A deployed model may receive many requests to forget: a withdrawn training image, a corrupted example, or an entire class that should no longer influence predictions. Retraining from scratch is expensive, while repeatedly fine-tuning the model can disturb behavior that should remain intact. Minimally Invasive Machine Unlearning (MIMU) takes a different route: learn a controller in advance, then fulfill each request by masking a small, targeted subset of weights.

The central shift

Unlearning becomes a control problem, not a new optimization problem for every request. The predictive model remains frozen; a learned policy decides which parameters to switch off.

MIMU inference pipeline. An unlearning example and its model context enter a control network, which selects a sparse weight mask. The masked predictive model becomes uncertain on the target and similar examples.
Figure 1 from the paper. The controller receives an unlearning example together with local model information, produces a top-k binary mask, and applies that mask to the frozen predictor—without request-time gradient optimization.

From a forget request to a sparse intervention

Let the trained predictor have parameters θ, and let m be a binary mask. The ideal request-specific masking policy is expensive to compute directly, so MIMU trains a parameterized controller Qφ to approximate it while enforcing an exact intervention budget:

Posterior-control objective
arg minφ KL[ Qφ(mi | xi, yi, θ) ‖ P(mi | xi, yi, θ) ],   ‖mi‖0 = δ

The controller learns to match the ideal masking distribution P, while the ℓ0 constraint fixes each intervention to exactly δ selected parameters.

Instead of solving this combinatorial search after every request, the method learns a distribution Qφ(m x, y, θ) over masks ahead of time. Top-δ sampling turns that distribution into an exactly sparse binary action. At request time, the controller only needs a forward pass, feature extraction, and mask application.
01Observe

Collect the request and local activations, gradients, weight values, and connectivity.

02Select

The pretrained controller scores parameters and returns a sparse top-δ mask.

03Intervene

Mask those weights so the target becomes unpredictable while retained behavior stays stable.

Why a graph controller?

A weight does not act alone. Two parameters are related when they meet at the same neuron, and their effect depends on the activations and gradients around them. MIMU therefore represents a selected neural-network layer as a graph: weights become nodes, and weights incident to a shared neuron are connected.

Construction of the MIMU parameter graph. Weights in one layer become graph nodes; weights connected through the same neuron share edges. Each node includes activation, output, weight, and gradient information.
Figure 2 from the paper. Each weight is represented by its inbound activation, outbound activation, value, and loss gradient. A graph convolutional network propagates this local context before estimating the probability that each weight should be masked.

This representation lets the controller learn interactions among nearby parameters rather than ranking every weight independently. The masking prior also favors influential weights by assigning probability in proportion to magnitude:

Weight-informed masking prior
P(mk | θ) = |θk| / ∑k′|θk′|

The learned posterior combines this prior with request-specific evidence. Gumbel top-k sampling makes the hard, fixed-size mask trainable with gradient descent.

Forget by becoming uncertain

Making a model confidently predict the wrong class is not the same as removing predictive information. MIMU instead pushes the forget examples toward high predictive entropy. For retained examples, the objective is the opposite: preserve confident predictions and preserve the internal evidence used to make them.

The experiments cover class-level and subclass-level requests on MNIST, Fashion-MNIST, CIFAR-10, and ImageNet-100, using models from an MLP through ResNet-50. In the reported class-level experiments, MIMU reduces forget-set accuracy to approximately zero across all four datasets while keeping retain-set degradation within two percentage points.

Efficiency plots for CIFAR-10 with ResNet-18 and ImageNet-100 with ResNet-50. MIMU appears as a yellow star near the original retain accuracy, with green color indicating successful forgetting, at much shorter request times than optimization-based baselines.
Figure 3 from the paper. Higher is better for retain accuracy, greener is better for forgetting, and farther left is faster. MIMU sits near the original model’s retain accuracy while processing requests in seconds rather than repeatedly optimizing for hundreds or thousands of seconds.

On ImageNet-100 with ResNet-50, the paper reports 9.18 ± 2.08 seconds per MIMU request. By comparison, NegGrad+, Saliency Unlearning, and SCRUB take roughly 2,036, 1,948, and 3,395 seconds respectively in the same table. The controller has an up-front training cost, but that cost is shared across subsequent requests.

What “minimally invasive” looks like inside the model

Accuracy alone cannot reveal whether retained predictions are now based on different or spurious evidence. The authors therefore compare input saliency before and after unlearning. Red pixels in the figure mark locations whose saliency changed substantially.

Saliency comparison across machine-unlearning methods on Fashion-MNIST and CIFAR-10. Forget examples are shown in the upper half and retained examples in the lower half. MIMU changes saliency strongly on forget examples while producing little change on retained examples.
Figure 4 from the paper. A successful intervention should alter the evidence used for the forget example (top pair of rows) but preserve it for the retain example (bottom pair). MIMU shows that asymmetric pattern on both datasets.

The saliency result completes the story behind the accuracy numbers. The controller is not merely keeping the final label unchanged on retained data; it largely preserves the prediction pattern that produced that label. For forget data, the opposite behavior is desirable: the marked shift shows that the targeted predictive pathway has been disrupted.

A reusable control layer for deployed models

MIMU separates two timescales. During training, it learns how examples, gradients, and parameter connectivity predict an effective intervention. During deployment, it converts each new request directly into a sparse mask. That separation makes repeated unlearning requests look less like repeated model repair and more like fast, structured model control.

Read the research