---
title: 'SalUn: Saliency Unlearning Framework'
url: https://www.emergentmind.com/topics/salun
type: topic
---

# SalUn: Saliency Unlearning Framework

Searching arXiv for recent papers on SalUn and related evaluations.
SalUn, short for **Saliency Unlearning**, is an approximate machine unlearning (MU) framework that removes the influence of a designated forgetting set by updating only the model weights that are most salient for that set. Introduced by Fan et al. for both image classification and conditional diffusion generation, SalUn is positioned between full retraining on the retain set—treated as the gold-standard form of exact unlearning—and cheaper but less selective procedures such as Fine-Tuning (FT) or Random Labeling (RL). Its defining mechanism is a gradient-based “weight saliency” map that localizes where forgetting updates should be applied, with the stated goals of efficiency, stability, strong unlearning behavior, and reduced collateral damage on retained knowledge [2310.12508].

## 1. Conceptual foundations

Machine unlearning addresses the requirement to remove the influence of a subset of training samples from a deployed model without retraining from scratch. In the standard formulation, a model with parameters $\theta_o$ is trained on a dataset $\mathcal{D}$, a forgetting set $\mathcal{D}_f \subset \mathcal{D}$ is designated for removal, and the retain set is $\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$. Exact unlearning corresponds to training a fresh model on $\mathcal{D}_r$ alone; SalUn instead seeks an unlearned model that approximates that retrained solution while remaining substantially cheaper to obtain [2310.12508].

The central idea of SalUn is to transfer the logic of saliency from explainability to unlearning. Rather than asking which input features most affect a prediction, SalUn asks which parameters most encode the influence of the forgetting data. This “weight saliency” is computed from the gradients of a forgetting-driven loss with respect to the model parameters. The resulting mask restricts parameter updates to a salient subset, leaving non-salient weights frozen. In the original presentation, SalUn is described as a **saliency-guided, plug-and-play MU framework** and, to the authors’ knowledge, the **first principled MU approach** that can effectively erase the influence of forgetting data, classes, or concepts in both image classification and generation [2310.12508].

This formulation distinguishes SalUn from simpler baselines. FT trains only on retain data and relies on representational drift to weaken the contribution of removed samples. RL directly corrupts the forgetting set by assigning incorrect labels and retraining briefly. SalUn incorporates the forgetting pressure associated with RL-like corruption, but only on the weights that appear most responsible for the forgotten information. In this sense, SalUn combines a data-centric corruption mechanism with a parameter-centric localization mechanism [2604.23854].

## 2. Formalism and optimization

In the classification setting, SalUn computes a forgetting loss on the forget set and derives a global saliency gradient at the original parameters:
$$
\mathbf{g}_S \triangleq \left.\nabla_{\theta}\,\ell_f(\theta;\mathcal{D}_f)\right|_{\theta=\theta_0}.
$$
A binary mask is then constructed by thresholding the elementwise absolute gradient:
$$
\mathbf{m}_S = \mathds{1}\big(|\mathbf{g}_S| \ge \gamma\big),
$$
where $\gamma$ is typically set to the median of $|\mathbf{g}_S|$, yielding a default sparsity of roughly $50\%$ in the original implementation. The unlearned parameters are decomposed as
$$
\theta_u = \mathbf{m}_S \odot (\Delta + \theta_0) + (\mathbf{1}-\mathbf{m}_S)\odot \theta_0,
$$
so that only the salient support is updated and non-salient weights remain intact [2310.12508].

For image classification, SalUn adopts a random-labeling forgetting objective plus a retain-side regularizer. Each forgetting example $(x,y)\in\mathcal{D}_f$ is assigned an incorrect label $y' \neq y$, and the masked update optimizes
$$
L_{\text{SalUn}^{(1)}}(\theta_u) =
\mathbb{E}_{(\mathbf{x},y)\sim \mathcal{D}_f,\; y' \ne y}\big[\ell_{\mathrm{CE}}(\theta_u;\mathbf{x},y')\big]
+\alpha\,\mathbb{E}_{(\mathbf{x},y)\sim \mathcal{D}_r}\big[\ell_{\mathrm{CE}}(\theta_u;\mathbf{x},y)\big].
$$
Gradient descent is then applied only through the salient mask:
$$
\theta \leftarrow \theta - \eta\big(\mathbf{m}_S \odot \nabla_\theta L_{\text{SalUn}^{(i)}}(\theta)\big).
$$
The role of $\alpha$ is to balance forgetting efficacy against retention of performance on $\mathcal{D}_r$ and held-out data [2310.12508].

