The research, led by Sayanta Adhikari, Vishnuprasadh Kumaravelu, and P. K. Srijith of the Bayesian Reasoning and Inference Lab at the Indian Institute of Technology Hyderabad, introduces a framework called UnCLe, short for a Hypernetwork Framework for Data-Free Unlearning and Continual Learning. The core insight is that machine unlearning—the deliberate removal of a task’s influence from a trained model—has almost always been designed with offline training in mind, where engineers retain full access to the original dataset. In continual learning, that assumption collapses. Data arrives task by task and is typically discarded after use, so when an unlearning request arrives, the original examples may simply no longer exist.

The team identified two failure modes that emerge when conventional unlearning is naively applied to continual learning environments. The first is catastrophic forgetting of retained tasks, a well-known pathology in which updating a network to remove one capability wipes out unrelated capabilities it was supposed to keep. The second is subtler and, in some ways, more troubling: catastrophic remembering, in which tasks that were supposedly unlearned resurface when the model later absorbs new information. A model that appears to have forgotten sensitive data can effectively relapse, undermining the very privacy guarantees that unlearning is meant to provide.

UnCLe attacks both problems by restructuring how the model’s parameters are produced in the first place. Instead of training a single monolithic network, the framework employs a hypernetwork—a network that generates the weights of another network—conditioned on compact task embeddings. Each task the system encounters is represented by its own embedding vector, and the hypernetwork maps that embedding to a full set of task-specific parameters. Learning a new task therefore means learning or refining an embedding, while the shared hypernetwork machinery remains stable across the entire sequence of operations.

Unlearning under this scheme becomes elegantly simple at the task level. To remove a task, the framework optimizes the hypernetwork so that, for that task’s embedding, it generates parameters that behave like noise. The generated network produces uniform, maximum-entropy outputs on the forgotten task—in other words, the model becomes maximally uncertain, exactly as if it had never seen the task at all. Crucially, this procedure does not require the original training data, which is precisely what makes it data-free. The optimization is guided by a mean squared error objective that pulls the generated parameters toward freshly sampled Gaussian noise, combined with a regularization term that anchors the hypernetwork’s outputs for all previously retained tasks, preventing collateral damage.

The choice of a noise-matching objective, rather than a direct norm penalty, turns out to matter a great deal. The authors show mathematically that averaging the squared distance to random Gaussian samples converges to the squared L2 norm of the parameters plus a constant, meaning the MSE objective implicitly drives the forgotten task’s parameters toward zero and its outputs toward a uniform distribution. But applying the L2 norm directly would, over repeated unlearning operations, drag the hypernetwork’s own shared weights toward zero and destabilize the whole system. By contrast, sampling a fresh noise target at each optimization step constrains the forget task only in distribution, acting as an implicit regularizer that preserves the shared representation. The researchers compared alternatives—including fixed noise targets, pure norm reduction, and simply discarding the task embedding—and found their approach achieved the best balance between erasing the target task and protecting retained performance.

Scaling a hypernetwork to generate all the weights of a modern convolutional backbone such as ResNet18 or ResNet50 presents its own engineering challenge, since the hypernetwork’s output layer would otherwise balloon to an impractical size. The team’s solution is chunked generation: the main network’s parameters are partitioned into roughly 200 chunks, each produced by a dedicated head of the hypernetwork conditioned on a unique chunk embedding concatenated with the task embedding. These chunk embeddings are frozen after the first task to guard against forgetting, and the final layer is split into specialized heads for weights, batch normalization parameters, and residual connection parameters, reducing redundancy and computational overhead.

The practical consequences of this design are striking. Because unlearning operates entirely in parameter space, its computational cost is dominated by the hypernetwork’s forward and backward passes and is essentially independent of dataset size and class count. The only term that grows over a sequence is the regularization over retained tasks, and it grows linearly in the number of tasks, not data points. In conventional replay-based unlearning adapted to continual settings, by contrast, the cost scales with a replay buffer whose size is difficult to budget in advance. The researchers also introduced an annealing strategy that shrinks the burn-in phase of each unlearning operation by ten percent per operation, exploiting forward transfer to cut unlearning time without degrading quality.

