pith. sign in

arxiv: 2605.20282 · v3 · pith:RSECQEF3new · submitted 2026-05-19 · 💻 cs.CV · cs.AI

Do Vision Models Truly Forget? New Findings from Representation-Level Certification of Visual Unlearning in Vertical Federated Learning

Zhenyu Yu , Yangchen Zeng , Chunlei Meng , Guangzhen Yao , Shuigeng Zhou This is my paper

Pith reviewed 2026-06-30 18:39 UTC · model grok-4.3

classification 💻 cs.CV cs.AI
keywords machine unlearningvertical federated learningrepresentation learningvision modelsforgetting certificationclass structure retentionlinear probe recovery
0
0 comments X

The pith

Unlearning methods that pass output-level checks in vertical federated learning still retain class structure in their representations.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces a representation-level auditing framework called Mirage with four diagnostics to test whether visual unlearning in VFL truly erases information. Experiments on seven datasets show that methods passing output certification keep substantial class structure, with linear probe recovery exceeding the retrained baseline by up to 15.4 points and models remaining structurally closer to the original than to a retrained reference. No existing method achieves high utility together with both output-level and representation-level forgetting. Class-level forgetting leaves strong traces while sample-level forgetting drops to chance levels, with residual information visible across network depths.

Core claim

Methods that pass output-level certification still retain substantial class structure in their representations, with LPR exceeding the retrained baseline by up to 15.4 points; CKA shows models remain structurally closer to the original than to the retrained reference; no method achieves the trilemma of utility, output forgetting, and representation forgetting; class-level unlearning leaves strong representational traces while sample-level unlearning does not.

What carries the argument

Mirage auditing framework using linear probe recovery (LPR), centered kernel alignment (CKA), feature separability scoring, and layer-wise recovery analysis to measure retained class structure beyond output metrics.

If this is right

  • Output-level certification alone is insufficient to confirm forgetting in VFL unlearning.
  • No current method can simultaneously deliver high utility, output-level forgetting, and representation-level forgetting.
  • Class-level unlearning leaves stronger representational traces than sample-level unlearning.
  • Residual class information persists across all depths of the network.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Unlearning algorithms may need to target internal layer activations directly rather than final outputs.
  • Evaluation standards for federated unlearning should require representation-level tests as a minimum.
  • The observed class-sample asymmetry suggests separate mechanisms may be needed for forgetting entire classes versus individual samples.

Load-bearing premise

The four diagnostics detect retained class information at the representation level when output metrics do not.

What would settle it

Run the four diagnostics on a model that has been explicitly altered to remove all class-discriminative structure in every layer and check whether all scores match those of a model retrained from scratch on the remaining data.

Figures

Figures reproduced from arXiv: 2605.20282 by Chunlei Meng, Guangzhen Yao, Shuigeng Zhou, Yangchen Zeng, Zhenyu Yu.

Figure 1
Figure 1. Figure 1: Mirage: The Illusion of Forgetting. Suppressing classifier predictions may create the appearance of successful unlearning (middle), while the underlying feature geometry remains largely unchanged. Consequently, a linear probe can still recover forgotten-label information with high accuracy (right). This mismatch between behav￾ioral suppression and representational persistence forms the forgetting illusion.… view at source ↗
Figure 2
Figure 2. Figure 2: Mirage: Representation-Level Certification Framework. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Forgetting gap across methods and datasets. Each point represents a method–dataset pair with coordinates (yu, ∆LPR). The red region (yu ≈ 0, ∆LPR > 0) indicates the forgetting illu￾sion. BU (triangles) consistently falls in this region. Feature Separability. The separabil￾ity scores in [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: t-SNE visualization of bottom-model features on COVID-19. Blue: retained classes; red: forgotten class. Retrain (left) shows the forgotten class forming a sepa￾rable cluster even without training on its labels. Target scatters all points, reflecting model collapse (Accr = 34.3%). BU preserves the forgotten-class cluster almost iden￾tically to Retrain, visually confirming the forgetting illusion (∆LPR = +15… view at source ↗
read the original abstract

