Recalling The Forgotten Class Memberships: Unlearned Models Can Be Noisy Labelers to Leak Privacy

1 Introduction

Data privacy is a core concept in the era of big data and extensive interconnectivity [Wu et al., 2024; Bao et al., 2023]. If a machine learning model has been trained on sensitive and private data, it can lead to significant security risks. In this context, the emergence of machine unlearning (MU) has been driven by stringent data privacy regulations such as GDPR [Hoofnagle et al., 2019] and CCPA [Itakura and Terada, 2018], which require the removal of specific sensitive data

∗Corresponding author

(RCM, ෪�ሺ��ሻ)

upon request. MU is designed to forget particular data points from the learned models [Cao and Yang, 2015]. As concerns about the increasing data misuse and privacy breaches, MU has gained more attention as a critical component in building safe machine learning systems.

Rapid advancements in MU research have increasingly posed a potential risk of privacy breaches by recovering the unlearned information about private data, highlighting the limited research on the full scope of MU vulnerabilities. In fact, the most relevant research [Hu et al., 2024] that investigates inversion attacks against MU models was published recently. However, this work is based on an impractical assumption that unlearning inversion attacks require access to both Trained Model (TRM, M(ΘT )), and Unlearned Model (ULM, M(ΘU)), as shown in Figure 1. In general, only ULM is accessible to users, where sensitive privacy has been removed from TRM.

The membership inference attack (MIA) [Shokri et al., 2017] is originally used to detect data samples used to train a machine learning model. Recently, MIA has been used to assess whether the influence of a forgetting dataset Df = {Xf , Yf} has been successfully erased after MU [Chen et al., 2021]. To go one step further, we formulate the attack on recovering the forgotten class memberships by only accessing ULM. As shown in Figure 1, our objective is to learn a RecalledModel (RCM, ˜M(ΘR)) from the ULMM(ΘU) to correctly infer the labels of the input data Xp, where Xp contains a subset of instances in Xf in which the class memberships, Yf , have been forgotten in the ULM. As a result, we propose a Membership Recall Attack (MRA) framework to learn RCM in this paper. As most MU models restrict the scope of the investigation to the area of image classification tasks [Bourtoule et al., 2021; Fan et al., 2024; Jia et al., 2023; Chen et al., 2023; Chen et al., 2024], we correspondingly study the proposed MRA on these MU models in this area.

To implement the MRA framework, we designed a teacherstudent architecture to distill the knowledge from the ULM M(ΘU) (as a teacher) to a Student Model (STM, ˜M(ΘS)). More specifically, given an input image set Xp, the ULM M(ΘU) outputs the prediction labels M(Xp;ΘU) ↦→ Yp, where the prediction labels Yp may be noisy, especially when Xp contains many instances of forgetting data Xf . Therefore, we use the ULMM(ΘU) to serve as a noisy labeling teacher for knowledge distillation, that is, using {Xp, Yp} to train the STM ˜M(ΘS). In this context, MRA can be further translated into a Learning with Noisy Labels (LNL) problem [Algan and Ulusoy, 2021] over {Xp, Yp} that aims to infer correct labels from the noisy ones. Consequently, we selected samples with high confidence agreement between the teacher modelM(ΘU) and the STM ˜M(ΘS) for LNL. In particular, we discuss two cases for MRA, one is the closed-source case where the parameters of ULMΘU are not accessible, and the other is the open-source case where the parameters are open for use. Moreover, we design a unified learning scheme of MRA to train the RCMs for these two cases. We summarize our contributions as follows.

• To our knowledge, this is the first attempt study of the recall attack of class membership, which can effectively assess the risk of data privacy breaches and promote the robustness of the MU study.
• We propose MRA, a model-agnostic attack framework, to effectively recover class memberships of forgotten instances from unlearned ULMs via various MU methods.
• We implement MRA with a teacher-student architecture where the ULM serves as a noisy labeling teacher to distill the knowledge to train the STMwith noisy labels.
• We conducted extensive experiments in four widely used datasets in MU research, demonstrating both the theoretical and practical efficacy of our MRA approach against various SOTA MU methods.

