Introduction↩︎

Edge AI systems are increasingly deployed in personal devices such as cameras, speakers and mobile generators, where models may need to change after deployment as users, tasks or privacy requirements evolve. Personal and embedded devices may need to incorporate user-specific data, adapt to newly arriving tasks, correct undesirable behaviours or reduce the influence of data associated with deletion requests. Cloud-based retraining followed by redeployment is often impractical when data are sensitive, communication is costly or rapid local adaptation is required. Efficient on-device model modification is therefore becoming an important requirement for continual learning and approximate machine unlearning, as illustrated in Fig. 1a.

Resistive-memory compute-in-memory (RM-CIM) accelerators are promising for energy-efficient edge inference. By storing neural-network weights as analogue conductance states and performing matrix–vector multiplication directly inside dense crossbar arrays, they reduce the data movement that dominates conventional von Neumann architectures [1]–[4]. However, this advantage relies on the mapped weights remaining largely fixed. Programming resistive-memory devices is stochastic and device-dependent, and typically requires iterative write-and-verify operations to reach a target conductance level. Frequent weight updates therefore incur substantial energy and latency overheads and may accumulate programming errors [5]–[8]. This creates a practical mismatch between adaptive learning algorithms, which require repeated model modification, and RM-CIM hardware, which favours stable analogue weights, as illustrated in Fig. 1b.

This mismatch motivates a hardware–algorithm partition in which the large analogue backbone remains fixed while post-deployment changes are confined to a compact and easily updateable parameter space, as illustrated in Fig. 1c. Prior RM-CIM studies have mainly addressed inference efficiency, mapping accuracy, device variation, programming precision and, more recently, hardware security of stored models [9]–[14]. Less attention has been paid to how a deployed RM-CIM model can be repeatedly modified after deployment without incurring the cost of reprogramming analogue weights. Here, we address the complementary problem of how a deployed RM-CIM model can be efficiently personalized, continually adapted or approximately unlearned without repeatedly reprogramming the analogue weight arrays. The objective is not only to accelerate inference, but also to make model modification compatible with the physical constraints of RM-CIM hardware.

Parameter-efficient adaptation provides a natural mechanism to realize this partition. Low-rank adaptation (LoRA) freezes a pretrained weight matrix and learns only a compact low-rank update [15]. In software, adapter-based methods have enabled efficient fine-tuning and continual learning with far fewer trainable parameters than full-model updating [16]. For RM-CIM systems, this suggests a hybrid analogue–digital mapping: the large and relatively stable pretrained backbone is deployed in analogue resistive-memory arrays, whereas the small adaptive branch is stored in SRAM and updated by digital logic. Keeping the adapter separate from the analogue backbone avoids repeated conductance reprogramming and allows task- or user-specific behaviours to be introduced, switched, updated or approximately removed with low overhead.

Here we propose and experimentally evaluate such a hybrid analogue–digital RM-CIM mapping for parameter-efficient continual adaptation and approximate machine unlearning. Frozen pretrained weights are mapped to analogue RM crossbars, while trainable LoRA branches are implemented in SRAM-connected digital compute. This co-design confines post-deployment updates to a small number of digital parameters, thereby reducing analogue write cost while preserving the energy-efficiency benefit of RM-CIM inference. The unlearning considered in this work is approximate and targets behaviours represented in the adaptation branch, rather than certified removal of arbitrary information from the entire pretrained model.

We validate the approach experimentally on a fabricated 180 nm 128\(\times\)​128 1T1R RM-CIM macro for the face identity recognition workload, and through circuit-accurate simulations for speaker authentication and stylized image generation. Compared with a baseline that reprograms all analogue parameters, updating only the SRAM-resident LoRA parameters reduces training cost by approximately 27.51\(\times\)–147.76\(\times\), reduces on-chip deployment overhead by approximately 69.68\(\times\)–387.95\(\times\), and reduces inference energy by approximately 13.07\(\times\)–59.44\(\times\), while maintaining competitive task performance. These results demonstrate hybrid analogue–digital LoRA mapping as a practical route towards hardware-efficient model modification on fabricated RM-CIM accelerators.

