Bias-Aware Machine Unlearning
- Bias-aware machine unlearning is a technique that selectively removes harmful biases—such as spurious correlations or systemic shortcuts—from models while maintaining overall utility.
- Methods include soft weighting, representation editing, and counterfactual interventions to address various bias types including societal, shortcut, and parameter-level biases.
- Evaluations use fairness metrics, robustness, and subgroup analyses to reveal risks like over-unlearning and bias redistribution, guiding more controlled debiasing strategies.
Bias-aware machine unlearning denotes post-hoc procedures that remove or attenuate model behavior associated with harmful training influence—such as spurious correlations, subgroup disparities, background shortcuts, or socially biased generations—while preserving as much retained utility as possible. In this literature, unlearning is often not treated as legal deletion alone, but as influence correction, selective forgetting, or controllable forgetting for fairness, robustness, and debiasing after deployment (Qiao et al., 24 May 2025, Aylapuram et al., 9 Sep 2025, Kwon et al., 25 Feb 2026, Dige et al., 2024).
1. Conceptual scope and problem definitions
Bias-aware machine unlearning is not a single problem formulation. One line of work studies group fairness disparities induced by training data, with fairness operationalized by metrics such as Demographic Parity (DP) and Equal Opportunity (EOP) under a binary sensitive attribute (Qiao et al., 24 May 2025). Another line studies class-level disparity and defines a fairness-gap over class-wise feature variances in normalization layers, linking retained-class imbalance to robustness rather than to protected-group fairness (Tran et al., 18 Apr 2025). A third line treats bias as systematic patterns and biases—for example color-label shortcuts or structured feature-label regularities—that must be removed from parameters or representations under distribution shift (Han et al., 2024). Representation-centric formulations instead view unlearning as suppressing information about the forget set directly in latent space while preserving information useful for retained data (Almudévar et al., 29 Jan 2026).
This heterogeneity means that the “bias” in bias-aware unlearning may refer to at least four different objects. It may denote societal bias in protected-group outcomes, spurious shortcut bias tied to backgrounds or artifacts, parameter-level bias shortcuts such as final-layer bias suppression, or distributional bias/corruption introduced by the forget set itself (Zheng et al., 9 May 2026, Xie et al., 7 Apr 2026). A plausible implication is that comparison across papers is difficult unless the target of forgetting, the fairness notion, and the evaluation reference are stated explicitly.
A recurring distinction is between privacy-driven unlearning and correction-driven unlearning. In privacy, exact removal of a specified subset is the point. In fairness or robustness correction, the objective is instead to correct unfair influence while preserving useful information. This motivates approaches that replace hard deletion with weighting, re-projection, or representation editing (Qiao et al., 24 May 2025, Seo et al., 2024). Adjacent work on privacy-preserving debiasing makes the same separation from the opposite direction: augmentation is used for debiasing, and unlearning is used as a privacy defense, so the two must be synchronized rather than applied independently (Pan et al., 2024).
2. Bias mechanisms and failure modes
A central failure mode is over-unlearning. “Soft Weighted Machine Unlearning” argues that fairness- and robustness-driven unlearning inherited a binary “remove / do not remove” logic from privacy-oriented unlearning, even though harmful influence is rarely all-or-nothing (Qiao et al., 24 May 2025). Its counterfactual leave-one-out analysis reports Spearman correlations of between fairness and utility, and between robustness and utility, implying near non-correlation. The stated consequence is that deleting all points identified as harmful to fairness is structurally prone to destroying predictive signal and can also distort the intended correction process itself.
A second failure mode is bias redistribution rather than removal. In zero-shot CLIP classifiers on CelebA, forgetting the dominant Young Female group does not neutralize the concept; instead it redistributes predictive mass primarily along gender boundaries, especially toward Old Female, rather than along age boundaries (Haruna et al., 9 Apr 2026). Prompt Erasure and Prompt Reweighting both achieve , yet demographic parity gaps worsen substantially. This establishes that perfect forgetting under a narrow forget metric can coexist with worse retained-group fairness.
A third failure mode is shortcut unlearning. Under severe spurious correlation, models may be “easy to learn, yet hard to forget”: they preferentially forget the shortcut rather than the intended class attribute (Kwon et al., 25 Feb 2026). The paper reports that standard unlearning can paradoxically improve accuracy on the bias-conflicting subset of the class that was supposed to be forgotten, precisely because the model removed reliance on the shortcut while preserving causal class evidence. This diagnosis makes subgroup-wise forgetting balance, rather than mean forget accuracy alone, the relevant object.
