The DOI matches its DataCite record; 245 of the 263 references it cites were found in a registry or an index.
A Survey of Machine Unlearning
Open accessAbstract
Today, computer systems hold large amounts of personal data. Yet while such an abundance of data allows breakthroughs in artificial intelligence, and especially machine learning (ML), its existence can be a threat to user privacy, and it can weaken the bonds of trust between humans and AI. Recent regulations now require that, on request, private information about a user must be removed from both computer systems and from ML models, i.e. ``the right to be forgotten''). While removing data from back-end databases should be straightforward, it is not sufficient in the AI context as ML models often `remember' the old data. Contemporary adversarial attacks on trained models have proven that we can learn whether an instance or an attribute belonged to the training data. This phenomenon calls for a new paradigm, namely machine unlearning, to make ML models forget about particular data. It turns out that recent works on machine unlearning have not been able to completely solve the problem due to the lack of common frameworks and resources. Therefore, this paper aspires to present a comprehensive examination of machine unlearning's concepts, scenarios, methods, and applications. Specifically, as a category collection of cutting-edge studies, the intention behind this article is to serve as a comprehensive resource for researchers and practitioners seeking an introduction to machine unlearning and its formulations, design criteria, removal requests, algorithms, and applications. In addition, we aim to highlight the key findings, current trends, and new research areas that have not yet featured the use of machine unlearning but could benefit greatly from it. We hope this survey serves as a valuable resource for ML researchers and those seeking to innovate privacy technologies. Our resources are publicly available at https://github.com/tamlhp/awesome-machine-unlearning.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Related surveys on digital forgetting and machine unlearning, such as Qu et al (2023); Xu et al (2023); Nguyen et al (2022); Shaik et al (2023), have focused on the general ML case by considering models used to classify tabular or image data.”
From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Nguyen et al 2022
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“Nguyen et al (2022) refer to two levels of guarantees, exact and approximate . Xu et al (2023) further expand approximate forgetting into strong and weak forgetting, where strong forgetting is equivalent to the definition of approximate forgetting by Nguyen et al ( 2022), and weak forgetting only applies to the outputs of the model.”
From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Nguyen et al 2022
The cited source says what the claim attributes to it.
In the citing paper
“Definitions of unlearning by Nguyen et al (2022); Xu et al (2023) include D as a parameter of the unlearning mechanism (as in F ( D,D f , A ( D )) ), but access to D is not always feasible.”
From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Nguyen et al 2022
The cited source says what the claim attributes to it.
In the citing paper
“Not surprisingly, the unlearning guarantees defined by Nguyen et al ( 2022) and Xu et al (2023 ) are heavily inspired by differential pri -vacy, and privacy attacks, such as membership inference attacks or reconstruction attacks, have been used to measure the risk of privacy leaks and to evaluate the effectiveness of unlearning.”
From Digital forgetting in large language models: a survey of unlearning methods (2025) · cites this paper as Nguyen et al (2022)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Items 201–245 of 245
A survey of security and privacy issues of machine unlearning
Chen, A., Li, Y., Zhao, C., & Huai, M. (2025) · AI Magazine · doi:10.1002/aaai.12209 · Cited by 13
Making Machine Learning Forget
Shintre, S., Roundy, K. A., & Dhaliwal, J. (2019) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-21752-5_6 · Cited by 13 · cited 2×
“the problem completely due to the lack of common frameworks and resources [128, 134, 153, 154].”
Machine Unlearning Method Based On Projection Residual
Cao, Z., Wang, J., Si, S., Huang, Z., & Xiao, J. (2022) · IEEE International Conference on Data Science and Advanced Analytics (DSAA) · doi:10.1109/dsaa54385.2022.10032413 · Cited by 13 · cited 4×
“For layers with convex activation functions, existing unlearning methods such as certified removal mechanisms can be applied [15, 59, 109, 133].”