Results↩︎

RM Device Characterization and Conductance Programming↩︎

Fig. 2a presents optical micrographs of the \(128 \times 128\) RM array and TEM images of the TiN/TaO\(_x\)/TiN RM stack (see Supplementary Fig. 1 for the detailed chip architecture). Panels (b)-(f) of Fig. 2 summarise the electrical characteristics and multilevel read/write capabilities of the RM devices. Quasi-static \(I\)–\(V\) sweeps over 50 cycles (Fig. 2b) exhibit highly uniform bipolar resistive switching. Robust endurance is observed over 30,000 cycles of SET and RESET operations (Fig. 2c). Single-shot SET programming yields more than 128 approximately linearly spaced conductance levels (Fig. 2d), demonstrating the strong multilevel capability of the RM cells. Repeated readout of 17 RM cells with distinct conductance levels (Fig. 2e) demonstrates stable programmed conductances over \(10^6\) s, with minimal temporal fluctuations and read noise, indicating excellent read stability. Fig. 2f shows programming trajectories for four RM cells targeting distinct conductance values, each requiring tens of operations.

Panels (g)-(h) of Fig. 2 highlight the challenges inherent in RM programming. In Fig. 2g, target conductance maps encoding the ‘CL’ (continual learning) and ‘UL’ (machine unlearning) patterns are programmed using a halting criterion that stops the write operation when the programming error is within a 2 \(\mu\)S tolerance, resulting in only a small residual conductance error and programmed maps that closely match the targets.

Achieving this precision, however, requires iterative tuning. Fig. 2h quantifies this trade-off by plotting the mean number of programming cycles per cell against the conductance error (shaded area, standard deviation); higher precision demands substantially more iterations. For example, achieving an error below 1 \(\mu\)S requires approximately 50 cycles per cell on average.

Face Recognition↩︎

Face recognition in smart cameras is highly privacy-sensitive, motivating mechanisms for controlled identity removal and efficient model adaptation. After deployment, such systems must accommodate personnel turnover by adding or removing identities from the recognition database. Accordingly, the underlying model should support approximate machine unlearning of removed identities and continual learning of newly added ones, while preserving recognition performance. We demonstrate this capability on face-recognition tasks using an RM analogue–digital system equipped with rank \(r=6\) LoRA adapters, evaluated on the Olivetti faces dataset [17].

Fig. 3a-c illustrate the model architecture and parameter transformations during learning, machine unlearning and continual learning. Fig. 3a shows the MLP-Mixer architecture [18], which consists of per-patch multilayer perceptrons (MLPs), mixer layers and an output layer, all implemented with fully connected layers (see Supplementary Fig. 2 for details). During initial learning, pretrained weights are programmed into the RM analogue array. The resulting conductance maps of the patch MLPs, mixer layer and output layer are shown in Fig. 3a, with conductance values ranging from 10 \(\mu\)S to 80 \(\mu\)S. To mitigate RM programming overhead, subsequent machine unlearning of face ID 2 (Fig. 3b) and continual learning of face ID 5 (Fig. 3c) are performed by updating only the encoder and decoder parameters of the LoRA modules.

Fig. 3d-f track the evolution of the representation space and recognition performance. Two-dimensional t-distributed stochastic neighbour embedding (t-SNE) visualizations of the embedding space reveal dynamic reconfiguration across the three stages. After initial learning, embeddings from five face classes form well-separated clusters, indicating accurate recognition (Fig. 3d). After unlearning face ID 2 via gradient ascent, features of the second class (green) overlap with those of the fourth class (blue), indicating loss of discriminative power for the second identity (Fig. 3e). Subsequent continual learning of a new face ID 5 using a replay strategy produces a new cluster that remains well separated from existing identities, demonstrating robust adaptability without catastrophic forgetting (Fig. 3f).