Machine unlearning in Vertical Federated Learning (VFL) has attracted growing interest, yet existing methods certify forgetting solely using output-level metrics. We challenge these works by introducing Mirage, a representation-level auditing framework that comprises four complementary diagnostics: Linear probe recovery (LPR), centered kernel alignment (CKA), feature separability scoring, and layer-wise recovery analysis. Extensive experiments across seven datasets and seven baseline methods following recent VFL unlearning protocols reveal three key findings: (1) Forgetting gap: methods that pass output-level certification still retain substantial class structure in their representations, with LPR exceeding the retrained baseline by up to 15.4 points; CKA shows that these models remain structurally closer to the original than to the retrained reference, while separability scores indicate persistent geometric discrimination. (2) Unlearning trilemma: no existing method simultaneously achieves high utility, output-level forgetting, and representation-level forgetting. (3) Class-sample asymmetry: class-level forgetting leaves strong representational traces (LPR exceeding 96 percent on several datasets), whereas sample-level forgetting is indistinguishable from chance (LPR is approximately 50 percent); layer-wise analysis further shows that residual class information persists across network depths. These findings call for representation-aware evaluation standards in federated unlearning research. Code is publicly available at https://github.com/YuZhenyuLindy/Mirage.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 1 minor

Summary. The paper claims that current output-level certification for machine unlearning in vertical federated learning is insufficient because models retain substantial class structure in their representations. Using the proposed Mirage framework with diagnostics LPR, CKA, feature separability, and layer-wise recovery on seven datasets and seven methods, it demonstrates LPR gaps up to 15.4 points above retrained baselines, structural similarity to original models via CKA, an unlearning trilemma, and asymmetry between class-level and sample-level forgetting.

Significance. If the four diagnostics are shown to be valid measures of representation-level forgetting, this work would have significant implications for the field by establishing that output-level metrics are inadequate and advocating for representation-aware evaluation standards in federated unlearning. The public code release at the provided GitHub link is a notable strength that enables reproducibility of the empirical findings.

major comments (2)
  1. [Abstract] The abstract summarizes results across seven datasets and methods but provides no details on metric implementations, baseline choices, statistical testing, or potential post-hoc selections, limiting verification of claims such as the 15.4-point LPR difference.
  2. [Mirage auditing framework] The four proposed diagnostics are introduced as complementary without a dedicated justification or comparison to alternative representation metrics, which is load-bearing for the central claim that output-certified methods retain class structure.
minor comments (1)
  1. [Abstract] The term 'Mirage' is introduced without prior definition in the abstract, though the framework is described immediately after.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback on our manuscript. The comments highlight opportunities to improve clarity in the abstract and strengthen the justification of our auditing framework. We respond to each major comment below.

read point-by-point responses

  1. Referee: [Abstract] The abstract summarizes results across seven datasets and methods but provides no details on metric implementations, baseline choices, statistical testing, or potential post-hoc selections, limiting verification of claims such as the 15.4-point LPR difference.

    Authors: We acknowledge the abstract's conciseness limits detail on implementations. The LPR metric is defined as linear probe accuracy on frozen representations (Section 3.1), CKA follows the standard formulation from Kornblith et al., baselines adhere to protocols in cited VFL unlearning papers, and statistical testing uses 5 independent runs with reported means and standard deviations (Appendix). The 15.4-point LPR gap is the observed maximum across all experiments rather than a post-hoc selection. Due to abstract length constraints, we will make a partial revision by adding a short clause referencing the four diagnostics. revision: partial

  2. Referee: [Mirage auditing framework] The four proposed diagnostics are introduced as complementary without a dedicated justification or comparison to alternative representation metrics, which is load-bearing for the central claim that output-certified methods retain class structure.

    Authors: This observation is correct and we agree a dedicated justification is warranted. The four diagnostics were selected because they probe orthogonal aspects of representation retention (linear recoverability via LPR, structural similarity via CKA, geometric separability, and depth-wise persistence), drawing from established representation learning literature. We will revise by adding a new subsection in Section 3 that explicitly justifies this complementarity, cites supporting references, and briefly compares against alternatives such as CCA, mutual information, or non-linear probes to better support the central claim. revision: yes

