Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
We present the findings of the first NeurIPS competition on unlearning, which sought to stimulate the development of novel algorithms and initiate discussions on formal and robust evaluation methodologies. The competition was highly successful: nearly 1,200 teams from across the world participated, and a wealth of novel, imaginative solutions with different characteristics were contributed. In this paper, we analyze top solutions and delve into discussions on benchmarking unlearning, which itself is a research problem. The evaluation methodology we developed for the competition measures forgetting quality according to a formal notion of unlearning, while incorporating model utility for a holistic evaluation. We analyze the effectiveness of different instantiations of this evaluation framework vis-a-vis the associated compute cost, and discuss implications for standardizing evaluation. We find that the ranking of leading methods remains stable under several variations of this framework, pointing to avenues for reducing the cost of evaluation. Overall, our findings indicate progress in unlearning, with top-performing competition entries surpassing existing algorithms under our evaluation framework. We analyze trade-offs made by different algorithms and strengths or weaknesses in terms of generalizability to new datasets, paving the way for advancing both benchmarking and algorithm development in this important area.
Key facts. Cited by 48 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 32 of its 35 references that are in the map. First posted on arXiv 13 Jun 2024.
Builds on
32 of 35 references.
Closest ancestors · 14
Same direction, newest first
- 2024What makes unlearning hard and what to do about it3 Jun
- 2024Challenging Forgets: Unveiling the Worst-Case Forget Sets in Machine Unlearning12 Mar
- 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy2 Mar
- 2024Corrective Machine Unlearning21 Feb
- 2023DUCK: Distance-based Unlearning via Centroid Kinematics4 Dec
- 2023Unlearning via Sparse Representations26 Nov
- 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation19 Oct
- 2023In-Context Unlearning: Language Models as Few Shot Unlearners11 Oct
- 2023Model Sparsity Can Simplify Machine Unlearning11 Apr
- 2022A Survey of Machine Unlearning6 Sep
- 2022Towards Adversarial Evaluations for Inexact Machine Unlearning17 Jan
- 2021Unrolling SGD: Understanding Factors Influencing Machine Unlearning27 Sep
2 more
Other references · 18
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
- 2019Machine Unlearningcited by 1,020
- 2021Membership Inference Attacks From First Principlescited by 839
- 2018LEAF: A Benchmark for Federated Settingscited by 780
- 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 599
- 2021Deep Learning on a Data Diet: Finding Important Examples Early in Trainingcited by 529
- 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
- 2020Descent-to-Delete: Gradient-Based Methods for Machine Unlearningcited by 303
- 2013The Composition Theorem for Differential Privacycited by 290
- 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
6 more
- 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 213
- 2020Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observationscited by 171
- 2020DeltaGrad: Rapid retraining of machine learning modelscited by 143
- 2022If Influence Functions are the Answer, Then What is the Question?cited by 142
- 2019CASIA-SURF: A Large-scale Multi-modal Benchmark for Face Anti-spoofingcited by 61
- 2024Information Complexity of Stochastic Convex Optimization: Applications to Generalization and Memorizationcited by 12
Built on by
Citing papers per year: 2024: 10; 2025: 21; 2026: 17.
48 papers.
Sort:
By area:
- 2024Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearningcited by 160
- 2024Alternate Preference Optimization for Unlearning Factual Knowledge in Large Language Modelscited by 32
- 2025MLRC-Bench: Can Language Agents Solve Machine Learning Research Challenges?cited by 27
- 2025Certified Unlearning for Neural Networkscited by 25
- 2025LoTUS: Large-Scale Machine Unlearning with a Taste of Uncertaintycited by 12
- 2025From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularizationcited by 12
- 2025A Certified Unlearning Approach without Access to Source Datacited by 9
- 2024Towards flexible perception with visual memorycited by 8
- 2024Deep Unlearn: Benchmarking Machine Unlearning for Image Classificationcited by 8
- 2025Rectifying Privacy and Efficacy Measurements in Machine Unlearning: A New Inference Attack Perspectivecited by 8
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted datacited by 7
- 2024Improved Localized Machine Unlearning Through the Lens of Memorizationcited by 6
36 more
