CLIPErase: Efficient Unlearning of Visual-Textual Associations in CLIP
Extracted source text · arXiv 2410.23330
% This must be in the first 5 lines to tell arXiv to use pdfLaTeX, which is strongly recommended.
\pdfoutput=1
% In particular, the hyperref package requires pdfLaTeX in order to break URLs across lines.
\documentclass[11pt]{article}
% Change "review" to "final" to generate the final (sometimes called camera-ready) version.
% Change to "preprint" to generate a non-anonymous version with page numbers.
\usepackage[preprint]{acl}
\usepackage{pifont}
\newcommand{\cmark}{\ding{51}} % 勾号
\newcommand{\xmark}{\ding{55}} % 叉号
\usepackage{amsmath}
% Standard package includes
\usepackage{times}
\usepackage{amsmath}
\usepackage{latexsym}
\usepackage{colortbl}
\usepackage{xcolor} % 加载颜色定义
\usepackage{multirow} % 处理多行单元格
\usepackage{booktabs} % 处理表格顶部/中部/底部的线
\usepackage{graphicx} % 支持缩放表格的命令 scalebox
\usepackage{amsmath} % 支持数学符号
\usepackage{colortbl, xcolor} % 在导言区加入包
\definecolor{lightblue}{rgb}{0.68, 0.85, 0.9} % 定义浅蓝色
\definecolor{babyblue}{rgb}{0.54, 0.81, 0.94}
% Standard package includes
\usepackage{times}
\usepackage{latexsym}
\usepackage{colortbl} % for cell colors
\usepackage{xcolor} % for color definitions
% For proper rendering and hyphenation of words containing Latin characters (including in bib files)
\usepackage[T1]{fontenc}
% For Vietnamese characters
% \usepackage[T5]{fontenc}
% See https://www.latex-project.org/help/documentation/encguide.pdf for other character sets
% This assumes your files are encoded as UTF8
\usepackage[utf8]{inputenc}
\usepackage{booktabs}
% This is not strictly necessary, and may be commented out,
% but it will improve the layout of the manuscript,
% and will typically save some space.
\usepackage{microtype}
% This is also not strictly necessary, and may be commented out.
% However, it will improve the aesthetics of text in
% the typewriter font.
\usepackage{inconsolata}
\usepackage[utf8]{inputenc} % 处理输入文件编码
\usepackage[T1]{fontenc} % 使用现代字体编码
%Including images in your LaTeX document requires adding
%additional package(s)
\usepackage{graphicx}
% If the title and author information does not fit in the area allocated, uncomment the following
%
%\setlength\titlebox{<dim>}
%
% and set <dim> to something 5cm or larger.
% @Tianyu Below are additional packages to make sure the original code work, remove them or find workaround if hurt the orginal format
\usepackage{amsmath}
\usepackage{multirow}
\usepackage{booktabs}
\usepackage{enumitem}
\usepackage{amssymb}
% For proper rendering and hyphenation of words containing Latin characters (including in bib files)
\usepackage[T1]{fontenc}
% For Vietnamese characters
% \usepackage[T5]{fontenc}
% See https://www.latex-project.org/help/documentation/encguide.pdf for other character sets
% This assumes your files are encoded as UTF8
\usepackage[utf8]{inputenc}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage[utf8]{inputenc}
\usepackage{CJKutf8}
% \usepackage[table]{xcolor} %
% This is not strictly necessary, and may be commented out,
% but it will improve the layout of the manuscript,
% and will typically save some space.
% This is also not strictly necessary, and may be commented out.
% However, it will improve the aesthetics of text in
% the typewriter font.
\usepackage{inconsolata}
\usepackage[utf8]{inputenc}
%Including images in your LaTeX document requires adding
%additional package(s)
\usepackage{graphicx}
% If the title and author information does not fit in the area allocated, uncomment the following
%
%\setlength\titlebox{<dim>}
%
% and set <dim> to something 5cm or larger.
\title{CLIPErase: Efficient Unlearning of Visual-Textual Associations in CLIP}
%Extendable and Efficient Machine Unlearning for Contrastive Multimodal Pre-Training}
% Author information can be set in various styles:
% For several authors from the same institution:
% \author{Author 1 \and ... \and Author n \\
% Address line \\ ... \\ Address line}
% if the names do not fit well on one line use
% Author 1 \\ {\bf Author 2} \\ ... \\ {\bf Author n} \\
% For authors from different institutions:
% \author{Author 1 \\ Address line \\ ... \\ Address line
% \And ... \And
% Author n \\ Address line \\ ... \\ Address line}
% To start a separate ``row'' of authors use \AND, as in
% \author{Author 1 \\ Address line \\ ... \\ Address line
% \AND
% Author 2 \\ Address line \\ ... \\ Address line \And
% Author 3 \\ Address line \\ ... \\ Address line}
% \author{First Author \\
% Affiliation / Address line 1 \\
% Affiliation / Address line 2 \\
% Affiliation / Address line 3 \\
% \texttt{email@domain} \\\And
% Second Author \\
% Affiliation / Address line 1 \\
% Affiliation / Address line 2 \\
% Affiliation / Address line 3 \\
% \texttt{email@domain} \\}
\author{
Tianyu Yang$^1$, Lisen Dai$^2$, Zheyuan Liu$^1$, Xiangqi Wang$^1$, Meng Jiang$^1$, \\
\textbf{Yapeng Tian}$^3$, \textbf{Xiangliang Zhang}$^1$ \\
$^1$University of Notre Dame \\
$^2$Columbia University \\
$^3$The University of Texas at Dallas \\
}
%\author{
% \textbf{First Author\textsuperscript{1}},
% \textbf{Second Author\textsuperscript{1,2}},
% \textbf{Third T. Author\textsuperscript{1}},
% \textbf{Fourth Author\textsuperscript{1}},
%\\
% \textbf{Fifth Author\textsuperscript{1,2}},
% \textbf{Sixth Author\textsuperscript{1}},
% \textbf{Seventh Author\textsuperscript{1}},
% \textbf{Eighth Author \textsuperscript{1,2,3,4}},
%\\
% \textbf{Ninth Author\textsuperscript{1}},
% \textbf{Tenth Author\textsuperscript{1}},
% \textbf{Eleventh E. Author\textsuperscript{1,2,3,4,5}},
% \textbf{Twelfth Author\textsuperscript{1}},
%\\
% \textbf{Thirteenth Author\textsuperscript{3}},
% \textbf{Fourteenth F. Author\textsuperscript{2,4}},
% \textbf{Fifteenth Author\textsuperscript{1}},
% \textbf{Sixteenth Author\textsuperscript{1}},
%\\
% \textbf{Seventeenth S. Author\textsuperscript{4,5}},
% \textbf{Eighteenth Author\textsuperscript{3,4}},
% \textbf{Nineteenth N. Author\textsuperscript{2,5}},
% \textbf{Twentieth Author\textsuperscript{1}}
%\\
%\\
% \textsuperscript{1}Affiliation 1,
% \textsuperscript{2}Affiliation 2,
% \textsuperscript{3}Affiliation 3,
% \textsuperscript{4}Affiliation 4,
% \textsuperscript{5}Affiliation 5
%\\
% \small{
% \textbf{Correspondence:} \href{mailto:email@domain}{email@domain}
% }
%}
\begin{document}
\maketitle
\begin{abstract}
% Machine Unlearning (MU) has become crucial for models like CLIP to comply with ethical standards and legal requirements such as the "right to be forgotten." However, unlearning in multimodal models like CLIP is challenging due to their complex integration of images and text. Other than previous methods that requires retraining from scratch, we introduce CLIPErase, an optimization-based framework that efficiently unlearns specific multimodal data from pretrained CLIP models. CLIPErase consists of three modules: a Forgetting Module that reduces the model's ability to associate image-text pairs in the forget set, a Retention Module that preserves performance on the retain set, and a Consistency Module that maintains output consistency with the original model. Extensive experiments on the CIFAR-100 and Flickr30K datasets demonstrate that CLIPErase effectively removes specified data while maintaining the model's performance on retained data, offering a practical solution for unlearning in multimodal models.
% Machine Unlearning (MU) has become crucial for models like CLIP, which links visual and textual concepts, to comply with ethical standards.
% Machine Unlearning (MU) is crucial for models like CLIP, which align visual and textual concepts, to adhere to ethical standards and legal requirements such as the "right to be forgotten."
% % However, unlearning in multimodal models like CLIP is challenging due to the complex embedding of images and text in a shared latent space, making it difficult to isolate and remove specific associations.
% However, unlearning in multimodal models like CLIP faces unique challenges, as traditional unimodal unlearning methods cannot be directly applied due to the shared latent space of images and text, which complicates the isolation and removal of specific associations.
% % Unlike previous methods that require retraining from scratch, we introduce CLIPErase, an optimization-based framework that efficiently unlearns specific multimodal data from pretrained CLIP models.
% In this context, we propose CLIPErase, a framework that efficiently removes the influence of specific multimodal data from pretrained CLIP models by disrupting the associations between modalities.
% % CLIPErase is scalable and consists of three key modules: a Forgetting Module that reduces the model's ability to associate image-text pairs in the forget set, a Retention Module that preserves performance on the retain set, and a Consistency Module that maintains output consistency with the original model.
% CLIPErase consists of three key modules: a Forgetting Module that disrupts the associations in the forget set, a Retention Module that preserves performance on the retain set, and a Consistency Module that maintains consistency with the original model.
% Extensive experiments on the CIFAR-100 and Flickr30K datasets demonstrate that CLIPErase effectively removes specified associations while preserving the model's performance on retained data. Moreover, CLIPErase outperforms state-of-the-art MU methods, offering a practical and efficient solution for MU in multimodal models.
Machine unlearning (MU) has gained significant attention as a means to remove specific data from trained models without requiring a full retraining process. While progress has been made in unimodal domains like text and image classification, unlearning in multimodal models remains relatively underexplored. In this work, we address the unique challenges of unlearning in CLIP, a prominent multimodal model that aligns visual and textual representations. We introduce CLIPErase, a novel approach that disentangles and selectively forgets both visual and textual associations, ensuring that unlearning does not compromise model performance.
CLIPErase consists of three key modules: a Forgetting Module that disrupts the associations in the forget set, a Retention Module that preserves performance on the retain set, and a Consistency Module that maintains consistency with the original model. Extensive experiments on the CIFAR-100 and Flickr30K datasets across four CLIP downstream tasks demonstrate that CLIPErase effectively forgets designated associations in zero-shot tasks for multimodal samples, while preserving the model's performance on the retain set after unlearning.
\end{abstract}
\section{Introduction}
In the era of rapid advancements in pre-trained large models \cite{Kim2021DiffusionCLIPTD,liu2024visual,achiam2023gpt}, ensuring these models can eliminate the influence of
%unlearn
specific data upon request has become crucial due to ethical concerns and legal requirements like the "right to be forgotten" \cite{yao2024machine, liu2024machine}.
%Machine unlearning (MU) aims to remove the influence of specific data points from a trained model~\cite{golatkar2020forgetting}.
Machine unlearning (MU) has been recently studied as a method to remove the influence of specific data points from a trained model without the need to retrain it from scratch~\cite{golatkar2020forgetting}.
