🤖 machine learning

PURGE: Projected Unlearning via Retain-Guided Erasure

The paper introduces PURGE, a machine unlearning algorithm that leverages the duality between continual learning and unlearning by combining gradient projection constraints with multi-layer representation erasure and a retain-confusion target to effectively remove specific data while preserving model utility and resisting membership inference attacks.

Original authors: Vedant Jawandhia, Daksh Ahuja, Ghufran Alam Siddiqui, Prashant Trivedi, Yash Sinha, Pratik Narang

Published 2026-06-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Vedant Jawandhia, Daksh Ahuja, Ghufran Alam Siddiqui, Prashant Trivedi, Yash Sinha, Pratik Narang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart student who has studied a massive library of books to become an expert. Now, imagine a specific person (let's call them "Bob") asks the student to forget everything about him because of privacy laws.

The old, "naïve" way to handle this is to tell the student: "Go back to the library, throw out Bob's books, and start studying from scratch." This works perfectly, but it takes years and costs a fortune.

PURGE is a new, clever shortcut. It's like a magic eraser that removes Bob's influence from the student's brain without making them forget everything else they learned.

Here is how the paper explains this process using simple analogies:

1. The Core Idea: Two Sides of the Same Coin

The authors noticed something interesting: Learning and Forgetting are actually opposites of the same problem.

Learning (Continual Learning): You want to learn a new skill (like playing guitar) without forgetting your old skill (like playing piano).
Forgetting (Machine Unlearning): You want to erase a specific memory (Bob) without forgetting the rest of the library.

The paper says, "Let's borrow the math used for learning new things and flip it around to help us forget things."

2. The Magic Trick: The "Guardrail" (Gradient Projection)

When the student tries to erase Bob's memory, they might accidentally knock over a vase of flowers (the "retain set" or other data).

PURGE uses a technique called Gradient Projection. Think of this as a guardrail or a bouncer.

Every time the student tries to take a step to erase Bob, the bouncer checks: "Will this step hurt the flowers?"
If the answer is "Yes," the bouncer gently pushes the student's foot back so they only move in a direction that doesn't damage the flowers.
This guarantees that while they are erasing Bob, the rest of their knowledge stays safe and accurate.

3. The "Fake Confusion" Strategy (Retain-Confusion Target)

Usually, when you try to make a model forget something, you tell it to guess randomly (like rolling a die). The paper found a problem with this: Robots are too good at spotting fake randomness. If a model suddenly starts guessing randomly, a hacker can tell, "Aha! This model was forced to forget something!"

Instead, PURGE uses a Retain-Confusion Target.

Imagine the student looks at the books they kept and sees where they get confused. Maybe they mix up "Cats" and "Dogs" sometimes.
When erasing Bob, the student is told: "Don't guess randomly. Instead, guess in the exact same confused way you do with the books you kept."
This makes the "erased" model look exactly like a student who never saw Bob in the first place. To a hacker, it's impossible to tell the difference.

4. Deep Cleaning: Erasing the "Gut Feeling"

Sometimes, even if a model stops saying the right answer, it still "feels" the wrong answer deep inside its brain (in the middle layers).

Old methods just told the model to stop saying the wrong answer at the very end (the output).
PURGE goes deeper. It wipes the "gut feeling" (intermediate representations) clean, pushing the internal brain activity to look like the activity of someone who never knew Bob.

5. The "Auto-Stop" Button

How does the student know when to stop erasing?

Old way: You have to count the minutes or guess how many times to practice.
PURGE way: It has two self-regulating stop signs:
1. The Budget: "If we start hurting the flowers (retaining data) too much, stop immediately."
2. The Target: "If Bob's memory is so fuzzy that we can't guess him better than random chance, stop."
  This means the algorithm decides when it's done, so humans don't have to guess.

6. The "Frozen Statistic" Surprise

The paper found a hidden trap: When erasing a whole class of data (like all pictures of "Cats"), the model's internal calculator (BatchNorm) gets confused because it only sees "Cats" and forgets how to handle "Dogs."

