The advancement of generative artificial intelligence (AI) has made the machine unlearning essential for resolving data privacy and copyright issues. While retraining models from scratch is efective, it is computationally expensive, and fine-tuning, a common alternative, sufers from catastrophic forgetting. To overcome this problem, this study proposes a two-step framework for auxiliary classifier-based generative adversarial network called "Discriminator-Guided Unlearning." Instead of directly targeting the generator, we intentionally weaken the ability of the discriminator to recognize specific classes. Feedback from this weakened discriminator guides the generator to avoid generating images of that class. Experiments suggest that our framework achieves efective forgetting performance comparable to retrained models while maintaining the quality of the remaining classes, efectively mitigating "catastrophic forgetting." Our approach provides a promising direction for building trustworthy AI.
Generative artificial intelligence (AI) techniques, such as generative adversarial networks (GANs) [
In machine unlearning, the simplest approach is to remove the data to be forgotten and then retrain the
model from scratch using the remaining dataset. While this approach has the advantage of completely
removing desired information, the enormous time and computational resources required for training
make it impractical [
Therefore, we propose a practical and efective selective unlearning framework that avoids both the
excessive cost of retraining and the performance degradation of fine-tuning. The proposed framework
is composed of a novel two-step method of “discriminator-guided unlearning," which is specialized for
auxiliary classifier-based GAN (ACGAN) [
The remainder of this paper is organized as follows. In Section 2, we introduce the theoretical background of GANs and machine unlearning methods. In Section 3, we describe the details of the proposed framework and then present experimental results in Section 4. Finally, in Section 5, we summarize our study and present the conclusions.
This section briefly reviews GANs and machine unlearning methods, which are the core technologies of our research, and explains why we adopted ACGAN and a discriminator-based unlearning strategy.
GANs, first proposed by Goodfellow [
In this study, we adopted the ACGAN [
Machine unlearning research explores how to eficiently remove the influence of specific data from
trained models. As comprehensively surveyed by [
Most of these methodologies focus on directly modifying the generator to induce forgetting. These
include improving the fine-tuning process via techniques like label reversal [
However, most of these methodologies risk degrading the performance of other classes when removing information from the target class. Therefore, we propose a novel approach that allows for efective unlearning while preserving the quality of generation for other classes by initially focusing on the discriminator.
In this paper, we propose a novel two-step selective unlearning framework for ACGAN models to efectively remove certain forgetting classes . The overall flow of the proposed framework is summarized in Figure 1. In the first step, the goal is to “confuse” the discriminator ( ) so that it cannot clearly distinguish the forgetting class ( ). In the second step, we utilize the feedback from this confused discriminator to guide the pre-trained original generator () to no longer generate images of class .
The first step of unlearning is the "soft forget" process described in the left panel of Figure 1. In this step, a new generator () and a new discriminator () are trained together from scratch. The main goal of this phase is to selectively weaken the ability of the discriminator to determine the forgetting class . To do this, the source discrimination loss is modified when a true image ( ) that belongs to the forgetting class is input to the discriminator.
In the ACGAN in this experiment with hinge loss, discriminator D is trained to output () ≥ 1
for the real image and () ≤ −1 for the fake image . In the proposed framework, we
introduce a hyperparameter, a ‘soft target’ ∈ [
Let denote the true image of class , denote the true image of the forgetting class , denote the latent vector, and denote the source output of the discriminator. In the third term (the unlearning term), if = 1, the loss is equal to the hinge loss. If = 0, the discriminator is trained to classify real images of class as fake. Through this process, we ultimately obtain a discriminator () whose judgment on class is intentionally weakened.
Mathematically, the total GAN loss for the discriminator, ,, is expressed as follows:
, = E,̸= [max(0, 1 − ())] + E,′ [max(0, 1 + ((, ′)))] ⏟ ⏟ Fake (All⏞Classes) + E [ · max(0, 1 − ( )) + (1 − ) · max(0, 1 + ( ))] ⏟
(1) 3.2. Step 2: Generator and Discriminator Final Fine-tuning The second step corresponds to the right panel of Figure 1. The goal of this step is to complete the ifnal training using the ‘confused’ discriminator ( ) obtained in step 1, and to ensure that the pre-trained original generator () no longer produces images of the forgetting class .
