Neuron Pruning

The foundation of neuron pruning lies in identifying which neurons are disproportionately activated by the data to be forgotten. This involves passing target samples through the network and recording activation magnitudes per neuron. Neurons exhibiting statistically significant activation spikes for target data—compared to their baseline on retained data—are flagged as candidate units for removal. This selectivity ensures that only the neural pathways encoding unwanted information are targeted, preserving the model's general performance on all other tasks.

Pruning can be implemented at two levels of granularity:

• Weight Pruning: Individual connections between neurons are set to zero, effectively severing specific synaptic pathways. This is finer-grained but may leave residual activation paths.
• Neuron Pruning: Entire neurons are removed from the architecture, eliminating all incoming and outgoing connections. This guarantees complete removal of that unit's contribution but requires more aggressive structural modification. The choice depends on the required unlearning guarantee strength versus acceptable performance degradation.

A common heuristic for selecting neurons to prune is magnitude-based importance scoring. The L1 or L2 norm of a neuron's outgoing weight vector serves as a proxy for its influence on downstream layers. Neurons with the highest activation magnitudes on target data and the lowest overall weight norms are prioritized for removal—they are highly responsive to the forget set but contribute minimally to general model function. This dual criterion minimizes collateral damage to retained knowledge.

Pruning is rarely a standalone operation. After removing neurons, the model undergoes a brief recovery fine-tuning phase on the retained dataset. This allows the remaining neurons to adjust their weights and compensate for the lost capacity, recovering any performance degradation caused by the structural modification. Without this step, pruned models often exhibit brittle behavior and degraded accuracy on non-target data. The fine-tuning phase effectively redistributes the removed neuron's functional responsibility across the surviving network.

Not all layers are equally amenable to pruning. Early convolutional layers in vision models encode low-level features like edges and textures—pruning here risks broad degradation. Later fully-connected layers encode more abstract, class-specific representations and are safer targets for selective forgetting. In transformer architectures, feed-forward network (FFN) layers often store factual associations, making them prime candidates for pruning when unlearning specific knowledge. Understanding layer-wise functional specialization is critical for surgical precision.

Post-pruning verification is essential to confirm successful unlearning. Membership inference attacks are executed against the pruned model to test whether the target data's influence persists. If an attacker cannot distinguish target samples from non-training samples with confidence above random chance, the pruning is considered effective. Additional verification includes backdoor trigger testing—if a deliberately implanted trigger associated with the target data no longer activates, the neural pathway has been successfully severed.

Distinguishes between two granularities of structural unlearning. Weight pruning removes individual connections (synapses) between neurons, creating sparse weight matrices. Neuron pruning removes entire nodes, eliminating all incoming and outgoing connections simultaneously. Neuron pruning is more aggressive, directly excising the computational unit responsible for a specific feature representation, while weight pruning offers finer control but may leave residual activation pathways intact.

The primary heuristic for identifying neurons to prune. The process involves:

• Running the target data through the model and recording activation magnitudes
• Comparing these against a baseline distribution from non-target data
• Flagging neurons with disproportionately high activation for removal This method assumes that neurons acting as specialized feature detectors for the forgotten data will exhibit statistically anomalous firing patterns.

A second-order method for estimating parameter importance. The Fisher Information Matrix quantifies how much each weight contributes to the model's output. In neuron pruning, it identifies neurons whose removal would minimally impact performance on retained data while maximally disrupting representations of target data. This provides a more theoretically grounded selection criterion than simple activation magnitude, though at higher computational cost.

The primary risk in neuron pruning. Catastrophic forgetting occurs when removing neurons degrades performance on retained tasks or data distributions. Mitigation strategies include:

• Elastic Weight Consolidation: Applying a quadratic penalty to slow learning on important weights
• Rehearsal: Retraining pruned models on a representative sample of retained data
• Importance-weighted pruning: Only removing neurons with low Fisher information scores for retained tasks

The empirical process of auditing a pruned model to confirm successful forgetting. Techniques include:

• Membership Inference Attacks: Testing whether an adversary can determine if target data was in the training set
• Backdoor triggers: Embedding known patterns in target data and verifying they no longer activate
• Statistical parity testing: Ensuring output distributions match a model trained without the target data Verification is essential for regulatory compliance under GDPR and CCPA.

An alternative approximate unlearning technique that reverses the standard gradient descent process. Instead of structurally removing neurons, gradient ascent adds the loss gradient of the target data to the model weights, effectively erasing its contribution. This is computationally cheaper than neuron pruning but provides weaker guarantees, as the erased information may be recoverable through adversarial attacks. Often used when structural modification is too aggressive.