The Fix: The authors realized they had to freeze this calculator so it doesn't update its statistics with the weird, one-sided data. It's like telling the calculator, "Don't change your settings while we are doing this surgery." Without this, the whole system crashes.

The Results: What Did They Find?

The authors tested this on five different types of data (from handwritten numbers to medical images).

Privacy: The "erased" model is so good at hiding that hackers can't tell if Bob was in the training data or not (a score of 0.5, which is perfect).
Utility: The model still remembers 96%+ of everything else.
Speed: It is about 13 times faster than retraining the whole model from scratch.

In short: PURGE is a fast, safe, and smart way to delete specific data from an AI's memory by borrowing tricks from how AI learns new things, ensuring the AI doesn't accidentally forget the rest of its knowledge or get caught by hackers.

Technical Summary: PURGE (Projected Unlearning via Retain-Guided Erasure)

1. Problem Statement

Machine unlearning (MU) aims to remove the influence of specific training data (the forget set, $D_f$ ) from a trained model without the prohibitive computational cost of retraining from scratch. A fundamental tension exists in MU: the model must aggressively forget $D_f$ to satisfy privacy audits (e.g., GDPR's "right to be forgotten") while preserving high utility on the remaining data (the retain set, $D_r$ ).

Existing methods face specific failure modes:

Gradient Ascent: Maximizes loss on $D_f$ but often catastrophically degrades performance on $D_r$ .
Saliency-based methods (e.g., SalUn): Selectively perturb weights but lack formal guarantees on retain performance.
Knowledge Distillation: Anchors retain distribution but fails to constrain gradient directions.
Fisher-based methods: Theoretically grounded but computationally expensive due to Hessian approximations.

Crucially, many existing approaches fail to ensure that the unlearned model is statistically indistinguishable from a model retrained from scratch on $D_r$ alone. This distinction is vital for resisting Membership Inference Attacks (MIA), where an adversary attempts to determine if a specific sample was in the training set.

2. Methodology

The core insight of PURGE is the duality between Continual Learning (CL) and Machine Unlearning. While CL learns new tasks without forgetting old ones, MU erases specific data without hurting retained performance. PURGE adapts the A-GEM (Averaged Gradient Episodic Memory) algorithm from CL, which projects new-task gradients to avoid increasing loss on old tasks.

2.1 Gradient Projection for Retain-Safety

PURGE treats the unlearning process as a constrained optimization problem. For every update step, the gradient for the forget direction ( $g_f$ ) is projected onto a half-space defined by the retain gradient ( $g_r$ ).

Constraint: The update must not increase the retain loss ( $L_r$ ).
Mechanism: If the forget gradient conflicts with the retain gradient (i.e., $\langle g_f, g_r \rangle < 0$ ), $g_f$ is projected onto the boundary of the half-space where $\langle g, g_r \rangle \geq 0$ .
Theoretical Guarantee: This provides a per-step constructive guarantee that the retain loss does not increase (to first-order approximation), a feature lacking in prior approximate unlearning methods.

2.2 Forget Objectives

PURGE introduces a novel target for the forget set, moving beyond simple uniform distribution targets:

KL-Retain (Retain-Confusion Target): Instead of pushing forget outputs toward a uniform distribution (which is easily detectable by MIA), PURGE targets the model's natural confusion pattern on the retain set. It precomputes a distribution $p_r$ by averaging the softmax outputs of the frozen original model on $D_r$ . The forget objective minimizes the KL-divergence between forget outputs and $p_r$ .
Rationale: This makes the unlearned model's outputs statistically indistinguishable from a model retrained from scratch, driving MIA AUROC toward the ideal 0.5.

2.3 Multi-Layer Representation Erasure

Output suppression alone is insufficient as information may persist in intermediate layers. PURGE computes the Mean Squared Error (MSE) between forget-set activations and the mean activations of the retain set (from the frozen model) across multiple intermediate layers. This forces the removal of information from hidden representations, not just the final output.