While MU has made notable progress in unimodal domains such as images and text, its application in multimodal models remains relatively underexplored. Multimodal models integrate diverse data modalities such as images, text, and audio, introducing unique challenges for MU, as removing the influence of specific data requires disentangling complex relationships across different modalities.
This unique challenge makes the existing MU methods for unimodal models, such as ~\cite{yao2023large,liu2022continual,chundawat2023zero,dou2024avoiding}, insufficient or ineffective. %\textcolor{red}{Please discuss why MU methods for unimodal models cannot be applied to Multimodal models.}
%The complex interactions between modalities make machine unlearning particularly important in multimodal settings. Specifically, existing unlearning methods designed for unimodal models~\cite{yao2023large,liu2022continual,chundawat2023zero} cannot be directly applied to multimodal models, as these methods may compromise overall model performance or disrupt understanding across modalities.
Our work focuses on the unlearning problem in CLIP~\cite{Kim2021DiffusionCLIPTD}, a multimodal model pre-trained to align visual and textual concepts. CLIP
%Among multimodal models, CLIP~\cite{Kim2021DiffusionCLIPTD} is a key vision-language pre-trained model,
has been widely used in various applications and serving as the encoder for many Vision Language Models (VLMs) and Multimodal Large Language Models (MLLMs)~\cite{liu2024visual,li2021align,yuan2021florence,zhai2022lit,yang2022unified}.
Unlearning in CLIP is thus important due to increasing concerns about data privacy, security, and compliance with regulations.
%Therefore, ensuring CLIP can unlearn specific data is essential, especially when sensitive information is embedded in the model. Failure to unlearn such information effectively could result in its propagation across different applications, raising ethical and legal concerns.
However, simply applying MU techniques designed for unimodal models would fail to account for how visual and textual features influence each other in CLIP. For example, if only the image of an ``apple'' is unlearned in CLIP, the text ``apple'' would still remain associated with other visual representations, leading to inconsistencies.
Conversely, if only the text ``apple'' is unlearned, the image could still be linked to other descriptions, causing similar issues.
%For instance, imagine an image of an apple paired with a text description. After unlearning, CLIP should no longer retrieve the corresponding text when presented with the image. This is particularly challenging because models like CLIP tightly align image and text modalities. The key challenge lies in selectively disrupting this alignment for specific data without affecting the model's performance on other image-text pairs.
%A very recent approach by \citet{kravets2024zero} proposes generating synthetic images to simulate the forget set and induce unlearning. However, this method is computationally expensive, limited to zero-shot tasks, and may be hindered by the quality of the synthetic data. This highlights a critical gap in developing efficient and broadly applicable unlearning methods for CLIP.
%To address these challenges, we introduce CLIPErase, an optimization framework designed to efficiently handle large-scale multimodal datasets in dynamic training environments. Unlike prior methods, CLIPErase eliminates the need for retraining on new datasets, ensuring model performance is maintained—an essential advantage for real-world applications. Furthermore, CLIPErase is not limited to zero-shot tasks; it can also be applied to various downstream tasks, such as image retrieval and text retrieval, making it more practical for a wide range of applications.
% The core of CLIPErase lies in manipulating cross-modal similarities to adjust the model’s cross modal representation of data to be forgotten. CLIPErase includes three modules: the Forgetting Module, which modifies the cross-modal similarity matrix between text-image pairs in the forget set, reducing the model's ability to associate these pairs; the Retention Module, which ensures that performance on the retain set remains unaffected; and the Consistency Module, which penalizes deviations in distributions inferred by the unimodal components (text and image) compared to the original model. This ensures the model's overall understanding capabilities are preserved while effectively forgetting specified data.
%The core of CLIPErase lies in disrupting the learned relationships between visual and textual representations in the data to be forgotten. By deliberately misaligning image and text features from the data to be deleted, we ensure the model no longer retains cross-modal information from it, thereby complying with data deletion requests without compromising performance on the data to be retained. CLIPErase consists of
To address these challenges, we introduce \textbf{CLIPErase}, which disentangles the relationships between visual and textual representations of the concept to be forgotten through
three key components: (1) \textbf{Forgetting Module}: reduces the model's ability to associate text-image pairs in the forget set by modifying the cross-modal similarity matrix; (2) \textbf{Retention Module}: ensures the model's performance on the retain set remains unaffected; (3) \textbf{Consistency Module}: maintains consistency by penalizing deviations in the unimodal (text and image) distributions compared to the original model.
Three loss functions, derived from the three modules, are jointly minimized to perform unlearning, making CLIPErase an efficient solution that eliminates the need for re-training from scratch.
Our key contributions are as follows: \vspace{-0.2cm}
\begin{enumerate} \item We introduce CLIPErase, an innovative framework designed for unlearning pretrained CLIP models. CLIPErase efficiently removes specific multimodal data without retraining. \item CLIPErase uses three modules to disrupt multimodal data alignment for unlearning while preserving performance on the retain set. \item Our extensive experiments, including ablation studies and visualizations across multiple datasets, validate the effectiveness of CLIPErase. \end{enumerate}
\begin{figure*}[h!]
\centering
\includegraphics[width=1\textwidth]{figures/method2.jpg}
\vspace{-5mm}
\caption{The architecture of CLIPErase. Given a CLIP model and a forget set, CLIPErase has three key modules: (a) Forgetting Module (FM): disrupts cross-modal associations in the forget set to reduce memory of deleted information; (b) Retention Module (RM): preserves cross-modal associations in the retain set; (c) Consistency Module (CM): maintains the original model’s consistency by aligning unimodal representations.
}
\vspace{-3mm}
\label{fig1}
\end{figure*}
\section{Related Works}
\textbf{Machine Unlearning:} As machine learning models continue to grow in size and their training datasets become increasingly vast and complex, the concept of MU has garnered significant attention in academic and industry~\cite{mcconnon2024machineunlearning, pedregosa2023unlearningchallenge} to promoting AI for social welfare. MU aims to selectively remove specific information—such as private data~\cite{Zhang2023FedRecoveryDP}, outdated knowledge~\cite{Wang2023KGAAG}, and harmful content~\cite{Liu2024TowardsSL} from a trained model without necessitating a complete retraining from scratch~\cite{Bourtoule2019MachineU}. We will next discuss these techniques in the context of text and image modalities.
%Despite numerous methods have been done on sucessfully unlearning lingustic models, the researches over multimodal unlearning remains sparse. For MU on large vision language models, paper~\cite{Li2024SingleIU, cheng2023multidelete} respectively sophisticated designed dataset for knowledge decoupling and designed loss function over three terms. As for diffusion models, paper~\cite{zhang2024forget} and paper~\cite{gandikota2023erasing} achieve class forgetting by altering cross-attention mechanisms, disrupting connections between visual and textual representations, similar diffusion MU paper~\cite{gandikota2024unified} utilizing to modify the cross-attention key and value matrices. Several survey and benchmarking papers are also proposed for multimodal MU, like paper~\cite{liu2024machine,liu2024multimodal} and paper~\cite{cheng2024mu}. To the best of our knowledge, only one paper~\cite{kravets2024zero} tackled MU on CLIP, yet it used Lipschitz regularization for zero-shot unlearning, which is far from thorough in covering in MU CLIP scenarios, nor would it reach CLIPErase's utility and flexibility.
\noindent
\textbf{Machine Unlearning for Text:} MU has been extensively studied in the text domain. \citet{gupta2021adaptive} first explored adaptive parameter tuning, while \citet{maini2024tofu}, \citet{chen2023unlearn}, and \citet{jia2024soul} leveraged gradient-based methods, including second-order optimization and KL-Divergence descent. \citet{eldan2023s} focused on preference optimization. To address high computational costs, \citet{kurmanji2024towards} proposed scalable, approximate methods, and \citet{chen2023boundary} aimed to reduce overhead. For theoretical guarantees, \citet{ullah2021machine} employed differential privacy to enhance trust in MU.
% \textbf{Machine Unlearning for Text:} MU has been well studied in text field and large models.
% For example, \citet{gupta2021adaptive} firstly explore adaptive parameter tuning for MU. For better performance, optimization methods like \citet{maini2024tofu} and \citet{chen2023unlearn} propose to use gradient descent to facilitate the unlearning process. similarly \citet{jia2024soul} using SOUL framework for second-order optimization, \citet{yao2024machine} using KL-Divergence descent, and \citet{eldan2023s} using preference optimization.
% However, the high computational cost of these methods has driven research into more efficient alternatives. \citet{kurmanji2024towards} investigate scalable, approximate methods via MU bounds, while \citet{chen2023boundary} aim to reduce computational overhead. To ensure theoretical guarantees, \citet{ullah2021machine} employ differential privacy, improving compliance and trust in MU data removal.
%Paper \cite{liu2024model} use exact unlearning utilizing model sparsity. Paper~\cite{gupta2021adaptive} use adaptive parameter tuning for MU. Optimization MU methods have been widely utilized in LLM, like paper~\cite{maini2024tofu, chen2023unlearn} utilizing gradient descent and paper~\cite{jia2024soul, eldan2023s} with preference optimization.
%Yet the above method's significant computation cost has spurred paper~\cite{kurmanji2024towards} and paper~\cite{chen2023boundary} delving into MU bounds and make swift and scalable approximate unlearning. To given reliable theoretical guarantee, there also exist paper~\cite{ullah2021machine} using methods like differential privacy to ensure compliance in data removal.
\noindent
\textbf{Machine Unlearning for Vision:}
%While many unlearning methods have succeeded in language models, research on multimodal unlearning remains limited.
In the image domain, MU techniques are applied in two primary scenarios. One is to eliminate the influence of specific visual data in classification models. For example,
SRCUB~\cite{kurmanji2024towards} uses a teacher-student framework to forget data in image classification tasks.
The other is for diffusion models, where MU techniques focus on unlearning specific visual patterns in image generation, e.g.,
%For diffusion models,
by modifying cross-attention mechanisms~\cite{zhang2024forget,gandikota2024unified, gandikota2023erasing,fuchi2024erasing} and disrupting connections between visual and textual representations.
\citet{Li2024SingleIU} introduced a method for knowledge decoupling with datasets designed for different retention needs, while \citet{cheng2023multidelete} proposed a similar multi-deletion mechanism. %In diffusion models, unlearning is achieved by modifying cross-attention mechanisms \citep{zhang2024forget, gandikota2024unified}.
Note that although the connections between visual and textual representations may be disrupted in these studies, the focus is primarily on affecting the visual patterns rather than the text, as the task is typically centered around image generation. In contrast, our study of unlearning in CLIP aims to unlearn both visual and textual representations, ensuring that downstream tasks involving both text and image, such as retrieval, classification, and multimodal association, are fully addressed. The most relevant work to ours is a
%However, unimodal methods face challenges when applied to CLIP. A
recent approach by \citet{kravets2024zero} utilized Lipschitz regularization and synthetic images to simulate the forget set in zero-shot tasks, but it suffers from high computational cost and limitations imposed by synthetic data quality. In contrast, our proposed method eliminates the need for retraining or synthetic data generation, enabling efficient unlearning in CLIP while preserving model performance for real-world applications.