InfluentialFederated Unlearning: a Perspective of Stability and Fairness
Shao, J.-Q., Lin, T., Cao, X., & Luo, B. (2024) · arXiv.org · doi:10.48550/arxiv.2402.01276 · Cited by 13
Bayesian Inference ForgettingPreprint
Fu, S., He, F., Xu, Y., & Tao, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.06417 · Cited by 13 · cited 1×
“wrong output ( ZRF = 0) or random output ( ZRF = ( )”
Forgetting Fast in Recommender SystemsPreprint
Liu, W., Wan, J., Wang, X., Zhang, W., Zhang, D., & Li, H. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2208.06875 · Cited by 13
Class Clown: Data Redaction in Machine Unlearning at Enterprise Scale
Felps, D., Schwickerath, A., Williams, J., Vuong, T., Briggs, A., Hunt, M., Sakmar, E., Saranchak, D., & Shumaker, T. (2021) · Proceedings of the 10th International Conference on Operations Research and Enterprise Systems · doi:10.5220/0010419600070014 · Cited by 12 · cited 3×
“More precisely, data redaction aims to poison the label information of the forget data inside the model [40].”
InfluentialLearning Mathematics “Asyik” with Youtube Educative Media
Sari, W., Samosir, B., Sahara, N., et al. (2020) · Journal of Physics, Conference Series · doi:10.1088/1742-6596/1477/2/022012 · Cited by 12
Certifiable Machine Unlearning for Linear ModelsPreprint
Mahadevan, A., & Mathioudakis, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.15093 · Cited by 11
Certifiable Unlearning Pipelines for Logistic Regression: An Experimental Study
Mahadevan, A., & Mathioudakis, M. (2022) · Machine Learning and Knowledge Extraction · doi:10.3390/make4030028 · Cited by 10
Continual Learning and Private UnlearningPreprint
Liu, B., Liu, Q., & Stone, P. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2203.12817 · Cited by 9
DeepObliviate: A Powerful Charm for Erasing Data Residual Memory in Deep Neural Networks
He, Y., Meng, G., Chen, K., He, J., & Hu, X. (2021) · arXiv · doi:10.48550/arxiv.2105.06209 · Cited by 9 · cited 2×
“• The degradation count: is defined as the ratio between the”
Unlearning Scanner Bias for MRI Harmonisation in Medical Image Segmentation
Dinsdale, N. K., Jenkinson, M., & Namburete, A. I. L. (2020) · Communications in computer and information science · doi:10.1007/978-3-030-52791-4_2 · Cited by 9
Formalizing Data Deletion in the Context of the Right to Be Forgotten
Garg, S., Goldwasser, S., & Vasudevan, P. N. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-45724-2_13 · Cited by 8 · cited 1×
“(Bounded/Certified Unlearning) Definition 1 ( 𝜖 -Approximate Unlearning). algorithm 𝐴 if ∀T ⊆ H ,𝐷 ∈ 𝑍 ∗ ,𝑧 ∈ 𝐷 :”
Wang, B. L., & Schelter, S. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2201.13313 · Cited by 8
Machine Unlearning: An Overview of the Paradigm Shift in the Evolution of AI
Jaman, L., Alsharabi, R., & Elkafrawy, P. (2024) · Learning and Technology Conference (L&T) · doi:10.1109/lt60077.2024.10469232 · Cited by 7
Machine Unlearning Through Fine-Grained Model Parameters Perturbation
Zuo, Z., Tang, Z., Li, K., & Datta, A. (2025) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2025.3528551 · Cited by 7
Machine Unlearning Methodology Based on Stochastic Teacher Network
Zhang, X., Wang, J., Cheng, N., Sun, Y., Zhang, C., & Xiao, J. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-46677-9_18 · Cited by 7
Evaluating Machine Unlearning via Epistemic UncertaintyPreprint
Becker, A., & Liebig, T. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2208.10836 · Cited by 6
$$\mathsf {EMA}$$: Auditing Data Removal from Trained Models
Huang, Y., Li, X., & Li, K. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-87240-3_76 · Cited by 6
A Unified PAC-Bayesian Framework for Machine Unlearning via Information Risk Minimization
Jose, S. T., & Simeone, O. (2021) · Machine learning for signal processing ... · doi:10.1109/mlsp52302.2021.9596170 · Cited by 6 · cited 1×
“wrong output ( ZRF = 0) or random output ( ZRF = ( )”
Federated unlearning for medical image analysis
Zhong, Y. (2024) · Other Conferences · doi:10.1117/12.3030004 · Cited by 6
Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and TaxonomyPreprint
Shaik, T., Tao, X., Xie, H., et al. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2305.06360 · Cited by 6
Graves, L., Nagisetty, V., & Ganesh, V. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i13.17371 · Cited by 5 · cited 7×
“com/inspire-group/unlearning-verification AmnesiacML [58] Python Model-agnostic https://github.”