Empirical evaluations across sequential vision benchmarks—including Permuted-MNIST, a five-dataset suite combining MNIST, Fashion-MNIST, KMNIST, notMNIST and SVHN, CIFAR-100, and TinyImageNet—showed that UnCLe can perform long interleaved sequences of learning and unlearning requests, up to 30 operations on TinyImageNet, with minimal disruption to previously acquired knowledge. Measured against baselines including fine-tuning, retraining from scratch, and hypernetwork variants that rely on natural catastrophic forgetting, UnCLe performed on par or better across metrics, and strictly better on three of five measures with a ResNet-18 backbone. It also achieved membership inference attack accuracy closest to the ideal fifty percent, a key indicator that forgotten data is genuinely indistinguishable from never-seen data—a central concern for privacy.

Perhaps most importantly for real-world deployment, UnCLe prevented the relapse phenomenon that plagues conventional approaches: tasks unlearned by prior methods tend to creep back once new learning occurs, whereas UnCLe’s unlearned tasks stayed forgotten even as subsequent tasks were absorbed. The authors argue this has broad implications for responsible AI governance, from honoring the right to be forgotten under data protection law to stripping biased or harmful behaviors from deployed models without full retraining. At the same time, they caution that the very possibility of relapse under weaker methods underscores the need for robust verification mechanisms. With code released publicly, the framework offers a template for AI systems that can keep learning throughout their operational life while remaining accountable to demands that they forget on command.

Subject of Research: A hypernetwork framework enabling data-free machine unlearning within continual learning settings

Article Title: A Hypernetwork Framework for Data-Free Unlearning and Continual Learning

Article References: A Hypernetwork Framework for Data-Free Unlearning and Continual Learning. (n.d.). https://doi.org/10.1007/s10994-026-07125-8

Image Credits: AI Generated

DOI: 10.1007/s10994-026-07125-8

Keywords: machine unlearning, continual learning, hypernetworks, data privacy, catastrophic forgetting, task embeddings, neural networks, AI safety, right to be forgotten, ResNet, membership inference, parameter generation

Using a PRISMA-style systematic review methodology, the researchers analyzed papers from the last five years of literature, the period in which privacy attacks against machine learning evolved from academic curiosities into practical threats. Their contribution is not a single new technique but a map of the entire battlefield: a unified taxonomy of attack families, a parallel taxonomy of defenses, recommended evaluation metrics for each attack type, and a reproducibility checklist alongside an attack-by-defense protection matrix that distills the qualitative findings of hundreds of studies into a single comparative view.

The taxonomy of attacks is sobering in its breadth. Membership inference attacks ask a deceptively simple question of a model: was this specific person’s record part of your training data? First demonstrated systematically by Shokri and colleagues in 2017 and refined since through approaches that exploit overfitting, prediction sensitivity, and quantile regression, these attacks now extend even to large language models, recommender systems, graph neural networks, and diffusion models. Model inversion attacks go further, reconstructing representative images or attributes of training classes from a model’s outputs, exploiting the confidence information that models emit so freely. Model extraction attacks steal entire architectures and weights through prediction APIs, converting years of training investment into a target for intellectual property theft as well as privacy abuse.

Perhaps most alarming for the federated learning era is gradient leakage. In collaborative training settings where participants share gradient updates instead of raw data, researchers showed as early as 2019 with the Deep Leakage from Gradients work that those updates can be inverted to reconstruct training inputs almost pixel-perfectly. The survey also covers property and attribute inference, in which adversaries deduce sensitive characteristics of training populations, alongside poisoning and backdoor attacks that corrupt models from within, side-channel attacks that exploit hardware implementations, and a rapidly growing family of large language model specific leakage, including verbatim training data extraction from production models and membership inference against in-context learning.

Against this arsenal, the survey organizes defenses into coherent families. Differential privacy, introduced by Cynthia Dwork in 2006, remains the workhorse: by injecting carefully calibrated noise into gradients during training, typically through the DP-SGD algorithm of Abadi and colleagues, it provides a mathematically provable bound on how much any single individual’s data can influence the model. The literature has spawned refinements including Rényi and Gaussian differential privacy, concentrated variants, adaptive gradient clipping, and privacy accounting improvements, along with integration into generative adversarial networks, Bayesian neural networks, and stochastic gradient Langevin dynamics.

