The problem, the authors contend, lies in how most generative models treat the awkward mix of data types that defines tabular data. A single row of a medical or financial record typically blends continuous quantities such as blood pressure or income with categorical variables such as diagnosis codes or employment status, and sometimes ordinal variables that have a natural order but no meaningful distance. Most existing pipelines force all of these into a single continuous space, often by embedding categories as vectors. That maneuver is convenient for neural networks, but it comes at a hidden cost: the model can interpolate between discrete states, producing nonsensical halfway points between, say, married and divorced, and blurring the sharp boundaries that give categorical variables their meaning.

Chen and Liu’s answer is to stop pretending everything lives in flat Euclidean space. Their framework, called product manifold flow matching, assigns each variable type to the geometric space that naturally describes it. Continuous variables remain in Euclidean space. Categorical variables are placed on probability simplexes—the geometric objects whose points are valid probability distributions—equipped with the Fisher-Rao metric, a Riemannian geometry that has long been central to information theory. Ordinal variables, meanwhile, live on arcs of unit circles, with monotone categories constrained to an order-preserving arc and periodic categories wrapping around the full circle. The full record is then modeled as a point on the product of these spaces, a composite manifold in which each factor retains its own intrinsic structure.

The generative engine is flow matching, a technique that has rapidly become a workhorse of modern generative modeling, powering state-of-the-art systems in image, audio, and protein generation. In standard flow matching, a neural network learns a velocity field that transports a simple noise distribution to the data distribution along smooth paths. On curved spaces, the straight-line interpolations of the Euclidean setting must be replaced by geodesics—the shortest paths on the manifold—defined through exponential and logarithmic maps. On the Fisher-Rao simplex, the authors show that these geodesics can be computed in closed form by mapping probability distributions onto the positive orthant of a unit sphere via a square-root transformation, running spherical geodesics there, and mapping back. The result is a principled way to morph one categorical distribution into another without ever leaving the space of valid distributions.

Two technical innovations tie the per-variable geometries together. The first is coordinate-wise vector field decomposition: because the Riemannian metric on a product manifold splits into a direct sum of metrics on its factors, the learned velocity field can be decomposed so that each component is processed with the geometry appropriate to its variable type, while each component still depends on the full record. The second is geometry-aware midpoint aggregation, a mechanism for capturing dependencies between variables of different types. The method builds a dependency graph over columns and exchanges information across edges through learned projection operators that translate between geometries—converting a categorical distribution into a continuous representation, or a continuous value into an ordinal position—while guaranteeing that the aggregated result remains a valid point on each target manifold. The authors prove that this aggregation procedure is a contraction mapping, guaranteeing that it converges to a unique fixed point regardless of whether the dependency graph contains cycles.

The empirical evaluation spans twelve benchmark datasets drawn from public repositories including UCI, OpenML, and Kaggle, ranging from small clinical records to an educational dataset with more than 101 million samples. Across these benchmarks, the geometric approach delivers measurable improvements in generation quality, with the largest gains appearing on datasets dominated by categorical variables and on the largest-scale data. The evaluation uses standard metrics for synthetic tabular data, including Wasserstein distances between marginal distributions and divergence measures of joint fidelity, and per-seed results reported in the paper’s appendices indicate that the improvements are stable across repeated runs rather than artifacts of a lucky initialization.

Perhaps the most striking claim concerns privacy. A persistent fear in synthetic data is memorization: a generative model that simply reproduces training records offers no privacy protection at all, a failure mode exposed by distance-to-closest-record tests and membership inference attacks, which attempt to determine whether a specific individual’s data was used in training. The authors report that the geometric constraints of their framework confer empirical resistance to memorization without any explicit noise injection. Because the model is confined to geodesic paths on curved spaces—never allowed to drift through the interpolations of an ambient continuous embedding—it appears less prone to latching onto individual training examples. The paper is careful to frame this as an empirical observation measured by standard privacy metrics rather than a formal guarantee, but it suggests that respecting data geometry may do quiet protective work that practitioners currently try to achieve with added noise.