Circularity Check

0 steps flagged

No significant circularity

full rationale

The paper is an empirical auditing study that defines four representation diagnostics (LPR, CKA, feature separability scoring, layer-wise recovery) and applies them to compare unlearned VFL models against retrained-from-scratch baselines on seven datasets. No equations, derivations, fitted parameters, or self-referential definitions appear in the provided text. Central claims rest on direct empirical gaps (e.g., LPR differences) measured against external references rather than any reduction to inputs by construction, self-citation chains, or renamed known results. The protocol is self-contained and externally falsifiable via the released code.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 1 invented entities

Central claim rests on the domain assumption that representation-level metrics provide a more complete certification of forgetting than output-level ones, plus the validity of the specific four diagnostics and the fairness of comparisons to retrained baselines. No free parameters or invented physical entities are described.

axioms (2)
  • domain assumption Representation-level metrics such as LPR and CKA are necessary to certify true forgetting beyond output-level checks
    Paper positions these as complementary diagnostics that reveal retained structure missed by outputs.
  • domain assumption The retrained model serves as the appropriate reference for measuring representation-level forgetting
    Comparisons repeatedly use distance or recovery relative to retrained baselines.
invented entities (1)
  • Mirage auditing framework no independent evidence
    purpose: Representation-level certification of visual unlearning via four diagnostics
    Newly proposed auditing method; no independent evidence outside the paper's experiments.

pith-pipeline@v0.9.1-grok · 5796 in / 1374 out tokens · 33827 ms · 2026-06-30T18:39:52.602031+00:00 · methodology

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

39 extracted references · 4 canonical work pages · 3 internal anchors

  1. [1]

    Understanding intermediate layers using linear classifier probes

    Alain, G., Bengio, Y.: Understanding intermediate layers using linear classifier probes. arXiv preprint arXiv:1610.01644 (2016)

    work page internal anchor Pith review Pith/arXiv arXiv 2016

  2. [2]

    Compu- tational Linguistics48(1), 207–219 (2022)

    Belinkov, Y.: Probing classifiers: Promises, shortcomings, and advances. Compu- tational Linguistics48(1), 207–219 (2022)

    2022

  3. [3]

    In: 2021 IEEE symposium on security and privacy (SP)

    Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C.A., Jia, H., Travers, A., Zhang, B., Lie, D., Papernot, N.: Machine unlearning. In: 2021 IEEE symposium on security and privacy (SP). pp. 141–159. IEEE (2021)

    2021

  4. [4]

    In: 2015 IEEE symposium on security and privacy

    Cao, Y., Yang, J.: Towards making systems forget with machine unlearning. In: 2015 IEEE symposium on security and privacy. pp. 463–480. IEEE (2015)

    2015

  5. [5]

    In: International conference on machine learning

    Che, T., Zhou, Y., Zhang, Z., Lyu, L., Liu, J., Yan, D., Dou, D., Huan, J.: Fast federated machine unlearning with nonlinear functional theory. In: International conference on machine learning. pp. 4241–4268. PMLR (2023)

    2023

  6. [6]

    In: Proceedings of the 58th annual meeting of the association for computational linguistics

    Chen, J., Yang, Z., Yang, D.: Mixtext: Linguistically-informed interpolation of hidden space for semi-supervised text classification. In: Proceedings of the 58th annual meeting of the association for computational linguistics. pp. 2147–2157 (2020)

    2020

  7. [7]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Chen, M., Gao, W., Liu, G., Peng, K., Wang, C.: Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 7766–7775 (2023)

    2023

  8. [8]

    Chowdhury, M.E., Rahman, T., Khandakar, A., Mazhar, R., Kadir, M.A., Mahbub, Z.B., Islam, K.R., Khan, M.S., Iqbal, A., Al Emadi, N., et al.: Can ai help in screening viral and covid-19 pneumonia? Ieee Access8, 132665–132676 (2020)

    2020

  9. [9]

    IEEE Transactions on Information Forensics and Security18, 2345– 2354 (2023)

    Chundawat, V.S., Tarun, A.K., Mandal, M., Kankanhalli, M.: Zero-shot machine unlearning. IEEE Transactions on Information Forensics and Security18, 2345– 2354 (2023)

    2023

  10. [10]

    In: Proceedings of the AAAI conference on artificial intelligence

    Foster, J., Schoepf, S., Brintrup, A.: Fast machine unlearning without retraining through selective synaptic dampening. In: Proceedings of the AAAI conference on artificial intelligence. vol. 38, pp. 12043–12051 (2024)