2 RelatedWork

2.1 Machine Unlearning

Exact Unlearning. Retraining the model from scratch after removing specific data can intuitively and effectively achieve exact unlearning. In addition, [Bourtoule et al., 2021] proposed SISA (Sharded, Isolated, Sliced, Aggregated) training, which trains isolated models on data shards for efficient unlearning by retraining only affected shards. Although effective, these unlearning approaches are computationally expensive and impractical for large-scale models and datasets.

Approximate Unlearning. The idea of modestly sacrificing the accuracy of forgetting in exchange for significant improvements in unlearning efficiency has spurred the exploration of approximate unlearning techniques. Gradient ascent (GA) [Graves et al., 2021; Golatkar et al., 2020; Thudi et al., 2022; Miao et al., 2024] reverses the training of the model by adding gradients, thus moving the model towards greater loss for the data points targeted for removal. Random labeling (RL) [Golatkar et al., 2020] that involves finetuning the original model on the forgetting dataset using random labels to enforce unlearning. Several methods estimate the impact of forgetting samples on the model parameters and conduct forgetting through the fisher information matrix (FF) [Becker and Liebig, 2022] or influence function (IU) [Koh and Liang, 2017; Izzo et al., 2021]. ℓ1-sparse (L1SP) [Jia et al., 2023] infuses weight sparsity into unlearning.

Moreover, most MU methods may degrade model performance. and lead to "over-unlearning". Some recent work has explored more precise unlearning on target forget instances. Boundary unlearning (BU) [Chen et al., 2023] shifts the decision boundary of the original model to imitate the decision behavior of the model retrained from scratch. SalUn [Fan et al., 2024] introduces the concept of 'weight saliency' to narrow the performance gap with exact unlearning. To avoid over-unlearning, UNSC [Chen et al., 2024] constrains the unlearning process within a null space tailored to the remaining samples to ensure that unlearning does not negatively impact the model performance.

2.2 Attacks onMachine Unlearning

Despite advances in MU techniques, the study of their vulnerabilities remains underexplored. To date, very limited MU attack methods have been proposed to affect efficiency [Marchant et al., 2022] or fidelity [Di et al., 2022; Hu et al., 2023]. Studying attacks on MU is crucial to developing robust and secure MU methods.

Membership Inference Attack (MIA). MIA is originally used to infer if data samples are used to train a machine learning model [Shokri et al., 2017]. With the development of MU, MIA has been widely used to check if the influence of forgetting data had been removed from the original model. However, [Chen et al., 2021] show that MU can jeopardize privacy in terms of MIA. The goals of MIA and the proposed MRA are different. MIA aims to detect data samples if used for training, whereas MRA aims at recalling and inferring the class memberships of forgetting samples from ULMs.

Model Inversion Attack. It aims to reconstruct the original input data from the model outputs. [Fredrikson et al., 2015] introduced model inversion attacks using the confidence scores output by a model to reconstruct input images. [Hu et al., 2024] proposed the first inversion attack against unlearning. It extracts features and labels of forgetting samples, which most closely match the objectives of our study. Although the attack demonstrates notable effectiveness, it requires access to the original TRM before unlearning, which is impractical in real scenarios. In contrast, the proposed MRA only needs to access ULMs and supports more versatile MU methods. To our knowledge, we are the first to explore the attack only using ULMs to recall the class memberships of forgetting samples, without comparable prior work.

3 Preliminaries

We first introduce the datasets and models used in our study, followed by a formal definition of the problem.

3.1 Involved Datasets

Training dataset Dtr : {Xtr, Ytr} is all data used to initially train machine learning models, where Xtr denotes the image set and Ytr denotes the corresponding label set.

Forgetting dataset Df : {Xf , Yf} is a subset of Dtr, that is, Df ⊂ Dtr. In MU, Df is a set of sensitive data that should be unlearned from the trained model, that is, the ULM cannot tell the true labels when Xf is input.

Remaining dataset Dr : {Xr, Yr} is the remaining data of Dtr, that is, Dr = Dtr \ Df , which should not be forgotten.

Prediction dataset Dp : {Xp, Yp} is the dataset for prediction, where Xp = Xts∪Xu can be decomposed into two parts. Xu ⊆ Xf is the subset of the forgotten instances while Xts is the unseen dataset for testing.

3.2 InvolvedModels

Trained Model (TRM) M(ΘT ) is the model that has been trained on the training dataset Dtr.

UnlearnedModel (ULM)M(ΘU) is the model that has unlearned the forgetting dataset Df based on M(ΘU). It will serve as a noisy labeling teacher to distill knowledge.

