Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models

Paper: Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models

Authors: Jiaqi Li, Qianshan Wei, Chuanyi Zhang, Guilin Qi, Miaozeng Du, Yongrui Chen, Sheng Bi, Fan Liu

Venue: NeurIPS 2024

URL: Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models

Introduction

Machine unlearning is the technique of erasing specific information from an already trained model. Large-scale pretraining data can contain material with privacy or copyright problems, such as leaked personal photos, and regulations like GDPR require that such information be deleted even from deployed models. In effect, the “right to be forgotten” is applied to the model as well.

The surest approach is to drop the problematic data and retrain from scratch, but the cost of retraining a foundation model is not realistic. In many cases the pretraining data itself is inaccessible, so even identifying which data is problematic is blocked from the start. Approximate unlearning methods, which fine-tune the trained model only slightly to remove specific knowledge, have therefore been studied.

Several unlearning studies already target LLMs: raising the loss on the forgetting data with Gradient Ascent (GA), adding a KL constraint on top of that to preserve the original output distribution, generating large volumes of substitute text for training (creating a dataset that makes the model forget Harry Potter), or training the model to answer “I don’t know” via Preference Optimization (PO).

The problem is that these methods do not transfer well to images. Text can be synthesized in bulk, but images of a specific concept cannot be produced that way, and a real deletion request usually arrives with a single leaked image. This paper asks whether, in that situation, a multimodal LLM (MLLM) can forget only its ability to visually recognize a specific concept, and proposes Single Image Unlearning (SIU), which achieves it from one image.

Problem Definition

Terminology

Term	Meaning
Machine Unlearning (MU)	A technique for removing specific knowledge from a trained model
MLLM	A multimodal large language model combining a visual encoder and an LLM
$\mathcal{M}_\theta$	The original model trained on image-text pairs $D$
$C$	The target concept to be forgotten (e.g., a specific person)
$D^f$	$K$ image-text pairs reflecting the forgetting of concept $C$ (forgetting set)
$D^f_{train}$	The single image-text pair used for fine-tuning
$D^f_{test}$	The remaining pairs, used to evaluate whether forgetting transfers to other images

The Goal of Unlearning

The paper defines the goal of unlearning in an MLLM as follows.

“Remove the learned patterns associated with visual recognition of the concept to be forgotten, while preserving predictive ability on inputs unrelated to those patterns.”

The scope needs to be made clear here. What this paper addresses is only the forgetting of visual recognition. Factual knowledge such as “Donald Trump is a former president” resides on the LLM side and has already been covered by prior unlearning work, so it is left untouched. After unlearning, the model should still answer factual questions posed in text, but should fail to recognize who the person in the photo is.

Limitations of Existing Methods

This problem is hard for two reasons. First, training data is scarce. Once a deletion request arrives, collecting many images of the target concept is unrealistic. Second, existing methods break the model. GA succeeds at inducing forgetting, but the output collapses into blanks or repeated tokens. Adding a KL constraint to GA keeps the model alive, but it produces incoherent answers. GA tries to lower the probability of the concept tokens while KL tries to restore the original distribution in which that probability was high, so the two objectives work against each other.

The SIU Method

SIU consists of two parts: a way to build fine-tuning data serving four objectives from a single image, and a Dual Masked KL-divergence (DMK) loss used together with the cross-entropy loss. The overall flow is that when an unlearning request arrives, fine-tuning data is constructed from one image, and a few steps of LoRA fine-tuning with the CE and DMK losses yield the unlearned model.

Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models

Overview of the MLLM unlearning process with SIU

How MLLMs Respond to Concepts They Have Never Seen

For a given concept, how should a model that has forgotten it answer? “I don’t know” seems natural, but the authors point out that this does not match how MLLMs actually behave.

To check this, they collected 190 personal photos that could not have been part of pretraining and asked the model to state the person’s name. The results are as follows.