InfluentialMachine Unlearning: Its Need and Implementation Strategies
Tahiliani, A., Hassija, V., Chamola, V., & Guizani, M. (2021) · International Conference on Contemporary Computing · doi:10.1145/3474124.3474158 · Cited by 5
Debunking Misinformation on the Web: Detection, Validation, and Visualisation
Nguyen, T. (2019) · doi:10.5075/epfl-thesis-9694 · Cited by 5
Self-citationA Decision-Making Process to Implement the ‘Right to Be Forgotten’ in Machine Learning
Hawkins, K., Alhuwaish, N., Belguith, S., Vranaki, A., & Charlesworth, A. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-61089-9_2 · Cited by 5
Verifiable and Provably Secure Machine UnlearningPreprint
Eisenhofer, T., Riepel, D., Chandrasekaran, V., Ghosh, E., Ohrimenko, O., & Papernot, N. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2210.09126 · Cited by 5
Knowledge Unlearning for Mitigating Privacy Risks in Language Models
Jang, J., Yoon, D., Yang, S., Cha, S., Lee, M., Logeswaran, L., & Seo, M. (2022) · arXiv · doi:10.48550/arxiv.2210.01504 · Cited by 4
Anatomizing Bias in Facial Analysis
Singh, R., Majumdar, P., Mittal, S., & Mayank Vatsa, A. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i11.21500 · Cited by 4 · cited 1×
“and unbiased feature representation [108, 120, 141, 165], where, machine unlearning, e.”
Chen, K., Huang, Y., & Wang, Y. (2021) · arXiv · doi:10.48550/arxiv.2111.11869 · Cited by 4 · cited 1×
“the parameter distribution of the original model 𝐴 ( 𝐷 ) ∼ 𝑃𝑟 ( 𝑤 | 𝐷 ) .”
Learn to Forget: Machine Unlearning via Neuron MaskingPreprint
Liu, Y., Ma, Z., Liu, X., Liu, J., Jiang, Z., Ma, J., Yu, P. S., & Ren, K. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.10933 · Cited by 4
One-Shot Machine Unlearning with Mnemonic CodePreprint
Yamashita, T., Yamada, M., & Shibata, T. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2306.05670 · Cited by 3
An Investigation on Learning, Polluting, and Unlearning the Spam Emails for Lifelong Learning
Parne, N., Puppaala, K., Bhupathi, N., et al. (2021) · doi:10.48550/arxiv.2111.14609 · Cited by 3
Revisiting Machine Learning Training Process for Enhanced Data Privacy
Goyal, A., Hassija, V., & de Albuquerque, V. H. C. (2021) · International Conference on Contemporary Computing · doi:10.1145/3474124.3474208 · Cited by 3 · cited 1×
“wrong output ( ZRF = 0) or random output ( ZRF = ( )”
Towards Efficient Target-Level Machine Unlearning Based on Essential Graph
Xu, H., Zhu, T.-Q., Zhang, L.-F., et al. (2024) · arXiv.org · doi:10.48550/arxiv.2406.10954 · Cited by 2
Towards Adversarial Evaluations for Inexact Machine UnlearningPreprint
Goel, S., Prabhu, A., Sanyal, A., et al. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2201.06640 · Cited by 2
Dissecting Language Models: Machine Unlearning via Selective Pruning
Pochinkov, N., & Schoots, N. (2024) · arXiv · doi:10.48550/arxiv.2403.01267 · Cited by 1
Fair Machine Unlearning: Data Removal while Mitigating DisparitiesPreprint
Oesterling, A., Ma, J., Calmon, F. P., & Lakkaraju, H. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2307.14754 · Cited by 1
Backdoor Defense with Machine UnlearningPreprint
Liu, Y., Fan, M., Chen, C., et al. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2201.09538 · Cited by 1
ModelPred: A Framework for Predicting Trained Model from Training DataPreprint