% \textbf{Machine Unlearning for Vision:} Despite numerous methods have successfully been applied to unlearning linguistic models, research on multimodal unlearning remains sparse.Yet in diffusion models, unlearning has been achieved by modifying cross-attention mechanisms \citep{zhang2024forget, gandikota2024unified, gandikota2023erasing} and by disrupting the connections between visual and textual representations.
% % For large multimodal language models, \citet{Li2024SingleIU} and \citet{cheng2023multidelete} have focused on decoupling knowledge by designing specific datasets with three terms defined for different retention requirement.
% % Yet in diffusion models, unlearning has been achieved by modifying cross-attention mechanisms~\citet{zhang2024forget,gandikota2024unified, gandikota2023erasing} and disrupting connections between visual and textual representations
% % Similarly, \citet{gandikota2024unified} modified the key and value matrices to forget specific classes. Regarding survey and benchmarking studies, \citet{liu2024machine}, \citet{liu2024multimodal}, and \citet{cheng2024mu} offer overviews of multimodal machine unlearning.
% Regarding CLIP models, only \citet{kravets2024zero} have addressed unlearning by using Lipschitz regularization for zero-shot scenarios. However, this approach does not fully address the flexibility and utility challenges, which is done by CLIPErase.
%To the best of our knowledge, only few papers tackled CLIP Unlearning. Paper~\cite{} XXX.
% Machine Unlearning in Current Research: As concerns over privacy increase, the importance of machine unlearning continues to grow. Machine unlearning focuses on developing techniques that enable models to effectively forget specific training data, aiming to ensure compliance with privacy laws such as the GDPR, which allows individuals to request the deletion of their data. This area is explored through various methods, including exact unlearning, where all influence of specified data is completely removed by recalculating model parameters or retraining certain parts of the model, and approximate unlearning, which adjusts the model to behave as if it never learned the data, though this method may leave some residual data traces.
% Despite this progress, these methods still face significant challenges, particularly in ensuring that all traces of data are irreversibly removed without affecting the model's overall performance. The stochastic nature of training algorithms and the need for incremental updates in machine learning further complicate the implementation of effective unlearning.
%\noindent
%\textbf{Multimodal Models:} Multimodal learning, particularly with CLIP has become a cornerstone in advancing how scaling law models process and integrate information from texts and images. Introduced by OpenAI, CLIP~\cite{Kim2021DiffusionCLIPTD} is trained to understand visual and textual data simultaneously, aligning them in a shared embedding space. CLIP is also widely used in Industry, leading to applications like Flamingo~\cite{alayrac2022flamingo}, DALLE~\cite{daras2022discovering} and PaLME~\cite{driess2023palm}.
%Several studies have investigated the sensitivity and fairness of CLIP, both in its usage and training, highlighting the necessity of leveraging Multilingual Understanding (MU) to ensure CLIP operates as a safe model. \citet{wang2021assessing} identify notable shortcomings in CLIP’s performance regarding multilingual group fairness by employing sophisticated propositions and diverse multilingual datasets. \citet{agarwal2021evaluating} conduct a comprehensive evaluation of CLIP’s harmful tendencies and sensitive attributes in downstream tasks. To address bias, \citet{dehdashtian2024fairerCLIP} propose a debiasing method using zero-shot learning, while \citet{poppi2024safe} explore the mitigation of NSFW content in CLIP via Direct Policy Optimization (DPO). Employing MU over CLIP can mitigate all desired content with flexibility, with superior and robust performance.
% Multimodal Learning (MM Learning) combines multiple data modalities like text and images to enhance AI's interpretative and interactive abilities. A notable advancement in this field is OpenAI’s CLIP model, which excels in bridging textual and visual information, improving tasks such as image captioning and content recommendation. Despite its strengths, challenges such as data alignment, model scalability, and mitigating biases in training data persist, potentially limiting the effectiveness of MM Learning.
\section{Preliminary}
\subsection{CLIP}
CLIP is a multimodal pre-training model developed by OpenAI with several hundred million parameters. It aligns images and their text information in a shared embedding space using an image encoder \( f_{\text{img}} \) and a text encoder \( f_{\text{txt}} \), which convert inputs into normalized feature vectors. CLIP is trained with a contrastive loss that maximizes the similarity between matching image-text pairs and minimizes it for non-matching pairs. For a batch of \( N \) image-text pairs \(\{(x_i^n, x_t^n)\}_{n=1}^N\), the loss function is:
\[
\mathcal{L} = -\frac{1}{N} \sum_{n=1}^N \log \frac{\exp\left( \frac{f_{\text{img}}(x_i^n) \cdot f_{\text{txt}}(x_t^n)}{\tau} \right)}{\sum_{k=1}^N \exp\left( \frac{f_{\text{img}}(x_i^n) \cdot f_{\text{txt}}(x_t^k)}{\tau} \right)},
\]
where \( \tau \) is a temperature parameter. This loss aims to correctly align each image with its corresponding text while distinguishing it from others.
% thereby enhancing CLIP’s ability to understand multimodal data.
\subsection{Problem Definition}
Let \( \Theta \) be a pre-trained CLIP model trained on a dataset \( D \). Upon receiving a deletion request specifying a subset of data to be removed, it is denoted as the forget set \( D_f \). %, the image and text features for \( D_f \) are extracted by passing \( D_f \) through the encoder, resulting in image features \( f_{fi} \) and text features \( f_{ft} \).
The remaining data, referred to as the retain set \( D_r = D - D_f \).
Our objective is to design an algorithm that enables the model to eliminate information related to \( D_f \) without compromising CLIP's performance on \( D_r \). We refer to this model as the unlearned model \( \Theta_u \), which is initialized with the parameters of the original model \( \Theta \).
With \( \Theta_u \), images and their corresponding text descriptions in \( D_f \) no longer align. Concequently, in downstream tasks, e.g., an image retrieval task, an input image from forget set \( D_f \) will no longer retrieve its associated text description, and vice versa. Meanwhile, it is crucial to maintain the model's performance on the retain set \( D_r \), ensuring effective text and image alignment.
\section{Proposed Method}
\vspace{-2mm}
% In this section, we present a novel machine unlearning method for pretrained CLIP models. Our approach modifies the optimization target to disrupt the alignment between images and their corresponding texts in forget set \( D_f \), meanwhile, maintaining the alignment for the retain set \( D_r \).
% In particular, in multimodal models like CLIP, unlearning a subset of classes \( D_f \) involves ensuring that images from these classes no longer retrieve their associated textual descriptions, and vice versa. At the same time, it is essential to preserve the model's performance on single-modal tasks, ensuring that feature extraction for images and texts remains effective for the retain set \( D_r \).
% To achieve this, our method targets the cross-modal representations of the forgotten data \( D_f \) within CLIP's shared embedding space. We directly optimize the representation space to separate the visual and textual features of \( D_f \) into distinct regions, thereby breaking their alignment. Concurrently, we ensure that the alignment for \( D_r \) remains unchanged, preserving the model's performance on the retained data.
In this section, we introduce CLIPErase, a novel machine unlearning method for the pre-trained CLIP. The overview of our proposed method is illustrated in Figure~\ref{fig1}, where the image encoder and text encoder after unlearning are denoted as \( f'_{\text{img}} \) and \( f'_{\text{txt}} \). The disentangled visual-textual association is illustrated by the \emph{Unlearned CLIP}.
%CLIPErase enables the removal of specific multimodal data without retraining the CLIP model. In multimodal models like CLIP, unlearning a subset of classes, known as the forget set \( D_f \), ensures that images and their corresponding text descriptions no longer align. For instance, in an image retrieval task, an input image from forget set \( D_f \) will no longer retrieve its associated text description, and vice versa. Meanwhile, it is crucial to maintain the model's performance on the retain set \( D_r \), ensuring effective text and image alignment.
\subsection{Forgetting Module}
% In pretrained multimodal models, alignment between images and text is essential for effective information fusion and cross-modal understanding. This alignment enables the model to capture rich semantic relations between images and their corresponding textual descriptions.
% To achieve forgetting, we propose a novel approach that disrupts the learned relationships between the visual and textual representations the image-text pairs in the forget set \( D_f \). By deliberately misaligning the image and text features in \( D_f \), we ensure that the model no longer understand the cross-modal information contained in \( D_f \), thereby complying with data deletion requests without compromising performance on the retain set \( D_r \).
% Our optimization objective for forgetting \( \mathcal{L}_{\text{FM}} \) is designed to minimize the similarity in-between the features of image-text pairs in the forget set. Specifically, we formulate \( \mathcal{L}_{\text{FM}} \) as:
% \[
% \mathcal{L}_{\text{FM}} = \frac{1}{N_f} \sum_{n=1}^{N_f} \left( \frac{f_{fi}(x_i^n) \cdot f_{ft}(x_t^n)}\right),
% \]
% where \( N_f \) is the number of samples in \( D_f \). By maximizing \( \mathcal{L}_{\text{FM}} \), we encourage the model to reduce the similarity between the image and text feature embeddings of the forget set, effectively disrupting their alignment.
%In pretrained multimodal models, alignment between images and text is essential for effective information fusion and cross-modal understanding. This alignment enables the model to capture rich semantic relations between images and their corresponding textual descriptions.
The pre-trained CLIP captures rich semantic relations between images and their corresponding text.
To achieve unlearning, we propose a novel approach that disrupts the learned relationships between the visual and textual representations in the forget set \( D_f \). By intentionally misaligning the image and text features in \( D_f \), we ensure that the model no longer understands the cross-modal information contained in \( D_f \), thereby complying with data deletion requests without compromising performance on the retain set \( D_r \).
Our optimization objective for forgetting, \( \mathcal{L}_{\text{FM}} \), is designed to reduce the similarity between the features of image-text pairs in the forget set. Specifically, we formulate \( \mathcal{L}_{\text{FM}} \) for minimization as:
\[
\mathcal{L}_{\text{FM}} = \frac{1}{N_f} \sum_{n=1}^{N_f} \left( f_{\text{img}}(x_i^n) \cdot f_{\text{txt}}(x_t^n) \right),
\]
where \( N_f \) is the number of samples in \( D_f \). %, \( f_{\text{img}} \) is the image encoder function that maps the image \( x_i^n \) to its feature embedding, and \( f_{\text{txt}} \) is the text encoder function that maps the text \( x_t^n \) to its feature embedding.
%By minimize \( \mathcal{L}_{\text{FM}} \), we encourage the model to reduce the similarity between the image and text feature embeddings of the forget set, effectively disrupting their alignment.
% \subsection{Retention Module}
% After disrupting the connection between the visual and textual representations of the forget set \( D_f \), there is a risk that this process may inadvertently impair the model's performance on the retain set \( D_r\). To address this, our goal is to preserve the CLIP model's original capabilities on \( D_r \), ensuring that its utility remains unaffected. The retention module is designed to maintain the model’s ability to correctly align images and texts in \( D_r \) during the unlearning process.