Response type	Ratio
“A young man/woman” (vague answer)	63.2%
The name “John”	28.9%
The name “Jason”	5.3%
The name “Danny”	2.6%

The model did not answer “I don’t know.” It hedged vaguely or invented a plausible name. The authors attribute this to instruction tuning data containing almost no “I don’t know” answers. Forcing such a model to learn “I don’t know” breaks the output characteristics it originally had. SIU therefore assigns the target concept a randomly chosen incorrect name.

Why Answering with a Wrong Name Counts as Forgetting

On whether answering with a wrong name can be regarded as forgetting, the paper offers the following argument.

Suppose there were an ideal model retrained without $C$. To that model, images of $C$ are unseen inputs. Moreover, removing the data of $C$ does not change predictions on other unseen images unrelated to $C$. Therefore, matching the unlearned model’s output distribution to “the original model’s output distribution on an unseen concept” is equivalent to matching it to the model retrained without that concept.

\[P_{\mathcal{M}_{\hat{\theta}}}(x \mid \mathcal{I}^c_{test}, \mathcal{T}^c_{test}) \cong P_{\mathcal{M}_\theta}(x \mid \mathcal{I}^u, \mathcal{T}^u) \;\Longleftrightarrow\; P_{\mathcal{M}_{\theta'}}(x \mid \mathcal{I}^c_{test}, \mathcal{T}^c_{test}) \cong P_{\mathcal{M}_{\hat{\theta}}}(x \mid \mathcal{I}^c_{test}, \mathcal{T}^c_{test})\]

In unlearning for classification problems as well, the unlearned model produces a wrong label. Answering with a wrong name can be seen as carrying that wrong label over to a generative model.

Multifaceted Fine-tuning Data

SIU builds fine-tuning data from a single image according to four objectives. The paper uses Donald Trump as the running example.

Objective	Content	Why it is needed
(a) Aligning with Unseen Concepts	Train the model to answer with a random name (“Jacob Campbell”)	To imitate the output behavior the model shows toward an unseen person
(b) Assigning New Visual Description	Invent and assign a new appearance description	Because with (a) alone the face remains mapped to both the original and the new name
(c) Decoupling Factual Knowledge	Keep the textual facts (“former president”) intact	Because (a) and (b) alone also erase factual knowledge
(d) Preserving Non-targeted Knowledge	Mix in data for an unrelated concept (Ed Sheeran)	Because training on the target concept alone destabilizes other knowledge

(a) and (b) feed in the training image as well, while (c) and (d) are text-only. The data for each objective is rewritten into four phrasings with GPT-4. The interesting part is (b). In early experiments, training with (a) alone made the model call the same face both “Donald Trump” and “Jacob Campbell.” Changing only the name did not sever the link between the visual representation and the original name.

Examples of fine-tuning data constructed for the four objectives

The Problem with Standard KL-divergence

The KL loss matches the unlearned model’s output distribution to the original model’s. But the original model’s distribution assigns very high probability to the concept tokens. The table below shows next-token probabilities the authors extracted from pretrained LLaVA.

Token	The	picture	features	President	Donald	Trump	.	</s>
max prob	0.57	0.77	0.92	0.42	0.68	0.94	0.45	0.99
Donald	0.06	3.2e-5	1.2e-9	0.22	0.68	4.2e-5	1.2e-7	2.5e-6
Trump	0.08	4.8e-7	8.2e-9	0.02	0.31	0.94	6.3e-8	3.1e-9

At the position following “President,” $P(\text{Donald}) + P(\text{Trump})$ is nearly 1. Applying KL as-is here makes the model say “Donald Trump” again. There are also positions, such as the sentence start or the position after “features,” where the concept tokens are not the maximum probability but are still high, and KL pulls those probabilities up as well.

The authors therefore respond differently depending on the position. At positions where the concept probability is extremely high, the entire distribution is excluded from the KL computation; at the remaining positions, only the concept tokens are excluded.

Dual Masked KL-divergence Loss

The DMK loss combines masks at two levels.