StudentModel (STM) ˜M(ΘS) is themodel that receives the knowledge distilled fromM(ΘU).

Recalled Model (RCM) ˜M(ΘR) is the model that has recalled forgotten class memberships based on M(ΘU ).

3.3 ProblemFormulation

MU models remove the influence of forgetting the dataset Df from TRMM(θT ), and release a ULMM(ΘU) for public use. This paper aims to implement the MRA framework to recall forgotten class memberships given M(ΘU). In particular, we employ M(ΘU) as a noisy labeler (i.e., teacher model) to distill the knowledge inferred from the prediction dataset Xp to the STM ˜M(ΘS).

Moreover, we discuss two common cases that lead to the final RCM ˜M(ΘR). In the first case, ULMM(ΘU) is usable but not trainable, e.g. M(ΘU) is only accessible as a blackbox service (closed-source case), and the STM ˜M(ΘS) will finally serve as RCM ˜M(ΘR). In the second case, M(ΘU) is trainable, for example, M(ΘU) is released with its ULM parameters ΘU (open-source case), and the ULMM(ΘU) is recovered to serve as the RCM ˜M(ΘR).

4 ProposedMethod

4.1 Overview

Firstly, we can easily obtain ULMs by applying various MU methods on a TRM. Given a ULM, Figure 2 demonstrates the workflow to implement the proposed MRA framework, which consists of two alternative learning steps to obtain the RCM ˜M(ΘR).

(1) Denosing Knowledge Distillation: The ULMM(ΘU) serves as a noisy labeler on the prediction dataset Dp with some augmentation strategy, and the inferred pseudo labels with the augmented images are used to train STM ˜M(ΘS). (2) Confident Membership Recall: Both ULMM(ΘU ) and STM ˜M(ΘS) are to generate the prediction on Dp, and the top-K data samples with the highest probability of joint prediction, that is, the most confidently agreed pseudo labels for each class are selected to train STM ˜M(ΘS) and ULM M(ΘU) (optional for the open source case).

4.2 Model Training and Unlearning

Given the training dataset Dtr = Df ∪Dr, we use Dtr to train the model M, which results in the TRMM(ΘT ) with the parameters ΘT . Then, we apply various SOTA MU methods on TRM M(ΘT ), which leads to ULMs M(ΘU ).

4.3 Implementation of MRA Framework

We implement the MRA framework with the following two alternative learning steps to obtain RCM ˜M(ΘR).

(1) Denoising Knowledge Distillation

A sophisticated MU method should only unlearn the influence of forgetting dataset Df but retain the classification capability that is learned from the remaining dataset Dr. As a result, the ULMM(ΘU) can serve as a noisy labeler to distill knowledge to the STM ˜M(ΘS) given the set of prediction images Xp. M(ΘU) is prone to mislabeling on Xp if it contains forgotten instances in Df . To avoid the input of original images that have been forgotten, we create augmented images by mixup [Zhang et al., 2018] which is an effective regularization technique to deal with label noise [Carratino et al., 2022]. Given an image x1 ∈ Xp, we randomly sample another image x2 from Xp, and mix them as follows:

where βx ∼ Beta(αx, αx) (αx = 0.2 in this paper). Then, we take ˜x as input to retrieve the soft pseudo label fromULM

M(ΘU) and STM ˜M(ΘS):

Then, we can obtain the mixed soft pseudo label:

where βy = 1 is applied in the first warmup epoch (i.e. completely accept the knowledge from the teacher model) and βy ∼ Beta(αy, αy) (αy = 0.75 in this paper) for label denoising after the warmup stage. Following Eqs (1) to (3), we can obtain ˜ YS = {˜yS} and ˜ YUS = {˜yUS} over the augmented set ˜x ∈ ˜ Xp. As a result, the parameters of STM ˜M(ΘS) can be updated by decreasing the mini-batch gradient in terms of minimizing cross-entropy (CE) loss.

