Tackling Fake Forgetting through Uncertainty Quantification

Machine unlearning seeks to remove the influence of specified data from a trained model. While the unlearning accuracy provides a widely used metric for assessing unlearning performance, it falls short in assessing the reliability of forgetting. In this paper, we find that the forgetting data points misclassified by unlearning accuracy still have their ground truth labels included in the conformal prediction set from the uncertainty quantification perspective, leading to a phenomenon we term fake forgetting. To address this issue, we propose a novel metric CR, inspired by conformal prediction, that offers a more reliable assessment of forgetting quality. Building on these insights, we further propose an unlearning framework CPU that incorporates conformal prediction into the Carlini & Wagner adversarial attack loss, enabling the ground truth label to be effectively removed from the conformal prediction set. Through extensive experiments on image classification tasks, we demonstrate both the effectiveness of our proposed metric and the superior forgetting quality achieved by our framework. Code is available at https://github.com/TIML-Group/Conformal-Prediction-Unlearning.

When we train an AI model on personal or sensitive data, we sometimes need to make it "forget" specific information — for example, to comply with privacy laws like the right to be erased. Existing methods for doing this check whether the model still correctly identifies the forgotten data, but we discovered this test can be fooled: the model may appear to forget while still secretly "knowing" the right answer. We developed a new way to measure true forgetting by examining the model's uncertainty about its predictions — specifically, whether the correct answer still appears among the model's plausible guesses. Building on this insight, we also designed a new forgetting method that actively pushes the correct answer out of the model's range of possibilities. Our work makes machine unlearning more trustworthy, which is important for building AI systems that genuinely respect privacy and can reliably remove the influence of sensitive data when needed.