---
title: Bias-Aware Machine Unlearning
url: https://www.emergentmind.com/topics/bias-aware-machine-unlearning
type: topic
---

# Bias-Aware Machine Unlearning

Bias-aware machine unlearning denotes post-hoc procedures that remove or attenuate model behavior associated with harmful training influence—such as spurious correlations, subgroup disparities, background shortcuts, or socially biased generations—while preserving as much retained utility as possible. In this literature, unlearning is often not treated as legal deletion alone, but as **influence correction**, **selective forgetting**, or **controllable forgetting** for fairness, robustness, and debiasing after deployment [2505.18783][2509.07456][2602.21773][2406.13551].

## 1. Conceptual scope and problem definitions

Bias-aware machine unlearning is not a single problem formulation. One line of work studies **group fairness disparities** induced by training data, with fairness operationalized by metrics such as **Demographic Parity (DP)** and **Equal Opportunity (EOP)** under a binary sensitive attribute \(g \in \{0,1\}\) [2505.18783]. Another line studies **class-level disparity** and defines a **fairness-gap** over class-wise feature variances in normalization layers, linking retained-class imbalance to robustness rather than to protected-group fairness [2504.13610]. A third line treats bias as **systematic patterns and biases**—for example color-label shortcuts or structured feature-label regularities—that must be removed from parameters or representations under distribution shift [2405.14020]. Representation-centric formulations instead view unlearning as suppressing information about the forget set directly in latent space while preserving information useful for retained data [2601.21564].

This heterogeneity means that the “bias” in bias-aware unlearning may refer to at least four different objects. It may denote **societal bias** in protected-group outcomes, **spurious shortcut bias** tied to backgrounds or artifacts, **parameter-level bias shortcuts** such as final-layer bias suppression, or **distributional bias/corruption** introduced by the forget set itself [2605.08730][2604.05669]. A plausible implication is that comparison across papers is difficult unless the target of forgetting, the fairness notion, and the evaluation reference are stated explicitly.

A recurring distinction is between **privacy-driven unlearning** and **correction-driven unlearning**. In privacy, exact removal of a specified subset is the point. In fairness or robustness correction, the objective is instead to correct unfair influence while preserving useful information. This motivates approaches that replace hard deletion with weighting, re-projection, or representation editing [2505.18783][2407.17710]. Adjacent work on privacy-preserving debiasing makes the same separation from the opposite direction: augmentation is used for debiasing, and unlearning is used as a privacy defense, so the two must be synchronized rather than applied independently [2404.13194].

## 2. Bias mechanisms and failure modes

A central failure mode is **over-unlearning**. “Soft Weighted Machine Unlearning” argues that fairness- and robustness-driven unlearning inherited a binary “remove / do not remove” logic from privacy-oriented unlearning, even though harmful influence is rarely all-or-nothing [2505.18783]. Its counterfactual leave-one-out analysis reports Spearman correlations of \(-0.11\) between fairness and utility, and \(-0.16\) between robustness and utility, implying near non-correlation. The stated consequence is that deleting all points identified as harmful to fairness is structurally prone to destroying predictive signal and can also distort the intended correction process itself.

A second failure mode is **bias redistribution rather than removal**. In zero-shot CLIP classifiers on CelebA, forgetting the dominant **Young Female** group does not neutralize the concept; instead it redistributes predictive mass primarily along gender boundaries, especially toward **Old Female**, rather than along age boundaries [2604.08111]. Prompt Erasure and Prompt Reweighting both achieve \(\mathrm{FA}=0.00\%\), yet demographic parity gaps worsen substantially. This establishes that perfect forgetting under a narrow forget metric can coexist with worse retained-group fairness.

A third failure mode is **shortcut unlearning**. Under severe spurious correlation, models may be “easy to learn, yet hard to forget”: they preferentially forget the shortcut rather than the intended class attribute [2602.21773]. The paper reports that standard unlearning can paradoxically improve accuracy on the **bias-conflicting subset** of the class that was supposed to be forgotten, precisely because the model removed reliance on the shortcut while preserving causal class evidence. This diagnosis makes subgroup-wise forgetting balance, rather than mean forget accuracy alone, the relevant object.

A fourth failure mode is **output-layer suppression masquerading as unlearning**. In class-level settings, forgotten-class predictions can be suppressed by decreasing the corresponding final classification-head bias terms, without removing internal class representations [2605.08730]. The diagnostic baseline **BiasShift** attains \(0.00\%\) forget accuracy in all tested settings and runs in about \(0.016\)–\(0.030\) seconds, yet leaves abnormal bias patterns that reveal forgotten labels. Related work on DAMP and MUDA shows the same concern from a representational perspective: low forget-class accuracy can arise from classifier-head suppression, logit masking, or unstable boundary shifts even when forget-class structure remains encoded in deep features [2604.15166][2407.17710].

