Class Machine Unlearning for Complex Data via Concepts Inference and Data Poisoning

The gist The proposed concept-guided poisoning unlearning framework explicitly identifies concepts that contribute most strongly to the target class or knowledge and uses them to guide the model update, providing a common unlearning principle for both image classifiers and LLMs.

How it works

The framework addresses two main technical challenges: Concept inference and Concept-guided unlearning, which are implemented differently for images and LLMs (Page 1). For image classification, the method first identifies class-relevant concepts with a Post-hoc Concept Bottleneck Model (PCBM) to map latent features to interpretable concept representations, then localizes the image regions expressing these concepts using vision–language similarity [10], and constructs replacement-based poisoned samples (Page 2). For LLMs, the process involves eliciting target knowledge through multiple questions and aggregating Integrated Gradients across responses to identify consistently important content, which is then masked to construct poisoned training targets (Page 2).

Concept Inference

The concept inference stage is modality-specific: for images, a PCBM ranks concepts by their contribution to each class in the PCBM, and the target concept is selected based on this ranking [9]. The process involves computing a concept score for each concept using the formula aj (x) = vj⊤ j h(x) + bj∥vj∥2 (Page 6). For LLMs, a question set Q is constructed by combining original questions with relation-specific variants and paraphrases to cover different factual relations, and Integrated Gradients (IG) are applied to model responses to identify semantic content that consistently contributes to the target knowledge [11]. This involves summing the attribution vector across embedding dimensions to obtain a word-level score for each word in an answer (Page 6).

Concept-Guided Unlearning

The second challenge is converting inferred concepts into a controlled model update, which is performed via concept-guided poisoning unlearning (Page 2). For images, the method selects a replacement concept along with its replacement class, and a patch containing the replacement concept is inserted into the localized target-concept region rather than at a fixed image center (Page 7). For LLMs, highly attributed sensitive words and entity-name words in model responses are replaced by mask markers while the remaining response is preserved, and these masked responses are mixed with sampled retain anchors before fine-tuning (Page 2).

Mechanism Analysis

The mechanism reduces exposure of target information by weakening the original mapping between target concepts and model outputs (Page 8). For image classification, concept inference identifies a target concept ct that contributes strongly to the target class yt, and the localization step identifies where this evidence appears in the image; this local evidence is then replaced with a replacement concept cr and assigned the replacement-class label yr (Page 9). This results in a training signal where the gradient pushes the target-class logit downward while pushing the replacement-class logit upward for poisoned samples (Page 9). The same principle applies to LLMs, where concept inference aggregates attribution scores across questions to produce a sensitive-word set Se, and these words are replaced with mask markers in the response to change the mapping from qi → ri to qi → r˜i (Page 8).

Experiments and Results

Experiments on multiple datasets show that the proposed framework achieves effective unlearning across different tasks while largely preserving retained model utility (Page 2). For image classification, the method consistently achieves zero target-class accuracy on CIFAR-10 and CIFAR-100 while maintaining high Aglobal values of 0.967 and 0.835, compared with retraining (Page 11). In LLM unlearning, the results show that target-author name disclosure is suppressed across original and paraphrased questions and multiple forgetting scopes, with no observed cross-author name leakage after unlearning (Page 16). The method demonstrates a strong balance between target-class unlearning and retained predictive utility (Page 10).

Conclusion

The work demonstrates that concept-level semantic information can provide a practical interface between unlearning requests and controlled model updates, offering a unified way to apply poisoning-based unlearning to both image classifiers and LLMs (Page 17). This approach reduces the exposure of target information by weakening the original mapping between target concepts and model outputs (Page 8).