Federated learning itself constitutes a second defense pillar, allowing organizations such as hospitals to train shared models without centralizing patient records, a principle already demonstrated in real multicenter studies for glaucoma detection, skin cancer diagnosis, and medical image analysis. Yet the survey is clear that federated learning alone is not privacy protection: gradient reconstruction, membership inference, and property inference all remain viable against naive federated systems, which is why the pairing with robust and privacy-preserving aggregation rules, secure aggregation protocols, and blockchain-based verification has become an active research frontier.

At the strongest end of the guarantee spectrum sit cryptographic approaches: homomorphic encryption, which permits computation directly on encrypted data, and secure multi-party computation, which distributes computation so no party sees another’s inputs. These techniques offer mathematically rigorous confidentiality, and standardized frameworks from IEEE and ITU now exist to guide their deployment. But the survey’s comparative analysis is unambiguous about the price: cryptographic stacks impose computational and communication overheads that can be orders of magnitude higher than plaintext training, making them practical today mainly for inference workloads, smaller models, or high-stakes domains such as healthcare and finance where the value of the data justifies the cost. Hybrid architectures, such as federated learning combined with homomorphic encryption or differential privacy layered over secure aggregation, attempt to balance these trade-offs.

The authors sharpen their analysis with three case studies covering centralized image classification, federated learning, and large language models. The verdict on the current landscape is nuanced. Noise-based methods such as differential privacy remain the practical baseline, deployable at scale and increasingly efficient, but they offer only partial protection, and their privacy-utility trade-off still forces difficult choices in accuracy-sensitive applications. Cryptographic methods deliver the strongest theoretical guarantees at substantially higher cost. Most urgently, the survey identifies large language model and multimodal leakage as an under-benchmarked gap: while training data extraction and membership inference against language models have been repeatedly demonstrated, standardized evaluation of defenses in this space lags far behind the pace of model deployment.

What makes this survey particularly valuable for practitioners is its insistence on evaluation discipline. For each attack family, the authors recommend specific metrics, recognizing, for example, that membership inference success should be measured against realistic background-knowledge assumptions rather than favorable shadow-model setups, and that privacy claims must be tested against adaptive attackers rather than fixed benchmarks. The reproducibility checklist addresses a chronic weakness of the field, where attack papers and defense papers often use incompatible threat models, making headline claims difficult to compare. The attack-by-defense protection matrix gives system designers a direct way to reason about which combination of techniques addresses which threats, and where residual risk remains.

The stakes of getting this right are rising alongside regulation. Data protection laws around the world increasingly impose concrete obligations on organizations whose models memorize personal information, and the survey situates the technical landscape within this regulatory context, noting that healthcare, finance, and government deployments face the tightest constraints. For the field as a whole, the message is one of guarded optimism paired with urgency. The defensive toolkit is now rich, mathematically grounded, and increasingly practical, and surveys like this one provide the coordination infrastructure the field has lacked. But as models grow larger, more multimodal, and more deeply embedded in everyday services, the attack surface grows with them, and the gap between what can be attacked and what has been rigorously defended remains widest precisely where the data is most personal. Closing that gap, the authors suggest, will require the same systematic, benchmark-driven rigor that this survey brings to mapping the problem.

Subject of Research: Privacy-preserving methodologies and privacy attacks in deep learning

Article Title: Privacy-preserving methodologies against privacy attacks on deep learning: a survey

Article References: Ghosh, S., & Mandal, A. K. (2026). Privacy-preserving methodologies against privacy attacks on deep learning: a survey. Knowledge and Information Systems, 68(1), Article 255. https://doi.org/10.1007/s10115-026-02865-4

Image Credits: AI Generated

DOI: 10.1007/s10115-026-02865-4

Keywords: deep learning, privacy attacks, differential privacy, federated learning, homomorphic encryption, membership inference, model inversion, gradient leakage, large language models, secure multi-party computation, data privacy, machine learning security