Fig. 3g highlights the benefits of the proposed hardware-software co-design by comparing inference accuracy obtained with fully analogue RM parameter updates and with the RM with digital LoRA accelerator (RM-DLoRA). The hybrid architecture achieves higher accuracy because it avoids repeated, error-prone analogue reprogramming, thereby reducing cumulative programming noise during inference after initial learning, machine unlearning (UL) and continual learning (CL) (see Supplementary Fig. 3 for the noise tolerance of RM programming).

A quantitative comparison of the three core workflows of training, deployment and inference is summarized in Fig. 3h-j. Fig. 3h shows that RM-DLoRA requires substantially lower training cost than conventional full-parameter fine-tuning on RM, reducing training update cost by 36.68\(\times\) and 27.51\(\times\) for UL and CL, respectively. Fig. 3i quantifies write overhead during deployment. Whereas traditional RM program updates require repeated analogue reprogramming of RM arrays, RM-DLoRA updates only the LoRA weights stored in SRAM, reducing write-energy consumption by 92.91\(\times\) and 69.68\(\times\) for UL and CL, respectively. As shown in Fig. 3j, RM-DLoRA further improves energy efficiency during inference procedure, achieving 21.77\(\times\), 27.99\(\times\) and 13.07\(\times\) lower energy consumption than a GPU for learn, UL and CL, respectively (see Supplementary Table 1 for the energy breakdown).

Speaker Authentication↩︎

Speaker authentication is widely integrated into voice assistants on smart speakers to authenticate users and control smart home devices (Fig. 4a). In such applications, enrolling new users and removing existing ones is routine. Therefore, the model should support efficient adaptation, including approximate unlearning of a removed user’s voice and continual learning of newly enrolled speakers. Such capability is important for mitigating privacy-related risks, as it suppresses the model’s ability to recognize speakers who should no longer be authorized. At the same time, the system must retain sufficient capacity to learn new voices without degrading recognition accuracy for previously registered users. We demonstrate these operations using the RM analogue–digital system with rank \(r=8\) LoRA adapters.

Figs. 4a-c illustrate the model architecture and parameter transformations during initial learning, machine unlearning and continual learning in a recurrent spiking neural network (RSNN) architecture inspired by liquid state machine [19] on speaker recognition system. Acoustic inputs are drawn from the Spiking Speech Commands dataset [20], which contains utterances from many speakers recorded under realistic, less-controlled conditions. As shown in Fig. 4a, raw audio input signals are processed by the input layer and recurrent hidden layer of RSNN for temporal feature extraction, followed by a readout for classification. In the initial learning stage, the pretrained weights of the input, recurrent hidden and readout layers are programmed onto an RM analog array to support efficient inference. In the subsequent machine unlearning and continual learning processes, the LoRA weights are updated on a digital computer with an SRAM buffer as shown in Figs. 4b and 4c .

Figs. 4d-f present two-dimensional t-SNE visualizations of the readout layer activations after the three stages. After initial learning, activations from five enrolled speakers form distinct, well-separated clusters, indicating accurate speaker discrimination (Fig. 4d). LoRA-based machine unlearning applied to speaker ID 1 causes its former cluster to overlap substantially with those of IDs 2 and 4 (Fig. 4e), reflecting loss of discriminative power for the forgotten speaker while leaving the remaining speakers separable. Subsequent LoRA-based continual learning for a new speaker (ID 5) yields a compact, clearly separated cluster for the new identity while preserving the separation of the original speakers (Fig. 4f).

Fig. 4g compares inference accuracy across the three tasks (Learn, UL and CL). The RM-DLoRA architecture achieves higher per-speaker accuracy than conventional RM program updates method because it avoids repeated, error-prone analogue reprogramming, thereby reducing cumulative conductance drift in the RM array (see Supplementary Fig. 4 for the noise tolerance of RM programming).