- 2025On the Impossibility of Retrain Equivalence in Machine Unlearningcited by 6
- 2024How Data Inter-connectivity Shapes LLMs Unlearning: A Structural Unlearning Perspectivecited by 5
- 2024Scalability of memorization-based machine unlearningcited by 5
- 2024Verifying Machine Unlearning with Explainable AIcited by 5
- 2025Position: Bridge the Gaps between Machine Unlearning and AI Regulationcited by 5
- 2024Unlearning in- vs. out-of-distribution data in LLMs under gradient-based methodcited by 4
- 2025Reference-Specific Unlearning Metrics Can Hide the Truth: A Reality Checkcited by 4
- 2024MUSO: Achieving Exact Machine Unlearning in Over-Parameterized Regimescited by 3
- 2025Forget-MI: Machine Unlearning for Forgetting Multimodal Information in Healthcare Settingscited by 3
- 2025Distribution Preference Optimization: A Fine-grained Perspective for LLM Unlearningcited by 3
- 2026Knowledge Vector Weakening: Efficient Training-free Unlearning for Large Vision-Language Modelscited by 3
- 2026Is your algorithm unlearning or untraining?cited by 3
- 2026Re-understanding Graph Unlearning through Memorizationcited by 2
- 2026Regularized f-Divergence Kernel Testscited by 2
- 2026Position: Capability Control Should be a Separate Goal From Alignmentcited by 2
- 2026How to sketch a learning algorithmcited by 2
- 2026Multilingual Unlearning in LLMs: Transfer, Dynamics, and Reversibilitycited by 2
- 2025Losing is for Cherishing: Data Valuation Based on Machine Unlearning and Shapley Valuecited by 1
- 2025Apollo: A Posteriori Label-Only Membership Inference Attack Towards Machine Unlearningcited by 1
- 2025Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Designcited by 1
- 2025On the importance of multiple training seeds for evaluating machine unlearningcited by 1
- 2026Reference-Guided Machine Unlearningcited by 1
- 2026Auditing of Unlearning Algorithmscited by 1
- 2026The BatchNorm Illusion: Diagnosing Normalization Artifacts in Machine Unlearning Evaluationcited by 1
- 2025Lifting Data-Tracing Machine Unlearning to Knowledge-Tracing for Foundation Modelscited by 0
- 2025Machine Unlearning of Traffic State Estimation and Predictioncited by 0
- 2025Unleashing Uncertainty: Efficient Machine Unlearning for Generative AIcited by 0
- 2025RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositoriescited by 0
- 2025When unlearning is free: leveraging low influence points to reduce computational costscited by 0
- 2026Benchmarking Unlearning for Vision Transformerscited by 0
- 2026Behavioral Guarantees for Proxy-Based Unlearningcited by 0
- 2026Characterizing Privacy-Audit Alignment in Behavioral Audit of Machine Unlearningcited by 0
- 2026Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpointscited by 0
- 2026Do Influence-Derived Data Perturbations Enable Machine Unlearning? A Controlled Study of Three Plausible Rolescited by 0
- 2026Evaluating Machine Unlearning in ASRcited by 0
- 2026Bounding Retraining Equivalence and the Deletion Floor in Materials Machine Unlearningcited by 0
- 2026Bounding Retraining Equivalence and the Deletion Floor in Materials Machine Unlearning28 Sep 2026
- 2026Evaluating Machine Unlearning in ASR28 Sep 2026
- 2026Do Influence-Derived Data Perturbations Enable Machine Unlearning? A Controlled Study of Three Plausible Roles11 Sep 2026
- 2026Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints10 Sep 2026
- 2026The BatchNorm Illusion: Diagnosing Normalization Artifacts in Machine Unlearning Evaluation8 Sep 2026
- 2026Auditing of Unlearning Algorithms7 Jul 2026
- 2026Characterizing Privacy-Audit Alignment in Behavioral Audit of Machine Unlearning12 Jun 2026
- 2026Multilingual Unlearning in LLMs: Transfer, Dynamics, and Reversibility2 Jun 2026
- 2026Behavioral Guarantees for Proxy-Based Unlearning11 May 2026
- 2026Is your algorithm unlearning or untraining?9 Apr 2026
- 2026How to sketch a learning algorithm8 Apr 2026
- 2026Reference-Guided Machine Unlearning11 Mar 2026
36 more
- 2026Benchmarking Unlearning for Vision Transformers23 Feb 2026
- 2026Position: Capability Control Should be a Separate Goal From Alignment5 Feb 2026
- 2026Knowledge Vector Weakening: Efficient Training-free Unlearning for Large Vision-Language Models29 Jan 2026
- 2026Regularized f-Divergence Kernel Tests27 Jan 2026
- 2026Re-understanding Graph Unlearning through Memorization21 Jan 2026
- 2025When unlearning is free: leveraging low influence points to reduce computational costs4 Dec 2025
- 2025RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories3 Dec 2025
- 2025On the importance of multiple training seeds for evaluating machine unlearning30 Oct 2025
- 2025On the Impossibility of Retrain Equivalence in Machine Unlearning18 Oct 2025
- 2025Reference-Specific Unlearning Metrics Can Hide the Truth: A Reality Check14 Oct 2025