% Our objective is to reinforce the alignment between the image and text features in the retain set \( D_r \) without altering its cross-modal representation space. We achieve this by defining the retention objective \( \mathcal{L}_{\text{RM}} \) as:
% \[
% \mathcal{L}_{\text{RM}} = -\frac{1}{N_r} \sum_{n=1}^{N_r} \log \frac{\exp\left( \frac{f_{ri}(x_i^n) \cdot f_{rt}(x_t^n)}{\tau} \right)}{\sum_{k=1}^{N_r} \exp\left( \frac{f_{ri}(x_i^n) \cdot f_{rt}(x_t^k)}{\tau} \right)},
% \]
% where \( N_r \) is the number of samples in \( D_r \), and \( f_{ri}(x_i^n) \) and \( f_{rt}(x_t^n) \) are the image and text features extracted from the retain set as defined earlier. The temperature parameter \( \tau \) controls the softness of the distribution.
% Minimizing \( \mathcal{L}_{\text{RM}} \) encourages the model to maintain the correct alignment between images and texts in \( D_r \), thereby preserving its original performance on the retain set. This ensures that the unlearning process does not negatively affect the model's utility on data that should be retained.
\subsection{Retention Module}
After disrupting the connection between the visual and textual representations of the forget set \( D_f \), this process may inadvertently impair the model's performance on the retain set \( D_r \). This is because adjustments to the model's parameters can affect the overall cross-modal representation space, influencing the model's understanding and processing of the retain set. To address this, %the CLIP model's original capabilities on \( D_r \) should be preserved.
the retention module is designed to maintain the CLIP model’s ability to correctly align images and texts in \( D_r \) during the unlearning process, by minimizing the alignment loss:
%We strengthen the alignment between the image and text features in the retain set \( D_r \) by \( \mathcal{L}_{\text{RM}} \):
\[
\mathcal{L}_{\text{RM}} = -\frac{1}{N_r} \sum_{n=1}^{N_r} \log \frac{\exp\left( \frac{ f_{\text{img}}(x_i^n) \cdot f_{\text{txt}}(x_t^n) }{ \tau } \right)}{\sum_{k=1}^{N_r} \exp\left( \frac{ f_{\text{img}}(x_i^n) \cdot f_{\text{txt}}(x_t^k) }{ \tau } \right)},
\]
where \( N_r \) is the number of samples in \( D_r \). %, and \( f_{\text{img}}(x_i^n) \) and \( f_{\text{txt}}(x_t^n) \) are the image and text encoder functions that map the image \( x_i^n \) and text \( x_t^n \) to their feature embeddings, respectively. The temperature parameter \( \tau \) can control the trade-off between the model's generalization ability.
%By minimizing the \( \mathcal{L}_{\text{RM}} \), we encourage the model to maintain the correct alignment between images and texts in \( D_r \), thereby preserving its original performance on the retain set. This ensures that the unlearning process does not negatively affect the retain set \( D_r \), even if the cross-modal representation space may have changed.
%\hfill
% \vspace{-0.3em}
\subsection{Consistency Module}
With the different optimization objectives for the forget set \( D_f \) and the retain set \( D_r \), the CLIP model might introduce new errors or biases in its predictions on \( D_r \) during the forgetting process. To prevent unexpected changes in the model's behavior on \( D_r \), we maintain consistency between the outputs of the unlearned model \( \Theta_u \) and that of the original model \( \Theta \) on \( D_r \) %By ensuring that \( \Theta_u \) behaves similarly to \( \Theta \) on the retain set, we enhance the model's stability and reduce the likelihood of introducing errors or biases.
by introducing a consistency restriction \( \mathcal{L}_{\text{CM}} \), defined as the Kullback-Leibler (KL) divergence between the output distributions of \( \Theta_u \) and \( \Theta \) on \( D_r \):
% \[
% \mathcal{L}_{\text{CM}} = \frac{1}{N_r} \sum_{n=1}^{N_r} \left[ \text{KL}\left( \mathbf{p}_o^{\text{img}}(n) \parallel \mathbf{p}_u^{\text{img}}(n) \right) + \text{KL}\left( \mathbf{p}_o^{\text{txt}}(n) \parallel \mathbf{p}_u^{\text{txt}}(n) \right) \right],
% \]
\begin{align*}
\mathcal{L}_{\text{CM}} &= \frac{1}{N_r} \sum_{n=1}^{N_r} \Big[ \text{KL}\left( \mathbf{p}_o^{\text{img}} \parallel \mathbf{p}_u^{\text{img}} \right) \notag \\
&\quad + \text{KL}\left( \mathbf{p}_o^{\text{txt}}\parallel \mathbf{p}_u^{\text{txt}}\right) \Big],
\end{align*}
where \( \mathbf{p}_o^{\text{img}} \) and \( \mathbf{p}_u^{\text{img}} \) are the distributions of one image embedding, obtained from the image encoder of the original model \( \Theta \) and the unlearned model \( \Theta_u \), respectively. Similarly, \( \mathbf{p}_o^{\text{txt}} \) and \( \mathbf{p}_u^{\text{txt}} \) are the distributions of one text embedding, obtained from the text encoder of the original model \( \Theta \) and the unlearned model \( \Theta_u \). These distributions are computed by applying softmax directly to the image and text embeddings.
% where the "image embedding distribution" reflects the similarity between an image and text \( x_t^n \), and vice versa for the "text embedding distribution."
% where %\( N_r \) is the number of samples in \( D_r \);
% \( \mathbf{p}_o^{\text{img}}\) and \( \mathbf{p}_u^{\text{img}} \) are the probability distributions over image embeddings, produced by the original model \( \Theta \) and the unlearned model \( \Theta_u \), respectively; \( \mathbf{p}_o^{\text{txt}} \) and \( \mathbf{p}_u^{\text{txt}} \) are the distributions over image embeddings for text \( x_t^n \) in \( D_r \). These distributions are obtained by applying the softmax function to the similarities between the image and text embeddings in \( D_r \).
% Similar definitions apply for \( \mathbf{p}_o^{\text{txt}}(n) \) and \( \mathbf{p}_u^{\text{txt}}(n) \) using \( f_{rt} \) and \( f_{ri} \).
At last, the overall unlearning loss is:
\[
\mathcal{L} = \lambda_1\mathcal{L}_{\text{RM}} + \lambda_2 \mathcal{L}_{\text{FM}} + \lambda_3 \mathcal{L}_{\text{CM}},
\]
where \( \lambda_1 \), \( \lambda_2 \), and \( \lambda_3 \) are hyperparameters.
% \textcolor{red}{Need some discussion here about how the minimization of this loss affects which part of the model. text, image encoder? alignment attention? what else?}
Minimizing \( \mathcal{L}_{\text{FM}} \) primarily affects the image and text encoders by reducing the similarity between image-text pairs in \( D_f \), disrupting their alignment and ensuring the model forgets the cross-model associations. At the same time, minimizing \( \mathcal{L}_{\text{RM}} \) preserves the alignment attention for \( D_r \), ensuring that the model maintains its performance on \( D_r \). Finally, minimizing \( \mathcal{L}_{\text{CM}} \) ensures consistency between the outputs of the unlearned model \( \Theta_u \) and the original model \( \Theta \) on \( D_r \), preventing the introduction of new errors or biases in the retain set during the unlearning process.
\section{Experiment}
\subsection{Experiments Setting}
Table \ref{setting} summarizes our experimental settings, including tasks, datasets, and evaluation metrics.
\begin{table}[t]
\centering
\renewcommand{\arraystretch}{1.2}
\small
\begin{tabular}{c|c|c}
\hline
\textbf{Task} & \textbf{Dataset} & \textbf{Evaluation} \\ \hline
Zero-shot Prediction & CIFAR-100 & Acc of $D_f$$\downarrow$, $D_r$$\uparrow$ \\
Zero-shot Retrieval & CIFAR-100 & Acc of $D_f$$\downarrow$, $D_r$$\uparrow$ \\
Image Retrieval & Flickr30k & Recall of $D_f$$\downarrow$, $D_r$$\uparrow$ \\
Text Retrieval & Flickr30k & Recall of $D_f$$\downarrow$, $D_r$$\uparrow$ \\
\hline
\end{tabular}
\caption{Experiment Settings}
\label{setting}
\end{table}
% Image Retrieval & Flickr30k & Recall (R@1, 5, 10) $\uparrow$ \\
% Text Retrieval & Flickr30k & Recall (R@1, 5, 10)
\noindent
\textbf{Tasks:} To evaluate the effectiveness of our method, we conducted experiments on four tasks:
% \vspace{-0.2cm}
% \begin{enumerate} \item Zero-shot Prediction: CLIP is employed to classify images based on a given category label (e.g., "cat," "dog") without training data. The unlearned CLIP is expected to predict a mismatch between the label ``dog'' and the image of a dog if it belongs to $D_f$.
% \item Zero-shot Image Retrieval: CLIP is used to retrieve images matching a text description (e.g., "red car") without task-specific training.
% \item Image Retrieval (IR): Given a text query, CLIP retrieves the top-$k$ relevant images.
% \item Text Retrieval (TR): Given an image query, CLIP retrieves the top-$k$ relevant text descriptions.
% \end{enumerate}
% \vspace{-0.2cm}
\noindent
\textit{\underline{1. Zero-shot Prediction:}} CLIP is employed to classify images based on a given category label (e.g., "cat," "dog") without training data. The unlearned CLIP is expected to predict a mismatch between the label ``dog'' and the image of a dog if it belongs to the forget set ($D_f$), demonstrating its ability to "forget" specific learned associations.
\noindent
\textit{\underline{2. Zero-shot Image Retrieval:}} CLIP is used to retrieve images matching a text description (e.g., "red car") without task-specific training. In the unlearning scenario, the unlearned CLIP should fail to retrieve images that belong to the forget set, such as cars described as "red car" if they are part of $D_f$, demonstrating its ability to forget these specific multimodal associations without further training.
% In the unlearning scenario, CLIP should fail to retrieve images that belong to the forget set, such as cars described as "red car" if they are part of $D_f$.
\noindent
\textit{\underline{3. Image Retrieval (IR):}} Given a text query, CLIP retrieves the top-$k$ relevant images. The unlearned CLIP should avoid retrieving images in the forget set, demonstrating the selective forgetting capability while maintaining performance on the retain set.
\noindent
\textit{\underline{4. Text Retrieval (TR):}} Given an image query, CLIP retrieves the top-$k$ relevant text descriptions. In the unlearning context, CLIP should fail to retrieve relevant text descriptions for images in the forget set.
% The zero-shot prediction task evaluates CLIP's ability to generalize to unseen categories without fine-tuning, while the retrieval tasks assess its capacity to link information across modalities. These tasks provide a comprehensive evaluation of our method's performance and robustness in real-world applications.
% \textcolor{red}{then how this is relevant to unlearning? "comprehensive evaluation of our method's performance" how? "generalize to unseen categories"? unseen in pre-training and unseen in forget set? }
% (1) Zero-shot Prediction: Given a category label (e.g., "cat," "dog"), CLIP classifies images by matching them to the label without any training data.