Efficiency is a further selling point. The coordinate-wise structure of the model means that per-variable computations can run in parallel, and the authors report that the approach scales well to very large datasets, including the 101-million-row educational benchmark. This matters because the field’s most accurate generative models have often been its slowest, and a method that combines geometric fidelity with parallelizable computation could be practical in settings where retraining on fresh data is routine. The authors have released all source code and configuration files on GitHub, and every benchmark dataset is publicly available, making the work unusually reproducible for a subfield where comparisons are often muddied by private preprocessing.

The study arrives at a moment when tabular data generation is under pressure from multiple directions. Regulators in healthcare and finance are scrutinizing how synthetic data is produced and what protections it actually affords, while the machine learning community is debating whether large language models, diffusion models, or specialized architectures best handle the idiosyncrasies of spreadsheet-like data. Chen and Liu’s contribution does not settle that contest, but it reframes it: instead of asking which continuous embedding trick best disguises discrete structure, it asks what happens when discrete structure is respected from the start. Their answer, backed by theory, benchmarks, and a contraction proof, is that geometry is not a constraint to be engineered around but a resource to be exploited.

For the industries that stand to benefit, the implications are concrete. A hospital could generate realistic but artificial patient cohorts for research without exposing individual records; a bank could stress-test models against synthetic portfolios that preserve the joint statistics of real ones. If geometric fidelity translates into both better utility and stronger resistance to memorization, the trade-off that has long haunted synthetic data—realism versus privacy—may prove less inevitable than it once seemed. The spreadsheet, it turns out, has a hidden geometry, and learning to walk its curved surfaces may be the key to generating data that is both useful and safe.

Subject of Research: Geometric flow matching for generating mixed-type synthetic tabular data

Article Title: Product Manifold Flow Matching for Mixed-Type Tabular Data Generation

Article References: Chen, S., & Liu, Y. (2026). Product Manifold Flow Matching for Mixed-Type Tabular Data Generation. Machine Learning, 115(10), Article 248. https://doi.org/10.1007/s10994-026-07178-9

Image Credits: AI Generated

DOI: 10.1007/s10994-026-07178-9

Keywords: flow matching, product manifolds, tabular data generation, synthetic data, Fisher-Rao geometry, categorical data, geometric deep learning, privacy, membership inference, Riemannian manifolds, machine learning, generative models

The core problem the study addresses is what the author calls rare-disease spillover. When an unlearning procedure is applied to a medical image classifier, the update does not merely erase the targeted records. Gradient-based deletion methods reshape the model’s internal decision boundaries, and those boundaries are often far more fragile for minority classes — the rare diagnoses that appear in only a handful of training images — than for common ones. A model can lose a substantial fraction of its rare-class accuracy while its aggregate F1 score, the metric most dashboards report, barely moves. The study formalizes this discrepancy with a statistic called the Rare-Disease Spillover Index, or RDSI, which measures the differential change in utility experienced by rare classes relative to the model’s overall performance after an unlearning update. Crucially, the author frames the RDSI as a reporting convention rather than an independent source of information, a deliberate design choice meant to prevent the statistic from being treated as a standalone certification of safety.

The experimental evidence is stark. Working with HAM10000, a widely used openly available dataset of dermatoscopic images of pigmented skin lesions, the study used a fixed lesion-disjoint partition — meaning images from the same patient’s lesion never straddle the training and evaluation sets, a detail that matters enormously in dermatology where multiple images of one lesion can otherwise inflate apparent performance. On this partition, an aggressive gradient-ascent unlearning method known as NegGrad produced an F1-based RDSI of 0.373, with a paired lesion-bootstrap confidence interval of [0.291, 0.449]. In plain terms, the rare classes suffered a large and statistically robust drop in utility that would be invisible in aggregate metrics. By contrast, ordinary retraining on the retained data alone — the naive baseline of simply rebuilding the model without the deleted records — yielded an RDSI of just 0.052, with an interval spanning [-0.014, 0.114] that includes zero. The gap between these two numbers carries the study’s central message: how successfully a model forgets and how much collateral damage it inflicts are two separate questions that demand separate assessment.