(2) Confident Membership Recall

After the above step, STM ˜M(ΘS) has been trained on the augmented dataset based on Xp with pseudo labels from the noisy labelerM(ΘU). Inspired by the LNL methods [Algan and Ulusoy, 2021], we design a balanced class membership recall strategy based on the highest confidence agreements betweenM(ΘU) and ˜M(ΘS). More specifically, we first input Xp into both ULMM(ΘU) and STM ˜M(ΘS) to predict soft labels (that is, probability over each class):

where YU p ,YU p ∈ RN×C , N = |Xp| denotes the number of samples in Xp and C denotes the number of classes. For each instance xi ∈ Xp, we apply Laplace smoothing on its soft label yU i =YU p [i, :] to avoid zero probability:

As a result, we obtain the smoothed probability matrices ˜YU p over Xp. ˜YS p can be obtained in the same way. Then, we have the joint probability ˜yi on xi:

For all xi ∈ Xp, we have ˜Yp = ˜YU p ⊙ ˜YS p in the matrix form, where ⊙ is the element-wise product. Given a class c, we have the joint probabilities yc = ˜Yp[:, c] of all instances. A higher joint probability yi ∈ yc implies greater confidence in the teacher and student models that the instance xi should have the membership of the class c. Consequently, we apply a balanced strategy to select top-K instances with the maximum joint probability for each class.

where K = ⌈τ ·N/C⌉, and ˜yc = (1-γs) ·yc+ γs K ·1 denotes the smoothing of the label versus the hard label c (yc stands for the one-hot encoding of c) which can effectively mitigate

Algorithm 1 The Scheme of MRA

Input: Prediction Set: Xp, Number of Epochs: KE, KD, KR Output: Recalled Labels: ˆ Yp

1: for e in {1, · · · , KE} do 2: (1) Denoising Knowledge Distillation 3: for i in {1, · · · , KD} do 4: ˜ Xp, ˜ YUS ▷ Mixup augmentation by Eqs (1) to (3) 5: ΘS = argminΘS CE( ˜ YS, ˜ YUS) ▷ Update STM 6: end for 7: (2) Confident Membership Recall 8: for i in {1, · · · , KR} do 9: DCF ▷ Confident agreements by Eqs (5) to (8) 10: ΘS = argminΘS CE(YS, YCF ) ▷ Update STM 11: ifM(ΘU) is trainable (open-source case) then 12: DCF ▷ Confident agreements by Eqs (5) to (8) 13: ΘU = arg minΘU CE(YU , YCF ) ▷ Update ULM 14: end if 15: end for 16: end for 17: return ˆ Yp = ˜M(Xp;ΘS) ▷ Closed-source case 18: ˆ Yp = M(Xp; ΘU ) ▷ Open-source case

label noise [Lukasik et al., 2020]. Then, the STM ˜M(ΘS) is updated on DCF to learn the confident memberships.

In the open-source case, the parameters of ULM M(ΘU) are also accessible, so we will construct DCF to refine ΘU by Eqs (5) to (8) with the above updated STM ˜M(ΘS).

As a result, it leads to an alternative improvement cotraining process between the teacher M(ΘU) and the student ˜M(ΘS), which can more effectively recall class memberships thanks to the knowledge retained byM(ΘU).

In Algorithm 1, we concisely summarize the above MRA scheme. After MRA, the updated STM ˜M(ΘS) (in closedsource case) or ULM M(ΘU) (in open-source case) will serve as the RCM to predict the labels ˆ Yp of Xp.

5 Experiments

5.1 Experiment Setup

Data Preparation

In our experiments, four real datasets are used, which cover both low- and high-resolution data, providing a comprehensive evaluation. CIFAR-10 and CIFAR-100 [Krizhevsky et al., 2009] consist of 60,000 low-resolution images classified into 10 and 100 classes, respectively. Oxford-IIIT Pet (Pet37) [Parkhi et al., 2012] contains 7,349 high-resolution images of cats and dogs in 37 classes. In particular, Oxford 102 Flower (Flower-102) [Nilsback and Zisserman, 2008] has 8,189 high-resolution images in 102 classes, where each class consists of between 40 and 258 images.

As shown in Table 1, we use the official splits of the training dataset Dtr and the testing dataset Dts provided in the dataset package. For each dataset, five classes are selected to construct the forgetting dataset Df by randomly sampling 50% of data from Dtr, and the prediction dataset used for evaluation is constructed by mixing Dts and Df , i.e., Dp = Dts ∪Df to jointly assess the prediction and recovery capability of RCM.