% (2) Zero-shot Image Retrieval: Given a text category (e.g., "red car"), CLIP retrieves images by encoding and comparing text and image embeddings, without the need for explicit training for the task. (3) Image Retrieval (IR): Given a text query, CLIP retrieves the top-$k$ most relevant images by comparing the encoded text with image embeddings. (4) Text Retrieval (TR): Given an image query, CLIP retrieves the top-$k$ most relevant text descriptions by comparing the encoded image with text embeddings.
% The zero-shot prediction task measures CLIP's generalization ability to new, unseen categories without fine-tuning. The retrieval tasks assess its capacity to understand and link information across different modalities, evaluating real-world applications such as classification and multimodal information retrieval. These tasks provide a comprehensive evaluation of the performance and robustness of our method in practical scenarios.
\noindent
\textbf{Datasets:} For the zero-shot prediction and retrieval tasks, we use the CIFAR-100 dataset~\cite{krizhevsky2009learning}. CIFAR-100 is an image classification dataset containing 100 categories. It consists of a total of 60,000 images, with 50,000 used for training and 10,000 for testing. For the Image Retrieval (IR) and Text Retrieval (TR) tasks, we use the Flickr30K dataset~\cite{bojchevski2017deep}. The dataset contains 31,783 images, each paired with five natural language captions. These images primarily depict daily life scenes.
\noindent
\textbf{Settings:} For CIFAR-100, we randomly select one class as the forget set. The model is trained for 50 epochs with a batch size of 32, using Adam and an initial learning rate of $1 \times 10^{-6}$. The loss weights are set to $\lambda_1 = \lambda_2 = \lambda_3 = 1$.
For Flickr30k, the forget set includes all image-text pairs containing "car," comprising 1\% of the dataset. The same setup is used, except with an initial learning rate of $1 \times 10^{-8}$.
Each experiment use the best checkpoint from the validation set. Our model and code are implemented in PyTorch, with training and evaluation on an NVIDIA Tesla V100-SXM2.
\noindent
\textbf{Evaluation:} Following prior work~\cite{Kim2021DiffusionCLIPTD}, we use two metrics to assess MU efficacy: (1) Retain Set Performance ($D_r$ $\uparrow$): Measures accuracy for zero-shot tasks and recall@1, @5, @10 for retrieval. Higher values indicate minimal impact on the retain set after unlearning. (2) Forget Set Performance ($D_f$ $\downarrow$): Uses the same metrics as $D_r$. Lower values indicate more effective unlearning.
% \subsection{Comparison to Prior Work}
% \label{Comparison to Prior Work}
% In this study, we propose CLIPrase, a novel multimodal machine unlearning framework. We extend experiments with several unlearning algorithms to demonstrate its effectiveness. The baseline methods include:
% (1) Gradient Ascent~\cite{yao2023large}: The main goal is to make the model perform poorly on the forgetting data by increasing the prediction errors on these data, forcing the model away from its original predictions.
% (2) Gradient Difference~\cite{liu2022continual}: While increasing the errors on the forgetting data, this method maintains the model's performance on the retaining data, achieving the purpose of "forgetting" part of the information without affecting the retained information.
% (3) KL Minimization~\cite{maini2024tofu}: By comparing the prediction distributions of the new and old models on the retaining data, this method ensures consistency in predictions on the retaining data while increasing the errors on the forgetting data.
% (4) Original CLIP Model ~\cite{Kim2021DiffusionCLIPTD}: We aim for the unlearned model to maintain its performance on the retain set; therefore, we compare its results with the original CLIP model to evaluate any changes.
\subsection{Comparison to Prior Work}
\label{Comparison to Prior Work}
%In this study, we propose CLIPErase, a novel multimodal machine unlearning framework. To demonstrate its effectiveness, we compare it against several state-of-the-art machine unlearning algorithms.
%The prior work~\cite{kravets2024zero} did not release their code or detailed experimental settings, making it difficult to fully replicate their results, particularly without access to their synthetic image generation code. Additionally, our approach adopts an entirely different strategy. To ensure a fair comparison, we applied several advanced unimodal unlearning strategies in the CLIP multimodal setting as our baselines.
%The baseline methods we used for comparison include the following unimodal unlearning strategies and the original CLIP model:
Besides the original CLIP model, we compare our method CLIPErase with commonly known unimodal MU methods when directly applied to CLIP. We omit using prior work~\cite{kravets2024zero} as a baseline because their code and detailed experimental settings were not released, making it challenging to replicate their results. Especially without access to their synthetic image generation code, it is unable to conduct CLIP unlearning in their setting.
\noindent
\textit{\underline{Original CLIP Model}}~\cite{Kim2021DiffusionCLIPTD}: We use the original CLIP model as a baseline to assess the impact of unlearning, ensuring that the model’s performance on the retain set remains unaffected.
\noindent
\textit{\underline{Gradient Ascent (GA)}}~\cite{yao2023large}: This method aims to degrade the model's performance on the forget set by increasing prediction errors, forcing the model behave away from its original predictions.
\noindent
\textit{\underline{Gradient Difference (GradDiff)}}~\cite{liu2022continual}: This method increases errors on the forgetting data while preserving performance on the retain set, achieving the goal of unlearning specific information without impacting retained data.
\noindent
\textit{\underline{KL Minimization (KL)}}~\cite{maini2024tofu}: The method ensures consistency on the retain set by comparing the prediction distributions of the unlearned and original models, while increasing errors on the forgetting data.
\noindent
\textit{\underline{Error Minimization-Maximization Noise (EMMN)}} \cite{chundawat2023zero}: It deletes specific class information from the model using noise-based error minimization and maximization techniques.
\begin{table}[t]
\renewcommand{\arraystretch}{0.8}
\scalebox{0.8}{
\begin{tabular}{c|cc|cc}
\toprule
\multirow{2}{*}{Method} & \multicolumn{2}{c|}{Zero-shot Prediction} & \multicolumn{2}{c}{Zero-shot Retrieval} \\
\cmidrule(lr){2-3} \cmidrule(lr){4-5}
& Acc.$D_f$ $\downarrow$ & Acc.$D_r$ $\uparrow$ & Acc.$D_f$ $\downarrow$ & Acc.$D_r$ $\uparrow$ \\
\midrule
CLIP & 86.08 & 72.85 & 88.61 & 73.43 \\
CLIP+GA & 11.81 & 66.26 & 5.35 & 67.31 \\
CLIP+GradDiff & 7.31 & 70.94 & 9.89 & 71.79 \\
CLIP+KL & 2.19 & 61.75 & 5.74 & 65.87 \\
CLIP+ENMN & 0.00 & 12.46 & 0.00 & 17.94 \\
\midrule
\rowcolor{lightgray} CLIPErase & 0.00 & 89.41 & 0.00 & 91.38 \\
\bottomrule
\end{tabular}
}
\caption{Comparison on CIFAR100 dataset for Zero-shot Prediction and Zero-shot Image Retrieval.}
\label{cmp}
\end{table}
% \begin{table}[t]
% % \begin{center}
% \renewcommand{\arraystretch}{0.8}
% \scalebox{0.8}{
% \begin{tabular}{c|cc|cc}
% \toprule
% \multirow{2}{*}{Method} & \multicolumn{2}{c|}{Zero-shot Prediction} & \multicolumn{2}{c}{Zero-shot Retrieval
% } \\
% \cmidrule(lr){2-3} \cmidrule(lr){4-5}
% & Acc.D_f $\downarrow$ & Acc.D_r $\uparrow$ & Acc.D_f $\downarrow$ & Acc.D_r $\uparrow$ \\
% \midrule
% CLIP & 86.08 & 72.85 & 88.61 & 73.43 \\
% CLIP+GA & 11.81 & 66.26 & 5.35 & 67.31 \\
% CLIP+GradDiff & 7.31 & 70.94 & 9.89 & 71.79 \\
% CLIP+KL & 2.19 & 61.75 & 5.74 & 65.87 \\
% CLIP+ENMN & 0.00 & 12.46 & 0.00 & 17.94 \\
% \midrule
% \rowcolor{lightgray}
% CLIPErase & 0.00& 89.41 & 0.00 & 91.38 \\
% \bottomrule
% \end{tabular}
% }
% \caption{Comparison on CIFAR100 dataset for Zero-shot Prediction and Zero-shot Image Retrieval.}
% % The top-2 results are highlighted.
% \label{cmp}
% % \end{center}
% \end{table}
\begin{table*}[ht]
\centering % 使用 \centering 代替 \begin{center}
\renewcommand{\arraystretch}{1} % 调整行间距
\scalebox{0.85}{
\begin{tabular}{c|cc|cc|cc|cc|cc|cc}
\toprule
\multirow{3}{*}{Method} & \multicolumn{6}{c|}{Image Retrieval} & \multicolumn{6}{c}{Text Retrieval} \\
\cmidrule(lr){2-7} \cmidrule(lr){8-13}
& \multicolumn{2}{c|}{R@1} & \multicolumn{2}{c|}{R@5} & \multicolumn{2}{c|}{R@10} & \multicolumn{2}{c|}{R@1} & \multicolumn{2}{c|}{R@5} & \multicolumn{2}{c}{R@10} \\
\cmidrule(lr){2-3} \cmidrule(lr){4-5} \cmidrule(lr){6-7} \cmidrule(lr){8-9} \cmidrule(lr){10-11} \cmidrule(lr){12-13}
& $D_f$ $\downarrow$ & $D_r$ $\uparrow$ & $D_f$ & $D_r$ $\uparrow$ & $D_f$ $\downarrow$ & $D_r$ $\uparrow$ & $D_f$ $\downarrow$ & $D_r$ $\uparrow$ & $D_f$ $\downarrow$ & $D_r$ $\uparrow$ & $D_f$ $\downarrow$ & $D_r$ $\uparrow$ \\
\midrule
CLIP & 28.61 & 22.76 & 56.75 & 50.14 & 66.73 & 60.67 & 25.04 & 19.11 & 58.87 & 48.82 & 68.33 & 59.17 \\
CLIP+GA & 19.40 & 17.10 & 41.99 & 37.76 & 51.37 & 47.46 & 14.67 & 12.59 & 37.87 & 34.53 & 47.16 & 44.25 \\
CLIP+GradDiff & 15.95 & 19.77 & 32.10 & 46.03 & 40.91 & 57.02 & 15.95 & 18.75 & 40.51 & 47.01 & 49.95 & 55.25 \\
CLIP+KL & 16.84 & 18.06 & 29.63 & 40.62 & 38.28 & 51.90 & 16.99 & 17.83 & 30.55 & 45.21 & 38.64 & 52.13 \\
\midrule
\rowcolor{lightgray} CLIPErase & 10.40 & 21.41 & 19.91 & 48.47 & 23.80 & 58.18 & 11.94 & 20.22 & 20.46 & 47.12 & 24.79 & 58.96 \\
\bottomrule
\end{tabular}
}
\caption{Comparison on Flickr30K dataset for Image Retrieval and Text Retrieval.}
\label{cmp2}
\vspace{-5mm}
\end{table*}
\subsection{Experiments on Cifar100 Dataset}
% To demonstrate the effectiveness of CLIPErase, our method achieves precise deletion based on multimodal information without for retraining. In Table~\ref{cmp}, we compare the proposed CLIPErase with prior state-of-the-art methods and oringibal CLIP model on zero-shot prediction and retrievle tasks. CLIPErase not only retains the robust performance of the CLIP model in these tasks but also ensures superior performance in zero-shot prediction and retrieval tasks after accurately deleting specific information.
