Stable Multimodal Graph Unlearning via Feature-Dimension Aware Quantile Selection

Abstract: Graph unlearning remains a critical technique for supporting privacy-preserving and sustainable multimodal graph learning. However, we observe that existing unlearning strategies tend to apply uniform parameter selection and editing across all graph neural network (GNN) layers, which is especially harmful for multimodal graphs where high-dimensional input projections encode dominant cross-modal knowledge. As a result, over-editing these sensitive layers often leads to catastrophic utility degradation after forgetting, undermining both stable learning and effective privacy protection. To address this gap, we propose FDQ, a Feature-Dimension Aware Quantile framework for multimodal graph unlearning. FDQ adaptively identifies high-dimensional input projection layers and applies more conservative, FDQ-guided quantile thresholds when constructing suppression sets, while keeping the underlying importance estimation mechanism unchanged. FDQ is seamlessly integrated with diagonal sensitivity-based parameter importance analysis to enable efficient node and edge unlearning under general forget requests. Through extensive experiments on Ele-Fashion and Goodreads-NC, we demonstrate that FDQ consistently achieves strong utility preservation while maintaining effective forgetting against membership inference attacks. Overall, FDQ offers a principled and robust solution for privacy-aware unlearning in high-dimensional multimodal graph systems.

• The paper introduces Feature-Dimension Aware Quantile (FDQ) selection, which tightens parameter-editing thresholds for wide input projections to prevent excessive modification of pretrained multimodal features.
• FDQ achieves up to 82.91% unlearning F1 on Goodreads-NC, outperforming strong baselines by roughly 4–5 points while keeping membership-inference results near random guessing.
• The method performs training-free unlearning in about 0.54–0.93 seconds on Ele-Fashion and 3.4–4.0 seconds on Goodreads-NC, though it remains sensitive to dataset-specific hyperparameters and lacks formal certification.

Motivation and problem statement

Graph unlearning removes the influence of specified nodes or edges from a trained GNN without full retraining, a capability mandated in practice by the GDPR's "right to be forgotten." The authors observe that mainstream unlearning methods—partition-based GraphEraser, certified IDEA, learning-based MEGU and GNNDelete, and parameter-editing ETR—are designed for unimodal or low-dimensional features, and degrade severely when applied to multimodal graphs whose node features come from encoders such as CLIP, ImageBind, T5+ViT, or T5+DINOv2 (feature dimensions of 1024–2048). The root cause they identify is structural: input projection matrices $W_{\text{in}} \in \mathbb{R}^{h \times d}$ dominate the parameter count when $d \gg h_{\text{hid}}$, so any uniform quantile-based selection rule edits a disproportionately large fraction of these layers. Because these projections encode pre-trained cross-modal knowledge, such over-editing causes catastrophic utility degradation on retained data.

The FDQ mechanism

FDQ (Feature-Dimension Aware Quantile) addresses this imbalance without changing the underlying importance estimation. Parameters are partitioned into input-projection layers $\theta_{\text{in}}$ (matrices with shape $m_\ell \times d$) and deeper layers $\theta_{\text{deep}}$. For each layer $\ell$, a scaling factor is defined:

$$\alpha^{(\ell)} = \begin{cases} \max(\rho,\; k_{\min}/k), & d \ge \tau \;\land\; W^{(\ell)} \in \theta_{\text{in}} \ 1, & \text{otherwise} \end{cases}$$

and the effective quantile is $k_{\text{eff}}^{(\ell)} = \alpha^{(\ell)} \cdot k$, where $\rho \in (0,1)$ is the tightening ratio, $k_{\min}$ a lower bound, and $d \gg h_{\text{hid}}$0 a feature-dimension threshold. Since $d \gg h_{\text{hid}}$1 on input layers, the selected suppression set satisfies $d \gg h_{\text{hid}}$2, enforcing sparser edits exactly where pre-trained multimodal representations reside. The paper derives the necessity argument from the parameter ratio $d \gg h_{\text{hid}}$3, which becomes substantial for high-dimensional inputs; this makes uniform quantiles structurally biased toward editing $d \gg h_{\text{hid}}$4.

Integrated unlearning pipeline

FDQ is paired with diagonal Fisher Information Matrix (FIM) approximation, where per-parameter importance on a node set $d \gg h_{\text{hid}}$5 is estimated by average squared gradients—a tractable surrogate for the full FIM, which is quadratic in parameter count. For node unlearning, three importance vectors are computed on the training set, forget set, and the $d \gg h_{\text{hid}}$6-hop neighbor set of forget nodes (capturing message-passing influence). Two element-wise suppression scores are formed: $d \gg h_{\text{hid}}$7 (small values indicate forget-set specialization) and $d \gg h_{\text{hid}}$8, which additionally penalizes parameters important to both forget nodes and their neighbors. Parameters below FDQ-adjusted quantile thresholds on either score are dampened multiplicatively by their score-to-threshold ratio, capped at a maximum factor $d \gg h_{\text{hid}}$9. For edge unlearning, the influenced node set (edge endpoints plus their $\theta_{\text{in}}$0-hop neighborhoods) approximates the edge's effect, and a single ratio score drives selection and scaling. The pipeline is training-free and requires no access to raw data beyond gradient computations.

