On-the-go Forgetting without Explicit Unlearning via ERASE
Kushal Chakrabarti, Mayank Baranwal
cs.LG · stat.ML
Quick verdict
ERASE does weight-free inference-time forgetting via input perturbations; best retention trade-off on vision, but weak on EEG/HAR and theory is sufficient-only.
Summary
The paper introduces ERASE, a framework for functional forgetting in fixed discriminative classifiers: instead of editing weights, it suppresses a target subclass's influence at inference time. In an offline phase, ERASE precomputes FGSM-style averaged signed input-gradients per subclass; online, it combines the forget-subclass direction and the average sibling-subclass direction into a single perturbation p = εf·δforget − εr·δretain, optimizes only two scalars on superclass training data with a sign-weighted loss, and applies the perturbation only when the model's initial prediction is the target superclass. Theorem 4.4 derives sufficient conditions (directional smoothness, bounded gradient projections, positive empirical alignment via Hoeffding bounds) under which forget-set loss rises above log K while sibling retention loss stays below log 2. Across CIFAR-100 (ResNet18, ViT-B/16), Tiny ImageNet, EEG seizure, and HAR benchmarks against KD, GA+GD, DELETE, Boundary Unlearning, and ERM-KTP, ERASE best preserves retention (e.g., 82.76% vs. 83.47% original retain-overall on Tiny ImageNet, versus 34.03% for DELETE) with moderate forgetting (14.64%), and matches baseline MIA resistance (AUC-ROC 0.37–0.50). Main limitations: forgetting on ESZ/HAR is weak (71.09%/76% vs. ~97% original), per-subclass variance is large, closest perturbation-based prior work (forget vectors, UAP unlearning) is not compared empirically, and guarantees concern behavior, not weight-level removal — white-box leakage persists.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- ERASE achieves selective subclass forgetting at inference time purely through class-conditioned input perturbations, with no weight modification, retraining, or auxiliary models.
- Theorem 4.4 gives sufficient conditions (directional smoothness, bounded projections, positive empirical alignment) under which the forget subclass's loss exceeds log K while sibling subclasses' loss stays below log 2.
- Across CIFAR-100, Tiny ImageNet, ESZ, and HAR versus five baselines, ERASE offers the best forgetting/retention balance, driven by near-original retention (82.76% retain-overall on Tiny ImageNet vs. 83.47% original).
- ERASE's black-box membership-inference resistance is on par with weight-modifying unlearning methods (AUC-ROC 0.37-0.50, Table 2).
Strengths
Genuinely lightweight online phase
Only two scalars (εf, εr) are optimized (Alg. 1, lines 19-30), converging in under 10 epochs with no model gradients (§4.2) — a real deployment advantage over retraining-based unlearning.
Best-in-table retention with frozen weights
Tiny ImageNet retain-overall 82.76% vs. 83.47% original, while DELETE collapses to 34.03%, Boundary Unlearning to 57.73%, GA+GD to 67.45% (Table 1); CIFAR-100/ViT retain-overall 88.73% vs. 89.98% original.
Evaluation beyond vision
Honest scope limitation
Ablation isolates the retain direction
Weaknesses
Weak absolute forgetting on non-vision modalities
Forgetting is not better than KD on vision, only retention is
Closest prior art not compared empirically
Theory never empirically instantiated
Unstated ± basis and large dispersions
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
ERASE (TMLR 07/2026; arXiv 2609.05966) proposes *functional forgetting* for frozen discriminative classifiers: instead of editing weights, a fixed input-space perturbation suppresses a target subclass Cf at inference time. The pipeline (Alg. 1) has an offline phase computing FGSM-style averaged signed input-gradients per subclass (Eq. 1) and an online phase combining the forget direction with the mean sibling-subclass direction into p = εf·δforget − εr·δretain (Eq. 2), optimizing only two scalars on superclass training data via a sign-weighted loss (Eq. 3), applied only when the model's initial prediction is the target superclass Sf. Four headline claims: deployable forgetting without retraining or model copies; Theorem 4.4's sufficient conditions for simultaneous forgetting (loss > log K) and sibling retention (loss < log 2); the best forgetting/retention/efficiency balance across four datasets versus five baselines; and MIA resistance on par with weight-editing methods.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is ERASE machine unlearning?
ERASE (Erasure via Reconstructive Adversarial Signal Editing) is an inference-time forgetting method for classifiers: instead of changing model weights, it adds a fixed, class-conditioned perturbation to inputs that makes a chosen subclass unreliable to the model while leaving sibling subclasses in the same superclass intact. The perturbation is built from precomputed input-gradient directions and applied only when the model's initial prediction is the target superclass.
Does ERASE actually remove data from the model weights?
No. The weights stay frozen; the influence of the forgotten data can remain encoded in the parameters and could be exposed by white-box or reconstruction attacks. The authors describe ERASE as 'functional forgetting' — it changes inference behavior only — and explicitly exclude weight-level removal guarantees.
How well does ERASE perform compared to other unlearning methods?
On CIFAR-100, Tiny ImageNet, EEG (ESZ) and HAR benchmarks, ERASE preserves the most accuracy among compared methods: e.g., 82.76% overall retention on Tiny ImageNet vs. 83.47% for the untouched model, while DELETE drops to 34.03%. Its forgetting is moderate on vision tasks (14.64% forget accuracy on Tiny ImageNet) and weak on ESZ/HAR (71-76% of forget samples still correctly classified vs. ~97% originally). Its membership-inference resistance matches weight-editing baselines (AUC-ROC 0.37-0.50).
Is code available for the ERASE paper?
The paper does not mention a public code release. However, all four datasets (CIFAR-100, Tiny ImageNet, Epileptic Seizure Recognition, HAR) are public, and the algorithm (averaged sign input-gradients plus a two-scalar perturbation optimization) is simple enough to reimplement from Algorithm 1 and the appendix hyperparameters.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1-3 are visual; the LPIPS scores said to confirm sibling-subclass preservation (Fig. 2 caption) are referenced but their numeric values do not appear anywhere in the extracted text.
- The TMLR acceptance is stated on the title page only; the OpenReview reviews/meta-review are not part of the provided text, so the review reflects the paper alone.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.