🤖 machine learning

Representation Unlearning: Forgetting through Information Compression

This paper introduces Representation Unlearning, a framework that achieves efficient and reliable machine unlearning by learning a transformation in the representation space to compress information about forgotten data while preserving utility for retained data, offering a more stable and computationally efficient alternative to traditional parameter modification methods.

Original authors: Antonio Almudévar, Alfonso Ortega

Published 2026-05-29

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Antonio Almudévar, Alfonso Ortega

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart student who has studied a massive library of books to become an expert. One day, the student is asked to "unlearn" a specific set of books—perhaps because those books contained sensitive secrets, were written by someone who withdrew permission, or were simply full of errors.

The traditional way to handle this is to make the student forget everything, throw out their current notes, and force them to re-study the entire library from scratch, skipping only the bad books. This is accurate, but it takes forever and is incredibly exhausting.

Other methods try to be clever: they tell the student, "Go back and erase the specific pages in your notebook where you wrote about the bad books." But the paper argues this is risky. The student's brain (the model's parameters) is so complex that trying to surgically remove just those pages often causes the student to forget good things they knew, or the surgery itself is so expensive it's almost as hard as re-studying everything.

The Paper's Solution: "Representation Unlearning"

This paper proposes a different approach called Representation Unlearning. Instead of trying to rewrite the student's entire brain or notebook, they change how the student looks at the information right before they answer a question.

Here is how it works, using a few analogies:

1. The "Translator" Analogy

Imagine the student has a special translator sitting between their brain and their mouth.

The Old Way: You try to edit the student's brain directly.
The New Way: You keep the student's brain exactly as it is. Instead, you train the translator to do a specific job.

When the student thinks about a "good" book (the data you want to keep), the translator says, "Okay, I'll let that information through clearly."
But when the student thinks about a "bad" book (the data to forget), the translator acts like a fog machine. It takes that specific thought and muddies it up so much that it becomes indistinguishable from the noise of the entire library. The student can no longer recognize the "bad" book as a specific thing; it just looks like "general library noise."

2. The "Information Bottleneck"

The paper describes this as creating an Information Bottleneck.
Think of the student's brain as a wide river of information. The translator is a narrow pipe.

For the good data: The pipe is wide enough to let the clear, useful water flow through.
For the bad data: The pipe squeezes that water until it loses its shape and identity. It's still water, but you can no longer tell which specific drop came from the "bad" bucket.

3. The Two Scenarios

The paper tests this in two situations:

Scenario A: The "Full Access" Mode
The translator is trained while looking at both the "good" books and the "bad" books. It learns exactly how to keep the good stuff clear and blur the bad stuff.
- Result: It works incredibly well, keeping the student smart on good topics while making them "forget" the bad ones.
Scenario B: The "Zero-Shot" Mode (The Magic Trick)
This is the most impressive part. Imagine the student is asked to forget a book, but you cannot show them the "good" books anymore (maybe they are locked away for privacy reasons). You only have the "bad" book.
- How it works: The paper uses a trick called Neural Collapse. It assumes that in a well-trained student, all the "good" books of a certain type (e.g., all books about cats) look very similar to each other in the brain. The translator learns to push the "bad" book's thoughts toward the average "center" of the whole library, effectively drowning the specific "bad" memory in the general noise.
- Result: Even without seeing the "good" books, the translator successfully hides the "bad" book's identity without ruining the student's ability to talk about other things.

Why is this better?

The paper claims this method is a winner for three main reasons:

It's Fast: Editing the translator is like changing a pair of glasses. It takes seconds. Rewriting the student's brain (retraining) takes days. The paper shows their method is hundreds of times faster than the old ways.
It's Safe: Because they aren't hacking the student's brain directly, they don't accidentally break the student's ability to do math or read. The "good" knowledge stays intact.
It Saves Memory: The old methods require massive computer power (like a supercomputer) to do the surgery. This method runs on a standard laptop because it only tweaks the small translator, not the whole brain.

The Catch (Limitations)

The paper is honest about one limitation: This "translator" is a layer added after the brain. If a hacker has direct access to the student's raw brain (the internal weights), they might still be able to find the "bad" information. The translator only protects the information once it leaves the brain and is about to be spoken. However, for most real-world uses where we only see the model's output, this protection is sufficient.

In Summary:
Instead of performing dangerous, expensive brain surgery to make a model forget, this paper suggests putting on a pair of "smart glasses" (a transformation layer) that blurs out the specific memories you want gone while keeping everything else crystal clear. It's faster, cheaper, and keeps the model smarter than previous methods.

Technical Summary: Representation Unlearning: Forgetting through Information Compression

Problem Definition

Modern machine learning systems face increasing regulatory and ethical pressures to remove the influence of specific training data (the "forget set," $D_f$ ) upon request, a requirement enshrined in frameworks like the GDPR and CCPA. Simply deleting raw data is insufficient because deep networks often memorize training examples, retaining statistical traces in their parameters.

Existing machine unlearning approaches typically adopt a parameter-centric perspective, attempting to modify model weights ( $\theta$ ) to approximate a model retrained solely on the "retain set" ( $D_r$ ). However, these methods face significant limitations:

Scalability: They struggle to preserve model utility on large-scale architectures and complex datasets.
Computational Cost: Many require expensive second-order information or multiple backward passes, narrowing their efficiency gap against naive retraining.
Instability: Modifying the entire parameter space can lead to heavy GPU usage and unstable updates.
Data Access Constraints: Many methods implicitly assume access to both $D_r$ and $D_f$ , whereas real-world scenarios often restrict access to $D_r$ due to privacy or storage limitations (the "zero-shot" setting).