This distinction has direct regulatory weight. Privacy frameworks such as the GDPR and emerging AI governance rules treat data deletion as a compliance obligation, and unlearning methods are attractive precisely because retraining a large clinical model from scratch for every deletion request is expensive and slow. But the audit shows that a fast unlearning update can satisfy the letter of a deletion request while quietly degrading the model’s clinical value for the patients who need it most. Rare diagnoses — unusual skin cancers, uncommon radiographic findings — are exactly the cases where clinical AI assistance is most valuable and where the training data is thinnest. A deletion procedure that erodes rare-class performance is therefore not a neutral maintenance operation; it is a potential patient-safety event that no current compliance checklist would catch.

The study does not stop at diagnosis. It also evaluates a mitigation strategy that combines two ideas: rare replay, in which a small, carefully chosen set of retained rare-class examples is revisited during the unlearning update to anchor the model’s rare-class behavior, and prototype anchoring, a technique borrowed from few-shot learning research in which class prototypes — averaged feature representations — serve as reference points that stabilize the encoder’s representation of rare categories. The illustrated replay-plus-anchor update achieved a test macro-F1 of 0.675 with a standard deviation of 0.020 across seeds, and a rare macro-F1 of 0.624 with a standard deviation of 0.038. For comparison, fresh retain-only retraining with the same rare-class-weighted loss function reached only a rare macro-F1 of 0.460 with a standard deviation of 0.029. The mitigation update also achieved a forget-set accuracy of 0.975 with a standard deviation of 0.014, versus 0.750 with a standard deviation of 0.020 for matched retraining — a number that, counterintuitively, signals residual predictive behavior on the forgotten images rather than successful deletion.

That last point deserves unpacking, because it reveals a subtle trap in unlearning evaluation. High accuracy on a forget set sounds like good news if you are measuring utility, but in the unlearning context it is a red flag: a model that still classifies deleted images accurately has not truly forgotten them. The study complements its utility comparisons with uniform probability distances, confidence diagnostics, and a retain-forget membership inference analysis — an adversarial test that asks whether an attacker can distinguish images the model trained on from images it did not. Successful unlearning should collapse that separability, making deleted records indistinguishable from never-seen ones. By pairing utility metrics with deletion-fidelity metrics, the audit framework forces both questions to be answered simultaneously, exposing methods that look safe on one axis while failing on the other.

Perhaps the most sobering result concerns the limits of the mitigation itself. In paired centroid-source controls, a retain-only encoder achieved a rare macro-F1 of 0.592 with a standard deviation of 0.033, compared with 0.608 with a standard deviation of 0.040 for the full-data encoder and 0.572 with a standard deviation of 0.022 for replay alone. In other words, simply matching the rare replay data does not reproduce the operating point achieved by the full mitigation pipeline, and swapping the anchor reference produced only a modest, uncertain incremental gain in utility. The author is candid about this: the mitigation is illustrative, not a finished prescription. The deeper contribution is the audit structure itself — raw class utilities, paired uncertainty quantification through lesion-level bootstrapping, and explicit retraining controls that let practitioners distinguish genuine rare-class preservation from artifacts of the evaluation setup.

The study also looked beyond dermatology, testing external chest-radiograph effects using openly available data from ChestX-ray14 and a credentialed subset drawn from MIMIC-CXR-JPG. There, the spillover effects were modest and heterogeneous, suggesting that the severity of rare-disease collateral damage depends on the dataset, the class structure, and the unlearning method. That heterogeneity is itself an argument for the audit: there is no universal safety margin that a hospital can assume when a model update deletes data. Each deletion event, on each deployed model, needs its own paired assessment of what was lost and whether the loss falls disproportionately on rare conditions.

What makes the work unusually verifiable is its commitment to reproducibility. The full pipeline — partitioning, training, unlearning, mitigation, auditing, and every reported calculation — is archived on Zenodo under an MIT license, complete with fixed split manifests, per-seed results, bootstrap distributions, and compact per-image predictions. The reported numbers can be recomputed without images, GPUs, or model checkpoints, and the credentialed chest-radiograph components are handled through identifiers and reconstruction scripts rather than redistributed data. In a field where unlearning claims are often difficult to check, this level of transparency sets a practical standard.