Model Configuration

The proposed MRA framework is model-agnostic, so we use EfficientNet (EFN) [Tan and Le, 2019] on CIFAR datasets, ResNet [He et al., 2016] on Pet-37, and Swin-Transformer (Swin-T) [Liu et al., 2022] on Flower-102 for a comprehensive study. Moreover, in our framework, the STM does not necessarily have the same architecture as the ULM (Teacher Model). Therefore, we also evaluate the case of heterogeneous architectures on Flower-102, where the ULM is based on Swin-T while the STM is based on ResNet, as shown in Tables 2 and 3.

We use SGD optimizer for MU methods with a momentum of 0.9, a weight decay of 0.005, and AdamW for our MRA scheme. Other more detailed settings can be found in the online extended version. For each comparison model, we carefully tuned their hyperparameters to achieve optimal performance.

MU Methods for MRA Evaluation

In the experiments, a set of SOTA MU methods, including GA [Graves et al., 2021], RL [Golatkar et al., 2020], FF [Becker and Liebig, 2022], IU [Koh and Liang, 2017], BU [Chen et al., 2023], L1-SP [Jia et al., 2023], UNSC [Chen et al., 2024] and SalUn [Fan et al., 2024], are involved to comprehensively evaluate the recall capability of proposed MRA. In particular, UNSC does not support the Swin-T architecture, so the evaluation results on Flower-102 are not available.

5.2 MRA in The Closed-source Case

First, we evaluated the performance of MRA in the closedsource case, i.e., ULMs are used as a black-box service where the model parameters are not accessible.

Overall MRA Efficacy Analysis

Table 2 show the accuracy (Acc) of prediction dataset Dp in terms of its subsets Dts and Dts respectively. We compared the Acc of ULM and RCM over four datasets and diverse configurations of the MU model. From the point of view of this table, all of the Acc on Df of TRM are 1.000 after training, while they drop to low Acc after MU, illustrating that all selected MU methods can successfully mitigate the influence of Df from well-trained models. Furthermore, according to all the results of improvement (∆Acc) on both Df and Dts, we find that RCMs can unexceptionally improve the prediction accuracy on all datasets for all MU models, which overall proves that the proposed MRA is an effective and versatile model-agnostic framework to recover the class memberships of forgotten instances fromULMs.

More specifically, the improvement (∆Acc) of L1-SP is overall smaller than that of other MU methods on both Df and Dts. This can be attributed to the weight pruning on TRM, which makes the parameters of ULM significantly different from those of TRM. As a result, the knowledge distillation from ULM is prone to having higher label noise. In contrast, the improvement (∆Acc) of SalUn and UNSC is overall larger than that of other MUmethods. This is because most MU methods degrade the model performance after unlearning, known as "over-unlearning". In comparison, SalUn and UNSC, can precisely unlearn target forgetting samples without over-unlearning. As a result, SalUn and UNSC can provide less noisy pseudo labels for knowledge distillation, leading to better recall fromULMs.

According to the observation and analysis above, it reveals a phenomenon that "The MU methods in precise unlearning may lead to high success rate to recall the forgotten class memberships via MRA". As a result, MRA can serve as a valuable tool to assess the potential risk of privacy leakage for MU methods, thus facilitating the development of more robust MU models.

Demonstration of Class-specific Recovery Efficacy

To intuitively demonstrate the capacity of MRA to recall the forgotten class memberships on the prediction images Xf , we further conducted detailed evaluations with respect to each forgetting class. Figures 3 and 4 demonstrate the comparison of the Acc between ULM and RCM after MRA on CIFAR-10 and Pet-37 for each forgetting class. By checking the improvement of Acc for each class, we can observe a similar phenomenon as shown in Table 2. For example, the improvement of Acc for each class on L1-SP is relatively small due to over-unlearning. In comparison, the ULMvia SalUn can precisely unlearn the target forgetting images, that is, Xf , which leads to very low Acc for each forgetting class, whereas the improvement for each class after MRA is the most significant. That is, "precise forgetting, easy recalling".

5.3 MRA in The Open-source Case

In comparison to the closed-source case, the ULMs are released with their parameters in the open-source case. As a result, the ULMs can be updated during the MRA process.

