PreprintCited by 193Privacy-Preserving Technologies in DataPrivacy, Security, and Data ProtectionAdversarial Robustness in Machine Learning

A Survey of Machine Unlearning

Open access
Nguyen, Thanh Tam, Huynh, Thanh Trung, Ren, Zhao, Nguyen, Phi Le, Liew, Alan Wee-Chung, Yin, Hongzhi, Nguyen, Quoc Viet Hung·2022·arXiv

Abstract

Today, computer systems hold large amounts of personal data. Yet while such an abundance of data allows breakthroughs in artificial intelligence, and especially machine learning (ML), its existence can be a threat to user privacy, and it can weaken the bonds of trust between humans and AI. Recent regulations now require that, on request, private information about a user must be removed from both computer systems and from ML models, i.e. ``the right to be forgotten''). While removing data from back-end databases should be straightforward, it is not sufficient in the AI context as ML models often `remember' the old data. Contemporary adversarial attacks on trained models have proven that we can learn whether an instance or an attribute belonged to the training data. This phenomenon calls for a new paradigm, namely machine unlearning, to make ML models forget about particular data. It turns out that recent works on machine unlearning have not been able to completely solve the problem due to the lack of common frameworks and resources. Therefore, this paper aspires to present a comprehensive examination of machine unlearning's concepts, scenarios, methods, and applications. Specifically, as a category collection of cutting-edge studies, the intention behind this article is to serve as a comprehensive resource for researchers and practitioners seeking an introduction to machine unlearning and its formulations, design criteria, removal requests, algorithms, and applications. In addition, we aim to highlight the key findings, current trends, and new research areas that have not yet featured the use of machine unlearning but could benefit greatly from it. We hope this survey serves as a valuable resource for ML researchers and those seeking to innovate privacy technologies. Our resources are publicly available at https://github.com/tamlhp/awesome-machine-unlearning.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2209.02299

Cites

245 of 245 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Related surveys on digital forgetting and machine unlearning have focused on the general ML case by considering models used to classify tabular or image data.

    “Related surveys on digital forgetting and machine unlearning, such as Qu et al (2023); Xu et al (2023); Nguyen et al (2022); Shaik et al (2023), have focused on the general ML case by considering models used to classify tabular or image data.”

    From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Nguyen et al 2022

    The Introduction (p. 2) describes this as a comprehensive survey of machine unlearning, and the published-datasets table (pp. 14–16) includes tabular and image classification. But the same table also covers text, sequence, and graph data, so the source does not support characterizing its focus solely as classification of tabular or image data. (LLM, conf=0.84)

    Experimental — accuracy not yet measured
  • Nguyen et al refer to two levels of forgetting guarantees, exact and approximate, and Xu et al further expand approximate forgetting into strong and weak forgetting, where strong forgetting is equivalent to Nguyen et al's approximate forgetting and weak forgetting only applies to model outputs.

    “Nguyen et al (2022) refer to two levels of guarantees, exact and approximate . Xu et al (2023) further expand approximate forgetting into strong and weak forgetting, where strong forgetting is equivalent to the definition of approximate forgetting by Nguyen et al ( 2022), and weak forgetting only applies to the outputs of the model.”

    From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Nguyen et al 2022

  • Definitions of unlearning by Nguyen et al and Xu et al include the original training dataset D as a parameter of the unlearning mechanism, but access to D is not always feasible.

    “Definitions of unlearning by Nguyen et al (2022); Xu et al (2023) include D as a parameter of the unlearning mechanism (as in F ( D,D f , A ( D )) ), but access to D is not always feasible.”

    From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Nguyen et al 2022

  • The unlearning guarantees defined by Nguyen et al (2022) and Xu et al (2023) are heavily inspired by differential privacy, and privacy attacks such as MIAs or reconstruction attacks have been used to measure privacy leak risk and evaluate unlearning effectiveness.

    “Not surprisingly, the unlearning guarantees defined by Nguyen et al ( 2022) and Xu et al (2023 ) are heavily inspired by differential pri -vacy, and privacy attacks, such as membership inference attacks or reconstruction attacks, have been used to measure the risk of privacy leaks and to evaluate the effectiveness of unlearning.”

    From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Nguyen et al (2022)

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

18 of the 263 references couldn’t be matched to a known paper.