The generation variant is structurally analogous. For conditional diffusion models, SalUn replaces a harmful concept $c$ with a mismatched concept $c' \ne c$ and updates only salient weights while regularizing on the retain concepts. A soft-threshold alternative, formulated with an $\ell_1$ proximity term to $\theta_0$, was also presented, but the hard-mask variant was preferred in practice because it showed better membership-inference behavior and stricter sparsity [2310.12508].

The theoretical framing remains approximate rather than certified. The original paper does not claim formal guarantees, but argues that support restriction stabilizes retention because parameter perturbations are confined to the salient subset. If the retain loss is Lipschitz in $\theta$, the perturbation of retained loss is bounded by the norm of the masked update, which is offered as an intuition for improved retained accuracy and test accuracy relative to full-model editing [2310.12508].

## 3. Empirical profile across tasks and benchmarks

In the original experiments, SalUn was evaluated on image classification datasets including CIFAR-10, CIFAR-100, SVHN, and Tiny ImageNet, as well as on conditional diffusion generation. For classification on CIFAR-10 with a ResNet-18 backbone, the unlearning schedule used 10 epochs with a learning-rate grid $[5\times 10^{-4}, 5\times 10^{-2}]$, and SalUn consistently showed the smallest average gap to exact unlearning among the compared baselines. At 10% random forgetting, the reported average gap was approximately $1.15$ with runtime efficiency around $2.66$ minutes; at 50% forgetting, SalUn retained superiority with an average gap of approximately $2.65$, while several baselines degraded sharply. The abstract further highlights a stability advantage under high-variance random forgetting, with a reported $\approx 0.2\%$ gap to exact unlearning on CIFAR-10 in specific settings [2310.12508].

The generative results established SalUn as more than a classifier-specific method. On CIFAR-10 DDPM class-wise forgetting, SalUn achieved unlearning accuracy of $100.00$, matching Retrain and ESD, while obtaining FID $11.21$ versus $11.69$ for Retrain and $17.37$ for ESD. On Stable Diffusion over Imagenette, average unlearning accuracy reached $99.82\%$, compared with $99.40\%$ for ESD and $42.54\%$ for Forget-Me-Not, while the average FID on non-forgetting prompts was $1.22$ versus $1.49$ for ESD and $1.30$ for Forget-Me-Not. For NSFW concept removal in Stable Diffusion v1.4, SalUn yielded the fewest harmful generations across all nude-body-part categories among the compared methods [2310.12508].

A broader picture emerged in **MU-Bench**, a unified benchmark spanning image, text, speech, video, multimodal reasoning, summarization, LLM-based generation, and text-to-image generation. MU-Bench concludes that **RandLabel and SalUn are the most effective general unlearning approaches** overall. SalUn performed particularly well on IMDB, DDI-2013, and NLVR2, where deletion-set performance could be driven low while test performance remained strong. It was much less effective on Speech Commands and UCF101, where current MU approaches generally failed to forget without severe retention damage or retained performance while leaving deletion-set accuracy high. On text-to-image generation with Stable Diffusion and Tiny ImageNet prompts, SalUn achieved $A^{img-gen}_{Df}=48.2\%$, substantially better than RandLabel ($64.6\%$), Bad-T ($69.1\%$), and SCRUB ($75.8\%$), though more aggressive methods such as NegGrad could erase more at greater utility cost [2406.14796].

MU-Bench also recast SalUn in a teacher–student framework. There, forgetting is implemented by increasing loss on the deletion set through saliency-weighted gradients, while retention is promoted by minimizing task loss on the remaining set and optionally matching the original model’s predictions through KL distillation:
$$
J(w)=\mathbb{E}_{(x,y)\in D_r}[L(w;x,y)] + \mu\,\mathbb{E}_{x\in D_r}[KL(p_w(x)\,\|\,p_f(x))] - \lambda\,\mathbb{E}_{(x,y)\in D_f}[L(w;x,y)].
$$
This formulation emphasizes that SalUn is not only a masking heuristic but also a general optimization pattern for balancing forgetting against utility preservation across modalities [2406.14796].