Overall MRA Efficacy Analysis

For the open-source case, we can find that the improvement (∆Acc) of SalUn and UNSC is significant again due to the same reason presented above. Comparing Table 3 with Table 2, it is easy to find that the improvement of Acc in the open-source case method is significantly greater than that in the closed-source case. Especially, we find IU achieves the Lowest-2 improvement three times in the closed-source case but it achieves the Top-2 improvement three times in the open-source case. This is because the Confident Membership Recall step (cf. Algorithm 1) can effectively recall the knowledge retained by the ULM (as a noisy labeler) using confident pseudo-label samples. Then, the improved teacher model can distill less noisy knowledge to the STM. This alternative optimization process results in significant improvement.

Demonstration of Class-specific Recovery Efficacy

The analogy to the closed-source case, Figures 5 and 6 demonstrate the comparison of the Acc between ULM and RCM after MRA on CIFAR-10 and Pet-37 for each forgetting class in the open-source case. Compared to Figures 3 and 4, we can find that the gaps between different MU methods are much smaller in Figures 5 and 6. Especially, we can find the improvement of Acc on different MU methods after the MRA is close for each forgetting class in Figure 6. Even the over-unlearning models, the ULMs via IU and L1SP are effectively recalled their forgotten instances through the MRA process in terms of the balanced class membership recall strategy (cf. Section 4.3).

5.4 Ablation Study

In this section, we discuss the effectiveness of each key component in the implementation of the MRA framework. Since the MRA framework consists of two alternative learning steps, we will evaluate the following components.

DST: This component is the Denosing Knowledge Distillation step presented in Section 4.3, which aims to distill knowledge from noisy labeling teacherM(ΘU) to STM ˜M(ΘS).

STU: The component serves as the class membership recall process for STM, as presented in the Confident Membership Recall step. That is, DST+STU is equivalent to the closedsource case of MRA.

TCH: The component serves as the class membership recall process for teacher models, as presented in the Confident Membership Recall step. That is, DST+STU+TCH is equivalent to the open-source case of MRA.

Comparison Results

Table 4 reports the results of MRA on Pet-37, where the Acc on testing dataset Dts and forgetting dataset Df is reported. Additional results for ablation on other datasets can be found in the online extended version.

From the results, we can easily find that DST underperforms DST+STU and DST+STU+TCH. This is because the DST component only distills knowledge inferred from the prediction dataset Dp from the ULM to the student model, where the distilled knowledge inevitably contains label noise from the ULM. As a result, the Acc of DST is close to that of ULM. In comparison, DST+STU and DST+STU+TCH are based on the alternative learning process with both distillation and recall steps (cf. Algorithm 1). In the recall step, samples with high-confidence agreement are extracted, which can effectively recall forgotten class memberships. The model with all components, i.e., DST+STU+TCH, achieves the best performance because the additional TCH component can further

(c) DST+STU

(d) DST+STU+TCH

Figure 7: Confusion matrices with different configurations of MRA components, where C0 stands for all other classes except the forgetting ones. (a) demonstrates the confusion matrices after unlearning with different MU methods. Due to space limit, more cases can be found in the online extended version.

recall the knowledge retained by the ULM, as illustrated in Section 5.3.

Visualization of Confusion Matrices

Figure 7 (a-d) visualize the normalized confusion matrices on Df w.r.t. ULM, DST, DST+STU and DST+STU+TCH. From Figure 7 (a) ULM, we can observe the highlights in the first column of each subfigure, which illustrates that MU methods have successfully unlearned true class memberships of forgetting instances. From Figure 7 (b) to (c), the diagonals of confusion matrices w.r.t. DST, DST+STU and DST+STU+TCH become more and more noticeable, that is, more and more forgotten class memberships have been successfully recalled, which shows that each component plays an important role in the MRA framework.

6 Conclusion

This study is the first attempt to explore MRA against MU techniques to recall unlearned class memberships, highlighting vulnerabilities of MU in data privacy protections. By using ULMs as noisy labelers, our implementation of MRA can recall forgotten class memberships from the ULMs without the need for the original model. Extensive experiments on four real-world datasets show that the proposed MRA framework exhibits high efficacy in recovering forgotten class memberships carried out by various MU methods. In particular, it reveals the phenomenon that "The MU methods in precise unlearning may lead to high success rate to recall the forgotten class memberships via MRA". Consequently, the proposed MRA can serve as a valuable tool to assess the potential risk of privacy leakage for existing and new MU methods, thus gaining deeper insights into MU.

Acknowledgments

This work is partially supported by the National Natural Science Foundation of China (NSFC Granted No. 62276190).