A fifth failure mode is that **the unlearning operation itself induces bias**. “Debiasing Machine Unlearning with Counterfactual Examples” distinguishes **data-level bias**, caused by uneven deletion that shifts the retained distribution, from **algorithm-level bias**, caused by forgetting objectives that push forgotten points toward arbitrary incorrect classes [2404.15760]. This suggests that unlearning can be unfair even when the pre-unlearning model was not, because deletion perturbs both data composition and local decision geometry.

## 3. Methodological families

The literature now spans several technical families of intervention.

| Family | Representative papers | Core mechanism |
|---|---|---|
| Soft weighting and influence correction | [2505.18783] | Weighted influence function with per-sample continuous weights from a convex quadratic program |
| Representation and geometry editing | [2601.21564], [2405.14020], [2407.17710], [2604.15166], [2604.08111] | Information bottlenecks, dimensional alignment, depth-aware projections, or prompt/embedding surgery |
| Counterfactual, contrastive, and pathway-aware forgetting | [2602.21773], [2404.15760], [2512.01291] | Sharpness partitioning, causal/bias pathway routing, counterfactual alignment, targeted triplet loss |
| Parameter- and head-aware stabilization | [2605.08730] | Diagnose bias-dominated shortcutting; stabilize forgotten-class biases with TS-BGRM or LB-HR |
| Controllable post-hoc debiasing | [2509.07456], [2406.13551] | Gradient Ascent, LoRA, teacher-student distillation, FMD, PCGU, or negated task vectors |
| Statistical efficient unlearning | [2604.05669], [2404.13194] | Debias the pretrained estimator using forget data and small retained subsamples, or combine augmentation with sharded unlearning |

The soft-weighting line changes the question from “which samples should be deleted?” to “how much should each sample’s influence be retained, suppressed, or corrected?” [2505.18783]. Its weighted influence formulation estimates each sample’s effect on a target metric and on utility, then solves a convex program with an \(L^2\) penalty, an over-correction bound, and a utility-preservation constraint. The paper emphasizes that hard fine-tuning and hard ascent are special cases of this broader weighting scheme.

Representation-centric methods treat forgetting as feature-space editing rather than parameter rollback. Representation Unlearning optimizes a latent-space bottleneck that preserves information needed for retained data while suppressing information tied to the forget set [2601.21564]. UIB similarly uses a parameter-space information bottleneck to remove **systematic patterns and biases** under non-i.i.d. deletion, with a practical UIB-IF instantiation layered on top of influence-function updates [2405.14020]. MUDA instead aligns forget-set features with the retain manifold through **dimensional alignment**, self-distillation, and alternating forget/recover phases [2407.17710]. DAMP removes forget-specific directions from internal representations with one-shot, closed-form, depth-aware projection updates [2604.15166]. In zero-shot CLIP, related geometry-based interventions operate directly on prompts or on a refusal direction in image embedding space [2604.08111].

Bias-specific forgetting methods often rely on more explicit structure. CUPID partitions the forget set into causal- and bias-approximated subsets using sample-wise sharpness, identifies causal and bias pathways by Hessian-weighted saliency, then routes projected causal and residual bias gradients to different parameter subsets [2602.21773]. Counterfactual-guided debiasing uses intervention-based retain-side distillation together with counterfactual examples to move forgotten samples toward semantically consistent alternatives rather than arbitrary wrong labels [2404.15760]. In sonar, **Targeted Contrastive Unlearning (TCU)** uses triplets in which the negative is always the **seafloor/background** class, thereby pushing object representations away from nuisance background structure [2512.01291].

At the parameter level, “Classification-Head Bias in Class-Level Machine Unlearning” argues that the final bias term is a privileged shortcut and proposes two direct mitigations: **Two-Stage Bias Gradient Reversal Mechanism (TS-BGRM)** and **Lower-Bound Hinge Regularization (LB-HR)** [2605.08730]. The underlying idea is not to forbid the head from adapting, but to prevent forgetting from being realized mainly through extreme forgotten-class bias suppression.

Controllable post-hoc debiasing methods are prominent in both vision and language. In vision, “Bias-Aware Machine Unlearning: Towards Fairer Vision Models via Controllable Forgetting” compares **Hard Unlearning**, **Gradient Ascent**, **LoRA**, **Teacher-Student / SCRUB-style distillation**, and **Fast Model Debiasing (FMD)**, and argues that the best strategy depends on the topology of the bias [2509.07456]. In language models, social debiasing is treated as unlearning either by **Partitioned Contrastive Gradient Unlearning (PCGU)** or by **Negation via Task Vector**, the latter subtracting a learned “bias direction” from the base model in parameter space [2406.13551].