Research works printed but not linked: 19

  1. [15][15] Gert Cauwenberghs et al. 2000. Incremental and decremental support vector machine learning. NIPS 13 (2000). -
  2. [22][22] Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. 2021. Graph unlearning. arXiv preprint arXiv:2103.14991 (2021). - · arXiv
  3. [26][26] Jiali Cheng, George Dasoulas, Huan He, Chirag Agarwal, and Marinka Zitnik. 2023. GNNDelete: A General Strategy for Unlearning in Graph Neural Networks. In ICLR . -
  4. [36][36] Nicola K Dinsdale, Mark Jenkinson, et al. 2020. Unlearning scanner bias for mri harmonisation. In MICCAI . 369-378. -
  5. [46][46] Stefan Feuerriegel, Mateusz Dolata, and Gerhard Schwabe. 2020. Fair AI. Business & information systems engineering 62, 4 (2020), 379-384. -
  6. [48][48] Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014. Privacy in pharmacogenetics: An { End-to-End } case study of personalized warfarin dosing. In USENIX Security . 17-32. -
  7. [55][55] Johannes Gasteiger, Aleksandar Bojchevski, and Stephan Günnemann. 2019. Combining Neural Networks with Personalized PageRank for Classification on Graphs. In ICLR . -
  8. [65][65] Ruocheng Guo, Lu Cheng, Jundong Li, P Richard Hahn, and Huan Liu. 2020. A survey of learning causality with data: Problems and methods. CSUR 53, 4 (2020), 1-37. -
  9. [69][69] William L Hamilton. 2020. Graph representation learning. Synthesis Lectures on Artifical Intelligence and Machine Learning 14, 3 (2020), 1-159. -
  10. [85][85] Masayuki Karasuyama and Ichiro Takeuchi. 2010. Multiple incremental decremental learning of support vector machines. IEEE Transactions on Neural Networks 21, 7 (2010), 1048-1059. -
  11. [123][123] Salvatore Mercuri, Raad Khraishi, Ramin Okhrati, Devesh Batra, Conor Hamill, Taha Ghasempour, and Andrew Nowlan. 2022. An introduction to machine unlearning. arXiv preprint arXiv:2209.00939 (2022). - · arXiv
  12. [125][125] Junhyun Nam, Hyuntak Cha, Sungsoo Ahn, Jaeho Lee, and Jinwoo Shin. 2020. Learning from failure: De-biasing classifier from biased classifier. NIPS 33 (2020), 20673-20684. -
  13. [130][130] Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. 2022. A Survey of Machine Unlearning. arXiv preprint arXiv:2209.02299 (2022). , , -
  14. [134][134] Stuart L Pardau. 2018. The California consumer privacy act: Towards a Europeanstyle privacy regime in the United States. J. Tech. L. & Pol'y 23 (2018), 68. -
  15. [157][157] S Shan, E Wenger, J Zhang, H Li, H Zheng, and BY Zhao. 2020. Protecting Personal Privacy against Una uthorized Deep Learning Models. In USENIX Security . 1-16. -
  16. [163][163] Abhijeet Singh and Abhineet Anand. 2017. Data leakage detection using cloud computing. IJECS 6, 4 (2017). -
  17. [165][165] Yash Sinha, Murari Mandal, and Mohan Kankanhalli. 2024. Multi-Modal Recommendation Unlearning. arXiv preprint arXiv:2405.15328 (2024). - · arXiv
  18. [189][189] Cheng-Long Wang, Mengdi Huai, and Di Wang. 2023. Inductive graph unlearning. In USENIX . 3205-3222. -
  19. [204][204] Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S. Yu. 2023. Machine Unlearning: A Survey. CSUR 56, 1 (2023), 36. -

Cited by

Sorted by citations

Authors
Nguyen, T. T., Huynh, T. T., Ren, Z., Nguyen, P. L., Liew, A. W.-C., Yin, H., & Nguyen, Q. V. H.
Affiliations
  • VinUniversity (VN)
  • University of Bremen (DE)
  • Trường Đại học Khoa học và Công nghệ Hà Nội (VN)
  • Griffith University (AU)
  • The University of Queensland (AU)
Venue
arXiv
Publisher
arXiv
Published
2022
Volume
16
Issue
5
Pages
1-46
ISSN
2157-6904 (ISSN-L)
OpenAlex
W4412565294
Cited by
193
References
263
Citations by year
2026: 75 · 2025: 53 · 2024: 45 · 2023: 20
FWCI
51.16
Type
journal article
Language
en
Open access
Locations
  • ACM Transactions on Intelligent Systems and Technology (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • Griffith Research Online (submittedVersion)
  • arXiv (Cornell University)
Funders
Australian Research Council
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
machine unlearning, right to be forgotten, privacy, adversarial attacks, training data reconstruction, personal data protection, privacy-preserving machine learning

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review