SalUn: Saliency Unlearning Framework

• SalUn is a machine unlearning method that uses gradient-based weight saliency to identify and update only the parameters most relevant to the forgetting set.
• It employs a masking mechanism that balances efficiency with model performance by selectively applying updates, bridging the gap between retraining and conventional fine-tuning.
• Empirical evaluations across image classification, conditional diffusion, and clinical applications confirm its competitive retention of knowledge and strong unlearning efficacy.

Searching arXiv for papers on SalUn and related evaluations. SalUn, short for Saliency Unlearning, is an approximate machine unlearning (MU) framework that removes the influence of a designated forgetting set by updating only the model weights that are most salient for that set. Introduced by Fan et al. for both image classification and conditional diffusion generation, SalUn is positioned between full retraining on the retain set—treated as the gold-standard form of exact unlearning—and cheaper but less selective procedures such as Fine-Tuning (FT) or Random Labeling (RL). Its defining mechanism is a gradient-based “weight saliency” map that localizes where forgetting updates should be applied, with the stated goals of efficiency, stability, strong unlearning behavior, and reduced collateral damage on retained knowledge (Fan et al., 2023).

1. Conceptual foundations

Machine unlearning addresses the requirement to remove the influence of a subset of training samples from a deployed model without retraining from scratch. In the standard formulation, a model with parameters $\theta_o$ is trained on a dataset $\mathcal{D}$, a forgetting set $\mathcal{D}_f \subset \mathcal{D}$ is designated for removal, and the retain set is $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$. Exact unlearning corresponds to training a fresh model on $\mathcal{D}_r$ alone; SalUn instead seeks an unlearned model that approximates that retrained solution while remaining substantially cheaper to obtain (Fan et al., 2023).

The central idea of SalUn is to transfer the logic of saliency from explainability to unlearning. Rather than asking which input features most affect a prediction, SalUn asks which parameters most encode the influence of the forgetting data. This “weight saliency” is computed from the gradients of a forgetting-driven loss with respect to the model parameters. The resulting mask restricts parameter updates to a salient subset, leaving non-salient weights frozen. In the original presentation, SalUn is described as a saliency-guided, plug-and-play MU framework and, to the authors’ knowledge, the first principled MU approach that can effectively erase the influence of forgetting data, classes, or concepts in both image classification and generation (Fan et al., 2023).

This formulation distinguishes SalUn from simpler baselines. FT trains only on retain data and relies on representational drift to weaken the contribution of removed samples. RL directly corrupts the forgetting set by assigning incorrect labels and retraining briefly. SalUn incorporates the forgetting pressure associated with RL-like corruption, but only on the weights that appear most responsible for the forgotten information. In this sense, SalUn combines a data-centric corruption mechanism with a parameter-centric localization mechanism (Falcao et al., 26 Apr 2026).

2. Formalism and optimization

In the classification setting, SalUn computes a forgetting loss on the forget set and derives a global saliency gradient at the original parameters:

$$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$

A binary mask is then constructed by thresholding the elementwise absolute gradient:

$\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$

where $\gamma$ is typically set to the median of $|\mathbf{g}_S|$, yielding a default sparsity of roughly $50\%$ in the original implementation. The unlearned parameters are decomposed as

$\mathcal{D}$0

so that only the salient support is updated and non-salient weights remain intact (Fan et al., 2023).

For image classification, SalUn adopts a random-labeling forgetting objective plus a retain-side regularizer. Each forgetting example $\mathcal{D}$1 is assigned an incorrect label $\mathcal{D}$2, and the masked update optimizes

$\mathcal{D}$3

Gradient descent is then applied only through the salient mask:

$\mathcal{D}$4

The role of $\mathcal{D}$5 is to balance forgetting efficacy against retention of performance on $\mathcal{D}$6 and held-out data (Fan et al., 2023).

The generation variant is structurally analogous. For conditional diffusion models, SalUn replaces a harmful concept $\mathcal{D}$7 with a mismatched concept $\mathcal{D}$8 and updates only salient weights while regularizing on the retain concepts. A soft-threshold alternative, formulated with an $\mathcal{D}$9 proximity term to $\mathcal{D}_f \subset \mathcal{D}$0, was also presented, but the hard-mask variant was preferred in practice because it showed better membership-inference behavior and stricter sparsity (Fan et al., 2023).

