Do Influence-Derived Data Perturbations Enable Machine Unlearning? A Controlled Study of Three Plausible Roles
Chenkai Wu, Chrispine Kambimbi, Qinyang Zeng, Jun Yan
cs.AI
Quick verdict
Careful role-matched study: influence-derived perturbations (DPL) fail direct unlearning, show inconsistent utility, and add cost as warm start on CIFAR-10.
Summary
This paper audits Deep Perturbation Learning (DPL), a method that perturbs training images and labels along influence-derived directions, in three roles previously suggested for machine unlearning: direct deletion, utility regularization, and warm-starting adversarial unlearning. Before comparing, the authors audit the public implementation and find two defects: image directions are computed on augmented, normalized tensors but applied to raw images, and the label perturbation is below float32 resolution so labels never change. Using corrected directions, exact-seed retraining references, and predeclared pass/fail gates, they evaluate CIFAR-10/ResNet-18 across three paired seeds plus a one-seed Tiny ImageNet check. DPL fails the direct-deletion gate in all three seeds; its best seed-1 checkpoint reaches average discrepancy 4.366 versus 1.745 for SalUn and 3.935 for AMUN despite preserving test accuracy. Utility gains are inconsistent in sign across seeds (passing in one of three), and as a warm start DPL tracks FGSM initialization while adding 47-66 seconds of direction-computation cost, never beating both simpler initializations. The Tiny ImageNet check exposes a preprocessing defect that changes outcomes more than the method choice, leaving the direct role inconclusive there. Limitations include only random 10% instance deletion, three seeds, and an influence direction computed with a far-from-converged conjugate-gradient solve, so the negative conclusions apply to the tested direction rather than influence methods generally.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- The public DPL implementation contains a coordinate mismatch (image directions computed on augmented, normalized tensors but applied to raw images) and a label perturbation below float32 resolution that never changes targets.
- After correcting the image pipeline, DPL fails the predeclared direct-deletion gate on CIFAR-10/ResNet-18 in all three paired seeds, with best Avg. Diff. 4.366 versus 1.745 (SalUn) and 3.935 (AMUN).
- As a utility regularizer DPL passes its gate in only one of three seeds, and as a warm start it tracks FGSM initialization while adding 47-66 seconds of direction-computation cost, never beating both simpler initializations.
- Under random instance deletion, exact retraining retains high forget accuracy (Proposition 1), so low forget accuracy is not evidence of successful unlearning.
- A Tiny ImageNet preprocessing defect in the official evaluation path changes outcomes by tens of accuracy points, exceeding the effect of method choice, and makes the direct-role comparison there inconclusive.
Strengths
Role-matched design with predeclared gates
Each of the three roles gets its own matched control and pass/fail criterion fixed before the comparison (Section 3, Appendix B): direct vs no-perturbation/SalUn/AMUN, utility vs clean retain CE, warm start vs official and FGSM initializations — directly blocking the fallacy of using weak-role evidence to support the strong deletion claim.
Concrete, tensor-level implementation audit
Section 5 quantifies the coordinate mismatch (directions built on augmented/normalized tensors, applied to raw [0,1] images), shows the label direction has ℓ∞ norm 3.27e-5 with zero float32 target change at β=0.007, and quantifies corrected normalized-vs-signed cosine alignment (0.653 mean, Table 8) rather than relying on code comments.
Exact-seed retraining references and frozen cross-seed validation
Theory that localizes rather than oversells
Honest disclosure of the weakest link in its own evidence
Weaknesses
The evaluated direction is far from a converged influence estimate
Statistical power is thin for the utility role
Narrow external validity
DPL-side tuning breadth is minimal
Descriptive baseline screening without uncertainty
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a controlled audit and negative-result study. It takes Deep Perturbation Learning (DPL; Song et al., ICML 2023) — which learns image and label perturbations along influence-derived directions — and tests the three roles prior work has suggested for it in machine unlearning: (I) a direct deletion signal, (II) a utility-preserving regularizer alongside an explicit forgetting objective, and (III) a warm start for adversarial unlearning (AMUN). The central claims: (a) the public DPL implementation contains a coordinate mismatch and a numerically inactive label perturbation; (b) after correction, DPL fails the direct-deletion gate on CIFAR-10/ResNet-18 in all three paired seeds; (c) its utility effect is sign-inconsistent across seeds (1/3 pass) and its warm start tracks FGSM while adding 47-66 seconds of direction cost; (d) exact retraining under random deletion keeps forget accuracy high, so low forget accuracy is the wrong success criterion. Scope is deliberately narrow: random 10% instance deletion only.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is Deep Perturbation Learning (DPL) and why was it tested for machine unlearning?
DPL (Song et al., ICML 2023) learns small image and label perturbations, derived from influence-function directions, that were originally proposed to improve supervised training accuracy. Because influence functions estimate how individual training points shift model parameters, the idea was redirected at data deletion: perturb retained data so the model moves as if the forget-set examples had been removed. This paper tests that idea in three roles (direct deletion, utility regularization, warm start) and finds it fails or adds no value in each.
Does this paper prove that influence-based machine unlearning does not work?
No. The results cover random deletion of 10% of CIFAR-10 (and a one-seed Tiny ImageNet check) with a specific influence direction produced by a conjugate-gradient solve that was far from numerical convergence. The authors state explicitly that their negative conclusions apply to this computable direction and deletion regime, not to influence-based methods for class deletion, difficult forget sets, or other settings.
Why is low forget-set accuracy not evidence of successful unlearning?
Under random deletion, forgotten examples are still i.i.d. draws from the same data distribution, so a model retrained without them still classifies them almost as well as before (the paper's Proposition 1: retrained forget accuracy is 94.75% on CIFAR-10). A method that collapses forget accuracy usually damages the whole classifier, moving away from — not toward — the retraining reference.
What implementation bugs did the audit find in the released code?
Two in the DPL deletion path: image perturbation directions were computed on augmented, normalized tensors but applied to unaugmented raw images (a coordinate/unit mismatch), and the label perturbation was so small (infinity-norm about 3.3e-5) that float32 soft targets never changed. A third, separate defect in the Tiny ImageNet evaluation path omitted the channel normalization used during source training, dropping the checkpoint's effective accuracy from 57.6% to 12.3%.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures are present only as captions and inline axis-label text in the extracted text; plot-level detail (e.g., the scatter shapes in Figure 3b) cannot be verified.
- The referenced supplementary validation records (data/, supplementary/final_validation/ CSVs and manifests) are described but not included in the extracted text; release claims could not be verified beyond the paper's own statement.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.