Figs. 4h-j quantify the benefits of the hardware-software co-design for training, on-device deployment and inference. Fig. 4h shows that RM-DLoRA uses substantially fewer trainable parameters than the baseline full-parameter fine-tuning on RM array, reducing the number of training update operations by 100.66\(\times\) and 50.33\(\times\) across UL and CL tasks, respectively. Fig. 4i compares write overhead: RM program updates require repeated reprogramming of the entire RM array, whereas our proposed RM-DLoRA updates only the LoRA weights stored in SRAM, reducing write-energy consumption by 254.97\(\times\) and 127.48\(\times\) for UL and CL tasks, respectively. As shown in Fig. 4j, the hybrid architecture enables RM-DLoRA to achieve 38.89\(\times\), 38.89\(\times\) and 15.21\(\times\) lower inference energy than a high-performance GPU for learning, machine unlearning and continual learning, respectively (see Supplementary Table 2 for the energy breakdown).

Stylized Image Generation↩︎

Diffusion-based image generation has raised substantial societal concerns, including the creation of harmful content and copyright infringement [21], [22]. In such settings, it is often necessary to suppress specific generative capabilities. However, access to the original training data may be restricted by data-governance, copyright, or deployment constraints, making full retraining from scratch impractical. Approximate machine unlearning therefore provides a practical mechanism for selectively reducing undesired behaviours. Similarly, when diffusion models must be adapted to generate images in new styles or under new conditions, continual learning mechanisms are required to expand model capabilities without catastrophic forgetting.

We demonstrate the effectiveness of our RM-based LoRA framework with LoRA rank \(r=4\) for approximate machine unlearning, and continual learning in a conditional diffusion model. Performance is evaluated on the UnlearnCanvas dataset [22], which focuses on artistic style manipulation, with representative results shown in Fig. 5.

Fig. 5a-c illustrate the model architecture and task sequence. As shown in Fig. 5a, the latent diffusion model takes 128\(\times\)​128\(\times\)​3 input images, which are compressed by a variational autoencoder into 16\(\times\)​16\(\times\)​4 latent representations. These latent maps are tokenized into 2\(\times\)​2 patches and processed by a DiT-B/2 backbone [23], in which standard attention layers are replaced with depth-wise convolutions [24] to improve efficiency. The denoising process uses 100 sampling steps during inference to ensure high-quality generation (see Supplementary Fig. 5 for details of the model architecture). In the first phase (Fig. 5b), the model learns four distinct artistic styles (Expressionism, Dadaism, Cartoon and Abstractionism). It then performs targeted machine unlearning of two styles (Cartoon and Abstractionism), mimicking scenarios in which particular generative capabilities must be revoked owing to licensing or ethical constraints. In the continual learning phase (Fig. 5c), the model acquires two new styles (Impressionism and Monet), demonstrating the ability to accumulate new knowledge while retaining prior capabilities.

Representative samples across these stages (Fig. 5d) show that the model preserves content fidelity while correctly applying or suppressing the specified styles. After unlearning, the removed styles no longer appear in generated outputs, providing strict control over prohibited categories (see Supplementary Fig. 6 for additional examples).

Quantitative results corroborate these observations. As shown in Fig. 5e, the full RM program-update baseline achieves perceptual quality that is comparable to our RM-DLoRA method. Perceptual quality is quantified using the Learned Perceptual Image Patch Similarity (LPIPS) metric [25] (lower is better). However, the performance of the full RM program-update baseline degrades severely in the presence of realistic programming noise, whereas RM-DLoRA maintains stable perceptual quality (see Supplementary Fig. 7 for the noise tolerance of RM programming). At the same time, the hybrid RM-DLoRA architecture delivers substantial efficiency gains over full-parameter fine-tuning. Fig. 5f shows reductions in training update cost of 147.76\(\times\) for UL and CL tasks, respectively. Fig. 5g reports corresponding write energy savings of 387.95\(\times\) for UL and CL tasks reflecting the avoidance of repeated analogue reprogramming of the RM array. Fig. 5h shows that inference energy is reduced by 59.44\(\times\), 59.44\(\times\) and 42.12\(\times\) relative to a high-performance GPU for learn, UL and CL tasks, respectively (see Supplementary Table 3 for the energy breakdown).