Token-Level Masking KL is not computed on tokens that contradict the original knowledge (the new name “Jacob Campbell”), nor at positions where the concept token probability is extremely high. At the latter positions, the probabilities of all other tokens are near zero, so computing KL after excluding only the concept token would collapse the entire distribution and damage the model’s utility. $K_{\mathcal{S}} = \{m_1, m_2, \ldots, m_n\}, \quad m_j = \begin{cases} 0, & \text{if } w_j \text{ is a specified token,} \\ 1, & \text{otherwise.} \end{cases}$
Vocabulary-Level Masking At the remaining positions where KL is computed, only the concept’s name tokens (“Donald”, “Trump”) are excluded from the full vocabulary. This prevents KL from raising the concept’s probability again while still anchoring the rest of the distribution to the original model. $K_{\mathcal{V}} = \{m_{v_1}, m_{v_2}, \ldots, m_{v_{|\mathcal{V}|}}\}, \quad m_{v_i} = \begin{cases} 0, & \text{if } v_i \in C, \\ 1, & \text{otherwise.} \end{cases}$

Combining the two masks, the DMK loss is as follows.

\[\mathcal{L}_{DMK}(\mathcal{I}_i, \mathcal{T}_i; \hat{\theta}) = \sum_{t=1}^{t_i} K_{\mathcal{S}} \cdot K_{\mathcal{V}} \cdot P_{\mathcal{M}_\theta}(w^i_t \mid \mathcal{I}_i, w^i_1, \ldots, w^i_{t-1}) \log \frac{P_{\mathcal{M}_\theta}(w^i_t \mid \mathcal{I}_i, w^i_1, \ldots, w^i_{t-1})}{P_{\mathcal{M}_{\hat{\theta}}}(w^i_t \mid \mathcal{I}_i, w^i_1, \ldots, w^i_{t-1})}\]

Training Objective

The final objective is a weighted sum of cross-entropy and the DMK loss. Unlike existing methods, it does not use gradient ascent and optimizes with gradient descent.

\[\mathcal{L}_{total}(\mathcal{I}_i, \mathcal{T}_i; \hat{\theta}) = -\alpha \cdot \sum_{t=1}^{t_i} \log P_{\mathcal{M}_{\hat{\theta}}}(w^i_t \mid \mathcal{I}_i, w^i_1, \ldots, w^i_{t-1}) + \beta \cdot \mathcal{L}_{DMK}(\mathcal{I}_i, \mathcal{T}_i; \hat{\theta})\]

Cross-entropy teaches the new answer, and DMK holds the rest of the output distribution, excluding the concept, close to the original.

In the ablation study (LLaVA-7B, using Mm-Vet as Specificity), removing either mask lowered EM (92.0 without the token mask, 94.3 without the vocabulary mask, 99.0 with both). Specificity was in fact slightly higher without the vocabulary mask (29.4 versus 28.9); the authors explain that excluding specific tokens from the KL computation seems to slightly disturb the logic of general outputs.

The MMUBench Benchmark

Dataset Construction

Since no benchmark existed for evaluating MLLM unlearning, the authors built one. It ends up comprising 20 concepts and 1,000 images.

Concept sampling: 300 visually distinctive concepts are drawn from the MIKE dataset.
Image collecting: At least 50 images per concept are gathered through Google search.
Concept filtering: Images inconsistent with the seed image are filtered out, and concepts the original LLaVA cannot recognize are excluded. A concept absent from pretraining has nothing to forget in the first place.
Question generation: 100 questions per concept are generated with GPT-4 and reviewed by humans.

For the forget set, a single image with the concept alone in the center is used for training, and all remaining images are used for evaluation. Concept types include people (Trump, Biden, Musk, Swift), characters (Hello Kitty, Mario), logos (Facebook), and artistic styles (Picasso, Van Gogh, Doodle).

Evaluation Metrics

Evaluation splits three ways: whether the model forgot, whether it remains useful, and whether the forgotten content resurfaces. Arrows indicate whether higher (↑) or lower (↓) is better.