2.4 Stability and Stopping Mechanisms

KD-Anchored Stability: A frozen copy of the pre-unlearning model acts as a teacher for the retain set via Knowledge Distillation (KD), reducing representation drift.
Entropy Gating & Capping: Updates are restricted to the retain objective if the model's output entropy on the forget batch is already near maximum, preventing over-forgetting or gradient explosion.
Dual Self-Regulating Stopping: The algorithm automatically stops based on two criteria:
1. Retain-Loss Budget: Stops if retain loss exceeds a predefined budget relative to the initial loss.
2. Forget-Accuracy (FA) Target: Stops when FA drops to a random-chance level (e.g., $100/K\%$ ).
BatchNorm Freezing: A critical implementation detail identified by the authors: BatchNorm layers must be frozen in evaluation mode during unlearning. Class-homogeneous forget batches can corrupt running statistics if BatchNorm remains in training mode, leading to model collapse.

3. Key Contributions

Algorithmic Instantiation of CL-MU Duality: PURGE is the first work to directly adapt the gradient projection mechanism from A-GEM (a CL algorithm) as the primary constructive tool for machine unlearning, providing formal per-step retain-safety guarantees.
Retain-Confusion Target: The proposal of a KL-divergence target based on the model's natural confusion on retain data, which significantly improves MIA resistance compared to uniform distribution targets.
Multi-Layer Erasure: Extending unlearning to intermediate layer activations to ensure deep information removal.
Self-Regulating Framework: Elimination of manual epoch tuning via dual stopping criteria (retain-loss budget and FA target).
Empirical Discovery: Identification of the BatchNorm failure mode in class-level unlearning, a subtle but critical issue affecting stability.

4. Experimental Results

PURGE was evaluated on five datasets (CIFAR-10, MNIST, SVHN, STL10, PathMNIST) across 22 class-level forgetting tasks using ResNet-18.

Privacy-Utility Trade-off: PURGE consistently maintains Retain Accuracy (RA) above 96% across all datasets.
Privacy (MIA Resistance): PURGE achieves MIA AUROC close to 0.5 (the ideal indistinguishability score) on four out of five datasets. For example, on CIFAR-10, it achieves an AUROC of 0.496.
Comparison with Baselines:
- Unlike Gradient Ascent (which drops retain accuracy to ~38% on CIFAR-10) or SalUn (which lacks formal MIA guarantees), PURGE balances high retain utility with genuine membership privacy.
- While PURGE's Test Accuracy (TA) on CIFAR-10 (84.5%) is lower than SalUn (93.5%), the authors argue this is a deliberate trade-off to achieve genuine privacy (MIA $\approx$ 0.5) rather than just low forget accuracy.
Efficiency: PURGE converges in approximately 1.75 epochs (under 200 seconds on CIFAR-10), offering a $\sim$ 13 $\times$ speedup over full retraining.
Representation Erasure: Feature-space Fréchet distance (FIDfeat) and cosine similarity metrics confirm that PURGE effectively alters intermediate representations, bringing them closer to those of a model retrained from scratch.

5. Significance and Claims

The paper claims that PURGE provides a principled framework for machine unlearning by leveraging the duality with continual learning. Its significance lies in:

Formal Guarantees: Providing a per-step guarantee that retain loss does not increase, a feature absent in heuristic-based unlearning methods.
Robust Privacy: Demonstrating that targeting the "natural confusion" of the model is superior to artificial uniform targets for defeating Membership Inference Attacks.
Practical Guidance: Offering critical implementation insights, such as the necessity of freezing BatchNorm layers, which are often overlooked in unlearning literature.

The authors acknowledge limitations, including a test accuracy gap compared to some baselines, the lack of formal $(\epsilon, \delta)$ -differential privacy guarantees, and the current evaluation scope (ResNet-18, single-class forgetting). However, they posit that the CL-MU duality perspective opens a broader design space for future unlearning algorithms.