Do machine-unlearning methods actually forget, or do they only appear to forget under standard benchmarks?
This project evaluates machine-unlearning techniques beyond conventional accuracy metrics by testing whether supposedly forgotten information can be recovered under adversarial and repeated-deletion conditions.
Using PyTorch, ResNet-18, and CIFAR-10, I implemented and compared six unlearning approaches across utility, forgetting effectiveness, privacy leakage, computational cost, similarity to full retraining, and robustness under stress tests.
- Trained a ResNet-18 baseline achieving 92.35% test accuracy on CIFAR-10.
- Implemented and benchmarked 6 machine-unlearning methods.
- Developed a two-phase Retain-Protected Gradient Ascent (RPGA) approach that achieved:
- 0% forget-set accuracy
- 80.3% retain-set accuracy
- 0.002 membership-inference score, compared with 0.034 for vanilla Gradient Ascent.
- Found that methods appearing successful under standard forgetting metrics remained vulnerable to relearning attacks.
- Forgotten knowledge could recover to 100% accuracy within approximately 20 fine-tuning steps in stress testing.
- Evaluated both class-level deletion and sample-level deletion rather than relying on a single unlearning scenario.
Machine unlearning aims to remove the influence of selected training data from a trained model without retraining the entire model from scratch.
This is increasingly relevant for:
- privacy-sensitive machine learning,
- data-deletion requests,
- regulatory compliance,
- removal of corrupted or poisoned data,
- and maintaining continuously updated ML systems.
A major problem, however, is that a model can achieve low accuracy on a forgotten class while still retaining information internally.
This project asks a stricter question:
If a model says it forgot something, can that knowledge still be recovered?
To investigate that question, I evaluated unlearning methods not only on immediate post-unlearning accuracy, but also through privacy attacks, retraining comparisons, sequential deletions, and relearning experiments.
| Method | Approach |
|---|---|
| Retraining from Scratch | Gold-standard baseline trained only on retained data |
| Fine-Tuning | Continues training the original model on retained samples |
| Gradient Ascent | Maximizes loss on samples that should be forgotten |
| Random Relabeling | Reassigns labels to forget samples before additional training |
| Informed SISA | Uses strategically constructed shards to reduce retraining cost |
| RPGA | Retain-Protected Gradient Ascent designed to improve forgetting while preserving retained knowledge |
Full retraining serves as the reference point because it produces a model that never trains on the deleted data.
Standard Gradient Ascent can aggressively erase information associated with the forget set, but it may also damage useful knowledge learned from retained data.
I explored a two-phase Retain-Protected Gradient Ascent (RPGA) strategy designed to balance these competing objectives:
- Increase loss on the data that must be forgotten.
- Protect performance on the retained dataset.
- Stop or adjust optimization when retained utility degrades excessively.
- Evaluate whether forgetting survives subsequent attacks.
The resulting model achieved:
| Metric | RPGA Result |
|---|---|
| Forget Accuracy | 0% |
| Retain Accuracy | 80.3% |
| Membership-Inference Score | 0.002 |
| Vanilla Gradient Ascent MIA | 0.034 |
These results suggest strong immediate forgetting and substantially lower membership signal than vanilla Gradient Ascent.
But immediate metrics were not the end of the evaluation.
A central contribution of this project is evaluating what happens after an unlearning algorithm appears successful.
After unlearning, the model is exposed again to a small amount of forgotten-class data.
The experiment asks:
How quickly can supposedly erased knowledge return?
Despite strong post-unlearning metrics, forgotten knowledge recovered rapidly, reaching 100% accuracy in approximately 20 fine-tuning steps in the tested setting.
This demonstrates an important distinction between:
behavioral forgetting and true removal of learned information.
Real systems may receive more than one deletion request.
I therefore tested how unlearning methods behave when deletion operations are applied repeatedly rather than only once.
This evaluates whether:
- retained accuracy degrades,
- forgetting becomes less effective,
- and errors accumulate across deletion operations.
The project also examines situations where forgotten and retained knowledge are not cleanly isolated.
This provides a more difficult test of whether an unlearning method can selectively remove information without damaging related representations.
In addition to deleting an entire class, the experiments include 500 randomly selected training samples as a separate forget set.
This more closely resembles realistic requests where individual records, rather than complete classes, must be removed.
I evaluated each method across multiple dimensions rather than using forget accuracy alone.
Measures whether the model remains useful after unlearning.
- retained-data accuracy
- overall predictive performance
Measures how strongly performance on deleted information decreases.
- forget-set accuracy
- class-level and sample-level deletion behavior
Uses a confidence-based Membership Inference Attack (MIA) to estimate whether forgotten samples still exhibit membership signals.
Lower values indicate behavior closer to a model that has not retained identifiable membership information.
Because retraining from scratch is the gold-standard deletion method, unlearned models are compared against a retrained model using:
- prediction agreement,
- output-distribution divergence,
- and retained/forgotten accuracy.
Runtime is measured to examine the practical trade-off between:
complete retraining and approximate unlearning.
| Component | Configuration |
|---|---|
| Dataset | CIFAR-10 |
| Architecture | ResNet-18 |
| Framework | PyTorch |
| Original Training Set | 50,000 images |
| Test Set | 10,000 images |
| Class-Level Forget Set | One CIFAR-10 class |
| Sample-Level Forget Set | 500 randomly selected samples |
| Optimization | SGD |
| Hardware | NVIDIA Tesla T4 GPU |
| Random Seed | 42 |
The ResNet-18 architecture was adapted for CIFAR-10 by replacing the original ImageNet input configuration with a smaller convolutional stem and removing max pooling.
Machine Learning
- Python
- PyTorch
- Torchvision
- ResNet-18
- scikit-learn
Data & Evaluation
- NumPy
- Matplotlib
- ROC-AUC
- Membership Inference Attacks
- KL divergence
- prediction-agreement analysis
Experimentation
- Jupyter Notebook
- Kaggle GPU
- NVIDIA Tesla T4
- reproducible random seeds
Stress-Testing-Machine-Unlearning/
│
├── README.md
│
├── notebooks/
│ └── machine_unlearning_experiments.ipynb
│
└── docs/
├── machine_unlearning_report.pdf
└── machine_unlearning_presentation.pptx
git clone https://github.com/Musharaf-khan/Stress-Testing-Machine-Unlearning.git
cd Stress-Testing-Machine-Unlearningpip install torch torchvision numpy matplotlib scikit-learn jupyterjupyter notebook notebooks/machine_unlearning_experiments.ipynbThe notebook automatically uses CUDA when a compatible GPU is available.
The most important result from this project was not simply identifying which algorithm produced the lowest forget accuracy.
It was discovering that:
Passing a standard unlearning benchmark does not necessarily mean the underlying information has been permanently removed.
Several approaches could make a model behave as though a class had been forgotten immediately after unlearning, yet relearning experiments showed that the information could return rapidly.
This suggests that robust evaluation of machine unlearning should include post-unlearning attacks and stress tests, not only immediate accuracy measurements.
This project gave me hands-on experience with:
- designing controlled ML experiments,
- implementing machine-unlearning algorithms,
- training and evaluating deep neural networks,
- balancing model utility against forgetting,
- membership-inference privacy evaluation,
- adversarial stress testing,
- GPU-based experimentation,
- and interpreting results beyond a single benchmark metric.
More importantly, it reinforced an engineering principle that applies beyond machine unlearning:
a system should be evaluated under the conditions in which it is likely to fail, not only under the conditions in which it was designed to succeed.
Musharaf Khan Pathan
B.S. Computer Science, Illinois Institute of Technology