov, I., & Papernot, N. (2021) · arXiv · doi:10.48550/arxiv.2110.11891 · Cited by 48 · see citing works
“Because ML models are known to memorize their training data [8], this forces model owners to resort to machine unlearning [4] to remove any effect the point had on the trained model.”
RevFRF: Enabling Cross-Domain Random Forest Training With Revocable Federated Learning
Liu, Y., Ma, Z., Yang, Y., Liu, X., Ma, J., & Ren, K. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3104842 · Cited by 49 · see citing works
“In more details, the revocable FL concept is motivated by an emerging technique called machine unlearning [18], [19], [20], which is proposed to make a trained model to forget the memories about some specific training samples.”
MethodRight to be forgotten in the Era of large language models: implications, challenges, and solutions
Zhang, D., Finckenberg-Broman, P., Hoang, T., Pan, S., Xing, Z., Staples, M., & Xu, X. (2024) · AI and Ethics · doi:10.1007/s43681-024-00573-9 · Cited by 47 · see citing works
“The methods in this category aim to solve the root of the issue by fixing the original model and fall within the idea of machine unlearning [19].”
MethodLearning to Unlearn: Instance-Wise Unlearning for Pre-trained Classifiers
Cha, S., Cho, S., Hwang, D., Lee, H., Moon, T., & Lee, M. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i10.28996 · Cited by 47 · see citing works
Data Subject Rights under the GDPR
Vrabec, H. U. (2021) · doi:10.1093/oso/9780198868422.001.0001 · Cited by 45 · see citing works
Efficient Two-stage Model Retraining for Machine Unlearning
Kim, J., & Woo, S. S. (2022) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw56347.2022.00482 · Cited by 46 · see citing works
“[3] showed an unlearning algorithm using a small number of summations in the restricted setting of statistical query learning, where the learning algorithm cannot access to specific samples.”
MethodLearning with Selective Forgetting
Shibata, T., Irie, G., Ikami, D., & Mitsuzumi, Y. (2021) · Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2021/137 · Cited by 47 · see citing works
“The concept of Machine Unlearning (MU) was first introduced by Cao et al. [Cao and Yang, 2015].”
BackgroundVerifying in the Dark: Verifiable Machine Unlearning by Using Invisible Backdoor Triggers
Guo, Y., Zhao, Y., Hou, S., Wang, C., & Jia, X. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3328269 · Cited by 44 · see citing works
“In [15], the authors applied the idea of statistical query learning to enable exact unlearning.”
BackgroundThreats, Attacks, and Defenses in Machine Unlearning: A Survey
Liu, Z., Ye, H., Chen, C., Zheng, Y., & Lam, K. (2025) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2025.3543483 · Cited by 51 · see citing works
“…challenge, a range of efficient MU methodologies have recently been developed, allowing the unlearned model to be obtained from the existing trained model without the need for retraining from scratch [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [23], [24], [25].”
Making recommender systems forget: Learning and unlearning for erasable recommendation
Li, Y., Chen, C., Zheng, X., Liu, J., & Wang, J. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.111124 · Cited by 55 · see citing works
Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearning
Hu, H., Wang, S., Dong, T., & Xue, M. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00248 · Cited by 44 · see citing works
“Deleting data from a database can be relatively straightforward [4], however, it is much more complicated in the case of machine learning models, especially deep neural networks (DNNs), due to factors such as model complexity and the randomness in the training algorithm [5].”
BackgroundTrustworthy and Synergistic Artificial Intelligence for Software Engineering: Vision and Roadmaps
Lo, D. (2023) · IEEE/ACM International Conference on Software Engineering: Future of Software Engineering (ICSE-FoSE) · doi:10.1109/icse-fose59343.2023.00010 · Cited by 52 · see citing works
“Moreover, strategies are needed to help AI4SE solutions respect the EU General Data Protection Regulation (GDPR)’s provision of “right to be forgotten” without necessitating extensive retraining, c.f., [131].”
BackgroundFooling intrusion detection systems using adversarially autoencoder
Chen, J., Wu, D., Zhao, Y., Sharma, N., Blumenstein, M., & Yu, S. (2020) · Digital Communications and Networks · doi:10.1016/j.dcan.2020.11.001 · Cited by 39 · see citing works
“To defend attacks in the training phase, data sanitization [9] was used to identify and remove the poisoned data from the training dataset.”
MethodHallucination of Multimodal Large Language Models: A Survey
Bai, Z., Wang, P., Xiao, T., He, T., Han, Z., Zhang, Z., & Shou, M. Z. (2024) · arXiv · doi:10.48550/arxiv.2404.18930 · Cited by 38 · see citing works
“Unlearning refers to a technique designed to induce a model to ’forget’ specific behaviors or data, primarily through the application of gradient ascent methods [9].”
Ginseng: Keeping Secrets in Registers When You Distrust the Operating System
Yun, M. H., & Zhong, L. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23327 · Cited by 37 · see citing works
“5 decision tree implementation used by recent works on model security [12], [24] and use Ginseng to protect the information on what attribute to be chosen at a decision node.”
MethodMachine Unlearning via Representation Forgetting With Parameter Self-Sharing
Wang, W., Zhang, C., Tian, Z., & Yu, S. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3331239 · Cited by 36 · see citing works
“The concept of machine unlearning has been introduced as an effective approach for removing the impact of specific data on a trained model in an efficient manner [1], [20], [21].”
BackgroundMachine Unlearning: Taxonomy, Metrics, Applications, Challenges, and Prospects
Li, N., Zhou, C., Gao, Y., Chen, H., Zhang, Z., Kuang, B., & Fu, A. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3530988 · Cited by 53 · see citing works
“Due to privacy and security concerns, data contributors may want to withdraw his/her personal data (or specific data features, etc.) from the deployed model [12].”
InfluentialNo Matter How You Slice It: Machine Unlearning with SISA Comes at the Expense of Minority Classes
Koch, K., & Soll, M. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00047 · Cited by 34 · see citing works
“RELATED WORK The topic of Machine Unlearning [2], [3] or the removal of data from trained models is a recent topic in machine learning [4], [6]-[9].”
Background
- Authors
- Cao, Y., & Yang, J.
- Affiliations
- Columbia University (US)
- Venue
- 2015 IEEE Symposium on Security and Privacy
- Publisher
- IEEE
- Published
- 2015-05
- Pages
- 463-480
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W1488996941
- Semantic Scholar
- 2f2ade8c4944a96a44e6f70ef403b80b058d1725
- Cited by
- 622
- References
- 54
- Citations by year
- 2026: 135 · 2025: 165 · 2024: 116 · 2023: 66 · 2022: 37 · 2021: 48 · 2020: 20 · 2019: 13 · 2018: 9 · 2017: 9 · 2016: 4
- FWCI
- 4.13
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Funders
- National Science Foundation (1054906, 1162021, FA8750-10-2-0253, FA8650-11-C-7190)
- Office of Naval Research (N00014-12-1-0166, N00014-12-1, N00014)
- Air Force Office of Scientific Research
- Air Force Research Laboratory
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Keywords
- machine unlearning, data lineage, privacy, anomaly detection, data poisoning, feature selection, recommender systems, data propagation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