Discussion↩︎

This study presents a hardware–software co-design framework that makes post-deployment model modification compatible with the physical constraints of RM-CIM hardware. Edge AI systems increasingly require local adaptation after deployment, including personalization, continual learning and approximate machine unlearning. However, these requirements conflict with the operating principles of RM-CIM accelerators, whose energy efficiency relies on keeping the analogue weight arrays largely fixed. Frequent reprogramming of RM devices introduces substantial write energy and latency overheads, is limited by device endurance, and may accumulate programming errors. Our RM-DLoRA framework addresses this mismatch by maintaining the pre-trained backbone weights in the analogue RM array while confining post-deployment updates to compact digital LoRA modules.

At the hardware level, this analogue–digital partition preserves the compute-in-memory advantage of RM arrays for high-throughput matrix–vector multiplication, while avoiding repeated analogue reprogramming during learning, approximate unlearning and continual learning. At the algorithmic level, low-rank adaptation restricts model updates to a small parameter subspace, substantially reducing the number of trainable parameters and update operations. As a result, RM-DLoRA enables efficient model modification without sacrificing the energy benefits of RM-CIM inference.

We validate this framework across both discriminative and generative workloads. For face and speaker recognition, RM-DLoRA supports the addition and removal of identities or speakers while preserving recognition performance for retained classes. Compared with full-parameter fine-tuning on RM hardware, it reduces training update count and write energy by orders of magnitude, and achieves substantially lower inference energy than high-performance GPUs, highlighting its suitability for privacy-sensitive edge applications. For conditional diffusion models evaluated on the UnlearnCanvas dataset, RM-DLoRA supports initial learning, approximate machine unlearning and continual learning of artistic styles while maintaining perceptual quality, as measured by LPIPS. These results indicate that the proposed framework is not limited to lightweight classifiers, but can also extend to more demanding generative models.

Importantly, the approximate unlearning demonstrated here should be interpreted as a practical mechanism for suppressing targeted behaviours, rather than as a formal privacy guarantee. In the generative setting, targeted approximate unlearning reduces the model’s ability to produce selected styles, such as prohibited or undesired styles, thereby supporting licensing-, safety- and data-governance-related adaptation requirements. In recognition tasks, it reduces the influence of removed identities or speakers while maintaining performance on retained users. Future work may combine RM-DLoRA with certified unlearning, differential privacy or stronger auditing protocols to provide formal guarantees. More broadly, this work suggests that separating stable analogue backbone computation from lightweight digital adaptation is a promising direction for building energy-efficient, updateable and trustworthy edge intelligence.

Methods↩︎

Fabrication of RM Chips↩︎

The RM chips used in this work comprise a \(128\times128\) 1T1R array fabricated in a 180 nm CMOS technology node. Each 1T1R cell integrates an access transistor with an RM device formed between metal layers M5 and M6. The RM device stack adopts a TiN/TaO\(_x\)/TiN metal-insulator-metal (MIM) structure. The array is organized in a standard crossbar configuration with shared word lines (WLs), source lines (SLs), and bit lines (BLs). Specifically, the BLs are connected to the top electrodes of the RM devices, while the SLs are connected to the source terminals of the transistors. In this architecture, devices in the same row share a common BL and WL, whereas devices in the same column share a common SL.