Experimental results

Evaluation uses two MM-GRAPH benchmark datasets: Ele-Fashion (97,766 nodes, 199,602 edges) and Goodreads-NC (685,294 nodes, 7,235,084 edges), both with 11 classes and text-plus-image features under four encoder combinations. Experiments use an 8/2 split, 10% forgetting ratio, SAGE backbone (best among GCN/GAT/SAGE), and 10 random seeds.

Utility preservation: FDQ achieves the best unlearning F1 in nearly all settings. On Goodreads-NC under node unlearning, FDQ reaches 82.68–82.91% across encoders versus 78.08% for the strongest baseline (IDEA with CLIP), a gain of roughly 4–5 points; GNNDelete collapses to 52–62% and encounters OOM failure with ImageBind features at this scale. Under edge unlearning on Goodreads-NC, FDQ attains 80.28–83.15%, again leading all baselines. The larger margins on Goodreads-NC than Ele-Fashion indicate that FDQ's benefit grows with graph scale and multimodal complexity.

Forgetting effectiveness: MIA AUC-ROC under the MIA-Graph threat model stays close to the 50% random-guess level for FDQ across encoder settings, whereas GNNDelete shows systematically elevated AUC, indicating residual membership signals. Under poisoning attacks on edges, FDQ maintains high post-unlearning F1 comparable to ETR, while GNNDelete and MEGU show notable drops from poisoned to unlearned performance.

Efficiency: FDQ completes unlearning sub-second on Ele-Fashion (0.54–0.93 s) and within ~3.4–4.0 s on Goodreads-NC. It is slower than ETR (training-free two-stage editing) but substantially faster than partition-based methods (BLPA/BEKM take 21–76 s and 133–232 s respectively, excluding partition construction overhead), ScaleGUN, and GNNDelete.

Ablations: Removing feature-dimension awareness (uniform quantile over FIM scores) costs up to ~9.6 F1 points on Goodreads-NC (e.g., 82.85 → 75.62 with T5+ViT); replacing quantile-tail selection with a Fisher-ratio threshold test ($\theta_{\text{in}}$1) costs up to ~12.9 points (82.85 → 69.99). Notably, neither ablated variant uniformly dominates the other—for instance, w/o Qtl. slightly exceeds w/o FD on Ele-Fashion with T5+DINOv2—so the relative ordering of uniform quantiles versus ratio-thresholding depends on encoder and dataset context.

Hyperparameter sensitivity: Optimal base quantiles are moderate ($\theta_{\text{in}}$2 on Ele-Fashion, $\theta_{\text{in}}$3 on Goodreads-NC), and tightening ratios peak around $\theta_{\text{in}}$4 (Ele-Fashion) and $\theta_{\text{in}}$5 (Goodreads-NC); overly small $\theta_{\text{in}}$6 makes edits too conservative, while large $\theta_{\text{in}}$7 forfeits the protection of wide input projections.

Limitations and open questions

The paper concedes that FDQ is sensitive to hyperparameters governing edit strength ($\theta_{\text{in}}$8) and dimension-aware calibration ($\theta_{\text{in}}$9, $m_\ell \times d$0, $m_\ell \times d$1), which may require per-dataset tuning; indeed, the reported optima differ between the two datasets. Evaluation is confined to node classification tasks on two datasets from a single benchmark, with a fixed 10% forgetting ratio, so behavior under varying forget-set sizes, other tasks (link prediction, KG completion), or non-homophilous graphs remains unexamined. The diagonal FIM approximation trades fidelity for scalability, and no certification guarantee is provided, in contrast to IDEA's certified framework. Whether the quantile mechanism transfers to architectures without a distinct wide input projection (e.g., GNN-LM hybrids) is left open.

Conclusion

FDQ identifies a structural failure mode of existing graph unlearning methods on multimodal graphs—uniform parameter selection over-editing parameter-dominant input projections—and corrects it with a lightweight, layer-wise quantile tightening rule layered on top of unchanged diagonal FIM importance estimation. Across two multimodal benchmarks and four encoder configurations, it delivers state-of-the-art utility retention, near-random MIA resistance, robustness to poisoned edges, and low latency, though its hyperparameter sensitivity and restriction to classification settings delineate the scope of these claims.