A fourth failure mode is output-layer suppression masquerading as unlearning. In class-level settings, forgotten-class predictions can be suppressed by decreasing the corresponding final classification-head bias terms, without removing internal class representations (Zheng et al., 9 May 2026). The diagnostic baseline BiasShift attains forget accuracy in all tested settings and runs in about $0.016$–$0.030$ seconds, yet leaves abnormal bias patterns that reveal forgotten labels. Related work on DAMP and MUDA shows the same concern from a representational perspective: low forget-class accuracy can arise from classifier-head suppression, logit masking, or unstable boundary shifts even when forget-class structure remains encoded in deep features (Hatami et al., 16 Apr 2026, Seo et al., 2024).
A fifth failure mode is that the unlearning operation itself induces bias. “Debiasing Machine Unlearning with Counterfactual Examples” distinguishes data-level bias, caused by uneven deletion that shifts the retained distribution, from algorithm-level bias, caused by forgetting objectives that push forgotten points toward arbitrary incorrect classes (Chen et al., 2024). This suggests that unlearning can be unfair even when the pre-unlearning model was not, because deletion perturbs both data composition and local decision geometry.
3. Methodological families
The literature now spans several technical families of intervention.
| Family | Representative papers | Core mechanism |
|---|---|---|
| Soft weighting and influence correction | (Qiao et al., 24 May 2025) | Weighted influence function with per-sample continuous weights from a convex quadratic program |
| Representation and geometry editing | (Almudévar et al., 29 Jan 2026, Han et al., 2024, Seo et al., 2024, Hatami et al., 16 Apr 2026, Haruna et al., 9 Apr 2026) | Information bottlenecks, dimensional alignment, depth-aware projections, or prompt/embedding surgery |
| Counterfactual, contrastive, and pathway-aware forgetting | (Kwon et al., 25 Feb 2026, Chen et al., 2024, S et al., 1 Dec 2025) | Sharpness partitioning, causal/bias pathway routing, counterfactual alignment, targeted triplet loss |
| Parameter- and head-aware stabilization | (Zheng et al., 9 May 2026) | Diagnose bias-dominated shortcutting; stabilize forgotten-class biases with TS-BGRM or LB-HR |
| Controllable post-hoc debiasing | (Aylapuram et al., 9 Sep 2025, Dige et al., 2024) | Gradient Ascent, LoRA, teacher-student distillation, FMD, PCGU, or negated task vectors |
| Statistical efficient unlearning | (Xie et al., 7 Apr 2026, Pan et al., 2024) | Debias the pretrained estimator using forget data and small retained subsamples, or combine augmentation with sharded unlearning |
The soft-weighting line changes the question from “which samples should be deleted?” to “how much should each sample’s influence be retained, suppressed, or corrected?” (Qiao et al., 24 May 2025). Its weighted influence formulation estimates each sample’s effect on a target metric and on utility, then solves a convex program with an penalty, an over-correction bound, and a utility-preservation constraint. The paper emphasizes that hard fine-tuning and hard ascent are special cases of this broader weighting scheme.
Representation-centric methods treat forgetting as feature-space editing rather than parameter rollback. Representation Unlearning optimizes a latent-space bottleneck that preserves information needed for retained data while suppressing information tied to the forget set (Almudévar et al., 29 Jan 2026). UIB similarly uses a parameter-space information bottleneck to remove systematic patterns and biases under non-i.i.d. deletion, with a practical UIB-IF instantiation layered on top of influence-function updates (Han et al., 2024). MUDA instead aligns forget-set features with the retain manifold through dimensional alignment, self-distillation, and alternating forget/recover phases (Seo et al., 2024). DAMP removes forget-specific directions from internal representations with one-shot, closed-form, depth-aware projection updates (Hatami et al., 16 Apr 2026). In zero-shot CLIP, related geometry-based interventions operate directly on prompts or on a refusal direction in image embedding space (Haruna et al., 9 Apr 2026).
Bias-specific forgetting methods often rely on more explicit structure. CUPID partitions the forget set into causal- and bias-approximated subsets using sample-wise sharpness, identifies causal and bias pathways by Hessian-weighted saliency, then routes projected causal and residual bias gradients to different parameter subsets (Kwon et al., 25 Feb 2026). Counterfactual-guided debiasing uses intervention-based retain-side distillation together with counterfactual examples to move forgotten samples toward semantically consistent alternatives rather than arbitrary wrong labels (Chen et al., 2024). In sonar, Targeted Contrastive Unlearning (TCU) uses triplets in which the negative is always the seafloor/background class, thereby pushing object representations away from nuisance background structure (S et al., 1 Dec 2025).
At the parameter level, “Classification-Head Bias in Class-Level Machine Unlearning” argues that the final bias term is a privileged shortcut and proposes two direct mitigations: Two-Stage Bias Gradient Reversal Mechanism (TS-BGRM) and Lower-Bound Hinge Regularization (LB-HR) (Zheng et al., 9 May 2026). The underlying idea is not to forbid the head from adapting, but to prevent forgetting from being realized mainly through extreme forgotten-class bias suppression.