A separate statistical line analyzes unlearning when only the pretrained estimator, the forget samples, and a small retained subsample are available. For squared loss, **Unlearning Least Squares (ULS)** debiases the pretrained estimator using forget residuals and retained-subsample covariance, and the estimation error decomposes into an oracle term plus an unlearning cost controlled by forget proportion and **forget model bias** \(\delta = \|\theta_r-\theta_f\|_2\) [2604.05669]. This gives a direct statistical account of why biased, corrupted, or outlying forget sets are harder to remove.

## 4. Evaluation, metrics, and gold standards

A major theme of the field is that standard retain/forget accuracy is inadequate. For fairness-aware sample reweighting, target metrics are usually outcome disparities such as **DP** and **EOP**, with lower values interpreted as better fairness [2505.18783]. For intersectional visual redistribution, evaluation expands to **Forget Accuracy (FA)**, **Retain Accuracy (RA)**, **per-group accuracy shifts**, **DP gap**, and the **Redistribution Score**  
\[
\mathrm{RS} = \frac{1}{K-1}\sum_{k\neq t} |\Delta \mathrm{Acc}_k|,
\]
which measures how much predictive mass moves among retained groups after unlearning [2604.08111].

Head-aware auditing introduces a different class of internal metrics. **Bias Stability Coefficient (BSC)** measures the mean forgotten-vs-retained bias gap, **Median Bias Gap (MBG)** checks whether the median forgotten-class bias lies below the retained lower tail, and **Minimal Bias Score (MBS)** focuses on the most extreme forgotten-class outlier [2605.08730]. These metrics are explicitly designed to quantify **bias dependence** and **forgotten-label leakage**.

Class-wise fairness/robustness work proposes yet another diagnostic: the **fairness-gap**  
\[
\epsilon^l = \max_c \sigma_c^l - \min_c \sigma_c^l,
\]
computed from class-wise feature variances at normalization layers [2504.13610]. The claim is that robust unlearning should preserve the fairness-gap of the original model on retained classes, and that larger fairness-gap often coincides with lower adversarial accuracy under FGSM. This is not demographic fairness, but it is a retained-class disparity diagnostic.

Representation-centric papers shift evaluation further away from outputs. MUDA argues that forget-set accuracy and MIA can be gamed by changing only the classifier head, and instead evaluates **dimensional alignment**, **linear probing** on forget and retain features, **F1**, and **normalized mutual information (NMI)** against retraining as the gold standard [2407.17710]. DAMP uses **layerwise selectivity**, **linear probes**, **representational dissimilarity matrices**, **t-SNE**, and explicit analysis of final-layer bias shifts to distinguish real erasure from superficial suppression [2604.15166].

Privacy-style auditing remains central even in debiasing-adjacent work. Adversarial Machine Unlearning formulates unlearning as a Stackelberg game against a best-response membership auditor and optimizes retain loss together with an attack-success penalty obtained by implicit differentiation through the attacker [2406.07687]. “Toward Reliable Machine Unlearning” strengthens this evaluation logic by treating similarity to retraining on forget and remain samples as the main driver of both random-set and class unlearning, and by introducing **MIA-NN** to show that class-unlearning methods can leak membership through the distribution assigned to neighboring classes even when the forgotten-class logit is suppressed [2512.06993].

Holistic evaluation appears in explicitly fairness-oriented work. BA-MU introduces **Co-BUM**, a weighted harmonic-mean score over utility, fairness, privacy, forgetting quality, and efficiency, precisely because fairness gains alone do not determine whether an unlearning method is a usable post-hoc correction [2509.07456]. This suggests that bias-aware unlearning is increasingly evaluated as a multi-objective control problem rather than a single forget metric.

## 5. Representative empirical regimes

The most direct empirical evidence for post-hoc fairness repair comes from vision benchmarks with deliberately different bias topologies. BA-MU studies **CUB-200-2011** pose bias, **CIFAR-10** synthetic patch bias, and **CelebA** gender bias in smile detection, and reports **demographic parity improvements of up to 94.86% on CUB-200, 30.28% on CIFAR-10, and 97.37% on CelebA**, with an average **Co-BUM** score of **0.62** across the three settings [2509.07456]. The paper’s main empirical conclusion is that the best strategy depends on the topology of the bias: **Gradient Ascent** or **FMD** are strongest for distributed pose bias, **LoRA** is strongest for localized patch bias, and **Gradient Ascent** most aggressively reduces entrenched demographic bias, albeit sometimes with severe utility loss.