In this step, the loss function of the discriminator remains the same as in step 1, which means that the discriminator continues to be trained in a confused state for class . The key change is in the loss function of the generator. When the generator attempts to generate an image of the forgetting class , it is penalized in the opposite direction to the standard GAN loss. The GAN loss for the generator ,, is split into two parts.
, = E,̸= [− ((, ))] + E[((, ))]
⏟Penalty for ⏞forget class (2) The first term is the standard hinge loss, which trains the output of the discriminator to be closer to +1 (to look real) when the generator produces an image of a class other than . The second term, on the other hand, teaches the generator to minimize the output of the discriminator for class , i.e., to get closer to -1 (look more fake). Since already tends to give a low score for class , the generator will naturally avoid generating images of this class in the process of minimizing this penalty term. The total loss of the generator is = , + · ,.
This section details the experimental setup and experimental results. Especially, we evaluated the proposed framework by four aspects: qualitative, quantitative, runtime (eficiency), and attack-based robustness.
Our experiments were conducted on the representative image generation benchmark datasets MNIST,
FashionMNIST, SVHN, and CIFAR-10. All experiments were performed on a system equipped with two
NVIDIA RTX 5000 Ada Generation GPUs. To ensure consistency and reliability, we utilized the same
ACGAN architecture in all experiments, which combines the structural advantages of ResNet [
Original / Retrain Step 1 (Soft Forgetting) Step 2 / Finetune T S I N M T S I N M n o i h s a F N H V S 0 1 R A F I C
To analyze visually the efectiveness of the proposed discriminator-guided unlearning framework, we compare images generated using a fixed noise vector for each model. Figure 2 shows these qualitative results. Each row corresponds to a diferent dataset (MNIST, SVHN, Fashion-MNIST, CIFAR-10), and each column represents the output of a diferent model: (a) Original, (b) Retrain, (c) Finetune, (d) Our proposed model. In all experiments, specific classes are targeted for forgetting (‘3’ in MNIST, ‘3’ in SVHN, ‘coat’ in Fashion-MNIST, ‘cat’ in CIFAR-10).
The results consistently suggest the efectiveness of the proposed framework. As shown in columns (a) and (b), the original model successfully generates all classes, and the retrained model suppresses the generation of forgotten classes while maintaining high quality for the remaining classes. In contrast, the fine-tuned model (c) exhibited a "catastrophic forgetting" phenomenon. This phenomenon is most evident in the complex CIFAR-10 dataset, where a degradation in image generation quality for the remaining class is observed.
The proposed framework (d) successfully unlearns the forgetting target class in all datasets, producing images of that class with unrecognizable noise patterns. Moreover, the image quality of the remaining nine classes is preserved at almost the same level as the retraining model (b). This consistency is maintained regardless of the complexity of the data, from simple black and white numbers in MNIST to complex color objects in CIFAR-10.
In summary, the qualitative results demonstrate that the proposed framework selectively and efectively removes the target class without "catastrophic forgetting."
FID(, ) = || −
||2 + Tr(Σ + Σ − 2(Σ Σ)1/2) MMD2(, ) = E,′∼ [(, ′)] + E,′∼ [(, ′)] − 2E ∼ ,′∼ [(, ′)] IS() = exp(E∼ [KL((|)||())]) (3) (4) (5) The interpretation of these metrics is nuanced depending on the evaluation scenario. In the retention scenario, the standard interpretation holds, as the goal is to preserve high-quality generation for the remaining classes. Conversely, in the forgetting scenario, the objective is to fail at generating the target class; therefore, a higher FID/KID score is interpreted as more efective unlearning, as it signifies that the generated outputs have successfully collapsed into a noise distribution far from the real data. The results clearly show the superiority of our method in achieving a balance between efective forgetting and knowledge preservation on all test datasets.