% Specifically, CLIPErase performs exceptionally well in zero-shot prediction and retrievle tasks, particularly achieving a 0\% accuracy rate in the Forget Set. This ensures that the data intended for deletion is precisely removed without any remnants. If a user initiates a deletion request to remove personal information, CLIPErase can completely delete the user's personal data, thereby effectively protecting user privacy. In contrast, methods such as CLIP+GA, CLIP+GF, and CLIP+KL failed to achieve ideal deletion results on forget Set, leaving some data residual. This is because the Forgetting Module alters the mapping of the Forget Set in the joint-modal latent space.
% Furthermore, CLIPErase significantly outperforms methods like CLIP+GA and CLIP+GF in retention performance on the Retain Set, with performance improvements over CLIP by $\uparrow$ 16.56\% and $\uparrow$ 17.9\%. This is because our Retention Module and Consistency Module preserve and enhance CLIP's performance on the Retain Set. We have made substantial improvements in this area.
As shown in Table \ref{cmp}, we compare the effectiveness of CLIPErase with several baseline methods and the original CLIP model on zero-shot prediction and retrieval tasks on CIFAR-100 dataset. CLIPErase not only preserves the robust performance of CLIP in these tasks but also achieves superior results after accurately deleting specific information. On the Forget Set, CLIPErase achieves \textbf{0\%} accuracy in both tasks, confirming full unlearning. While methods like CLIP+GA~\cite{yao2023large}, CLIP+GradDiff~\cite{liu2022continual}, and CLIP+KL~\cite{maini2024tofu} leave residual accuracy, CLIP+ENMN~\cite{chundawat2023zero} also achieves 0\% accuracy but at the expense of drastically reduced retention performance, dropping to 12.46\% in prediction and 17.94\% in retrieval.
In contrast, CLIPErase excels on the Retain Set, achieving \textbf{89.41\%} in prediction and \textbf{91.38\%} in retrieval, representing a \textbf{16.56\%} and \textbf{17.95\%} improvement over the original CLIP model. This is due to CLIPErase's Retention and Consistency Modules, which not only prevent the model from forgetting retained data but also improve its alignment of visual and textual features, thus enhancing overall performance on the Retain Set. The improved performance on $D_r$ suggests that the forgetting process in CLIPErase leads to a more focused representation of retain set, thereby optimizing the model's zero shot capabilities.
% Specifically, CLIPErase excels in zero-shot prediction and retrieval, achieving a 0\% accuracy rate on the Forget Set. This confirms that the data targeted for deletion is completely removed without any residuals. In scenarios such as removing personal information, CLIPErase ensures total deletion, effectively safeguarding user privacy. In contrast, methods like CLIP+GA, CLIP+GradDiff, and CLIP+KL leave residual data in the Forget Set, indicating incomplete deletion. This is because CLIPErase’s Forgetting Module alters the mapping of the Forget Set in the joint-modal latent space more effectively.
% Furthermore, CLIPErase significantly outperforms methods like CLIP+GA and CLIP+GradDiff in retention performance on the Retain Set, with improvements of \textbf{16.56\%} and \textbf{17.9\%} over CLIP in zero-shot prediction and retrieval, respectively. This is due to the Retention and Consistency Modules, which help preserve and enhance CLIP's performance on the retained data. These substantial improvements further validate the effectiveness of our approach.
\subsection{Experiments on Flicker30K Dataset}
As shown in Table \ref{cmp2}, we compare the effectiveness of CLIPErase with several baseline methods and the original CLIP model on Image Retrieval and Text Retrieval tasks on Flickr30K dataset. CLIPErase delivers strong performance in both image and text retrieval tasks at multimodal MU, surpassing prior methods. In image retrieval, CLIPErase significantly outperforms CLIP+GA, CLIP+GradDiff~\cite{liu2022continual}, and CLIP+KL)~\cite{maini2024tofu}, with notable gains in \textbf{R@1 (64.64\%)}, \textbf{R@5 (48.4\%)}, and \textbf{R@10 (58.18\%)}. Similarly, it shows superior results in text retrieval, with a \textbf{6.56\%} improvement in R@10 over CLIP+KL.
These results highlight the effectiveness of CLIPErase’s Forgetting, Retention, and Consistency Modules. The Forgetting Module successfully reduces model reliance on forgotten data, while the Retention and Consistency Modules preserve performance on the retain set, ensuring robust multimodal unlearning without retraining.
\subsection{Ablation Studies}
As shown in Table \ref{ablation}, we performed ablation studies on the CIFAR-100 dataset to quantitatively evaluate the impact of the Forgetting Module (FM), Retention Module (RM), and Consistency Module (CM) on the zero-shot prediction task.
\begin{table}[ht]
\centering
\footnotesize
\renewcommand{\arraystretch}{1}
\scalebox{0.87}{
\begin{tabular}{ccc|cc|cc}
\toprule
\multirow{2}{*}{FM} & \multirow{2}{*}{RM} & \multirow{2}{*}{CM} & \multicolumn{2}{c|}{Accuracy (\%)} & \multicolumn{2}{c}{Improvement (\%)} \\
\cmidrule(lr){4-5} \cmidrule(lr){6-7}
& & & $\downarrow D_f$ & $\uparrow D_r$ & $\downarrow D_f$ & $\uparrow D_r$ \\
\midrule
\xmark & \xmark & \xmark & 86.08 & 72.85 & - & - \\
\cmark & \xmark & \xmark & 18.57 & 64.12 & $\downarrow 67.5$ & $\downarrow 8.73$ \\
\cmark & \cmark & \xmark & 9.40 & 73.14 & $\downarrow 76.68$ & $\uparrow 0.56$ \\
\cmark & \cmark & \cmark & 0 & 89.41 & $\downarrow 86.08$ & $\uparrow 16.56$ \\
\bottomrule
\end{tabular}
}
\caption{Ablation studies on the Forgetting Module (FM), Retention Module (RM), and Consistency Module (CM).}
\label{ablation}
\end{table}
\begin{figure*}[t]
\centering
\includegraphics[width=1\textwidth]{figures/fig23.jpg}
\vspace{-5mm}
\caption{
Performance on varying percentages of forget classes. The x-axis shows the percentage of forget classes, and the y-axis shows forget accuracy (left) and retain accuracy (right).}
\label{case study}
\end{figure*}
\noindent
\textbf{Effectiveness of FM:} Activating the Forgetting Module led to a significant drop in accuracy on the forget set, from 86.08\% to 18.57\%, indicating that FM effectively disrupted the correspondence between images and texts in the forget set. However, relying solely on FM negatively impacted the retain set performance, reducing its accuracy from 72.85\% to 64.12\%.
\noindent
\textbf{Effectiveness of RM:} When both the Forgetting Module and Retention Module were activated, the accuracy on the retain set recovered to 73.14\%, demonstrating that RM successfully protected the retain set's performance. Simultaneously, the model’s accuracy on the forget set further decreased to 9.40\%, showing that RM plays a critical role in balancing the task of forgetting specific data while preserving the retain set performance.
\noindent
\textbf{Effectiveness of CM:} When the Consistency Module (CM) was activated alongside FM and RM, the retain set accuracy significantly improved to 89.41\%, while the accuracy on the forget set dropped to 0\%. This indicates that the model successfully forgot the specified data while maintaining high performance on the retain set. Consistency Module ensures consistency throughout the unlearning process, preventing potential errors or biases introduced by the forgetting process.
\subsection{Robustness and Utility for Our Method}
Figure~\ref{case study} shows experiments with CLIPErase, GradDiff, GA, and the original CLIP across various proportions of forget classes (0\%, 3\%, 10\%, 20\%, 30\%) on the CIFAR-100 dataset for the zero-shot prediction task. The left plot shows the forget accuracy, where CLIPErase demonstrates a significant unlearning effect at different proportions of forget classes. However, for GradDiff and GA, forget accuracy increases as the number of forget classes grows, indicating a worsening unlearning effect. The right plot presents the retain accuracy, where CLIPErase maintains performance comparable to CLIP, particularly at lower proportions, while GA shows a sharp decline in retain accuracy as the forget proportion increases. Overall, CLIPErase exhibits strong robustness and utility, effectively balancing both forget accuracy and retain accuracy.
% \begin{table*}[h]
% \begin{center}
% \renewcommand{\arraystretch}{1} % 调整行间距
% \scalebox{0.8}{
% \begin{tabular}{c|cc|cc|cc|cc|cc|cc}
% \toprule
% \multirow{3}{*}{Method} & \multicolumn{6}{c|}{Image Retrieval} & \multicolumn{6}{c}{Text Retrieval} \\
% \cmidrule(lr){2-7} \cmidrule(lr){8-13}
% & \multicolumn{2}{c|}{R@1} & \multicolumn{2}{c|}{R@5} & \multicolumn{2}{c|}{R@10} & \multicolumn{2}{c|}{R@1} & \multicolumn{2}{c|}{R@5} & \multicolumn{2}{c}{R@10} \\
% \cmidrule(lr){2-3} \cmidrule(lr){4-5} \cmidrule(lr){6-7} \cmidrule(lr){8-9} \cmidrule(lr){10-11} \cmidrule(lr){12-13}
% & D_f $\downarrow$ & D_r $\uparrow$ & D_f & D_r $\uparrow$ & D_f $\downarrow$ & D_r $\uparrow$ & D_f $\downarrow$ & D_r $\uparrow$ & D_f $\downarrow$ & D_r $\uparrow$ & D_f $\downarrow$ & D_r $\uparrow$ \\
% \midrule
% CLIP & 28.61 & 22.76 & 56.75 & 50.14 & 66.73 & 60.67 & 25.04 & 19.11 & 58.87 & 48.82 & 68.33 & 59.17\\
% CLIP+GA & 19.40 & 17.10 & 41.99 & 37.76 & 51.37 & 47.46 & 14.67 & 12.59 & 37.87 & 34.53 & 47.16 & 44.25\\
% CLIP+GradDiff & 15.95 & 19.77 & 32.10 & 46.03 & 40.91 & 57.02 & 15.95 & 18.75 & 40.51 & 47.01 & 49.95 & 55.25\\
% CLIP+KL & 16.84 & 18.06 & 29.63 & 40.62 & 38.28 & 51.90 & 16.99 & 17.83 & 30.55 & 45.21 & 38.64 & 52.13\\
% \midrule
% CLIPErase & 10.40 & 21.41 & 19.91 & 48.47 & 23.80 & 58.18 & 11.94 & 20.22 & 20.46 & 47.12 & 24.79 & 58.96\\
% \bottomrule
% \end{tabular}
% }
% \caption{Different methods on Flickr30K dataset. The top-2 results are highlighted.}
% \label{cmp}
% \end{center}
% \end{table*}
\begin{figure}[t]
\centering
%\hspace*{0.6cm}
\includegraphics[width=0.45\textwidth]{figures/vis.jpg}
% \vspace{-5mm}
\caption{Attention heatmap visualization of CLIP (before unlearning) and CLIPErase (after unlearning) from the original apple images. In the CLIP heatmaps, the attention is highly concentrated on the objects, whereas in the CLIPErase heatmaps, the attention becomes more random and dispersed.