The broader implication is that healthcare AI needs a maintenance discipline analogous to pharmacovigilance. Models are not static artifacts; they are edited throughout their deployment lives as privacy requests arrive, datasets are corrected, and regulations evolve. The study’s framework treats each such edit as a potential safety event requiring a structured audit: measure raw per-class utilities before and after, quantify uncertainty at the level of correlated patient clusters, run explicit retraining controls, test deletion fidelity against membership inference, and report rare-class spillover alongside aggregate performance. As medical AI systems move from research demos into clinical infrastructure, the question is no longer only whether a model can forget on command, but whether the rest of the model — and the rare patients it serves — survives the forgetting intact. This audit provides the first systematic vocabulary for asking that question, and a reproducible toolkit for answering it.

Subject of Research: Machine unlearning safety in healthcare AI, focusing on rare-disease performance degradation and mitigation

Article Title: Rare-disease spillover after medical AI unlearning: a safety audit and mitigation framework for healthcare model maintenance

Article References: Kinalioglu, I. H. (2026). Rare-disease spillover after medical AI unlearning: a safety audit and mitigation framework for healthcare model maintenance. International Journal of Data Science and Analytics, 22(1), Article 342. https://doi.org/10.1007/s41060-026-01329-w

Image Credits: AI Generated

DOI: 10.1007/s41060-026-01329-w

Keywords: machine unlearning, healthcare AI, rare diseases, dermoscopy, HAM10000, membership inference, model maintenance, data deletion, medical imaging, safety audit, class imbalance, deep learning

The work, authored by Chaofan Shen, Mingyu Wang, and Jing Zhang of Southeast University’s School of Cyber Science and Engineering in Nanjing, addresses a gap that has frustrated researchers since machine unlearning emerged as a field. Full retraining from scratch after every deletion request is the gold standard for forgetting, but it is prohibitively expensive for large graphs and models that may need to serve thousands of erasure requests. Approximate unlearning methods promise speed, yet existing approaches fall into camps with distinct weaknesses. Some partition the graph so that deleting a shard leaves the rest of the model untouched, but this disrupts the very structure that makes graph learning powerful. Others approximate removal directly in parameter space, editing weights with influence functions or closed-form corrections, but they can leave residual traces of deleted data. Still others rely on fixed neighborhoods when updating predictions, which cannot capture the fact that some nodes are far more sensitive to a deletion than others.

SURGE’s central insight is conceptual: a deletion request is fundamentally a prediction-level structural perturbation. When an edge disappears from a citation network, the predictions for nodes near that edge shift in ways that depend on how information propagates through the graph. Rather than guessing which parameters to edit, SURGE asks how the model’s outputs would change if the requested data were genuinely removed, and then repairs the model to match that ideal. The framework unfolds in three stages that the authors describe as Sense, Repair, and Distill.

In the sensing stage, SURGE estimates a continuous response field over all nodes in the graph. Instead of treating every node identically, the response field quantifies how strongly each node’s prediction is affected by the structural change introduced by the deletion. Nodes directly connected to removed data register strong responses; distant nodes register weak ones. This continuous, per-node characterization is what allows the method to express heterogeneous node sensitivity, something the authors argue fixed-neighborhood schemes cannot do. The response field effectively becomes a map of where forgetting must be deep and where it can be gentle.

The repair stage then solves for corrected logits, the raw pre-softmax outputs of the classifier, across the graph. Crucially, this is formulated as a graph-regularized optimization problem that is solved without backpropagation. Rather than running gradient descent through the network, SURGE draws on techniques from numerical linear algebra for sparse systems, computing corrections that respect both the deletion constraints and the smoothness structure of the graph. The graph regularizer ensures that corrected predictions remain coherent with their neighbors, preventing the kind of fragmented, inconsistent outputs that can arise when unlearning methods patch predictions locally. Because no gradients flow through the deep network, the repair step avoids the cost and instability of fine-tuning while still producing outputs that approximate what full retraining would yield.

