Paper: Benchmarking Vision Language Model Unlearning via Fictitious Facial Identity Dataset
Authors: Yingzi Ma, Jiongxiao Wang, Fei Wang, Siyuan Ma, Jiazhao Li, Jinsheng Pan, Xiujun Li, Furong Huang, Lichao Sun, Bo Li, Yejin Choi, Muhao Chen, Chaowei Xiao
Venue: ICLR 2025
Introduction
A Vision-Language Model (VLM) can learn to associate face images with textual information such as names, addresses, and health records. When a user requests deletion of their information, retraining the whole model from scratch is the surest approach, but retraining a large VLM for every request is highly impractical. Machine unlearning aims to remove the influence of selected data without such full retraining.
Existing multimodal unlearning research focused on image-text matching or removing particular visual concepts. What matters in deleting personal information, however, is not making the model unable to recognize the shape of a face, but severing the learned association between the visual facial information and the textual personal information.
For example, the model should still be able to describe the expression, glasses, or hair color of the person in a photo. By contrast, the paper emphasizes that the name, address, and medical records learned together with that face should no longer be answerable or recoverable.
Fictitious Facial Identity Dataset Construction
Using the personal information of real people would make the benchmark itself a new privacy risk. It is also hard to control how much a pretrained model already knew about those people. To avoid these problems, FIUBench uses synthetic faces and randomly constructed fictitious profiles.
First, the SFHQ synthetic face dataset is converted into CLIP features and grouped into 400 clusters with UMAP and K-means. One image is selected from each cluster to reduce repetition of similar-looking faces.
Each face is then randomly linked to a fictitious profile including a name, occupation, address, phone number, health records, criminal records, and so on. GPT-4o then generates 20 question-answer pairs per profile.
\[400\ \text{identities} \times 20\ \text{QA pairs} = 8000\ \text{VQA pairs}\]Because faces and profiles are linked arbitrarily, the answers are not existing knowledge of the pretrained model. The paper also confirms that the privacy keyword overlap of the model before fine-tuning is only 3.4%. If the model can subsequently state the correct answers, that knowledge can be regarded as newly formed during the benchmark’s training process. The paper set out to check whether the generated fictitious profiles and their face dataset were included in the pretrained model’s existing knowledge, and the 3.4% privacy keyword overlap before fine-tuning shows that this fictitious dataset was not part of the pretrained model’s pretraining.
Two-Stage Pipeline
Because it is hard to know how many times a particular piece of personal information appeared in real pre-training data, FIUBench applies a two-stage pipeline that first trains the knowledge to be deleted and then removes the knowledge of some individuals.
Stage I: Learning
The model is fine-tuned to take a face image and a privacy question as input and generate the profile’s correct answer auto-regressively, so that it learns the face-text information.
Stage II: Unlearning
The training data is split into a forget set and a retain set at the identity level. In the default 5-95 split, all QA pairs of 20 people are used as the forget set and the information of the remaining 380 people is preserved. Since one person’s questions never appear in both sets, the same personal information cannot be re-supplied through the retain data.
An ideal unlearned model should behave similarly to a Retain Model trained only on the retain set, having never seen the forget set data.
Unlearning Methods
FIUBench applies four unlearning methods used in LLM unlearning to VLMs.
Gradient Ascent (GA) raises the loss on the forget answers to lower the probability of the original correct answers. It can corrupt the correct answers quickly, but has the drawback that stronger updates can damage general generation ability as well.
Gradient Difference (GD) raises the loss on the forget set while minimizing the normal loss on the retain set. It considers preservation more than GA, but the forget and retain gradients can conflict.
KL Minimization (KL) applies GA on the forget set while constraining the retain set’s output distribution not to deviate far from the original model. Preserving existing behavior can come at the cost of weaker deletion.
Preference Optimization (PO) replaces private answers with a refusal response such as I cannot answer that. so the model learns to refuse those questions. It can force personal information not to appear in the output, but does not guarantee that the internal likelihood of the original answer is removed as well.
Evaluation
FIUBench uses three evaluation axes: Model Utility, Forget Quality, and Robust Evaluation.
Model Utility checks whether retain knowledge and general VLM ability are preserved. Answers on the retain set are evaluated with ROUGE-L, semantic correctness, and Truth Ratio, and general image understanding is evaluated with the MME and POPE metrics.
Forget Quality evaluates whether the unlearned model and the Retain Model behave similarly on the forget set. Whether private keywords reappear in generated answers is checked with Exact Match, and the Truth Ratio distributions of the two models are compared with a KS test. A high KS p-value can be read as meaning the unlearned model’s distribution is statistically hard to distinguish from a Retain Model that never learned the information in the first place.
Robust Evaluation takes into account that a VLM can handle questions with the same meaning in various forms, and aims to provide robust measures using membership inference attacks and carefully designed adversarial privacy attacks.
- Membership Inference Attack (MIA) uses the likelihood of the K% of answer tokens to which the model assigns the lowest probability. If forget answers still receive high likelihood like training members, it can be read as evidence that learning traces remain.
- Adversarial Privacy Extraction (APE) paraphrases the forget questions into various forms and checks whether private keywords can be extracted again. It is designed to identify models trained to refuse only the original question phrasing.
Experimental Results
After Stage I fine-tuning, the model becomes able to answer by linking the fictitious faces to profiles.
The key result of Stage II is that none of the four methods satisfied forgetting and utility at the same time.
- GA quickly lowers the probability of the forget answers but also substantially damages model utility.
- GD uses the retain loss as well and is better balanced than GA, but does not avoid performance degradation.
- KL preserves the existing distribution but struggles to achieve sufficient unlearning.
- PO lowers Exact Match and APE, but unlearning was not effective under MIA.
For gradient-based methods, the forget metrics improve as unlearning steps increase, but retain performance keeps declining as well. This can be read as meaning that a low answer rate is obtainable by damaging the model enough.
The PO result shows the gap between the direct output and the internal knowledge. If the model outputs a refusal to a privacy question yet assigns high likelihood to the correct answer sequence, it is merely understanding the question and hiding the answer, and the knowledge itself can hardly be said to have been removed.
Limitations
FIUBench injects fictitious knowledge through Stage I fine-tuning in order to control the source and exposure of the information. This design has the advantage of allowing a clear before-and-after comparison of unlearning, but it differs from real personal information learned repeatedly across many contexts in web-scale pre-training.
The Retain Model provides an ideal reference close to full retraining, but the mere fact that the two models’ output distributions are similar cannot prove that the information was completely deleted at the parameter level. MIA likewise depends on a particular score and attacker assumptions, so the paper explains that a low attack success rate should not be interpreted as a complete deletion certificate.
There is also the limitation that synthetic faces and formulaic VQA are convenient for control but do not sufficiently reflect the diversity of real privacy requests. In a real service, the deletion target may be personal information repeatedly linked across documents, conversation logs, and multiple images.
Conclusion
FIUBench defines VLM unlearning not as the problem of removing the visual features of a face but as the problem of selectively removing the textual personal information linked to that face. To that end, it builds 400 synthetic faces and 8,000 private VQA pairs and proposes a two-stage pipeline that first trains the knowledge and then deletes part of it at the identity level.
The paper’s most important contribution lies not in presenting a new unlearning algorithm but in the new evaluation criteria. Rather than checking only whether personal information appears in the output, it also evaluates distributional comparison with a model that never learned the information, membership inference attacks, and privacy extraction using paraphrased questions.