Hybrid Analogue-digital Computing System↩︎

The hybrid analogue-digital computing system is implemented on a custom printed circuit board (PCB) that integrates the 180 nm RM CIM chip and peripheral circuits, and interfaces with a Xilinx ZC706 evaluation board based on a Zynq-7000 SoC. The digital control and data-processing functions are implemented in the programmable logic (FPGA fabric). The RM macro is addressed via serial-in/parallel-out shift registers (SN74HC595, Texas Instruments) and analogue multiplexers (CD4051B, Texas Instruments), while input voltages are provided by 16-bit digital-to-analogue converters (DAC80508, Texas Instruments). The output currents from the RM array are converted to voltages using transimpedance amplifiers (OPA4322, Texas Instruments) and subsequently digitized by 14-bit analogue-to-digital converters (ADS8324, Texas Instruments), with the digitized data processed by the FPGA fabric. A dedicated programming interface connects the RM array to a B1500A semiconductor device analyser for precise conductance initialization and reprogramming.

Machine Unlearning↩︎

Machine unlearning aims to remove the influence of designated training examples from a pretrained model [26]. This is critical for mitigating unintended memorization and leakage of personally identifiable information [27]–[29], as well as reducing the generation of unsafe outputs such as toxic or misleading content [30]–[33]. By removing these contributions, unlearning supports compliance with the “right to be forgotten” under privacy-protecting regulations, including the EU General Data Protection Regulation [34] and the California Consumer Privacy Act [35].

Machine unlearning methods are commonly grouped into exact unlearning and approximate unlearning [36]–[38]. Exact unlearning retrains the model from scratch after removing the target data, guaranteeing complete erasure but incurring prohibitive computational cost. Approximate unlearning uses more efficient techniques, such as gradient ascent [39] or label obfuscation [38], [40], to approximate the effect of data removal without full retraining.

In this work we focus on efficient realization on RM-based accelerators rather than proposing new unlearning algorithms. We therefore adopt two representative approximate unlearning baselines:

Gradient Ascent Based Unlearning↩︎

This approach removes the influence of the forget set \(\mathcal{D}_f\) by maximizing its loss, effectively reversing the original gradient descent updates. Starting from the pretrained parameters \(\theta_0\), the optimization objective is \[\min_{\theta} \; \underbrace{-\frac{1}{|\mathcal{D}_f|} \sum_{(x,y_f)\in \mathcal{D}_f} \ell(y_f \mid x; \theta)}_{\text{gradient ascent on forget set}} \;+\; \lambda \; \underbrace{\frac{1}{|\mathcal{D}_r|} \sum_{(x,y)\in \mathcal{D}_r} \ell(y \mid x; \theta)}_{\text{gradient descent on retain set}}, \label{eq:mu-ga-unified}\tag{1}\] where \(\lambda \geq 0\) balances forgetting and retention, and \(\ell(\cdot;\theta)\) denotes the per-sample loss. The negative term induces gradient ascent on \(\mathcal{D}_f\), pushing predictions away from patterns induced by the forget data, while the retain term preserves performance on the retain set \(\mathcal{D}_r\).

Label Obfuscation Based Unlearning↩︎

Another widely used technique replaces the original labels of samples in the forget set \(\mathcal{D}_f\) with random incorrect labels and fine-tunes the model on the combined dataset. The optimization objective is \[\min_{\theta} \; \underbrace{\frac{1}{|\mathcal{D}_f|} \sum_{(x,\tilde{y}_f)\in \tilde{\mathcal{D}}_f} \ell(\tilde{y}_f \mid x; \theta)}_{\text{gradient descent on forget set with label obfuscation}} \;+\; \lambda \; \underbrace{\frac{1}{|\mathcal{D}_r|} \sum_{(x,y)\in \mathcal{D}_r} \ell(y \mid x; \theta)}_{\text{gradient descent on retain set}}, \label{eq:mu-rl-unified}\tag{2}\] where, for classification tasks, \[\tilde{\mathcal{D}}_f = \bigl\{(x, \tilde{y}_f) \,\big|\, (x, y_f) \in \mathcal{D}_f,\; \tilde{y}_f \sim \mathrm{Uniform}(\mathcal{Y} \setminus \{y_f\})\bigr\},\] is the forget set with randomized labels \(\tilde{y}_f\), and \(\lambda \geq 0\). This encourages the model to treat forgotten samples as belonging to arbitrary incorrect classes, thereby scrambling their original influence while preserving performance on the retain set \(\mathcal{D}_r\). For other types of tasks, the core idea of this method remains applicable, though its specific form may vary. For example, in generative tasks, when faced with conditions requiring unlearning, the network can be trained to shift its prediction target toward nonsensical or meaningless output.