    2024

  11. [11]

    Advances in neural information processing systems32(2019)

    Ginart, A., Guan, M., Valiant, G., Zou, J.Y.: Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems32(2019)

    2019

  12. [12]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Golatkar, A., Achille, A., Soatto, S.: Eternal sunshine of the spotless net: Selec- tive forgetting in deep networks. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 9304–9312 (2020)

    2020

  13. [13]

    In: Proceedings of the AAAI conference on artificial intelligence

    Graves, L., Nagisetty, V., Ganesh, V.: Amnesiac machine learning. In: Proceedings of the AAAI conference on artificial intelligence. vol. 35, pp. 11516–11524 (2021)

    2021

  14. [14]

    In: The Fourteenth International Conference on Learning Representations (2026)

    Gu, H., Tae, H.X., Fan, L., Chan, C.S.: Towards privacy-guaranteed label unlearn- ing in vertical federated learning: Few-shot forgetting without disclosure. In: The Fourteenth International Conference on Learning Representations (2026)

    2026

  15. [15]

    In: 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)

    Hayes, J., Shumailov, I., Triantafillou, E., Khalifa, A., Papernot, N.: Inexact un- learning needs more careful evaluations to avoid a false sense of privacy. In: 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). pp. 497–519. IEEE (2025)

    2025

  16. [16]

    He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

    2016

  17. [17]

    Advances in Neural Information Processing Systems36, 51584–51605 (2023) 16 Yu et al

    Jia, J., Liu, J., Ram, P., Yao, Y., Liu, G., Liu, Y., Sharma, P., Liu, S.: Model spar- sity can simplify machine unlearning. Advances in Neural Information Processing Systems36, 51584–51605 (2023) 16 Yu et al

    2023

  18. [18]

    In: International conference on machine learning

    Koh, P.W., Liang, P.: Understanding black-box predictions via influence functions. In: International conference on machine learning. pp. 1885–1894. PMLR (2017)

    2017

  19. [19]

    In: International conference on machine learning

    Kornblith, S., Norouzi, M., Lee, H., Hinton, G.: Similarity of neural network rep- resentations revisited. In: International conference on machine learning. pp. 3519–

  20. [20]

    Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)

    2009

  21. [21]

    Advances in neural information processing systems36, 1957– 1987 (2023)

    Kurmanji, M., Triantafillou, P., Hayes, J., Triantafillou, E.: Towards unbounded machine unlearning. Advances in neural information processing systems36, 1957– 1987 (2023)

    1957

  22. [22]

    Proceedings of the IEEE86(11), 2278–2324 (2002)

    LeCun, Y., Bottou, L., Bengio, Y., Haffner, P.: Gradient-based learning applied to document recognition. Proceedings of the IEEE86(11), 2278–2324 (2002)

    2002

  23. [23]

    In: 2021 IEEE/ACM 29th in- ternational symposium on quality of service (IWQOS)

    Liu, G., Ma, X., Yang, Y., Wang, C., Liu, J.: Federaser: Enabling efficient client- level data removal from federated learning models. In: 2021 IEEE/ACM 29th in- ternational symposium on quality of service (IWQOS). pp. 1–10. IEEE (2021)

    2021

  24. [24]

    Proceedings of the National Academy of Sciences117(40), 24652–24663 (2020)

    Papyan, V., Han, X., Donoho, D.L.: Prevalence of neural collapse during the ter- minal phase of deep learning training. Proceedings of the National Academy of Sciences117(40), 24652–24663 (2020)

    2020

  25. [25]

    Computers in biology and medicine132, 104319 (2021)

    Rahman, T., Khandakar, A., Qiblawey, Y., Tahir, A., Kiranyaz, S., Kashem, S.B.A., Islam, M.T., Al Maadeed, S., Zughaier, S.M., Khan, M.S., et al.: Exploring the effect of image enhancement techniques on covid-19 detection using chest x-ray images. Computers in biology and medicine132, 104319 (2021)

    2021

  26. [26]

    Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks againstmachinelearningmodels.In:2017IEEEsymposiumonsecurityandprivacy (SP). pp. 3–18. IEEE (2017)