}
\vspace{-3mm}
\label{heatmap}
\end{figure}
% \hfill
% \vspace{-0.6mm}
\section{Visualization}
\noindent
\textbf{Attention Visualization:} In Fig.~\ref{heatmap}, %We selected the "apple" class from the CIFAR-100 dataset as the forget set to be unlearned. To enhance the interpretability of our CLIP unlearning method,
we visualized the attention heatmaps of the ``forget set'' before and after the unlearning process. Using ``apple'' from CIFAR-100 as an example, we presented the original images, the heatmaps generated by the CLIP model, and the heatmaps after unlearning with CLIPErase. In the CLIP heatmaps, attention is highly focused on the object, displaying strong visual-semantic alignment. This indicates that CLIP successfully establishes a robust connection between textual and visual semantics. In contrast, after machine unlearning with CLIPErase, the heatmaps show that attention becomes more random and dispersed across each patch, no longer concentrated on the relevant object. This suggests that CLIPErase effectively disrupts the alignment between text and visual semantics for the data to be unlearned, thus achieving the intended unlearning objective.
\begin{figure*}[h!]
\centering
\includegraphics[width=1\textwidth, height=0.25\textheight]{figures/tsne.png}
% \vspace{-5mm}
\caption{t-SNE visualizations of text and visual embeddings from the CLIP model (before unlearning, left) and the CLIPErase model (after unlearning, right) on CIFAR-100. The unlearned category is "apple." We use $\circ$ and $\triangle$ to represent visual and text modalities, respectively, with different colors indicating different categories. In the CLIPErase results, the embeddings for the "apple" category have become more distant between the text and visual modalities, while the embeddings for other categories remain compact within their respective classes.
}
\vspace{-3mm}
\label{tsne}
\end{figure*}
\noindent
\textbf{Embedding Visualization:} To further investigate the impact of CLIPErase on the retain set within the cross-modal shared representation space, we conducted t-SNE visualizations \cite{van2008visualizing} of the textual and visual embeddings from both the original CLIP model and the CLIPErase model. Specifically, we selected 10 classes from the CIFAR-100 dataset, with the "apple" class serving as the forget set and the remaining classes as the retain set. %We used $\circ$ and $\triangle$ to represent the visual and text modalities, respectively, with different colors indicating different classes.
From the CLIPErase results, we observed that the distance between the textual and visual embeddings of the "apple" class significantly increased, while the embeddings of the other classes remained tightly clustered within their respective categories. This suggests that CLIPErase effectively weakens the association between the textual and visual modalities in the forget set, with minimal impact on the modality associations of the retain set. In summary, CLIPErase can effectively decouple the connection between the textual and visual embeddings of the forget set without affecting the visual-textual associations of the retain set, thus achieving the intended goal of machine unlearning.
\section{Discussion and Future Works}
% The proposed CLIPErase method has significant practical applications, especially in addressing ethical and legal concerns related to harmful information and biases in multimodal datasets. For example, datasets containing racial or gender discrimination, or offensive combinations of text and images, can perpetuate harmful biases. In tasks such as Online-Antisemitism-Detection, individual components like text or images may seem harmless when viewed independently, but their combination could convey damaging messages, as illustrated in Figure X. CLIPErase effectively decouples these associations, "forgetting" the harmful links between text and images, thus mitigating the risk of reinforcing biases.
% Our approach also holds potential in protecting user privacy. When a user requests the deletion of specific personal data, CLIPErase ensures that any associations between their personal information and multimodal content are effectively removed. This makes CLIPErase a valuable tool for content moderation and privacy protection in a variety of real-world applications.
The proposed CLIPErase method has significant potential in practical applications, especially in addressing ethical and legal concerns related to harmful information and biases in multimodal datasets. In tasks like online antisemitism detection, individual components such as text or images may appear harmless on their own, but when combined, they can convey harmful messages. For example, in an image where the text "Even grandma can see what’s going on" seems innocuous at first glance, when paired with an antisemitic image and stereotypical messaging, it transmits damaging, implicit bias. Such hidden biases are especially dangerous in multimodal data. CLIPErase caneffectively decouple these associations, to forget the harmful links between text and images, thereby mitigating the risk of perpetuating bias.
Additionally, CLIPErase holds great potential in safeguarding user privacy. When users request the deletion of specific personal data, CLIPErase can remove any associations between their personal information and multimodal content. %The proposed CLIPErase has significant real-world applications.
% \vspace{-2mm}
% \noindent
% \textbf{Future Opportunity:}
In the future, although our current implementation is focused on the CLIP model, the framework can be extended to any modality or multimodal pretrained model, not just CLIP. This broader applicability would enable flexible unlearning across a wide range of systems, making the approach more versatile. Additionally, we aim to apply CLIPErase to Generative AI systems, such as Multimodal Large Language Models (MLLMs), %and diffusion models,
where CLIP-based encoders are widely used. By unlearning at the encoder level, CLIPErase can help address the growing challenges in Generative AI, including the generation of private, malicious, or illegal content, the continuation of biases, and even the risk of weaponizing these models. Our approach can serve as a safeguard, correcting problematic associations and enhancing user privacy, thus providing a safer and more ethical experience in the future of AI development.
\section{Conclusion}
In this paper, we present CLIPErase, a machine unlearning framework for multimodal contrastive pre-training that removes specific data while preserving performance on retained data. It integrates the Forgetting Module, Retention Module, and Consistency Module to disrupt cross-modal relationships for targeted data while maintaining retention. Extensive experiments on zero-shot prediction and retrieval tasks with CIFAR-100 and Flickr30K validate its effectiveness in unlearning and performance retention, offering practical applications for privacy preservation and data management.
\section{Limitation}
While CLIPErase achieves good unlearning performance on multimodal tasks, it may face challenges when the forgetting and retain sets share highly similar features (e.g., fine-grained categories). In such cases, disrupting cross-modal associations without affecting closely related retain set becomes more complex. In the future, we plan to introduce strategies that target specific feature subspaces or by implementing adaptive unlearning techniques that dynamically adjust the unlearning process based on the similarity between the forget and retain sets.
% Additionally, incorporating advanced contrastive learning methods could help the model better differentiate subtle variations in data, enabling more precise unlearning without compromising retain set.
% Observation: We observed that the size of the forget set significantly affects the unlearning performance of CLIPErase. As shown in Table x, we conducted experiments using CLIPErase (with unlearning) with different proportions and categories of the forget set (1\%, 3\%, 10\%, 20\%, 30\%) and compared the results with the original CLIP model without unlearning. The horizontal axis represents the proportion of the forget set, and the vertical axis represents accuracy.
% As the number and categories of data to be deleted increase, both the unlearning effect of CLIPErase on the forget set and the zero-shot prediction performance on the retain set exhibit a slight decline but remain generally stable. Notably, when the proportion of the forget set is within 10\%, CLIPErase demonstrates a very significant unlearning effect on the forget set, almost completely deleting its data, while maintaining performance on the retain set comparable to the original CLIP model. However, when the size of the forget set becomes too large, reaching 30\%, the unlearning effect of CLIPErase on the forget set slightly decreases, with about 10\% of the forget set data not being completely unlearned.
% \subsection{Appendices}
% Use \verb|\appendix| before any appendix section to switch the section numbering over to letters. See Appendix~\ref{sec:appendix} for an example.
% \section{Bib\TeX{} Files}
% \label{sec:bibtex}
% Unicode cannot be used in Bib\TeX{} entries, and some ways of typing special characters can disrupt Bib\TeX's alphabetization. The recommended way of typing special characters is shown in Table~\ref{tab:accents}.
% Please ensure that Bib\TeX{} records contain DOIs or URLs when possible, and for all the ACL materials that you reference.
% Use the \verb|doi| field for DOIs and the \verb|url| field for URLs.
% If a Bib\TeX{} entry has a URL or DOI field, the paper title in the references section will appear as a hyperlink to the paper, using the hyperref \LaTeX{} package.
\bibliography{custom}
\appendix
\section{Example Appendix}
\label{sec:appendix}
This is an appendix.
\end{document}
\begin{thebibliography}{38}
\providecommand{\natexlab}[1]{#1}
\bibitem[{Achiam et~al.(2023)Achiam, Adler, Agarwal, Ahmad, Akkaya, Aleman, Almeida, Altenschmidt, Altman, Anadkat et~al.}]{achiam2023gpt}
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia~Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et~al. 2023.
\newblock Gpt-4 technical report.
\newblock \emph{arXiv preprint arXiv:2303.08774}.
\bibitem[{Bojchevski and G{\"u}nnemann(2017)}]{bojchevski2017deep}
Aleksandar Bojchevski and Stephan G{\"u}nnemann. 2017.
\newblock Deep gaussian embedding of graphs: Unsupervised inductive learning via ranking.
\newblock \emph{arXiv preprint arXiv:1707.03815}.
\bibitem[{Bourtoule et~al.(2019)Bourtoule, Chandrasekaran, Choquette-Choo, Jia, Travers, Zhang, Lie, and Papernot}]{Bourtoule2019MachineU}
Lucas Bourtoule, Varun Chandrasekaran, Christopher~A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2019.
\newblock \href {https://api.semanticscholar.org/CorpusID:208909851} {Machine unlearning}.
\newblock \emph{2021 IEEE Symposium on Security and Privacy (SP)}, pages 141--159.
\bibitem[{Chen and Yang(2023)}]{chen2023unlearn}
Jiaao Chen and Diyi Yang. 2023.
\newblock Unlearn what you want to forget: Efficient unlearning for llms.
\newblock \emph{arXiv preprint arXiv:2310.20150}.
\bibitem[{Chen et~al.(2023)Chen, Gao, Liu, Peng, and Wang}]{chen2023boundary}
Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. 2023.
\newblock Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary.
\newblock In \emph{Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition}, pages 7766--7775.
\bibitem[{Cheng and Amiri(2023)}]{cheng2023multidelete}
Jiali Cheng and Hadi Amiri. 2023.
\newblock Multidelete for multimodal machine unlearning.
\newblock \emph{arXiv preprint arXiv:2311.12047}.
\bibitem[{Chundawat et~al.(2023)Chundawat, Tarun, Mandal, and Kankanhalli}]{chundawat2023zero}
Vikram~S Chundawat, Ayush~K Tarun, Murari Mandal, and Mohan Kankanhalli. 2023.
\newblock Zero-shot machine unlearning.
\newblock \emph{IEEE Transactions on Information Forensics and Security}, 18:2345--2354.
\bibitem[{Dou et~al.(2024)Dou, Liu, Lyu, Ding, and Wong}]{dou2024avoiding}
Guangyao Dou, Zheyuan Liu, Qing Lyu, Kaize Ding, and Eric Wong. 2024.
\newblock Avoiding copyright infringement via machine unlearning.
\newblock \emph{arXiv preprint arXiv:2406.10952}.