Continual Learning↩︎

Continual learning methods can be broadly classified into three categories: regularization-based [41], [42], replay-based [43], [44] and parameter-isolation-based approaches [41]. These methods update model parameters to accommodate new tasks while preserving prior knowledge. In this work we only focus on efficient deployment on RM-based accelerators, and adopt a replay-based continual learning framework as the baseline across all three application scenarios.

Replay-based methods maintain a compact memory buffer of past examples (or generate pseudo-samples) and jointly train them with current-task data to mitigate catastrophic forgetting. Let \(\theta_{t-1}\) denote the model parameters after learning the previous task and \(\ell(\cdot;\theta)\) the per-sample loss. Starting from \(\theta = \theta_{t-1}\), we optimize the following composite objective, \[\min_{\theta} \; \underbrace{\frac{1}{|\mathcal{D}_n|} \sum_{(x,y)\in \mathcal{D}_n} \ell(y \mid x; \theta)}_{\text{gradient descent on new data}} \;+\; \gamma \; \underbrace{\frac{1}{|\mathcal{D}_p|} \sum_{(x,y)\in \mathcal{D}_p} \ell(y \mid x; \theta)}_{\text{gradient descent on replay buffer}}, \label{eq:cl-replay-unified}\tag{3}\] where \(\gamma \geq 0\) controls the trade-off between acquiring new knowledge and retaining prior knowledge, \(\mathcal{D}_n\) denotes the dataset of the current task and \(\mathcal{D}_p\) is the replay buffer storing representative samples from previous tasks (for example, selected via random sampling, herding or gradient-based prioritization). This joint optimization performs gradient descent on both sets, enabling the model to learn new task capabilities from \(\mathcal{D}_n\) while preserving performance on past tasks through \(\mathcal{D}_p\).

LoRA-based Machine Unlearning and Continual Learning↩︎

To achieve parameter-efficient adaptation in both machine unlearning and continual learning, we incorporate LoRA [15] into the gradient ascent based unlearning and replay-based continual learning frameworks introduced above. LoRA enables efficient fine-tuning by injecting trainable low-rank decomposition matrices into model layers while keeping the pretrained weights \(W_0 \in \mathbb{R}^{d \times k}\) frozen. The updated weight is expressed as \[W = W_0 + \Delta W = W_0 + B A, \label{eq:lora}\tag{4}\] where \(B \in \mathbb{R}^{d \times r}\), \(A \in \mathbb{R}^{r \times k}\), and \(r \ll \min(d, k)\) is the rank of the adaptation. Only the low-rank matrices \(A\) and \(B\) are optimized, reducing the number of trainable parameters from \(dk\) to \(r(d+k)\) per layer.

LoRA-based Machine Unlearning↩︎

LoRA substantially reduces the computational and memory overhead of machine unlearning by updating only the LoRA matrices while keeping the pretrained weights \(W_0\) frozen. We apply LoRA to both gradient ascent based and label obfuscation based unlearning baselines, optimizing LoRA parameters \((A, B)\) (initialized as \(A_0, B_0\)) such that the forward pass uses the effective weights \(W_0 + BA\).