    2017

  27. [27]

    In: Proceedings of the 2017 ACM SIGSAC Conference on computer and communications security

    Song, C., Ristenpart, T., Shmatikov, V.: Machine learning models that remember too much. In: Proceedings of the 2017 ACM SIGSAC Conference on computer and communications security. pp. 587–601 (2017)

    2017

  28. [28]

    IEEE transactions on neural networks and learning systems 35(9), 13046–13055 (2023)

    Tarun, A.K., Chundawat, V.S., Mandal, M., Kankanhalli, M.: Fast yet effective machine unlearning. IEEE transactions on neural networks and learning systems 35(9), 13046–13055 (2023)

    2023

  29. [29]

    In: 31st USENIX security symposium (USENIX Security 22)

    Thudi, A., Jia, H., Shumailov, I., Papernot, N.: On the necessity of auditable algo- rithmic definitions for machine unlearning. In: 31st USENIX security symposium (USENIX Security 22). pp. 4007–4022 (2022)

    2022

  30. [30]

    arXiv preprint arXiv:2501.13683 (2025)

    Varshney, A.K., Vandikas, K., Torra, V.: Unlearning clients, features and samples in vertical federated learning. arXiv preprint arXiv:2501.13683 (2025)

    work page arXiv 2025

  31. [31]

    Split learning for health: Distributed deep learning without sharing raw patient data

    Vepakomma, P., Gupta, O., Swedish, T., Raskar, R.: Split learning for health: Distributed deep learning without sharing raw patient data. arXiv preprint arXiv:1812.00564 (2018)

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  32. [32]

    IEEE Transactions on Cognitive Communications and Networking (2025)

    Wang, J., Lin, Y., Niyato, D., Gao, Z., Du, H., Zhang, T., Tang, X., Fan, J., Han, Z.: A zero-shot federated unlearning framework with stability verification. IEEE Transactions on Cognitive Communications and Networking (2025)

    2025

  33. [33]

    ACM Transactions on Internet Technology24(2), 1–22 (2024)

    Wang, Z., Gao, X., Wang, C., Cheng, P., Chen, J.: Efficient vertical federated unlearning via fast retraining. ACM Transactions on Internet Technology24(2), 1–22 (2024)

    2024

  34. [34]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Wu, Z., Song, S., Khosla, A., Yu, F., Zhang, L., Tang, X., Xiao, J.: 3d shapenets: A deep representation for volumetric shapes. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 1912–1920 (2015)

    1912

  35. [35]

    IEEE Transactions on Privacy 2, 131–143 (2025) Mirage 17

    Yang, W., Al-Masri, E., Kotevska, O.: Mic-dp: A scalable correlation-aware differ- ential privacy framework for high-dimensional data. IEEE Transactions on Privacy 2, 131–143 (2025) Mirage 17

    2025

  36. [36]

    In: Proceedings of the AAAI Conference on Artificial Intelligence (2025)

    Yu, Z., Chan, C.S.: Yuan: Yielding unblemished aesthetics through a unified net- work for visual imperfections removal in generated images. In: Proceedings of the AAAI Conference on Artificial Intelligence (2025)

    2025

  37. [37]

    Yu, Z., Han, L., Wang, P., IDRIS, M.Y.I., Xiang, Y.: Instantforget: Training-free functionalfeatureunlearningviasubspaceprojectionandinference-timesmoothing (2025)

    2025

  38. [38]

    Engineering Applications of Artificial Intelligence161, 112087 (2025)

    Yu, Z., Idris, M.Y.I., Wang, P., Xia, Y., Xiang, Y.: Forgetme: Benchmarking the selective forgetting capabilities of generative models. Engineering Applications of Artificial Intelligence161, 112087 (2025)

    2025

  39. [39]

    Verification of Machine Unlearning is Fragile

    Zhang, B., Chen, Z., Shen, C., Li, J.: Verification of machine unlearning is fragile. arXiv preprint arXiv:2408.00929 (2024) Mirage 1 A1 Additional t-SNE Visualizations We provide t-SNE visualizations of bottom-model features for all remaining datasets. In each panel, blue points represent retained classes and red points represent the forgotten class. Acr...

    work page internal anchor Pith review Pith/arXiv arXiv 2024