The final stage, distillation, transfers the corrected knowledge back into the model. Knowledge distillation, a technique originally popularized for compressing large teacher networks into smaller students, is repurposed here as a forgetting mechanism. But SURGE adapts it: the distillation is response-adaptive, meaning the influence of the corrected teacher predictions on each node is weighted by that node’s position in the response field. Nodes that were strongly perturbed by the deletion receive aggressive correction, while nodes barely affected are nudged only lightly, preserving their original utility. This residual distillation is what gives the method its name and its balance between two competing goals: erasing the influence of deleted data and retaining accuracy on everything that remains.

The empirical case for SURGE rests on an unusually rigorous evaluation design. The authors tested the framework across seven standard benchmarks, including widely used citation corpora such as Cora, CiteSeer, and PubMed alongside larger graphs, and across multiple graph neural network backbones, including graph convolutional networks and graph attention networks. They evaluated three distinct deletion types: node unlearning, edge unlearning, and feature unlearning, covering the full range of erasure requests a deployed system might receive. To eliminate luck from the comparison, they ran a matched 18-cell evaluation spanning deletion types, datasets, backbones, and ten random seeds per configuration, comparing SURGE against three established baselines: ETR, an erase-then-rectify parameter editing approach; MEGU, a mutual-evolution unlearning method; and IDEA, a framework for certified graph unlearning.

The results are striking. Across the matched evaluation, SURGE achieved the highest mean micro-F1 score of 0.8632, indicating that models unlearned with SURGE retained the most predictive power on retained data. It also achieved the best retraining faithfulness, measured as a test Jensen-Shannon divergence of just 0.0243 against models retrained from scratch, meaning its post-deletion predictions stayed closest to the gold standard of full retraining. In other words, SURGE did not trade forgetting quality for utility or vice versa; it led on both axes simultaneously. The Jensen-Shannon divergence metric, rooted in Shannon entropy theory, provides a symmetric measure of how two probability distributions diverge, making it a natural yardstick for how faithfully an unlearned model mimics its fully retrained counterpart. An additional ablation study on ogbn-arxiv, a large-scale graph from the Open Graph Benchmark with millions of nodes, further supports the method’s scalability, suggesting the approach is not confined to small academic datasets.

The broader significance of this work lies at the intersection of privacy regulation and the economics of deployed AI. Membership inference attacks, demonstrated in influential security research over the past decade, can often detect whether a specific record was part of a model’s training data, turning residual traces into genuine privacy liabilities. As graph neural networks increasingly underpin systems that process personal relationships, transactions, and social connections, the ability to provably and efficiently remove an individual’s data becomes a compliance necessity rather than an academic curiosity. SURGE’s response-field formulation offers a template that could generalize: sense how a data change propagates, repair predictions to match the ideal, and distill the repair back into the model, all without the expense of retraining.

There remain open questions, as with any approximate unlearning method. The framework’s guarantees are empirical rather than cryptographic, and the field continues to debate what level of assurance suffices for regulatory compliance. Certified unlearning approaches offer stronger theoretical promises but often at greater cost or with more restrictive assumptions. Still, the combination of leading utility, near-retraining faithfulness, backbone-agnostic design, and demonstrated scalability on a graph the size of ogbn-arxiv positions SURGE as one of the most complete graph unlearning solutions reported to date. Funded by the Basic Research Program of Jiangsu, the study signals that the era of treating forgetting as an afterthought in graph machine learning is coming to an end. As deletion requests multiply and regulators sharpen their scrutiny, methods that let models forget precisely, quickly, and faithfully may become as fundamental to trustworthy AI as the training algorithms themselves.

Subject of Research: Efficient removal of nodes, edges, and features from trained graph neural networks without full retraining

Article Title: SURGE: Structural Perturbation Response Field Guided Residual Distillation for Graph Unlearning

Article References: Shen, C., Wang, M., & Zhang, J. (2026). SURGE: Structural Perturbation Response Field Guided Residual Distillation for Graph Unlearning. Machine Learning, 115(10), Article 239. https://doi.org/10.1007/s10994-026-07176-x

Image Credits: AI Generated

DOI: 10.1007/s10994-026-07176-x

Keywords: graph unlearning, graph neural networks, machine unlearning, knowledge distillation, privacy, GDPR, data deletion, response field, Jensen-Shannon divergence, ogbn-arxiv, membership inference, Machine Learning journal

The research, led by Sayanta Adhikari, Vishnuprasadh Kumaravelu, and P. K. Srijith of the Bayesian Reasoning and Inference Lab at the Indian Institute of Technology Hyderabad, introduces a framework called UnCLe, short for a Hypernetwork Framework for Data-Free Unlearning and Continual Learning. The core insight is that machine unlearning—the deliberate removal of a task’s influence from a trained model—has almost always been designed with offline training in mind, where engineers retain full access to the original dataset. In continual learning, that assumption collapses. Data arrives task by task and is typically discarded after use, so when an unlearning request arrives, the original examples may simply no longer exist.

