Invisible Watermarks - Visible Gains - Steering Machine Unlearning with Bi-Level Watermarking Design

Aug 27, 2026

Upload by Miles

Increasing demand for the right to be forgotten has made machine unlearning (MU) essential for removing sensitive data effects while preserving performance on unrelated data. Existing MU mainly updates model weights using in-training methods, leaving limited exploration of whether data-level adjustments help. This work proposes a watermarking-assisted MU framework that enables controlled removal of specified data. It introduces WATER4MU, a bi-level optimization that reduces unlearning difficulty by designing watermarks while keeping the model training independent. Experiments show improved MU effectiveness in image classification and generation, especially on challenging forgets.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages12

Reading Time30 min

AccessFree to download

Introduction

Problem motivation: right to be forgotten and machine unlearning

Data-level perspective: watermarking as a controllable modification

Research question and two integration paradigms

WATER4MU overview and bi-level optimization idea

This ICCV paper is the Open Access version, provided by the Computer Vision Foundation. Except for this watermark, it is identical to the accepted version; the final published version of the proceedings is available on IEEE Xplore. Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Design Yuhao Sun 1 ,2 , Yihua Zhang3 , Gaowen Liu4 , Hongtao Xie 1 *†, Sijia Liu3∗ 1University of Science and Technology of China, 2Institute of Artificial Intelligence, Hefei Comprehensive National Science Center, 3Michigan State University, 4 Cisco Research Abstract With the increasing demand for the right to be forgotten, machine unlearning (MU) has emerged as a vital tool for enhancing trust and regulatory compliance by enabling the removal of sensitive data influences from machine learning (ML) models. However, most MU algorithms primarily rely on in-training methods to adjust model weights, with limited exploration of the benefits that data-level adjustments could bring to the unlearning process. To address this gap, we propose a novel approach that leverages digital watermarking to facilitate MU. By integrating watermarking, we establish a controlled unlearning mechanism that enables precise removal of specified data while maintaining model utility for unrelated tasks. We first examine the impact of watermarked data on MU, finding that MU effectively generalizes to watermarked data. Building on this, we introduce an unlearning-friendly watermarking framework, termed WATER4MU, to enhance unlearning effectiveness. The core of WATER4MU is a bi-level optimization (BLO) framework: at the upper level, the watermarking network is optimized to minimize unlearning difficulty, while at the lower level, the model itself is trained independently of watermarking. Experimental results demonstrate that WATER4MU is effective in MU across both image classification and image generation tasks. Notably, it outperforms existing methods in challenging MU scenarios, known as “challenging forgets”. 1. Introduction Machine unlearning (MU), which aims to remove the influence of unwanted data from a pre-trained model while preserving the model’s utility on data unrelated to the unlearning request, has emerged as a promising approach for customizing and adapting machine learning (ML) models *Equal advising †Corresponding author Figure 1 . An overview of the watermarking for machine unlearning framework via bi-level optimization proposed in this work. to diverse contexts and requirements [1–4] . For example, MU is widely used to enhance model privacy, aligning with the right to be forgotten by removing private or copyrighted information from models to prevent privacy breaches [5–9] . It has also been applied to improve model generalization in transfer learning by removing the influence of undesired source data in pre-trained models, where removing nonsalient source data to downstream tasks improves fine-tuning performance [10, 11] . Furthermore, MU shows promise in enhancing model robustness, for instance, by removing the influence of backdoored training data to defend against backdoor attacks [12, 13] or eliminating harmful data to improve the model’s trust [14–16] . The expanding applications of MU across diverse domains and model types–including discriminative and generative models [17, 18]–are driven by its effectiveness in erasing specific data influence within ML models. That is, a key aspect of MU involves characterizing the influence of specific data on the model and leveraging this data-model interaction to adjust the model for effective unlearning. However, predominant research in MU focuses on model-based weight updating as the primary approach to achieve the unlearning objective [19–25], with less attention given to the impact of data modifications–such as watermarking, which we will investigate in this work–on MU effectiveness. Digital watermarking, which embeds ownership signatures (kn

FAQs

What problem does the paper address in machine unlearning?

It addresses how to remove the influence of specified sensitive data while keeping utility on unrelated tasks, focusing on whether data-level modifications can improve MU rather than relying only on weight updates.

How does watermarking affect unlearning effectiveness according to the paper?

The paper investigates watermarking in MU and finds that unlearning generalizes well to watermarked data, with watermarking behaving largely orthogonally to unlearning and causing minimal negative impact.

What is WATER4MU and how does it work?

WATER4MU is an MU-aware watermarking framework built on bi-level optimization: the upper level optimizes the watermarking network to minimize unlearning difficulty, while the lower level trains the model independently of watermarking.

On what tasks and scenarios does the proposed method improve results?

The experiments evaluate both image classification and image generation, and the method improves performance particularly in challenging forget scenarios called “challenging forgets”.

Aug 27, 2026

Upload by Miles