[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-86353-en":3,"doc-seo-86353-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},86353,1099513958762,"Logic","https://ap-avatar.wpscdn.com/avatar/1000023916a998db790?x-image-process=image/resize,m_fixed,w_180,h_180&k=1784791008015729253",8,"Research & Report","On the Necessity of Output Distribution Reweighting for Effective Class Unlearning","Class unlearning evaluation can suffer from hidden information leakage when the underlying class geometry is ignored, allowing remnants of a “forgotten” class to be inferred. The work introduces the Class Membership Inference Attack (CMIA), using model probability signals toward neighboring classes to detect unlearned samples, and shows existing unlearning methods are vulnerable across multiple datasets. It proposes Tilted REWeighting (TREW), a fine-tuning objective that reassigns forget-class probability mass to remaining classes and tilts the target distribution via inter-class similarity to approximate retrained-from-scratch behavior. On CIFAR-10, TREW reduces gaps versus retrained models by 19% and 46% for U-LiRA and CMIA scores.","Unlearning Isn’t Forgetting: Revealing Hidden Leakage in  \nClass Unlearning Evaluations  \nAli Ebrahimpour-Boroojeny*  \nUIUC [ae20@illinois.edu](ae20@illinois.edu)  \nYian Wang*  \nUIUC [yian3@illinois.edu](yian3@illinois.edu)  \nHari Sundaram  \nUIUC [hs1@illinois.edu](hs1@illinois.edu)  \narXiv :2506 .20893v 5 [ cs .LG] 11 Jul 2026  \nAbstract  \nIn this paper, we reveal a significant shortcoming in class unlearning evaluations: overlooking the underlying class geometry can cause information leakage about the forgotten class. We further propose a simple unlearning strategy to mitigate this issue. We introduce Class Membership Inference Attack (CMIA) that uses the probabilities assigned by the model to neighboring classes to detect unlearned samples. We find that existing unlearning methods are vulnerable to CMIA across multiple datasets. We then propose a new fine-tuning objective that mitigates this privacy leakage by approximating, for forget-class inputs, the distribution over the remaining classes that a retrained-from-scratch model would produce.  \nTo construct this approximation, we estimate inter-class similarity and tilt the target model’s distribution accordingly. The resulting Tilted REWeighting (TREW) distribution serves asthe desired distribution during fine-tuning. We also show that across multiple benchmarks, TREW matches or surpasses existing unlearning methods on prior unlearning metrics. More specifically, on CIFAR-10, it reduces the gap with retrained models by 19% and 46% for U-LiRA and CMIA scores, accordingly, compared to the SOTA method for each category.  \nOur code is publicly available* .  \n1 Introduction  \nMachine learning models deployed in real-world applications must support the ability to forget specific information upon request. Class unlearning is particularly challenging because retraining large models from scratch can be prohibitively expensive and it is difficult to change a trained model to completely forget about a learned class or concept. However, privacy regulations such as the EU’s GDPR [Voigt and Von dem Bussche, 2017] mandate the “right to be forgotten,” enforcing model owners to delete personal data upon request. Early methods for machine unlearning primarily expedite the retraining of models at the potential cost to model performance [Bourtoule et al., 2021] . These models also have high computational overhead.  \nBeyond retraining from scratch, prior work on machine unlearning has explored both exact and approximate approaches. Exact methods offer formal guarantees but typically rely on restrictive assumptions such as convex objectives or constrained training procedures, limiting their applicability to modern deep networks [Izzoet al., 2021, Thudi et al., 2022] . As a result, most practical work focuses on approximate unlearning, including fine-tuning and weight-level interventions, which are computationally efficient but generally lack strong guarantees [Golatkar et al., 2020, Jia et al., 2023, Fan et al., 2023, Ebrahimpour-Boroojeny et al.] . More recently, class unlearning has emerged as a distinct setting that aims to remove an entire semantic class rather than individual samples [Warnecke et al., 2021, Poppi et al., 2024, Chen et al., 2023, Chang et al., 2024], posing new challenges for both evaluation and robustness.  \nThe setting of class unlearning differs fundamentally from unlearning random training samples. An unlearned model must be free of any residual signal of the forgotten class, whereas merely enforcing low  \n*  \nThese authors contributed equally to this work  \n*  \n[https://github.com/CrowdDynamicsLab/ICML_TREW](https://github.com/CrowdDynamicsLab/ICML_TREW)  \nor zero accuracy on that class reflects only superficial forgetting rather than true unlearning. Ignoring this distinction, we show that existing methods are vulnerable to new attacks specifically designed for class-wise membership inference, such as CMIA introduced in this work. This issue has remained largely unnot","cbCaiieMZjDLyw7w","https://ap.wps.com/l/cbCaiieMZjDLyw7w","pdf",3921533,5,1,25,"English","en",105,"# Introduction\n## Motivation and limitations of existing class unlearning evaluations\n## Exact vs. approximate unlearning approaches\n## Risks of superficial forgetting and class-wise leakage\n# Proposed method and evaluation\n## CMIA: class-structured membership inference\n## TREW training objective\n## Experimental results and benchmarks","[{\"question\":\"What problem does the paper identify in current class unlearning evaluations?\",\"answer\":\"It identifies that evaluations can overlook class geometry, causing hidden leakage about the forgotten class. As a result, residual information may remain inferable even when unlearning appears effective by standard metrics.\"},{\"question\":\"How does the proposed Class Membership Inference Attack (CMIA) work?\",\"answer\":\"CMIA leverages the model’s assigned probabilities to neighboring classes of the forget class. It uses these signals to detect whether samples from the forgotten class were used during training, and can operate in a more restrictive setting without training data access.\"},{\"question\":\"What is Tilted REWeighting (TREW) and how does it mitigate leakage?\",\"answer\":\"TREW is a fine-tuning objective that redistributes the forget-class probability mass proportionally to remaining classes. It then tilts the distribution using estimated inter-class similarity so the target distribution better matches what a retrained-from-scratch model would produce.\"}]",1784210785,63,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"on-the-necessity-of-output-distribution-reweighting-for-effective-class-unlearning","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/on-the-necessity-of-output-distribution-reweighting-for-effective-class-unlearning/86353/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-07-26","2026-07-16",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What problem does the paper identify in current class unlearning evaluations?","Question",{"text":76,"@type":77},"It identifies that evaluations can overlook class geometry, causing hidden leakage about the forgotten class. As a result, residual information may remain inferable even when unlearning appears effective by standard metrics.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"How does the proposed Class Membership Inference Attack (CMIA) work?",{"text":81,"@type":77},"CMIA leverages the model’s assigned probabilities to neighboring classes of the forget class. It uses these signals to detect whether samples from the forgotten class were used during training, and can operate in a more restrictive setting without training data access.",{"name":83,"@type":74,"acceptedAnswer":84},"What is Tilted REWeighting (TREW) and how does it mitigate leakage?",{"text":85,"@type":77},"TREW is a fine-tuning objective that redistributes the forget-class probability mass proportionally to remaining classes. It then tilts the distribution using estimated inter-class similarity so the target distribution better matches what a retrained-from-scratch model would produce.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":20,"slug":138},19,"General","general"]