Can Vision Models Truly Forget? Mirage: Representation-Level Certification of Visual Unlearning¶

Conference: ECCV 2026
Paper: ECCV Official Link
Code: https://github.com/YuZhenyuLindy/Mirage
Area: Optimization & Theory
Keywords: machine unlearning, vertical federated learning, representation auditing, forgetting gap, linear probing

TL;DR¶

Addressing the critical vulnerability that existing visual unlearning evaluations rely solely on output-level metrics and mask persistent internal traces, this paper proposes Mirage, a representation-level certification framework combining linear probe recovery, centered kernel alignment, feature separability, and layer-wise tracking, revealing the widespread "forgetting illusion" and an unlearning trilemma across utility, output forgetting, and representational erasure.

Background & Motivation¶

In collaborative, cross-organizational data pipelines such as medical image analysis consortia and model-serving systems, strict regulatory compliance and the "right to be forgotten" mandate that trained models selectively erase specific categories or training samples upon request. Existing evaluations in the machine unlearning literature focus almost exclusively on behavioral output metrics, including retained-data accuracy, forgotten-label prediction accuracy, and computational efficiency. Under this prevailing paradigm, if an unlearned model produces uninformative or near-zero predictions on forgotten data while maintaining predictive utility on the remaining data, unlearning is deemed complete.

However, this output-suppression assumption is fundamentally flawed for deep vision models. Deep neural networks encode class identity into intricate, high-dimensional feature spaces where class-conditional manifolds remain geometrically separable even under extensive training variations. Merely shifting the classifier weights or manipulating the decision boundary does not dismantle the underlying feature geometry in intermediate layers. Especially in paradigms like Vertical Federated Learning (VFL), where passive clients compute and transmit intermediate embeddings directly to an active party holding the task labels, exposed representations allow downstream adversaries or audit probes to decode supposedly "forgotten" sensitive knowledge with simple linear models.

This mismatch between behavioral output suppression and deep representational persistence creates a false sense of privacy and safety. To establish rigorous unlearning certification, evaluations must audit the internal representation space against a gold-standard reference retrained from scratch on the retained dataset, measuring the excess information that cannot be explained away by natural visual priors. Core Idea: Introduce Mirage, a representation-level auditing framework that measures unlearning relative to a retrained-from-scratch baseline using linear probe recovery, centered kernel alignment, feature separability, and layer-wise diagnostics, formalizing the "forgetting gap" to expose and certify true representational erasure.

Method¶

Overall Architecture¶

Mirage audits unlearned vision models by systematically benchmarking them against both the original model and an ideal retrained-from-scratch baseline. Rather than inspecting output logits, Mirage targets the intermediate and penultimate representations produced by the bottom feature encoders. The auditing pipeline sequentially executes four complementary diagnostics: evaluating decodable class information via linear probing to compute the retraining-relative forgetting gap; assessing global manifold preservation against the original model using Centered Kernel Alignment (CKA); quantifying geometric inter-class margins via an optimization-free Fisher separability score; and probing representation depth across early, middle, and penultimate layers to detect spatial persistence.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Input: Original Model Θ* / Unlearned Model Θu / Retrained Baseline Θr"] --> B["Linear Probe Recovery & Forgetting Gap<br/>Freeze embeddings, train linear classifier to detect unlearned classes relative to Θr"]
    B --> C["CKA Global Structural Alignment<br/>Compute feature-level Gram matrix alignment to examine manifold shifts"]
    C --> D["Geometric Feature Separability<br/>Fisher-inspired score measuring centroid distance vs intra-class variance"]
    D --> E["Layer-Wise Representation Persistence<br/>Probe early, intermediate, and deep layers to map residual depth penetration"]
    E --> F["Output: Certification Verdict<br/>Disambiguate behavioral illusion vs representation collapse vs true erasure"]