The team identified two failure modes that emerge when conventional unlearning is naively applied to continual learning environments. The first is catastrophic forgetting of retained tasks, a well-known pathology in which updating a network to remove one capability wipes out unrelated capabilities it was supposed to keep. The second is subtler and, in some ways, more troubling: catastrophic remembering, in which tasks that were supposedly unlearned resurface when the model later absorbs new information. A model that appears to have forgotten sensitive data can effectively relapse, undermining the very privacy guarantees that unlearning is meant to provide.

UnCLe attacks both problems by restructuring how the model’s parameters are produced in the first place. Instead of training a single monolithic network, the framework employs a hypernetwork—a network that generates the weights of another network—conditioned on compact task embeddings. Each task the system encounters is represented by its own embedding vector, and the hypernetwork maps that embedding to a full set of task-specific parameters. Learning a new task therefore means learning or refining an embedding, while the shared hypernetwork machinery remains stable across the entire sequence of operations.

Unlearning under this scheme becomes elegantly simple at the task level. To remove a task, the framework optimizes the hypernetwork so that, for that task’s embedding, it generates parameters that behave like noise. The generated network produces uniform, maximum-entropy outputs on the forgotten task—in other words, the model becomes maximally uncertain, exactly as if it had never seen the task at all. Crucially, this procedure does not require the original training data, which is precisely what makes it data-free. The optimization is guided by a mean squared error objective that pulls the generated parameters toward freshly sampled Gaussian noise, combined with a regularization term that anchors the hypernetwork’s outputs for all previously retained tasks, preventing collateral damage.

The choice of a noise-matching objective, rather than a direct norm penalty, turns out to matter a great deal. The authors show mathematically that averaging the squared distance to random Gaussian samples converges to the squared L2 norm of the parameters plus a constant, meaning the MSE objective implicitly drives the forgotten task’s parameters toward zero and its outputs toward a uniform distribution. But applying the L2 norm directly would, over repeated unlearning operations, drag the hypernetwork’s own shared weights toward zero and destabilize the whole system. By contrast, sampling a fresh noise target at each optimization step constrains the forget task only in distribution, acting as an implicit regularizer that preserves the shared representation. The researchers compared alternatives—including fixed noise targets, pure norm reduction, and simply discarding the task embedding—and found their approach achieved the best balance between erasing the target task and protecting retained performance.

Scaling a hypernetwork to generate all the weights of a modern convolutional backbone such as ResNet18 or ResNet50 presents its own engineering challenge, since the hypernetwork’s output layer would otherwise balloon to an impractical size. The team’s solution is chunked generation: the main network’s parameters are partitioned into roughly 200 chunks, each produced by a dedicated head of the hypernetwork conditioned on a unique chunk embedding concatenated with the task embedding. These chunk embeddings are frozen after the first task to guard against forgetting, and the final layer is split into specialized heads for weights, batch normalization parameters, and residual connection parameters, reducing redundancy and computational overhead.

The practical consequences of this design are striking. Because unlearning operates entirely in parameter space, its computational cost is dominated by the hypernetwork’s forward and backward passes and is essentially independent of dataset size and class count. The only term that grows over a sequence is the regularization over retained tasks, and it grows linearly in the number of tasks, not data points. In conventional replay-based unlearning adapted to continual settings, by contrast, the cost scales with a replay buffer whose size is difficult to budget in advance. The researchers also introduced an annealing strategy that shrinks the burn-in phase of each unlearning operation by ten percent per operation, exploiting forward transfer to cut unlearning time without degrading quality.

