Notice: The reproducibility variables underlying each score are classified using an automated LLM-based pipeline, validated against a manually labeled dataset. LLM-based classification introduces uncertainty and potential bias; scores should be interpreted as estimates. Full accuracy metrics and methodology are described in Coakley et alK. L. Coakley, T. Snelleman, H. Hoos, and O. E. Gundersen, "The embrace of open science: An analysis of a decade of AI research and 56 800 conference papers," Under Review, 2026..
The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples
Authors: Hsiang Hsu, Pradeep Niroula, Zichang He, Ivan Brugere, Freddy Lecue, Richard Chen
NeurIPS 2025 | Venue PDF | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | Experiments on vision benchmarks with deep neural networks demonstrate that residual knowledge is prevalent across existing unlearning methods and that our approach effectively prevents residual knowledge. We empirically validate the existence of such local disagreement and residual knowledge across multiple unlearning algorithms in 5. We further demonstrate that our fine-tuning strategy effectively reduces residual knowledge on standard vision datasets using deep neural networks. |
| Researcher Affiliation | Industry | 1JPMorgan Chase Global Technology Applied Research 2JPMorgan Chase AI Research Correspondence to: Hsiang Hsu <EMAIL> |
| Pseudocode | Yes | We first provide the pseudo-code of RURK in the following algorithm box Algorithm 1. |
| Open Source Code | No | Due to intellectual property protection and anonymity requirements, we choose to release our codes upon decision. We provide details scripts on how to access the datasets, implement our methodology, and reproduce the empirical results in the main text and appendix. |
| Open Datasets | Yes | Experiments on vision benchmarks with deep neural networks demonstrate that residual knowledge is prevalent across existing unlearning methods and that our approach effectively prevents residual knowledge. Experiments on vision benchmarks with deep neural networks demonstrate that residual knowledge is prevalent across existing unlearning methods and that our approach effectively prevents residual knowledge. Residual knowledge is a prevalent issue. For instance, on the CIFAR-10 dataset, when subjected to a small perturbation norm ( 0.03), over 7% of the forget samples still exhibit residual knowledge (cf. Appendix C.4). The third scenario is based on a larger-scale Image Net-100, a 100-class subset of Image Net-1k (Deng et al., 2009) with 1,300 images per class, trained with Res Net-50. |
| Dataset Splits | Yes | The CIFAR-10 dataset contains 60,000 color images of size 32 32 pixels, evenly distributed across 10 classes: airplane, automobile, bird, cat, deer, dog, frog, horse, ship, and truck. Each class includes 5,000 training and 1,000 test samples. In the first scenario small CIFAR5 we follow the setup of Golatkar et al. (2020a,b) by creating a reduced version of CIFAR-10 with 200 training and 200 test samples from each of the first five classes. From class 0, we randomly select 100 samples (50%) as the forget set Sf. The second scenario uses the full CIFAR-10 dataset. Here, we designate 2,000 samples (50%) from class 0 as the forget set Sf. In the class unlearning setting, the forget set contains 200 samples from class 0 in the small CIFAR-5 scenario, and 4,000 samples from class 0 in the full CIFAR-10 scenario. Each class has 5,000 training samples, with 20% held out for validation. |
| Hardware Specification | Yes | All experiments are conducted on an AWS EC2 g5.24xlarge instance. |
| Software Dependencies | No | We implement RURK using PyTorch (torch) (Paszke, 2019), and ensure reproducibility by fixing three random seeds: [131, 42, 7]. During optimization, we use a batch size of 128, the standard cross-entropy loss (torch.nn.Cross Entropy Loss()), and the SGD optimizer (torch.optim.SGD) with a learning rate of 0.01, momentum of 0.90, and weight decay of 5 10 4. To stabilize training, we apply a cosine annealing learning rate scheduler (torch.optim.lr_scheduler.Cosine Annealing LR) and cap the total number of iterations at 200. Additionally, we clip the gradient norm to 1.0 using torch.nn.utils.clip_grad_norm_. For both unlearning scenarios (small CIFAR-5 and CIFAR-10), we set the perturbation budget τ = 0.03 and use the Torch Attacks library (Kim, 2020) to identify the vulnerable set V((x, y), τ). |
| Experiment Setup | Yes | We implement RURK using PyTorch (torch) (Paszke, 2019), and ensure reproducibility by fixing three random seeds: [131, 42, 7]. During optimization, we use a batch size of 128, the standard cross-entropy loss (torch.nn.Cross Entropy Loss()), and the SGD optimizer (torch.optim.SGD) with a learning rate of 0.01, momentum of 0.90, and weight decay of 5 10 4. To stabilize training, we apply a cosine annealing learning rate scheduler (torch.optim.lr_scheduler.Cosine Annealing LR) and cap the total number of iterations at 200. Additionally, we clip the gradient norm to 1.0 using torch.nn.utils.clip_grad_norm_. For both unlearning scenarios (small CIFAR-5 and CIFAR-10), we set the perturbation budget τ = 0.03 and use the Torch Attacks library (Kim, 2020) to identify the vulnerable set V((x, y), τ). We configure the hyper-parameters as follows: for small CIFAR-5, we use N = 2 and λf = λa = 0.03; for CIFAR-10, we set N = 2, λf = 0.03, and λa = 0.00045. |