0.0.0.1 LoRA-based Gradient Ascent Unlearning.

This variant adapts the gradient ascent objective from Equation 1 . Optimization is performed solely over the adapter parameters, \[\min_{A,B} \; \underbrace{-\frac{1}{|\mathcal{D}_f|} \sum_{(x,y_f)\in \mathcal{D}_f} \ell(y_f \mid x; W_0 + BA)}_{\text{gradient ascent on forget set}} \;+\; \lambda \; \underbrace{\frac{1}{|\mathcal{D}_r|} \sum_{(x,y)\in \mathcal{D}_r} \ell(y \mid x; W_0 + BA)}_{\text{gradient descent on retain set}}. \label{eq:lora-ga-mu}\tag{5}\]

The negative term induces gradient ascent on the forget set \(\mathcal{D}_f\) via the adapters, pushing the model away from patterns associated with the data to be forgotten, while the retain term preserves performance on \(\mathcal{D}_r\). We employ this approach for the face recognition task.

0.0.0.2 LoRA-based Label Obfuscation Unlearning.

This method utilizes the label obfuscation Unlearning objective, Equation 2 while training only the adapter parameters, \[\min_{A,B} \; \underbrace{\frac{1}{|\mathcal{D}_f|} \sum_{(x,\tilde{y}_f)\in \tilde{\mathcal{D}}_f} \ell(\tilde{y}_f \mid x; W_0 + BA)}_{\text{gradient descent on forget set with label obfuscation}} \;+\; \lambda \; \underbrace{\frac{1}{|\mathcal{D}_r|} \sum_{(x,y)\in \mathcal{D}_r} \ell(y \mid x; W_0 + BA)}_{\text{gradient descent on retain set}}, \label{eq:lora-rl-mu}\tag{6}\] where, for classification tasks, \[\tilde{\mathcal{D}}_f = \bigl\{(x, \tilde{y}_f) \,\big|\, (x, y_f) \in \mathcal{D}_f,\; \tilde{y}_f \sim \mathrm{Uniform}(\mathcal{Y} \setminus \{y_f\})\bigr\},\] denotes the forget set with randomized incorrect labels \(\tilde{y}_f\). By fine-tuning only the adapters on this combined dataset, the model effectively erases the influence of the original forget samples while preserving its performance on the retain set. We apply this method to both speaker authentication and stylized image generation.

LoRA-based Continual Learning↩︎

For replay-based continual learning, LoRA is similarly integrated into the joint training objective in Equation 3 . At task \(t\), we initialize new LoRA adapters \((A_t, B_t)\) (or reuse and extend prior adapters) and optimize \[\min_{A,B} \; \frac{1}{|\mathcal{D}_n|} \sum_{(x,y)\in \mathcal{D}_n} \ell(y \mid x; W_0 + BA) \;+\; \gamma \; \frac{1}{|\mathcal{D}_p|} \sum_{(x,y)\in \mathcal{D}_p} \ell(y \mid x; W_0 + BA). \label{eq:lora-cl}\tag{7}\]

Both terms involve gradient descent: the first adapts the model to the new task \(\mathcal{D}_n\), and the second reinforces prior knowledge via the replay buffer \(\mathcal{D}_p\). By updating only the LoRA adapters, this technique enables efficient continual learning across face recognition, speaker authentication and stylized image generation tasks without modifying the pretrained weights, mitigating catastrophic forgetting while minimizing resource demands.

Data Availability↩︎

The Olivetti faces dataset [17], the UnlearnCanvas dataset [22] and Spiking Speech Commands dataset [20] are publicly available.

Code Availability↩︎

The code that supports the plots within this paper is available at https://github.com/MrLinNing/RMAdaptiveMachine.

Acknowledgement↩︎

This research is supported by the National Natural Science Foundation of China (Grant Nos. 62374181, 62488101, 62495104), Hong Kong Research Grant Council (Grant No. 17212923, C1009-22G, C7003-24Y and AOE/E-101/23-N). This research is also partially supported by ACCESS - AI Chip Center for Emerging Smart Systems, sponsored by Innovation and Technology Fund (ITF), Hong Kong SAR.

Author Contributions↩︎

N.L., JC.Y., YG.H. contributed to the design and development of the models, software, and hardware experiments. All authors discussed the results and implications and commented on the manuscript at all stages.

Competing Interests↩︎

The authors declare no competing interests.

References↩︎