Empirical evaluations across sequential vision benchmarks—including Permuted-MNIST, a five-dataset suite combining MNIST, Fashion-MNIST, KMNIST, notMNIST and SVHN, CIFAR-100, and TinyImageNet—showed that UnCLe can perform long interleaved sequences of learning and unlearning requests, up to 30 operations on TinyImageNet, with minimal disruption to previously acquired knowledge. Measured against baselines including fine-tuning, retraining from scratch, and hypernetwork variants that rely on natural catastrophic forgetting, UnCLe performed on par or better across metrics, and strictly better on three of five measures with a ResNet-18 backbone. It also achieved membership inference attack accuracy closest to the ideal fifty percent, a key indicator that forgotten data is genuinely indistinguishable from never-seen data—a central concern for privacy.

Perhaps most importantly for real-world deployment, UnCLe prevented the relapse phenomenon that plagues conventional approaches: tasks unlearned by prior methods tend to creep back once new learning occurs, whereas UnCLe’s unlearned tasks stayed forgotten even as subsequent tasks were absorbed. The authors argue this has broad implications for responsible AI governance, from honoring the right to be forgotten under data protection law to stripping biased or harmful behaviors from deployed models without full retraining. At the same time, they caution that the very possibility of relapse under weaker methods underscores the need for robust verification mechanisms. With code released publicly, the framework offers a template for AI systems that can keep learning throughout their operational life while remaining accountable to demands that they forget on command.

Subject of Research: A hypernetwork framework enabling data-free machine unlearning within continual learning settings

Article Title: A Hypernetwork Framework for Data-Free Unlearning and Continual Learning

Article References: Adhikari, S., Kumaravelu, V., & Srijith, P. K. (2026). A Hypernetwork Framework for Data-Free Unlearning and Continual Learning. Machine Learning, 115(9), Article 219. https://doi.org/10.1007/s10994-026-07125-8

Image Credits: AI Generated

DOI: 10.1007/s10994-026-07125-8

Keywords: machine unlearning, continual learning, hypernetworks, data privacy, catastrophic forgetting, task embeddings, neural networks, AI safety, right to be forgotten, ResNet, membership inference, parameter generation

Using a PRISMA-style systematic review methodology, the researchers analyzed papers from the last five years of literature, the period in which privacy attacks against machine learning evolved from academic curiosities into practical threats. Their contribution is not a single new technique but a map of the entire battlefield: a unified taxonomy of attack families, a parallel taxonomy of defenses, recommended evaluation metrics for each attack type, and a reproducibility checklist alongside an attack-by-defense protection matrix that distills the qualitative findings of hundreds of studies into a single comparative view.

The taxonomy of attacks is sobering in its breadth. Membership inference attacks ask a deceptively simple question of a model: was this specific person’s record part of your training data? First demonstrated systematically by Shokri and colleagues in 2017 and refined since through approaches that exploit overfitting, prediction sensitivity, and quantile regression, these attacks now extend even to large language models, recommender systems, graph neural networks, and diffusion models. Model inversion attacks go further, reconstructing representative images or attributes of training classes from a model’s outputs, exploiting the confidence information that models emit so freely. Model extraction attacks steal entire architectures and weights through prediction APIs, converting years of training investment into a target for intellectual property theft as well as privacy abuse.

Perhaps most alarming for the federated learning era is gradient leakage. In collaborative training settings where participants share gradient updates instead of raw data, researchers showed as early as 2019 with the Deep Leakage from Gradients work that those updates can be inverted to reconstruct training inputs almost pixel-perfectly. The survey also covers property and attribute inference, in which adversaries deduce sensitive characteristics of training populations, alongside poisoning and backdoor attacks that corrupt models from within, side-channel attacks that exploit hardware implementations, and a rapidly growing family of large language model specific leakage, including verbatim training data extraction from production models and membership inference against in-context learning.

Against this arsenal, the survey organizes defenses into coherent families. Differential privacy, introduced by Cynthia Dwork in 2006, remains the workhorse: by injecting carefully calibrated noise into gradients during training, typically through the DP-SGD algorithm of Abadi and colleagues, it provides a mathematically provable bound on how much any single individual’s data can influence the model. The literature has spawned refinements including Rényi and Gaussian differential privacy, concentrated variants, adaptive gradient clipping, and privacy accounting improvements, along with integration into generative adversarial networks, Bayesian neural networks, and stochastic gradient Langevin dynamics.