Key Designs¶

1. Linear Probe Recovery & Forgetting Gap: Grounding Excess Residuals Against Retraining Baselines

Because standard visual backbones naturally group semantically coherent concepts even when trained without their specific labels, evaluating raw probe accuracy in isolation produces misleading false alarms. Mirage freezes the unlearned model's feature extractor, extracts penultimate-layer representations, and optimizes a linear probe with \(\ell_2\) regularization via cross-entropy to classify whether a given representation belongs to the forgotten set or the retained set. To isolate genuine residual artifacts from intrinsic visual clustering, Mirage establishes a retraining-relative metric termed the forgetting gap:

\[\Delta_{\text{LPR}} = \text{LPR}(\Theta_u) - \text{LPR}(\Theta_r)\]

Here, \(\text{LPR}(\Theta)\) denotes the optimal classification accuracy achieved by the linear probe on model \(\Theta\). A strictly positive forgetting gap (\(\Delta_{\text{LPR}} > 0\)) indicates that the unlearned model retains excess class-specific structure beyond what an untainted retrained model inherently encodes. Unlearning is certified only when \(\Delta_{\text{LPR}}\) converges within a negligible threshold \(\epsilon\).

2. CKA Global Structural Alignment: Auditing Global Manifold Deformation

While linear decodability captures immediate linear readouts, it does not evaluate whether the broader geometry of the feature space has genuinely reorganized toward the retrained reference. Mirage incorporates linear Centered Kernel Alignment (CKA) to compare representations across the original model \(\Theta^*\), the unlearned model \(\Theta_u\), and the retrained baseline \(\Theta_r\). Given feature representations \(X \in \mathbb{R}^{n \times p}\) and \(Y \in \mathbb{R}^{n \times q}\) across matched inputs, linear CKA computes:

\[\text{CKA}(X, Y) = \frac{\|Y^\top X\|_F^2}{\|X^\top X\|_F \cdot \|Y^\top Y\|_F}\]

This metric is invariant to orthogonal transformations and uniform isotropic scaling. If an unlearned model maintains near-unity CKA similarity with the original model while diverging sharply from the retrained baseline, it demonstrates that the algorithm left the underlying representation manifold untouched, confirming that output-level forgetting is an illusion confined to the classification head.

3. Geometric Feature Separability: Probe-Independent Geometric Margin Measurement

Probe accuracy can fluctuate depending on optimization hyperparameters, learning rates, or epoch counts. To establish an optimization-free geometric diagnostic, Mirage formulates a Fisher-inspired separability score. Let \(\mu_u\) and \(\Sigma_u\) denote the mean vector and covariance matrix of forgotten-set embeddings, and \(\mu_r, \Sigma_r\) denote those of the retained set. The separability index is calculated as:

\[\mathcal{F} = \frac{\|\mu_u - \mu_r\|_2^2}{\mathrm{Tr}(\Sigma_u) + \mathrm{Tr}(\Sigma_r)}\]

Under isotropic Gaussian assumptions, this metric serves as a dimension-normalized proxy for the signal-to-noise ratio (SNR) governing Bayes-optimal linear classification accuracy. When an unlearned model exhibits a feature separability score substantially higher than that of the retrained reference, the feature space geometrically isolates the forgotten category into distinct clusters, directly validating the probe's decodability.

4. Layer-Wise Representation Persistence: Tracking Residual Information Across Depth

Unlearning adjustments rarely distribute uniformly throughout a deep neural network. Mirage computes layer-wise linear probe recovery and the corresponding gap \(\Delta_{\text{LPR}}^{(l)}\) across early convolutional blocks, intermediate layers, and the penultimate feature bottleneck. Empirical tracking reveals that many gradient-ascent or boundary-shifting interventions affect only the shallowest layers adjacent to the classifier. Deep within the feature hierarchy, the unlearned class representation remains preserved, demonstrating that auditing must probe multiple depths to prevent superficial unlearning defenses.