In the forgetting scenario, which measures how well the target class is removed, our method achieves a much more complete unlearning efect than all baseline models. The forgetting FID/KID scores are significantly higher, indicating that the images generated for the target class have successfully collapsed into unrecognizable noise. For example, on FashionMNIST, the forgetting FID (417.23) is significantly higher than the fine-tuning (131.30). More importantly, this strong forgetting ability does not lead to "catastrophic forgetting." In the retention scenario, our framework consistently and significantly outperforms the fine-tuning model. For MNIST and FashionMNIST, retention performance is better than the retrained baseline model, suggesting a positive generalization efect from our unlearning process. Even on the more complex CIFAR-10 dataset, performance remains competitive with the retrained model.
In this section, to demonstrate eficiency, we compare the execution times of retrain, finetune, and our proposed framework. As shown in Table 3, the execution phase of our framework is significantly faster than full retraining, ofering a crucial advantage for time-sensitive removal requests. More importantly, unlike fine-tuning approach that ofer comparable speed but sufer from catastrophic forgetting phenomenon, our framework maintains high image quality comparable to much slower retraining models.
This section presents qualitative evidence from a model inversion attack and quantitative proof from a membership inference attack (MIA). This section aims to more directly and rigorously quantify the absence of specific learned information. A model inversion attack visually probes the conceptual knowledge of the model. In contrast, MIA aims to determine whether a specicfi data point was part of the original training set of the model by exploiting subtle diferences in the output of the model on training data versus unseen data. Therefore, for an unlearned class, an efective unlearning method should obscure these behavioral diferences, thereby reducing the attack accuracy.
MNIST
SVHN
The qualitative results in Figure 3 are unequivocal. The reconstructed image for the forgotten class ‘3’ in our model (d) is an unrecognizable artifact, mirroring the ‘Retrain’ gold standard (b). This contrasts with the Finetune model (c), which fails to fully forget the target class and exhibits severe catastrophic forgetting on retained digits in the SVHN dataset. Our method, however, preserves the quality of all other digits, providing clear visual proof of selective and robust unlearning.
The quantitative MIA results in Table 4 further solidify these findings. Our framework consistently achieves the lowest attack accuracy on the Forget Set—even surpassing the Retrain baseline on complex datasets—while maintaining a high accuracy on the Retain Set. This confirms that our strong forgetting performance does not induce catastrophic forgetting.
In this study, we propose a selective unlearning framework based on a "discriminator-guided" method to efectively remove specific classes from generative models. The framework introduces a two-step structure. First, it selectively weakens the ability of the discriminator to recognize the target class and then uses this altered feedback to guide the unlearning process of the generator.
The experimental results validated across four benchmark datasets show that this indirect approach presents a promising solution to the unlearning problem. The framework achieves strong forgetting performance comparable to a retrained model, efectively suppressing the generation of target class images. It successfully mitigates the “catastrophic forgetting" problem associated with simple fine-tuning, maintaining stable image generation quality for retained classes. Furthermore, the efectiveness of the framework was additionally confirmed through attack-based evaluations, including model inversion and membership inference attacks. These findings indicate that discriminator-guided unlearning is a practical and efective direction for removing specific data from generative models, demonstrating a superior balance between performance, eficiency, and verifiability.
However, a practical limitation is that its time eficiency relies on the first step being prepared in advance for anticipated unlearning requests. Future work will focus on applying this framework to other types of generative models and validating its efectiveness on high-resolution image datasets.
This research was supported by the "Regional Innovation System & Education (RISE)" through the Seoul RISE Center, funded by the Ministry of Education (MOE) and the Seoul Metropolitan Government. (2025-RISE-01-024-04) and in part by the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) (RS-2025-00518960, 50%).
During the preparation of this work, the author(s) used OpenAI ChatGPT-4 and DeepL in order to: Grammar and spelling check. After using these tool(s)/service(s), the author(s) reviewed and edited the content as needed and take(s) full responsibility for the publication’s content.