Zeng, Y., Wang, J. T., Chen, S., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.12545
Class Clown: Data Redaction in Machine Unlearning at Enterprise ScalePreprint
Felps, D., Schwickerath, A. D., Williams, J. D., Vuong, T. N., Briggs, A., Hunt, M., Sakmar, E., Saranchak, D. D., & Shumaker, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.04699
FAST: Feature Aware Similarity Thresholding for Weak Unlearning in Black-Box Generative ModelsPreprint
Panda, S., & Prathosh, A. P. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2312.14895
Towards Efficient and Effective Unlearning of Large Language Models for RecommendationPreprint
Wang, H., Lin, J., Chen, B., et al. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2403.03536
(2008) · doi:10.1201/b17320-16 · cited 1×
“The Cora dataset [131] includes 2708 scientific papers categorised into one of seven categories.”
Research works printed but not linked: 19
- [15][15] Gert Cauwenberghs et al. 2000. Incremental and decremental support vector machine learning. NIPS 13 (2000). -
- [22][22] Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. 2021. Graph unlearning. arXiv preprint arXiv:2103.14991 (2021). - · arXiv
- [26][26] Jiali Cheng, George Dasoulas, Huan He, Chirag Agarwal, and Marinka Zitnik. 2023. GNNDelete: A General Strategy for Unlearning in Graph Neural Networks. In ICLR . -
- [36][36] Nicola K Dinsdale, Mark Jenkinson, et al. 2020. Unlearning scanner bias for mri harmonisation. In MICCAI . 369-378. -
- [46][46] Stefan Feuerriegel, Mateusz Dolata, and Gerhard Schwabe. 2020. Fair AI. Business & information systems engineering 62, 4 (2020), 379-384. -
- [48][48] Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014. Privacy in pharmacogenetics: An { End-to-End } case study of personalized warfarin dosing. In USENIX Security . 17-32. -
- [55][55] Johannes Gasteiger, Aleksandar Bojchevski, and Stephan Günnemann. 2019. Combining Neural Networks with Personalized PageRank for Classification on Graphs. In ICLR . -
- [65][65] Ruocheng Guo, Lu Cheng, Jundong Li, P Richard Hahn, and Huan Liu. 2020. A survey of learning causality with data: Problems and methods. CSUR 53, 4 (2020), 1-37. -
- [69][69] William L Hamilton. 2020. Graph representation learning. Synthesis Lectures on Artifical Intelligence and Machine Learning 14, 3 (2020), 1-159. -
- [85][85] Masayuki Karasuyama and Ichiro Takeuchi. 2010. Multiple incremental decremental learning of support vector machines. IEEE Transactions on Neural Networks 21, 7 (2010), 1048-1059. -
- [123][123] Salvatore Mercuri, Raad Khraishi, Ramin Okhrati, Devesh Batra, Conor Hamill, Taha Ghasempour, and Andrew Nowlan. 2022. An introduction to machine unlearning. arXiv preprint arXiv:2209.00939 (2022). - · arXiv
- [125][125] Junhyun Nam, Hyuntak Cha, Sungsoo Ahn, Jaeho Lee, and Jinwoo Shin. 2020. Learning from failure: De-biasing classifier from biased classifier. NIPS 33 (2020), 20673-20684. -
- [130][130] Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. 2022. A Survey of Machine Unlearning. arXiv preprint arXiv:2209.02299 (2022). , , -
- [134][134] Stuart L Pardau. 2018. The California consumer privacy act: Towards a Europeanstyle privacy regime in the United States. J. Tech. L. & Pol'y 23 (2018), 68. -
- [157][157] S Shan, E Wenger, J Zhang, H Li, H Zheng, and BY Zhao. 2020. Protecting Personal Privacy against Una uthorized Deep Learning Models. In USENIX Security . 1-16. -