Loss & Training¶

During the auditing phase, the probe consists of a logistic regression classifier (\(C=1.0\)) trained with \(\ell_2\) regularization for 1000 iterations over frozen representations. Linear CKA calculations use 5000 randomly selected validation samples to compute normalized Gram matrices. Feature separability evaluations incorporate all available forgotten samples and a balanced subset of retained samples. The testbed mirrors a standard Vertical Federated Learning setup where input features are partitioned equally across two passive parties, while the active party hosts labels and the final classification head.

Key Experimental Results¶

Main Results¶

Mirage was evaluated on seven benchmark datasets (six visual datasets spanning MNIST, CIFAR-10, CIFAR-100, Brain Tumor MRI, COVID-19 Radiography, and ModelNet, alongside Yahoo Answers for text) against seven prominent unlearning algorithms. The table below highlights the sharp divergence between output-level metrics and representation-level metrics in single-label unlearning.

Dataset	Evaluation Dimension / Metric	Retrain Baseline	Fine-Tuning (FT)	Boundary Unlearning (BU)	SSD	Target Method
CIFAR-10	Retained Accuracy \(Acc_r\) (%) ↑	89.7	89.7	47.4	89.6	24.1
	Forgotten Accuracy \(y_u\) (%) ↓	0.0	48.5	0.0	88.2	0.0
	Linear Probe Recovery LPR (%)	82.8	90.4	86.8	91.3	82.0
	Forgetting Gap \(\Delta_{\text{LPR}}\) (%)	—	+7.5	+4.0	+8.5	-0.8
	Original Model CKA Alignment	0.989	0.999	0.956	1.000	0.928
	Feature Separability \(\mathcal{F}\)	0.093	0.160	0.149	0.246	0.104
COVID-19	Retained Accuracy \(Acc_r\) (%) ↑	92.8	92.0	77.9	92.1	34.3
	Forgotten Accuracy \(y_u\) (%) ↓	0.0	91.8	0.0	90.9	0.0
	Linear Probe Recovery LPR (%)	79.2	96.2	94.7	96.5	69.9
	Forgetting Gap \(\Delta_{\text{LPR}}\) (%)	—	+17.0	+15.4	+17.3	-9.4
	Original Model CKA Alignment	0.981	0.998	0.957	1.000	0.841
	Feature Separability \(\mathcal{F}\)	0.031	0.280	0.115	0.340	0.089
Brain Tumor	Retained Accuracy \(Acc_r\) (%) ↑	99.1	98.5	72.4	98.8	33.3
	Forgotten Accuracy \(y_u\) (%) ↓	0.0	77.4	0.0	74.7	0.0
	Linear Probe Recovery LPR (%)	79.8	91.8	88.1	91.5	79.9
	Forgetting Gap \(\Delta_{\text{LPR}}\) (%)	—	+12.0	+8.3	+11.7	+0.1

Ablation Study¶

To verify whether extending unlearning duration can dissolve representational residuals, the authors conducted an ablation study over unlearning epochs for Boundary Unlearning (BU), tracking retained accuracy and the forgetting gap.

BU Unlearning Epochs	CIFAR-10 \(Acc_r\) (%)	CIFAR-10 \(\Delta_{\text{LPR}}\) (%)	CIFAR-100 \(Acc_r\) (%)	CIFAR-100 \(\Delta_{\text{LPR}}\) (%)	COVID-19 \(Acc_r\) (%)	COVID-19 \(\Delta_{\text{LPR}}\) (%)
Epoch 0 (Retrain Reference)	89.7	—	62.2	—	92.7	—
Epoch 1	79.2	+4.4	57.4	+6.2	89.3	+15.9
Epoch 3	58.9	+4.5	42.3	+7.3	85.6	+15.1
Epoch 5	43.3	+2.9	32.9	+3.4	81.7	+15.1
Epoch 10	32.7	+2.0	25.5	+3.4	78.8	+14.9
Epoch 20	21.8	+0.6	22.0	+1.1	68.2	+15.9