The proposed concept-guided poisoning unlearning framework explicitly identifies concepts that contribute most strongly to the target class or knowledge and uses them to guide the model update, providing a common unlearning principle for both image classifiers and LLMs

The framework uses humaninterpretable concepts connect the forgetting target to the model representations that produce the target behavior

For image classification, our method first identifies class-relevant concepts with a Post-hoc Concept Bottleneck Model (PCBM) to map latent features to interpretable concept representations, then localizes the image regions expressing these concepts using vision–language similarity [10], and constructs replacement-based poisoned samples

For LLMs, it elicits the target knowledge through multiple questions and aggregates Integrated Gradients across responses to identify consistently important content, which is then masked to construct poisoned training targets

The framework uses humaninterpretable concepts connect the forgetting target to the model representations that produce the target behavior

Concept inference first identifies the semantic connection between the forgetting target and the model output, and poisoning uses this content to construct modified training data

Training on these data weakens the original mapping between target concepts and model outputs

Concept inference provides a more targeted basis for constructing poisoned samples

Experiments on image classification and LLM unlearning tasks show that the proposed method achieves effective unlearning of target information while largely preserving retained model utility across different classes, datasets, models, and forgetting scales

The results show that concept inference provides a more targeted basis for constructing poisoned samples

Overall, our work demonstrates that concept-level semantic information can provide a practical interface between unlearning requests and controlled model updates, and offers a unified way to apply poisoning-based unlearning to both image classifiers and LLMs

The framework uses humaninterpretable concepts connect the forgetting target to the model representations that produce the target behavior

Concept inference first identifies the semantic connection between the forgetting target and the model output, and poisoning uses this content to construct modified training data

Training on these data weakens the original mapping between target concepts and model outputs

Experiments on image classification and LLM unlearning tasks show that the proposed method achieves effective unlearning of target information while largely preserving retained model utility across different classes, datasets, models, and forgetting scales

The results show that concept inference provides a more targeted basis for constructing poisoned samples

Overall, our work demonstrates that concept-level semantic information can provide a practical interface between unlearning requests and controlled model updates, and offers a unified way to apply poisoning-based unlearning to both image classifiers and LLMs

The framework uses humaninterpretable concepts connect the forgetting target to the model representations that produce the target behavior

Concept inference first identifies the semantic connection between the forgetting target and the model output, and poisoning uses this content to construct modified training data

Training on these data weakens the original mapping between target concepts and model outputs</ref:2405.

1. textbfConcept-Guided Poisoning Unlearning for Image Classification: Semantic Evidence Modification and Replacement Labeling. The system can perform concept inference by using a Post-hoc Concept Bottleneck Model (PCBM) to identify class-relevant concepts with a Post-hoc Concept Bottleneck Model, localize the image regions expressing these concepts, and construct replacement-based poisoned samples. This process modifies the target image region with a patch containing a replacement concept and assigns it the replacement-class label to obtain an updated model, effectively weakening the original mapping.

2. textbfConcept-Guided Poisoning Unlearning for LLMs: Cross-Question Attribution and Masked Target Construction. The system can elicit target knowledge through multiple independent questions and apply Integrated Gradients (IG) to responses across all questions, aggregating the results to identify consistently important content. It then constructs poisoned training targets by masking these identified words with mask markers, which are mixed with sampled retain anchors before fine-tuning.

3. textbfQuantifiable Unlearning Evaluation: Preserving Retained Utility and Stability Under Corruption. The system can rigorously evaluate unlearning effectiveness by monitoring metrics such as Atrain and Atest while simultaneously tracking Aglobal, ensuring that the method achieves a balance where retained utility is largely preserved, as shown by the observation that the model's cross-entropy losses shift toward the high-loss region observed after retraining.

4. textbfRobustness to Input Corruption: Timing Sensitivity Analysis for Image Unlearning. The system can demonstrate robustness by analyzing corruption timing, showing that applying corruption after poisoned-image construction leads to a lower residual target accuracy compared to applying it before localization, indicating that the concept-guided intervention is effective even when visual evidence is altered.

5. textbfModel Selection and Utility Preservation: Constraint-Based Checkpoint Selection for LLMs. The system can select the optimal unlearned checkpoint by using constraint-based checkpoint selection based on metrics like Ao ≤ 0.025, Ap ≤ 0.005, and H = 0, which is shown to preserve retained answer utility (R) while suppressing target-author name disclosure (Ao and Ap).