Federated learning itself constitutes a second defense pillar, allowing organizations such as hospitals to train shared models without centralizing patient records, a principle already demonstrated in real multicenter studies for glaucoma detection, skin cancer diagnosis, and medical image analysis. Yet the survey is clear that federated learning alone is not privacy protection: gradient reconstruction, membership inference, and property inference all remain viable against naive federated systems, which is why the pairing with robust and privacy-preserving aggregation rules, secure aggregation protocols, and blockchain-based verification has become an active research frontier.

At the strongest end of the guarantee spectrum sit cryptographic approaches: homomorphic encryption, which permits computation directly on encrypted data, and secure multi-party computation, which distributes computation so no party sees another’s inputs. These techniques offer mathematically rigorous confidentiality, and standardized frameworks from IEEE and ITU now exist to guide their deployment. But the survey’s comparative analysis is unambiguous about the price: cryptographic stacks impose computational and communication overheads that can be orders of magnitude higher than plaintext training, making them practical today mainly for inference workloads, smaller models, or high-stakes domains such as healthcare and finance where the value of the data justifies the cost. Hybrid architectures, such as federated learning combined with homomorphic encryption or differential privacy layered over secure aggregation, attempt to balance these trade-offs.

The authors sharpen their analysis with three case studies covering centralized image classification, federated learning, and large language models. The verdict on the current landscape is nuanced. Noise-based methods such as differential privacy remain the practical baseline, deployable at scale and increasingly efficient, but they offer only partial protection, and their privacy-utility trade-off still forces difficult choices in accuracy-sensitive applications. Cryptographic methods deliver the strongest theoretical guarantees at substantially higher cost. Most urgently, the survey identifies large language model and multimodal leakage as an under-benchmarked gap: while training data extraction and membership inference against language models have been repeatedly demonstrated, standardized evaluation of defenses in this space lags far behind the pace of model deployment.

What makes this survey particularly valuable for practitioners is its insistence on evaluation discipline. For each attack family, the authors recommend specific metrics, recognizing, for example, that membership inference success should be measured against realistic background-knowledge assumptions rather than favorable shadow-model setups, and that privacy claims must be tested against adaptive attackers rather than fixed benchmarks. The reproducibility checklist addresses a chronic weakness of the field, where attack papers and defense papers often use incompatible threat models, making headline claims difficult to compare. The attack-by-defense protection matrix gives system designers a direct way to reason about which combination of techniques addresses which threats, and where residual risk remains.

The stakes of getting this right are rising alongside regulation. Data protection laws around the world increasingly impose concrete obligations on organizations whose models memorize personal information, and the survey situates the technical landscape within this regulatory context, noting that healthcare, finance, and government deployments face the tightest constraints. For the field as a whole, the message is one of guarded optimism paired with urgency. The defensive toolkit is now rich, mathematically grounded, and increasingly practical, and surveys like this one provide the coordination infrastructure the field has lacked. But as models grow larger, more multimodal, and more deeply embedded in everyday services, the attack surface grows with them, and the gap between what can be attacked and what has been rigorously defended remains widest precisely where the data is most personal. Closing that gap, the authors suggest, will require the same systematic, benchmark-driven rigor that this survey brings to mapping the problem.

Subject of Research: Privacy-preserving methodologies and privacy attacks in deep learning

Article Title: Privacy-preserving methodologies against privacy attacks on deep learning: a survey

Article References: Ghosh, S., & Mandal, A. K. (2026). Privacy-preserving methodologies against privacy attacks on deep learning: a survey. Knowledge and Information Systems, 68(1), Article 255. https://doi.org/10.1007/s10115-026-02865-4

Image Credits: AI Generated

DOI: 10.1007/s10115-026-02865-4

Keywords: deep learning, privacy attacks, differential privacy, federated learning, homomorphic encryption, membership inference, model inversion, gradient leakage, large language models, secure multi-party computation, data privacy, machine learning security