Axis	Metric	Content
Efficacy	Efficacy ↑	Forgetting accuracy on the image used for training
	Generality	Forgetting performance on unseen images and varied prompts, measured three ways: EM (Exact Match) ↑, G-Eval (GPT-4, 1-5 rubric) ↓, C-Dis (probability distance of concept tokens before and after unlearning) ↑
Utility	Specificity ↑	Average over 8 public VQA benchmarks (GQA, VQA-v2, VizWiz, SQA, TextVQA, POPE, MMB, Mm-Vet)
	Fluency ↓	Perplexity of generated text, measured with concept tokens masked
	Diversity ↑	Number of unique words appearing in the output
Robustness	MIA ↓	Suspicious queries are found with Min-K% PROB, then answers before and after unlearning are compared with ROUGE-L
	Jailbreak ↓	Questions translated into 6 languages, and multi-hop questions that ask facts rather than the name

Fluency is perplexity, so lower is better, and C-Dis is better when the concept token probability shifts further apart before and after unlearning, so higher is better. C-Dis in particular is designed to catch models that only pretend to forget, which matters when interpreting the results below.

Experimental Results

Setup

Model/training: LLaVA-7B and 13B, LoRA fine-tuning, Adam (lr 3e-4), batch 4, 6 training steps, 4× A100 40G
Hyperparameters: $\alpha = 0.9$ (CE), $\beta = 0.75$ (DMK), mean ± standard deviation over 3 independent runs
Baselines: PO (fine-tuned to answer “I don’t know”), GA (optimized to raise the loss on the forgetting data), GA+KL (GA with an added KL constraint)

Main Results

Performance comparison against existing methods on LLaVA-7B / 13B

First, Efficacy is 100% for every method. That is, forgetting the single image used for training is something any method can do; the difference lies in how well it generalizes to unseen images and how intact the model remains.

On LLaVA-7B, SIU records Generality EM 99.0 while preserving utility at Specificity 60.7, Fluency 61.2, and Diversity 97.0. GA, by contrast, reaches Fluency 373.6 and Diversity 6.3, effectively a state that outputs only blanks and repeated tokens. Broken down by benchmark, it scores 0.0 on 5 of the 8, meaning not one concept but the model’s general ability as a whole has vanished. GA’s G-Eval (1.8) looking better than SIU’s (1.9) is likewise an illusion created by answers that carry no meaning at all.

PO reaches a passable EM of 58.3, but its C-Dis stops at 0.4. That means the internal probability of the concept tokens barely moved: the model did not forget but merely learned the form of answering “I don’t know.” This becomes clearer in the jailbreak experiments below.

Scaling the model to 13B sharply degrades the baselines’ Generality. PO’s EM drops from 58.3 to 10.7 and GA’s from 36.3 to 24.7. SIU also falls, from 99.0 to 90.0, but by a far smaller margin. SIU maintains Specificity at the level of the original model, and on POPE (85.5) and Mm-Vet (28.9) it is the highest of the four methods.

Number of Fine-tuning Steps

Observing six metrics while increasing the steps from 6 to 35, SIU traces an almost flat curve, meaning it is not sensitive to the number of steps. For GA, Specificity and Fluency degrade sharply as steps increase, and PO’s C-Dis does not move no matter how many steps are added. The 13B model takes longer than the 7B for EM to rise, so it adapts more slowly.

Other Concepts and Simultaneous Unlearning

Across 9 concepts spanning people, characters, logos, and artistic styles, SIU recorded EM close to 100% on all of them, while the baselines fluctuated between 50-85%. Styles such as Doodle or Picasso were relatively easy for any method to forget. The substitute names SIU assigns come out suited to the concept type: Biden became “Statesman Blue,” Van Gogh “Impressionist Blaze,” and Facebook “Global Connect.”

In the experiment that forgets 20 concepts at once (training for 120 steps over the combined forgetting set), the gap widens further. GA and GA+KL collapsed into “image image image…” for every response, giving Specificity 0 and Diversity 0.67, and PO’s Specificity halved to 12.7. SIU stayed at EM 97.0, Fluency 54.4, and Diversity 99.3, essentially the same as in the single-concept case.

