Source-linked AI summary
Machine Unlearning: Linear Filtration for Logit-based Classifiers
Thomas Baumhauer, Pascal Schöttle, Matthias Zeppelzauer
TL;DR
Machine unlearning asks how to remove the influence of deleted training data, motivated by privacy rights and model memorization. This paper studies class-wide deletion for logit-based classifiers and proposes computationally efficient linear filtration. Across experiments, normalization reduced classifier advantage for unlearned classes while preserving similar advantage for remaining classes.
Problem
Machine unlearning seeks to remove training-data influence from models, but efficient deletion is difficult because data can affect many parameters and models may expose memorized information.
Method
Linear filtration sanitizes logit-based classifiers by applying a linear transformation to predictions that can be absorbed into the classifier.
Results
Normalization decreased classifier advantage on unlearned classes in all three experiments and showed robustness to sample size for parameter estimation.
Takeaways & Limitations
Linear filtration provided adversarial benefits over naive deletion schemes in the paper’s class-wide unlearning setting.
Takeaways & Limitations
The approach remains limited by its shallowness because linear filtration can be absorbed only into the final layer for the considered hypothesis class.
Abstract
from arXiv · showhide
Recently enacted legislation grants individuals certain rights to decide in what fashion their personal data may be used, and in particular a "right to be forgotten". This poses a challenge to machine learning: how to proceed when an individual retracts permission to use data which has been part of the training process of a model? From this question emerges the field of machine unlearning, which could be broadly described as the investigation of how to "delete training data from models". Our work complements this direction of research for the specific setting of class-wide deletion requests for classification models (e.g. deep neural networks). As a first step, we propose linear filtration as a intuitive, computationally efficient sanitization method. Our experiments demonstrate benefits in an adversarial setting over naive deletion schemes.
I. INTRODUCTION
Machine unlearning addresses deletion requests for training data, but efficient removal is difficult because data can influence many model parameters. The paper studies class-wide deletion for logit-based classifiers and proposes linear filtration, evaluated adversarially.
- Motivation: Legal privacy rights motivate machine unlearning: removing training data so a model appears not to have seen it.Retraining without the deleted data is straightforward but may be computationally infeasible for large models.
- Motivation: Training data can be memorized by models, enabling privacy attacks such as model inversion.The paper links this concern to image classification and natural language processing applications.
- Problem: Efficient unlearning is difficult because many learning algorithms allow each training point to affect every model parameter.The paper therefore seeks alternatives to retraining from scratch.
- Setting: The paper assumes class-wide deletion requests in classifiers, such as cases where one individual owns all training data for a class.This setting differs from approaches focused on individual data points.
- Contribution: Linear filtration applies a linear transformation to logits and can be absorbed into the classifier, with computation requiring predictions on only a small number of data points per class.The method targets classifiers whose predictions are logits and is presented as a sanitization method against model inversion.
- Evaluation: The experiments evaluate unlearning adversarially by testing whether privacy attacks are prevented.The paper uses membership-inference-inspired evaluation and reports classifier-advantage results across MNIST, CIFAR-10, and AT&T Faces.
III. PROBLEM DEFINITION.
The paper formalizes class unlearning for classifiers that combine feature extraction with a linear logit layer and softmax outputs. It distinguishes strong parameter-distribution unlearning from weak black-box output-distribution unlearning.
- Classifier model: The considered hypothesis class decomposes classifiers into feature extraction, a linear transformation, and softmax.This includes deep neural networks with densely connected softmax output layers.
- Randomness: The learning algorithm may be nondeterministic, so the formal definitions compare distributions of random classifiers and outputs.The paper uses distributions over the relevant spaces rather than single deterministic results.
- Strong unlearning: Class unlearning removes a set of classes from the data and compares the transformed original classifier with a classifier trained on the remaining classes.The resulting hypothesis class has fewer output classes.
- Strong unlearning: Strong unlearning requires the transformed and retrained classifiers to have the same distribution over the hypothesis class.This is a parameter-space, or white-box, criterion.
- Weak unlearning: Weak unlearning requires matching distributions of logit outputs rather than matching model parameters.It is motivated by the difficulty of understanding internal neural-network representations and is treated as a black-box criterion.
- Relationship: If an operation satisfies strong unlearning, it also satisfies weak unlearning.The paper explicitly states this implication as Fact III.3.
IV. METHOD
The method proposes an intuitive weak unlearning operation for class deletion by exploiting the structure of the classifier hypothesis class.
- Method: The proposed weak unlearning operation exploits the special structure of classifiers in the considered hypothesis class.The paper states that experiments demonstrate satisfactory performance for neural networks.
A. Definition of weak unlearning operation Dz
The weak unlearning operation constructs a linear filtration that transforms logits after removing a class, then absorbs this transformation into the classifier weights. Different choices of the replacement vector z define naive, normalization, randomization, and zeroing variants.
- The filtration matrix F_z maps the expected predictions A to a target matrix B_z, defining the linear transformation used for unlearning.
- The new classifier h_z applies the transformed weights W_z to the original feature representation f(x).
- The operation D_z replaces W with W_z = F_zW, allowing the filter to be absorbed into the classifier and the original model to be deleted.
- Naive unlearning sets z = π(a_0), effectively cutting the output unit associated with the deleted class and providing the baseline.
- For CIFAR-10 airplane deletion, normalization aligns with retrained-model distributions, while randomization does not.
- Normalization shifts π(a_0) so its mean matches the mean of the remaining rows of B_z, whereas randomization samples z from N(0, I_{k−1}) and zeroing sets z = 0.
B. Computational Complexity of Dz
Computing D_z is dominated by estimating class-wise mean predictions; the remaining matrix operations are negligible, and the method remains inexpensive for concurrent deletion requests.