The theoretical framing remains approximate rather than certified. The original paper does not claim formal guarantees, but argues that support restriction stabilizes retention because parameter perturbations are confined to the salient subset. If the retain loss is Lipschitz in $\mathcal{D}_f \subset \mathcal{D}$1, the perturbation of retained loss is bounded by the norm of the masked update, which is offered as an intuition for improved retained accuracy and test accuracy relative to full-model editing (Fan et al., 2023).

3. Empirical profile across tasks and benchmarks

In the original experiments, SalUn was evaluated on image classification datasets including CIFAR-10, CIFAR-100, SVHN, and Tiny ImageNet, as well as on conditional diffusion generation. For classification on CIFAR-10 with a ResNet-18 backbone, the unlearning schedule used 10 epochs with a learning-rate grid $\mathcal{D}_f \subset \mathcal{D}$2, and SalUn consistently showed the smallest average gap to exact unlearning among the compared baselines. At 10% random forgetting, the reported average gap was approximately $\mathcal{D}_f \subset \mathcal{D}$3 with runtime efficiency around $\mathcal{D}_f \subset \mathcal{D}$4 minutes; at 50% forgetting, SalUn retained superiority with an average gap of approximately $\mathcal{D}_f \subset \mathcal{D}$5, while several baselines degraded sharply. The abstract further highlights a stability advantage under high-variance random forgetting, with a reported $\mathcal{D}_f \subset \mathcal{D}$6 gap to exact unlearning on CIFAR-10 in specific settings (Fan et al., 2023).

The generative results established SalUn as more than a classifier-specific method. On CIFAR-10 DDPM class-wise forgetting, SalUn achieved unlearning accuracy of $\mathcal{D}_f \subset \mathcal{D}$7, matching Retrain and ESD, while obtaining FID $\mathcal{D}_f \subset \mathcal{D}$8 versus $\mathcal{D}_f \subset \mathcal{D}$9 for Retrain and $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$0 for ESD. On Stable Diffusion over Imagenette, average unlearning accuracy reached $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$1, compared with $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$2 for ESD and $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$3 for Forget-Me-Not, while the average FID on non-forgetting prompts was $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$4 versus $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$5 for ESD and $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$6 for Forget-Me-Not. For NSFW concept removal in Stable Diffusion v1.4, SalUn yielded the fewest harmful generations across all nude-body-part categories among the compared methods (Fan et al., 2023).

A broader picture emerged in MU-Bench, a unified benchmark spanning image, text, speech, video, multimodal reasoning, summarization, LLM-based generation, and text-to-image generation. MU-Bench concludes that RandLabel and SalUn are the most effective general unlearning approaches overall. SalUn performed particularly well on IMDB, DDI-2013, and NLVR2, where deletion-set performance could be driven low while test performance remained strong. It was much less effective on Speech Commands and UCF101, where current MU approaches generally failed to forget without severe retention damage or retained performance while leaving deletion-set accuracy high. On text-to-image generation with Stable Diffusion and Tiny ImageNet prompts, SalUn achieved $$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$7, substantially better than RandLabel ($$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$8), Bad-T ($$\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$$9), and SCRUB ($\mathcal{D}_r$0), though more aggressive methods such as NegGrad could erase more at greater utility cost (Cheng et al., 2024).

MU-Bench also recast SalUn in a teacher–student framework. There, forgetting is implemented by increasing loss on the deletion set through saliency-weighted gradients, while retention is promoted by minimizing task loss on the remaining set and optionally matching the original model’s predictions through KL distillation:

$\mathcal{D}_r$1

This formulation emphasizes that SalUn is not only a masking heuristic but also a general optimization pattern for balancing forgetting against utility preservation across modalities (Cheng et al., 2024).

4. Clinical safety and the SalUn-CRA variant

In medical image classification, the principal criticism of standard SalUn is not its inability to forget, but the possibility that it forgets in clinically hazardous ways. A focused study on binary medical image tasks shows that standard unlearning strategies—FT, RL, and SalUn—may reduce test utility while increasing false-negative rates, thereby amplifying clinical risk under asymmetric error costs. The mechanism identified is specific to the binary malignant-versus-benign setting: random relabeling maps malignant forget samples to benign labels, so optimizing cross-entropy on these contaminated labels teaches the model to suppress malignant activations and shift the decision boundary toward higher specificity but lower recall (Falcao et al., 26 Apr 2026).