Controllable post-hoc debiasing methods are prominent in both vision and language. In vision, “Bias-Aware Machine Unlearning: Towards Fairer Vision Models via Controllable Forgetting” compares Hard Unlearning, Gradient Ascent, LoRA, Teacher-Student / SCRUB-style distillation, and Fast Model Debiasing (FMD), and argues that the best strategy depends on the topology of the bias (Aylapuram et al., 9 Sep 2025). In LLMs, social debiasing is treated as unlearning either by Partitioned Contrastive Gradient Unlearning (PCGU) or by Negation via Task Vector, the latter subtracting a learned “bias direction” from the base model in parameter space (Dige et al., 2024).
A separate statistical line analyzes unlearning when only the pretrained estimator, the forget samples, and a small retained subsample are available. For squared loss, Unlearning Least Squares (ULS) debiases the pretrained estimator using forget residuals and retained-subsample covariance, and the estimation error decomposes into an oracle term plus an unlearning cost controlled by forget proportion and forget model bias (Xie et al., 7 Apr 2026). This gives a direct statistical account of why biased, corrupted, or outlying forget sets are harder to remove.
4. Evaluation, metrics, and gold standards
A major theme of the field is that standard retain/forget accuracy is inadequate. For fairness-aware sample reweighting, target metrics are usually outcome disparities such as DP and EOP, with lower values interpreted as better fairness (Qiao et al., 24 May 2025). For intersectional visual redistribution, evaluation expands to Forget Accuracy (FA), Retain Accuracy (RA), per-group accuracy shifts, DP gap, and the Redistribution Score
which measures how much predictive mass moves among retained groups after unlearning (Haruna et al., 9 Apr 2026).
Head-aware auditing introduces a different class of internal metrics. Bias Stability Coefficient (BSC) measures the mean forgotten-vs-retained bias gap, Median Bias Gap (MBG) checks whether the median forgotten-class bias lies below the retained lower tail, and Minimal Bias Score (MBS) focuses on the most extreme forgotten-class outlier (Zheng et al., 9 May 2026). These metrics are explicitly designed to quantify bias dependence and forgotten-label leakage.
Class-wise fairness/robustness work proposes yet another diagnostic: the fairness-gap
0
computed from class-wise feature variances at normalization layers (Tran et al., 18 Apr 2025). The claim is that robust unlearning should preserve the fairness-gap of the original model on retained classes, and that larger fairness-gap often coincides with lower adversarial accuracy under FGSM. This is not demographic fairness, but it is a retained-class disparity diagnostic.
Representation-centric papers shift evaluation further away from outputs. MUDA argues that forget-set accuracy and MIA can be gamed by changing only the classifier head, and instead evaluates dimensional alignment, linear probing on forget and retain features, F1, and normalized mutual information (NMI) against retraining as the gold standard (Seo et al., 2024). DAMP uses layerwise selectivity, linear probes, representational dissimilarity matrices, t-SNE, and explicit analysis of final-layer bias shifts to distinguish real erasure from superficial suppression (Hatami et al., 16 Apr 2026).
Privacy-style auditing remains central even in debiasing-adjacent work. Adversarial Machine Unlearning formulates unlearning as a Stackelberg game against a best-response membership auditor and optimizes retain loss together with an attack-success penalty obtained by implicit differentiation through the attacker (Di et al., 2024). “Toward Reliable Machine Unlearning” strengthens this evaluation logic by treating similarity to retraining on forget and remain samples as the main driver of both random-set and class unlearning, and by introducing MIA-NN to show that class-unlearning methods can leak membership through the distribution assigned to neighboring classes even when the forgotten-class logit is suppressed (Ebrahimpour-Boroojeny, 7 Dec 2025).
Holistic evaluation appears in explicitly fairness-oriented work. BA-MU introduces Co-BUM, a weighted harmonic-mean score over utility, fairness, privacy, forgetting quality, and efficiency, precisely because fairness gains alone do not determine whether an unlearning method is a usable post-hoc correction (Aylapuram et al., 9 Sep 2025). This suggests that bias-aware unlearning is increasingly evaluated as a multi-objective control problem rather than a single forget metric.
5. Representative empirical regimes
The most direct empirical evidence for post-hoc fairness repair comes from vision benchmarks with deliberately different bias topologies. BA-MU studies CUB-200-2011 pose bias, CIFAR-10 synthetic patch bias, and CelebA gender bias in smile detection, and reports demographic parity improvements of up to 94.86% on CUB-200, 30.28% on CIFAR-10, and 97.37% on CelebA, with an average Co-BUM score of 0.62 across the three settings (Aylapuram et al., 9 Sep 2025). The paper’s main empirical conclusion is that the best strategy depends on the topology of the bias: Gradient Ascent or FMD are strongest for distributed pose bias, LoRA is strongest for localized patch bias, and Gradient Ascent most aggressively reduces entrenched demographic bias, albeit sometimes with severe utility loss.