Methodology: Representation Unlearning

The authors propose Representation Unlearning, a framework that shifts the unlearning operation from the high-dimensional parameter space to the lower-dimensional representation space ( $Z$ ). Instead of re-optimizing network weights, the method learns a lightweight transformation $f_\phi$ that maps original representations $Z$ to new representations $Z'$ .

Core Objective: Information Bottleneck

The transformation $f_\phi$ is trained to enforce an information bottleneck with two competing goals:

Retention: Maximize mutual information between the transformed representation $Z'$ and the retain data $X_r$ (i.e., $I(Z'; Z | X_r) \approx 0$ , meaning no information relevant to $D_r$ is discarded).
Forgetting: Suppress mutual information between $Z'$ and the forget data $X_f$ (i.e., $I(Z'; X_f) \approx 0$ , meaning $Z'$ is statistically independent of $D_f$ ).

Variational Surrogates

Since mutual information is intractable to compute directly, the authors derive variational upper bounds to create optimizable loss functions. They address two distinct data-access regimes:

1. Standard Setting (Access to $D_r$ and $D_f$ )

Retention Loss ( $L_r$ ): Minimizes the KL divergence between the transformed distribution and the original encoder distribution for retain samples. Under Gaussian assumptions, this simplifies to a Mean Squared Error (MSE) between original and transformed representations: $\|z_r - f_\phi(z_r)\|_2^2$ .
Forget Loss ( $L_f$ ): Minimizes the KL divergence between the transformed forget distribution and the marginal distribution of the entire dataset. This forces forget representations to match aggregate statistics, rendering them indistinguishable from the general population.

2. Zero-Shot Setting (Access to $D_f$ only)

In scenarios where $D_r$ is unavailable, the framework relies on Neural Collapse and metadata (class counts) to construct proxies:

Retention Proxy: Instead of sampling $D_r$ , the method uses class centroids (derived from classifier weights $w_c$ ) as proxies for class means. The retention loss penalizes deviations of transformed class prototypes from their original positions.
Forget Proxy: The forget loss minimizes the weighted distance of transformed forget samples to all class prototypes, effectively "drowning" specific instance information into the global label space distribution.

Architecture

The transformation $f_\phi$ is constrained to be a lightweight linear map or a shallow Multi-Layer Perceptron (MLP), leveraging the "Linear Representation Hypothesis" which suggests semantic information is linearly separable in deep layers.

Key Contributions

Paradigm Shift: Introduces a representation-centric unlearning framework that avoids the instability and computational bottlenecks of parameter-level updates.
Zero-Shot Capability: Demonstrates a novel approach to unlearning without access to retain data, utilizing Neural Collapse hypotheses to anchor the semantic manifold.
Theoretical Formulation: Derives tractable variational surrogates for information-theoretic objectives, balancing retention and forgetting via a regularization parameter $\beta$ .
Efficiency: Achieves unlearning via a lightweight transformation layer rather than full model retraining or complex gradient manipulation.

Experimental Results

The framework was evaluated on CIFAR-10, CIFAR-100, and Tiny ImageNet against baselines including SISA, SCRUB, Bad Teacher, and various zero-shot methods (Boundary Shrinking, EMMN, GKT).

Utility and Forgetting: Representation Unlearning achieves near-perfect forgetting (low accuracy on $D_f$ ) while maintaining high utility on $D_r$ . In the zero-shot setting, it significantly outperforms baselines, which often suffer from catastrophic forgetting or fail to forget entirely.
Computational Efficiency: The method offers massive speed-ups compared to full retraining. On Tiny ImageNet, the zero-shot variant achieves a 757 $\times$ speed-up over retraining. It consistently outperforms all competing baselines in execution time.
Resource Efficiency: The approach requires significantly less peak GPU memory (e.g., ~1.9 GB on Tiny ImageNet vs. ~8.3 GB for retraining), making it suitable for resource-constrained environments.
Robustness: The method remains stable across different dataset complexities and unlearning scenarios (class vs. random unlearning).

Significance and Limitations

The paper positions Representation Unlearning as a practical, scalable solution for large-scale unlearning deployments. By decoupling unlearning efficacy from high hardware demands and parameter instability, it offers a superior stability-plasticity trade-off.

Modest Claims and Limitations:

Black-Box Threat Model: The method operates as a downstream transformation. The raw encoder parameters remain unchanged, meaning the original representation $Z$ still encodes the forget set. The system is vulnerable to white-box recovery attacks if the raw encoder is accessible; it secures the output $Z'$ , not the internal weights.
Inference Overhead: The introduction of the transformation layer $f_\phi$ adds a permanent, albeit microsecond-scale, inference-time overhead.
Neural Collapse Dependency: The zero-shot variant relies on the Neural Collapse hypothesis. If the pre-trained model does not exhibit strong collapse (i.e., classifier weights are poor proxies for class centers), the quality of the zero-shot unlearning degrades, though the method "gracefully" trades off retain utility rather than failing to forget.

The authors suggest future work could apply these loss functions to fine-tune the entire encoder (solving the white-box vulnerability) or extend the framework to Large Language Models (LLMs) for unlearning complex behaviors.