Unlearning Comparator: A Visual Analytics System for Comparative Evaluation of Machine Unlearning Methods

TL;DR

Unlearning Comparator addresses the lack of standardized MU evaluation by delivering a visual analytics workflow for pairwise model comparison and attack-based privacy assessment. It introduces a Worst-Case Privacy Score to robustly quantify privacy under strong attacker assumptions and provides an integrated UI for building, screening, contrasting, and attacking MU models. Through a case study on CIFAR-10 with ResNet-18 and ViT-B/16, the authors reveal nuanced trade-offs across accuracy, efficiency, and privacy, and derive Guided Unlearning (GU) with Warm-Up, Forgetting, and Recovery stages that outperforms baselines. Expert feedback supports the approach's usefulness and outlines future extensions, including broader unlearning scenarios and privacy evaluations without retraining. The work demonstrates how visual analytics can accelerate MU research and yield actionable design insights for more effective unlearning methods.

Abstract

Machine Unlearning (MU) aims to remove target training data from a trained model so that the removed data no longer influences the model's behavior, fulfilling "right to be forgotten" obligations under data privacy laws. Yet, we observe that researchers in this rapidly emerging field face challenges in analyzing and understanding the behavior of different MU methods, especially in terms of three fundamental principles in MU: accuracy, efficiency, and privacy. Consequently, they often rely on aggregate metrics and ad-hoc evaluations, making it difficult to accurately assess the trade-offs between methods. To fill this gap, we introduce a visual analytics system, Unlearning Comparator, designed to facilitate the systematic evaluation of MU methods. Our system supports two important tasks in the evaluation process: model comparison and attack simulation. First, it allows the user to compare the behaviors of two models, such as a model generated by a certain method and a retrained baseline, at class-, instance-, and layer-levels to better understand the changes made after unlearning. Second, our system simulates membership inference attacks (MIAs) to evaluate the privacy of a method, where an attacker attempts to determine whether specific data samples were part of the original training set. We evaluate our system through a case study visually analyzing prominent MU methods and demonstrate that it helps the user not only understand model behaviors but also gain insights that can inform the improvement of MU methods. The source code is publicly available at https://github.com/gnueaj/Machine-Unlearning-Comparator.

Figures (14)

• Figure 1: Comparative MU evaluation workflow of Unlearning Comparator. The workflow guides users through four iterative stages. In the Build stage, users generate various unlearned models, followed by the Screen stage where they use summary metrics to select two for in-depth analysis. The Contrast stage involves comparing the selected pair from class-, instance-, and layer-level perspectives to understand model behaviors. Finally, the Attack stage verifies privacy by simulating membership inference attacks. Insights from all stages then guide iterative refinement of the unlearning methods.
• Figure 2: Unlearning Comparator assists MU researchers in analyzing and comparing MU methods. (A) The Model Builder (shown in \ref{['fig:build_screen']}A) creates unlearned models. (B) The Model Screening view lets users obtain an overview and select two models for deeper inspection. (C) The Metrics view highlights class-level performance and internal representation changes. (D) The Embedding Space view displays each model’s feature embeddings side-by-side. (E) The Attack Simulation view (shown in \ref{['fig:attack']}) performs membership inference attacks to verify that no residual signal remains about the unlearned data.
• Figure 3: Users configure unlearning settings in the Model Builder (A) to generate candidate models. By selecting multiple values for each hyperparameter, they can build multiple models at once; all combinations are generated automatically. They then review each model’s performance in the Model Screening view (B), which presents summary metrics and reveals epoch-wise metrics upon clicking a row, allowing users to select two for deeper comparison.
• Figure 4: Comparison of privacy metrics using FT beyond zero unlearning accuracy. C-MIA prematurely reaches and remains at 1.0 due to its reliance on raw confidence, while E-MIA incorrectly declines as the model confidently misclassifies samples. In contrast, WCPS progressively increases, reflecting the convergence toward the retrained model's distribution.
• Figure 5: The Metrics view provides metrics that reveal how an unlearning method targets the forget class while preserving the retain classes. (A) Class-wise Accuracy chart displays the per-class accuracy differences to examine high-level trade-offs. (B) Prediction Matrix visualizes predicted proportion and average confidence to inspect misclassification patterns, and (C) Layer-wise Similarity chart shows the similarity of layer representations against the original or the retrained models to reveal changes in internal representations.