- [163][163] Abhijeet Singh and Abhineet Anand. 2017. Data leakage detection using cloud computing. IJECS 6, 4 (2017). -
- [165][165] Yash Sinha, Murari Mandal, and Mohan Kankanhalli. 2024. Multi-Modal Recommendation Unlearning. arXiv preprint arXiv:2405.15328 (2024). - · arXiv
- [189][189] Cheng-Long Wang, Mengdi Huai, and Di Wang. 2023. Inductive graph unlearning. In USENIX . 3205-3222. -
- [204][204] Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S. Yu. 2023. Machine Unlearning: A Survey. CSUR 56, 1 (2023), 36. -
Cited by
Sorted by citations
Longo, L., Brcic, M., Cabitza, F., Choi, J., Confalonieri, R., Ser, J. D., Guidotti, R., Hayashi, Y., Herrera, F., Holzinger, A., et al. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102301 · Cited by 626
“While the interest in the machine unlearning paradigm [280] has been on the rise [281], it is unclear how to efficiently ensure that data owned by a particular user is unlearned by a given large-scale generative model, so that it can be ensured that no instance like that of the user claiming their…”
BackgroundXu, H., Zhu, T., Zhang, L., Zhou, W., & Yu, P. S. (2024) · ACM Computing Surveys · doi:10.1145/3603620 · Cited by 164
A Survey on Federated Unlearning: Challenges, Methods, and Future Directions
Liu, Z., Jiang, Y., Shen, J., Peng, M., Lam, K., Yuan, X., & Liu, X. (2024) · ACM Computing Surveys · doi:10.1145/3679014 · Cited by 182
“A detailed comparison of related FU surveys is summarized in Table 1.”
Generative AI in EU law: Liability, privacy, intellectual property, and cybersecurity
Novelli, C., Casolari, F., Hacker, P., Spedicato, G., & Floridi, L. (2024) · Computer Law & Security Review · doi:10.1016/j.clsr.2024.106066 · Cited by 124
FedRecovery: Differentially Private Machine Unlearning for Federated Learning Frameworks
Zhang, L., Zhu, T., Zhang, H., Xiong, P., & Zhou, W. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3297905 · Cited by 118
“It stems from the increasingly urgent requirement of individuals for data protection, and is one of the centrepieces of machine learning research [1], [2].”
Background
Metadata
- Authors
- Nguyen, T. T., Huynh, T. T., Ren, Z., Nguyen, P. L., Liew, A. W.-C., Yin, H., & Nguyen, Q. V. H.
- Affiliations
- VinUniversity (VN)
- University of Bremen (DE)
- Trường Đại học Khoa học và Công nghệ Hà Nội (VN)
- Griffith University (AU)
- The University of Queensland (AU)
- ORCID
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2022
- Volume
- 16
- Issue
- 5
- Pages
- 1-46
- ISSN
- 2157-6904 (ISSN-L)
- arXiv
- 2209.02299
- OpenAlex
- W4412565294
- Cited by
- 193
- References
- 263
- Citations by year
- 2026: 75 · 2025: 53 · 2024: 45 · 2023: 20
- FWCI
- 51.16
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- ACM Transactions on Intelligent Systems and Technology (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Griffith Research Online (submittedVersion)
- arXiv (Cornell University)
- Funders
- Australian Research Council
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- machine unlearning, right to be forgotten, privacy, adversarial attacks, training data reconstruction, personal data protection, privacy-preserving machine learning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