## 4. Clinical safety and the SalUn-CRA variant

In medical image classification, the principal criticism of standard SalUn is not its inability to forget, but the possibility that it forgets in clinically hazardous ways. A focused study on binary medical image tasks shows that standard unlearning strategies—FT, RL, and SalUn—may reduce test utility while increasing false-negative rates, thereby amplifying clinical risk under asymmetric error costs. The mechanism identified is specific to the binary malignant-versus-benign setting: random relabeling maps malignant forget samples to benign labels, so optimizing cross-entropy on these contaminated labels teaches the model to suppress malignant activations and shift the decision boundary toward higher specificity but lower recall [2604.23854].

The paper formalizes clinical safety through **Global Risk** metrics:
$$
\text{Risk}=\frac{C_{\mathrm{FP}}\cdot \mathrm{FP}+C_{\mathrm{FN}}\cdot \mathrm{FN}}{N}.
$$
Two scenarios are used. **Global Risk I** sets $C_{\mathrm{FN}}=1$ and $C_{\mathrm{FP}}=1$, while **Global Risk II** sets $C_{\mathrm{FN}}=20$ and $C_{\mathrm{FP}}=1$, representing clinically asymmetric costs in which missed malignancies are much more serious than false alarms. The medical study’s main conclusion is that unlearning validation based only on efficiency, privacy, and aggregate accuracy can obscure clinically dangerous shifts in sensitivity [2604.23854].

To address this failure mode, the paper introduces **SalUn-CRA (Clinical Risk-Aware)**, a class-dependent modification of SalUn. For malignant forget samples $\mathcal{D}_f^+$, SalUn-CRA avoids benign relabeling and instead maximizes predictive entropy,
$$
H(p(x;\theta))=-\sum_{c=1}^{C} p_c(x;\theta)\log p_c(x;\theta),
$$
pushing the prediction toward uncertainty rather than benign confidence. For benign forget samples $\mathcal{D}_f^-$, random relabeling is retained. The resulting objective is
$$
\mathcal{L}_{\text{CRA}}(\theta)=
-\,\mathbb{E}_{x\in \mathcal{D}_f^+}[H(p(x;\theta))]
+\mathbb{E}_{(x,y')\in \mathcal{D}_f^-}[\ell_{\mathrm{CE}}(\theta;x,y')]
+\alpha\,\mathbb{E}_{(x,y)\in \mathcal{D}_r}[\ell_{\mathrm{CE}}^{w}(\theta;x,y)],
$$
with the same saliency mask used to restrict updates to salient weights [2604.23854].

Empirically, SalUn-CRA changes the behavior of SalUn in the direction of recall preservation. On DermaMNIST with 20% removal, SalUn-CRA achieved specificity $0.85$, recall $0.78$, BAC $0.81$, TBAC $0.81$, and MIA $17.77$, while standard SalUn achieved specificity $0.88$, recall $0.72$, BAC $0.80$, TBAC $0.80$, and MIA $7.21$. On PathMNIST with 50% removal, SalUn-CRA achieved specificity $0.98$, recall $0.91$, BAC $0.94$, UBAC $0.00$, RBAC $1.00$, TBAC $0.94$, and MIA $1.98$, yielding the lowest Global Risk II and even outperforming Retrain in risk under asymmetric costs in that scenario. Across all reported medical scenarios, TBAC for SalUn-CRA remained within $0.00$–$0.02$ of Retrain while lowering or matching clinical risk and preserving unlearning effectiveness [2604.23854].

## 5. Data augmentation and medical-image evaluations

A separate line of work examined how data augmentation alters the behavior of SalUn and other MU methods. On CIFAR-10 and CIFAR-100, seven augmentation scenarios were compared: NoAug; Default; Default + RandAugment; Default + AutoAugment; Default + Random Erasing; Default + TrivialAugment; and Default + AugMix. The reported headline result is that appropriate augmentation can reduce the performance gap to retrained models by **up to 40.12% of the Average Gap unlearning Metric**, with **TrivialAugment** identified as a particularly strong default. In that study, SalUn was run for 10 epochs at learning rate $0.01$, starting from the pretrained model, with augmentations applied consistently to baseline training, retraining, and unlearning pipelines [2508.18502].

The augmentation effects were dataset-dependent. On CIFAR-100, TrivialAugment materially improved SalUn. At a 10% forget rate, the Average Gap dropped from approximately $19.20$ under Default to approximately $7.81$ under Default + TrivialAug; the UA gap fell from $29.86$ to $4.70$, the MIA gap from $39.09$ to $18.25$, and the TA gap from $6.91$ to $5.17$. At a 50% forget rate, the Average Gap dropped from approximately $18.61$ to approximately $11.32$. By contrast, on CIFAR-10, TrivialAugment did not reduce SalUn’s Average Gap at 10% forgetting and was essentially unchanged or slightly worse at 50%, which the study interprets as evidence that SalUn is less sensitive to augmentation on easier datasets [2508.18502].