The paper formalizes clinical safety through Global Risk metrics:

$\mathcal{D}_r$2

Two scenarios are used. Global Risk I sets $\mathcal{D}_r$3 and $\mathcal{D}_r$4, while Global Risk II sets $\mathcal{D}_r$5 and $\mathcal{D}_r$6, representing clinically asymmetric costs in which missed malignancies are much more serious than false alarms. The medical study’s main conclusion is that unlearning validation based only on efficiency, privacy, and aggregate accuracy can obscure clinically dangerous shifts in sensitivity (Falcao et al., 26 Apr 2026).

To address this failure mode, the paper introduces SalUn-CRA (Clinical Risk-Aware), a class-dependent modification of SalUn. For malignant forget samples $\mathcal{D}_r$7, SalUn-CRA avoids benign relabeling and instead maximizes predictive entropy,

$\mathcal{D}_r$8

pushing the prediction toward uncertainty rather than benign confidence. For benign forget samples $\mathcal{D}_r$9, random relabeling is retained. The resulting objective is

$$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$0

with the same saliency mask used to restrict updates to salient weights (Falcao et al., 26 Apr 2026).

Empirically, SalUn-CRA changes the behavior of SalUn in the direction of recall preservation. On DermaMNIST with 20% removal, SalUn-CRA achieved specificity $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$1, recall $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$2, BAC $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$3, TBAC $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$4, and MIA $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$5, while standard SalUn achieved specificity $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$6, recall $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$7, BAC $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$8, TBAC $$\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.$$9, and MIA $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$0. On PathMNIST with 50% removal, SalUn-CRA achieved specificity $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$1, recall $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$2, BAC $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$3, UBAC $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$4, RBAC $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$5, TBAC $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$6, and MIA $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$7, yielding the lowest Global Risk II and even outperforming Retrain in risk under asymmetric costs in that scenario. Across all reported medical scenarios, TBAC for SalUn-CRA remained within $\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$8–$\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),$9 of Retrain while lowering or matching clinical risk and preserving unlearning effectiveness (Falcao et al., 26 Apr 2026).

5. Data augmentation and medical-image evaluations

A separate line of work examined how data augmentation alters the behavior of SalUn and other MU methods. On CIFAR-10 and CIFAR-100, seven augmentation scenarios were compared: NoAug; Default; Default + RandAugment; Default + AutoAugment; Default + Random Erasing; Default + TrivialAugment; and Default + AugMix. The reported headline result is that appropriate augmentation can reduce the performance gap to retrained models by up to 40.12% of the Average Gap unlearning Metric, with TrivialAugment identified as a particularly strong default. In that study, SalUn was run for 10 epochs at learning rate $\gamma$0, starting from the pretrained model, with augmentations applied consistently to baseline training, retraining, and unlearning pipelines (Falcao et al., 25 Aug 2025).

The augmentation effects were dataset-dependent. On CIFAR-100, TrivialAugment materially improved SalUn. At a 10% forget rate, the Average Gap dropped from approximately $\gamma$1 under Default to approximately $\gamma$2 under Default + TrivialAug; the UA gap fell from $\gamma$3 to $\gamma$4, the MIA gap from $\gamma$5 to $\gamma$6, and the TA gap from $\gamma$7 to $\gamma$8. At a 50% forget rate, the Average Gap dropped from approximately $\gamma$9 to approximately $|\mathbf{g}_S|$0. By contrast, on CIFAR-10, TrivialAugment did not reduce SalUn’s Average Gap at 10% forgetting and was essentially unchanged or slightly worse at 50%, which the study interprets as evidence that SalUn is less sensitive to augmentation on easier datasets (Falcao et al., 25 Aug 2025).