- 2025Distribution Preference Optimization: A Fine-grained Perspective for LLM Unlearning6 Oct 2025
- 2025Unleashing Uncertainty: Efficient Machine Unlearning for Generative AI28 Aug 2025
- 2025Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Design13 Aug 2025
- 2025Machine Unlearning of Traffic State Estimation and Prediction23 Jul 2025
- 2025Forget-MI: Machine Unlearning for Forgetting Multimodal Information in Healthcare Settings29 Jun 2025
- 2025Rectifying Privacy and Efficacy Measurements in Machine Unlearning: A New Inference Attack Perspective16 Jun 2025
- 2025Lifting Data-Tracing Machine Unlearning to Knowledge-Tracing for Foundation Models12 Jun 2025
- 2025Apollo: A Posteriori Label-Only Membership Inference Attack Towards Machine Unlearning11 Jun 2025
- 2025Certified Unlearning for Neural Networks8 Jun 2025
- 2025A Certified Unlearning Approach without Access to Source Data6 Jun 2025
- 2025From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization28 May 2025
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted data23 May 2025
- 2025Losing is for Cherishing: Data Valuation Based on Machine Unlearning and Shapley Value22 May 2025
- 2025MLRC-Bench: Can Language Agents Solve Machine Learning Research Challenges?13 Apr 2025
- 2025LoTUS: Large-Scale Machine Unlearning with a Taste of Uncertainty24 Mar 2025
- 2025Position: Bridge the Gaps between Machine Unlearning and AI Regulation18 Feb 2025
- 2024Improved Localized Machine Unlearning Through the Lens of Memorization3 Dec 2024
- 2024Verifying Machine Unlearning with Explainable AI20 Nov 2024
- 2024Unlearning in- vs. out-of-distribution data in LLMs under gradient-based method7 Nov 2024
- 2024Scalability of memorization-based machine unlearning21 Oct 2024
- 2024MUSO: Achieving Exact Machine Unlearning in Over-Parameterized Regimes11 Oct 2024
- 2024Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning9 Oct 2024
- 2024Deep Unlearn: Benchmarking Machine Unlearning for Image Classification2 Oct 2024
- 2024Alternate Preference Optimization for Unlearning Factual Knowledge in Large Language Models20 Sep 2024
- 2024Towards flexible perception with visual memory15 Aug 2024
- 2024How Data Inter-connectivity Shapes LLMs Unlearning: A Structural Unlearning Perspective24 Jun 2024
- 2025Certified Unlearning for Neural Networkscited by 25
- 2025LoTUS: Large-Scale Machine Unlearning with a Taste of Uncertaintycited by 12
- 2025From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularizationcited by 12
- 2025A Certified Unlearning Approach without Access to Source Datacited by 9
- 2024Deep Unlearn: Benchmarking Machine Unlearning for Image Classificationcited by 8
- 2025Rectifying Privacy and Efficacy Measurements in Machine Unlearning: A New Inference Attack Perspectivecited by 8
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted datacited by 7
- 2024Improved Localized Machine Unlearning Through the Lens of Memorizationcited by 6
- 2025On the Impossibility of Retrain Equivalence in Machine Unlearningcited by 6
- 2024How Data Inter-connectivity Shapes LLMs Unlearning: A Structural Unlearning Perspectivecited by 5
- 2024Scalability of memorization-based machine unlearningcited by 5
- 2024Verifying Machine Unlearning with Explainable AIcited by 5
12 most cited of 38 All 38 (JSON)
- 2026Bounding Retraining Equivalence and the Deletion Floor in Materials Machine Unlearning28 Sep 2026
- 2026Evaluating Machine Unlearning in ASR28 Sep 2026
- 2026Do Influence-Derived Data Perturbations Enable Machine Unlearning? A Controlled Study of Three Plausible Roles11 Sep 2026
- 2026Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints10 Sep 2026
- 2026The BatchNorm Illusion: Diagnosing Normalization Artifacts in Machine Unlearning Evaluation8 Sep 2026
- 2026Auditing of Unlearning Algorithms7 Jul 2026
- 2026Characterizing Privacy-Audit Alignment in Behavioral Audit of Machine Unlearning12 Jun 2026
- 2026Multilingual Unlearning in LLMs: Transfer, Dynamics, and Reversibility2 Jun 2026
- 2026Behavioral Guarantees for Proxy-Based Unlearning11 May 2026
- 2026Is your algorithm unlearning or untraining?9 Apr 2026
- 2026Reference-Guided Machine Unlearning11 Mar 2026
- 2026Benchmarking Unlearning for Vision Transformers23 Feb 2026
12 newest of 38 All 38 (JSON)
- 2024Towards flexible perception with visual memorycited by 8
- 2026Position: Capability Control Should be a Separate Goal From Alignmentcited by 2
- 2026How to sketch a learning algorithmcited by 2
- 2025Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Designcited by 1
- 2026How to sketch a learning algorithm8 Apr 2026
- 2026Position: Capability Control Should be a Separate Goal From Alignment5 Feb 2026
- 2025Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Design13 Aug 2025
- 2024Towards flexible perception with visual memory15 Aug 2024