\bibitem[{Eldan and Russinovich(2023)}]{eldan2023s}
Ronen Eldan and Mark Russinovich. 2023.
\newblock Who's harry potter? approximate unlearning in llms.
\newblock \emph{arXiv preprint arXiv:2310.02238}.
\bibitem[{Fuchi and Takagi(2024)}]{fuchi2024erasing}
Masane Fuchi and Tomohiro Takagi. 2024.
\newblock Erasing concepts from text-to-image diffusion models with few-shot unlearning.
\newblock \emph{arXiv preprint arXiv:2405.07288}.
\bibitem[{Gandikota et~al.(2023)Gandikota, Materzynska, Fiotto-Kaufman, and Bau}]{gandikota2023erasing}
Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. 2023.
\newblock Erasing concepts from diffusion models.
\newblock In \emph{Proceedings of the IEEE/CVF International Conference on Computer Vision}, pages 2426--2436.
\bibitem[{Gandikota et~al.(2024)Gandikota, Orgad, Belinkov, Materzy{\'n}ska, and Bau}]{gandikota2024unified}
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy{\'n}ska, and David Bau. 2024.
\newblock Unified concept editing in diffusion models.
\newblock In \emph{Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision}, pages 5111--5120.
\bibitem[{Golatkar et~al.(2020)Golatkar, Achille, and Soatto}]{golatkar2020forgetting}
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. 2020.
\newblock Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations.
\newblock In \emph{Computer Vision--ECCV 2020: 16th European Conference, Glasgow, UK, August 23--28, 2020, Proceedings, Part XXIX 16}, pages 383--398. Springer.
\bibitem[{Gupta et~al.(2021)Gupta, Jung, Neel, Roth, Sharifi-Malvajerdi, and Waites}]{gupta2021adaptive}
Varun Gupta, Christopher Jung, Seth Neel, Aaron Roth, Saeed Sharifi-Malvajerdi, and Chris Waites. 2021.
\newblock Adaptive machine unlearning.
\newblock \emph{Advances in Neural Information Processing Systems}, 34:16319--16330.
\bibitem[{Jia et~al.(2024)Jia, Zhang, Zhang, Liu, Runwal, Diffenderfer, Kailkhura, and Liu}]{jia2024soul}
Jinghan Jia, Yihua Zhang, Yimeng Zhang, Jiancheng Liu, Bharat Runwal, James Diffenderfer, Bhavya Kailkhura, and Sijia Liu. 2024.
\newblock Soul: Unlocking the power of second-order optimization for llm unlearning.
\newblock \emph{arXiv preprint arXiv:2404.18239}.
\bibitem[{Kim et~al.(2021)Kim, Kwon, and Ye}]{Kim2021DiffusionCLIPTD}
Gwanghyun Kim, Taesung Kwon, and Jong-Chul Ye. 2021.
\newblock \href {https://api.semanticscholar.org/CorpusID:244909410} {Diffusionclip: Text-guided diffusion models for robust image manipulation}.
\newblock \emph{2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)}, pages 2416--2425.
\bibitem[{Kravets and Namboodiri(2024)}]{kravets2024zero}
Alexey Kravets and Vinay Namboodiri. 2024.
\newblock Zero-shot class unlearning in clip with synthetic samples.
\newblock \emph{arXiv preprint arXiv:2407.07485}.
\bibitem[{Krizhevsky et~al.(2009)Krizhevsky, Hinton et~al.}]{krizhevsky2009learning}
Alex Krizhevsky, Geoffrey Hinton, et~al. 2009.
\newblock Learning multiple layers of features from tiny images.
\bibitem[{Kurmanji et~al.(2024)Kurmanji, Triantafillou, Hayes, and Triantafillou}]{kurmanji2024towards}
Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. 2024.
\newblock Towards unbounded machine unlearning.
\newblock \emph{Advances in neural information processing systems}, 36.
\bibitem[{Li et~al.(2024)Li, Wei, Zhang, Qi, Du, Chen, and Bi}]{Li2024SingleIU}
Jiaqi Li, Qianshan Wei, Chuanyi Zhang, Guilin Qi, Miaozeng Du, Yongrui Chen, and Sheng Bi. 2024.
\newblock \href {https://api.semanticscholar.org/CorpusID:269930051} {Single image unlearning: Efficient machine unlearning in multimodal large language models}.
\newblock \emph{ArXiv}, abs/2405.12523.
\bibitem[{Li et~al.(2021)Li, Selvaraju, Gotmare, Joty, Xiong, and Hoi}]{li2021align}
Junnan Li, Ramprasaath Selvaraju, Akhilesh Gotmare, Shafiq Joty, Caiming Xiong, and Steven Chu~Hong Hoi. 2021.
\newblock Align before fuse: Vision and language representation learning with momentum distillation.
\newblock \emph{Advances in neural information processing systems}, 34:9694--9705.
\bibitem[{Liu et~al.(2022)Liu, Liu, and Stone}]{liu2022continual}
Bo~Liu, Qiang Liu, and Peter Stone. 2022.
\newblock Continual learning and private unlearning.
\newblock In \emph{Conference on Lifelong Learning Agents}, pages 243--254. PMLR.
\bibitem[{Liu et~al.(2024{\natexlab{a}})Liu, Li, Wu, and Lee}]{liu2024visual}
Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong~Jae Lee. 2024{\natexlab{a}}.
\newblock Visual instruction tuning.
\newblock \emph{Advances in neural information processing systems}, 36.
\bibitem[{Liu et~al.(2024{\natexlab{b}})Liu, Dou, Tan, Tian, and Jiang}]{liu2024machine}
Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. 2024{\natexlab{b}}.
\newblock Machine unlearning in generative ai: A survey.
\newblock \emph{arXiv preprint arXiv:2407.20516}.
\bibitem[{Liu et~al.(2024{\natexlab{c}})Liu, Dou, Tan, Tian, and Jiang}]{Liu2024TowardsSL}
Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. 2024{\natexlab{c}}.
\newblock \href {https://api.semanticscholar.org/CorpusID:267681958} {Towards safer large language models through machine unlearning}.
\newblock \emph{ArXiv}, abs/2402.10058.
\bibitem[{Maini et~al.(2024)Maini, Feng, Schwarzschild, Lipton, and Kolter}]{maini2024tofu}
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary~Chase Lipton, and J~Zico Kolter. 2024.
\newblock \href {https://openreview.net/forum?id=B41hNBoWLo} {{TOFU}: A task of fictitious unlearning for {LLM}s}.
\newblock In \emph{First Conference on Language Modeling}.
\bibitem[{McConnon(2024)}]{mcconnon2024machineunlearning}
Anthony McConnon. 2024.
\newblock \href {https://www.ibm.com/blog/machine-unlearning/} {Teaching large language models to "forget" unwanted content}.
\newblock Accessed: 2024-10-09.
\bibitem[{Pedregosa and Triantafillou(2023)}]{pedregosa2023unlearningchallenge}
Fabian Pedregosa and Eleni Triantafillou. 2023.
\newblock \href {https://research.google/blog/announcing-the-first-machine-unlearning-challenge/} {Announcing the first machine unlearning challenge}.
\newblock Accessed: 2024-10-09.
\bibitem[{Ullah et~al.(2021)Ullah, Mai, Rao, Rossi, and Arora}]{ullah2021machine}
Enayat Ullah, Tung Mai, Anup Rao, Ryan~A Rossi, and Raman Arora. 2021.
\newblock Machine unlearning via algorithmic stability.
\newblock In \emph{Conference on Learning Theory}, pages 4126--4142. PMLR.
\bibitem[{Van~der Maaten and Hinton(2008)}]{van2008visualizing}
Laurens Van~der Maaten and Geoffrey Hinton. 2008.
\newblock Visualizing data using t-sne.
\newblock \emph{Journal of machine learning research}, 9(11).
\bibitem[{Wang et~al.(2023)Wang, Chen, Yuan, Zeng, Wong, and Yin}]{Wang2023KGAAG}
Lingzhi Wang, Tong Chen, Wei Yuan, Xingshan Zeng, Kam-Fai Wong, and Hongzhi Yin. 2023.
\newblock \href {https://api.semanticscholar.org/CorpusID:258615571} {Kga: A general machine unlearning framework based on knowledge gap alignment}.
\newblock \emph{ArXiv}, abs/2305.06535.
\bibitem[{Yang et~al.(2022)Yang, Li, Zhang, Xiao, Liu, Yuan, and Gao}]{yang2022unified}
Jianwei Yang, Chunyuan Li, Pengchuan Zhang, Bin Xiao, Ce~Liu, Lu~Yuan, and Jianfeng Gao. 2022.
\newblock Unified contrastive learning in image-text-label space.
\newblock In \emph{Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition}, pages 19163--19173.
\bibitem[{Yao et~al.(2024)Yao, Chien, Du, Niu, Wang, Cheng, and Yue}]{yao2024machine}
Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. 2024.
\newblock Machine unlearning of pre-trained large language models.
\newblock \emph{arXiv preprint arXiv:2402.15159}.
\bibitem[{Yao et~al.(2023)Yao, Xu, and Liu}]{yao2023large}
Yuanshun Yao, Xiaojun Xu, and Yang Liu. 2023.
\newblock Large language model unlearning.
\newblock \emph{arXiv preprint arXiv:2310.10683}.
\bibitem[{Yuan et~al.(2021)Yuan, Chen, Chen, Codella, Dai, Gao, Hu, Huang, Li, Li et~al.}]{yuan2021florence}
Lu~Yuan, Dongdong Chen, Yi-Ling Chen, Noel Codella, Xiyang Dai, Jianfeng Gao, Houdong Hu, Xuedong Huang, Boxin Li, Chunyuan Li, et~al. 2021.
\newblock Florence: A new foundation model for computer vision.
\newblock \emph{arXiv preprint arXiv:2111.11432}.
\bibitem[{Zhai et~al.(2022)Zhai, Wang, Mustafa, Steiner, Keysers, Kolesnikov, and Beyer}]{zhai2022lit}
Xiaohua Zhai, Xiao Wang, Basil Mustafa, Andreas Steiner, Daniel Keysers, Alexander Kolesnikov, and Lucas Beyer. 2022.
\newblock Lit: Zero-shot transfer with locked-image text tuning.
\newblock In \emph{Proceedings of the IEEE/CVF conference on computer vision and pattern recognition}, pages 18123--18133.
\bibitem[{Zhang et~al.(2024)Zhang, Wang, Xu, Wang, and Shi}]{zhang2024forget}
Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. 2024.
\newblock Forget-me-not: Learning to forget in text-to-image diffusion models.
\newblock In \emph{Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition}, pages 1755--1764.
\bibitem[{Zhang et~al.(2023)Zhang, Zhu, Zhang, Xiong, and Zhou}]{Zhang2023FedRecoveryDP}
Lefeng Zhang, Tianqing Zhu, Haibin Zhang, Ping Xiong, and Wanlei Zhou. 2023.
\newblock \href {https://api.semanticscholar.org/CorpusID:260080177} {Fedrecovery: Differentially private machine unlearning for federated learning frameworks}.
\newblock \emph{IEEE Transactions on Information Forensics and Security}, 18:4732--4746.
\end{thebibliography}