Medical image classification studies offer a related but distinct picture. On BloodMNIST, OrganAMNIST, and PathMNIST, SalUn was evaluated with a ResNet-18, 64×64 images, 200-epoch initial training, and 10-epoch unlearning. At a forget rate of 10%, SalUn was close to Retrain on BloodMNIST and OrganAMNIST: on BloodMNIST, Retrain yielded UA $0.84$, RA $99.80$, TA $98.57$, MIA $1.76$, AG $0.00$, and RTE $22.2$ minutes, while SalUn yielded UA $0.00$, RA $99.92$, TA $98.89$, MIA $0.17$, AG $0.72$, and RTE $1.1$ minutes. OrganAMNIST showed similarly small gaps. PathMNIST was substantially harder: at 10% forgetting, Retrain had TA $87.77$ and MIA $1.06$, whereas SalUn had TA $77.49$ and MIA $4.43$; at 50% forgetting, Retrain had TA $91.80$ and MIA $1.93$, whereas SalUn had TA $83.87$ and MIA $6.60$ [2508.18509].

That medical study also reports that stronger augmentation, specifically **Default + RA**, generally improved the AG metric, indicating closer approximation to retraining, although the per-scenario numeric AG values for the augmentation ablation were presented qualitatively rather than tabulated. A plausible implication is that augmentation can improve SalUn not only by regularizing the retain-side optimization but also by reducing dependence on idiosyncratic patterns that would otherwise make selective forgetting unstable [2508.18509].

## 6. Limitations, trade-offs, and practical use

SalUn is consistently described as an **approximate** rather than certified unlearning method. The original paper explicitly does not claim formal guarantees, and later evaluations reinforce that its performance depends on hyperparameters such as the saliency threshold $\gamma$, sparsity ratio, and regularization weights $\alpha$ and $\beta$. Poor choices can induce over-forgetting or under-forgetting; larger forgetting fractions widen the gap to Retrain for all approximate methods, including SalUn; and residual memorization may remain detectable by sufficiently strong attacks [2310.12508].

Benchmark studies identify several additional limitations. In MU-Bench, SalUn struggled on speech and video, where correlated structure appears to frustrate current deletion losses; on summarization and LLM-based generation, it had limited influence relative to its classification strengths; and in NLVR2, deletion-set accuracy could become extremely low, which MU-Bench notes may reveal the existence of deletion and thus increase adversarial information-leakage risk. Parameter-efficient fine-tuning was also found to be restrictive: when the trainable fraction fell below roughly 50% of parameters, SalUn’s deletion-set accuracy tended to approach its remaining-set accuracy, indicating that selective forgetting could not be achieved even with larger learning rates and longer training [2406.14796].

Practical guidance in the literature is correspondingly conditional. The original SalUn work recommends the median of $|g_S|$ as a strong default for $\gamma$, giving roughly 50% sparsity, and suggests adjusting sparsity upward for larger forgetting sets to reduce collateral damage. For classification on CIFAR-10 with ResNet-18, the reported default is 10 epochs with learning rate in $[5\times10^{-4}, 5\times10^{-2}]$; for DDPM, 1000 iterations with Adam and learning rate $10^{-4}$; and for Stable Diffusion, 5 epochs with learning rate $10^{-5}$ and DDIM sampling with 100 steps [2310.12508].

In medical contexts, the literature recommends a stricter evaluation protocol. The clinical-safety analysis argues that deployment should always include asymmetric risk metrics such as Global Risk II, explicit monitoring of recall and false-negative rate, and, for binary malignant-versus-benign tasks, preference for entropy-based forgetting of malignant forget samples rather than deterministic benign relabeling. This suggests that standard SalUn is best suited to settings where random relabeling does not create a clinically asymmetric hazard, while SalUn-CRA is the more appropriate variant when false negatives are substantially costlier than false positives [2604.23854].

Taken together, the current literature presents SalUn as a weight-centric unlearning framework with unusually broad empirical reach, strong retained-utility characteristics, and clear efficiency advantages over full retraining, but also with modality-dependent failure modes and, in high-stakes domains such as medicine, safety properties that depend critically on how the forgetting objective is instantiated [2310.12508].

Source: https://www.emergentmind.com/topics/salun