Intersectional zero-shot vision reveals a different phenomenon. On CelebA with CLIP variants, forgetting Young Female by Prompt Erasure or Prompt Reweighting yields 1 yet sends most of the lost mass to Old Female, increases DP gaps, and exposes a gender-dominant embedding geometry; Refusal Vector reduces redistribution somewhat but fails to forget completely and sharply degrades retained performance (Haruna et al., 9 Apr 2026). The empirical lesson is that forgetting one demographic slice can harm another even when the forget-set metric appears perfect.
Domain-specific nuisance forgetting is exemplified by sonar. The TCU framework treats seafloor/background bias as the forget target and reports that the unlearned EfficientNet-B0 preserves overall accuracy 0.99, while plane recall improves from 0.96 to 0.99 and ship precision from 0.96 to 0.99 (S et al., 1 Dec 2025). The paper interprets this as selective forgetting of background dependence rather than ordinary class deletion.
Language-model work extends the same logic to social bias. On OPT and LLaMA-2 decoder models, Negation via Task Vector consistently outperforms PCGU in the joint bias/utility tradeoff, and on LLaMA-2 7B it reduces the CrowS bias score by 11.8% with only slight perplexity increase (Dige et al., 2024). The broader implication is that global, smooth parameter-space debiasing can preserve open-ended generation more effectively than sparse partition-wise edits.
Privacy-preserving debiasing provides an adjacent empirical regime. Diffusion-based augmentation plus multi-shard unlearning is used to match target attribute distributions while progressively removing original data to reduce vulnerability to MIA; on CIFAR-10 and CelebA, the paper reports attack success moving toward random-guessing levels over iterative forgetting, while retain accuracy remains roughly in the 74.1%–76.1% range and testing accuracy roughly in the 64.2%–68.8% range in the reported 10-round utility table (Pan et al., 2024). This is not a full fairness-preserving unlearning theory, but it shows that privacy and debiasing can be optimized jointly in practice.
6. Limitations, controversies, and open problems
The strongest limitation across the literature is the lack of formal fairness guarantees. Soft weighting gives a clean convex derivation only under twice-differentiable, strictly convex ERM; in deep nets it relies on last-layer surrogates or Hessian approximations, and the reported fairness gains are primarily empirical (Qiao et al., 24 May 2025). Several works also acknowledge that the fairness notions studied are narrow: DP and EOP do not cover individual fairness or richer causal criteria, and class-wise fairness-gap is not demographic fairness at all (Tran et al., 18 Apr 2025).
Benchmark scope is another restriction. The CLIP redistribution study uses a single dataset, a single forget target (Young Female), and coarse binary age/gender attributes; it explicitly leaves richer intersectional and continuous demographic structures open (Haruna et al., 9 Apr 2026). Head-aware class-unlearning work controls the classification head while freezing the backbone, which stabilizes bias patterns but does not determine whether deeper features have actually forgotten the target class (Zheng et al., 9 May 2026). Counterfactual-guided debiasing depends on the availability and quality of counterfactual generators, concept groupings, and intervention heuristics, which may be fragile outside the studied settings (Chen et al., 2024).
Scalability remains unsettled. Soft-weighted fairness/robustness unlearning explicitly notes that LLM fairness/robustness unlearning is untested due to lack of benchmarks and resources (Qiao et al., 24 May 2025). The fairness-gap paper similarly calls for broader validation on larger datasets and model families, including LLMs and VLMs (Tran et al., 18 Apr 2025). In LLMs, PCGU requires distributed training and can still take roughly six hours per epoch on two A100 GPUs for 7B-scale models, while task-vector negation is more efficient but still benchmark-sensitive (Dige et al., 2024).
A more conceptual controversy concerns the reference distribution used to define successful forgetting. Adversarial Machine Unlearning shows that when forget and non-member sets are intrinsically distributionally different, even a retrained model can remain highly distinguishable to an auditor (Di et al., 2024). This suggests that subgroup-aware or bias-aware auditing cannot simply equate low distinguishability with successful debiasing unless the reference set is appropriately matched.
Finally, many general unlearning frameworks are only partially bias-aware. Representation Unlearning and MUDA provide powerful latent-space control and evaluation machinery, but they do not by themselves enforce subgroup fairness or protect minority-group geometry if the retain manifold already reflects majority structure (Almudévar et al., 29 Jan 2026, Seo et al., 2024). A plausible implication is that the next stage of the field will require explicit integration of subgroup-aware objectives, subgroup-matched auditors, and geometry-sensitive fairness constraints, rather than assuming that better forgetting automatically implies fairer models.