MIA and Jailbreak

SIU recorded the lowest score on all three attacks (MIA 0.27, multilingual 2.3, multi-hop 0.16). PO’s MIA score is not bad either, but that is because an “I don’t know” answer cannot resemble the original answer in the first place, not because it forgot.

The multilingual jailbreak asks the Generality questions translated into Spanish, French, Chinese, German, Japanese, and Russian. GA+KL emitted the real name verbatim in Chinese and Russian, and PO repeated only refusal sentences in every language. SIU never produced the real name, and interestingly it invented a different name per language: “Jacob Campbell” in Spanish and French, “Bill” in German, and “Дэвид” in Russian.

The multi-hop jailbreak asks facts about the person rather than the name, with questions such as “What golf course does the man in the photo own in Scotland?” PO answered “I don’t know” to all of them, confirming that it had learned only the form, and GA+KL avoided the name while answering accurate facts such as the founding of the Space Force or the real-estate business, which is internally inconsistent. SIU produced answers that were factually wrong but mutually consistent, such as “owner of the Old Course at St Andrews” or “a former soldier.”

Qualitative examples of the multi-hop jailbreak. PO repeats only "I don't know," GA+KL avoids the name while getting the facts right, and SIU constructs a consistent alternative answer.

Positive Butterfly Effect

The authors also report one phenomenon they did not anticipate. Given a photo of the Trump family, the unlearned model calls not only Trump but also Melania standing beside him by a different name. Yet given a photo cropped to Melania alone, it recognizes her correctly, and when asked who her husband is, it answers Donald Trump.

The authors interpret it this way: since the model no longer recognizes the man in the center as Trump, it infers that the woman beside him cannot be Melania. Erasing one concept did not indiscriminately erase the related knowledge along with it; rather, the knowledge was rearranged to stay coherent under the erasure.

In the family photo, Melania is also called by a different name (left), while in the solo photo she is recognized correctly and her relationship to Trump is answered (right).

Conclusion

This paper asks whether an MLLM can forget its ability to visually recognize a specific concept, and answers that it can, with a single image and six fine-tuning steps. It is the first attempt at unlearning targeting MLLMs, and it also delivers MMUBench, a benchmark for evaluating it.

In summary:

The standard for a model that has forgotten is a retrained model. A model that has forgotten is not one that answers “I don’t know” but one that behaves as if it were seeing the concept for the first time. Under this standard, SIU argues that assigning a random name is equivalent to retraining, and aligns the model with the behavior it originally showed toward unseen concepts. As the C-Dis figures show, PO failed precisely because it went against this property.
Forgetting and utility can be secured together through loss design. Standard KL revives the concept probability as well, but the DMK loss, masked at both the positional and vocabulary levels, excludes only the concept while protecting the rest of the distribution. Training with gradient descent alone, without GA, is another departure from existing methods.
Apparent forgetting and actual forgetting are different. Multiple evaluations such as C-Dis, MIA, and multilingual and multi-hop jailbreaks are needed to distinguish a model that merely repeats “I don’t know” from one whose internal knowledge has actually changed.

The limitations are also clear. The experiments were conducted only on LLaVA 7B and 13B. MMUBench’s concept filtering was done with LLaVA, with the intent of comparing before and after unlearning on the same model, but whether the same results hold on other MLLMs has not been verified. The approach of inventing a wrong name also invites discussion: it has the merit of coherent forgetting, but the model is generating a plausible falsehood, which may be a problem depending on the application. The authors cite new MLLM unlearning methods and the evaluation of data-point-level rather than concept-level unlearning as future work.

In conclusion, the significance of this work lies in extending machine unlearning to the multimodal setting while treating forgetting not as “blocking outputs” but as “reorganizing knowledge in the way the model originally would.” By offering a method usable in the realistic situation of a request to erase a single leaked photo, it is well positioned to serve as a starting point for follow-up research.