Medical image classification studies offer a related but distinct picture. On BloodMNIST, OrganAMNIST, and PathMNIST, SalUn was evaluated with a ResNet-18, 64×64 images, 200-epoch initial training, and 10-epoch unlearning. At a forget rate of 10%, SalUn was close to Retrain on BloodMNIST and OrganAMNIST: on BloodMNIST, Retrain yielded UA $|\mathbf{g}_S|$1, RA $|\mathbf{g}_S|$2, TA $|\mathbf{g}_S|$3, MIA $|\mathbf{g}_S|$4, AG $|\mathbf{g}_S|$5, and RTE $|\mathbf{g}_S|$6 minutes, while SalUn yielded UA $|\mathbf{g}_S|$7, RA $|\mathbf{g}_S|$8, TA $|\mathbf{g}_S|$9, MIA $50\%$0, AG $50\%$1, and RTE $50\%$2 minutes. OrganAMNIST showed similarly small gaps. PathMNIST was substantially harder: at 10% forgetting, Retrain had TA $50\%$3 and MIA $50\%$4, whereas SalUn had TA $50\%$5 and MIA $50\%$6; at 50% forgetting, Retrain had TA $50\%$7 and MIA $50\%$8, whereas SalUn had TA $50\%$9 and MIA $\mathcal{D}$00 (Falcao et al., 25 Aug 2025).

That medical study also reports that stronger augmentation, specifically Default + RA, generally improved the AG metric, indicating closer approximation to retraining, although the per-scenario numeric AG values for the augmentation ablation were presented qualitatively rather than tabulated. A plausible implication is that augmentation can improve SalUn not only by regularizing the retain-side optimization but also by reducing dependence on idiosyncratic patterns that would otherwise make selective forgetting unstable (Falcao et al., 25 Aug 2025).

6. Limitations, trade-offs, and practical use

SalUn is consistently described as an approximate rather than certified unlearning method. The original paper explicitly does not claim formal guarantees, and later evaluations reinforce that its performance depends on hyperparameters such as the saliency threshold $\mathcal{D}$01, sparsity ratio, and regularization weights $\mathcal{D}$02 and $\mathcal{D}$03. Poor choices can induce over-forgetting or under-forgetting; larger forgetting fractions widen the gap to Retrain for all approximate methods, including SalUn; and residual memorization may remain detectable by sufficiently strong attacks (Fan et al., 2023).

Benchmark studies identify several additional limitations. In MU-Bench, SalUn struggled on speech and video, where correlated structure appears to frustrate current deletion losses; on summarization and LLM-based generation, it had limited influence relative to its classification strengths; and in NLVR2, deletion-set accuracy could become extremely low, which MU-Bench notes may reveal the existence of deletion and thus increase adversarial information-leakage risk. Parameter-efficient fine-tuning was also found to be restrictive: when the trainable fraction fell below roughly 50% of parameters, SalUn’s deletion-set accuracy tended to approach its remaining-set accuracy, indicating that selective forgetting could not be achieved even with larger learning rates and longer training (Cheng et al., 2024).

Practical guidance in the literature is correspondingly conditional. The original SalUn work recommends the median of $\mathcal{D}$04 as a strong default for $\mathcal{D}$05, giving roughly 50% sparsity, and suggests adjusting sparsity upward for larger forgetting sets to reduce collateral damage. For classification on CIFAR-10 with ResNet-18, the reported default is 10 epochs with learning rate in $\mathcal{D}$06; for DDPM, 1000 iterations with Adam and learning rate $\mathcal{D}$07; and for Stable Diffusion, 5 epochs with learning rate $\mathcal{D}$08 and DDIM sampling with 100 steps (Fan et al., 2023).

In medical contexts, the literature recommends a stricter evaluation protocol. The clinical-safety analysis argues that deployment should always include asymmetric risk metrics such as Global Risk II, explicit monitoring of recall and false-negative rate, and, for binary malignant-versus-benign tasks, preference for entropy-based forgetting of malignant forget samples rather than deterministic benign relabeling. This suggests that standard SalUn is best suited to settings where random relabeling does not create a clinically asymmetric hazard, while SalUn-CRA is the more appropriate variant when false negatives are substantially costlier than false positives (Falcao et al., 26 Apr 2026).

Taken together, the current literature presents SalUn as a weight-centric unlearning framework with unusually broad empirical reach, strong retained-utility characteristics, and clear efficiency advantages over full retraining, but also with modality-dependent failure modes and, in high-stakes domains such as medicine, safety properties that depend critically on how the forgetting objective is instantiated (Fan et al., 2023).