- Estimating A accounts for most computational cost, while inverting A, computing F_z, and multiplying by W are negligible.
- When A is estimated from ℓ samples per class, finding D_z(h) costs ℓ·k times one prediction of h.
- The method is robust to estimation quality, so only a small number of sample points per class is sufficient.
- Concurrent deletion requests incur virtually the same filtration cost, with only negligible additional computation for each new replacement vector.
V. EXPERIMENTS
The experiments evaluate unlearning by testing whether a binary classifier can distinguish predictions from models that saw a deleted class from predictions of models retrained without it. Lower classifier advantage indicates more similar distributions.
- The evaluation compares prediction distributions P(L_seen) and P(L_¬seen) using binary classifiers trained on model outputs.
- Classifier advantage α_b measures how well a binary classifier distinguishes the two distributions, relative to random guessing.
- A Bayes-optimal advantage α_b* near 0 indicates that the seen and not-seen prediction distributions are similar.
- The experiments use 100 models trained on full data and 100 models trained with the deleted class removed, then apply unlearning to the full-data models.
- The empirical setup uses 70 models from each category for training and 30 from each category for testing, with separate classifiers trained for each class.
- Unlike standard membership inference, the attack classifier is intended to fail at identifying whether a model has seen the deleted class.
B. Data
The experiments use MNIST, CIFAR-10, and the AT&T Faces database, covering handwritten digits, natural images, and face images across class-based datasets.
- MNIST contains 70,000 28×28 handwritten-digit images in 10 classes, split into 60,000 training and 10,000 test images.
- CIFAR-10 contains 60,000 32×32×3 images in 10 classes, split into 50,000 training and 10,000 test images.
- AT&T Faces contains 400 92×112 images of 40 subjects, with 10 images per subject.
C. Network Architectures
The experiments evaluate linear-filtration unlearning across MLP, CNN, and residual-network architectures, using classifier advantage and label changes to compare methods. Normalization consistently reduced advantage for unlearned classes without negatively affecting classification accuracy.
- Network architectures: The experiments use an MLP on MNIST, CNNs on CIFAR-10, and residual networks on AT&T faces.The CIFAR-10 CNNs vary the fully connected layer size p, while the AT&T model uses a residual architecture.
- Unlearning targets: The evaluation unlearns one class on MNIST and CIFAR-10, and four individuals on AT&T faces.The remaining classes serve as a comparison for collateral effects.
- Classifier-advantage results: Normalization significantly decreases classifier advantage for the unlearned class on MNIST and CIFAR-10, and slightly decreases it for AT&T faces.Randomization and zeroing do not provide the same benefit in the CIFAR-10 experiment.
- Robustness: Normalization remains effective across sample sizes and fully connected-layer widths, although advantage for remaining classes can slightly increase with p.With 100 samples per class, performance is comparable to estimation using the full test data.
- Classification accuracy: Normalization did not change any predicted labels relative to naive unlearning, including correct labels on remaining classes.This result is reported for the CIFAR-10 CNNs with p = 256.
E. Model inversion
The model-inversion experiment uses gradient ascent to reconstruct recognizable inputs from face-recognition models. Normalization greatly disrupts reconstructions for the unlearned class while barely affecting remaining classes, though the phenomenon is left for further investigation.
- Attack setup: The model-inversion attack performs gradient ascent on the input space of an AT&T Faces neural network.The network has fully connected layers with 1000 and 300 sigmoid units followed by a softmax output layer.
- Results: Naive unlearning barely affects reconstruction quality, whereas normalization greatly disturbs reconstruction of the unlearned class.Normalization barely affects reconstructions for the remaining classes.
- Interpretation: The authors interpret the visual result as evidence that normalization affects the model’s input-output correlation, but defer detailed investigation.The passage presents this as visual evidence rather than a complete analysis.
F. Random direction KolmogorovSmirnov statistics
The paper evaluates unlearning with the KSΦ statistic, comparing naive unlearning, normalizing filtration, and an independent-training baseline. Normalizing filtration lowers the statistic for the unlearned class while leaving remaining classes unchanged.
- Statistic: The KSΦ statistic compares distributions using random unit-vector projections, with φ·S denoting projected samples.The statistic uses the two-sample Kolmogorov–Smirnov statistic.
- Experimental comparison: The experiments compare naive unlearning with normalizing filtration on CIFAR-10 CNNs and MNIST MLPs.They also report a baseline from independent batches of models trained without the unlearned class.
- Results: Normalizing filtration decreases KSΦ for the unlearned class in both experiments while leaving the statistic unchanged for remaining classes.Performance is somewhat better in the CIFAR-10 experiment.
- Interpretation: The paper’s broader weak-unlearning definition is black-box and is applicable only when the operation is interpreted in good faith.A malicious construction can hide a separately trained model behind unchanged internal content.
- Scope: The conclusion identifies shallow absorption into the classifier’s final layer as a limitation of the approach.The authors suggest deeper absorption as a direction for stronger privacy guarantees.
APPENDIX
The appendix provides expanded experimental table descriptions for MNIST MLPs and CIFAR-10 CNNs, covering accuracy, cross-entropy loss, and classifier advantage.
- MNIST: The appendix includes accuracy and cross-entropy loss tables for 100 MLPs trained on MNIST.Values are reported as mean ± standard deviation.
- MNIST: It reports classifier advantage for one unlearned and nine remaining MNIST classes.The table concerns MLPs trained on MNIST.
- CIFAR-10: It reports classifier advantage for one unlearned and nine remaining CIFAR-10 classes.The table concerns CNNs trained on CIFAR-10.
- Experimental parameters: The CIFAR-10 table descriptions define p as fully connected-layer dimension and s as the per-class sample size used to estimate mean predictions.These parameters are specified for the classifier-advantage and accuracy/loss tables.