Intersectional zero-shot vision reveals a different phenomenon. On CelebA with CLIP variants, forgetting **Young Female** by Prompt Erasure or Prompt Reweighting yields \(\mathrm{FA}=0.00\%\) yet sends most of the lost mass to **Old Female**, increases DP gaps, and exposes a gender-dominant embedding geometry; **Refusal Vector** reduces redistribution somewhat but fails to forget completely and sharply degrades retained performance [2604.08111]. The empirical lesson is that forgetting one demographic slice can harm another even when the forget-set metric appears perfect.

Domain-specific nuisance forgetting is exemplified by sonar. The TCU framework treats **seafloor/background bias** as the forget target and reports that the unlearned EfficientNet-B0 preserves **overall accuracy 0.99**, while **plane recall** improves from **0.96 to 0.99** and **ship precision** from **0.96 to 0.99** [2512.01291]. The paper interprets this as selective forgetting of background dependence rather than ordinary class deletion.

Language-model work extends the same logic to social bias. On OPT and LLaMA-2 decoder models, **Negation via Task Vector** consistently outperforms **PCGU** in the joint bias/utility tradeoff, and on **LLaMA-2 7B** it reduces the CrowS bias score by **11.8%** with only slight perplexity increase [2406.13551]. The broader implication is that global, smooth parameter-space debiasing can preserve open-ended generation more effectively than sparse partition-wise edits.

Privacy-preserving debiasing provides an adjacent empirical regime. Diffusion-based augmentation plus multi-shard unlearning is used to match target attribute distributions while progressively removing original data to reduce vulnerability to MIA; on CIFAR-10 and CelebA, the paper reports attack success moving toward random-guessing levels over iterative forgetting, while retain accuracy remains roughly in the **74.1%–76.1%** range and testing accuracy roughly in the **64.2%–68.8%** range in the reported 10-round utility table [2404.13194]. This is not a full fairness-preserving unlearning theory, but it shows that privacy and debiasing can be optimized jointly in practice.

## 6. Limitations, controversies, and open problems

The strongest limitation across the literature is the lack of formal fairness guarantees. Soft weighting gives a clean convex derivation only under twice-differentiable, strictly convex ERM; in deep nets it relies on last-layer surrogates or Hessian approximations, and the reported fairness gains are primarily empirical [2505.18783]. Several works also acknowledge that the fairness notions studied are narrow: DP and EOP do not cover individual fairness or richer causal criteria, and class-wise fairness-gap is not demographic fairness at all [2504.13610].

Benchmark scope is another restriction. The CLIP redistribution study uses a single dataset, a single forget target (**Young Female**), and coarse binary age/gender attributes; it explicitly leaves richer intersectional and continuous demographic structures open [2604.08111]. Head-aware class-unlearning work controls the classification head while freezing the backbone, which stabilizes bias patterns but does not determine whether deeper features have actually forgotten the target class [2605.08730]. Counterfactual-guided debiasing depends on the availability and quality of counterfactual generators, concept groupings, and intervention heuristics, which may be fragile outside the studied settings [2404.15760].

Scalability remains unsettled. Soft-weighted fairness/robustness unlearning explicitly notes that LLM fairness/robustness unlearning is untested due to lack of benchmarks and resources [2505.18783]. The fairness-gap paper similarly calls for broader validation on larger datasets and model families, including LLMs and VLMs [2504.13610]. In language models, PCGU requires distributed training and can still take roughly six hours per epoch on two A100 GPUs for 7B-scale models, while task-vector negation is more efficient but still benchmark-sensitive [2406.13551].

A more conceptual controversy concerns the **reference distribution** used to define successful forgetting. Adversarial Machine Unlearning shows that when forget and non-member sets are intrinsically distributionally different, even a retrained model can remain highly distinguishable to an auditor [2406.07687]. This suggests that subgroup-aware or bias-aware auditing cannot simply equate low distinguishability with successful debiasing unless the reference set is appropriately matched.

Finally, many general unlearning frameworks are only partially bias-aware. Representation Unlearning and MUDA provide powerful latent-space control and evaluation machinery, but they do not by themselves enforce subgroup fairness or protect minority-group geometry if the retain manifold already reflects majority structure [2601.21564][2407.17710]. A plausible implication is that the next stage of the field will require explicit integration of subgroup-aware objectives, subgroup-matched auditors, and geometry-sensitive fairness constraints, rather than assuming that better forgetting automatically implies fairer models.

Source: https://www.emergentmind.com/topics/bias-aware-machine-unlearning