Machine Unlearning

Abstract

Once users have shared their data online, it is generally difficult for them to revoke access and ask for the data to be deleted. Machine learning (ML) exacerbates this problem because any model trained with said data may have memorized it, putting users at risk of a successful privacy attack exposing their information. Yet, having models unlearn is notoriously difficult. After a data point is removed from a training set, one often resorts to entirely retraining downstream models from scratch.We introduce SISA training, a framework that decreases the number of model parameters affected by an unlearning request and caches intermediate outputs of the training algorithm to limit the number of model updates that need to be computed to have these parameters unlearn. This framework reduces the computational overhead associated with unlearning, even in the worst-case setting where unlearning requests are made uniformly across the training set. In some cases, we may have a prior on the distribution of unlearning requests that will be issued by users. We may take this prior into account to partition and order data accordingly and further decrease overhead from unlearning.Our evaluation spans two datasets from different application domains, with corresponding motivations for unlearning. Under no distributional assumptions, we observe that SISA training improves unlearning for the Purchase dataset by 3.13×, and 1.658× for the SVHN dataset, over retraining from scratch. We also validate how knowledge of the unlearning distribution provides further improvements in retraining time by simulating a scenario where we model unlearning requests that come from users of a commercial product that is available in countries with varying sensitivity to privacy. Our work contributes to practical data governance in machine learning.

A unified PAC-Bayesian framework for machine unlearning via information risk minimization

“…Important to our framework is the observation that the PAC-Bayesian bound (6), and hence also (7), hold uniformly over all choices of the learning algorithm P W |D . As such, one can optimize the right-hand side of (7) ove the learning algorithm P W |D by considering the problem min P W |D F IRM .…”

“…By minimizing an upper bound on the population loss, the learning criterion (7) facilitates generalization. This approach is known as Information Risk Minimization (IRM) [3], and it amounts to the minimization of a free energy criterion [10].…”

“…Several machine unlearning approaches have been studied since the introduction of the concept in [5], where the problem was studied in the context of statistical query learning. [7] proposes an unlearning approach that partitions the data set into shards that are used to train multiple models in isolation and finally aggregrated. This allows unlearning to be carried out by aggregating only the remaining shards, avoiding the need for retraining.…”

RETRONLU: Retrieval Augmented Task-Oriented Semantic Parsing

“…However, such implicit knowledge is hard to update, i.e. remove certain information (Bourtoule et al 2019), change or add new data and labels. Additionally, parametric knowledge may perform worse for less frequent facts, which don't appear often in the training set, and "hallucinate" responses.…”

EMA: Auditing Data Removal from Trained Models

“…Some investigate how training data can be memorized in model parameters or outputs [20,3] so as to show the importance of data removal. Others study data removal methods from trained models, especially those that does not require retraining the model [4,2]. However, independent of how data is removed, in order to meet the compliance of data privacy regulations, it is important, especially for healthcare applications such as medical imaging analysis, to have a robust data auditing process to verify if certain data are used in a trained model.…”