Key Findings¶

The Pervasive Forgetting Illusion: Methods such as Boundary Unlearning (BU) achieve a seemingly perfect 0.0% forgotten-label accuracy on COVID-19, appearing fully compliant under output-level checks. Yet Mirage reveals an LPR of 94.7% (a massive gap of +15.4% above Retrain) and a CKA similarity of 0.957 with the original model. Increasing unlearning epochs merely crushes retained utility (CIFAR-10 accuracy plummets from 79.2% to 21.8%) without eliminating representational residuals.
The Unlearning Trilemma: Across all evaluations, no method simultaneously attains high retained utility, low output-level accuracy on forgotten data, and low representation-level residual gaps (\(\Delta_{\text{LPR}} \approx 0\)). Methods either fail to forget (FT, SSD), camouflage persistence behind classifier manipulation (BU), or destroy the entire representational manifold through catastrophic utility collapse (Fisher, Target).
Class-Sample Asymmetry: While class-level unlearning leaves prominent clusters and high decodability (\(\text{LPR} > 90\%\)), sample-level unlearning (removing 5% or 10% of random samples) yields probe accuracies around chance (\(\approx 50\%\)) across all methods, including the retrained model. This proves that linear probes are essential for class-level certification but ineffective for sample-level auditing, necessitating distinct diagnostic paradigms for different granularities.

Highlights & Insights¶

Retraining-Relative Baseline Formulation: The paper demonstrates that absolute probe accuracy is fundamentally misleading because deep vision backbones naturally structure visual concepts. Establishing the retrained baseline as the geometric reference point transforms unlearning auditing into a rigorous relative metric.
Holistic Geometric Diagnostic Suite: By coupling linear decodability (LPR) with manifold alignment (CKA) and parameter-free cluster geometry (Fisher separability), Mirage successfully decouples genuine unlearning from behavioral masking and representation collapse.
Critical Implications for Federated Learning: In collaborative pipelines where intermediate embeddings are routinely transmitted across institutional boundaries, output-level certification provides zero guarantee against representation leakage, underscoring the urgent necessity of representation-level auditing protocols.

Limitations & Future Work¶

Conservativeness of Linear Probing: Linear probes explore only linearly separable subspaces in frozen embeddings. Adversaries equipped with non-linear decoders (such as multi-layer perceptrons or kernel classifiers) could potentially extract additional non-linear residuals.
Absence of a Constructive Unlearning Algorithm: Mirage is strictly designed as an auditing framework. While it formalizes the unlearning trilemma and diagnoses widespread failures, it does not introduce a novel algorithmic solution that successfully overcomes the trilemma.
Extension to Broader Settings: Future work should adapt this geometric certification framework to horizontal federated learning regimes, non-IID client distributions, and large-scale multimodal vision-language models.

vs Output-Level Unlearning (Boundary Unlearning / SSD / UNSIR): Prior work primarily optimizes the trade-off between retained accuracy and forgotten error rate. Mirage proves that these techniques manipulate decision boundaries while leaving high-dimensional representations intact.
vs Certified Differential Privacy Unlearning: Theoretical DP guarantees bound the output distribution divergence but rarely examine whether representation-space geometry retains extractable class structure. Mirage provides an empirical, representation-aware auditing mechanism that directly tests internal embeddings.

Rating¶

Novelty: ⭐⭐⭐⭐⭐ Formulates the first comprehensive representation-level auditing framework for visual unlearning, identifying the forgetting gap and the unlearning trilemma.
Experimental Thoroughness: ⭐⭐⭐⭐⭐ Comprehensive evaluation across seven diverse datasets, seven baselines, layer-wise analyses, and varying client partitions in VFL.
Writing Quality: ⭐⭐⭐⭐⭐ Exceptionally clear narrative, rigorous formal definitions, and insightful geometric interpretations supported by compelling t-SNE and CKA visualizations.
Value: ⭐⭐⭐⭐⭐ Serves as a vital reality check for machine unlearning and privacy research, paving the way for next-generation representation-certified unlearning standards.